ysk-server-core 1.0.0

package/dist/email/domain-flags-apply.js

@@ -0,0 +1,304 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * Apply domain suspend + vacation artifacts to host (Postfix / Dovecot).
+ * Never fakes applied without successful host commands.
+ */
+import { mkdirSync, writeFileSync, existsSync, readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { shellBinExists } from '../hosting/software-probe/index.js';
+/**
+ * Rebuild aggregate suspend map from all domain SUSPENDED.flag files.
+ */
+export function rebuildSuspendDomainMap(dataDir) {
+    const root = join(dataDir, 'email');
+    const outDir = join(dataDir, 'email', 'policy');
+    mkdirSync(outDir, { recursive: true });
+    const path = join(outDir, 'ysk-suspend-domains');
+    const domains = [];
+    if (existsSync(root)) {
+        for (const name of readdirSync(root)) {
+            const flag = join(root, name, 'SUSPENDED.flag');
+            if (existsSync(flag)) {
+                // domain dir name is the domain
+                if (name.includes('.') || name.length > 1)
+                    domains.push(name.toLowerCase());
+            }
+        }
+    }
+    const body = domains.map((d) => `${d} REJECT Domain suspended by YSK`).join('\n') +
+        (domains.length ? '\n' : '# no suspended domains\n');
+    writeFileSync(path, body, 'utf8');
+    return {
+        path,
+        domains,
+        notes: [
+            `suspend map: ${path} (${domains.length} domains)`,
+            domains.length
+                ? `paused: ${domains.join(', ')}`
+                : tl('notes.auto.n1120'),
+        ],
+    };
+}
+/**
+ * Write per-mailbox vacation sieve copies under dataDir (from domain vacation.sieve).
+ */
+export function writeMailboxVacationCopies(input) {
+    const written = [];
+    const notes = [];
+    const domainSieve = join(input.dataDir, 'email', input.domain, 'sieve', 'vacation.sieve');
+    if (!existsSync(domainSieve)) {
+        notes.push(tl('notes.auto.n1075'));
+        return { written, notes };
+    }
+    const content = readFileSync(domainSieve, 'utf8');
+    for (const local of input.mailboxes) {
+        const addr = `${local}@${input.domain}`;
+        const dir = join(input.dataDir, 'email', 'sieve', addr);
+        mkdirSync(dir, { recursive: true });
+        const path = join(dir, input.enabled ? 'vacation.sieve' : 'vacation.disabled.sieve');
+        writeFileSync(path, content, 'utf8');
+        written.push(path);
+    }
+    if (input.mailboxes.length) {
+        notes.push(tl('notes.auto.t0065', { v0: (input.mailboxes.length) }));
+    }
+    else {
+        notes.push(tl('notes.auto.n0628'));
+    }
+    return { written, notes };
+}
+/**
+ * Install suspend map into Postfix + postmap + ensure recipient restriction + reload.
+ */
+export async function applySuspendMapToPostfix(input) {
+    const notes = [];
+    const commandResults = [];
+    const sysDir = '/etc/postfix/ysk-server';
+    const sysMap = `${sysDir}/ysk-suspend-domains`;
+    const steps = [
+        {
+            name: 'mkdir',
+            argv: ['mkdir', '-p', sysDir],
+            hard: true,
+        },
+        {
+            name: 'cp map',
+            argv: ['cp', '-f', input.mapPath, sysMap],
+            hard: true,
+        },
+        {
+            name: 'postmap',
+            argv: [
+                'bash',
+                '-c',
+                `if ${shellBinExists('postmap')}; then postmap hash:${sysMap} || postmap ${sysMap}; fi`,
+            ],
+            hard: true,
+        },
+        {
+            name: 'postconf recipient access',
+            argv: [
+                'bash',
+                '-c',
+                `grep -q 'ysk-suspend-domains' /etc/postfix/main.cf 2>/dev/null || postconf -e "smtpd_recipient_restrictions=\$smtpd_recipient_restrictions, check_recipient_access hash:${sysMap}"`,
+            ],
+            hard: true,
+        },
+        {
+            name: 'reload postfix',
+            argv: ['bash', '-c', 'systemctl reload postfix 2>&1 || service postfix reload 2>&1'],
+            hard: true,
+        },
+    ];
+    for (const step of steps) {
+        const r = await input.host.runCommand(step.argv, { timeoutMs: 30_000 });
+        commandResults.push({
+            argv: step.argv,
+            exitCode: r.exitCode,
+            stderr: r.stderr,
+        });
+        if (r.exitCode !== 0) {
+            notes.push(tl('notes.tpl.actionFailed', { action: step.name, detail: (r.stderr || r.stdout).slice(0, 200) }));
+            if (step.hard) {
+                return { ok: false, notes, commandResults };
+            }
+        }
+        else {
+            notes.push(`${step.name} ok`);
+        }
+    }
+    notes.push(tl('notes.auto.n0156'));
+    return { ok: true, notes, commandResults };
+}
+/**
+ * Deploy vacation sieve to system vmail paths when present.
