add MFA, user web mail portal

internal/webui/mailboxes.go

@@ -129,6 +129,23 @@ func (a *App) mailboxWithAccess(w http.ResponseWriter, r *http.Request) (mailbox
 	return mailbox, true
 }
 
+// resetMailboxMFA clears a mailbox owner's TOTP and passkeys — e.g. after a lost
+// device, or (under enforce_mailbox_mfa) to unblock their webmail login without
+// needing a domain/mailbox exemption — so they can sign back in and, if MFA is
+// enforced, re-enroll from the webmail portal on their next login.
+func (a *App) resetMailboxMFA(w http.ResponseWriter, r *http.Request) {
+	mailbox, ok := a.mailboxWithAccess(w, r)
+	if !ok {
+		return
+	}
+	if err := a.DB.ResetMailboxMFA(mailbox.ID); err != nil {
+		setFlash(w, "error", "Error resetting MFA")
+	} else {
+		setFlash(w, "success", "MFA reset for "+mailbox.Email)
+	}
+	http.Redirect(w, r, Prefix+"/mailboxes", http.StatusFound)
+}
+
 func (a *App) disableMailbox(w http.ResponseWriter, r *http.Request) {
 	mailbox, ok := a.mailboxWithAccess(w, r)
 	if !ok {
@@ -226,6 +243,11 @@ func (a *App) editMailbox(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 	}
+	if err := a.DB.SetMailboxMFAExempt(mailbox.ID, r.FormValue("mfa_exempt") == "on"); err != nil {
+		setFlash(w, "error", "Error updating mailbox")
+		http.Redirect(w, r, Prefix+"/mailboxes", http.StatusFound)
+		return
+	}
 	setFlash(w, "success", "Mailbox updated successfully")
 	http.Redirect(w, r, Prefix+"/mailboxes", http.StatusFound)
 }