Repository navigation

✨ Add Roundcube login with 2FA and short-lived webmail credentials - #1394

Merged

t2d merged 26 commits into

mainfrom

feat/webmail-2fa

Oct 26, 2026

Merged

✨ Add Roundcube login with 2FA and short-lived webmail credentials#1394
t2d merged 26 commits into
mainfrom
feat/webmail-2fa

Commits on Oct 25, 2026
- ✨ Add Roundcube login with 2FA and short-lived webmail credentials
  
  t2d
  and
  claude
  committed
  80377b6
- 🔒 Require app passwords in mail programs for 2FA users
  
  t2d
  and
  claude
  committed
  3072ace
- 🗃️ Merge the app password migrations into one
  
  t2d
  and
  claude
  committed
  4f74982
- 💡 Document the fixed webmail credential lifetime as intended
  
  t2d
  and
  claude
  committed
  f54c2b5
- ✨ Return the expiry of the webmail credential
  
  t2d
  and
  claude
  committed
  020a386
- 📝 Document the Roundcube 2FA login
  
  t2d
  and
  claude
  committed
  45521cc
- 💬 Point 2FA users to app passwords when they are required
  
  t2d
  and
  claude
  committed
  c2365ac
- 🔒 Rate-limit the Roundcube login and check the account status
  
  t2d
  and
  claude
  committed
  a8f7a3d
- 🔒 End webmail sessions when the password changes
  
  t2d
  and
  claude
  committed
  533b1f1
- ♻️ Turn on required app passwords in the setup wizard instead of a migration
  
  t2d
  and
  claude
  committed
  ac45d8e
- ✅ Test that webmail credentials stay hidden
  
  t2d
  and
  claude
  committed
  0d2bf0c
- 🐛 Enforce required app passwords in authenticateMailClient
  
  t2d
  and
  claude
  committed
  00ae510
- ♻️ Follow the app password conventions from main
  
  t2d
  and
  claude
  committed
  af1b974
- 📝 Document the auth endpoint and app password removal conventions
  
  t2d
  and
  claude
  committed
  4c7da54
- 📝 Clarify which app passwords a password change removes
  
  t2d
  and
  claude
  committed
  9850170
- 🐛 Delay Roundcube login event until after 2FA
  t2d
  committed
  4c927d0
- 🗃️ Require app passwords with 2FA by default, except on existing installations
  
  t2d
  and
  claude
  committed
  f3076ad
- 🐛 Fix review findings for webmail credentials
  
  t2d
  and
  claude
  committed
  435d50d
- ♻️ Split the Roundcube login into check and credential steps
  
  t2d
  and
  claude
  committed
  d6ebaf2
- 🐛 Remove keyless webmail credentials when a MailCrypt key is created
  
  t2d
  and
  claude
  committed
  2cfe420
- 🔒️ Check the password before the account state in the Roundcube login
  
  t2d
  and
  claude
  committed
  8f01eca
Commits on Oct 26, 2026
- 🔥 Remove the per-user limit on the Roundcube login
  
  t2d
  and
  claude
  committed
  1c3657a
- 🗃️ Merge the app password migrations into one
  
  t2d
  and
  claude
  committed
  d5decf3
- 📝 Show the app password hint in the two-factor screenshot
  
  t2d
  and
  claude
  committed
  2ab0f86
- 🐛 Keep webmail credentials when a MailCrypt key is created but not enabled
  
  t2d
  and
  claude
  committed
  3093f0e
- 📝 Document app password pruning and API responses, test MailCrypt webmail login
  
  t2d
  and
  claude
  committed
  f6d2df4

Commits

Commits on Oct 25, 2026

Commits on Oct 26, 2026