+ * Looks for /var/vmail, /var/mail/vhosts, or dataDir maildir parents.
+ */
+export async function applyVacationSieveToSystem(input) {
+    const notes = [];
+    const written = [];
+    const commandResults = [];
+    const domainSieve = join(input.dataDir, 'email', input.domain, 'sieve', 'vacation.sieve');
+    if (!existsSync(domainSieve)) {
+        return {
+            ok: false,
+            notes: [tl('notes.auto.n1088')],
+            written,
+            commandResults,
+        };
+    }
+    if (!input.mailboxes.length) {
+        notes.push(tl('notes.auto.n1200'));
+        return { ok: true, notes, written, commandResults };
+    }
+    let anyOk = false;
+    let anyFail = false;
+    for (const local of input.mailboxes) {
+        const candidates = [
+            `/var/vmail/${input.domain}/${local}/sieve`,
+            `/var/mail/vhosts/${input.domain}/${local}/sieve`,
+            join(input.dataDir, 'email', input.domain, 'mailboxes', local, 'sieve'),
+        ];
+        let destDir;
+        for (const c of candidates) {
+            // Prefer existing mailbox home parent
+            const parent = join(c, '..');
+            if (existsSync(parent) || c.includes(input.dataDir)) {
+                destDir = c;
+                break;
+            }
+        }
+        if (!destDir)
+            destDir = candidates[0];
+        const destFile = join(destDir, input.enabled ? 'vacation.sieve' : 'vacation.disabled.sieve');
+        const activeLink = join(destDir, '.dovecot.sieve');
+        const script = [
+            `mkdir -p ${JSON.stringify(destDir)}`,
+            `cp -f ${JSON.stringify(domainSieve)} ${JSON.stringify(destFile)}`,
+            input.enabled
+                ? `ln -sfn ${JSON.stringify(destFile)} ${JSON.stringify(activeLink)}`
+                : `rm -f ${JSON.stringify(activeLink)}`,
+        ].join(' && ');
+        const r = await input.host.runCommand(['bash', '-c', script], { timeoutMs: 15_000 });
+        commandResults.push({
+            argv: ['bash', '-c', script],
+            exitCode: r.exitCode,
+            stderr: r.stderr,
+        });
+        if (r.exitCode === 0) {
+            anyOk = true;
+            written.push(destFile);
+            notes.push(input.enabled
+                ? tl('notes.auto.t0066', { v0: (local), v1: (input.domain) })
+                : tl('notes.auto.t0067', { v0: (local), v1: (input.domain) }));
+        }
+        else {
+            anyFail = true;
+            notes.push(tl('notes.auto.t0068', { v0: (local), v1: (input.domain), v2: ((r.stderr || r.stdout).slice(0, 120)) }));
+        }
+    }
+    // reload dovecot when present — soft: files already written
+    if (anyOk) {
+        const reload = await input.host.runCommand(['bash', '-c', 'systemctl reload dovecot 2>&1 || service dovecot reload 2>&1'], { timeoutMs: 10_000 });
+        commandResults.push({
+            argv: ['systemctl', 'reload', 'dovecot'],
+            exitCode: reload.exitCode,
+            stderr: reload.stderr,
+        });
+        if (reload.exitCode === 0)
+            notes.push('dovecot reloaded');
+        else
+            notes.push(tl('notes.auto.n0261'));
+    }
+    return {
+        ok: anyOk && !anyFail,
+        notes,
+        written,
+        commandResults,
+    };
+}
+/**
+ * Full system apply for suspend map + vacation, after control-plane files exist.
