GitLab

record security relevant events

See merge request !61

reset the over_quota flag when changing the quota - since obviously they might...

See merge request !63

reset the over_quota flag when changing the quota - since obviously they might not anymore be over quota and otherwise it will be set back

update gems

See merge request !62

whois api for identifying type of mail objects

See merge request !60

prevent purging when deleting fwd of deleted iaddress

See merge request !59

the events are recorded in the user transaction log and the user is
informed by email.

For translating event strings we use a new i18n repo that is shared with
the user interface.

There is an edge-case, when removing the last forward of a deleted
mail_object. E.g. email_user with fwd, first delete email_user,
email_iaddress gets marked as deleted. Then delete fwd and the second
delete triggers a purge. Instead the iaddress must be marked deleted and
kept around to reserve the identifier.

allow out-of-band saml signature verification

See merge request !58

Support for saml redirect bindings, where the signature is passed as
additional get parameters.

Unsigned requests

See merge request !57

Over quota tracking

See merge request !56

Introduce a flag for mailboxes that indicate whether this mailbox
is over quota or not.

The flag can be toggled through a dedicated endpoint that will be
triggered through dovecot.
Include current quota status in mailbox info and especially when
asking for a mailbox, so message delivery can be deferred at the
edge.

See https://doc.dovecot.org/configuration_manual/quota/ for background.

authentication convenience

See merge request !54

rename methods - https://rubyinrails.com/2019/04/09/rails-6-1-activerecord-deprecates-update-attributes-methods/

db maintenance - update schema & drop migrations + script to update schema from tests db

See merge request !48

update gems

See merge request !53

app pw admin access

See merge request !55

for admin show app pw and allow revocation

We have a mechanism where we allow logins only with the second factor if
the last login was very recent (maybe this is not a good idea anyway).
But for most people the totp is more annoying to get than the password.
So let's use the reissue mechanism only with webauthn.

fix an issue when trying to create a forward for an alias

See merge request !51