added IMAP, LetsEncrypt, update layout

internal/smtpserver/auth.go

@@ -66,6 +66,11 @@ func (s *Session) Auth(mech string) (sasl.Server, error) {
 // AuthLog row either way, and on any failure returns a *smtp.SMTPError carrying the
 // exact Python response code/message, arming the connection to close right after that
 // response is flushed — mirroring CustomSMTP.smtp_AUTH's transport.close() override.
+//
+// Two independent identity types can authenticate here: a Sender (relay-only, tried
+// first — unchanged from the original behavior), or a mailbox's app password (never
+// its portal password — see esrv_mailbox_app_passwords), which lets a mailbox owner
+// send mail as their own primary address or a send-as-enabled alias.
 func (s *Session) authenticate(username, password string) error {
 	sender, err := s.backend.DB.GetSenderByEmail(username)
 	if err != nil {
@@ -73,16 +78,32 @@ func (s *Session) authenticate(username, password string) error {
 		_ = s.backend.DB.LogAuthAttempt("sender", username, s.peerIP, false, fmt.Sprintf("Authentication error: %v", err))
 		return s.failAuth(451, "Internal server error")
 	}
-	if sender == nil || !db.CheckPassword(password, sender.PasswordHash) {
-		_ = s.backend.DB.LogAuthAttempt("sender", username, s.peerIP, false, fmt.Sprintf("Invalid credentials for %s", username))
-		return s.failAuth(535, "Authentication failed")
+	if sender != nil && db.CheckPassword(password, sender.PasswordHash) {
+		s.authenticatedSender = sender
+		s.authType = "sender"
+		s.username = username
+		_ = s.backend.DB.LogAuthAttempt("sender", username, s.peerIP, true, "Successful sender authentication")
+		return nil
 	}
 
-	s.authenticatedSender = sender
-	s.authType = "sender"
-	s.username = username
-	_ = s.backend.DB.LogAuthAttempt("sender", username, s.peerIP, true, "Successful sender authentication")
-	return nil
+	if s.backend.Mailstore != nil {
+		mbox, merr := s.backend.DB.VerifyMailboxAppPassword(username, password)
+		if merr != nil {
+			s.backend.Logger.Error("Mailbox authentication error: %v", merr)
+			_ = s.backend.DB.LogAuthAttempt("mailbox", username, s.peerIP, false, fmt.Sprintf("Authentication error: %v", merr))
+			return s.failAuth(451, "Internal server error")
+		}
+		if mbox != nil {
+			s.authenticatedMailbox = mbox
+			s.authType = "mailbox"
+			s.username = username
+			_ = s.backend.DB.LogAuthAttempt("mailbox", username, s.peerIP, true, "Successful mailbox app-password authentication")
+			return nil
+		}
+	}
+
+	_ = s.backend.DB.LogAuthAttempt("sender", username, s.peerIP, false, fmt.Sprintf("Invalid credentials for %s", username))
+	return s.failAuth(535, "Authentication failed")
 }
 
 // failAuth builds the SMTPError for a failed AUTH attempt and closes the connection