+ */
+export async function applyDomainFlagsToSystem(input) {
+    const notes = [];
+    const written = [];
+    const commandResults = [];
+    if (!input.host.executeEnabled() || !input.host.isRoot()) {
+        return {
+            ok: false,
+            blocked: true,
+            blockMessage: tl('notes.auto.n1306'),
+            apply_status: 'blocked',
+            notes: [tl('notes.auto.n1214')],
+            written,
+            commandResults,
+        };
+    }
+    let hardFail = false;
+    let didWork = false;
+    if (input.applySuspend !== false) {
+        const map = rebuildSuspendDomainMap(input.dataDir);
+        written.push(map.path);
+        notes.push(...map.notes);
+        // Always refresh map content for current suspended set
+        const r = await applySuspendMapToPostfix({ host: input.host, mapPath: map.path });
+        notes.push(...r.notes);
+        commandResults.push(...r.commandResults);
+        if (!r.ok)
+            hardFail = true;
+        else
+            didWork = true;
+    }
+    if (input.applyVacation !== false) {
+        const copies = writeMailboxVacationCopies({
+            dataDir: input.dataDir,
+            domain: input.domain,
+            mailboxes: input.mailboxes,
+            enabled: input.vacationEnabled,
+        });
+        written.push(...copies.written);
+        notes.push(...copies.notes);
+        const vac = await applyVacationSieveToSystem({
+            host: input.host,
+            dataDir: input.dataDir,
+            domain: input.domain,
+            mailboxes: input.mailboxes,
+            enabled: input.vacationEnabled,
+        });
+        notes.push(...vac.notes);
+        written.push(...vac.written);
+        commandResults.push(...vac.commandResults);
+        if (!vac.ok && input.mailboxes.length > 0)
+            hardFail = true;
+        else if (vac.ok)
+            didWork = true;
+    }
+    void input.suspended;
+    if (hardFail) {
+        return {
+            ok: false,
+            apply_status: 'partial',
+            notes: [...notes, tl('notes.auto.n1220')],
+            written,
+            commandResults,
+        };
+    }
+    if (!didWork) {
+        return {
+            ok: true,
+            apply_status: 'written',
+            notes: [...notes, tl('notes.auto.n1093')],
+            written,
+            commandResults,
+        };
+    }
+    return {
+        ok: true,
+        apply_status: 'applied',
+        notes: [...notes, tl('notes.auto.n1212')],
+        written,
+        commandResults,
+    };
+}
+//# sourceMappingURL=domain-flags-apply.js.map

package/dist/email/domain-flags-apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-flags-apply.js","sourceRoot":"","sources":["../../src/email/domain-flags-apply.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAYpE;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IAKrD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChD,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACjD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;YAChD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,gCAAgC;gBAChC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GACR,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACpE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;IACvD,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAClC,OAAO;QACL,IAAI;QACJ,OAAO;QACP,KAAK,EAAE;YACL,gBAAgB,IAAI,KAAK,OAAO,CAAC,MAAM,WAAW;YAClD,OAAO,CAAC,MAAM;gBACZ,CAAC,CAAC,WAAW,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACjC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC;SAC3B;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAK1C;IACC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC1F,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACxD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC;QACrF,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CACzD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAG9C;IAKC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,cAAc,GAA6C,EAAE,CAAC;IACpE,MAAM,MAAM,GAAG,yBAAyB,CAAC;IACzC,MAAM,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC;IAE/C,MAAM,KAAK,GAA4D;QACrE;YACE,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC;YAC7B,IAAI,EAAE,IAAI;SACX;QACD;YACE,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;YACzC,IAAI,EAAE,IAAI;SACX;QACD;YACE,IAAI,EAAE,SAAS;YACf,IAAI,EAAE;gBACJ,MAAM;gBACN,IAAI;gBACJ,MAAM,cAAc,CAAC,SAAS,CAAC,uBAAuB,MAAM,eAAe,MAAM,MAAM;aACxF;YACD,IAAI,EAAE,IAAI;SACX;QACD;YACE,IAAI,EAAE,2BAA2B;YACjC,IAAI,EAAE;gBACJ,MAAM;gBACN,IAAI;gBACJ,2KAA2K,MAAM,GAAG;aACrL;YACD,IAAI,EAAE,IAAI;SACX;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,8DAA8D,CAAC;YACpF,IAAI,EAAE,IAAI;SACX;KACF,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACxE,cAAc,CAAC,IAAI,CAAC;YAClB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9G,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;YAC9C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACnC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAMhD;IAMC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,cAAc,GAA6C,EAAE,CAAC;IACpE,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC1F,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;YAC/B,OAAO;YACP,cAAc;SACf,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG;YACjB,cAAc,KAAK,CAAC,MAAM,IAAI,KAAK,QAAQ;YAC3C,oBAAoB,KAAK,CAAC,MAAM,IAAI,KAAK,QAAQ;YACjD