Local parts are ASCII-folded — never str.lower(), which maps U+212A onto "k"
and would resolve a look-alike to someone else's mailbox — for everything we
own or resolve: mailbox lookup, login identity, inbound recipients. Domains
are IDNA-canonicalized. Addresses we merely carry, in contacts and MIME
headers, keep the case they were typed or received in. core.mda.addresses is
the single policy, held in place by a pylint checker and an eslint rule that
ban hand-rolled '@' splits and Unicode case folding.
Migration 0035 folds existing rows and reports the collisions it will not
merge on its own. Also drops mta-out, and adds dual RSA+ECDSA certificates,
per-refusal logging and an mta_session correlation claim to mta-in.
Removed the direct access grant on the rest-api client in the dev
realm.json
Repair make test-keycloak, which could not run against a freshly
imported realm. The fixtures need more rights than the rest-api service
account holds, so they now use the bootstrap admin service account. The
bootstrap admin user cannot serve here, because it has an empty profile
and Keycloak refuses the password grant.
Grant view-realm to the service account. set_realm_role reads a realm
role by id, which fails with 403 without that role.
Add a setup guide for the authentication provider and one for the
identity provider. Document the required client shape in env.md.
Notably, we try to reduce disk usage by standardizind on common
base Docker images. We also improve node_modules by reducing
duplicate dependencies and install speed.
This large PR modernizes the backend of the app:
- Python Dependency Management: Poetry → uv
- Object Storage for local dev: MinIO (now unmaintained) → RustFS
- Makefile Target Standardization to align with other LaSuite repos
- Internationalization Removal on backend: we only care about i18n on the frontend
- Backend dependencies upgrade
* ✨(dns) add admin page for DNS records. Fixes#177
* 👷(dockerflow) add a flag to disable Dockerflow
* 💚(ghactions) fix check-api-update that was missing Orval
* 💚(ci) fix tests that depended on Keycloak
* ♻️(admin) refactor CopyableInput into a separate component
* 🎨(dns) improve code style
We are going to release a 0.1 version soon, along with our first production deployment. Starting from there, migrations and a consistent developer experience will be officially supported. To make that easier, this large patch cleans up several areas:
* Reset migrations one last time
* Update models for storage efficiency (move textchoices to integerchoices on high-volume tables)
* Use Blobs for mail mime data and draft bodies. Having them in a separate PG table is a first step, we will later start offloading them to object storage.
* Add default ZSTD compression to blobs
* Add per-domain DKIM Keys
* Add DNS check and provisioning, with a first Scaleway provider
* Fix Keycloak user provisioning
* Fix Attachment storage, they are now stored individually only at the drafting stage. Afterwards they are extracted from the main blob. This may be optimized later but at least we only store once. For JMAP compatibility, this requires using fake IDs in the blob API route.
* Add a management command and recurring task to retry unsent messages
* Improve the local developer experience with new ports and make commands
* Repackage MTA-in and MTA-out to be closer to Backend: Poetry, multi-step Dockerfile, move compose and makefile to the root
* Migrate to OpenSearch
* Improve overall documentation and add a self-hosting page
Contributes to #177 and #185
