Latest fixes in the stdlib make it a more solid alternative for strict composition than Flanker. We keep Flanker for now for lenient inbound parsing. We add stronger tests and fuzzing to validate we didn't regress.
Add `NEXT_PUBLIC_FEEDBACK_WIDGET_HOME_CHANNEL` env var to be able to
set a specific channel id to receive feedback from unauthenticated
users.
For configuration ease and backward compatibility, if
`NEXT_PUBLIC_FEEDBACK_WIDGET_HOME_CHANNEL` is not set, the home feedback
widget fallback to `NEXT_PUBLIC_FEEDBACK_WIDGET_CHANNEL`.
A spoofed inbound with From == To was being marked is_sender=True via
the
`sender_email == recipient_email` shortcut in
_create_message_from_inbound.
Because MessageRecipient rows from the inbound path carry no
delivery_status, those messages matched retry_messages_task's
(is_sender=True AND delivery_status IN (RETRY, NULL)) filter and went
through send_message on every 5-min beat — DKIM-signing and re-emitting
the spam to every recipient on the envelope, externals included.
Legitimate self-sends are unaffected: send_message's internal redelivery
hits the mime_id dedup in deliver_inbound_message before reaching
_create_message_from_inbound, so the shortcut was already dead code on
the legitimate path.
The new widget loader consume `window._lasuite_widget` property to
know which widget to load. The previous version was using
`window._stmsg_header`. We refactor widget loading logic to support
both version with ease.
The new widget loader consume `window._lasuite_widget` property to
know which widget to load. The previous version was using
`window._stmsg_header`.
/!\ Update NEXT_PUBLIC_LAGAUFRE_WIDGET_PATH and
NEXT_PUBLIC_FEEDBACK_WIDGET_PATH
to target the new widget version before deploying this commit.
Add an option `--from-date` to the `search_reindex` management command.
In this way, in case of index task failure, we are able to reindex only
resources updated in a recent timeframe.
OpenSearch was returning 503/429 on delete_by_query under the load of
the periodic reindex. Each bulk_reindex_threads_task could fire up to
100 delete_by_query calls (one per chunk of 100 threads) to sweep
orphan messages, and bulk_delete_threads_task did one more to drop a
thread and all its children. delete_by_query holds a scroll context,
scans the index and refreshes per call — far heavier than the bulk
upserts running alongside it.
Tracking message deletes explicitly at signal time lets us replace
every hot-path delete_by_query with a bulk delete by _id:
- New search:pending_delete_messages set storing thread_id:message_id
pairs, fed by Message.post_delete (covers cascaded deletes too).
- New bulk_delete_messages_task issuing bulk DELETE actions with the
parent thread_id as routing.
- bulk_delete_threads_task rewritten to bulk DELETE thread parent docs
by _id; child message docs ride the new task via cascaded signals.
- _purge_orphan_docs and the per-chunk purge in reindex_bulk_threads
removed; reindex is now pure upsert.
Currently, we retry indexing task only on ConnectionError (socket-level)
but some error at http-level are also relevant to a retry.
So now we filter TransportError by status code: retryable (5xx + 429)
propagate so `bulk_reindex_threads_task` can autoretry with the existing
exponential backoff, 4xx stay swallowed since retrying caller bugs only
burns worker time.
Currently, when user has not its language set into local storage, we
retrieve
the default language through the navigator language. In some instance,
we would
like to enforce the default language. So we add a new env var
`NEXT_PUBLIC_FORCED_DEFAULT_LANGUAGE`, if this one is set to `true`, we
skip
the navigator.language and use the `NEXT_PUBLIC_DEFAULT_LANGUAGE` as
default
`bulk_data` method was missing some options (timeout, max_retries) so
sometimes when
the payload was heavy, the request can failed because the timeout was
too slow by default
(10s) and there is no `max_retries`. Furthermore, we build bulk payload
by chunking thread
but it did not check the payload bytes size, so in case of heavy
message, the payload could
be heavy. Now a max_bytes limit is set (50 Mib by default)
Opensearch index is updated each time a Thread, Message or MessageRecipient
is updated through signals. The current logic has performance issues has
n update of a resource will generate n celery task to update the same
resource... So this work aims to batch updates. Index is updated each
30s and resource ids is deduplicated to only update a resource once.
Furthermore, in an import context, the index will be updated only
when the import will be completed to prevent to spam the celery
worker with numerous indexation task.
As a follow-up of the mention feature, we build upon ThreadEvent & UserEvent
models a feature to assign users to a thread.
We allow to filter mailboxe's inbox through assignation state (assigned to me, unassigned).
The thread share modal has been forked from ui-kit to be able to list users of each
mailbox and add a cta to assign them to the thread. A section above shows assigned users.
Currently, the logic to show/hide thread-event-input was only processed
into a scroll handler and by default the thread-event-input was hiddden.
So in thread view with only few messages, we expect to display the
thread
event input, but it is not. Now we call the near bottom check at mount
to
display the input if it is relevant when a thread is opened.
Added sender authentication checks (DKIM/DMARC) with multiple modes (native, rspamd, authentication-results). Message UI now shows a clear error banner for forged senders and a warning for unverified senders; contact chips display a forged state.
The popup hosted the modal and portalled into document.body. Because
#__next establishes an isolated stacking context while body does not,
the popup sat on a higher paint layer than anything inside #__next
regardless of z-index, making the modal appear behind it and letting
the popup's overlay steal clicks and Escape from it.
