docs: 新增移动端界面截图（响应式布局）

- 会话 cookie 增加 Secure 标志；新增 [web].cookie_secure 配置
  （默认 true，仅本地 HTTP 调试关闭；缺失字段按安全默认处理）
- SMTP/IMAP/POP3 认证接入封禁体系（store.RecordAuthFailure 与 Web
  共用 ban_entries）：失败计数达 ban.max_fail_attempts 即封禁 IP，
  已封禁 IP 拒绝认证，堵住协议层暴力破解
- 附件存储路径遍历防护重写：FullPath 白名单校验（UUID 文件名格式）
  + baseDir 前缀兜底，非法路径返回错误；Save 扩展名白名单化
- 初始管理员不再使用 admin/admin：密码取 MAILGO_ADMIN_PASSWORD 或
  随机生成并打印一次；新增 MustChangePassword 首登强制改密
  （管理员重置密码同样触发）
- 外发中继默认验证 TLS 证书（保护 AUTH 凭据，防 MITM），直投 MX
  保持机会式 TLS；新增 outbound.relay_tls_insecure 开关（默认 false）
- 新增安全响应头中间件：HSTS、X-Frame-Options DENY、nosniff、
  Referrer-Policy、基础 CSP（frame-ancestors 'none' 防点击劫持，
  connect-src/form-action 'self' 防数据外泄）
- LDAP/OAuth 登录错误统一为通用文案，原始错误只写日志，
  不再回显邮箱/内部细节（防用户枚举与信息泄露）
- 新增 25 个回归测试：cookie 标志、封禁阈值、路径遍历用例、
  中继 TLS 验证（自签证书 STARTTLS 集成）、安全头、OAuth 文案

部署注意：升级后所有会话失效需重新登录；若直接以 HTTP 提供
服务需显式配置 cookie_secure = false。

README.md

@@ -1,18 +1,31 @@
 # MailGo
 
 Go 语言编写的轻量级邮件系统，集成 SMTP / IMAP / POP3 协议服务和 Web 管理界面。
+Web 前端采用 QQ 邮箱风格的布局：顶部导航 + 左侧文件夹栏 + 邮件列表三栏设计。
 
 ## 功能特性
 
 - **邮件协议**：SMTP（发送）、IMAP（同步）、POP3（收取），均支持 TLS 加密
 - **外部投递**：认证用户可向外部邮箱（QQ/Gmail/Outlook 等）发送邮件，内置外发队列、MX 直投、STARTTLS、指数退避重试、退信通知与 DKIM 签名
-- **Web 邮箱**：收件箱、已发送、草稿箱、富文本编辑（Quill.js）、附件上传/下载
+- **Web 邮箱**：QQ 邮箱风格界面，支持收件箱 / 已发送 / 草稿箱、未读角标与搜索过滤、全选 / 批量删除、发件人头像、富文本编辑（Quill.js）、附件上传/下载
 - **管理后台**：域名管理、用户管理、DKIM 密钥自动生成、DNS 配置提示、全量邮件查看、外发队列管理、IP 封禁管理、仪表盘统计
 - **外部认证**：OAuth2（Google / GitHub）、LDAP（可选，默认关闭）
 - **安全机制**：BCrypt 密码哈希、登录失败自动封禁 IP、外发频率限制（防滥用）、非认证禁止中继（防开放中继）、管理员可解封
 - **多数据库**：默认 SQLite，可切换 MySQL
 - **跨平台**：Linux 生产部署 + Windows 本地调试
 
+## 界面预览
+
+| 收件箱 | 邮件阅读 |
+|--------|----------|
+| ![收件箱](docs/screenshots/inbox.png) | ![邮件阅读](docs/screenshots/view.png) |
+
+| 写信 | 设置 | 登录 |
+|------|------|------|
+| ![写信](docs/screenshots/compose.png) | ![设置](docs/screenshots/settings.png) | ![登录](docs/screenshots/login.png) |
+
+> 截图使用演示数据渲染，实际界面以部署为准。
+
 ## 快速开始
 
 ### 编译
@@ -69,6 +82,11 @@ attach_dir = "/srv/mail_go/attachments"     # 附件存储目录
 
 [web]
 addr = ":8080"                             # 监听地址，支持 TCP 端口或 Unix socket
+secret_key = ""                             # Web 会话签名密钥；留空时首次启动自动生成
+                                           # 随机密钥并写入本文件（请妥善备份，泄露/丢失
+                                           # 分别意味着会话可被伪造/所有登录态失效）
+cookie_secure = true                        # 会话 cookie 仅通过 HTTPS 传输（Secure 标志）；
+                                           # 仅本地 HTTP 调试时才改为 false
 
 [smtp]
 addr = ":25"                               # SMTP 明文端口
@@ -108,6 +126,11 @@ ldap_use_tls = false
 max_fail_attempts = 5                    # 登录失败次数阈值
 ban_duration_min = 30                     # 封禁时长（分钟）
 
+[caddy]
+data_dir = ""                             # Caddy 数据目录（含 certificates/ 的那个），
+                                          # 供后台一键导入证书；留空自动探测
+                                          # /var/lib/caddy/.local/share/caddy 等常见位置
+
 [outbound]
 hostname = ""                            # EHLO 主机名，留空使用 [smtp] domain
 poll_interval = 15                       # 外发队列扫描间隔（秒）
@@ -117,6 +140,16 @@ max_recipients = 50                      # 单封邮件最大外部收件人数
 max_per_min = 30                         # 每用户每分钟最大外发数
 max_per_day = 500                        # 每用户每日最大外发数，0 表示禁用外部投递
 connect_timeout = 30                     # 连接远程 MX 超时（秒）
+relay_host = ""                          # 智能主机（smarthost），留空则直投 MX
+relay_port = 587                         # 465 = 隐式 TLS，其他端口按需 STARTTLS
+relay_user = ""                          # 中继认证用户名（AUTH PLAIN）
+relay_password = ""                      # 中继认证密码
+relay_starttls = true                    # 非 465 端口是否使用 STARTTLS
+relay_tls_insecure = false                # 是否跳过中继服务器 TLS 证书验证；
+                                          # 默认验证证书（保护中继凭据），仅自签证书
+                                          # 内网中继且明确知晓风险时才改为 true
+ip_family = "ipv4"                       # 出站地址族：ipv4（默认）| ipv6 | auto
+source_ip = ""                           # 出站源地址绑定（如静态 IPv6 地址），留空由内核选择
 ```
 
 ---
@@ -150,6 +183,16 @@ addr = "/run/mail_go/web.sock"
 
 当 `addr` 以 `/` 开头时，Gin 自动以 Unix socket 方式监听。
 
+### 3. 指定会话密钥（容器/多实例部署）
+
+会话签名密钥可通过环境变量 `MAILGO_SECRET_KEY` 覆盖（优先于配置文件，且不会写入磁盘）：
+
+```bash
+MAILGO_SECRET_KEY="$(openssl rand -hex 32)" mail_go
+```
+
+要求：长度至少 16 字节；留空时由配置文件提供（首次启动自动生成）。更换密钥后所有已登录会话立即失效，用户需重新登录。
+
 Nginx 反向代理配置：
 
 ```nginx
@@ -200,6 +243,32 @@ tls_key = "/etc/mail_go/certs/server.key"
 > # 私钥路径: /etc/letsencrypt/live/mail.example.com/privkey.pem
 > ```
 
+#### 从 Caddy 一键导入证书
+
+如果本机已用 [Caddy](https://caddyserver.com/) 托管该域名 HTTPS（Caddy 会自动签发并续期证书），
+可在管理后台 **域名管理 → 编辑域名** 页面点击 **“从 Caddy 获取证书”** 按钮，
+一键把 Caddy 存储中的证书与私钥导入邮件服务（自动启用该域名的 TLS），无需手动复制 PEM 文件。
+支持通配符证书（如 `*.example.com` 可匹配 `mail.example.com`）。
+证书支持**热加载**：导入（或手动上传）后立即生效，无需重启服务——SMTP/IMAP/POP3
+每次 TLS 握手会自动检查并重载变化的证书文件。
+
+由于 Caddy 的证书目录仅 `caddy` 用户可读，install.sh 会安装一个 root 权限的证书同步任务
+（`mailgo-caddy-sync.{path,timer}`），把 Caddy 证书树镜像到 `/srv/mail_go/tls/caddy`，
+证书续期后自动同步，mail_go 始终可读；另外还会授予 ACL 权限作为直接读取的兜底。
+安装时自动配置，也可手动执行：
+
+```bash
+sudo ./install.sh setup-caddy-cert          # 自动探测 Caddy 数据目录并配置同步 + ACL
+sudo ./install.sh setup-caddy-cert /path/to/caddy/data   # 或手动指定数据目录
+```
+
+若 Caddy 数据目录不在常见位置，可在配置文件中显式指定：
+
+```toml
+[caddy]
+data_dir = "/var/lib/caddy/.local/share/caddy"
+```
+
 ### 4. 启用 OAuth2 登录（Google 示例）
 
 ```toml
@@ -258,6 +327,30 @@ max_per_day = 500             # 设为 0 可完全禁用外部投递
 每用户每分钟/每日外发数受限；失败邮件会退信到发件人收件箱；
 管理员可在后台「外发队列」查看投递状态、手动重试或取消。
 
+> **IPv4/IPv6**：默认仅使用 IPv4 出站（`ip_family = "ipv4"`），因为很多收件方
+> （如 Gmail）会拒收没有 PTR 的 IPv6 地址，而 IPv4 通常具备正反向一致的 PTR。
+> 如需走 IPv6：请运营商为静态地址配置 PTR（指向 `mail.example.com`），
+> 然后设置 `ip_family = "ipv6"` 并把 `source_ip` 绑定到该静态地址
+> （避免内核使用轮换的临时隐私地址）。
+
+### 7. 通过智能主机（smarthost）中继外发
+
+服务器 IP 属于家庭宽带/动态 IP 段时，常被 Spamhaus PBL 等策略列表收录，
+Microsoft（Outlook/Hotmail）等收件方会直接拒收。此时建议把外发邮件交给
+第三方 SMTP 中继（Mailgun / SendGrid / Amazon SES / 阿里云邮件推送等），
+在 `[outbound]` 中配置即可，所有外部投递自动改走中继：
+
+```toml
+[outbound]
+relay_host = "smtp.example-relay.com"
+relay_port = 587          # 465 为隐式 TLS
+relay_user = "your-api-user"
+relay_password = "your-api-key"
+relay_starttls = true
+```
+
+中继使用 AUTH PLAIN 认证；本地收件人仍走本地投递，不受影响。
+
 ---
 
 ## 端口速查

config/config.go

@@ -1,10 +1,14 @@
 package config
 
 import (
+	"crypto/rand"
+	"encoding/hex"
 	"fmt"
+	"log"
 	"os"
 	"path/filepath"
 	"runtime"
+	"strings"
 
 	"github.com/BurntSushi/toml"
 )
@@ -24,8 +28,29 @@ type StorageConfig struct {
 // WebConfig holds web server settings.
 type WebConfig struct {
 	Addr string `toml:"addr"`
+	// SecretKey 是 Web 会话 cookie 的签名密钥。留空时首次启动自动生成
+	// 随机密钥并持久化到配置文件；也可通过环境变量 MAILGO_SECRET_KEY
+	// 覆盖（覆盖值不落盘，适合容器部署）。
+	SecretKey string `toml:"secret_key"`
+	// CookieSecure 控制会话 cookie 是否仅通过 HTTPS 传输（Secure 标志）。
+	// 默认 true；仅当应用直接以 HTTP 提供服务（本地调试、内网明文）时
+	// 才应改为 false。
+	CookieSecure bool `toml:"cookie_secure"`
 }
 
+// SecretKeyEnvVar 是覆盖会话签名密钥的环境变量名。
+const SecretKeyEnvVar = "MAILGO_SECRET_KEY"
+
+// InsecureLegacySecretKey 是旧版本硬编码在源码中的会话签名密钥。
+// 源码公开意味着该密钥完全不可信，任何出现都必须替换。
+const InsecureLegacySecretKey = "mail-go-secret-key-change-in-production"
+
+// MinSecretKeyLen 是允许的最短会话密钥长度（字节）。
+const MinSecretKeyLen = 16
+
+// secretKeyRandomBytes 是自动生成密钥的随机字节数（hex 编码后 64 字符）。
+const secretKeyRandomBytes = 32
+
 // SMTPConfig holds SMTP server settings.
 type SMTPConfig struct {
 	Addr           string `toml:"addr"`
@@ -78,6 +103,15 @@ type BanConfig struct {
 	BanDurationMin  int `toml:"ban_duration_min"`  // Default: 30 (minutes)
 }
 
+// CaddyConfig holds settings for importing TLS certificates from a local Caddy.
+type CaddyConfig struct {
+	// DataDir is the Caddy data directory (the one containing the
+	// "certificates/" subdirectory), used by the one-click certificate
+	// import in the admin panel. Leave empty to auto-detect common
+	// locations such as /var/lib/caddy/.local/share/caddy.
+	DataDir string `toml:"data_dir"`
+}
+
 // OutboundConfig holds outbound (external) mail delivery settings.
 type OutboundConfig struct {
 	Hostname       string `toml:"hostname"`        // EHLO 主机名，留空使用 [smtp] domain
@@ -88,6 +122,23 @@ type OutboundConfig struct {
 	MaxPerMin      int    `toml:"max_per_min"`     // 每用户每分钟最大外发数
 	MaxPerDay      int    `toml:"max_per_day"`     // 每用户每日最大外发数，0 表示禁用外部投递
 	ConnectTimeout int    `toml:"connect_timeout"` // 连接远程 MX 超时（秒）
+
+	// Smarthost relay: when relay_host is non-empty, all external mail is
+	// delivered through this relay instead of direct MX delivery. Useful when
+	// the server IP is listed in PBL/blocklists (residential/dynamic IPs).
+	RelayHost     string `toml:"relay_host"`     // 中继服务器地址，留空则直投 MX
+	RelayPort     int    `toml:"relay_port"`     // 465 = 隐式 TLS，其他端口先尝试 STARTTLS
+	RelayUser     string `toml:"relay_user"`     // 中继认证用户名（AUTH PLAIN）
+	RelayPassword string `toml:"relay_password"` // 中继认证密码
+	RelayStartTLS bool   `toml:"relay_starttls"` // 非 465 端口是否使用 STARTTLS
+	// RelayTLSInsecure 是否跳过中继服务器的 TLS 证书验证。
+	// 默认 false（验证证书），避免凭据被中间人截获；仅当使用自签证书的
+	// 内网中继且明确知晓风险时才设为 true。
+	RelayTLSInsecure bool `toml:"relay_tls_insecure"`
+
+	// IP family and source address binding for outbound connections.
+	IPFamily string `toml:"ip_family"` // ipv4（默认，PTR/SPF 最可靠）| ipv6 | auto
+	SourceIP string `toml:"source_ip"` // 出站源地址绑定（如静态 IPv6），留空由内核选择
 }
 
 // Config is the top-level configuration structure.
@@ -100,6 +151,7 @@ type Config struct {
 	POP3     POP3Config     `toml:"pop3"`
 	Auth     AuthConfig     `toml:"auth"`
 	Ban      BanConfig      `toml:"ban"`
+	Caddy    CaddyConfig    `toml:"caddy"`
 	Outbound OutboundConfig `toml:"outbound"`
 }
 
@@ -145,7 +197,8 @@ func defaultConfig() *Config {
 			AttachDir: filepath.Join(bd, "attachments"),
 		},
 		Web: WebConfig{
-			Addr: DefaultWebPort,
+			Addr:         DefaultWebPort,
+			CookieSecure: true,
 		},
 		SMTP: SMTPConfig{
 			Addr:           fmt.Sprintf(":%d", DefaultSMTPPort),
@@ -170,6 +223,8 @@ func defaultConfig() *Config {
 			MaxFailAttempts: 5,
 			BanDurationMin:  30,
 		},
+		// Caddy: 留空则自动探测常见数据目录，无需配置
+		Caddy: CaddyConfig{},
 		Outbound: OutboundConfig{
 			PollInterval:   15, // 15 秒扫描一次队列
 			MaxAttempts:    12, // 最多尝试 12 次
@@ -177,7 +232,10 @@ func defaultConfig() *Config {
 			MaxRecipients:  50, // 单封最多 50 个外部收件人
 			MaxPerMin:      30, // 每用户每分钟 30 封
 			MaxPerDay:      500,
-			ConnectTimeout: 30, // 连接远程 MX 超时 30 秒
+			ConnectTimeout: 30,  // 连接远程 MX 超时 30 秒
+			RelayPort:      587, // smarthost 默认提交端口
+			RelayStartTLS:  true,
+			IPFamily:       "ipv4",
 		},
 	}
 }
@@ -260,9 +318,72 @@ func mergeDefaults(cfg *Config, defaults *Config) *Config {
 	if cfg.Outbound.ConnectTimeout == 0 {
 		cfg.Outbound.ConnectTimeout = defaults.Outbound.ConnectTimeout
 	}
+	if cfg.Outbound.RelayPort == 0 {
+		cfg.Outbound.RelayPort = defaults.Outbound.RelayPort
+	}
+	if cfg.Outbound.IPFamily == "" {
+		cfg.Outbound.IPFamily = defaults.Outbound.IPFamily
+	}
 	return cfg
 }
 
+// generateSecretKey generates a cryptographically random session key,
+// hex-encoded (64 characters for 32 random bytes).
+func generateSecretKey() (string, error) {
+	buf := make([]byte, secretKeyRandomBytes)
+	if _, err := rand.Read(buf); err != nil {
+		return "", fmt.Errorf("生成随机会话密钥失败: %w", err)
+	}
+	return hex.EncodeToString(buf), nil
+}
+
+// ensureSecretKey guarantees that cfg holds a trustworthy session key:
+// an empty value or the known insecure legacy default is replaced with a
+// freshly generated random key. The caller is responsible for persisting
+// the updated config.
+func ensureSecretKey(cfg *Config) error {
+	if cfg.Web.SecretKey != "" && cfg.Web.SecretKey != InsecureLegacySecretKey {
+		return nil
+	}
+	key, err := generateSecretKey()
+	if err != nil {
+		return err
+	}
+	if cfg.Web.SecretKey == InsecureLegacySecretKey {
+		log.Printf("检测到不安全的旧默认会话密钥，已自动更换为随机密钥（所有已登录会话将失效）")
+	} else {
+		log.Printf("已生成随机会话密钥并写入配置文件（Web 会话签名密钥，请妥善备份）")
+	}
+	cfg.Web.SecretKey = key
+	return nil
+}
+
+// applySecretKeyEnv lets the MAILGO_SECRET_KEY environment variable
+// override the key loaded from the config file. The override value is
+// never persisted to disk.
+func applySecretKeyEnv(cfg *Config) *Config {
+	if env := os.Getenv(SecretKeyEnvVar); env != "" {
+		cfg.Web.SecretKey = env
+	}
+	return cfg
+}
+
+// ValidateSecretKey rejects session signing keys that are missing, too
+// short, or the known insecure legacy default hardcoded in old versions.
+func ValidateSecretKey(key string) error {
+	if key == "" {
+		return fmt.Errorf("Web 会话密钥为空，拒绝启动：请检查配置文件 [web].secret_key 或环境变量 %s", SecretKeyEnvVar)
+	}
+	if key == InsecureLegacySecretKey {
+		return fmt.Errorf("Web 会话密钥为已知不安全的旧默认值，拒绝启动：请删除配置文件 [web].secret_key 后重启以自动生成随机密钥")
+	}
+	if len(key) < MinSecretKeyLen {
+		return fmt.Errorf("Web 会话密钥过短（%d 字节，最少 %d）：请检查 %s 或 [web].secret_key",
+			len(key), MinSecretKeyLen, SecretKeyEnvVar)
+	}
+	return nil
+}
+
 // writeConfig writes the configuration to the given file path.
 // It creates the parent directories if they don't exist.
 func writeConfig(path string, cfg *Config) error {
@@ -281,6 +402,11 @@ func writeConfig(path string, cfg *Config) error {
 	if err := enc.Encode(cfg); err != nil {
 		return fmt.Errorf("写入配置文件失败: %w", err)
 	}
+
+	// 配置文件包含会话密钥、中继密码等敏感信息，收紧为仅属主可读写
+	if err := os.Chmod(path, 0600); err != nil {
+		return fmt.Errorf("设置配置文件权限失败 %s: %w", path, err)
+	}
 	return nil
 }
 
@@ -288,15 +414,23 @@ func writeConfig(path string, cfg *Config) error {
 // If the configuration file does not exist, it creates one with default values.
 // If the file exists but has missing fields, they are filled with defaults and the file is updated.
 func LoadConfig() (*Config, error) {
-	path := configFilePath()
+	return loadConfigFrom(configFilePath())
+}
+
+// loadConfigFrom implements LoadConfig against an explicit file path so it
+// can be unit-tested with temporary directories.
+func loadConfigFrom(path string) (*Config, error) {
 	defaults := defaultConfig()
 
 	// If config file doesn't exist, create it with defaults
 	if _, err := os.Stat(path); os.IsNotExist(err) {
+		if err := ensureSecretKey(defaults); err != nil {
+			return nil, err
+		}
 		if mkErr := writeConfig(path, defaults); mkErr != nil {
 			return nil, mkErr
 		}
-		return defaults, nil
+		return applySecretKeyEnv(defaults), nil
 	}
 
 	// Read existing config file
@@ -310,6 +444,21 @@ func LoadConfig() (*Config, error) {
 		return nil, fmt.Errorf("解析配置文件失败: %w", err)
 	}
 
+	// relay_starttls 与 web.cookie_secure 默认值为 true for safety;
+	// the raw file is checked because TOML decoding cannot distinguish
+	// an absent bool from false.
+	if !strings.Contains(string(data), "relay_starttls") {
+		cfg.Outbound.RelayStartTLS = defaults.Outbound.RelayStartTLS
+	}
+	if !strings.Contains(string(data), "cookie_secure") {
+		cfg.Web.CookieSecure = defaults.Web.CookieSecure
+	}
+
+	// 会话密钥缺失或不安全时补发随机密钥（随下面的写回一并落盘）
+	if err := ensureSecretKey(cfg); err != nil {
+		return nil, err
+	}
+
 	// Merge defaults for any missing fields
 	merged := mergeDefaults(cfg, defaults)
 
@@ -319,5 +468,5 @@ func LoadConfig() (*Config, error) {
 		return nil, writeErr
 	}
 
-	return merged, nil
+	return applySecretKeyEnv(merged), nil
 }

config/config_test.go

@@ -0,0 +1,191 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+func TestGenerateSecretKey(t *testing.T) {
+	key, err := generateSecretKey()
+	if err != nil {
+		t.Fatalf("generateSecretKey() error: %v", err)
+	}
+	// 32 随机字节 hex 编码 = 64 字符
+	if len(key) != secretKeyRandomBytes*2 {
+		t.Fatalf("key length = %d, want %d", len(key), secretKeyRandomBytes*2)
+	}
+
+	// 两次生成必须不同
+	key2, err := generateSecretKey()
+	if err != nil {
+		t.Fatalf("generateSecretKey() error: %v", err)
+	}
+	if key == key2 {
+		t.Fatal("generated keys must be unique")
+	}
+
+	if key == InsecureLegacySecretKey {
+		t.Fatal("generated key must never equal the legacy insecure default")
+	}
+}
+
+func TestLoadConfigFirstBootGeneratesSecretKey(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "mail_go.toml")
+
+	cfg, err := loadConfigFrom(path)
+	if err != nil {
+		t.Fatalf("loadConfigFrom() error: %v", err)
+	}
+	if cfg.Web.SecretKey == "" {
+		t.Fatal("secret key should be generated on first boot")
+	}
+
+	// 密钥必须落盘，保证重启后会话不失效
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read config file: %v", err)
+	}
+	if !strings.Contains(string(data), "secret_key = \""+cfg.Web.SecretKey+"\"") {
+		t.Fatalf("generated secret key should be persisted, file content:\n%s", data)
+	}
+
+	// 第二次加载返回相同密钥（会话保持）
+	cfg2, err := loadConfigFrom(path)
+	if err != nil {
+		t.Fatalf("second loadConfigFrom() error: %v", err)
+	}
+	if cfg2.Web.SecretKey != cfg.Web.SecretKey {
+		t.Fatalf("secret key must be stable across restarts: %q != %q", cfg2.Web.SecretKey, cfg.Web.SecretKey)
+	}
+
+	// 配置文件包含敏感信息，权限必须为 0600（Windows 无 POSIX 权限，跳过）
+	if runtime.GOOS != "windows" {
+		info, err := os.Stat(path)
+		if err != nil {
+			t.Fatalf("stat config file: %v", err)
+		}
+		if perm := info.Mode().Perm(); perm != 0600 {
+			t.Fatalf("config file mode = %o, want 0600", perm)
+		}
+	}
+}
+
+func TestLoadConfigBackfillsSecretKey(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "mail_go.toml")
+
+	// 模拟旧版本升级：配置文件中没有 secret_key 字段
+	old := "[web]\naddr = \":9090\"\n\n[smtp]\ndomain = \"example.com\"\n"
+	if err := os.WriteFile(path, []byte(old), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	cfg, err := loadConfigFrom(path)
+	if err != nil {
+		t.Fatalf("loadConfigFrom() error: %v", err)
+	}
+	if cfg.Web.SecretKey == "" {
+		t.Fatal("missing secret key should be backfilled")
+	}
+	// 原有字段保持不变
+	if cfg.Web.Addr != ":9090" {
+		t.Fatalf("existing field overwritten: addr = %q", cfg.Web.Addr)
+	}
+	if cfg.SMTP.Domain != "example.com" {
+		t.Fatalf("existing field overwritten: domain = %q", cfg.SMTP.Domain)
+	}
+}
+
+func TestLoadConfigReplacesLegacySecretKey(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "mail_go.toml")
+
+	content := "[web]\naddr = \":8080\"\nsecret_key = \"" + InsecureLegacySecretKey + "\"\n"
+	if err := os.WriteFile(path, []byte(content), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	cfg, err := loadConfigFrom(path)
+	if err != nil {
+		t.Fatalf("loadConfigFrom() error: %v", err)
+	}
+	if cfg.Web.SecretKey == InsecureLegacySecretKey {
+		t.Fatal("legacy insecure secret key must be replaced")
+	}
+	if cfg.Web.SecretKey == "" {
+		t.Fatal("replacement key must be non-empty")
+	}
+
+	// 替换后的密钥必须落盘
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(string(data), InsecureLegacySecretKey) {
+		t.Fatal("legacy key should be removed from the config file")
+	}
+	if !strings.Contains(string(data), cfg.Web.SecretKey) {
+		t.Fatal("replaced key should be persisted")
+	}
+}
+
+func TestSecretKeyEnvOverride(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "mail_go.toml")
+
+	// 先正常生成一个落盘密钥
+	cfg1, err := loadConfigFrom(path)
+	if err != nil {
+		t.Fatalf("first loadConfigFrom() error: %v", err)
+	}
+
+	// 环境变量覆盖运行时密钥
+	envKey := "env-override-secret-key-0123456789abcdef"
+	t.Setenv(SecretKeyEnvVar, envKey)
+
+	cfg2, err := loadConfigFrom(path)
+	if err != nil {
+		t.Fatalf("second loadConfigFrom() error: %v", err)
+	}
+	if cfg2.Web.SecretKey != envKey {
+		t.Fatalf("env var should override the file key: got %q", cfg2.Web.SecretKey)
+	}
+
+	// 环境变量的值不能落盘
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(string(data), envKey) {
+		t.Fatal("env-provided secret must not be persisted to disk")
+	}
+	// 落盘密钥保持原值
+	if !strings.Contains(string(data), cfg1.Web.SecretKey) {
+		t.Fatal("file key should remain unchanged when env override is active")
+	}
+}
+
+func TestValidateSecretKey(t *testing.T) {
+	cases := []struct {
+		name    string
+		key     string
+		wantErr bool
+	}{
+		{"empty", "", true},
+		{"legacy default", InsecureLegacySecretKey, true},
+		{"too short", "short", true},
+		{"valid hex key", "0123456789abcdef0123456789abcdef", false},
+		{"valid env style", "env-override-secret-key-0123456789abcdef", false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := ValidateSecretKey(tc.key)
+			if tc.wantErr && err == nil {
+				t.Fatalf("expected error for key %q", tc.key)
+			}
+			if !tc.wantErr && err != nil {
+				t.Fatalf("unexpected error for key %q: %v", tc.key, err)
+			}
+		})
+	}
+}

go.mod

@@ -13,6 +13,7 @@ require (
 	github.com/gin-gonic/gin v1.12.0
 	github.com/go-ldap/ldap/v3 v3.4.13
 	github.com/google/uuid v1.6.0
+	github.com/gorilla/securecookie v1.1.2
 	golang.org/x/crypto v0.48.0
 	golang.org/x/oauth2 v0.36.0
 	golang.org/x/text v0.35.0
@@ -38,7 +39,6 @@ require (
 	github.com/goccy/go-json v0.10.5 // indirect
 	github.com/goccy/go-yaml v1.19.2 // indirect
 	github.com/gorilla/context v1.1.2 // indirect
-	github.com/gorilla/securecookie v1.1.2 // indirect
 	github.com/gorilla/sessions v1.4.0 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect

install.sh

@@ -214,6 +214,20 @@ do_install() {
     # 4. 拉取代码并编译
     build_binary
 
+    # 4.5 配置 Caddy 证书同步（若检测到 Caddy），供后台一键导入使用
+    local caddy_data
+    caddy_data="$(find_caddy_data_dir 2>/dev/null || true)"
+    if [[ -n "${caddy_data}" ]]; then
+        info "检测到 Caddy（${caddy_data}），配置证书同步任务 ..."
