4.36.6

.drone.yml

@@ -0,0 +1,52 @@
+
+kind: pipeline
+type: docker
+name: build-multiarch-images
+
+platform:
+  os: linux
+  arch: amd64
+
+steps:
+- name: make-tags
+  image: node
+  commands:
+    - echo -n "${DRONE_TAG}, latest" > .tags
+
+- name: build  
+  image: thegeeklab/drone-docker-buildx
+  privileged: true
+  settings:
+    provenance: false
+    dockerfile: app/Dockerfile
+    context: app
+    registry: git.mrmeeb.stream
+    username: 
+      from_secret: docker_username
+    password: 
+      from_secret: docker_password
+    repo: git.mrmeeb.stream/mrmeeb/simple-login
+    platforms:
+      - linux/arm64
+      - linux/amd64
+
+- name: notify
+  image: plugins/slack
+  when:
+    status:
+    - success
+    - failure
+    - killed
+  settings:
+    webhook: 
+      from_secret: slack_webhook
+    icon_url:
+      from_secret: slack_avatar
+
+trigger:
+  event:
+    include:
+    - tag
+  ref:
+    include:
+    - refs/tags/**

.gitea/workflows/build-release-image.yaml

@@ -1,195 +0,0 @@
-name: Build-Release-Image
-on:
-  push:
-    tags:
-      - '*'
-
-env:
-  CONTAINER_NAME: git.mrmeeb.stream/mrmeeb/simple-login
-  TEA_VERSION: 0.9.2
-
-jobs:
-
-  Build-Image:
-    runs-on: [ubuntu-docker-latest, "${{ matrix.platform }}"]
-    strategy:
-      fail-fast: false
-      matrix:
-        platform:
-          - linux/amd64
-          - linux/arm64
-    steps:
-      - name: Prepare
-        run: |
-          platform=${{ matrix.platform }}
-          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
-          echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
-      - name: Checkout
-        uses: actions/checkout@v2
-      # Not needed currently due to https://github.com/go-gitea/gitea/issues/29563
-      #- name: Prepare tags
-      #  id: meta
-      #  uses: docker/metadata-action@v5
-      #  with:
-      #    images: ${{ env.CONTAINER_NAME }}
-      #    tags: |
-      #      type=pep440,pattern={{version}}
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Login to Gitea Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: git.mrmeeb.stream
-          username: ${{ env.GITHUB_ACTOR }}
-          password: ${{ secrets.GTCR_TOKEN }}
-      - name: Build and push by digest
-        uses: docker/build-push-action@v5
-        id: build
-        with:
-          context: ./app
-          platforms: ${{ matrix.platform }}
-          provenance: false
-          outputs: type=image,name=${{ env.CONTAINER_NAME }},push-by-digest=true,name-canonical=true,push=true
-      - name: Export digest
-        run: |
-          mkdir -p /tmp/digests
-          digest="${{ steps.build.outputs.digest }}"
-          touch "/tmp/digests/${digest#sha256:}"
-      - name: Upload digest
-        uses: actions/upload-artifact@v3
-        with:
-          name: digests-${{ env.PLATFORM_PAIR }}
-          path: /tmp/digests/*
-          if-no-files-found: error
-          retention-days: 1
-      - name: Notify
-        uses: rjstone/discord-webhook-notify@v1
-        if: failure()
-        with:
-          severity: ${{ job.status == 'success' && 'info' || (job.status == 'cancelled' && 'warn' || 'error') }}
-          details: Build ${{ job.status == 'success' && 'succeeded' || (job.status == 'cancelled' && 'cancelled' || 'failed') }}!
-          webhookUrl: ${{ secrets.DISCORD_WEBHOOK }}
-          username: Gitea
-          avatarUrl: ${{ vars.RUNNER_ICON_URL }}
-
-  Merge-Images:
-    runs-on: ubuntu-docker-latest
-    needs: [Build-Image]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v2
-      - name: Get tag
-        run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
-      - name: Download digests
-        uses: actions/download-artifact@v3
-        with:
-          path: /tmp/digests
-          pattern: digests-*
-          merge-multiple: true
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      # Not needed currently due to https://github.com/go-gitea/gitea/issues/29563
-      #- name: Prepare Docker metadata
-      #  id: meta
-      #  uses: docker/metadata-action@v5
-      #  with:
-      #    images: ${{ env.CONTAINER_NAME }}
-      - name: Login to Gitea Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: git.mrmeeb.stream
-          username: ${{ env.GITHUB_ACTOR }}
-          password: ${{ secrets.GTCR_TOKEN }}
-      - name: Create manifest latest
-        working-directory: /tmp/digests
-        run: |
-          docker manifest create ${{ env.CONTAINER_NAME }}:latest \
-            --amend ${{ env.CONTAINER_NAME }}@sha256:$(ls -p digests-linux-amd64/* | cut -d / -f 2) \
-            --amend ${{ env.CONTAINER_NAME }}@sha256:$(ls -p digests-linux-arm64/* | cut -d / -f 2)
-          #docker manifest annotate --arch amd64 --os linux ${{ env.CONTAINER_NAME }}:latest ${{ env.CONTAINER_NAME }}@sha256:$(ls -p digests-linux-amd64/* | cut -d / -f 2)
-          #docker manifest annotate --arch arm64 --os linux ${{ env.CONTAINER_NAME }}:latest ${{ env.CONTAINER_NAME }}@sha256:$(ls -p digests-linux-arm64/* | cut -d / -f 2)
-          docker manifest inspect ${{ env.CONTAINER_NAME }}:latest
-
-          docker manifest push ${{ env.CONTAINER_NAME }}:latest
-      - name: Create manifest tagged
-        working-directory: /tmp/digests
-        run: |
-          docker manifest create ${{ env.CONTAINER_NAME }}:${{ env.RELEASE_VERSION }} \
-            --amend ${{ env.CONTAINER_NAME }}@sha256:$(ls -p digests-linux-amd64/* | cut -d / -f 2) \
-            --amend ${{ env.CONTAINER_NAME }}@sha256:$(ls -p digests-linux-arm64/* | cut -d / -f 2)
-          #docker manifest annotate --arch amd64 --os linux ${{ env.CONTAINER_NAME }}:${{ env.RELEASE_VERSION }} ${{ env.CONTAINER_NAME }}@sha256:$(ls -p digests-linux-amd64/* | cut -d / -f 2)
-          #docker manifest annotate --arch arm64 --os linux ${{ env.CONTAINER_NAME }}:${{ env.RELEASE_VERSION }} ${{ env.CONTAINER_NAME }}@sha256:$(ls -p digests-linux-arm64/* | cut -d / -f 2)
-          docker manifest inspect ${{ env.CONTAINER_NAME }}:${{ env.RELEASE_VERSION }}
-
-          docker manifest push ${{ env.CONTAINER_NAME }}:${{ env.RELEASE_VERSION }}
-      # Disabled due to https://github.com/go-gitea/gitea/issues/29563
-      #- name: Create manifest list and push
-      #  working-directory: /tmp/digests
-      #  run: |
-      #    echo $DOCKER_METADATA_OUTPUT_JSON
-      #    echo $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-      #      $(printf '${{ env.CONTAINER_NAME }}@sha256:%s ' $(ls -p */* | cut -d / -f 2))
-      #    docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-      #      $(printf '${{ env.CONTAINER_NAME }}@sha256:%s ' $(ls -p */* | cut -d / -f 2))
-      #- name: Inspect image
-      #  run: |
-      #    docker buildx imagetools inspect ${{ env.CONTAINER_NAME }}:${{ steps.meta.outputs.version }}          
-      - name: Notify
-        uses: rjstone/discord-webhook-notify@v1
-        if: failure()
-        with:
-          severity: ${{ job.status == 'success' && 'info' || (job.status == 'cancelled' && 'warn' || 'error') }}
-          details: Build ${{ job.status == 'success' && 'succeeded' || (job.status == 'cancelled' && 'cancelled' || 'failed') }}!
-          webhookUrl: ${{ secrets.DISCORD_WEBHOOK }}
-          username: Gitea
-          avatarUrl: ${{ vars.RUNNER_ICON_URL }}
-
-  Create-Release:
-    runs-on: [ubuntu-latest, linux/amd64]
-    needs: [Merge-Images]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v2
-      - name: Get tag
-        run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
-      - name: Prepare tea
-        run: |
-          # Download tea from Gitea release page
-          echo "Downloading Tea v${{ env.TEA_VERSION }}" && \
-          wget -q -O tea https://gitea.com/gitea/tea/releases/download/v${{ env.TEA_VERSION }}/tea-${{ env.TEA_VERSION }}-linux-amd64 && \
-          echo "Downloaded Tea" && \
-          chmod +x tea && \
-          # Login to Gitea
-          echo "Logging in to Gitea using Tea" && \
-          ./tea login add --name SimpleLogin --url https://git.mrmeeb.stream --token ${{ secrets.GITHUB_TOKEN }} && \
-          echo "Done"
-      - name: Make release
-        run: |
-          echo "Creating release" && \
-          ./tea release create --login "SimpleLogin" --repo ${{ env.GITHUB_REPOSITORY }} --tag ${{ env.RELEASE_VERSION }} -t ${{ env.RELEASE_VERSION }} -n "Triggered by release of v${{ env.RELEASE_VERSION }} by the SimpleLogin team. <a href=\"https://github.com/simple-login/app/releases/tag/v${{ env.RELEASE_VERSION }}\" target=\"_blank\">View the changelog</a>" && \
-          echo "Done"
-      - name: Notify
-        uses: rjstone/discord-webhook-notify@v1
-        if: failure()
-        with:
-          severity: ${{ job.status == 'success' && 'info' || (job.status == 'cancelled' && 'warn' || 'error') }}
-          details: Release ${{ job.status == 'success' && 'succeeded' || (job.status == 'cancelled' && 'cancelled' || 'failed') }}!
-          webhookUrl: ${{ secrets.DISCORD_WEBHOOK }}
-          username: Gitea
-          avatarUrl: ${{ vars.RUNNER_ICON_URL }}
-
-  Notify:
-    runs-on: ubuntu-latest
-    needs: [Build-Image, Merge-Images, Create-Release]
-    steps:
-      - name: Notify
-        uses: rjstone/discord-webhook-notify@v1
-        if: always()
-        with:
-          severity: ${{ job.status == 'success' && 'info' || (job.status == 'cancelled' && 'warn' || 'error') }}
-          details: Release ${{ job.status == 'success' && 'succeeded' || (job.status == 'cancelled' && 'cancelled' || 'failed') }}!
-          webhookUrl: ${{ secrets.DISCORD_WEBHOOK }}
-          username: Gitea
-          avatarUrl: ${{ vars.RUNNER_ICON_URL }}

app/.github/workflows/main.yml

@@ -1,6 +1,7 @@
 name: Test and lint
 
-on: [push, pull_request]
+on:
+  push:
 
 jobs:
   lint:
@@ -138,12 +139,6 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-
       - name: Create Sentry release
         uses: getsentry/action-release@v1
         env:
@@ -163,7 +158,6 @@ jobs:
         uses: docker/build-push-action@v3
         with:
           context: .
-          platforms: linux/amd64,linux/arm64
           push: true
           tags: ${{ steps.meta.outputs.tags }}
 

app/CONTRIBUTING.md

@@ -68,12 +68,6 @@ For most tests, you will need to have ``redis`` installed and started on your ma
 sh scripts/run-test.sh
 ```
 
-You can also run tests using a local Postgres DB to speed things up. This can be done by
-
-- creating an empty test DB and running the database migration by `dropdb test && createdb test && DB_URI=postgresql://localhost:5432/test alembic upgrade head`
-
-- replacing the `DB_URI` in `test.env` file by `DB_URI=postgresql://localhost:5432/test`
-
 ## Run the code locally
 
 Install npm packages
@@ -157,10 +151,10 @@ Here are the small sum-ups of the directory structures and their roles:
 
 ## Pull request
 
-The code is formatted using [ruff](https://github.com/astral-sh/ruff), to format the code, simply run
+The code is formatted using https://github.com/psf/black, to format the code, simply run
 
 ```
-poetry run ruff format .
+poetry run black .
 ```
 
 The code is also checked with `flake8`, make sure to run `flake8` before creating the pull request by

app/README.md

@@ -74,7 +74,7 @@ Setting up DKIM is highly recommended to reduce the chance your emails ending up
 First you need to generate a private and public key for DKIM:
 
 ```bash
-openssl genrsa -out dkim.key -traditional 1024
+openssl genrsa -out dkim.key 1024
 openssl rsa -in dkim.key -pubout -out dkim.pub.key
 ```
 
@@ -510,14 +510,11 @@ server {
     server_name  app.mydomain.com;
 
     location / {
-        proxy_pass              http://localhost:7777;
+        proxy_pass http://localhost:7777;
-    	proxy_set_header        Host $host;
     }
 }
 ```
 
-Note: If `/etc/nginx/sites-enabled/default` exists, delete it or certbot will fail due to the conflict. The `simplelogin` file should be the only file in `sites-enabled`.
-
 Reload Nginx with the command below
 
 ```bash

app/app/account_linking.py

@@ -168,8 +168,6 @@ class NewUserStrategy(ClientMergeStrategy):
 
 class ExistingUnlinkedUserStrategy(ClientMergeStrategy):
     def process(self) -> LinkResult:
-        # IF it was scheduled to be deleted. Unschedule it.
-        self.user.delete_on = None
         partner_user = ensure_partner_user_exists_for_user(
             self.link_request, self.user, self.partner
         )
@@ -248,8 +246,6 @@ def link_user(
 ) -> LinkResult:
     # Sanitize email just in case
     link_request.email = sanitize_email(link_request.email)
-    # If it was scheduled to be deleted. Unschedule it.
-    current_user.delete_on = None
     partner_user = ensure_partner_user_exists_for_user(
         link_request, current_user, partner
     )

app/app/admin_model.py

@@ -46,8 +46,7 @@ class SLModelView(sqla.ModelView):
 
     def inaccessible_callback(self, name, **kwargs):
         # redirect to login page if user doesn't have access
-        flash("You don't have access to the admin page", "error")
+        return redirect(url_for("auth.login", next=request.url))
-        return redirect(url_for("dashboard.index", next=request.url))
 
     def on_model_change(self, form, model, is_created):
         changes = {}
@@ -215,20 +214,6 @@ class UserAdmin(SLModelView):
 
         Session.commit()
 
-    @action(
-        "remove trial",
-        "Stop trial period",
-        "Remove trial for this user?",
-    )
-    def stop_trial(self, ids):
-        for user in User.filter(User.id.in_(ids)):
-            user.trial_end = None
-
-            flash(f"Stopped trial for {user}", "success")
-            AdminAuditLog.stop_trial(current_user.id, user.id)
-
-        Session.commit()
-
     @action(
         "disable_otp_fido",
         "Disable OTP & FIDO",

app/app/alias_utils.py

@@ -25,8 +25,6 @@ from app.email_utils import (
     render,
 )
 from app.errors import AliasInTrashError
-from app.events.event_dispatcher import EventDispatcher
-from app.events.generated.event_pb2 import AliasDeleted, AliasStatusChange, EventContent
 from app.log import LOG
 from app.models import (
     Alias,
@@ -310,36 +308,31 @@ def delete_alias(alias: Alias, user: User):
     Delete an alias and add it to either global or domain trash
     Should be used instead of Alias.delete, DomainDeletedAlias.create, DeletedAlias.create
     """
-    LOG.i(f"User {user} has deleted alias {alias}")
+    # save deleted alias to either global or domain trash
-    # save deleted alias to either global or domain tra
     if alias.custom_domain_id:
         if not DomainDeletedAlias.get_by(
             email=alias.email, domain_id=alias.custom_domain_id
         ):
-            domain_deleted_alias = DomainDeletedAlias(
+            LOG.d("add %s to domain %s trash", alias, alias.custom_domain_id)
-                user_id=user.id,
+            Session.add(
-                email=alias.email,
+                DomainDeletedAlias(
-                domain_id=alias.custom_domain_id,
+                    user_id=user.id,
+                    email=alias.email,
+                    domain_id=alias.custom_domain_id,
+                )
             )
-            Session.add(domain_deleted_alias)
             Session.commit()
-            LOG.i(
+
-                f"Moving {alias} to domain {alias.custom_domain_id} trash {domain_deleted_alias}"
-            )
     else:
         if not DeletedAlias.get_by(email=alias.email):
-            deleted_alias = DeletedAlias(email=alias.email)
+            LOG.d("add %s to global trash", alias)
-            Session.add(deleted_alias)
+            Session.add(DeletedAlias(email=alias.email))
             Session.commit()
-            LOG.i(f"Moving {alias} to global trash {deleted_alias}")
 
+    LOG.i("delete alias %s", alias)
     Alias.filter(Alias.id == alias.id).delete()
     Session.commit()
 
-    EventDispatcher.send_event(
-        user, EventContent(alias_deleted=AliasDeleted(alias_id=alias.id))
-    )
-
 
 def aliases_for_mailbox(mailbox: Mailbox) -> [Alias]:
     """
@@ -465,15 +458,3 @@ def transfer_alias(alias, new_user, new_mailboxes: [Mailbox]):
     alias.pinned = False
 
     Session.commit()
-
-
-def change_alias_status(alias: Alias, enabled: bool, commit: bool = False):
-    alias.enabled = enabled
-
-    event = AliasStatusChange(
-        alias_id=alias.id, alias_email=alias.email, enabled=enabled
-    )
-    EventDispatcher.send_event(alias.user, EventContent(alias_status_change=event))
-
-    if commit:
-        Session.commit()

app/app/api/base.py

@@ -33,9 +33,6 @@ def authorize_request() -> Optional[Tuple[str, int]]:
     if g.user.disabled:
         return jsonify(error="Disabled account"), 403
 
-    if not g.user.is_active():
-        return jsonify(error="Account does not exist"), 401
-
     g.api_key = api_key
     return None
 

app/app/api/serializer.py

@@ -201,10 +201,10 @@ def get_alias_infos_with_pagination_v3(
         q = q.order_by(Alias.pinned.desc())
         q = q.order_by(latest_activity.desc())
 
-    q = q.limit(page_limit).offset(page_id * page_size)
+    q = list(q.limit(page_limit).offset(page_id * page_size))
 
     ret = []
-    for alias, contact, email_log, nb_reply, nb_blocked, nb_forward in list(q):
+    for alias, contact, email_log, nb_reply, nb_blocked, nb_forward in q:
         ret.append(
             AliasInfo(
                 alias=alias,
@@ -358,6 +358,7 @@ def construct_alias_query(user: User):
                     else_=0,
                 )
             ).label("nb_forward"),
+            func.max(EmailLog.created_at).label("latest_email_log_created_at"),
         )
         .join(EmailLog, Alias.id == EmailLog.alias_id, isouter=True)
         .filter(Alias.user_id == user.id)
@@ -365,6 +366,14 @@ def construct_alias_query(user: User):
         .subquery()
     )
 
+    alias_contact_subquery = (
+        Session.query(Alias.id, func.max(Contact.id).label("max_contact_id"))
+        .join(Contact, Alias.id == Contact.alias_id, isouter=True)
+        .filter(Alias.user_id == user.id)
+        .group_by(Alias.id)
+        .subquery()
+    )
+
     return (
         Session.query(
             Alias,
@@ -376,7 +385,23 @@ def construct_alias_query(user: User):
         )
         .options(joinedload(Alias.hibp_breaches))
         .options(joinedload(Alias.custom_domain))
-        .join(EmailLog, Alias.last_email_log_id == EmailLog.id, isouter=True)
+        .join(Contact, Alias.id == Contact.alias_id, isouter=True)
-        .join(Contact, EmailLog.contact_id == Contact.id, isouter=True)
+        .join(EmailLog, Contact.id == EmailLog.contact_id, isouter=True)
         .filter(Alias.id == alias_activity_subquery.c.id)
+        .filter(Alias.id == alias_contact_subquery.c.id)
+        .filter(
+            or_(
+                EmailLog.created_at
+                == alias_activity_subquery.c.latest_email_log_created_at,
+                and_(
+                    # no email log yet for this alias
+                    alias_activity_subquery.c.latest_email_log_created_at.is_(None),
+                    # to make sure only 1 contact is returned in this case
+                    or_(
+                        Contact.id == alias_contact_subquery.c.max_contact_id,
+                        alias_contact_subquery.c.max_contact_id.is_(None),
+                    ),
+                ),
+            )
+        )
     )

app/app/api/views/alias.py

@@ -31,7 +31,6 @@ from app.models import Alias, Contact, Mailbox, AliasMailbox
 @deprecated
 @api_bp.route("/aliases", methods=["GET", "POST"])
 @require_api_auth
-@limiter.limit("10/minute", key_func=lambda: g.user.id)
 def get_aliases():
     """
     Get aliases
@@ -73,8 +72,10 @@ def get_aliases():
 
 
 @api_bp.route("/v2/aliases", methods=["GET", "POST"])
+@limiter.limit(
+    "5/minute",
+)
 @require_api_auth
-@limiter.limit("50/minute", key_func=lambda: g.user.id)
 def get_aliases_v2():
     """
     Get aliases
@@ -184,7 +185,7 @@ def toggle_alias(alias_id):
     if not alias or alias.user_id != user.id:
         return jsonify(error="Forbidden"), 403
 
-    alias_utils.change_alias_status(alias, enabled=not alias.enabled)
+    alias.enabled = not alias.enabled
     Session.commit()
 
     return jsonify(enabled=alias.enabled), 200

app/app/api/views/apple.py

@@ -17,14 +17,9 @@ from app.models import PlanEnum, AppleSubscription
 _MONTHLY_PRODUCT_ID = "io.simplelogin.ios_app.subscription.premium.monthly"
 _YEARLY_PRODUCT_ID = "io.simplelogin.ios_app.subscription.premium.yearly"
 
-# SL Mac app used to be in SL account
 _MACAPP_MONTHLY_PRODUCT_ID = "io.simplelogin.macapp.subscription.premium.monthly"
 _MACAPP_YEARLY_PRODUCT_ID = "io.simplelogin.macapp.subscription.premium.yearly"
 
-# SL Mac app is moved to Proton account
-_MACAPP_MONTHLY_PRODUCT_ID_NEW = "me.proton.simplelogin.macos.premium.monthly"
-_MACAPP_YEARLY_PRODUCT_ID_NEW = "me.proton.simplelogin.macos.premium.yearly"
-
 # Apple API URL
 _SANDBOX_URL = "https://sandbox.itunes.apple.com/verifyReceipt"
 _PROD_URL = "https://buy.itunes.apple.com/verifyReceipt"
@@ -268,11 +263,7 @@ def apple_update_notification():
         plan = (
             PlanEnum.monthly
             if transaction["product_id"]
-            in (
+            in (_MONTHLY_PRODUCT_ID, _MACAPP_MONTHLY_PRODUCT_ID)
-                _MONTHLY_PRODUCT_ID,
-                _MACAPP_MONTHLY_PRODUCT_ID,
-                _MACAPP_MONTHLY_PRODUCT_ID_NEW,
-            )
             else PlanEnum.yearly
         )
 
@@ -526,11 +517,7 @@ def verify_receipt(receipt_data, user, password) -> Optional[AppleSubscription]:
     plan = (
         PlanEnum.monthly
         if latest_transaction["product_id"]
-        in (
+        in (_MONTHLY_PRODUCT_ID, _MACAPP_MONTHLY_PRODUCT_ID)
-            _MONTHLY_PRODUCT_ID,
-            _MACAPP_MONTHLY_PRODUCT_ID,
-            _MACAPP_MONTHLY_PRODUCT_ID_NEW,
-        )
         else PlanEnum.yearly
     )
 

app/app/api/views/auth.py

@@ -11,7 +11,7 @@ from itsdangerous import Signer
 from app import email_utils
 from app.api.base import api_bp
 from app.config import FLASK_SECRET, DISABLE_REGISTRATION
-from app.dashboard.views.account_setting import send_reset_password_email
+from app.dashboard.views.setting import send_reset_password_email
 from app.db import Session
 from app.email_utils import (
     email_can_be_used_as_mailbox,

app/app/api/views/user_info.py

@@ -32,7 +32,6 @@ def user_to_dict(user: User) -> dict:
         "in_trial": user.in_trial(),
         "max_alias_free_plan": user.max_alias_for_free_account(),
         "connected_proton_address": None,
-        "can_create_reverse_alias": user.can_create_contacts(),
     }
 
     if config.CONNECT_WITH_PROTON:
@@ -59,7 +58,6 @@ def user_info():
     - in_trial
     - max_alias_free
     - is_connected_with_proton
-    - can_create_reverse_alias
     """
     user = g.user
 

app/app/auth/__init__.py

@@ -16,7 +16,6 @@ from .views import (
     social,
     recovery,
     api_to_cookie,
-    oidc,
 )
 
 __all__ = [
@@ -37,5 +36,4 @@ __all__ = [
     "social",
     "recovery",
     "api_to_cookie",
-    "oidc",
 ]

app/app/auth/views/change_email.py

@@ -3,13 +3,10 @@ from flask_login import login_user
 
 from app.auth.base import auth_bp
 from app.db import Session
-from app.extensions import limiter
-from app.log import LOG
 from app.models import EmailChange, ResetPasswordCode
 
 
 @auth_bp.route("/change_email", methods=["GET", "POST"])
-@limiter.limit("3/hour")
 def change_email():
     code = request.args.get("code")
 
@@ -25,14 +22,12 @@ def change_email():
         return render_template("auth/change_email.html")
 
     user = email_change.user
-    old_email = user.email
     user.email = email_change.new_email
 
     EmailChange.delete(email_change.id)
     ResetPasswordCode.filter_by(user_id=user.id).delete()
     Session.commit()
 
-    LOG.i(f"User {user} has changed their email from {old_email} to {user.email}")
     flash("Your new email has been updated", "success")
 
     login_user(user)

app/app/auth/views/forgot_password.py

@@ -3,7 +3,7 @@ from flask_wtf import FlaskForm
 from wtforms import StringField, validators
 
 from app.auth.base import auth_bp
-from app.dashboard.views.account_setting import send_reset_password_email
+from app.dashboard.views.setting import send_reset_password_email
 from app.extensions import limiter
 from app.log import LOG
 from app.models import User

app/app/auth/views/google.py

@@ -7,7 +7,7 @@ from app.config import URL, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET
 from app.db import Session
 from app.log import LOG
 from app.models import User, File, SocialAuth
-from app.utils import random_string, sanitize_email, sanitize_next_url
+from app.utils import random_string, sanitize_email
 from .login_utils import after_login
 
 _authorization_base_url = "https://accounts.google.com/o/oauth2/v2/auth"
@@ -29,7 +29,7 @@ def google_login():
     # to avoid flask-login displaying the login error message
     session.pop("_flashes", None)
 
-    next_url = sanitize_next_url(request.args.get("next"))
+    next_url = request.args.get("next")
 
     # Google does not allow to append param to redirect_url
     # we need to pass the next url by session

app/app/auth/views/login.py

@@ -5,7 +5,7 @@ from wtforms import StringField, validators
 
 from app.auth.base import auth_bp
 from app.auth.views.login_utils import after_login
-from app.config import CONNECT_WITH_PROTON, CONNECT_WITH_OIDC_ICON, OIDC_CLIENT_ID
+from app.config import CONNECT_WITH_PROTON
 from app.events.auth_event import LoginEvent
 from app.extensions import limiter
 from app.log import LOG
@@ -77,6 +77,4 @@ def login():
         next_url=next_url,
         show_resend_activation=show_resend_activation,
         connect_with_proton=CONNECT_WITH_PROTON,
-        connect_with_oidc=OIDC_CLIENT_ID is not None,
-        connect_with_oidc_icon=CONNECT_WITH_OIDC_ICON,
     )

app/app/auth/views/oidc.py

@@ -1,135 +0,0 @@
-from flask import request, session, redirect, flash, url_for
-from requests_oauthlib import OAuth2Session
-
-import requests
-
-from app import config
-from app.auth.base import auth_bp
-from app.auth.views.login_utils import after_login
-from app.config import (
-    URL,
-    OIDC_SCOPES,
-    OIDC_NAME_FIELD,
-)
-from app.db import Session
-from app.email_utils import send_welcome_email
-from app.log import LOG
-from app.models import User, SocialAuth
-from app.utils import sanitize_email, sanitize_next_url
-
-
-# need to set explicitly redirect_uri instead of leaving the lib to pre-fill redirect_uri
-# when served behind nginx, the redirect_uri is localhost... and not the real url
-redirect_uri = URL + "/auth/oidc/callback"
-
-SESSION_STATE_KEY = "oauth_state"
-SESSION_NEXT_KEY = "oauth_redirect_next"
-
-
-@auth_bp.route("/oidc/login")
-def oidc_login():
-    if config.OIDC_CLIENT_ID is None or config.OIDC_CLIENT_SECRET is None:
-        return redirect(url_for("auth.login"))
-
-    next_url = sanitize_next_url(request.args.get("next"))
-
-    auth_url = requests.get(config.OIDC_WELL_KNOWN_URL).json()["authorization_endpoint"]
-
-    oidc = OAuth2Session(
-        config.OIDC_CLIENT_ID, scope=[OIDC_SCOPES], redirect_uri=redirect_uri
-    )
-    authorization_url, state = oidc.authorization_url(auth_url)
-
-    # State is used to prevent CSRF, keep this for later.
