add MFA, user web mail portal

internal/webui/webmail_auth.go

@@ -92,3 +92,29 @@ func (a *App) requireMailboxAuth(next http.Handler) http.Handler {
 		next.ServeHTTP(w, r.WithContext(ctx))
 	})
 }
+
+// mailboxNeedsMFASetup reports whether [Auth] enforce_mailbox_mfa applies to this
+// mailbox and it doesn't have a second factor configured yet — false if enforcement
+// is off, MFA is already set up, or the mailbox/its domain is explicitly exempt.
+// Used at webmail login time (see webmailLoginSubmit) to block the login outright,
+// not any specific action once logged in — app passwords (creating or using them)
+// are never gated by this, since IMAP/SMTP AUTH has no interactive MFA step to
+// enforce one on regardless.
+func (a *App) mailboxNeedsMFASetup(mbox *db.Mailbox) bool {
+	if !a.Cfg.Section("Auth").Key("enforce_mailbox_mfa").MustBool(false) {
+		return false
+	}
+	hasMFA := mbox.TOTPEnabled
+	if !hasMFA {
+		if n, _ := a.DB.CountMailboxWebAuthnCredentials(mbox.ID); n > 0 {
+			hasMFA = true
+		}
+	}
+	if hasMFA || mbox.MFAExempt {
+		return false
+	}
+	if dom, err := a.DB.GetDomainByID(mbox.DomainID); err == nil && dom != nil && dom.MFAExempt {
+		return false
+	}
+	return true
+}