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC;SACxE,CAAC;QACF,IAAI,OAA2B,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,sCAAsC;YACtC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAC7B,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpD,OAAO,GAAG,CAAC,CAAC;gBACZ,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAEtC,MAAM,QAAQ,GAAG,IAAI,CACnB,OAAQ,EACR,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,yBAAyB,CAC7D,CAAC;QACF,MAAM,UAAU,GAAG,IAAI,CAAC,OAAQ,EAAE,gBAAgB,CAAC,CAAC;QAEpD,MAAM,MAAM,GAAG;YACb,YAAY,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;YACrC,SAAS,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;YAClE,KAAK,CAAC,OAAO;gBACX,CAAC,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;gBACrE,CAAC,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;SAC1C,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEf,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACrF,cAAc,CAAC,IAAI,CAAC;YAClB,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;YAC5B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACrB,KAAK,GAAG,IAAI,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,OAAO;gBACX,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7D,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAChE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,IAAI,CAAC;YACf,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CACxG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CACxC,CAAC,MAAM,EAAE,IAAI,EAAE,8DAA8D,CAAC,EAC9E,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;QACF,cAAc,CAAC,IAAI,CAAC;YAClB,IAAI,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC;YACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;;YAExD,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,kBAAkB,CAAC,CACvB,CAAC;IACN,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK,IAAI,CAAC,OAAO;QACrB,KAAK;QACL,OAAO;QACP,cAAc;KACf,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAY9C;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,cAAc,GAA6C,EAAE,CAAC;IAEpE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACzD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,EAAE,CAAC,kBAAkB,CAAC;YACpC,YAAY,EAAE,SAAS;YACvB,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;YAC/B,OAAO;YACP,cAAc;SACf,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,uDAAuD;QACvD,MAAM,CAAC,GAAG,MAAM,wBAAwB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAClF,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACvB,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;QACzC,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,QAAQ,GAAG,IAAI,CAAC;;YACtB,OAAO,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,IAAI,KAAK,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,0BAA0B,CAAC;YACxC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,eAAe;SAC/B,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAE5B,MAAM,GAAG,GAAG,MAAM,0BAA0B,CAAC;YAC3C,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,eAAe;SAC/B,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,cAAc,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,QAAQ,GAAG,IAAI,CAAC;aACtD,IAAI,GAAG,CAAC,EAAE;YAAE,OAAO,GAAG,IAAI,CAAC;IAClC,CAAC;IAED,KAAK,KAAK,CAAC,SAAS,CAAC;IAErB,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,YAAY,EAAE,SAAS;YACvB,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;YACzC,OAAO;YACP,cAAc;SACf,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,IAAI;YACR,YAAY,EAAE,SAAS;YACvB,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;YACzC,OAAO;YACP,cAAc;SACf,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,YAAY,EAAE,SAAS;QACvB,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;QACzC,OAAO;QACP,cAAc;KACf,CAAC;AACJ,CAAC"}

package/dist/email/dovecot-passdb.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Build Dovecot passwd-file / userdb snippets from managed mailboxes.
+ * Format is compatible with Dovecot passwd-file scheme (not crypt(3) — document ysk-scrypt).
+ */
+import type { YskDatabase } from '../db/database.js';
+import type { HostExecutor } from '../host/executor.js';
+/** Shared vmail uid/gid used in passwd-file (create system user on apply). */
+export declare const YSK_VMAIL_UID = 5000;
+export declare const YSK_VMAIL_GID = 5000;
+export declare const YSK_VMAIL_USER = "vmail";
+export declare const YSK_VMAIL_GROUP = "vmail";
+export interface DovecotPassdbResult {
+    ok: boolean;
+    domain: string;
+    passwdPath: string;
+    userdbPath: string;
+    confSnippetPath: string;
+    written: string[];
+    mailboxCount: number;
+    notes: string[];
+}
+/**
+ * Rewrite Dovecot passwd-file for a domain from snapshot.mailboxes.
+ * Password field: if hash present use it; else use '*' (login denied until password set).
+ */
+export declare function writeDovecotPassdb(input: {
+    dataDir: string;
+    db: YskDatabase;
+    domain: string;
+    domainId?: string;
+}): DovecotPassdbResult;
+/**
+ * Write passdb for all domains that have mailboxes.
+ */
+export declare function writeAllDovecotPassdbs(input: {
+    dataDir: string;
+    db: YskDatabase;
+}): {
+    ok: boolean;
+    domains: DovecotPassdbResult[];
+    notes: string[];
+};
+export declare function passdbExists(dataDir: string, domain: string): boolean;
+/**
+ * Install YSK virtual-mail auth into live Dovecot + ensure vmail user + maildir ownership.
+ * Without this step, Roundcube login always fails (Dovecot still uses PAM/system users only).