-    session[SESSION_STATE_KEY] = state
-    session[SESSION_NEXT_KEY] = next_url
-    return redirect(authorization_url)
-
-
-@auth_bp.route("/oidc/callback")
-def oidc_callback():
-    if SESSION_STATE_KEY not in session:
-        flash("Invalid state, please retry", "error")
-        return redirect(url_for("auth.login"))
-    if config.OIDC_CLIENT_ID is None or config.OIDC_CLIENT_SECRET is None:
-        return redirect(url_for("auth.login"))
-
-    # user clicks on cancel
-    if "error" in request.args:
-        flash("Please use another sign in method then", "warning")
-        return redirect("/")
-
-    oidc_configuration = requests.get(config.OIDC_WELL_KNOWN_URL).json()
-    user_info_url = oidc_configuration["userinfo_endpoint"]
-    token_url = oidc_configuration["token_endpoint"]
-
-    oidc = OAuth2Session(
-        config.OIDC_CLIENT_ID,
-        state=session[SESSION_STATE_KEY],
-        scope=[OIDC_SCOPES],
-        redirect_uri=redirect_uri,
-    )
-    oidc.fetch_token(
-        token_url,
-        client_secret=config.OIDC_CLIENT_SECRET,
-        authorization_response=request.url,
-    )
-
-    oidc_user_data = oidc.get(user_info_url)
-    if oidc_user_data.status_code != 200:
-        LOG.e(
-            f"cannot get oidc user data {oidc_user_data.status_code} {oidc_user_data.text}"
-        )
-        flash(
-            "Cannot get user data from OIDC, please use another way to login/sign up",
-            "error",
-        )
-        return redirect(url_for("auth.login"))
-    oidc_user_data = oidc_user_data.json()
-
-    email = oidc_user_data.get("email")
-
-    if not email:
-        LOG.e(f"cannot get email for OIDC user {oidc_user_data} {email}")
-        flash(
-            "Cannot get a valid email from OIDC, please another way to login/sign up",
-            "error",
-        )
-        return redirect(url_for("auth.login"))
-
-    email = sanitize_email(email)
-    user = User.get_by(email=email)
-
-    if not user and config.DISABLE_REGISTRATION:
-        flash(
-            "Sorry you cannot sign up via the OIDC provider. Please sign-up first with your email.",
-            "error",
-        )
-        return redirect(url_for("auth.register"))
-    elif not user:
-        user = create_user(email, oidc_user_data)
-
-    if not SocialAuth.get_by(user_id=user.id, social="oidc"):
-        SocialAuth.create(user_id=user.id, social="oidc")
-        Session.commit()
-
-    # The activation link contains the original page, for ex authorize page
-    next_url = session[SESSION_NEXT_KEY]
-    session[SESSION_NEXT_KEY] = None
-
-    return after_login(user, next_url)
-
-
-def create_user(email, oidc_user_data):
-    new_user = User.create(
-        email=email,
-        name=oidc_user_data.get(OIDC_NAME_FIELD),
-        password="",
-        activated=True,
-    )
-    LOG.i(f"Created new user for login request from OIDC. New user {new_user.id}")
-    Session.commit()
-
-    send_welcome_email(new_user)
-
-    return new_user

app/app/auth/views/register.py

@@ -6,7 +6,7 @@ from wtforms import StringField, validators
 
 from app import email_utils, config
 from app.auth.base import auth_bp
-from app.config import CONNECT_WITH_PROTON, CONNECT_WITH_OIDC_ICON
+from app.config import CONNECT_WITH_PROTON
 from app.auth.views.login_utils import get_referral
 from app.config import URL, HCAPTCHA_SECRET, HCAPTCHA_SITEKEY
 from app.db import Session
@@ -109,8 +109,6 @@ def register():
         next_url=next_url,
         HCAPTCHA_SITEKEY=HCAPTCHA_SITEKEY,
         connect_with_proton=CONNECT_WITH_PROTON,
-        connect_with_oidc=config.OIDC_CLIENT_ID is not None,
-        connect_with_oidc_icon=CONNECT_WITH_OIDC_ICON,
     )
 
 

app/app/config.py

@@ -234,7 +234,7 @@ else:
 
     print("WARNING: Use a temp directory for GNUPGHOME", GNUPGHOME)
 
-# Github, Google, Facebook, OIDC client id and secrets
+# Github, Google, Facebook client id and secrets
 GITHUB_CLIENT_ID = os.environ.get("GITHUB_CLIENT_ID")
 GITHUB_CLIENT_SECRET = os.environ.get("GITHUB_CLIENT_SECRET")
 
@@ -244,13 +244,6 @@ GOOGLE_CLIENT_SECRET = os.environ.get("GOOGLE_CLIENT_SECRET")
 FACEBOOK_CLIENT_ID = os.environ.get("FACEBOOK_CLIENT_ID")
 FACEBOOK_CLIENT_SECRET = os.environ.get("FACEBOOK_CLIENT_SECRET")
 
-CONNECT_WITH_OIDC_ICON = os.environ.get("CONNECT_WITH_OIDC_ICON")
-OIDC_WELL_KNOWN_URL = os.environ.get("OIDC_WELL_KNOWN_URL")
-OIDC_CLIENT_ID = os.environ.get("OIDC_CLIENT_ID")
-OIDC_CLIENT_SECRET = os.environ.get("OIDC_CLIENT_SECRET")
-OIDC_SCOPES = os.environ.get("OIDC_SCOPES")
-OIDC_NAME_FIELD = os.environ.get("OIDC_NAME_FIELD", "name")
-
 PROTON_CLIENT_ID = os.environ.get("PROTON_CLIENT_ID")
 PROTON_CLIENT_SECRET = os.environ.get("PROTON_CLIENT_SECRET")
 PROTON_BASE_URL = os.environ.get(
@@ -428,11 +421,6 @@ try:
 except Exception:
     HIBP_SCAN_INTERVAL_DAYS = 7
 HIBP_API_KEYS = sl_getenv("HIBP_API_KEYS", list) or []
-HIBP_MAX_ALIAS_CHECK = 10_000
-HIBP_RPM = int(os.environ.get("HIBP_API_RPM", 100))
-HIBP_SKIP_PARTNER_ALIAS = os.environ.get("HIBP_SKIP_PARTNER_ALIAS")
-
-KEEP_OLD_DATA_DAYS = 30
 
 POSTMASTER = os.environ.get("POSTMASTER")
 
@@ -501,34 +489,7 @@ def setup_nameservers():
 
 NAMESERVERS = setup_nameservers()
 
-DISABLE_CREATE_CONTACTS_FOR_FREE_USERS = os.environ.get(
+DISABLE_CREATE_CONTACTS_FOR_FREE_USERS = False
-    "DISABLE_CREATE_CONTACTS_FOR_FREE_USERS", False
-)
-
-
-# Expect format hits,seconds:hits,seconds...
-# Example 1,10:4,60 means 1 in the last 10 secs or 4 in the last 60 secs
-def getRateLimitFromConfig(
-    env_var: string, default: string = ""
-) -> list[tuple[int, int]]:
-    value = os.environ.get(env_var, default)
-    if not value:
-        return []
-    entries = [entry for entry in value.split(":")]
-    limits = []
-    for entry in entries:
-        fields = entry.split(",")
-        limit = (int(fields[0]), int(fields[1]))
-        limits.append(limit)
-    return limits
-
-
-ALIAS_CREATE_RATE_LIMIT_FREE = getRateLimitFromConfig(
-    "ALIAS_CREATE_RATE_LIMIT_FREE", "10,900:50,3600"
-)
-ALIAS_CREATE_RATE_LIMIT_PAID = getRateLimitFromConfig(
-    "ALIAS_CREATE_RATE_LIMIT_PAID", "50,900:200,3600"
-)
 PARTNER_API_TOKEN_SECRET = os.environ.get("PARTNER_API_TOKEN_SECRET") or (
     FLASK_SECRET + "partnerapitoken"
 )
@@ -579,11 +540,3 @@ MAX_API_KEYS = int(os.environ.get("MAX_API_KEYS", 30))
 UPCLOUD_USERNAME = os.environ.get("UPCLOUD_USERNAME", None)
 UPCLOUD_PASSWORD = os.environ.get("UPCLOUD_PASSWORD", None)
 UPCLOUD_DB_ID = os.environ.get("UPCLOUD_DB_ID", None)
-
-STORE_TRANSACTIONAL_EMAILS = "STORE_TRANSACTIONAL_EMAILS" in os.environ
-
-EVENT_WEBHOOK = os.environ.get("EVENT_WEBHOOK", None)
-
-# We want it disabled by default, so only skip if defined
-EVENT_WEBHOOK_SKIP_VERIFY_SSL = "EVENT_WEBHOOK_SKIP_VERIFY_SSL" in os.environ
-EVENT_WEBHOOK_DISABLE = "EVENT_WEBHOOK_DISABLE" in os.environ

app/app/dashboard/__init__.py

@@ -32,7 +32,6 @@ from .views import (
     delete_account,
     notification,
     support,
-    account_setting,
 )
 
 __all__ = [
@@ -69,5 +68,4 @@ __all__ = [
     "delete_account",
     "notification",
     "support",
-    "account_setting",
 ]

app/app/dashboard/views/account_setting.py

@@ -1,242 +0,0 @@
-import arrow
-from flask import (
-    render_template,
-    request,
-    redirect,
-    url_for,
-    flash,
-)
-from flask_login import login_required, current_user
-
-from app import email_utils
-from app.config import (
-    URL,
-    FIRST_ALIAS_DOMAIN,
-    ALIAS_RANDOM_SUFFIX_LENGTH,
-    CONNECT_WITH_PROTON,
-)
-from app.dashboard.base import dashboard_bp
-from app.dashboard.views.enter_sudo import sudo_required
-from app.dashboard.views.mailbox_detail import ChangeEmailForm
-from app.db import Session
-from app.email_utils import (
-    email_can_be_used_as_mailbox,
-    personal_email_already_used,
-)
-from app.extensions import limiter
-from app.jobs.export_user_data_job import ExportUserDataJob
-from app.log import LOG
-from app.models import (
-    BlockBehaviourEnum,
-    PlanEnum,
-    ResetPasswordCode,
-    EmailChange,
-    User,
-    Alias,
-    AliasGeneratorEnum,
-    SenderFormatEnum,
-    UnsubscribeBehaviourEnum,
-)
-from app.proton.utils import perform_proton_account_unlink
-from app.utils import (
-    random_string,
-    CSRFValidationForm,
-    canonicalize_email,
-)
-
-
-@dashboard_bp.route("/account_setting", methods=["GET", "POST"])
-@login_required
-@sudo_required
-@limiter.limit("5/minute", methods=["POST"])
-def account_setting():
-    change_email_form = ChangeEmailForm()
-    csrf_form = CSRFValidationForm()
-
-    email_change = EmailChange.get_by(user_id=current_user.id)
-    if email_change:
-        pending_email = email_change.new_email
-    else:
-        pending_email = None
-
-    if request.method == "POST":
-        if not csrf_form.validate():
-            flash("Invalid request", "warning")
-            return redirect(url_for("dashboard.setting"))
-        if request.form.get("form-name") == "update-email":
-            if change_email_form.validate():
-                # whether user can proceed with the email update
-                new_email_valid = True
-                new_email = canonicalize_email(change_email_form.email.data)
-                if new_email != current_user.email and not pending_email:
-                    # check if this email is not already used
-                    if personal_email_already_used(new_email) or Alias.get_by(
-                        email=new_email
-                    ):
-                        flash(f"Email {new_email} already used", "error")
-                        new_email_valid = False
-                    elif not email_can_be_used_as_mailbox(new_email):
-                        flash(
-                            "You cannot use this email address as your personal inbox.",
-                            "error",
-                        )
-                        new_email_valid = False
-                    # a pending email change with the same email exists from another user
-                    elif EmailChange.get_by(new_email=new_email):
-                        other_email_change: EmailChange = EmailChange.get_by(
-                            new_email=new_email
-                        )
-                        LOG.w(
-                            "Another user has a pending %s with the same email address. Current user:%s",
-                            other_email_change,
-                            current_user,
-                        )
-
-                        if other_email_change.is_expired():
-                            LOG.d(
-                                "delete the expired email change %s", other_email_change
-                            )
-                            EmailChange.delete(other_email_change.id)
-                            Session.commit()
-                        else:
-                            flash(
-                                "You cannot use this email address as your personal inbox.",
-                                "error",
-                            )
-                            new_email_valid = False
-
-                    if new_email_valid:
-                        email_change = EmailChange.create(
-                            user_id=current_user.id,
-                            code=random_string(
-                                60
-                            ),  # todo: make sure the code is unique
-                            new_email=new_email,
-                        )
-                        Session.commit()
-                        send_change_email_confirmation(current_user, email_change)
-                        flash(
-                            "A confirmation email is on the way, please check your inbox",
-                            "success",
-                        )
-                        return redirect(url_for("dashboard.account_setting"))
-        elif request.form.get("form-name") == "change-password":
-            flash(
-                "You are going to receive an email containing instructions to change your password",
-                "success",
-            )
-            send_reset_password_email(current_user)
-            return redirect(url_for("dashboard.account_setting"))
-        elif request.form.get("form-name") == "send-full-user-report":
-            if ExportUserDataJob(current_user).store_job_in_db():
-                flash(
-                    "You will receive your SimpleLogin data via email shortly",
-                    "success",
-                )
-            else:
-                flash("An export of your data is currently in progress", "error")
-
-    partner_sub = None
-    partner_name = None
-
-    return render_template(
-        "dashboard/account_setting.html",
-        csrf_form=csrf_form,
-        PlanEnum=PlanEnum,
-        SenderFormatEnum=SenderFormatEnum,
-        BlockBehaviourEnum=BlockBehaviourEnum,
-        change_email_form=change_email_form,
-        pending_email=pending_email,
-        AliasGeneratorEnum=AliasGeneratorEnum,
-        UnsubscribeBehaviourEnum=UnsubscribeBehaviourEnum,
-        partner_sub=partner_sub,
-        partner_name=partner_name,
-        FIRST_ALIAS_DOMAIN=FIRST_ALIAS_DOMAIN,
-        ALIAS_RAND_SUFFIX_LENGTH=ALIAS_RANDOM_SUFFIX_LENGTH,
-        connect_with_proton=CONNECT_WITH_PROTON,
-    )
-
-
-def send_reset_password_email(user):
-    """
-    generate a new ResetPasswordCode and send it over email to user
-    """
-    # the activation code is valid for 1h
-    reset_password_code = ResetPasswordCode.create(
-        user_id=user.id, code=random_string(60)
-    )
-    Session.commit()
-
-    reset_password_link = f"{URL}/auth/reset_password?code={reset_password_code.code}"
-
-    email_utils.send_reset_password_email(user.email, reset_password_link)
-
-
-def send_change_email_confirmation(user: User, email_change: EmailChange):
-    """
-    send confirmation email to the new email address
-    """
-
-    link = f"{URL}/auth/change_email?code={email_change.code}"
-
-    email_utils.send_change_email(email_change.new_email, user.email, link)
-
-
-@dashboard_bp.route("/resend_email_change", methods=["GET", "POST"])
-@limiter.limit("5/hour")
-@login_required
-@sudo_required
-def resend_email_change():
-    form = CSRFValidationForm()
-    if not form.validate():
-        flash("Invalid request. Please try again", "warning")
-        return redirect(url_for("dashboard.setting"))
-    email_change = EmailChange.get_by(user_id=current_user.id)
-    if email_change:
-        # extend email change expiration
-        email_change.expired = arrow.now().shift(hours=12)
-        Session.commit()
-
-        send_change_email_confirmation(current_user, email_change)
-        flash("A confirmation email is on the way, please check your inbox", "success")
-        return redirect(url_for("dashboard.setting"))
-    else:
-        flash(
-            "You have no pending email change. Redirect back to Setting page", "warning"
-        )
-        return redirect(url_for("dashboard.setting"))
-
-
-@dashboard_bp.route("/cancel_email_change", methods=["GET", "POST"])
-@login_required
-@sudo_required
-def cancel_email_change():
-    form = CSRFValidationForm()
-    if not form.validate():
-        flash("Invalid request. Please try again", "warning")
-        return redirect(url_for("dashboard.setting"))
-    email_change = EmailChange.get_by(user_id=current_user.id)
-    if email_change:
-        EmailChange.delete(email_change.id)
-        Session.commit()
-        flash("Your email change is cancelled", "success")
-        return redirect(url_for("dashboard.setting"))
-    else:
-        flash(
-            "You have no pending email change. Redirect back to Setting page", "warning"
-        )
-        return redirect(url_for("dashboard.setting"))
-
-
-@dashboard_bp.route("/unlink_proton_account", methods=["POST"])
-@login_required
-@sudo_required
-def unlink_proton_account():
-    csrf_form = CSRFValidationForm()
-    if not csrf_form.validate():
-        flash("Invalid request", "warning")
-        return redirect(url_for("dashboard.setting"))
-
-    perform_proton_account_unlink(current_user)
-    flash("Your Proton account has been unlinked", "success")
-    return redirect(url_for("dashboard.setting"))

app/app/dashboard/views/alias_contact_manager.py

@@ -51,6 +51,14 @@ def email_validator():
     return _check
 
 
+def user_can_create_contacts(user: User) -> bool:
+    if user.is_premium():
+        return True
+    if user.flags & User.FLAG_FREE_DISABLE_CREATE_ALIAS == 0:
+        return True
+    return not config.DISABLE_CREATE_CONTACTS_FOR_FREE_USERS
+
+
 def create_contact(user: User, alias: Alias, contact_address: str) -> Contact:
     """
     Create a contact for a user. Can be restricted for new free users by enabling DISABLE_CREATE_CONTACTS_FOR_FREE_USERS.