+        if install_caddy_sync "${caddy_data}"; then
+            ok "Caddy 证书同步已配置（后台可一键导入证书）"
+        else
+            warn "Caddy 证书同步配置失败，可稍后手动执行: sudo $0 setup-caddy-cert"
+        fi
+        # ACL 兜底（失败不影响使用）
+        command -v setfacl &>/dev/null && setup_caddy_acls "${caddy_data}" || true
+    fi
+
     # 5. 部署文件
     deploy_files
 
@@ -250,6 +264,153 @@ do_install() {
     warn "⚠ 请登录后立即修改默认密码！"
 }
 
+# ======================== Caddy 证书同步 ========================
+# mail_go 后台有一键“从 Caddy 获取证书”功能：从 Caddy 的证书存储读取
+# 域名证书与私钥并导入邮件服务。Caddy 证书目录默认仅 caddy 用户可读
+# （0700/0600），且证书续期后文件会被替换（权限重置），因此安装一个
+# root 权限的 systemd path/timer 同步任务，把 Caddy 证书树镜像到
+# mail_go 可读的 <storage>/tls/caddy 目录，续期后自动更新；
+# 同时授予 ACL 作为直接读取的兜底。用法: sudo ./install.sh setup-caddy-cert [caddy数据目录]
+
+# 探测 Caddy 数据目录（包含 certificates/ 子目录的那个目录）
+find_caddy_data_dir() {
+    local candidates=(
+        "/var/lib/caddy/.local/share/caddy"
+        "/root/.local/share/caddy"
+        "/home/caddy/.local/share/caddy"
+    )
+    local d
+    for d in "${candidates[@]}"; do
+        if [[ -d "${d}/certificates" ]]; then
+            echo "${d}"
+            return 0
+        fi
+    done
+    # systemd 服务可能配置了自定义 HOME
+    local home
+    home=$(systemctl show caddy -p Environment --value 2>/dev/null | grep -oP '(?<=HOME=)[^ ]+' || true)
+    if [[ -n "${home}" && -d "${home}/.local/share/caddy/certificates" ]]; then
+        echo "${home}/.local/share/caddy"
+        return 0
+    fi
+    return 1
+}
+
+# 用 ACL 授予 mail_go 用户读取 Caddy 证书的权限（幂等，兜底用：
+# 续期后 caddy 以 0600 重建文件，ACL 可能失效，靠同步任务保障）
+setup_caddy_acls() {
+    local data_dir="${1:-$(find_caddy_data_dir 2>/dev/null || true)}"
+    [[ -n "${data_dir}" ]] || return 1
+    local certs_dir="${data_dir}/certificates"
+    [[ -d "${certs_dir}" ]] || return 1
+
+    command -v setfacl &>/dev/null || return 1
+
+    # 各级父目录需要 x（遍历）权限
+    local p="${data_dir}"
+    while [[ "${p}" != "/" ]]; do
+        setfacl -m "u:${SERVICE_USER}:x" "${p}" 2>/dev/null
+        p="$(dirname "${p}")"
+    done
+    setfacl -R -m "u:${SERVICE_USER}:rX" "${certs_dir}" 2>/dev/null
+    setfacl -R -m "d:u:${SERVICE_USER}:rX" "${certs_dir}" 2>/dev/null
+    return 0
+}
+
+# 安装证书同步脚本 + systemd path/timer 单元，并立即同步一次
+install_caddy_sync() {
+    local data_dir="$1"
+    local sync_script="/usr/local/sbin/mailgo-caddy-cert-sync.sh"
+    local sync_dir="${DATA_DIR}/tls/caddy"
+    local certs_dir="${data_dir}/certificates"
+
+    # 同步脚本（把数据目录固化进去）
+    cat > "${sync_script}" <<EOF
+#!/usr/bin/env bash
+# MailGo - 将 Caddy 证书存储镜像到 mail_go 可读目录（root 运行，
+# 由 mailgo-caddy-sync.{path,timer} 触发），供后台一键导入使用。
+set -euo pipefail
+SRC="${certs_dir}"
+SYNC="${sync_dir}"
+[[ -d "\${SRC}" ]] || exit 0
+mkdir -p "\${SYNC}"
+rm -rf "\${SYNC}/.certs.tmp"
+cp -a "\${SRC}" "\${SYNC}/.certs.tmp"
+chown -R "${SERVICE_USER}:${SERVICE_USER}" "\${SYNC}/.certs.tmp"
+chmod -R u+rwX,go-rwx "\${SYNC}/.certs.tmp"
+rm -rf "\${SYNC}/certificates"
+mv "\${SYNC}/.certs.tmp" "\${SYNC}/certificates"
+EOF
+    chmod 700 "${sync_script}"
+
+    cat > /etc/systemd/system/mailgo-caddy-sync.service <<EOF
+[Unit]
+Description=MailGo - 同步 Caddy 证书到 mail_go TLS 目录
+After=network.target
+
+[Service]
+Type=oneshot
+ExecStart=${sync_script}
+EOF
+
+    cat > /etc/systemd/system/mailgo-caddy-sync.path <<EOF
+[Unit]
+Description=MailGo - 监视 Caddy 证书目录变化并触发同步
+
+[Path]
+PathChanged=${certs_dir}
+PathChanged=${certs_dir}/*/*
+Unit=mailgo-caddy-sync.service
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+    cat > /etc/systemd/system/mailgo-caddy-sync.timer <<EOF
+[Unit]
+Description=MailGo - 定期同步 Caddy 证书（开机 + 每日兜底）
+
+[Timer]
+OnBootSec=1min
+OnUnitActiveSec=1d
+Unit=mailgo-caddy-sync.service
+
+[Install]
+WantedBy=timers.target
+EOF
+
+    systemctl daemon-reload
+    systemctl enable --now mailgo-caddy-sync.path mailgo-caddy-sync.timer >/dev/null
+    systemctl start mailgo-caddy-sync.service
+    return 0
+}
+
+do_setup_caddy_cert() {
+    check_root
+    local data_dir="${2:-}"
+    if [[ -z "${data_dir}" ]]; then
+        data_dir="$(find_caddy_data_dir || true)"
+        if [[ -z "${data_dir}" ]]; then
+            error "未检测到 Caddy 数据目录（/var/lib/caddy 等），请手动指定: sudo $0 setup-caddy-cert <caddy数据目录>"
+        fi
+        info "检测到 Caddy 数据目录: ${data_dir}"
+    elif [[ ! -d "${data_dir}/certificates" ]]; then
+        error "目录 ${data_dir} 下未找到 certificates/ 子目录，请确认传入的是 Caddy 数据目录"
+    fi
+
+    info "安装证书同步任务（systemd path + timer，续期后自动同步）..."
+    install_caddy_sync "${data_dir}"
+    ok "证书同步任务已安装并完成首次同步"
+
+    if command -v setfacl &>/dev/null && setup_caddy_acls "${data_dir}"; then
+        ok "已授予 ${SERVICE_USER} 用户直接读取 Caddy 证书的 ACL 权限（兜底）"
+    else
+        warn "未配置 ACL 兜底（不影响使用，同步镜像始终可读）"
+    fi
+
+    ok "现在可在管理后台“编辑域名”页点击“从 Caddy 获取证书”一键导入"
+}
+
 # ======================== 卸载 ========================
 do_uninstall() {
     info "========== 卸载 ${SERVICE_NAME} =========="
@@ -352,21 +513,24 @@ do_status() {
 
 # ======================== 入口 ========================
 case "${1:-}" in
-    install)   do_install   ;;
-    uninstall) do_uninstall ;;
-    start)     do_start     ;;
-    stop)      do_stop      ;;
-    restart)   do_restart   ;;
-    status)    do_status    ;;
+    install)           do_install           ;;
+    uninstall)         do_uninstall         ;;
+    start)             do_start             ;;
+    stop)              do_stop              ;;
+    restart)           do_restart           ;;
+    status)            do_status            ;;
+    setup-caddy-cert)  do_setup_caddy_cert  ;;
     *)
-        echo "用法: sudo $0 {install|uninstall|start|stop|restart|status}"
+        echo "用法: sudo $0 {install|uninstall|start|stop|restart|status|setup-caddy-cert}"
         echo ""
-        echo "  install   — 完整安装/更新（拉代码+编译+部署+启动+开机自启）"
-        echo "  uninstall — 卸载服务（可选保留数据）"
-        echo "  start     — 启动服务"
-        echo "  stop      — 停止服务"
-        echo "  restart   — 重启服务"
-        echo "  status    — 查看服务状态"
+        echo "  install          — 完整安装/更新（拉代码+编译+部署+启动+开机自启）"
+        echo "  uninstall        — 卸载服务（可选保留数据）"
+        echo "  start            — 启动服务"
+        echo "  stop             — 停止服务"
+        echo "  restart          — 重启服务"
+        echo "  status           — 查看服务状态"
+        echo "  setup-caddy-cert — 授予 mail_go 读取本机 Caddy 证书的 ACL 权限"
+        echo "                     （后台“从 Caddy 获取证书”按钮的前置条件）"
         exit 1
         ;;
 esac

internal/caddycert/caddycert.go

@@ -0,0 +1,243 @@
+// Package caddycert 从本机 Caddy 的证书存储中查找并读取某个域名
+// 的 TLS 证书与私钥，供 MailGo 一键导入使用。
+//
+// Caddy（certmagic）将 ACME 证书保存在其数据目录下的
+//
+//	<data>/certificates/<CA 目录>/<域名>/<域名>.crt
+//	<data>/certificates/<CA 目录>/<域名>/<域名>.key
+//
+// 数据目录默认是 $HOME/.local/share/caddy（systemd 服务通常是
+// /var/lib/caddy/.local/share/caddy），可通过配置 caddy.data_dir 覆盖。
+package caddycert
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"os"
+	"os/user"
+	"path/filepath"
+	"sort"
+	"strings"
+	"time"
+)
+
+// DefaultDataDirs 是未显式配置时依次探测的 Caddy 数据目录。
+var DefaultDataDirs = []string{
+	"/var/lib/caddy/.local/share/caddy", // Debian/Ubuntu 软件包的 systemd 服务默认 HOME
+	"/root/.local/share/caddy",          // 直接以 root 运行的 caddy
+	"/home/caddy/.local/share/caddy",
+}
+
+// Cert 是从 Caddy 存储中找到的一对证书与私钥（PEM 编码）。
+type Cert struct {
+	CertPEM []byte // 证书链（含叶子证书）
+	KeyPEM  []byte // 私钥
+	Source  string // 来源 .crt 文件的绝对路径
+}
+
+// Fetch 在给定的 Caddy 证书数据目录中查找 domain 的证书与私钥。
+//
+// dataDirs 按优先级从高到低排列，每个目录都是包含 certificates/ 子目录的
+// Caddy 数据目录（如 /var/lib/caddy/.local/share/caddy，或 mail_go 的同步
+// 镜像目录 /srv/mail_go/tls/caddy）；空字符串项被忽略。dataDirs 为空时仅
+// 探测 DefaultDataDirs 及当前进程用户的数据目录。
+//
+// 返回的证书保证：能组成有效的密钥对、尚未过期、且证书 SAN 覆盖 domain
+// （支持通配符证书，例如 *.example.com 的证书可匹配 mail.example.com）。
+func Fetch(domain string, dataDirs []string) (*Cert, error) {
+	domain = strings.ToLower(strings.TrimSpace(domain))
+	if domain == "" {
+		return nil, fmt.Errorf("域名为空")
+	}
+
+	roots := dataRoots(dataDirs)
+
+	var (
+		permDenied []string
+		seen       []string // 找到同名/相关文件但证书无效的来源
+	)
+	for _, root := range roots {
+		cert, found, invalid, err := searchRoot(domain, root)
+		if err != nil {
+			if os.IsPermission(err) {
+				permDenied = append(permDenied, root)
+				continue
+			}
+			continue
+		}
+		if found {
+			return cert, nil
+		}
+		seen = append(seen, invalid...)
+	}
+
+	msg := fmt.Sprintf("在 Caddy 证书存储中未找到域名 %q 的证书（请确认 Caddy 已为该域名签发证书）", domain)
+	if len(seen) > 0 {
+		msg += fmt.Sprintf("；发现相关文件但证书无效/已过期/不匹配域名: %s", strings.Join(seen, "、"))
+	}
+	if len(permDenied) > 0 {
+		msg += fmt.Sprintf("；另有目录因权限不足未能检查: %s，可运行 install.sh 的 setup-caddy-cert 授予 %s 用户读取权限",
+			strings.Join(permDenied, "、"), currentUsername())
+	}
+	return nil, fmt.Errorf("%s", msg)
+}
+
+// dataRoots 返回要探测的候选数据目录列表（去重，保留优先级顺序）。
+func dataRoots(dataDirs []string) []string {
+	var roots []string
+	seen := map[string]bool{}
+	add := func(p string) {
+		p = strings.TrimRight(filepath.Clean(p), string(filepath.Separator))
+		if p == "" || seen[p] {
+			return
+		}
+		seen[p] = true
+		roots = append(roots, p)
+	}
+
+	for _, d := range dataDirs {
+		add(d)
+	}
+	for _, d := range DefaultDataDirs {
+		add(d)
+	}
+	if home, err := os.UserHomeDir(); err == nil && home != "" {
+		add(filepath.Join(home, ".local", "share", "caddy"))
+	}
+	return roots
+}
+
+// searchRoot 在单个数据目录中查找 domain 的证书。
+// 返回 (证书, 是否找到, 找到但无效的来源列表, 错误)。
+func searchRoot(domain, root string) (*Cert, bool, []string, error) {
+	// 允许把 certificates/ 目录本身当作 data_dir 传入
+	certsDir := root
+	if filepath.Base(certsDir) != "certificates" {
+		certsDir = filepath.Join(root, "certificates")
+	}
+
+	info, err := os.Stat(certsDir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, false, nil, nil
+		}
+		return nil, false, nil, err
+	}
+	if !info.IsDir() {
+		return nil, false, nil, nil
+	}
+
+	caDirs, err := os.ReadDir(certsDir)
+	if err != nil {
+		return nil, false, nil, err
+	}
+
+	var invalid []string
+
+	// 1) 直接路径: certificates/<CA>/<domain>/<domain>.crt|.key
+	for _, ca := range caDirs {
+		if !ca.IsDir() {
+			continue
+		}
+		cert, found, bad, err := readDomainDir(filepath.Join(certsDir, ca.Name(), domain), domain)
+		if err != nil {
+			return nil, false, nil, err
+		}
+		if found {
+			return cert, true, nil, nil
+		}
+		invalid = append(invalid, bad...)
+	}
+
+	// 2) 全量扫描，处理通配符证书（如 *.example.com 目录）等情况
+	for _, ca := range caDirs {
+		if !ca.IsDir() {
+			continue
+		}
+		caPath := filepath.Join(certsDir, ca.Name())
+		domDirs, err := os.ReadDir(caPath)
+		if err != nil {
+			return nil, false, nil, err
+		}
+		for _, d := range domDirs {
+			if !d.IsDir() {
+				continue
+			}
+			cert, found, bad, err := readDomainDir(filepath.Join(caPath, d.Name()), domain)
+			if err != nil {
+				return nil, false, nil, err
+			}
+			if found {
+				return cert, true, nil, nil
+			}
+			invalid = append(invalid, bad...)
+		}
+	}
+
+	sort.Strings(invalid)
+	return nil, false, invalid, nil
+}
+
+// readDomainDir 读取 Caddy 某个域名目录下的 <name>.crt 与 <name>.key，
+// 校验其是否为 domain 的有效证书。bad 返回“存在但无效”的来源路径。
+func readDomainDir(dirPath, domain string) (*Cert, bool, []string, error) {
+	name := filepath.Base(dirPath)
+	certPath := filepath.Join(dirPath, name+".crt")
+	keyPath := filepath.Join(dirPath, name+".key")
+
+	certPEM, err := os.ReadFile(certPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, false, nil, nil
+		}
+		return nil, false, nil, err
+	}
+	keyPEM, err := os.ReadFile(keyPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, false, nil, nil
+		}
+		return nil, false, nil, err
+	}
+
+	// 只有与目标域名相关的目录才值得报“无效”，否则静默跳过
+	related := strings.TrimSuffix(name, "."+domain) == domain ||
+		name == domain || strings.HasPrefix(name, "*.") && strings.HasSuffix(domain, name[1:])
+
+	if !validPair(certPEM, keyPEM, domain) {
+		if related {
+			return nil, false, []string{certPath}, nil
+		}
+		return nil, false, nil, nil
+	}
+
+	return &Cert{CertPEM: certPEM, KeyPEM: keyPEM, Source: certPath}, true, nil, nil
+}
+
+// validPair 校验证书/私钥是否组成有效密钥对、未过期且 SAN 覆盖 domain。
+func validPair(certPEM, keyPEM []byte, domain string) bool {
+	pair, err := tls.X509KeyPair(certPEM, keyPEM)
+	if err != nil {
+		return false
+	}
+	if len(pair.Certificate) == 0 {
+		return false
+	}
+	leaf, err := x509.ParseCertificate(pair.Certificate[0])
+	if err != nil {
+		return false
+	}
+	if time.Now().After(leaf.NotAfter) {
+		return false
+	}
+	return leaf.VerifyHostname(domain) == nil
+}
+
+// currentUsername 返回当前进程的运行用户（错误提示用）。
+func currentUsername() string {
+	if u, err := user.Current(); err == nil && u.Username != "" {
+		return u.Username
+	}
+	return os.Getenv("USER")
+}

internal/caddycert/caddycert_test.go

@@ -0,0 +1,176 @@
+package caddycert
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+// makeCert 生成一份自签名证书（含指定 SAN），返回 PEM 编码的证书与私钥。
+func makeCert(t *testing.T, dnsNames []string, notBefore, notAfter time.Time) (certPEM, keyPEM []byte) {
+	t.Helper()
+
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("生成私钥失败: %v", err)
+	}
+
+	tmpl := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: dnsNames[0]},
+		DNSNames:     dnsNames,
+		NotBefore:    notBefore,
+		NotAfter:     notAfter,
+		KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
+	if err != nil {
+		t.Fatalf("生成证书失败: %v", err)
+	}
+
+	certPEM = pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
+	keyPEM = pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)})
+	return certPEM, keyPEM
+}
+
+// writeSite 在 Caddy 风格目录结构中写入某个域名的证书。
+func writeSite(t *testing.T, dataDir, domain string, certPEM, keyPEM []byte) {
+	t.Helper()
+	dir := filepath.Join(dataDir, "certificates", "acme-v02.api.letsencrypt.org-directory", domain)
+	if err := os.MkdirAll(dir, 0700); err != nil {
+		t.Fatalf("创建目录失败: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, domain+".crt"), certPEM, 0600); err != nil {
+		t.Fatalf("写入证书失败: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, domain+".key"), keyPEM, 0600); err != nil {
+		t.Fatalf("写入私钥失败: %v", err)
+	}
+}
+
+func TestFetchExactDomain(t *testing.T) {
+	dataDir := t.TempDir()
+	certPEM, keyPEM := makeCert(t, []string{"mail.example.com"}, time.Now().Add(-time.Hour), time.Now().Add(24*time.Hour))
+	writeSite(t, dataDir, "mail.example.com", certPEM, keyPEM)
+
+	got, err := Fetch("mail.example.com", []string{dataDir})
+	if err != nil {
+		t.Fatalf("Fetch 失败: %v", err)
+	}
+	if string(got.CertPEM) != string(certPEM) {
+		t.Error("返回的证书与写入的不一致")
+	}
+	if string(got.KeyPEM) != string(keyPEM) {
+		t.Error("返回的私钥与写入的不一致")
+	}
+}
+
+func TestFetchWildcardCoversSubdomain(t *testing.T) {
+	dataDir := t.TempDir()
+	certPEM, keyPEM := makeCert(t, []string{"*.example.com", "example.com"}, time.Now().Add(-time.Hour), time.Now().Add(24*time.Hour))
+	writeSite(t, dataDir, "*.example.com", certPEM, keyPEM)
+
+	got, err := Fetch("mail.example.com", []string{dataDir})
+	if err != nil {
+		t.Fatalf("通配符证书应覆盖子域名，Fetch 失败: %v", err)
+	}
+	if got.Source == "" {
+		t.Error("Source 不应为空")
+	}
+}
+
+func TestFetchSkipsExpiredCert(t *testing.T) {
+	dataDir := t.TempDir()
+	certPEM, keyPEM := makeCert(t, []string{"mail.example.com"}, time.Now().Add(-48*time.Hour), time.Now().Add(-24*time.Hour))
+	writeSite(t, dataDir, "mail.example.com", certPEM, keyPEM)
+
+	_, err := Fetch("mail.example.com", []string{dataDir})
+	if err == nil {
+		t.Fatal("过期证书不应被返回")
+	}
+	if !strings.Contains(err.Error(), "无效") {
+		t.Errorf("错误信息应说明证书无效，实际: %v", err)
+	}
+}
+
+func TestFetchNotExist(t *testing.T) {
+	dataDir := t.TempDir()
+
+	_, err := Fetch("nobody.example.com", []string{dataDir})
+	if err == nil {
+		t.Fatal("不存在的域名应返回错误")
+	}
+	if !strings.Contains(err.Error(), "未找到") {
+		t.Errorf("错误信息应包含“未找到”，实际: %v", err)
+	}
+}
+
+func TestFetchUppercaseDomainIsLowercased(t *testing.T) {
+	dataDir := t.TempDir()
+	certPEM, keyPEM := makeCert(t, []string{"mail.example.com"}, time.Now().Add(-time.Hour), time.Now().Add(24*time.Hour))
+	writeSite(t, dataDir, "mail.example.com", certPEM, keyPEM)
+
+	if _, err := Fetch("MAIL.Example.COM", []string{dataDir}); err != nil {
+		t.Fatalf("域名大小写应被归一化，Fetch 失败: %v", err)
+	}
+}
+
+func TestFetchCertificatesDirAsDataDir(t *testing.T) {
+	dataDir := t.TempDir()
+	certPEM, keyPEM := makeCert(t, []string{"mail.example.com"}, time.Now().Add(-time.Hour), time.Now().Add(24*time.Hour))
+	writeSite(t, dataDir, "mail.example.com", certPEM, keyPEM)
+
+	// 把 certificates 目录本身当作 data_dir 传入
+	certsDir := filepath.Join(dataDir, "certificates")
+	if _, err := Fetch("mail.example.com", []string{certsDir}); err != nil {
+		t.Fatalf("data_dir 直接指向 certificates 目录时应可用: %v", err)
+	}
+}
+
+func TestFetchPrefersFirstDataDir(t *testing.T) {
+	// 模拟“同步镜像目录优先”：两个目录都有该域名证书时，应返回第一个的
+	dirA := t.TempDir()
+	dirB := t.TempDir()
+	certA, keyA := makeCert(t, []string{"mail.example.com"}, time.Now().Add(-time.Hour), time.Now().Add(48*time.Hour))
+	certB, keyB := makeCert(t, []string{"mail.example.com"}, time.Now().Add(-time.Hour), time.Now().Add(24*time.Hour))
+	writeSite(t, dirA, "mail.example.com", certA, keyA)
+	writeSite(t, dirB, "mail.example.com", certB, keyB)
+
+	got, err := Fetch("mail.example.com", []string{dirA, dirB})
+	if err != nil {
+		t.Fatalf("Fetch 失败: %v", err)
+	}
+	if string(got.CertPEM) != string(certA) {
+		t.Error("应按优先级返回第一个目录中的证书")
+	}
+}
+
+func TestFetchPermissionDeniedHint(t *testing.T) {
+	if os.Geteuid() == 0 {
+		t.Skip("root 用户不受文件权限限制，跳过")
+	}
+	dataDir := t.TempDir()
+	certPEM, keyPEM := makeCert(t, []string{"mail.example.com"}, time.Now().Add(-time.Hour), time.Now().Add(24*time.Hour))
+	writeSite(t, dataDir, "mail.example.com", certPEM, keyPEM)
+	if err := os.Chmod(dataDir, 0000); err != nil {
+		t.Fatalf("chmod 失败: %v", err)
+	}
+	defer os.Chmod(dataDir, 0700)
+
+	_, err := Fetch("mail.example.com", []string{dataDir})
+	if err == nil {
+		t.Fatal("无权限时应返回错误")
+	}
+	if !strings.Contains(err.Error(), "权限不足") {
+		t.Errorf("错误信息应提示权限不足，实际: %v", err)
+	}
+}

internal/db/models.go

@@ -15,8 +15,11 @@ type User struct {
 	UsedBytes    int64     `gorm:"default:0" json:"used_bytes"`
 	IsActive     bool      `gorm:"default:true" json:"is_active"`
 	IsAdmin      bool      `gorm:"default:false" json:"is_admin"`
-	CreatedAt    time.Time `json:"created_at"`
-	UpdatedAt    time.Time `json:"updated_at"`
+	// MustChangePassword 为 true 时该用户（通常是初始管理员或被重置密码的
+	// 用户）在首次登录后必须修改密码。
+	MustChangePassword bool      `gorm:"default:false" json:"-"`
+	CreatedAt          time.Time `json:"created_at"`
+	UpdatedAt          time.Time `json:"updated_at"`
 }
 
 // TableName specifies the table name for User.

internal/imap_server/backend.go

@@ -10,6 +10,7 @@ import (
 	"strings"
 	"time"
 
+	"mail_go/config"
 	"mail_go/internal/db"
 	"mail_go/internal/mailutil"
 	"mail_go/internal/store"
@@ -26,12 +27,22 @@ import (
 // imapBackend implements backend.Backend.
 type imapBackend struct {
 	stores *store.Stores
+	banCfg config.BanConfig
 }
 
 // Login authenticates a user by email and password.
 func (b *imapBackend) Login(connInfo *imap.ConnInfo, username, password string) (backend.User, error) {
+	clientIP := store.ClientIPFromAddr(connInfo.RemoteAddr)
+
+	// 已封禁 IP 一律拒绝认证（防协议层暴力破解）
+	if banned, _ := b.stores.Bans.IsBanned(clientIP); banned {
+		return nil, backend.ErrInvalidCredentials
+	}
+
 	user, err := b.stores.Users.Authenticate(username, password)
 	if err != nil {
+		// 认证失败计数，达到阈值封禁（与 Web 登录共用 ban_entries）
+		b.stores.RecordAuthFailure(clientIP, b.banCfg.MaxFailAttempts, b.banCfg.BanDurationMin)
 		return nil, fmt.Errorf("invalid credentials: %w", err)
 	}
 

internal/imap_server/server.go

@@ -7,6 +7,7 @@ import (
 
 	"mail_go/config"
 	"mail_go/internal/store"
+	"mail_go/internal/tlsutil"
 
 	"github.com/emersion/go-imap/backend"
 	imapserver "github.com/emersion/go-imap/server"
@@ -14,32 +15,34 @@ import (
 
 // IMAPServer wraps a go-imap Server and provides mailbox access capability.
 type IMAPServer struct {
-	stores *store.Stores
-	cfg    config.IMAPConfig
+	stores    *store.Stores
+	cfg       config.IMAPConfig
+	banCfg    config.BanConfig
+	tlsLoader *tlsutil.Loader
 }
 
-// NewIMAPServer creates a new IMAP server instance.
-func NewIMAPServer(cfg config.IMAPConfig, stores *store.Stores) *IMAPServer {
+// NewIMAPServer creates a new IMAP server instance. tlsLoader may be nil
+// when TLS is not configured.
