From 2c5718c9c9e3e7f21c497e9dde0d1c2e2f87c3ac Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Tue, 27 Oct 2026 10:01:33 +0100 Subject: [PATCH 1/4] [Web][Dovecot][SOGo][DockerApi] Add mailbox groups, shared mailboxes and identity provider sync --- .../dockerapi/modules/DockerApi.py | 106 ++- data/Dockerfiles/dovecot/docker-entrypoint.sh | 12 +- data/Dockerfiles/sogo/bootstrap-sogo.sh | 6 +- data/conf/phpfpm/crons/group-grants.php | 65 ++ data/conf/phpfpm/crons/identity-sync.php | 95 +++ data/conf/phpfpm/crons/keycloak-sync.php | 231 ------- data/conf/phpfpm/crons/ldap-sync.php | 198 ------ data/web/admin/mailbox.php | 2 + data/web/admin/system.php | 1 + data/web/domainadmin/mailbox.php | 1 + data/web/edit.php | 19 + data/web/inc/footer.inc.php | 1 + data/web/inc/functions.auth.inc.php | 94 ++- data/web/inc/functions.inc.php | 119 +++- data/web/inc/functions.mailbox.inc.php | 100 ++- data/web/inc/init_db.inc.php | 426 ++++++++++-- .../mailcow/ApiKey/Service/ApiKeyService.php | 6 +- data/web/inc/lib/mailcow/Auth/AuthModule.php | 36 + .../mailcow/Auth/Service/IdpLoginService.php | 70 ++ data/web/inc/lib/mailcow/Core/ApiResponse.php | 6 + data/web/inc/lib/mailcow/Core/Context.php | 18 + .../inc/lib/mailcow/Dovecot/DovecotModule.php | 22 + .../Dovecot/Service/DovecotService.php | 54 ++ .../Controller/IdentityApiController.php | 72 ++ .../mailcow/Identity/Directory/Directory.php | 21 + .../Identity/Directory/DirectoryException.php | 14 + .../Identity/Directory/KeycloakDirectory.php | 105 +++ .../Identity/Directory/LdapDirectory.php | 240 +++++++ .../mailcow/Identity/Http/KeycloakClient.php | 92 +++ .../lib/mailcow/Identity/IdentityModule.php | 85 +++ .../Identity/Legacy/LegacyAccounts.php | 30 + .../lib/mailcow/Identity/Model/Account.php | 27 + .../mailcow/Identity/Model/DirectoryGroup.php | 23 + .../mailcow/Identity/Model/DirectoryUser.php | 26 + .../lib/mailcow/Identity/Model/Listing.php | 20 + .../lib/mailcow/Identity/Model/Settings.php | 118 ++++ .../inc/lib/mailcow/Identity/Model/State.php | 30 + .../lib/mailcow/Identity/Model/SyncPlan.php | 73 ++ .../Repository/IdentityRepository.php | 130 ++++ .../Identity/Repository/RunRepository.php | 81 +++ .../mailcow/Identity/Service/LinkService.php | 51 ++ .../Identity/Service/StatusService.php | 80 +++ .../mailcow/Identity/Service/SyncPlanner.php | 311 +++++++++ .../mailcow/Identity/Service/SyncService.php | 231 +++++++ .../Imapsync/Service/SourceService.php | 2 +- .../Controller/MailboxGroupApiController.php | 173 +++++ .../MailboxGroup/Legacy/LegacyMailbox.php | 59 ++ .../MailboxGroup/MailboxGroupModule.php | 62 ++ .../lib/mailcow/MailboxGroup/Model/Group.php | 108 +++ .../Repository/GroupRepository.php | 649 ++++++++++++++++++ .../Repository/LookupRepository.php | 148 ++++ .../MailboxGroup/Service/AccountHooks.php | 70 ++ .../MailboxGroup/Service/ChangeEffects.php | 40 ++ .../MailboxGroup/Service/GroupService.php | 485 +++++++++++++ .../MailboxGroup/Service/IdpSyncService.php | 124 ++++ .../MailboxGroup/Service/SharingService.php | 169 +++++ .../MailboxGroup/Service/TemplateService.php | 83 +++ data/web/inc/lib/mailcow/README.md | 9 + .../lib/mailcow/Sogo/Service/SogoService.php | 80 +++ data/web/inc/lib/mailcow/Sogo/SogoModule.php | 22 + data/web/js/site/admin.js | 6 + data/web/js/site/groups.js | 152 ++++ data/web/js/site/identity.js | 104 +++ data/web/js/site/mailbox.js | 14 + data/web/json_api.php | 38 +- .../templates/admin/iam-redirect-urls.twig | 41 ++ .../templates/admin/iam-sync-settings.twig | 153 +++++ data/web/templates/admin/iam-sync-status.twig | 30 + .../templates/admin/iam-template-mapping.twig | 72 ++ .../admin/tab-config-identity-provider.twig | 620 ++++------------- data/web/templates/edit.twig | 1 + .../templates/edit/mailbox-group-grant.twig | 49 ++ .../templates/edit/mailbox-group-grants.twig | 24 + data/web/templates/edit/mailbox-group.twig | 142 ++++ data/web/templates/edit/mailbox.twig | 39 ++ data/web/templates/mailbox.twig | 7 + data/web/templates/mailbox/tab-groups.twig | 30 + data/web/templates/modals/mailbox.twig | 11 + data/web/templates/modals/mailbox_group.twig | 119 ++++ data/web/templates/user/tab-user-details.twig | 12 + data/web/user.php | 1 + docker-compose.yml | 19 +- 82 files changed, 6488 insertions(+), 1027 deletions(-) create mode 100644 data/conf/phpfpm/crons/group-grants.php create mode 100644 data/conf/phpfpm/crons/identity-sync.php delete mode 100644 data/conf/phpfpm/crons/keycloak-sync.php delete mode 100644 data/conf/phpfpm/crons/ldap-sync.php create mode 100644 data/web/inc/lib/mailcow/Auth/AuthModule.php create mode 100644 data/web/inc/lib/mailcow/Auth/Service/IdpLoginService.php create mode 100644 data/web/inc/lib/mailcow/Dovecot/DovecotModule.php create mode 100644 data/web/inc/lib/mailcow/Dovecot/Service/DovecotService.php create mode 100644 data/web/inc/lib/mailcow/Identity/Controller/IdentityApiController.php create mode 100644 data/web/inc/lib/mailcow/Identity/Directory/Directory.php create mode 100644 data/web/inc/lib/mailcow/Identity/Directory/DirectoryException.php create mode 100644 data/web/inc/lib/mailcow/Identity/Directory/KeycloakDirectory.php create mode 100644 data/web/inc/lib/mailcow/Identity/Directory/LdapDirectory.php create mode 100644 data/web/inc/lib/mailcow/Identity/Http/KeycloakClient.php create mode 100644 data/web/inc/lib/mailcow/Identity/IdentityModule.php create mode 100644 data/web/inc/lib/mailcow/Identity/Legacy/LegacyAccounts.php create mode 100644 data/web/inc/lib/mailcow/Identity/Model/Account.php create mode 100644 data/web/inc/lib/mailcow/Identity/Model/DirectoryGroup.php create mode 100644 data/web/inc/lib/mailcow/Identity/Model/DirectoryUser.php create mode 100644 data/web/inc/lib/mailcow/Identity/Model/Listing.php create mode 100644 data/web/inc/lib/mailcow/Identity/Model/Settings.php create mode 100644 data/web/inc/lib/mailcow/Identity/Model/State.php create mode 100644 data/web/inc/lib/mailcow/Identity/Model/SyncPlan.php create mode 100644 data/web/inc/lib/mailcow/Identity/Repository/IdentityRepository.php create mode 100644 data/web/inc/lib/mailcow/Identity/Repository/RunRepository.php create mode 100644 data/web/inc/lib/mailcow/Identity/Service/LinkService.php create mode 100644 data/web/inc/lib/mailcow/Identity/Service/StatusService.php create mode 100644 data/web/inc/lib/mailcow/Identity/Service/SyncPlanner.php create mode 100644 data/web/inc/lib/mailcow/Identity/Service/SyncService.php create mode 100644 data/web/inc/lib/mailcow/MailboxGroup/Controller/MailboxGroupApiController.php create mode 100644 data/web/inc/lib/mailcow/MailboxGroup/Legacy/LegacyMailbox.php create mode 100644 data/web/inc/lib/mailcow/MailboxGroup/MailboxGroupModule.php create mode 100644 data/web/inc/lib/mailcow/MailboxGroup/Model/Group.php create mode 100644 data/web/inc/lib/mailcow/MailboxGroup/Repository/GroupRepository.php create mode 100644 data/web/inc/lib/mailcow/MailboxGroup/Repository/LookupRepository.php create mode 100644 data/web/inc/lib/mailcow/MailboxGroup/Service/AccountHooks.php create mode 100644 data/web/inc/lib/mailcow/MailboxGroup/Service/ChangeEffects.php create mode 100644 data/web/inc/lib/mailcow/MailboxGroup/Service/GroupService.php create mode 100644 data/web/inc/lib/mailcow/MailboxGroup/Service/IdpSyncService.php create mode 100644 data/web/inc/lib/mailcow/MailboxGroup/Service/SharingService.php create mode 100644 data/web/inc/lib/mailcow/MailboxGroup/Service/TemplateService.php create mode 100644 data/web/inc/lib/mailcow/Sogo/Service/SogoService.php create mode 100644 data/web/inc/lib/mailcow/Sogo/SogoModule.php create mode 100644 data/web/js/site/groups.js create mode 100644 data/web/js/site/identity.js create mode 100644 data/web/templates/admin/iam-redirect-urls.twig create mode 100644 data/web/templates/admin/iam-sync-settings.twig create mode 100644 data/web/templates/admin/iam-sync-status.twig create mode 100644 data/web/templates/admin/iam-template-mapping.twig create mode 100644 data/web/templates/edit/mailbox-group-grant.twig create mode 100644 data/web/templates/edit/mailbox-group-grants.twig create mode 100644 data/web/templates/edit/mailbox-group.twig create mode 100644 data/web/templates/mailbox/tab-groups.twig create mode 100644 data/web/templates/modals/mailbox_group.twig diff --git a/data/Dockerfiles/dockerapi/modules/DockerApi.py b/data/Dockerfiles/dockerapi/modules/DockerApi.py index 4701cbf51..af76c5377 100644 --- a/data/Dockerfiles/dockerapi/modules/DockerApi.py +++ b/data/Dockerfiles/dockerapi/modules/DockerApi.py @@ -412,6 +412,63 @@ class DockerApi: sogo_return = container.exec_run(["/bin/bash", "-c", f"sogo-tool rename-user '{old_username}' '{new_username}'"], user='sogo') return self.exec_run_handler('generic', sogo_return) + # api call: container_post - post_action: exec - cmd: sogo - task: subscribe + # Subscribes users to a folder of the owner, or unsubscribes them; values are passed as environment and + # arguments, never through the shell + def container_post__exec__sogo__subscribe(self, request_json, **kwargs): + if 'container_id' in kwargs: + filters = {"id": kwargs['container_id']} + elif 'container_name' in kwargs: + filters = {"name": kwargs['container_name']} + + for container in self.sync_docker_client.containers.list(filters=filters): + owner = str(request_json.get('owner', '')) + folder = str(request_json.get('folder', '')) + users = [str(user) for user in request_json.get('users', []) if str(user)] + if not owner or not users or not re.match(r'^(Calendar|Contacts)/[A-Za-z0-9._-]+$', folder): + return Response(content=json.dumps({ 'type': 'danger', 'msg': 'owner, folder and users required' }, indent=4), media_type="application/json") + script = 'for user in "$@"; do sogo-tool manage-acl "$SOGO_ACTION" "$SOGO_OWNER" "$SOGO_FOLDER" "$user" || exit 1; done' + subscribe_return = container.exec_run(["/bin/bash", "-c", script, "subscribe"] + users, user='sogo', + environment={ 'SOGO_ACTION': 'unsubscribe' if request_json.get('unsubscribe') else 'subscribe', 'SOGO_OWNER': owner, 'SOGO_FOLDER': folder }) + return self.exec_run_handler('generic', subscribe_return) + # api call: container_post - post_action: exec - cmd: sogo - task: init_user + # Creates the personal folders of users that never logged in to SOGo (e.g. shared mailboxes) + def container_post__exec__sogo__init_user(self, request_json, **kwargs): + if 'container_id' in kwargs: + filters = {"id": kwargs['container_id']} + elif 'container_name' in kwargs: + filters = {"name": kwargs['container_name']} + + for container in self.sync_docker_client.containers.list(filters=filters): + users = [str(user) for user in request_json.get('users', []) if str(user)] + if not users: + return Response(content=json.dumps({ 'type': 'danger', 'msg': 'users required' }, indent=4), media_type="application/json") + init_return = container.exec_run(["/bin/bash", "-c", 'for user in "$@"; do sogo-tool init-user "$user" || exit 1; done', "init_user"] + users, user='sogo') + return self.exec_run_handler('generic', init_return) + # api call: container_post - post_action: exec - cmd: doveadm - task: subscribe_shared + # Subscribes users to every folder of a mailbox shared with them (Shared//...), or unsubscribes them + def container_post__exec__doveadm__subscribe_shared(self, request_json, **kwargs): + if 'container_id' in kwargs: + filters = {"id": kwargs['container_id']} + elif 'container_name' in kwargs: + filters = {"name": kwargs['container_name']} + + for container in self.sync_docker_client.containers.list(filters=filters): + owner = str(request_json.get('owner', '')) + users = [str(user) for user in request_json.get('users', []) if str(user)] + if not owner or not users or any(c in owner for c in '/*%'): + return Response(content=json.dumps({ 'type': 'danger', 'msg': 'owner and users required' }, indent=4), media_type="application/json") + if request_json.get('unsubscribe'): + # Without access the user no longer sees the folders, their names come from the owner + script = ('set -o pipefail; for user in "$@"; do doveadm mailbox list -u "$SUB_OWNER" | while IFS= read -r folder; do ' + 'case "$folder" in Shared|Shared/*) continue;; esac; doveadm mailbox unsubscribe -u "$user" "Shared/$SUB_OWNER/$folder" || exit 1; ' + 'done || exit 1; done') + else: + # No visible folder means no access yet (ACL, auth cache): fail, so the subscription is retried + script = ('for user in "$@"; do folders=$(doveadm mailbox list -u "$user" "Shared/$SUB_OWNER/*") && [ -n "$folders" ] || exit 1; ' + 'while IFS= read -r folder; do doveadm mailbox subscribe -u "$user" "$folder" || exit 1; done <<< "$folders"; done') + subscribe_return = container.exec_run(["/bin/bash", "-c", script, "subscribe_shared"] + users, environment={ 'SUB_OWNER': owner }) + return self.exec_run_handler('generic', subscribe_return) # api call: container_post - post_action: exec - cmd: doveadm - task: get_acl def container_post__exec__doveadm__get_acl(self, request_json, **kwargs): if 'container_id' in kwargs: @@ -439,7 +496,8 @@ class DockerApi: if len(acls) >= 2: for acl in acls[1:]: user_id, rights = acl.split(maxsplit=1) - user_id = user_id.split('=')[1] + # user= as plain name, other identifiers (group=...) keep their type + user_id = user_id.split('=', 1)[1] if user_id.startswith('user=') else user_id mailbox_seen.append(mailbox) formatted_acls.append({ 'user': id, 'id': user_id, 'mailbox': mailbox, 'rights': rights.split() }) elif "Shared" in shared_folder and "/" in shared_folder: @@ -476,7 +534,7 @@ class DockerApi: id = request_json['id'].replace("'", "'\\''") if user and mailbox and id: - acl_delete_return = container.exec_run(["/bin/bash", "-c", f"doveadm acl delete -u '{user}' '{mailbox}' 'user={id}'"]) + acl_delete_return = container.exec_run(["/bin/bash", "-c", f"doveadm acl delete -u '{user}' '{mailbox}' '{self.acl_identifier(id)}'"]) return self.exec_run_handler('generic', acl_delete_return) # api call: container_post - post_action: exec - cmd: doveadm - task: set_acl def container_post__exec__doveadm__set_acl(self, request_json, **kwargs): @@ -510,8 +568,50 @@ class DockerApi: rights += right + " " if user and mailbox and id and rights: - acl_set_return = container.exec_run(["/bin/bash", "-c", f"doveadm acl set -u '{user}' '{mailbox}' 'user={id}' {rights}"]) + acl_set_return = container.exec_run(["/bin/bash", "-c", f"doveadm acl set -u '{user}' '{mailbox}' '{self.acl_identifier(id)}' {rights}"]) return self.exec_run_handler('generic', acl_set_return) + # api call: container_post - post_action: exec - cmd: doveadm - task: set_acl_all + # Sets the rights of an identifier on every folder of a mailbox, no rights = delete; values are passed as + # environment, never through the shell + def container_post__exec__doveadm__set_acl_all(self, request_json, **kwargs): + if 'container_id' in kwargs: + filters = {"id": kwargs['container_id']} + elif 'container_name' in kwargs: + filters = {"name": kwargs['container_name']} + + for container in self.sync_docker_client.containers.list(filters=filters): + user = request_json.get('user', '') + id = self.acl_identifier(request_json.get('id', '')) + rights = [right.lower() for right in request_json.get('rights', []) if right.lower() in self.acl_rights] + if not user or id in ('user=', 'group='): + return Response(content=json.dumps({ 'type': 'danger', 'msg': 'user and id required' }, indent=4), media_type="application/json") + action = 'doveadm acl set -u "$ACL_USER" "$folder" "$ACL_ID" $ACL_RIGHTS' if rights else 'doveadm acl delete -u "$ACL_USER" "$folder" "$ACL_ID"' + script = ('set -o pipefail; doveadm mailbox list -u "$ACL_USER" | while IFS= read -r folder; do ' + 'case "$folder" in Shared/*) continue;; esac; ' + action + ' || exit 1; done && doveadm acl recalc -u "$ACL_USER"') + acl_return = container.exec_run(["/bin/bash", "-c", script], + environment={ 'ACL_USER': user, 'ACL_ID': id, 'ACL_RIGHTS': ' '.join(rights) }) + return self.exec_run_handler('generic', acl_return) + # api call: container_post - post_action: exec - cmd: doveadm - task: auth_cache_flush + # Drops cached userdb results (e.g. acl_groups) of the given users, all users if none are given + def container_post__exec__doveadm__auth_cache_flush(self, request_json, **kwargs): + if 'container_id' in kwargs: + filters = {"id": kwargs['container_id']} + elif 'container_name' in kwargs: + filters = {"name": kwargs['container_name']} + + for container in self.sync_docker_client.containers.list(filters=filters): + users = [str(user) for user in request_json.get('users', []) if str(user)] + flush_return = container.exec_run(["doveadm", "auth", "cache", "flush"] + users) + return self.exec_run_handler('generic', flush_return) + + # Rights doveadm acl set accepts from the API + acl_rights = ["admin", "create", "delete", "expunge", "insert", "lookup", "post", "read", "write", "write-deleted", "write-seen"] + + # ACL identifier for doveadm: "user=" for a plain name, "user=..." / "group=..." as given + def acl_identifier(self, id): + if id.startswith('user=') or id.startswith('group='): + return id + return 'user=' + id # Collect host stats diff --git a/data/Dockerfiles/dovecot/docker-entrypoint.sh b/data/Dockerfiles/dovecot/docker-entrypoint.sh index d5175e96d..0a66275f6 100755 --- a/data/Dockerfiles/dovecot/docker-entrypoint.sh +++ b/data/Dockerfiles/dovecot/docker-entrypoint.sh @@ -127,7 +127,8 @@ cat < /etc/dovecot/sql/dovecot-dict-sql-userdb.conf # Autogenerated by mailcow driver = mysql connect = "host=/var/run/mysqld/mysqld.sock dbname=${DBNAME} user=${DBUSER} password=${DBPASS}" -user_query = SELECT CONCAT(JSON_UNQUOTE(JSON_VALUE(attributes, '$.mailbox_format')), mailbox_path_prefix, '%d/%n/${MAILDIR_SUB}:VOLATILEDIR=/var/volatile/%u:INDEX=/var/vmail_index/%u') AS mail, '%s' AS protocol, 5000 AS uid, 5000 AS gid, concat('*:bytes=', quota) AS quota_rule FROM mailbox WHERE username = '%u' AND (active = '1' OR active = '2') +# acl_groups: active mailbox groups of the user, IMAP grants are ACLs on group=mcg_ +user_query = SELECT CONCAT(JSON_UNQUOTE(JSON_VALUE(attributes, '$.mailbox_format')), mailbox_path_prefix, '%d/%n/${MAILDIR_SUB}:VOLATILEDIR=/var/volatile/%u:INDEX=/var/vmail_index/%u') AS mail, '%s' AS protocol, 5000 AS uid, 5000 AS gid, concat('*:bytes=', quota) AS quota_rule, (SELECT GROUP_CONCAT(CONCAT('mcg_', gm.group_id)) FROM mailbox_group_member gm JOIN mailbox_group g ON g.id = gm.group_id AND g.active = 1 WHERE gm.username = mailbox.username) AS acl_groups FROM mailbox WHERE username = '%u' AND (active = '1' OR active = '2') iterate_query = SELECT username FROM mailbox WHERE active = '1' OR active = '2'; EOF @@ -304,6 +305,15 @@ IMAPSYNC_TABLE=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DB # Envsubst maildir_gc echo "$(envsubst < /usr/local/bin/maildir_gc.sh)" > /usr/local/bin/maildir_gc.sh +# Wait for updated schema (DB_VERSION from docker-compose.yml), the userdb query reads tables the init_db of php-fpm creates on updates +DBV_NOW=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN) +while [[ "${DBV_NOW}" != "${DB_VERSION}" ]]; do + echo "Waiting for schema update..." + sleep 5 + DBV_NOW=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN) +done +echo "DB schema is ${DBV_NOW}" + # GUID generation while [[ ${VERSIONS_OK} != 'OK' ]]; do if [[ ! -z $(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -B -e "SELECT 'OK' FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA = \"${DBNAME}\" AND TABLE_NAME = 'versions'") ]]; then diff --git a/data/Dockerfiles/sogo/bootstrap-sogo.sh b/data/Dockerfiles/sogo/bootstrap-sogo.sh index 1b2cd2ace..19ef60a92 100755 --- a/data/Dockerfiles/sogo/bootstrap-sogo.sh +++ b/data/Dockerfiles/sogo/bootstrap-sogo.sh @@ -13,13 +13,11 @@ do sleep 3 done -# Wait for updated schema +# Wait for updated schema (DB_VERSION from docker-compose.yml) DBV_NOW=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN) -DBV_NEW=$(grep -oE '\$db_version = .*;' init_db.inc.php | sed 's/$db_version = //g;s/;//g' | cut -d \" -f2) -while [[ "${DBV_NOW}" != "${DBV_NEW}" ]]; do +while [[ "${DBV_NOW}" != "${DB_VERSION}" ]]; do echo "Waiting for schema update..." DBV_NOW=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN) - DBV_NEW=$(grep -oE '\$db_version = .*;' init_db.inc.php | sed 's/$db_version = //g;s/;//g' | cut -d \" -f2) sleep 5 done echo "DB schema is ${DBV_NOW}" diff --git a/data/conf/phpfpm/crons/group-grants.php b/data/conf/phpfpm/crons/group-grants.php new file mode 100644 index 000000000..6083fa81b --- /dev/null +++ b/data/conf/phpfpm/crons/group-grants.php @@ -0,0 +1,65 @@ + PDO::ERRMODE_EXCEPTION, + PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC, + PDO::ATTR_EMULATE_PREPARES => false, +]; +try { + $pdo = new PDO($dsn, $database_user, $database_pass, $opt); +} catch (PDOException $e) { + fwrite(STDERR, "DB connect failed: " . $e->getMessage() . "\n"); + exit(1); +} + +$redis = new Redis(); +try { + if (!empty(getenv('REDIS_SLAVEOF_IP'))) { + $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT')); + } else { + $redis->connect('redis-mailcow', 6379); + } + $redis->auth(getenv("REDISPASS")); +} catch (Exception $e) { + fwrite(STDERR, "Redis connect failed: " . $e->getMessage() . "\n"); + exit(1); +} + +function logMsg($priority, $message, $task = "Group Shares") { + global $redis; + $redis->lPush('CRON_LOG', json_encode(array( + "time" => time(), + "priority" => $priority, + "task" => $task, + "message" => $message, + ))); +} + +require_once __DIR__ . '/../web/inc/functions.inc.php'; +require_once __DIR__ . '/../web/inc/functions.docker.inc.php'; + +// One run at a time, released when the process ends +$lock = fopen('/tmp/group-grants.lock', 'c'); +if ($lock === false || !flock($lock, LOCK_EX | LOCK_NB)) { + exit(0); +} + +$sharing = \Mailcow\MailboxGroup\MailboxGroupModule::create($pdo, \Mailcow\Core\Context::system())->sharing; + +// Every minute: subscriptions of changed groups; failed ones are retried and logged by the full run +if ((int)date('i') % 15 !== 0) { + $sharing->syncSubscriptions(); + exit(0); +} + +// Every 15 minutes: IMAP ACLs on new top-level folders and failed grants, SOGo grants of owners that opened SOGo meanwhile +foreach ($sharing->reconcile() as $warning) { + logMsg("warning", $warning[0] . ": " . html_entity_decode(implode(", ", array_slice($warning, 1)))); +} diff --git a/data/conf/phpfpm/crons/identity-sync.php b/data/conf/phpfpm/crons/identity-sync.php new file mode 100644 index 000000000..11c55bff2 --- /dev/null +++ b/data/conf/phpfpm/crons/identity-sync.php @@ -0,0 +1,95 @@ + PDO::ERRMODE_EXCEPTION, + PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC, + PDO::ATTR_EMULATE_PREPARES => false, +]; +try { + $pdo = new PDO($dsn, $database_user, $database_pass, $opt); +} catch (PDOException $e) { + fwrite(STDERR, "DB connect failed: " . $e->getMessage() . "\n"); + exit(1); +} + +$redis = new Redis(); +try { + if (!empty(getenv('REDIS_SLAVEOF_IP'))) { + $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT')); + } else { + $redis->connect('redis-mailcow', 6379); + } + $redis->auth(getenv("REDISPASS")); +} catch (Exception $e) { + fwrite(STDERR, "Redis connect failed: " . $e->getMessage() . "\n"); + exit(1); +} + +function logMsg($priority, $message, $task = "Identity Sync") { + global $redis; + $redis->lPush('CRON_LOG', json_encode(array( + "time" => time(), + "priority" => $priority, + "task" => $task, + "message" => $message, + ))); +} + +require_once __DIR__ . '/../web/inc/functions.inc.php'; +require_once __DIR__ . '/../web/inc/functions.auth.inc.php'; +require_once __DIR__ . '/../web/inc/sessions.inc.php'; +require_once __DIR__ . '/../web/inc/functions.mailbox.inc.php'; +require_once __DIR__ . '/../web/inc/functions.ratelimit.inc.php'; +require_once __DIR__ . '/../web/inc/functions.acl.inc.php'; + +// The legacy mailbox functions run as admin +$_SESSION['mailcow_cc_username'] = "admin"; +$_SESSION['mailcow_cc_role'] = "admin"; +$_SESSION['acl']['tls_policy'] = "1"; +$_SESSION['acl']['quarantine_notification'] = "1"; +$_SESSION['acl']['quarantine_category'] = "1"; +$_SESSION['acl']['ratelimit'] = "1"; +$_SESSION['acl']['sogo_access'] = "1"; +$_SESSION['acl']['protocol_access'] = "1"; +$_SESSION['acl']['mailbox_relayhost'] = "1"; +$_SESSION['acl']['unlimited_quota'] = "1"; + +// One run at a time, released when the process ends +$lock = fopen('/tmp/identity-sync.lock', 'c'); +if ($lock === false || !flock($lock, LOCK_EX | LOCK_NB)) { + exit(0); +} + +// Users, offboarding and groups of Keycloak or LDAP; requested runs first, else every sync_interval minutes. +// The IdP is only contacted when a run is due. +$iam_settings = identity_provider('get'); +$identity = \Mailcow\Identity\IdentityModule::create($pdo, \Mailcow\Core\Context::system(), $iam_settings, function () { + return identity_provider('init'); +}); +$run = $identity->sync->runDue(); +if ($run !== null) { + $summary = $run['summary']; + if ($run['status'] == 'error') { + logMsg("err", ucfirst($run['mode']) . " failed: " . $summary['error']); + } else { + $counts = array(); + foreach ($summary['counts'] as $key => $count) { + if ($count > 0) $counts[] = $key . "=" . $count; + } + logMsg(($run['status'] == 'blocked') ? "warning" : "info", ucfirst($run['mode']) . " " . $run['status'] . ": " . (empty($counts) ? "no changes" : implode(", ", $counts))); + foreach ($summary['details']['conflicts'] as $conflict) { + logMsg("warning", $conflict); + } + foreach ($summary['errors'] ?? array() as $error) { + logMsg("err", $error); + } + } +} +session_destroy(); diff --git a/data/conf/phpfpm/crons/keycloak-sync.php b/data/conf/phpfpm/crons/keycloak-sync.php deleted file mode 100644 index f09a47d79..000000000 --- a/data/conf/phpfpm/crons/keycloak-sync.php +++ /dev/null @@ -1,231 +0,0 @@ - PDO::ERRMODE_EXCEPTION, - PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC, - PDO::ATTR_EMULATE_PREPARES => false, -]; -try { - $pdo = new PDO($dsn, $database_user, $database_pass, $opt); -} -catch (PDOException $e) { - logMsg("err", $e->getMessage()); - session_destroy(); - exit; -} - -// Init Redis -$redis = new Redis(); -try { - if (!empty(getenv('REDIS_SLAVEOF_IP'))) { - $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT')); - } - else { - $redis->connect('redis-mailcow', 6379); - } - $redis->auth(getenv("REDISPASS")); -} -catch (Exception $e) { - echo "Exiting: " . $e->getMessage(); - session_destroy(); - exit; -} - -function logMsg($priority, $message, $task = "Keycloak Sync") { - global $redis; - - $finalMsg = array( - "time" => time(), - "priority" => $priority, - "task" => $task, - "message" => $message - ); - $redis->lPush('CRON_LOG', json_encode($finalMsg)); -} - -// Load core functions first -require_once __DIR__ . '/../web/inc/functions.inc.php'; -require_once __DIR__ . '/../web/inc/functions.auth.inc.php'; -require_once __DIR__ . '/../web/inc/sessions.inc.php'; -require_once __DIR__ . '/../web/inc/functions.mailbox.inc.php'; -require_once __DIR__ . '/../web/inc/functions.ratelimit.inc.php'; -require_once __DIR__ . '/../web/inc/functions.acl.inc.php'; - -$_SESSION['mailcow_cc_username'] = "admin"; -$_SESSION['mailcow_cc_role'] = "admin"; -$_SESSION['acl']['tls_policy'] = "1"; -$_SESSION['acl']['quarantine_notification'] = "1"; -$_SESSION['acl']['quarantine_category'] = "1"; -$_SESSION['acl']['ratelimit'] = "1"; -$_SESSION['acl']['sogo_access'] = "1"; -$_SESSION['acl']['protocol_access'] = "1"; -$_SESSION['acl']['mailbox_relayhost'] = "1"; -$_SESSION['acl']['unlimited_quota'] = "1"; - -$iam_settings = identity_provider('get'); -if ($iam_settings['authsource'] != "keycloak" || (intval($iam_settings['periodic_sync']) != 1 && intval($iam_settings['import_users']) != 1)) { - session_destroy(); - exit; -} - -// Set pagination variables -$start = 0; -$max = 100; - -// lock sync if already running -$lock_file = '/tmp/iam-sync.lock'; -if (file_exists($lock_file)) { - $lock_file_parts = explode("\n", file_get_contents($lock_file)); - $pid = $lock_file_parts[0]; - if (count($lock_file_parts) > 1){ - $last_execution = $lock_file_parts[1]; - $elapsed_time = (time() - $last_execution) / 60; - if ($elapsed_time < intval($iam_settings['sync_interval'])) { - logMsg("warning", "Sync not ready (".number_format((float)$elapsed_time, 2, '.', '')."min / ".$iam_settings['sync_interval']."min)"); - session_destroy(); - exit; - } - } - - if (posix_kill($pid, 0)) { - logMsg("warning", "Sync is already running"); - session_destroy(); - exit; - } else { - unlink($lock_file); - } -} -$lock_file_handle = fopen($lock_file, 'w'); -fwrite($lock_file_handle, getmypid()); -fclose($lock_file_handle); - -// Init Keycloak Provider -$iam_provider = identity_provider('init'); - -// Loop until all users have been retrieved -while (true) { - // Get admin access token - $admin_token = identity_provider("get-keycloak-admin-token"); - - // Make the API request to retrieve the users - $url = "{$iam_settings['server_url']}/admin/realms/{$iam_settings['realm']}/users?first=$start&max=$max"; - $ch = curl_init(); - curl_setopt($ch, CURLOPT_URL, $url); - curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); - curl_setopt($ch, CURLOPT_HTTPHEADER, [ - "Content-Type: application/json", - "Authorization: Bearer " . $admin_token - ]); - $response = curl_exec($ch); - $code = curl_getinfo($ch, CURLINFO_HTTP_CODE); - curl_close($ch); - - if ($code != 200){ - logMsg("err", "Received HTTP {$code}"); - session_destroy(); - exit; - } - try { - $response = json_decode($response, true); - } catch (Exception $e) { - logMsg("err", $e->getMessage()); - break; - } - if (!is_array($response)){ - logMsg("err", "Received malformed response from keycloak api"); - break; - } - if (count($response) == 0) { - break; - } - - // Process the batch of users - foreach ($response as $user) { - if (empty($user['email'])){ - logMsg("warning", "No email address in keycloak found for user " . $user['name']); - continue; - } - - // try get mailbox user - $stmt = $pdo->prepare("SELECT - mailbox.*, - domain.active AS d_active - FROM `mailbox` - INNER JOIN domain on mailbox.domain = domain.domain - WHERE `kind` NOT REGEXP 'location|thing|group' - AND `username` = :user"); - $stmt->execute(array(':user' => $user['email'])); - $row = $stmt->fetch(PDO::FETCH_ASSOC); - - // check if matching attribute mapping exists - $user_template = $user['attributes']['mailcow_template'][0]; - $mapper_key = array_search($user_template, $iam_settings['mappers']); - - $_SESSION['access_all_exception'] = '1'; - if (!$row && intval($iam_settings['import_users']) == 1){ - if ($mapper_key === false){ - if (!empty($iam_settings['default_template'])) { - $mbox_template = $iam_settings['default_template']; - logMsg("warning", "Using default template for user " . $user['email']); - } else { - logMsg("warning", "No matching attribute mapping found for user " . $user['email']); - continue; - } - } else { - $mbox_template = $iam_settings['templates'][$mapper_key]; - } - // mailbox user does not exist, create... - logMsg("info", "Creating user " . $user['email']); - $create_res = mailbox('add', 'mailbox_from_template', array( - 'domain' => explode('@', $user['email'])[1], - 'local_part' => explode('@', $user['email'])[0], - 'name' => $user['firstName'] . " " . $user['lastName'], - 'authsource' => 'keycloak', - 'template' => $mbox_template - )); - if (!$create_res){ - logMsg("err", "Could not create user " . $user['email']); - continue; - } - } else if ($row && intval($iam_settings['periodic_sync']) == 1 && $row['authsource'] == "keycloak") { - if ($mapper_key === false){ - logMsg("warning", "No matching attribute mapping found for user " . $user['email']); - continue; - } - $mbox_template = $iam_settings['templates'][$mapper_key]; - // mailbox user does exist, sync attribtues... - logMsg("info", "Syncing attributes for user " . $user['email']); - mailbox('edit', 'mailbox_from_template', array( - 'username' => $user['email'], - 'name' => $user['firstName'] . " " . $user['lastName'], - 'template' => $mbox_template - )); - } else { - // skip mailbox user - logMsg("info", "Skipping user " . $user['email']); - } - $_SESSION['access_all_exception'] = '0'; - - sleep(0.025); - } - - // Update the pagination variables for the next batch - $start += $max; - sleep(1); -} - -logMsg("info", "DONE!"); -// add last execution time to lock file -$lock_file_handle = fopen($lock_file, 'w'); -fwrite($lock_file_handle, getmypid() . "\n" . time()); -fclose($lock_file_handle); -session_destroy(); diff --git a/data/conf/phpfpm/crons/ldap-sync.php b/data/conf/phpfpm/crons/ldap-sync.php deleted file mode 100644 index 32026c071..000000000 --- a/data/conf/phpfpm/crons/ldap-sync.php +++ /dev/null @@ -1,198 +0,0 @@ - PDO::ERRMODE_EXCEPTION, - PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC, - PDO::ATTR_EMULATE_PREPARES => false, -]; -try { - $pdo = new PDO($dsn, $database_user, $database_pass, $opt); -} -catch (PDOException $e) { - logMsg("err", $e->getMessage()); - session_destroy(); - exit; -} - -// Init Redis -$redis = new Redis(); -try { - if (!empty(getenv('REDIS_SLAVEOF_IP'))) { - $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT')); - } - else { - $redis->connect('redis-mailcow', 6379); - } - $redis->auth(getenv("REDISPASS")); -} -catch (Exception $e) { - echo "Exiting: " . $e->getMessage(); - session_destroy(); - exit; -} - -function logMsg($priority, $message, $task = "LDAP Sync") { - global $redis; - - $finalMsg = array( - "time" => time(), - "priority" => $priority, - "task" => $task, - "message" => $message - ); - $redis->lPush('CRON_LOG', json_encode($finalMsg)); -} - -// Load core functions first -require_once __DIR__ . '/../web/inc/functions.inc.php'; -require_once __DIR__ . '/../web/inc/functions.auth.inc.php'; -require_once __DIR__ . '/../web/inc/sessions.inc.php'; -require_once __DIR__ . '/../web/inc/functions.mailbox.inc.php'; -require_once __DIR__ . '/../web/inc/functions.ratelimit.inc.php'; -require_once __DIR__ . '/../web/inc/functions.acl.inc.php'; - -$_SESSION['mailcow_cc_username'] = "admin"; -$_SESSION['mailcow_cc_role'] = "admin"; -$_SESSION['acl']['tls_policy'] = "1"; -$_SESSION['acl']['quarantine_notification'] = "1"; -$_SESSION['acl']['quarantine_category'] = "1"; -$_SESSION['acl']['ratelimit'] = "1"; -$_SESSION['acl']['sogo_access'] = "1"; -$_SESSION['acl']['protocol_access'] = "1"; -$_SESSION['acl']['mailbox_relayhost'] = "1"; -$_SESSION['acl']['unlimited_quota'] = "1"; - -$iam_settings = identity_provider('get'); -if ($iam_settings['authsource'] != "ldap" || (intval($iam_settings['periodic_sync']) != 1 && intval($iam_settings['import_users']) != 1)) { - session_destroy(); - exit; -} - -// Set pagination variables -$start = 0; -$max = 100; - -// lock sync if already running -$lock_file = '/tmp/iam-sync.lock'; -if (file_exists($lock_file)) { - $lock_file_parts = explode("\n", file_get_contents($lock_file)); - $pid = $lock_file_parts[0]; - if (count($lock_file_parts) > 1){ - $last_execution = $lock_file_parts[1]; - $elapsed_time = (time() - $last_execution) / 60; - if ($elapsed_time < intval($iam_settings['sync_interval'])) { - logMsg("warning", "Sync not ready (".number_format((float)$elapsed_time, 2, '.', '')."min / ".$iam_settings['sync_interval']."min)"); - session_destroy(); - exit; - } - } - - if (posix_kill($pid, 0)) { - logMsg("warning", "Sync is already running"); - session_destroy(); - exit; - } else { - unlink($lock_file); - } -} -$lock_file_handle = fopen($lock_file, 'w'); -fwrite($lock_file_handle, getmypid()); -fclose($lock_file_handle); - -// Init Provider -$iam_provider = identity_provider('init'); - -// Get ldap users -$ldap_query = $iam_provider->query(); -if (!empty($iam_settings['filter'])) { - $ldap_query = $ldap_query->rawFilter($iam_settings['filter']); -} -$response = $ldap_query->where($iam_settings['username_field'], "*") - ->where($iam_settings['attribute_field'], "*") - ->select([$iam_settings['username_field'], $iam_settings['attribute_field'], 'displayname']) - ->paginate($max); - -// Process the users -foreach ($response as $user) { - // try get mailbox user - $stmt = $pdo->prepare("SELECT - mailbox.*, - domain.active AS d_active - FROM `mailbox` - INNER JOIN domain on mailbox.domain = domain.domain - WHERE `kind` NOT REGEXP 'location|thing|group' - AND `username` = :user"); - $stmt->execute(array(':user' => $user[$iam_settings['username_field']][0])); - $row = $stmt->fetch(PDO::FETCH_ASSOC); - - // check if matching attribute mapping exists - $user_template = $user[$iam_settings['attribute_field']][0]; - $mapper_key = array_search($user_template, $iam_settings['mappers']); - - if (empty($user[$iam_settings['username_field']][0])){ - logMsg("warning", "Skipping user " . $user['displayname'][0] . " due to empty LDAP ". $iam_settings['username_field'] . " property."); - continue; - } - - $_SESSION['access_all_exception'] = '1'; - if (!$row && intval($iam_settings['import_users']) == 1){ - if ($mapper_key === false){ - if (!empty($iam_settings['default_template'])) { - $mbox_template = $iam_settings['default_template']; - } else { - logMsg("warning", "No matching attribute mapping found for user " . $user[$iam_settings['username_field']][0]); - continue; - } - } else { - $mbox_template = $iam_settings['templates'][$mapper_key]; - } - // mailbox user does not exist, create... - logMsg("info", "Creating user " . $user[$iam_settings['username_field']][0]); - $create_res = mailbox('add', 'mailbox_from_template', array( - 'domain' => explode('@', $user[$iam_settings['username_field']][0])[1], - 'local_part' => explode('@', $user[$iam_settings['username_field']][0])[0], - 'name' => $user['displayname'][0], - 'authsource' => 'ldap', - 'template' => $mbox_template - )); - if (!$create_res){ - logMsg("err", "Could not create user " . $user[$iam_settings['username_field']][0]); - continue; - } - } else if ($row && intval($iam_settings['periodic_sync']) == 1 && $row['authsource'] == "ldap") { - if ($mapper_key === false){ - logMsg("warning", "No matching attribute mapping found for user " . $user[$iam_settings['username_field']][0]); - continue; - } - $mbox_template = $iam_settings['templates'][$mapper_key]; - // mailbox user does exist, sync attribtues... - logMsg("info", "Syncing attributes for user " . $user[$iam_settings['username_field']][0]); - mailbox('edit', 'mailbox_from_template', array( - 'username' => $user[$iam_settings['username_field']][0], - 'name' => $user['displayname'][0], - 'template' => $mbox_template - )); - } else { - // skip mailbox user - logMsg("info", "Skipping user " . $user[$iam_settings['username_field']][0]); - } - $_SESSION['access_all_exception'] = '0'; - - sleep(0.025); -} - -logMsg("info", "DONE!"); -// add last execution time to lock file -$lock_file_handle = fopen($lock_file, 'w'); -fwrite($lock_file_handle, getmypid() . "\n" . time()); -fclose($lock_file_handle); -session_destroy(); diff --git a/data/web/admin/mailbox.php b/data/web/admin/mailbox.php index a79c68c1a..05530e99e 100644 --- a/data/web/admin/mailbox.php +++ b/data/web/admin/mailbox.php @@ -10,6 +10,7 @@ $_SESSION['return_to'] = $_SERVER['REQUEST_URI']; $js_minifier->add('/web/js/site/imapsync.js'); +$js_minifier->add('/web/js/site/groups.js'); $js_minifier->add('/web/js/site/mailbox.js'); $js_minifier->add('/web/js/presets/sieveMailbox.js'); $js_minifier->add('/web/js/site/pwgen.js'); @@ -39,6 +40,7 @@ $template_data = [ 'global_filters' => mailbox('get', 'global_filter_details'), 'domains' => $domains, 'mailboxes' => $mailboxes, + 'mbox_templates' => mailbox('get', 'mailbox_templates'), 'lang_mailbox' => json_encode($lang['mailbox']), 'lang_rl' => json_encode($lang['ratelimit']), 'lang_edit' => json_encode($lang['edit']), diff --git a/data/web/admin/system.php b/data/web/admin/system.php index 326a8a6af..8353a8d2d 100644 --- a/data/web/admin/system.php +++ b/data/web/admin/system.php @@ -12,6 +12,7 @@ $fido2_data = fido2(array("action" => "get_friendly_names")); $js_minifier->add('/web/js/site/admin.js'); $js_minifier->add('/web/js/presets/rspamd.js'); $js_minifier->add('/web/js/site/pwgen.js'); +$js_minifier->add('/web/js/site/identity.js'); // all domains $domains = mailbox('get', 'domains'); diff --git a/data/web/domainadmin/mailbox.php b/data/web/domainadmin/mailbox.php index cc1f5bc1b..4b99579a0 100644 --- a/data/web/domainadmin/mailbox.php +++ b/data/web/domainadmin/mailbox.php @@ -10,6 +10,7 @@ $_SESSION['return_to'] = $_SERVER['REQUEST_URI']; $js_minifier->add('/web/js/site/imapsync.js'); +$js_minifier->add('/web/js/site/groups.js'); $js_minifier->add('/web/js/site/mailbox.js'); $js_minifier->add('/web/js/presets/sieveMailbox.js'); $js_minifier->add('/web/js/site/pwgen.js'); diff --git a/data/web/edit.php b/data/web/edit.php index 4594ae3c8..eceaf6f75 100644 --- a/data/web/edit.php +++ b/data/web/edit.php @@ -99,6 +99,22 @@ if (isset($_SESSION['mailcow_cc_role'])) { $template = 'edit/oauth2client.twig'; $template_data = ['oauth2client' => $oauth2client]; } + elseif (isset($_GET['mailbox-group']) && + is_numeric($_GET['mailbox-group'])) { + $result = \Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->getGroup($_GET['mailbox-group']); + $template = 'edit/mailbox-group.twig'; + // Member candidates: mailboxes of the domains the caller manages + $mailboxes = []; + foreach (mailbox('get', 'domains') as $domain) { + foreach (mailbox('get', 'mailboxes', $domain) as $mailbox) { + $mailboxes[] = $mailbox; + } + } + $template_data = [ + 'mailboxes' => $mailboxes, + 'mbox_templates' => ($_SESSION['mailcow_cc_role'] == 'admin') ? mailbox('get', 'mailbox_templates') : [], + ]; + } elseif (isset($_GET['api-key']) && is_numeric($_GET['api-key'])) { $result = \Mailcow\ApiKey\ApiKeyModule::fromGlobals()->api->getKey($_GET['api-key']); @@ -141,6 +157,8 @@ if (isset($_SESSION['mailcow_cc_role'])) { 'get_tls_policy' => $get_tls_policy, 'rlyhosts' => $rlyhosts, 'sender_acl_handles' => mailbox('get', 'sender_acl_handles', $mailbox), + 'mailbox_groups' => \Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->getMemberships($mailbox), + 'identity_link' => \Mailcow\Identity\IdentityModule::fromGlobals()->api->getLink($mailbox), 'user_acls' => acl('get', 'user', $mailbox), 'mailbox_details' => $result, 'iam_settings' => $iam_settings, @@ -237,6 +255,7 @@ else { } $js_minifier->add('/web/js/site/imapsync.js'); +$js_minifier->add('/web/js/site/groups.js'); $js_minifier->add('/web/js/site/edit.js'); $js_minifier->add('/web/js/site/pwgen.js'); diff --git a/data/web/inc/footer.inc.php b/data/web/inc/footer.inc.php index 01dc2c532..41cd022bb 100644 --- a/data/web/inc/footer.inc.php +++ b/data/web/inc/footer.inc.php @@ -73,6 +73,7 @@ $globalVariables = [ 'lang_success' => json_encode($lang['success']), 'lang_danger' => json_encode($lang['danger']), 'lang_syncjobs' => json_encode($lang['syncjobs']), + 'lang_groups' => json_encode($lang['groups']), 'docker_timeout' => $DOCKER_TIMEOUT, 'session_lifetime' => (int)$SESSION_LIFETIME, 'csrf_token' => $_SESSION['CSRF']['TOKEN'], diff --git a/data/web/inc/functions.auth.inc.php b/data/web/inc/functions.auth.inc.php index e5a303f9b..a507bbfa4 100644 --- a/data/web/inc/functions.auth.inc.php +++ b/data/web/inc/functions.auth.inc.php @@ -262,12 +262,20 @@ function user_login($user, $pass, $extra = null){ // check if user has access to service (imap, smtp, pop3, sieve) if service is set $row['attributes'] = json_decode($row['attributes'], true); + // Shared mailboxes have no login of their own, members open them through group shares + if (($row['attributes']['shared'] ?? '0') == '1') { + return false; + } if ($extra['service'] != 'NONE') { $key = strtolower($extra['service']) . "_access"; if (isset($row['attributes'][$key]) && $row['attributes'][$key] != '1') { return false; } } + // IdP accounts: refuse inactive mailboxes and domains before asking the IdP (no template side effects) + if ($row['authsource'] != 'mailcow' && ($row['active'] != '1' || $row['d_active'] != '1')) { + return false; + } switch ($row['authsource']) { case 'keycloak': // user authsource is keycloak, try using via rest flow @@ -462,6 +470,7 @@ function apppass_login($user, $pass, $extra = null){ AND `mailbox`.`active` = '1' AND `domain`.`active` = '1' AND `app_passwd`.`active` = '1' + AND COALESCE(JSON_UNQUOTE(JSON_VALUE(`mailbox`.`attributes`, '$.shared')), '0') != '1' AND `app_passwd`.`mailbox` = :user" ); // fetch password data @@ -525,7 +534,11 @@ function keycloak_mbox_login_rest($user, $pass, $extra = null){ 'Authorization: Bearer ' . $admin_token, 'Content-Type: application/json' )); - $user_res = json_decode(curl_exec($curl), true)[0]; + if (intval($iam_settings['ignore_ssl_error']) == 1) { + curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false); + curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 0); + } + $users = json_decode(curl_exec($curl), true); $code = curl_getinfo($curl, CURLINFO_HTTP_CODE); curl_close($curl); if ($code != 200) { @@ -536,6 +549,14 @@ function keycloak_mbox_login_rest($user, $pass, $extra = null){ ); return false; } + // exact=true can still return several users with that email + if (!is_array($users) || count($users) != 1) { + return false; + } + $user_res = $users[0]; + if (empty($user_res['enabled'])) { + return false; + } if (!isset($user_res['attributes']['mailcow_password']) || !is_array($user_res['attributes']['mailcow_password'])){ $_SESSION['return'][] = array( 'type' => 'danger', @@ -560,18 +581,28 @@ function keycloak_mbox_login_rest($user, $pass, $extra = null){ } // get mapped template - $user_template = $user_res['attributes']['mailcow_template'][0]; - $mapper_key = array_search($user_template, $iam_settings['mappers']); + $name = trim(($user_res['firstName'] ?? '') . ' ' . ($user_res['lastName'] ?? '')); + $idp_login = \Mailcow\Auth\AuthModule::fromGlobals()->idp; + $mapped_template = $idp_login->mappedTemplate($user_res['attributes']['mailcow_template'] ?? array()); if (!$create) { + if (!$idp_login->verifyLink('keycloak', $user, (string)($user_res['id'] ?? ''))) { + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $user, '*', 'The mailbox is linked to another IdP user'), + 'msg' => 'generic_server_error' + ); + return false; + } // login success - if ($mapper_key !== false) { + $update_template = $idp_login->templateFor($user, $mapped_template); + if ($update_template !== null) { // update user $_SESSION['access_all_exception'] = '1'; mailbox('edit', 'mailbox_from_template', array( 'username' => $user, - 'name' => $user_res['name'], - 'template' => $iam_settings['templates'][$mapper_key] + 'name' => $name, + 'template' => $update_template )); $_SESSION['access_all_exception'] = '0'; } @@ -590,7 +621,7 @@ function keycloak_mbox_login_rest($user, $pass, $extra = null){ return false; } // check if matching attribute exist - if (empty($iam_settings['mappers']) || !$user_template || $mapper_key === false) { + if ($mapped_template === null) { if (!empty($iam_settings['default_template'])) { $mbox_template = $iam_settings['default_template']; } else { @@ -602,7 +633,16 @@ function keycloak_mbox_login_rest($user, $pass, $extra = null){ return false; } } else { - $mbox_template = $iam_settings['templates'][$mapper_key]; + $mbox_template = $mapped_template; + } + + if (!$idp_login->mayCreate('keycloak', $user, (string)($user_res['id'] ?? ''))) { + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $user, '*', 'The IdP user is linked to another mailbox'), + 'msg' => 'generic_server_error' + ); + return false; } // create mailbox @@ -610,7 +650,7 @@ function keycloak_mbox_login_rest($user, $pass, $extra = null){ $create_res = mailbox('add', 'mailbox_from_template', array( 'domain' => explode('@', $user)[1], 'local_part' => explode('@', $user)[0], - 'name' => $user_res['name'], + 'name' => $name, 'authsource' => 'keycloak', 'template' => $mbox_template )); @@ -624,6 +664,7 @@ function keycloak_mbox_login_rest($user, $pass, $extra = null){ ); return false; } + $idp_login->storeLink('keycloak', $user, (string)($user_res['id'] ?? '')); return 'user'; } @@ -655,7 +696,8 @@ function ldap_mbox_login($user, $pass, $extra = null){ $ldap_query = $ldap_query->rawFilter($iam_settings['filter']); } $ldap_query = $ldap_query->where($iam_settings['username_field'], '=', $user) - ->select([$iam_settings['username_field'], $iam_settings['attribute_field'], 'displayname', 'distinguishedname', 'dn']); + ->select(array_values(array_filter(array_merge([$iam_settings['username_field'], $iam_settings['attribute_field'], 'displayname', 'distinguishedname', 'dn'], + \Mailcow\Identity\Directory\LdapDirectory::idAttributes($iam_settings['id_attribute'] ?? ''))))); $user_res = $ldap_query->firstOrFail(); } catch (Exception $e) { @@ -684,18 +726,28 @@ function ldap_mbox_login($user, $pass, $extra = null){ } // get mapped template - $user_template = $user_res[$iam_settings['attribute_field']][0]; - $mapper_key = array_search($user_template, $iam_settings['mappers']); + $idp_login = \Mailcow\Auth\AuthModule::fromGlobals()->idp; + $mapped_template = $idp_login->mappedTemplate($user_res[$iam_settings['attribute_field']] ?? array()); + $external_id = \Mailcow\Identity\Directory\LdapDirectory::entryId($user_res, $iam_settings['id_attribute'] ?? ''); if (!$create) { + if (!$idp_login->verifyLink('ldap', $user, $external_id)) { + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $user, '*', 'The mailbox is linked to another IdP user'), + 'msg' => 'generic_server_error' + ); + return false; + } // login success - if ($mapper_key !== false) { + $update_template = $idp_login->templateFor($user, $mapped_template); + if ($update_template !== null) { // update user $_SESSION['access_all_exception'] = '1'; mailbox('edit', 'mailbox_from_template', array( 'username' => $user, 'name' => $user_res['displayname'][0], - 'template' => $iam_settings['templates'][$mapper_key] + 'template' => $update_template )); $_SESSION['access_all_exception'] = '0'; } @@ -714,7 +766,7 @@ function ldap_mbox_login($user, $pass, $extra = null){ return false; } // check if matching attribute exist - if (empty($iam_settings['mappers']) || !$user_template || $mapper_key === false) { + if ($mapped_template === null) { if (!empty($iam_settings['default_template'])) { $mbox_template = $iam_settings['default_template']; } else { @@ -726,7 +778,16 @@ function ldap_mbox_login($user, $pass, $extra = null){ return false; } } else { - $mbox_template = $iam_settings['templates'][$mapper_key]; + $mbox_template = $mapped_template; + } + + if (!$idp_login->mayCreate('ldap', $user, $external_id)) { + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $user, '*', 'The IdP user is linked to another mailbox'), + 'msg' => 'generic_server_error' + ); + return false; } // create mailbox @@ -748,6 +809,7 @@ function ldap_mbox_login($user, $pass, $extra = null){ ); return false; } + $idp_login->storeLink('ldap', $user, $external_id); return 'user'; } diff --git a/data/web/inc/functions.inc.php b/data/web/inc/functions.inc.php index 286a5bdf7..660cd67f0 100644 --- a/data/web/inc/functions.inc.php +++ b/data/web/inc/functions.inc.php @@ -2360,6 +2360,7 @@ function identity_provider($_action = null, $_data = null, $_extra = null) { $data_log = $_data; if (isset($data_log['client_secret'])) $data_log['client_secret'] = '*'; if (isset($data_log['access_token'])) $data_log['access_token'] = '*'; + if (isset($data_log['bindpass'])) $data_log['bindpass'] = '*'; switch ($_action) { case 'get': @@ -2370,9 +2371,12 @@ function identity_provider($_action = null, $_data = null, $_extra = null) { foreach($rows as $row){ switch ($row["key"]) { case "redirect_url_extra": + $settings[$row["key"]] = json_decode($row["value"]); + break; case "mappers": case "templates": - $settings[$row["key"]] = json_decode($row["value"]); + // Parallel lists; older rows can be JSON objects, decode as arrays to keep the keys aligned + $settings[$row["key"]] = (array)json_decode($row["value"], true); break; case "use_ssl": case "use_tls": @@ -2455,6 +2459,13 @@ function identity_provider($_action = null, $_data = null, $_extra = null) { $_data['ignore_ssl_error'] = isset($_data['ignore_ssl_error']) ? boolval($_data['ignore_ssl_error']) : false; $_data['login_provisioning'] = isset($_data['login_provisioning']) ? boolval($_data['login_provisioning']) : false; + // Identity sync: offboarding and groups (Keycloak and LDAP) + $sync_settings = array('offboarding', 'offboarding_limit', 'group_sync', 'group_autocreate', 'group_default_domain'); + $_data['offboarding'] = isset($_data['offboarding']) ? intval($_data['offboarding']) : 0; + $_data['offboarding_limit'] = isset($_data['offboarding_limit']) && is_numeric($_data['offboarding_limit']) ? min(100, max(0, intval($_data['offboarding_limit']))) : 10; + $_data['group_sync'] = isset($_data['group_sync']) ? intval($_data['group_sync']) : 0; + $_data['group_autocreate'] = isset($_data['group_autocreate']) ? intval($_data['group_autocreate']) : 0; + $_data['group_default_domain'] = isset($_data['group_default_domain']) ? strtolower(trim($_data['group_default_domain'])) : ""; switch ($_data['authsource']) { case "keycloak": $_data['server_url'] = (!empty($_data['server_url'])) ? rtrim($_data['server_url'], '/') : null; @@ -2463,7 +2474,8 @@ function identity_provider($_action = null, $_data = null, $_extra = null) { $_data['import_users'] = isset($_data['import_users']) ? intval($_data['import_users']) : 0; $_data['sync_interval'] = (!empty($_data['sync_interval'])) ? intval($_data['sync_interval']) : 15; $_data['sync_interval'] = $_data['sync_interval'] < 1 ? 1 : $_data['sync_interval']; - $required_settings = array('authsource', 'server_url', 'realm', 'client_id', 'client_secret', 'redirect_url', 'version', 'mailpassword_flow', 'periodic_sync', 'import_users', 'sync_interval', 'ignore_ssl_error', 'login_provisioning'); + $_data['group_paths'] = isset($_data['group_paths']) ? trim($_data['group_paths']) : ""; + $required_settings = array_merge(array('authsource', 'server_url', 'realm', 'client_id', 'client_secret', 'redirect_url', 'version', 'mailpassword_flow', 'periodic_sync', 'import_users', 'sync_interval', 'ignore_ssl_error', 'login_provisioning', 'group_paths'), $sync_settings); break; case "generic-oidc": $_data['authorize_url'] = (!empty($_data['authorize_url'])) ? $_data['authorize_url'] : null; @@ -2484,7 +2496,14 @@ function identity_provider($_action = null, $_data = null, $_extra = null) { $_data['use_tls'] = isset($_data['use_tls']) && !$_data['use_ssl'] ? boolval($_data['use_tls']) : false; $_data['sync_interval'] = (!empty($_data['sync_interval'])) ? intval($_data['sync_interval']) : 15; $_data['sync_interval'] = $_data['sync_interval'] < 1 ? 1 : $_data['sync_interval']; - $required_settings = array('authsource', 'host', 'port', 'basedn', 'username_field', 'filter', 'attribute_field', 'binddn', 'bindpass', 'periodic_sync', 'import_users', 'sync_interval', 'use_ssl', 'use_tls', 'ignore_ssl_error', 'login_provisioning'); + $_data['id_attribute'] = isset($_data['id_attribute']) ? strtolower(trim($_data['id_attribute'])) : ""; + $_data['disabled_filter'] = isset($_data['disabled_filter']) ? trim($_data['disabled_filter']) : ""; + $_data['group_basedn'] = isset($_data['group_basedn']) ? trim($_data['group_basedn']) : ""; + $_data['group_filter'] = isset($_data['group_filter']) ? trim($_data['group_filter']) : ""; + $_data['group_name_attribute'] = (!empty($_data['group_name_attribute'])) ? strtolower(trim($_data['group_name_attribute'])) : "cn"; + $_data['group_member_mode'] = isset($_data['group_member_mode']) && in_array($_data['group_member_mode'], array('memberof', 'member', 'ad_chain')) ? $_data['group_member_mode'] : "memberof"; + $_data['group_member_attribute'] = (!empty($_data['group_member_attribute'])) ? strtolower(trim($_data['group_member_attribute'])) : "member"; + $required_settings = array_merge(array('authsource', 'host', 'port', 'basedn', 'username_field', 'filter', 'attribute_field', 'binddn', 'bindpass', 'periodic_sync', 'import_users', 'sync_interval', 'use_ssl', 'use_tls', 'ignore_ssl_error', 'login_provisioning', 'id_attribute', 'disabled_filter', 'group_basedn', 'group_filter', 'group_name_attribute', 'group_member_mode', 'group_member_attribute'), $sync_settings); break; } @@ -2506,6 +2525,10 @@ function identity_provider($_action = null, $_data = null, $_extra = null) { $stmt->bindParam(':value', $_data[$setting]); $stmt->execute(); } + // Stored LDAP ids of another id attribute never match again, the mailboxes are linked by email again + if ($_data['authsource'] == 'ldap' && ($iam_settings['id_attribute'] ?? '') != $_data['id_attribute']) { + $pdo->query("UPDATE `identity_link` SET `external_id` = NULL WHERE `provider` = 'ldap'"); + } $pdo->commit(); // add redirect_url_extra @@ -2533,19 +2556,26 @@ function identity_provider($_action = null, $_data = null, $_extra = null) { $_data['mappers'] = (!is_array($_data['mappers'])) ? array($_data['mappers']) : $_data['mappers']; $_data['templates'] = (!is_array($_data['templates'])) ? array($_data['templates']) : $_data['templates']; - $mappers = array_filter($_data['mappers']); - $templates = array_filter($_data['templates']); - if (count($mappers) == count($templates)){ - $mappers = json_encode($mappers); - $templates = json_encode($templates); - - $stmt = $pdo->prepare("INSERT INTO identity_provider (`key`, `value`) VALUES ('mappers', :value) ON DUPLICATE KEY UPDATE `value` = VALUES(`value`);"); - $stmt->bindParam(':value', $mappers); - $stmt->execute(); - $stmt = $pdo->prepare("INSERT INTO identity_provider (`key`, `value`) VALUES ('templates', :value) ON DUPLICATE KEY UPDATE `value` = VALUES(`value`);"); - $stmt->bindParam(':value', $templates); - $stmt->execute(); + // Keep mapper/template pairs together, incomplete rows are dropped + $mappers = array(); + $templates = array(); + $template_values = array_values($_data['templates']); + foreach (array_values($_data['mappers']) as $i => $mapper) { + if ((string)$mapper === '' || (string)($template_values[$i] ?? '') === '') { + continue; + } + $mappers[] = $mapper; + $templates[] = $template_values[$i]; } + $mappers = json_encode($mappers); + $templates = json_encode($templates); + + $stmt = $pdo->prepare("INSERT INTO identity_provider (`key`, `value`) VALUES ('mappers', :value) ON DUPLICATE KEY UPDATE `value` = VALUES(`value`);"); + $stmt->bindParam(':value', $mappers); + $stmt->execute(); + $stmt = $pdo->prepare("INSERT INTO identity_provider (`key`, `value`) VALUES ('templates', :value) ON DUPLICATE KEY UPDATE `value` = VALUES(`value`);"); + $stmt->bindParam(':value', $templates); + $stmt->execute(); } // delete old access_token @@ -2670,6 +2700,8 @@ function identity_provider($_action = null, $_data = null, $_extra = null) { } $stmt = $pdo->query("DELETE FROM identity_provider;"); + $stmt = $pdo->query("DELETE FROM identity_link;"); + $stmt = $pdo->query("DELETE FROM identity_sync_run;"); $_SESSION['return'][] = array( 'type' => 'success', @@ -2790,8 +2822,8 @@ function identity_provider($_action = null, $_data = null, $_extra = null) { } // get mapped template - $user_template = $info['mailcow_template']; - $mapper_key = array_search($user_template, $iam_settings['mappers']); + $idp_login = \Mailcow\Auth\AuthModule::fromGlobals()->idp; + $mapped_template = $idp_login->mappedTemplate($info['mailcow_template'] ?? array()); // token valid, get mailbox $stmt = $pdo->prepare("SELECT @@ -2813,13 +2845,23 @@ function identity_provider($_action = null, $_data = null, $_extra = null) { ); return false; } - if ($mapper_key !== false) { + if (!$idp_login->verifyLink($iam_settings['authsource'], $info['email'], (string)($info['sub'] ?? ''))) { + clear_session(); + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $info['email'], 'The mailbox is linked to another IdP user'), + 'msg' => 'login_failed' + ); + return false; + } + $update_template = $idp_login->templateFor($info['email'], $mapped_template); + if ($update_template !== null) { // update user $_SESSION['access_all_exception'] = '1'; mailbox('edit', 'mailbox_from_template', array( 'username' => $info['email'], 'name' => $info['name'], - 'template' => $iam_settings['templates'][$mapper_key] + 'template' => $update_template )); $_SESSION['access_all_exception'] = '0'; @@ -2834,11 +2876,11 @@ function identity_provider($_action = null, $_data = null, $_extra = null) { $stmt->execute(array(':user' => $info['email'])); $row = $stmt->fetch(PDO::FETCH_ASSOC); } - if ($row['active'] != 1 || $row['d_active'] != 1) { + if ($row['active'] != 1 || $row['d_active'] != 1 || (json_decode($row['attributes'], true)['shared'] ?? '0') == '1') { clear_session(); $_SESSION['return'][] = array( 'type' => 'danger', - 'log' => array(__FUNCTION__, $info['email'], 'Domain or mailbox is inactive'), + 'log' => array(__FUNCTION__, $info['email'], 'Domain or mailbox is inactive or shared'), 'msg' => 'login_failed' ); return false; @@ -2864,7 +2906,7 @@ function identity_provider($_action = null, $_data = null, $_extra = null) { return false; } - if (empty($iam_settings['mappers']) || empty($user_template) || $mapper_key === false){ + if ($mapped_template === null){ if (!empty($iam_settings['default_template'])) { $mbox_template = $iam_settings['default_template']; } else { @@ -2877,7 +2919,17 @@ function identity_provider($_action = null, $_data = null, $_extra = null) { return false; } } else { - $mbox_template = $iam_settings['templates'][$mapper_key]; + $mbox_template = $mapped_template; + } + + if (!$idp_login->mayCreate($iam_settings['authsource'], $info['email'], (string)($info['sub'] ?? ''))) { + clear_session(); + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $info['email'], 'The IdP user is linked to another mailbox'), + 'msg' => 'login_failed' + ); + return false; } // create mailbox @@ -2899,6 +2951,7 @@ function identity_provider($_action = null, $_data = null, $_extra = null) { ); return false; } + $idp_login->storeLink($iam_settings['authsource'], $info['email'], (string)($info['sub'] ?? '')); // double check if mailbox and domain is active $stmt = $pdo->prepare("SELECT * FROM `mailbox` @@ -2955,6 +3008,26 @@ function identity_provider($_action = null, $_data = null, $_extra = null) { return false; } + // The mailbox may have been deleted or deactivated since the login + $stmt = $pdo->prepare("SELECT `mailbox`.`authsource` FROM `mailbox` + INNER JOIN `domain` ON `mailbox`.`domain` = `domain`.`domain` + WHERE `kind` NOT REGEXP 'location|thing|group' + AND `mailbox`.`active` = '1' + AND `domain`.`active` = '1' + AND COALESCE(JSON_UNQUOTE(JSON_VALUE(`mailbox`.`attributes`, '$.shared')), '0') != '1' + AND `username` = :user"); + $stmt->execute(array(':user' => $info['email'])); + $row = $stmt->fetch(PDO::FETCH_ASSOC); + if (!