@@ -74,7 +82,7 @@ def create_contact(user: User, alias: Alias, contact_address: str) -> Contact:
     if contact:
         raise ErrContactAlreadyExists(contact)
 
-    if not user.can_create_contacts():
+    if not user_can_create_contacts(user):
         raise ErrContactErrorUpgradeNeeded()
 
     contact = Contact.create(
@@ -319,6 +327,6 @@ def alias_contact_manager(alias_id):
         last_page=last_page,
         query=query,
         nb_contact=nb_contact,
-        can_create_contacts=current_user.can_create_contacts(),
+        can_create_contacts=user_can_create_contacts(current_user),
         csrf_form=csrf_form,
     )

app/app/dashboard/views/alias_export.py

@@ -1,13 +1,9 @@
 from app.dashboard.base import dashboard_bp
 from flask_login import login_required, current_user
 from app.alias_utils import alias_export_csv
-from app.dashboard.views.enter_sudo import sudo_required
-from app.extensions import limiter
 
 
 @dashboard_bp.route("/alias_export", methods=["GET"])
 @login_required
-@sudo_required
-@limiter.limit("2/minute")
 def alias_export_route():
     return alias_export_csv(current_user)

app/app/dashboard/views/batch_import.py

@@ -5,9 +5,7 @@ from flask_login import login_required, current_user
 from app import s3
 from app.config import JOB_BATCH_IMPORT
 from app.dashboard.base import dashboard_bp
-from app.dashboard.views.enter_sudo import sudo_required
 from app.db import Session
-from app.extensions import limiter
 from app.log import LOG
 from app.models import File, BatchImport, Job
 from app.utils import random_string, CSRFValidationForm
@@ -15,8 +13,6 @@ from app.utils import random_string, CSRFValidationForm
 
 @dashboard_bp.route("/batch_import", methods=["GET", "POST"])
 @login_required
-@sudo_required
-@limiter.limit("10/minute", methods=["POST"])
 def batch_import_route():
     # only for users who have custom domains
     if not current_user.verified_custom_domains():
@@ -41,7 +37,7 @@ def batch_import_route():
             return redirect(request.url)
         if len(batch_imports) > 10:
             flash(
-                "You have too many imports already. Please wait until some get cleaned up",
+                "You have too many imports already. Wait until some get cleaned up",
                 "error",
             )
             return render_template(

app/app/dashboard/views/custom_alias.py

@@ -24,7 +24,6 @@ from app.models import (
     AliasMailbox,
     DomainDeletedAlias,
 )
-from app.utils import CSRFValidationForm
 
 
 @dashboard_bp.route("/custom_alias", methods=["GET", "POST"])
@@ -49,13 +48,9 @@ def custom_alias():
             at_least_a_premium_domain = True
             break
 
-    csrf_form = CSRFValidationForm()
     mailboxes = current_user.mailboxes()
 
     if request.method == "POST":
-        if not csrf_form.validate():
-            flash("Invalid request", "warning")
-            return redirect(request.url)
         alias_prefix = request.form.get("prefix").strip().lower().replace(" ", "")
         signed_alias_suffix = request.form.get("signed-alias-suffix")
         mailbox_ids = request.form.getlist("mailboxes")
@@ -169,5 +164,4 @@ def custom_alias():
         alias_suffixes=alias_suffixes,
         at_least_a_premium_domain=at_least_a_premium_domain,
         mailboxes=mailboxes,
-        csrf_form=csrf_form,
     )

app/app/dashboard/views/enter_sudo.py

@@ -6,15 +6,15 @@ from flask_login import login_required, current_user
 from flask_wtf import FlaskForm
 from wtforms import PasswordField, validators
 
-from app.config import CONNECT_WITH_PROTON, OIDC_CLIENT_ID, CONNECT_WITH_OIDC_ICON
+from app.config import CONNECT_WITH_PROTON
 from app.dashboard.base import dashboard_bp
 from app.extensions import limiter
 from app.log import LOG
-from app.models import PartnerUser, SocialAuth
+from app.models import PartnerUser
 from app.proton.utils import get_proton_partner
 from app.utils import sanitize_next_url
 
-_SUDO_GAP = 120
+_SUDO_GAP = 900
 
 
 class LoginForm(FlaskForm):
@@ -51,19 +51,11 @@ def enter_sudo():
         if not partner_user or partner_user.partner_id != get_proton_partner().id:
             proton_enabled = False
 
-    oidc_enabled = OIDC_CLIENT_ID is not None
-    if oidc_enabled:
-        oidc_enabled = (
-            SocialAuth.get_by(user_id=current_user.id, social="oidc") is not None
-        )
-
     return render_template(
         "dashboard/enter_sudo.html",
         password_check_form=password_check_form,
         next=request.args.get("next"),
         connect_with_proton=proton_enabled,
-        connect_with_oidc=oidc_enabled,
-        connect_with_oidc_icon=CONNECT_WITH_OIDC_ICON,
     )
 
 

app/app/dashboard/views/index.py

@@ -52,13 +52,16 @@ def get_stats(user: User) -> Stats:
 
 
 @dashboard_bp.route("/", methods=["GET", "POST"])
-@login_required
 @limiter.limit(
     ALIAS_LIMIT,
     methods=["POST"],
     exempt_when=lambda: request.form.get("form-name") != "create-random-email",
 )
-@limiter.limit("10/minute", methods=["GET"], key_func=lambda: current_user.id)
+@limiter.limit(
+    "5/minute",
+    methods=["GET"],
+)
+@login_required
 @parallel_limiter.lock(
     name="alias_creation",
     only_when=lambda: request.form.get("form-name") == "create-random-email",
@@ -141,12 +144,12 @@ def index():
                 )
 
             if request.form.get("form-name") == "delete-alias":
-                LOG.i(f"User {current_user} requested deletion of alias {alias}")
+                LOG.d("delete alias %s", alias)
                 email = alias.email
                 alias_utils.delete_alias(alias, current_user)
                 flash(f"Alias {email} has been deleted", "success")
             elif request.form.get("form-name") == "disable-alias":
-                alias_utils.change_alias_status(alias, enabled=False)
+                alias.enabled = False
                 Session.commit()
                 flash(f"Alias {alias.email} has been disabled", "success")
 

app/app/dashboard/views/mailbox_detail.py

@@ -11,11 +11,9 @@ from wtforms.fields.html5 import EmailField
 from app.config import ENFORCE_SPF, MAILBOX_SECRET
 from app.config import URL
 from app.dashboard.base import dashboard_bp
-from app.dashboard.views.enter_sudo import sudo_required
 from app.db import Session
 from app.email_utils import email_can_be_used_as_mailbox
 from app.email_utils import mailbox_already_used, render, send_email
-from app.extensions import limiter
 from app.log import LOG
 from app.models import Alias, AuthorizedAddress
 from app.models import Mailbox
@@ -31,8 +29,6 @@ class ChangeEmailForm(FlaskForm):
 
 @dashboard_bp.route("/mailbox/<int:mailbox_id>/", methods=["GET", "POST"])
 @login_required
-@sudo_required
-@limiter.limit("20/minute", methods=["POST"])
 def mailbox_detail_route(mailbox_id):
     mailbox: Mailbox = Mailbox.get(mailbox_id)
     if not mailbox or mailbox.user_id != current_user.id:
@@ -183,15 +179,8 @@ def mailbox_detail_route(mailbox_id):
 
         elif request.form.get("form-name") == "toggle-pgp":
             if request.form.get("pgp-enabled") == "on":
-                if mailbox.is_proton():
+                mailbox.disable_pgp = False
-                    mailbox.disable_pgp = True
+                flash(f"PGP is enabled on {mailbox.email}", "success")
-                    flash(
-                        "Enabling PGP for a Proton Mail mailbox is redundant and does not add any security benefit",
-                        "info",
-                    )
-                else:
-                    mailbox.disable_pgp = False
-                    flash(f"PGP is enabled on {mailbox.email}", "info")
             else:
                 mailbox.disable_pgp = True
                 flash(f"PGP is disabled on {mailbox.email}", "info")

app/app/dashboard/views/setting.py

@@ -13,24 +13,34 @@ from flask_login import login_required, current_user
 from flask_wtf import FlaskForm
 from flask_wtf.file import FileField
 from wtforms import StringField, validators
+from wtforms.fields.html5 import EmailField
 
-from app import s3
+from app import s3, email_utils
 from app.config import (
+    URL,
     FIRST_ALIAS_DOMAIN,
     ALIAS_RANDOM_SUFFIX_LENGTH,
     CONNECT_WITH_PROTON,
 )
 from app.dashboard.base import dashboard_bp
 from app.db import Session
+from app.email_utils import (
+    email_can_be_used_as_mailbox,
+    personal_email_already_used,
+)
 from app.errors import ProtonPartnerNotSetUp
 from app.extensions import limiter
 from app.image_validation import detect_image_format, ImageFormat
+from app.jobs.export_user_data_job import ExportUserDataJob
 from app.log import LOG
 from app.models import (
     BlockBehaviourEnum,
     PlanEnum,
     File,
+    ResetPasswordCode,
     EmailChange,
+    User,
+    Alias,
     CustomDomain,
     AliasGeneratorEnum,
     AliasSuffixEnum,
@@ -43,10 +53,11 @@ from app.models import (
     PartnerSubscription,
     UnsubscribeBehaviourEnum,
 )
-from app.proton.utils import get_proton_partner
+from app.proton.utils import get_proton_partner, perform_proton_account_unlink
 from app.utils import (
     random_string,
     CSRFValidationForm,
+    canonicalize_email,
 )
 
 
@@ -55,6 +66,12 @@ class SettingForm(FlaskForm):
     profile_picture = FileField("Profile Picture")
 
 
+class ChangeEmailForm(FlaskForm):
+    email = EmailField(
+        "email", validators=[validators.DataRequired(), validators.Email()]
+    )
+
+
 class PromoCodeForm(FlaskForm):
     code = StringField("Name", validators=[validators.DataRequired()])
 
@@ -92,6 +109,7 @@ def get_partner_subscription_and_name(
 def setting():
     form = SettingForm()
     promo_form = PromoCodeForm()
+    change_email_form = ChangeEmailForm()
     csrf_form = CSRFValidationForm()
 
     email_change = EmailChange.get_by(user_id=current_user.id)
@@ -104,7 +122,63 @@ def setting():
         if not csrf_form.validate():
             flash("Invalid request", "warning")
             return redirect(url_for("dashboard.setting"))
+        if request.form.get("form-name") == "update-email":
+            if change_email_form.validate():
+                # whether user can proceed with the email update
+                new_email_valid = True
+                new_email = canonicalize_email(change_email_form.email.data)
+                if new_email != current_user.email and not pending_email:
+                    # check if this email is not already used
+                    if personal_email_already_used(new_email) or Alias.get_by(
+                        email=new_email
+                    ):
+                        flash(f"Email {new_email} already used", "error")
+                        new_email_valid = False
+                    elif not email_can_be_used_as_mailbox(new_email):
+                        flash(
+                            "You cannot use this email address as your personal inbox.",
+                            "error",
+                        )
+                        new_email_valid = False
+                    # a pending email change with the same email exists from another user
+                    elif EmailChange.get_by(new_email=new_email):
+                        other_email_change: EmailChange = EmailChange.get_by(
+                            new_email=new_email
+                        )
+                        LOG.w(
+                            "Another user has a pending %s with the same email address. Current user:%s",
+                            other_email_change,
+                            current_user,
+                        )
 
+                        if other_email_change.is_expired():
+                            LOG.d(
+                                "delete the expired email change %s", other_email_change
+                            )
+                            EmailChange.delete(other_email_change.id)
+                            Session.commit()
+                        else:
+                            flash(
+                                "You cannot use this email address as your personal inbox.",
+                                "error",
+                            )
+                            new_email_valid = False
+
+                    if new_email_valid:
+                        email_change = EmailChange.create(
+                            user_id=current_user.id,
+                            code=random_string(
+                                60
+                            ),  # todo: make sure the code is unique
+                            new_email=new_email,
+                        )
+                        Session.commit()
+                        send_change_email_confirmation(current_user, email_change)
+                        flash(
+                            "A confirmation email is on the way, please check your inbox",
+                            "success",
+                        )
+                        return redirect(url_for("dashboard.setting"))
         if request.form.get("form-name") == "update-profile":
             if form.validate():
                 profile_updated = False
@@ -148,6 +222,15 @@ def setting():
                 if profile_updated:
                     flash("Your profile has been updated", "success")
                     return redirect(url_for("dashboard.setting"))
+
+        elif request.form.get("form-name") == "change-password":
+            flash(
+                "You are going to receive an email containing instructions to change your password",
+                "success",
+            )
+            send_reset_password_email(current_user)
+            return redirect(url_for("dashboard.setting"))
+
         elif request.form.get("form-name") == "notification-preference":
             choose = request.form.get("notification")
             if choose == "on":
@@ -157,6 +240,7 @@ def setting():
             Session.commit()
             flash("Your notification preference has been updated", "success")
             return redirect(url_for("dashboard.setting"))
+
         elif request.form.get("form-name") == "change-alias-generator":
             scheme = int(request.form.get("alias-generator-scheme"))
             if AliasGeneratorEnum.has_value(scheme):
@@ -164,6 +248,7 @@ def setting():
                 Session.commit()
             flash("Your preference has been updated", "success")
             return redirect(url_for("dashboard.setting"))
+
         elif request.form.get("form-name") == "change-random-alias-default-domain":
             default_domain = request.form.get("random-alias-default-domain")
 
@@ -202,6 +287,7 @@ def setting():
             Session.commit()
             flash("Your preference has been updated", "success")
             return redirect(url_for("dashboard.setting"))
+
         elif request.form.get("form-name") == "random-alias-suffix":
             scheme = int(request.form.get("random-alias-suffix-generator"))
             if AliasSuffixEnum.has_value(scheme):
@@ -209,6 +295,7 @@ def setting():
                 Session.commit()
             flash("Your preference has been updated", "success")
             return redirect(url_for("dashboard.setting"))
+
         elif request.form.get("form-name") == "change-sender-format":
             sender_format = int(request.form.get("sender-format"))
             if SenderFormatEnum.has_value(sender_format):
@@ -218,6 +305,7 @@ def setting():
                 flash("Your sender format preference has been updated", "success")
             Session.commit()
             return redirect(url_for("dashboard.setting"))
+
         elif request.form.get("form-name") == "replace-ra":
             choose = request.form.get("replace-ra")
             if choose == "on":
@@ -227,21 +315,7 @@ def setting():
             Session.commit()
             flash("Your preference has been updated", "success")
             return redirect(url_for("dashboard.setting"))
-        elif request.form.get("form-name") == "enable_data_breach_check":
+
-            if not current_user.is_premium():
-                flash("Only premium plan can enable data breach monitoring", "warning")
-                return redirect(url_for("dashboard.setting"))
-            choose = request.form.get("enable_data_breach_check")
-            if choose == "on":
-                LOG.i("User {current_user} has enabled data breach monitoring")
-                current_user.enable_data_breach_check = True
-                flash("Data breach monitoring is enabled", "success")
-            else:
-                LOG.i("User {current_user} has disabled data breach monitoring")
-                current_user.enable_data_breach_check = False
-                flash("Data breach monitoring is disabled", "info")
-            Session.commit()
-            return redirect(url_for("dashboard.setting"))
         elif request.form.get("form-name") == "sender-in-ra":
             choose = request.form.get("enable")
             if choose == "on":
@@ -251,6 +325,7 @@ def setting():
             Session.commit()
             flash("Your preference has been updated", "success")
             return redirect(url_for("dashboard.setting"))
+
         elif request.form.get("form-name") == "expand-alias-info":
             choose = request.form.get("enable")
             if choose == "on":
@@ -312,6 +387,14 @@ def setting():
             Session.commit()
             flash("Your preference has been updated", "success")
             return redirect(url_for("dashboard.setting"))
+        elif request.form.get("form-name") == "send-full-user-report":
+            if ExportUserDataJob(current_user).store_job_in_db():
+                flash(
+                    "You will receive your SimpleLogin data via email shortly",
+                    "success",
+                )
+            else:
+                flash("An export of your data is currently in progress", "error")
 
     manual_sub = ManualSubscription.get_by(user_id=current_user.id)
     apple_sub = AppleSubscription.get_by(user_id=current_user.id)
@@ -334,6 +417,7 @@ def setting():
         SenderFormatEnum=SenderFormatEnum,
         BlockBehaviourEnum=BlockBehaviourEnum,
         promo_form=promo_form,
+        change_email_form=change_email_form,
         pending_email=pending_email,
         AliasGeneratorEnum=AliasGeneratorEnum,
         UnsubscribeBehaviourEnum=UnsubscribeBehaviourEnum,
@@ -348,3 +432,85 @@ def setting():
         connect_with_proton=CONNECT_WITH_PROTON,
         proton_linked_account=proton_linked_account,
     )
+
+
+def send_reset_password_email(user):
+    """
+    generate a new ResetPasswordCode and send it over email to user
+    """
+    # the activation code is valid for 1h
+    reset_password_code = ResetPasswordCode.create(
+        user_id=user.id, code=random_string(60)
+    )
+    Session.commit()
+
+    reset_password_link = f"{URL}/auth/reset_password?code={reset_password_code.code}"
+
+    email_utils.send_reset_password_email(user.email, reset_password_link)
+
+
+def send_change_email_confirmation(user: User, email_change: EmailChange):
+    """
+    send confirmation email to the new email address
+    """
+
+    link = f"{URL}/auth/change_email?code={email_change.code}"
+
+    email_utils.send_change_email(email_change.new_email, user.email, link)
+
+
+@dashboard_bp.route("/resend_email_change", methods=["GET", "POST"])
+@limiter.limit("5/hour")
+@login_required
+def resend_email_change():
+    form = CSRFValidationForm()
+    if not form.validate():
+        flash("Invalid request. Please try again", "warning")
+        return redirect(url_for("dashboard.setting"))
+    email_change = EmailChange.get_by(user_id=current_user.id)
+    if email_change:
+        # extend email change expiration
+        email_change.expired = arrow.now().shift(hours=12)
+        Session.commit()
+
+        send_change_email_confirmation(current_user, email_change)
+        flash("A confirmation email is on the way, please check your inbox", "success")
+        return redirect(url_for("dashboard.setting"))
+    else:
+        flash(
+            "You have no pending email change. Redirect back to Setting page", "warning"
+        )
+        return redirect(url_for("dashboard.setting"))
+
+
+@dashboard_bp.route("/cancel_email_change", methods=["GET", "POST"])
+@login_required
+def cancel_email_change():
+    form = CSRFValidationForm()
+    if not form.validate():
+        flash("Invalid request. Please try again", "warning")
+        return redirect(url_for("dashboard.setting"))
+    email_change = EmailChange.get_by(user_id=current_user.id)
+    if email_change:
+        EmailChange.delete(email_change.id)
+        Session.commit()
+        flash("Your email change is cancelled", "success")
+        return redirect(url_for("dashboard.setting"))
+    else:
+        flash(
+            "You have no pending email change. Redirect back to Setting page", "warning"
+        )
+        return redirect(url_for("dashboard.setting"))
+
+
+@dashboard_bp.route("/unlink_proton_account", methods=["POST"])
+@login_required
+def unlink_proton_account():
+    csrf_form = CSRFValidationForm()
+    if not csrf_form.validate():
+        flash("Invalid request", "warning")
+        return redirect(url_for("dashboard.setting"))
+
+    perform_proton_account_unlink(current_user)
+    flash("Your Proton account has been unlinked", "success")
+    return redirect(url_for("dashboard.setting"))

app/app/dashboard/views/unsubscribe.py

@@ -8,7 +8,6 @@ from app.db import Session
 from flask import redirect, url_for, flash, request, render_template
 from flask_login import login_required, current_user
 
-from app import alias_utils
 from app.dashboard.base import dashboard_bp
 from app.handler.unsubscribe_encoder import UnsubscribeAction
 from app.handler.unsubscribe_handler import UnsubscribeHandler
@@ -32,7 +31,7 @@ def unsubscribe(alias_id):
 
     # automatic unsubscribe, according to https://tools.ietf.org/html/rfc8058
     if request.method == "POST":
-        alias_utils.change_alias_status(alias, False)
+        alias.enabled = False
         flash(f"Alias {alias.email} has been blocked", "success")
         Session.commit()
 

app/app/email/headers.py

@@ -21,7 +21,6 @@ LIST_UNSUBSCRIBE = "List-Unsubscribe"
 LIST_UNSUBSCRIBE_POST = "List-Unsubscribe-Post"
 RETURN_PATH = "Return-Path"
 AUTHENTICATION_RESULTS = "Authentication-Results"
-SL_QUEUE_ID = "X-SL-Queue-Id"
 
 # headers used to DKIM sign in order of preference
 DKIM_HEADERS = [

app/app/email_utils.py

@@ -494,10 +494,9 @@ def delete_header(msg: Message, header: str):
 
 def sanitize_header(msg: Message, header: str):
     """remove trailing space and remove linebreak from a header"""
-    header_lowercase = header.lower()
     for i in reversed(range(len(msg._headers))):
         header_name = msg._headers[i][0].lower()
-        if header_name == header_lowercase:
+        if header_name == header.lower():
             # msg._headers[i] is a tuple like ('From', 'hey@google.com')
             if msg._headers[i][1]:
                 msg._headers[i] = (
@@ -584,26 +583,6 @@ def email_can_be_used_as_mailbox(email_address: str) -> bool:
             LOG.d("MX Domain %s %s is invalid mailbox domain", mx_domain, domain)
             return False
 
-    existing_user = User.get_by(email=email_address)
-    if existing_user and existing_user.disabled:
-        LOG.d(
-            f"User {existing_user} is disabled. {email_address} cannot be used for other mailbox"
-        )
-        return False
-
-    for existing_user in (
-        User.query()
-        .join(Mailbox, User.id == Mailbox.user_id)
-        .filter(Mailbox.email == email_address)
-        .group_by(User.id)
-        .all()
-    ):
-        if existing_user.disabled:
-            LOG.d(
-                f"User {existing_user} is disabled and has a mailbox with {email_address}. Id cannot be used for other mailbox"
-            )
-            return False
-
     return True
 
 
@@ -1404,7 +1383,7 @@ def generate_verp_email(
     # Time is in minutes granularity and start counting on 2022-01-01 to reduce bytes to represent time
     data = [
         verp_type.value,
-        object_id or 0,
+        object_id,
         int((time.time() - VERP_TIME_START) / 60),
     ]
     json_payload = json.dumps(data).encode("utf-8")

app/app/events/event_dispatcher.py

@@ -1,66 +0,0 @@
-from abc import ABC, abstractmethod
-from app import config
-from app.db import Session
-from app.errors import ProtonPartnerNotSetUp
-from app.events.generated import event_pb2
-from app.models import User, PartnerUser, SyncEvent
-from app.proton.utils import get_proton_partner
-from typing import Optional
-
-NOTIFICATION_CHANNEL = "simplelogin_sync_events"
-
-
-class Dispatcher(ABC):
-    @abstractmethod
-    def send(self, event: bytes):
-        pass
-
-
-class PostgresDispatcher(Dispatcher):
-    def send(self, event: bytes):
-        instance = SyncEvent.create(content=event, flush=True)
-        Session.execute(f"NOTIFY {NOTIFICATION_CHANNEL}, '{instance.id}';")
-
-    @staticmethod
-    def get():
-        return PostgresDispatcher()
-
-
-class EventDispatcher:
-    @staticmethod
-    def send_event(
-        user: User,
-        content: event_pb2.EventContent,
-        dispatcher: Dispatcher = PostgresDispatcher.get(),
-        skip_if_webhook_missing: bool = True,
-    ):
-        if config.EVENT_WEBHOOK_DISABLE:
-            return
-
-        if not config.EVENT_WEBHOOK and skip_if_webhook_missing:
-            return
-
-        partner_user = EventDispatcher.__partner_user(user.id)
-        if not partner_user:
-            return
-
-        event = event_pb2.Event(
-            user_id=user.id,
-            external_user_id=partner_user.external_user_id,
-            partner_id=partner_user.partner_id,
-            content=content,
-        )
-
-        serialized = event.SerializeToString()
-        dispatcher.send(serialized)
-
-    @staticmethod
-    def __partner_user(user_id: int) -> Optional[PartnerUser]:
-        # Check if the current user has a partner_id
-        try:
-            proton_partner_id = get_proton_partner().id
-        except ProtonPartnerNotSetUp:
-            return None
-
-        # It has. Retrieve the information for the PartnerUser
-        return PartnerUser.get_by(user_id=user_id, partner_id=proton_partner_id)

app/app/events/generated/event_pb2.py

@@ -1,38 +0,0 @@
-# -*- coding: utf-8 -*-
-# Generated by the protocol buffer compiler.  DO NOT EDIT!
-# source: event.proto
-# Protobuf Python Version: 5.26.1
-"""Generated protocol buffer code."""
