MFA fix, added IP blacklist, update webmail client

internal/webui/security_headers_test.go

@@ -0,0 +1,35 @@
+package webui
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// TestSecurityHeadersSetOnEveryResponse confirms the hardening headers are present
+// regardless of which underlying handler produced the response — admin, webmail, or
+// anything else, since main.go wraps the whole app's handler once with this rather
+// than per-route.
+func TestSecurityHeadersSetOnEveryResponse(t *testing.T) {
+	inner := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) })
+	handler := SecurityHeaders(inner)
+
+	req := httptest.NewRequest(http.MethodGet, "/anything", nil)
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	cases := map[string]string{
+		"X-Content-Type-Options":  "nosniff",
+		"X-Frame-Options":         "SAMEORIGIN",
+		"Referrer-Policy":         "same-origin",
+		"Content-Security-Policy": contentSecurityPolicy,
+	}
+	for header, want := range cases {
+		if got := rec.Header().Get(header); got != want {
+			t.Errorf("header %s = %q, want %q", header, got, want)
+		}
+	}
+	if rec.Header().Get("Permissions-Policy") == "" {
+		t.Error("expected a Permissions-Policy header")
+	}
+}