$row || !in_array($row['authsource'], array('keycloak', 'generic-oidc'))) { + clear_session(); + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $info['email'], 'Mailbox or domain is inactive or not of type OIDC'), + 'msg' => 'refresh_login_failed' + ); + return false; + } + set_user_loggedin_session($info['email']); $_SESSION['iam_token'] = $plain_token; $_SESSION['iam_refresh_token'] = $plain_refreshtoken; diff --git a/data/web/inc/functions.mailbox.inc.php b/data/web/inc/functions.mailbox.inc.php index 645e96a4d..121d43a0c 100644 --- a/data/web/inc/functions.mailbox.inc.php +++ b/data/web/inc/functions.mailbox.inc.php @@ -938,6 +938,8 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { $eas_access = (isset($_data['eas_access'])) ? intval($_data['eas_access']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['eas_access']); $dav_access = (isset($_data['dav_access'])) ? intval($_data['dav_access']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['dav_access']); $relayhost = (isset($_data['relayhost'])) ? intval($_data['relayhost']) : 0; + // Shared mailbox: no login of its own, members open it through group shares + $shared = (isset($_data['shared'])) ? intval($_data['shared']) : 0; $quarantine_notification = (isset($_data['quarantine_notification'])) ? strval($_data['quarantine_notification']) : strval($MAILBOX_DEFAULT_ATTRIBUTES['quarantine_notification']); $quarantine_category = (isset($_data['quarantine_category'])) ? strval($_data['quarantine_category']) : strval($MAILBOX_DEFAULT_ATTRIBUTES['quarantine_category']); // Validate quarantine_category @@ -971,6 +973,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { 'eas_access' => strval($eas_access), 'dav_access' => strval($dav_access), 'relayhost' => strval($relayhost), + 'shared' => strval($shared), 'passwd_update' => time(), 'mailbox_format' => strval($MAILBOX_DEFAULT_ATTRIBUTES['mailbox_format']), 'quarantine_notification' => strval($quarantine_notification), @@ -1050,7 +1053,11 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { ); return false; } - if ($authsource == 'mailcow'){ + if ($authsource == 'mailcow' && $shared == 1 && empty($password) && empty($password2)) { + // Nobody logs in to a shared mailbox, a random password keeps it unusable + $password_hashed = hash_password(bin2hex(random_bytes(32))); + } + elseif ($authsource == 'mailcow'){ if (password_check($password, $password2) !== true) { return false; } @@ -1268,7 +1275,16 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { } } - return mailbox('add', 'mailbox', $mailbox_attributes); + $result = mailbox('add', 'mailbox', $mailbox_attributes); + if ($result !== false) { + // Remember the applied template, see edit mailbox_from_template + $stmt = $pdo->prepare("UPDATE `mailbox` SET `attributes` = JSON_SET(`attributes`, '$.template', :template) WHERE `username` = :username"); + $stmt->execute(array( + ':template' => $_data['template'], + ':username' => strtolower(trim($_data['local_part'])) . '@' . idn_to_ascii(strtolower(trim($_data['domain'])), 0, INTL_IDNA_VARIANT_UTS46) + )); + } + return $result; break; case 'mta_sts': $domain = idn_to_ascii(strtolower(trim($_data['domain'])), 0, INTL_IDNA_VARIANT_UTS46); @@ -2208,6 +2224,14 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { ); continue; } + if (!empty($is_now['group_id'])) { + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr), + 'msg' => array('alias_group_managed', htmlspecialchars($is_now['address'])) + ); + continue; + } if ($_data['expand_alias'] === true || $_data['expand_alias'] == 1) { $stmt = $pdo->prepare("SELECT `address` FROM `alias` WHERE `address` = :address @@ -2370,7 +2394,8 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { // Delete from sender_acl to prevent duplicates $stmt = $pdo->prepare("DELETE FROM `sender_acl` WHERE `logged_in_as` = :goto AND - `send_as` = :address"); + `send_as` = :address AND + `group_id` IS NULL"); $stmt->execute(array( ':goto' => $goto, ':address' => $address @@ -2404,6 +2429,10 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { ':active' => $active, ':id' => $is_now['id'] )); + if ($address != $is_now['address']) { + // Send-as grants of groups follow the address + \Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->addressRenamed($is_now['address'], $address); + } } $_SESSION['return'][] = array( 'type' => 'success', @@ -2785,6 +2814,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { (int)$eas_access = (isset($_data['eas_access']) && hasACLAccess("protocol_access")) ? intval($_data['eas_access']) : intval($is_now['attributes']['eas_access']); (int)$dav_access = (isset($_data['dav_access']) && hasACLAccess("protocol_access")) ? intval($_data['dav_access']) : intval($is_now['attributes']['dav_access']); (int)$relayhost = (isset($_data['relayhost']) && hasACLAccess("mailbox_relayhost")) ? intval($_data['relayhost']) : intval($is_now['attributes']['relayhost']); + (int)$shared = (isset($_data['shared'])) ? intval($_data['shared']) : intval($is_now['attributes']['shared'] ?? 0); (int)$quota_m = (isset_has_content($_data['quota'])) ? intval($_data['quota']) : ($is_now['quota'] / 1048576); $name = (!empty($_data['name'])) ? ltrim(rtrim($_data['name'], '>'), '<') : $is_now['name']; $domain = $is_now['domain']; @@ -3007,7 +3037,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { $sender_acl_merged = array_merge($sender_acl_domain_admin, $sender_acl_admin); // If merged array still contains "*", set it as only value !in_array('*', $sender_acl_merged) ?: $sender_acl_merged = array('*'); - $stmt = $pdo->prepare("DELETE FROM `sender_acl` WHERE `external` = 0 AND `logged_in_as` = :username"); + $stmt = $pdo->prepare("DELETE FROM `sender_acl` WHERE `external` = 0 AND `group_id` IS NULL AND `logged_in_as` = :username"); $stmt->execute(array( ':username' => $username )); @@ -3039,7 +3069,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { } } else { - $stmt = $pdo->prepare("DELETE FROM `sender_acl` WHERE `external` = 0 AND `logged_in_as` = :username"); + $stmt = $pdo->prepare("DELETE FROM `sender_acl` WHERE `external` = 0 AND `group_id` IS NULL AND `logged_in_as` = :username"); $stmt->execute(array( ':username' => $username )); @@ -3080,6 +3110,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { `attributes` = JSON_SET(`attributes`, '$.sieve_access', :sieve_access), `attributes` = JSON_SET(`attributes`, '$.pop3_access', :pop3_access), `attributes` = JSON_SET(`attributes`, '$.relayhost', :relayhost), + `attributes` = JSON_SET(`attributes`, '$.shared', :shared), `attributes` = JSON_SET(`attributes`, '$.smtp_access', :smtp_access), `attributes` = JSON_SET(`attributes`, '$.eas_access', :eas_access), `attributes` = JSON_SET(`attributes`, '$.dav_access', :dav_access), @@ -3102,6 +3133,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { ':dav_access' => $dav_access, ':recovery_email' => $pw_recovery_email, ':relayhost' => $relayhost, + ':shared' => strval($shared), ':username' => $username, ':authsource' => $authsource )); @@ -3258,7 +3290,12 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { "imapsync" => ['user2'], 'bcc_maps' => ['local_dest', 'bcc_dest'], 'recipient_maps' => ['old_dest', 'new_dest'], - 'sender_acl' => ['logged_in_as', 'send_as'] + 'sender_acl' => ['logged_in_as', 'send_as'], + 'identity_link' => ['username'], + 'mailbox_group_imap_grant' => ['owner'], + 'mailbox_group_sogo_grant' => ['owner'], + 'mailbox_group_sogo_acl' => ['c_uid'], + 'mailbox_group_subscription' => ['username', 'owner'] ]; foreach ($tables as $table => $columns) { foreach ($columns as $column) { @@ -3272,6 +3309,8 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { // Sync sources created by / targeting the mailbox and its OAuth tokens (owner); a PDOException rolls back below \Mailcow\Imapsync\ImapsyncModule::fromGlobals()->sources->onAccountRenamed($old_username, $new_username); + // Group memberships and send-as grants follow, group aliases are rebuilt + \Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->hooks->onMailboxRenamed($old_username, $new_username); // Update c_uid, c_name and mail in _sogo_static_view table $pdo->prepare("UPDATE _sogo_static_view SET c_uid = :new_username, c_name = :new_username2, mail = :new_username3 WHERE c_uid = :old_username") @@ -3370,10 +3409,27 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { $attribute_hash = sha1(json_encode($mbox_template_data["attributes"])); $is_now = mailbox('get', 'mailbox_details', $_data['username']); $name = ltrim(rtrim($_data['name'], '>'), '<'); - if ($is_now['attributes']['attribute_hash'] == $attribute_hash && $is_now['name'] == $name) + // Last applied template, null for mailboxes created before it was recorded + $applied_template = $is_now['attributes']['template'] ?? null; + $stmt_template = $pdo->prepare("UPDATE `mailbox` SET `attributes` = JSON_SET(`attributes`, '$.template', :template) WHERE `username` = :username"); + if ($is_now['attributes']['attribute_hash'] == $attribute_hash && $is_now['name'] == $name) { + if ($applied_template === null) { + $stmt_template->execute(array(':template' => $_data['template'], ':username' => $_data['username'])); + } return true; + } $mbox_template_data = json_decode($mbox_template_data["attributes"], true); + // Any manual edit clears attribute_hash: re-applying the same template must not undo a manual (de)activation + if ($applied_template === null || $applied_template === $_data['template']) { + unset($mbox_template_data['active']); + } + // Login disabled by the IdP sync is only lifted by the sync + $stmt = $pdo->prepare("SELECT `idp_disabled` FROM `identity_link` WHERE `username` = :username"); + $stmt->execute(array(':username' => $_data['username'])); + if (intval($stmt->fetchColumn()) == 1) { + unset($mbox_template_data['active']); + } $mbox_template_data['attribute_hash'] = $attribute_hash; $mbox_template_data['name'] = $name; $quarantine_attributes = array('username' => $_data['username']); @@ -3416,6 +3472,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { if ($result === false) return $result; $result = acl('edit', 'user', $acl_attributes); if ($result === false) return $result; + $stmt_template->execute(array(':template' => $_data['template'], ':username' => $_data['username'])); $_SESSION['return'] = array(); return true; @@ -3528,6 +3585,8 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { ":template" => $_data["template"] , ":attributes" => json_encode($attr) )); + // Mailboxes with this effective group template get the new settings + \Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->templateChanged((int)$id); } @@ -3959,7 +4018,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { } // Return array $data['sender_acl_domains/addresses']['ro'] with read-only objects // Return array $data['sender_acl_domains/addresses']['rw'] with read-write objects (can be deleted) - $stmt = $pdo->prepare("SELECT REPLACE(`send_as`, '@', '') AS `send_as` FROM `sender_acl` WHERE `logged_in_as` = :logged_in_as AND `external` = '0' AND (`send_as` LIKE '@%' OR `send_as` = '*')"); + $stmt = $pdo->prepare("SELECT REPLACE(`send_as`, '@', '') AS `send_as` FROM `sender_acl` WHERE `logged_in_as` = :logged_in_as AND `external` = '0' AND `group_id` IS NULL AND (`send_as` LIKE '@%' OR `send_as` = '*')"); $stmt->execute(array(':logged_in_as' => $_data)); $domain_rows = $stmt->fetchAll(PDO::FETCH_ASSOC); while ($domain_row = array_shift($domain_rows)) { @@ -3978,7 +4037,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { $data['sender_acl_domains']['rw'][] = $domain_row['send_as']; } } - $stmt = $pdo->prepare("SELECT `send_as` FROM `sender_acl` WHERE `logged_in_as` = :logged_in_as AND `external` = '0' AND (`send_as` NOT LIKE '@%' AND `send_as` != '*')"); + $stmt = $pdo->prepare("SELECT `send_as` FROM `sender_acl` WHERE `logged_in_as` = :logged_in_as AND `external` = '0' AND `group_id` IS NULL AND (`send_as` NOT LIKE '@%' AND `send_as` != '*')"); $stmt->execute(array(':logged_in_as' => $_data)); $address_rows = $stmt->fetchAll(PDO::FETCH_ASSOC); while ($address_row = array_shift($address_rows)) { @@ -4436,7 +4495,9 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { `sogo_visible`, `sender_allowed`, `created`, - `modified` + `modified`, + `group_id`, + (SELECT `name` FROM `mailbox_group` WHERE `mailbox_group`.`id` = `alias`.`group_id`) AS `group_name` FROM `alias` WHERE (`id` = :id OR `address` = :address) AND `address` != `goto`"); $stmt->execute(array( @@ -4469,6 +4530,9 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { $aliasdata['sogo_visible'] = $row['sogo_visible']; $aliasdata['sogo_visible_int'] = $row['sogo_visible']; $aliasdata['sender_allowed'] = $row['sender_allowed']; + // Distribution address of a mailbox group, read-only here + $aliasdata['group_id'] = $row['group_id']; + $aliasdata['group_name'] = $row['group_name']; $aliasdata['created'] = $row['created']; $aliasdata['modified'] = $row['modified']; if (!hasDomainAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $aliasdata['domain'])) { @@ -4909,7 +4973,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { $mailboxdata['is_relayed'] = $row['backupmx']; // Internal send-as ACL for this mailbox, mirrors the sender_acl field accepted by edit/mailbox $mailboxdata['sender_acl'] = array(); - $stmt = $pdo->prepare("SELECT `send_as` FROM `sender_acl` WHERE `logged_in_as` = :username AND `external` = '0'"); + $stmt = $pdo->prepare("SELECT `send_as` FROM `sender_acl` WHERE `logged_in_as` = :username AND `external` = '0' AND `group_id` IS NULL"); $stmt->execute(array(':username' => $_data)); $sender_acl_rows = $stmt->fetchAll(PDO::FETCH_ASSOC); foreach ($sender_acl_rows as $sender_acl_row) { @@ -5283,6 +5347,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { $stmt->execute(array( ':domain' => $domain, )); + \Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->domainDeleted($domain); $stmt = $pdo->prepare("DELETE FROM `imapsync_source_domain` WHERE `domain` = :domain"); $stmt->execute(array( ':domain' => $domain, @@ -5410,6 +5475,14 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { ); continue; } + if (!empty($alias_data['group_id'])) { + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr), + 'msg' => array('alias_group_managed', htmlspecialchars($alias_data['address'])) + ); + continue; + } // Track affected mailboxes for SOGo update (capture before deletion) if (!empty($alias_data['goto'])) { @@ -5430,6 +5503,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { $stmt->execute(array( ':alias_address' => $alias_data['address'] )); + \Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->addressDeleted($alias_data['address']); $_SESSION['return'][] = array( 'type' => 'success', 'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr), @@ -5470,6 +5544,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { $stmt->execute(array( ':alias_domain' => $alias_domain, )); + \Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->domainDeleted($alias_domain); $stmt = $pdo->prepare("DELETE FROM `alias` WHERE `domain` = :alias_domain"); $stmt->execute(array( ':alias_domain' => $alias_domain, @@ -5552,7 +5627,8 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) { 'msg' => 'Could not move maildir to garbage collector: variables local_part and/or domain empty' ); } - $stmt = $pdo->prepare("DELETE FROM `alias` WHERE `goto` = :username"); + \Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->mailboxDeleted($username); + $stmt = $pdo->prepare("DELETE FROM `alias` WHERE `goto` = :username AND `group_id` IS NULL"); $stmt->execute(array( ':username' => $username )); diff --git a/data/web/inc/init_db.inc.php b/data/web/inc/init_db.inc.php index 02a876a86..2afb086b3 100644 --- a/data/web/inc/init_db.inc.php +++ b/data/web/inc/init_db.inc.php @@ -4,7 +4,20 @@ function init_db_schema() try { global $pdo; - $db_version = "22102026_1200"; + // Defined once as DB_VERSION in docker-compose.yml + $db_version = (string)getenv('DB_VERSION'); + if ($db_version === '') { + if (php_sapi_name() == "cli") { + echo "DB initialization failed: DB_VERSION is not set" . PHP_EOL; + } else { + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__), + 'msg' => 'Database not initialized: DB_VERSION is not set.' + ); + } + return false; + } $stmt = $pdo->query("SHOW TABLES LIKE 'versions'"); $num_results = count($stmt->fetchAll(PDO::FETCH_ASSOC)); @@ -174,34 +187,6 @@ function init_db_schema() ), "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC" ), - "alias" => array( - "cols" => array( - "id" => "INT NOT NULL AUTO_INCREMENT", - "address" => "VARCHAR(255) NOT NULL", - "goto" => "TEXT NOT NULL", - "domain" => "VARCHAR(255) NOT NULL", - "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)", - "modified" => "DATETIME ON UPDATE CURRENT_TIMESTAMP", - "private_comment" => "TEXT", - "public_comment" => "TEXT", - "sogo_visible" => "TINYINT(1) NOT NULL DEFAULT '1'", - "internal" => "TINYINT(1) NOT NULL DEFAULT '0'", - "sender_allowed" => "TINYINT(1) NOT NULL DEFAULT '1'", - "active" => "TINYINT(1) NOT NULL DEFAULT '1'" - ), - "keys" => array( - "primary" => array( - "" => array("id") - ), - "unique" => array( - "address" => array("address") - ), - "key" => array( - "domain" => array("domain") - ) - ), - "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC" - ), "api" => array( "cols" => array( "id" => "INT NOT NULL AUTO_INCREMENT", @@ -226,20 +211,6 @@ function init_db_schema() ), "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC" ), - "sender_acl" => array( - "cols" => array( - "id" => "INT NOT NULL AUTO_INCREMENT", - "logged_in_as" => "VARCHAR(255) NOT NULL", - "send_as" => "VARCHAR(255) NOT NULL", - "external" => "TINYINT(1) NOT NULL DEFAULT '0'" - ), - "keys" => array( - "primary" => array( - "" => array("id") - ) - ), - "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC" - ), "templates" => array( "cols" => array( "id" => "INT NOT NULL AUTO_INCREMENT", @@ -418,6 +389,360 @@ function init_db_schema() ), "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC" ), + "mailbox_group" => array( + "cols" => array( + "id" => "INT NOT NULL AUTO_INCREMENT", + "domain" => "VARCHAR(255) NOT NULL", + "name" => "VARCHAR(100) NOT NULL", + "description" => "VARCHAR(255) NOT NULL DEFAULT ''", + // distribution address, maintained as alias row with group_id + "address" => "VARCHAR(255) NULL DEFAULT NULL", + // members may send as the address + "sender_allowed" => "TINYINT(1) NOT NULL DEFAULT '0'", + "sogo_visible" => "TINYINT(1) NOT NULL DEFAULT '0'", + "internal" => "TINYINT(1) NOT NULL DEFAULT '0'", + "template_id" => "INT NULL DEFAULT NULL", + // highest priority wins when a mailbox is in several groups with a template + "priority" => "INT NOT NULL DEFAULT '0'", + // IdP group id: set = memberships are synced from the IdP + "idp_ref" => "VARCHAR(255) NULL DEFAULT NULL", + "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)", + "modified" => "DATETIME ON UPDATE CURRENT_TIMESTAMP", + "active" => "TINYINT(1) NOT NULL DEFAULT '1'" + ), + "keys" => array( + "primary" => array( + "" => array("id") + ), + "unique" => array( + "domain_name" => array("domain", "name"), + "address" => array("address"), + "idp_ref" => array("idp_ref") + ), + "fkey" => array( + "fk_mailbox_group_domain" => array( + "col" => "domain", + "ref" => "domain.domain", + "delete" => "CASCADE", + "update" => "NO ACTION" + ), + "fk_mailbox_group_template" => array( + "col" => "template_id", + "ref" => "templates.id", + "delete" => "SET NULL", + "update" => "NO ACTION" + ) + ) + ), + "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC" + ), + "mailbox_group_member" => array( + "cols" => array( + "group_id" => "INT NOT NULL", + "username" => "VARCHAR(255) NOT NULL", + "source" => "ENUM('manual', 'idp') NOT NULL DEFAULT 'manual'", + "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)" + ), + "keys" => array( + "primary" => array( + "" => array("group_id", "username") + ), + "key" => array( + "username" => array("username") + ), + "fkey" => array( + "fk_mailbox_group_member_group" => array( + "col" => "group_id", + "ref" => "mailbox_group.id", + "delete" => "CASCADE", + "update" => "NO ACTION" + ), + "fk_mailbox_group_member_mailbox" => array( + "col" => "username", + "ref" => "mailbox.username", + "delete" => "CASCADE", + "update" => "NO ACTION" + ) + ) + ), + "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC" + ), + "mailbox_group_send_as" => array( + "cols" => array( + "group_id" => "INT NOT NULL", + // address or @domain the members may send as + "address" => "VARCHAR(255) NOT NULL" + ), + "keys" => array( + "primary" => array( + "" => array("group_id", "address") + ), + "key" => array( + "address" => array("address") + ), + "fkey" => array( + "fk_mailbox_group_send_as_group" => array( + "col" => "group_id", + "ref" => "mailbox_group.id", + "delete" => "CASCADE", + "update" => "NO ACTION" + ) + ) + ), + "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC" + ), + "mailbox_group_imap_grant" => array( + "cols" => array( + "id" => "INT NOT NULL AUTO_INCREMENT", + "group_id" => "INT NOT NULL", + // mailbox whose folders the members may access + "owner" => "VARCHAR(255) NOT NULL", + "rights" => "ENUM('read', 'write', 'full') NOT NULL DEFAULT 'read'", + // 1 = the group-grants cron subscribes the members to the folders (once per member) + "subscribe" => "TINYINT(1) NOT NULL DEFAULT '0'", + // removing = the ACL is deleted in Dovecot, then the row + "state" => "ENUM('pending', 'applied', 'failed', 'removing') NOT NULL DEFAULT 'pending'", + "last_error" => "TEXT", + "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)", + "modified" => "DATETIME ON UPDATE CURRENT_TIMESTAMP" + ), + "keys" => array( + "primary" => array( + "" => array("id") + ), + "unique" => array( + "group_owner" => array("group_id", "owner") + ), + "key" => array( + "owner" => array("owner") + ), + "fkey" => array( + "fk_mailbox_group_imap_grant_group" => array( + "col" => "group_id", + "ref" => "mailbox_group.id", + "delete" => "CASCADE", + "update" => "NO ACTION" + ), + "fk_mailbox_group_imap_grant_owner" => array( + "col" => "owner", + "ref" => "mailbox.username", + "delete" => "CASCADE", + "update" => "NO ACTION" + ) + ) + ), + "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC" + ), + "mailbox_group_sogo_grant" => array( + "cols" => array( + "id" => "INT NOT NULL AUTO_INCREMENT", + "group_id" => "INT NOT NULL", + "owner" => "VARCHAR(255) NOT NULL", + "folder_type" => "ENUM('Calendar', 'Contacts') NOT NULL DEFAULT 'Calendar'", + "folder" => "VARCHAR(255) NOT NULL DEFAULT 'personal'", + "access" => "ENUM('read', 'write') NOT NULL DEFAULT 'read'", + // 1 = the group-grants cron subscribes the members to the folder (once per member) + "subscribe" => "TINYINT(1) NOT NULL DEFAULT '0'", + // pending = the owner has not opened SOGo yet, the folder does not exist + "state" => "ENUM('pending', 'applied', 'failed') NOT NULL DEFAULT 'pending'", + "last_error" => "TEXT", + "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)", + "modified" => "DATETIME ON UPDATE CURRENT_TIMESTAMP" + ), + "keys" => array( + "primary" => array( + "" => array("id") + ), + "unique" => array( + "group_folder" => array("group_id", "owner", "folder_type", "folder") + ), + "key" => array( + "owner" => array("owner") + ), + "fkey" => array( + "fk_mailbox_group_sogo_grant_group" => array( + "col" => "group_id", + "ref" => "mailbox_group.id", + "delete" => "CASCADE", + "update" => "NO ACTION" + ), + "fk_mailbox_group_sogo_grant_owner" => array( + "col" => "owner", + "ref" => "mailbox.username", + "delete" => "CASCADE", + "update" => "NO ACTION" + ) + ) + ), + "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC" + ), + // sogo_acl rows written for a grant, so only those are ever removed again. No FK: rows of grants + // removed by a cascade stay until their sogo_acl rows are deleted (GroupRepository::cleanupSogoAcl()) + "mailbox_group_sogo_acl" => array( + "cols" => array( + "acl_id" => "INT NOT NULL", + "grant_id" => "INT NOT NULL", + "c_uid" => "VARCHAR(255) NOT NULL", + "c_role" => "VARCHAR(80) NOT NULL" + ), + "keys" => array( + "primary" => array( + "" => array("acl_id") + ), + "key" => array( + "grant_id" => array("grant_id") + ) + ), + "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC" + ), + // IMAP and SOGo subscriptions made by the group-grants cron. No FK: rows of grants removed by a cascade stay + // until the members are unsubscribed again + "mailbox_group_subscription" => array( + "cols" => array( + "id" => "INT NOT NULL AUTO_INCREMENT", + "kind" => "ENUM('imap', 'sogo') NOT NULL", + // mailbox_group_imap_grant.id or mailbox_group_sogo_grant.id + "grant_id" => "INT NOT NULL", + "username" => "VARCHAR(255) NOT NULL", + "owner" => "VARCHAR(255) NOT NULL", + // SOGo: Calendar/ or Contacts/, IMAP: empty (all folders of the owner) + "folder" => "VARCHAR(255) NOT NULL DEFAULT ''", + "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)" + ), + "keys" => array( + "primary" => array( + "" => array("id") + ), + "unique" => array( + "grant_username" => array("kind", "grant_id", "username") + ), + "key" => array( + "username" => array("username") + ) + ), + "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC" + ), + "identity_link" => array( + "cols" => array( + "username" => "VARCHAR(255) NOT NULL", + "provider" => "VARCHAR(20) NOT NULL", + // Keycloak user id (= OIDC sub), LDAP objectGUID/entryUUID/... or dn:, OIDC sub; NULL = not linked yet + "external_id" => "VARCHAR(255) NULL DEFAULT NULL", + // 1 = the sync set the mailbox to login disabled (active = 2) + "idp_disabled" => "TINYINT(1) NOT NULL DEFAULT '0'", + // first complete sync run that did not list the user + "missing_since" => "DATETIME NULL DEFAULT NULL", + "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)", + "modified" => "DATETIME ON UPDATE CURRENT_TIMESTAMP" + ), + "keys" => array( + "primary" => array( + "" => array("username") + ), + "unique" => array( + "provider_external_id" => array("provider", "external_id") + ), + "fkey" => array( + "fk_identity_link_mailbox" => array( + "col" => "username", + "ref" => "mailbox.username", + "delete" => "CASCADE", + "update" => "NO ACTION" + ) + ) + ), + "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC" + ), + "identity_sync_run" => array( + "cols" => array( + "id" => "INT NOT NULL AUTO_INCREMENT", + "provider" => "VARCHAR(20) NOT NULL DEFAULT ''", + // run = scheduled or requested, preview = dry run, force = without the deactivation limit + "mode" => "ENUM('run', 'preview', 'force') NOT NULL DEFAULT 'run'", + "status" => "ENUM('pending', 'running', 'ok', 'blocked', 'error') NOT NULL DEFAULT 'pending'", + "requested_by" => "VARCHAR(255) NOT NULL DEFAULT ''", + "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)", + "started" => "DATETIME NULL DEFAULT NULL", + "finished" => "DATETIME NULL DEFAULT NULL", + "summary" => "MEDIUMTEXT" + ), + "keys" => array( + "primary" => array( + "" => array("id") + ), + "key" => array( + "status" => array("status") + ) + ), + "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC" + ), + // alias and sender_acl come after mailbox_group (foreign keys) + "alias" => array( + "cols" => array( + "id" => "INT NOT NULL AUTO_INCREMENT", + "address" => "VARCHAR(255) NOT NULL", + "goto" => "TEXT NOT NULL", + "domain" => "VARCHAR(255) NOT NULL", + "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)", + "modified" => "DATETIME ON UPDATE CURRENT_TIMESTAMP", + "private_comment" => "TEXT", + "public_comment" => "TEXT", + "sogo_visible" => "TINYINT(1) NOT NULL DEFAULT '1'", + "internal" => "TINYINT(1) NOT NULL DEFAULT '0'", + "sender_allowed" => "TINYINT(1) NOT NULL DEFAULT '1'", + "active" => "TINYINT(1) NOT NULL DEFAULT '1'", + // set = distribution address of a mailbox group, read-only in the alias UI + "group_id" => "INT NULL DEFAULT NULL" + ), + "keys" => array( + "primary" => array( + "" => array("id") + ), + "unique" => array( + "address" => array("address"), + "group_id" => array("group_id") + ), + "key" => array( + "domain" => array("domain") + ), + "fkey" => array( + "fk_alias_mailbox_group" => array( + "col" => "group_id", + "ref" => "mailbox_group.id", + "delete" => "CASCADE", + "update" => "NO ACTION" + ) + ) + ), + "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC" + ), + "sender_acl" => array( + "cols" => array( + "id" => "INT NOT NULL AUTO_INCREMENT", + "logged_in_as" => "VARCHAR(255) NOT NULL", + "send_as" => "VARCHAR(255) NOT NULL", + "external" => "TINYINT(1) NOT NULL DEFAULT '0'", + // set = granted through a mailbox group, rebuilt by the group module + "group_id" => "INT NULL DEFAULT NULL" + ), + "keys" => array( + "primary" => array( + "" => array("id") + ), + "key" => array( + "group_id" => array("group_id") + ), + "fkey" => array( + "fk_sender_acl_mailbox_group" => array( + "col" => "group_id", + "ref" => "mailbox_group.id", + "delete" => "CASCADE", + "update" => "NO ACTION" + ) + ) + ), + "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC" + ), "sieve_filters" => array( "cols" => array( "id" => "INT NOT NULL AUTO_INCREMENT", @@ -727,7 +1052,8 @@ function init_db_schema() "mailbox_relayhost" => "TINYINT(1) NOT NULL DEFAULT '1'", "domain_relayhost" => "TINYINT(1) NOT NULL DEFAULT '1'", "domain_desc" => "TINYINT(1) NOT NULL DEFAULT '0'", - "alias_external_goto" => "TINYINT(1) NOT NULL DEFAULT '1'" + "alias_external_goto" => "TINYINT(1) NOT NULL DEFAULT '1'", + "mailbox_groups" => "TINYINT(1) NOT NULL DEFAULT '1'" ), "keys" => array( "primary" => array( @@ -1807,6 +2133,18 @@ function init_db_schema() // fill quarantine.qhash $pdo->query("UPDATE `quarantine` SET `qhash` = SHA2(CONCAT(`id`, `qid`), 256) WHERE ISNULL(`qhash`)"); + // Group rows that lost their group_id (init_db of an older version ran) belong to their group again, so the + // group can update its alias and revokes send-as rights of former members. An active group without rows of its + // own for a grant only exists after such a downgrade; manual rows next to group rows stay manual. + $pdo->query("UPDATE `alias` a JOIN `mailbox_group` g ON g.`address` = a.`address` SET a.`group_id` = g.`id` WHERE a.`group_id` IS NULL"); + $pdo->query("UPDATE `sender_acl` s + JOIN `mailbox_group_member` m ON m.`username` = s.`logged_in_as` + JOIN `mailbox_group` g ON g.`id` = m.`group_id` AND g.`active` = 1 + JOIN `mailbox_group_send_as` ga ON ga.`group_id` = m.`group_id` AND ga.`address` = s.`send_as` + SET s.`group_id` = m.`group_id` + WHERE s.`group_id` IS NULL AND s.`external` = 0 + AND NOT EXISTS (SELECT 1 FROM (SELECT `group_id` FROM `sender_acl` WHERE `group_id` IS NOT NULL) own WHERE own.`group_id` = m.`group_id`)"); + } catch (PDOException $e) { if (php_sapi_name() == "cli") { echo "DB initialization failed: " . print_r($e, true) . PHP_EOL; diff --git a/data/web/inc/lib/mailcow/ApiKey/Service/ApiKeyService.php b/data/web/inc/lib/mailcow/ApiKey/Service/ApiKeyService.php index 73a518db3..d7b82a91d 100644 --- a/data/web/inc/lib/mailcow/ApiKey/Service/ApiKeyService.php +++ b/data/web/inc/lib/mailcow/ApiKey/Service/ApiKeyService.php @@ -30,9 +30,7 @@ class ApiKeyService /** @throws AccessDenied unless an admin (login or read-write API key) */ public function requireAdmin(): void { - if (!$this->context->isAdmin() || $this->context->isReadOnlyApi()) { - throw new AccessDenied(); - } + $this->context->requireAdmin(); } /** @return ApiKey[] all keys, service keys first; [] for other callers */ @@ -146,7 +144,7 @@ class ApiKeyService private function canRead(): bool { - return $this->context->isAdmin() && !$this->context->isReadOnlyApi(); + return $this->context->hasAdminRights() && !$this->context->isReadOnlyApi(); } /** @throws AccessDenied when missing, UserError api_key_service_locked for service keys */ diff --git a/data/web/inc/lib/mailcow/Auth/AuthModule.php b/data/web/inc/lib/mailcow/Auth/AuthModule.php new file mode 100644 index 000000000..751ad0fe5 --- /dev/null +++ b/data/web/inc/lib/mailcow/Auth/AuthModule.php @@ -0,0 +1,36 @@ +settings, $identity->links, MailboxGroupModule::create($pdo, $context)->templates)); + } + + /** Logins run before a session exists, so the default context is the system */ + public static function fromGlobals(?Context $context = null): self + { + $settings = $GLOBALS['iam_settings'] ?? null; + return self::create($GLOBALS['pdo'], $context ?? Context::system(), is_array($settings) ? $settings : identity_provider('get')); + } +} diff --git a/data/web/inc/lib/mailcow/Auth/Service/IdpLoginService.php b/data/web/inc/lib/mailcow/Auth/Service/IdpLoginService.php new file mode 100644 index 000000000..bc9833398 --- /dev/null +++ b/data/web/inc/lib/mailcow/Auth/Service/IdpLoginService.php @@ -0,0 +1,70 @@ +settings->mappedTemplate((array)$values); + } + + /** Template for the login of an existing mailbox: its effective group template, else the mapped one */ + public function templateFor(string $username, ?string $mapped): ?string + { + try { + return $this->templates->templateForLogin($username, $mapped); + } catch (Throwable $e) { + error_log('mailcow: group template lookup failed for ' . $username . ': ' . $e->getMessage()); + return $mapped; + } + } + + /** The IdP user may open the mailbox, an unlinked mailbox gets linked */ + public function verifyLink(string $provider, string $username, string $externalId): bool + { + try { + return $this->links->verify($provider, $username, $externalId); + } catch (Throwable $e) { + error_log('mailcow: IdP link check failed for ' . $username . ': ' . $e->getMessage()); + return false; + } + } + + /** Before a mailbox is created on login: the IdP user must not own another mailbox */ + public function mayCreate(string $provider, string $username, string $externalId): bool + { + try { + return $this->links->mayCreate($provider, $username, $externalId); + } catch (Throwable $e) { + error_log('mailcow: IdP link check failed for ' . $username . ': ' . $e->getMessage()); + return false; + } + } + + /** Links a mailbox created on login */ + public function storeLink(string $provider, string $username, string $externalId): void + { + try { + $this->links->link($provider, $username, $externalId); + } catch (Throwable $e) { + error_log('mailcow: IdP link could not be stored for ' . $username . ': ' . $e->getMessage()); + } + } +} diff --git a/data/web/inc/lib/mailcow/Core/ApiResponse.php b/data/web/inc/lib/mailcow/Core/ApiResponse.php index 81af09e7f..3caf069d7 100644 --- a/data/web/inc/lib/mailcow/Core/ApiResponse.php +++ b/data/web/inc/lib/mailcow/Core/ApiResponse.php @@ -38,6 +38,12 @@ class ApiResponse return $this->danger($error->msg(), $log); } + /** Something went partly wrong, but the call itself succeeded */ + public function warning(string|array $msg, array $log): void + { + $this->add('warning', $msg, $log); + } + /** Messages collected since the last flush() */ public function messages(): array { diff --git a/data/web/inc/lib/mailcow/Core/Context.php b/data/web/inc/lib/mailcow/Core/Context.php index 86f69e113..e3336af0b 100644 --- a/data/web/inc/lib/mailcow/Core/Context.php +++ b/data/web/inc/lib/mailcow/Core/Context.php @@ -70,6 +70,24 @@ class Context return $this->apiAccess === 'ro'; } + /** An admin, or a legacy call that may ignore ownership (access_all_exception) */ + public function hasAdminRights(): bool + { + return $this->isAdmin() || $this->accessAll; + } + + /** + * Admin rights; a write also needs more than a read-only API key. + * + * @throws AccessDenied + */ + public function requireAdmin(bool $write = true): void + { + if (!$this->hasAdminRights() || ($write && $this->isReadOnlyApi())) { + throw new AccessDenied(); + } + } + public function hasAcl(string $name): bool { return isset($this->acl[$name]) && $this->acl[$name] == '1'; diff --git a/data/web/inc/lib/mailcow/Dovecot/DovecotModule.php b/data/web/inc/lib/mailcow/Dovecot/DovecotModule.php new file mode 100644 index 000000000..ae516d909 --- /dev/null +++ b/data/web/inc/lib/mailcow/Dovecot/DovecotModule.php @@ -0,0 +1,22 @@ +, group=) on every folder of the owner; no rights + * remove it. + * + * @return ?string null on success, else the error of dockerapi + */ + public function setAclAll(string $owner, string $identifier, array $rights): ?string + { + return self::error($this->exec(['cmd' => 'doveadm', 'task' => 'set_acl_all', 'user' => $owner, 'id' => $identifier, + 'rights' => array_values($rights)])); + } + + /** + * Subscribes the users to every folder of the owner they see under Shared//, or unsubscribes them. + * + * @return ?string null on success, else the error of dockerapi + */ + public function subscribeShared(string $owner, array $usernames, bool $unsubscribe = false): ?string + { + return self::error($this->exec(['cmd' => 'doveadm', 'task' => 'subscribe_shared', 'owner' => $owner, + 'users' => array_values($usernames), 'unsubscribe' => $unsubscribe])); + } + + /** Drops the cached userdb results, so changed userdb fields apply at the next login instead of after auth_cache_ttl */ + public function flushAuthCache(array $usernames): void + { + if (!empty($usernames)) { + $this->exec(['cmd' => 'doveadm', 'task' => 'auth_cache_flush', 'users' => array_values($usernames)]); + } + } + + protected function exec(array $fields): mixed + { + return docker('post', 'dovecot-mailcow', 'exec', $fields); + } + + private static function error(mixed $response): ?string + { + $result = json_decode((string)$response, true); + return (($result['type'] ?? '') === 'success') ? null : (string)($result['msg'] ?? 'dockerapi did not answer'); + } +} diff --git a/data/web/inc/lib/mailcow/Identity/Controller/IdentityApiController.php b/data/web/inc/lib/mailcow/Identity/Controller/IdentityApiController.php new file mode 100644 index 000000000..f69051dbd --- /dev/null +++ b/data/web/inc/lib/mailcow/Identity/Controller/IdentityApiController.php @@ -0,0 +1,72 @@ +status->status(); + } catch (UserError) { + return []; + } + } + + /** POST edit/identity-provider-sync: attr mode = preview|run|force */ + public function requestRun(array $attr): bool + { + return $this->handle('edit', 'sync', $attr, function (array $log) use ($attr): bool { + $this->status->requestRun($attr['mode'] ?? 'run'); + return $this->response->success('iam_sync_requested', $log); + }); + } + + /** GET identity-link/ */ + public function getLink(string $username): array + { + return $this->status->link($username) ?? []; + } + + /** POST delete/identity-link: usernames */ + public function unlink(array $items): bool + { + return $this->handle('delete', 'link', $items, function (array $log) use ($items): bool { + foreach ($items as $username) { + $this->status->unlink((string)$username); + $this->response->success(['iam_link_removed', htmlspecialchars((string)$username)], $log); + } + return true; + }); + } + + private function handle(string $action, string $object, mixed $data, callable $work): bool + { + $log = ['identity_provider', $action, $object, $data]; + try { + $result = $work($log); + } catch (UserError $e) { + $result = $this->response->error($e, $log); + } catch (PDOException $e) { + $result = $this->response->danger(['mysql_error', $e->getMessage()], $log); + } + $this->response->flush(); + return $result; + } +} diff --git a/data/web/inc/lib/mailcow/Identity/Directory/Directory.php b/data/web/inc/lib/mailcow/Identity/Directory/Directory.php new file mode 100644 index 000000000..0951045b1 --- /dev/null +++ b/data/web/inc/lib/mailcow/Identity/Directory/Directory.php @@ -0,0 +1,21 @@ +paged('/users', ['briefRepresentation' => 'false']) as $row) { + if (isset($row['id'])) { + $user = self::user($row); + $users[$user->id] = $user; + } + } + return new Listing($users, $withGroups ? $this->groups($users) : null); + } + + /** A user of the admin REST API */ + public static function user(array $row): DirectoryUser + { + $email = (isset($row['email']) && $row['email'] !== '') ? strtolower((string)$row['email']) : null; + return new DirectoryUser((string)$row['id'], $email, trim(($row['firstName'] ?? '') . ' ' . ($row['lastName'] ?? '')), + !empty($row['enabled']), array_map('strval', (array)($row['attributes']['mailcow_template'] ?? []))); + } + + /** + * @param array $users + * @return array selected groups, members limited to listed users + */ + private function groups(array $users): array + { + $groups = []; + foreach ($this->paged('/groups', ['briefRepresentation' => 'false']) as $row) { + $this->collect($row, $groups); + } + foreach ($groups as $id => $group) { + foreach ($this->paged('/groups/' . rawurlencode((string)$id) . '/members', ['briefRepresentation' => 'true']) as $member) { + if (isset($member['id'], $users[$member['id']])) { + $group->memberIds[] = (string)$member['id']; + } + } + } + return $groups; + } + + /** Adds the group and its subgroups that match the configured paths (Keycloak >= 23 lists children separately) */ + private function collect(array $row, array &$groups): void + { + $path = (string)($row['path'] ?? '/' . ($row['name'] ?? '')); + if ($this->selected($path)) { + $mail = $row['attributes']['mail'][0] ?? null; + $groups[(string)$row['id']] = new DirectoryGroup((string)$row['id'], (string)($row['name'] ?? $path), + is_string($mail) && $mail !== '' ? strtolower($mail) : null); + } + $children = $row['subGroups'] ?? []; + if (empty($children) && (int)($row['subGroupCount'] ?? 0) > 0) { + $children = $this->paged('/groups/' . rawurlencode((string)$row['id']) . '/children', ['briefRepresentation' => 'false']); + } + foreach ($children as $child) { + $this->collect($child, $groups); + } + } + + /** '/a' exactly, '/a/*' every group below /a, '/*' every group */ + private function selected(string $path): bool + { + foreach ($this->settings->groupPaths as $pattern) { + if ($pattern === $path || (str_ends_with($pattern, '/*') && str_starts_with($path, substr($pattern, 0, -1)))) { + return true; + } + } + return false; + } + + /** @return array[] all rows of a paged list endpoint */ + private function paged(string $path, array $query): array + { + $rows = []; + for ($first = 0; ; $first += self::PAGE) { + $page = array_values($this->client->get($path, $query + ['first' => $first, 'max' => self::PAGE])); + $rows = array_merge($rows, $page); + if (count($page) < self::PAGE) { + return $rows; + } + } + } +} diff --git a/data/web/inc/lib/mailcow/Identity/Directory/LdapDirectory.php b/data/web/inc/lib/mailcow/Identity/Directory/LdapDirectory.php new file mode 100644 index 000000000..5ebab7eb8 --- /dev/null +++ b/data/web/inc/lib/mailcow/Identity/Directory/LdapDirectory.php @@ -0,0 +1,240 @@ +settings; + $userFilter = $this->userFilter(); + $disabled = []; + if ($s->disabledFilter !== '') { + foreach ($this->search($s->basedn, '(&' . $userFilter . self::wrap($s->disabledFilter) . ')', ['dn']) as $entry) { + $disabled[strtolower((string)$entry['dn'])] = true; + } + } + $attributes = array_merge([$s->usernameField, 'displayname', 'cn', 'useraccountcontrol'], + ($s->attributeField !== '') ? [$s->attributeField] : [], + self::idAttributes($s->idAttribute), + ($withGroups && $s->groupMemberMode === 'memberof') ? ['memberof'] : []); + $users = []; + $memberOf = []; + foreach ($this->search($s->basedn, $userFilter, array_values(array_unique($attributes))) as $entry) { + $dn = strtolower((string)$entry['dn']); + $email = self::first($entry, $s->usernameField); + $uac = self::first($entry, 'useraccountcontrol'); + $user = new DirectoryUser(self::entryId($entry, $s->idAttribute), + ($email === null) ? null : strtolower($email), + self::first($entry, 'displayname') ?? self::first($entry, 'cn') ?? '', + !isset($disabled[$dn]) && !($uac !== null && ((int)$uac & self::UAC_DISABLED)), + ($s->attributeField !== '') ? self::values($entry, $s->attributeField) : [], + $dn); + $users[$user->id] = $user; + $memberOf[$user->id] = array_map('strtolower', self::values($entry, 'memberof')); + } + return new Listing($users, $withGroups ? $this->groups($users, $memberOf, $userFilter) : null); + } + + /** Attributes entryId() reads */ + public static function idAttributes(string $configured): array + { + return ($configured !== '') ? [$configured] : self::ID_ATTRIBUTES; + } + + /** + * Stable id of an entry: the configured attribute, else objectGUID (as GUID string), entryUUID, nsUniqueId, + * ipaUniqueID, else the DN. Also used at login, with an entry of an LdapRecord raw query. + */ + public static function entryId(array $entry, string $configured = ''): string + { + foreach (self::idAttributes($configured) as $attribute) { + $value = self::first($entry, $attribute); + if ($value !== null && $value !== '') { + return ($attribute === 'objectguid' && strlen($value) === 16) ? self::guid($value) : strtolower($value); + } + } + return 'dn:' . strtolower((string)(self::first($entry, 'dn') ?? '')); + } + + /** + * @param array $users + * @param array $memberOf user id => lowercase group DNs + * @return array + */ + private function groups(array $users, array $memberOf, string $userFilter): array + { + $s = $this->settings; + if ($s->groupFilter === '') { + throw new DirectoryException('The LDAP group filter is empty'); + } + $userIds = []; + foreach ($users as $user) { + $userIds[$user->dn] = $user->id; + } + $attributes = array_merge([$s->groupNameAttribute, 'mail'], self::ID_ATTRIBUTES, + ($s->groupMemberMode === 'member') ? [$s->groupMemberAttribute] : []); + $groups = []; + $groupIds = []; + foreach ($this->search(($s->groupBasedn !== '') ? $s->groupBasedn : $s->basedn, self::wrap($s->groupFilter), + array_values(array_unique($attributes))) as $entry) { + $dn = strtolower((string)$entry['dn']); + $mail = self::first($entry, 'mail'); + $group = new DirectoryGroup(self::entryId($entry), self::first($entry, $s->groupNameAttribute) ?? $dn, + ($mail === null) ? null : strtolower($mail)); + if ($s->groupMemberMode === 'member') { + foreach (array_keys($entry) as $key) { + // AD returns large member lists in ranges; a partial list would remove members + if (is_string($key) && str_starts_with($key, $s->groupMemberAttribute . ';range=')) { + throw new DirectoryException('LDAP returned a ranged member list for ' . $dn . ', use the memberOf or AD mode'); + } + } + foreach (self::values($entry, $s->groupMemberAttribute) as $memberDn) { + if (isset($userIds[strtolower($memberDn)])) { + $group->memberIds[] = $userIds[strtolower($memberDn)]; + } + } + } + $groups[$group->id] = $group; + $groupIds[$dn] = $group->id; + } + if ($s->groupMemberMode === 'memberof') { + foreach ($memberOf as $userId => $dns) { + foreach ($dns as $dn) { + if (isset($groupIds[$dn])) { + $groups[$groupIds[$dn]]->memberIds[] = (string)$userId; + } + } + } + } elseif ($s->groupMemberMode === 'ad_chain') { + foreach ($groupIds as $dn => $groupId) { + $filter = '(&' . $userFilter . '(memberOf:' . self::AD_IN_CHAIN . ':=' . self::escape($dn) . '))'; + foreach ($this->search($s->basedn, $filter, ['dn']) as $entry) { + $userDn = strtolower((string)$entry['dn']); + if (isset($userIds[$userDn])) { + $groups[$groupId]->memberIds[] = $userIds[$userDn]; + } + } + } + } + foreach ($groups as $group) { + $group->memberIds = array_values(array_unique($group->memberIds)); + } + return $groups; + } + + /** Users of the configured filter that have the username attribute */ + private function userFilter(): string + { + $filter = ($this->settings->filter !== '') ? self::wrap($this->settings->filter) : '(objectClass=*)'; + return '(&' . $filter . '(' . $this->settings->usernameField . '=*))'; + } + + /** + * Paged search that fails instead of returning a partial result. + * + * @return array[] entries as returned by ldap_get_entries() + * @throws DirectoryException + */ + protected function search(string $base, string $filter, array $attributes): array + { + if ($this->connection === null) { + throw new DirectoryException('No connection to the LDAP server'); + } + $link = $this->connection->getLdapConnection()->getConnection(); + $entries = []; + $cookie = ''; + $paged = true; + while (true) { + $controls = $paged ? [['oid' => LDAP_CONTROL_PAGEDRESULTS, 'iscritical' => true, + 'value' => ['size' => self::PAGE, 'cookie' => $cookie]]] : []; + $result = @ldap_search($link, $base, $filter, $attributes, 0, 0, 0, LDAP_DEREF_NEVER, $controls); + if ($result === false) { + throw new DirectoryException('LDAP search failed: ' . ldap_error($link)); + } + $responseControls = []; + if (!ldap_parse_result($link, $result, $code, $matched, $message, $referrals, $responseControls)) { + throw new DirectoryException('LDAP result could not be read: ' . ldap_error($link)); + } + // 12 = unavailableCriticalExtension: no paging on this server, search once without it + if ($code === 12 && $paged && $cookie === '') { + $paged = false; + continue; + } + if ($code !== 0) { + throw new DirectoryException('LDAP search incomplete (code ' . $code . '): ' . (($message !== '') ? $message : ldap_err2str($code))); + } + $page = ldap_get_entries($link, $result); + for ($i = 0; $i < (int)($page['count'] ?? 0); $i++) { + $entries[] = $page[$i]; + } + $cookie = $paged ? (string)($responseControls[LDAP_CONTROL_PAGEDRESULTS]['value']['cookie'] ?? '') : ''; + if ($cookie === '') { + return $entries; + } + } + } + + /** First value of an attribute: ldap_get_entries() format or LdapRecord attributes */ + private static function first(array $entry, string $attribute): ?string + { + $values = self::values($entry, $attribute); + return $values[0] ?? null; + } + + /** @return string[] */ + private static function values(array $entry, string $attribute): array + { + $raw = $entry[$attribute] ?? $entry[strtolower($attribute)] ?? null; + if (!is_array($raw)) { + return is_scalar($raw) ? [(string)$raw] : []; + } + unset($raw['count']); + return array_values(array_map('strval', array_filter($raw, 'is_scalar'))); + } + + private static function wrap(string $filter): string + { + return str_starts_with($filter, '(') ? $filter : '(' . $filter . ')'; + } + + /** RFC 4515 value escaping */ + private static function escape(string $value): string + { + return str_replace(['\\', '*', '(', ')', "\0"], ['\\5c', '\\2a', '\\28', '\\29', '\\00'], $value); + } + + /** Binary objectGUID as the usual GUID string */ + private static function guid(string $binary): string + { + $hex = bin2hex($binary); + return substr($hex, 6, 2) . substr($hex, 4, 2) . substr($hex, 2, 2) . substr($hex, 0, 2) . '-' + . substr($hex, 10, 2) . substr($hex, 8, 2) . '-' . substr($hex, 14, 2) . substr($hex, 12, 2) . '-' + . substr($hex, 16, 4) . '-' . substr($hex, 20, 12); + } +} diff --git a/data/web/inc/lib/mailcow/Identity/Http/KeycloakClient.php b/data/web/inc/lib/mailcow/Identity/Http/KeycloakClient.php new file mode 100644 index 000000000..c60b2fb02 --- /dev/null +++ b/data/web/inc/lib/mailcow/Identity/Http/KeycloakClient.php @@ -0,0 +1,92 @@ +, decoded JSON. A rejected token is renewed once. + * + * @throws DirectoryException + */ + public function get(string $path, array $query = []): array + { + $url = $this->serverUrl . '/admin/realms/' . rawurlencode($this->realm) . $path . (empty($query) ? '' : '?' . http_build_query($query)); + for ($attempt = 0; $attempt < 2; $attempt++) { + $this->token ??= $this->fetchToken(); + [$code, $body] = $this->send('GET', $url, ['Authorization: Bearer ' . $this->token, 'Accept: application/json'], null); + if ($code === 401 && $attempt === 0) { + $this->token = null; + continue; + } + if ($code !== 200) { + throw new DirectoryException('Keycloak returned HTTP ' . $code . ' for ' . $path); + } + $data = json_decode($body, true); + if (!is_array($data)) { + throw new DirectoryException('Keycloak returned invalid JSON for ' . $path); + } + return $data; + } + throw new DirectoryException('Keycloak rejected the access token of the mailcow client'); + } + + /** @throws DirectoryException */ + private function fetchToken(): string + { + [$code, $body] = $this->send('POST', $this->serverUrl . '/realms/' . rawurlencode($this->realm) . '/protocol/openid-connect/token', + ['Content-Type: application/x-www-form-urlencoded'], + http_build_query(['grant_type' => 'client_credentials', 'client_id' => $this->clientId, 'client_secret' => $this->clientSecret])); + $data = json_decode($body, true); + if ($code !== 200 || !is_array($data) || empty($data['access_token'])) { + throw new DirectoryException('Keycloak token request failed (HTTP ' . $code . ')'); + } + return (string)$data['access_token']; + } + + /** + * @return array{0: int, 1: string} HTTP status and body + * @throws DirectoryException on transport errors + */ + protected function send(string $method, string $url, array $headers, ?string $body): array + { + $curl = curl_init($url); + curl_setopt_array($curl, [ + CURLOPT_RETURNTRANSFER => true, + CURLOPT_CONNECTTIMEOUT => 5, + CURLOPT_TIMEOUT => 30, + CURLOPT_HTTPHEADER => $headers, + ]); + if ($method === 'POST') { + curl_setopt($curl, CURLOPT_POST, true); + curl_setopt($curl, CURLOPT_POSTFIELDS, (string)$body); + } + if ($this->ignoreSslError) { + curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false); + curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 0); + } + $response = curl_exec($curl); + $code = (int)curl_getinfo($curl, CURLINFO_HTTP_CODE); + $error = curl_error($curl); + curl_close($curl); + if ($response === false) { + throw new DirectoryException('Keycloak request failed: ' . $error); + } + return [$code, (string)$response]; + } +} diff --git a/data/web/inc/lib/mailcow/Identity/IdentityModule.php b/data/web/inc/lib/mailcow/Identity/IdentityModule.php new file mode 100644 index 000000000..04effbeb5 --- /dev/null +++ b/data/web/inc/lib/mailcow/Identity/IdentityModule.php @@ -0,0 +1,85 @@ + identity_provider('init'))->sync->runDue(); // cron + * IdentityModule::fromGlobals()->api->getLink($username); // edit page + * + * Logins use the links through Mailcow\Auth (AuthModule::fromGlobals()->idp). + */ +class IdentityModule +{ + public function __construct( + public readonly Settings $settings, + public readonly SyncService $sync, + public readonly LinkService $links, + public readonly StatusService $status, + public readonly IdentityApiController $api + ) { + } + + /** + * @param array $settings identity_provider('get') + * @param ?Closure $ldap returns the bound LDAP connection (identity_provider('init')), called when a run starts + */ + public static function create(PDO $pdo, Context $context, array $settings, ?Closure $ldap = null): self + { + $config = Settings::fromArray($settings); + $repo = new IdentityRepository($pdo); + $runs = new RunRepository($pdo); + $groups = MailboxGroupModule::create($pdo, Context::system()); + $status = new StatusService($config, $repo, $runs, $context); + $directory = fn(): ?Directory => self::directory($config, $ldap); + return new self($config, + new SyncService($config, $directory, $repo, $runs, new SyncPlanner(), $groups->idp, $groups->templates, new LegacyAccounts(), + SogoModule::create()->sogo), + new LinkService($repo), $status, new IdentityApiController($status, new ApiResponse())); + } + + /** Legacy entry point for procedural callers: reads $pdo, $iam_settings and $_SESSION; $context overrides the session caller */ + public static function fromGlobals(?Context $context = null): self + { + $settings = $GLOBALS['iam_settings'] ?? null; + return self::create($GLOBALS['pdo'], $context ?? Context::fromSession($_SESSION ?? []), + is_array($settings) ? $settings : identity_provider('get'), fn(): mixed => $GLOBALS['iam_provider'] ?? null); + } + + private static function directory(Settings $settings, ?Closure $ldap): ?Directory + { + if ($settings->provider === Settings::KEYCLOAK) { + return new KeycloakDirectory(new KeycloakClient($settings->serverUrl, $settings->realm, $settings->clientId, + $settings->clientSecret, $settings->ignoreSslError), $settings); + } + if ($settings->provider === Settings::LDAP) { + $connection = ($ldap === null) ? null : $ldap(); + return new LdapDirectory(($connection instanceof Connection) ? $connection : null, $settings); + } + return null; + } +} diff --git a/data/web/inc/lib/mailcow/Identity/Legacy/LegacyAccounts.php b/data/web/inc/lib/mailcow/Identity/Legacy/LegacyAccounts.php new file mode 100644 index 000000000..4b79ad9da --- /dev/null +++ b/data/web/inc/lib/mailcow/Identity/Legacy/LegacyAccounts.php @@ -0,0 +1,30 @@ +asSystem(fn(): mixed => $this->callCreate($email, $name, $authsource, $template)); + } + + protected function callCreate(string $email, string $name, string $authsource, string $template): mixed + { + [$local, $domain] = explode('@', $email, 2); + return mailbox('add', 'mailbox_from_template', ['domain' => $domain, 'local_part' => $local, 'name' => $name, + 'authsource' => $authsource, 'template' => $template]); + } +} diff --git a/data/web/inc/lib/mailcow/Identity/Model/Account.php b/data/web/inc/lib/mailcow/Identity/Model/Account.php new file mode 100644 index 000000000..ce9e3231d --- /dev/null +++ b/data/web/inc/lib/mailcow/Identity/Model/Account.php @@ -0,0 +1,27 @@ + $users by id + * @param ?array $groups by id, null when groups were not listed + */ + public function __construct(public readonly array $users, public readonly ?array $groups = null) + { + } +} diff --git a/data/web/inc/lib/mailcow/Identity/Model/Settings.php b/data/web/inc/lib/mailcow/Identity/Model/Settings.php new file mode 100644 index 000000000..29ca20403 --- /dev/null +++ b/data/web/inc/lib/mailcow/Identity/Model/Settings.php @@ -0,0 +1,118 @@ +provider = (string)($s['authsource'] ?? ''); + $settings->periodicSync = self::flag($s['periodic_sync'] ?? 0); + $settings->importUsers = self::flag($s['import_users'] ?? 0); + $settings->syncInterval = max(1, (int)($s['sync_interval'] ?? 15)); + $settings->offboarding = self::flag($s['offboarding'] ?? 0); + $settings->offboardingLimit = min(100, max(0, (int)($s['offboarding_limit'] ?? 10))); + $settings->groupSync = self::flag($s['group_sync'] ?? 0); + $settings->groupAutocreate = self::flag($s['group_autocreate'] ?? 1); + $settings->groupDefaultDomain = strtolower(trim((string)($s['group_default_domain'] ?? ''))); + $settings->defaultTemplate = (string)($s['default_template'] ?? ''); + $settings->mappers = array_map('strval', (array)($s['mappers'] ?? [])); + $settings->templates = array_map('strval', (array)($s['templates'] ?? [])); + $settings->serverUrl = rtrim((string)($s['server_url'] ?? ''), '/'); + $settings->realm = (string)($s['realm'] ?? ''); + $settings->clientId = (string)($s['client_id'] ?? ''); + $settings->clientSecret = (string)($s['client_secret'] ?? ''); + $settings->ignoreSslError = self::flag($s['ignore_ssl_error'] ?? 0); + $settings->groupPaths = array_values(array_filter(array_map('trim', explode(',', (string)($s['group_paths'] ?? ''))), 'strlen')); + $settings->basedn = (string)($s['basedn'] ?? ''); + $settings->filter = trim((string)($s['filter'] ?? '')); + $settings->usernameField = strtolower((string)(($s['username_field'] ?? '') ?: 'mail')); + $settings->attributeField = strtolower(trim((string)($s['attribute_field'] ?? ''))); + $settings->idAttribute = strtolower(trim((string)($s['id_attribute'] ?? ''))); + $settings->disabledFilter = trim((string)($s['disabled_filter'] ?? '')); + $settings->groupBasedn = trim((string)($s['group_basedn'] ?? '')); + $settings->groupFilter = trim((string)($s['group_filter'] ?? '')); + $settings->groupNameAttribute = strtolower((string)(($s['group_name_attribute'] ?? '') ?: 'cn')); + $mode = (string)($s['group_member_mode'] ?? 'memberof'); + $settings->groupMemberMode = in_array($mode, self::MEMBER_MODES, true) ? $mode : 'memberof'; + $settings->groupMemberAttribute = strtolower((string)(($s['group_member_attribute'] ?? '') ?: 'member')); + return $settings; + } + + /** Only Keycloak and LDAP can be listed by the sync */ + public function canSync(): bool + { + return in_array($this->provider, [self::KEYCLOAK, self::LDAP], true); + } + + public function syncEnabled(): bool + { + return $this->canSync() && ($this->periodicSync || $this->importUsers || $this->offboarding || $this->groupSync); + } + + /** Template of the first mapping (in configured order) matching one of the values, null if none */ + public function mappedTemplate(array $values): ?string + { + $values = array_map('strval', array_filter($values, 'is_scalar')); + foreach ($this->mappers as $key => $mapper) { + if (in_array($mapper, $values, true) && ($this->templates[$key] ?? '') !== '') { + return $this->templates[$key]; + } + } + return null; + } + + private static function flag(mixed $value): bool + { + return filter_var($value, FILTER_VALIDATE_BOOLEAN); + } +} diff --git a/data/web/inc/lib/mailcow/Identity/Model/State.php b/data/web/inc/lib/mailcow/Identity/Model/State.php new file mode 100644 index 000000000..ce52e07db --- /dev/null +++ b/data/web/inc/lib/mailcow/Identity/Model/State.php @@ -0,0 +1,30 @@ + $accounts mailboxes with the provider as authsource, by username + * @param array $mailboxes username => authsource of every mailbox + * @param string[] $domains mailcow domains + * @param array[] $groups mailbox groups {id, domain, name, idp_ref, template, priority, + * active, members: username => source} + * @param array $effectiveTemplates username => effective group template + * @param array $templateHashes template name => attribute hash + */ + public function __construct( + public readonly array $accounts, + public readonly array $mailboxes = [], + public readonly array $domains = [], + public readonly array $groups = [], + public readonly array $effectiveTemplates = [], + public readonly array $templateHashes = [] + ) { + } +} diff --git a/data/web/inc/lib/mailcow/Identity/Model/SyncPlan.php b/data/web/inc/lib/mailcow/Identity/Model/SyncPlan.php new file mode 100644 index 000000000..2dbc8e796 --- /dev/null +++ b/data/web/inc/lib/mailcow/Identity/Model/SyncPlan.php @@ -0,0 +1,73 @@ + username => external id (adopted by email or relinked) */ + public array $links = []; + /** @var array[] {email, name, template, id}: mailboxes to create */ + public array $creates = []; + /** @var string[] usernames set to login disabled (active = 2) */ + public array $deactivate = []; + /** @var string[] usernames the sync had disabled and the IdP enabled again (active = 1) */ + public array $restore = []; + /** @var string[] usernames whose idp_disabled marker is dropped, active stays (an admin changed it) */ + public array $release = []; + /** @var string[] usernames not listed for the first time (missing_since is set) */ + public array $missing = []; + /** @var string[] usernames listed again (missing_since is cleared) */ + public array $found = []; + /** @var array[] {username, name, template}: existing mailboxes whose name/template is synced; template = legacy mapping */ + public array $updates = []; + /** @var array username => {name, template}: IdP name and legacy mapping of every listed mailbox */ + public array $profiles = []; + /** @var array[] {ref, name, domain, mail}: groups to create for IdP groups */ + public array $groupCreates = []; + /** @var array group id => new name */ + public array $groupRenames = []; + /** @var array group ref => usernames of its IdP members */ + public array $memberships = []; + /** @var int[] linked groups no longer listed; their IdP members are removed */ + public array $orphanedGroups = []; + /** Number of IdP memberships the plan removes (for the guard) */ + public int $membershipRemovals = 0; + /** @var string[] situations an admin has to resolve */ + public array $conflicts = []; + /** Users without email, not in a mailcow domain or without template (not created) */ + public int $skipped = 0; + /** The guard stopped deactivations and membership removals */ + public bool $blocked = false; + + /** Stored with the run and shown in the UI */ + public function summary(): array + { + $summary = ['counts' => [], 'details' => []]; + foreach (['links' => 'links', 'creates' => 'creates', 'deactivate' => 'deactivate', 'restore' => 'restore', + 'release' => 'release', 'missing' => 'missing', 'found' => 'found', 'updates' => 'updates', 'group_creates' => 'groupCreates', + 'group_renames' => 'groupRenames', 'memberships' => 'memberships', 'orphaned_groups' => 'orphanedGroups', + 'conflicts' => 'conflicts'] as $key => $kind) { + $summary['counts'][$key] = count($this->$kind); + } + $summary['counts']['membership_removals'] = $this->membershipRemovals; + $summary['counts']['skipped'] = $this->skipped; + $summary['details'] = [ + 'creates' => array_slice(array_column($this->creates, 'email'), 0, self::DETAILS), + 'deactivate' => array_slice($this->deactivate, 0, self::DETAILS), + 'restore' => array_slice($this->restore, 0, self::DETAILS), + 'missing' => array_slice($this->missing, 0, self::DETAILS), + 'group_creates' => array_slice(array_column($this->groupCreates, 'name'), 0, self::DETAILS), + 'conflicts' => array_slice($this->conflicts, 0, self::DETAILS), + ]; + $summary['blocked'] = $this->blocked; + return $summary; + } +} diff --git a/data/web/inc/lib/mailcow/Identity/Repository/IdentityRepository.php b/data/web/inc/lib/mailcow/Identity/Repository/IdentityRepository.php new file mode 100644 index 000000000..8beecc3e4 --- /dev/null +++ b/data/web/inc/lib/mailcow/Identity/Repository/IdentityRepository.php @@ -0,0 +1,130 @@ + mailboxes with the provider as authsource, by username */ + public function accounts(string $provider): array + { + $rows = $this->query("SELECT m.