-from google.protobuf import descriptor as _descriptor
-from google.protobuf import descriptor_pool as _descriptor_pool
-from google.protobuf import symbol_database as _symbol_database
-from google.protobuf.internal import builder as _builder
-# @@protoc_insertion_point(imports)
-
-_sym_db = _symbol_database.Default()
-
-
-
-
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x0b\x65vent.proto\x12\x12simplelogin_events\"\'\n\x0eUserPlanChange\x12\x15\n\rplan_end_time\x18\x01 \x01(\r\"\r\n\x0bUserDeleted\"Z\n\x0c\x41liasCreated\x12\x10\n\x08\x61lias_id\x18\x01 \x01(\r\x12\x13\n\x0b\x61lias_email\x18\x02 \x01(\t\x12\x12\n\nalias_note\x18\x03 \x01(\t\x12\x0f\n\x07\x65nabled\x18\x04 \x01(\x08\"K\n\x11\x41liasStatusChange\x12\x10\n\x08\x61lias_id\x18\x01 \x01(\r\x12\x13\n\x0b\x61lias_email\x18\x02 \x01(\t\x12\x0f\n\x07\x65nabled\x18\x03 \x01(\x08\"5\n\x0c\x41liasDeleted\x12\x10\n\x08\x61lias_id\x18\x01 \x01(\r\x12\x13\n\x0b\x61lias_email\x18\x02 \x01(\t\"\xce\x02\n\x0c\x45ventContent\x12>\n\x10user_plan_change\x18\x01 \x01(\x0b\x32\".simplelogin_events.UserPlanChangeH\x00\x12\x37\n\x0cuser_deleted\x18\x02 \x01(\x0b\x32\x1f.simplelogin_events.UserDeletedH\x00\x12\x39\n\ralias_created\x18\x03 \x01(\x0b\x32 .simplelogin_events.AliasCreatedH\x00\x12\x44\n\x13\x61lias_status_change\x18\x04 \x01(\x0b\x32%.simplelogin_events.AliasStatusChangeH\x00\x12\x39\n\ralias_deleted\x18\x05 \x01(\x0b\x32 .simplelogin_events.AliasDeletedH\x00\x42\t\n\x07\x63ontent\"y\n\x05\x45vent\x12\x0f\n\x07user_id\x18\x01 \x01(\r\x12\x18\n\x10\x65xternal_user_id\x18\x02 \x01(\t\x12\x12\n\npartner_id\x18\x03 \x01(\r\x12\x31\n\x07\x63ontent\x18\x04 \x01(\x0b\x32 .simplelogin_events.EventContentb\x06proto3')
-
-_globals = globals()
-_builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
-_builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'event_pb2', _globals)
-if not _descriptor._USE_C_DESCRIPTORS:
-  DESCRIPTOR._loaded_options = None
-  _globals['_USERPLANCHANGE']._serialized_start=35
-  _globals['_USERPLANCHANGE']._serialized_end=74
-  _globals['_USERDELETED']._serialized_start=76
-  _globals['_USERDELETED']._serialized_end=89
-  _globals['_ALIASCREATED']._serialized_start=91
-  _globals['_ALIASCREATED']._serialized_end=181
-  _globals['_ALIASSTATUSCHANGE']._serialized_start=183
-  _globals['_ALIASSTATUSCHANGE']._serialized_end=258
-  _globals['_ALIASDELETED']._serialized_start=260
-  _globals['_ALIASDELETED']._serialized_end=313
-  _globals['_EVENTCONTENT']._serialized_start=316
-  _globals['_EVENTCONTENT']._serialized_end=650
-  _globals['_EVENT']._serialized_start=652
-  _globals['_EVENT']._serialized_end=773
-# @@protoc_insertion_point(module_scope)

app/app/events/generated/event_pb2.pyi

@@ -1,71 +0,0 @@
-from google.protobuf import descriptor as _descriptor
-from google.protobuf import message as _message
-from typing import ClassVar as _ClassVar, Mapping as _Mapping, Optional as _Optional, Union as _Union
-
-DESCRIPTOR: _descriptor.FileDescriptor
-
-class UserPlanChange(_message.Message):
-    __slots__ = ("plan_end_time",)
-    PLAN_END_TIME_FIELD_NUMBER: _ClassVar[int]
-    plan_end_time: int
-    def __init__(self, plan_end_time: _Optional[int] = ...) -> None: ...
-
-class UserDeleted(_message.Message):
-    __slots__ = ()
-    def __init__(self) -> None: ...
-
-class AliasCreated(_message.Message):
-    __slots__ = ("alias_id", "alias_email", "alias_note", "enabled")
-    ALIAS_ID_FIELD_NUMBER: _ClassVar[int]
-    ALIAS_EMAIL_FIELD_NUMBER: _ClassVar[int]
-    ALIAS_NOTE_FIELD_NUMBER: _ClassVar[int]
-    ENABLED_FIELD_NUMBER: _ClassVar[int]
-    alias_id: int
-    alias_email: str
-    alias_note: str
-    enabled: bool
-    def __init__(self, alias_id: _Optional[int] = ..., alias_email: _Optional[str] = ..., alias_note: _Optional[str] = ..., enabled: bool = ...) -> None: ...
-
-class AliasStatusChange(_message.Message):
-    __slots__ = ("alias_id", "alias_email", "enabled")
-    ALIAS_ID_FIELD_NUMBER: _ClassVar[int]
-    ALIAS_EMAIL_FIELD_NUMBER: _ClassVar[int]
-    ENABLED_FIELD_NUMBER: _ClassVar[int]
-    alias_id: int
-    alias_email: str
-    enabled: bool
-    def __init__(self, alias_id: _Optional[int] = ..., alias_email: _Optional[str] = ..., enabled: bool = ...) -> None: ...
-
-class AliasDeleted(_message.Message):
-    __slots__ = ("alias_id", "alias_email")
-    ALIAS_ID_FIELD_NUMBER: _ClassVar[int]
-    ALIAS_EMAIL_FIELD_NUMBER: _ClassVar[int]
-    alias_id: int
-    alias_email: str
-    def __init__(self, alias_id: _Optional[int] = ..., alias_email: _Optional[str] = ...) -> None: ...
-
-class EventContent(_message.Message):
-    __slots__ = ("user_plan_change", "user_deleted", "alias_created", "alias_status_change", "alias_deleted")
-    USER_PLAN_CHANGE_FIELD_NUMBER: _ClassVar[int]
-    USER_DELETED_FIELD_NUMBER: _ClassVar[int]
-    ALIAS_CREATED_FIELD_NUMBER: _ClassVar[int]
-    ALIAS_STATUS_CHANGE_FIELD_NUMBER: _ClassVar[int]
-    ALIAS_DELETED_FIELD_NUMBER: _ClassVar[int]
-    user_plan_change: UserPlanChange
-    user_deleted: UserDeleted
-    alias_created: AliasCreated
-    alias_status_change: AliasStatusChange
-    alias_deleted: AliasDeleted
-    def __init__(self, user_plan_change: _Optional[_Union[UserPlanChange, _Mapping]] = ..., user_deleted: _Optional[_Union[UserDeleted, _Mapping]] = ..., alias_created: _Optional[_Union[AliasCreated, _Mapping]] = ..., alias_status_change: _Optional[_Union[AliasStatusChange, _Mapping]] = ..., alias_deleted: _Optional[_Union[AliasDeleted, _Mapping]] = ...) -> None: ...
-
-class Event(_message.Message):
-    __slots__ = ("user_id", "external_user_id", "partner_id", "content")
-    USER_ID_FIELD_NUMBER: _ClassVar[int]
-    EXTERNAL_USER_ID_FIELD_NUMBER: _ClassVar[int]
-    PARTNER_ID_FIELD_NUMBER: _ClassVar[int]
-    CONTENT_FIELD_NUMBER: _ClassVar[int]
-    user_id: int
-    external_user_id: str
-    partner_id: int
-    content: EventContent
-    def __init__(self, user_id: _Optional[int] = ..., external_user_id: _Optional[str] = ..., partner_id: _Optional[int] = ..., content: _Optional[_Union[EventContent, _Mapping]] = ...) -> None: ...

app/app/handler/dmarc.py

@@ -30,9 +30,7 @@ def apply_dmarc_policy_for_forward_phase(
 ) -> Tuple[Message, Optional[str]]:
     spam_result = SpamdResult.extract_from_headers(msg, Phase.forward)
     if not DMARC_CHECK_ENABLED or not spam_result:
-        LOG.i("DMARC check disabled")
         return msg, None
-    LOG.i(f"Spam check result in {spam_result}")
 
     from_header = get_header_unicode(msg[headers.FROM])
 
@@ -133,7 +131,7 @@ def quarantine_dmarc_failed_forward_email(alias, contact, envelope, msg) -> Emai
     refused_email = RefusedEmail.create(
         full_report_path=s3_report_path, user_id=alias.user_id, flush=True
     )
-    email_log = EmailLog.create(
+    return EmailLog.create(
         user_id=alias.user_id,
         mailbox_id=alias.mailbox_id,
         contact_id=contact.id,
@@ -144,7 +142,6 @@ def quarantine_dmarc_failed_forward_email(alias, contact, envelope, msg) -> Emai
         blocked=True,
         commit=True,
     )
-    return email_log
 
 
 def apply_dmarc_policy_for_reply_phase(
@@ -152,10 +149,8 @@ def apply_dmarc_policy_for_reply_phase(
 ) -> Optional[str]:
     spam_result = SpamdResult.extract_from_headers(msg, Phase.reply)
     if not DMARC_CHECK_ENABLED or not spam_result:
-        LOG.i("DMARC check disabled")
         return None
 
-    LOG.i(f"Spam check result is {spam_result}")
     if spam_result.dmarc not in (
         DmarcCheckResult.quarantine,
         DmarcCheckResult.reject,

app/app/handler/unsubscribe_generator.py

@@ -3,7 +3,6 @@ from email.header import Header
 from email.message import Message
 
 from app.email import headers
-from app import config
 from app.email_utils import add_or_replace_header, delete_header
 from app.handler.unsubscribe_encoder import (
     UnsubscribeEncoder,
@@ -48,11 +47,6 @@ class UnsubscribeGenerator:
             method = raw_method[start + 1 : end]
             url_data = urllib.parse.urlparse(method)
             if url_data.scheme == "mailto":
-                if url_data.path == config.UNSUBSCRIBER:
-                    LOG.debug(
-                        f"Skipping replacing unsubscribe since the original email already points to {config.UNSUBSCRIBER}"
-                    )
-                    return message
                 query_data = urllib.parse.parse_qs(url_data.query)
                 mailto_unsubs = (url_data.path, query_data.get("subject", [""])[0])
                 LOG.debug(f"Unsub is mailto to {mailto_unsubs}")

app/app/handler/unsubscribe_handler.py

@@ -5,7 +5,6 @@ from typing import Optional
 from aiosmtpd.smtp import Envelope
 
 from app import config
-from app import alias_utils
 from app.db import Session
 from app.email import headers, status
 from app.email_utils import (
@@ -102,7 +101,7 @@ class UnsubscribeHandler:
             mailbox.email, alias
         ):
             return status.E509
-        alias_utils.change_alias_status(alias, enabled=False)
+        alias.enabled = False
         Session.commit()
         enable_alias_url = config.URL + f"/dashboard/?highlight_alias_id={alias.id}"
         for mailbox in alias.mailboxes:

app/app/import_utils.py

@@ -30,10 +30,7 @@ def handle_batch_import(batch_import: BatchImport):
 
     LOG.d("Download file %s from %s", batch_import.file, file_url)
     r = requests.get(file_url)
-    # Replace invisible character
+    lines = [line.decode("utf-8") for line in r.iter_lines()]
-    lines = [
-        line.decode("utf-8").replace("\ufeff", "").strip() for line in r.iter_lines()
-    ]
 
     import_from_csv(batch_import, user, lines)
 

app/app/models.py

@@ -27,7 +27,7 @@ from sqlalchemy.orm import deferred
 from sqlalchemy.sql import and_
 from sqlalchemy_utils import ArrowType
 
-from app import config, rate_limiter
+from app import config
 from app import s3
 from app.db import Session
 from app.dns_utils import get_mx_domains
@@ -235,7 +235,6 @@ class AuditLogActionEnum(EnumE):
     download_provider_complaint = 8
     disable_user = 9
     enable_user = 10
-    stop_trial = 11
 
 
 class Phase(EnumE):
@@ -525,11 +524,6 @@ class User(Base, ModelMixin, UserMixin, PasswordOracle):
         sa.Boolean, default=True, nullable=False, server_default="1"
     )
 
-    # user opted in for data breach check
-    enable_data_breach_check = sa.Column(
-        sa.Boolean, default=False, nullable=False, server_default="0"
-    )
-
     # bitwise flags. Allow for future expansion
     flags = sa.Column(
         sa.BigInteger,
@@ -657,21 +651,6 @@ class User(Base, ModelMixin, UserMixin, PasswordOracle):
 
         return user
 
-    @classmethod
-    def delete(cls, obj_id, commit=False):
-        # Internal import to avoid global import cycles
-        from app.events.event_dispatcher import EventDispatcher
-        from app.events.generated.event_pb2 import UserDeleted, EventContent
-
-        user: User = cls.get(obj_id)
-        EventDispatcher.send_event(user, EventContent(user_deleted=UserDeleted()))
-
-        res = super(User, cls).delete(obj_id)
-        if commit:
-            Session.commit()
-
-        return res
-
     def get_active_subscription(
         self, include_partner_subscription: bool = True
     ) -> Optional[
@@ -747,11 +726,6 @@ class User(Base, ModelMixin, UserMixin, PasswordOracle):
 
         return True
 
-    def is_active(self) -> bool:
-        if self.delete_on is None:
-            return True
-        return self.delete_on < arrow.now()
-
     def in_trial(self):
         """return True if user does not have lifetime licence or an active subscription AND is in trial period"""
         if self.lifetime_or_active_subscription():
@@ -853,9 +827,6 @@ class User(Base, ModelMixin, UserMixin, PasswordOracle):
         Whether user can create a new alias. User can't create a new alias if
         - has more than 15 aliases in the free plan, *even in the free trial*
         """
-        if not self.is_active():
-            return False
-
         if self.disabled:
             return False
 
@@ -936,11 +907,7 @@ class User(Base, ModelMixin, UserMixin, PasswordOracle):
             return sub
 
     def verified_custom_domains(self) -> List["CustomDomain"]:
-        return (
+        return CustomDomain.filter_by(user_id=self.id, ownership_verified=True).all()
-            CustomDomain.filter_by(user_id=self.id, ownership_verified=True)
-            .order_by(CustomDomain.domain.asc())
-            .all()
-        )
 
     def mailboxes(self) -> List["Mailbox"]:
         """list of mailbox that user own"""
@@ -1146,13 +1113,6 @@ class User(Base, ModelMixin, UserMixin, PasswordOracle):
 
         return random_words(1)
 
-    def can_create_contacts(self) -> bool:
-        if self.is_premium():
-            return True
-        if self.flags & User.FLAG_FREE_DISABLE_CREATE_ALIAS == 0:
-            return True
-        return not config.DISABLE_CREATE_CONTACTS_FOR_FREE_USERS
-
     def __repr__(self):
         return f"<User {self.id} {self.name} {self.email}>"
 
@@ -1442,9 +1402,6 @@ def generate_random_alias_email(
 
 class Alias(Base, ModelMixin):
     __tablename__ = "alias"
-
-    FLAG_PARTNER_CREATED = 1 << 0
-
     user_id = sa.Column(
         sa.ForeignKey(User.id, ondelete="cascade"), nullable=False, index=True
     )
@@ -1454,9 +1411,6 @@ class Alias(Base, ModelMixin):
     name = sa.Column(sa.String(128), nullable=True, default=None)
 
     enabled = sa.Column(sa.Boolean(), default=True, nullable=False)
-    flags = sa.Column(
-        sa.BigInteger(), default=0, server_default="0", nullable=False, index=True
-    )
 
     custom_domain_id = sa.Column(
         sa.ForeignKey("custom_domain.id", ondelete="cascade"), nullable=True, index=True
@@ -1534,8 +1488,6 @@ class Alias(Base, ModelMixin):
         TSVector(), sa.Computed("to_tsvector('english', note)", persisted=True)
     )
 
-    last_email_log_id = sa.Column(sa.Integer, default=None, nullable=True)
-
     __table_args__ = (
         Index("ix_video___ts_vector__", ts_vector, postgresql_using="gin"),
         # index on note column using pg_trgm
@@ -1554,8 +1506,7 @@ class Alias(Base, ModelMixin):
     def mailboxes(self):
         ret = [self.mailbox]
         for m in self._mailboxes:
-            if m.id is not self.mailbox.id:
+            ret.append(m)
-                ret.append(m)
 
         ret = [mb for mb in ret if mb.verified]
         ret = sorted(ret, key=lambda mb: mb.email)
@@ -1604,15 +1555,6 @@ class Alias(Base, ModelMixin):
         flush = kw.pop("flush", False)
 
         new_alias = cls(**kw)
-        user = User.get(new_alias.user_id)
-        if user.is_premium():
-            limits = config.ALIAS_CREATE_RATE_LIMIT_PAID
-        else:
-            limits = config.ALIAS_CREATE_RATE_LIMIT_FREE
-        # limits is array of (hits,days)
-        for limit in limits:
-            key = f"alias_create_{limit[1]}d:{user.id}"
-            rate_limiter.check_bucket_limit(key, limit[0], limit[1])
 
         email = kw["email"]
         # make sure email is lowercase and doesn't have any whitespace
@@ -1634,18 +1576,6 @@ class Alias(Base, ModelMixin):
         Session.add(new_alias)
         DailyMetric.get_or_create_today_metric().nb_alias += 1
 
-        # Internal import to avoid global import cycles
-        from app.events.event_dispatcher import EventDispatcher
-        from app.events.generated.event_pb2 import AliasCreated, EventContent
-
-        event = AliasCreated(
-            alias_id=new_alias.id,
-            alias_email=new_alias.email,
-            alias_note=new_alias.note,
-            enabled=True,
-        )
-        EventDispatcher.send_event(user, EventContent(alias_created=event))
-
         if commit:
             Session.commit()
 
@@ -2107,20 +2037,6 @@ class EmailLog(Base, ModelMixin):
     def get_dashboard_url(self):
         return f"{config.URL}/dashboard/refused_email?highlight_id={self.id}"
 
-    @classmethod
-    def create(cls, *args, **kwargs):
-        commit = kwargs.pop("commit", False)
-        email_log = super().create(*args, **kwargs)
-        Session.flush()
-        if "alias_id" in kwargs:
-            sql = "UPDATE alias SET last_email_log_id = :el_id WHERE id = :alias_id"
-            Session.execute(
-                sql, {"el_id": email_log.id, "alias_id": kwargs["alias_id"]}
-            )
-        if commit:
-            Session.commit()
-        return email_log
-
     def __repr__(self):
         return f"<EmailLog {self.id}>"
 
@@ -2624,13 +2540,10 @@ class Job(Base, ModelMixin):
         nullable=False,
         server_default=str(JobState.ready.value),
         default=JobState.ready.value,
-        index=True,
     )
     attempts = sa.Column(sa.Integer, nullable=False, server_default="0", default=0)
     taken_at = sa.Column(ArrowType, nullable=True)
 
-    __table_args__ = (Index("ix_state_run_at_taken_at", state, run_at, taken_at),)
-
     def __repr__(self):
         return f"<Job {self.id} {self.name} {self.payload}>"
 
@@ -2676,15 +2589,10 @@ class Mailbox(Base, ModelMixin):
         return False
 
     def nb_alias(self):
-        alias_ids = set(
+        return (
-            am.alias_id
+            AliasMailbox.filter_by(mailbox_id=self.id).count()
-            for am in AliasMailbox.filter_by(mailbox_id=self.id).values(
+            + Alias.filter_by(mailbox_id=self.id).count()
-                AliasMailbox.alias_id
-            )
         )
-        for alias in Alias.filter_by(mailbox_id=self.id).values(Alias.id):
-            alias_ids.add(alias.id)
-        return len(alias_ids)
 
     def is_proton(self) -> bool:
         if (
@@ -2733,15 +2641,12 @@ class Mailbox(Base, ModelMixin):
 
     @property
     def aliases(self) -> [Alias]:
-        ret = dict(
+        ret = Alias.filter_by(mailbox_id=self.id).all()
-            (alias.id, alias) for alias in Alias.filter_by(mailbox_id=self.id).all()
-        )
 
         for am in AliasMailbox.filter_by(mailbox_id=self.id):
-            if am.alias_id not in ret:
+            ret.append(am.alias)
-                ret[am.alias_id] = am.alias
 
-        return list(ret.values())
+        return ret
 
     @classmethod
     def create(cls, **kw):
@@ -2986,9 +2891,7 @@ class RecoveryCode(Base, ModelMixin):
 
 class Notification(Base, ModelMixin):
     __tablename__ = "notification"
-    user_id = sa.Column(
+    user_id = sa.Column(sa.ForeignKey(User.id, ondelete="cascade"), nullable=False)
-        sa.ForeignKey(User.id, ondelete="cascade"), nullable=False, index=True
-    )
     message = sa.Column(sa.Text, nullable=False)
     title = sa.Column(sa.String(512))
 
@@ -3229,20 +3132,6 @@ class TransactionalEmail(Base, ModelMixin):
 
     __table_args__ = (sa.Index("ix_transactional_email_created_at", "created_at"),)
 
-    @classmethod
-    def create(cls, **kw):
-        # whether to call Session.commit
-        commit = kw.pop("commit", False)
-
-        r = cls(**kw)
-        if not config.STORE_TRANSACTIONAL_EMAILS:
-            return r
-
-        Session.add(r)
-        if commit:
-            Session.commit()
-        return r
-
 
 class Payout(Base, ModelMixin):
     """Referral payouts"""
@@ -3433,15 +3322,6 @@ class AdminAuditLog(Base):
             },
         )
 
-    @classmethod
-    def stop_trial(cls, admin_user_id: int, user_id: int):
-        cls.create(
-            admin_user_id=admin_user_id,
-            action=AuditLogActionEnum.stop_trial.value,
-            model="User",
-            model_id=user_id,
-        )
-
     @classmethod
     def disable_otp_fido(
         cls, admin_user_id: int, user_id: int, had_otp: bool, had_fido: bool
@@ -3675,52 +3555,3 @@ class ApiToCookieToken(Base, ModelMixin):
         code = secrets.token_urlsafe(32)
 
         return super().create(code=code, **kwargs)
-
-
-class SyncEvent(Base, ModelMixin):
-    """This model holds the events that need to be sent to the webhook"""
-
-    __tablename__ = "sync_event"
-    content = sa.Column(sa.LargeBinary, unique=False, nullable=False)
-    taken_time = sa.Column(
-        ArrowType, default=None, nullable=True, server_default=None, index=True
-    )
-
-    __table_args__ = (
-        sa.Index("ix_sync_event_created_at", "created_at"),
-        sa.Index("ix_sync_event_taken_time", "taken_time"),
-    )
-
-    def mark_as_taken(self) -> bool:
-        sql = """
-        UPDATE sync_event
-        SET taken_time = :taken_time
-        WHERE id = :sync_event_id
-          AND taken_time IS NULL
-        """
-        args = {"taken_time": arrow.now().datetime, "sync_event_id": self.id}