+func NewIMAPServer(cfg config.IMAPConfig, stores *store.Stores, tlsLoader *tlsutil.Loader, banCfg config.BanConfig) *IMAPServer {
 	return &IMAPServer{
-		stores: stores,
-		cfg:    cfg,
+		stores:    stores,
+		cfg:       cfg,
+		banCfg:    banCfg,
+		tlsLoader: tlsLoader,
 	}
 }
 
 func (s *IMAPServer) tlsConfig() (*tls.Config, error) {
-	if s.cfg.TLSCert == "" || s.cfg.TLSKey == "" {
+	if s.tlsLoader == nil {
 		return nil, fmt.Errorf("IMAP TLS certificate or key not configured")
 	}
-	cert, err := tls.LoadX509KeyPair(s.cfg.TLSCert, s.cfg.TLSKey)
-	if err != nil {
-		return nil, fmt.Errorf("failed to load IMAP TLS certificate: %w", err)
-	}
-	return &tls.Config{Certificates: []tls.Certificate{cert}}, nil
+	// GetCertificate 每次握手按需重载证书，证书更新后无需重启服务
+	return &tls.Config{GetCertificate: s.tlsLoader.GetCertificate}, nil
 }
 
 // newServer creates a configured imapserver.Server with the given address.
 func (s *IMAPServer) newServer(addr string, tlsConfig *tls.Config) *imapserver.Server {
-	be := &imapBackend{stores: s.stores}
+	be := &imapBackend{stores: s.stores, banCfg: s.banCfg}
 	srv := imapserver.New(be)
 	srv.Addr = addr
 	srv.TLSConfig = tlsConfig

internal/outbound/mailer.go

@@ -3,12 +3,14 @@
 // Messages queued for external recipients are stored in the outbound_messages
 // table and delivered by the Manager's background worker: MX lookup, SMTP
 // transaction over port 25 with opportunistic STARTTLS, exponential backoff
-// retries, permanent-failure bounces and DKIM signing.
+// retries, permanent-failure bounces and DKIM signing. A smarthost relay can
+// be configured for servers whose own IP is blocklisted (e.g. PBL).
 package outbound
 
 import (
 	"context"
 	"crypto/tls"
+	"encoding/base64"
 	"errors"
 	"fmt"
 	"net"
@@ -45,10 +47,23 @@ func newPermError(format string, args ...interface{}) *DeliveryError {
 	return &DeliveryError{Permanent: true, Msg: fmt.Sprintf(format, args...)}
 }
 
-// Mailer performs direct MX delivery of a single message.
+// RelayConfig describes a smarthost through which all external mail is sent.
+type RelayConfig struct {
+	Host        string
+	Port        int    // 465 = implicit TLS; other ports may use STARTTLS
+	Username    string // AUTH PLAIN credentials (empty = no authentication)
+	Password    string
+	StartTLS    bool // use STARTTLS on non-465 ports
+	TLSInsecure bool // skip certificate verification (test-only, credentials leak risk)
+}
+
+// Mailer performs direct MX delivery (or smarthost relay) of a single message.
 type Mailer struct {
 	Hostname       string // EHLO hostname presented to remote servers
 	Port           int    // destination port, 0 means the default SMTP port 25
+	Relay          *RelayConfig
+	IPFamily       string // "ipv4" (default), "ipv6" or "auto"
+	SourceIP       string // optional source address to bind (e.g. a static IPv6)
 	ConnectTimeout time.Duration
 }
 
@@ -68,17 +83,22 @@ func (m *Mailer) port() int {
 	return m.Port
 }
 
-// Deliver sends one message to one recipient via the recipient domain's MX.
-// It returns the final SMTP response text on success and a *DeliveryError on
-// failure.
+// Deliver sends one message to one recipient. When a relay is configured the
+// message goes through the smarthost; otherwise the recipient domain's MX is
+// used. It returns the final SMTP response text on success and a
+// *DeliveryError on failure.
 func (m *Mailer) Deliver(from, to string, data []byte) (string, error) {
+	if m.Relay != nil && m.Relay.Host != "" {
+		return m.deliverViaRelay(from, to, data)
+	}
+
 	at := strings.LastIndex(to, "@")
 	if at < 0 || at == len(to)-1 {
 		return "", newPermError("invalid recipient address: %s", to)
 	}
 	domain := strings.ToLower(strings.TrimSpace(to[at+1:]))
 
-	mxHosts, err := lookupMX(domain)
+	mxHosts, err := lookupMX(domain, m.IPFamily)
 	if err != nil {
 		var de *DeliveryError
 		if errors.As(err, &de) {
@@ -111,6 +131,21 @@ func (m *Mailer) Deliver(from, to string, data []byte) (string, error) {
 	return "", lastErr
 }
 
+// deliverViaRelay sends the message through the configured smarthost.
+// The relay carries AUTH credentials, so its TLS certificate is verified
+// unless RelayTLSInsecure is explicitly enabled.
+func (m *Mailer) deliverViaRelay(from, to string, data []byte) (string, error) {
+	port := m.Relay.Port
+	if port == 0 {
+		port = 587
+	}
+	implicitTLS := port == 465
+	return m.smtpTransaction(m.Relay.Host, port, implicitTLS,
+		m.Relay.StartTLS && !implicitTLS,
+		m.Relay.Username, m.Relay.Password, from, to, data,
+		m.Relay.TLSInsecure)
+}
+
 // smtpClient wraps a textproto connection to a remote SMTP server.
 type smtpClient struct {
 	conn net.Conn
@@ -191,15 +226,41 @@ func (c *smtpClient) hello(hostname string) error {
 	return nil
 }
 
+// authPlain performs AUTH PLAIN with the initial-response form, falling back
+// to the two-step form when the server asks for credentials separately.
+func (c *smtpClient) authPlain(username, password string) error {
+	b64 := base64.StdEncoding.EncodeToString([]byte("\x00" + username + "\x00" + password))
+	code, msg, err := c.cmd(235, "AUTH PLAIN %s", b64)
+	if err != nil {
+		if code == 334 {
+			_, _, err = c.cmd(235, "%s", b64)
+		}
+		if err != nil {
+			return err
+		}
+	}
+	_ = msg
+	return nil
+}
+
 // deliverToHost performs a full SMTP transaction with a single MX host.
+// Direct MX delivery is opportunistic TLS: certificates are not verified
+// because most MX certificates cannot be validated over a cold connection.
 func (m *Mailer) deliverToHost(host, from, to string, data []byte) (string, error) {
-	addr := net.JoinHostPort(host, strconv.Itoa(m.port()))
+	return m.smtpTransaction(host, m.port(), false, false, "", "", from, to, data, true)
+}
+
+// smtpTransaction performs one complete SMTP session: connect, greeting,
+// optional implicit TLS / STARTTLS, optional AUTH PLAIN, MAIL/RCPT/DATA/QUIT.
+// tlsInsecure 控制 TLS 握手时是否跳过证书验证：直投 MX 用 true（机会式
+// TLS），relay 用配置值（默认 false，保护中继凭据）。
+func (m *Mailer) smtpTransaction(host string, port int, implicitTLS, startTLS bool, username, password, from, to string, data []byte, tlsInsecure bool) (string, error) {
+	addr := net.JoinHostPort(host, strconv.Itoa(port))
 
 	ctx, cancel := context.WithTimeout(context.Background(), m.ConnectTimeout)
 	defer cancel()
 
-	dialer := &net.Dialer{Timeout: m.ConnectTimeout}
-	conn, err := dialer.DialContext(ctx, "tcp", addr)
+	conn, err := m.dialSMTP(ctx, addr)
 	if err != nil {
 		return "", newTempError("connect to %s failed: %v", addr, err)
 	}
@@ -212,26 +273,51 @@ func (m *Mailer) deliverToHost(host, from, to string, data []byte) (string, erro
 		return "", classifyResponse(err, msg)
 	}
 
-	if err := c.hello(m.Hostname); err != nil {
-		return "", err
+	tlsServerName := host
+	if ip := net.ParseIP(host); ip != nil {
+		// IP literal 同样作为 ServerName：证书验证模式下校验其 IP SAN
+		tlsServerName = ip.String()
 	}
 
-	// Opportunistic STARTTLS (RFC 3207): only when the server advertises it.
-	if _, ok := c.exts["STARTTLS"]; ok {
-		if _, _, err := c.cmd(220, "STARTTLS"); err != nil {
+	if implicitTLS {
+		tlsConn, err := tlsClientHandshake(ctx, conn, tlsServerName, host, tlsInsecure)
+		if err != nil {
 			return "", err
 		}
-		tlsConn := tls.Client(conn, &tls.Config{
-			ServerName:         host,
-			InsecureSkipVerify: true, // remote MX certificates often cannot be verified
-		})
-		if err := tlsConn.HandshakeContext(ctx); err != nil {
-			return "", newTempError("TLS handshake with %s failed: %v", host, err)
-		}
 		c.txt = textproto.NewConn(tlsConn)
 		if err := c.hello(m.Hostname); err != nil {
 			return "", err
 		}
+	} else {
+		if err := c.hello(m.Hostname); err != nil {
+			return "", err
+		}
+		// Opportunistic STARTTLS: only when the server advertises it, unless
+		// startTLS is explicitly requested (smarthost), in which case a
+		// non-advertising server is an error.
+		_, adv := c.exts["STARTTLS"]
+		if adv || startTLS {
+			if !adv && startTLS {
+				return "", newTempError("%s does not advertise STARTTLS", host)
+			}
+			if _, _, err := c.cmd(220, "STARTTLS"); err != nil {
+				return "", err
+			}
+			tlsConn, err := tlsClientHandshake(ctx, conn, tlsServerName, host, tlsInsecure)
+			if err != nil {
+				return "", err
+			}
+			c.txt = textproto.NewConn(tlsConn)
+			if err := c.hello(m.Hostname); err != nil {
+				return "", err
+			}
+		}
+	}
+
+	if username != "" {
+		if err := c.authPlain(username, password); err != nil {
+			return "", fmt.Errorf("AUTH PLAIN with %s failed: %w", host, err)
+		}
 	}
 
 	// MAIL FROM with BODY=8BITMIME when the message contains 8-bit bytes and
@@ -276,6 +362,61 @@ func (m *Mailer) deliverToHost(host, from, to string, data []byte) (string, erro
 	return fmt.Sprintf("%d %s", code, msg), nil
 }
 
+// tlsClientHandshake upgrades a plain connection to TLS.
+// Direct MX delivery passes insecure=true (opportunistic TLS: remote MX
+// certificates often cannot be verified). Relays with AUTH credentials must
+// pass insecure=false so the connection cannot be MITM'd.
+func tlsClientHandshake(ctx context.Context, conn net.Conn, serverName, host string, insecure bool) (net.Conn, error) {
+	tlsConn := tls.Client(conn, &tls.Config{
+		ServerName:         serverName,
+		InsecureSkipVerify: insecure,
+	})
+	if err := tlsConn.HandshakeContext(ctx); err != nil {
+		return nil, newTempError("TLS handshake with %s failed: %v", host, err)
+	}
+	return tlsConn, nil
+}
+
+// dialSMTP connects to a remote SMTP server, honoring the configured IP
+// family and optional source address binding.
+//
+// The default is IPv4-only: many receiving systems (e.g. Gmail) reject mail
+// from IPv6 addresses without PTR records, and the IPv4 address of a mail
+// host usually has a forward-confirmed PTR and a matching SPF entry. Switch
+// IPFamily to "ipv6"/"auto" after the ISP has configured a PTR for the
+// source address and SourceIP binds the connection to that static address.
+func (m *Mailer) dialSMTP(ctx context.Context, addr string) (net.Conn, error) {
+	host, port, err := net.SplitHostPort(addr)
+	if err != nil {
+		return nil, err
+	}
+
+	network := "tcp4"
+	if ip := net.ParseIP(host); ip != nil {
+		// Literal destination: pick the matching family.
+		if ip.To4() == nil {
+			network = "tcp6"
+		}
+	} else {
+		switch strings.ToLower(m.IPFamily) {
+		case "ipv6":
+			network = "tcp6"
+		case "auto":
+			network = "tcp"
+		default: // "ipv4" and anything unrecognized
+			network = "tcp4"
+		}
+	}
+
+	dialer := &net.Dialer{Timeout: m.ConnectTimeout}
+	if m.SourceIP != "" {
+		if ip := net.ParseIP(m.SourceIP); ip != nil {
+			dialer.LocalAddr = &net.TCPAddr{IP: ip}
+		}
+	}
+	return dialer.DialContext(ctx, network, net.JoinHostPort(host, port))
+}
+
 // is8Bit reports whether the data contains any byte >= 0x80.
 func is8Bit(data []byte) bool {
 	for _, b := range data {
@@ -288,8 +429,9 @@ func is8Bit(data []byte) bool {
 
 // lookupMX resolves the MX hosts for a domain, sorted by preference.
 // Per RFC 5321 section 5.1, when no MX record exists the domain itself is
-// used as an implicit MX with preference 0.
-func lookupMX(domain string) ([]string, error) {
+// used as an implicit MX with preference 0. ipFamily controls the ordering
+// of the A/AAAA fallback ("ipv6" puts IPv6 first, otherwise IPv4 first).
+func lookupMX(domain, ipFamily string) ([]string, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
 
@@ -308,9 +450,19 @@ func lookupMX(domain string) ([]string, error) {
 		if err != nil {
 			return nil, err
 		}
-		hosts := make([]string, 0, len(ips))
+		var hosts []string
+		var v6 []string
 		for _, ip := range ips {
-			hosts = append(hosts, ip.String())
+			if ip.IP.To4() != nil {
+				hosts = append(hosts, ip.IP.String())
+			} else {
+				v6 = append(v6, ip.IP.String())
+			}
+		}
+		if strings.EqualFold(ipFamily, "ipv6") {
+			hosts = append(v6, hosts...)
+		} else {
+			hosts = append(hosts, v6...)
 		}
 		if len(hosts) == 0 {
 			return nil, fmt.Errorf("no MX or A records for %s", domain)

internal/outbound/mailer_test.go

@@ -2,7 +2,16 @@ package outbound
 
 import (
 	"bufio"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/base64"
+	"encoding/pem"
+	"math/big"
 	"net"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -225,3 +234,286 @@ func TestMailerPermanentFailure(t *testing.T) {
 	}
 	<-done
 }
+
+func TestMailerSmarthostRelay(t *testing.T) {
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	defer ln.Close()
+
+	type result struct {
+		gotData  []byte
+		authLine string
+	}
+	ch := make(chan result, 1)
+
+	go func() {
+		conn, err := ln.Accept()
+		if err != nil {
+			ch <- result{}
+			return
+		}
+		defer conn.Close()
+		r := bufio.NewReader(conn)
+		w := bufio.NewWriter(conn)
+		_, _ = w.WriteString("220 relay.test ESMTP\r\n")
+		_ = w.Flush()
+
+		var authLine string
+		var got []byte
+		for {
+			line, err := r.ReadString('\n')
+			if err != nil {
+				break
+			}
+			trimmed := strings.TrimRight(line, "\r\n")
+			up := strings.ToUpper(trimmed)
+			switch {
+			case strings.HasPrefix(up, "EHLO"):
+				_, _ = w.WriteString("250-relay.test\r\n250-8BITMIME\r\n250 AUTH PLAIN\r\n")
+				_ = w.Flush()
+			case strings.HasPrefix(up, "AUTH PLAIN"):
+				authLine = trimmed
+				_, _ = w.WriteString("235 2.0.0 ok\r\n")
+				_ = w.Flush()
+			case strings.HasPrefix(up, "MAIL FROM"):
+				if authLine == "" {
+					_, _ = w.WriteString("530 5.7.0 auth required\r\n")
+					_ = w.Flush()
+					break
+				}
+				_, _ = w.WriteString("250 ok\r\n")
+				_ = w.Flush()
+			case strings.HasPrefix(up, "RCPT TO"):
+				_, _ = w.WriteString("250 ok\r\n")
+				_ = w.Flush()
+			case strings.HasPrefix(up, "DATA"):
+				_, _ = w.WriteString("354 go\r\n")
+				_ = w.Flush()
+				for {
+					dl, err := r.ReadString('\n')
+					if err != nil {
+						break
+					}
+					if strings.TrimRight(dl, "\r\n") == "." {
+						break
+					}
+					if strings.HasPrefix(dl, "..") {
+						dl = dl[1:]
+					}
+					got = append(got, []byte(dl)...)
+				}
+				_, _ = w.WriteString("250 queued\r\n")
+				_ = w.Flush()
+			case strings.HasPrefix(up, "QUIT"):
+				_, _ = w.WriteString("221 bye\r\n")
+				_ = w.Flush()
+				ch <- result{gotData: got, authLine: authLine}
+				return
+			}
+		}
+		ch <- result{}
+	}()
+
+	m := NewMailer("mail.lmve.net", 10*time.Second)
+	m.Relay = &RelayConfig{
+		Host:     "127.0.0.1",
+		Port:     ln.Addr().(*net.TCPAddr).Port,
+		Username: "relay-user",
+		Password: "relay-pass",
+		StartTLS: false,
+	}
+
+	// The recipient domain does not even exist — with a relay configured,
+	// no MX lookup happens and the relay still receives the message.
+	input := []byte("From: a@lmve.net\r\nTo: b@bogus-domain.invalid\r\nSubject: relay\r\n\r\nbody\r\n")
+	resp, err := m.Deliver("a@lmve.net", "b@bogus-domain.invalid", input)
+	if err != nil {
+		t.Fatalf("Deliver via relay: %v", err)
+	}
+	if !strings.HasPrefix(resp, "250") {
+		t.Fatalf("unexpected relay response: %q", resp)
+	}
+
+	res := <-ch
+	if res.authLine == "" {
+		t.Fatal("relay did not receive AUTH PLAIN")
+	}
+	wantAuth := "AUTH PLAIN " + base64.StdEncoding.EncodeToString([]byte("\x00relay-user\x00relay-pass"))
+	if res.authLine != wantAuth {
+		t.Fatalf("auth line mismatch: got %q want %q", res.authLine, wantAuth)
+	}
+	if string(res.gotData) != string(input) {
+		t.Fatalf("relay data mismatch.\ngot:  %q\nwant: %q", res.gotData, input)
+	}
+}
+
+// startTLSSMTPServer 起一个支持 STARTTLS 的 SMTP 服务器（自签证书），
+// 供 relay TLS 验证测试使用：未升级 TLS 时广告 STARTTLS 能力，
+// 收到 STARTTLS 后升级为 TLS 并重新 EHLO。
+func startTLSSMTPServer(t *testing.T) (addr string, cleanup func()) {
+	t.Helper()
+	cert, err := tls.X509KeyPair(makeSelfSignedCertPEM(t))
+	if err != nil {
+		t.Fatalf("load self-signed cert: %v", err)
+	}
+	tlsCfg := &tls.Config{Certificates: []tls.Certificate{cert}}
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+
+	go func() {
+		for {
+			conn, err := ln.Accept()
+			if err != nil {
+				return
+			}
+			go func() {
+				defer conn.Close()
+				r := bufio.NewReader(conn)
+				w := bufio.NewWriter(conn)
+				_, _ = w.WriteString("220 relay.test ESMTP ready\r\n")
+				_ = w.Flush()
+				for {
+					line, err := r.ReadString('\n')
+					if err != nil {
+						return
+					}
+					up := strings.ToUpper(strings.TrimRight(line, "\r\n"))
+					switch {
+					case strings.HasPrefix(up, "STARTTLS"):
+						_, _ = w.WriteString("220 2.0.0 ready to start TLS\r\n")
+						_ = w.Flush()
+						tlsConn := tls.Server(conn, tlsCfg)
+						if err := tlsConn.Handshake(); err != nil {
+							return
+						}
+						conn = tlsConn
+						r = bufio.NewReader(conn)
+						w = bufio.NewWriter(conn)
+					case strings.HasPrefix(up, "EHLO"), strings.HasPrefix(up, "HELO"):
+						_, _ = w.WriteString("250-relay.test\r\n250-STARTTLS\r\n250 8BITMIME\r\n")
+						_ = w.Flush()
+					case strings.HasPrefix(up, "AUTH PLAIN"):
+						_, _ = w.WriteString("235 2.0.0 ok\r\n")
+						_ = w.Flush()
+					case strings.HasPrefix(up, "DATA"):
+						_, _ = w.WriteString("354 go ahead\r\n")
+						_ = w.Flush()
+						for {
+							dl, err := r.ReadString('\n')
+							if err != nil {
+								return
+							}
+							if strings.TrimRight(dl, "\r\n") == "." {
+								break
+							}
+						}
+						_, _ = w.WriteString("250 2.0.0 queued\r\n")
+						_ = w.Flush()
+					case strings.HasPrefix(up, "QUIT"):
+						_, _ = w.WriteString("221 bye\r\n")
+						_ = w.Flush()
+						return
+					default:
+						_, _ = w.WriteString("250 ok\r\n")
+						_ = w.Flush()
+					}
+				}
+			}()
+		}
+	}()
+
+	addr = ln.Addr().String()
+	return addr, func() { ln.Close() }
+}
+
+// makeSelfSignedCertPEM 生成一对自签证书（CN=relay.test）。
+func makeSelfSignedCertPEM(t *testing.T) (certPEM, keyPEM []byte) {
+	t.Helper()
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("generate key: %v", err)
+	}
+	tmpl := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: "relay.test"},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(24 * time.Hour),
+		DNSNames:     []string{"relay.test"},
+		KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
+	if err != nil {
+		t.Fatalf("create certificate: %v", err)
+	}
+	certPEM = pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
+	keyPEM = pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)})
+	return certPEM, keyPEM
+}
+
+// TestMailerRelayRejectsUntrustedCert 中继使用自签证书时默认必须拒绝
+// （证书验证开启，防止凭据被中间人截获）。
+func TestMailerRelayRejectsUntrustedCert(t *testing.T) {
+	addr, cleanup := startTLSSMTPServer(t)
+	defer cleanup()
+
+	m := NewMailer("mail.lmve.net", 5*time.Second)
+	m.Relay = &RelayConfig{
+		Host:        "127.0.0.1",
+		Port:        mustPort(t, addr),
+		Username:    "relay-user",
+		Password:    "relay-pass",
+		TLSInsecure: false,
+	}
+
+	input := []byte("From: a@lmve.net\r\nTo: b@bogus-domain.invalid\r\nSubject: relay\r\n\r\nbody\r\n")
+	_, err := m.Deliver("a@lmve.net", "b@bogus-domain.invalid", input)
+	if err == nil {
+		t.Fatal("relay with untrusted self-signed cert should be rejected")
+	}
+	if !strings.Contains(err.Error(), "certificate") {
+		t.Fatalf("expected certificate verification error, got: %v", err)
+	}
+}
+
+// TestMailerRelayInsecureSkipsVerification 显式开启 relay_tls_insecure
+// 后，自签证书的中继可以完成 TLS 握手并进入 SMTP 会话。
+func TestMailerRelayInsecureSkipsVerification(t *testing.T) {
+	addr, cleanup := startTLSSMTPServer(t)
+	defer cleanup()
+
+	m := NewMailer("mail.lmve.net", 5*time.Second)
+	m.Relay = &RelayConfig{
+		Host:        "127.0.0.1",
+		Port:        mustPort(t, addr),
+		Username:    "relay-user",
+		Password:    "relay-pass",
+		TLSInsecure: true,
+	}
+
+	input := []byte("From: a@lmve.net\r\nTo: b@bogus-domain.invalid\r\nSubject: relay\r\n\r\nbody\r\n")
+	resp, err := m.Deliver("a@lmve.net", "b@bogus-domain.invalid", input)
+	if err != nil {
+		t.Fatalf("relay with TLSInsecure should proceed: %v", err)
+	}
+	if !strings.HasPrefix(resp, "250") {
+		t.Fatalf("unexpected response: %q", resp)
+	}
+}
+
+func mustPort(t *testing.T, addr string) int {
+	t.Helper()
+	_, portStr, err := net.SplitHostPort(addr)
+	if err != nil {
+		t.Fatalf("split %q: %v", addr, err)
+	}
+	port, err := strconv.Atoi(portStr)
+	if err != nil {
+		t.Fatalf("port %q: %v", portStr, err)
+	}
+	return port
+}

internal/outbound/manager.go

@@ -56,6 +56,23 @@ func NewManager(cfg config.OutboundConfig, hostname string, stores *store.Stores
 		lim:      make(map[uint]*userWindow),
 		batch:    50,
 	}
+	m.mailer.IPFamily = cfg.IPFamily
+	m.mailer.SourceIP = cfg.SourceIP
+	if cfg.SourceIP != "" {
+		log.Printf("outbound: binding source address %s (ip_family=%s)", cfg.SourceIP, cfg.IPFamily)
+	}
+
+	if cfg.RelayHost != "" {
+		m.mailer.Relay = &RelayConfig{
+			Host:        cfg.RelayHost,
+			Port:        cfg.RelayPort,
+			Username:    cfg.RelayUser,
+			Password:    cfg.RelayPassword,
+			StartTLS:    cfg.RelayStartTLS,
+			TLSInsecure: cfg.RelayTLSInsecure,
+		}
+		log.Printf("outbound: using smarthost relay %s:%d", cfg.RelayHost, cfg.RelayPort)
+	}
 	return m
 }
 

internal/pop3_server/server.go

@@ -14,30 +14,31 @@ import (
 	"mail_go/config"
 	"mail_go/internal/db"
 	"mail_go/internal/store"
+	"mail_go/internal/tlsutil"
 )
 
 // POP3Server implements a simple POP3 mail server over TCP.
 type POP3Server struct {
-	listener net.Listener
-	stores   *store.Stores
-	cfg      config.POP3Config
-	wg       sync.WaitGroup
+	listener  net.Listener
+	stores    *store.Stores
+	cfg       config.POP3Config
+	banCfg    config.BanConfig
+	tlsLoader *tlsutil.Loader
+	wg        sync.WaitGroup
 }
 
-// NewPOP3Server creates a new POP3 server instance.
-func NewPOP3Server(cfg config.POP3Config, stores *store.Stores) *POP3Server {
-	return &POP3Server{stores: stores, cfg: cfg}
+// NewPOP3Server creates a new POP3 server instance. tlsLoader may be nil
+// when TLS is not configured.
+func NewPOP3Server(cfg config.POP3Config, stores *store.Stores, tlsLoader *tlsutil.Loader, banCfg config.BanConfig) *POP3Server {
+	return &POP3Server{stores: stores, cfg: cfg, banCfg: banCfg, tlsLoader: tlsLoader}
 }
 
 func (s *POP3Server) tlsConfig() (*tls.Config, error) {
-	if s.cfg.TLSCert == "" || s.cfg.TLSKey == "" {
+	if s.tlsLoader == nil {
 		return nil, fmt.Errorf("POP3 TLS certificate or key not configured")
 	}
-	cert, err := tls.LoadX509KeyPair(s.cfg.TLSCert, s.cfg.TLSKey)
-	if err != nil {
-		return nil, fmt.Errorf("load POP3 TLS certificate failed: %w", err)
-	}
-	return &tls.Config{Certificates: []tls.Certificate{cert}}, nil
+	// GetCertificate 每次握手按需重载证书，证书更新后无需重启服务
+	return &tls.Config{GetCertificate: s.tlsLoader.GetCertificate}, nil
 }
 
 // Start starts the POP3 server on the configured plain-text port.
@@ -107,6 +108,14 @@ func (s *POP3Server) handleConn(conn net.Conn) {
 	defer conn.Close()
 	conn.SetDeadline(time.Now().Add(10 * time.Minute))
 
+	clientIP := store.ClientIPFromAddr(conn.RemoteAddr())
+
+	// 已封禁 IP 直接拒绝（防协议层暴力破解）
+	if banned, _ := s.stores.Bans.IsBanned(clientIP); banned {
+		sendResponse(conn, "-ERR access denied")
+		return
+	}
+
 	reader := bufio.NewReader(conn)
 	var user *db.User
 	var messages []pop3Message
@@ -272,8 +281,12 @@ func (s *POP3Server) handlePASS(conn net.Conn, password string, user *db.User) (
 		return nil, nil, nil
 	}
 
+	clientIP := store.ClientIPFromAddr(conn.RemoteAddr())
+
 	authUser, err := s.stores.Users.Authenticate(user.Username, password)
 	if err != nil {
+		// 认证失败计数，达到阈值封禁（与 Web 登录共用 ban_entries）
+		s.stores.RecordAuthFailure(clientIP, s.banCfg.MaxFailAttempts, s.banCfg.BanDurationMin)
 		sendResponse(conn, "-ERR authentication failed")
 		return nil, nil, nil
 	}

internal/smtp_server/server.go

@@ -15,6 +15,7 @@ import (
 	"mail_go/internal/outbound"
 	"mail_go/internal/storage"
 	"mail_go/internal/store"
+	"mail_go/internal/tlsutil"
 
 	"github.com/emersion/go-message/mail"
 	"github.com/emersion/go-sasl"
@@ -31,27 +32,26 @@ const (
 
 // SMTPServer wraps go-smtp servers and provides local mail delivery.
 type SMTPServer struct {
-	stores   *store.Stores
-	storage  *storage.AttachmentStorage
-	outbound *outbound.Manager
-	cfg      config.SMTPConfig
+	stores    *store.Stores
+	storage   *storage.AttachmentStorage
+	outbound  *outbound.Manager
+	cfg       config.SMTPConfig
+	banCfg    config.BanConfig
+	tlsLoader *tlsutil.Loader
 }
 
-// NewSMTPServer creates a new SMTP server instance.