`username`, m.`name`, m.`active`, + JSON_UNQUOTE(JSON_EXTRACT(m.`attributes`, '$.attribute_hash')) AS `attribute_hash`, + l.`external_id`, l.`idp_disabled`, l.`missing_since` + FROM `mailbox` m + LEFT JOIN `identity_link` l ON l.`username` = m.`username` AND l.`provider` = :p1 + WHERE m.`authsource` = :p2 AND m.`kind` = ''", ['p1' => $provider, 'p2' => $provider])->fetchAll(PDO::FETCH_ASSOC); + $accounts = []; + foreach ($rows as $row) { + $accounts[(string)$row['username']] = new Account((string)$row['username'], (string)$row['name'], (int)$row['active'], + isset($row['external_id']) ? (string)$row['external_id'] : null, (int)($row['idp_disabled'] ?? 0) === 1, + isset($row['missing_since']) ? (string)$row['missing_since'] : null, (string)($row['attribute_hash'] ?? '')); + } + return $accounts; + } + + /** @return array{accounts: int, linked: int, idp_disabled: int, missing: int} mailboxes of the provider */ + public function stats(string $provider): array + { + $row = $this->query("SELECT COUNT(*) AS `accounts`, COUNT(l.`external_id`) AS `linked`, + COALESCE(SUM(l.`idp_disabled`), 0) AS `idp_disabled`, COUNT(l.`missing_since`) AS `missing` + FROM `mailbox` m LEFT JOIN `identity_link` l ON l.`username` = m.`username` AND l.`provider` = :p1 + WHERE m.`authsource` = :p2 AND m.`kind` = ''", ['p1' => $provider, 'p2' => $provider])->fetch(PDO::FETCH_ASSOC); + return array_map('intval', $row); + } + + /** @return array username => authsource of every mailbox (incl. resources) */ + public function mailboxes(): array + { + return $this->query("SELECT `username`, `authsource` FROM `mailbox`")->fetchAll(PDO::FETCH_KEY_PAIR); + } + + /** @return string[] mailcow domains (no alias domains) */ + public function domains(): array + { + return $this->query("SELECT `domain` FROM `domain`")->fetchAll(PDO::FETCH_COLUMN); + } + + /** @return array template name => hash as stored by mailbox_from_template in attributes.attribute_hash */ + public function templateHashes(): array + { + $hashes = []; + foreach ($this->query("SELECT `template`, `attributes` FROM `templates` WHERE `type` = 'mailbox'")->fetchAll(PDO::FETCH_ASSOC) as $row) { + $hashes[(string)$row['template']] = sha1(json_encode($row['attributes'])); + } + return $hashes; + } + + /** @return ?array{provider: string, external_id: string, idp_disabled: int, missing_since: ?string} */ + public function findLink(string $username): ?array + { + $row = $this->query("SELECT `provider`, `external_id`, `idp_disabled`, `missing_since` FROM `identity_link` WHERE `username` = :username", + ['username' => $username])->fetch(PDO::FETCH_ASSOC); + return $row ?: null; + } + + /** Mailbox linked to the IdP user; links of mailboxes that no longer use the provider do not count */ + public function usernameOf(string $provider, string $externalId): ?string + { + $username = $this->query("SELECT l.`username` FROM `identity_link` l + JOIN `mailbox` m ON m.`username` = l.`username` AND m.`authsource` = l.`provider` + WHERE l.`provider` = :provider AND l.`external_id` = :id", ['provider' => $provider, 'id' => $externalId])->fetchColumn(); + return ($username === false) ? null : (string)$username; + } + + /** + * Links the mailbox to the IdP user; an older link of the mailbox is replaced. Callers make sure the IdP user + * is not linked to another mailbox of the provider (usernameOf()); stale links of the id are dropped. + */ + public function link(string $username, string $provider, string $externalId): void + { + $this->transaction(function () use ($username, $provider, $externalId): void { + $this->query("DELETE FROM `identity_link` WHERE `provider` = :provider AND `external_id` = :id AND `username` != :username", + ['provider' => $provider, 'id' => $externalId, 'username' => $username]); + $this->query("INSERT INTO `identity_link` (`username`, `provider`, `external_id`) VALUES (:username, :provider, :id) + ON DUPLICATE KEY UPDATE `provider` = VALUES(`provider`), `external_id` = VALUES(`external_id`), `missing_since` = NULL", + ['username' => $username, 'provider' => $provider, 'id' => $externalId]); + }); + } + + public function unlink(string $username): void + { + $this->query("DELETE FROM `identity_link` WHERE `username` = :username", ['username' => $username]); + } + + /** Marks the IdP mailbox as not listed (now) or listed again; unlinked mailboxes get a link row without id */ + public function setMissing(string $username, string $provider, bool $missing): void + { + $this->query("INSERT INTO `identity_link` (`username`, `provider`, `missing_since`) VALUES (:username, :provider, " + . ($missing ? "NOW()" : "NULL") . ") ON DUPLICATE KEY UPDATE `missing_since` = VALUES(`missing_since`)", + ['username' => $username, 'provider' => $provider]); + } + + /** + * Sets mailbox.active like the mailbox edit does (incl. the mailbox's own alias row) and records whether the + * IdP sync caused it. + */ + public function setActive(string $username, string $provider, int $active, bool $idpDisabled): void + { + $this->transaction(function () use ($username, $provider, $active, $idpDisabled): void { + $this->query("UPDATE `mailbox` SET `active` = :active WHERE `username` = :username", ['active' => $active, 'username' => $username]); + $this->query("UPDATE `alias` SET `active` = :active WHERE `address` = :username", ['active' => $active, 'username' => $username]); + $this->setIdpDisabled($username, $provider, $idpDisabled); + }); + } + + public function setIdpDisabled(string $username, string $provider, bool $idpDisabled): void + { + $this->query("INSERT INTO `identity_link` (`username`, `provider`, `idp_disabled`) VALUES (:username, :provider, :flag) + ON DUPLICATE KEY UPDATE `idp_disabled` = VALUES(`idp_disabled`)", + ['username' => $username, 'provider' => $provider, 'flag' => $idpDisabled ? 1 : 0]); + } +} diff --git a/data/web/inc/lib/mailcow/Identity/Repository/RunRepository.php b/data/web/inc/lib/mailcow/Identity/Repository/RunRepository.php new file mode 100644 index 000000000..ba2e0ed25 --- /dev/null +++ b/data/web/inc/lib/mailcow/Identity/Repository/RunRepository.php @@ -0,0 +1,81 @@ +query("SELECT `id` FROM `identity_sync_run` WHERE `status` = 'pending' AND `mode` = :mode", + ['mode' => $mode])->fetchColumn(); + if ($id !== false) { + return (int)$id; + } + return $this->insertRow('identity_sync_run', ['provider' => $provider, 'mode' => $mode, 'status' => 'pending', + 'requested_by' => $requestedBy]); + } + + /** @return ?array oldest pending request */ + public function nextPending(): ?array + { + $row = $this->query("SELECT * FROM `identity_sync_run` WHERE `status` = 'pending' ORDER BY `id` LIMIT 1")->fetch(PDO::FETCH_ASSOC); + return $row ?: null; + } + + /** A scheduled run (not requested by anyone) */ + public function create(string $provider, string $mode): int + { + return $this->insertRow('identity_sync_run', ['provider' => $provider, 'mode' => $mode, 'status' => 'pending', 'requested_by' => '']); + } + + public function start(int $id): void + { + $this->query("UPDATE `identity_sync_run` SET `status` = 'running', `started` = NOW() WHERE `id` = :id", ['id' => $id]); + } + + public function finish(int $id, string $status, array $summary): void + { + $this->query("UPDATE `identity_sync_run` SET `status` = :status, `finished` = NOW(), `summary` = :summary WHERE `id` = :id", + ['status' => $status, 'summary' => json_encode($summary), 'id' => $id]); + $this->query("DELETE FROM `identity_sync_run` WHERE `id` NOT IN (SELECT `id` FROM (SELECT `id` FROM `identity_sync_run` + ORDER BY `id` DESC LIMIT " . self::KEEP . ") AS `keep`)"); + } + + /** Seconds since the last scheduled run started, null if there was none */ + public function secondsSinceScheduled(): ?int + { + $seconds = $this->query("SELECT TIMESTAMPDIFF(SECOND, MAX(`started`), NOW()) FROM `identity_sync_run` + WHERE `requested_by` = '' AND `mode` = 'run'")->fetchColumn(); + return ($seconds === false || $seconds === null) ? null : (int)$seconds; + } + + /** Runs left in status running by a crashed cron are closed, so they do not hide new runs */ + public function failStale(int $minutes): void + { + $this->query("UPDATE `identity_sync_run` SET `status` = 'error', `finished` = NOW(), + `summary` = JSON_OBJECT('error', 'The sync run did not finish') + WHERE `status` = 'running' AND `started` < NOW() - INTERVAL :minutes MINUTE", ['minutes' => $minutes]); + } + + /** @return array[] newest first, summary decoded */ + public function recent(int $limit = 10): array + { + $rows = $this->query("SELECT * FROM `identity_sync_run` ORDER BY `id` DESC LIMIT " . max(1, $limit))->fetchAll(PDO::FETCH_ASSOC); + foreach ($rows as &$row) { + $row['id'] = (int)$row['id']; + $row['summary'] = ($row['summary'] === null) ? null : json_decode((string)$row['summary'], true); + } + return $rows; + } +} diff --git a/data/web/inc/lib/mailcow/Identity/Service/LinkService.php b/data/web/inc/lib/mailcow/Identity/Service/LinkService.php new file mode 100644 index 000000000..6a136f15c --- /dev/null +++ b/data/web/inc/lib/mailcow/Identity/Service/LinkService.php @@ -0,0 +1,51 @@ +repo->findLink($username); + if ($link !== null && $link['provider'] === $provider && $link['external_id'] !== null) { + return hash_equals((string)$link['external_id'], $externalId); + } + if (!$this->mayCreate($provider, $username, $externalId)) { + return false; + } + $this->repo->link($username, $provider, $externalId); + return true; + } + + /** The IdP user owns no other mailbox (checked before a mailbox is created on login) */ + public function mayCreate(string $provider, string $username, string $externalId): bool + { + $owner = ($externalId === '') ? null : $this->repo->usernameOf($provider, $externalId); + return $externalId !== '' && ($owner === null || $owner === $username); + } + + /** Links a mailbox created on login */ + public function link(string $provider, string $username, string $externalId): void + { + if ($externalId !== '') { + $this->repo->link($username, $provider, $externalId); + } + } +} diff --git a/data/web/inc/lib/mailcow/Identity/Service/StatusService.php b/data/web/inc/lib/mailcow/Identity/Service/StatusService.php new file mode 100644 index 000000000..12118a879 --- /dev/null +++ b/data/web/inc/lib/mailcow/Identity/Service/StatusService.php @@ -0,0 +1,80 @@ +context->requireAdmin(false); + return [ + 'provider' => $this->settings->provider, + 'can_sync' => $this->settings->canSync(), + 'sync_enabled' => $this->settings->syncEnabled(), + 'counts' => $this->repo->stats($this->settings->provider), + 'runs' => $this->runs->recent(), + ]; + } + + /** + * Queues a run for the cron: preview (dry run), run, or force (run without the change limit). + * + * @throws UserError + */ + public function requestRun(mixed $mode): int + { + $this->context->requireAdmin(); + $mode = Input::text($mode); + if (!in_array($mode, self::MODES, true)) { + throw new UserError('iam_sync_mode_invalid'); + } + if (!$this->settings->canSync()) { + throw new UserError('iam_sync_unavailable'); + } + return $this->runs->request($this->settings->provider, $mode, (string)$this->context->username); + } + + /** Link of a mailbox for the mailbox edit page, null if none or not allowed */ + public function link(string $username): ?array + { + $username = strtolower(trim($username)); + if (!($this->context->hasAdminRights() || ($this->context->isDomainAdmin() && $this->context->canAccessMailbox($username)))) { + return null; + } + return $this->repo->findLink($username); + } + + /** + * Drops the link, the mailbox is linked again by email (next run or login). Resolves conflicts, e.g. when an + * address was given to another IdP user. + * + * @throws AccessDenied + */ + public function unlink(string $username): void + { + $this->context->requireAdmin(); + $this->repo->unlink(strtolower(trim($username))); + } +} diff --git a/data/web/inc/lib/mailcow/Identity/Service/SyncPlanner.php b/data/web/inc/lib/mailcow/Identity/Service/SyncPlanner.php new file mode 100644 index 000000000..9870be7c4 --- /dev/null +++ b/data/web/inc/lib/mailcow/Identity/Service/SyncPlanner.php @@ -0,0 +1,311 @@ +accounts as $username => $account) { + if ($account->externalId !== null) { + $owners[$account->externalId] = (string)$username; + } + } + /** @var array $matched username => listed user */ + $matched = []; + /** @var array $candidates email => user to create, template still open */ + $candidates = []; + $duplicates = []; + foreach ($listing->users as $user) { + if (isset($owners[$user->id])) { + $username = $owners[$user->id]; + if ($user->email !== null && $user->email !== $username) { + self::conflict($plan, $username . ' is linked to an IdP user whose email is now ' . $user->email); + } + $matched[$username] = $user; + } elseif ($user->email === null) { + $plan->skipped++; + } elseif (isset($state->accounts[$user->email])) { + $account = $state->accounts[$user->email]; + if ($account->externalId !== null || isset($plan->links[$user->email])) { + self::conflict($plan, $user->email . ' is linked to another IdP user'); + continue; + } + $plan->links[$user->email] = $user->id; + $matched[$user->email] = $user; + } elseif (isset($state->mailboxes[$user->email]) || !$settings->importUsers || !$user->enabled + || !in_array(substr((string)strrchr($user->email, '@'), 1), $state->domains, true)) { + // other authsource, import off, disabled or no mailcow domain + $plan->skipped++; + } elseif (isset($candidates[$user->email]) || isset($duplicates[$user->email])) { + self::conflict($plan, 'Several IdP users have the email ' . $user->email); + unset($candidates[$user->email]); + $duplicates[$user->email] = true; + } else { + $candidates[$user->email] = $user; + } + } + $groups = ($settings->groupSync && $listing->groups !== null) ? $listing->groups : null; + $this->planCreates($settings, $candidates, $groups ?? [], $state, $plan); + $usernames = []; + foreach ($matched as $username => $user) { + $usernames[$user->id] = (string)$username; + } + foreach ($plan->creates as $create) { + $usernames[$create['id']] = $create['email']; + } + if ($groups !== null) { + $this->planGroups($settings, $groups, $state, $usernames, $matched, $plan); + } + $this->planStates($settings, $state, $matched, $plan); + if ($settings->periodicSync) { + $this->planUpdates($settings, $state, $matched, $plan); + } + $active = count(array_filter($state->accounts, fn(Account $a): bool => $a->active === 1)); + $memberships = array_sum(array_map(fn(array $g): int => count(self::idpMembers($g)), $state->groups)); + if (!$force && (count($plan->deactivate) > self::limit($active, $settings->offboardingLimit) + || $plan->membershipRemovals > self::limit($memberships, $settings->offboardingLimit))) { + $plan->blocked = true; + } + return $plan; + } + + /** + * @param array $groups + * @param array $usernames user id => username of matched and new users + */ + private function planGroups(Settings $settings, array $groups, State $state, array $usernames, array $matched, SyncPlan $plan): void + { + $linked = []; + $names = []; + foreach ($state->groups as $group) { + if ($group['idp_ref'] !== null) { + $linked[(string)$group['idp_ref']] = $group; + } + $names[$group['domain']][mb_strtolower($group['name'])] = (int)$group['id']; + } + foreach ($groups as $ref => $directoryGroup) { + $ref = (string)$ref; + $members = []; + foreach ($directoryGroup->memberIds as $id) { + if (isset($usernames[$id])) { + $members[] = $usernames[$id]; + } + } + $current = $linked[$ref] ?? null; + if ($current === null) { + if (!$settings->groupAutocreate) { + continue; + } + $domain = self::groupDomain($settings, $directoryGroup, $state->domains); + if ($domain === null) { + self::conflict($plan, 'IdP group ' . $directoryGroup->name . ' has no mailcow domain'); + continue; + } + if (isset($names[$domain][mb_strtolower($directoryGroup->name)])) { + self::conflict($plan, 'A group ' . $directoryGroup->name . ' exists in ' . $domain . ' and is not linked to the IdP group'); + continue; + } + $names[$domain][mb_strtolower($directoryGroup->name)] = 0; + $plan->groupCreates[] = ['ref' => $ref, 'name' => $directoryGroup->name, 'domain' => $domain, 'mail' => $directoryGroup->mail]; + $plan->memberships[$ref] = self::sorted($members); + continue; + } + $idpMembers = self::idpMembers($current); + // Linked users missing in the listing keep their memberships until they are listed again + foreach ($idpMembers as $username) { + if (isset($state->accounts[$username]) && !isset($matched[$username])) { + $members[] = $username; + } + } + $members = self::sorted($members); + $removed = array_diff($idpMembers, $members); + if (!empty($removed) || !empty(array_diff($members, array_map('strval', array_keys($current['members']))))) { + $plan->memberships[$ref] = $members; + $plan->membershipRemovals += count($removed); + } + if ($directoryGroup->name !== $current['name']) { + $taken = $names[$current['domain']][mb_strtolower($directoryGroup->name)] ?? null; + if ($taken !== null && $taken !== (int)$current['id']) { + self::conflict($plan, 'IdP group ' . $current['name'] . ' was renamed to ' . $directoryGroup->name . ', which exists in ' . $current['domain']); + } else { + $plan->groupRenames[(int)$current['id']] = $directoryGroup->name; + $names[$current['domain']][mb_strtolower($directoryGroup->name)] = (int)$current['id']; + } + } + } + foreach ($linked as $ref => $group) { + if (!isset($groups[$ref])) { + $plan->orphanedGroups[] = (int)$group['id']; + $plan->membershipRemovals += count(self::idpMembers($group)); + } + } + } + + /** + * Template of a new mailbox: the template of its highest-priority linked group (as in TemplateService), else + * the attribute mapping, else the default template. + * + * @param array $candidates + * @param array $groups listed groups, [] without group sync + */ + private function planCreates(Settings $settings, array $candidates, array $groups, State $state, SyncPlan $plan): void + { + $linked = []; + foreach ($state->groups as $group) { + if ($group['idp_ref'] !== null && $group['template'] !== null && $group['active'] === 1) { + $linked[(string)$group['idp_ref']] = $group; + } + } + $groupsOf = []; + foreach ($groups as $ref => $directoryGroup) { + if (isset($linked[(string)$ref])) { + foreach ($directoryGroup->memberIds as $id) { + $groupsOf[$id][] = $linked[(string)$ref]; + } + } + } + foreach ($candidates as $email => $user) { + $best = null; + foreach ($groupsOf[$user->id] ?? [] as $group) { + if ($best === null || $group['priority'] > $best['priority'] || ($group['priority'] === $best['priority'] && $group['id'] < $best['id'])) { + $best = $group; + } + } + $template = $best['template'] ?? $settings->mappedTemplate($user->templateValues) + ?? (($settings->defaultTemplate !== '') ? $settings->defaultTemplate : null); + if ($template === null) { + self::conflict($plan, 'No template matches ' . $email); + continue; + } + $plan->creates[] = ['email' => (string)$email, 'name' => self::name($user->name, ''), 'template' => $template, 'id' => $user->id]; + } + } + + /** @param array $matched */ + private function planStates(Settings $settings, State $state, array $matched, SyncPlan $plan): void + { + foreach ($state->accounts as $username => $account) { + $username = (string)$username; + $user = $matched[$username] ?? null; + if ($user === null && $account->missingSince === null) { + $plan->missing[] = $username; + continue; + } + if ($user !== null && $account->missingSince !== null) { + $plan->found[] = $username; + } + if (!$settings->offboarding) { + continue; + } + // Second complete run without the user counts as removed from the IdP + $disabled = ($user === null) || !$user->enabled; + if ($disabled && !$account->idpDisabled && $account->active === 1) { + $plan->deactivate[] = $username; + } elseif (!$disabled && $account->idpDisabled) { + if ($account->active === 2) { + $plan->restore[] = $username; + } else { + $plan->release[] = $username; + } + } + } + } + + /** + * Name and template of linked mailboxes, like the IdP login does. The planned template is the legacy mapping; + * SyncService applies the effective template again after the group changes of the run. + * + * @param array $matched + */ + private function planUpdates(Settings $settings, State $state, array $matched, SyncPlan $plan): void + { + foreach ($matched as $username => $user) { + $account = $state->accounts[$username]; + $legacy = $settings->mappedTemplate($user->templateValues); + $plan->profiles[$username] = ['name' => self::name($user->name, $account->name), 'template' => $legacy]; + $template = $state->effectiveTemplates[$username] ?? $legacy; + if ($template === null) { + continue; + } + if (!isset($state->templateHashes[$template])) { + self::conflict($plan, 'Template ' . $template . ' does not exist'); + continue; + } + $name = self::name($user->name, $account->name); + if ($name !== $account->name || $state->templateHashes[$template] !== $account->attributeHash) { + $plan->updates[] = ['username' => (string)$username, 'name' => $name, 'template' => $legacy]; + } + } + } + + /** Domain for a new group: the domain of its mail if it is a mailcow domain, else the default group domain */ + private static function groupDomain(Settings $settings, DirectoryGroup $group, array $domains): ?string + { + $domain = ($group->mail !== null) ? substr((string)strrchr($group->mail, '@'), 1) : ''; + if (in_array($domain, $domains, true)) { + return $domain; + } + return in_array($settings->groupDefaultDomain, $domains, true) ? $settings->groupDefaultDomain : null; + } + + /** Mailbox name as mailbox_from_template stores it; an empty IdP name keeps the current one */ + private static function name(string $name, string $current): string + { + $name = ltrim(rtrim(trim($name), '>'), '<'); + return ($name === '') ? $current : $name; + } + + private static function limit(int $base, int $percent): int + { + return max(self::GUARD_MIN, (int)ceil($base * $percent / 100)); + } + + /** @return string[] members of a state group with source idp */ + private static function idpMembers(array $group): array + { + return array_map('strval', array_keys(array_filter($group['members'], fn(string $source): bool => $source === 'idp'))); + } + + private static function sorted(array $usernames): array + { + $usernames = array_values(array_unique(array_map('strval', $usernames))); + sort($usernames); + return $usernames; + } + + private static function conflict(SyncPlan $plan, string $message): void + { + if (!in_array($message, $plan->conflicts, true)) { + $plan->conflicts[] = $message; + } + } +} diff --git a/data/web/inc/lib/mailcow/Identity/Service/SyncService.php b/data/web/inc/lib/mailcow/Identity/Service/SyncService.php new file mode 100644 index 000000000..e953edee8 --- /dev/null +++ b/data/web/inc/lib/mailcow/Identity/Service/SyncService.php @@ -0,0 +1,231 @@ +runs->failStale(self::STALE_MINUTES); + $run = $this->runs->nextPending(); + if ($run === null) { + if (!$this->settings->syncEnabled()) { + return null; + } + $since = $this->runs->secondsSinceScheduled(); + if ($since !== null && $since < $this->settings->syncInterval * 60) { + return null; + } + $run = ['id' => $this->runs->create($this->settings->provider, 'run'), 'mode' => 'run']; + } + return $this->execute((int)$run['id'], (string)$run['mode']); + } + + /** @return array{id: int, mode: string, status: string, summary: array} */ + public function execute(int $id, string $mode): array + { + $this->runs->start($id); + try { + $directory = $this->settings->canSync() ? ($this->directory)() : null; + if ($directory === null) { + throw new DirectoryException('The identity provider cannot be synced'); + } + $listing = $directory->listAll($this->settings->groupSync); + $plan = $this->planner->plan($this->settings, $listing, $this->state(), $mode === 'force'); + $summary = $plan->summary(); + if ($mode === 'preview') { + $status = 'ok'; + } elseif ($plan->blocked) { + $status = 'blocked'; + } else { + [$errors, $updated] = $this->apply($plan); + $summary['counts']['updates'] = $updated; + $summary['counts']['errors'] = count($errors); + $summary['errors'] = array_slice($errors, 0, self::DETAILS); + $status = 'ok'; + } + } catch (DirectoryException $e) { + $status = 'error'; + $summary = ['error' => $e->getMessage()]; + } catch (Throwable $e) { + $this->runs->finish($id, 'error', ['error' => 'The sync run failed: ' . $e->getMessage(), 'mode' => $mode]); + throw $e; + } + $summary['mode'] = $mode; + $this->runs->finish($id, $status, $summary); + return ['id' => $id, 'mode' => $mode, 'status' => $status, 'summary' => $summary]; + } + + private function state(): State + { + $accounts = $this->repo->accounts($this->settings->provider); + return new State($accounts, $this->repo->mailboxes(), $this->repo->domains(), + $this->settings->groupSync ? $this->groups->groups() : [], + $this->settings->periodicSync ? $this->templates->effective(array_keys($accounts)) : [], + $this->repo->templateHashes()); + } + + /** @return array{0: string[], 1: int} errors of single changes (the rest is still applied), updated mailboxes */ + private function apply(SyncPlan $plan): array + { + $provider = $this->settings->provider; + $errors = []; + foreach ($plan->links as $username => $externalId) { + $this->repo->link((string)$username, $provider, $externalId); + } + foreach ($plan->found as $username) { + $this->repo->setMissing($username, $provider, false); + } + foreach ($plan->missing as $username) { + $this->repo->setMissing($username, $provider, true); + } + foreach ($plan->creates as $create) { + $error = $this->legacy->createMailbox($create['email'], $create['name'], $provider, $create['template']); + if ($error !== null) { + $errors[] = $create['email'] . ': ' . $error; + continue; + } + $this->repo->link($create['email'], $provider, $create['id']); + } + foreach ($plan->deactivate as $username) { + $this->repo->setActive($username, $provider, 2, true); + } + foreach ($plan->restore as $username) { + $this->repo->setActive($username, $provider, 1, false); + } + foreach ($plan->release as $username) { + $this->repo->setIdpDisabled($username, $provider, false); + } + $this->sogo->refreshStaticView(array_merge($plan->deactivate, $plan->restore)); + $changed = []; + $errors = array_merge($errors, $this->applyGroups($plan, $changed)); + [$updateErrors, $updated] = $this->applyUpdates($plan, $changed); + return [array_merge($errors, $updateErrors), $updated]; + } + + /** + * @param string[] $changed collects the members that joined or left a group + * @return string[] + */ + private function applyGroups(SyncPlan $plan, array &$changed): array + { + $errors = []; + foreach ($plan->groupCreates as $create) { + try { + foreach ($this->groups->createFromIdp($create['ref'], $create['name'], $create['domain'], $create['mail']) as $warning) { + $errors[] = $create['name'] . ': ' . $warning[0]; + } + } catch (UserError $e) { + $errors[] = $create['name'] . ': ' . $e->key; + } + } + foreach ($plan->groupRenames as $id => $name) { + try { + $this->groups->renameFromIdp((int)$id, $name); + } catch (UserError $e) { + $errors[] = $name . ': ' . $e->key; + } + } + foreach ($plan->memberships as $ref => $usernames) { + $group = $this->groups->findByIdpRef((string)$ref); + if ($group !== null) { + $this->groupResult($group->name, $this->groups->syncGroupMembers((int)$group->id, $usernames), $errors, $changed); + } + } + foreach ($plan->orphanedGroups as $id) { + $this->groupResult((string)$id, $this->groups->syncGroupMembers($id, []), $errors, $changed); + } + return $errors; + } + + /** + * Name and template updates after the group changes: planned updates and members that joined or left a group + * in this run (e.g. the legacy mapping applies again after leaving a template group). The effective template + * is resolved and compared again. + * + * @return array{0: string[], 1: int} errors, updated mailboxes + */ + private function applyUpdates(SyncPlan $plan, array $changed): array + { + $candidates = array_values(array_unique(array_merge(array_column($plan->updates, 'username'), + array_intersect($changed, array_keys($plan->profiles))))); + if (empty($candidates)) { + return [[], 0]; + } + $errors = []; + $updated = 0; + $accounts = $this->repo->accounts($this->settings->provider); + $hashes = $this->repo->templateHashes(); + $effective = $this->templates->effective($candidates); + foreach ($candidates as $username) { + $profile = $plan->profiles[$username] ?? null; + $account = $accounts[$username] ?? null; + $template = $effective[$username] ?? $profile['template'] ?? null; + if ($profile === null || $account === null || $template === null + || ($profile['name'] === $account->name && ($hashes[$template] ?? null) === $account->attributeHash)) { + continue; + } + $error = $this->legacy->applyTemplate($username, $profile['name'], $template); + if ($error !== null) { + $errors[] = $username . ': ' . $error; + } else { + $updated++; + } + } + return [$errors, $updated]; + } + + private function groupResult(string $group, array $result, array &$errors, array &$changed): void + { + foreach ($result['warnings'] as $warning) { + $errors[] = $group . ': ' . $warning[0]; + } + array_push($changed, ...$result['added'], ...$result['removed']); + } +} diff --git a/data/web/inc/lib/mailcow/Imapsync/Service/SourceService.php b/data/web/inc/lib/mailcow/Imapsync/Service/SourceService.php index b3b70a8b0..c2a9b6d6d 100644 --- a/data/web/inc/lib/mailcow/Imapsync/Service/SourceService.php +++ b/data/web/inc/lib/mailcow/Imapsync/Service/SourceService.php @@ -66,7 +66,7 @@ class SourceService public function canEdit(Source $source): bool { - if ($this->context->accessAll || $this->context->isAdmin() || $source->createdBy === $this->context->username) { + if ($this->context->hasAdminRights() || $source->createdBy === $this->context->username) { return true; } // A domain admin may manage sources created by mailboxes of his domains diff --git a/data/web/inc/lib/mailcow/MailboxGroup/Controller/MailboxGroupApiController.php b/data/web/inc/lib/mailcow/MailboxGroup/Controller/MailboxGroupApiController.php new file mode 100644 index 000000000..86533ca31 --- /dev/null +++ b/data/web/inc/lib/mailcow/MailboxGroup/Controller/MailboxGroupApiController.php @@ -0,0 +1,173 @@ +handle('add', $attr, function (array $log) use ($attr): bool { + $group = $this->groups->create($attr); + $this->warnings($group->warnings, $log); + return $this->response->success(['group_added', htmlspecialchars($group->name)], $log); + }); + } + + /** POST edit/mailbox-group: one message per id */ + public function editGroups(?array $items, array $attr): bool + { + $data = array_merge(['id' => $items], $attr); + return $this->handle('edit', $data, function (array $log) use ($data, $attr): bool { + $this->groups->requireEditor(); + return $this->batch((array)($data['id'] ?? []), $log, function (int $id) use ($attr, $log): array { + $group = $this->groups->update($id, $attr); + $this->warnings($group->warnings, $log); + return ['group_modified', htmlspecialchars($group->name)]; + }); + }); + } + + /** POST delete/mailbox-group: one message per id */ + public function deleteGroups(array $items): bool + { + return $this->handle('delete', ['id' => $items], function (array $log) use ($items): bool { + $this->groups->requireEditor(); + return $this->batch($items, $log, function (int $id) use ($log): array { + $group = $this->groups->delete($id); + $this->warnings($group->warnings, $log); + return ['group_removed', htmlspecialchars($group->name)]; + }); + }); + } + + /** GET mailbox-group/all[/] */ + public function getGroups(?string $domains = null): array + { + $list = array_values(array_filter(array_map('trim', explode(',', (string)$domains)), 'strlen')); + return array_values(array_filter(array_map(fn(int $id): array => $this->getGroup($id), $this->groups->visibleIds($list)))); + } + + /** GET mailbox-group/, also edit.php */ + public function getGroup(mixed $id): array + { + $id = $this->toId($id); + $group = ($id === null) ? null : $this->groups->get($id); + return ($group === null) ? [] : $this->groups->toArray($group); + } + + /** GET mailbox-group/member/: groups of a mailbox (mailbox edit page, user page) */ + public function getMemberships(string $username): array + { + return $this->groups->membershipsOf($username); + } + + public function mailboxDeleted(string $username): void + { + $this->hook('mailbox_deleted', $username, fn() => $this->hooks->onMailboxDeleted($username)); + } + + public function domainDeleted(string $domain): void + { + $this->hook('domain_deleted', $domain, fn() => $this->hooks->onDomainDeleted($domain)); + } + + public function addressDeleted(string $address): void + { + $this->hook('address_deleted', $address, fn() => $this->hooks->onAddressDeleted($address)); + } + + public function addressRenamed(string $old, string $new): void + { + $this->hook('address_renamed', [$old, $new], fn() => $this->hooks->onAddressRenamed($old, $new)); + } + + /** A mailbox template was edited: apply it where it is the effective group template */ + public function templateChanged(int $templateId): void + { + $this->hook('template_changed', $templateId, function () use ($templateId): void { + $this->warnings($this->templates->onTemplateChanged($templateId), ['mailbox_group', 'edit', 'template', $templateId]); + }); + } + + private function warnings(array $warnings, array $log): void + { + foreach ($warnings as $msg) { + $this->response->warning($msg, $log); + } + } + + /** + * Runs one write call: $work gets the log entry and returns the result for process_*_return(). + * A UserError becomes a danger message, a database error stops the call with one `mysql_error` message. + */ + private function handle(string $action, mixed $data, callable $work): bool + { + $log = ['mailbox_group', $action, 'group', $data]; + try { + $result = $work($log); + } catch (UserError $e) { + $result = $this->response->error($e, $log); + } catch (PDOException $e) { + $result = $this->response->danger(['mysql_error', $e->getMessage()], $log); + } + $this->response->flush(); + return $result; + } + + private function hook(string $action, mixed $data, callable $work): void + { + try { + $work(); + } catch (PDOException $e) { + $this->response->danger(['mysql_error', $e->getMessage()], ['mailbox_group', $action, 'hook', $data]); + } + $this->response->flush(); + } + + /** One message per id: the success message returned by $work(id), or the UserError */ + private function batch(array $ids, array $log, callable $work): bool + { + foreach ($ids as $id) { + try { + $this->response->success($work($this->requireId($id)), $log); + } catch (UserError $e) { + $this->response->error($e, $log); + } + } + return true; + } + + /** Integer id from request input ("12", 12); null for anything else */ + private function toId(mixed $id): ?int + { + return (is_numeric($id) && (float)$id == (int)(float)$id) ? (int)(float)$id : null; + } + + /** @throws AccessDenied for ids that cannot exist */ + private function requireId(mixed $id): int + { + return $this->toId($id) ?? throw new AccessDenied(); + } +} diff --git a/data/web/inc/lib/mailcow/MailboxGroup/Legacy/LegacyMailbox.php b/data/web/inc/lib/mailcow/MailboxGroup/Legacy/LegacyMailbox.php new file mode 100644 index 000000000..ac2e7157f --- /dev/null +++ b/data/web/inc/lib/mailcow/MailboxGroup/Legacy/LegacyMailbox.php @@ -0,0 +1,59 @@ +asSystem(fn(): mixed => $this->callTemplate($username, $name, $template)); + } + + /** + * Runs a legacy call as system caller (access_all_exception); the caller's session messages are kept. + * + * @return ?string null unless the call returned false, else the message key of the legacy error + */ + protected function asSystem(callable $call): ?string + { + $hasReturn = array_key_exists('return', $_SESSION ?? []); + $return = $_SESSION['return'] ?? null; + $accessAll = $_SESSION['access_all_exception'] ?? null; + $_SESSION['return'] = []; + $_SESSION['access_all_exception'] = '1'; + try { + if ($call() !== false) { + return null; + } + foreach ($_SESSION['return'] as $message) { + if (($message['type'] ?? '') === 'danger') { + return (string)(is_array($message['msg']) ? $message['msg'][0] : $message['msg']); + } + } + return 'generic_server_error'; + } finally { + if ($hasReturn) { + $_SESSION['return'] = $return; + } else { + unset($_SESSION['return']); + } + $_SESSION['access_all_exception'] = $accessAll ?? '0'; + } + } + + protected function callTemplate(string $username, string $name, string $template): mixed + { + return mailbox('edit', 'mailbox_from_template', ['username' => $username, 'name' => $name, 'template' => $template]); + } +} diff --git a/data/web/inc/lib/mailcow/MailboxGroup/MailboxGroupModule.php b/data/web/inc/lib/mailcow/MailboxGroup/MailboxGroupModule.php new file mode 100644 index 000000000..d7d1fd66c --- /dev/null +++ b/data/web/inc/lib/mailcow/MailboxGroup/MailboxGroupModule.php @@ -0,0 +1,62 @@ +api->addGroup($attr)); + * MailboxGroupModule::fromGlobals(Context::system())->templates->templateForLogin($username, $legacyTemplate); + * MailboxGroupModule::create($pdo, Context::system())->sharing->reconcile(); // cron + */ +class MailboxGroupModule +{ + public function __construct( + public readonly GroupService $groups, + public readonly TemplateService $templates, + public readonly AccountHooks $hooks, + public readonly IdpSyncService $idp, + public readonly SharingService $sharing, + public readonly MailboxGroupApiController $api + ) { + } + + public static function create(PDO $pdo, Context $context): self + { + $repo = new GroupRepository($pdo); + $lookup = new LookupRepository($pdo); + $dovecot = DovecotModule::create()->dovecot; + $sogo = SogoModule::create()->sogo; + $templates = new TemplateService($lookup, new LegacyMailbox()); + $effects = new ChangeEffects($templates, $sogo, $repo, $dovecot); + $sharing = new SharingService($repo, $dovecot, $sogo, $effects); + $groups = new GroupService($repo, $lookup, $templates, $effects, $sharing, $context); + $hooks = new AccountHooks($repo, $effects); + return new self($groups, $templates, $hooks, new IdpSyncService($repo, $lookup, $effects), $sharing, + new MailboxGroupApiController($groups, $hooks, $templates, new ApiResponse())); + } + + /** Legacy entry point for procedural callers: reads $pdo and $_SESSION; $context overrides the session caller */ + public static function fromGlobals(?Context $context = null): self + { + return self::create($GLOBALS['pdo'], $context ?? Context::fromSession($_SESSION ?? [])); + } +} diff --git a/data/web/inc/lib/mailcow/MailboxGroup/Model/Group.php b/data/web/inc/lib/mailcow/MailboxGroup/Model/Group.php new file mode 100644 index 000000000..90a5b54e7 --- /dev/null +++ b/data/web/inc/lib/mailcow/MailboxGroup/Model/Group.php @@ -0,0 +1,108 @@ + username => source */ + public array $members = []; + /** @var string[] addresses or @domain */ + public array $sendAs = []; + /** @var array[] {owner, rights, subscribe, state, last_error}: members may open these mailboxes (ACL group=mcg_) */ + public array $imapGrants = []; + /** @var array[] {owner, type, folder, access, subscribe, state, last_error}: SOGo folders shared with the members */ + public array $sogoGrants = []; + /** @var array[] warnings of the last write (msg values), not stored */ + public array $warnings = []; + + /** Builds a group from a `mailbox_group` row (`template_name` optional) */ + public static function fromRow(array $row): self + { + $group = new self(); + $group->id = isset($row['id']) ? (int)$row['id'] : null; + $group->domain = (string)($row['domain'] ?? ''); + $group->name = (string)($row['name'] ?? ''); + $group->description = (string)($row['description'] ?? ''); + $group->address = isset($row['address']) ? (string)$row['address'] : null; + $group->senderAllowed = (int)($row['sender_allowed'] ?? 0); + $group->sogoVisible = (int)($row['sogo_visible'] ?? 0); + $group->internal = (int)($row['internal'] ?? 0); + $group->templateId = isset($row['template_id']) ? (int)$row['template_id'] : null; + $group->template = isset($row['template_name']) ? (string)$row['template_name'] : null; + $group->priority = (int)($row['priority'] ?? 0); + $group->idpRef = isset($row['idp_ref']) ? (string)$row['idp_ref'] : null; + $group->active = (int)($row['active'] ?? 1); + $group->created = isset($row['created']) ? (string)$row['created'] : null; + $group->modified = isset($row['modified']) ? (string)$row['modified'] : null; + return $group; + } + + /** @return string[] */ + public function usernames(): array + { + return array_keys($this->members); + } + + /** API representation (GET mailbox-group) */ + public function toArray(bool $canEdit): array + { + $members = []; + foreach ($this->members as $username => $source) { + $members[] = ['username' => (string)$username, 'source' => $source]; + } + return [ + 'id' => $this->id, + 'domain' => $this->domain, + 'name' => $this->name, + 'description' => $this->description, + 'address' => $this->address, + 'sender_allowed' => $this->senderAllowed, + 'sogo_visible' => $this->sogoVisible, + 'internal' => $this->internal, + 'template_id' => $this->templateId, + 'template' => $this->template, + 'priority' => $this->priority, + 'idp_ref' => $this->idpRef, + 'members' => $members, + 'send_as' => $this->sendAs, + 'imap_grants' => $this->imapGrants, + 'sogo_grants' => $this->sogoGrants, + 'active' => $this->active, + 'created' => $this->created, + 'modified' => $this->modified, + 'can_edit' => $canEdit, + ]; + } +} diff --git a/data/web/inc/lib/mailcow/MailboxGroup/Repository/GroupRepository.php b/data/web/inc/lib/mailcow/MailboxGroup/Repository/GroupRepository.php new file mode 100644 index 000000000..f414ea2cd --- /dev/null +++ b/data/web/inc/lib/mailcow/MailboxGroup/Repository/GroupRepository.php @@ -0,0 +1,649 @@ + [ + 'read' => ['PublicViewer', 'ConfidentialViewer', 'PrivateDAndTViewer'], + 'write' => ['PublicModifier', 'ConfidentialModifier', 'PrivateDAndTViewer', 'ObjectCreator', 'ObjectEraser'], + ], + 'Contacts' => [ + 'read' => ['ObjectViewer'], + 'write' => ['ObjectViewer', 'ObjectCreator', 'ObjectEditor', 'ObjectEraser'], + ], + ]; + + /** Grant table, folder and extra "access gone" condition of the subscriptions per kind */ + private const SUBSCRIPTION_GRANTS = [ + 'imap' => ['table' => 'mailbox_group_imap_grant', 'folder' => "''", 'gone' => " OR g.`state` = 'removing'", 'valid' => " AND g2.`state` != 'removing'"], + 'sogo' => ['table' => 'mailbox_group_sogo_grant', 'folder' => "CONCAT(g.`folder_type`, '/', g.`folder`)", 'gone' => '', 'valid' => ''], + ]; + + /** Side effects of the writes since the last takeEffects(): members whose acl_groups changed, sogo_acl changed */ + private array $effects = ['members' => [], 'sogo_acl' => false]; + /** Members removed by writeMembers(), rebuild() decides whether Dovecot needs to know */ + private array $removedMembers = []; + + public function find(int $id): ?Group + { + return $this->fetch('1=1', ['id' => $id]); + } + + /** Like find(), but only when the group is visible to the caller */ + public function findVisible(int $id, Context $context): ?Group + { + [$visible, $params] = $this->visibility($context); + return $this->fetch($visible, $params + ['id' => $id]); + } + + public function findByIdpRef(string $ref): ?Group + { + $id = $this->query("SELECT `id` FROM `mailbox_group` WHERE `idp_ref` = :ref", ['ref' => $ref])->fetchColumn(); + return ($id === false) ? null : $this->find((int)$id); + } + + /** + * @param string[] $domains limit to these domains, [] = all visible + * @return int[] ids of the groups visible to the caller, ordered by domain and name + */ + public function visibleIds(Context $context, array $domains = []): array + { + [$visible, $params] = $this->visibility($context); + $sql = "SELECT g.`id` FROM `mailbox_group` g WHERE $visible"; + if (!empty($domains)) { + $names = []; + foreach (array_values($domains) as $i => $domain) { + $names[] = ':dom' . $i; + $params['dom' . $i] = $domain; + } + $sql .= " AND g.`domain` IN (" . implode(', ', $names) . ")"; + } + return array_map('intval', $this->query($sql . " ORDER BY g.`domain`, g.`name`", $params)->fetchAll(PDO::FETCH_COLUMN)); + } + + public function nameExists(string $domain, string $name, ?int $exceptId = null): bool + { + return (bool)$this->query("SELECT 1 FROM `mailbox_group` WHERE `domain` = :domain AND `name` = :name AND `id` != :id", + ['domain' => $domain, 'name' => $name, 'id' => $exceptId ?? 0])->fetchColumn(); + } + + /** @return string[] usernames whose SOGo identities changed */ + public function insert(Group $group): array + { + return $this->transaction(function () use ($group): array { + $group->id = $this->insertRow('mailbox_group', $this->values($group)); + $this->writeMembers($group); + $this->writeSendAs($group); + $this->writeGrants($group); + return $this->rebuild((int)$group->id); + }); + } + + /** @return string[] usernames whose SOGo identities changed */ + public function update(Group $group): array + { + return $this->transaction(function () use ($group): array { + $this->updateRow('mailbox_group', (int)$group->id, $this->values($group)); + $this->writeMembers($group); + $this->writeSendAs($group); + $this->writeGrants($group); + return $this->rebuild((int)$group->id); + }); + } + + /** + * Deletes the group; members, grants and the derived alias/sender_acl rows go via FK cascade. + * + * @return string[] usernames whose SOGo identities changed + */ + public function delete(int $id): array + { + return $this->transaction(function () use ($id): array { + $before = $this->aliasState($id); + $this->query("DELETE FROM `mailbox_group` WHERE `id` = :id", ['id' => $id]); + $this->cleanupSogoAcl(); + return $before['members']; + }); + } + + /** + * Rewrites the rows derived from the group: the alias row of its address (goto = members, inactive while the + * group is inactive or empty, so the address bounces but stays reserved) and one sender_acl row per member + * and send-as grant, and the sogo_acl rows of its SOGo grants. Idempotent, joins the caller's transaction. + * $sogo = false keeps the sogo_acl rows (mailbox rename: sogo-tool rename-user updates them afterwards). + * + * @return string[] usernames whose SOGo identities changed + */ + public function rebuild(int $id, bool $sogo = true): array + { + return $this->transaction(function () use ($id, $sogo): array { + $group = $this->query("SELECT * FROM `mailbox_group` WHERE `id` = :id FOR UPDATE", ['id' => $id])->fetch(PDO::FETCH_ASSOC); + if (!$group) { + return []; + } + $before = $this->aliasState($id); + $members = $this->query("SELECT `username` FROM `mailbox_group_member` WHERE `group_id` = :id ORDER BY `username`", + ['id' => $id])->fetchAll(PDO::FETCH_COLUMN); + $visible = false; + if ($group['address'] === null) { + $this->query("DELETE FROM `alias` WHERE `group_id` = :id", ['id' => $id]); + } else { + $values = [ + 'address' => $group['address'], + 'goto' => empty($members) ? 'null@localhost' : implode(',', $members), + 'domain' => $group['domain'], + 'public_comment' => $group['description'], + 'sender_allowed' => (int)$group['sender_allowed'], + // SOGo identities only make sense when the members may send as the address + 'sogo_visible' => ($group['sogo_visible'] == 1 && $group['sender_allowed'] == 1) ? 1 : 0, + 'internal' => (int)$group['internal'], + 'active' => ($group['active'] == 1 && !empty($members)) ? 1 : 0, + ]; + // Never insert by address: an existing foreign row must not be taken over + $aliasId = $this->query("SELECT `id` FROM `alias` WHERE `group_id` = :id", ['id' => $id])->fetchColumn(); + if ($aliasId === false) { + $this->insertRow('alias', $values + ['group_id' => $id]); + } else { + $this->updateRow('alias', (int)$aliasId, $values); + } + $visible = ($values['active'] === 1 && $values['sogo_visible'] === 1); + } + $this->query("DELETE FROM `sender_acl` WHERE `group_id` = :id", ['id' => $id]); + if ($group['active'] == 1) { + $this->query("INSERT INTO `sender_acl` (`logged_in_as`, `send_as`, `external`, `group_id`) + SELECT m.`username`, s.`address`, 0, m.`group_id` FROM `mailbox_group_member` m + JOIN `mailbox_group_send_as` s ON s.`group_id` = m.`group_id` + WHERE m.`group_id` = :id AND m.`username` != s.`address`", ['id' => $id]); + } + if ($sogo) { + $this->rebuildSogoAcl($id, $group['active'] == 1, $members); + } + // Dovecot caches acl_groups (userdb) of the members, incl. the ones that just left + if ($this->query("SELECT 1 FROM `mailbox_group_imap_grant` WHERE `group_id` = :id LIMIT 1", ['id' => $id])->fetchColumn()) { + $this->effects['members'] = array_merge($this->effects['members'], $members, $this->removedMembers); + } + $this->removedMembers = []; + $after = $visible ? $members : []; + // Same visible address: only joined and left members are affected + if ($before['members'] !== [] && $visible && $before['address'] === $group['address']) { + return array_values(array_merge(array_diff($before['members'], $after), array_diff($after, $before['members']))); + } + return array_values(array_unique(array_merge($before['members'], $after))); + }); + } + + /** + * Every group as the IdP sync plans with it: {id, domain, name, idp_ref, template, priority, active, + * members: username => source} + * + * @return array[] + */ + public function syncState(): array + { + $members = []; + foreach ($this->query("SELECT `group_id`, `username`, `source` FROM `mailbox_group_member`")->fetchAll(PDO::FETCH_ASSOC) as $row) { + $members[(int)$row['group_id']][(string)$row['username']] = (string)$row['source']; + } + $groups = []; + foreach ($this->query("SELECT g.`id`, g.`domain`, g.`name`, g.`idp_ref`, t.`template`, g.`priority`, g.`active` + FROM `mailbox_group` g LEFT JOIN `templates` t ON t.`id` = g.`template_id` ORDER BY g.`id`")->fetchAll(PDO::FETCH_ASSOC) as $row) { + $groups[] = [ + 'id' => (int)$row['id'], + 'domain' => (string)$row['domain'], + 'name' => (string)$row['name'], + 'idp_ref' => isset($row['idp_ref']) ? (string)$row['idp_ref'] : null, + 'template' => isset($row['template']) ? (string)$row['template'] : null, + 'priority' => (int)$row['priority'], + 'active' => (int)$row['active'], + 'members' => $members[(int)$row['id']] ?? [], + ]; + } + return $groups; + } + + /** @return int[] groups with this member, a send-as grant on this address or a SOGo grant on this mailbox */ + public function groupIdsOfAccount(string $address): array + { + return array_map('intval', $this->query("SELECT `group_id` FROM `mailbox_group_member` WHERE `username` = :a1 + UNION SELECT `group_id` FROM `mailbox_group_send_as` WHERE `address` = :a2 + UNION SELECT `group_id` FROM `mailbox_group_sogo_grant` WHERE `owner` = :a3", + ['a1' => $address, 'a2' => $address, 'a3' => $address])->fetchAll(PDO::FETCH_COLUMN)); + } + + /** @return int[] groups with send-as grants on addresses of the domain (incl. @domain) */ + public function groupIdsWithSendAsIn(string $domain): array + { + return array_map('intval', $this->query("SELECT DISTINCT `group_id` FROM `mailbox_group_send_as` + WHERE SUBSTRING_INDEX(`address`, '@', -1) = :domain", ['domain' => $domain])->fetchAll(PDO::FETCH_COLUMN)); + } + + /** + * A mailbox is deleted: its memberships and the grants on its address go, the groups are rebuilt. + * + * @param int[] $ids groups of the account (groupIdsOfAccount()) + * @return string[] usernames whose SOGo identities changed + */ + public function removeAccount(string $username, array $ids): array + { + return $this->transaction(function () use ($username, $ids): array { + $this->query("DELETE FROM `mailbox_group_member` WHERE `username` = :username", ['username' => $username]); + $this->query("DELETE FROM `mailbox_group_send_as` WHERE `address` = :username", ['username' => $username]); + return $this->rebuildAll($ids); + }); + } + + /** An alias was deleted: grants on its address go */ + public function removeSendAs(string $address, array $ids): array + { + return $this->transaction(function () use ($address, $ids): array { + $this->query("DELETE FROM `mailbox_group_send_as` WHERE `address` = :address", ['address' => $address]); + return $this->rebuildAll($ids); + }); + } + + /** A domain or alias domain is deleted: grants on its addresses go */ + public function removeSendAsIn(string $domain, array $ids): array + { + return $this->transaction(function () use ($domain, $ids): array { + $this->query("DELETE FROM `mailbox_group_send_as` WHERE SUBSTRING_INDEX(`address`, '@', -1) = :domain", ['domain' => $domain]); + return $this->rebuildAll($ids); + }); + } + + /** + * Account or alias address renamed: members and grants follow. Explicit updates, because the mailbox rename + * runs with FOREIGN_KEY_CHECKS = 0; joins the caller's transaction. + */ + public function renameAccount(string $old, string $new, array $ids): array + { + return $this->transaction(function () use ($old, $new, $ids): array { + $this->query("UPDATE `mailbox_group_member` SET `username` = :new WHERE `username` = :old", ['new' => $new, 'old' => $old]); + $this->query("UPDATE `mailbox_group_send_as` SET `address` = :new WHERE `address` = :old", ['new' => $new, 'old' => $old]); + return $this->rebuildAll($ids, false); + }); + } + + /** @return int[] groups with SOGo grants */ + public function groupIdsWithSogoGrants(): array + { + return array_map('intval', $this->query("SELECT DISTINCT `group_id` FROM `mailbox_group_sogo_grant`")->fetchAll(PDO::FETCH_COLUMN)); + } + + /** + * IMAP grants Dovecot has to apply: pending, failed and removing ones, with $all also applied ones (new + * top-level folders); of one group or all. + * + * @return array[] rows of mailbox_group_imap_grant + */ + public function imapGrantsToApply(?int $groupId, bool $all): array + { + $where = $all ? '1=1' : "`state` != 'applied'"; + $params = []; + if ($groupId !== null) { + $where .= " AND `group_id` = :id"; + $params['id'] = $groupId; + } + return $this->query("SELECT * FROM `mailbox_group_imap_grant` WHERE $where ORDER BY `id`", $params)->fetchAll(PDO::FETCH_ASSOC); + } + + public function setImapState(int $grantId, string $state, ?string $error): void + { + $this->query("UPDATE `mailbox_group_imap_grant` SET `state` = :state, `last_error` = :error WHERE `id` = :id", + ['state' => $state, 'error' => $error, 'id' => $grantId]); + } + + public function deleteImapGrant(int $grantId): void + { + $this->query("DELETE FROM `mailbox_group_imap_grant` WHERE `id` = :id", ['id' => $grantId]); + } + + /** + * Deletes the sogo_acl rows of grants that are gone, e.g. by FK cascades of groups, owners and domains. + * Joins the caller's transaction. + */ + public function cleanupSogoAcl(): void + { + $this->transaction(function (): void { + $orphans = $this->query("SELECT l.`acl_id` FROM `mailbox_group_sogo_acl` l + LEFT JOIN `mailbox_group_sogo_grant` g ON g.`id` = l.`grant_id` + WHERE g.`id` IS NULL")->fetchAll(PDO::FETCH_COLUMN); + foreach ($orphans as $aclId) { + $this->deleteSogoAcl((int)$aclId); + } + }); + } + + /** + * Members to subscribe to grants with `subscribe` (kind imap or sogo): applied grants of active groups, members + * without a subscription by mailcow yet (a member that removes it keeps it removed). + * + * @return array[] {grant_id, owner, folder, usernames} + */ + public function missingSubscriptions(string $kind): array + { + $config = self::SUBSCRIPTION_GRANTS[$kind]; + $grants = []; + foreach ($this->query("SELECT g.`id`, g.`owner`, {$config['folder']} AS `folder`, m.`username` + FROM `{$config['table']}` g + JOIN `mailbox_group` mg ON mg.`id` = g.`group_id` AND mg.`active` = 1 + JOIN `mailbox_group_member` m ON m.`group_id` = g.`group_id` AND m.`username` != g.`owner` + LEFT JOIN `mailbox_group_subscription` s ON s.`kind` = :kind AND s.`grant_id` = g.`id` AND s.`username` = m.`username` + WHERE g.`subscribe` = 1 AND g.`state` = 'applied' AND s.`id` IS NULL + ORDER BY g.`id`, m.`username`", ['kind' => $kind])->fetchAll(PDO::FETCH_ASSOC) as $row) { + $grants[$row['id']] ??= ['grant_id' => (int)$row['id'], 'owner' => (string)$row['owner'], 'folder' => (string)$row['folder'], 'usernames' => []]; + $grants[$row['id']]['usernames'][] = (string)$row['username']; + } + return array_values($grants); + } + + /** + * Subscriptions by mailcow whose member lost the access: grant, membership or group gone or inactive. + * `covered`: another group still grants the member the same folder, so the subscription stays. + * + * @return array[] rows of mailbox_group_subscription with member_exists, owner_exists, covered + */ + public function staleSubscriptions(string $kind): array + { + $config = self::SUBSCRIPTION_GRANTS[$kind]; + return $this->query("SELECT s.`id`, s.`username`, s.`owner`, s.`folder`, + EXISTS(SELECT 1 FROM `mailbox` WHERE `username` = s.`username`) AS `member_exists`, + EXISTS(SELECT 1 FROM `mailbox` WHERE `username` = s.`owner`) AS `owner_exists`, + EXISTS(SELECT 1 FROM `mailbox_group_subscription` s2 + JOIN `{$config['table']}` g2 ON g2.`id` = s2.`grant_id`{$config['valid']} + JOIN `mailbox_group` mg2 ON mg2.`id` = g2.`group_id` AND mg2.`active` = 1 + JOIN `mailbox_group_member` m2 ON m2.`group_id` = g2.`group_id` AND m2.`username` = s2.`username` + WHERE s2.`kind` = s.`kind` AND s2.`id` != s.`id` AND s2.`username` = s.`username` AND s2.`owner` = s.`owner` + AND s2.`folder` = s.`folder`) AS `covered` + FROM `mailbox_group_subscription` s + LEFT JOIN `{$config['table']}` g ON g.`id` = s.`grant_id` + LEFT JOIN `mailbox_group` mg ON mg.`id` = g.`group_id` AND mg.`active` = 1 + LEFT JOIN `mailbox_group_member` m ON m.`group_id` = g.`group_id` AND m.`username` = s.`username` + WHERE s.`kind` = :kind AND (g.`id` IS NULL OR mg.`id` IS NULL OR m.`username` IS NULL{$config['gone']}) + ORDER BY s.`id`", ['kind' => $kind])->fetchAll(PDO::FETCH_ASSOC); + } + + public function addSubscriptions(string $kind, int $grantId, string $owner, string $folder, array $usernames): void + { + foreach ($usernames as $username) { + $this->query("INSERT IGNORE INTO `mailbox_group_subscription` (`kind`, `grant_id`, `username`, `owner`, `folder`) + VALUES (:kind, :grant, :username, :owner, :folder)", + ['kind' => $kind, 'grant' => $grantId, 'username' => $username, 'owner' => $owner, 'folder' => $folder]); + } + } + + public function deleteSubscription(int $id): void + { + $this->query("DELETE FROM `mailbox_group_subscription` WHERE `id` = :id", ['id' => $id]); + } + + /** + * Owners of pending SOGo grants on their personal folder that SOGo knows (active mailboxes), of one group or all. + * Their folders do not exist because they never logged in to SOGo, e.g. shared mailboxes. + * + * @return string[] + */ + public function pendingSogoOwners(?int $groupId): array + { + $params = []; + $where = ''; + if ($groupId !== null) { + $where = " AND g.`group_id` = :id"; + $params['id'] = $groupId; + } + return $this->query("SELECT DISTINCT g.`owner` FROM `mailbox_group_sogo_grant` g + JOIN `mailbox` mb ON mb.`username` = g.`owner` AND mb.`active` = '1' AND mb.`kind` = '' + WHERE g.`state` = 'pending' AND g.`folder` = 'personal'$where ORDER BY g.`owner`", $params)->fetchAll(PDO::FETCH_COLUMN); + } + + /** + * Side effects of the writes since the last call, for ChangeEffects after the commit. + * + * @return array{members: string[], sogo_acl: bool} + */ + public function takeEffects(): array + { + $effects = $this->effects; + $effects['members'] = array_values(array_unique($effects['members'])); + $this->effects = ['members' => [], 'sogo_acl' => false]; + return $effects; + } + + /** @return string[] */ + private function rebuildAll(array $ids, bool $sogo = true): array + { + $users = []; + foreach (array_unique($ids) as $id) { + $users = array_merge($users, $this->rebuild((int)$id, $sogo)); + } + return array_values(array_unique($users)); + } + + /** + * sogo_acl rows of the group's SOGo grants: one row per member (except the owner) and role while the group is + * active. Only rows of the ledger are ever deleted, so shares made in SOGo stay. A grant on a folder that does + * not exist yet (the owner never opened SOGo) stays pending. + */ + private function rebuildSogoAcl(int $id, bool $active, array $members): void + { + $this->cleanupSogoAcl(); + foreach ($this->query("SELECT * FROM `mailbox_group_sogo_grant` WHERE `group_id` = :id", ['id' => $id])->fetchAll(PDO::FETCH_ASSOC) as $grant) { + $object = '/' . $grant['owner'] . '/' . $grant['folder_type'] . '/' . $grant['folder']; + $folderId = $this->query("SELECT `c_folder_id` FROM `sogo_folder_info` WHERE `c_path` = :path", + ['path' => '/Users' . $object])->fetchColumn(); + $wanted = []; + if ($folderId !== false && $active) { + foreach ($members as $username) { + foreach (($username === $grant['owner']) ? [] : self::SOGO_ROLES[$grant['folder_type']][$grant['access']] as $role) { + $wanted[$username . '|' . $role] = [$username, $role]; + } + } + } + $rows = $this->query("SELECT l.`acl_id`, l.`c_uid`, l.`c_role`, a.`c_folder_id`, a.`c_object` FROM `mailbox_group_sogo_acl` l + LEFT JOIN `sogo_acl` a ON a.`id` = l.`acl_id` + WHERE l.`grant_id` = :id", ['id' => $grant['id']])->fetchAll(PDO::FETCH_ASSOC); + foreach ($rows as $row) { + $key = $row['c_uid'] . '|' . $row['c_role']; + if (isset($wanted[$key]) && (string)$row['c_folder_id'] === (string)$folderId && $row['c_object'] === $object) { + unset($wanted[$key]); + continue; + } + $this->deleteSogoAcl((int)$row['acl_id']); + } + foreach ($wanted as [$username, $role]) { + $aclId = $this->insertRow('sogo_acl', ['c_folder_id' => $folderId, 'c_object' => $object, 'c_uid' => $username, 'c_role' => $role]); + $this->query("INSERT INTO `mailbox_group_sogo_acl` (`acl_id`, `grant_id`, `c_uid`, `c_role`) VALUES (:acl, :grant, :uid, :role)", + ['acl' => $aclId, 'grant' => $grant['id'], 'uid' => $username, 'role' => $role]); + $this->effects['sogo_acl'] = true; + } + $state = ($folderId === false) ? 'pending' : 'applied'; + if ($grant['state'] !== $state) { + $this->query("UPDATE `mailbox_group_sogo_grant` SET `state` = :state, `last_error` = :error WHERE `id` = :id", + ['state' => $state, 'error' => ($folderId === false) ? 'folder_missing' : null, 'id' => $grant['id']]); + } + } + } + + private function deleteSogoAcl(int $aclId): void + { + $this->query("DELETE FROM `sogo_acl` WHERE `id` = :id", ['id' => $aclId]); + $this->query("DELETE FROM `mailbox_group_sogo_acl` WHERE `acl_id` = :id", ['id' => $aclId]); + $this->effects['sogo_acl'] = true; + } + + private function fetch(string $where, array $params): ?Group + { + $row = $this->query("SELECT g.*, t.`template` AS `template_name` FROM `mailbox_group` g + LEFT JOIN `templates` t ON t.`id` = g.`template_id` + WHERE g.`id` = :id AND $where", $params)->fetch(PDO::FETCH_ASSOC); + if (!