Lift modal ownership and label mutations to LabelsWidget so the modal
renders as a sibling of the popup, portal the popup into #__next so
both share a stacking context, mark the popup aria-modal, and expose
closeOnEsc so the parent can silence the popup's Escape while a modal
is stacked above. thread-selection now defers Escape to any open
dialog so the popup owning Escape no longer exits selection mode.
The select_for_update() was ineffective for two reasons:
- .exclude(id=instance.id) caused each concurrent thread to lock
a disjoint set of rows, so no serialization occurred
- .count()/.exists() generate aggregate SQL (SELECT COUNT(*))
that silently drops the FOR UPDATE clause in Django ORM
Now locks ALL editor rows (including self) via values_list()
evaluation, forcing concurrent deletes to serialize properly.
Currently the ThreadEventInput is always showed and sticked to the
bottom of the screen. But it can be annoying when the user is writing a
message for example as the input is displayed above the message reply
form. Then it is not relevant to show the input when the user is at the
top of the thread view. So we only show the input when the user reach
the end of the view.
When a Celery worker crashes (e.g. OOM during large imports), the task
result contains a raw exception object (WorkerLostError) that is not
JSON-serializable, causing a 500 on the task status endpoint. The
frontend polling hooks never received a FAILURE status and kept polling
indefinitely.
Backend: convert exception objects in task results to serializable
strings instead of letting DRF fail on serialization.
Frontend: stop polling on API errors and surface the failure state to
consumers so they can display appropriate error UI immediately.
Writing an internal comment is a personal authoring act that should
not require thread edit rights: support teammates invited as thread
viewers must still be able to comment and mention colleagues, as long
as they have edit rights on the mailbox. ThreadEvent IM writes and
ThreadUser listing are relaxed accordingly, while every other thread
mutation keeps the full edit-rights check.
The message composer is now gated by the thread edit ability so that
read-only users cannot bypass the check through reply or forward, and
the thread-panel selection separator is hidden when no bulk action is
available. A few unrelated UI polish fixes (disabled link button
style, combobox placeholder visibility) ship alongside.
Previously the settings dropdown could open an empty menu when
the selected mailbox granted none of the required abilities, leaving
users to think the button was broken. The menu is now rendered as a
disabled button with an explanatory tooltip so the UI stays stable
across mailbox switches and the reason is surfaced to the user.
Dragging threads onto a label now assigns the label and archive by default.
Holding Shift while dropping only assign the label to the threads, mimicking
Gmail's "move" behavior. A custom drag preview follows the cursor
and updates in real-time to reflect the current action.
A new BulkLabelsWidget in the thread selection toolbar lets users
assign labels to multiple threads at once.
The existing LabelsPopup was refactored to support
multi-thread selection with indeterminate checkbox states.
Resolve#396
A user with VIEWER MailboxAccess on a shared mailbox could still mutate
threads that the mailbox had EDITOR ThreadAccess to: the permission
check only looked at ThreadAccess.role, never at MailboxAccess.role.
Both roles must now be satisfied (EDITOR on ThreadAccess AND a role in
MAILBOX_ROLES_CAN_EDIT on MailboxAccess) for archive, spam, trash,
label, split, refresh_summary and thread-event writes. Personal actions
(unread, starred) intentionally stay open to any mailbox access since
they only mutate the caller's own ThreadAccess row.
The rule is centralised in ThreadAccessQuerySet.editable_by(user,
mailbox_id) so viewsets and permission classes share a single source of
truth, and exposed to the frontend via a new Thread.abilities.edit
field consumed by use-ability, which gates the matching UI controls.
- Optional outgoing SPF validation that can block or mark external deliveries when sender SPF fails.
- SPF cache invalidation so DNS rechecks are used immediately after DNS validation.
- More robust SPF evaluation including recursive include resolution, improved TXT handling, duplicate/limit detection, and clearer result statuses.
ThreadEvent IM mentions previously lived only inside the event payload,
with no per-user tracking, so a user had no way to see or filter the
threads where they were mentioned. The new UserEvent model materializes
mentions as first-class records (one row per mentioned user per event),
reconciled by a post_save signal whenever a ThreadEvent is created or
edited.
ThreadEvent edits and deletes are now bounded by THREAD_EVENT_EDIT_DELAY
(1h default) so UserEvent records cannot drift out of sync with stale
audit data past the window.
There was bug in the default thread ordering. Actually, on list that
embed active and draft messages, some draft messages might have a
messaged_at at None (New message) but when we were sort threads by this
field, new draft message was sort at the top of the list because of null
attribute. So in this case, we need to first try to sort by messaged_at
then by draft_message_at.
buildpack is no more able to install dependencies due to the npm version
constraint... As npm is installed with node, we can assume to only set
node version into engines
When a Thread has several accesses or is linked to a shared mailbox,
an input allows to post internal messages. It also allows to
mention user in a message. The ThreadEvent model
is the foundation to enrich Threads with further kind of event.
Co-authored-by: Sylvain Zimmer <sylvinus@users.noreply.github.com>
The search queryKey included searchParams.toString(), creating a new
React Query entry per search term (triggering fetch #1). Meanwhile,
resetSearchQueryDebounced cleared the active query 500ms later
(triggering fetch #2 + flicker).
The previous implementation indexed each thread and message with individual
OpenSearch HTTP calls and triggered N+1 DB queries for accesses, recipients
and sender lookups. This rewrites reindex_all to batch documents via
opensearchpy.helpers.bulk and prefetch related objects in a single queryset,
drastically reducing both DB round-trips and HTTP overhead.
Sylvain Zimmer