-
-        res = Session.execute(sql, args)
-        Session.commit()
-
-        return res.rowcount > 0
-
-    @classmethod
-    def get_dead_letter(cls, older_than: Arrow) -> [SyncEvent]:
-        return (
-            SyncEvent.filter(
-                (
-                    (
-                        SyncEvent.taken_time.isnot(None)
-                        & (SyncEvent.taken_time < older_than)
-                    )
-                    | (
-                        SyncEvent.taken_time.is_(None)
-                        & (SyncEvent.created_at < older_than)
-                    )
-                )
-            )
-            .order_by(SyncEvent.id)
-            .limit(100)
-            .all()
-        )

app/app/oauth/views/authorize.py

@@ -140,7 +140,7 @@ def authorize():
                 Scope=Scope,
             )
     else:  # POST - user allows or denies
-        if not current_user.is_authenticated or not current_user.is_active():
+        if not current_user.is_authenticated or not current_user.is_active:
             LOG.i(
                 "Attempt to validate a OAUth allow request by an unauthenticated user"
             )

app/app/rate_limiter.py

@@ -1,42 +0,0 @@
-from datetime import datetime
-from typing import Optional
-
-import newrelic.agent
-import redis.exceptions
-import werkzeug.exceptions
-from limits.storage import RedisStorage
-
-from app.log import LOG
-
-lock_redis: Optional[RedisStorage] = None
-
-
-def set_redis_concurrent_lock(redis: RedisStorage):
-    global lock_redis
-    lock_redis = redis
-
-
-def check_bucket_limit(
-    lock_name: Optional[str] = None,
-    max_hits: int = 5,
-    bucket_seconds: int = 3600,
-):
-    # Calculate current bucket time
-    int_time = int(datetime.utcnow().timestamp())
-    bucket_id = int_time - (int_time % bucket_seconds)
-    bucket_lock_name = f"bl:{lock_name}:{bucket_id}"
-    if not lock_redis:
-        return
-    try:
-        value = lock_redis.incr(bucket_lock_name, bucket_seconds)
-        if value > max_hits:
-            LOG.i(
-                f"Rate limit hit for {lock_name} (bucket id {bucket_id}) -> {value}/{max_hits}"
-            )
-            newrelic.agent.record_custom_event(
-                "BucketRateLimit",
-                {"lock_name": lock_name, "bucket_seconds": bucket_seconds},
-            )
-            raise werkzeug.exceptions.TooManyRequests()
-    except (redis.exceptions.RedisError, AttributeError):
-        LOG.e("Cannot connect to redis")

app/app/redis_services.py

@@ -2,7 +2,6 @@ import flask
 import limits.storage
 
 from app.parallel_limiter import set_redis_concurrent_lock
-from app.rate_limiter import set_redis_concurrent_lock as rate_limit_set_redis
 from app.session import RedisSessionStore
 
 
@@ -11,14 +10,12 @@ def initialize_redis_services(app: flask.Flask, redis_url: str):
         storage = limits.storage.RedisStorage(redis_url)
         app.session_interface = RedisSessionStore(storage.storage, storage.storage, app)
         set_redis_concurrent_lock(storage)
-        rate_limit_set_redis(storage)
     elif redis_url.startswith("redis+sentinel://"):
         storage = limits.storage.RedisSentinelStorage(redis_url)
         app.session_interface = RedisSessionStore(
             storage.storage, storage.storage_slave, app
         )
         set_redis_concurrent_lock(storage)
-        rate_limit_set_redis(storage)
     else:
         raise RuntimeError(
             f"Tried to set_redis_session with an invalid redis url: ${redis_url}"

app/app/s3.py

@@ -5,9 +5,19 @@ from typing import Optional
 import boto3
 import requests
 
-from app import config
+from app.config import (
+    AWS_REGION,
+    BUCKET,
+    AWS_ACCESS_KEY_ID,
+    AWS_SECRET_ACCESS_KEY,
+    LOCAL_FILE_UPLOAD,
+    UPLOAD_DIR,
+    URL,
+    AWS_ENDPOINT_URL,
+)
 from app.log import LOG
 
+
 _s3_client = None
 
 
@@ -15,12 +25,12 @@ def _get_s3client():
     global _s3_client
     if _s3_client is None:
         args = {
-            "aws_access_key_id": config.AWS_ACCESS_KEY_ID,
+            "aws_access_key_id": AWS_ACCESS_KEY_ID,
-            "aws_secret_access_key": config.AWS_SECRET_ACCESS_KEY,
+            "aws_secret_access_key": AWS_SECRET_ACCESS_KEY,
-            "region_name": config.AWS_REGION,
+            "region_name": AWS_REGION,
         }
-        if config.AWS_ENDPOINT_URL:
+        if AWS_ENDPOINT_URL:
-            args["endpoint_url"] = config.AWS_ENDPOINT_URL
+            args["endpoint_url"] = AWS_ENDPOINT_URL
         _s3_client = boto3.client("s3", **args)
     return _s3_client
 
@@ -28,8 +38,8 @@ def _get_s3client():
 def upload_from_bytesio(key: str, bs: BytesIO, content_type="application/octet-stream"):
     bs.seek(0)
 
-    if config.LOCAL_FILE_UPLOAD:
+    if LOCAL_FILE_UPLOAD:
-        file_path = os.path.join(config.UPLOAD_DIR, key)
+        file_path = os.path.join(UPLOAD_DIR, key)
         file_dir = os.path.dirname(file_path)
         os.makedirs(file_dir, exist_ok=True)
         with open(file_path, "wb") as f:
@@ -37,7 +47,7 @@ def upload_from_bytesio(key: str, bs: BytesIO, content_type="application/octet-s
 
     else:
         _get_s3client().put_object(
-            Bucket=config.BUCKET,
+            Bucket=BUCKET,
             Key=key,
             Body=bs,
             ContentType=content_type,
@@ -47,8 +57,8 @@ def upload_from_bytesio(key: str, bs: BytesIO, content_type="application/octet-s
 def upload_email_from_bytesio(path: str, bs: BytesIO, filename):
     bs.seek(0)
 
-    if config.LOCAL_FILE_UPLOAD:
+    if LOCAL_FILE_UPLOAD:
-        file_path = os.path.join(config.UPLOAD_DIR, path)
+        file_path = os.path.join(UPLOAD_DIR, path)
         file_dir = os.path.dirname(file_path)
         os.makedirs(file_dir, exist_ok=True)
         with open(file_path, "wb") as f:
@@ -56,7 +66,7 @@ def upload_email_from_bytesio(path: str, bs: BytesIO, filename):
 
     else:
         _get_s3client().put_object(
-            Bucket=config.BUCKET,
+            Bucket=BUCKET,
             Key=path,
             Body=bs,
             # Support saving a remote file using Http header
@@ -67,12 +77,12 @@ def upload_email_from_bytesio(path: str, bs: BytesIO, filename):
 
 
 def download_email(path: str) -> Optional[str]:
-    if config.LOCAL_FILE_UPLOAD:
+    if LOCAL_FILE_UPLOAD:
-        file_path = os.path.join(config.UPLOAD_DIR, path)
+        file_path = os.path.join(UPLOAD_DIR, path)
         with open(file_path, "rb") as f:
             return f.read()
     resp = _get_s3client().get_object(
-        Bucket=config.BUCKET,
+        Bucket=BUCKET,
         Key=path,
     )
     if not resp or "Body" not in resp:
@@ -86,30 +96,29 @@ def upload_from_url(url: str, upload_path):
 
 
 def get_url(key: str, expires_in=3600) -> str:
-    if config.LOCAL_FILE_UPLOAD:
+    if LOCAL_FILE_UPLOAD:
-        return config.URL + "/static/upload/" + key
+        return URL + "/static/upload/" + key
     else:
         return _get_s3client().generate_presigned_url(
             ExpiresIn=expires_in,
             ClientMethod="get_object",
-            Params={"Bucket": config.BUCKET, "Key": key},
+            Params={"Bucket": BUCKET, "Key": key},
         )
 
 
 def delete(path: str):
-    if config.LOCAL_FILE_UPLOAD:
+    if LOCAL_FILE_UPLOAD:
-        file_path = os.path.join(config.UPLOAD_DIR, path)
+        os.remove(os.path.join(UPLOAD_DIR, path))
-        os.remove(file_path)
     else:
-        _get_s3client().delete_object(Bucket=config.BUCKET, Key=path)
+        _get_s3client().delete_object(Bucket=BUCKET, Key=path)
 
 
 def create_bucket_if_not_exists():
     s3client = _get_s3client()
     buckets = s3client.list_buckets()
     for bucket in buckets["Buckets"]:
-        if bucket["Name"] == config.BUCKET:
+        if bucket["Name"] == BUCKET:
             LOG.i("Bucket already exists")
             return
-    s3client.create_bucket(Bucket=config.BUCKET)
+    s3client.create_bucket(Bucket=BUCKET)
-    LOG.i(f"Bucket {config.BUCKET} created")
+    LOG.i(f"Bucket {BUCKET} created")

app/app/subscription_webhook.py

@@ -2,8 +2,6 @@ import requests
 from requests import RequestException
 
 from app import config
-from app.events.event_dispatcher import EventDispatcher
-from app.events.generated.event_pb2 import EventContent, UserPlanChange
 from app.log import LOG
 from app.models import User
 
@@ -33,6 +31,3 @@ def execute_subscription_webhook(user: User):
             )
     except RequestException as e:
         LOG.error(f"Subscription request exception: {e}")
-
-    event = UserPlanChange(plan_end_time=sl_subscription_end)
-    EventDispatcher.send_event(user, EventContent(user_plan_change=event))

app/app/utils.py

@@ -49,11 +49,11 @@ def random_string(length=10, include_digits=False):
 
 def convert_to_id(s: str):
     """convert a string to id-like: remove space, remove special accent"""
+    s = s.replace(" ", "")
     s = s.lower()
     s = unidecode(s)
-    s = s.replace(" ", "")
 
-    return s[:256]
+    return s
 
 
 _ALLOWED_CHARS = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-."

app/cron.py

@@ -61,11 +61,6 @@ from app.pgp_utils import load_public_key_and_check, PGPException
 from app.proton.utils import get_proton_partner
 from app.utils import sanitize_email
 from server import create_light_app
-from tasks.cleanup_old_imports import cleanup_old_imports
-from tasks.cleanup_old_jobs import cleanup_old_jobs
-from tasks.cleanup_old_notifications import cleanup_old_notifications
-
-DELETE_GRACE_DAYS = 30
 
 
 def notify_trial_end():
@@ -965,9 +960,6 @@ async def _hibp_check(api_key, queue):
 
     This function to be ran simultaneously (multiple _hibp_check functions with different keys on the same queue) to make maximum use of multiple API keys.
     """
-    default_rate_sleep = (60.0 / config.HIBP_RPM) + 0.1
-    rate_sleep = default_rate_sleep
-    rate_hit_counter = 0
     while True:
         try:
             alias_id = queue.get_nowait()
@@ -975,14 +967,9 @@ async def _hibp_check(api_key, queue):
             return
 
         alias = Alias.get(alias_id)
+        # an alias can be deleted in the meantime
         if not alias:
-            continue
+            return
-        user = alias.user
-        if user.disabled or not user.is_paid():
-            # Mark it as hibp done to skip it as if it had been checked
-            alias.hibp_last_check = arrow.utcnow()
-            Session.commit()
-            continue
 
         LOG.d("Checking HIBP for %s", alias)
 
@@ -994,6 +981,7 @@ async def _hibp_check(api_key, queue):
             f"https://haveibeenpwned.com/api/v3/breachedaccount/{urllib.parse.quote(alias.email)}",
             headers=request_headers,
         )
+
         if r.status_code == 200:
             # Breaches found
             alias.hibp_breaches = [
@@ -1001,27 +989,20 @@ async def _hibp_check(api_key, queue):
             ]
             if len(alias.hibp_breaches) > 0:
                 LOG.w("%s appears in HIBP breaches %s", alias, alias.hibp_breaches)
-            if rate_hit_counter > 0:
-                rate_hit_counter -= 1
         elif r.status_code == 404:
             # No breaches found
             alias.hibp_breaches = []
         elif r.status_code == 429:
             # rate limited
             LOG.w("HIBP rate limited, check alias %s in the next run", alias)
-            rate_hit_counter += 1
+            await asyncio.sleep(1.6)
-            rate_sleep = default_rate_sleep + (0.2 * rate_hit_counter)
+            return
-            if rate_hit_counter > 10:
-                LOG.w(f"HIBP rate limited too many times stopping with alias {alias}")
-                return
-            # Just sleep for a while
-            asyncio.sleep(5)
         elif r.status_code > 500:
             LOG.w("HIBP server 5** error %s", r.status_code)
             return
         else:
             LOG.error(
-                "An error occurred while checking alias %s: %s - %s",
+                "An error occured while checking alias %s: %s - %s",
                 alias,
                 r.status_code,
                 r.text,
@@ -1032,63 +1013,9 @@ async def _hibp_check(api_key, queue):
         Session.add(alias)
         Session.commit()
 
-        LOG.d("Updated breach info for %s", alias)
+        LOG.d("Updated breaches info for %s", alias)
-        await asyncio.sleep(rate_sleep)
 
-
+        await asyncio.sleep(1.6)
-def get_alias_to_check_hibp(
-    oldest_hibp_allowed: arrow.Arrow,
-    user_ids_to_skip: list[int],
-    min_alias_id: int,
-    max_alias_id: int,
-):
-    now = arrow.now()
-    alias_query = (
-        Session.query(Alias)
-        .join(User, User.id == Alias.user_id)
-        .join(Subscription, User.id == Subscription.user_id, isouter=True)
-        .join(ManualSubscription, User.id == ManualSubscription.user_id, isouter=True)
-        .join(AppleSubscription, User.id == AppleSubscription.user_id, isouter=True)
-        .join(
-            CoinbaseSubscription,
-            User.id == CoinbaseSubscription.user_id,
-            isouter=True,
-        )
-        .join(PartnerUser, User.id == PartnerUser.user_id, isouter=True)
-        .join(
-            PartnerSubscription,
-            PartnerSubscription.partner_user_id == PartnerUser.id,
-            isouter=True,
-        )
-        .filter(
-            or_(
-                Alias.hibp_last_check.is_(None),
-                Alias.hibp_last_check < oldest_hibp_allowed,
-            ),
-            Alias.user_id.notin_(user_ids_to_skip),
-            Alias.enabled,
-            Alias.id >= min_alias_id,
-            Alias.id < max_alias_id,
-            User.disabled == False,  # noqa: E712
-            User.enable_data_breach_check,
-            or_(
-                User.lifetime,
-                ManualSubscription.end_at > now,
-                Subscription.next_bill_date > now.date(),
-                AppleSubscription.expires_date > now,
-                CoinbaseSubscription.end_at > now,
-                PartnerSubscription.end_at > now,
-            ),
-        )
-    )
-    if config.HIBP_SKIP_PARTNER_ALIAS:
-        alias_query = alias_query.filter(
-            Alias.flags.op("&")(Alias.FLAG_PARTNER_CREATED) == 0
-        )
-    for alias in (
-        alias_query.order_by(Alias.id.asc()).enable_eagerloads(False).yield_per(500)
-    ):
-        yield alias
 
 
 async def check_hibp():
@@ -1111,49 +1038,40 @@ async def check_hibp():
     Session.commit()
     LOG.d("Updated list of known breaches")
 
-    LOG.d("Getting the list of users to skip")
+    LOG.d("Preparing list of aliases to check")
-    query = "select u.id, count(a.id) from users u, alias a where a.user_id=u.id group by u.id having count(a.id) > :max_alias"
-    rows = Session.execute(query, {"max_alias": config.HIBP_MAX_ALIAS_CHECK})
-    user_ids = [row[0] for row in rows]
-    LOG.d("Got %d users to skip" % len(user_ids))
-
-    LOG.d("Checking aliases")
     queue = asyncio.Queue()
-    min_alias_id = 0
+    max_date = arrow.now().shift(days=-config.HIBP_SCAN_INTERVAL_DAYS)
-    max_alias_id = Session.query(func.max(Alias.id)).scalar()
+    for alias in (
-    step = 10000
+        Alias.filter(
-    now = arrow.now()
+            or_(Alias.hibp_last_check.is_(None), Alias.hibp_last_check < max_date)
-    oldest_hibp_allowed = now.shift(days=-config.HIBP_SCAN_INTERVAL_DAYS)
-    alias_checked = 0
-    for alias_batch_id in range(min_alias_id, max_alias_id, step):
-        for alias in get_alias_to_check_hibp(
-            oldest_hibp_allowed, user_ids, alias_batch_id, alias_batch_id + step
-        ):
-            await queue.put(alias.id)
-
-        alias_checked += queue.qsize()
-        LOG.d(
-            f"Need to check about {queue.qsize()} aliases in this loop {alias_batch_id}/{max_alias_id}"
         )
+        .filter(Alias.enabled)
+        .order_by(Alias.hibp_last_check.asc())
+        .yield_per(500)
+        .enable_eagerloads(False)
+    ):
+        await queue.put(alias.id)
 
-        # Start one checking process per API key
+    LOG.d("Need to check about %s aliases", queue.qsize())
-        # Each checking process will take one alias from the queue, get the info
+
-        # and then sleep for 1.5 seconds (due to HIBP API request limits)
+    # Start one checking process per API key
-        checkers = []
+    # Each checking process will take one alias from the queue, get the info
-        for i in range(len(config.HIBP_API_KEYS)):
+    # and then sleep for 1.5 seconds (due to HIBP API request limits)
-            checker = asyncio.create_task(
+    checkers = []
-                _hibp_check(
+    for i in range(len(config.HIBP_API_KEYS)):
-                    config.HIBP_API_KEYS[i],
+        checker = asyncio.create_task(
-                    queue,
+            _hibp_check(
-                )
+                config.HIBP_API_KEYS[i],
+                queue,
             )
-            checkers.append(checker)
+        )
+        checkers.append(checker)
 
-        # Wait until all checking processes are done
+    # Wait until all checking processes are done
-        for checker in checkers:
+    for checker in checkers:
-            await checker
+        await checker
 
-    LOG.d(f"Done checking {alias_checked} HIBP API for aliases in breaches")
+    LOG.d("Done checking HIBP API for aliases in breaches")
 
 
 def notify_hibp():
@@ -1208,30 +1126,18 @@ def notify_hibp():
         Session.commit()
 
 
-def clear_users_scheduled_to_be_deleted(dry_run=False):
+def clear_users_scheduled_to_be_deleted():
     users = User.filter(
-        and_(
+        and_(User.delete_on.isnot(None), User.delete_on < arrow.now())
-            User.delete_on.isnot(None),
-            User.delete_on <= arrow.now().shift(days=-DELETE_GRACE_DAYS),
-        )
     ).all()
     for user in users:
         LOG.i(
             f"Scheduled deletion of user {user} with scheduled delete on {user.delete_on}"
         )
-        if dry_run:
-            continue
         User.delete(user.id)
         Session.commit()
 
 
-def delete_old_data():
-    oldest_valid = arrow.now().shift(days=-config.KEEP_OLD_DATA_DAYS)
-    cleanup_old_imports(oldest_valid)
-    cleanup_old_jobs(oldest_valid)
-    cleanup_old_notifications(oldest_valid)
-
-
 if __name__ == "__main__":
     LOG.d("Start running cronjob")
     parser = argparse.ArgumentParser()
@@ -1246,7 +1152,6 @@ if __name__ == "__main__":
             "notify_manual_subscription_end",
             "notify_premium_end",
             "delete_logs",
-            "delete_old_data",
             "poll_apple_subscription",
             "sanity_check",
             "delete_old_monitoring",
@@ -1275,9 +1180,6 @@ if __name__ == "__main__":
         elif args.job == "delete_logs":
             LOG.d("Deleted Logs")
             delete_logs()
-        elif args.job == "delete_old_data":
-            LOG.d("Delete old data")
-            delete_old_data()
         elif args.job == "poll_apple_subscription":
             LOG.d("Poll Apple Subscriptions")
             poll_apple_subscription()
@@ -1304,4 +1206,4 @@ if __name__ == "__main__":
             load_unsent_mails_from_fs_and_resend()
         elif args.job == "delete_scheduled_users":
             LOG.d("Deleting users scheduled to be deleted")
-            clear_users_scheduled_to_be_deleted(dry_run=True)
+            clear_users_scheduled_to_be_deleted()

app/crontab.yml

@@ -37,12 +37,6 @@ jobs:
     schedule: "15 5 * * *"
     captureStderr: true
 
-  - name: SimpleLogin Delete Old data
-    command: python /code/cron.py -j delete_old_data
-    shell: /bin/bash
-    schedule: "30 5 * * *"
-    captureStderr: true
-
   - name: SimpleLogin Poll Apple Subscriptions
     command: python /code/cron.py -j poll_apple_subscription
     shell: /bin/bash
@@ -68,7 +62,7 @@ jobs:
     captureStderr: true
 
   - name: SimpleLogin delete users scheduled to be deleted
-    command: python /code/cron.py -j delete_scheduled_users
+    command: echo disabled_user_deletion #python /code/cron.py -j delete_scheduled_users
     shell: /bin/bash
     schedule: "15 11 * * *"
     captureStderr: true

app/docs/api.md

@@ -388,7 +388,7 @@ Input:
 - (Optional but recommended) `hostname` passed in query string
 - Request Message Body in json (`Content-Type` is `application/json`)
     - alias_prefix: string. The first part of the alias that user can choose.
-    - signed_suffix: should be one of the suffixes returned in the `GET /api/v5/alias/options` endpoint.
+    - signed_suffix: should be one of the suffixes returned in the `GET /api/v4/alias/options` endpoint.
