v0.2.22

RELEASE-MANIFEST.txt

@@ -1,6 +1,16 @@
-RustBox 0.2.20 release manifest
+RustBox 0.2.22 release manifest
 
-0.2.20 release changes and retained feature set:
+0.2.22 release changes:
+- adds message snooze: snoozing a message hides it client-side from its folder's current view until the chosen wake time, without touching server-side folder pagination/count SQL; `snoozed_messages` is a local-only cache table with no IMAP side effects, so a snoozed message is unaffected on any other client
+- adds an "Undo Send" window: when `undo_send_window_secs > 0` (default 8s, max 120s), a submitted message is held in memory and only dispatched to SMTP after the window elapses unless cancelled; nothing is persisted, so a server restart during the window loses the staged send the same way an in-flight SMTP connection would be lost
+- adds `GET/DELETE /messages/send/{pending_send_id}` to poll or cancel a staged send, and `POST/DELETE /messages/{folder}/{uid}/snooze`, `GET /messages/snoozed`, `GET /folders/{name}/snoozed-uids` for snooze
+
+0.2.21 release changes and retained feature set:
+- adds configurable login brute-force protection (`[login_rate_limit]`): per-IP token bucket plus per-mailbox and per-IP failed-attempt lockouts with exponential back-off; locked attempts return 429 + Retry-After before any IMAP connection
+- the public `/api/auth/policy` GET no longer consumes the per-IP login budget
+- adds `cookie_secure = auto | always | never`; `auto` sets the cookie `Secure` attribute only for requests that really arrived over HTTPS, so plain-HTTP installs keep working
+- adds attachment memory guards: attachment sets that cannot fit `max_message_size_mb` once MIME-encoded are rejected with 413 from stored sizes before any file is loaded (send, IMAP draft snapshot, attach-message, streaming upload), and `max_concurrent_message_builds` / `message_build_wait_secs` bound how many requests hold attachments in RAM at once
+- adds gmail-style message row opening: Ctrl/Cmd+click opens a message in a new tab, Shift+click opens it in a popup window, both deep-linked (outside selection mode; existing shift/ctrl selection behavior while selecting is unchanged)
 - fixes the Axum route visibility mismatch for `AttachMessageSourceRequest`, allowing the forward-as-attachment handler to compile from `routes::mod`
 - falls back to IMAP `INTERNALDATE` for messages with a missing/invalid message `Date` and repairs cached missing dates when opening a folder
 - forwards a message as a real server-created `message/rfc822` `.eml` draft attachment
@@ -64,7 +74,8 @@ Database/schema:
 - compatibility baseline is V050; former V047-V050 changes are consolidated into `schema.sql` and their standalone migrations are removed
 - databases older than V050 must be upgraded with a V050-capable RustBox release before using this build
 - V051 adds `display_preferences.adaptive_email_colors` and `mail_preferences.message_loading_mode` to existing V050 tenants
-- next migration number: V052
+- V052 adds `snoozed_messages` (local-only cache state, no IMAP side effects) to existing V051 tenants
+- next migration number: V053
 
 Docker examples:
 - docker/compose-single-sqlite.yml
@@ -74,14 +85,14 @@ Docker examples:
 
 Operations/docs:
 - standalone `scripts/migrate_roundcube.py` imports Roundcube contacts/identities using RustBox config.toml and supports SQLite/MySQL/PostgreSQL targets
-- README.md documents 0.2.20 configuration
+- README.md documents 0.2.22 configuration
 - docker/README.md documents Compose variants
 - docs/STORAGE_SEARCH_OPERATIONS.md documents failure modes, shared-storage requirements and migration behavior
 - TODO.md leaves live SILO/MinIO/AWS/Ceph and real multi-node acceptance validation explicitly pending
 
 Build/release metadata:
 - `scripts/package-release.sh` runs the full Rust release gate before creating ZIP/SHA256 artifacts
-- Cargo.toml version = 0.2.20
+- Cargo.toml version = 0.2.22
 - rust-toolchain.toml pins Rust 1.99.1
 - Cargo.lock is retained for reproducible application builds; the release gate generates it only when missing
 - CI and scripts/build-release.sh use the retained Cargo.lock (generating it only if missing), then run locked tests/Clippy/release build