-func NewSMTPServer(cfg config.SMTPConfig, stores *store.Stores, attStorage *storage.AttachmentStorage, ob *outbound.Manager) *SMTPServer {
-	return &SMTPServer{stores: stores, storage: attStorage, outbound: ob, cfg: cfg}
+// NewSMTPServer creates a new SMTP server instance. tlsLoader may be nil
+// when TLS is not configured.
+func NewSMTPServer(cfg config.SMTPConfig, stores *store.Stores, attStorage *storage.AttachmentStorage, ob *outbound.Manager, tlsLoader *tlsutil.Loader, banCfg config.BanConfig) *SMTPServer {
+	return &SMTPServer{stores: stores, storage: attStorage, outbound: ob, cfg: cfg, banCfg: banCfg, tlsLoader: tlsLoader}
 }
 
 func (s *SMTPServer) tlsConfig() (*tls.Config, error) {
-	if s.cfg.TLSCert == "" || s.cfg.TLSKey == "" {
+	if s.tlsLoader == nil {
 		return nil, fmt.Errorf("SMTP TLS certificate or key not configured")
 	}
-
-	cert, err := tls.LoadX509KeyPair(s.cfg.TLSCert, s.cfg.TLSKey)
-	if err != nil {
-		return nil, fmt.Errorf("failed to load SMTP TLS certificate: %w", err)
-	}
-	return &tls.Config{Certificates: []tls.Certificate{cert}}, nil
+	// GetCertificate 每次握手按需重载证书，证书更新后无需重启服务
+	return &tls.Config{GetCertificate: s.tlsLoader.GetCertificate}, nil
 }
 
 func (s *SMTPServer) newServer(addr string, mode smtpMode, tlsConfig *tls.Config) *smtp.Server {
@@ -109,9 +109,10 @@ type smtpBackend struct {
 // NewSession creates a new SMTP session for the incoming connection.
 func (be *smtpBackend) NewSession(c *smtp.Conn) (smtp.Session, error) {
 	return &smtpSession{
-		backend: be,
-		mode:    be.mode,
-		rcpts:   make([]string, 0),
+		backend:   be,
+		mode:      be.mode,
+		rcpts:     make([]string, 0),
+		clientIP:  store.ClientIPFromAddr(c.Conn().RemoteAddr()),
 	}, nil
 }
 
@@ -127,6 +128,7 @@ type smtpSession struct {
 	userID        uint
 	email         string
 	user          *db.User
+	clientIP      string
 }
 
 // AuthMechanisms returns supported SMTP AUTH mechanisms.
@@ -140,8 +142,19 @@ func (s *smtpSession) Auth(mech string) (sasl.Server, error) {
 		return nil, smtp.ErrAuthUnknownMechanism
 	}
 	return sasl.NewPlainServer(func(identity, username, password string) error {
+		// 已封禁 IP 一律拒绝认证（防协议层暴力破解）
+		if banned, _ := s.backend.server.stores.Bans.IsBanned(s.clientIP); banned {
+			return smtp.ErrAuthFailed
+		}
+
 		user, err := s.backend.server.stores.Users.Authenticate(username, password)
 		if err != nil {
+			// 认证失败计数，达到阈值封禁（与 Web 登录共用 ban_entries）
+			s.backend.server.stores.RecordAuthFailure(
+				s.clientIP,
+				s.backend.server.banCfg.MaxFailAttempts,
+				s.backend.server.banCfg.BanDurationMin,
+			)
 			return smtp.ErrAuthFailed
 		}
 

internal/storage/attachment.go

@@ -4,11 +4,16 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"regexp"
 	"strings"
 
 	"github.com/google/uuid"
 )
 
+// savedFileRe 匹配 Save 生成的文件名：UUID（小写十六进制）+ 可选白名单扩展名。
+// 只允许这种格式的路径进入文件系统，杜绝路径遍历（../）、绝对路径等。
+var savedFileRe = regexp.MustCompile(`^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}(\.[A-Za-z0-9._-]{1,32})?$`)
+
 // AttachmentStorage handles file operations for email attachments on disk.
 type AttachmentStorage struct {
 	baseDir string // cfg.Storage.AttachDir
@@ -19,6 +24,24 @@ func NewAttachmentStorage(baseDir string) *AttachmentStorage {
 	return &AttachmentStorage{baseDir: baseDir}
 }
 
+// safeExt 提取并白名单化文件扩展名：只保留字母数字与 ._-，最长 32 字符。
+// 非法字符（含 CR/LF、路径分隔符）直接丢弃扩展名。
+func safeExt(filename string) string {
+	ext := filepath.Ext(filename)
+	if len(ext) > 33 {
+		return ""
+	}
+	for _, r := range ext {
+		switch {
+		case r >= 'a' && r <= 'z', r >= 'A' && r <= 'Z', r >= '0' && r <= '9':
+		case r == '.', r == '_', r == '-':
+		default:
+			return ""
+		}
+	}
+	return ext
+}
+
 // Save writes attachment data to disk and returns the relative file path.
 // The filename is generated as {uuid}{ext} to avoid collisions.
 func (s *AttachmentStorage) Save(filename string, data []byte) (string, error) {
@@ -27,8 +50,8 @@ func (s *AttachmentStorage) Save(filename string, data []byte) (string, error) {
 		return "", fmt.Errorf("创建附件目录失败: %w", err)
 	}
 
-	// Generate a unique filename with the original extension
-	ext := filepath.Ext(filename)
+	// Generate a unique filename with a sanitized extension
+	ext := safeExt(filename)
 	uniqueName := uuid.New().String() + ext
 
 	fullPath := filepath.Join(s.baseDir, uniqueName)
@@ -41,7 +64,10 @@ func (s *AttachmentStorage) Save(filename string, data []byte) (string, error) {
 
 // Read reads attachment data from disk given a relative path.
 func (s *AttachmentStorage) Read(relPath string) ([]byte, error) {
-	fullPath := s.FullPath(relPath)
+	fullPath, err := s.FullPath(relPath)
+	if err != nil {
+		return nil, err
+	}
 	data, err := os.ReadFile(fullPath)
 	if err != nil {
 		return nil, fmt.Errorf("读取附件文件失败: %w", err)
@@ -51,19 +77,29 @@ func (s *AttachmentStorage) Read(relPath string) ([]byte, error) {
 
 // Delete removes an attachment file from disk given a relative path.
 func (s *AttachmentStorage) Delete(relPath string) error {
-	fullPath := s.FullPath(relPath)
+	fullPath, err := s.FullPath(relPath)
+	if err != nil {
+		return err
+	}
 	if err := os.Remove(fullPath); err != nil && !os.IsNotExist(err) {
 		return fmt.Errorf("删除附件文件失败: %w", err)
 	}
 	return nil
 }
 
-// FullPath returns the absolute path for a given relative path.
-func (s *AttachmentStorage) FullPath(relPath string) string {
-	// Prevent directory traversal attacks
-	cleanRel := filepath.Clean(relPath)
-	if strings.HasPrefix(cleanRel, "..") {
-		cleanRel = strings.TrimPrefix(cleanRel, "../")
+// FullPath returns the absolute path for a relative path produced by Save.
+// Paths that do not match the saved-file format (traversal attempts,
+// absolute paths, unrelated names) are rejected with an error so they can
+// never escape baseDir.
+func (s *AttachmentStorage) FullPath(relPath string) (string, error) {
+	if !savedFileRe.MatchString(relPath) {
+		return "", fmt.Errorf("非法的附件路径: %q", relPath)
 	}
-	return filepath.Join(s.baseDir, cleanRel)
+
+	// 兜底校验：解析后的路径必须仍在 baseDir 内
+	fullPath := filepath.Join(s.baseDir, relPath)
+	if !strings.HasPrefix(fullPath, filepath.Clean(s.baseDir)+string(os.PathSeparator)) {
+		return "", fmt.Errorf("附件路径越界: %q", relPath)
+	}
+	return fullPath, nil
 }

internal/storage/attachment_test.go

@@ -0,0 +1,97 @@
+package storage
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/google/uuid"
+)
+
+// TestFullPathRejectsTraversal 验证路径遍历/绝对路径等恶意输入被拒绝。
+func TestFullPathRejectsTraversal(t *testing.T) {
+	s := NewAttachmentStorage(filepath.Join(t.TempDir(), "attachments"))
+
+	valid := uuid.New().String() + ".pdf"
+	bad := []string{
+		"../secret.txt",
+		"../../etc/passwd",
+		"..",
+		"....//x",
+		"/etc/passwd",
+		"a/../b.txt",
+		"sub/file.png",
+		"",
+		".", "..\\..\\x", // windows style
+		"00000000-0000-0000-0000-000000000000.exe\r\nBcc: x@y.com",
+		"garbage",
+		"00000000-0000-0000-0000-000000000000.%2e%2e",
+	}
+	for _, p := range bad {
+		if _, err := s.FullPath(p); err == nil {
+			t.Errorf("FullPath(%q) should be rejected", p)
+		}
+	}
+
+	// 合法文件名必须通过
+	full, err := s.FullPath(valid)
+	if err != nil {
+		t.Fatalf("FullPath(%q) rejected: %v", valid, err)
+	}
+	if !strings.HasPrefix(full, s.baseDir+string(os.PathSeparator)) {
+		t.Fatalf("FullPath(%q) = %q escapes baseDir", valid, full)
+	}
+}
+
+// TestSaveSanitizesExtension 验证恶意扩展名不会进入文件名。
+func TestSaveSanitizesExtension(t *testing.T) {
+	s := NewAttachmentStorage(filepath.Join(t.TempDir(), "attachments"))
+
+	// 换行/路径分隔符等非法字符的扩展名应被丢弃
+	rel, err := s.Save("evil.pdf\r\nBcc: x@y.com", []byte("data"))
+	if err != nil {
+		t.Fatalf("Save: %v", err)
+	}
+	if strings.ContainsAny(rel, "\r\n/\\") {
+		t.Fatalf("saved name contains dangerous chars: %q", rel)
+	}
+	if !savedFileRe.MatchString(rel) {
+		t.Fatalf("saved name %q does not match allowed pattern", rel)
+	}
+	// 后续 Read 应能按返回的路径读取
+	if _, err := s.Read(rel); err != nil {
+		t.Fatalf("Read after Save: %v", err)
+	}
+
+	// 正常扩展名保留
+	rel2, err := s.Save("report.pdf", []byte("data"))
+	if err != nil {
+		t.Fatalf("Save: %v", err)
+	}
+	if !strings.HasSuffix(rel2, ".pdf") {
+		t.Fatalf("extension lost: %q", rel2)
+	}
+}
+
+// TestReadDeleteRoundTrip 正常读写删流程。
+func TestReadDeleteRoundTrip(t *testing.T) {
+	dir := t.TempDir()
+	s := NewAttachmentStorage(filepath.Join(dir, "attachments"))
+
+	rel, err := s.Save("a.txt", []byte("hello"))
+	if err != nil {
+		t.Fatalf("Save: %v", err)
+	}
+	data, err := s.Read(rel)
+	if err != nil || string(data) != "hello" {
+		t.Fatalf("Read = %q, %v", data, err)
+	}
+	if err := s.Delete(rel); err != nil {
+		t.Fatalf("Delete: %v", err)
+	}
+	// 删除后路径仍然合法（删除不存在文件不算错误）
+	if err := s.Delete(rel); err != nil {
+		t.Fatalf("Delete again: %v", err)
+	}
+}

internal/store/auth_guard.go

@@ -0,0 +1,43 @@
+package store
+
+import (
+	"fmt"
+	"net"
+	"time"
+
+	"mail_go/internal/db"
+)
+
+// ClientIPFromAddr 从 net.Addr 提取客户端 IP 字符串（去掉端口）。
+// 解析失败返回空字符串，调用方应据此跳过封禁逻辑（不误封）。
+func ClientIPFromAddr(addr net.Addr) string {
+	if addr == nil {
+		return ""
+	}
+	host, _, err := net.SplitHostPort(addr.String())
+	if err != nil {
+		return addr.String()
+	}
+	return host
+}
+
+// RecordAuthFailure 记录一次协议层（SMTP/IMAP/POP3）认证失败：
+// 失败计数累加，达到 maxFail 阈值时封禁该 IP（封禁时长 minutes 分钟）。
+// 返回 (是否触发封禁, 当前失败计数)。Web 登录的封禁逻辑在
+// handlers.AuthHandler 中，与这里独立。
+func (s *Stores) RecordAuthFailure(ip string, maxFail int, minutes int) (banned bool, failCount int) {
+	if ip == "" || maxFail <= 0 {
+		return false, 0
+	}
+	failCount, _ = s.Bans.IncrementFail(ip)
+	if failCount >= maxFail {
+		_ = s.Bans.Create(&db.BanEntry{
+			IPAddress: ip,
+			Reason:    fmt.Sprintf("邮件协议认证失败次数过多 (%d次)", failCount),
+			FailCount: failCount,
+			ExpiresAt: time.Now().Add(time.Duration(minutes) * time.Minute),
+		})
+		return true, failCount
+	}
+	return false, failCount
+}

internal/store/auth_guard_test.go

@@ -0,0 +1,113 @@
+package store
+
+import (
+	"net"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"mail_go/internal/db"
+
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+)
+
+func newTestStores(t *testing.T) *Stores {
+	t.Helper()
+	gdb, err := gorm.Open(sqlite.Open(filepath.Join(t.TempDir(), "test.db")), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	if err := gdb.AutoMigrate(&db.User{}, &db.Domain{}, &db.Message{}, &db.Attachment{}, &db.BanEntry{}, &db.OutboundMessage{}); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	return NewStores(gdb)
+}
+
+// TestRecordAuthFailureBansAfterThreshold 验证连续认证失败达到阈值后封禁。
+func TestRecordAuthFailureBansAfterThreshold(t *testing.T) {
+	s := newTestStores(t)
+	const ip = "203.0.113.10"
+	const maxFail = 3
+
+	// 前两次失败不封禁
+	for i := 1; i < maxFail; i++ {
+		banned, count := s.RecordAuthFailure(ip, maxFail, 30)
+		if banned {
+			t.Fatalf("attempt %d should not be banned yet", i)
+		}
+		if count != i {
+			t.Fatalf("attempt %d: fail count = %d, want %d", i, count, i)
+		}
+	}
+
+	// 第三次失败触发封禁
+	banned, count := s.RecordAuthFailure(ip, maxFail, 30)
+	if !banned {
+		t.Fatal("attempt reaching threshold should ban the IP")
+	}
+	if count != maxFail {
+		t.Fatalf("fail count = %d, want %d", count, maxFail)
+	}
+
+	// IP 现在处于封禁状态
+	banned, entry := s.Bans.IsBanned(ip)
+	if !banned {
+		t.Fatal("IP should be banned")
+	}
+	if entry.ExpiresAt.Before(time.Now().Add(29 * time.Minute)) {
+		t.Fatalf("ban expiry too short: %v", entry.ExpiresAt)
+	}
+}
+
+// TestRecordAuthFailureEmptyIPSafe 空 IP 不应产生副作用。
+func TestRecordAuthFailureEmptyIPSafe(t *testing.T) {
+	s := newTestStores(t)
+	banned, count := s.RecordAuthFailure("", 3, 30)
+	if banned || count != 0 {
+		t.Fatalf("empty IP must be a no-op: banned=%v count=%d", banned, count)
+	}
+	if _, err := s.Bans.GetByIP(""); err == nil {
+		t.Fatal("empty IP should not be recorded")
+	}
+}
+
+// TestRecordAuthFailureWebAndProtocolShared 协议层与 Web 层共用封禁记录。
+func TestRecordAuthFailureWebAndProtocolShared(t *testing.T) {
+	s := newTestStores(t)
+	const ip = "198.51.100.20"
+
+	// Web 层已封禁（直接建记录模拟），协议层认证必须被拒绝
+	s.Bans.Create(&db.BanEntry{
+		IPAddress: ip,
+		Reason:    "web login failures",
+		FailCount: 5,
+		ExpiresAt: time.Now().Add(30 * time.Minute),
+	})
+	if banned, _ := s.Bans.IsBanned(ip); !banned {
+		t.Fatal("IP should be banned for both web and protocol auth")
+	}
+}
+
+func TestClientIPFromAddr(t *testing.T) {
+	cases := []struct {
+		addr net.Addr
+		want string
+	}{
+		{nil, ""},
+		{addrMock("203.0.113.5:12345"), "203.0.113.5"},
+		{addrMock("[2001:db8::1]:993"), "2001:db8::1"},
+		{addrMock("bad-format"), "bad-format"},
+	}
+	for _, tc := range cases {
+		if got := ClientIPFromAddr(tc.addr); got != tc.want {
+			t.Errorf("ClientIPFromAddr(%v) = %q, want %q", tc.addr, got, tc.want)
+		}
+	}
+}
+
+// addrMock 实现 net.Addr 的最小桩。
+type addrMock string
+
+func (a addrMock) Network() string { return "tcp" }
+func (a addrMock) String() string  { return string(a) }

internal/store/user_store.go

@@ -124,9 +124,14 @@ func (s *userStoreGorm) UpdateUsedBytes(id uint, delta int64) error {
 		Update("used_bytes", gorm.Expr("used_bytes + ?", delta)).Error
 }
 
-// UpdatePassword updates the password hash for a user.
+// UpdatePassword updates the password hash for a user and clears the
+// must-change-password flag (the user has now set their own password).
 func (s *userStoreGorm) UpdatePassword(userID uint, hashedPassword string) error {
-	return s.db.Model(&db.User{}).Where("id = ?", userID).Update("password_hash", hashedPassword).Error
+	return s.db.Model(&db.User{}).Where("id = ?", userID).
+		Updates(map[string]interface{}{
+			"password_hash":         hashedPassword,
+			"must_change_password": false,
+		}).Error
 }
 
 // ListAll retrieves a paginated list of all users across all domains.

internal/tlsutil/tlsutil.go

@@ -0,0 +1,127 @@
+// Package tlsutil 提供 TLS 证书热加载：每次 TLS 握手时按需检查
+// 证书路径与文件内容是否变化，变化则自动重载，证书更新后无需重启
+// 服务即可生效。
+package tlsutil
+
+import (
+	"crypto/tls"
+	"fmt"
+	"os"
+	"sync"
+	"time"
+)
+
+// retryInterval 是重载失败后的最小重试间隔，避免证书文件损坏时
+// 每个握手都重复做无意义的磁盘读取。
+const retryInterval = 5 * time.Second
+
+// Source 返回当前应使用的证书路径。路径可能随时间变化（例如管理后台
+// 一键导入证书后切换到新的域名证书）；返回空路径表示暂无可用证书。
+type Source func() (certPath, keyPath string)
+
+// Loader 管理一对可热加载的证书。所有方法均并发安全。
+type Loader struct {
+	mu       sync.Mutex
+	source   Source
+	certPath string
+	keyPath  string
+	cert     *tls.Certificate
+	certMod  time.Time
+	keyMod   time.Time
+	lastTry  time.Time
+	logf     func(format string, args ...interface{})
+}
+
+// NewLoader 立即加载并校验证书，失败返回错误（保持启动时 fail-fast）。
+// source 为 nil 时证书路径固定不变，仅检测文件内容变化。
+func NewLoader(certPath, keyPath string, source Source, logf func(string, ...interface{})) (*Loader, error) {
+	if certPath == "" || keyPath == "" {
+		return nil, fmt.Errorf("TLS 证书路径为空")
+	}
+	l := &Loader{
+		source:   source,
+		certPath: certPath,
+		keyPath:  keyPath,
+		logf:     logf,
+	}
+	if err := l.load(); err != nil {
+		return nil, err
+	}
+	return l, nil
+}
+
+// GetCertificate 实现 tls.Config.GetCertificate：
+// 每次 TLS 握手时检查证书路径与文件是否有变化，有则自动重载；
+// 重载失败时继续使用上一次成功加载的证书，避免中断现有服务。
+func (l *Loader) GetCertificate(_ *tls.ClientHelloInfo) (*tls.Certificate, error) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	certPath, keyPath := l.certPath, l.keyPath
+	if l.source != nil {
+		certPath, keyPath = l.source()
+	}
+	if certPath == "" || keyPath == "" {
+		// 暂无证书可用：继续使用旧证书（若有）
+		return l.current()
+	}
+
+	changed := certPath != l.certPath || keyPath != l.keyPath
+	if !changed {
+		changed = l.filesChanged(certPath, keyPath)
+	}
+
+	// 仅在重载失败后节流（避免证书文件损坏时每个握手都重复读盘）；
+	// 成功后清零节流，保证正常的连续更新立即生效。
+	if changed && time.Since(l.lastTry) >= retryInterval {
+		l.lastTry = time.Now()
+		l.certPath, l.keyPath = certPath, keyPath
+		if err := l.load(); err != nil {
+			if l.logf != nil {
+				l.logf("TLS 证书重载失败 (%s, %s): %v，继续使用旧证书", certPath, keyPath, err)
+			}
+		} else {
+			l.lastTry = time.Time{}
+			if l.logf != nil {
+				l.logf("TLS 证书已热加载: %s", certPath)
+			}
+		}
+	}
+
+	return l.current()
+}
+
+// current 返回当前已加载的证书。
+func (l *Loader) current() (*tls.Certificate, error) {
+	if l.cert == nil {
+		return nil, fmt.Errorf("TLS 证书不可用")
+	}
+	return l.cert, nil
+}
+
+// filesChanged 判断证书/私钥文件自上次加载后是否被修改。
+// 文件暂时不可读（如正在原子替换）时视为已变化，触发重载尝试。
+func (l *Loader) filesChanged(certPath, keyPath string) bool {
+	stC, errC := os.Stat(certPath)
+	stK, errK := os.Stat(keyPath)
+	if errC != nil || errK != nil {
+		return true
+	}
+	return !stC.ModTime().Equal(l.certMod) || !stK.ModTime().Equal(l.keyMod)
+}
+
+// load 从当前路径加载证书对并记录文件修改时间。
+func (l *Loader) load() error {
+	cert, err := tls.LoadX509KeyPair(l.certPath, l.keyPath)
+	if err != nil {
+		return err
+	}
+	if stC, err := os.Stat(l.certPath); err == nil {
+		l.certMod = stC.ModTime()
+	}
+	if stK, err := os.Stat(l.keyPath); err == nil {
+		l.keyMod = stK.ModTime()
+	}
+	l.cert = &cert
+	return nil
+}

internal/tlsutil/tlsutil_test.go

@@ -0,0 +1,241 @@
+package tlsutil
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"os"
+	"path/filepath"
+	"sync"
+	"testing"
+	"time"
+)
+
+// writeCertPair 生成一对自签名证书并写入文件，返回叶子证书序列号。
+func writeCertPair(t *testing.T, certPath, keyPath string, serial int64) {
+	t.Helper()
+
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("生成私钥失败: %v", err)
+	}
+	tmpl := &x509.Certificate{
+		SerialNumber: big.NewInt(serial),
+		Subject:      pkix.Name{CommonName: "test"},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(24 * time.Hour),
+		DNSNames:     []string{"localhost"},
+		KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
+	if err != nil {
+		t.Fatalf("生成证书失败: %v", err)
+	}
+
+	certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
+	keyPEM := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)})
+
+	if err := os.MkdirAll(filepath.Dir(certPath), 0700); err != nil {
+		t.Fatalf("创建目录失败: %v", err)
+	}
+	if err := os.WriteFile(certPath, certPEM, 0600); err != nil {
+		t.Fatalf("写入证书失败: %v", err)
+	}
+	if err := os.WriteFile(keyPath, keyPEM, 0600); err != nil {
+		t.Fatalf("写入私钥失败: %v", err)
+	}
+}
+
+func leafSerial(t *testing.T, cert *x509.Certificate) *big.Int {
+	t.Helper()
+	return cert.SerialNumber
+}
+
+func TestNewLoaderFailsFast(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "cert.pem")
+	keyPath := filepath.Join(dir, "key.pem")
+	os.WriteFile(certPath, []byte("garbage"), 0600)
+	os.WriteFile(keyPath, []byte("garbage"), 0600)
+
+	if _, err := NewLoader(certPath, keyPath, nil, nil); err == nil {
+		t.Fatal("无效证书应返回错误")
+	}
+}
+
+func TestReloadOnFileChange(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "cert.pem")
+	keyPath := filepath.Join(dir, "key.pem")
+
+	writeCertPair(t, certPath, keyPath, 1)
+	l, err := NewLoader(certPath, keyPath, nil, nil)
+	if err != nil {
+		t.Fatalf("NewLoader 失败: %v", err)
+	}
+
+	c1, err := l.GetCertificate(nil)
+	if err != nil {
+		t.Fatalf("GetCertificate 失败: %v", err)
+	}
+	if c1.Leaf == nil {
+		if parsed, err := x509.ParseCertificate(c1.Certificate[0]); err == nil {
+			c1.Leaf = parsed
+		}
+	}
+	if leafSerial(t, c1.Leaf).Int64() != 1 {
+		t.Fatalf("初始证书序列号应为 1")
+	}
+
+	// 替换文件内容（模拟证书更新），无需重启
+	time.Sleep(10 * time.Millisecond) // 确保 mtime 变化
+	writeCertPair(t, certPath, keyPath, 2)
+
+	c2, err := l.GetCertificate(nil)
+	if err != nil {
+		t.Fatalf("更新后 GetCertificate 失败: %v", err)
+	}
+	if parsed, err := x509.ParseCertificate(c2.Certificate[0]); err == nil {
+		c2.Leaf = parsed
+	}
+	if leafSerial(t, c2.Leaf).Int64() != 2 {
+		t.Fatal("文件更新后应自动加载新证书（序列号 2）")
+	}
+}
+
+func TestStaleCertOnInvalidReload(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "cert.pem")
+	keyPath := filepath.Join(dir, "key.pem")
+
+	writeCertPair(t, certPath, keyPath, 1)
+	l, err := NewLoader(certPath, keyPath, nil, nil)
+	if err != nil {
+		t.Fatalf("NewLoader 失败: %v", err)
+	}
+
+	// 写入损坏的证书：重载失败时应继续使用旧证书
+	time.Sleep(10 * time.Millisecond)
+	os.WriteFile(certPath, []byte("broken"), 0600)
+
+	c, err := l.GetCertificate(nil)
+	if err != nil {
+		t.Fatalf("重载失败时不应返回错误: %v", err)
+	}
+	if parsed, err := x509.ParseCertificate(c.Certificate[0]); err == nil {
+		c.Leaf = parsed
+	}
+	if leafSerial(t, c.Leaf).Int64() != 1 {
+		t.Fatal("重载失败时应继续使用旧证书")
+	}
+}
+
+func TestSourcePathSwitch(t *testing.T) {
+	dir := t.TempDir()
+	certA := filepath.Join(dir, "a", "cert.pem")
+	keyA := filepath.Join(dir, "a", "key.pem")
+	certB := filepath.Join(dir, "b", "cert.pem")
+	keyB := filepath.Join(dir, "b", "key.pem")
+	writeCertPair(t, certA, keyA, 1)
+	writeCertPair(t, certB, keyB, 2)
+
+	// 初始用 A，source 后续切换到 B（模拟后台导入新域名证书）
+	source := func() (string, string) { return certB, keyB }
+	l, err := NewLoader(certA, keyA, source, nil)
+	if err != nil {
+		t.Fatalf("NewLoader 失败: %v", err)
+	}
+
+	c, err := l.GetCertificate(nil)
+	if err != nil {
+		t.Fatalf("GetCertificate 失败: %v", err)
+	}
+	if parsed, err := x509.ParseCertificate(c.Certificate[0]); err == nil {
+		c.Leaf = parsed
+	}
+	if leafSerial(t, c.Leaf).Int64() != 2 {
+		t.Fatal("source 切换路径后应自动加载新证书")
+	}
+}
+
+func TestRapidSuccessiveChanges(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "cert.pem")
+	keyPath := filepath.Join(dir, "key.pem")
+
+	writeCertPair(t, certPath, keyPath, 1)
+	l, err := NewLoader(certPath, keyPath, nil, nil)
+	if err != nil {
+		t.Fatalf("NewLoader 失败: %v", err)
+	}
+
+	serialOf := func() int64 {
+		t.Helper()
+		c, err := l.GetCertificate(nil)
+		if err != nil {
+			t.Fatalf("GetCertificate 失败: %v", err)
+		}
+		parsed, err := x509.ParseCertificate(c.Certificate[0])
+		if err != nil {
+			t.Fatalf("解析证书失败: %v", err)
+		}
+		return parsed.SerialNumber.Int64()
+	}
+
+	// 5 秒内连续两次更新，两次都应立即生效（节流只针对失败重载）
+	time.Sleep(10 * time.Millisecond)
+	writeCertPair(t, certPath, keyPath, 2)
+	if got := serialOf(); got != 2 {
+		t.Fatalf("第一次更新后应加载序列号 2，实际 %d", got)
+	}
+
+	time.Sleep(10 * time.Millisecond)
+	writeCertPair(t, certPath, keyPath, 3)
+	if got := serialOf(); got != 3 {
+		t.Fatalf("第二次快速更新后应立即加载序列号 3，实际 %d", got)
+	}
+}
+
+func TestConcurrentGetCertificate(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "cert.pem")
+	keyPath := filepath.Join(dir, "key.pem")
+	writeCertPair(t, certPath, keyPath, 1)
+
+	l, err := NewLoader(certPath, keyPath, nil, nil)
+	if err != nil {
+		t.Fatalf("NewLoader 失败: %v", err)
+	}
+
+	var wg sync.WaitGroup
+	stop := make(chan struct{})
+	// 并发读
+	for i := 0; i < 8; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for {
+				select {
+				case <-stop:
+					return
+				default:
+					if _, err := l.GetCertificate(nil); err != nil {
+						t.Errorf("并发 GetCertificate 失败: %v", err)
+						return
+					}
+				}
+			}
+		}()
+	}
+	// 同时反复替换证书文件（模拟续期）
+	for i := int64(2); i < 6; i++ {
+		writeCertPair(t, certPath, keyPath, i)
+		time.Sleep(20 * time.Millisecond)
+	}
+	close(stop)
+	wg.Wait()
+}

internal/web/handlers/admin.go

@@ -5,12 +5,14 @@ import (
 	"fmt"
 	"log"
 	"net/http"
+	"net/url"
 	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
 	"time"
 
+	"mail_go/internal/caddycert"
 	"mail_go/internal/db"
 	"mail_go/internal/dkim"
 	"mail_go/internal/outbound"
@@ -23,16 +25,17 @@ import (
 
 // AdminHandler handles admin-related routes (dashboard, domain/user management).
 type AdminHandler struct {
-	stores   *store.Stores
-	storage  *storage.AttachmentStorage
-	tlsDir   string
-	outbound *outbound.Manager
+	stores       *store.Stores
+	storage      *storage.AttachmentStorage
+	tlsDir       string
+	caddyDataDir string
+	outbound     *outbound.Manager
 }
 
 // NewAdminHandler creates a new AdminHandler with the given stores, attachment
-// storage, TLS directory and outbound delivery manager.