     - mailbox_ids: list of mailbox_id that "owns" this alias
     - (Optional) note: alias note
     - (Optional) name: alias name

app/email_handler.py

@@ -53,7 +53,7 @@ from flanker.addresslib.address import EmailAddress
 from sqlalchemy.exc import IntegrityError
 
 from app import pgp_utils, s3, config
-from app.alias_utils import try_auto_create, change_alias_status
+from app.alias_utils import try_auto_create
 from app.config import (
     EMAIL_DOMAIN,
     URL,
@@ -236,16 +236,15 @@ def get_or_create_contact(from_header: str, mail_from: str, alias: Alias) -> Con
             Session.commit()
     else:
         try:
-            contact_email_for_reply = (
-                contact_email if is_valid_email(contact_email) else ""
-            )
             contact = Contact.create(
                 user_id=alias.user_id,
                 alias_id=alias.id,
                 website_email=contact_email,
                 name=contact_name,
                 mail_from=mail_from,
-                reply_email=generate_reply_email(contact_email_for_reply, alias),
+                reply_email=generate_reply_email(contact_email, alias)
+                if is_valid_email(contact_email)
+                else NOREPLY,
                 automatic_created=True,
             )
             if not contact_email:
@@ -637,10 +636,6 @@ def handle_forward(envelope, msg: Message, rcpt_to: str) -> List[Tuple[bool, str
 
     user = alias.user
 
-    if not user.is_active():
-        LOG.w(f"User {user} has been soft deleted")
-        return False, status.E502
-
     if not user.can_send_or_receive():
         LOG.i(f"User {user} cannot receive emails")
         if should_ignore_bounce(envelope.mail_from):
@@ -875,7 +870,6 @@ def forward_email_to_mailbox(
         # References and In-Reply-To are used for keeping the email thread
         headers.REFERENCES,
         headers.IN_REPLY_TO,
-        headers.SL_QUEUE_ID,
         headers.LIST_UNSUBSCRIBE,
         headers.LIST_UNSUBSCRIBE_POST,
     ] + headers.MIME_HEADERS
@@ -1061,9 +1055,6 @@ def handle_reply(envelope, msg: Message, rcpt_to: str) -> (bool, str):
     if not contact:
         LOG.w(f"No contact with {reply_email} as reverse alias")
         return False, status.E502
-    if not contact.user.is_active():
-        LOG.w(f"User {contact.user} has been soft deleted")
-        return False, status.E502
 
     alias = contact.alias
     alias_address: str = contact.alias.email
@@ -1180,7 +1171,6 @@ def handle_reply(envelope, msg: Message, rcpt_to: str) -> (bool, str):
             # References and In-Reply-To are used for keeping the email thread
             headers.REFERENCES,
             headers.IN_REPLY_TO,
-            headers.SL_QUEUE_ID,
         ]
         + headers.MIME_HEADERS,
     )
@@ -1585,7 +1575,7 @@ def handle_bounce_forward_phase(msg: Message, email_log: EmailLog):
         LOG.w(
             f"Disable alias {alias} because {reason}. {alias.mailboxes} {alias.user}. Last contact {contact}"
         )
-        change_alias_status(alias, enabled=False)
+        alias.enabled = False
 
         Notification.create(
             user_id=user.id,
@@ -1893,30 +1883,24 @@ def handle_transactional_bounce(
     envelope: Envelope, msg, rcpt_to, transactional_id=None
 ):
     LOG.d("handle transactional bounce sent to %s", rcpt_to)
-    if transactional_id is None:
-        LOG.i(
-            f"No transactional record for {envelope.mail_from} -> {envelope.rcpt_tos}"
-        )
-        return
 
+    # parse the TransactionalEmail
+    transactional_id = transactional_id or parse_id_from_bounce(rcpt_to)
     transactional = TransactionalEmail.get(transactional_id)
+
     # a transaction might have been deleted in delete_logs()
-    if not transactional:
+    if transactional:
-        LOG.i(
+        LOG.i("Create bounce for %s", transactional.email)
-            f"No transactional record for {envelope.mail_from} -> {envelope.rcpt_tos}"
+        bounce_info = get_mailbox_bounce_info(msg)
-        )
+        if bounce_info:
-        return
+            Bounce.create(
-    LOG.i("Create bounce for %s", transactional.email)
+                email=transactional.email,
-    bounce_info = get_mailbox_bounce_info(msg)
+                info=bounce_info.as_bytes().decode(),
-    if bounce_info:
+                commit=True,
-        Bounce.create(
+            )
-            email=transactional.email,
+        else:
-            info=bounce_info.as_bytes().decode(),
+            LOG.w("cannot get bounce info, debug at %s", save_email_for_debugging(msg))
-            commit=True,
+            Bounce.create(email=transactional.email, commit=True)
-        )
-    else:
-        LOG.w("cannot get bounce info, debug at %s", save_email_for_debugging(msg))
-        Bounce.create(email=transactional.email, commit=True)
 
 
 def handle_bounce(envelope, email_log: EmailLog, msg: Message) -> str:
@@ -1937,9 +1921,6 @@ def handle_bounce(envelope, email_log: EmailLog, msg: Message) -> str:
         contact,
         alias,
     )
-    if not email_log.user.is_active():
-        LOG.d(f"User {email_log.user} is not active")
-        return status.E510
 
     if email_log.is_reply:
         content_type = msg.get_content_type().lower()
@@ -2001,9 +1982,6 @@ def send_no_reply_response(mail_from: str, msg: Message):
     if not mailbox:
         LOG.d("Unknown sender. Skipping reply from {}".format(NOREPLY))
         return
-    if not mailbox.user.is_active():
-        LOG.d(f"User {mailbox.user} is soft-deleted. Skipping sending reply response")
-        return
     send_email_at_most_times(
         mailbox.user,
         ALERT_TO_NOREPLY,
@@ -2042,11 +2020,10 @@ def handle(envelope: Envelope, msg: Message) -> str:
         return status.E204
 
     # sanitize email headers
-    sanitize_header(msg, headers.FROM)
+    sanitize_header(msg, "from")
-    sanitize_header(msg, headers.TO)
+    sanitize_header(msg, "to")
-    sanitize_header(msg, headers.CC)
+    sanitize_header(msg, "cc")
-    sanitize_header(msg, headers.REPLY_TO)
+    sanitize_header(msg, "reply-to")
-    sanitize_header(msg, headers.MESSAGE_ID)
 
     LOG.d(
         "==>> Handle mail_from:%s, rcpt_tos:%s, header_from:%s, header_to:%s, "

app/event_listener.py

@@ -1,64 +0,0 @@
-import argparse
-from enum import Enum
-from sys import argv, exit
-
-from app.config import DB_URI
-from app.log import LOG
-from events.runner import Runner
-from events.event_source import DeadLetterEventSource, PostgresEventSource
-from events.event_sink import ConsoleEventSink, HttpEventSink
-
-
-class Mode(Enum):
-    DEAD_LETTER = "dead_letter"
-    LISTENER = "listener"
-
-    @staticmethod
-    def from_str(value: str):
-        if value == Mode.DEAD_LETTER.value:
-            return Mode.DEAD_LETTER
-        elif value == Mode.LISTENER.value:
-            return Mode.LISTENER
-        else:
-            raise ValueError(f"Invalid mode: {value}")
-
-
-def main(mode: Mode, dry_run: bool):
-    if mode == Mode.DEAD_LETTER:
-        LOG.i("Using DeadLetterEventSource")
-        source = DeadLetterEventSource()
-    elif mode == Mode.LISTENER:
-        LOG.i("Using PostgresEventSource")
-        source = PostgresEventSource(DB_URI)
-    else:
-        raise ValueError(f"Invalid mode: {mode}")
-
-    if dry_run:
-        LOG.i("Starting with ConsoleEventSink")
-        sink = ConsoleEventSink()
-    else:
-        LOG.i("Starting with HttpEventSink")
-        sink = HttpEventSink()
-
-    runner = Runner(source=source, sink=sink)
-    runner.run()
-
-
-def args():
-    parser = argparse.ArgumentParser(description="Run event listener")
-    parser.add_argument(
-        "mode",
-        help="Mode to run",
-        choices=[Mode.DEAD_LETTER.value, Mode.LISTENER.value],
-    )
-    parser.add_argument("--dry-run", help="Dry run mode", action="store_true")
-    return parser.parse_args()
-
-
-if __name__ == "__main__":
-    if len(argv) < 2:
-        print("Invalid usage. Pass 'listener' or 'dead_letter' as argument")
-        exit(1)
-
-    args = args()
-    main(Mode.from_str(args.mode), args.dry_run)

app/events/event_sink.py

@@ -1,42 +0,0 @@
-import requests
-
-from abc import ABC, abstractmethod
-from app.config import EVENT_WEBHOOK, EVENT_WEBHOOK_SKIP_VERIFY_SSL
-from app.log import LOG
-from app.models import SyncEvent
-
-
-class EventSink(ABC):
-    @abstractmethod
-    def process(self, event: SyncEvent) -> bool:
-        pass
-
-
-class HttpEventSink(EventSink):
-    def process(self, event: SyncEvent) -> bool:
-        if not EVENT_WEBHOOK:
-            LOG.warning("Skipping sending event because there is no webhook configured")
-            return False
-
-        LOG.info(f"Sending event {event.id} to {EVENT_WEBHOOK}")
-
-        res = requests.post(
-            url=EVENT_WEBHOOK,
-            data=event.content,
-            headers={"Content-Type": "application/x-protobuf"},
-            verify=not EVENT_WEBHOOK_SKIP_VERIFY_SSL,
-        )
-        if res.status_code != 200:
-            LOG.warning(
-                f"Failed to send event to webhook: {res.status_code} {res.text}"
-            )
-            return False
-        else:
-            LOG.info(f"Event {event.id} sent successfully to webhook")
-            return True
-
-
-class ConsoleEventSink(EventSink):
-    def process(self, event: SyncEvent) -> bool:
-        LOG.info(f"Handling event {event.id}")
-        return True

app/events/event_source.py

@@ -1,100 +0,0 @@
-import arrow
-import newrelic.agent
-import psycopg2
-import select
-
-from abc import ABC, abstractmethod
-from app.log import LOG
-from app.models import SyncEvent
-from app.events.event_dispatcher import NOTIFICATION_CHANNEL
-from time import sleep
-from typing import Callable, NoReturn
-
-_DEAD_LETTER_THRESHOLD_MINUTES = 10
-_DEAD_LETTER_INTERVAL_SECONDS = 30
-
-_POSTGRES_RECONNECT_INTERVAL_SECONDS = 5
-
-
-class EventSource(ABC):
-    @abstractmethod
-    def run(self, on_event: Callable[[SyncEvent], NoReturn]):
-        pass
-
-
-class PostgresEventSource(EventSource):
-    def __init__(self, connection_string: str):
-        self.__connection_string = connection_string
-        self.__connect()
-
-    def run(self, on_event: Callable[[SyncEvent], NoReturn]):
-        while True:
-            try:
-                self.__listen(on_event)
-            except Exception as e:
-                LOG.warn(f"Error listening to events: {e}")
-                sleep(_POSTGRES_RECONNECT_INTERVAL_SECONDS)
-                self.__connect()
-
-    def __listen(self, on_event: Callable[[SyncEvent], NoReturn]):
-        self.__connection.set_isolation_level(
-            psycopg2.extensions.ISOLATION_LEVEL_AUTOCOMMIT
-        )
-
-        cursor = self.__connection.cursor()
-        cursor.execute(f"LISTEN {NOTIFICATION_CHANNEL};")
-
-        while True:
-            if select.select([self.__connection], [], [], 5) != ([], [], []):
-                self.__connection.poll()
-                while self.__connection.notifies:
-                    notify = self.__connection.notifies.pop(0)
-                    LOG.debug(
-                        f"Got NOTIFY: pid={notify.pid} channel={notify.channel} payload={notify.payload}"
-                    )
-                    try:
-                        webhook_id = int(notify.payload)
-                        event = SyncEvent.get_by(id=webhook_id)
-                        if event is not None:
-                            if event.mark_as_taken():
-                                on_event(event)
-                            else:
-                                LOG.info(
-                                    f"Event {event.id} was handled by another runner"
-                                )
-                        else:
-                            LOG.info(f"Could not find event with id={notify.payload}")
-                    except Exception as e:
-                        LOG.warn(f"Error getting event: {e}")
-
-    def __connect(self):
-        self.__connection = psycopg2.connect(self.__connection_string)
-
-        from app.db import Session
-
-        Session.close()
-
-
-class DeadLetterEventSource(EventSource):
-    @newrelic.agent.background_task()
-    def run(self, on_event: Callable[[SyncEvent], NoReturn]):
-        while True:
-            try:
-                threshold = arrow.utcnow().shift(
-                    minutes=-_DEAD_LETTER_THRESHOLD_MINUTES
-                )
-                events = SyncEvent.get_dead_letter(older_than=threshold)
-                if events:
-                    LOG.info(f"Got {len(events)} dead letter events")
-                    if events:
-                        newrelic.agent.record_custom_metric(
-                            "Custom/dead_letter_events_to_process", len(events)
-                        )
-                    for event in events:
-                        on_event(event)
-                else:
-                    LOG.debug("No dead letter events")
-                    sleep(_DEAD_LETTER_INTERVAL_SECONDS)
-            except Exception as e:
-                LOG.warn(f"Error getting dead letter event: {e}")
-                sleep(_DEAD_LETTER_INTERVAL_SECONDS)

app/events/runner.py

@@ -1,42 +0,0 @@
-import arrow
-import newrelic.agent
-
-from app.log import LOG
-from app.models import SyncEvent
-from events.event_sink import EventSink
-from events.event_source import EventSource
-
-
-class Runner:
-    def __init__(self, source: EventSource, sink: EventSink):
-        self.__source = source
-        self.__sink = sink
-
-    def run(self):
-        self.__source.run(self.__on_event)
-
-    @newrelic.agent.background_task()
-    def __on_event(self, event: SyncEvent):
-        try:
-            event_created_at = event.created_at
-            start_time = arrow.now()
-            success = self.__sink.process(event)
-            if success:
-                event_id = event.id
-                SyncEvent.delete(event.id, commit=True)
-                LOG.info(f"Marked {event_id} as done")
-
-                end_time = arrow.now() - start_time
-                time_between_taken_and_created = start_time - event_created_at
-
-                newrelic.agent.record_custom_metric("Custom/sync_event_processed", 1)
-                newrelic.agent.record_custom_metric(
-                    "Custom/sync_event_process_time", end_time.total_seconds()
-                )
-                newrelic.agent.record_custom_metric(
-                    "Custom/sync_event_elapsed_time",
-                    time_between_taken_and_created.total_seconds(),
-                )
-        except Exception as e:
-            LOG.warn(f"Exception processing event [id={event.id}]: {e}")
-            newrelic.agent.record_custom_metric("Custom/sync_event_failed", 1)

app/example.env

@@ -116,14 +116,6 @@ WORDS_FILE_PATH=local_data/test_words.txt
 # CONNECT_WITH_PROTON=true
 # CONNECT_WITH_PROTON_COOKIE_NAME=to_fill
 
-# Login with OIDC
-# CONNECT_WITH_OIDC_ICON=fa-github
-# OIDC_WELL_KNOWN_URL=to_fill
-# OIDC_SCOPES=openid email profile
-# OIDC_NAME_FIELD=name
-# OIDC_CLIENT_ID=to_fill
-# OIDC_CLIENT_SECRET=to_fill
-
 # Flask profiler
 # FLASK_PROFILER_PATH=/tmp/flask-profiler.sql
 # FLASK_PROFILER_PASSWORD=password

app/local_data/test_words.txt

@@ -192,6 +192,7 @@ amigos
 amines
 amnion
 amoeba
+amoral
 amount
 amours
 ampere
@@ -214,6 +215,7 @@ animus
 anions
 ankles
 anklet
+annals
 anneal
 annoys
 annual
@@ -362,6 +364,7 @@ auntie
 aureus
 aurora
 author
+autism
 autumn
 avails
 avatar
@@ -635,12 +638,14 @@ bigwig
 bijoux
 bikers
 biking
+bikini
 bilges
 bilked
 bilker
 billed
 billet
 billow
+bimbos
 binary
 binder
 binged
@@ -705,6 +710,8 @@ blocks
 blokes
 blonde
 blonds
+bloods
+bloody
 blooms
 bloops
 blotch
@@ -810,6 +817,8 @@ bounds
 bounty
 bovine
 bovver
+bowels
+bowers
 bowing
 bowled
 bowleg
@@ -818,8 +827,10 @@ bowman
 bowmen
 bowwow
 boxcar
+boxers
 boxier
 boxing
+boyish
 braced
 bracer
 braces
@@ -850,6 +861,7 @@ breach
 breads
 breaks
 breams
+breast
 breath
 breech
 breeds
@@ -860,6 +872,9 @@ brevet
 brewed
 brewer
 briars
+bribed
+briber
+bribes
 bricks
 bridal
 brides
@@ -911,7 +926,13 @@ buffed
 buffer
 buffet
 bugged
+bugger
+bugled
+bugler
+bugles
 builds
+bulged
+bulges
 bulked
 bulled
 bullet
@@ -1319,6 +1340,8 @@ clingy
 clinic
 clinks
 clique
+cloaca
+cloaks
 cloche
 clocks
 clomps
@@ -1425,6 +1448,7 @@ comply
 compos
 conchs
 concur
+condom
 condor
 condos
 coneys
@@ -1544,6 +1568,8 @@ cranes
 cranks
 cranky
 cranny
+crapes
+crappy
 crated
 crater
 crates
@@ -1559,6 +1585,7 @@ crazes
 creaks
 creaky
 creams
+creamy
 crease
 create
 creche
@@ -1567,6 +1594,8 @@ credos
 creeds
 creeks
 creels
+creeps
+creepy
 cremes
 creole
 crepes
@@ -1699,6 +1728,9 @@ dainty
 daises
 damage
 damask
+dammed
+dammit
+damned
 damped
 dampen
 damper
@@ -1722,6 +1754,7 @@ darers
 daring
 darken
 darker
+darkie
 darkly
 darned
 darner
@@ -1730,6 +1763,8 @@ darter
 dashed
 dasher
 dashes
+daters
+dating
 dative
 daubed
 dauber
@@ -1886,6 +1921,7 @@ dharma
 dhotis
 diadem
 dialog
+diaper
 diatom
 dibble
 dicier
@@ -1907,6 +1943,7 @@ digits
 diking
 diktat
 dilate
+dildos
 dilute
 dimity
 dimmed
@@ -2021,6 +2058,7 @@ dotted
 double
 doubly
 doubts
+douche
 doughy
 dourer
 dourly
@@ -2101,6 +2139,15 @@ duenna
 duffed
 duffer
 dugout
+dulcet
+dulled
+duller
+dumber
+dumbly
+dumbos
+dumdum
+dumped
+dumper
 dunces
 dunged
 dunked
@@ -2238,6 +2285,7 @@ endows
 endued
 endues
 endure
+enemas
 energy
 enfold
 engage
@@ -2285,6 +2333,7 @@ erects
 ermine
 eroded
 erodes
+erotic
 errand
 errant
 errata
@@ -2295,6 +2344,7 @@ eructs
 erupts
 escape
 eschew
+escort
 escrow
 escudo
 espied
@@ -2313,6 +2363,7 @@ ethnic
 etudes
 euchre
 eulogy
+eunuch
 eureka
 evaded
 evader
@@ -2341,6 +2392,7 @@ exempt
 exerts
 exeunt
 exhale
+exhort
 exhume
 exiled
 exiles
@@ -2363,6 +2415,7 @@ extant
 extend
 extent
 extols
+extort
 extras
 exuded
 exudes
@@ -2387,6 +2440,7 @@ faeces
 faerie
 faffed
 fagged
+faggot
 failed
 faille
 fainer
@@ -2419,10 +2473,18 @@ faring
 farmed
 farmer
 farrow
+farted
 fascia
 fasted
 fasten
 faster
+father
+fathom
+fating
+fatsos
+fatten
+fatter
+fatwas
 faucet
 faults
 faulty
@@ -2470,6 +2532,7 @@ fesses
 festal
 fester
 feting
+fetish
 fetter
 fettle
 feudal
@@ -2554,7 +2617,9 @@ flaked
 flakes
 flambe
 flamed
+flamer
 flames
+flange
 flanks
 flared
 flares
@@ -2689,6 +2754,8 @@ franks
 frappe
 frauds
 frayed
+freaks
+freaky
 freely
 freest
 freeze
@@ -2728,6 +2795,8 @@ fryers
 frying
 ftpers
 ftping
+fucked
+fucker
 fuddle
 fudged
 fudges
@@ -2822,7 +2891,10 @@ gasbag
 gashed
 gashes
 gasket
+gasman
+gasmen
 gasped
+gassed
 gasses
 gateau
 gather
@@ -3032,6 +3104,7 @@ grimed
 grimes
 grimly
 grinds
+gringo
 griped
 griper
 gripes
@@ -3113,6 +3186,8 @@ gypsum
 gyrate
 gyving
 habits
+hacked
+hacker
 hackle
 hadith
 haggis
@@ -3120,6 +3195,8 @@ haggle
 hailed
 hairdo
 haired
+hajjes
+hajjis
 halest
 haling
 halite
@@ -3146,8 +3223,11 @@ happen
 haptic
 harass
 harden
+harder
+hardly
 harems
 haring
+harked
 harlot
 harmed
 harped
@@ -3327,6 +3407,7 @@ hoofed
 hoofer
 hookah
 hooked
+hooker
 hookup
 hooped
 hoopla
@@ -3378,6 +3459,8 @@ huffed
 hugely
 hugest
 hugged
+hulled
+huller
 humane
 humans
 humble
@@ -3584,6 +3667,8 @@ jacket
 jading
 jagged
 jaguar
+jailed
+jailer
 jalopy
 jammed
 jangle
@@ -3604,6 +3689,8 @@ jejune
 jelled
 jellos
 jennet
+jerked
+jerkin
 jersey
 jested
 jester
@@ -3727,7 +3814,11 @@ kidded
 kidder
 kiddie
 kiddos
+kidnap
 kidney
+killed
+killer
+kilned
 kilted
 kilter
 kimono
@@ -3736,11 +3827,15 @@ kinder
 kindle
 kindly
 kingly
+kinked
 kiosks
 kipped
 kipper
 kirsch
 kismet
+kissed
+kisser
+kisses
 kiting
 kitsch
 kitted
@@ -3752,6 +3847,10 @@ kluges
 klutzy
 knacks
 knaves
+kneads
+kneels
+knells
+knifed
 knifes
 knight
 knives
@@ -4111,6 +4210,8 @@ lunges
 lupine
 lupins
 luring
+lurked
+lurker
 lusher
 lushes
 lushly
@@ -4507,6 +4608,7 @@ muggle
 mukluk
 mulcts
 mulish
+mullah
 mulled
 mullet
 mumble
@@ -4619,6 +4721,9 @@ nickel
 nicker
 nickle
 nieces
+niggas
+niggaz
+nigger
 niggle
 nigher
 nights
@@ -4631,6 +4736,7 @@ ninjas
 ninths
 nipped
 nipper
+nipple
 nitric
 nitwit
 nixing
@@ -4675,6 +4781,15 @@ nozzle
 nuance
 nubbin
 nubile
+nuclei
+nudest
+nudged
+nudges
+nudism
+nudist
+nudity
+nugget
+nuking
 numbed
 number
 numbly
@@ -4689,6 +4804,7 @@ nutter
 nuzzle
 nybble
 nylons
+nympho
 nymphs
 oafish
 oaring
@@ -4769,6 +4885,7 @@ opting
 option
 opuses
 oracle
+orally
 orange
 orated
 orates
@@ -4780,6 +4897,7 @@ ordeal
 orders
 ordure
 organs
+orgasm
 orgies
 oriels
 orient
@@ -4875,6 +4993,10 @@ pander
 panels
 panics
 panned
+panted
+pantie
+pantos
+pantry
 papacy
 papaya
 papers
@@ -4956,6 +5078,7 @@ pebble
 pebbly
 pecans
 pecked
+pecker
 pectic
 pectin
 pedalo
@@ -5028,6 +5151,9 @@ phenom
 phials
 phlegm
 phloem
+phobia
+phobic
+phoebe
 phoned
 phones
 phoney
@@ -5102,6 +5228,9 @@ piques
 piracy
 pirate
 pirogi
+pissed
+pisser
+pisses
 pistes
 pistil
 pistol
@@ -5182,6 +5311,8 @@ pogrom
 points
 pointy
 poised
+poises
+poison
 pokers
 pokeys
 pokier
@@ -5291,6 +5422,7 @@ preyed
 priced
 prices
 pricey
+pricks
 prided
 prides
 priers
@@ -5470,9 +5602,14 @@ rabbit
 rabble
 rabies
 raceme
+racers
+racial
 racier
 racily
 racing
+racism
+racist
+racked
 racket
 radars
 radial
@@ -5524,6 +5661,8 @@ rapers
 rapids
 rapier
 rapine
+raping
+rapist
 rapped
 rappel
 rapper
@@ -5608,6 +5747,7 @@ recoup
 rectal
 rector
 rectos
+rectum
 recurs
 recuse
 redact
@@ -5751,6 +5891,7 @@ resume
 retail
 retain
 retake
+retard
 retell
 retest
 retied
@@ -5984,6 +6125,8 @@ sadden
 sadder
 saddle
 sadhus
+sadism
+sadist
 safari
 safely
 safest
@@ -6221,6 +6364,16 @@ severs
 sewage
 sewers
 sewing
+sexier
+sexily
+sexing
+sexism
+sexist
+sexpot
+sextet
+sexton
+sexual
+shabby
 shacks
 shaded
 shades
@@ -6230,7 +6383,10 @@ shaggy
 shaken
 shaker
 shakes
+shalom
 shaman
+shamed
+shames
 shandy
 shanks
 shanty
@@ -6276,6 +6432,7 @@ shirks
 shirrs
 shirts
 shirty
+shitty
 shiver
 shoals
 shoats
@@ -6418,6 +6575,9 @@ slangy
 slants
 slated
 slates
+slaved
+slaver
+slaves
 slayed
 slayer
 sleaze
@@ -6512,6 +6672,7 @@ snarks
 snarky
 snarls
 snarly
+snatch
 snazzy
 sneaks
 sneaky
@@ -6555,6 +6716,7 @@ socket
 sodded
 sodden
 sodium
+sodomy
 soever
 soften
 softer
@@ -7306,6 +7468,7 @@ torrid
 torsos
 tortes
 tossed
+tosser
 tosses
 tossup
 totals
@@ -7523,6 +7686,7 @@ unhook
 unhurt
 unions
 unique
+unisex
 unison
 united
 unites
@@ -7629,6 +7793,7 @@ vacant
 vacate
 vacuum
 vagary
+vagina
 vaguer
 vainer
 vainly
@@ -7765,6 +7930,9 @@ votive
 vowels
 vowing
 voyage
+voyeur
+vulgar
+vulvae
 wabbit
 wacker
 wackos
@@ -7807,6 +7975,7 @@ wander
 wangle
 waning
 wanked
+wanker
 wanner
 wanted
 wanton

app/local_data/words.txt

@@ -1944,6 +1944,7 @@ dosage
 dose
 dotted
 doubling
+douche
 dove
 down
 dowry
@@ -3014,6 +3015,7 @@ groom
 groove
 grooving
 groovy
+grope
 ground
 grouped
 grout
@@ -3133,6 +3135,7 @@ happiness
 happy
 harbor
 hardcopy
+hardcore
 hardcover
 harddisk
 hardened
@@ -6550,6 +6553,7 @@ swimmer
 swimming
 swimsuit
 swimwear
+swinger
 swinging
 swipe
 swirl
@@ -7460,7 +7464,9 @@ villain
 vindicate
 vineyard
 vintage
+violate
 violation
+violator
 violet
 violin
 viper

app/migrations/versions/2024_020110_818b0a956205_.py

@@ -1,29 +0,0 @@
-"""empty message
-
-Revision ID: 818b0a956205
-Revises: 4bc54632d9aa
-Create Date: 2024-02-01 10:43:46.253184
-
-"""
-import sqlalchemy_utils
-from alembic import op
-import sqlalchemy as sa
-
-
-# revision identifiers, used by Alembic.