+ */
+export declare function applyDovecotPassdbToSystem(input: {
+    dataDir: string;
+    host: HostExecutor;
+    /** Re-write all domain passdbs first (default true) */
+    rewritePassdbs?: boolean;
+    db?: YskDatabase;
+}): Promise<{
+    ok: boolean;
+    notes: string[];
+    written: string[];
+}>;
+//# sourceMappingURL=dovecot-passdb.d.ts.map

package/dist/email/dovecot-passdb.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dovecot-passdb.d.ts","sourceRoot":"","sources":["../../src/email/dovecot-passdb.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,8EAA8E;AAC9E,eAAO,MAAM,aAAa,OAAO,CAAC;AAClC,eAAO,MAAM,aAAa,OAAO,CAAC;AAClC,eAAO,MAAM,cAAc,UAAU,CAAC;AACtC,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,WAAW,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,mBAAmB,CAmGtB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,WAAW,CAAC;CACjB,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAmBnE;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAErE;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,uDAAuD;IACvD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,EAAE,CAAC,EAAE,WAAW,CAAC;CAClB,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA+F/D"}

package/dist/email/dovecot-passdb.js

@@ -0,0 +1,220 @@
+/**
+ * Build Dovecot passwd-file / userdb snippets from managed mailboxes.
+ * Format is compatible with Dovecot passwd-file scheme (not crypt(3) — document ysk-scrypt).
+ */
+import { mkdirSync, writeFileSync, existsSync, readdirSync, chmodSync } from 'node:fs';
+import { join } from 'node:path';
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+/** Shared vmail uid/gid used in passwd-file (create system user on apply). */
+export const YSK_VMAIL_UID = 5000;
+export const YSK_VMAIL_GID = 5000;
+export const YSK_VMAIL_USER = 'vmail';
+export const YSK_VMAIL_GROUP = 'vmail';
+/**
+ * Rewrite Dovecot passwd-file for a domain from snapshot.mailboxes.
+ * Password field: if hash present use it; else use '*' (login denied until password set).
+ */
+export function writeDovecotPassdb(input) {
+    const domain = input.domain.trim().toLowerCase();
+    if (!domain) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.needDomain'), { httpStatus: 400 });
+    }
+    const mailboxes = input.db.snapshot.mailboxes.filter((m) => {
+        if (input.domainId)
+            return m.domain_id === input.domainId;
+        return String(m.domain ?? '').toLowerCase() === domain;
+    });
+    const dir = join(input.dataDir, 'email', domain, 'dovecot');
+    mkdirSync(dir, { recursive: true });
+    const passwdPath = join(dir, 'passwd');
+    const userdbPath = join(dir, 'userdb');
+    const confSnippetPath = join(dir, 'auth-ysk.conf.ext');
+    const passwdLines = [
+        '# YSK Server Dovecot passwd-file — review before production',
+        '# user:password:uid:gid:gecos:home:shell:extra_fields',
+    ];
+    const userdbLines = ['# userdb lines for virtual mail (uid/gid/home/mail)'];
+    for (const m of mailboxes) {
+        const user = String(m.address ?? `${m.local_part}@${domain}`);
+        const maildir = m.maildir ||
+            join(input.dataDir, 'email', domain, 'mailboxes', String(m.local_part), 'Maildir');
+        const home = join(maildir, '..');
+        let hash = m.password_hash || '*';
+        // Ensure Dovecot scheme prefix when raw $6$ crypt is stored
+        if (hash.startsWith('$6$') && !hash.includes('{SHA512-CRYPT}')) {
+            hash = `{SHA512-CRYPT}${hash}`;
+        }
+        // uid/gid/home in classic passwd fields; mail= extra field (passwd-file userdb)
+        passwdLines.push(`${user}:${hash}:${YSK_VMAIL_UID}:${YSK_VMAIL_GID}::${home}::mail=maildir:${maildir}`);
+        userdbLines.push(`${user}::${YSK_VMAIL_UID}:${YSK_VMAIL_GID}::${home}::mail=maildir:${maildir}`);
+    }
+    writeFileSync(passwdPath, passwdLines.join('\n') + '\n', 'utf8');
+    writeFileSync(userdbPath, userdbLines.join('\n') + '\n', 'utf8');
+    try {
+        chmodSync(passwdPath, 0o640);
+        chmodSync(userdbPath, 0o640);
+    }
+    catch {
+        /* best-effort */
+    }
+    const hasSha512 = mailboxes.some((m) => String(m.password_hash ?? '').includes('SHA512-CRYPT') ||