$row) { + return null; + } + $group = Group::fromRow($row); + $id = ['id' => $group->id]; + $group->members = $this->query("SELECT `username`, `source` FROM `mailbox_group_member` WHERE `group_id` = :id ORDER BY `username`", + $id)->fetchAll(PDO::FETCH_KEY_PAIR); + $group->sendAs = $this->query("SELECT `address` FROM `mailbox_group_send_as` WHERE `group_id` = :id ORDER BY `address`", + $id)->fetchAll(PDO::FETCH_COLUMN); + $group->imapGrants = array_map(fn(array $grant): array => array_merge($grant, ['subscribe' => (int)$grant['subscribe']]), + $this->query("SELECT `owner`, `rights`, `subscribe`, `state`, `last_error` FROM `mailbox_group_imap_grant` + WHERE `group_id` = :id AND `state` != 'removing' ORDER BY `owner`", $id)->fetchAll(PDO::FETCH_ASSOC)); + $group->sogoGrants = array_map(fn(array $grant): array => array_merge($grant, ['subscribe' => (int)$grant['subscribe']]), + $this->query("SELECT `owner`, `folder_type` AS `type`, `folder`, `access`, `subscribe`, `state`, `last_error` + FROM `mailbox_group_sogo_grant` WHERE `group_id` = :id ORDER BY `owner`, `folder_type`, `folder`", $id)->fetchAll(PDO::FETCH_ASSOC)); + return $group; + } + + /** Members (username => source) as in the model; changed sources are updated, created stays */ + private function writeMembers(Group $group): void + { + $id = (int)$group->id; + $stored = $this->query("SELECT `username`, `source` FROM `mailbox_group_member` WHERE `group_id` = :id", ['id' => $id]) + ->fetchAll(PDO::FETCH_KEY_PAIR); + foreach (array_diff_key($stored, $group->members) as $username => $source) { + $this->query("DELETE FROM `mailbox_group_member` WHERE `group_id` = :id AND `username` = :username", + ['id' => $id, 'username' => $username]); + $this->removedMembers[] = (string)$username; + } + foreach ($group->members as $username => $source) { + if (!isset($stored[$username])) { + $this->query("INSERT INTO `mailbox_group_member` (`group_id`, `username`, `source`) VALUES (:id, :username, :source)", + ['id' => $id, 'username' => $username, 'source' => $source]); + } elseif ($stored[$username] !== $source) { + $this->query("UPDATE `mailbox_group_member` SET `source` = :source WHERE `group_id` = :id AND `username` = :username", + ['source' => $source, 'id' => $id, 'username' => $username]); + } + } + } + + /** + * IMAP grants: new ones are pending, removed ones are set to removing until Dovecot dropped the ACL + * (SharingService). SOGo grants are replaced; rebuild() maintains their sogo_acl rows. + */ + private function writeGrants(Group $group): void + { + $id = (int)$group->id; + $stored = []; + foreach ($this->query("SELECT `id`, `owner`, `rights`, `subscribe`, `state` FROM `mailbox_group_imap_grant` WHERE `group_id` = :id", + ['id' => $id])->fetchAll(PDO::FETCH_ASSOC) as $row) { + $stored[(string)$row['owner']] = $row; + } + $wanted = []; + foreach ($group->imapGrants as $grant) { + $wanted[(string)$grant['owner']] = $grant; + } + foreach ($stored as $owner => $row) { + if (!isset($wanted[$owner]) && $row['state'] !== 'removing') { + $this->setImapState((int)$row['id'], 'removing', null); + } + } + foreach ($wanted as $owner => $grant) { + $row = $stored[$owner] ?? null; + $subscribe = (int)($grant['subscribe'] ?? 0); + if ($row === null) { + $this->insertRow('mailbox_group_imap_grant', ['group_id' => $id, 'owner' => $owner, 'rights' => $grant['rights'], + 'subscribe' => $subscribe, 'state' => 'pending']); + continue; + } + if ($row['rights'] !== $grant['rights'] || $row['state'] === 'removing') { + $this->query("UPDATE `mailbox_group_imap_grant` SET `rights` = :rights, `state` = 'pending', `last_error` = NULL WHERE `id` = :id", + ['rights' => $grant['rights'], 'id' => $row['id']]); + } + if ((int)$row['subscribe'] !== $subscribe) { + $this->query("UPDATE `mailbox_group_imap_grant` SET `subscribe` = :subscribe WHERE `id` = :id", + ['subscribe' => $subscribe, 'id' => $row['id']]); + } + } + $stored = []; + foreach ($this->query("SELECT `id`, `owner`, `folder_type`, `folder`, `access`, `subscribe` FROM `mailbox_group_sogo_grant` WHERE `group_id` = :id", + ['id' => $id])->fetchAll(PDO::FETCH_ASSOC) as $row) { + $stored[$row['owner'] . '|' . $row['folder_type'] . '|' . $row['folder']] = $row; + } + $wanted = []; + foreach ($group->sogoGrants as $grant) { + $wanted[$grant['owner'] . '|' . $grant['type'] . '|' . $grant['folder']] = $grant; + } + foreach (array_diff_key($stored, $wanted) as $row) { + $this->query("DELETE FROM `mailbox_group_sogo_grant` WHERE `id` = :id", ['id' => $row['id']]); + } + foreach ($wanted as $key => $grant) { + $subscribe = (int)($grant['subscribe'] ?? 0); + if (!isset($stored[$key])) { + $this->insertRow('mailbox_group_sogo_grant', ['group_id' => $id, 'owner' => $grant['owner'], 'folder_type' => $grant['type'], + 'folder' => $grant['folder'], 'access' => $grant['access'], 'subscribe' => $subscribe, 'state' => 'pending']); + } elseif ($stored[$key]['access'] !== $grant['access'] || (int)$stored[$key]['subscribe'] !== $subscribe) { + $this->query("UPDATE `mailbox_group_sogo_grant` SET `access` = :access, `subscribe` = :subscribe WHERE `id` = :id", + ['access' => $grant['access'], 'subscribe' => $subscribe, 'id' => $stored[$key]['id']]); + } + } + } + + private function writeSendAs(Group $group): void + { + $id = ['id' => $group->id]; + $this->query("DELETE FROM `mailbox_group_send_as` WHERE `group_id` = :id", $id); + foreach ($group->sendAs as $address) { + $this->query("INSERT INTO `mailbox_group_send_as` (`group_id`, `address`) VALUES (:id, :address)", $id + ['address' => $address]); + } + } + + /** + * The group's alias row as SOGo sees it: visible = active and sogo_visible (see the grouped_mail_aliases view). + * + * @return array{address: ?string, members: string[]} members only when visible + */ + private function aliasState(int $id): array + { + $row = $this->query("SELECT `address`, `goto`, `active`, `sogo_visible` FROM `alias` WHERE `group_id` = :id", + ['id' => $id])->fetch(PDO::FETCH_ASSOC); + $visible = $row && $row['active'] == 1 && $row['sogo_visible'] == 1; + return ['address' => $row['address'] ?? null, 'members' => $visible ? explode(',', (string)$row['goto']) : []]; + } + + /** + * WHERE fragment over `mailbox_group g` that limits rows to what the caller may see, and its parameters. + * + * @return array{0: string, 1: array} + */ + private function visibility(Context $context): array + { + if ($context->hasAdminRights()) { + return ['1=1', []]; + } + if ($context->isDomainAdmin()) { + return ["g.`domain` IN (SELECT `domain` FROM `domain_admins` WHERE `active` = '1' AND `username` = :vis_da)", + ['vis_da' => $context->username]]; + } + return ['0=1', []]; + } + + private function values(Group $group): array + { + return [ + 'domain' => $group->domain, + 'name' => $group->name, + 'description' => $group->description, + 'address' => $group->address, + 'sender_allowed' => $group->senderAllowed, + 'sogo_visible' => $group->sogoVisible, + 'internal' => $group->internal, + 'template_id' => $group->templateId, + 'priority' => $group->priority, + 'idp_ref' => $group->idpRef, + 'active' => $group->active, + ]; + } +} diff --git a/data/web/inc/lib/mailcow/MailboxGroup/Repository/LookupRepository.php b/data/web/inc/lib/mailcow/MailboxGroup/Repository/LookupRepository.php new file mode 100644 index 000000000..58749098f --- /dev/null +++ b/data/web/inc/lib/mailcow/MailboxGroup/Repository/LookupRepository.php @@ -0,0 +1,148 @@ +query("SELECT 1 FROM `domain` WHERE `domain` = :domain", ['domain' => $domain])->fetchColumn(); + } + + public function isDomainOrAliasDomain(string $domain): bool + { + return (bool)$this->query("SELECT 1 FROM `domain` WHERE `domain` = :d1 UNION SELECT 1 FROM `alias_domain` WHERE `alias_domain` = :d2", + ['d1' => $domain, 'd2' => $domain])->fetchColumn(); + } + + /** An alias or mailbox address (mailboxes have an alias row of their own) */ + public function aliasExists(string $address): bool + { + return (bool)$this->query("SELECT 1 FROM `alias` WHERE `address` = :address", ['address' => $address])->fetchColumn(); + } + + /** Used by an alias other than the group's own row, by a mailbox or resource, or as spam alias */ + public function addressTaken(string $address, ?int $groupId): bool + { + return (bool)$this->query("SELECT 1 FROM `alias` WHERE `address` = :a1 AND (`group_id` IS NULL OR `group_id` != :id) + UNION SELECT 1 FROM `mailbox` WHERE `username` = :a2 + UNION SELECT 1 FROM `spamalias` WHERE `address` = :a3", + ['a1' => $address, 'id' => $groupId ?? 0, 'a2' => $address, 'a3' => $address])->fetchColumn(); + } + + /** Aliases the domain may still create (same count as mailbox('get', 'domain_details')) */ + public function aliasesLeft(string $domain): int + { + $max = $this->query("SELECT `aliases` FROM `domain` WHERE `domain` = :domain", ['domain' => $domain])->fetchColumn(); + $used = $this->query("SELECT COUNT(`address`) FROM `alias` + WHERE (`domain` = :d1 OR `domain` IN (SELECT `alias_domain` FROM `alias_domain` WHERE `target_domain` = :d2)) + AND `address` NOT IN (SELECT `username` FROM `mailbox`)", ['d1' => $domain, 'd2' => $domain])->fetchColumn(); + return (int)$max - (int)$used; + } + + /** + * @param string[] $usernames + * @return string[] the given usernames that are regular mailboxes (no resources) + */ + public function regularMailboxes(array $usernames): array + { + if (empty($usernames)) { + return []; + } + [$in, $params] = self::in('u', $usernames); + return $this->query("SELECT `username` FROM `mailbox` WHERE `kind` = '' AND `username` IN ($in)", $params)->fetchAll(PDO::FETCH_COLUMN); + } + + /** Name of a mailbox template, null if there is none with this id */ + public function templateName(int $id): ?string + { + $name = $this->query("SELECT `template` FROM `templates` WHERE `id` = :id AND `type` = 'mailbox'", ['id' => $id])->fetchColumn(); + return ($name === false) ? null : (string)$name; + } + + /** @return array username => full name */ + public function mailboxNames(array $usernames): array + { + if (empty($usernames)) { + return []; + } + [$in, $params] = self::in('u', $usernames); + return $this->query("SELECT `username`, `name` FROM `mailbox` WHERE `username` IN ($in)", $params)->fetchAll(PDO::FETCH_KEY_PAIR); + } + + /** + * Template of the active group with the highest priority (lowest id on ties) per member. + * + * @return array username => template name, null without group template + */ + public function effectiveTemplates(array $usernames): array + { + $result = array_fill_keys(array_map('strval', $usernames), null); + if (empty($usernames)) { + return $result; + } + [$in, $params] = self::in('u', $usernames); + $rows = $this->query("SELECT m.`username`, t.`template` FROM `mailbox_group_member` m + JOIN `mailbox_group` g ON g.`id` = m.`group_id` AND g.`active` = '1' + JOIN `templates` t ON t.`id` = g.`template_id` AND t.`type` = 'mailbox' + WHERE m.`username` IN ($in) + ORDER BY m.`username`, g.`priority` DESC, g.`id`", $params)->fetchAll(PDO::FETCH_ASSOC); + foreach ($rows as $row) { + $result[$row['username']] ??= $row['template']; + } + return $result; + } + + /** @return string[] members of active groups bound to the template */ + public function membersWithTemplate(int $templateId): array + { + return $this->query("SELECT DISTINCT m.`username` FROM `mailbox_group_member` m + JOIN `mailbox_group` g ON g.`id` = m.`group_id` AND g.`active` = '1' + WHERE g.`template_id` = :id", ['id' => $templateId])->fetchAll(PDO::FETCH_COLUMN); + } + + /** Groups of a mailbox with its membership source */ + public function membershipsOf(string $username): array + { + return $this->query("SELECT g.`id`, g.`domain`, g.`name`, g.`address`, g.`sender_allowed`, g.`active`, g.`priority`, + t.`template`, m.`source` FROM `mailbox_group_member` m + JOIN `mailbox_group` g ON g.`id` = m.`group_id` + LEFT JOIN `templates` t ON t.`id` = g.`template_id` + WHERE m.`username` = :username ORDER BY g.`domain`, g.`name`", ['username' => $username])->fetchAll(PDO::FETCH_ASSOC); + } + + /** @return string[] addresses a mailbox may send as through its active groups */ + public function sendAsOf(string $username): array + { + return $this->query("SELECT `send_as` FROM `sender_acl` WHERE `logged_in_as` = :u1 AND `group_id` IS NOT NULL + UNION SELECT g.`address` FROM `mailbox_group_member` m JOIN `mailbox_group` g ON g.`id` = m.`group_id` + WHERE m.`username` = :u2 AND g.`active` = '1' AND g.`sender_allowed` = '1' AND g.`address` IS NOT NULL + ORDER BY 1", ['u1' => $username, 'u2' => $username])->fetchAll(PDO::FETCH_COLUMN); + } + + /** + * IN list with one placeholder per value (native prepares allow a placeholder only once). + * + * @return array{0: string, 1: array} + */ + private static function in(string $prefix, array $values): array + { + $names = []; + $params = []; + foreach (array_values($values) as $i => $value) { + $names[] = ':' . $prefix . $i; + $params[$prefix . $i] = (string)$value; + } + return [implode(', ', $names), $params]; + } +} diff --git a/data/web/inc/lib/mailcow/MailboxGroup/Service/AccountHooks.php b/data/web/inc/lib/mailcow/MailboxGroup/Service/AccountHooks.php new file mode 100644 index 000000000..2f805d3f1 --- /dev/null +++ b/data/web/inc/lib/mailcow/MailboxGroup/Service/AccountHooks.php @@ -0,0 +1,70 @@ +repo->groupIdsOfAccount($username); + if (!empty($ids)) { + // The deleted mailbox itself needs no SOGo refresh + $this->effects->apply(array_diff($this->repo->removeAccount($username, $ids), [$username]), []); + } + } + + /** + * Inside the legacy mailbox rename transaction (FOREIGN_KEY_CHECKS = 0): members and grants follow. + * Must not catch, so the caller can roll back. The legacy rename refreshes SOGo itself. + */ + public function onMailboxRenamed(string $old, string $new): void + { + $ids = $this->repo->groupIdsOfAccount($old); + if (!empty($ids)) { + $this->repo->renameAccount($old, $new, $ids); + } + } + + /** + * After a domain or alias domain was deleted: grants on its addresses go. Its groups went via FK cascade, + * the sogo_acl rows of their SOGo grants go here. + */ + public function onDomainDeleted(string $domain): void + { + $ids = $this->repo->groupIdsWithSendAsIn($domain); + $users = empty($ids) ? [] : $this->repo->removeSendAsIn($domain, $ids); + $this->repo->cleanupSogoAcl(); + $this->effects->apply($users, []); + } + + /** An alias was deleted: grants on its address go */ + public function onAddressDeleted(string $address): void + { + $ids = $this->repo->groupIdsOfAccount($address); + if (!empty($ids)) { + $this->effects->apply($this->repo->removeSendAs($address, $ids), []); + } + } + + /** An alias address changed: grants follow */ + public function onAddressRenamed(string $old, string $new): void + { + $ids = $this->repo->groupIdsOfAccount($old); + if (!empty($ids) && $old !== $new) { + $this->effects->apply($this->repo->renameAccount($old, $new, $ids), []); + } + } +} diff --git a/data/web/inc/lib/mailcow/MailboxGroup/Service/ChangeEffects.php b/data/web/inc/lib/mailcow/MailboxGroup/Service/ChangeEffects.php new file mode 100644 index 000000000..5a975c810 --- /dev/null +++ b/data/web/inc/lib/mailcow/MailboxGroup/Service/ChangeEffects.php @@ -0,0 +1,40 @@ +templates->effective($usernames); + } + + /** @return array[] warnings (msg values) */ + public function apply(array $sogoUsers, array $snapshot): array + { + $this->sogo->refreshStaticView($sogoUsers); + $effects = $this->repo->takeEffects(); + if ($effects['sogo_acl']) { + $this->sogo->flushCache(); + } + $this->dovecot->flushAuthCache($effects['members']); + return $this->templates->applyChanged($snapshot); + } +} diff --git a/data/web/inc/lib/mailcow/MailboxGroup/Service/GroupService.php b/data/web/inc/lib/mailcow/MailboxGroup/Service/GroupService.php new file mode 100644 index 000000000..3780a1b40 --- /dev/null +++ b/data/web/inc/lib/mailcow/MailboxGroup/Service/GroupService.php @@ -0,0 +1,485 @@ +context->hasAdminRights() + || ($this->context->isDomainAdmin() && $this->context->hasAcl('mailbox_groups')); + } + + /** @throws AccessDenied unless the caller may edit groups at all */ + public function requireEditor(): void + { + if (!$this->canRead() || $this->context->isReadOnlyApi()) { + throw new AccessDenied(); + } + } + + public function get(int $id): ?Group + { + return $this->canRead() ? $this->repo->findVisible($id, $this->context) : null; + } + + /** @return int[] */ + public function visibleIds(array $domains = []): array + { + return $this->canRead() ? $this->repo->visibleIds($this->context, $domains) : []; + } + + public function canEdit(Group $group): bool + { + if ($this->context->isReadOnlyApi() || !$this->canRead()) { + return false; + } + if ($this->context->hasAdminRights()) { + return true; + } + if (!$this->context->canAccessDomain($group->domain)) { + return false; + } + // Grants on foreign domains or mailboxes make the group read-only for a domain admin + foreach ($group->sendAs as $address) { + if (!$this->context->canAccessDomain(self::domainOf($address))) { + return false; + } + } + foreach (array_merge($group->imapGrants, $group->sogoGrants) as $grant) { + if (!$this->context->canAccessMailbox((string)$grant['owner'])) { + return false; + } + } + return true; + } + + public function toArray(Group $group): array + { + return $group->toArray($this->canEdit($group)); + } + + /** @throws UserError */ + public function create(array $input): Group + { + $this->requireEditor(); + $group = new Group(); + $group->domain = $this->domainFor($input['domain'] ?? null); + $this->apply($group, $input, null); + $snapshot = $this->effects->snapshot($group->usernames()); + $sogo = $this->repo->insert($group); + $group->warnings = array_merge($this->sizeWarnings($group), $this->effects->apply($sogo, $snapshot), + $this->sharing->applyImap((int)$group->id), $this->sharing->applySogo((int)$group->id)); + return $group; + } + + /** + * Updates a group; attributes missing in $input keep their value. `reapply_template` (admin) applies the + * effective templates to all members again. + * + * @throws UserError + */ + public function update(int $id, array $input): Group + { + $this->requireEditor(); + $current = $this->editable($id); + $group = clone $current; + $this->apply($group, $input, $current); + $snapshot = $this->effects->snapshot(array_merge($current->usernames(), $group->usernames())); + $sogo = $this->repo->update($group); + $group->warnings = array_merge($this->sizeWarnings($group), $this->effects->apply($sogo, $snapshot), + $this->sharing->applyImap((int)$group->id), $this->sharing->applySogo((int)$group->id)); + if ($this->context->hasAdminRights() && self::flag($input['reapply_template'] ?? 0) === 1) { + $group->warnings = array_merge($group->warnings, $this->templates->applyTo($group->usernames())); + } + return $group; + } + + /** + * Deletes a group and returns it. Members keep their settings; another group's template may now apply. + * + * @throws UserError + */ + public function delete(int $id): Group + { + $this->requireEditor(); + $group = $this->editable($id); + $snapshot = $this->effects->snapshot($group->usernames()); + $this->sharing->removeImap($group); + $sogo = $this->repo->delete($id); + $group->warnings = $this->effects->apply($sogo, $snapshot); + return $group; + } + + /** + * Groups of a mailbox, its effective group template and the addresses it may send as through groups. + * For the mailbox itself and for admins/domain admins with access to it. + */ + public function membershipsOf(string $username): array + { + $username = strtolower(trim($username)); + $own = ($this->context->isUser() && $this->context->username === $username); + if (!$own && !($this->canRead() && $this->context->canAccessMailbox($username))) { + return []; + } + return [ + 'groups' => $this->lookup->membershipsOf($username), + 'template' => $this->templates->effective([$username])[$username] ?? null, + 'send_as' => $this->lookup->sendAsOf($username), + ]; + } + + /** @throws AccessDenied when the caller cannot see or edit the group */ + private function editable(int $id): Group + { + $group = $this->get($id); + if ($group === null || !$this->canEdit($group)) { + throw new AccessDenied(); + } + return $group; + } + + /** @throws UserError domain_not_found, access_denied */ + private function domainFor(mixed $value): string + { + $domain = Input::text($value); + $domain = ($domain === null || $domain === '') ? '' : (string)idn_to_ascii(strtolower($domain), 0, INTL_IDNA_VARIANT_UTS46); + if ($domain === '' || !$this->lookup->isDomain($domain)) { + throw new UserError('domain_not_found', [htmlspecialchars((string)Input::text($value))]); + } + if (!$this->context->hasAdminRights() && !$this->context->canAccessDomain($domain)) { + throw new AccessDenied(); + } + return $domain; + } + + /** + * Add/edit rules shared by create() and update(): attributes missing in $input keep the value of $group, + * a new group starts with the model defaults. Everything is validated before anything is written. + * + * @throws UserError + */ + private function apply(Group $group, array $input, ?Group $current): void + { + $name = isset($input['name']) ? Input::text($input['name']) : $group->name; + if ($name === null || $name === '' || mb_strlen($name) > 100) { + throw new UserError('group_name_invalid'); + } + $description = isset($input['description']) ? Input::text($input['description']) : $group->description; + if ($description === null || mb_strlen($description) > 255) { + throw new UserError('group_description_invalid'); + } + if ($this->repo->nameExists($group->domain, $name, $group->id)) { + throw new UserError('object_exists', [htmlspecialchars($name)]); + } + $group->name = $name; + $group->description = $description; + foreach (['sender_allowed' => 'senderAllowed', 'sogo_visible' => 'sogoVisible', 'internal' => 'internal', 'active' => 'active'] as $key => $property) { + if (isset($input[$key])) { + $group->$property = self::flag($input[$key]); + } + } + $this->applyAddress($group, $input, $current); + $this->applyMembers($group, $input); + $this->applySendAs($group, $input); + $this->applyGrants($group, $input); + if ($this->context->hasAdminRights()) { + $this->applyAdminFields($group, $input); + } + } + + /** @throws UserError */ + private function applyAddress(Group $group, array $input, ?Group $current): void + { + if (array_key_exists('address', $input)) { + $value = Input::text($input['address']); + } elseif (array_key_exists('local_part', $input)) { + $local = Input::text($input['local_part']); + $value = ($local === null || $local === '') ? $local : $local . '@' . $group->domain; + } else { + return; + } + if ($value === '') { + $group->address = null; + return; + } + $address = ($value === null) ? null : self::normalizeAddress($value); + if ($address === null || self::domainOf($address) !== $group->domain) { + throw new UserError('group_address_invalid', [htmlspecialchars((string)$value)]); + } + $group->address = $address; + if ($address === $current?->address) { + return; + } + if ($this->lookup->addressTaken($address, $group->id)) { + throw new UserError('is_alias_or_mailbox', [htmlspecialchars($address)]); + } + // A group with an address counts like an alias of the domain + if ($current?->address === null && $this->lookup->aliasesLeft($group->domain) < 1) { + throw new UserError('max_alias_exceeded'); + } + } + + /** + * `members` replaces the manual members the caller may access, `add_members` / `remove_members` change them. + * + * @throws UserError group_member_invalid, group_member_idp, access_denied + */ + private function applyMembers(Group $group, array $input): void + { + $members = $group->members; + $add = []; + if (array_key_exists('members', $input)) { + $add = self::cleanList($input['members']); + foreach ($members as $username => $source) { + if ($source === Group::SOURCE_MANUAL && !in_array((string)$username, $add, true) && $this->context->canAccessMailbox((string)$username)) { + unset($members[$username]); + } + } + } + $add = array_merge($add, self::cleanList($input['add_members'] ?? [])); + foreach (self::cleanList($input['remove_members'] ?? []) as $username) { + if (!isset($members[$username])) { + continue; + } + if ($members[$username] === Group::SOURCE_IDP) { + throw new UserError('group_member_idp', [htmlspecialchars($username)]); + } + if (!$this->context->canAccessMailbox($username)) { + throw new AccessDenied(); + } + unset($members[$username]); + } + $new = array_values(array_diff(array_unique($add), array_map('strval', array_keys($members)))); + $regular = $this->lookup->regularMailboxes($new); + foreach ($new as $username) { + if (!in_array($username, $regular, true)) { + throw new UserError('group_member_invalid', [htmlspecialchars($username)]); + } + if (!$this->context->canAccessMailbox($username)) { + throw new AccessDenied(); + } + $members[$username] = Group::SOURCE_MANUAL; + } + ksort($members); + $group->members = $members; + } + + /** + * Addresses (mailboxes or aliases) and @domain the members may send as; the editor needs access to their domains. + * + * @throws UserError group_send_as_invalid, access_denied + */ + private function applySendAs(Group $group, array $input): void + { + if (!array_key_exists('send_as', $input)) { + return; + } + $sendAs = []; + foreach (self::cleanList($input['send_as']) as $value) { + if (str_starts_with($value, '@')) { + $domain = (string)idn_to_ascii(substr($value, 1), 0, INTL_IDNA_VARIANT_UTS46); + $address = '@' . $domain; + $valid = ($domain !== '' && $this->lookup->isDomainOrAliasDomain($domain)); + } else { + $address = self::normalizeAddress($value); + // The group's own address is covered by sender_allowed + $valid = ($address !== null && $address !== $group->address && $this->lookup->aliasExists($address)); + } + if (!$valid) { + throw new UserError('group_send_as_invalid', [htmlspecialchars($value)]); + } + if (!$this->context->hasAdminRights() && !$this->context->canAccessDomain(self::domainOf((string)$address))) { + throw new AccessDenied(); + } + $sendAs[] = (string)$address; + } + $sendAs = array_values(array_unique($sendAs)); + sort($sendAs); + $group->sendAs = $sendAs; + } + + /** + * `imap_grants` [{owner, rights, subscribe}] and `sogo_grants` [{owner, type, folder, access, subscribe}] replace + * the grants; the editor needs access to every owner mailbox. + * + * @throws UserError group_grant_invalid, access_denied + */ + private function applyGrants(Group $group, array $input): void + { + if (array_key_exists('imap_grants', $input)) { + $grants = []; + foreach (self::grantList($input['imap_grants']) as $grant) { + $owner = $this->grantOwner($grant); + $rights = Input::text($grant['rights'] ?? 'read'); + if (!isset(SharingService::IMAP_RIGHTS[$rights])) { + throw new UserError('group_grant_invalid', [htmlspecialchars($owner)]); + } + $grants[$owner] = ['owner' => $owner, 'rights' => $rights, 'subscribe' => self::flag($grant['subscribe'] ?? 0)]; + } + ksort($grants); + $group->imapGrants = array_values($grants); + } + if (array_key_exists('sogo_grants', $input)) { + $grants = []; + foreach (self::grantList($input['sogo_grants']) as $grant) { + $owner = $this->grantOwner($grant); + $type = Input::text($grant['type'] ?? 'Calendar'); + $folder = Input::text($grant['folder'] ?? '') ?: 'personal'; + $access = Input::text($grant['access'] ?? 'read'); + if (!isset(GroupRepository::SOGO_ROLES[$type][$access]) || !preg_match('/^[A-Za-z0-9._-]{1,100}$/', $folder)) { + throw new UserError('group_grant_invalid', [htmlspecialchars($owner)]); + } + $grants[$owner . '|' . $type . '|' . $folder] = ['owner' => $owner, 'type' => $type, 'folder' => $folder, 'access' => $access, + 'subscribe' => self::flag($grant['subscribe'] ?? 0)]; + } + ksort($grants); + $group->sogoGrants = array_values($grants); + } + } + + /** @throws UserError group_grant_invalid, access_denied */ + private function grantOwner(array $grant): string + { + $owner = strtolower((string)Input::text($grant['owner'] ?? '')); + if ($owner === '' || empty($this->lookup->regularMailboxes([$owner]))) { + throw new UserError('group_grant_invalid', [htmlspecialchars($owner)]); + } + if (!$this->context->canAccessMailbox($owner)) { + throw new AccessDenied(); + } + return $owner; + } + + /** + * Grant objects of a JSON body or of a form field (JSON string) + * + * @throws UserError group_grant_invalid + */ + private static function grantList(mixed $value): array + { + if (is_string($value)) { + $value = ($value === '') ? [] : json_decode($value, true); + } + if (!is_array($value)) { + throw new UserError('group_grant_invalid', ['']); + } + foreach ($value as $grant) { + if (!is_array($grant)) { + throw new UserError('group_grant_invalid', ['']); + } + } + return array_values($value); + } + + /** @throws UserError template_id_invalid, group_priority_invalid */ + private function applyAdminFields(Group $group, array $input): void + { + if (array_key_exists('template_id', $input)) { + $id = $input['template_id']; + if ($id === null || $id === '' || $id === '0' || $id === 0) { + $group->templateId = null; + $group->template = null; + } else { + $templateId = Input::intInRange($id, 1, PHP_INT_MAX); + $name = ($templateId === null) ? null : $this->lookup->templateName($templateId); + if ($name === null) { + throw new UserError('template_id_invalid', [htmlspecialchars((string)Input::text($id))]); + } + $group->templateId = $templateId; + $group->template = $name; + } + } + if (isset($input['priority'])) { + $priority = Input::intInRange($input['priority'], -1000000, 1000000); + if ($priority === null) { + throw new UserError('group_priority_invalid'); + } + $group->priority = $priority; + } + if (array_key_exists('idp_ref', $input)) { + $ref = Input::text($input['idp_ref']); + if ($ref === null || mb_strlen($ref) > 255) { + throw new AccessDenied(); + } + $group->idpRef = ($ref === '') ? null : $ref; + } + } + + /** @return array[] */ + private function sizeWarnings(Group $group): array + { + if ($group->address !== null && count($group->members) > self::MAX_RECIPIENTS) { + return [['group_too_many_members', htmlspecialchars($group->name), self::MAX_RECIPIENTS]]; + } + return []; + } + + /** Checkbox or API flag; a hidden "0" + checkbox pair arrives as ["0", "1"] when checked */ + private static function flag(mixed $value): int + { + if (is_array($value)) { + $value = end($value); + } + return filter_var($value, FILTER_VALIDATE_BOOLEAN) ? 1 : 0; + } + + /** @return string[] trimmed, lowercase, unique entries of an array or of a string separated by spaces, commas, semicolons or newlines */ + private static function cleanList(mixed $value): array + { + $values = is_array($value) ? $value : preg_split('/[\s,;]+/', is_scalar($value) ? (string)$value : ''); + $clean = []; + foreach ($values as $item) { + if (is_scalar($item) && trim((string)$item) !== '') { + $clean[] = strtolower(trim((string)$item)); + } + } + return array_values(array_unique($clean)); + } + + /** Lowercase address with ASCII (IDN) domain, null if invalid */ + private static function normalizeAddress(string $value): ?string + { + $value = strtolower(trim($value)); + $at = strrpos($value, '@'); + if ($at === false || $at === 0) { + return null; + } + $domain = idn_to_ascii(substr($value, $at + 1), 0, INTL_IDNA_VARIANT_UTS46); + $address = substr($value, 0, $at) . '@' . $domain; + return ($domain !== false && filter_var($address, FILTER_VALIDATE_EMAIL)) ? $address : null; + } + + private static function domainOf(string $address): string + { + return substr($address, strrpos($address, '@') + 1); + } +} diff --git a/data/web/inc/lib/mailcow/MailboxGroup/Service/IdpSyncService.php b/data/web/inc/lib/mailcow/MailboxGroup/Service/IdpSyncService.php new file mode 100644 index 000000000..1f2711068 --- /dev/null +++ b/data/web/inc/lib/mailcow/MailboxGroup/Service/IdpSyncService.php @@ -0,0 +1,124 @@ +repo->findByIdpRef($ref); + } + + /** @return array[] every group with its members, see GroupRepository::syncState() */ + public function groups(): array + { + return $this->repo->syncState(); + } + + /** + * Creates the group of an IdP group, members follow with syncGroupMembers(). The group mail becomes the + * distribution address when it is in the group's domain and free. + * + * @return array[] warnings (msg values) + * @throws UserError + */ + public function createFromIdp(string $ref, string $name, string $domain, ?string $mail): array + { + $name = $this->validName($domain, $name, null); + if (!$this->lookup->isDomain($domain)) { + throw new UserError('domain_not_found', [htmlspecialchars($domain)]); + } + $group = new Group(); + $group->domain = $domain; + $group->name = $name; + $group->idpRef = $ref; + $warnings = []; + if ($mail !== null && filter_var($mail, FILTER_VALIDATE_EMAIL) && str_ends_with($mail, '@' . $domain)) { + if ($this->lookup->addressTaken($mail, null) || $this->lookup->aliasesLeft($domain) < 1) { + $warnings[] = ['group_idp_address_skipped', htmlspecialchars($mail), htmlspecialchars($name)]; + } else { + $group->address = $mail; + } + } + $this->repo->insert($group); + return $warnings; + } + + /** @throws UserError */ + public function renameFromIdp(int $groupId, string $name): void + { + $group = $this->repo->find($groupId); + if ($group === null) { + return; + } + $group->name = $this->validName($group->domain, $name, $groupId); + $this->repo->update($group); + } + + /** + * Sets the IdP members of a group. Usernames that are no regular mailbox are skipped; a manual member that + * the IdP also lists stays manual. + * + * @return array{added: string[], removed: string[], skipped: string[], warnings: array[]} + */ + public function syncGroupMembers(int $groupId, array $usernames): array + { + $result = ['added' => [], 'removed' => [], 'skipped' => [], 'warnings' => []]; + $group = $this->repo->find($groupId); + if ($group === null) { + return $result; + } + $wanted = array_values(array_unique(array_map(fn(mixed $u): string => strtolower(trim((string)$u)), $usernames))); + $regular = $this->lookup->regularMailboxes($wanted); + $result['skipped'] = array_values(array_diff($wanted, $regular)); + $members = $group->members; + foreach ($members as $username => $source) { + if ($source === Group::SOURCE_IDP && !in_array((string)$username, $regular, true)) { + unset($members[$username]); + $result['removed'][] = (string)$username; + } + } + foreach ($regular as $username) { + if (!isset($members[$username])) { + $members[$username] = Group::SOURCE_IDP; + $result['added'][] = $username; + } + } + if (empty($result['added']) && empty($result['removed'])) { + return $result; + } + ksort($members); + $snapshot = $this->effects->snapshot(array_merge($group->usernames(), array_keys($members))); + $group->members = $members; + $result['warnings'] = $this->effects->apply($this->repo->update($group), $snapshot); + return $result; + } + + /** @throws UserError */ + private function validName(string $domain, string $name, ?int $groupId): string + { + $name = trim($name); + if ($name === '' || mb_strlen($name) > 100) { + throw new UserError('group_name_invalid'); + } + if ($this->repo->nameExists($domain, $name, $groupId)) { + throw new UserError('object_exists', [htmlspecialchars($name)]); + } + return $name; + } +} diff --git a/data/web/inc/lib/mailcow/MailboxGroup/Service/SharingService.php b/data/web/inc/lib/mailcow/MailboxGroup/Service/SharingService.php new file mode 100644 index 000000000..1453c3851 --- /dev/null +++ b/data/web/inc/lib/mailcow/MailboxGroup/Service/SharingService.php @@ -0,0 +1,169 @@ + on every folder of the owner; members get the group through + * the userdb field acl_groups, so membership changes need no ACL change. Dovecot is reached through dockerapi + * after the commit; subfolders created later inherit the ACL, new top-level folders and failed grants are + * handled by reconcile() (cron). + * SOGo: sogo_acl rows per member, maintained by GroupRepository::rebuild(); missing personal folders of owners that + * never logged in to SOGo (shared mailboxes) are created with sogo-tool init-user. + * Grants with `subscribe` are subscribed for each member once by syncSubscriptions(); a member that removes the + * subscription keeps it removed, members that lose the access are unsubscribed. + */ +class SharingService +{ + /** Dovecot rights per grant level */ + public const IMAP_RIGHTS = [ + 'read' => ['lookup', 'read', 'write-seen'], + 'write' => ['lookup', 'read', 'write-seen', 'write', 'write-deleted', 'insert', 'post', 'expunge', 'create'], + 'full' => ['lookup', 'read', 'write-seen', 'write', 'write-deleted', 'insert', 'post', 'expunge', 'create', 'delete'], + ]; + + public function __construct(private GroupRepository $repo, private DovecotService $dovecot, private SogoService $sogo, + private ChangeEffects $effects) + { + } + + /** Group name in the userdb field acl_groups (dovecot docker-entrypoint.sh) */ + public static function aclGroup(int $groupId): string + { + return 'mcg_' . $groupId; + } + + /** + * Applies the IMAP grants Dovecot does not have yet (pending, failed, removing); $all also applies the applied + * ones again. Of one group or all. + * + * @return array[] warnings (msg values) + */ + public function applyImap(?int $groupId, bool $all = false): array + { + $warnings = []; + foreach ($this->repo->imapGrantsToApply($groupId, $all) as $grant) { + $removing = ($grant['state'] === 'removing'); + $error = $this->dovecot->setAclAll((string)$grant['owner'], 'group=' . self::aclGroup((int)$grant['group_id']), + $removing ? [] : self::IMAP_RIGHTS[$grant['rights']]); + if ($error === null && $removing) { + $this->repo->deleteImapGrant((int)$grant['id']); + continue; + } + if ($error === null) { + if ($grant['state'] !== 'applied' || $grant['last_error'] !== null) { + $this->repo->setImapState((int)$grant['id'], 'applied', null); + } + continue; + } + $this->repo->setImapState((int)$grant['id'], $removing ? 'removing' : 'failed', $error); + $warnings[] = ['group_imap_grant_failed', htmlspecialchars((string)$grant['owner'])]; + } + return $warnings; + } + + /** After a group write: creates missing SOGo folders of its grant owners and applies the pending grants to them */ + public function applySogo(int $groupId): array + { + $warnings = $this->initSogoFolders($groupId); + // null: no grant waits for a folder, warnings: the folders could not be created + if ($warnings === null || $warnings !== []) { + return $warnings ?? []; + } + return $this->effects->apply($this->repo->rebuild($groupId), []); + } + + /** Before a group is deleted: its Dovecot ACLs go (best effort, the ACL of a deleted group grants nothing) */ + public function removeImap(Group $group): void + { + foreach ($group->imapGrants as $grant) { + $this->dovecot->setAclAll((string)$grant['owner'], 'group=' . self::aclGroup((int)$group->id), []); + } + } + + /** + * Cron: applies all IMAP grants again (new top-level folders, failed grants), rebuilds the SOGo grants + * (owners that opened SOGo meanwhile, rows of removed grants) and syncs the SOGo subscriptions. + * + * @return array[] warnings (msg values) + */ + public function reconcile(): array + { + $warnings = array_merge($this->applyImap(null, true), $this->initSogoFolders(null) ?? []); + $users = []; + foreach ($this->repo->groupIdsWithSogoGrants() as $id) { + $users = array_merge($users, $this->repo->rebuild($id)); + } + $this->repo->cleanupSogoAcl(); + $warnings = array_merge($warnings, $this->effects->apply(array_values(array_unique($users)), [])); + return array_merge($warnings, $this->syncSubscriptions()); + } + + /** + * Unsubscribes members that lost the access to a folder mailcow subscribed them to, then subscribes the members + * of grants with `subscribe` that have no subscription by mailcow yet. Cheap without pending changes, the cron + * runs it every minute. + * + * @return array[] warnings (msg values) + */ + public function syncSubscriptions(): array + { + $warnings = []; + $sogoChanged = false; + foreach (['imap', 'sogo'] as $kind) { + foreach ($this->repo->staleSubscriptions($kind) as $row) { + // A deleted member has no subscriptions left, a deleted owner no folders; another group may still grant it + if ($row['member_exists'] && $row['owner_exists'] && !$row['covered']) { + if ($this->subscribe($kind, (string)$row['owner'], (string)$row['folder'], [(string)$row['username']], true) !== null) { + $warnings[] = ['group_subscription_failed', htmlspecialchars((string)$row['username'])]; + continue; + } + $sogoChanged = $sogoChanged || ($kind === 'sogo'); + } + $this->repo->deleteSubscription((int)$row['id']); + } + foreach ($this->repo->missingSubscriptions($kind) as $grant) { + if ($this->subscribe($kind, $grant['owner'], $grant['folder'], $grant['usernames']) !== null) { + $warnings[] = ['group_subscription_failed', htmlspecialchars(implode(', ', $grant['usernames']))]; + continue; + } + $this->repo->addSubscriptions($kind, $grant['grant_id'], $grant['owner'], $grant['folder'], $grant['usernames']); + $sogoChanged = $sogoChanged || ($kind === 'sogo'); + } + } + if ($sogoChanged) { + $this->sogo->flushCache(); + } + return $warnings; + } + + /** @return ?string null on success, else the error */ + private function subscribe(string $kind, string $owner, string $folder, array $usernames, bool $unsubscribe = false): ?string + { + return ($kind === 'imap') ? $this->dovecot->subscribeShared($owner, $usernames, $unsubscribe) + : $this->sogo->subscribe($owner, $folder, $usernames, $unsubscribe); + } + + /** + * Creates the personal SOGo folders of grant owners that never logged in to SOGo, so their pending grants can + * be applied. + * + * @return ?array[] warnings, null if no grant was waiting for a folder + */ + private function initSogoFolders(?int $groupId): ?array + { + $owners = $this->repo->pendingSogoOwners($groupId); + if (empty($owners)) { + return null; + } + return ($this->sogo->initUsers($owners) === null) ? [] : [['group_sogo_init_failed', htmlspecialchars(implode(', ', $owners))]]; + } +} diff --git a/data/web/inc/lib/mailcow/MailboxGroup/Service/TemplateService.php b/data/web/inc/lib/mailcow/MailboxGroup/Service/TemplateService.php new file mode 100644 index 000000000..af8f0f028 --- /dev/null +++ b/data/web/inc/lib/mailcow/MailboxGroup/Service/TemplateService.php @@ -0,0 +1,83 @@ + username => effective group template */ + public function effective(array $usernames): array + { + return $this->lookup->effectiveTemplates(array_values(array_unique($usernames))); + } + + /** + * Applies the effective template to the mailboxes whose effective template differs from $before + * (a snapshot of effective() taken before the change). + * + * @return array[] warnings (msg values) + */ + public function applyChanged(array $before): array + { + $changed = []; + foreach ($this->effective(array_keys($before)) as $username => $template) { + if ($template !== null && $template !== $before[$username]) { + $changed[$username] = $template; + } + } + return $this->apply($changed); + } + + /** Applies the effective templates again, e.g. after manual changes (admin action) */ + public function applyTo(array $usernames): array + { + return $this->apply(array_filter($this->effective($usernames), fn(?string $template): bool => $template !== null)); + } + + /** A template was edited: apply it to the mailboxes it is the effective template of */ + public function onTemplateChanged(int $templateId): array + { + $name = $this->lookup->templateName($templateId); + if ($name === null) { + return []; + } + return $this->apply(array_filter($this->effective($this->lookup->membersWithTemplate($templateId)), + fn(?string $template): bool => $template === $name)); + } + + /** Template for IdP logins and syncs: the effective group template, else the legacy attribute mapping */ + public function templateForLogin(string $username, ?string $legacy): ?string + { + return $this->effective([$username])[$username] ?? $legacy; + } + + /** + * @param array $templates username => template + * @return array[] warnings (msg values) + */ + private function apply(array $templates): array + { + $warnings = []; + $names = $this->lookup->mailboxNames(array_keys($templates)); + foreach ($templates as $username => $template) { + $error = $this->legacy->applyTemplate((string)$username, (string)($names[$username] ?? ''), $template); + if ($error !== null) { + $warnings[] = ['group_template_failed', htmlspecialchars($template), htmlspecialchars((string)$username)]; + } + } + return $warnings; + } +} diff --git a/data/web/inc/lib/mailcow/README.md b/data/web/inc/lib/mailcow/README.md index 7bf2fb2e7..4eb89aaa6 100644 --- a/data/web/inc/lib/mailcow/README.md +++ b/data/web/inc/lib/mailcow/README.md @@ -30,6 +30,15 @@ Core/ shared by all modules Example: `Imapsync/` (sync jobs, sync sources, OAuth). Use it as the template for new modules. `ApiKey/` (API keys incl. the service keys of mailcow.conf) is a small module with the same layout. +`MailboxGroup/` (mailbox groups) keeps its own tables as source of truth and maintains rows the legacy code and +Postfix read (`alias`, `sender_acl`, tagged with `group_id`); calls into procedural code go through `Legacy/`. +Shares become Dovecot ACLs on `group=mcg_` (userdb `acl_groups`) and `sogo_acl` rows tracked in a ledger. +`Dovecot/` (doveadm through dockerapi: ACLs, subscriptions, auth cache) and `Sogo/` (user view, cache, sogo-tool +through dockerapi) are used by other modules instead of calling `docker()` or the SOGo functions themselves. +`Identity/` (IdP links, sync runs, offboarding) lists Keycloak/LDAP through `Directory/` adapters, decides in the +side-effect free `SyncPlanner` and is run by the `identity-sync.php` cron. +`Auth/` (logins) holds for now the IdP login steps the legacy login flows call (link checks fail closed, group +template before the attribute mapping); the auth logic of the function files moves here step by step. ## Layers and rules diff --git a/data/web/inc/lib/mailcow/Sogo/Service/SogoService.php b/data/web/inc/lib/mailcow/Sogo/Service/SogoService.php new file mode 100644 index 000000000..530031470 --- /dev/null +++ b/data/web/inc/lib/mailcow/Sogo/Service/SogoService.php @@ -0,0 +1,80 @@ + self::SINGLE_UPDATES) { + $this->updateStaticView(null); + return; + } + foreach ($usernames as $username) { + $this->updateStaticView($username); + } + } + + /** SOGo caches ACLs and user settings in memcached */ + public function flushCache(): void + { + $this->flushMemcached(); + } + + /** + * Subscribes the users to a folder of the owner (sogo-tool manage-acl), or unsubscribes them. + * + * @param string $folder Calendar/ or Contacts/ + * @return ?string null on success, else the error of dockerapi + */ + public function subscribe(string $owner, string $folder, array $usernames, bool $unsubscribe = false): ?string + { + return self::error($this->exec(['cmd' => 'sogo', 'task' => 'subscribe', 'owner' => $owner, 'folder' => $folder, + 'users' => array_values($usernames), 'unsubscribe' => $unsubscribe])); + } + + /** + * Creates the personal folders of users that never logged in to SOGo (sogo-tool init-user). + * + * @return ?string null on success, else the error of dockerapi + */ + public function initUsers(array $usernames): ?string + { + return self::error($this->exec(['cmd' => 'sogo', 'task' => 'init_user', 'users' => array_values($usernames)])); + } + + protected function updateStaticView(?string $username): void + { + update_sogo_static_view($username); + } + + protected function flushMemcached(): void + { + flush_memcached(); + } + + protected function exec(array $fields): mixed + { + return docker('post', 'sogo-mailcow', 'exec', $fields); + } + + private static function error(mixed $response): ?string + { + $result = json_decode((string)$response, true); + return (($result['type'] ?? '') === 'success') ? null : (string)($result['msg'] ?? 'dockerapi did not answer'); + } +} diff --git a/data/web/inc/lib/mailcow/Sogo/SogoModule.php b/data/web/inc/lib/mailcow/Sogo/SogoModule.php new file mode 100644 index 000000000..346aaf488 --- /dev/null +++ b/data/web/inc/lib/mailcow/Sogo/SogoModule.php @@ -0,0 +1,22 @@ + ' : '') + esc(m.username); + }).join('
'); + if (members.length > 3) list += '
+' + (members.length - 3) + ''; + return '' + members.length + '
' + list; + } + + function addressCell(item) { + if (!item.address) return '-'; + var flags = []; + if (item.sender_allowed == 1) flags.push(''); + if (item.internal == 1) flags.push(''); + return esc(item.address) + (flags.length ? ' ' + flags.join(' ') : ''); + } + + function drawTable() { + if ($.fn.DataTable.isDataTable('#mailbox_group_table')) { + $('#mailbox_group_table').DataTable().columns.adjust().responsive.recalc(); + return; + } + $('#mailbox_group_table').DataTable({ + responsive: true, + processing: true, + serverSide: false, + stateSave: true, + pageLength: pagination_size, + dom: "<'row'<'col-sm-12 col-md-6'f><'col-sm-12 col-md-6'l>>" + "tr" + + "<'row'<'col-sm-12 col-md-5'i><'col-sm-12 col-md-7'p>>", + language: lang_datatables, + order: [[3, 'asc']], + ajax: { + type: "GET", + url: "/api/v1/get/mailbox-group/all", + dataSrc: function(json) { + if (!Array.isArray(json)) return []; + $.each(json, function(i, item) { + item.chkbox = item.can_edit ? + '' : + ''; + item.name_display = esc(item.name) + (item.idp_ref ? ' ' + esc(L('idp')) + '' : ''); + if (item.description) item.name_display += '
' + esc(item.description) + '
'; + item.address_display = addressCell(item); + item.members_display = membersCell(item.members); + item.send_as_display = (item.send_as || []).map(esc).join('
') || '-'; + item.template_display = item.template ? esc(item.template) + ' (' + esc(item.priority) + ')' : '-'; + item.action = '
' + + ' ' + esc(item.can_edit ? lang.edit : L('view')) + '' + + (item.can_edit ? ' ' + esc(lang.remove) + '' : '') + + '
'; + }); + return json; + }, + error: function() { + mailcow_alert_box(L('list_error'), 'danger'); + } + }, + columns: [ + { + // placeholder, so checkbox will not block child row toggle + title: '', + data: null, + searchable: false, + orderable: false, + defaultContent: '', + responsivePriority: 1 + }, + { title: '', data: 'chkbox', searchable: false, orderable: false, defaultContent: '', responsivePriority: 2 }, + { title: 'ID', data: 'id', defaultContent: '', responsivePriority: 6 }, + { title: L('name'), data: 'name_display', defaultContent: '', responsivePriority: 2 }, + { title: L('domain'), data: 'domain', defaultContent: '', responsivePriority: 5 }, + { title: L('address'), data: 'address_display', defaultContent: '', responsivePriority: 3 }, + { title: L('members'), data: 'members_display', defaultContent: '', responsivePriority: 4 }, + { title: L('send_as'), data: 'send_as_display', defaultContent: '', responsivePriority: 7 }, + { title: L('template'), data: 'template_display', defaultContent: '', responsivePriority: 8 }, + { + title: lang.active, + data: 'active', + defaultContent: '', + responsivePriority: 6, + render: function(d) { return d == 1 ? '' : ''; } + }, + { + title: lang.action, + data: 'action', + orderable: false, + className: 'dt-sm-head-hidden dt-data-w100 dtr-col-md dt-text-right', + responsivePriority: 3, + defaultContent: '' + } + ] + }); + } + + // Share rows (edit page, add modal) are kept as JSON in the hidden form field of their table (imap_grants, sogo_grants) + function syncGrants($table) { + var grants = []; + $table.find('tr.group-grant').each(function() { + var grant = {}; + $(this).find('[data-grant]').each(function() { + grant[$(this).data('grant')] = $(this).is(':checkbox') ? ($(this).is(':checked') ? 1 : 0) : $(this).val(); + }); + if (grant.owner) grants.push(grant); + }); + $table.closest('form').find('input[name="' + $table.data('field') + '"]').val(JSON.stringify(grants)); + } + + $(document).ready(function() { + // @domain suffix of the address in the add modal + $('.mailbox-group-domain-select').on('change', function() { + $(this).closest('form').find('.mailbox-group-domain').text($(this).val()); + }); + $(document).on('change', '.group-grants [data-grant]', function() { + syncGrants($(this).closest('.group-grants')); + }); + $(document).on('click', '.group-grant-add', function(e) { + e.preventDefault(); + var $table = $('#' + $(this).data('table')); + var $body = $table.children('tbody'); + if (!$body.length) $body = $('').appendTo($table); + var $row = $($('#' + $(this).data('table') + '_template').html()).appendTo($body); + $row.find('select').selectpicker({'styleBase': 'btn btn-xs-lg', 'noneSelectedText': lang_footer.nothing_selected}); + syncGrants($table); + }); + $(document).on('click', '.group-grant-del', function(e) { + e.preventDefault(); + var $table = $(this).closest('.group-grants'); + $(this).closest('tr').remove(); + syncGrants($table); + }); + }); + + return { + drawTable: drawTable, + L: L + }; +})(jQuery); diff --git a/data/web/js/site/identity.js b/data/web/js/site/identity.js new file mode 100644 index 000000000..475db5d1b --- /dev/null +++ b/data/web/js/site/identity.js @@ -0,0 +1,104 @@ +// Identity provider sync: status card and run requests (admin system page, identity provider tab). +// Runs are executed by the identity-sync cron (every minute); the card polls until the requested run is done. +var mailcowIdentity = (function($) { + 'use strict'; + + var POLL_MS = 5000; + var POLL_MAX = 36; + var polls = 0; + var timer = null; + var STATUS_CLASS = {ok: 'bg-success', blocked: 'bg-warning text-dark', error: 'bg-danger', pending: 'bg-secondary', running: 'bg-info text-dark'}; + // summary counts in display order + var COUNTS = ['creates', 'links', 'deactivate', 'restore', 'release', 'missing', 'found', 'updates', 'group_creates', 'group_renames', + 'memberships', 'orphaned_groups', 'membership_removals', 'conflicts', 'errors', 'skipped']; + var DETAILS = ['conflicts', 'errors', 'deactivate', 'restore', 'missing', 'creates', 'group_creates']; + + // admin.twig injects the admin lang section as `lang` + function L(key) { + var src = (typeof lang_admin !== 'undefined') ? lang_admin : ((typeof lang !== 'undefined') ? lang : {}); + return (src[key] !== undefined) ? src[key] : key; + } + function esc(s) { + return escapeHtml(s === null || s === undefined ? '' : String(s)); + } + + function badge(label, value, cls) { + return '' + esc(label) + ': ' + esc(value) + ''; + } + + function changes(run) { + var s = run.summary; + if (!s) return ''; + if (s.error) return '' + esc(s.error) + ''; + var counts = s.counts || {}; + var html = ''; + $.each(COUNTS, function(i, key) { + if (counts[key] > 0) html += badge(L('iam_sync_count_' + key), counts[key], (key === 'errors' || key === 'conflicts') ? 'bg-danger' : null); + }); + if (html === '') html = '' + esc(L('iam_sync_no_changes')) + ''; + var details = $.extend({}, s.details || {}, {errors: s.errors || []}); + var lists = ''; + $.each(DETAILS, function(i, key) { + var items = details[key] || []; + if (!items.length) return; + lists += '
' + esc(L('iam_sync_count_' + key)) + '
    ' + + $.map(items, function(item) { return '
  • ' + esc(item) + '
    • '; }).join('') + '
'; + }); + if (lists !== '') html += '
' + esc(L('iam_sync_details')) + '' + lists + '
'; + return html; + } + + function render(status) { + var c = status.counts || {}; + var counts = badge(L('iam_sync_accounts'), c.accounts || 0) + badge(L('iam_sync_linked'), c.linked || 0) + + badge(L('iam_sync_idp_disabled'), c.idp_disabled || 0, c.idp_disabled ? 'bg-warning text-dark' : null) + + badge(L('iam_sync_missing'), c.missing || 0, c.missing ? 'bg-warning text-dark' : null); + if (!status.sync_enabled) counts += '
' + esc(L('iam_sync_off')) + '
'; + $('#iam_sync_counts').html(counts); + var rows = $.map(status.runs || [], function(run) { + var state = '' + esc(L('iam_sync_status_' + run.status)) + ''; + return '' + esc(run.started || run.created) + '' + + '' + esc(L('iam_sync_mode_' + run.mode)) + (run.requested_by ? '
' + esc(run.requested_by) + '
' : '') + '' + + '' + state + '' + changes(run) + ''; + }); + $('#iam_sync_runs tbody').html(rows.length ? rows.join('') : '' + esc(L('iam_sync_none')) + ''); + return status.runs && status.runs.length && (status.runs[0].status === 'pending' || status.runs[0].status === 'running'); + } + + function load() { + clearTimeout(timer); + $.get('/api/v1/get/identity-provider/sync-status', function(status) { + if (render(status || {}) && polls++ < POLL_MAX) timer = setTimeout(load, POLL_MS); + }, 'json'); + } + + function request(mode) { + $.ajax({ + type: 'POST', + dataType: 'json', + url: '/api/v1/edit/identity-provider-sync', + data: {items: JSON.stringify(['sync']), attr: JSON.stringify({mode: mode}), csrf_token: csrf_token}, + success: function(res) { + var msg = (res && res[0]) ? res[0] : {type: 'danger', msg: 'generic_server_error'}; + var key = $.isArray(msg.msg) ? msg.msg[0] : msg.msg; + var text = (msg.type === 'success' ? lang_success : lang_danger)[key] || key; + mailcow_alert_box(text, msg.type === 'success' ? 'success' : 'danger'); + polls = 0; + load(); + } + }); + } + + $(document).ready(function() { + if (!$('#iam_sync_status').length) return; + load(); + $(document).on('click', '.iam_sync_request', function(e) { + e.preventDefault(); + var mode = $(this).data('mode'); + if (mode === 'force' && !confirm(L('iam_sync_force_confirm'))) return; + request(mode); + }); + }); + + return {load: load}; +})(jQuery); diff --git a/data/web/js/site/mailbox.js b/data/web/js/site/mailbox.js index e073650d3..32de2a8d1 100644 --- a/data/web/js/site/mailbox.js +++ b/data/web/js/site/mailbox.js @@ -120,6 +120,10 @@ $(document).ready(function() { } }); }); + // Shared mailboxes need no password, the server sets a random one + $('#add_mailbox_shared').on('change', function() { + $(this).closest('form').find('input[name="password"], input[name="password2"]').prop('required', !this.checked); + }); // @Open Mailbox add modal $('#addMailboxModal').on('show.bs.modal', function(e) { $.ajax({ @@ -996,6 +1000,9 @@ jQuery(function($){ 'style="min-width:2em;width:' + item.percent_in_use + '%">' + item.percent_in_use + '%' + '' }; item.username = escapeHtml(item.username); + if (item.attributes && item.attributes.shared == '1') { + item.username += ' ' + escapeHtml(lang.shared_mailbox) + ''; + } item.name = escapeHtml(item.name); if (Array.isArray(item.tags)){ @@ -1926,6 +1933,12 @@ jQuery(function($){ ' ' + lang.remove + '' + ''; item.chkbox = ''; + if (item.group_id) { + // Distribution address of a group: changed through the group + item.action = ' ' + + escapeHtml((lang.groups && lang.groups.managed_alias ? lang.groups.managed_alias : '%s').replace('%s', item.group_name)) + ''; + item.chkbox = ''; + } item.goto = escapeHtml(item.goto.replace(/,/g, " ")); if (item.public_comment !== null) { item.public_comment = escapeHtml(item.public_comment); @@ -2479,6 +2492,7 @@ jQuery(function($){ onVisible("[id^=aliasdomain_table]", () => draw_aliasdomain_table()); onVisible("[id^=sync_job_table]", () => draw_sync_job_table()); onVisible("[id^=imapsync_source_table]", () => mailcowImapsync.drawSourceTable(role === 'admin' || acl_data.syncjobs === 1)); + onVisible("[id^=mailbox_group_table]", () => mailcowGroups.drawTable()); onVisible("[id^=filter_table]", () => draw_filter_table()); onVisible("[id^=bcc_table]", () => draw_bcc_table()); onVisible("[id^=recipient_map_table]", () => draw_recipient_map_table()); diff --git a/data/web/json_api.php b/data/web/json_api.php index d1b9807ea..3a6ad2659 100644 --- a/data/web/json_api.php +++ b/data/web/json_api.php @@ -258,6 +258,9 @@ if (isset($_GET['query'])) { case "api-key": process_add_return(\Mailcow\ApiKey\ApiKeyModule::fromGlobals()->api->addKey($attr)); break; + case "mailbox-group": + process_add_return(\Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->addGroup($attr)); + break; case "domain": switch ($object) { case "template": @@ -820,6 +823,22 @@ if (isset($_GET['query'])) { } break; + case "mailbox-group": + switch ($object) { + case "all": + process_get_return(\Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->getGroups($extra)); + break; + + case "member": + process_get_return(\Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->getMemberships((string)$extra)); + break; + + default: + process_get_return(\Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->getGroup($object)); + break; + } + break; + case "logs": switch ($object) { case "dovecot": @@ -1527,12 +1546,17 @@ if (isset($_GET['query'])) { process_get_return($score); break; case "identity-provider": - if($_SESSION['mailcow_cc_role'] === 'admin') { + if ($object == "sync-status") { + process_get_return(\Mailcow\Identity\IdentityModule::fromGlobals()->api->getStatus()); + } elseif($_SESSION['mailcow_cc_role'] === 'admin') { process_get_return($iam_settings); } else { process_get_return(null); } break; + case "identity-link": + process_get_return(\Mailcow\Identity\IdentityModule::fromGlobals()->api->getLink((string)$object)); + break; break; // return no route found if no case is matched default: @@ -1726,6 +1750,9 @@ if (isset($_GET['query'])) { case "api-key": process_delete_return(\Mailcow\ApiKey\ApiKeyModule::fromGlobals()->api->deleteKeys($items)); break; + case "mailbox-group": + process_delete_return(\Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->deleteGroups($items)); + break; case "app-passwd": process_delete_return(app_passwd('delete', array('id' => $items))); break; @@ -1825,6 +1852,9 @@ if (isset($_GET['query'])) { case "identity-provider": process_delete_return(identity_provider('delete')); break; + case "identity-link": + process_delete_return(\Mailcow\Identity\IdentityModule::fromGlobals()->api->unlink($items)); + break; // return no route found if no case is matched default: http_response_code(404); @@ -1894,6 +1924,9 @@ if (isset($_GET['query'])) { case "api-key": process_edit_return(\Mailcow\ApiKey\ApiKeyModule::fromGlobals()->api->editKeys($items, $attr)); break; + case "mailbox-group": + process_edit_return(\Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->editGroups($items, $attr)); + break; case "recipient_map": process_edit_return(recipient_map('edit', array_merge(array('id' => $items), $attr))); break; @@ -2081,6 +2114,9 @@ if (isset($_GET['query'])) { case "identity-provider-test": process_edit_return(identity_provider('test', $attr)); break; + case "identity-provider-sync": + process_edit_return(\Mailcow\Identity\IdentityModule::fromGlobals()->api->requestRun($attr)); + break; case "cors": process_edit_return(cors('edit', $attr)); break; diff --git a/data/web/templates/admin/iam-redirect-urls.twig b/data/web/templates/admin/iam-redirect-urls.twig new file mode 100644 index 000000000..8a4756af8 --- /dev/null +++ b/data/web/templates/admin/iam-redirect-urls.twig @@ -0,0 +1,41 @@ +{# Redirect URLs of the OIDC forms (iam_form = keycloak|generic); row markup is used by addRedirectUrlRow() in admin.js #} +
+
+ +
+
+
+ + + +
+ +
+
+
+
+
+ + {% for key, url in iam_settings.redirect_url_extra %} +
+
+
+ +
+
+ +
+
+
+ {% endfor %} +
+
+
+ +
+
+ +
+
+
+
diff --git a/data/web/templates/admin/iam-sync-settings.twig b/data/web/templates/admin/iam-sync-settings.twig new file mode 100644 index 000000000..bbd88d411 --- /dev/null +++ b/data/web/templates/admin/iam-sync-settings.twig @@ -0,0 +1,153 @@ +{# Sync and group settings of the Keycloak and LDAP forms (iam_form = keycloak|ldap) #} + {{ lang.admin.iam_section_sync }}
+ {% if iam_form == 'keycloak' %} +
+
+ {{ lang.admin.iam_extra_permission|raw }} +
+
+ {% endif %} +
+
+ + +
+
+
+ +
+
+
+
+
+ + +
+
+
+ +
+
+
+
+
+ + +
+
+
+ +
+
+
+
+
+ +
+
+ +
+
+
+
+ + +
+
+ +
+
+ {{ lang.admin.iam_section_groups }}
+
+
+ + +
+
+
+ +
+
+
+ {% if iam_form == 'keycloak' %} +
+
+ + +
+
+ +
+
+ {% else %} +
+
+ +
+
+ +
+
+
+
+ +
+
+ +
+
+
+
+ +
+
+ +
+
+
+
+ +
+
+ +
+
+
+
+ + +
+
+ +
+
+ {% endif %} +
+
+ + +
+
+
+ +
+
+
+
+
+ + +
+
+ +
+
diff --git a/data/web/templates/admin/iam-sync-status.twig b/data/web/templates/admin/iam-sync-status.twig new file mode 100644 index 000000000..f3ebd0f13 --- /dev/null +++ b/data/web/templates/admin/iam-sync-status.twig @@ -0,0 +1,30 @@ +{# Status of the identity sync (Keycloak and LDAP), filled by js/site/identity.js #} +
+
+ {{ lang.admin.iam_sync_status }} +
+ + + +
+
+
+

