- Raise password maximum length from 32 to 256 characters
- fix profileSchema to accept `t` for proper internationalization
- Invalidate user's WebUI token on password change, requiring re-login
- Add GET /envelope/{account_id}/{message_id} endpoint to retrieve message envelope (metadata)
- Add get_envelope_by_id method to ENVELOPE_INDEX_MANAGER for querying single envelope
- Move message_id from query parameter to path parameter for clearer API paths:
- /message-content/{account_id}/{message_id}
- /download-message/{account_id}/{message_id}
- /download-attachment/{account_id}/{message_id}
- /envelope/{account_id}/{message_id}
- Fix API documentation descriptions to be more accurate:
- search_messages: Now correctly describes search functionality
- get_thread_messages: Mentions thread_id requirement
- proxy endpoints: Fixed copy-paste errors from OAuth2 docs
- Update frontend API client to use new path-based URLs
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Fix Path import in message.rs, account.rs, mailbox.rs, oauth2.rs,
and auto_config.rs to use poem_openapi::param::Path instead of
poem::web::Path
- This ensures path parameters appear in OpenAPI/Swagger documentation
- Update frontend API calls to use message_id parameter
- Add parameter documentation comments for better API clarity
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Rename the `id` query parameter to `message_id` in three message API
endpoints for better API clarity and consistency:
- GET /api/v1/message-content/:account_id
- GET /api/v1/download-message/:account_id
- GET /api/v1/download-attachment/:account_id
This is a breaking change for API clients that use these endpoints.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Changed behavior so that when BICHON_CORS_ORIGINS is not configured, CORS now allows any origin.
- Added debug logging to print incoming Origin and configured origins to help users diagnose CORS misconfiguration issues.
Refactor account authentication logic to prioritize the `name` field over the `email` field during the IMAP connection phase.
- The `name` field now serves as the primary IMAP login credential and is no longer treated purely as an optional, descriptive field.
- If the `name` field is empty or unset, the system will fall back to using the full `email` address for authentication.
- This change supports IMAP providers that require a username different from the full email address (e.g., employee ID, specific account name).
Modified the meaning of "disabled" accounts: they no longer connect to the IMAP server for syncing, but existing data remains accessible for search and queries.
Lukas Krejci