-func NewAdminHandler(stores *store.Stores, attStorage *storage.AttachmentStorage, tlsDir string, ob *outbound.Manager) *AdminHandler {
-	return &AdminHandler{stores: stores, storage: attStorage, tlsDir: tlsDir, outbound: ob}
+// storage, TLS directory, Caddy data directory and outbound delivery manager.
+func NewAdminHandler(stores *store.Stores, attStorage *storage.AttachmentStorage, tlsDir string, caddyDataDir string, ob *outbound.Manager) *AdminHandler {
+	return &AdminHandler{stores: stores, storage: attStorage, tlsDir: tlsDir, caddyDataDir: caddyDataDir, outbound: ob}
 }
 
 // Dashboard renders the admin dashboard with summary statistics.
@@ -209,6 +212,16 @@ func (h *AdminHandler) EditDomain(c *gin.Context) {
 	}
 
 	currentUser, _ := c.Get("currentUser")
+
+	caddyMsg, caddyMsgType := "", ""
+	if c.Query("caddy_err") != "" {
+		caddyMsg = c.Query("caddy_err")
+		caddyMsgType = "error"
+	} else if c.Query("caddy_ok") == "1" {
+		caddyMsg = "✅ 已从 Caddy 获取证书并保存到域名 TLS 目录，同时已启用该域名的 TLS；证书已热加载，无需重启服务。"
+		caddyMsgType = "success"
+	}
+
 	c.HTML(200, "admin_domain_form", gin.H{
 		"currentUser":       currentUser,
 		"activeFolder":      "domains",
@@ -217,6 +230,8 @@ func (h *AdminHandler) EditDomain(c *gin.Context) {
 		"domain":            domain,
 		"tlsPublicCert":     readTLSCert(domain.TlsCertPath),
 		"tlsCertConfigured": domain.TlsCertPath != "" && domain.TlsKeyPath != "",
+		"caddyMsg":          caddyMsg,
+		"caddyMsgType":      caddyMsgType,
 	})
 }
 
@@ -264,6 +279,78 @@ func (h *AdminHandler) UpdateDomain(c *gin.Context) {
 	c.Redirect(http.StatusFound, "/admin/domains")
 }
 
+// FetchCaddyCert 尝试从本机 Caddy 的证书存储中获取该域名的证书与私钥，
+// 保存到 MailGo 的域名 TLS 目录并更新数据库记录。结果通过查询参数回显到
+// 编辑页面（caddy_ok=1 成功 / caddy_err=<消息> 失败）。
+func (h *AdminHandler) FetchCaddyCert(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil {
+		c.String(http.StatusBadRequest, "无效的域名ID")
+		return
+	}
+
+	domain, err := h.stores.Domains.GetByID(uint(id))
+	if err != nil {
+		c.String(http.StatusNotFound, "域名不存在")
+		return
+	}
+
+	editURL := fmt.Sprintf("/admin/domains/%d/edit", domain.ID)
+	fail := func(msg string) {
+		log.Printf("从 Caddy 获取证书失败 domain=%s: %s", domain.Name, msg)
+		c.Redirect(http.StatusFound, editURL+"?caddy_err="+url.QueryEscape(msg))
+	}
+
+	cert, err := caddycert.Fetch(domain.Name, h.caddyCertRoots())
+	if err != nil {
+		fail(fmt.Sprintf("从 Caddy 获取证书失败: %v", err))
+		return
+	}
+
+	// 保存到域名 TLS 目录（与手动上传证书的位置一致）
+	domainTLSDir := filepath.Join(h.tlsDir, strconv.FormatUint(uint64(domain.ID), 10))
+	if err := os.MkdirAll(domainTLSDir, 0700); err != nil {
+		fail(fmt.Sprintf("创建 TLS 证书目录失败: %v", err))
+		return
+	}
+
+	certPath := filepath.Join(domainTLSDir, "cert.pem")
+	keyPath := filepath.Join(domainTLSDir, "key.pem")
+	if err := os.WriteFile(certPath, cert.CertPEM, 0644); err != nil {
+		fail(fmt.Sprintf("保存 TLS 公钥证书失败: %v", err))
+		return
+	}
+	if err := os.WriteFile(keyPath, cert.KeyPEM, 0600); err != nil {
+		fail(fmt.Sprintf("保存 TLS 私钥失败: %v", err))
+		return
+	}
+
+	domain.TlsCertPath = certPath
+	domain.TlsKeyPath = keyPath
+	domain.TlsEnabled = true
+	if err := h.stores.Domains.Update(domain); err != nil {
+		fail(fmt.Sprintf("更新域名记录失败: %v", err))
+		return
+	}
+
+	log.Printf("已从 Caddy 导入域名 %s 的证书 (%s)，热加载生效", domain.Name, cert.Source)
+	c.Redirect(http.StatusFound, editURL+"?caddy_ok=1")
+}
+
+// caddyCertRoots 返回按优先级排列的证书来源目录：
+//  1. MailGo 的同步镜像目录 <storage>/tls/caddy —— 由 install.sh 安装的
+//     systemd path 同步任务以 root 权限从 Caddy 证书存储镜像而来，
+//     mail_go 始终可读，证书续期后自动更新；
+//  2. 配置文件 caddy.data_dir 指定的目录（可选）；
+//
+// 其余默认位置由 caddycert.Fetch 自行探测。
+func (h *AdminHandler) caddyCertRoots() []string {
+	return []string{
+		filepath.Join(filepath.Dir(h.tlsDir), "caddy"),
+		h.caddyDataDir,
+	}
+}
+
 func readTLSCert(path string) string {
 	if path == "" {
 		return ""
@@ -276,7 +363,20 @@ func readTLSCert(path string) string {
 	return string(data)
 }
 
+// normalizePEM 统一 PEM 文本的换行为 LF：浏览器提交 textarea 时会把
+// 换行规范为 CRLF，而证书文件里通常是 LF，直接比较会误判“证书已修改”
+// （表现为：私钥留空保留现有私钥时仍报“必须同时填写”）。
+func normalizePEM(s string) string {
+	s = strings.ReplaceAll(s, "\r\n", "\n")
+	s = strings.ReplaceAll(s, "\r", "\n")
+	return s
+}
+
 func (h *AdminHandler) handleDomainTLSUpdate(domain *db.Domain, publicCert, privateKey string) error {
+	// 归一化换行，保证与磁盘文件一致，避免表单往返时被误判为已修改
+	publicCert = normalizePEM(strings.TrimSpace(publicCert))
+	privateKey = normalizePEM(strings.TrimSpace(privateKey))
+
 	if !domain.TlsEnabled {
 		return nil
 	}
@@ -288,7 +388,7 @@ func (h *AdminHandler) handleDomainTLSUpdate(domain *db.Domain, publicCert, priv
 		}
 		return fmt.Errorf("启用 TLS 时必须填写 TLS 私钥和公钥证书")
 	}
-	if hasExistingCert && privateKey == "" && strings.TrimSpace(readTLSCert(domain.TlsCertPath)) == publicCert {
+	if hasExistingCert && privateKey == "" && normalizePEM(strings.TrimSpace(readTLSCert(domain.TlsCertPath))) == publicCert {
 		return nil
 	}
 	if publicCert == "" || privateKey == "" {
@@ -596,6 +696,8 @@ func (h *AdminHandler) UpdateUser(c *gin.Context) {
 			return
 		}
 		user.PasswordHash = string(hashedPassword)
+		// 管理员重置的密码必须由用户本人修改后才能正常使用
+		user.MustChangePassword = true
 	}
 
 	if err := h.stores.Users.Update(user); err != nil {
@@ -760,7 +862,7 @@ func (h *AdminHandler) AdminDownloadAttachment(c *gin.Context) {
 		return
 	}
 
-	c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", att.FileName))
+	c.Header("Content-Disposition", formatContentDisposition(att.FileName))
 	c.Data(http.StatusOK, att.ContentType, data)
 }
 

internal/web/handlers/admin_tls_test.go

@@ -0,0 +1,126 @@
+package handlers
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"mail_go/internal/db"
+)
+
+// makeTestCertPair 生成一对自签名证书（PEM），可选 LF/CRLF 换行。
+func makeTestCertPair(t *testing.T, lineEnding string) (certPEM, keyPEM string) {
+	t.Helper()
+
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("生成私钥失败: %v", err)
+	}
+	tmpl := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: "test"},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(24 * time.Hour),
+		DNSNames:     []string{"mail.example.com"},
+		KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
+	if err != nil {
+		t.Fatalf("生成证书失败: %v", err)
+	}
+
+	certPEM = string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}))
+	if lineEnding == "crlf" {
+		certPEM = strings.ReplaceAll(certPEM, "\n", "\r\n")
+	}
+	keyPEM = string(pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)}))
+	if lineEnding == "crlf" {
+		keyPEM = strings.ReplaceAll(keyPEM, "\n", "\r\n")
+	}
+	return certPEM, keyPEM
+}
+
+// writeExistingCert 模拟已有证书文件（LF 换行）并返回 domain。
+func writeExistingCert(t *testing.T, tlsDir string, certPEM, keyPEM string) *db.Domain {
+	t.Helper()
+	dir := filepath.Join(tlsDir, "1")
+	if err := os.MkdirAll(dir, 0700); err != nil {
+		t.Fatalf("创建目录失败: %v", err)
+	}
+	certPath := filepath.Join(dir, "cert.pem")
+	keyPath := filepath.Join(dir, "key.pem")
+	if err := os.WriteFile(certPath, []byte(certPEM+"\n"), 0644); err != nil {
+		t.Fatalf("写入证书失败: %v", err)
+	}
+	if err := os.WriteFile(keyPath, []byte(keyPEM+"\n"), 0600); err != nil {
+		t.Fatalf("写入私钥失败: %v", err)
+	}
+	return &db.Domain{
+		ID:          1,
+		Name:        "mail.example.com",
+		TlsEnabled:  true,
+		TlsCertPath: certPath,
+		TlsKeyPath:  keyPath,
+	}
+}
+
+// TestHandleDomainTLSUpdateUnchangedCertCRLF 复现用户报告的 bug：
+// 浏览器把 textarea 的 LF 换成 CRLF 提交，私钥留空（保留现有私钥），
+// 证书内容未变，此时保存不应报“必须同时填写”。
+func TestHandleDomainTLSUpdateUnchangedCertCRLF(t *testing.T) {
+	certLF, keyLF := makeTestCertPair(t, "lf")
+	h := &AdminHandler{tlsDir: t.TempDir()}
+	domain := writeExistingCert(t, h.tlsDir, certLF, keyLF)
+
+	submittedCert := strings.ReplaceAll(certLF, "\n", "\r\n") // 模拟浏览器提交
+	if err := h.handleDomainTLSUpdate(domain, submittedCert, ""); err != nil {
+		t.Fatalf("证书未修改且私钥留空时应保留现有私钥，实际报错: %v", err)
+	}
+}
+
+// TestHandleDomainTLSUpdateNewPairCRLF 新证书+私钥（CRLF 提交）应正常保存，
+// 且写入文件为 LF 换行、能组成有效密钥对。
+func TestHandleDomainTLSUpdateNewPairCRLF(t *testing.T) {
+	certCRLF, keyCRLF := makeTestCertPair(t, "crlf")
+	h := &AdminHandler{tlsDir: t.TempDir()}
+	domain := &db.Domain{ID: 1, Name: "mail.example.com", TlsEnabled: true}
+
+	if err := h.handleDomainTLSUpdate(domain, certCRLF, keyCRLF); err != nil {
+		t.Fatalf("CRLF 提交的新证书应保存成功，实际报错: %v", err)
+	}
+
+	data, err := os.ReadFile(domain.TlsCertPath)
+	if err != nil {
+		t.Fatalf("读取保存的证书失败: %v", err)
+	}
+	if strings.Contains(string(data), "\r") {
+		t.Error("保存的证书文件不应包含 CR")
+	}
+	if _, err := tls.LoadX509KeyPair(domain.TlsCertPath, domain.TlsKeyPath); err != nil {
+		t.Fatalf("保存的证书对无效: %v", err)
+	}
+}
+
+// TestHandleDomainTLSUpdateChangedCertWithoutKey 证书确实被修改但私钥留空，
+// 应报“必须同时填写”（防止用不匹配的私钥）。
+func TestHandleDomainTLSUpdateChangedCertWithoutKey(t *testing.T) {
+	certA, keyA := makeTestCertPair(t, "lf")
+	certB, _ := makeTestCertPair(t, "lf")
+	h := &AdminHandler{tlsDir: t.TempDir()}
+	domain := writeExistingCert(t, h.tlsDir, certA, keyA)
+
+	err := h.handleDomainTLSUpdate(domain, certB, "")
+	if err == nil || !strings.Contains(err.Error(), "必须同时填写") {
+		t.Fatalf("修改证书但私钥留空应报“必须同时填写”，实际: %v", err)
+	}
+}

internal/web/handlers/auth.go

@@ -1,6 +1,9 @@
 package handlers
 
 import (
+	"crypto/rand"
+	"crypto/subtle"
+	"encoding/hex"
 	"fmt"
 	"log"
 	"net/http"
@@ -167,7 +170,7 @@ func (h *AuthHandler) LDAPLogin(c *gin.Context) {
 
 		remaining := h.banCfg.MaxFailAttempts - failCount
 		c.HTML(200, "login", gin.H{
-			"error":          fmt.Sprintf("LDAP 认证失败，还剩 %d 次尝试机会: %v", remaining, err),
+			"error":          fmt.Sprintf("LDAP 认证失败，还剩 %d 次尝试机会", remaining),
 			"oauth2Enabled":  h.authCfg.OAuth2Enabled,
 			"ldapEnabled":    h.authCfg.LDAPEnabled,
 			"oauth2Provider": h.authCfg.OAuth2Provider,
@@ -179,7 +182,7 @@ func (h *AuthHandler) LDAPLogin(c *gin.Context) {
 	user, err := h.stores.Users.GetByEmail(email)
 	if err != nil {
 		c.HTML(200, "login", gin.H{
-			"error":          fmt.Sprintf("LDAP 用户 %s 在系统中不存在", email),
+			"error":          "LDAP 账号未接入本系统，请联系管理员",
 			"oauth2Enabled":  h.authCfg.OAuth2Enabled,
 			"ldapEnabled":    h.authCfg.LDAPEnabled,
 			"oauth2Provider": h.authCfg.OAuth2Provider,
@@ -218,6 +221,36 @@ func (h *AuthHandler) LDAPLogin(c *gin.Context) {
 	c.Redirect(302, "/inbox")
 }
 
+// OAuth2 state cookie 配置。state 用于防止登录 CSRF / 授权码注入：
+// 发起授权时下发随机值，回调时必须原样带回。
+//
+// 注意 state 不能放进主会话 cookie：主会话是 SameSite=Strict，
+// OAuth2 回调是从 IdP 发起的跨站顶级导航，浏览器不会携带 Strict
+// cookie，因此使用独立的短期 SameSite=Lax cookie。
+const (
+	oauth2StateCookie  = "mail_go_oauth2_state"
+	oauth2StateMaxAge  = 600 // 秒，10 分钟内完成授权流程
+	oauth2StateRandLen = 16  // 随机字节数（hex 编码后 32 字符）
+)
+
+// randomOAuth2State generates a hex-encoded cryptographically random state.
+func randomOAuth2State() (string, error) {
+	buf := make([]byte, oauth2StateRandLen)
+	if _, err := rand.Read(buf); err != nil {
+		return "", fmt.Errorf("生成 OAuth2 state 失败: %w", err)
+	}
+	return hex.EncodeToString(buf), nil
+}
+
+// oauth2LoginVars 是登录模板所需的公共变量。
+func (h *AuthHandler) oauth2LoginVars() gin.H {
+	return gin.H{
+		"oauth2Enabled":  h.authCfg.OAuth2Enabled,
+		"ldapEnabled":    h.authCfg.LDAPEnabled,
+		"oauth2Provider": h.authCfg.OAuth2Provider,
+	}
+}
+
 // OAuth2Start redirects to the OAuth2 provider's authorization page.
 func (h *AuthHandler) OAuth2Start(c *gin.Context) {
 	if !h.authCfg.OAuth2Enabled {
@@ -226,8 +259,13 @@ func (h *AuthHandler) OAuth2Start(c *gin.Context) {
 	}
 
 	provider := auth.NewOAuth2Provider(h.authCfg)
-	// Use a simple state for CSRF protection (in production, use a random token)
-	state := "mailgo_oauth2_state"
+	state, err := randomOAuth2State()
+	if err != nil {
+		log.Printf("生成 OAuth2 state 失败: %v", err)
+		c.String(http.StatusInternalServerError, "OAuth2 登录暂不可用，请稍后重试")
+		return
+	}
+	c.SetCookie(oauth2StateCookie, state, oauth2StateMaxAge, "/auth/oauth2", "", true, true)
 	c.Redirect(http.StatusFound, provider.GetAuthURL(state))
 }
 
@@ -238,6 +276,22 @@ func (h *AuthHandler) OAuth2Callback(c *gin.Context) {
 		return
 	}
 
+	// 校验 state：必须与发起授权时下发的随机值一致（常量时间比较）。
+	// 缺失或不匹配视为登录 CSRF / 授权码注入，直接拒绝。
+	cookieState, cookieErr := c.Cookie(oauth2StateCookie)
+	reqState := c.Query("state")
+	if cookieErr != nil || reqState == "" ||
+		subtle.ConstantTimeCompare([]byte(cookieState), []byte(reqState)) != 1 {
+		c.HTML(http.StatusForbidden, "login", func() gin.H {
+			v := h.oauth2LoginVars()
+			v["error"] = "OAuth2 state 校验失败，请重新发起登录"
+			return v
+		}())
+		return
+	}
+	// state 一次性使用：无论后续成败都立即失效
+	c.SetCookie(oauth2StateCookie, "", -1, "/auth/oauth2", "", true, true)
+
 	code := c.Query("code")
 	if code == "" {
 		c.HTML(200, "login", gin.H{
@@ -254,7 +308,7 @@ func (h *AuthHandler) OAuth2Callback(c *gin.Context) {
 	if err != nil {
 		log.Printf("OAuth2 回调失败: %v", err)
 		c.HTML(200, "login", gin.H{
-			"error":          fmt.Sprintf("OAuth2 认证失败: %v", err),
+			"error":          "OAuth2 认证失败，请重试或联系管理员",
 			"oauth2Enabled":  h.authCfg.OAuth2Enabled,
 			"ldapEnabled":    h.authCfg.LDAPEnabled,
 			"oauth2Provider": h.authCfg.OAuth2Provider,
@@ -266,7 +320,7 @@ func (h *AuthHandler) OAuth2Callback(c *gin.Context) {
 	user, err := h.stores.Users.GetByEmail(email)
 	if err != nil {
 		c.HTML(200, "login", gin.H{
-			"error":          fmt.Sprintf("OAuth2 用户 %s 在系统中不存在", email),
+			"error":          "OAuth2 账号未接入本系统，请联系管理员",
 			"oauth2Enabled":  h.authCfg.OAuth2Enabled,
 			"ldapEnabled":    h.authCfg.LDAPEnabled,
 			"oauth2Provider": h.authCfg.OAuth2Provider,

internal/web/handlers/mail.go

@@ -4,6 +4,7 @@ import (
 	"encoding/base64"
 	"fmt"
 	"io"
+	"mime"
 	"net/http"
 	"path/filepath"
 	"strconv"
@@ -56,6 +57,14 @@ func NewMailHandler(stores *store.Stores, attStorage *storage.AttachmentStorage,
 	return &MailHandler{stores: stores, storage: attStorage, outbound: ob}
 }
 
+// folderCounts returns sidebar badge counts for the current user.
+func (h *MailHandler) folderCounts(userID uint) (inboxUnread, draftsTotal, sentTotal int64) {
+	inboxUnread, _ = h.stores.Mails.CountUnread(userID, "INBOX")
+	draftsTotal, _ = h.stores.Mails.CountByUserAndFolder(userID, "Drafts")
+	sentTotal, _ = h.stores.Mails.CountByUserAndFolder(userID, "Sent")
+	return
+}
+
 // Inbox renders the inbox page showing all messages in the user's INBOX folder.
 func (h *MailHandler) Inbox(c *gin.Context) {
 	userID := c.GetUint("userID")
@@ -67,7 +76,7 @@ func (h *MailHandler) Inbox(c *gin.Context) {
 		return
 	}
 
-	unreadCount, _ := h.stores.Mails.CountUnread(userID, "INBOX")
+	inboxUnread, draftsTotal, sentTotal := h.folderCounts(userID)
 
 	currentUser, _ := c.Get("currentUser")
 
@@ -83,12 +92,14 @@ func (h *MailHandler) Inbox(c *gin.Context) {
 		"currentUser":  currentUser,
 		"messages":     messages,
 		"total":        total,
-		"unreadCount":  unreadCount,
 		"page":         page,
 		"pageSize":     20,
 		"totalPages":   totalPages,
 		"folder":       "INBOX",
 		"activeFolder": "inbox",
+		"inboxUnread":  inboxUnread,
+		"draftsTotal":  draftsTotal,
+		"sentTotal":    sentTotal,
 	})
 }
 
@@ -123,12 +134,16 @@ func (h *MailHandler) View(c *gin.Context) {
 	}
 
 	currentUser, _ := c.Get("currentUser")
+	inboxUnread, draftsTotal, sentTotal := h.folderCounts(userID)
 
 	c.HTML(200, "view", gin.H{
 		"currentUser":  currentUser,
 		"message":      msg,
 		"attachments":  attachments,
 		"activeFolder": resolveActiveFolder(msg.Folder),
+		"inboxUnread":  inboxUnread,
+		"draftsTotal":  draftsTotal,
+		"sentTotal":    sentTotal,
 	})
 }
 
@@ -146,6 +161,8 @@ func (h *MailHandler) Compose(c *gin.Context) {
 		quotaBytes = user.QuotaBytes
 	}
 
+	inboxUnread, draftsTotal, sentTotal := h.folderCounts(userID)
+
 	c.HTML(200, "compose", gin.H{
 		"currentUser":  currentUser,
 		"activeFolder": "compose",
@@ -155,6 +172,9 @@ func (h *MailHandler) Compose(c *gin.Context) {
 		"bodyContent":  "",
 		"usedBytes":    usedBytes,
 		"quotaBytes":   quotaBytes,
+		"inboxUnread":  inboxUnread,
+		"draftsTotal":  draftsTotal,
+		"sentTotal":    sentTotal,
 	})
 }
 
@@ -245,62 +265,8 @@ func (h *MailHandler) DoSend(c *gin.Context) {
 
 	// Build the email content
 	fromAddr := fmt.Sprintf("%s@%s", currentUser.Username, currentUser.Domain.Name)
+	messageID, rawMessage := buildOutgoingMessage(fromAddr, to, cc, subject, body, htmlBody, attachments)
 	now := time.Now()
-	messageID := fmt.Sprintf("<%s@mail_go>", uuid.New().String())
-
-	// Construct the raw email message
-	var sb strings.Builder
-	sb.WriteString(fmt.Sprintf("From: %s\r\n", fromAddr))
-	sb.WriteString(fmt.Sprintf("To: %s\r\n", to))
-	if cc != "" {
-		sb.WriteString(fmt.Sprintf("Cc: %s\r\n", cc))
-	}
-	sb.WriteString(fmt.Sprintf("Subject: %s\r\n", subject))
-	sb.WriteString(fmt.Sprintf("Message-ID: %s\r\n", messageID))
-	sb.WriteString(fmt.Sprintf("Date: %s\r\n", now.Format(time.RFC1123Z)))
-	sb.WriteString("MIME-Version: 1.0\r\n")
-
-	// Attachments are wrapped in an outer multipart/mixed container.
-	outerBoundary := ""
-	hasAttachments := len(attachments) > 0
-	if hasAttachments {
-		outerBoundary = fmt.Sprintf("----=_Mixed_%s", uuid.New().String())
-		sb.WriteString(fmt.Sprintf("Content-Type: multipart/mixed; boundary=\"%s\"\r\n", outerBoundary))
-		sb.WriteString("\r\n")
-		sb.WriteString(fmt.Sprintf("--%s\r\n", outerBoundary))
-	}
-
-	// Build message body with multipart/alternative if HTML is present
-	if htmlBody != "" {
-		boundary := fmt.Sprintf("----=_Part_%s", uuid.New().String())
-		sb.WriteString(fmt.Sprintf("Content-Type: multipart/alternative; boundary=\"%s\"\r\n", boundary))
-		sb.WriteString("\r\n")
-		sb.WriteString(fmt.Sprintf("--%s\r\n", boundary))
-		sb.WriteString("Content-Type: text/plain; charset=utf-8\r\n\r\n")
-		sb.WriteString(body)
-		sb.WriteString(fmt.Sprintf("\r\n--%s\r\n", boundary))
-		sb.WriteString("Content-Type: text/html; charset=utf-8\r\n\r\n")
-		sb.WriteString(htmlBody)
-		sb.WriteString(fmt.Sprintf("\r\n--%s--\r\n", boundary))
-	} else {
-		sb.WriteString("Content-Type: text/plain; charset=utf-8\r\n")
-		sb.WriteString("\r\n")
-		sb.WriteString(body)
-		sb.WriteString("\r\n")
-	}
-
-	// Append attachment parts to the multipart/mixed container.