{{ lang.admin.iam_sync_status_info }}

+
+
+ + + + + + + + + + + + +
{{ lang.admin.iam_sync_started }}{{ lang.admin.iam_sync_mode }}{{ lang.admin.iam_sync_result }}{{ lang.admin.iam_sync_changes }}
{{ lang.admin.iam_sync_none }}
+
+
+
diff --git a/data/web/templates/admin/iam-template-mapping.twig b/data/web/templates/admin/iam-template-mapping.twig new file mode 100644 index 000000000..1b646aa71 --- /dev/null +++ b/data/web/templates/admin/iam-template-mapping.twig @@ -0,0 +1,72 @@ +{# Default template and attribute mapping of all IdP forms (iam_form = keycloak|generic|ldap); row markup is used by + addAttributeMappingRow() in admin.js #} +
+
+ + +
+
+ +
+
+
+
+ + +
+
+
+ {{ lang.user.attribute }} + {{ lang.mailbox.template }} +
+ +
+
+
+
+
+ + + {% for key, role in iam_settings.mappers %} +
+
+
+ +
+
+ +
+
+ +
+
+
+ {% endfor %} +
+
+
+ +
+
+ +
+
+ +
+
+
+
diff --git a/data/web/templates/admin/tab-config-identity-provider.twig b/data/web/templates/admin/tab-config-identity-provider.twig index 4572d7fb5..c40b8305c 100644 --- a/data/web/templates/admin/tab-config-identity-provider.twig +++ b/data/web/templates/admin/tab-config-identity-provider.twig @@ -10,7 +10,7 @@