-revision = '818b0a956205'
-down_revision = '4bc54632d9aa'
-branch_labels = None
-depends_on = None
-
-
-def upgrade():
-    # ### commands auto generated by Alembic - please adjust! ###
-    op.add_column('alias', sa.Column('last_email_log_id', sa.Integer(), nullable=True))
-    # ### end Alembic commands ###
-
-
-def downgrade():
-    # ### commands auto generated by Alembic - please adjust! ###
-    op.drop_column('alias', 'last_email_log_id')
-    # ### end Alembic commands ###

app/migrations/versions/2024_031212_52510a633d6f_.py

@@ -1,48 +0,0 @@
-"""empty message
-
-Revision ID: 52510a633d6f
-Revises: 818b0a956205
-Create Date: 2024-03-12 12:46:24.161644
-
-"""
-import sqlalchemy_utils
-from alembic import op
-import sqlalchemy as sa
-
-
-# revision identifiers, used by Alembic.
-revision = "52510a633d6f"
-down_revision = "818b0a956205"
-branch_labels = None
-depends_on = None
-
-
-def upgrade():
-    # ### commands auto generated by Alembic - please adjust! ###
-    op.add_column(
-        "alias", sa.Column("flags", sa.BigInteger(), server_default="0", nullable=False)
-    )
-    with op.get_context().autocommit_block():
-        op.create_index(op.f("ix_alias_flags"), "alias", ["flags"], unique=False)
-        op.create_index(op.f("ix_job_state"), "job", ["state"], unique=False)
-        op.create_index(
-            "ix_state_run_at_taken_at",
-            "job",
-            ["state", "run_at", "taken_at"],
-            unique=False,
-        )
-        op.create_index(
-            op.f("ix_notification_user_id"), "notification", ["user_id"], unique=False
-        )
-    # ### end Alembic commands ###
-
-
-def downgrade():
-    # ### commands auto generated by Alembic - please adjust! ###
-    with op.get_context().autocommit_block():
-        op.drop_index(op.f("ix_notification_user_id"), table_name="notification")
-        op.drop_index("ix_state_run_at_taken_at", table_name="job")
-        op.drop_index(op.f("ix_job_state"), table_name="job")
-        op.drop_index(op.f("ix_alias_flags"), table_name="alias")
-    op.drop_column("alias", "flags")
-    # ### end Alembic commands ###

app/migrations/versions/2024_040913_fa2f19bb4e5a_.py

@@ -1,29 +0,0 @@
-"""empty message
-
-Revision ID: fa2f19bb4e5a
-Revises: 52510a633d6f
-Create Date: 2024-04-09 13:12:26.305340
-
-"""
-import sqlalchemy_utils
-from alembic import op
-import sqlalchemy as sa
-
-
-# revision identifiers, used by Alembic.
-revision = 'fa2f19bb4e5a'
-down_revision = '52510a633d6f'
-branch_labels = None
-depends_on = None
-
-
-def upgrade():
-    # ### commands auto generated by Alembic - please adjust! ###
-    op.add_column('users', sa.Column('enable_data_breach_check', sa.Boolean(), server_default='0', nullable=False))
-    # ### end Alembic commands ###
-
-
-def downgrade():
-    # ### commands auto generated by Alembic - please adjust! ###
-    op.drop_column('users', 'enable_data_breach_check')
-    # ### end Alembic commands ###

app/migrations/versions/2024_051713_06a9a7133445_.py

@@ -1,38 +0,0 @@
-"""Create sync_event table
-
-Revision ID: 06a9a7133445
-Revises: fa2f19bb4e5a
-Create Date: 2024-05-17 13:11:20.402259
-
-"""
-import sqlalchemy_utils
-from alembic import op
-import sqlalchemy as sa
-
-
-# revision identifiers, used by Alembic.
-revision = '06a9a7133445'
-down_revision = 'fa2f19bb4e5a'
-branch_labels = None
-depends_on = None
-
-
-def upgrade():
-    # ### commands auto generated by Alembic - please adjust! ###
-    op.create_table('sync_event',
-    sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
-    sa.Column('created_at', sqlalchemy_utils.types.arrow.ArrowType(), nullable=False),
-    sa.Column('updated_at', sqlalchemy_utils.types.arrow.ArrowType(), nullable=True),
-    sa.Column('content', sa.LargeBinary(), nullable=False),
-    sa.Column('taken_time', sqlalchemy_utils.types.arrow.ArrowType(), nullable=True),
-    sa.PrimaryKeyConstraint('id')
-    )
-    op.create_index(op.f('ix_sync_event_created_at'), 'sync_event', ['created_at'], unique=False)
-    op.create_index(op.f('ix_sync_event_taken_time'), 'sync_event', ['taken_time'], unique=False)
-    # ### end Alembic commands ###
-
-
-def downgrade():
-    # ### commands auto generated by Alembic - please adjust! ###
-    op.drop_table('sync_event')
-    # ### end Alembic commands ###

app/monitoring.py

@@ -4,7 +4,6 @@ import subprocess
 from time import sleep
 from typing import List, Dict
 
-import arrow
 import newrelic.agent
 
 from app.db import Session
@@ -94,44 +93,11 @@ def log_nb_db_connection():
     newrelic.agent.record_custom_metric("Custom/nb_db_connections", nb_connection)
 
 
-@newrelic.agent.background_task()
-def log_pending_to_process_events():
-    r = Session.execute("select count(*) from sync_event WHERE taken_time IS NULL;")
-    events_pending = list(r)[0][0]
-
-    LOG.d("number of events pending to process %s", events_pending)
-    newrelic.agent.record_custom_metric(
-        "Custom/sync_events_pending_to_process", events_pending
-    )
-
-
-@newrelic.agent.background_task()
-def log_events_pending_dead_letter():
-    since = arrow.now().shift(minutes=-10).datetime
-    r = Session.execute(
-        """
-        SELECT COUNT(*)
-        FROM sync_event
-        WHERE (taken_time IS NOT NULL AND taken_time < :since)
-           OR (taken_time IS NULL AND created_at < :since)
-        """,
-        {"since": since},
-    )
-    events_pending = list(r)[0][0]
-
-    LOG.d("number of events pending dead letter %s", events_pending)
-    newrelic.agent.record_custom_metric(
-        "Custom/sync_events_pending_dead_letter", events_pending
-    )
-
-
 if __name__ == "__main__":
     exporter = MetricExporter(get_newrelic_license())
     while True:
         log_postfix_metrics()
         log_nb_db_connection()
-        log_pending_to_process_events()
-        log_events_pending_dead_letter()
         Session.close()
 
         exporter.run()

app/oneshot/backfill_email_log.py

@@ -1,44 +0,0 @@
-#!/usr/bin/env python3
-import argparse
-import time
-
-from sqlalchemy import func
-from app.models import Alias
-from app.db import Session
-
-parser = argparse.ArgumentParser(
-    prog="Backfill alias", description="Backfill alias las use"
-)
-parser.add_argument(
-    "-s", "--start_alias_id", default=0, type=int, help="Initial alias_id"
-)
-parser.add_argument("-e", "--end_alias_id", default=0, type=int, help="Last alias_id")
-
-args = parser.parse_args()
-alias_id_start = args.start_alias_id
-max_alias_id = args.end_alias_id
-if max_alias_id == 0:
-    max_alias_id = Session.query(func.max(Alias.id)).scalar()
-
-print(f"Checking alias {alias_id_start} to {max_alias_id}")
-step = 1000
-el_query = "SELECT alias_id, MAX(id) from email_log where alias_id>=:start AND alias_id < :end GROUP BY alias_id"
-alias_query = "UPDATE alias set last_email_log_id = :el_id where id = :alias_id"
-updated = 0
-start_time = time.time()
-for batch_start in range(alias_id_start, max_alias_id, step):
-    rows = Session.execute(el_query, {"start": batch_start, "end": batch_start + step})
-    for row in rows:
-        Session.execute(alias_query, {"alias_id": row[0], "el_id": row[1]})
-        Session.commit()
-        updated += 1
-    elapsed = time.time() - start_time
-    time_per_alias = elapsed / (updated + 1)
-    last_batch_id = batch_start + step
-    remaining = max_alias_id - last_batch_id
-    time_remaining = (max_alias_id - last_batch_id) * time_per_alias
-    hours_remaining = time_remaining / 3600.0
-    print(
-        f"\rAlias {batch_start}/{max_alias_id} {updated} {hours_remaining:.2f}hrs remaining"
-    )
-print("")

app/oneshot/emulate_dummy_load.py

@@ -1,37 +0,0 @@
-#!/usr/bin/env python3
-import argparse
-import random
-import time
-
-from sqlalchemy import func
-
-from app import config
-from app.models import Alias, Contact
-from app.db import Session
-
-parser = argparse.ArgumentParser(
-    prog=f"Replace {config.NOREPLY}",
-    description=f"Replace {config.NOREPLY} from contacts reply email",
-)
-args = parser.parse_args()
-
-max_alias_id: int = Session.query(func.max(Alias.id)).scalar()
-
-start = time.time()
-tests = 1000
-for i in range(tests):
-    alias = (
-        Alias.filter(Alias.id > int(random.random() * max_alias_id))
-        .order_by(Alias.id.asc())
-        .limit(1)
-        .first()
-    )
-    contact = Contact.filter_by(alias_id=alias.id).order_by(Contact.id.asc()).first()
-    mailboxes = alias.mailboxes
-    user = alias.user
-    if i % 10:
-        print("{i} -> {alias.id}")
-
-end = time.time()
-time_taken = end - start
-print(f"Took {time_taken} -> {time_taken/tests} per test")

app/oneshot/mark_aliases_as_partner_created.py

@@ -1,56 +0,0 @@
-#!/usr/bin/env python3
-import argparse
-import time
-
-from sqlalchemy import func
-
-from app.models import Alias, SLDomain
-from app.db import Session
-
-parser = argparse.ArgumentParser(
-    prog="Mark partner created aliases with the PARTNER_CREATED flag",
-)
-parser.add_argument(
-    "-s", "--start_alias_id", default=0, type=int, help="Initial alias_id"
-)
-parser.add_argument("-e", "--end_alias_id", default=0, type=int, help="Last alias_id")
-
-args = parser.parse_args()
-alias_id_start = args.start_alias_id
-max_alias_id = args.end_alias_id
-if max_alias_id == 0:
-    max_alias_id = Session.query(func.max(Alias.id)).scalar()
-
-print(f"Updating aliases from {alias_id_start} to {max_alias_id}")
-
-domains = SLDomain.filter(SLDomain.partner_id.isnot(None)).all()
-cond = [f"email like '%{domain.domain}'" for domain in domains]
-sql_or_cond = " OR ".join(cond)
-sql = f"UPDATE alias set flags = (flags | :flag) WHERE id >= :start and id<:end and flags & :flag = 0 and ({sql_or_cond})"
-print(sql)
-
-step = 1000
-updated = 0
-start_time = time.time()
-for batch_start in range(alias_id_start, max_alias_id, step):
-    updated += Session.execute(
-        sql,
-        {
-            "start": batch_start,
-            "end": batch_start + step,
-            "flag": Alias.FLAG_PARTNER_CREATED,
-        },
-    ).rowcount
-    elapsed = time.time() - start_time
-    time_per_alias = elapsed / (batch_start - alias_id_start + step)
-    last_batch_id = batch_start + step
-    remaining = max_alias_id - last_batch_id
-    time_remaining = (max_alias_id - last_batch_id) * time_per_alias
-    hours_remaining = time_remaining / 3600.0
-    percent = int(
-        ((batch_start - alias_id_start) * 100) / (max_alias_id - alias_id_start)
-    )
-    print(
-        f"\rAlias {batch_start}/{max_alias_id} {percent}% {updated} updated {hours_remaining:.2f}hrs remaining"
-    )
-print(f"Updated aliases up to {max_alias_id}")

app/oneshot/replace_noreply_in_contacts.py

@@ -1,53 +0,0 @@
-#!/usr/bin/env python3
-import argparse
-import time
-
-
-from app import config
-from app.email_utils import generate_reply_email
-from app.email_validation import is_valid_email
-from app.models import Alias
-from app.db import Session
-
-parser = argparse.ArgumentParser(
-    prog=f"Replace {config.NOREPLY}",
-    description=f"Replace {config.NOREPLY} from contacts reply email",
-)
-args = parser.parse_args()
-
-el_query = "SELECT id, alias_id, website_email from contact where id>=:last_id AND reply_email=:reply_email ORDER BY id ASC LIMIT :step"
-update_query = "UPDATE contact SET reply_email=:reply_email WHERE id=:contact_id "
-updated = 0
-start_time = time.time()
-step = 100
-last_id = 0
-print(f"Replacing contacts with reply_email={config.NOREPLY}")
-while True:
-    rows = Session.execute(
-        el_query, {"last_id": last_id, "reply_email": config.NOREPLY, "step": step}
-    )
-    loop_updated = 0
-    for row in rows:
-        contact_id = row[0]
-        alias_id = row[1]
-        last_id = contact_id
-        website_email = row[2]
-        contact_email_for_reply = website_email if is_valid_email(website_email) else ""
-        alias = Alias.get(alias_id)
-        if alias is None:
-            print(f"CANNOT find alias {alias_id} in database for contact {contact_id}")
-        reply_email = generate_reply_email(contact_email_for_reply, alias)
-        print(
-            f"Replacing contact {contact_id} with {website_email} reply_email for {reply_email}"
-        )
-        Session.execute(
-            update_query, {"contact_id": row[0], "reply_email": reply_email}
-        )
-        Session.commit()
-        updated += 1
-        loop_updated += 1
-    elapsed = time.time() - start_time
-    print(f"\rContact {last_id} done")
-    if loop_updated == 0:
-        break
-print("")

app/proto/event.proto

@@ -1,45 +0,0 @@
-syntax = "proto3";
-
-package simplelogin_events;
-
-message UserPlanChange {
-  uint32 plan_end_time = 1;
-}
-
-message UserDeleted {
-}
-
-message AliasCreated {
-  uint32 alias_id = 1;
-  string alias_email = 2;
-  string alias_note = 3;
-  bool enabled = 4;
-}
-
-message AliasStatusChange {
-  uint32 alias_id = 1;
-  string alias_email = 2;
-  bool enabled = 3;
-}
-
-message AliasDeleted {
-  uint32 alias_id = 1;
-  string alias_email = 2;
-}
-
-message EventContent {
-  oneof content {
-    UserPlanChange user_plan_change = 1;
-    UserDeleted user_deleted = 2;
-    AliasCreated alias_created = 3;
-    AliasStatusChange alias_status_change = 4;
-    AliasDeleted alias_deleted = 5;
-  }
-}
-
-message Event {
-  uint32 user_id = 1;
-  string external_user_id = 2;
-  uint32 partner_id = 3;
-  EventContent content = 4;
-}

app/pyproject.toml

@@ -14,14 +14,12 @@ exclude = '''
     | build
     | dist
     | migrations    # migrations/ is generated by alembic
-    | app/events/generated
   )/
 )
 '''
 
 [tool.ruff]
 ignore-init-module-imports = true
-exclude = [".venv", "migrations", "app/events/generated"]
 
 [tool.djlint]
 indent = 2

app/scripts/generate-proto-files.sh

@@ -1,24 +0,0 @@
-#!/bin/bash
-
-set -euxo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" || exit 1; pwd -P)"
-REPO_ROOT=$(echo "${SCRIPT_DIR}" | sed 's:scripts::g')
-
-DEST_DIR="${REPO_ROOT}/app/events/generated"
-
-PROTOC=${PROTOC:-"protoc"}
-
-if ! eval "${PROTOC} --version" &> /dev/null ; then
-  echo "Cannot find $PROTOC"
-  exit 1
-fi
-
-rm -rf "${DEST_DIR}"
-mkdir -p "${DEST_DIR}"
-
-pushd $REPO_ROOT || exit 1
-
-eval "${PROTOC} --proto_path=proto --python_out=\"${DEST_DIR}\" --pyi_out=\"${DEST_DIR}\" proto/event.proto"
-
-popd || exit 1

app/server.py

@@ -228,8 +228,6 @@ def load_user(alternative_id):
         sentry_sdk.set_user({"email": user.email, "id": user.id})
         if user.disabled:
             return None
-        if not user.is_active():
-            return None
 
     return user
 

app/tasks/cleanup_old_imports.py

@@ -1,19 +0,0 @@
-import arrow
-
-from app import s3
-from app.log import LOG
-from app.models import BatchImport
-
-
-def cleanup_old_imports(oldest_allowed: arrow.Arrow):
-    LOG.i(f"Deleting imports older than {oldest_allowed}")
-    for batch_import in (
-        BatchImport.filter(BatchImport.created_at < oldest_allowed).yield_per(500).all()
-    ):
-        LOG.i(
-            f"Deleting batch import {batch_import} with file {batch_import.file.path}"
-        )
-        file = batch_import.file
-        if file is not None:
-            s3.delete(file.path)
-        BatchImport.delete(batch_import.id, commit=True)

app/tasks/cleanup_old_jobs.py

@@ -1,24 +0,0 @@
-import arrow
-from sqlalchemy import or_, and_
-
-from app import config
-from app.db import Session
-from app.log import LOG
-from app.models import Job, JobState
-
-
-def cleanup_old_jobs(oldest_allowed: arrow.Arrow):
-    LOG.i(f"Deleting jobs older than {oldest_allowed}")
-    count = Job.filter(
-        or_(
-            Job.state == JobState.done.value,
-            Job.state == JobState.error.value,
-            and_(
-                Job.state == JobState.taken.value,
-                Job.attempts >= config.JOB_MAX_ATTEMPTS,
-            ),
-        ),
-        Job.updated_at < oldest_allowed,
-    ).delete()
-    Session.commit()
-    LOG.i(f"Deleted {count} jobs")

app/tasks/cleanup_old_notifications.py

@@ -1,12 +0,0 @@
-import arrow
-
-from app.db import Session
-from app.log import LOG
-from app.models import Notification
-
-
-def cleanup_old_notifications(oldest_allowed: arrow.Arrow):
-    LOG.i(f"Deleting notifications older than {oldest_allowed}")
-    count = Notification.filter(Notification.created_at < oldest_allowed).delete()
-    Session.commit()
-    LOG.i(f"Deleted {count} notifications")

app/templates/auth/login.html

@@ -38,21 +38,11 @@
           <span>or</span>
         </div>
         <a class="btn btn-primary btn-block mt-2 proton-button"
-           href="{{ url_for('auth.proton_login', next=next_url) }}">
+           href="{{ url_for("auth.proton_login", next=next_url) }}">
           <img class="mr-2" src="/static/images/proton.svg" />
           Log in with Proton
         </a>
       {% endif %}
-      {% if connect_with_oidc %}
-
-        <div class="text-center my-2 text-gray">
-          <span>or</span>
-        </div>
-        <a class="btn btn-primary btn-block mt-2 btn-social"
-           href="{{ url_for('auth.oidc_login', next=next_url) }}">
-          <i class="fa {{ connect_with_oidc_icon }}"></i> Log in with SSO
-        </a>
-      {% endif %}
     </div>
   </div>
   <div class="text-center text-muted mt-2">

app/templates/auth/mfa.html

@@ -15,7 +15,7 @@
         {{ otp_token_form.csrf_token }}
         <input type="hidden" name="form-name" value="create" />
         <div class="font-weight-bold mt-5">Token</div>
-        <div class="small-text mb-3">Please enter the 2FA code from your authenticator app</div>
+        <div class="small-text mb-3">Please enter the 2FA code from your 2FA authenticator</div>
         {{ otp_token_form.token(class="form-control", autofocus="true") }}
         {{ render_field_errors(otp_token_form.token) }}
         <div class="form-check">

app/templates/auth/register.html

@@ -9,7 +9,7 @@
       <h1 class="card-title">Create new account</h1>
       <div class="form-group">
         <label class="form-label">Email address</label>
-        {{ form.email(class="form-control", type="email", placeholder="username@proton.me") }}
+        {{ form.email(class="form-control", type="email", placeholder="YourName@protonmail.com") }}
         <div class="small-text alert alert-info" style="margin-top: 1px">
           Emails sent to your alias will be forwarded to this email address.
           <br>
@@ -50,21 +50,11 @@
           <span>or</span>
         </div>
         <a class="btn btn-primary btn-block mt-2 proton-button"
-           href="{{ url_for('auth.proton_login', next=next_url) }}">
+           href="{{ url_for("auth.proton_login", next=next_url) }}">
           <img class="mr-2" src="/static/images/proton.svg" />
           Sign up with Proton
         </a>
       {% endif %}
-      {% if connect_with_oidc %}
-
-        <div class="text-center my-2 text-gray">
-          <span>or</span>
-        </div>
-        <a class="btn btn-primary btn-block mt-2 btn-social"
-           href="{{ url_for('auth.oidc_login', next=next_url) }}">
-          <i class="fa {{ connect_with_oidc_icon }}"></i> Sign up with SSO
-        </a>
-      {% endif %}
     </div>
   </form>
   <div class="text-center text-muted mb-6">

app/templates/auth/register_waiting_activation.html

@@ -7,7 +7,6 @@
     <div class="card-body p-6 text-center">
       <h1 class="h4">An email to validate your email is on its way.</h1>
       <p>Please check your inbox/spam folder.</p>
-      <p>Make sure to mark the message as not spam so that future messages come to your normal inbox</p>
     </div>
   </div>
 {% endblock %}

app/templates/dashboard/account_setting.html

@@ -1,164 +0,0 @@
-{% extends "default.html" %}
-
-{% set active_page = "setting" %}
-{% block title %}Settings{% endblock %}
-{% block head %}
-
-  <style>
-        .card-title {
-            font-size: 22px;
-            font-weight: 600;
-            margin-bottom: 3px;
-        }
-        .highlighted{
-            border: solid 2px #5675E2;
-        }
-        li {
-            margin-top: 8px;
-        }
-
-  </style>
-{% endblock %}
-{% block default_content %}
-
-  <div class="col pb-3">
-    <!-- Change email -->
-    <div class="card">
-      <div class="card-body">
-        <form method="post" enctype="multipart/form-data">
-          <input type="hidden" name="form-name" value="update-email">
-          {{ change_email_form.csrf_token }}
-          <div class="card-title">Account Email</div>
-          <div class="mb-3">
-            This email address is used to log in to SimpleLogin.
-            <br />
-            If you want to change the mailbox that emails are forwarded to, use the
-            <a href="{{ url_for('dashboard.mailbox_route') }}">
-              <i class="fe fe-inbox"></i> Mailboxes page
-            </a>
-            instead.
-          </div>
-          <div class="form-group mt-2">
-            <!-- Not allow user to change email if there's a pending change -->
-            {{ change_email_form.email(class="form-control", value=current_user.email, readonly=pending_email != None) }}
-            {{ render_field_errors(change_email_form.email) }}
-          </div>
-          <button class="btn btn-outline-primary">Change Email</button>
-        </form>
-        {% if pending_email %}
-
-          <div class="mt-2">
-            <span class="text-danger float-left">Pending email change: {{ pending_email }}</span>
-            <form method="POST"
-                  action="{{ url_for('dashboard.resend_email_change') }}"
-                  class="float-left ml-2">
-              {{ change_email_form.csrf_token }}
-              <a onclick="this.closest('form').submit()"
-                 class="btn btn-secondary btn-sm">Resend confirmation email</a>
-            </form>
-            <form method="POST"
-                  action="{{ url_for('dashboard.cancel_email_change') }}"
-                  class="float-left ml-2">
-              {{ change_email_form.csrf_token }}
-              <a onclick="this.closest('form').submit()"
-                 class="btn btn-secondary btn-sm">Cancel email change</a>
-            </form>
-          </div>
-        {% endif %}
-      </div>
-    </div>
-    <!-- END Change email -->
-    <!-- Change password -->
-    <div class="card" id="change_password">
-      <div class="card-body">
-        <div class="card-title">Password</div>
-        <div class="mb-3">You will receive an email containing instructions on how to change your password.</div>
-        <form method="post">
-          {{ csrf_form.csrf_token }}
-          <input type="hidden" name="form-name" value="change-password">
-          <button class="btn btn-outline-primary">Change password</button>
-        </form>
-      </div>
-    </div>
-    <!-- END Change password -->
-    <!-- TOTP -->
-    <div class="card" id="totp">
-      <div class="card-body">
-        <div class="card-title">Two Factor Authentication</div>
-        <div class="mb-3">
-          Secure your account with 2FA, you'll be asked for a code generated through an app when you login.