-	for _, att := range attachments {
-		sb.WriteString(fmt.Sprintf("--%s\r\n", outerBoundary))
-		sb.WriteString(fmt.Sprintf("Content-Type: %s; name=\"%s\"\r\n", att.contentType, att.filename))
-		sb.WriteString("Content-Transfer-Encoding: base64\r\n")
-		sb.WriteString(fmt.Sprintf("Content-Disposition: attachment; filename=\"%s\"\r\n\r\n", att.filename))
-		sb.WriteString(base64LineWrap(att.data))
-		sb.WriteString("\r\n")
-	}
-	if hasAttachments {
-		sb.WriteString(fmt.Sprintf("--%s--\r\n", outerBoundary))
-	}
 
 	allRecipients := append(parseAddressInput(to), parseAddressInput(cc)...)
 	localUsers := make([]*db.User, 0, len(allRecipients))
@@ -348,7 +314,7 @@ func (h *MailHandler) DoSend(c *gin.Context) {
 			return
 		}
 		for _, rcpt := range externalRecipients {
-			if _, err := ob.Enqueue(currentUser, fromAddr, rcpt, []byte(sb.String())); err != nil {
+			if _, err := ob.Enqueue(currentUser, fromAddr, rcpt, []byte(rawMessage)); err != nil {
 				c.HTML(http.StatusBadRequest, "compose", gin.H{
 					"currentUser":  currentUser,
 					"activeFolder": "compose",
@@ -376,7 +342,7 @@ func (h *MailHandler) DoSend(c *gin.Context) {
 			Subject:   subject,
 			TextBody:  body,
 			HtmlBody:  htmlBody,
-			RawData:   sb.String(),
+			RawData:   rawMessage,
 			Date:      now,
 			IsRead:    false,
 		}
@@ -407,7 +373,7 @@ func (h *MailHandler) DoSend(c *gin.Context) {
 		Subject:   subject,
 		TextBody:  body,
 		HtmlBody:  htmlBody,
-		RawData:   sb.String(),
+		RawData:   rawMessage,
 		Date:      now,
 		IsRead:    true,
 	}
@@ -464,6 +430,94 @@ func parseAddressInput(input string) []string {
 	return addresses
 }
 
+// sanitizeHeaderField removes CR/LF/NUL from a value destined for an RFC 5322
+// message header, preventing header injection (e.g. smuggling a Bcc or
+// Reply-To header via a crafted subject or address list).
+func sanitizeHeaderField(s string) string {
+	s = strings.ReplaceAll(s, "\r", "")
+	s = strings.ReplaceAll(s, "\n", "")
+	s = strings.ReplaceAll(s, "\x00", "")
+	return s
+}
+
+// encodeSubject prepares a subject for safe inclusion as a message header:
+// header injection characters are stripped and non-ASCII content is encoded
+// per RFC 2047.
+func encodeSubject(s string) string {
+	return mime.QEncoding.Encode("utf-8", sanitizeHeaderField(s))
+}
+
+// formatContentDisposition builds a Content-Disposition header value for the
+// given filename, quoting/encoding it per RFC 2183/2231 (also neutralizes
+// CR/LF injection through crafted filenames).
+func formatContentDisposition(filename string) string {
+	return mime.FormatMediaType("attachment", map[string]string{"filename": filename})
+}
+
+// buildOutgoingMessage constructs the raw RFC 5322 message for the web
+// compose form and returns its Message-ID. All header values derived from
+// user input are sanitized to prevent CRLF header injection.
+func buildOutgoingMessage(from, to, cc, subject, body, htmlBody string, attachments []pendingAttachment) (messageID, raw string) {
+	now := time.Now()
+	messageID = fmt.Sprintf("<%s@mail_go>", uuid.New().String())
+
+	var sb strings.Builder
+	sb.WriteString(fmt.Sprintf("From: %s\r\n", sanitizeHeaderField(from)))
+	sb.WriteString(fmt.Sprintf("To: %s\r\n", sanitizeHeaderField(to)))
+	if cc != "" {
+		sb.WriteString(fmt.Sprintf("Cc: %s\r\n", sanitizeHeaderField(cc)))
+	}
+	sb.WriteString(fmt.Sprintf("Subject: %s\r\n", encodeSubject(subject)))
+	sb.WriteString(fmt.Sprintf("Message-ID: %s\r\n", messageID))
+	sb.WriteString(fmt.Sprintf("Date: %s\r\n", now.Format(time.RFC1123Z)))
+	sb.WriteString("MIME-Version: 1.0\r\n")
+
+	// Attachments are wrapped in an outer multipart/mixed container.
+	outerBoundary := ""
+	hasAttachments := len(attachments) > 0
+	if hasAttachments {
+		outerBoundary = fmt.Sprintf("----=_Mixed_%s", uuid.New().String())
+		sb.WriteString(fmt.Sprintf("Content-Type: multipart/mixed; boundary=\"%s\"\r\n", outerBoundary))
+		sb.WriteString("\r\n")
+		sb.WriteString(fmt.Sprintf("--%s\r\n", outerBoundary))
+	}
+
+	// Build message body with multipart/alternative if HTML is present
+	if htmlBody != "" {
+		boundary := fmt.Sprintf("----=_Part_%s", uuid.New().String())
+		sb.WriteString(fmt.Sprintf("Content-Type: multipart/alternative; boundary=\"%s\"\r\n", boundary))
+		sb.WriteString("\r\n")
+		sb.WriteString(fmt.Sprintf("--%s\r\n", boundary))
+		sb.WriteString("Content-Type: text/plain; charset=utf-8\r\n\r\n")
+		sb.WriteString(body)
+		sb.WriteString(fmt.Sprintf("\r\n--%s\r\n", boundary))
+		sb.WriteString("Content-Type: text/html; charset=utf-8\r\n\r\n")
+		sb.WriteString(htmlBody)
+		sb.WriteString(fmt.Sprintf("\r\n--%s--\r\n", boundary))
+	} else {
+		sb.WriteString("Content-Type: text/plain; charset=utf-8\r\n")
+		sb.WriteString("\r\n")
+		sb.WriteString(body)
+		sb.WriteString("\r\n")
+	}
+
+	// Append attachment parts to the multipart/mixed container.
+	for _, att := range attachments {
+		contentType := mime.FormatMediaType(att.contentType, map[string]string{"name": att.filename})
+		sb.WriteString(fmt.Sprintf("--%s\r\n", outerBoundary))
+		sb.WriteString(fmt.Sprintf("Content-Type: %s\r\n", contentType))
+		sb.WriteString("Content-Transfer-Encoding: base64\r\n")
+		sb.WriteString(fmt.Sprintf("Content-Disposition: %s\r\n\r\n", formatContentDisposition(att.filename)))
+		sb.WriteString(base64LineWrap(att.data))
+		sb.WriteString("\r\n")
+	}
+	if hasAttachments {
+		sb.WriteString(fmt.Sprintf("--%s--\r\n", outerBoundary))
+	}
+
+	return messageID, sb.String()
+}
+
 // mimeTypes maps common file extensions to MIME types.
 var mimeTypes = map[string]string{
 	".txt":  "text/plain",
@@ -495,6 +549,7 @@ func (h *MailHandler) Sent(c *gin.Context) {
 	}
 
 	currentUser, _ := c.Get("currentUser")
+	inboxUnread, draftsTotal, sentTotal := h.folderCounts(userID)
 
 	totalPages := int(total) / 20
 	if int(total)%20 > 0 {
@@ -513,6 +568,9 @@ func (h *MailHandler) Sent(c *gin.Context) {
 		"totalPages":   totalPages,
 		"folder":       "Sent",
 		"activeFolder": "sent",
+		"inboxUnread":  inboxUnread,
+		"draftsTotal":  draftsTotal,
+		"sentTotal":    sentTotal,
 	})
 }
 
@@ -600,7 +658,7 @@ func (h *MailHandler) DownloadAttachment(c *gin.Context) {
 		return
 	}
 
-	c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", att.FileName))
+	c.Header("Content-Disposition", formatContentDisposition(att.FileName))
 	c.Data(http.StatusOK, att.ContentType, data)
 }
 
@@ -630,6 +688,7 @@ func (h *MailHandler) Drafts(c *gin.Context) {
 	}
 
 	currentUser, _ := c.Get("currentUser")
+	inboxUnread, draftsTotal, sentTotal := h.folderCounts(userID)
 
 	totalPages := int(total) / 20
 	if int(total)%20 > 0 {
@@ -648,17 +707,26 @@ func (h *MailHandler) Drafts(c *gin.Context) {
 		"totalPages":   totalPages,
 		"folder":       "Drafts",
 		"activeFolder": "drafts",
+		"inboxUnread":  inboxUnread,
+		"draftsTotal":  draftsTotal,
+		"sentTotal":    sentTotal,
 	})
 }
 
 // Settings renders the user settings page.
 func (h *MailHandler) Settings(c *gin.Context) {
 	currentUser, _ := c.Get("currentUser")
+	userID := c.GetUint("userID")
+	inboxUnread, draftsTotal, sentTotal := h.folderCounts(userID)
 	c.HTML(200, "settings", gin.H{
 		"currentUser":  currentUser,
 		"activeFolder": "settings",
 		"error":        "",
 		"success":      "",
+		"mustChange":   c.Query("force") == "1",
+		"inboxUnread":  inboxUnread,
+		"draftsTotal":  draftsTotal,
+		"sentTotal":    sentTotal,
 	})
 }
 

internal/web/handlers/mail_injection_test.go

@@ -0,0 +1,106 @@
+package handlers
+
+// P1 #4 回归测试：Web 写信的邮件头不可被 CRLF 注入。
+// 旧实现把 to/cc/subject/附件名原样拼进 MIME 头，攻击者可通过
+// subject 注入 Reply-To/Bcc 等任意头用于钓鱼。
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestSanitizeHeaderField(t *testing.T) {
+	cases := []struct {
+		in, want string
+	}{
+		{"normal value", "normal value"},
+		{"with\r\ninjected: header", "withinjected: header"},
+		{"lf\nonly", "lfonly"},
+		{"cr\ronly", "cronly"},
+		{"nul\x00byte", "nulbyte"},
+		{"mixed\r\n\x00all", "mixedall"},
+		{"中文主题", "中文主题"},
+	}
+	for _, tc := range cases {
+		if got := sanitizeHeaderField(tc.in); got != tc.want {
+			t.Errorf("sanitizeHeaderField(%q) = %q, want %q", tc.in, got, tc.want)
+		}
+	}
+}
+
+func TestBuildOutgoingMessageBlocksHeaderInjection(t *testing.T) {
+	_, raw := buildOutgoingMessage(
+		"alice@example.com",
+		"bob@example.com\r\nBcc: victim@evil.com",
+		"carol@example.com\r\nReply-To: attacker@evil.com",
+		"Hi\r\nBcc: victim@evil.com\r\nReply-To: attacker@evil.com",
+		"body",
+		"",
+		nil,
+	)
+
+	// 注入的头不允许以独立头形式出现
+	for _, injected := range []string{
+		"Bcc:", "Reply-To:",
+	} {
+		if strings.Contains(raw, "\r\n"+injected) || strings.HasPrefix(raw, injected) {
+			t.Fatalf("injected header %q found in message:\n%s", injected, raw)
+		}
+	}
+
+	// 注入的邮箱地址本身允许以折叠形式残留在原头值中，
+	// 但绝不能成为独立的一行头。
+	lines := strings.Split(raw, "\r\n")
+	for _, line := range lines[1:] { // 跳过 From
+		trimmed := strings.TrimSpace(line)
+		if strings.HasPrefix(trimmed, "Bcc:") || strings.HasPrefix(trimmed, "Reply-To:") {
+			t.Fatalf("injected header line %q found in message:\n%s", line, raw)
+		}
+	}
+}
+
+func TestBuildOutgoingMessageAttFilenameInjection(t *testing.T) {
+	atts := []pendingAttachment{
+		{filename: "evil.png\r\nBcc: victim@evil.com", contentType: "image/png", data: []byte("x")},
+		{filename: `quote".png`, contentType: "image/png", data: []byte("x")},
+	}
+	_, raw := buildOutgoingMessage("a@b.com", "c@d.com", "", "t", "body", "", atts)
+
+	lines := strings.Split(raw, "\r\n")
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if strings.HasPrefix(trimmed, "Bcc:") {
+			t.Fatalf("filename header injection found: %q\nmessage:\n%s", line, raw)
+		}
+	}
+
+	// 含引号/换行的文件名必须被正确编码，不能破坏头结构
+	if !strings.Contains(raw, "Content-Disposition: attachment;") {
+		t.Fatalf("Content-Disposition missing in message:\n%s", raw)
+	}
+}
+
+func TestBuildOutgoingMessageEncodesNonASCIISubject(t *testing.T) {
+	_, raw := buildOutgoingMessage("a@b.com", "c@d.com", "", "中文主题测试", "body", "", nil)
+	// 非 ASCII 主题应按 RFC 2047 编码为 =?utf-8?...?= 形式
+	if !strings.Contains(raw, "Subject: =?utf-8?") && !strings.Contains(raw, "Subject: =?UTF-8?") {
+		t.Fatalf("non-ASCII subject should be RFC 2047 encoded, got:\n%s", raw)
+	}
+	// 头部不应再包含裸中文（应被编码）
+	for _, line := range strings.Split(raw, "\r\n") {
+		if strings.HasPrefix(line, "Subject:") && strings.ContainsAny(line, "中文测试") {
+			t.Fatalf("raw non-ASCII in Subject header: %q", line)
+		}
+	}
+}
+
+func TestFormatContentDisposition(t *testing.T) {
+	if got := formatContentDisposition("report.pdf"); got != "attachment; filename=report.pdf" {
+		t.Fatalf("simple filename: got %q", got)
+	}
+	// 特殊字符需要安全编码而不是原样嵌入
+	got := formatContentDisposition("a\"b\\c\r\nd.png")
+	if strings.ContainsAny(got, "\r\n") {
+		t.Fatalf("CRLF leaked into Content-Disposition: %q", got)
+	}
+}

internal/web/handlers/oauth2_state_test.go

@@ -0,0 +1,208 @@
+package handlers
+
+// P1 #2 回归测试：OAuth2 state 必须随机、回调必须校验。
+// 旧实现 state 为硬编码常量且回调完全不校验（登录 CSRF / 授权码注入）。
+
+import (
+	"html/template"
+	"math"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"mail_go/config"
+	"mail_go/internal/mailutil"
+
+	"github.com/gin-gonic/gin"
+)
+
+// testTemplateFuncs 提供模板解析所需的自定义函数（与 web 包的
+// templateFuncs 等价，但 handlers 包无法反向依赖 web 包）。
+func testTemplateFuncs() template.FuncMap {
+	return template.FuncMap{
+		"add":        func(a, b int) int { return a + b },
+		"sub":        func(a, b int) int { return a - b },
+		"mul":        func(a, b int) int { return a * b },
+		"div":        func(a, b int) int { return a / b },
+		"mod":        func(a, b int) int { return a % b },
+		"ceilDiv":    func(a, b int) int { return int(math.Ceil(float64(a) / float64(b))) },
+		"seq":        func(n int) []int { r := make([]int, n); for i := range r { r[i] = i + 1 }; return r },
+		"domainName": func(domainID uint, domains []interface{}) string { return "Domain #1" },
+		"safeHTML":   func(s string) template.HTML { return template.HTML(s) },
+		"safeJS":     func(s string) template.JS { return template.JS(s) },
+		"formatBytes": func(b int64) string {
+			return "1 KB"
+		},
+		"decodeHeader": mailutil.DecodeRFC2047,
+		"mailName":     func(s string) string { return s },
+		"mailEmail":    func(s string) string { return s },
+		"initial":      func(s string) string { return "?" },
+		"truncate":     func(s string, n int) string { return s },
+		"shortDate":    func(t time.Time) string { return t.Format("2006-01-02") },
+		"avatarStyle":  func(s string) string { return "background:#eee;color:#333" },
+	}
+}
+
+func newOAuth2TestContext(t *testing.T) (*gin.Context, *AuthHandler, *httptest.ResponseRecorder) {
+	t.Helper()
+	gin.SetMode(gin.TestMode)
+	w := httptest.NewRecorder()
+	c, engine := gin.CreateTestContext(w)
+	// 回调的错误分支渲染 login 模板，需要加载模板及自定义函数
+	tmpl := template.Must(template.New("").Funcs(testTemplateFuncs()).ParseGlob(filepath.Join("..", "templates", "*.html")))
+	engine.SetHTMLTemplate(tmpl)
+	c.Request = httptest.NewRequest(http.MethodGet, "/auth/oauth2", nil)
+
+	authCfg := config.AuthConfig{
+		OAuth2Enabled:      true,
+		// 使用本地拒绝连接的地址作为 provider，token 交换快速失败，
+		// 测试不依赖外部网络。
+		OAuth2Provider:     "127.0.0.1:1",
+		OAuth2ClientID:     "test-client-id",
+		OAuth2ClientSecret: "test-client-secret",
+		OAuth2RedirectURL:  "https://mail.example.com/auth/oauth2/callback",
+	}
+	h := NewAuthHandler(nil, authCfg, config.BanConfig{MaxFailAttempts: 100})
+	return c, h, w
+}
+
+func TestRandomOAuth2State(t *testing.T) {
+	s1, err := randomOAuth2State()
+	if err != nil {
+		t.Fatalf("randomOAuth2State() error: %v", err)
+	}
+	if len(s1) != oauth2StateRandLen*2 {
+		t.Fatalf("state length = %d, want %d (hex)", len(s1), oauth2StateRandLen*2)
+	}
+	s2, _ := randomOAuth2State()
+	if s1 == s2 {
+		t.Fatal("state must be unique per request")
+	}
+	if s1 == "mailgo_oauth2_state" {
+		t.Fatal("state must not be the old hardcoded constant")
+	}
+}
+
+func TestOAuth2StartSetsRandomStateCookie(t *testing.T) {
+	c, h, w := newOAuth2TestContext(t)
+	h.OAuth2Start(c)
+
+	if w.Code != http.StatusFound {
+		t.Fatalf("status = %d, want 302", w.Code)
+	}
+	loc := w.Header().Get("Location")
+	if !strings.Contains(loc, "state=") {
+		t.Fatalf("redirect URL should carry state: %s", loc)
+	}
+
+	// state cookie 必须存在且与 URL 中的一致
+	cookies := w.Result().Cookies()
+	var stateVal string
+	found := false
+	for _, ck := range cookies {
+		if ck.Name == oauth2StateCookie {
+			found = true
+			stateVal = ck.Value
+			if !ck.HttpOnly {
+				t.Error("state cookie must be HttpOnly")
+			}
+			if !ck.Secure {
+				t.Error("state cookie must be Secure")
+			}
+			if ck.MaxAge <= 0 || ck.MaxAge > oauth2StateMaxAge {
+				t.Errorf("state cookie MaxAge = %d, want in (0, %d]", ck.MaxAge, oauth2StateMaxAge)
+			}
+		}
+	}
+	if !found {
+		t.Fatal("OAuth2Start should set state cookie")
+	}
+
+	u, err := url.Parse(loc)
+	if err != nil {
+		t.Fatalf("parse location: %v", err)
+	}
+	if u.Query().Get("state") != stateVal {
+		t.Fatalf("cookie state %q != URL state %q", stateVal, u.Query().Get("state"))
+	}
+
+	// 两次发起的 state 不同
+	c2, h2, w2 := newOAuth2TestContext(t)
+	h2.OAuth2Start(c2)
+	u2, _ := url.Parse(w2.Header().Get("Location"))
+	if u2.Query().Get("state") == stateVal {
+		t.Fatal("state must differ between sessions")
+	}
+}
+
+func TestOAuth2CallbackRejectsMissingOrMismatchedState(t *testing.T) {
+	cases := []struct {
+		name        string
+		cookieState string
+		queryState  string
+	}{
+		{"no cookie", "", "abc"},
+		{"no query state", "abc", ""},
+		{"mismatch", "abc", "xyz"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			c, h, w := newOAuth2TestContext(t)
+			q := url.Values{}
+			q.Set("code", "test-code")
+			if tc.queryState != "" {
+				q.Set("state", tc.queryState)
+			}
+			c.Request = httptest.NewRequest(http.MethodGet, "/auth/oauth2/callback?"+q.Encode(), nil)
+			if tc.cookieState != "" {
+				c.Request.AddCookie(&http.Cookie{Name: oauth2StateCookie, Value: tc.cookieState})
+			}
+			h.OAuth2Callback(c)
+			if w.Code != http.StatusForbidden {
+				t.Fatalf("status = %d, want 403", w.Code)
+			}
+		})
+	}
+}
+
+func TestOAuth2CallbackAcceptsValidState(t *testing.T) {
+	// 模拟完整流程：Start 下发 state -> Callback 带回同一 state。
+	// state 校验通过后应进入后续流程（本测试无真实 IdP，
+	// code 交换会失败并渲染登录错误页，但这证明 state 关卡已通过）。
+	c, h, w := newOAuth2TestContext(t)
+	h.OAuth2Start(c)
+	var stateVal string
+	for _, ck := range w.Result().Cookies() {
+		if ck.Name == oauth2StateCookie {
+			stateVal = ck.Value
+		}
+	}
+
+	w2 := httptest.NewRecorder()
+	c2, engine2 := gin.CreateTestContext(w2)
+	tmpl2 := template.Must(template.New("").Funcs(testTemplateFuncs()).ParseGlob(filepath.Join("..", "templates", "*.html")))
+	engine2.SetHTMLTemplate(tmpl2)
+	q := url.Values{}
+	q.Set("code", "test-code")
+	q.Set("state", stateVal)
+	c2.Request = httptest.NewRequest(http.MethodGet, "/auth/oauth2/callback?"+q.Encode(), nil)
+	c2.Request.AddCookie(&http.Cookie{Name: oauth2StateCookie, Value: stateVal})
+
+	h.OAuth2Callback(c2)
+
+	// state 校验失败返回 403；此处应为非 403（进入 token 交换失败分支）
+	if w2.Code == http.StatusForbidden {
+		t.Fatalf("valid state was rejected")
+	}
+	if !strings.Contains(w2.Body.String(), "OAuth2") {
+		body := w2.Body.String()
+		if len(body) > 200 {
+			body = body[:200]
+		}
+		t.Fatalf("expected OAuth2 error page after state check passed, body: %s", body)
+	}
+}

internal/web/middleware/auth.go

@@ -48,6 +48,13 @@ func AuthMiddleware(stores *store.Stores) gin.HandlerFunc {
 			return
 		}
 
+		// 首次登录/密码被重置的用户必须先修改密码才能使用其他功能
+		if user.MustChangePassword && c.Request.URL.Path != "/settings" && c.Request.URL.Path != "/logout" {
+			c.Redirect(302, "/settings?force=1")
+			c.Abort()
+			return
+		}
+
 		c.Set("currentUser", user)
 		c.Set("userID", id)
 		c.Next()

internal/web/middleware/security.go

@@ -0,0 +1,36 @@
+package middleware
+
+import (
+	"github.com/gin-gonic/gin"
+)
+
+// securityCSP 是本应用的基础 CSP。
+//
+// 说明：
+//   - 模板大量使用内联脚本/样式（Quill 初始化、行内事件处理、
+//     avatarStyle 内联 CSS），故 script-src / style-src 需要
+//     'unsafe-inline'；
+//   - 邮件正文在 srcdoc iframe 中渲染，可能引用远程图片（https:），
+//     因此 img-src 放行 https，同时仍阻止 data: 以外的自定义协议；
+//   - frame-ancestors 'none' 与 X-Frame-Options 共同防护点击劫持；
+//   - connect-src 'self' / form-action 'self' 阻止页面数据外泄到
+//     外部域名。
+const securityCSP = "default-src 'self'; " +
+	"script-src 'self' 'unsafe-inline'; " +
+	"style-src 'self' 'unsafe-inline'; " +
+	"img-src 'self' data: https:; " +
+	"connect-src 'self'; object-src 'none'; base-uri 'self'; " +
+	"form-action 'self'; frame-ancestors 'none'"
+
+// SecurityHeaders 为所有响应设置基础安全头：HSTS、点击劫持防护、
+// MIME 嗅探防护、Referrer 策略与基础 CSP。
+func SecurityHeaders() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		c.Header("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
+		c.Header("X-Frame-Options", "DENY")
+		c.Header("X-Content-Type-Options", "nosniff")
+		c.Header("Referrer-Policy", "strict-origin-when-cross-origin")
+		c.Header("Content-Security-Policy", securityCSP)
+		c.Next()
+	}
+}

internal/web/middleware/security_test.go

@@ -0,0 +1,45 @@
+package middleware
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+)
+
+// TestSecurityHeaders 验证所有基础安全响应头都存在。
+func TestSecurityHeaders(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	r := gin.New()
+	r.Use(SecurityHeaders())
+	r.GET("/", func(c *gin.Context) { c.String(http.StatusOK, "ok") })
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	r.ServeHTTP(w, req)
+
+	for _, h := range []string{
+		"Strict-Transport-Security",
+		"X-Frame-Options",
+		"X-Content-Type-Options",
+		"Referrer-Policy",
+		"Content-Security-Policy",
+	} {
+		if v := w.Header().Get(h); v == "" {
+			t.Errorf("missing security header %q", h)
+		}
+	}
+
+	// 关键头内容抽查
+	if got := w.Header().Get("X-Frame-Options"); got != "DENY" {
+		t.Errorf("X-Frame-Options = %q, want DENY", got)
+	}
+	if got := w.Header().Get("Content-Security-Policy"); !strings.Contains(got, "frame-ancestors 'none'") {
+		t.Errorf("CSP should include frame-ancestors 'none', got %q", got)
+	}
+	if got := w.Header().Get("Content-Security-Policy"); !strings.Contains(got, "connect-src 'self'") {
+		t.Errorf("CSP should include connect-src 'self', got %q", got)
+	}
+}

internal/web/render_test.go

@@ -0,0 +1,92 @@
+package web
+
+// Temporary render test used to validate the rewritten frontend templates.
+// Renders every page template with realistic dummy data and writes the
+// output to /tmp/mailgo_preview for visual verification.
+
+import (
+	"html/template"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"mail_go/internal/db"
+)
+
+func TestRenderAllPages(t *testing.T) {
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	tmpl := template.Must(template.New("").Funcs(templateFuncs()).ParseGlob(filepath.Join(wd, "templates", "*.html")))
+	template.Must(tmpl.ParseGlob(filepath.Join(wd, "templates", "admin", "*.html")))
+
+	now := time.Now()
+	user := &db.User{
+		ID:         1,
+		Username:   "admin",
+		IsAdmin:    true,
+		Domain:     db.Domain{Name: "lmve.net"},
+		UsedBytes:  5 * 1024 * 1024,
+		QuotaBytes: 5 * 1024 * 1024 * 1024,
+	}
+
+	messages := []db.Message{
+		{ID: 1, Folder: "INBOX", FromAddr: "=?UTF-8?B?5byg5LiJ?= <zhangsan@lmve.net>", ToAddr: "admin@lmve.net", Subject: "邮件系统部署完成通知", TextBody: "您好！您的 MailGo 邮件系统已成功部署，本邮件为测试邮件。", Date: now, IsRead: false},
+		{ID: 2, Folder: "INBOX", FromAddr: "alice@example.com", ToAddr: "admin@lmve.net", Subject: "Re: 项目进度同步", TextBody: "好的，我们下周一上午十点开会同步一下进度。", Date: now.Add(-3 * time.Hour), IsRead: true},
+		{ID: 3, Folder: "INBOX", FromAddr: "=?UTF-8?B?6ZmI5rKz?= <wangwu@lmve.net>", ToAddr: "admin@lmve.net", Subject: "服务器巡检报告（8 月）", TextBody: "本月巡检完成，磁盘使用率 62%，内存使用正常。", Date: now.Add(-48 * time.Hour), IsRead: false},
+		{ID: 4, Folder: "INBOX", FromAddr: "bob@other.com", ToAddr: "admin@lmve.net", Subject: "Newsletter #42", TextBody: "这是本周的资讯摘要，共 5 篇文章。", Date: now.Add(-10 * 24 * time.Hour), IsRead: true},
+		{ID: 5, Folder: "INBOX", FromAddr: "=?UTF-8?B?6ZmI5rKz?= <wangwu@lmve.net>", ToAddr: "admin@lmve.net", Subject: "DNS 记录更新", TextBody: "已按文档更新 SPF 与 DKIM 记录，请验证。", Date: now.Add(-100 * 24 * time.Hour), IsRead: true},
+	}
+
+	attachments := []db.Attachment{
+		{ID: 1, FileName: "部署文档.pdf", FileSize: 1024 * 1024},
+		{ID: 2, FileName: "logo.png", FileSize: 128 * 1024},
+	}
+
+	cases := []struct {
+		name string
+		data ginH
+	}{
+		{"login", ginH{"error": ""}},
+		{"banned", ginH{"entry": &db.BanEntry{IPAddress: "1.2.3.4", Reason: "登录失败次数过多", FailCount: 8, ExpiresAt: now.Add(20 * time.Minute)}}},
+		{"inbox", ginH{"currentUser": user, "messages": messages, "total": 5, "page": 1, "totalPages": 1, "activeFolder": "inbox", "inboxUnread": int64(2), "draftsTotal": int64(1), "sentTotal": int64(3)}},
+		{"drafts", ginH{"currentUser": user, "messages": messages, "total": 1, "page": 1, "totalPages": 1, "activeFolder": "drafts", "inboxUnread": int64(2), "draftsTotal": int64(1), "sentTotal": int64(3)}},
+		{"sent", ginH{"currentUser": user, "messages": messages, "total": 3, "page": 1, "totalPages": 1, "activeFolder": "sent", "inboxUnread": int64(2), "draftsTotal": int64(1), "sentTotal": int64(3)}},
+		{"view", ginH{
+			"currentUser": user, "activeFolder": "inbox",
+			"message":     &db.Message{ID: 1, Folder: "INBOX", FromAddr: "=?UTF-8?B?5byg5LiJ?= <zhangsan@lmve.net>", ToAddr: "admin@lmve.net", Subject: "邮件系统部署完成通知", TextBody: "您好！您的 MailGo 邮件系统已成功部署。", HtmlBody: "", Date: now, IsRead: false},
+			"attachments": attachments, "inboxUnread": int64(2), "draftsTotal": int64(1), "sentTotal": int64(3),
+		}},
+		{"compose", ginH{
+			"currentUser": user, "activeFolder": "compose", "error": "",
+			"to": "zhangsan@lmve.net", "subject": "Re: 邮件系统部署完成通知", "bodyContent": "",
+			"usedBytes": int64(5 * 1024 * 1024), "quotaBytes": int64(5 * 1024 * 1024 * 1024),
+			"inboxUnread": int64(2), "draftsTotal": int64(1), "sentTotal": int64(3),
+		}},
+		{"settings", ginH{"currentUser": user, "activeFolder": "settings", "error": "", "success": "", "inboxUnread": int64(2), "draftsTotal": int64(1), "sentTotal": int64(3)}},
+		{"admin_dashboard", ginH{"currentUser": user, "activeFolder": "admin", "domainCount": 2, "userCount": 5, "totalMails": 100, "banCount": 1, "inboxCount": 50, "sentCount": 30, "draftsCount": 10, "trashCount": 5, "inboxSize": int64(1024), "sentSize": int64(512), "totalSize": int64(2048), "todayReceived": 3, "todaySent": 2, "weekReceived": 20, "weekSent": 15}},
+	}
+
+	outDir := os.Getenv("MAILGO_PREVIEW_DIR")
+	if outDir == "" {
+		outDir = filepath.Join(os.TempDir(), "mailgo_preview")
+	}
+	os.MkdirAll(outDir, 0755)
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			var buf strings.Builder
+			if err := tmpl.ExecuteTemplate(&buf, tc.name, tc.data); err != nil {
+				t.Fatalf("render %s: %v", tc.name, err)
+			}
+			os.WriteFile(filepath.Join(outDir, tc.name+".html"), []byte(buf.String()), 0644)
+			t.Logf("%s -> %d bytes", tc.name, buf.Len())
+		})
+	}
+}
+
+// ginH mimics gin.H so the test does not need the gin dependency surface.