{{ lang.admin.iam_description|raw }}

- +
+ {{ lang.admin.iam_section_connection }}
- +
- +
@@ -43,6 +45,14 @@
+
+
+ +
+
+ +
+
@@ -62,215 +72,62 @@
-
-
- -
-
-
- - - -
- -
-
-
-
-
- - {% for key, url in iam_settings.redirect_url_extra %} -
-
-
- -
-
- -
-
-
- {% endfor %} -
-
-
- -
-
- -
-
-
-
-
-
- -
-
- -
-
-
-
- -
-
-
- {{ lang.user.attribute }} - {{ lang.mailbox.template }} -
- -
-
-
-
-
- - -
-
-
- - {{ lang.admin.iam_default_template}} -
-
- -
-
-
-
- {% for key, role in iam_settings.mappers %} -
-
-
- -
-
- -
-
- -
-
-
- {% endfor %} -
-
-
- -
-
- -
-
- -
-
-
-
-
-
-
- {{ lang.admin.iam_extra_permission|raw }} -
-
-
-
- -
-
-
- -
-

- - {{ lang.admin.iam_auth_flow_info|raw }} - -

-
-
-
+
+
+
+ +
+
+ {{ lang.admin.iam_section_login }}
+ {% include 'admin/iam-redirect-urls.twig' with {'iam_form': 'keycloak'} %}
+ + +
+
+
+ +
+
+
+
+
+
-
+
- +
+ {{ lang.admin.iam_section_templates }}
+ {% include 'admin/iam-template-mapping.twig' with {'iam_form': 'keycloak'} %} + {% include 'admin/iam-sync-settings.twig' with {'iam_form': 'keycloak'} %} +
-
- -
-
-
- -
-
-
-
-
- -
-
-
- -
-
-
-
-
- -
-
- -
-
-
-
- - -
+
+ {# Generic OIDC #}
+ {{ lang.admin.iam_section_connection }}
@@ -315,46 +172,6 @@
-
- -
-
-
- - - -
- -
-
-
-
-
- - {% for key, url in iam_settings.redirect_url_extra %} -
-
-
- -
-
- -
-
-
- {% endfor %} -
-
-
- -
-
- -
-
-
-
-
@@ -362,125 +179,57 @@
-
-
- -
-
-
- {{ lang.user.attribute }} - {{ lang.mailbox.template }} -
- -
-
-
-
-
- - -
-
-
- - {{ lang.admin.iam_default_template}} -
-
- -
-
-
-
- {% for key, role in iam_settings.mappers %} -
-
-
- -
-
- -
-
- -
-
-
- {% endfor %} -
-
-
- -
-
- -
-
- -
-
-
-
-
+
-
+
+
+ +
+
+ {{ lang.admin.iam_section_login }}
+ {% include 'admin/iam-redirect-urls.twig' with {'iam_form': 'generic'} %} +
+
-
+
- +
-
+ {{ lang.admin.iam_section_templates }}
+ {% include 'admin/iam-template-mapping.twig' with {'iam_form': 'generic'} %} +
+
-
- - -
+
+ {# LDAP #}
+ {{ lang.admin.iam_section_connection }}
-
- +
+
@@ -488,96 +237,44 @@
- +
- - + +
-
-
- -
+
+ {# use_ssl and use_tls exclude each other, the select sets both #} + + +
-
- - -
-
-
- -
-
-
-
-
+
-
-
- -
-
- -
-
-
-
- -
-
- -
-
-
-
- -
-
- -
-
-
-
- -
-
- -
-
- +
-
+
@@ -589,132 +286,91 @@
-
- -
-
-
- {{ lang.user.attribute }} - {{ lang.mailbox.template }} -
- -
-
+
+
-
- - -
-
-
- - {{ lang.admin.iam_default_template }} -
-
- -
-
-
+ {{ lang.admin.iam_section_users }}
+
+
+
- {% for key, role in iam_settings.mappers %} -
-
-
- -
-
- -
-
- -
-
-
- {% endfor %} -
-
-
- -
-
- -
-
- -
-
+
+
+ + +
+
+ +
+
+
+
+ + +
+
+ +
+
+
+
+ + +
+
+ +
+
+
+
+ + +
+
+ +
+
+ {{ lang.admin.iam_section_login }}
+
+
+
-
+
- +
+ {{ lang.admin.iam_section_templates }}
- -
-
-
- -
-
-
-
-
- -
-
-
- -
-
-
-
-
- + +
- +
-
+ {% include 'admin/iam-template-mapping.twig' with {'iam_form': 'ldap'} %} + {% include 'admin/iam-sync-settings.twig' with {'iam_form': 'ldap'} %} +
+
-
- - -
+
+ {% if iam_settings.authsource == 'keycloak' or iam_settings.authsource == 'ldap' %} + {% include 'admin/iam-sync-status.twig' %} + {% endif %}
diff --git a/data/web/templates/edit.twig b/data/web/templates/edit.twig index a5c2cc154..d210370b7 100644 --- a/data/web/templates/edit.twig +++ b/data/web/templates/edit.twig @@ -27,6 +27,7 @@ var lang_admin = {{ lang_admin|raw }}; var lang_datatables = {{ lang_datatables|raw }}; var lang_syncjobs = {{ lang_syncjobs|raw }}; + var lang_groups = {{ lang_groups|raw }}; var csrf_token = '{{ csrf_token }}'; var pagination_size = Math.trunc('{{ pagination_size }}'); var table_for_domain = '{{ domain }}'; diff --git a/data/web/templates/edit/mailbox-group-grant.twig b/data/web/templates/edit/mailbox-group-grant.twig new file mode 100644 index 000000000..5c9c21f39 --- /dev/null +++ b/data/web/templates/edit/mailbox-group-grant.twig @@ -0,0 +1,49 @@ +{# One share row of the group edit page: kind = imap|sogo, grant = {} for the add template #} +{% set level_key = kind == 'imap' ? 'rights' : 'access' %} +{# new IMAP shares are subscribed by default, like automapping in Exchange #} +{% set subscribed = grant.owner is defined ? grant.subscribe|default(0) == 1 : kind == 'imap' %} + + + + + {% if kind == 'sogo' %} + + + + + + + {% endif %} + + + + +
+ +
+ + + {% if grant.state %} + {{ attribute(lang.groups, 'grant_state_' ~ grant.state) }} + {% endif %} + + + {% if not ro %} + + {% endif %} + + diff --git a/data/web/templates/edit/mailbox-group-grants.twig b/data/web/templates/edit/mailbox-group-grants.twig new file mode 100644 index 000000000..46fea6cb5 --- /dev/null +++ b/data/web/templates/edit/mailbox-group-grants.twig @@ -0,0 +1,24 @@ +{# Shares of a group (edit page, add modal): kind = imap|sogo, grants, id = table id, ro; rows go to the hidden JSON field #} +{% set field = kind ~ '_grants' %} +
+ +
+ {% if not ro %} + + {% endif %} + + + {% for grant in grants %} + {% include 'edit/mailbox-group-grant.twig' with {'kind': kind, 'grant': grant} %} + {% endfor %} + +
+ {% if not ro %} + + + {% endif %} + {{ attribute(lang.groups, field ~ '_hint') }} +
+
diff --git a/data/web/templates/edit/mailbox-group.twig b/data/web/templates/edit/mailbox-group.twig new file mode 100644 index 000000000..d886e743c --- /dev/null +++ b/data/web/templates/edit/mailbox-group.twig @@ -0,0 +1,142 @@ +{% extends 'edit.twig' %} + +{% block inner_content %} +{% if result %} +{% set ro = not result.can_edit %} +{% set editable_members = [] %} +{% set fixed_members = [] %} +{% for member in result.members %} + {% if member.source == 'idp' or member.username not in mailboxes %} + {% set fixed_members = fixed_members|merge([member]) %} + {% else %} + {% set editable_members = editable_members|merge([member.username]) %} + {% endif %} +{% endfor %} +

{{ lang.groups.group }}: {{ result.name }}

+{% if result.idp_ref %} + +{% endif %} +
+ + + + + + {% if not ro %} + {# an empty selection still sends the field, so all editable members can be removed #} + + {% endif %} +
+ +
+ +
+
+
+ +
+ +
+
+
+ +
+ +
+
+
+ +
+ + {{ lang.groups.address_hint }} +
+
+
+ +
+ + {% if fixed_members %} +
+ {% for member in fixed_members %} + {% if member.source == 'idp' %} {% endif %}{{ member.username }} + {% endfor %} +
+ {% endif %} +
+
+
+ +
+ + {{ lang.groups.send_as_hint }} +
+
+ {% include 'edit/mailbox-group-grants.twig' with {'kind': 'imap', 'grants': result.imap_grants, 'id': 'group_imap_grants'} %} + {% if not skip_sogo %} + {% include 'edit/mailbox-group-grants.twig' with {'kind': 'sogo', 'grants': result.sogo_grants, 'id': 'group_sogo_grants'} %} + {% endif %} +
+
+
+ +
+ {% if not skip_sogo %} +
+ +
+ {% endif %} +
+ +
+
+
+
+ + {% if mailcow_cc_role == 'admin' %} +
+ +
+ +
+ +
+
+
+ +
+ {{ lang.groups.template_hint }} +
+ {% else %} +
+ +
+ {% endif %} +
+
+
+
+ +
+
+
+ {% if not ro %} +
+
+ +
+
+ {% endif %} +
+{% else %} + {{ parent() }} +{% endif %} +{% endblock %} diff --git a/data/web/templates/edit/mailbox.twig b/data/web/templates/edit/mailbox.twig index db258fe49..9f56ac56c 100644 --- a/data/web/templates/edit/mailbox.twig +++ b/data/web/templates/edit/mailbox.twig @@ -24,6 +24,7 @@
+ @@ -46,6 +47,20 @@
+ {% if result.authsource != 'mailcow' and identity_link %} +
+ +
+ {% if identity_link.external_id %}{{ identity_link.external_id }}{% else %}{{ lang.edit.iam_not_linked }}{% endif %} + {% if identity_link.idp_disabled == 1 %}{{ lang.edit.iam_idp_disabled }}{% endif %} + {% if identity_link.missing_since %}{{ lang.edit.iam_missing_since }} {{ identity_link.missing_since }}{% endif %} + {% if mailcow_cc_role == 'admin' and identity_link.external_id %} + {{ lang.edit.iam_unlink }} + {% endif %} + {{ lang.edit.iam_link_info }} +
+
+ {% endif %}
@@ -121,6 +136,22 @@ {{ lang.edit.sender_acl_info|raw }}
+ {% if mailbox_groups.groups %} +
+ +
+ {% for group in mailbox_groups.groups %} + {% if group.source == 'idp' %} {% endif %}{{ group.name }}{% if group.address %} <{{ group.address }}>{% endif %} + {% endfor %} + {% if mailbox_groups.template %} + {{ lang.groups.effective_template }}: {{ mailbox_groups.template }} + {% endif %} + {% if mailbox_groups.send_as %} + {{ lang.groups.send_as_groups }}: {{ mailbox_groups.send_as|join(', ') }} + {% endif %} +
+
+ {% endif %} {% if acl.mailbox_relayhost == '1' %}
@@ -310,6 +341,14 @@
+
+
+
+ + {{ lang.mailbox.shared_mailbox_info }} +
+
+
diff --git a/data/web/templates/mailbox.twig b/data/web/templates/mailbox.twig index f330a76b9..6a6cbe58d 100644 --- a/data/web/templates/mailbox.twig +++ b/data/web/templates/mailbox.twig @@ -33,6 +33,9 @@
    • + {% if acl.mailbox_groups == 1 %} + + {% endif %} @@ -53,6 +56,9 @@ {% include 'mailbox/tab-resources.twig' %} {% include 'mailbox/tab-domain-aliases.twig' %} {% include 'mailbox/tab-mbox-aliases.twig' %} + {% if acl.mailbox_groups == 1 %} + {% include 'mailbox/tab-groups.twig' %} + {% endif %} {% include 'mailbox/tab-syncjobs.twig' %} {% include 'mailbox/tab-filters.twig' %} {% include 'mailbox/tab-bcc.twig' %} @@ -68,6 +74,7 @@ var acl = '{{ acl_json|raw }}'; var lang = {{ lang_mailbox|raw }}; lang.syncjobs = {{ lang_syncjobs|raw }}; + lang.groups = {{ lang_groups|raw }}; var lang_rl = {{ lang_rl|raw }}; var lang_edit = {{ lang_edit|raw }}; var lang_datatables = {{ lang_datatables|raw }}; diff --git a/data/web/templates/mailbox/tab-groups.twig b/data/web/templates/mailbox/tab-groups.twig new file mode 100644 index 000000000..408453ca7 --- /dev/null +++ b/data/web/templates/mailbox/tab-groups.twig @@ -0,0 +1,30 @@ +
    +
    +
    + + {{ lang.groups.groups }} +
    + +
    +
    +
    +

    {{ lang.groups.info }}

    +
    +
    +
    + {{ lang.mailbox.toggle_all }} + {{ lang.mailbox.quick_actions }} + + {{ lang.groups.add }} +
    +
    +
    +
    +
    diff --git a/data/web/templates/modals/mailbox.twig b/data/web/templates/modals/mailbox.twig index db61054e7..0a886957c 100644 --- a/data/web/templates/modals/mailbox.twig +++ b/data/web/templates/modals/mailbox.twig @@ -197,6 +197,14 @@
    +
    +
    +
    + + {{ lang.mailbox.shared_mailbox_info }} +
    +
    +
    @@ -1351,3 +1359,6 @@
    {% include "modals/imapsync_source.twig" %} +{% if acl.mailbox_groups == 1 %} +{% include "modals/mailbox_group.twig" %} +{% endif %} diff --git a/data/web/templates/modals/mailbox_group.twig b/data/web/templates/modals/mailbox_group.twig new file mode 100644 index 000000000..f29bd76d4 --- /dev/null +++ b/data/web/templates/modals/mailbox_group.twig @@ -0,0 +1,119 @@ + + diff --git a/data/web/templates/user/tab-user-details.twig b/data/web/templates/user/tab-user-details.twig index 62842fc9b..32761c167 100644 --- a/data/web/templates/user/tab-user-details.twig +++ b/data/web/templates/user/tab-user-details.twig @@ -61,6 +61,18 @@

    {% if not user_get_alias_details.aliases_send_as_all %}{% else %}{{ user_get_alias_details.aliases_send_as_all }}{% endif %}

    +
    +
    {{ lang.groups.memberships }}:
    +
    +

    + {% for group in mailbox_groups.groups %} + {{ group.name }}{% if group.address %} <{{ group.address }}>{% endif %}{% if not loop.last %}
    {% endif %} + {% else %} + + {% endfor %} +