-          <br />
-        </div>
-        {% if not current_user.enable_otp %}
-
-          <a href="{{ url_for('dashboard.mfa_setup') }}"
-             class="btn btn-outline-primary">Setup TOTP</a>
-        {% else %}
-          <a href="{{ url_for('dashboard.mfa_cancel') }}"
-             class="btn btn-outline-danger">Disable TOTP</a>
-        {% endif %}
-      </div>
-    </div>
-    <!-- END TOTP -->
-    <!-- WebAuthn -->
-    <div class="card">
-      <div class="card-body">
-        <div class="card-title">Security Key (WebAuthn)</div>
-        <div class="mb-3">
-          You can secure your account by linking either your FIDO-supported physical key such as Yubikey, Google
-          Titan,
-          or a device with appropriate hardware to your account.
-        </div>
-        {% if current_user.fido_uuid is none %}
-
-          <a href="{{ url_for('dashboard.fido_setup') }}"
-             class="btn btn-outline-primary">Setup WebAuthn</a>
-        {% else %}
-          <a href="{{ url_for('dashboard.fido_manage') }}"
-             class="btn btn-outline-info">Manage WebAuthn</a>
-        {% endif %}
-      </div>
-    </div>
-    <!-- END WebAuthn -->
-    <!-- data export -->
-    <div class="card">
-      <div class="card-body">
-        <div class="card-title">SimpleLogin data export</div>
-        <div class="mb-3">
-          As per GDPR (General Data Protection Regulation) law, you can request a copy of your data which are stored on
-          SimpleLogin.
-          A zip file that contains all information will be sent to your SimpleLogin account address.
-        </div>
-        <div class="d-flex">
-          <div>
-            <form method="post">
-              {{ csrf_form.csrf_token }}
-              <input type="hidden" name="form-name" value="send-full-user-report">
-              <button class="btn btn-outline-info">Request your data</button>
-            </form>
-          </div>
-        </div>
-      </div>
-    </div>
-    <!-- END data export -->
-    <!-- Delete account -->
-    <div class="card">
-      <div class="card-body">
-        <div class="card-title">Account Deletion</div>
-        <div class="mb-3">If SimpleLogin isn't the right fit for you, you can simply delete your account.</div>
-        <a href="{{ url_for('dashboard.delete_account') }}"
-           class="btn btn-outline-danger">Delete account</a>
-      </div>
-    </div>
-    <!-- END Delete account -->
-  </div>
-{% endblock %}
-{% block script %}
-
-  <script>
-        let anchor = window.location.hash;
-        $(anchor).addClass("highlighted")
-
-
-  </script>
-{% endblock %}

app/templates/dashboard/alias_contact_manager.html

@@ -59,29 +59,26 @@
       </div>
     </div>
   </div>
-  {% if can_create_contacts %}
+  <div class="row mb-5">
+    <div class="col-12 col-lg-6 pt-1">
+      <form method="post">
+        <input type="hidden" name="form-name" value="create" />
+        {{ new_contact_form.csrf_token }}
+        {{ new_contact_form.email(class="form-control", placeholder="First Last <email@example.com>", autofocus=True) }}
+        {{ render_field_errors(new_contact_form.email) }}
+        <div class="small-text">Where do you want to send the email?</div>
+        {% if can_create_contacts %}
 
-    <div class="row mb-5">
+          <button class="btn btn-primary mt-2">Create reverse-alias</button>
-      <div class="col-12 col-lg-6 pt-1">
+        {% else %}
-        <form method="post">
+          <button disabled
-          <input type="hidden" name="form-name" value="create" />
+                  title="Upgrade to premium to create reverse-aliases"
-          {{ new_contact_form.csrf_token }}
+                  class="btn btn-primary mt-2">
-          {{ new_contact_form.email(class="form-control", placeholder="First Last <email@example.com>", autofocus=True) }}
+            Create reverse-alias
-          {{ render_field_errors(new_contact_form.email) }}
+          </button>
-          <div class="small-text">Where do you want to send the email?</div>
+        {% endif %}
-          {% if can_create_contacts %}
+      </form>
-
+    </div>
-            <button class="btn btn-primary mt-2">Create reverse-alias</button>
-          {% else %}
-            <button disabled
-                    title="Upgrade to premium to create reverse-aliases"
-                    class="btn btn-primary mt-2">
-              Create reverse-alias
-            </button>
-          {% endif %}
-        </form>
-      </div>
-    {% endif %}
     <div class="col-12 col-lg-6 pt-1">
       <div class="float-right d-flex">
         <form method="post">

app/templates/dashboard/custom_alias.html

@@ -17,7 +17,7 @@
               <b>hello@{{ FIRST_ALIAS_DOMAIN }}</b>,
               <b>me@{{ FIRST_ALIAS_DOMAIN }}</b>, etc.
               <br />
-              If you add your own domain (or subdomain), this restriction is removed, and you can fully customize the alias.
+              If you add your own domain, this restriction is removed, and you can fully customize the alias.
               <br />
             </div>
           </div>
@@ -93,7 +93,6 @@
         </div>
         <div class="row">
           <div class="col p-1">
-            {{ csrf_form.csrf_token }}
             <button type="submit" id="create" class="btn btn-primary mt-1">Create</button>
           </div>
         </div>

app/templates/dashboard/enter_sudo.html

@@ -22,20 +22,11 @@
           <p>Alternatively you can use your Proton credentials to ensure it's you.</p>
         </div>
         <a class="btn btn-primary btn-block mt-2 proton-button w-25"
-           href="{{ url_for('auth.proton_login', next=next) }}">
+           href="{{ url_for("auth.proton_login", next=next) }}">
           <img class="mr-2" src="/static/images/proton.svg" />
           Authenticate with Proton
         </a>
       {% endif %}
-      {% if connect_with_oidc %}
-
-        <div class="my-3">
-          <p>Alternatively you can use your SSO credentials to ensure it's you.</p>
-          <a class="btn btn-primary btn-block mt-2 btn-social w-25"
-             href="{{ url_for('auth.oidc_login', next=next) }}">
-            <i class="fa {{ connect_with_oidc_icon }}"></i> Authenticate with SSO
-          </a>
-        {% endif %}
-      </div>
     </div>
-  {% endblock %}
+  </div>
+{% endblock %}

app/templates/dashboard/mfa_setup.html

@@ -12,7 +12,7 @@
     <div class="card-body">
       <h1 class="h3">Two Factor Authentication - TOTP</h1>
       <p>
-        You will need to use a 2FA application like Proton Pass or Aegis on your phone or PC and scan the following QR Code:
+        You will need to use a 2FA application like Google Authenticator or Authy on your phone or PC and scan the following QR Code:
       </p>
       <canvas id="qr"></canvas>
       <script>

app/templates/dashboard/notification.html

@@ -10,7 +10,7 @@
       <div>{{ notification.message | safe }}</div>
       <form method="post"
             class="float-right mt-3"
-            onsubmit="return confirm('This operation is irreversible, please confirm');">
+            onsubmit="return confirm('This operation is not reversible, please confirm');">
         <button class="btn btn-outline-danger">Delete</button>
       </form>
     </div>

app/templates/dashboard/setting.html

@@ -88,6 +88,45 @@
       </div>
     </div>
     <!-- END Current plan -->
+    <!-- TOTP -->
+    <div class="card" id="totp">
+      <div class="card-body">
+        <div class="card-title">Two Factor Authentication</div>
+        <div class="mb-3">
+          Secure your account with 2FA, you'll be asked for a code generated through an app when you login.
+          <br />
+        </div>
+        {% if not current_user.enable_otp %}
+
+          <a href="{{ url_for('dashboard.mfa_setup') }}"
+             class="btn btn-outline-primary">Setup TOTP</a>
+        {% else %}
+          <a href="{{ url_for('dashboard.mfa_cancel') }}"
+             class="btn btn-outline-danger">Disable TOTP</a>
+        {% endif %}
+      </div>
+    </div>
+    <!-- END TOTP -->
+    <!-- WebAuthn -->
+    <div class="card">
+      <div class="card-body">
+        <div class="card-title">Security Key (WebAuthn)</div>
+        <div class="mb-3">
+          You can secure your account by linking either your FIDO-supported physical key such as Yubikey, Google
+          Titan,
+          or a device with appropriate hardware to your account.
+        </div>
+        {% if current_user.fido_uuid is none %}
+
+          <a href="{{ url_for('dashboard.fido_setup') }}"
+             class="btn btn-outline-primary">Setup WebAuthn</a>
+        {% else %}
+          <a href="{{ url_for('dashboard.fido_manage') }}"
+             class="btn btn-outline-info">Manage WebAuthn</a>
+        {% endif %}
+      </div>
+    </div>
+    <!-- END WebAuthn -->
     <!-- Newsletter -->
     <div class="card" id="notification">
       <div class="card-body">
@@ -140,6 +179,52 @@
       </form>
     </div>
     <!-- END change name & profile picture -->
+    <!-- Change email -->
+    <div class="card">
+      <div class="card-body">
+        <form method="post" enctype="multipart/form-data">
+          <input type="hidden" name="form-name" value="update-email">
+          {{ change_email_form.csrf_token }}
+          <div class="card-title">Account Email</div>
+          <div class="mb-3">
+            This email address is used to log in to SimpleLogin.
+            <br />
+            If you want to change the mailbox that emails are forwarded to, use the
+            <a href="{{ url_for('dashboard.mailbox_route') }}">
+              <i class="fe fe-inbox"></i> Mailboxes page
+            </a>
+            instead.
+          </div>
+          <div class="form-group mt-2">
+            <!-- Not allow user to change email if there's a pending change -->
+            {{ change_email_form.email(class="form-control", value=current_user.email, readonly=pending_email != None) }}
+            {{ render_field_errors(change_email_form.email) }}
+          </div>
+          <button class="btn btn-outline-primary">Change Email</button>
+        </form>
+        {% if pending_email %}
+
+          <div class="mt-2">
+            <span class="text-danger float-left">Pending email change: {{ pending_email }}</span>
+            <form method="POST"
+                  action="{{ url_for('dashboard.resend_email_change') }}"
+                  class="float-left ml-2">
+              {{ change_email_form.csrf_token }}
+              <a onclick="this.closest('form').submit()"
+                 class="btn btn-secondary btn-sm">Resend confirmation email</a>
+            </form>
+            <form method="POST"
+                  action="{{ url_for('dashboard.cancel_email_change') }}"
+                  class="float-left ml-2">
+              {{ change_email_form.csrf_token }}
+              <a onclick="this.closest('form').submit()"
+                 class="btn btn-secondary btn-sm">Cancel email change</a>
+            </form>
+          </div>
+        {% endif %}
+      </div>
+    </div>
+    <!-- END Change email -->
     <!-- Connect with Proton -->
     {% if connect_with_proton %}
 
@@ -180,11 +265,32 @@
       </div>
     {% endif %}
     <!-- END Connect with Proton -->
+    <!-- Change password -->
+    <div class="card" id="change_password">
+      <div class="card-body">
+        <div class="card-title">Password</div>
+        <div class="mb-3">
+          You will receive an email containing instructions on how to change your password.
+        </div>
+        <form method="post">
+          {{ csrf_form.csrf_token }}
+          <input type="hidden" name="form-name" value="change-password">
+          <button class="btn btn-outline-primary">
+            Change password
+          </button>
+        </form>
+      </div>
+    </div>
+    <!-- END Change password -->
     <!-- Random alias -->
     <div id="random-alias" class="card">
       <div class="card-body">
-        <div class="card-title">Aliases</div>
+        <div class="card-title">
-        <div class="mt-3 mb-1">Change the way random aliases are generated by default.</div>
+          Aliases
+        </div>
+        <div class="mt-3 mb-1">
+          Change the way random aliases are generated by default.
+        </div>
         <form method="post" action="#random-alias" class="form-inline">
           {{ csrf_form.csrf_token }}
           <input type="hidden" name="form-name" value="change-alias-generator">
@@ -200,9 +306,13 @@
               on {{ AliasGeneratorEnum.uuid.name.upper() }}
             </option>
           </select>
-          <button class="btn btn-outline-primary">Update</button>
+          <button class="btn btn-outline-primary">
+            Update
+          </button>
         </form>
-        <div class="mt-3 mb-1">Select the default domain for aliases.</div>
+        <div class="mt-3 mb-1">
+          Select the default domain for aliases.
+        </div>
         <form method="post" action="#random-alias" class="form-inline">
           {{ csrf_form.csrf_token }}
           <input type="hidden"
@@ -228,9 +338,13 @@
               </option>
             {% endfor %}
           </select>
-          <button class="btn btn-outline-primary">Update</button>
+          <button class="btn btn-outline-primary">
+            Update
+          </button>
         </form>
-        <div id="random-alias-suffix" class="mt-3 mb-1">Select the default suffix generator for aliases.</div>
+        <div id="random-alias-suffix" class="mt-3 mb-1">
+          Select the default suffix generator for aliases.
+        </div>
         <form method="post" action="#random-alias-suffix" class="form-inline">
           {{ csrf_form.csrf_token }}
           <input type="hidden" name="form-name" value="random-alias-suffix">
@@ -244,51 +358,19 @@
               Random combination of {{ ALIAS_RAND_SUFFIX_LENGTH }} letter and digits
             </option>
           </select>
-          <button class="btn btn-outline-primary">Update</button>
+          <button class="btn btn-outline-primary">
+            Update
+          </button>
         </form>
       </div>
     </div>
     <!-- END Random alias -->
-    <!-- Data breach check -->
-    <div class="card" id="data-breach">
-      <div class="card-body">
-        <div class="card-title">Data breach monitoring</div>
-        <div class="mt-1 mb-3">
-          {% if not current_user.is_premium() %}
-
-            <div class="alert alert-info" role="alert">
-              This feature is only available on Premium plan.
-              <a href="{{ url_for('dashboard.pricing') }}"
-                 target="_blank"
-                 rel="noopener noreferrer">
-                Upgrade<i class="fe fe-external-link"></i>
-              </a>
-            </div>
-          {% endif %}
-          If enabled, we will inform you via email if one of your aliases appears in a data breach.
-          <br>
-          SimpleLogin uses <a href="https://haveibeenpwned.com/">HaveIBeenPwned</a> API for checking for data breaches.
-        </div>
-        <form method="post" action="#data-breach">
-          {{ csrf_form.csrf_token }}
-          <input type="hidden" name="form-name" value="enable_data_breach_check">
-          <div class="form-check">
-            <input type="checkbox"
-                   id="enable_data_breach_check"
-                   name="enable_data_breach_check"
-                   {% if current_user.enable_data_breach_check %} checked{% endif %}
-                   class="form-check-input">
-            <label for="enable_data_breach_check">Enable data breach monitoring</label>
-          </div>
-          <button type="submit" class="btn btn-outline-primary">Update</button>
-        </form>
-      </div>
-    </div>
-    <!-- END Data breach check -->
     <!-- Sender Format -->
     <div class="card" id="sender-format">
       <div class="card-body">
-        <div class="card-title">Sender Address Format</div>
+        <div class="card-title">
+          Sender Address Format
+        </div>
         <div class="mt-1 mb-3">
           When your alias receives an email, say from: <b>John Wick &lt;john@wick.com&gt;</b>,
           SimpleLogin forwards it to your mailbox.
@@ -603,7 +685,7 @@
               sender address.
               <br />
               If this option is enabled, the original sender addresses is stored in the email header <b>X-SimpleLogin-Envelope-From</b>
-              and the original From header is stored in <b>X-SimpleLogin-Original-From</b>.
+              and the original From header is stored in <b>X-SimpleLogin-Original-From<b>.
               You can choose to display this header in your email client.
               <br />
               As email headers aren't encrypted, your mailbox service can know the sender address via this header.
@@ -627,7 +709,6 @@
             </form>
           </div>
         </div>
-        <!-- Alias import/export -->
         <div class="card">
           <div class="card-body">
             <div class="card-title">
@@ -638,12 +719,52 @@
               You can also export your aliases to a readable csv format for a future batch import.
             </div>
             <a href="{{ url_for('dashboard.batch_import_route') }}"
-               class="btn btn-outline-primary">Batch Import</a>
+               class="btn btn-outline-primary">
+              Batch Import
+            </a>
             <a href="{{ url_for('dashboard.alias_export_route') }}"
-               class="btn btn-outline-secondary">Export Aliases</a>
+               class="btn btn-outline-secondary">
+              Export Aliases
+            </a>
+          </div>
+        </div>
+        <div class="card">
+          <div class="card-body">
+            <div class="card-title">
+              SimpleLogin data export
+            </div>
+            <div class="mb-3">
+              As per GDPR (General Data Protection Regulation) law, you can request a copy of your data which are stored on
+              SimpleLogin.
+              A zip file that contains all information will be sent to your SimpleLogin account address.
+            </div>
+            <div class="d-flex">
+              <div>
+                <form method="post">
+                  {{ csrf_form.csrf_token }}
+                  <input type="hidden" name="form-name" value="send-full-user-report">
+                  <button class="btn btn-outline-info">
+                    Request your data
+                  </button>
+                </form>
+              </div>
+            </div>
+          </div>
+        </div>
+        <div class="card">
+          <div class="card-body">
+            <div class="card-title">
+              Account Deletion
+            </div>
+            <div class="mb-3">
+              If SimpleLogin isn't the right fit for you, you can simply delete your account.
+            </div>
+            <a href="{{ url_for('dashboard.delete_account') }}"
+               class="btn btn-outline-danger">
+              Delete account
+            </a>
           </div>
         </div>
-        <!-- END Alias import/export -->
       </div>
     {% endblock %}
     {% block script %}

app/templates/dashboard/support.html

@@ -18,7 +18,7 @@
           <br />
           For generic questions, i.e. not related to your account, we recommend to post the question on
           our
-          <a href="https://www.reddit.com/r/Simplelogin/">Reddit</a> or <a href="https://forum.simplelogin.io/">our official forum</a>
+          <a href="https://www.reddit.com/r/Simplelogin/">Reddit</a>
           where our community can help answer the question
           and other people with the same question can find the answer there.
         </div>

app/templates/dashboard/unsubscribe.html

@@ -1,19 +1,17 @@
 {% extends "default.html" %}
 
 {% set active_page = "dashboard" %}
-{% block title %}Deactivate an alias{% endblock %}
+{% block title %}Block an alias{% endblock %}
 {% block default_content %}
 
   <div class="card">
     <div class="card-body">
-      <h1 class="h3">Deactivate alias</h1>
+      <h1 class="h3">Block alias</h1>
       <p>
-        You are about to deactivate the alias
+        You are about to block the alias
         <a href="mailto:{{ alias }}" target="_blank">{{ alias }}</a>
       </p>
-      <p>
+      <p>After this, you will stop receiving all emails sent to this alias, please confirm.</p>
-        After this, you will stop receiving all emails sent to this alias, please confirm. You will always be able to re-activate it untill you will decide to delete it.
-      </p>
       <form method="post">
         <button class="btn btn-warning">Confirm</button>
       </form>

app/templates/emails/com/newsletter/safari-extension.html

@@ -28,7 +28,7 @@
   {{ render_text("Hi") }}
   {{ render_text("If you use Safari on a MacBook or iMac, you should check out our new Safari extension.") }}
   {{ render_text('It can be installed on
-  <a href="https://apps.apple.com/app/id6475835429">App Store</a>
+  <a href="https://apps.apple.com/app/id1494051017">App Store</a>
   . Its code is available on
   <a href="https://github.com/simple-login/mac-app">GitHub</a>
   .') }}

app/templates/emails/com/newsletter/safari-extension.txt

@@ -8,7 +8,7 @@ If you use Safari on a MacBook or iMac, you should check out our new Safari exte
 
 It can be installed on:
 
-https://apps.apple.com/app/id6475835429
+https://apps.apple.com/app/id1494051017
 
 As usual, let me know if you have any question by replying to this email.
 

app/templates/emails/com/onboarding/browser-extension.html

@@ -12,7 +12,7 @@ If you want to quickly create aliases <b>without</b> going to SimpleLogin websit
 (or other Chromium-based browsers like Brave or Vivaldi),
 <a href="https://addons.mozilla.org/firefox/addon/simplelogin/">Firefox</a>
 and
-<a href="https://apps.apple.com/app/id6475835429 ">Safari</a>
+<a href="https://apps.apple.com/app/id1494051017 ">Safari</a>
 extension.
 {% endcall %}
 

app/templates/emails/com/onboarding/browser-extension.txt

@@ -11,7 +11,7 @@ Chrome: https://chrome.google.com/webstore/detail/dphilobhebphkdjbpfohgikllaljmg
 
 Firefox: https://addons.mozilla.org/firefox/addon/simplelogin/
 
-Safari: https://apps.apple.com/app/id6475835429
+Safari: https://apps.apple.com/app/id1494051017
 
 You can also manage your aliases using SimpleLogin mobile apps, available at
 - Play Store https://play.google.com/store/apps/details?id=io.simplelogin.android

app/templates/emails/com/onboarding/welcome-proton-user.html

@@ -43,8 +43,9 @@ Note, if you are a paying Proton Mail user, you automatically receive the premiu
 {% endcall %}
 
 {% call text() %}
-For any question or feedback, please join our <a href="https://forum.simplelogin.io/">official forum</a>.
+For any question, feedback or feature request, please join our
-If you want to request a feature, please submit it on our <a href="https://github.com/simple-login/app/discussions">GitHub repo</a>.
+<a href="https://github.com/simple-login/app/discussions">GitHub forum</a>
+.
 You can also join our
 <a href="https://www.reddit.com/r/Simplelogin/">Reddit</a>
 or follow our

app/templates/emails/com/onboarding/welcome-proton-user.txt.jinja2

@@ -13,8 +13,7 @@ SimpleLogin is also available on Android and iOS so you can manage your aliases
 
 Note, if you are a paying Proton Mail user, you automatically receive the premium version of SimpleLogin.
 
-For any question or feedback, please join our official forum.
+For any question, feedback or feature request, please join our GitHub forum.
-If you want to request a feature, please submit it on our GitHub repo.
 You can also join our Reddit or follow our Twitter.
 
 Best,
@@ -27,8 +26,7 @@ Firefox: https://addons.mozilla.org/firefox/addon/simplelogin/
 Edge: https://microsoftedge.microsoft.com/addons/detail/simpleloginreceive-sen/diacfpipniklenphgljfkmhinphjlfff
 Android: https://play.google.com/store/apps/details?id=io.simplelogin.android
 iOS: https://apps.apple.com/app/id1494359858
-Github repo: https://github.com/simple-login/app/discussions
+Github forum: https://github.com/simple-login/app/discussions
-Official forum: https://forum.simplelogin.io/
 Reddit: https://www.reddit.com/r/Simplelogin/
 Twitter: https://twitter.com/simple_login
 

app/templates/emails/com/welcome.html

@@ -71,10 +71,9 @@ Please note that you can't create more than {{ MAX_NB_EMAIL_FREE_PLAN }} aliases
 
 {% endif %}
 {% call text() %}
-For any question or feedback,
+For any question, feedback or feature request, please join our
-please join our <a href="https://forum.simplelogin.io/">official forum</a>.
+<a href="https://github.com/simple-login/app/discussions">GitHub forum</a>
-If you want to request a feature,
+.
-please submit it on our <a href="https://github.com/simple-login/app/discussions">GitHub repo</a>.
 You can also join our
 <a href="https://www.reddit.com/r/Simplelogin/">Reddit</a>
 or follow our