MFA fix, added IP blacklist, update webmail client

internal/mailstore/rules.go

@@ -1,6 +1,10 @@
 package mailstore
 
-import "strings"
+import (
+	"strings"
+
+	"mailgoserver/internal/db"
+)
 
 // FilterAction is the outcome of evaluating a mailbox's filter rules against one
 // incoming message.
@@ -24,12 +28,17 @@ func (s *Store) ApplyRules(mailboxID int64, headers map[string]string) (FilterAc
 		if !r.IsActive {
 			continue
 		}
-		if !matchCondition(r.ConditionOp, headers[r.ConditionField], r.ConditionValue) {
+		if !ruleMatches(r, headers) {
 			continue
 		}
 		switch r.Action {
 		case "move_to_folder":
 			return FilterAction{Folder: r.ActionValue}, nil
+		case "mark_as_spam":
+			// Reuses the same Spam folder score-based quarantine already delivers
+			// into (see smtpserver/session.go) — from the mailbox owner's
+			// perspective it's the same "goes to Spam" outcome either way.
+			return FilterAction{Folder: "Spam"}, nil
 		case "delete":
 			return FilterAction{Drop: true}, nil
 		case "mark_read":
@@ -39,6 +48,26 @@ func (s *Store) ApplyRules(mailboxID int64, headers map[string]string) (FilterAc
 	return FilterAction{}, nil
 }
 
+// ruleMatches combines a rule's conditions per its match type: "all" requires every
+// condition to match (AND), "any" requires at least one (OR).
+func ruleMatches(r db.MailboxFilterRule, headers map[string]string) bool {
+	conditions, matchType := r.Conditions()
+	if matchType == "any" {
+		for _, c := range conditions {
+			if matchCondition(c.Op, headers[c.Field], c.Value) {
+				return true
+			}
+		}
+		return false
+	}
+	for _, c := range conditions {
+		if !matchCondition(c.Op, headers[c.Field], c.Value) {
+			return false
+		}
+	}
+	return true
+}
+
 func matchCondition(op, value, target string) bool {
 	value = strings.ToLower(value)
 	target = strings.ToLower(target)