    +
    +
    {{ lang.user.is_catch_all }}:
    diff --git a/data/web/user.php b/data/web/user.php index c176b8655..e9e10c72a 100644 --- a/data/web/user.php +++ b/data/web/user.php @@ -64,6 +64,7 @@ $template_data = [ 'mailboxdata' => $mailboxdata, 'clientconfigstr' => $clientconfigstr, 'user_get_alias_details' => $user_get_alias_details, + 'mailbox_groups' => \Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->getMemberships($username), 'get_tagging_options' => mailbox('get', 'delimiter_action', $username), 'get_tls_policy' => mailbox('get', 'tls_policy', $username), 'quarantine_notification' => mailbox('get', 'quarantine_notification', $username), diff --git a/docker-compose.yml b/docker-compose.yml index 2d94177fa..fda28e8ea 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,3 +1,6 @@ +# Version of the database schema +x-db-version: &db_version DB_VERSION=26102026_1200 + services: unbound-mailcow: @@ -150,6 +153,7 @@ services: dns: - ${IPV4_NETWORK:-172.22.1}.254 environment: + - *db_version - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-} - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-} - REDISPASS=${REDISPASS} @@ -188,12 +192,12 @@ services: restart: always labels: ofelia.enabled: "true" - ofelia.job-exec.phpfpm_keycloak_sync.schedule: "0 * * * * *" - ofelia.job-exec.phpfpm_keycloak_sync.no-overlap: "true" - ofelia.job-exec.phpfpm_keycloak_sync.command: "/bin/bash -c \"php /crons/keycloak-sync.php || exit 0\"" - ofelia.job-exec.phpfpm_ldap_sync.schedule: "0 * * * * *" - ofelia.job-exec.phpfpm_ldap_sync.no-overlap: "true" - ofelia.job-exec.phpfpm_ldap_sync.command: "/bin/bash -c \"php /crons/ldap-sync.php || exit 0\"" + ofelia.job-exec.phpfpm_identity_sync.schedule: "0 * * * * *" + ofelia.job-exec.phpfpm_identity_sync.no-overlap: "true" + ofelia.job-exec.phpfpm_identity_sync.command: "/bin/bash -c \"php /crons/identity-sync.php || exit 0\"" + ofelia.job-exec.phpfpm_group_grants.schedule: "0 * * * * *" + ofelia.job-exec.phpfpm_group_grants.no-overlap: "true" + ofelia.job-exec.phpfpm_group_grants.command: "/bin/bash -c \"php /crons/group-grants.php || exit 0\"" ofelia.job-exec.phpfpm_imapsync_oauth_refresh.schedule: "0 * * * * *" ofelia.job-exec.phpfpm_imapsync_oauth_refresh.no-overlap: "true" ofelia.job-exec.phpfpm_imapsync_oauth_refresh.command: "/bin/bash -c \"php /crons/imapsync-oauth-refresh.php || exit 0\"" @@ -205,6 +209,7 @@ services: sogo-mailcow: image: ghcr.io/mailcow/sogo:5.12.12-1 environment: + - *db_version - DBNAME=${DBNAME} - DBUSER=${DBUSER} - DBPASS=${DBPASS} @@ -227,7 +232,6 @@ services: volumes: - ./data/hooks/sogo:/hooks:Z - ./data/conf/sogo/:/etc/sogo/:z - - ./data/web/inc/init_db.inc.php:/init_db.inc.php:z - ./data/conf/sogo/custom-favicon.ico:/usr/local/lib/GNUstep/SOGo/WebServerResources/img/sogo.ico:z - ./data/conf/sogo/custom-shortlogo.svg:/usr/local/lib/GNUstep/SOGo/WebServerResources/img/sogo-compact.svg:z - ./data/conf/sogo/custom-fulllogo.svg:/usr/local/lib/GNUstep/SOGo/WebServerResources/img/sogo-full.svg:z @@ -278,6 +282,7 @@ services: - rspamd-vol-1:/var/lib/rspamd - mysql-socket-vol-1:/var/run/mysqld/:z environment: + - *db_version - DOVECOT_MASTER_USER=${DOVECOT_MASTER_USER:-} - DOVECOT_MASTER_PASS=${DOVECOT_MASTER_PASS:-} - MAILCOW_REPLICA_IP=${MAILCOW_REPLICA_IP:-} From ad86403b875975d2e6b08a5d49386f46c4c0b95c Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Tue, 27 Oct 2026 10:15:00 +0100 Subject: [PATCH 2/4] [Web][Tests] Add mailbox group, identity sync, auth, Dovecot and SOGo module tests --- .../php/Auth/Service/IdpLoginServiceTest.php | 67 ++++ tests/php/Core/ApiResponseTest.php | 11 + tests/php/Core/ContextTest.php | 25 ++ .../Dovecot/Service/DovecotServiceTest.php | 60 +++ .../Directory/KeycloakDirectoryTest.php | 117 ++++++ .../Identity/Directory/LdapDirectoryTest.php | 153 ++++++++ .../php/Identity/Service/LinkServiceTest.php | 57 +++ .../Identity/Service/StatusServiceTest.php | 68 ++++ .../php/Identity/Service/SyncPlannerTest.php | 264 +++++++++++++ .../php/Identity/Service/SyncServiceTest.php | 185 +++++++++ .../MailboxGroupApiControllerTest.php | 136 +++++++ .../MailboxGroup/Legacy/LegacyMailboxTest.php | 70 ++++ .../Service/ChangeEffectsTest.php | 42 ++ .../MailboxGroup/Service/GroupServiceTest.php | 359 ++++++++++++++++++ .../Service/IdpSyncServiceTest.php | 49 +++ .../Service/SharingServiceTest.php | 182 +++++++++ .../Service/TemplateServiceTest.php | 79 ++++ tests/php/Sogo/Service/SogoServiceTest.php | 63 +++ tests/php/bootstrap.php | 10 + 19 files changed, 1997 insertions(+) create mode 100644 tests/php/Auth/Service/IdpLoginServiceTest.php create mode 100644 tests/php/Dovecot/Service/DovecotServiceTest.php create mode 100644 tests/php/Identity/Directory/KeycloakDirectoryTest.php create mode 100644 tests/php/Identity/Directory/LdapDirectoryTest.php create mode 100644 tests/php/Identity/Service/LinkServiceTest.php create mode 100644 tests/php/Identity/Service/StatusServiceTest.php create mode 100644 tests/php/Identity/Service/SyncPlannerTest.php create mode 100644 tests/php/Identity/Service/SyncServiceTest.php create mode 100644 tests/php/MailboxGroup/Controller/MailboxGroupApiControllerTest.php create mode 100644 tests/php/MailboxGroup/Legacy/LegacyMailboxTest.php create mode 100644 tests/php/MailboxGroup/Service/ChangeEffectsTest.php create mode 100644 tests/php/MailboxGroup/Service/GroupServiceTest.php create mode 100644 tests/php/MailboxGroup/Service/IdpSyncServiceTest.php create mode 100644 tests/php/MailboxGroup/Service/SharingServiceTest.php create mode 100644 tests/php/MailboxGroup/Service/TemplateServiceTest.php create mode 100644 tests/php/Sogo/Service/SogoServiceTest.php diff --git a/tests/php/Auth/Service/IdpLoginServiceTest.php b/tests/php/Auth/Service/IdpLoginServiceTest.php new file mode 100644 index 000000000..dbc5acd23 --- /dev/null +++ b/tests/php/Auth/Service/IdpLoginServiceTest.php @@ -0,0 +1,67 @@ +createMock(LinkService::class); + $links->method('verify')->willThrowException(new PDOException('gone')); + $links->method('mayCreate')->willThrowException(new PDOException('gone')); + $links->method('link')->willThrowException(new PDOException('gone')); + $login = new IdpLoginService(Settings::fromArray([]), $links, $this->createMock(TemplateService::class)); + + $this->assertFalse($login->verifyLink('keycloak', 'a@example.org', 'u1')); + $this->assertFalse($login->mayCreate('keycloak', 'a@example.org', 'u1')); + $login->storeLink('keycloak', 'a@example.org', 'u1'); + } + + public function testLinkChecksArePassedOn(): void + { + $links = $this->createMock(LinkService::class); + $links->method('verify')->with('ldap', 'a@example.org', 'guid-1')->willReturn(true); + $links->method('mayCreate')->with('ldap', 'b@example.org', 'guid-2')->willReturn(false); + $links->expects($this->once())->method('link')->with('ldap', 'c@example.org', 'guid-3'); + $login = new IdpLoginService(Settings::fromArray([]), $links, $this->createMock(TemplateService::class)); + + $this->assertTrue($login->verifyLink('ldap', 'a@example.org', 'guid-1')); + $this->assertFalse($login->mayCreate('ldap', 'b@example.org', 'guid-2')); + $login->storeLink('ldap', 'c@example.org', 'guid-3'); + } + + public function testGroupTemplateWinsAndErrorsFallBackToTheMapping(): void + { + $templates = $this->createMock(TemplateService::class); + $templates->method('templateForLogin')->willReturnCallback(function (string $username, ?string $mapped): ?string { + if ($username === 'broken@example.org') { + throw new PDOException('gone'); + } + return 'Group'; + }); + $login = new IdpLoginService(Settings::fromArray([]), $this->createMock(LinkService::class), $templates); + + $this->assertSame('Group', $login->templateFor('a@example.org', 'Staff')); + $this->assertSame('Staff', $login->templateFor('broken@example.org', 'Staff')); + } + + public function testMappingTakesSingleValuesAndLists(): void + { + $settings = Settings::fromArray(['mappers' => ['default', 'sales'], 'templates' => ['Staff', 'Sales']]); + $login = new IdpLoginService($settings, $this->createMock(LinkService::class), $this->createMock(TemplateService::class)); + + $this->assertSame('Staff', $login->mappedTemplate('default')); + $this->assertSame('Sales', $login->mappedTemplate(['other', 'sales'])); + $this->assertNull($login->mappedTemplate(null)); + $this->assertNull($login->mappedTemplate(['unknown'])); + } +} diff --git a/tests/php/Core/ApiResponseTest.php b/tests/php/Core/ApiResponseTest.php index c6c4a7503..789cfce18 100644 --- a/tests/php/Core/ApiResponseTest.php +++ b/tests/php/Core/ApiResponseTest.php @@ -29,6 +29,17 @@ class ApiResponseTest extends TestCase ], $response->messages()); } + public function testWarningsKeepTheCallSuccessful(): void + { + $response = new ApiResponse(); + + $response->warning(['group_template_failed', 'Staff', 'a@example.org'], ['mailbox_group', 'edit', 'group', []]); + + $this->assertSame([ + ['type' => 'warning', 'log' => ['mailbox_group', 'edit', 'group', []], 'msg' => ['group_template_failed', 'Staff', 'a@example.org']], + ], $response->messages()); + } + public function testSecretsAreMaskedInArrayLogParts(): void { $response = new ApiResponse(['password1', 'oauth_client_secret']); diff --git a/tests/php/Core/ContextTest.php b/tests/php/Core/ContextTest.php index 19217391f..1a4f2e7b4 100644 --- a/tests/php/Core/ContextTest.php +++ b/tests/php/Core/ContextTest.php @@ -4,6 +4,7 @@ declare(strict_types=1); namespace Mailcow\Tests\Core; +use Mailcow\Core\AccessDenied; use Mailcow\Core\Context; use Mailcow\Tests\Support\LegacyAclCalls; use PHPUnit\Framework\TestCase; @@ -84,6 +85,30 @@ class ContextTest extends TestCase $this->assertFalse($context->hasAcl('syncjobs')); } + public function testAdminRightsComeFromTheRoleOrAccessAll(): void + { + $this->assertTrue((new Context('admin', 'admin'))->hasAdminRights()); + $this->assertTrue((new Context('user', 'user@example.org', [], true))->hasAdminRights()); + $this->assertFalse((new Context('domainadmin', 'da'))->hasAdminRights()); + $this->assertFalse(Context::system()->hasAdminRights()); + } + + public function testReadOnlyApiKeysMayOnlyRead(): void + { + $readOnly = new Context('admin', 'admin', [], false, 'ro'); + $readOnly->requireAdmin(false); + (new Context('admin', 'admin', [], false, 'rw'))->requireAdmin(); + + $this->expectException(AccessDenied::class); + $readOnly->requireAdmin(); + } + + public function testRequireAdminDeniesOtherRoles(): void + { + $this->expectException(AccessDenied::class); + (new Context('domainadmin', 'da'))->requireAdmin(false); + } + public function testBridgePassesUsernameAndRoleToTheLegacyFunctions(): void { $context = new Context('user', 'user@example.org'); diff --git a/tests/php/Dovecot/Service/DovecotServiceTest.php b/tests/php/Dovecot/Service/DovecotServiceTest.php new file mode 100644 index 000000000..2a4bacc1d --- /dev/null +++ b/tests/php/Dovecot/Service/DovecotServiceTest.php @@ -0,0 +1,60 @@ + 'success', 'msg' => 'command completed successfully']); + + $this->assertNull($dovecot->setAclAll('shared@example.org', 'group=mcg_7', ['lookup', 'read'])); + $this->assertSame([['cmd' => 'doveadm', 'task' => 'set_acl_all', 'user' => 'shared@example.org', 'id' => 'group=mcg_7', + 'rights' => ['lookup', 'read']]], $dovecot->calls); + } + + public function testErrorsOfDockerapiAreReturned(): void + { + $this->assertSame('command failed: no such user', (new FakeDovecot(['type' => 'danger', 'msg' => 'command failed: no such user'])) + ->setAclAll('x@example.org', 'group=mcg_7', [])); + $this->assertSame('dockerapi did not answer', (new FakeDovecot(false))->setAclAll('x@example.org', 'group=mcg_7', [])); + } + + public function testSharedFoldersAreSubscribedThroughDockerapi(): void + { + $dovecot = new FakeDovecot(['type' => 'success']); + + $this->assertNull($dovecot->subscribeShared('team@example.org', ['a@example.org'], true)); + $this->assertSame([['cmd' => 'doveadm', 'task' => 'subscribe_shared', 'owner' => 'team@example.org', 'users' => ['a@example.org'], + 'unsubscribe' => true]], $dovecot->calls); + } + + public function testAuthCacheFlushOnlyWithUsers(): void + { + $dovecot = new FakeDovecot([]); + $dovecot->flushAuthCache([]); + $dovecot->flushAuthCache(['a@example.org']); + + $this->assertSame([['cmd' => 'doveadm', 'task' => 'auth_cache_flush', 'users' => ['a@example.org']]], $dovecot->calls); + } +} + +class FakeDovecot extends DovecotService +{ + public array $calls = []; + + public function __construct(private mixed $result) + { + } + + protected function exec(array $fields): mixed + { + $this->calls[] = $fields; + return is_array($this->result) ? json_encode($this->result) : $this->result; + } +} diff --git a/tests/php/Identity/Directory/KeycloakDirectoryTest.php b/tests/php/Identity/Directory/KeycloakDirectoryTest.php new file mode 100644 index 000000000..9daaf5bdb --- /dev/null +++ b/tests/php/Identity/Directory/KeycloakDirectoryTest.php @@ -0,0 +1,117 @@ + "u$i", 'email' => "User$i@Example.org", 'firstName' => 'User', 'lastName' => (string)$i, 'enabled' => $i !== 2, + 'attributes' => ['mailcow_template' => ['staff']]]; + } + $client = new FakeKeycloakClient(['/users' => $users]); + + $listing = (new KeycloakDirectory($client, Settings::fromArray([])))->listAll(false); + + $this->assertCount(150, $listing->users); + $this->assertNull($listing->groups); + $this->assertSame('user1@example.org', $listing->users['u1']->email); + $this->assertSame('User 1', $listing->users['u1']->name); + $this->assertSame(['staff'], $listing->users['u1']->templateValues); + $this->assertFalse($listing->users['u2']->enabled); + $this->assertSame(['/users?briefRepresentation=false&first=0&max=100', '/users?briefRepresentation=false&first=100&max=100'], + $client->paths()); + } + + public function testSelectsGroupsByPathWithChildrenAndListedMembers(): void + { + $client = new FakeKeycloakClient([ + '/users' => [['id' => 'u1', 'email' => 'a@example.org', 'enabled' => true], ['id' => 'u2', 'email' => 'b@example.org', 'enabled' => true]], + '/groups' => [ + ['id' => 'g1', 'name' => 'mailcow', 'path' => '/mailcow', 'subGroupCount' => 2, 'subGroups' => []], + ['id' => 'g4', 'name' => 'Other', 'path' => '/Other', 'subGroups' => []], + ], + '/groups/g1/children' => [ + ['id' => 'g2', 'name' => 'Sales', 'path' => '/mailcow/Sales'], + ['id' => 'g3', 'name' => 'Support', 'path' => '/mailcow/Support', 'attributes' => ['mail' => ['Support@Example.org']]], + ], + '/groups/g2/members' => [['id' => 'u1'], ['id' => 'u2'], ['id' => 'not-listed']], + '/groups/g3/members' => [], + '/groups/g4/members' => [], + ]); + + $listing = (new KeycloakDirectory($client, Settings::fromArray(['group_paths' => '/mailcow/*, /Other'])))->listAll(true); + + $this->assertSame(['g2', 'g3', 'g4'], array_keys($listing->groups)); + $this->assertSame(['u1', 'u2'], $listing->groups['g2']->memberIds); + $this->assertSame('support@example.org', $listing->groups['g3']->mail); + $this->assertSame('Other', $listing->groups['g4']->name); + } + + public function testRejectedTokenIsRenewedOnce(): void + { + $client = new FakeKeycloakClient(['/users' => []], 1); + + (new KeycloakDirectory($client, Settings::fromArray([])))->listAll(false); + + $this->assertSame(2, $client->tokens); + } + + public function testHttpErrorsAbortTheListing(): void + { + $client = new FakeKeycloakClient(['/users' => 500]); + + $this->expectException(DirectoryException::class); + $this->expectExceptionMessage('Keycloak returned HTTP 500 for /users'); + (new KeycloakDirectory($client, Settings::fromArray([])))->listAll(false); + } +} + +/** + * Keycloak admin API in memory: routes are paths below the realm with a list (paged by first/max) or an HTTP status. + */ +class FakeKeycloakClient extends KeycloakClient +{ + public int $tokens = 0; + private array $requests = []; + + public function __construct(private array $routes, private int $rejectTokens = 0) + { + parent::__construct('https://kc.example.org', 'mailcow', 'mailcow', 'secret'); + } + + /** @return string[] requested paths with query, token requests excluded */ + public function paths(): array + { + return $this->requests; + } + + protected function send(string $method, string $url, array $headers, ?string $body): array + { + if (str_ends_with($url, '/protocol/openid-connect/token')) { + $this->tokens++; + return [200, json_encode(['access_token' => 'token' . $this->tokens])]; + } + if ($this->rejectTokens > 0 && in_array('Authorization: Bearer token1', $headers, true)) { + return [401, '']; + } + $path = substr((string)parse_url($url, PHP_URL_PATH), strlen('/admin/realms/mailcow')); + parse_str((string)parse_url($url, PHP_URL_QUERY), $query); + $this->requests[] = $path . '?' . http_build_query($query); + $route = $this->routes[$path] ?? 404; + if (is_int($route)) { + return [$route, '']; + } + return [200, json_encode(array_slice($route, (int)($query['first'] ?? 0), (int)($query['max'] ?? count($route))))]; + } +} diff --git a/tests/php/Identity/Directory/LdapDirectoryTest.php b/tests/php/Identity/Directory/LdapDirectoryTest.php new file mode 100644 index 000000000..5504dc9ae --- /dev/null +++ b/tests/php/Identity/Directory/LdapDirectoryTest.php @@ -0,0 +1,153 @@ + self::BASE, 'filter' => 'objectClass=person', 'disabled_filter' => '(employeeType=left)'], + function (string $base, string $filter): array { + if (str_contains($filter, 'employeeType=left')) { + return [self::entry('cn=c,ou=people,dc=example,dc=org', [])]; + } + return [ + self::entry('CN=A,ou=people,dc=example,dc=org', ['mail' => 'A@example.org', 'displayname' => 'A User', + 'objectguid' => hex2bin('0123456789abcdef0123456789abcdef'), 'useraccountcontrol' => '512']), + self::entry('cn=b,ou=people,dc=example,dc=org', ['mail' => 'b@example.org', 'cn' => 'B', + 'entryuuid' => 'F81D4FAE-7DEC-11D0-A765-00A0C91E6BF6', 'useraccountcontrol' => '514']), + self::entry('cn=c,ou=people,dc=example,dc=org', ['mail' => 'c@example.org']), + ]; + }); + + $users = $directory->listAll(false)->users; + + $this->assertSame(['67452301-ab89-efcd-0123-456789abcdef', 'f81d4fae-7dec-11d0-a765-00a0c91e6bf6', 'dn:cn=c,ou=people,dc=example,dc=org'], + array_keys($users)); + $user = $users['67452301-ab89-efcd-0123-456789abcdef']; + $this->assertSame(['a@example.org', 'A User', true], [$user->email, $user->name, $user->enabled]); + $this->assertFalse($users['f81d4fae-7dec-11d0-a765-00a0c91e6bf6']->enabled); + $this->assertFalse($users['dn:cn=c,ou=people,dc=example,dc=org']->enabled); + $this->assertSame('(&(&(objectClass=person)(mail=*))(employeeType=left))', $directory->searches[0][1]); + $this->assertSame('(&(objectClass=person)(mail=*))', $directory->searches[1][1]); + } + + public function testConfiguredIdAttributeWins(): void + { + $entry = self::entry('cn=a,dc=example,dc=org', ['employeenumber' => 'E-17', 'entryuuid' => 'x']); + + $this->assertSame('e-17', LdapDirectory::entryId($entry, 'employeenumber')); + $this->assertSame('x', LdapDirectory::entryId($entry)); + } + + public function testMembersFromMemberOf(): void + { + $directory = new FakeLdapDirectory(['basedn' => self::BASE, 'group_filter' => '(objectClass=groupOfNames)'], + function (string $base, string $filter, array $attributes): array { + if ($filter === '(objectClass=groupOfNames)') { + $this->assertContains('mail', $attributes); + return [self::entry('CN=Sales,ou=groups,dc=example,dc=org', ['cn' => 'Sales', 'entryuuid' => 'g1', 'mail' => 'Sales@example.org'])]; + } + $this->assertContains('memberof', $attributes); + return [ + self::entry('cn=a,dc=example,dc=org', ['mail' => 'a@example.org', 'entryuuid' => 'u1', 'memberof' => ['cn=sales,ou=groups,dc=example,dc=org']]), + self::entry('cn=b,dc=example,dc=org', ['mail' => 'b@example.org', 'entryuuid' => 'u2', 'memberof' => ['cn=other,dc=example,dc=org']]), + ]; + }); + + $groups = $directory->listAll(true)->groups; + + $this->assertSame(['g1'], array_keys($groups)); + $this->assertSame(['Sales', 'sales@example.org', ['u1']], [$groups['g1']->name, $groups['g1']->mail, $groups['g1']->memberIds]); + } + + public function testMembersFromTheMemberAttribute(): void + { + $directory = new FakeLdapDirectory(['basedn' => self::BASE, 'group_filter' => 'objectClass=groupOfNames', 'group_member_mode' => 'member'], + fn(string $base, string $filter): array => ($filter === '(objectClass=groupOfNames)') + ? [self::entry('cn=sales,dc=example,dc=org', ['cn' => 'Sales', 'entryuuid' => 'g1', + 'member' => ['CN=A,dc=example,dc=org', 'cn=unknown,dc=example,dc=org']])] + : [self::entry('cn=a,dc=example,dc=org', ['mail' => 'a@example.org', 'entryuuid' => 'u1'])]); + + $this->assertSame(['u1'], $directory->listAll(true)->groups['g1']->memberIds); + } + + public function testRangedMemberListsAbort(): void + { + $directory = new FakeLdapDirectory(['basedn' => self::BASE, 'group_filter' => '(objectClass=group)', 'group_member_mode' => 'member'], + fn(string $base, string $filter): array => ($filter === '(objectClass=group)') + ? [self::entry('cn=big,dc=example,dc=org', ['cn' => 'Big', 'member;range=0-1499' => ['cn=a,dc=example,dc=org']])] + : []); + + $this->expectException(DirectoryException::class); + $directory->listAll(true); + } + + public function testNestedMembersFromTheAdInChainRule(): void + { + $directory = new FakeLdapDirectory(['basedn' => self::BASE, 'group_basedn' => 'ou=groups,dc=example,dc=org', + 'group_filter' => '(objectClass=group)', 'group_member_mode' => 'ad_chain'], + function (string $base, string $filter): array { + if ($filter === '(objectClass=group)') { + $this->assertSame('ou=groups,dc=example,dc=org', $base); + return [self::entry('cn=sales (de),ou=groups,dc=example,dc=org', ['cn' => 'Sales', 'objectguid' => 'g1'])]; + } + if (str_contains($filter, '1.2.840.113556.1.4.1941')) { + $this->assertSame('(&(&(objectClass=*)(mail=*))(memberOf:1.2.840.113556.1.4.1941:=cn=sales \\28de\\29,ou=groups,dc=example,dc=org))', $filter); + return [self::entry('cn=a,dc=example,dc=org', [])]; + } + return [self::entry('cn=a,dc=example,dc=org', ['mail' => 'a@example.org', 'entryuuid' => 'u1'])]; + }); + + $this->assertSame(['u1'], $directory->listAll(true)->groups['g1']->memberIds); + } + + public function testGroupsNeedAFilter(): void + { + $directory = new FakeLdapDirectory(['basedn' => self::BASE], fn(): array => []); + + $this->expectException(DirectoryException::class); + $directory->listAll(true); + } + + /** An entry as ldap_get_entries() returns it */ + private static function entry(string $dn, array $attributes): array + { + $entry = ['dn' => $dn]; + foreach ($attributes as $name => $values) { + $values = (array)$values; + $entry[$name] = $values + ['count' => count($values)]; + } + return $entry + ['count' => count($attributes)]; + } +} + +/** + * LdapDirectory with canned search results instead of an LDAP server. + */ +class FakeLdapDirectory extends LdapDirectory +{ + /** @var array[] [base, filter, attributes] of every search */ + public array $searches = []; + + public function __construct(array $settings, private Closure $results) + { + parent::__construct(null, Settings::fromArray($settings + ['authsource' => 'ldap'])); + } + + protected function search(string $base, string $filter, array $attributes): array + { + $this->searches[] = [$base, $filter, $attributes]; + return ($this->results)($base, $filter, $attributes); + } +} diff --git a/tests/php/Identity/Service/LinkServiceTest.php b/tests/php/Identity/Service/LinkServiceTest.php new file mode 100644 index 000000000..32a9725b2 --- /dev/null +++ b/tests/php/Identity/Service/LinkServiceTest.php @@ -0,0 +1,57 @@ +createMock(IdentityRepository::class); + $repo->method('findLink')->willReturn(['provider' => 'keycloak', 'external_id' => 'u1', 'idp_disabled' => 0, 'missing_since' => null]); + $repo->expects($this->never())->method('link'); + $login = new LinkService($repo); + + $this->assertTrue($login->verify('keycloak', 'a@example.org', 'u1')); + $this->assertFalse($login->verify('keycloak', 'a@example.org', 'u2')); + $this->assertFalse($login->verify('keycloak', 'a@example.org', '')); + } + + public function testUnlinkedMailboxIsLinkedOnLogin(): void + { + $repo = $this->createMock(IdentityRepository::class); + $repo->method('findLink')->willReturn(['provider' => 'keycloak', 'external_id' => null, 'idp_disabled' => 1, 'missing_since' => null]); + $repo->method('usernameOf')->willReturn(null); + $repo->expects($this->once())->method('link')->with('a@example.org', 'keycloak', 'u1'); + + $this->assertTrue((new LinkService($repo))->verify('keycloak', 'a@example.org', 'u1')); + } + + public function testUserOfAnotherMailboxIsDenied(): void + { + $repo = $this->createMock(IdentityRepository::class); + $repo->method('findLink')->willReturn(null); + $repo->method('usernameOf')->with('ldap', 'guid-1')->willReturn('old@example.org'); + $repo->expects($this->never())->method('link'); + $login = new LinkService($repo); + + $this->assertFalse($login->verify('ldap', 'new@example.org', 'guid-1')); + $this->assertFalse($login->mayCreate('ldap', 'new@example.org', 'guid-1')); + $this->assertTrue($login->mayCreate('ldap', 'old@example.org', 'guid-1')); + } + + public function testLinkOfAnotherProviderIsReplaced(): void + { + $repo = $this->createMock(IdentityRepository::class); + $repo->method('findLink')->willReturn(['provider' => 'ldap', 'external_id' => 'guid-1', 'idp_disabled' => 0, 'missing_since' => null]); + $repo->method('usernameOf')->willReturn(null); + $repo->expects($this->once())->method('link')->with('a@example.org', 'keycloak', 'u1'); + + $this->assertTrue((new LinkService($repo))->verify('keycloak', 'a@example.org', 'u1')); + } +} diff --git a/tests/php/Identity/Service/StatusServiceTest.php b/tests/php/Identity/Service/StatusServiceTest.php new file mode 100644 index 000000000..92f51810e --- /dev/null +++ b/tests/php/Identity/Service/StatusServiceTest.php @@ -0,0 +1,68 @@ +createMock(RunRepository::class); + $runs->expects($this->once())->method('request')->with('keycloak', 'force', 'admin')->willReturn(5); + + $this->assertSame(5, $this->service(FakeContext::admin(), $runs)->requestRun('force')); + } + + public function testInvalidModeIsRejected(): void + { + $this->expectExceptionObject(new UserError('iam_sync_mode_invalid')); + $this->service(FakeContext::admin())->requestRun(['run']); + } + + public function testReadOnlyApiMayOnlyRead(): void + { + $service = $this->service(new Context('admin', 'api', [], false, 'ro')); + + $this->assertSame('keycloak', $service->status()['provider']); + $this->expectException(AccessDenied::class); + $service->requestRun('run'); + } + + public function testDomainAdminsSeeOnlyLinksOfTheirMailboxes(): void + { + $repo = $this->createMock(IdentityRepository::class); + $repo->method('findLink')->willReturn(['provider' => 'keycloak', 'external_id' => 'u1', 'idp_disabled' => 0, 'missing_since' => null]); + $service = $this->service(FakeContext::domainAdmin(['a@example.org']), null, $repo); + + $this->assertSame('u1', $service->link('A@example.org')['external_id']); + $this->assertNull($service->link('b@example.org')); + $this->expectException(AccessDenied::class); + $service->status(); + } + + public function testDomainAdminsCannotUnlink(): void + { + $repo = $this->createMock(IdentityRepository::class); + $repo->expects($this->never())->method('unlink'); + + $this->expectException(AccessDenied::class); + $this->service(FakeContext::domainAdmin(['a@example.org']), null, $repo)->unlink('a@example.org'); + } + + private function service(Context $context, ?RunRepository $runs = null, ?IdentityRepository $repo = null): StatusService + { + return new StatusService(Settings::fromArray(['authsource' => 'keycloak']), $repo ?? $this->createMock(IdentityRepository::class), + $runs ?? $this->createMock(RunRepository::class), $context); + } +} diff --git a/tests/php/Identity/Service/SyncPlannerTest.php b/tests/php/Identity/Service/SyncPlannerTest.php new file mode 100644 index 000000000..54a5c4c10 --- /dev/null +++ b/tests/php/Identity/Service/SyncPlannerTest.php @@ -0,0 +1,264 @@ +plan([self::user('u1', 'a@example.org')], [new Account('a@example.org', 'A', 1)]); + + $this->assertSame(['a@example.org' => 'u1'], $plan->links); + $this->assertSame([], $plan->conflicts); + } + + public function testLinkedUserWithNewEmailIsAConflictAndNotCreated(): void + { + $plan = $this->plan([self::user('u1', 'new@example.org')], [new Account('a@example.org', 'A', 1, 'u1')]); + + $this->assertSame([], $plan->creates); + $this->assertSame([], $plan->missing); + $this->assertSame(['a@example.org is linked to an IdP user whose email is now new@example.org'], $plan->conflicts); + } + + public function testMailboxLinkedToAnotherUserIsNotTakenOver(): void + { + $plan = $this->plan([self::user('u2', 'a@example.org')], [new Account('a@example.org', 'A', 1, 'u1', false, self::SINCE)]); + + $this->assertSame([], $plan->links); + $this->assertSame(['a@example.org is linked to another IdP user'], $plan->conflicts); + // u1 is gone for the second run: login disabled + $this->assertSame(['a@example.org'], $plan->deactivate); + } + + public function testCreatesOnlyEnabledUsersOfMailcowDomainsWithTemplate(): void + { + $settings = ['mappers' => ['staff'], 'templates' => ['Staff']]; + $users = [ + self::user('u1', 'new@example.org', true, ['staff'], 'New User'), + self::user('u2', 'off@example.org', false, ['staff']), + self::user('u3', 'x@foreign.org', true, ['staff']), + self::user('u4', 'local@example.org', true, ['staff']), + self::user('u5', 'none@example.org'), + self::user('u6', null), + ]; + $plan = $this->plan($users, [], $settings, ['mailboxes' => ['local@example.org' => 'mailcow']]); + + $this->assertSame([['email' => 'new@example.org', 'name' => 'New User', 'template' => 'Staff', 'id' => 'u1']], $plan->creates); + $this->assertSame(['No template matches none@example.org'], $plan->conflicts); + $this->assertSame(4, $plan->skipped); + } + + public function testNothingIsCreatedWithoutImport(): void + { + $plan = $this->plan([self::user('u1', 'new@example.org')], [], ['import_users' => 0, 'default_template' => 'Default']); + + $this->assertSame([], $plan->creates); + } + + public function testDuplicateEmailsAreAConflict(): void + { + $plan = $this->plan([self::user('u1', 'a@example.org'), self::user('u2', 'a@example.org')], [], ['default_template' => 'Default']); + + $this->assertSame([], $plan->creates); + $this->assertSame(['Several IdP users have the email a@example.org'], $plan->conflicts); + } + + public function testNewMailboxGetsTheTemplateOfItsHighestPriorityGroup(): void + { + $groups = [self::group(1, 'g1', 'Sales', [], 'Sales', 5), self::group(2, 'g2', 'Board', [], 'Board', 10)]; + $listing = [new DirectoryGroup('g1', 'Sales', null, ['u1']), new DirectoryGroup('g2', 'Board', null, ['u1'])]; + $plan = $this->plan([self::user('u1', 'new@example.org', true, ['staff'])], [], + ['group_sync' => 1, 'mappers' => ['staff'], 'templates' => ['Staff']], ['groups' => $groups], $listing); + + $this->assertSame('Board', $plan->creates[0]['template']); + $this->assertSame(['g1' => ['new@example.org'], 'g2' => ['new@example.org']], $plan->memberships); + } + + /** + * @param ?bool $listed null = not listed, else enabled in the IdP + */ + #[DataProvider('offboardingCases')] + public function testOffboardingStates(int $active, bool $idpDisabled, ?string $missingSince, ?bool $listed, bool $offboarding, array $expected): void + { + $users = ($listed === null) ? [] : [self::user('u1', 'a@example.org', $listed)]; + $plan = $this->plan($users, [new Account('a@example.org', 'A', $active, 'u1', $idpDisabled, $missingSince)], + ['offboarding' => $offboarding ? 1 : 0]); + + foreach (['deactivate', 'restore', 'release', 'missing', 'found'] as $kind) { + $this->assertSame(in_array($kind, $expected, true) ? ['a@example.org'] : [], $plan->$kind, $kind); + } + } + + public static function offboardingCases(): array + { + return [ + 'disabled in the IdP' => [1, false, null, false, true, ['deactivate']], + 'activated by an admin after the sync disabled it' => [1, true, null, false, true, []], + 'disabled by an admin' => [2, false, null, false, true, []], + 'inactive' => [0, false, null, false, true, []], + 'enabled again' => [2, true, null, true, true, ['restore']], + 'enabled again, active changed by an admin' => [0, true, null, true, true, ['release']], + 'not listed for the first time' => [1, false, null, null, true, ['missing']], + 'not listed for the second time' => [1, false, self::SINCE, null, true, ['deactivate']], + 'listed again' => [1, false, self::SINCE, true, true, ['found']], + 'listed again after removal' => [2, true, self::SINCE, true, true, ['found', 'restore']], + 'offboarding off' => [1, false, null, false, false, []], + 'offboarding off tracks missing users' => [1, false, null, null, false, ['missing']], + ]; + } + + public function testGuardBlocksMassDeactivationUnlessForced(): void + { + $accounts = []; + $users = []; + for ($i = 1; $i <= 6; $i++) { + $accounts[] = new Account("u$i@example.org", '', 1, "u$i"); + $users[] = self::user("u$i", "u$i@example.org", $i > 5); + } + $this->assertFalse($this->plan($users, $accounts)->blocked); + + $users[5] = self::user('u6', 'u6@example.org', false); + $this->assertTrue($this->plan($users, $accounts)->blocked); + $this->assertFalse($this->plan($users, $accounts, [], [], null, true)->blocked); + } + + public function testGuardCountsMembershipsOfOrphanedGroups(): void + { + $members = []; + for ($i = 1; $i <= 6; $i++) { + $members["u$i@example.org"] = 'idp'; + } + $plan = $this->plan([], [], ['group_sync' => 1], ['groups' => [self::group(3, 'gone', 'Old', $members)]], []); + + $this->assertSame([3], $plan->orphanedGroups); + $this->assertSame(6, $plan->membershipRemovals); + $this->assertTrue($plan->blocked); + } + + public function testGroupMembershipsFollowTheIdp(): void + { + $accounts = [new Account('a@example.org', '', 1, 'u1'), new Account('b@example.org', '', 1, 'u2'), + new Account('c@example.org', '', 1, 'u3'), new Account('gone@example.org', '', 1, 'u4')]; + $members = ['a@example.org' => 'manual', 'b@example.org' => 'idp', 'gone@example.org' => 'idp']; + $plan = $this->plan([self::user('u1', 'a@example.org'), self::user('u2', 'b@example.org'), self::user('u3', 'c@example.org')], + $accounts, ['group_sync' => 1], ['groups' => [self::group(1, 'g1', 'Sales', $members)]], + [new DirectoryGroup('g1', 'Sales', null, ['u1', 'u3'])]); + + // b leaves, c joins, a stays manual, gone@ is not listed and keeps its membership + $this->assertSame(['g1' => ['a@example.org', 'c@example.org', 'gone@example.org']], $plan->memberships); + $this->assertSame(1, $plan->membershipRemovals); + } + + public function testUnchangedMembershipsArePlannedAsNothing(): void + { + $plan = $this->plan([self::user('u1', 'a@example.org')], [new Account('a@example.org', '', 1, 'u1')], ['group_sync' => 1], + ['groups' => [self::group(1, 'g1', 'Sales', ['a@example.org' => 'manual'])]], [new DirectoryGroup('g1', 'Sales', null, ['u1'])]); + + $this->assertSame([], $plan->memberships); + } + + public function testNewGroupsGoToTheDomainOfTheirMailOrTheDefaultDomain(): void + { + $groups = [ + new DirectoryGroup('g1', 'Sales', 'sales@sub.example.org'), + new DirectoryGroup('g2', 'Staff', 'staff@foreign.org'), + new DirectoryGroup('g3', 'Board'), + new DirectoryGroup('g4', 'Support'), + ]; + $state = ['domains' => ['example.org', 'sub.example.org'], 'groups' => [self::group(9, null, 'support', [])]]; + $plan = $this->plan([], [], ['group_sync' => 1, 'group_autocreate' => 1, 'group_default_domain' => 'example.org'], $state, $groups); + + $this->assertSame([ + ['ref' => 'g1', 'name' => 'Sales', 'domain' => 'sub.example.org', 'mail' => 'sales@sub.example.org'], + ['ref' => 'g2', 'name' => 'Staff', 'domain' => 'example.org', 'mail' => 'staff@foreign.org'], + ['ref' => 'g3', 'name' => 'Board', 'domain' => 'example.org', 'mail' => null], + ], $plan->groupCreates); + $this->assertSame(['A group Support exists in example.org and is not linked to the IdP group'], $plan->conflicts); + + $plan = $this->plan([], [], ['group_sync' => 1, 'group_autocreate' => 1], $state, [new DirectoryGroup('g3', 'Board')]); + $this->assertSame(['IdP group Board has no mailcow domain'], $plan->conflicts); + + $plan = $this->plan([], [], ['group_sync' => 1, 'group_autocreate' => 0, 'group_default_domain' => 'example.org'], $state, $groups); + $this->assertSame([], $plan->groupCreates); + } + + public function testRenamedIdpGroupsAreRenamedUnlessTheNameIsTaken(): void + { + $state = ['groups' => [self::group(1, 'g1', 'Sales', []), self::group(2, 'g2', 'Support', []), self::group(3, null, 'Board', [])]]; + $plan = $this->plan([], [], ['group_sync' => 1], $state, + [new DirectoryGroup('g1', 'Sales DE'), new DirectoryGroup('g2', 'board')]); + + $this->assertSame([1 => 'Sales DE'], $plan->groupRenames); + $this->assertSame(['IdP group Support was renamed to board, which exists in example.org'], $plan->conflicts); + } + + public function testUpdatesNameAndTemplateWhenTheyDiffer(): void + { + $settings = ['periodic_sync' => 1, 'mappers' => ['staff'], 'templates' => ['Staff']]; + $accounts = [new Account('a@example.org', 'A', 1, 'u1', false, null, 'h-staff'), + new Account('b@example.org', 'B', 1, 'u2', false, null, 'h-old'), + new Account('c@example.org', 'C', 1, 'u3', false, null, 'h-staff'), + new Account('d@example.org', 'D', 1, 'u4', false, null, 'h-staff')]; + $users = [self::user('u1', 'a@example.org', true, ['staff'], 'A'), self::user('u2', 'b@example.org', true, ['staff'], 'B'), + self::user('u3', 'c@example.org', true, ['staff'], 'C New'), self::user('u4', 'd@example.org', true, ['staff'])]; + $state = ['hashes' => ['Staff' => 'h-staff', 'Sales' => 'h-sales'], 'effective' => ['a@example.org' => 'Sales']]; + $plan = $this->plan($users, $accounts, $settings, $state); + + $this->assertSame([ + ['username' => 'a@example.org', 'name' => 'A', 'template' => 'Staff'], + ['username' => 'b@example.org', 'name' => 'B', 'template' => 'Staff'], + ['username' => 'c@example.org', 'name' => 'C New', 'template' => 'Staff'], + ], $plan->updates); + } + + private function plan(array $users, array $accounts, array $settings = [], array $state = [], ?array $groups = null, bool $force = false) + { + $byId = []; + foreach ($users as $user) { + $byId[$user->id] = $user; + } + $groupsById = null; + if ($groups !== null) { + $groupsById = []; + foreach ($groups as $group) { + $groupsById[$group->id] = $group; + } + } + $byName = []; + foreach ($accounts as $account) { + $byName[$account->username] = $account; + } + return (new SyncPlanner())->plan( + Settings::fromArray($settings + ['authsource' => 'keycloak', 'offboarding' => 1, 'import_users' => 1]), + new Listing($byId, $groupsById), + new State($byName, array_fill_keys(array_keys($byName), 'keycloak') + ($state['mailboxes'] ?? []), + $state['domains'] ?? ['example.org'], $state['groups'] ?? [], $state['effective'] ?? [], $state['hashes'] ?? []), + $force); + } + + private static function user(string $id, ?string $email, bool $enabled = true, array $templates = [], string $name = ''): DirectoryUser + { + return new DirectoryUser($id, $email, $name, $enabled, $templates); + } + + private static function group(int $id, ?string $ref, string $name, array $members, ?string $template = null, int $priority = 0): array + { + return ['id' => $id, 'domain' => 'example.org', 'name' => $name, 'idp_ref' => $ref, 'template' => $template, + 'priority' => $priority, 'active' => 1, 'members' => $members]; + } +} diff --git a/tests/php/Identity/Service/SyncServiceTest.php b/tests/php/Identity/Service/SyncServiceTest.php new file mode 100644 index 000000000..ea5f995c3 --- /dev/null +++ b/tests/php/Identity/Service/SyncServiceTest.php @@ -0,0 +1,185 @@ +repo = $this->createMock(IdentityRepository::class); + $this->repo->method('accounts')->willReturn(['a@example.org' => new Account('a@example.org', 'A', 1, 'u1'), + 'b@example.org' => new Account('b@example.org', 'B', 1)]); + $this->repo->method('mailboxes')->willReturn(['a@example.org' => 'keycloak', 'b@example.org' => 'keycloak']); + $this->repo->method('domains')->willReturn(['example.org']); + $this->runs = $this->createMock(RunRepository::class); + $this->runs->method('finish')->willReturnCallback(function (int $id, string $status, array $summary): void { + $this->finished = [$id, $status, $summary]; + }); + $this->groups = $this->createMock(IdpSyncService::class); + $this->groups->method('groups')->willReturn([['id' => 4, 'domain' => 'example.org', 'name' => 'Sales', 'idp_ref' => 'g1', + 'template' => null, 'priority' => 0, 'active' => 1, 'members' => []]]); + $this->templates = $this->createMock(TemplateService::class); + $this->templates->method('effective')->willReturn([]); + $this->legacy = $this->createMock(LegacyAccounts::class); + $this->sogo = $this->createMock(SogoService::class); + } + + public function testRunAppliesThePlan(): void + { + $this->repo->expects($this->exactly(2))->method('link')->willReturnCallback(fn(string $u, string $p, string $id) => + $this->assertContains([$u, $p, $id], [['b@example.org', 'keycloak', 'u2'], ['new@example.org', 'keycloak', 'u3']])); + $this->repo->expects($this->once())->method('setActive')->with('a@example.org', 'keycloak', 2, true); + $this->legacy->expects($this->once())->method('createMailbox')->with('new@example.org', 'New', 'keycloak', 'Default')->willReturn(null); + $this->sogo->expects($this->once())->method('refreshStaticView')->with(['a@example.org']); + $group = Group::fromRow(['id' => 4, 'name' => 'Sales']); + $this->groups->method('findByIdpRef')->with('g1')->willReturn($group); + $this->groups->expects($this->once())->method('syncGroupMembers')->with(4, ['b@example.org', 'new@example.org']) + ->willReturn(['added' => [], 'removed' => [], 'skipped' => [], 'warnings' => []]); + + $run = $this->service($this->listing())->execute(9, 'run'); + + $this->assertSame('ok', $run['status']); + $this->assertSame([], $run['summary']['errors']); + $this->assertSame([9, 'ok'], array_slice($this->finished, 0, 2)); + } + + public function testLeavingATemplateGroupAppliesTheMappingInTheSameRun(): void + { + $this->repo = $this->createMock(IdentityRepository::class); + $this->repo->method('accounts')->willReturn(['a@example.org' => new Account('a@example.org', 'A', 1, 'u1', false, null, 'h-default')]); + $this->repo->method('templateHashes')->willReturn(['Default' => 'h-default', 'Staff' => 'h-staff']); + $this->groups = $this->createMock(IdpSyncService::class); + $this->groups->method('groups')->willReturn([['id' => 4, 'domain' => 'example.org', 'name' => 'Sales', 'idp_ref' => 'g1', + 'template' => 'Default', 'priority' => 0, 'active' => 1, 'members' => ['a@example.org' => 'idp']]]); + $this->groups->method('findByIdpRef')->willReturn(Group::fromRow(['id' => 4, 'name' => 'Sales'])); + $this->groups->method('syncGroupMembers')->with(4, []) + ->willReturn(['added' => [], 'removed' => ['a@example.org'], 'skipped' => [], 'warnings' => []]); + $this->templates = $this->createMock(TemplateService::class); + $this->templates->method('effective')->willReturnOnConsecutiveCalls(['a@example.org' => 'Default'], ['a@example.org' => null]); + $this->legacy->expects($this->once())->method('applyTemplate')->with('a@example.org', 'A', 'Staff')->willReturn(null); + $directory = $this->createMock(Directory::class); + $directory->method('listAll')->willReturn(new Listing(['u1' => new DirectoryUser('u1', 'a@example.org', 'A', true, ['staff'])], + ['g1' => new DirectoryGroup('g1', 'Sales')])); + + $run = $this->service($directory, ['periodic_sync' => 1, 'mappers' => ['staff'], 'templates' => ['Staff']])->execute(9, 'run'); + + $this->assertSame(1, $run['summary']['counts']['updates']); + } + + public function testPreviewWritesNothing(): void + { + $this->repo->expects($this->never())->method('link'); + $this->repo->expects($this->never())->method('setActive'); + $this->legacy->expects($this->never())->method('createMailbox'); + $this->groups->expects($this->never())->method('syncGroupMembers'); + + $run = $this->service($this->listing())->execute(9, 'preview'); + + $this->assertSame(['ok', 'preview', 1, 1], [$run['status'], $run['summary']['mode'], $run['summary']['counts']['deactivate'], + $run['summary']['counts']['creates']]); + } + + public function testListingErrorsWriteNothing(): void + { + $this->repo->expects($this->never())->method('setMissing'); + $directory = $this->createMock(Directory::class); + $directory->method('listAll')->willThrowException(new DirectoryException('LDAP search incomplete (code 4): Sizelimit exceeded')); + + $run = $this->service($directory)->execute(9, 'run'); + + $this->assertSame('error', $run['status']); + $this->assertSame('LDAP search incomplete (code 4): Sizelimit exceeded', $this->finished[2]['error']); + } + + public function testBlockedRunsWriteNothing(): void + { + $this->repo->expects($this->never())->method('link'); + $this->repo->expects($this->never())->method('setActive'); + + $run = $this->service($this->listing(), ['offboarding_limit' => 0, 'group_sync' => 0], 6)->execute(9, 'run'); + + $this->assertSame('blocked', $run['status']); + } + + public function testScheduledRunsWaitForTheInterval(): void + { + $this->runs->method('nextPending')->willReturn(null); + $this->runs->method('secondsSinceScheduled')->willReturn(600); + $this->runs->expects($this->never())->method('create'); + + $this->assertNull($this->service($this->listing())->runDue()); + } + + public function testRequestedRunsComeFirst(): void + { + $this->runs->method('nextPending')->willReturn(['id' => 3, 'mode' => 'preview']); + $this->runs->expects($this->once())->method('start')->with(3); + + $this->assertSame('preview', $this->service($this->listing())->runDue()['mode']); + } + + public function testNothingIsDueWithoutSync(): void + { + $this->runs->method('nextPending')->willReturn(null); + $this->runs->expects($this->never())->method('create'); + + $this->assertNull($this->service($this->listing(), ['offboarding' => 0, 'group_sync' => 0, 'import_users' => 0])->runDue()); + } + + /** a@ (linked) is disabled, b@ is adopted, new@ is created, b@ and new@ are in Sales */ + private function listing(): Directory + { + $directory = $this->createMock(Directory::class); + $directory->method('listAll')->willReturn(new Listing([ + 'u1' => new DirectoryUser('u1', 'a@example.org', 'A', false), + 'u2' => new DirectoryUser('u2', 'b@example.org', 'B', true), + 'u3' => new DirectoryUser('u3', 'new@example.org', 'New', true), + ], ['g1' => new DirectoryGroup('g1', 'Sales', null, ['u2', 'u3'])])); + return $directory; + } + + private function service(Directory $directory, array $settings = [], int $extraAccounts = 0): SyncService + { + if ($extraAccounts > 0) { + $accounts = []; + for ($i = 0; $i < $extraAccounts; $i++) { + $accounts["x$i@example.org"] = new Account("x$i@example.org", '', 1, "x$i", false, '2026-10-25 10:00:00'); + } + $this->repo = $this->createMock(IdentityRepository::class); + $this->repo->method('accounts')->willReturn($accounts); + $this->repo->expects($this->never())->method('setActive'); + } + return new SyncService(Settings::fromArray($settings + ['authsource' => 'keycloak', 'offboarding' => 1, 'import_users' => 1, + 'group_sync' => 1, 'default_template' => 'Default']), fn(): Directory => $directory, $this->repo, $this->runs, new SyncPlanner(), + $this->groups, $this->templates, $this->legacy, $this->sogo); + } +} diff --git a/tests/php/MailboxGroup/Controller/MailboxGroupApiControllerTest.php b/tests/php/MailboxGroup/Controller/MailboxGroupApiControllerTest.php new file mode 100644 index 000000000..dfe74ad36 --- /dev/null +++ b/tests/php/MailboxGroup/Controller/MailboxGroupApiControllerTest.php @@ -0,0 +1,136 @@ +groups = $this->createMock(GroupService::class); + $this->hooks = $this->createMock(AccountHooks::class); + $this->templates = $this->createMock(TemplateService::class); + $this->api = new MailboxGroupApiController($this->groups, $this->hooks, $this->templates, new ApiResponse()); + } + + private static function group(string $name, array $warnings = []): Group + { + $group = Group::fromRow(['id' => 7, 'domain' => 'example.org', 'name' => $name]); + $group->warnings = $warnings; + return $group; + } + + /** Messages written to the session as [type, msg] */ + private function messages(): array + { + return array_map(fn(array $m): array => [$m['type'], $m['msg']], $_SESSION['return'] ?? []); + } + + public function testAddReportsWarningsAndTheEscapedName(): void + { + $this->groups->method('create')->willReturn(self::group('', [['group_template_failed', 'Staff', 'a@example.org']])); + + $this->assertTrue($this->api->addGroup(['name' => ''])); + + $this->assertSame([ + ['warning', ['group_template_failed', 'Staff', 'a@example.org']], + ['success', ['group_added', '<Sales>']], + ], $this->messages()); + $this->assertSame(['mailbox_group', 'add', 'group', ['name' => '']], $_SESSION['return'][1]['log']); + } + + public function testErrorsBecomeDangerMessages(): void + { + $this->groups->method('create')->willReturnOnConsecutiveCalls( + $this->throwException(new UserError('group_name_invalid')), + $this->throwException(new PDOException('gone away')) + ); + + $this->assertFalse($this->api->addGroup([])); + $this->assertFalse($this->api->addGroup([])); + + $this->assertSame([['danger', 'group_name_invalid'], ['danger', ['mysql_error', 'gone away']]], $this->messages()); + } + + public function testEditReportsEachId(): void + { + $this->groups->method('update')->willReturnCallback(fn(int $id, array $attr): Group => ($id === 2) + ? throw new UserError('group_member_idp', ['a@example.org']) : self::group('G' . $id)); + + $this->assertTrue($this->api->editGroups(['1', '2', 'x'], ['active' => '0'])); + + $this->assertSame([ + ['success', ['group_modified', 'G1']], + ['danger', ['group_member_idp', 'a@example.org']], + ['danger', 'access_denied'], + ], $this->messages()); + } + + public function testEditAndDeleteNeedAnEditorOnce(): void + { + $this->groups->method('requireEditor')->willThrowException(new AccessDenied()); + $this->groups->expects($this->never())->method('update'); + $this->groups->expects($this->never())->method('delete'); + + $this->assertFalse($this->api->editGroups(['1', '2'], [])); + $this->assertFalse($this->api->deleteGroups(['1', '2'])); + + $this->assertSame([['danger', 'access_denied'], ['danger', 'access_denied']], $this->messages()); + } + + public function testDelete(): void + { + $this->groups->expects($this->once())->method('delete')->with(7)->willReturn(self::group('Sales')); + + $this->assertTrue($this->api->deleteGroups(['7'])); + + $this->assertSame([['success', ['group_removed', 'Sales']]], $this->messages()); + } + + public function testGetGroupsSplitsTheDomainList(): void + { + $this->groups->expects($this->once())->method('visibleIds')->with(['a.org', 'b.org'])->willReturn([7]); + $this->groups->method('get')->willReturnMap([[7, self::group('Sales')]]); + $this->groups->method('toArray')->willReturn(['id' => 7]); + + $this->assertSame([['id' => 7]], $this->api->getGroups(' a.org,,b.org ')); + $this->assertSame([], $this->api->getGroup('all')); + } + + public function testHooksTurnDatabaseErrorsIntoMessages(): void + { + $this->hooks->method('onMailboxDeleted')->willThrowException(new PDOException('locked')); + + $this->api->mailboxDeleted('a@example.org'); + + $this->assertSame([['danger', ['mysql_error', 'locked']]], $this->messages()); + } + + public function testTemplateChangesReportWarnings(): void + { + $this->templates->method('onTemplateChanged')->with(3)->willReturn([['group_template_failed', 'Staff', 'a@example.org']]); + + $this->api->templateChanged(3); + + $this->assertSame([['warning', ['group_template_failed', 'Staff', 'a@example.org']]], $this->messages()); + } +} diff --git a/tests/php/MailboxGroup/Legacy/LegacyMailboxTest.php b/tests/php/MailboxGroup/Legacy/LegacyMailboxTest.php new file mode 100644 index 000000000..1bb1691e0 --- /dev/null +++ b/tests/php/MailboxGroup/Legacy/LegacyMailboxTest.php @@ -0,0 +1,70 @@ + [['type' => 'success', 'msg' => 'caller']], 'access_all_exception' => '0']; + } + + /** Replaces the global calls: $result is returned, $messages are written like the legacy code does */ + private static function legacy(mixed $result, array $messages = [], array &$calls = []): LegacyMailbox + { + return new class($result, $messages, $calls) extends LegacyMailbox { + private array $calls; + + public function __construct(private mixed $result, private array $messages, array &$calls) + { + $this->calls = &$calls; + } + + protected function callTemplate(string $username, string $name, string $template): mixed + { + $this->calls[] = [$username, $name, $template, $_SESSION['access_all_exception']]; + if ($this->result instanceof RuntimeException) { + throw $this->result; + } + $_SESSION['return'] = array_merge($_SESSION['return'], $this->messages); + return $this->result; + } + }; + } + + public function testTemplatesAreAppliedAsSystemAndTheSessionIsRestored(): void + { + $calls = []; + + $this->assertNull(self::legacy(true, [['type' => 'success', 'msg' => 'mailbox_modified']], $calls)->applyTemplate('a@example.org', 'A', 'Staff')); + + $this->assertSame([['a@example.org', 'A', 'Staff', '1']], $calls); + $this->assertSame(['return' => [['type' => 'success', 'msg' => 'caller']], 'access_all_exception' => '0'], $_SESSION); + } + + public function testTheFirstLegacyErrorIsReturned(): void + { + $error = self::legacy(false, [['type' => 'success', 'msg' => 'x'], ['type' => 'danger', 'msg' => ['mailbox_quota_exceeded', 1]]]) + ->applyTemplate('a@example.org', 'A', 'Staff'); + + $this->assertSame('mailbox_quota_exceeded', $error); + $this->assertSame('0', $_SESSION['access_all_exception']); + } + + public function testTheSessionIsRestoredOnExceptions(): void + { + try { + self::legacy(new RuntimeException('boom'))->applyTemplate('a@example.org', 'A', 'Staff'); + $this->fail('exception expected'); + } catch (RuntimeException) { + } + + $this->assertSame(['return' => [['type' => 'success', 'msg' => 'caller']], 'access_all_exception' => '0'], $_SESSION); + } +} diff --git a/tests/php/MailboxGroup/Service/ChangeEffectsTest.php b/tests/php/MailboxGroup/Service/ChangeEffectsTest.php new file mode 100644 index 000000000..8346ad8e8 --- /dev/null +++ b/tests/php/MailboxGroup/Service/ChangeEffectsTest.php @@ -0,0 +1,42 @@ +createMock(GroupRepository::class); + $repo->method('takeEffects')->willReturn(['members' => ['a@example.org'], 'sogo_acl' => true]); + $legacy = $this->createMock(SogoService::class); + $legacy->expects($this->once())->method('refreshStaticView')->with(['b@example.org']); + $legacy->expects($this->once())->method('flushCache'); + $dovecot = $this->createMock(DovecotService::class); + $dovecot->expects($this->once())->method('flushAuthCache')->with(['a@example.org']); + $templates = $this->createMock(TemplateService::class); + $templates->method('applyChanged')->willReturn([]); + + (new ChangeEffects($templates, $legacy, $repo, $dovecot))->apply(['b@example.org'], []); + } + + public function testSogoCacheStaysWithoutAclChanges(): void + { + $repo = $this->createMock(GroupRepository::class); + $repo->method('takeEffects')->willReturn(['members' => [], 'sogo_acl' => false]); + $legacy = $this->createMock(SogoService::class); + $legacy->expects($this->never())->method('flushCache'); + $templates = $this->createMock(TemplateService::class); + $templates->method('applyChanged')->willReturn([]); + + (new ChangeEffects($templates, $legacy, $repo, $this->createMock(DovecotService::class)))->apply([], []); + } +} diff --git a/tests/php/MailboxGroup/Service/GroupServiceTest.php b/tests/php/MailboxGroup/Service/GroupServiceTest.php new file mode 100644 index 000000000..731e656cc --- /dev/null +++ b/tests/php/MailboxGroup/Service/GroupServiceTest.php @@ -0,0 +1,359 @@ + '1']; + + private GroupRepository&MockObject $repo; + private LookupRepository&MockObject $lookup; + private TemplateService&MockObject $templates; + private ChangeEffects&MockObject $effects; + private SharingService&MockObject $sharing; + + protected function setUp(): void + { + $this->repo = $this->createMock(GroupRepository::class); + $this->lookup = $this->createMock(LookupRepository::class); + $this->templates = $this->createMock(TemplateService::class); + $this->effects = $this->createMock(ChangeEffects::class); + $this->effects->method('snapshot')->willReturn([]); + $this->effects->method('apply')->willReturn([]); + $this->sharing = $this->createMock(SharingService::class); + $this->sharing->method('applyImap')->willReturn([]); + $this->sharing->method('applySogo')->willReturn([]); + $this->lookup->method('isDomain')->willReturnCallback(fn(string $d): bool => in_array($d, ['example.org', 'other.org'], true)); + $this->lookup->method('isDomainOrAliasDomain')->willReturnCallback(fn(string $d): bool => in_array($d, ['example.org', 'other.org', 'alias.org'], true)); + $this->lookup->method('aliasExists')->willReturnCallback(fn(string $a): bool => str_starts_with($a, 'shared@') || str_starts_with($a, 'a@')); + $this->lookup->method('regularMailboxes')->willReturnCallback(fn(array $u): array => array_values(array_filter($u, fn(string $x): bool => !str_starts_with($x, 'room')))); + $this->lookup->method('aliasesLeft')->willReturn(10); + $this->lookup->method('templateName')->willReturnCallback(fn(int $id): ?string => $id === 3 ? 'Staff' : null); + } + + private function service(Context $context): GroupService + { + return new GroupService($this->repo, $this->lookup, $this->templates, $this->effects, $this->sharing, $context); + } + + private static function admin(): FakeContext + { + return FakeContext::admin(self::ACL); + } + + /** Domain admin of example.org with its mailboxes a@ and b@ */ + private static function domainAdmin(array $acl = self::ACL): FakeContext + { + return FakeContext::domainAdmin(['a@example.org', 'b@example.org'], ['example.org'], $acl); + } + + private static function stored(array $row = [], array $members = ['a@example.org' => 'manual'], array $sendAs = []): Group + { + $group = Group::fromRow($row + ['id' => 7, 'domain' => 'example.org', 'name' => 'Sales', 'address' => 'sales@example.org', + 'sender_allowed' => 1, 'active' => 1, 'priority' => 0]); + $group->members = $members; + $group->sendAs = $sendAs; + return $group; + } + + private function expectUserError(string|array $msg, callable $call): void + { + try { + $call(); + $this->fail('UserError ' . json_encode($msg) . ' expected'); + } catch (UserError $e) { + $this->assertSame($msg, $e->msg()); + } + } + + public static function deniedEditors(): array + { + return [ + 'user' => [FakeContext::user('a@example.org', self::ACL)], + 'domain admin without ACL' => [self::domainAdmin([])], + 'read-only API key' => [new Context('admin', 'API', self::ACL, false, 'ro')], + 'system' => [Context::system()], + ]; + } + + #[DataProvider('deniedEditors')] + public function testOnlyAdminsAndDomainAdminsWithAclMayWrite(Context $context): void + { + $this->repo->expects($this->never())->method('insert'); + + $this->expectUserError('access_denied', fn() => $this->service($context)->create(['domain' => 'example.org', 'name' => 'X'])); + } + + public function testReadOnlyApiKeyMayRead(): void + { + $this->repo->expects($this->once())->method('visibleIds')->willReturn([7]); + + $this->assertSame([7], $this->service(new Context('admin', 'API', self::ACL, false, 'ro'))->visibleIds()); + } + + public function testCreateNormalisesInput(): void + { + $this->repo->expects($this->once())->method('insert')->with($this->callback(function (Group $g): bool { + $this->assertSame('example.org', $g->domain); + $this->assertSame('Sales', $g->name); + $this->assertSame('sales@example.org', $g->address); + $this->assertSame(['a@example.org' => 'manual', 'b@example.org' => 'manual'], $g->members); + $this->assertSame(['@alias.org', 'shared@example.org'], $g->sendAs); + $this->assertSame([1, 0, 1, 1], [$g->senderAllowed, $g->sogoVisible, $g->internal, $g->active]); + $this->assertSame([3, 'Staff', 5], [$g->templateId, $g->template, $g->priority]); + return true; + }))->willReturn([]); + + $group = $this->service(self::admin())->create([ + 'domain' => ' Example.ORG ', 'name' => ' Sales ', 'local_part' => 'Sales', + 'members' => "B@example.org\na@example.org, a@example.org", 'send_as' => ['Shared@Example.org', '@alias.org'], + 'sender_allowed' => ['0', '1'], 'sogo_visible' => '0', 'internal' => 'true', + 'template_id' => '3', 'priority' => '5', + ]); + + $this->assertSame([], $group->warnings); + } + + public static function invalidInput(): array + { + return [ + 'empty name' => [['name' => ' '], 'group_name_invalid'], + 'long name' => [['name' => str_repeat('x', 101)], 'group_name_invalid'], + 'long description' => [['description' => str_repeat('x', 256)], 'group_description_invalid'], + 'unknown domain' => [['domain' => 'nope.org'], ['domain_not_found', 'nope.org']], + 'address in other domain' => [['address' => 'sales@other.org'], ['group_address_invalid', 'sales@other.org']], + 'invalid address' => [['local_part' => 'a b'], ['group_address_invalid', 'a b@example.org']], + 'member is a resource' => [['members' => ['room1@example.org']], ['group_member_invalid', 'room1@example.org']], + 'unknown send-as address' => [['send_as' => 'nobody@example.org'], ['group_send_as_invalid', 'nobody@example.org']], + 'send-as on own address' => [['local_part' => 'shared', 'send_as' => 'shared@example.org'], ['group_send_as_invalid', 'shared@example.org']], + 'send-as on unknown domain' => [['send_as' => '@nope.org'], ['group_send_as_invalid', '@nope.org']], + 'unknown template' => [['template_id' => '4'], ['template_id_invalid', '4']], + 'invalid priority' => [['priority' => 'high'], 'group_priority_invalid'], + ]; + } + + #[DataProvider('invalidInput')] + public function testCreateRejectsInvalidInput(array $input, string|array $msg): void + { + $this->repo->expects($this->never())->method('insert'); + + $this->expectUserError($msg, fn() => $this->service(self::admin())->create($input + ['domain' => 'example.org', 'name' => 'Sales'])); + } + + public function testAddressMustBeFreeAndWithinQuota(): void + { + $lookup = $this->createMock(LookupRepository::class); + $lookup->method('isDomain')->willReturn(true); + $lookup->method('addressTaken')->willReturnOnConsecutiveCalls(true, false); + $lookup->method('aliasesLeft')->willReturn(0); + $this->lookup = $lookup; + $this->repo->expects($this->never())->method('insert'); + $service = $this->service(self::admin()); + + $this->expectUserError(['is_alias_or_mailbox', 'sales@example.org'], fn() => $service->create(['domain' => 'example.org', 'name' => 'S', 'local_part' => 'sales'])); + $this->expectUserError('max_alias_exceeded', fn() => $service->create(['domain' => 'example.org', 'name' => 'S', 'local_part' => 'sales'])); + } + + public function testNameIsUniquePerDomain(): void + { + $this->repo->method('nameExists')->willReturn(true); + + $this->expectUserError(['object_exists', 'Sales'], fn() => $this->service(self::admin())->create(['domain' => 'example.org', 'name' => 'Sales'])); + } + + public function testDomainAdminScope(): void + { + $service = $this->service(self::domainAdmin()); + + $this->expectUserError('access_denied', fn() => $service->create(['domain' => 'other.org', 'name' => 'X'])); + $this->expectUserError('access_denied', fn() => $service->create(['domain' => 'example.org', 'name' => 'X', 'members' => ['c@other.org']])); + $this->expectUserError('access_denied', fn() => $service->create(['domain' => 'example.org', 'name' => 'X', 'send_as' => '@other.org'])); + } + + public function testAdminFieldsAreIgnoredForDomainAdmins(): void + { + $this->repo->expects($this->once())->method('insert')->with($this->callback(fn(Group $g): bool => + $g->templateId === null && $g->priority === 0 && $g->idpRef === null))->willReturn([]); + + $this->service(self::domainAdmin())->create(['domain' => 'example.org', 'name' => 'X', 'template_id' => 3, 'priority' => 9, 'idp_ref' => 'x']); + } + + public function testReplacingMembersKeepsIdpAndOutOfScopeMembers(): void + { + $this->repo->method('findVisible')->willReturn(self::stored([], [ + 'a@example.org' => 'manual', 'c@other.org' => 'manual', 'd@example.org' => 'idp', + ])); + $this->repo->expects($this->once())->method('update')->with($this->callback(fn(Group $g): bool => + $g->members === ['b@example.org' => 'manual', 'c@other.org' => 'manual', 'd@example.org' => 'idp']))->willReturn([]); + + $this->service(self::domainAdmin())->update(7, ['members' => ['b@example.org']]); + } + + public function testIdpMembersCannotBeRemoved(): void + { + $this->repo->method('findVisible')->willReturn(self::stored([], ['a@example.org' => 'idp'])); + $this->repo->expects($this->never())->method('update'); + + $this->expectUserError(['group_member_idp', 'a@example.org'], fn() => $this->service(self::admin())->update(7, ['remove_members' => 'a@example.org'])); + } + + public function testUpdateKeepsMissingAttributes(): void + { + $stored = self::stored(['description' => 'Team', 'template_id' => 3, 'priority' => 4], ['a@example.org' => 'manual'], ['shared@example.org']); + $this->repo->method('findVisible')->willReturn($stored); + $this->repo->expects($this->once())->method('update')->with($this->callback(function (Group $g): bool { + $this->assertSame(['Team', 'sales@example.org', 0, 3, 4], [$g->description, $g->address, $g->active, $g->templateId, $g->priority]); + $this->assertSame(['a@example.org' => 'manual'], $g->members); + $this->assertSame(['shared@example.org'], $g->sendAs); + return true; + }))->willReturn([]); + + $this->service(self::admin())->update(7, ['active' => '0']); + } + + public function testRemovingTheAddressFreesIt(): void + { + $this->repo->method('findVisible')->willReturn(self::stored()); + $this->repo->expects($this->once())->method('update')->with($this->callback(fn(Group $g): bool => $g->address === null))->willReturn([]); + + $this->service(self::admin())->update(7, ['address' => '']); + } + + public function testForeignSendAsMakesAGroupReadOnlyForDomainAdmins(): void + { + $group = self::stored([], ['a@example.org' => 'manual'], ['@other.org']); + $this->repo->method('findVisible')->willReturn($group); + $this->repo->expects($this->never())->method('update'); + $service = $this->service(self::domainAdmin()); + + $this->assertFalse($service->toArray($group)['can_edit']); + $this->expectUserError('access_denied', fn() => $service->update(7, ['name' => 'X'])); + } + + public function testGrantsAreNormalisedAndApplied(): void + { + $this->repo->method('findVisible')->willReturn(self::stored()); + $this->repo->expects($this->once())->method('update')->with($this->callback(function (Group $g): bool { + $this->assertSame([['owner' => 'a@example.org', 'rights' => 'full', 'subscribe' => 1], ['owner' => 'b@example.org', 'rights' => 'read', 'subscribe' => 0]], + $g->imapGrants); + $this->assertSame([['owner' => 'a@example.org', 'type' => 'Calendar', 'folder' => 'personal', 'access' => 'write', 'subscribe' => 1], + ['owner' => 'a@example.org', 'type' => 'Contacts', 'folder' => 'team-1', 'access' => 'read', 'subscribe' => 0]], $g->sogoGrants); + return true; + }))->willReturn([]); + $this->sharing = $this->createMock(SharingService::class); + $this->sharing->expects($this->once())->method('applyImap')->with(7)->willReturn([['group_imap_grant_failed', 'b@example.org']]); + $this->sharing->expects($this->once())->method('applySogo')->with(7)->willReturn([]); + + $group = $this->service(self::admin())->update(7, [ + // a form sends JSON strings, an API client lists + 'imap_grants' => '[{"owner":"B@example.org","rights":"read"},{"owner":"a@example.org","rights":"full","subscribe":1}]', + 'sogo_grants' => [['owner' => 'a@example.org', 'type' => 'Contacts', 'folder' => 'team-1'], + ['owner' => 'a@example.org', 'access' => 'write', 'subscribe' => '1']], + ]); + + $this->assertSame([['group_imap_grant_failed', 'b@example.org']], $group->warnings); + } + + public static function invalidGrants(): array + { + return [ + 'unknown rights' => [['imap_grants' => [['owner' => 'a@example.org', 'rights' => 'admin']]], ['group_grant_invalid', 'a@example.org']], + 'resource owner' => [['imap_grants' => [['owner' => 'room1@example.org']]], ['group_grant_invalid', 'room1@example.org']], + 'no owner' => [['sogo_grants' => [['type' => 'Calendar']]], ['group_grant_invalid', '']], + 'folder path' => [['sogo_grants' => [['owner' => 'a@example.org', 'folder' => '../x']]], ['group_grant_invalid', 'a@example.org']], + 'unknown type' => [['sogo_grants' => [['owner' => 'a@example.org', 'type' => 'Mail']]], ['group_grant_invalid', 'a@example.org']], + 'no list' => [['imap_grants' => 'a@example.org'], ['group_grant_invalid', '']], + 'foreign owner for a domain admin' => [['imap_grants' => [['owner' => 'c@other.org']]], 'access_denied'], + ]; + } + + #[DataProvider('invalidGrants')] + public function testInvalidGrantsAreRejected(array $input, string|array $msg): void + { + $this->repo->method('findVisible')->willReturn(self::stored()); + $this->repo->expects($this->never())->method('update'); + + $this->expectUserError($msg, fn() => $this->service(self::domainAdmin())->update(7, $input)); + } + + public function testForeignGrantOwnersMakeAGroupReadOnlyForDomainAdmins(): void + { + $group = self::stored(); + $group->sogoGrants = [['owner' => 'c@other.org', 'type' => 'Calendar', 'folder' => 'personal', 'access' => 'read']]; + + $this->assertFalse($this->service(self::domainAdmin())->canEdit($group)); + $this->assertTrue($this->service(self::admin())->canEdit($group)); + } + + public function testDeleteRemovesTheImapAclsFirst(): void + { + $group = self::stored(); + $this->repo->method('findVisible')->willReturn($group); + $calls = []; + $this->sharing->expects($this->once())->method('removeImap')->with($group)->willReturnCallback(function () use (&$calls): void { + $calls[] = 'acl'; + }); + $this->repo->method('delete')->willReturnCallback(function () use (&$calls): array { + $calls[] = 'delete'; + return []; + }); + + $this->service(self::admin())->delete(7); + + $this->assertSame(['acl', 'delete'], $calls); + } + + public function testDeleteReportsWarningsOfTheEffects(): void + { + $effects = $this->createMock(ChangeEffects::class); + $effects->expects($this->once())->method('snapshot')->with(['a@example.org'])->willReturn(['a@example.org' => 'Staff']); + $effects->expects($this->once())->method('apply')->with(['a@example.org'], ['a@example.org' => 'Staff'])->willReturn([['w']]); + $this->effects = $effects; + $this->repo->method('findVisible')->willReturn(self::stored()); + $this->repo->expects($this->once())->method('delete')->with(7)->willReturn(['a@example.org']); + + $this->assertSame([['w']], $this->service(self::admin())->delete(7)->warnings); + } + + public function testLargeDistributionGroupsWarn(): void + { + $members = []; + for ($i = 0; $i < 1001; $i++) { + $members[] = 'u' . $i . '@example.org'; + } + $this->repo->method('insert')->willReturn([]); + + $group = $this->service(self::admin())->create(['domain' => 'example.org', 'name' => 'All', 'local_part' => 'all', 'members' => $members]); + + $this->assertSame([['group_too_many_members', 'All', 1000]], $group->warnings); + } + + public function testMembershipsAreVisibleToTheMailboxAndItsManagers(): void + { + $this->lookup->method('membershipsOf')->willReturn([['id' => 7, 'name' => 'Sales']]); + $this->lookup->method('sendAsOf')->willReturn(['sales@example.org']); + $this->templates->method('effective')->willReturn(['a@example.org' => 'Staff']); + $expected = ['groups' => [['id' => 7, 'name' => 'Sales']], 'template' => 'Staff', 'send_as' => ['sales@example.org']]; + + $this->assertSame($expected, $this->service(FakeContext::user('a@example.org', []))->membershipsOf('A@example.org')); + $this->assertSame($expected, $this->service(self::domainAdmin())->membershipsOf('a@example.org')); + $this->assertSame([], $this->service(FakeContext::user('b@example.org', []))->membershipsOf('a@example.org')); + $this->assertSame([], $this->service(self::domainAdmin())->membershipsOf('c@other.org')); + } +} diff --git a/tests/php/MailboxGroup/Service/IdpSyncServiceTest.php b/tests/php/MailboxGroup/Service/IdpSyncServiceTest.php new file mode 100644 index 000000000..7d79331c1 --- /dev/null +++ b/tests/php/MailboxGroup/Service/IdpSyncServiceTest.php @@ -0,0 +1,49 @@ + 7, 'domain' => 'example.org', 'name' => 'Sales']); + $group->members = ['a@example.org' => 'manual', 'b@example.org' => 'idp', 'c@example.org' => 'idp']; + $repo = $this->createMock(GroupRepository::class); + $repo->method('find')->with(7)->willReturn($group); + $repo->expects($this->once())->method('update')->with($this->callback(fn(Group $g): bool => + $g->members === ['a@example.org' => 'manual', 'c@example.org' => 'idp', 'd@example.org' => 'idp']))->willReturn([]); + $lookup = $this->createMock(LookupRepository::class); + $lookup->method('regularMailboxes')->willReturnCallback(fn(array $u): array => array_values(array_diff($u, ['room@example.org']))); + $effects = $this->createMock(ChangeEffects::class); + $effects->method('apply')->willReturn([]); + + $result = (new IdpSyncService($repo, $lookup, $effects)) + ->syncGroupMembers(7, ['A@example.org', 'c@example.org', 'd@example.org', 'room@example.org']); + + $this->assertSame(['d@example.org'], $result['added']); + $this->assertSame(['b@example.org'], $result['removed']); + $this->assertSame(['room@example.org'], $result['skipped']); + } + + public function testNothingIsWrittenWithoutChanges(): void + { + $group = Group::fromRow(['id' => 7]); + $group->members = ['a@example.org' => 'idp']; + $repo = $this->createMock(GroupRepository::class); + $repo->method('find')->willReturn($group); + $repo->expects($this->never())->method('update'); + $lookup = $this->createMock(LookupRepository::class); + $lookup->method('regularMailboxes')->willReturn(['a@example.org']); + + (new IdpSyncService($repo, $lookup, $this->createMock(ChangeEffects::class)))->syncGroupMembers(7, ['a@example.org']); + } +} diff --git a/tests/php/MailboxGroup/Service/SharingServiceTest.php b/tests/php/MailboxGroup/Service/SharingServiceTest.php new file mode 100644 index 000000000..11206cca5 --- /dev/null +++ b/tests/php/MailboxGroup/Service/SharingServiceTest.php @@ -0,0 +1,182 @@ +createMock(GroupRepository::class); + $repo->method('imapGrantsToApply')->with(7, false)->willReturn([ + self::grant(1, 'a@example.org', 'write', 'pending'), + self::grant(2, 'b@example.org', 'read', 'removing'), + self::grant(3, 'c@example.org', 'read', 'pending'), + self::grant(4, 'd@example.org', 'read', 'removing'), + ]); + $dovecot = $this->createMock(DovecotService::class); + $dovecot->method('setAclAll')->willReturnCallback(fn(string $owner, string $identifier, array $rights): ?string => + in_array($owner, ['c@example.org', 'd@example.org'], true) ? 'command failed' : null); + $states = []; + $repo->method('setImapState')->willReturnCallback(function (int $id, string $state, ?string $error) use (&$states): void { + $states[$id] = [$state, $error]; + }); + $repo->expects($this->once())->method('deleteImapGrant')->with(2); + + $warnings = (new SharingService($repo, $dovecot, $this->createMock(SogoService::class), $this->createMock(ChangeEffects::class)))->applyImap(7); + + $this->assertSame([1 => ['applied', null], 3 => ['failed', 'command failed'], 4 => ['removing', 'command failed']], $states); + $this->assertSame([['group_imap_grant_failed', 'c@example.org'], ['group_imap_grant_failed', 'd@example.org']], $warnings); + } + + public function testRightsPerLevel(): void + { + $repo = $this->createMock(GroupRepository::class); + $repo->method('imapGrantsToApply')->willReturn([self::grant(1, 'a@example.org', 'read', 'pending')]); + $dovecot = $this->createMock(DovecotService::class); + $dovecot->expects($this->once())->method('setAclAll')->with('a@example.org', 'group=mcg_7', ['lookup', 'read', 'write-seen'])->willReturn(null); + + (new SharingService($repo, $dovecot, $this->createMock(SogoService::class), $this->createMock(ChangeEffects::class)))->applyImap(7); + } + + public function testRemovingAGroupDropsItsAcls(): void + { + $group = Group::fromRow(['id' => 7]); + $group->imapGrants = [['owner' => 'a@example.org', 'rights' => 'read']]; + $dovecot = $this->createMock(DovecotService::class); + $dovecot->expects($this->once())->method('setAclAll')->with('a@example.org', 'group=mcg_7', []); + + (new SharingService($this->createMock(GroupRepository::class), $dovecot, $this->createMock(SogoService::class), $this->createMock(ChangeEffects::class)))->removeImap($group); + } + + public function testReconcileAppliesEverythingAgain(): void + { + $repo = $this->createMock(GroupRepository::class); + $repo->expects($this->once())->method('imapGrantsToApply')->with(null, true)->willReturn([]); + $repo->method('groupIdsWithSogoGrants')->willReturn([3, 5]); + $repo->method('rebuild')->willReturnCallback(fn(int $id): array => ($id === 3) ? ['a@example.org'] : ['a@example.org', 'b@example.org']); + $repo->expects($this->once())->method('cleanupSogoAcl'); + $effects = $this->createMock(ChangeEffects::class); + $effects->expects($this->once())->method('apply')->with(['a@example.org', 'b@example.org'], [])->willReturn([]); + + (new SharingService($repo, $this->createMock(DovecotService::class), $this->createMock(SogoService::class), $effects))->reconcile(); + } + + public function testMembersAreSubscribedOnce(): void + { + $repo = $this->reconcileRepo(); + $repo->method('staleSubscriptions')->willReturn([]); + $repo->method('missingSubscriptions')->willReturnCallback(fn(string $kind): array => ($kind === 'imap') + ? [['grant_id' => 2, 'owner' => 'team@example.org', 'folder' => '', 'usernames' => ['a@example.org']]] + : [['grant_id' => 3, 'owner' => 'team@example.org', 'folder' => 'Calendar/personal', 'usernames' => ['a@example.org', 'b@example.org']], + ['grant_id' => 4, 'owner' => 'team@example.org', 'folder' => 'Contacts/personal', 'usernames' => ['c@example.org']]]); + $added = []; + $repo->method('addSubscriptions')->willReturnCallback(function (string $kind, int $grant, string $owner, string $folder, array $users) use (&$added): void { + $added[] = [$kind, $grant, $folder, $users]; + }); + $dovecot = $this->createMock(DovecotService::class); + $dovecot->expects($this->once())->method('subscribeShared')->with('team@example.org', ['a@example.org'], false)->willReturn(null); + $legacy = $this->createMock(SogoService::class); + $legacy->method('subscribe')->willReturnCallback(fn(string $owner, string $folder): ?string => + ($folder === 'Contacts/personal') ? 'command failed' : null); + $legacy->expects($this->once())->method('flushCache'); + + $warnings = (new SharingService($repo, $dovecot, $legacy, $this->effects()))->reconcile(); + + // the failed batch is not recorded, so the next run tries again + $this->assertSame([['imap', 2, '', ['a@example.org']], ['sogo', 3, 'Calendar/personal', ['a@example.org', 'b@example.org']]], $added); + $this->assertSame([['group_subscription_failed', 'c@example.org']], $warnings); + } + + public function testSubscriptionsOfMembersWithoutAccessAreRemoved(): void + { + $repo = $this->reconcileRepo(); + $repo->method('missingSubscriptions')->willReturn([]); + $repo->method('staleSubscriptions')->willReturnCallback(fn(string $kind): array => ($kind === 'imap') + ? [['id' => 1, 'username' => 'a@example.org', 'owner' => 'team@example.org', 'folder' => '', 'member_exists' => 1, 'owner_exists' => 1, 'covered' => 0], + ['id' => 2, 'username' => 'gone@example.org', 'owner' => 'team@example.org', 'folder' => '', 'member_exists' => 0, 'owner_exists' => 1, 'covered' => 0]] + : [['id' => 3, 'username' => 'b@example.org', 'owner' => 'team@example.org', 'folder' => 'Calendar/personal', 'member_exists' => 1, 'owner_exists' => 1, 'covered' => 0], + // another group still grants the calendar + ['id' => 4, 'username' => 'c@example.org', 'owner' => 'team@example.org', 'folder' => 'Calendar/personal', 'member_exists' => 1, 'owner_exists' => 1, 'covered' => 1]]); + $deleted = []; + $repo->method('deleteSubscription')->willReturnCallback(function (int $id) use (&$deleted): void { + $deleted[] = $id; + }); + $dovecot = $this->createMock(DovecotService::class); + $dovecot->expects($this->once())->method('subscribeShared')->with('team@example.org', ['a@example.org'], true)->willReturn(null); + $legacy = $this->createMock(SogoService::class); + $legacy->expects($this->once())->method('subscribe')->with('team@example.org', 'Calendar/personal', ['b@example.org'], true)->willReturn('failed'); + $legacy->expects($this->never())->method('flushCache'); + + $warnings = (new SharingService($repo, $dovecot, $legacy, $this->effects()))->reconcile(); + + $this->assertSame([1, 2, 4], $deleted); + $this->assertSame([['group_subscription_failed', 'b@example.org']], $warnings); + } + + public function testMissingSogoFoldersAreCreatedAfterAWrite(): void + { + $repo = $this->createMock(GroupRepository::class); + $repo->method('pendingSogoOwners')->with(7)->willReturn(['team@example.org']); + $repo->expects($this->once())->method('rebuild')->with(7)->willReturn([]); + $legacy = $this->createMock(SogoService::class); + $legacy->expects($this->once())->method('initUsers')->with(['team@example.org'])->willReturn(null); + + $this->assertSame([], (new SharingService($repo, $this->createMock(DovecotService::class), $legacy, $this->effects()))->applySogo(7)); + } + + public function testNothingHappensWithoutPendingFolders(): void + { + $repo = $this->createMock(GroupRepository::class); + $repo->method('pendingSogoOwners')->willReturn([]); + $repo->expects($this->never())->method('rebuild'); + $legacy = $this->createMock(SogoService::class); + $legacy->expects($this->never())->method('initUsers'); + + $this->assertSame([], (new SharingService($repo, $this->createMock(DovecotService::class), $legacy, $this->effects()))->applySogo(7)); + } + + public function testFailedFolderCreationIsAWarning(): void + { + $repo = $this->createMock(GroupRepository::class); + $repo->method('pendingSogoOwners')->willReturn(['team@example.org']); + $repo->expects($this->never())->method('rebuild'); + $legacy = $this->createMock(SogoService::class); + $legacy->method('initUsers')->willReturn('command failed'); + + $this->assertSame([['group_sogo_init_failed', 'team@example.org']], + (new SharingService($repo, $this->createMock(DovecotService::class), $legacy, $this->effects()))->applySogo(7)); + } + + /** Repository mock for reconcile(): no IMAP grants, no SOGo grants, no pending folders */ + private function reconcileRepo(): GroupRepository&MockObject + { + $repo = $this->createMock(GroupRepository::class); + $repo->method('imapGrantsToApply')->willReturn([]); + $repo->method('groupIdsWithSogoGrants')->willReturn([]); + $repo->method('pendingSogoOwners')->willReturn([]); + return $repo; + } + + private function effects(): ChangeEffects&MockObject + { + $effects = $this->createMock(ChangeEffects::class); + $effects->method('apply')->willReturn([]); + return $effects; + } + + private static function grant(int $id, string $owner, string $rights, string $state): array + { + return ['id' => $id, 'group_id' => 7, 'owner' => $owner, 'rights' => $rights, 'state' => $state, 'last_error' => null]; + } +} diff --git a/tests/php/MailboxGroup/Service/TemplateServiceTest.php b/tests/php/MailboxGroup/Service/TemplateServiceTest.php new file mode 100644 index 000000000..921fac29c --- /dev/null +++ b/tests/php/MailboxGroup/Service/TemplateServiceTest.php @@ -0,0 +1,79 @@ +lookup = $this->createMock(LookupRepository::class); + $this->legacy = $this->createMock(LegacyMailbox::class); + $this->lookup->method('mailboxNames')->willReturnCallback(fn(array $u): array => array_fill_keys($u, 'Name')); + } + + private function service(): TemplateService + { + return new TemplateService($this->lookup, $this->legacy); + } + + public function testOnlyChangedTemplatesAreApplied(): void + { + $this->lookup->method('effectiveTemplates')->willReturn([ + 'a@example.org' => 'Staff', // unchanged + 'b@example.org' => 'Admins', // changed + 'c@example.org' => null, // left all groups: settings stay + 'd@example.org' => 'Staff', // joined + ]); + $applied = []; + $this->legacy->method('applyTemplate')->willReturnCallback(function (string $u, string $name, string $t) use (&$applied): ?string { + $applied[] = [$u, $name, $t]; + return ($u === 'd@example.org') ? 'mailbox_quota_exceeded' : null; + }); + + $warnings = $this->service()->applyChanged([ + 'a@example.org' => 'Staff', 'b@example.org' => 'Staff', 'c@example.org' => 'Staff', 'd@example.org' => null, + ]); + + $this->assertSame([['b@example.org', 'Name', 'Admins'], ['d@example.org', 'Name', 'Staff']], $applied); + $this->assertSame([['group_template_failed', 'Staff', 'd@example.org']], $warnings); + } + + public function testLoginPrefersTheGroupTemplate(): void + { + $this->lookup->method('effectiveTemplates')->willReturnCallback(fn(array $u): array => + ($u === ['a@example.org']) ? ['a@example.org' => 'Staff'] : array_fill_keys($u, null)); + + $this->assertSame('Staff', $this->service()->templateForLogin('a@example.org', 'Legacy')); + $this->assertSame('Legacy', $this->service()->templateForLogin('b@example.org', 'Legacy')); + $this->assertNull($this->service()->templateForLogin('b@example.org', null)); + } + + public function testAnEditedTemplateIsAppliedWhereItIsEffective(): void + { + $this->lookup->method('templateName')->with(3)->willReturn('Staff'); + $this->lookup->method('membersWithTemplate')->with(3)->willReturn(['a@example.org', 'b@example.org']); + $this->lookup->method('effectiveTemplates')->willReturn(['a@example.org' => 'Staff', 'b@example.org' => 'Admins']); + $this->legacy->expects($this->once())->method('applyTemplate')->with('a@example.org', 'Name', 'Staff')->willReturn(null); + + $this->assertSame([], $this->service()->onTemplateChanged(3)); + } + + public function testReapplyUsesTheEffectiveTemplates(): void + { + $this->lookup->method('effectiveTemplates')->willReturn(['a@example.org' => 'Staff', 'b@example.org' => null]); + $this->legacy->expects($this->once())->method('applyTemplate')->with('a@example.org', 'Name', 'Staff')->willReturn(null); + + $this->service()->applyTo(['a@example.org', 'b@example.org']); + } +} diff --git a/tests/php/Sogo/Service/SogoServiceTest.php b/tests/php/Sogo/Service/SogoServiceTest.php new file mode 100644 index 000000000..7f840c468 --- /dev/null +++ b/tests/php/Sogo/Service/SogoServiceTest.php @@ -0,0 +1,63 @@ + 'success']); + + $this->assertNull($sogo->subscribe('team@example.org', 'Calendar/personal', ['a@example.org'])); + $this->assertSame('dockerapi did not answer', (new FakeSogo(false))->subscribe('team@example.org', 'Calendar/personal', ['a@example.org'], true)); + $this->assertSame([['cmd' => 'sogo', 'task' => 'subscribe', 'owner' => 'team@example.org', 'folder' => 'Calendar/personal', + 'users' => ['a@example.org'], 'unsubscribe' => false]], $sogo->calls); + } + + public function testFoldersAreCreatedThroughDockerapi(): void + { + $sogo = new FakeSogo(['type' => 'success']); + + $this->assertNull($sogo->initUsers(['team@example.org'])); + $this->assertSame([['cmd' => 'sogo', 'task' => 'init_user', 'users' => ['team@example.org']]], $sogo->calls); + } + + public function testManyChangesRebuildTheWholeView(): void + { + $few = new FakeSogo(true); + $few->refreshStaticView(['a@example.org', 'a@example.org', 'b@example.org']); + $many = new FakeSogo(true); + $many->refreshStaticView(array_map(fn(int $i): string => 'u' . $i . '@example.org', range(1, 26))); + $none = new FakeSogo(true); + $none->refreshStaticView([]); + + $this->assertSame([['view', 'a@example.org'], ['view', 'b@example.org']], $few->calls); + $this->assertSame([['view', null]], $many->calls); + $this->assertSame([], $none->calls); + } +} + +class FakeSogo extends SogoService +{ + public array $calls = []; + + public function __construct(private mixed $result) + { + } + + protected function updateStaticView(?string $username): void + { + $this->calls[] = ['view', $username]; + } + + protected function exec(array $fields): mixed + { + $this->calls[] = $fields; + return is_array($this->result) ? json_encode($this->result) : $this->result; + } +} diff --git a/tests/php/bootstrap.php b/tests/php/bootstrap.php index b5f93e966..1df5e57f4 100644 --- a/tests/php/bootstrap.php +++ b/tests/php/bootstrap.php @@ -6,3 +6,13 @@ declare(strict_types=1); // of data/web/inc/lib/composer.json, exactly as php-fpm does. require __DIR__ . '/../../data/web/inc/lib/vendor/autoload.php'; require __DIR__ . '/vendor/autoload.php'; + +// The php:8.2-cli test image has no intl (php-fpm has); ASCII domains are all the unit tests need +if (!function_exists('idn_to_ascii')) { + define('INTL_IDNA_VARIANT_UTS46', 1); + + function idn_to_ascii(string $domain, int $flags = 0, int $variant = INTL_IDNA_VARIANT_UTS46): string|false + { + return preg_match('/^[\x21-\x7e]*$/', $domain) ? $domain : false; + } +} From 3959e311a03b8eea8c37deb3eb7175e7668369cd Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Tue, 27 Oct 2026 10:20:24 +0100 Subject: [PATCH 3/4] [Web] Add API Documentation for mailbox groups and identity provider sync --- data/web/api/openapi.yaml | 675 +++++++++++++++++++++++++++++++++++++- 1 file changed, 674 insertions(+), 1 deletion(-) diff --git a/data/web/api/openapi.yaml b/data/web/api/openapi.yaml index cdb1dd01c..7e3578a71 100644 --- a/data/web/api/openapi.yaml +++ b/data/web/api/openapi.yaml @@ -1260,9 +1260,123 @@ paths: tls_enforce_out: description: force oubound tmail tls encryption type: boolean + shared: + description: >- + shared mailbox: no login of its own, members of groups open it through shares; + password and password2 may be empty (a random password is set) + type: boolean type: object summary: Create mailbox + /api/v1/add/mailbox-group: + post: + responses: + "401": + $ref: "#/components/responses/Unauthorized" + "200": + content: + application/json: + examples: + response: + value: + - log: + - mailbox_group + - add + - group + - domain: example.org + name: Sales + local_part: sales + members: + - alice@example.org + msg: + - group_added + - Sales + type: success + schema: + properties: + log: + description: contains request object + items: {} + type: array + msg: + items: {} + type: array + type: + enum: + - success + - danger + - warning + - error + type: string + type: object + description: OK + headers: {} + tags: + - Groups + description: >- + Create a mailbox group (admins; domain admins with the "mailbox_groups" + ACL for their domains). With an address the group is a distribution + list; its alias is maintained by the group and read-only in the alias + API. + operationId: Create group + requestBody: + content: + application/json: + schema: + example: + domain: example.org + name: Sales + local_part: sales + members: + - alice@example.org + - bob@example.org + send_as: + - shared@example.org + sender_allowed: "1" + active: "1" + properties: + domain: + description: domain of the group (required) + type: string + name: + description: unique per domain, max. 100 characters + type: string + description: + description: max. 255 characters + type: string + local_part: + description: local part of the group address (domain of the group), empty = no address + type: string + address: + description: full group address instead of local_part, empty = no address + type: string + members: + description: >- + mailboxes (array or list separated by commas, spaces or + newlines); replaces the manual members you may access + type: array + send_as: + description: addresses (mailbox or alias) or @domain the members may send as + type: array + sender_allowed: + description: members may send as the group address + type: boolean + sogo_visible: + description: show the group address as SOGo identity (needs sender_allowed) + type: boolean + internal: + description: only accept mail from senders of the domain + type: boolean + template_id: + description: mailbox template applied to the members (admin only), empty = none + type: number + priority: + description: highest priority wins if a mailbox is in several groups with a template (admin only) + type: number + active: + type: boolean + type: object + summary: Create group /api/v1/add/oauth2-client: post: responses: @@ -2673,6 +2787,103 @@ paths: type: object type: object summary: Delete mailbox + /api/v1/delete/mailbox-group: + post: + responses: + "401": + $ref: "#/components/responses/Unauthorized" + "200": + content: + application/json: + examples: + response: + value: + - log: + - mailbox_group + - delete + - group + - id: + - "7" + msg: + - group_removed + - Sales + type: success + schema: + properties: + log: + description: contains request object + items: {} + type: array + msg: + items: {} + type: array + type: + enum: + - success + - danger + - warning + - error + type: string + type: object + description: OK + headers: {} + tags: + - Groups + description: >- + Delete groups by ID. Members keep their settings; their group alias and + send-as rights of the group are removed. + operationId: Delete groups + requestBody: + content: + application/json: + schema: + example: + - "7" + properties: + items: + description: contains list of group IDs you want to delete + type: object + type: object + summary: Delete groups + /api/v1/delete/identity-link: + post: + responses: + "401": + $ref: "#/components/responses/Unauthorized" + "200": + content: + application/json: + examples: + response: + value: + - log: + - identity_provider + - delete + - link + - - alice@example.org + msg: + - iam_link_removed + - alice@example.org + type: success + description: OK + headers: {} + tags: + - Identity Provider + description: >- + Removes the link between mailboxes and their Identity Provider users (admins only). The mailbox is + linked again by email on the next sync run or login, e.g. after its address was given to another + Identity Provider user. + operationId: Delete identity links + requestBody: + content: + application/json: + schema: + example: + - alice@example.org + items: + type: string + type: array + summary: Delete identity links /api/v1/delete/mailq: post: responses: @@ -4025,6 +4236,9 @@ paths: sogo_access: description: is access to SOGo webmail active or not type: boolean + shared: + description: shared mailbox, no login of its own (IMAP, SMTP, SOGo, app passwords, mailcow UI) + type: boolean type: object items: description: contains list of mailboxes you want update @@ -4111,6 +4325,219 @@ paths: type: object type: object summary: Update mailbox custom attributes + /api/v1/edit/mailbox-group: + post: + responses: + "401": + $ref: "#/components/responses/Unauthorized" + "200": + content: + application/json: + examples: + response: + value: + - log: + - mailbox_group + - edit + - group + - id: + - "7" + add_members: + - carol@example.org + msg: + - group_modified + - Sales + type: success + schema: + properties: + log: + description: contains request object + items: {} + type: array + msg: + items: {} + type: array + type: + enum: + - success + - danger + - warning + - error + type: string + type: object + description: OK + headers: {} + tags: + - Groups + description: >- + Update groups. Attributes you do not send keep their value. Members + synced from the identity provider cannot be removed here + (group_member_idp). + operationId: Update groups + requestBody: + content: + application/json: + schema: + example: + items: + - "7" + attr: + add_members: + - carol@example.org + properties: + attr: + properties: + name: + description: unique per domain, max. 100 characters + type: string + description: + description: max. 255 characters + type: string + local_part: + description: local part of the group address (domain of the group), empty = no address + type: string + address: + description: full group address instead of local_part, empty = no address + type: string + members: + description: >- + mailboxes (array or list separated by commas, spaces or + newlines); replaces the manual members you may access + type: array + send_as: + description: addresses (mailbox or alias) or @domain the members may send as + type: array + sender_allowed: + description: members may send as the group address + type: boolean + sogo_visible: + description: show the group address as SOGo identity (needs sender_allowed) + type: boolean + internal: + description: only accept mail from senders of the domain + type: boolean + template_id: + description: mailbox template applied to the members (admin only), empty = none + type: number + priority: + description: highest priority wins if a mailbox is in several groups with a template (admin only) + type: number + active: + type: boolean + add_members: + description: mailboxes to add + type: array + remove_members: + description: manual members to remove + type: array + reapply_template: + description: apply the effective templates to all members again (admin only) + type: boolean + imap_grants: + description: >- + replaces the mailbox access of the members (Dovecot ACL on every folder of the + mailbox, shown as Shared/); rights read, write or full; you need access + to each mailbox; subscribe = the group-grants cron subscribes the folders for every + member once (within 15 minutes) + type: array + items: + type: object + properties: + owner: + type: string + rights: + type: string + enum: [read, write, full] + subscribe: + type: boolean + default: false + example: + - owner: shared@example.org + rights: write + subscribe: true + sogo_grants: + description: >- + replaces the SOGo folders shared with the members; folder = SOGo folder ID + (default personal); pending until the mailbox opened SOGo once; subscribe = the + group-grants cron subscribes every member once (within 15 minutes) + type: array + items: + type: object + properties: + owner: + type: string + type: + type: string + enum: [Calendar, Contacts] + folder: + type: string + default: personal + access: + type: string + enum: [read, write] + subscribe: + type: boolean + default: false + example: + - owner: shared@example.org + type: Calendar + access: write + subscribe: true + type: object + items: + description: contains list of group IDs you want to update + type: object + type: object + summary: Update groups + /api/v1/edit/identity-provider-sync: + post: + responses: + "401": + $ref: "#/components/responses/Unauthorized" + "200": + content: + application/json: + examples: + response: + value: + - log: + - identity_provider + - edit + - sync + - mode: preview + msg: iam_sync_requested + type: success + description: OK + headers: {} + tags: + - Identity Provider + description: >- + Queues a sync run of the Identity Provider (Keycloak and LDAP, admins only). The identity-sync cron + starts it within a minute. `preview` lists the changes without applying them, `run` applies them, + `force` applies them without the change limit (offboarding_limit). + operationId: Request identity sync run + requestBody: + content: + application/json: + schema: + example: + items: + - sync + attr: + mode: preview + properties: + items: + type: array + default: ["sync"] + attr: + type: object + properties: + mode: + type: string + enum: [preview, run, force] + default: run + type: object + summary: Request identity sync run /api/v1/edit/mailq: post: responses: @@ -5898,6 +6325,203 @@ paths: description: You can list all mailboxes existing in system. operationId: Get mailboxes summary: Get mailboxes + "/api/v1/get/mailbox-group/{id}": + get: + parameters: + - description: id of the group, or "all" (optionally followed by /domain1,domain2) + example: all + in: path + name: id + required: true + schema: + type: string + - description: e.g. api-key-string + example: api-key-string + in: header + name: X-API-Key + required: false + schema: + type: string + responses: + "401": + $ref: "#/components/responses/Unauthorized" + "200": + content: + application/json: + examples: + response: + value: + - id: 7 + domain: example.org + name: Sales + description: Sales team + address: sales@example.org + sender_allowed: 1 + sogo_visible: 0 + internal: 0 + template_id: 3 + template: Staff + priority: 10 + idp_ref: null + members: + - username: alice@example.org + source: manual + - username: bob@example.org + source: idp + send_as: + - shared@example.org + imap_grants: + - owner: shared@example.org + rights: write + subscribe: 1 + state: applied + last_error: null + sogo_grants: + - owner: shared@example.org + type: Calendar + folder: personal + access: write + subscribe: 1 + state: applied + last_error: null + active: 1 + created: "2026-10-25 12:00:00" + modified: null + can_edit: true + description: OK + headers: {} + tags: + - Groups + description: >- + Groups visible to the caller (admins all, domain admins their domains). + operationId: Get groups + summary: Get groups + "/api/v1/get/mailbox-group/member/{username}": + get: + parameters: + - description: mailbox + example: alice@example.org + in: path + name: username + required: true + schema: + type: string + responses: + "401": + $ref: "#/components/responses/Unauthorized" + "200": + content: + application/json: + examples: + response: + value: + groups: + - id: 7 + domain: example.org + name: Sales + address: sales@example.org + sender_allowed: 1 + active: 1 + priority: 10 + template: Staff + source: manual + template: Staff + send_as: + - sales@example.org + - shared@example.org + description: OK + headers: {} + tags: + - Groups + description: >- + Groups of a mailbox, its effective group template and the addresses it + may send as through groups. + operationId: Get group memberships + summary: Get group memberships + /api/v1/get/identity-provider/sync-status: + get: + responses: + "401": + $ref: "#/components/responses/Unauthorized" + "200": + content: + application/json: + examples: + response: + value: + provider: keycloak + can_sync: true + sync_enabled: true + counts: + accounts: 120 + linked: 118 + idp_disabled: 2 + missing: 1 + runs: + - id: 42 + provider: keycloak + mode: run + status: ok + requested_by: "" + created: "2026-10-25 12:00:00" + started: "2026-10-25 12:00:01" + finished: "2026-10-25 12:00:03" + summary: + counts: + creates: 1 + deactivate: 1 + memberships: 2 + details: + creates: + - new@example.org + deactivate: + - left@example.org + conflicts: [] + errors: [] + blocked: false + mode: run + description: OK + headers: {} + tags: + - Identity Provider + description: >- + Sync status (admins only): mailboxes of the Identity Provider and their links, and the last sync runs + with their summary. Run status: pending, running, ok, blocked (change limit), error (listing failed, + nothing was changed). + operationId: Get identity sync status + summary: Get identity sync status + "/api/v1/get/identity-link/{username}": + get: + parameters: + - description: mailbox + example: alice@example.org + in: path + name: username + required: true + schema: + type: string + responses: + "401": + $ref: "#/components/responses/Unauthorized" + "200": + content: + application/json: + examples: + response: + value: + provider: keycloak + external_id: 8d5da28d-7541-428b-8356-a9704f73e7f4 + idp_disabled: 0 + missing_since: null + description: OK + headers: {} + tags: + - Identity Provider + description: >- + Identity Provider user a mailbox is linked to (admins, and domain admins for their mailboxes). + `idp_disabled` = login was disabled by the sync, `missing_since` = not listed by the Identity Provider. + operationId: Get identity link + summary: Get identity link /api/v1/get/mailq/all: get: responses: @@ -7199,7 +7823,7 @@ paths: description: An optional LDAP search filter to refine which users can authenticate. type: string attribute_field: - description: Specifies an LDAP attribute that holds a specific value which can be mapped to a mailbox template using the Attribute Mapping section. Required if `authsource` is ldap. + description: (Optional) Specifies an LDAP attribute that holds a specific value which can be mapped to a mailbox template using the Attribute Mapping section. type: string binddn: description: The Distinguished Name (DN) of the LDAP user that will be used to authenticate and perform LDAP searches. This account should have sufficient permissions to read the required attributes. Required if `authsource` is ldap. @@ -7220,6 +7844,53 @@ paths: description: Specifies the OIDC scopes requested during authentication. type: string default: "openid profile email mailcow_template" + offboarding: + description: (Keycloak, LDAP) Users disabled in the Identity Provider, or missing in two complete sync runs, get login disabled (mailbox active = 2, mail is still received). Only mailboxes disabled by the sync are enabled again. + type: boolean + default: false + offboarding_limit: + description: (Keycloak, LDAP) Sync runs that would disable more mailboxes or remove more group memberships than this share in percent (at least 5) are blocked. + type: number + default: 10 + group_sync: + description: (Keycloak, LDAP) Syncs the members of Identity Provider groups to mailbox groups. Members added in mailcow stay. + type: boolean + default: false + group_autocreate: + description: (Keycloak, LDAP) Creates a mailbox group for every Identity Provider group without one. The group mail becomes its address if it is free. + type: boolean + default: false + group_default_domain: + description: (Keycloak, LDAP) Domain of new groups whose mail is not in a mailcow domain. + type: string + group_paths: + description: (Keycloak) Comma-separated group paths, e.g. `/Sales` or `/mailcow/*` (all groups below /mailcow). Needs the `query-groups` permission. + type: string + id_attribute: + description: (LDAP) Attribute with a stable user id. Empty = objectGUID, entryUUID, nsUniqueId or ipaUniqueID. Changing it links all mailboxes again by email. + type: string + disabled_filter: + description: (LDAP) Filter for disabled users. Active Directory accounts with ACCOUNTDISABLE in userAccountControl are always disabled. + type: string + group_basedn: + description: (LDAP) Base DN of the group search, default `basedn`. + type: string + group_filter: + description: (LDAP) Filter for the synced groups, required for group sync. + type: string + group_name_attribute: + description: (LDAP) Attribute with the group name. + type: string + default: cn + group_member_mode: + description: "(LDAP) Source of the memberships: memberof (memberOf of the users), member (member attribute of the groups) or ad_chain (Active Directory incl. nested groups)." + type: string + enum: [memberof, member, ad_chain] + default: memberof + group_member_attribute: + description: (LDAP) Member attribute for group_member_mode member, e.g. member or uniqueMember. + type: string + default: member examples: keycloak: value: @@ -7320,6 +7991,8 @@ tags: description: Use mailcow as a oAuth server - name: API Keys description: Manage API keys + - name: Groups + description: Mailbox groups (distribution lists, send-as rights, templates) - name: Routing description: Define your own email routes - name: Resources From 15042e592114190f86678ca662c292ce2567cd54 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Tue, 27 Oct 2026 10:21:11 +0100 Subject: [PATCH 4/4] [Web] Add mailbox group and identity provider translations --- data/web/lang/lang.de-de.json | 169 +++++++++++++++++++++++++++++++++- data/web/lang/lang.en-gb.json | 169 +++++++++++++++++++++++++++++++++- 2 files changed, 336 insertions(+), 2 deletions(-) diff --git a/data/web/lang/lang.de-de.json b/data/web/lang/lang.de-de.json index 5f66698e4..e825b5a73 100644 --- a/data/web/lang/lang.de-de.json +++ b/data/web/lang/lang.de-de.json @@ -11,6 +11,7 @@ "extend_sender_acl": "Eingabe externer Absenderadressen erlauben", "filters": "Filter", "login_as": "Einloggen als Mailbox-Benutzer", + "mailbox_groups": "Gruppen", "mailbox_relayhost": "Relayhost für eine Mailbox setzen", "prohibited": "Untersagt durch Richtlinie", "protocol_access": "Ändern der erlaubten Protokolle", @@ -149,6 +150,91 @@ "credentials_transport_warning": "Warnung: Das Hinzufügen einer neuen Regel bewirkt die Aktualisierung der Authentifizierungsdaten aller vorhandenen Einträge mit identischem Next Hop.", "customer_id": "Kunde", "customize": "UI-Anpassung", + "iam_attribute_field_info": "Optional. LDAP-Attribut, dessen Wert in der Zuordnung unten die Vorlage wählt.", + "iam_disabled_filter": "Filter für deaktivierte Benutzer", + "iam_disabled_filter_info": "LDAP-Filter für deaktivierte Benutzer. Active-Directory-Konten mit ACCOUNTDISABLE in userAccountControl gelten immer als deaktiviert.", + "iam_encryption": "Verschlüsselung", + "iam_encryption_info": "StartTLS nutzt den normalen Port (389). SSL (LDAPS) nutzt Port 636, Port 389 wird automatisch umgestellt.", + "iam_encryption_none": "Keine", + "iam_filter_info": "LDAP-Filter für die Benutzer, die sich anmelden dürfen und synchronisiert werden, z. B. (objectClass=person).", + "iam_group_autocreate": "Gruppen anlegen", + "iam_group_autocreate_info": "Legt für jede IdP-Gruppe ohne Gegenstück eine Gruppe an. Die Mail-Adresse der Gruppe wird ihre Adresse, wenn sie frei ist.", + "iam_group_basedn": "Gruppen-Base-DN", + "iam_group_default_domain": "Standard-Domain für Gruppen", + "iam_group_default_domain_info": "Domain neuer Gruppen, deren Mail-Adresse in keiner mailcow-Domain liegt.", + "iam_group_filter": "Gruppenfilter", + "iam_group_member_attribute": "Mitglieder-Attribut", + "iam_group_member_attribute_info": "Nur für \"Mitglieder-Attribut der Gruppen\", z. B. member oder uniqueMember.", + "iam_group_member_mode": "Mitgliedschaften", + "iam_group_member_mode_ad_chain": "Active Directory inkl. verschachtelter Gruppen", + "iam_group_member_mode_member": "Mitglieder-Attribut der Gruppen", + "iam_group_member_mode_memberof": "memberOf der Benutzer", + "iam_group_name_attribute": "Attribut für Gruppennamen", + "iam_group_paths": "Gruppenpfade", + "iam_group_paths_info": "Kommagetrennte Keycloak-Gruppenpfade: /Vertrieb oder /mailcow/* für alle Gruppen unter /mailcow. Der mailcow-Client braucht die Berechtigung query-groups.", + "iam_group_sync": "Gruppen-Sync", + "iam_group_sync_info": "Überträgt die Mitglieder von IdP-Gruppen in Gruppen (Mailboxen → Gruppen). In mailcow hinzugefügte Mitglieder bleiben.", + "iam_id_attribute": "ID-Attribut", + "iam_id_attribute_info": "Stabile Benutzer-ID. Leer = objectGUID, entryUUID, nsUniqueId oder ipaUniqueID. Eine Änderung verknüpft alle Mailboxen erneut über die E-Mail-Adresse.", + "iam_import_users_info": "Legt Postfächer für alle IdP-Benutzer mit passender Vorlage an, ohne auf ihre erste Anmeldung zu warten.", + "iam_login_provisioning_info": "Legt das Postfach bei der ersten Anmeldung an, mit passender Vorlage oder der Standard-Vorlage.", + "iam_mapping_add": "Zuordnung hinzufügen", + "iam_mapping_info": "Der Attributwert eines Benutzers wählt die Vorlage (Keycloak und OIDC: mailcow_template). Vorlagen von Gruppen haben Vorrang.", + "iam_offboarding": "Offboarding", + "iam_offboarding_info": "Benutzer, die im IdP deaktiviert sind oder in zwei vollständigen Sync-Läufen fehlen, können sich nicht mehr anmelden. Ihre Mailbox empfängt weiter E-Mails. Nur vom Sync gesperrte Mailboxen werden wieder freigegeben.", + "iam_offboarding_limit": "Änderungslimit (%)", + "iam_offboarding_limit_info": "Sync-Läufe, die mehr Mailboxen sperren oder mehr Gruppenmitgliedschaften entfernen würden als dieser Anteil (mindestens 5), werden blockiert.", + "iam_periodic_full_sync_info": "Übernimmt Name und Vorlage bestehender Postfächer aus dem IdP.", + "iam_redirect_url_add": "Redirect-URL hinzufügen", + "iam_section_connection": "Verbindung", + "iam_section_groups": "Gruppen", + "iam_section_login": "Anmeldung", + "iam_section_sync": "Synchronisation", + "iam_section_templates": "Postfach-Vorlagen", + "iam_section_users": "Benutzer", + "iam_sync_accounts": "IdP-Mailboxen", + "iam_sync_changes": "Änderungen", + "iam_sync_count_conflicts": "Konflikte", + "iam_sync_count_creates": "Angelegt", + "iam_sync_count_deactivate": "Login gesperrt", + "iam_sync_count_errors": "Fehler", + "iam_sync_count_found": "Wieder gefunden", + "iam_sync_count_group_creates": "Gruppen angelegt", + "iam_sync_count_group_renames": "Gruppen umbenannt", + "iam_sync_count_links": "Verknüpft", + "iam_sync_count_membership_removals": "Mitgliedschaften entfernt", + "iam_sync_count_memberships": "Gruppen mit neuen Mitgliedern", + "iam_sync_count_missing": "Fehlend", + "iam_sync_count_orphaned_groups": "Gruppen nicht im IdP", + "iam_sync_count_release": "Freigegeben", + "iam_sync_count_restore": "Login entsperrt", + "iam_sync_count_skipped": "Übersprungen", + "iam_sync_count_updates": "Aktualisiert", + "iam_sync_details": "Details", + "iam_sync_force": "Ohne Limit ausführen", + "iam_sync_force_confirm": "Sync ohne Änderungslimit ausführen? Dabei können Mailboxen gesperrt und Gruppenmitgliedschaften entfernt werden.", + "iam_sync_idp_disabled": "Vom IdP gesperrt", + "iam_sync_linked": "Verknüpft", + "iam_sync_missing": "Fehlen im IdP", + "iam_sync_mode": "Modus", + "iam_sync_mode_force": "Ohne Limit", + "iam_sync_mode_preview": "Vorschau", + "iam_sync_mode_run": "Lauf", + "iam_sync_no_changes": "Keine Änderungen", + "iam_sync_none": "Noch keine Sync-Läufe.", + "iam_sync_off": "Der Sync ist aus. Aktiviere Import, periodischen Sync, Offboarding oder Gruppen-Sync.", + "iam_sync_preview": "Vorschau", + "iam_sync_result": "Ergebnis", + "iam_sync_run": "Jetzt ausführen", + "iam_sync_started": "Gestartet", + "iam_sync_status": "Sync-Status", + "iam_sync_status_blocked": "Blockiert", + "iam_sync_status_error": "Fehler", + "iam_sync_status_info": "Läufe starten innerhalb einer Minute. Eine Vorschau zeigt die Änderungen, ohne sie auszuführen.", + "iam_sync_status_ok": "OK", + "iam_sync_status_pending": "Wartet", + "iam_sync_status_running": "Läuft", + "iam_username_field_info": "Attribut mit der E-Mail-Adresse, sie wird zum Postfachnamen. Standard: mail.", "login_page": "Login-Seite", "description": "Beschreibung", "destination": "Ziel", @@ -217,7 +303,7 @@ "iam_default_template": "Standardvorlage", "iam_default_template_description": "Falls für einen Benutzer kein Template hinterlegt ist, wird die Standardvorlage zum Erstellen der Mailbox verwendet, jedoch nicht zum Aktualisieren der Mailbox.", "iam_description": "Konfiguriere einen externen Identity Provider für die Authentifizierung
    Die Mailboxen der Benutzer werden bei ihrer ersten Anmeldung automatisch erstellt, vorausgesetzt, dass ein Attribut Mapping festgelegt wurde.", - "iam_extra_permission": "Damit die folgenden Einstellungen funktionieren, benötigt der mailcow Client in Keycloak ein Service-Konto und die Berechtigung view-users.", + "iam_extra_permission": "Damit die folgenden Einstellungen funktionieren, benötigt der mailcow Client in Keycloak ein Service-Konto und die Berechtigung view-users (Gruppen-Sync: zusätzlich query-groups).", "iam_host": "Host", "iam_host_info": "Gib einen oder mehrere LDAP-Hosts ein, getrennt durch Kommas.", "iam_import_users": "Importiere Benutzer", @@ -420,6 +506,7 @@ "alias_domain_invalid": "Alias-Domain %s ist ungültig", "alias_empty": "Alias-Adresse darf nicht leer sein", "alias_goto_identical": "Alias- und Ziel-Adresse dürfen nicht identisch sein", + "alias_group_managed": "Alias %s gehört zu einer Gruppe und kann nur dort geändert werden", "alias_invalid": "Alias-Adresse %s ist ungültig", "aliasd_targetd_identical": "Alias-Domain darf nicht gleich Ziel-Domain sein: %s", "aliases_in_use": "Maximale Anzahl an Aliassen muss größer oder gleich %d sein", @@ -461,7 +548,17 @@ "global_map_write_error": "Kann globale Map ID %s nicht schreiben: %s", "goto_empty": "Eine Alias-Adresse muss auf mindestens eine gültige Ziel-Adresse zeigen", "goto_invalid": "Ziel-Adresse %s ist ungültig", + "group_address_invalid": "Gruppenadresse %s ist ungültig oder liegt nicht in der Domain der Gruppe", + "group_description_invalid": "Die Beschreibung der Gruppe darf höchstens 255 Zeichen lang sein", + "group_grant_invalid": "Ungültige Freigabe für Mailbox %s", + "group_member_idp": "%s ist über den Identity Provider Mitglied und kann nur dort entfernt werden", + "group_member_invalid": "%s ist kein Postfach und kann nicht Mitglied einer Gruppe werden", + "group_name_invalid": "Der Gruppenname ist ungültig (1-100 Zeichen)", + "group_priority_invalid": "Die Priorität muss eine Zahl sein", + "group_send_as_invalid": "Send-as-Adresse %s ist ungültig oder unbekannt", "ham_learn_error": "Ham-Lernfehler: %s", + "iam_sync_mode_invalid": "Ungültiger Sync-Modus", + "iam_sync_unavailable": "Der Identity Provider kann nicht synchronisiert werden (nur Keycloak und LDAP)", "iam_test_connection": "Verbindung fehlgeschlagen", "imagick_exception": "Fataler Bildverarbeitungsfehler", "img_dimensions_exceeded": "Grafik überschreitet die maximale Bildgröße", @@ -523,6 +620,7 @@ "recipient_map_entry_exists": "Eine Empfängerumschreibung für Objekt \"%s\" existiert bereits", "recovery_email_failed": "E-Mail zur Wiederherstellung konnte nicht gesendet werden. Bitte wenden Sie sich an Ihren Administrator.", "redis_error": "Redis Fehler: %s", + "refresh_login_failed": "Die Sitzung konnte nicht verlängert werden. Bitte melden Sie sich erneut an.", "relayhost_invalid": "Map-Eintrag %s ist ungültig", "release_send_failed": "Die Nachricht konnte nicht versendet werden: %s", "reset_f2b_regex": "Regex-Filter konnten nicht in vorgegebener Zeit zurückgesetzt werden, bitte erneut versuchen oder die Webseite neu laden.", @@ -720,6 +818,12 @@ "generate": "generieren", "grant_types": "Grant-types", "hostname": "Servername", + "iam_idp_disabled": "Login vom IdP-Sync gesperrt", + "iam_link": "IdP-Verknüpfung", + "iam_link_info": "Die Mailbox gehört zu diesem IdP-Benutzer. Löse die Verknüpfung, wenn die Adresse an einen anderen IdP-Benutzer vergeben wurde; sie wird dann erneut über die E-Mail-Adresse verknüpft.", + "iam_missing_since": "Fehlt im IdP seit", + "iam_not_linked": "Noch nicht verknüpft", + "iam_unlink": "Verknüpfung lösen", "inactive": "Inaktiv", "internal": "Intern", "internal_info": "Interne Aliasse sind nur von der eigenen Domäne oder Alias-Domänen erreichbar.", @@ -837,6 +941,57 @@ "restarting_container": "Container wird neugestartet, bitte warten...", "hibp_check": "Gegen haveibeenpwned.com prüfen" }, + "groups": { + "active": "Aktiv", + "add": "Gruppe hinzufügen", + "address": "Gruppenadresse", + "address_hint": "Optional. Mails an diese Adresse gehen an alle Mitglieder.", + "description": "Beschreibung", + "domain": "Domain", + "effective_template": "Template aus Gruppen", + "grant_add": "Hinzufügen", + "grant_folder": "Ordner-ID in SOGo, personal = Standardordner", + "grant_owner": "Mailbox", + "grant_state_applied": "Aktiv", + "grant_state_failed": "Fehlgeschlagen", + "grant_state_pending": "Ausstehend", + "grant_subscribe": "Abonnieren", + "grant_subscribe_imap_hint": "Abonniert die Ordner der Mailbox innerhalb einer Minute bei jedem Mitglied, damit Mailprogramme sie anzeigen. Einmalig: Wer sie abbestellt, behält das so", + "grant_subscribe_sogo_hint": "Fügt den Ordner innerhalb einer Minute bei jedem Mitglied in SOGo hinzu, einmalig: Wer ihn entfernt, bekommt ihn nicht erneut", + "group": "Gruppe", + "groups": "Gruppen", + "idp": "IdP", + "idp_member": "Vom Identity Provider synchronisiert, nur dort änderbar", + "idp_ref": "IdP-Gruppe", + "imap_grants": "Postfachzugriff", + "imap_grants_hint": "Mitglieder öffnen diese Mailboxen in ihrem Mailprogramm (Ordner Shared/). Lesen: lesen und als gelesen markieren. Schreiben: zusätzlich ablegen, verschieben und löschen. Vollzugriff: zusätzlich Ordner löschen. Team-Postfächer ohne eigenen Login als geteiltes Postfach markieren.", + "info": "Gruppen bündeln Postfächer. Eine Gruppe kann eine eigene Adresse haben: ein Alias, der automatisch an alle Mitglieder zustellt (in Exchange: Verteilerliste). Mitglieder können als andere Adressen senden, auf freigegebene Postfächer, Kalender und Adressbücher zugreifen und ein Postfach-Template erhalten. Vom Identity Provider synchronisierte Mitglieder sind mit IdP markiert.", + "internal": "Nur Mails von Absendern der Domain annehmen", + "list_error": "Gruppen konnten nicht geladen werden", + "managed_alias": "Wird von Gruppe %s verwaltet", + "members": "Mitglieder", + "memberships": "Gruppenmitgliedschaften", + "name": "Name", + "no_memberships": "In keiner Gruppe", + "priority": "Priorität", + "reapply_template": "Template erneut auf alle Mitglieder anwenden", + "rights_full": "Vollzugriff", + "rights_read": "Lesen", + "rights_write": "Schreiben", + "send_as": "Senden als", + "send_as_groups": "Darf senden als (über Gruppen)", + "send_as_hint": "Adressen (Postfach oder Alias) oder @domain, als die die Mitglieder senden dürfen, eine pro Zeile.", + "sender_allowed": "Mitglieder dürfen als Gruppenadresse senden", + "sogo_grants": "Kalender und Adressbücher", + "sogo_grants_hint": "Mitglieder erhalten Zugriff auf den SOGo-Ordner der Mailbox. Mit \"Abonnieren\" erscheint er automatisch in ihrem SOGo, sonst abonnieren sie ihn selbst. Ausstehend: Die Mailbox hat SOGo noch nicht geöffnet.", + "sogo_visible": "Gruppenadresse in SOGo als Identität anzeigen", + "template": "Mailbox-Template", + "template_hint": "Wird auf alle Mitglieder angewendet. Ist ein Postfach in mehreren Gruppen, gilt das Template der Gruppe mit der höchsten Priorität.", + "template_none": "Kein Template", + "type_calendar": "Kalender", + "type_contacts": "Adressbuch", + "view": "Ansehen" + }, "header": { "administration": "Server-Konfiguration", "apps": "Apps", @@ -998,6 +1153,8 @@ "running": "In Ausführung", "set_postfilter": "Als Postfilter markieren", "set_prefilter": "Als Prefilter markieren", + "shared_mailbox": "Geteiltes Postfach", + "shared_mailbox_info": "Kein eigener Login (IMAP, SMTP, SOGo, ActiveSync, App-Passwörter, mailcow-UI). Es empfängt Mails, Gruppenmitglieder öffnen es über Freigaben. Kein Passwort nötig.", "sieve_info": "Es können mehrere Filter pro Benutzer existieren, aber nur ein Filter eines Typs (Pre-/Postfilter) kann gleichzeitig aktiv sein.
    \r\nDie Ausführung erfolgt in nachstehender Reihenfolge. Ein fehlgeschlagenes Script sowie der Befehl \"keep;\" stoppen die weitere Verarbeitung nicht. Änderungen an globalen Sieve-Filtern bewirken einen Neustart von Dovecot.

