MFA fix, added IP blacklist, update webmail client

internal/webui/logs.go

@@ -42,6 +42,11 @@ func (a *App) logs(w http.ResponseWriter, r *http.Request) {
 		page = 1
 	}
 	offset := (page - 1) * perPage
+	// Read once here (not just inside the "auth" case) so every branch's M literal
+	// can set it unconditionally — logs.html's pagination links reference it regardless
+	// of filter_type, and a map[string]any with the key entirely absent renders
+	// inconsistently across template functions versus one that's always present as "".
+	authCategory := r.URL.Query().Get("auth_category")
 
 	switch filterType {
 	case "emails":
@@ -58,7 +63,8 @@ func (a *App) logs(w http.ResponseWriter, r *http.Request) {
 		recipientMap, attachMap := a.buildLogMaps(emails)
 		a.render(w, r, "logs.html", M{
 			"active": "logs", "logs": emails, "filter_type": filterType, "page": page,
-			"has_next": len(fetched) == perPage, "has_prev": page > 1,
+			"auth_category": authCategory,
+			"has_next":      len(fetched) == perPage, "has_prev": page > 1,
 			"recipient_logs_map": recipientMap, "attachments_map": attachMap,
 		})
 	case "auth":
@@ -68,13 +74,14 @@ func (a *App) logs(w http.ResponseWriter, r *http.Request) {
 		}
 		var auths []db.AuthLog
 		for _, au := range fetched {
-			if authAllowed(au) {
+			if authAllowed(au) && authCategoryMatches(au.AuthType, authCategory) {
 				auths = append(auths, au)
 			}
 		}
 		a.render(w, r, "logs.html", M{
 			"active": "logs", "logs": auths, "filter_type": filterType, "page": page,
-			"has_next": len(fetched) == perPage, "has_prev": page > 1,
+			"auth_category": authCategory,
+			"has_next":      len(fetched) == perPage, "has_prev": page > 1,
 		})
 	default:
 		half := perPage / 2
@@ -109,11 +116,35 @@ func (a *App) logs(w http.ResponseWriter, r *http.Request) {
 		}
 		a.render(w, r, "logs.html", M{
 			"active": "logs", "logs": logs, "filter_type": filterType, "page": page,
-			"has_next": len(logs) > perPage, "has_prev": page > 1,
+			"auth_category": authCategory,
+			"has_next":      len(logs) > perPage, "has_prev": page > 1,
 		})
 	}
 }
 
+// authCategoryMatches buckets esrv_auth_logs.auth_type values into "admin" (dashboard
+// login/MFA), "webmail" (mailbox portal login/MFA), or "mailserver" (SMTP/IMAP — the
+// same set abuseguard counts, see crud_ip_blacklist.go's smtpImapAuthTypesSQL). An
+// empty category matches everything (no filter applied).
+func authCategoryMatches(authType, category string) bool {
+	switch category {
+	case "", "all":
+		return true
+	case "admin":
+		return authType == "admin_login" || authType == "admin_mfa"
+	case "webmail":
+		return authType == "webmail_login" || authType == "mailbox_mfa"
+	case "mailserver":
+		switch authType {
+		case "sender", "mailbox", "sender_validation", "mailbox_validation", "ip", "imap_login":
+			return true
+		}
+		return false
+	default:
+		return true
+	}
+}
+
 func (a *App) buildLogMaps(emails []db.EmailLog) (map[int64][]db.EmailRecipientLog, map[int64][]db.EmailAttachment) {
 	recipientMap := map[int64][]db.EmailRecipientLog{}
 	attachMap := map[int64][]db.EmailAttachment{}