+        String(m.password_hash ?? '').startsWith('$6$') ||
+        m.password_scheme === 'SHA512-CRYPT');
+    // Prefer scheme in the password field ({SHA512-CRYPT}$6$…) — omit default scheme to avoid double-prefix bugs
+    const argsLine = hasSha512 ? `args = ${passwdPath}` : `args = scheme=YSK-SCRYPT ${passwdPath}`;
+    writeFileSync(confSnippetPath, [
+        '# Include from /etc/dovecot/conf.d/ — generated by YSK Server',
+        'passdb {',
+        '  driver = passwd-file',
+        `  ${argsLine}`,
+        '}',
+        'userdb {',
+        '  driver = passwd-file',
+        `  args = ${userdbPath}`,
+        '}',
+        '',
+    ].join('\n'), 'utf8');
+    const notes = [
+        `passwd-file: ${passwdPath}`,
+        `userdb: ${userdbPath}`,
+        `auth snippet: ${confSnippetPath}`,
+        hasSha512
+            ? 'Passwords use {SHA512-CRYPT} (openssl) — Dovecot reads scheme from hash prefix'
+            : 'Passwords use YSK-SCRYPT — re-create mailboxes with openssl available for production',
+        mailboxes.length === 0
+            ? 'No mailboxes yet — create via email mailbox API first'
+            : `${mailboxes.length} mailbox(es) exported`,
+    ];
+    return {
+        ok: true,
+        domain,
+        passwdPath,
+        userdbPath,
+        confSnippetPath,
+        written: [passwdPath, userdbPath, confSnippetPath],
+        mailboxCount: mailboxes.length,
+        notes,
+    };
+}
+/**
+ * Write passdb for all domains that have mailboxes.
+ */
+export function writeAllDovecotPassdbs(input) {
+    const domains = new Set();
+    for (const m of input.db.snapshot.mailboxes) {
+        if (m.domain)
+            domains.add(String(m.domain).toLowerCase());
+    }
+    // also from email_domains
+    for (const d of input.db.snapshot.email_domains) {
+        if (d.domain)
+            domains.add(String(d.domain).toLowerCase());
+    }
+    const results = [];
+    for (const domain of domains) {
+        results.push(writeDovecotPassdb({ dataDir: input.dataDir, db: input.db, domain }));
+    }
+    const ok = results.every((r) => r.ok !== false);
+    return {
+        ok,
+        domains: results,
+        notes: [`Wrote passdb for ${results.length} domain(s)`],
+    };
+}
+export function passdbExists(dataDir, domain) {
+    return existsSync(join(dataDir, 'email', domain, 'dovecot', 'passwd'));
+}
+/**
+ * Install YSK virtual-mail auth into live Dovecot + ensure vmail user + maildir ownership.
+ * Without this step, Roundcube login always fails (Dovecot still uses PAM/system users only).
+ */
+export async function applyDovecotPassdbToSystem(input) {
+    const notes = [];
+    const written = [];
+    if (!input.host.executeEnabled() || !input.host.isRoot()) {
+        return {
+            ok: false,
+            notes: [tl('notes.email.dovecotApplyNeedRoot')],
+            written,
+        };
+    }
+    if (!input.host.pathExists('/usr/sbin/dovecot') && !input.host.pathExists('/usr/bin/doveconf')) {
+        return {
+            ok: false,
+            notes: [tl('notes.email.dovecotNotInstalled')],
+            written,
+        };
+    }
+    if (input.rewritePassdbs !== false && input.db) {
+        const all = writeAllDovecotPassdbs({ dataDir: input.dataDir, db: input.db });
+        for (const r of all.domains)
+            written.push(...r.written);
+        notes.push(...all.notes);
+    }
+    const emailRoot = join(input.dataDir, 'email');
+    const confd = '/etc/dovecot/conf.d';
+    const authConf = join(confd, '99-ysk-virtual-mail.conf');
+    const mailConf = join(confd, '99-ysk-virtual-mail-location.conf');
+    // Build include list of domain auth snippets
+    const includes = [];
+    if (existsSync(emailRoot)) {
+        for (const d of readdirSync(emailRoot)) {
+            const snip = join(emailRoot, d, 'dovecot', 'auth-ysk.conf.ext');
+            if (existsSync(snip))
+                includes.push(snip);
+        }
+    }
+    if (includes.length === 0) {
+        notes.push(tl('notes.email.dovecotNoPassdbSnippets'));
+    }
+    const authBody = [
