MFA fix, added IP blacklist, update webmail client

internal/imapserver/session.go

@@ -9,6 +9,7 @@ import (
 	"github.com/emersion/go-imap/v2"
 	goimapserver "github.com/emersion/go-imap/v2/imapserver"
 
+	"mailgoserver/internal/abuseguard"
 	"mailgoserver/internal/db"
 )
 
@@ -24,6 +25,7 @@ var _ goimapserver.Session = (*Session)(nil)
 // just not an instant push. Add a tracker if that matters.
 type Session struct {
 	backend        *Backend
+	peerIP         string
 	mailbox        *db.Mailbox // set once Login succeeds
 	selectedFolder string      // set by Select; defaults to INBOX if empty
 }
@@ -35,11 +37,16 @@ func (s *Session) Close() error { return nil }
 func (s *Session) Login(username, password string) error {
 	mbox, err := s.backend.DB.VerifyMailboxAppPassword(username, password)
 	if err != nil {
+		_ = s.backend.DB.LogAuthAttempt("imap_login", username, s.peerIP, false, "Authentication error: "+err.Error())
+		abuseguard.RecordFailureAndMaybeBlacklist(s.backend.DB, s.backend.Cfg, s.backend.Logger, s.peerIP)
 		return err
 	}
 	if mbox == nil {
+		_ = s.backend.DB.LogAuthAttempt("imap_login", username, s.peerIP, false, "Invalid credentials")
+		abuseguard.RecordFailureAndMaybeBlacklist(s.backend.DB, s.backend.Cfg, s.backend.Logger, s.peerIP)
 		return goimapserver.ErrAuthFailed
 	}
+	_ = s.backend.DB.LogAuthAttempt("imap_login", username, s.peerIP, true, "Successful IMAP app-password authentication")
 	s.mailbox = mbox
 	return nil
 }