+type ginH map[string]interface{}

internal/web/server.go

@@ -5,9 +5,12 @@ import (
 	"html/template"
 	"math"
 	"net"
+	"net/http"
 	"os"
 	"path/filepath"
 	"strings"
+	"time"
+	"unicode/utf8"
 
 	"mail_go/config"
 	"mail_go/internal/mailutil"
@@ -38,14 +41,15 @@ func formatBytes(b int64) string {
 
 // WebServer wraps the Gin engine and its dependencies.
 type WebServer struct {
-	engine     *gin.Engine
-	stores     *store.Stores
-	storage    *storage.AttachmentStorage
-	cfg        config.WebConfig
-	storageCfg config.StorageConfig
-	authCfg    config.AuthConfig
-	banCfg     config.BanConfig
-	outbound   *outbound.Manager
+	engine       *gin.Engine
+	stores       *store.Stores
+	storage      *storage.AttachmentStorage
+	cfg          config.WebConfig
+	storageCfg   config.StorageConfig
+	authCfg      config.AuthConfig
+	banCfg       config.BanConfig
+	caddyDataDir string
+	outbound     *outbound.Manager
 }
 
 // templateFuncs returns custom template functions for rendering.
@@ -79,22 +83,115 @@ func templateFuncs() template.FuncMap {
 		"decodeHeader": func(s string) string {
 			return mailutil.DecodeRFC2047(s)
 		},
+		// mailName 从 "Name <addr>" 中提取显示名；无显示名时退回邮箱地址。
+		"mailName": mailName,
+		// mailEmail 从 "Name <addr>" 中提取邮箱地址部分。
+		"mailEmail": mailEmail,
+		// initial 返回字符串的首字符（用于头像占位）。
+		"initial": initial,
+		// truncate 折叠空白并截断到 n 个字符（用于列表摘要）。
+		"truncate": truncate,
+		// shortDate 按 QQ 邮箱习惯格式化：今天显示 HH:mm，今年显示 MM-DD，更早显示 YYYY-MM-DD。
+		"shortDate": shortDate,
+		// avatarStyle 根据字符串哈希生成头像背景/前景色。
+		"avatarStyle": avatarStyle,
 	}
 }
 
+// mailName extracts the display name from an RFC 5322 address.
+func mailName(s string) string {
+	s = strings.TrimSpace(s)
+	if i := strings.IndexByte(s, '<'); i >= 0 {
+		name := strings.Trim(strings.TrimSpace(s[:i]), `"' `)
+		if name != "" {
+			return name
+		}
+		if j := strings.IndexByte(s, '>'); j > i {
+			return s[i+1 : j]
+		}
+	}
+	return s
+}
+
+// mailEmail extracts the bare email address from an RFC 5322 address.
+func mailEmail(s string) string {
+	if i := strings.IndexByte(s, '<'); i >= 0 {
+		if j := strings.IndexByte(s, '>'); j > i {
+			return s[i+1 : j]
+		}
+	}
+	return strings.TrimSpace(s)
+}
+
+// initial returns the first rune of a string, upper-cased.
+func initial(s string) string {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return "?"
+	}
+	r, _ := utf8.DecodeRuneInString(s)
+	return strings.ToUpper(string(r))
+}
+
+// truncate collapses whitespace and cuts the string to n runes.
+func truncate(s string, n int) string {
+	s = strings.Join(strings.Fields(s), " ")
+	r := []rune(s)
+	if len(r) <= n {
+		return s
+	}
+	return string(r[:n]) + "…"
+}
+
+// shortDate formats a time like QQ Mail does: today -> HH:mm,
+// this year -> MM-DD, otherwise -> YYYY-MM-DD.
+func shortDate(t time.Time) string {
+	now := time.Now()
+	if t.Year() == now.Year() && t.YearDay() == now.YearDay() {
+		return t.Format("15:04")
+	}
+	if t.Year() == now.Year() {
+		return t.Format("01-02")
+	}
+	return t.Format("2006-01-02")
+}
+
+// avatarStyle returns inline CSS colors derived from a string hash.
+func avatarStyle(s string) string {
+	h := 0
+	for _, r := range s {
+		h = (h*31 + int(r)) % 360
+	}
+	return fmt.Sprintf("background:hsl(%d,78%%,92%%);color:hsl(%d,72%%,36%%)", h, h)
+}
+
 // NewWebServer creates a new WebServer, initializes the Gin engine,
 // configures sessions, middleware, and registers all routes.
-func NewWebServer(cfg config.WebConfig, stores *store.Stores, attStorage *storage.AttachmentStorage, storageCfg config.StorageConfig, authCfg config.AuthConfig, banCfg config.BanConfig, ob *outbound.Manager) *WebServer {
+func NewWebServer(cfg config.WebConfig, stores *store.Stores, attStorage *storage.AttachmentStorage, storageCfg config.StorageConfig, authCfg config.AuthConfig, banCfg config.BanConfig, caddyCfg config.CaddyConfig, ob *outbound.Manager) (*WebServer, error) {
+	if err := config.ValidateSecretKey(cfg.SecretKey); err != nil {
+		return nil, err
+	}
+
 	gin.SetMode(gin.ReleaseMode)
 	engine := gin.New()
 	engine.Use(gin.Logger())
 	engine.Use(gin.Recovery())
 
-	// Session store (cookie-based)
-	cookieStore := cookie.NewStore([]byte("mail-go-secret-key-change-in-production"))
+	// 仅信任本机回环上的反向代理（Caddy/Nginx）。外部直连时
+	// X-Forwarded-For 不可信，防止伪造客户端 IP 绕过登录封禁或
+	// 恶意封禁他人 IP。gin 对 Unix socket 监听无条件信任转发头，
+	// 因此 socket 必须保持仅本机可达。
+	if err := engine.SetTrustedProxies([]string{"127.0.0.1", "::1"}); err != nil {
+		return nil, fmt.Errorf("设置可信代理失败: %w", err)
+	}
+
+	// Session store (cookie-based). The signing key comes from the config
+	// file (auto-generated random key) or the MAILGO_SECRET_KEY env var.
+	cookieStore := cookie.NewStore([]byte(cfg.SecretKey))
 	cookieStore.Options(sessions.Options{
 		HttpOnly: true,
-		SameSite: 3, // SameSiteLaxMode
+		SameSite: 3, // SameSiteStrictMode（比 Lax 更严格）
+		Secure:   cfg.CookieSecure,
 		MaxAge:   86400,
 		Path:     "/",
 	})
@@ -107,28 +204,31 @@ func NewWebServer(cfg config.WebConfig, stores *store.Stores, attStorage *storag
 	engine.SetHTMLTemplate(tmpl)
 
 	ws := &WebServer{
-		engine:     engine,
-		stores:     stores,
-		storage:    attStorage,
-		cfg:        cfg,
-		storageCfg: storageCfg,
-		authCfg:    authCfg,
-		banCfg:     banCfg,
-		outbound:   ob,
+		engine:       engine,
+		stores:       stores,
+		storage:      attStorage,
+		cfg:          cfg,
+		storageCfg:   storageCfg,
+		authCfg:      authCfg,
+		banCfg:       banCfg,
+		caddyDataDir: caddyCfg.DataDir,
+		outbound:     ob,
 	}
 
 	ws.registerRoutes()
-	return ws
+	return ws, nil
 }
 
 // registerRoutes sets up all HTTP routes with their handlers and middleware.
 func (ws *WebServer) registerRoutes() {
 	authHandler := handlers.NewAuthHandler(ws.stores, ws.authCfg, ws.banCfg)
 	mailHandler := handlers.NewMailHandler(ws.stores, ws.storage, ws.outbound)
-	adminHandler := handlers.NewAdminHandler(ws.stores, ws.storage, filepath.Join(ws.storageCfg.BaseDir, "tls", "domains"), ws.outbound)
+	adminHandler := handlers.NewAdminHandler(ws.stores, ws.storage, filepath.Join(ws.storageCfg.BaseDir, "tls", "domains"), ws.caddyDataDir, ws.outbound)
 
 	// Apply BanMiddleware globally before public routes
 	ws.engine.Use(middleware.BanMiddleware(ws.stores))
+	// Security headers on every response
+	ws.engine.Use(middleware.SecurityHeaders())
 
 	// Public routes (no auth required)
 	ws.engine.GET("/login", authHandler.ShowLogin)
@@ -175,6 +275,7 @@ func (ws *WebServer) registerRoutes() {
 		admin.GET("/domains/:id/edit", adminHandler.EditDomain)
 		admin.POST("/domains/:id", adminHandler.UpdateDomain)
 		admin.POST("/domains/:id/delete", adminHandler.DeleteDomain)
+		admin.POST("/domains/:id/fetch-caddy-cert", adminHandler.FetchCaddyCert)
 		admin.GET("/domains/:id/dns", adminHandler.DNSHint)
 		admin.GET("/users", adminHandler.ListUsers)
 		admin.GET("/users/new", adminHandler.NewUser)
@@ -194,6 +295,12 @@ func (ws *WebServer) registerRoutes() {
 	}
 }
 
+// Handler returns the underlying Gin engine as an http.Handler, useful for
+// integration tests and for embedding behind a reverse proxy.
+func (ws *WebServer) Handler() http.Handler {
+	return ws.engine
+}
+
 // Start launches the HTTP server on the configured address.
 // Supports both TCP (e.g. ":8080") and Unix socket (e.g. "/run/mail_go/web.sock").
 func (ws *WebServer) Start() error {

internal/web/session_secret_test.go

@@ -0,0 +1,196 @@
+package web
+
+// P0 回归测试：验证会话 cookie 由配置中的 secret_key 签名，
+// 且旧版硬编码密钥（源码公开，视为已泄露）无法再伪造有效会话。
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"mail_go/config"
+	"mail_go/internal/db"
+	"mail_go/internal/storage"
+	"mail_go/internal/store"
+
+	"github.com/gorilla/securecookie"
+	"golang.org/x/crypto/bcrypt"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+)
+
+func chdirRepoRoot(t *testing.T) {
+	t.Helper()
+	// NewWebServer 以相对路径加载 internal/web/templates/，
+	// 测试进程的 CWD 是 internal/web，需要切到仓库根目录。
+	if err := os.Chdir(filepath.Join("..", "..")); err != nil {
+		t.Fatalf("chdir to repo root: %v", err)
+	}
+	t.Cleanup(func() { _ = os.Chdir(filepath.Join("internal", "web")) })
+}
+
+func newTestStores(t *testing.T) *store.Stores {
+	t.Helper()
+	gdb, err := gorm.Open(sqlite.Open(filepath.Join(t.TempDir(), "test.db")), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	if err := gdb.AutoMigrate(&db.User{}, &db.Domain{}, &db.Message{}, &db.Attachment{}, &db.BanEntry{}, &db.OutboundMessage{}); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	return store.NewStores(gdb)
+}
+
+func newTestWebServer(t *testing.T, secretKey string) (*WebServer, *store.Stores) {
+	t.Helper()
+	chdirRepoRoot(t)
+
+	stores := newTestStores(t)
+
+	domain := &db.Domain{Name: "example.com", SmtpPort: 25, ImapPort: 143, Pop3Port: 110}
+	if err := stores.Domains.Create(domain); err != nil {
+		t.Fatalf("create domain: %v", err)
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte("test-password-123"), bcrypt.MinCost)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := stores.Users.Create(&db.User{
+		Username:     "alice",
+		PasswordHash: string(hash),
+		DomainID:     domain.ID,
+		IsActive:     true,
+	}); err != nil {
+		t.Fatalf("create user: %v", err)
+	}
+
+	baseDir := t.TempDir()
+	attStorage := storage.NewAttachmentStorage(filepath.Join(baseDir, "attachments"))
+	cfg := config.WebConfig{Addr: "127.0.0.1:0", SecretKey: secretKey, CookieSecure: true}
+
+	ws, err := NewWebServer(cfg, stores, attStorage, config.StorageConfig{BaseDir: baseDir},
+		config.AuthConfig{}, config.BanConfig{MaxFailAttempts: 100}, config.CaddyConfig{}, nil)
+	if err != nil {
+		t.Fatalf("NewWebServer: %v", err)
+	}
+	return ws, stores
+}
+
+func TestSessionSignedWithConfiguredSecretKey(t *testing.T) {
+	ws, _ := newTestWebServer(t, "0123456789abcdef0123456789abcdef")
+	srv := httptest.NewServer(ws.Handler())
+	defer srv.Close()
+
+	// 登录成功 -> 返回会话 cookie（禁用自动重定向以获取原始 302 响应）
+	form := url.Values{"email": {"alice@example.com"}, "password": {"test-password-123"}}
+	loginReq, _ := http.NewRequest(http.MethodPost, srv.URL+"/login", strings.NewReader(form.Encode()))
+	loginReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	client := &http.Client{CheckRedirect: func(req *http.Request, via []*http.Request) error {
+		return http.ErrUseLastResponse
+	}}
+	resp, err := client.Do(loginReq)
+	if err != nil {
+		t.Fatalf("login request: %v", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusFound {
+		t.Fatalf("login status = %d, want 302", resp.StatusCode)
+	}
+	var sessionCookie string
+	for _, c := range resp.Cookies() {
+		if c.Name == "mail_go_session" {
+			sessionCookie = c.Value
+			if !c.HttpOnly {
+				t.Error("session cookie must be HttpOnly")
+			}
+			if !c.Secure {
+				t.Error("session cookie must be Secure")
+			}
+			if c.SameSite != http.SameSiteStrictMode {
+				t.Errorf("session cookie SameSite = %v, want Strict", c.SameSite)
+			}
+		}
+	}
+	if sessionCookie == "" {
+		t.Fatal("login should set mail_go_session cookie")
+	}
+
+	// 合法会话可以访问收件箱
+	req, _ := http.NewRequest(http.MethodGet, srv.URL+"/inbox", nil)
+	req.AddCookie(&http.Cookie{Name: "mail_go_session", Value: sessionCookie})
+	resp2, err := client.Do(req)
+	if err != nil {
+		t.Fatalf("inbox request: %v", err)
+	}
+	defer resp2.Body.Close()
+	if resp2.StatusCode != http.StatusOK {
+		t.Fatalf("inbox with valid session: status = %d, want 200", resp2.StatusCode)
+	}
+}
+
+func TestLegacyHardcodedKeyCannotForgeSession(t *testing.T) {
+	// 服务端使用随机生成的新密钥
+	ws, _ := newTestWebServer(t, "9f8e7d6c5b4a39281706f5e4d3c2b1a09f8e7d6c5b4a39281706f5e4d3c2b1a0")
+	srv := httptest.NewServer(ws.Handler())
+	defer srv.Close()
+
+	// 攻击者用旧硬编码密钥（源码中公开）伪造管理员会话
+	forger := securecookie.New([]byte(config.InsecureLegacySecretKey), nil)
+	forged, err := forger.Encode("mail_go_session", map[interface{}]interface{}{
+		"userID":    uint(1),
+		"userEmail": "admin@example.com",
+		"isAdmin":   true,
+	})
+	if err != nil {
+		t.Fatalf("forge cookie: %v", err)
+	}
+
+	req, _ := http.NewRequest(http.MethodGet, srv.URL+"/inbox", nil)
+	req.AddCookie(&http.Cookie{Name: "mail_go_session", Value: forged})
+	client := &http.Client{CheckRedirect: func(req *http.Request, via []*http.Request) error {
+		return http.ErrUseLastResponse
+	}}
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatalf("request with forged cookie: %v", err)
+	}
+	defer resp.Body.Close()
+
+	// 签名校验失败 -> 未认证，必须被重定向到登录页
+	if resp.StatusCode != http.StatusFound {
+		t.Fatalf("forged legacy-key session must be rejected: status = %d, want 302 redirect to /login", resp.StatusCode)
+	}
+	if loc := resp.Header.Get("Location"); !strings.HasPrefix(loc, "/login") {
+		t.Fatalf("forged session should redirect to /login, got Location: %q", loc)
+	}
+}
+
+func TestNewWebServerRejectsBadSecretKeys(t *testing.T) {
+	chdirRepoRoot(t)
+	stores := newTestStores(t)
+	baseDir := t.TempDir()
+	attStorage := storage.NewAttachmentStorage(filepath.Join(baseDir, "attachments"))
+
+	cases := []struct {
+		name string
+		key  string
+	}{
+		{"empty", ""},
+		{"legacy default", config.InsecureLegacySecretKey},
+		{"too short", "short-key"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := NewWebServer(config.WebConfig{Addr: "127.0.0.1:0", SecretKey: tc.key},
+				stores, attStorage, config.StorageConfig{BaseDir: baseDir},
+				config.AuthConfig{}, config.BanConfig{}, config.CaddyConfig{}, nil)
+			if err == nil {
+				t.Fatalf("NewWebServer should reject secret key %q", tc.key)
+			}
+		})
+	}
+}

internal/web/templates/admin/bans.html

@@ -3,7 +3,7 @@
 <html lang="zh-CN">
 <head>
     <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
     <title>IP黑名单 - MailGo</title>
     {{template "styles" .}}
 </head>

internal/web/templates/admin/dashboard.html

@@ -3,7 +3,7 @@
 <html lang="zh-CN">
 <head>
     <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
     <title>管理后台 - MailGo</title>
     {{template "styles" .}}
 </head>

internal/web/templates/admin/dns_hint.html

@@ -3,7 +3,7 @@
 <html lang="zh-CN">
 <head>
     <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
     <title>DNS配置 - MailGo</title>
     {{template "styles" .}}
 </head>

internal/web/templates/admin/domain_form.html

@@ -3,7 +3,7 @@
 <html lang="zh-CN">
 <head>
     <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
     <title>{{if .isEdit}}编辑域名{{else}}新增域名{{end}} - MailGo</title>
     {{template "styles" .}}
 </head>
@@ -24,6 +24,7 @@
                 <div class="card">
                     <h2 style="margin-bottom:16px;">{{if .isEdit}}编辑域名{{else}}新增域名{{end}}</h2>
                     {{if .error}}<div class="alert alert-error">{{.error}}</div>{{end}}
+                    {{if .caddyMsg}}<div class="alert {{if eq .caddyMsgType "success"}}alert-success{{else}}alert-error{{end}}">{{.caddyMsg}}</div>{{end}}
                     <form method="POST" action="{{if .isEdit}}/admin/domains/{{.domain.ID}}{{else}}/admin/domains{{end}}">
                         <div class="form-group">
                             <label>域名</label>
@@ -63,12 +64,40 @@
                                 <label>TLS 公钥证书 PEM</label>
                                 <textarea name="tls_public_cert" rows="8" placeholder="-----BEGIN CERTIFICATE-----&#10;...&#10;-----END CERTIFICATE-----" style="font-family:monospace;">{{.tlsPublicCert}}</textarea>
                                 {{if .tlsCertConfigured}}
-                                <p style="color:#27ae60;font-size:12px;margin-top:4px;">✅ TLS 证书已配置；上传新证书后需重启服务生效。</p>
+                                <p style="color:#27ae60;font-size:12px;margin-top:4px;">✅ TLS 证书已配置；上传新证书后自动热加载生效。</p>
                                 {{else}}
                                 <p style="color:#e67e22;font-size:12px;margin-top:4px;">⚠️ TLS 证书未配置，启用 TLS 时必须同时填写私钥和证书。</p>
                                 {{end}}
                             </div>
                         </div>
+                        <div class="form-group" style="margin-top:4px;">
+                            <label>从 Caddy 获取证书</label>
+                            <p style="color:#7f8c8d;font-size:12px;margin-top:2px;margin-bottom:8px;">若该域名已由本机 Caddy 托管 HTTPS（自动签发证书），可一键导入其证书与私钥，并自动启用 TLS；证书热加载，无需重启服务。</p>
+                            <button type="button" class="btn" id="btn_fetch_caddy" onclick="fetchCaddyCert()" style="background:#2e86de;color:#fff;">🔒 从 Caddy 获取证书</button>
+                            <span id="caddy_fetch_msg" style="margin-left:10px;font-size:12px;color:#7f8c8d;"></span>
+                            <script>
+                            async function fetchCaddyCert() {
+                                var btn = document.getElementById('btn_fetch_caddy');
+                                var msg = document.getElementById('caddy_fetch_msg');
+                                btn.disabled = true;
+                                var oldText = btn.textContent;
+                                btn.textContent = '获取中…';
+                                msg.textContent = '';
+                                try {
+                                    var resp = await fetch('/admin/domains/{{.domain.ID}}/fetch-caddy-cert', { method: 'POST' });
+                                    if (resp.redirected) {
+                                        window.location.href = resp.url;
+                                        return;
+                                    }
+                                    msg.textContent = '获取失败: ' + await resp.text();
+                                } catch (e) {
+                                    msg.textContent = '请求失败: ' + e;
+                                }
+                                btn.disabled = false;
+                                btn.textContent = oldText;
+                            }
+                            </script>
+                        </div>
                         {{end}}
                         <script>
                         function togglePorts() {

internal/web/templates/admin/domains.html

@@ -3,7 +3,7 @@
 <html lang="zh-CN">
 <head>
     <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
     <title>域名管理 - MailGo</title>
     {{template "styles" .}}
 </head>

internal/web/templates/admin/mail_view.html

@@ -3,7 +3,7 @@
 <html lang="zh-CN">
 <head>
     <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
     <title>查看邮件 - MailGo 管理后台</title>
     {{template "styles" .}}
     <style>

internal/web/templates/admin/mails.html

@@ -3,7 +3,7 @@
 <html lang="zh-CN">
 <head>
     <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
     <title>所有邮件 - MailGo</title>
     {{template "styles" .}}
 </head>

internal/web/templates/admin/outbound.html

@@ -3,7 +3,7 @@
 <html lang="zh-CN">
 <head>
     <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
     <title>外发队列 - MailGo</title>
     {{template "styles" .}}
 </head>

internal/web/templates/admin/user_form.html

@@ -3,7 +3,7 @@
 <html lang="zh-CN">
 <head>
     <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
     <title>{{if .isEdit}}编辑用户{{else}}新增用户{{end}} - MailGo</title>
     {{template "styles" .}}
 </head>

internal/web/templates/admin/users.html

@@ -3,7 +3,7 @@
 <html lang="zh-CN">
 <head>
     <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
     <title>用户管理 - MailGo</title>
     {{template "styles" .}}
 </head>

internal/web/templates/banned.html

@@ -3,21 +3,40 @@
 <html lang="zh-CN">
 <head>
     <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
     <title>访问被禁止 - MailGo</title>
     <style>
         * { margin: 0; padding: 0; box-sizing: border-box; }
-        body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; background: #f5f5f5; color: #333; display: flex; justify-content: center; align-items: center; min-height: 100vh; }
-        .banned-card { background: #fff; border-radius: 12px; box-shadow: 0 4px 12px rgba(0,0,0,0.1); padding: 48px; text-align: center; max-width: 480px; width: 100%; }
-        .banned-icon { font-size: 64px; margin-bottom: 16px; }
-        h1 { font-size: 24px; color: #c0392b; margin-bottom: 12px; }
-        p { color: #7f8c8d; line-height: 1.6; margin-bottom: 8px; }
-        .detail { background: #f8f9fa; border-radius: 6px; padding: 16px; margin: 16px 0; text-align: left; }
-        .detail-row { display: flex; justify-content: space-between; padding: 6px 0; border-bottom: 1px solid #eee; }
+        body {
+            font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", "PingFang SC",
+                "Hiragino Sans GB", "Microsoft YaHei", sans-serif;
+            background: linear-gradient(165deg, #fdecec 0%, #f6f8fc 55%, #eaf2ff 100%);
+            color: #1f2329; display: flex; justify-content: center; align-items: center; min-height: 100vh;
+        }
+        .banned-card {
+            background: #fff; border-radius: 14px;
+            box-shadow: 0 10px 40px rgba(227, 77, 89, 0.10);
+            padding: 48px; text-align: center; max-width: 480px; width: 100%;
+        }
+        .banned-icon {
+            width: 72px; height: 72px; margin: 0 auto 18px; border-radius: 50%;
+            background: #fde8e8; display: flex; align-items: center; justify-content: center;
+            font-size: 34px;
+        }
+        h1 { font-size: 22px; color: #e34d59; margin-bottom: 12px; }
+        p { color: #646a73; line-height: 1.7; margin-bottom: 8px; font-size: 14px; }
+        .detail {
+            background: #f8f9fb; border-radius: 10px; padding: 16px 18px;
+            margin: 18px 0; text-align: left;
+        }
+        .detail-row { display: flex; justify-content: space-between; padding: 7px 0; border-bottom: 1px solid #f0f1f3; }
         .detail-row:last-child { border-bottom: none; }
-        .detail-label { color: #7f8c8d; font-size: 13px; }
-        .detail-value { color: #2c3e50; font-weight: 600; font-size: 13px; }
-        .back-link { display: inline-block; margin-top: 20px; color: #3498db; text-decoration: none; }
+        .detail-label { color: #8f959e; font-size: 13px; }
+        .detail-value { color: #1f2329; font-weight: 600; font-size: 13px; }
+        .back-link {
+            display: inline-block; margin-top: 22px; color: #1677ff;
+            text-decoration: none; font-size: 14px;
+        }
         .back-link:hover { text-decoration: underline; }
     </style>
 </head>

internal/web/templates/base.html

@@ -1,66 +1,615 @@
 {{define "styles"}}
 <style>
-    * { margin:0; padding:0; box-sizing:border-box; }
-    body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; background:#f5f5f5; color:#333; }
-    .navbar { background:#2c3e50; padding:0 20px; height:50px; display:flex; align-items:center; }
-    .navbar a { color:#ecf0f1; text-decoration:none; margin-right:20px; font-size:14px; }
-    .navbar a:hover { color:#3498db; }
-    .navbar .right { margin-left:auto; }
-    .container { max-width:1200px; margin:20px auto; padding:0 20px; }
-    .card { background:#fff; border-radius:8px; box-shadow:0 2px 4px rgba(0,0,0,0.1); padding:20px; margin-bottom:20px; }
-    table { width:100%; border-collapse:collapse; }
-    th, td { padding:10px 12px; text-align:left; border-bottom:1px solid #eee; }
-    th { background:#f8f9fa; font-weight:600; }
-    .btn { display:inline-block; padding:8px 16px; border-radius:4px; text-decoration:none; font-size:14px; cursor:pointer; border:none; }
-    .btn-primary { background:#3498db; color:#fff; }
-    .btn-primary:hover { background:#2980b9; }
-    .btn-danger { background:#e74c3c; color:#fff; }
-    .btn-danger:hover { background:#c0392b; }
-    .btn-sm { padding:4px 10px; font-size:12px; }
-    .alert { padding:12px 16px; border-radius:4px; margin-bottom:16px; }
-    .alert-error { background:#fde8e8; color:#c0392b; }
-    .alert-success { background:#e8fde8; color:#27ae60; }
-    .form-group { margin-bottom:16px; }
-    .form-group label { display:block; margin-bottom:6px; font-weight:600; }
-    .form-group input, .form-group textarea, .form-group select { width:100%; padding:8px 12px; border:1px solid #ddd; border-radius:4px; font-size:14px; }
-    .form-group input[type="checkbox"] { width:auto; }
-    .unread { font-weight:bold; }
-    .message-subject { color:#2c3e50; text-decoration:none; }
-    .message-subject:hover { color:#3498db; }
-    .sidebar { width:200px; float:left; }
-    .sidebar a { display:block; padding:10px 15px; color:#2c3e50; text-decoration:none; border-radius:4px; margin-bottom:2px; }
-    .sidebar a:hover, .sidebar a.active { background:#3498db; color:#fff; }
-    .content { margin-left:220px; }
-    .pagination { margin-top:16px; text-align:center; }
-    .pagination a, .pagination span { display:inline-block; padding:6px 12px; margin:0 2px; border:1px solid #ddd; border-radius:4px; text-decoration:none; color:#333; }
-    .pagination .current { background:#3498db; color:#fff; border-color:#3498db; }
-    .mail-meta { color:#7f8c8d; font-size:13px; margin-bottom:8px; }
-    .mail-body { line-height:1.6; margin-top:16px; padding-top:16px; border-top:1px solid #eee; }
-    .attachment-list { margin-top:16px; padding-top:16px; border-top:1px solid #eee; }
-    .attachment-item { display:inline-block; margin-right:12px; margin-bottom:8px; padding:6px 12px; background:#ecf0f1; border-radius:4px; font-size:13px; }