+        '# Generated by YSK Server — virtual mailbox auth (passwd-file)',
+        '# Included after defaults; PAM remains as fallback for system users.',
+        ...includes.map((p) => `!include ${p}`),
+        '',
+    ].join('\n');
+    writeFileSync(authConf, authBody, 'utf8');
+    written.push(authConf);
+    const mailBody = [
+        '# Generated by YSK Server — virtual mail defaults',
+        `mail_uid = ${YSK_VMAIL_UID}`,
+        `mail_gid = ${YSK_VMAIL_GID}`,
+        `first_valid_uid = ${YSK_VMAIL_UID}`,
+        'last_valid_uid = 60000',
+        'mail_privileged_group = mail',
+        // Prefer userdb mail=; keep a safe default
+        'mail_location = maildir:~/Maildir',
+        '',
+    ].join('\n');
+    writeFileSync(mailConf, mailBody, 'utf8');
+    written.push(mailConf);
+    // Create vmail user + chown maildirs + reload
+    const script = [
+        'set -euo pipefail',
+        `groupadd -g ${YSK_VMAIL_GID} ${YSK_VMAIL_GROUP} 2>/dev/null || true`,
+        `id -u ${YSK_VMAIL_USER} >/dev/null 2>&1 || useradd -u ${YSK_VMAIL_UID} -g ${YSK_VMAIL_GID} -d ${JSON.stringify(join(input.dataDir, 'email'))} -s /usr/sbin/nologin ${YSK_VMAIL_USER}`,
+        `if [ "$(id -u ${YSK_VMAIL_USER} 2>/dev/null || echo x)" != "${YSK_VMAIL_UID}" ]; then echo "WARN: ${YSK_VMAIL_USER} uid mismatch"; fi`,
+        `chown root:dovecot ${JSON.stringify(authConf)} ${JSON.stringify(mailConf)} 2>/dev/null || true`,
+        `chmod 644 ${JSON.stringify(authConf)} ${JSON.stringify(mailConf)}`,
+        // passwd files readable by dovecot
+        `find ${JSON.stringify(emailRoot)} \\( -path '*/dovecot/passwd' -o -path '*/dovecot/userdb' \\) 2>/dev/null | while read -r f; do chown root:dovecot "$f" 2>/dev/null || true; chmod 640 "$f"; done`,
+        // maildirs owned by vmail
+        `if [ -d ${JSON.stringify(emailRoot)} ]; then`,
+        `  find ${JSON.stringify(emailRoot)} -type d -name Maildir -print0 | xargs -0 -r chown -R ${YSK_VMAIL_UID}:${YSK_VMAIL_GID}`,
+        `  find ${JSON.stringify(emailRoot)} -type d -path '*/mailboxes/*' -print0 | xargs -0 -r chown ${YSK_VMAIL_UID}:${YSK_VMAIL_GID} 2>/dev/null || true`,
+        `fi`,
+        'doveconf -n >/dev/null',
+        'systemctl reload dovecot 2>/dev/null || service dovecot reload 2>/dev/null || doveadm reload 2>/dev/null || true',
+    ].join('\n');
+    const r = await input.host.runCommand(['bash', '-c', script], { timeoutMs: 60_000 });
+    if (r.exitCode !== 0) {
+        notes.push(tl('notes.email.dovecotApplyFailed', {
+            detail: (r.stderr || r.stdout || '').slice(0, 300),
+        }));
+        return { ok: false, notes, written };
+    }
+    notes.push(tl('notes.email.dovecotApplyOk', { conf: authConf, count: includes.length }));
+    notes.push(...(r.stdout || '').split('\n').filter(Boolean).slice(0, 5));
+    return { ok: true, notes, written };
+}
+//# sourceMappingURL=dovecot-passdb.js.map

package/dist/email/dovecot-passdb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dovecot-passdb.js","sourceRoot":"","sources":["../../src/email/dovecot-passdb.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACvF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAI7D,8EAA8E;AAC9E,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC;AAClC,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC;AAClC,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AACtC,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAavC;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAKlC;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACzD,IAAI,KAAK,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,CAAC;QAC1D,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5D,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACvC,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAEvD,MAAM,WAAW,GAAa;QAC5B,6DAA6D;QAC7D,uDAAuD;KACxD,CAAC;IACF,MAAM,WAAW,GAAa,CAAC,qDAAqD,CAAC,CAAC;IAEtF,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC,UAAU,IAAI,MAAM,EAAE,CAAC,CAAC;QAC9D,MAAM,OAAO,GACV,CAAC,CAAC,OAAkB;YACrB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,IAAI,GAAI,CAAC,CAAC,aAAwB,IAAI,GAAG,CAAC;QAC9C,4DAA4D;QAC5D,