MFA fix, added IP blacklist, update webmail client

internal/smtpserver/mailbox_rules_test.go

@@ -34,9 +34,13 @@ func TestBlockedSenderRejectedAtRcpt(t *testing.T) {
 	}
 }
 
-func TestAllowListBypassesSpamRejection(t *testing.T) {
+// TestAllowListBypassesSpamQuarantine confirms a zero reject threshold quarantines a
+// non-allow-listed sender's mail into Spam (still accepted at SMTP level — spam is
+// stored for review, not silently bounced), while an allow-listed sender's mail
+// skips scoring entirely and lands in INBOX as normal.
+func TestAllowListBypassesSpamQuarantine(t *testing.T) {
 	backend, mailboxID := newTestBackendWithMailbox(t)
-	// Force every non-allow-listed message to be rejected as spam.
+	// Force every non-allow-listed message to be quarantined as spam.
 	backend.Cfg.Section("Mailstore").Key("spam_reject_score").SetValue("0")
 
 	send := func(t *testing.T) error {
@@ -63,8 +67,12 @@ func TestAllowListBypassesSpamRejection(t *testing.T) {
 		return w.Close()
 	}
 
-	if err := send(t); err == nil {
-		t.Fatal("expected delivery to fail as spam with a zero reject threshold and no allow-list entry")
+	if err := send(t); err != nil {
+		t.Fatalf("expected delivery accepted (quarantined) with a zero reject threshold and no allow-list entry, got: %v", err)
+	}
+	spamMsgs, err := backend.DB.ListMessagesInFolder(mailboxID, "Spam")
+	if err != nil || len(spamMsgs) != 1 {
+		t.Fatalf("expected 1 quarantined message in Spam, got %d (err=%v)", len(spamMsgs), err)
 	}
 
 	if _, err := backend.DB.AddAllowBlockEntry(mailboxID, "allow", "test@example.com"); err != nil {
@@ -73,6 +81,10 @@ func TestAllowListBypassesSpamRejection(t *testing.T) {
 	if err := send(t); err != nil {
 		t.Fatalf("expected delivery to succeed once the sender is allow-listed, got: %v", err)
 	}
+	inboxMsgs, err := backend.DB.ListMessagesInFolder(mailboxID, "INBOX")
+	if err != nil || len(inboxMsgs) != 1 {
+		t.Fatalf("expected 1 message in INBOX once allow-listed (spam scoring skipped), got %d (err=%v)", len(inboxMsgs), err)
+	}
 }
 
 func TestFilterRuleDeleteDropsMessage(t *testing.T) {