    Global sieve prefilter • Prefilter • User scripts • Postfilter • Global sieve postfilter", "sieve_preset_1": "E-Mails mit potenziell gefährlichen Dateitypen abweisen", "sieve_preset_2": "E-Mail eines bestimmten Absenders immer als gelesen markieren", @@ -1173,7 +1330,12 @@ "forwarding_host_added": "Weiterleitungs-Host %s wurde hinzugefügt", "forwarding_host_removed": "Weiterleitungs-Host %s wurde entfernt", "global_filter_written": "Filterdatei wurde erfolgreich geschrieben", + "group_added": "Gruppe %s wurde hinzugefügt", + "group_modified": "Änderungen an Gruppe %s wurden gespeichert", + "group_removed": "Gruppe %s wurde entfernt", "hash_deleted": "Hash wurde gelöscht", + "iam_link_removed": "IdP-Verknüpfung von %s gelöst", + "iam_sync_requested": "Sync-Lauf eingereiht, er startet innerhalb einer Minute", "iam_test_connection": "Verbindung erfolgreich", "ip_check_opt_in_modified": "IP Check wurde erfolgreich gespeichert", "item_deleted": "Objekt %s wurde entfernt", @@ -1554,6 +1716,11 @@ "domain_added_sogo_failed": "Domain wurde hinzugefügt, aber SOGo konnte nicht neugestartet werden", "dovecot_restart_failed": "Dovecot wurde nicht erfolgreich neu gestartet, bitte prüfen Sie die Logs.", "fuzzy_learn_error": "Fuzzy-Lernfehler: %s", + "group_imap_grant_failed": "Der Postfachzugriff auf %s konnte in Dovecot noch nicht gesetzt werden, er wird alle 15 Minuten erneut versucht", + "group_sogo_init_failed": "Die SOGo-Ordner von %s konnten noch nicht angelegt werden, es wird alle 15 Minuten erneut versucht", + "group_subscription_failed": "Abonnement für %s fehlgeschlagen, es wird automatisch erneut versucht", + "group_template_failed": "Template %s konnte nicht auf %s angewendet werden", + "group_too_many_members": "Gruppe %s hat mehr als %s Mitglieder. Postfix stellt Mails an eine Adresse höchstens an so viele Empfänger zu.", "hash_not_found": "Hash nicht gefunden. Möglicherweise wurde dieser bereits gelöscht.", "ip_invalid": "Ungültige IP übersprungen: %s", "is_not_primary_alias": "Überspringe nicht-primären Alias %s", diff --git a/data/web/lang/lang.en-gb.json b/data/web/lang/lang.en-gb.json index d51a9e304..bf023df75 100644 --- a/data/web/lang/lang.en-gb.json +++ b/data/web/lang/lang.en-gb.json @@ -11,6 +11,7 @@ "extend_sender_acl": "Allow to extend sender ACL by external addresses", "filters": "Filters", "login_as": "Login as mailbox user", + "mailbox_groups": "Groups", "mailbox_relayhost": "Change relayhost for a mailbox", "prohibited": "Prohibited by ACL", "protocol_access": "Change protocol access", @@ -146,6 +147,91 @@ "ays": "Are you sure you want to proceed?", "ban_list_info": "See a list of banned IPs below: network (remaining ban time) - [actions].
    IPs queued to be unbanned will be removed from the active ban list within a few seconds.
    Red labels indicate active permanent bans by denylisting.", "change_logo": "Change logo", + "iam_attribute_field_info": "Optional. LDAP attribute whose value selects the template in the mapping below.", + "iam_disabled_filter": "Disabled filter", + "iam_disabled_filter_info": "LDAP filter for disabled users. Active Directory accounts with ACCOUNTDISABLE in userAccountControl always count as disabled.", + "iam_encryption": "Encryption", + "iam_encryption_info": "StartTLS uses the normal port (389). SSL (LDAPS) uses port 636, port 389 is changed automatically.", + "iam_encryption_none": "None", + "iam_filter_info": "LDAP filter for the users that may log in and are synced, e.g. (objectClass=person).", + "iam_group_autocreate": "Create groups", + "iam_group_autocreate_info": "Creates a mailbox group for every IdP group that has none yet. The group mail becomes its address if it is free.", + "iam_group_basedn": "Group Base DN", + "iam_group_default_domain": "Default group domain", + "iam_group_default_domain_info": "Domain of new groups whose mail is not in a mailcow domain.", + "iam_group_filter": "Group filter", + "iam_group_member_attribute": "Member attribute", + "iam_group_member_attribute_info": "Only for \"Member attribute of the groups\", e.g. member or uniqueMember.", + "iam_group_member_mode": "Memberships", + "iam_group_member_mode_ad_chain": "Active Directory incl. nested groups", + "iam_group_member_mode_member": "Member attribute of the groups", + "iam_group_member_mode_memberof": "memberOf of the users", + "iam_group_name_attribute": "Group name attribute", + "iam_group_paths": "Group paths", + "iam_group_paths_info": "Comma-separated Keycloak group paths: /Sales or /mailcow/* for all groups below /mailcow. The mailcow client needs the query-groups permission.", + "iam_group_sync": "Group sync", + "iam_group_sync_info": "Syncs the members of IdP groups to mailbox groups (Mailboxes → Groups). Members added in mailcow stay.", + "iam_id_attribute": "ID attribute", + "iam_id_attribute_info": "Stable user ID. Empty = objectGUID, entryUUID, nsUniqueId or ipaUniqueID. Changing it links all mailboxes again by email.", + "iam_import_users_info": "Creates mailboxes for all users of the IdP with a matching template, without waiting for their first login.", + "iam_login_provisioning_info": "Creates the mailbox at the first login of a user, with a matching or the default template.", + "iam_mapping_add": "Add mapping", + "iam_mapping_info": "The attribute value of a user selects the template (Keycloak and OIDC: mailcow_template). Templates of groups take precedence.", + "iam_offboarding": "Offboarding", + "iam_offboarding_info": "Users disabled in the IdP or missing in two complete sync runs cannot log in anymore. Their mailbox still receives mail. Only mailboxes disabled by the sync are enabled again.", + "iam_offboarding_limit": "Change limit (%)", + "iam_offboarding_limit_info": "Sync runs that would disable more mailboxes or remove more group memberships than this share (at least 5) are blocked.", + "iam_periodic_full_sync_info": "Updates name and template of existing mailboxes from the IdP.", + "iam_redirect_url_add": "Add redirect URL", + "iam_section_connection": "Connection", + "iam_section_groups": "Groups", + "iam_section_login": "Login", + "iam_section_sync": "Synchronization", + "iam_section_templates": "Mailbox templates", + "iam_section_users": "Users", + "iam_sync_accounts": "IdP mailboxes", + "iam_sync_changes": "Changes", + "iam_sync_count_conflicts": "Conflicts", + "iam_sync_count_creates": "Created", + "iam_sync_count_deactivate": "Login disabled", + "iam_sync_count_errors": "Errors", + "iam_sync_count_found": "Found again", + "iam_sync_count_group_creates": "Groups created", + "iam_sync_count_group_renames": "Groups renamed", + "iam_sync_count_links": "Linked", + "iam_sync_count_membership_removals": "Memberships removed", + "iam_sync_count_memberships": "Groups with new members", + "iam_sync_count_missing": "Missing", + "iam_sync_count_orphaned_groups": "Groups not in IdP", + "iam_sync_count_release": "Released", + "iam_sync_count_restore": "Login enabled", + "iam_sync_count_skipped": "Skipped", + "iam_sync_count_updates": "Updated", + "iam_sync_details": "Details", + "iam_sync_force": "Run without limit", + "iam_sync_force_confirm": "Run the sync without the change limit? Mailboxes may be disabled and group memberships removed.", + "iam_sync_idp_disabled": "Disabled by IdP", + "iam_sync_linked": "Linked", + "iam_sync_missing": "Missing in IdP", + "iam_sync_mode": "Mode", + "iam_sync_mode_force": "Without limit", + "iam_sync_mode_preview": "Preview", + "iam_sync_mode_run": "Run", + "iam_sync_no_changes": "No changes", + "iam_sync_none": "No sync runs yet.", + "iam_sync_off": "The sync is off. Enable import, periodic sync, offboarding or group sync.", + "iam_sync_preview": "Preview", + "iam_sync_result": "Result", + "iam_sync_run": "Run now", + "iam_sync_started": "Started", + "iam_sync_status": "Sync status", + "iam_sync_status_blocked": "Blocked", + "iam_sync_status_error": "Error", + "iam_sync_status_info": "Runs start within a minute. A preview shows the changes without applying them.", + "iam_sync_status_ok": "OK", + "iam_sync_status_pending": "Queued", + "iam_sync_status_running": "Running", + "iam_username_field_info": "Attribute with the email address, it becomes the mailbox name. Default: mail.", "logo_normal_label": "Normal", "logo_dark_label": "Inverted for dark mode", "configuration": "Configuration", @@ -224,7 +310,7 @@ "iam_default_template": "Default Template", "iam_default_template_description": "If no template is assigned to a user, the default template will be used for creating the mailbox, but not for updating the mailbox.", "iam_description": "Configure an external Provider for Authentication
    User's mailboxes will be automatically created upon their first login, provided that an attribute mapping has been set.", - "iam_extra_permission": "For the following settings to work, the mailcow client in Keycloak needs a Service account and the permission to view-users.", + "iam_extra_permission": "For the following settings to work, the mailcow client in Keycloak needs a Service account and the permission to view-users (group sync: also query-groups).", "iam_host": "Host", "iam_host_info": "Enter one or more LDAP hosts, separated by commas.", "iam_import_users": "Import Users", @@ -417,10 +503,21 @@ }, "danger": { "access_denied": "Access denied or invalid form data", + "alias_group_managed": "Alias %s belongs to a group and can only be changed there", "api_key_access_invalid": "Invalid API access type, allowed values are ro and rw", "api_key_description_invalid": "API key description must not exceed 255 characters", "api_key_network_invalid": "Invalid IP address or network: %s", "api_key_service_locked": "API key %s is defined in mailcow.conf and can only be changed there", + "group_address_invalid": "Group address %s is invalid or not in the domain of the group", + "group_description_invalid": "The group description must not exceed 255 characters", + "group_grant_invalid": "Invalid share for mailbox %s", + "group_member_idp": "%s is a member through the identity provider and can only be removed there", + "group_member_invalid": "%s is not a mailbox and cannot be a group member", + "group_name_invalid": "Group name is invalid (1-100 characters)", + "group_priority_invalid": "The priority must be a number", + "group_send_as_invalid": "Send-as address %s is invalid or unknown", + "iam_sync_mode_invalid": "Invalid sync mode", + "iam_sync_unavailable": "The identity provider cannot be synced (Keycloak and LDAP only)", "tfa_removal_blocked": "Two-factor authentication cannot be removed because it is required for your account.", "alias_domain_invalid": "Alias domain %s is invalid", "alias_empty": "Alias address must not be empty", @@ -524,6 +621,7 @@ "recipient_map_entry_exists": "A Recipient map entry \"%s\" exists", "recovery_email_failed": "Could not send a recovery email. Please contact your administrator.", "redis_error": "Redis error: %s", + "refresh_login_failed": "The session could not be refreshed. Please log in again.", "relayhost_invalid": "Map entry %s is invalid", "release_send_failed": "Message could not be released: %s", "required_data_missing": "Required data %s is missing", @@ -720,6 +818,12 @@ "generate": "generate", "grant_types": "Grant types", "hostname": "Hostname", + "iam_idp_disabled": "Login disabled by the IdP sync", + "iam_link": "IdP link", + "iam_link_info": "The mailbox is bound to this IdP user. Unlink it when the address was given to another IdP user; it is linked again by email.", + "iam_missing_since": "Missing in the IdP since", + "iam_not_linked": "Not linked yet", + "iam_unlink": "Unlink", "inactive": "Inactive", "internal": "Internal", "internal_info": "Internal aliases are only accessible from the own domain or alias domains.", @@ -837,6 +941,57 @@ "restart_now": "Restart now", "restarting_container": "Restarting container, this may take a while" }, + "groups": { + "active": "Active", + "add": "Add group", + "address": "Group address", + "address_hint": "Optional. Mail to this address is delivered to all members.", + "description": "Description", + "domain": "Domain", + "effective_template": "Template from groups", + "grant_add": "Add", + "grant_folder": "Folder ID in SOGo, personal = default folder", + "grant_owner": "Mailbox", + "grant_state_applied": "Active", + "grant_state_failed": "Failed", + "grant_state_pending": "Pending", + "grant_subscribe": "Subscribe", + "grant_subscribe_imap_hint": "Subscribes the folders of the mailbox for every member within a minute, so mail clients show them. Once: a member who unsubscribes keeps it that way", + "grant_subscribe_sogo_hint": "Adds the folder to the SOGo of every member within a minute, once: a member who removes it keeps it removed", + "group": "Group", + "groups": "Groups", + "idp": "IdP", + "idp_member": "Synced from the identity provider, can only be changed there", + "idp_ref": "IdP group", + "imap_grants": "Mailbox access", + "imap_grants_hint": "Members open these mailboxes in their mail client (folder Shared/). Read: read and mark as read. Write: also file, move and delete mails. Full access: also delete folders. For team mailboxes without a login of their own, mark the mailbox as shared mailbox.", + "info": "Groups bundle mailboxes. A group can have its own address: an alias that delivers to all members automatically (in Exchange: distribution list). Members can send as other addresses, access shared mailboxes, calendars and address books and get a mailbox template. Members synced from the identity provider are marked IdP.", + "internal": "Only accept mail from senders of the domain", + "list_error": "Groups could not be loaded", + "managed_alias": "Managed by group %s", + "members": "Members", + "memberships": "Group memberships", + "name": "Name", + "no_memberships": "Not a member of any group", + "priority": "Priority", + "reapply_template": "Apply the template to all members again", + "rights_full": "Full access", + "rights_read": "Read", + "rights_write": "Write", + "send_as": "Send as", + "send_as_groups": "May send as (through groups)", + "send_as_hint": "Addresses (mailbox or alias) or @domain the members may send as, one per line.", + "sender_allowed": "Members may send as the group address", + "sogo_grants": "Calendars and address books", + "sogo_grants_hint": "Members get access to the SOGo folder of the mailbox. With \"Subscribe\" it appears in their SOGo automatically, otherwise they subscribe to it themselves. Pending: the mailbox has not opened SOGo yet.", + "sogo_visible": "Show the group address as identity in SOGo", + "template": "Mailbox template", + "template_hint": "Applied to all members. A mailbox in several groups gets the template of the group with the highest priority.", + "template_none": "No template", + "type_calendar": "Calendar", + "type_contacts": "Address book", + "view": "View" + }, "header": { "administration": "Configuration & Details", "apps": "Apps", @@ -1007,6 +1162,8 @@ "sender": "Sender", "set_postfilter": "Mark as postfilter", "set_prefilter": "Mark as prefilter", + "shared_mailbox": "Shared mailbox", + "shared_mailbox_info": "No login of its own (IMAP, SMTP, SOGo, ActiveSync, app passwords, mailcow UI). It receives mail, members of groups open it through shares. No password needed.", "sieve_info": "You can store multiple filters per user, but only one prefilter and one postfilter can be active at the same time.
    \r\nEach filter will be processed in the described order. Neither a failed script nor an issued \"keep;\" will stop processing of further scripts. Changes to global sieve scripts will trigger a restart of Dovecot.

    Global sieve prefilter • Prefilter • User scripts • Postfilter • Global sieve postfilter", "sieve_preset_1": "Discard mail with probable dangerous file types", "sieve_preset_2": "Always mark the e-mail of a specific sender as seen", @@ -1180,7 +1337,12 @@ "forwarding_host_added": "Forwarding host %s has been added", "forwarding_host_removed": "Forwarding host %s has been removed", "global_filter_written": "Filter was successfully written to file", + "group_added": "Group %s has been added", + "group_modified": "Changes to group %s have been saved", + "group_removed": "Group %s has been removed", "hash_deleted": "Hash deleted", + "iam_link_removed": "IdP link of %s removed", + "iam_sync_requested": "Sync run queued, it starts within a minute", "iam_test_connection": "Connection successful", "ip_check_opt_in_modified": "IP check was saved successfully", "item_deleted": "Item %s successfully deleted", @@ -1561,6 +1723,11 @@ "domain_added_sogo_failed": "Added domain but failed to restart SOGo, please check your server logs.", "dovecot_restart_failed": "Dovecot failed to restart, please check the logs", "fuzzy_learn_error": "Fuzzy hash learn error: %s", + "group_imap_grant_failed": "Mailbox access to %s could not be set in Dovecot yet, it is retried every 15 minutes", + "group_sogo_init_failed": "The SOGo folders of %s could not be created yet, it is retried every 15 minutes", + "group_subscription_failed": "Subscription for %s failed, it is retried automatically", + "group_template_failed": "Template %s could not be applied to %s", + "group_too_many_members": "Group %s has more than %s members. Postfix delivers mail to an address to at most that many recipients.", "hash_not_found": "Hash not found or already deleted", "ip_invalid": "Skipped invalid IP: %s", "is_not_primary_alias": "Skipped non-primary alias %s",