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/D,IAAI,GAAG,iBAAiB,IAAI,EAAE,CAAC;QACjC,CAAC;QACD,gFAAgF;QAChF,WAAW,CAAC,IAAI,CACd,GAAG,IAAI,IAAI,IAAI,IAAI,aAAa,IAAI,aAAa,KAAK,IAAI,kBAAkB,OAAO,EAAE,CACtF,CAAC;QACF,WAAW,CAAC,IAAI,CACd,GAAG,IAAI,KAAK,aAAa,IAAI,aAAa,KAAK,IAAI,kBAAkB,OAAO,EAAE,CAC/E,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACjE,aAAa,CAAC,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC7B,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAC9B,CAAC,CAAC,EAAE,EAAE,CACJ,MAAM,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;QACtD,MAAM,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;QAC/C,CAAC,CAAC,eAAe,KAAK,cAAc,CACvC,CAAC;IACF,6GAA6G;IAC7G,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,UAAU,EAAE,CAAC,CAAC,CAAC,4BAA4B,UAAU,EAAE,CAAC;IAE/F,aAAa,CACX,eAAe,EACf;QACE,+DAA+D;QAC/D,UAAU;QACV,wBAAwB;QACxB,KAAK,QAAQ,EAAE;QACf,GAAG;QACH,UAAU;QACV,wBAAwB;QACxB,YAAY,UAAU,EAAE;QACxB,GAAG;QACH,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,MAAM,CACP,CAAC;IAEF,MAAM,KAAK,GAAG;QACZ,gBAAgB,UAAU,EAAE;QAC5B,WAAW,UAAU,EAAE;QACvB,iBAAiB,eAAe,EAAE;QAClC,SAAS;YACP,CAAC,CAAC,gFAAgF;YAClF,CAAC,CAAC,sFAAsF;QAC1F,SAAS,CAAC,MAAM,KAAK,CAAC;YACpB,CAAC,CAAC,uDAAuD;YACzD,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,uBAAuB;KAC/C,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM;QACN,UAAU;QACV,UAAU;QACV,eAAe;QACf,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,eAAe,CAAC;QAClD,YAAY,EAAE,SAAS,CAAC,MAAM;QAC9B,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAGtC;IACC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC,CAAC,MAAM;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,0BAA0B;IAC1B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAChD,IAAI,CAAC,CAAC,MAAM;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IAChD,OAAO;QACL,EAAE;QACF,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,CAAC,oBAAoB,OAAO,CAAC,MAAM,YAAY,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,MAAc;IAC1D,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAMhD;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACzD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,EAAE,CAAC,kCAAkC,CAAC,CAAC;YAC/C,OAAO;SACR,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC/F,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,EAAE,CAAC,iCAAiC,CAAC,CAAC;YAC9C,OAAO;SACR,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,sBAAsB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,qBAAqB,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,mCAAmC,CAAC,CAAC;IAElE,6CAA6C;IAC7C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;YAChE,IAAI,UAAU,CAAC,IAAI,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,qCAAqC,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,QAAQ,GAAG;QACf,gEAAgE;QAChE,sEAAsE;QACtE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;QACvC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEvB,MAAM,QAAQ,GAAG;QACf,mDAAmD;QACnD,cAAc,aAAa,EAAE;QAC7B,cAAc,aAAa,EAAE;QAC7B,qBAAqB,aAAa,EAAE;QACpC,wBAAwB;QACxB,8BAA8B;QAC9B,2CAA2C;QAC3C,mCAAmC;QACnC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEvB,8CAA8C;IAC9C,MAAM,MAAM,GAAG;QACb,mBAAmB;QACnB,eAAe,aAAa,IAAI,eAAe,sBAAsB;QACrE,SAAS,cAAc,kCAAkC,aAAa,OAAO,aAAa,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,yBAAyB,cAAc,EAAE;QACtL,iBAAiB,cAAc,gCAAgC,aAAa,yBAAyB,cAAc,oBAAoB;QACvI,sBAAsB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,sBAAsB;QAChG,aAAa,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;QACnE,mCAAmC;QACnC,QAAQ,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,mKAAmK;QACpM,0BAA0B;QAC1B,WAAW,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU;QAC9C,UAAU,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,yDAAyD,aAAa,IAAI,aAAa,EAAE;QAC5H,UAAU,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,8DAA8D,aAAa,IAAI,aAAa,sBAAsB;QACrJ,IAAI;QACJ,wBAAwB;QACxB,kHAAkH;KACnH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,gCAAgC,EAAE;YACnC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACnD,CAAC,CACH,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACvC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACzF,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC"}