-    .attachment-item a { color:#2c3e50; text-decoration:none; }
-    .attachment-item a:hover { color:#3498db; }
-    .badge { display:inline-block; padding:2px 8px; border-radius:10px; font-size:11px; font-weight:bold; }
-    .badge-unread { background:#e74c3c; color:#fff; }
-    .stat-card { display:inline-block; width:200px; padding:20px; margin-right:20px; background:#fff; border-radius:8px; box-shadow:0 2px 4px rgba(0,0,0,0.1); text-align:center; }
-    .stat-card h3 { font-size:32px; color:#2c3e50; margin-bottom:4px; }
-    .stat-card p { color:#7f8c8d; font-size:14px; }
-    .dns-record { background:#f8f9fa; padding:12px 16px; border-radius:4px; margin-bottom:12px; font-family:monospace; font-size:13px; white-space:pre-wrap; }
-    .clearfix::after { content:""; display:table; clear:both; }
+    /* ===== MailGo 设计系统（参考 QQ 邮箱布局） ===== */
+    :root {
+        --primary: #1677ff;
+        --primary-hover: #0e5fd8;
+        --primary-soft: #e8f1ff;
+        --orange: #ff9500;
+        --orange-hover: #f08800;
+        --danger: #e34d59;
+        --danger-soft: #fde8e8;
+        --success: #34a853;
+        --success-soft: #e6f7ec;
+        --sidebar-bg: #f6f8fc;
+        --topbar-h: 56px;
+        --border: #e5e6eb;
+        --border-light: #f0f1f3;
+        --text: #1f2329;
+        --text-2: #646a73;
+        --text-3: #8f959e;
+        --radius: 8px;
+    }
+    * { margin: 0; padding: 0; box-sizing: border-box; }
+    body {
+        font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", "PingFang SC",
+            "Hiragino Sans GB", "Microsoft YaHei", sans-serif;
+        background: #f6f8fc; color: var(--text); font-size: 14px;
+    }
+    a { text-decoration: none; color: inherit; }
+    ul { list-style: none; }
+    input, textarea, select, button { font-family: inherit; }
+    input[type="checkbox"] { width: 15px; height: 15px; accent-color: var(--primary); cursor: pointer; flex-shrink: 0; }
+    svg { flex-shrink: 0; }
+    a, button { touch-action: manipulation; }
+
+    /* ---------- 顶部导航栏 ---------- */
+    .topbar {
+        position: fixed; top: 0; left: 0; right: 0; height: var(--topbar-h);
+        background: #fff; border-bottom: 1px solid var(--border);
+        display: flex; align-items: center; gap: 28px; padding: 0 20px; z-index: 100;
+    }
+    .logo { display: flex; align-items: center; gap: 9px; }
+    .logo-icon {
+        width: 34px; height: 34px; border-radius: 9px; color: #fff; font-size: 17px;
+        background: linear-gradient(135deg, #1677ff, #4aa3ff);
+        display: inline-flex; align-items: center; justify-content: center;
+        box-shadow: 0 2px 6px rgba(22, 119, 255, 0.35);
+    }
+    .logo-text { font-size: 19px; font-weight: 700; color: var(--primary); letter-spacing: 0.5px; }
+    .logo-text em { font-style: normal; font-weight: 400; font-size: 13px; color: var(--text-2); margin-left: 3px; }
+    .topbar-search {
+        flex: 0 1 340px; height: 34px; display: none; align-items: center; gap: 8px;
+        background: #f2f3f5; border: 1px solid transparent; border-radius: 17px;
+        padding: 0 14px; color: var(--text-3);
+    }
+    body.page-list .topbar-search { display: flex; }
+    .topbar-search:focus-within { background: #fff; border-color: var(--primary); box-shadow: 0 0 0 3px rgba(22, 119, 255, 0.12); }
+    .topbar-search input { border: none; outline: none; background: transparent; flex: 1; font-size: 13px; color: var(--text); }
+    .topbar-search input::placeholder { color: var(--text-3); }
+    .topbar-right { margin-left: auto; display: flex; align-items: center; gap: 18px; }
+    .topbar-link { color: var(--text-2); font-size: 13.5px; }
+    .topbar-link:hover { color: var(--primary); }
+    .user-chip { display: flex; align-items: center; gap: 8px; }
+    .user-email { font-size: 13px; color: var(--text-2); max-width: 220px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+    .logout-form { display: inline-flex; }
+    .icon-btn {
+        display: inline-flex; align-items: center; justify-content: center;
+        width: 30px; height: 30px; border: 1px solid var(--border); border-radius: 6px;
+        background: #fff; color: var(--text-2); cursor: pointer;
+    }
+    .icon-btn:hover { color: var(--danger); border-color: var(--danger); }
+
+    /* ---------- 头像 ---------- */
+    .avatar {
+        width: 36px; height: 36px; border-radius: 50%;
+        display: inline-flex; align-items: center; justify-content: center;
+        font-size: 15px; font-weight: 600; flex-shrink: 0; user-select: none;
+    }
+    .avatar-sm { width: 28px; height: 28px; font-size: 12.5px; }
+
+    /* ---------- 整体布局 ---------- */
+    .app-body { display: flex; min-height: 100vh; padding-top: var(--topbar-h); }
+
+    /* ---------- 左侧文件夹导航 ---------- */
+    .mail-sidebar {
+        width: 200px; flex-shrink: 0;
+        background: var(--sidebar-bg); border-right: 1px solid var(--border);
+        padding: 16px 12px; display: flex; flex-direction: column; gap: 14px;
+        position: sticky; top: var(--topbar-h); height: calc(100vh - var(--topbar-h));
+    }
+    .compose-btn {
+        display: flex; align-items: center; justify-content: center; gap: 7px;
+        height: 38px; border-radius: 19px; color: #fff; font-size: 14.5px; font-weight: 600;
+        background: linear-gradient(135deg, #ffa940, #ff9500);
+        box-shadow: 0 2px 8px rgba(255, 149, 0, 0.35);
+        transition: transform 0.1s, box-shadow 0.1s;
+    }
+    .compose-btn:hover { background: linear-gradient(135deg, #ff9d2e, #f08800); box-shadow: 0 3px 10px rgba(255, 149, 0, 0.45); transform: translateY(-1px); }
+    .folder-nav { display: flex; flex-direction: column; gap: 3px; }
+    .folder {
+        display: flex; align-items: center; gap: 10px;
+        height: 36px; padding: 0 10px; border-radius: 7px;
+        color: var(--text-2); font-size: 13.5px; position: relative;
+    }
+    .folder:hover { background: #eef1f6; color: var(--text); }
+    .folder.active { background: var(--primary-soft); color: var(--primary); font-weight: 600; }
+    .folder.active::before {
+        content: ""; position: absolute; left: -12px; top: 9px; bottom: 9px;
+        width: 3px; border-radius: 2px; background: var(--primary);
+    }
+    .folder .badge {
+        margin-left: auto; min-width: 20px; height: 20px; padding: 0 6px;
+        border-radius: 10px; background: #ff4d4f; color: #fff;
+        font-size: 11px; line-height: 20px; text-align: center; font-weight: 600;
+    }
+    .folder .count { margin-left: auto; color: var(--text-3); font-size: 12px; }
+    .sidebar-footer { margin-top: auto; border-top: 1px solid var(--border-light); padding-top: 12px; display: flex; flex-direction: column; gap: 3px; }
+
+    /* ---------- 主内容区 ---------- */
+    .mail-main { flex: 1; min-width: 0; background: #fff; display: flex; flex-direction: column; }
+
+    /* ---------- 列表工具条 ---------- */
+    .list-toolbar {
+        display: flex; align-items: center; gap: 10px;
+        padding: 10px 18px; border-bottom: 1px solid var(--border-light); background: #fff;
+    }
+    .tb-btn {
+        display: inline-flex; align-items: center; gap: 6px;
+        height: 30px; padding: 0 11px; border: 1px solid var(--border); border-radius: 6px;
+        background: #fff; color: var(--text-2); font-size: 13px; cursor: pointer;
+    }
+    .tb-btn:hover { color: var(--primary); border-color: var(--primary); }
+    .tb-btn.danger:hover { color: var(--danger); border-color: var(--danger); }
+    .check-all { display: flex; align-items: center; gap: 6px; font-size: 13px; color: var(--text-2); cursor: pointer; user-select: none; }
+    .toolbar-spacer { flex: 1; }
+    .page-info { font-size: 13px; color: var(--text-3); }
+
+    /* ---------- 邮件列表 ---------- */
+    .mail-list { flex: 1; overflow-y: auto; }
+    .mail-row {
+        display: flex; align-items: center; gap: 10px;
+        padding: 0 18px; height: 54px; border-bottom: 1px solid var(--border-light);
+        cursor: pointer; transition: background 0.08s;
+        background: #fff;
+    }
+    .mail-row:not(.unread) { background: #fbfcfe; }
+    .mail-row:hover { background: #f2f6ff; }
+    .mail-row.selected { background: var(--primary-soft); }
+    .cell-check { display: flex; align-items: center; }
+    .cell-avatar { flex: 0 0 auto; }
+    .cell-from {
+        width: 150px; flex-shrink: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+        font-size: 13.5px; color: var(--text-2);
+    }
+    .mail-row.unread .cell-from { color: var(--text); font-weight: 600; }
+    .cell-subject-wrap { display: flex; align-items: center; gap: 7px; flex: 0 1 36%; min-width: 150px; }
+    .unread-dot { width: 7px; height: 7px; border-radius: 50%; background: var(--primary); flex-shrink: 0; }
+    .cell-subject {
+        overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+        font-size: 13.5px; color: var(--text-2);
+    }
+    .mail-row.unread .cell-subject { color: var(--text); font-weight: 600; }
+    .cell-snippet {
+        flex: 1; min-width: 60px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+        font-size: 12.5px; color: var(--text-3);
+    }
+    .cell-date {
+        width: 78px; flex-shrink: 0; text-align: right;
+        font-size: 12.5px; color: var(--text-3);
+    }
+    .mail-row.unread .cell-date { color: var(--text-2); }
+    .row-del { opacity: 0; transition: opacity 0.12s; }
+    .mail-row:hover .row-del { opacity: 1; }
+    .empty-tip { padding: 90px 0; text-align: center; color: var(--text-3); font-size: 14px; }
+    .empty-tip .empty-icon { font-size: 46px; display: block; margin-bottom: 14px; opacity: 0.5; }
+
+    /* ---------- 列表底部分页 ---------- */
+    .list-footer {
+        display: flex; align-items: center; gap: 12px;
+        padding: 10px 18px; border-top: 1px solid var(--border-light);
+        font-size: 13px; color: var(--text-3); background: #fff;
+    }
+    .pager { margin-left: auto; display: flex; align-items: center; gap: 6px; }
+    .page-btn {
+        height: 28px; padding: 0 11px; border: 1px solid var(--border); border-radius: 6px;
+        background: #fff; color: var(--text-2); font-size: 13px;
+        display: inline-flex; align-items: center; gap: 4px;
+    }
+    .page-btn:hover:not(.disabled) { color: var(--primary); border-color: var(--primary); }
+    .page-btn.disabled { opacity: 0.45; cursor: not-allowed; }
+    .page-num { font-size: 13px; }
+
+    /* ---------- 邮件阅读页 ---------- */
+    .view-toolbar { display: flex; align-items: center; gap: 10px; padding: 10px 18px; border-bottom: 1px solid var(--border-light); }
+    .mail-head { padding: 22px 28px 0; }
+    .mail-title { font-size: 20px; font-weight: 600; line-height: 1.45; word-break: break-word; }
+    .mail-from-row { display: flex; align-items: center; gap: 12px; margin: 16px 0 18px; }
+    .mail-from-name { font-size: 14.5px; font-weight: 600; }
+    .mail-from-addr { color: var(--text-3); font-size: 12.5px; }
+    .mail-date { color: var(--text-3); font-size: 12.5px; margin-left: auto; }
+    .mail-body-wrap { padding: 22px 28px; flex: 1; overflow: auto; }
+    .mail-body { line-height: 1.7; font-size: 14.5px; }
+    .mail-body pre { white-space: pre-wrap; font-family: inherit; }
+    .mail-body-iframe {
+        width: 100%; min-height: 340px; border: 1px solid var(--border-light);
+        border-radius: 8px; background: #fff;
+    }
+    .attachment-list { margin-top: 22px; padding-top: 18px; border-top: 1px solid var(--border-light); }
+    .attachment-item {
+        display: inline-flex; align-items: center; gap: 7px;
+        margin: 0 12px 10px 0; padding: 7px 13px;
+        background: #f2f3f5; border-radius: 7px; font-size: 13px; color: var(--text);
+    }
+    .attachment-item a { color: var(--text); }
+    .attachment-item a:hover { color: var(--primary); }
+    .view-actions { display: flex; align-items: center; gap: 10px; padding: 18px 28px 24px; }
+
+    /* ---------- 写信页 ---------- */
+    .compose-toolbar { display: flex; align-items: center; gap: 10px; padding: 10px 18px; border-bottom: 1px solid var(--border-light); }
+    .compose-form { flex: 1; display: flex; flex-direction: column; min-height: 0; }
+    .compose-field { display: flex; align-items: center; gap: 12px; padding: 9px 22px; border-bottom: 1px solid var(--border-light); }
+    .compose-field label { width: 54px; color: var(--text-2); font-size: 13.5px; flex-shrink: 0; }
+    .compose-field input { border: none; outline: none; flex: 1; font-size: 14px; color: var(--text); background: transparent; }
+    .editor-wrap { flex: 1; display: flex; flex-direction: column; min-height: 0; }
+    .editor-wrap .ql-toolbar { border-left: none; border-right: none; border-top: none; }
+    .editor-wrap .ql-container { border: none; flex: 1; font-size: 14.5px; }
+    #editor { height: 100%; }
+    .attach-chips { display: flex; flex-wrap: wrap; gap: 8px; padding: 10px 22px; border-bottom: 1px solid var(--border-light); }
+    .attach-chip {
+        display: inline-flex; align-items: center; gap: 7px;
+        padding: 5px 11px; background: #f2f3f5; border-radius: 15px;
+        font-size: 12.5px; color: var(--text-2);
+    }
+    .attach-chip .chip-del { cursor: pointer; color: var(--text-3); border: none; background: none; font-size: 13px; line-height: 1; }
+    .attach-chip .chip-del:hover { color: var(--danger); }
+    .compose-footer {
+        display: flex; align-items: center; gap: 14px;
+        padding: 12px 22px; border-top: 1px solid var(--border-light);
+        font-size: 12.5px; color: var(--text-3); background: #fafbfc;
+    }
+    .quota-bar { width: 200px; height: 6px; background: #eceef1; border-radius: 3px; overflow: hidden; }
+    .quota-bar i { display: block; height: 100%; background: linear-gradient(90deg, #4aa3ff, var(--primary)); border-radius: 3px; }
+    .quota-bar.warn i { background: linear-gradient(90deg, #ffc53d, var(--orange)); }
+    .quota-bar.over i { background: var(--danger); }
+
+    /* ---------- 登录页 ---------- */
+    .login-page {
+        min-height: 100vh; display: flex; align-items: center; justify-content: center;
+        background: linear-gradient(165deg, #eaf2ff 0%, #f6f8fc 55%, #f0f6ff 100%);
+    }
+    .login-card {
+        width: 400px; max-width: calc(100vw - 32px);
+        background: #fff; border-radius: 14px;
+        box-shadow: 0 10px 40px rgba(22, 119, 255, 0.10);
+        padding: 42px 38px 36px;
+    }
+    .login-logo { display: flex; align-items: center; justify-content: center; gap: 10px; margin-bottom: 8px; }
+    .login-title { text-align: center; font-size: 21px; font-weight: 700; color: var(--text); margin-bottom: 26px; }
+    .login-sub { text-align: center; color: var(--text-3); font-size: 13px; margin-bottom: 26px; }
+    .divider { display: flex; align-items: center; gap: 10px; color: var(--text-3); font-size: 12.5px; margin: 18px 0; }
+    .divider::before, .divider::after { content: ""; flex: 1; height: 1px; background: var(--border-light); }
+
+    /* ---------- 通用组件（兼容管理后台） ---------- */
+    .container { max-width: 1400px; margin: 20px auto; padding: 0 20px; }
+    .card {
+        background: #fff; border: 1px solid var(--border-light); border-radius: var(--radius);
+        box-shadow: 0 1px 3px rgba(0, 0, 0, 0.04); padding: 20px; margin-bottom: 16px;
+    }
+    .btn {
+        display: inline-block; padding: 8px 16px; border-radius: 6px; border: 1px solid transparent;
+        text-decoration: none; font-size: 14px; cursor: pointer; text-align: center;
+        background: #f2f3f5; color: var(--text); line-height: 1.4;
+    }
+    .btn-primary { background: var(--primary); color: #fff; }
+    .btn-primary:hover { background: var(--primary-hover); }
+    .btn-danger { background: var(--danger); color: #fff; }
+    .btn-danger:hover { background: #d23b47; }
+    .btn-sm { padding: 4px 10px; font-size: 12px; border-radius: 5px; }
+    .alert { padding: 12px 16px; border-radius: 7px; margin-bottom: 16px; font-size: 13.5px; }
+    .alert-error { background: var(--danger-soft); color: #c0392b; }
+    .alert-success { background: var(--success-soft); color: #2e9e4f; }
+    .form-group { margin-bottom: 16px; }
+    .form-group label { display: block; margin-bottom: 7px; font-weight: 600; font-size: 13.5px; }
+    .form-group input, .form-group textarea, .form-group select {
+        width: 100%; padding: 8px 12px; border: 1px solid var(--border); border-radius: 6px;
+        font-size: 14px; outline: none; background: #fff; color: var(--text);
+    }
+    .form-group input:focus, .form-group textarea:focus, .form-group select:focus {
+        border-color: var(--primary); box-shadow: 0 0 0 3px rgba(22, 119, 255, 0.12);
+    }
+    .form-group input[type="checkbox"] { width: auto; }
+    table { width: 100%; border-collapse: collapse; }
+    th, td { padding: 10px 12px; text-align: left; border-bottom: 1px solid var(--border-light); font-size: 13.5px; }
+    th { background: #f8f9fb; font-weight: 600; color: var(--text-2); }
+    tbody tr:hover td { background: #fafbfc; }
+    .unread { font-weight: bold; }
+    .message-subject { color: var(--text); }
+    .message-subject:hover { color: var(--primary); }
+    .mail-meta { color: var(--text-2); font-size: 13px; margin-bottom: 10px; line-height: 1.9; }
+    .pagination { margin-top: 16px; text-align: center; }
+    .pagination a, .pagination span {
+        display: inline-block; padding: 6px 12px; margin: 0 2px;
+        border: 1px solid var(--border); border-radius: 6px; text-decoration: none;
+        color: var(--text-2); font-size: 13px;
+    }
+    .pagination .current { background: var(--primary); color: #fff; border-color: var(--primary); }
+    .badge { display: inline-block; padding: 2px 8px; border-radius: 10px; font-size: 11px; font-weight: bold; }
+    .badge-unread { background: #ff4d4f; color: #fff; }
+    .stat-card {
+        display: inline-block; width: 200px; padding: 20px; margin: 0 20px 16px 0;
+        background: #fff; border: 1px solid var(--border-light); border-radius: var(--radius);
+        box-shadow: 0 1px 3px rgba(0, 0, 0, 0.04); text-align: center;
+    }
+    .stat-card h3 { font-size: 30px; color: var(--primary); margin-bottom: 4px; }
+    .stat-card p { color: var(--text-2); font-size: 13.5px; }
+    .dns-record {
+        background: #f8f9fb; padding: 12px 16px; border-radius: 6px; margin-bottom: 12px;
+        font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+        font-size: 12.5px; white-space: pre-wrap;
+    }
+    .clearfix::after { content: ""; display: table; clear: both; }
+    /* 管理后台左侧导航兼容 */
+    .sidebar { width: 200px; float: left; background: #fff; border: 1px solid var(--border-light); border-radius: var(--radius); padding: 8px; }
+    .sidebar a { display: block; padding: 9px 14px; color: var(--text-2); text-decoration: none; border-radius: 6px; margin-bottom: 2px; font-size: 13.5px; }
+    .sidebar a:hover, .sidebar a.active { background: var(--primary-soft); color: var(--primary); }
+    .content { margin-left: 220px; }
+    .settings-main { padding: 24px; background: var(--sidebar-bg); }
+
+    /* ===== 移动端适配（≤767px） ===== */
+    @media (max-width: 767px) {
+        :root { --topbar-h: 50px; }
+
+        /* 顶栏：紧凑单行 + 列表页搜索框下移为第二行 */
+        .topbar { height: auto; min-height: 50px; padding: 8px 12px; gap: 8px; flex-wrap: wrap; }
+        .logo-icon { width: 30px; height: 30px; font-size: 15px; border-radius: 8px; }
+        .logo-text { font-size: 17px; }
+        .logo-text em { display: none; }
+        .topbar-search { flex: 1 1 100%; order: 9; border-radius: 8px; }
+        body.page-list { --topbar-h: 96px; }
+        .topbar-right { gap: 12px; }
+        .user-email { display: none; }
+
+        /* 左侧文件夹栏 → 底部导航条 */
+        .mail-sidebar {
+            position: fixed; top: auto; bottom: 0; left: 0; right: 0;
+            width: 100%; height: auto; min-height: 58px;
+            padding: 4px 8px calc(4px + env(safe-area-inset-bottom));
+            flex-direction: row; align-items: center; gap: 2px;
+            background: #fff; border-top: 1px solid var(--border); border-right: none;
+            z-index: 90; box-shadow: 0 -2px 8px rgba(0, 0, 0, 0.04);
+        }
+        .folder-nav { display: contents; }
+        .folder {
+            flex: 1; flex-direction: column; justify-content: center; gap: 2px;
+            height: 46px; padding: 0; border-radius: 8px; font-size: 10.5px;
+            position: relative;
+        }
+        .folder-nav .folder:nth-child(1) { order: 1; }
+        .folder-nav .folder:nth-child(2) { order: 2; }
+        .folder-nav .folder:nth-child(3) { order: 4; }
+        .folder svg { width: 19px; height: 19px; }
+        .folder.active::before { display: none; }
+        .folder .badge {
+            position: absolute; top: 1px; right: calc(50% - 20px);
+            min-width: 16px; height: 16px; padding: 0 4px;
+            font-size: 10px; line-height: 16px; border-radius: 8px;
+        }
+        .folder .count { display: none; }
+        .compose-btn {
+            width: 46px; height: 46px; padding: 0; border-radius: 50%;
+            margin: 0 4px; flex-shrink: 0; order: 3;
+            font-size: 0; box-shadow: 0 3px 10px rgba(255, 149, 0, 0.5);
+            transform: translateY(-10px);
+        }
+        .compose-btn:hover { transform: translateY(-10px); }
+        .compose-btn svg { width: 20px; height: 20px; }
+        .sidebar-footer {
+            margin: 0; border: none; padding: 0;
+            flex-direction: row; gap: 2px; order: 5;
+        }
+        .mail-main { padding-bottom: calc(58px + env(safe-area-inset-bottom)); }
+
+        /* 邮件列表 */
+        .list-toolbar { padding: 8px 10px; gap: 8px; }
+        .check-all { font-size: 12.5px; }
+        .tb-btn { height: 30px; padding: 0 9px; font-size: 12.5px; }
+        .page-info { font-size: 12px; }
+        .mail-row { padding: 0 10px; height: 60px; gap: 8px; }
+        .avatar { width: 32px; height: 32px; font-size: 13px; }
+        .cell-from { width: 88px; font-size: 13px; }
+        .cell-subject-wrap { flex: 1; min-width: 0; }
+        .cell-subject { font-size: 13px; }
+        .cell-snippet { display: none; }
+        .cell-date { width: 56px; font-size: 11.5px; }
+        .row-del { opacity: 1; }
+        .list-footer { padding: 8px 10px; }
+        .pager { margin-left: auto; gap: 4px; }
+
+        /* 阅读页 */
+        .view-toolbar { padding: 8px 10px; gap: 8px; }
+        .mail-head { padding: 16px 16px 0; }
+        .mail-title { font-size: 17px; }
+        .mail-from-row { gap: 10px; margin: 12px 0 14px; }
+        .mail-body-wrap { padding: 14px 16px; }
+        .mail-body-iframe { min-height: 260px; }
+        .view-actions { padding: 14px 16px 20px; flex-wrap: wrap; }
+
+        /* 写信页 */
+        .compose-toolbar { padding: 8px 10px; gap: 8px; }
+        .compose-field { padding: 8px 14px; gap: 8px; }
+        .compose-field label { width: 44px; font-size: 13px; }
+        .compose-footer { padding: 10px 14px; flex-wrap: wrap; }
+        .quota-bar { width: 130px; }
+
+        /* 设置页 */
+        .settings-main { padding: 14px; }
+
+        /* 管理后台 */
+        .container { padding: 0 12px; margin: 12px auto; }
+        .sidebar { float: none; width: 100%; margin-bottom: 12px; display: flex; flex-wrap: wrap; gap: 2px; padding: 6px; }
+        .sidebar a { margin: 0; padding: 8px 12px; font-size: 13px; }
+        .content { margin-left: 0; overflow-x: auto; }
+        th, td { white-space: nowrap; }
+        .stat-card { width: calc(50% - 10px); margin: 0 0 10px; }
+    }
 </style>
 {{end}}
 
 {{define "navbar"}}
 {{if .currentUser}}
-<nav class="navbar">
-    <a href="/inbox">MailGo</a>
-    {{if .currentUser.IsAdmin}}<a href="/admin">管理后台</a>{{end}}
-    <div class="right">
-        <span style="color:#ecf0f1;font-size:13px;">{{.currentUser.Username}}@{{.currentUser.Domain.Name}}</span>
-        <form method="POST" action="/logout" style="display:inline;">
-            <a href="#" onclick="this.parentElement.submit(); return false;">退出</a>
+<header class="topbar">
+    <div class="topbar-left">
+        <a class="logo" href="/inbox">
+            <span class="logo-icon">✉</span>
+            <span class="logo-text">MailGo<em>邮箱</em></span>
+        </a>
+    </div>
+    <div class="topbar-search">
+        <svg width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"/><line x1="21" y1="21" x2="16.65" y2="16.65"/></svg>
+        <input id="mail-search" type="text" placeholder="搜索邮件（发件人 / 主题）" autocomplete="off">
+    </div>
+    <div class="topbar-right">
+        {{if .currentUser.IsAdmin}}<a class="topbar-link" href="/admin">管理后台</a>{{end}}
+        <a class="topbar-link" href="/settings">设置</a>
+        <span class="user-chip">
+            <span class="avatar avatar-sm" style="{{avatarStyle .currentUser.Username}}">{{initial .currentUser.Username}}</span>
+            <span class="user-email" title="{{.currentUser.Username}}@{{.currentUser.Domain.Name}}">{{.currentUser.Username}}@{{.currentUser.Domain.Name}}</span>
+        </span>
+        <form method="POST" action="/logout" class="logout-form">
+            <button type="submit" class="icon-btn" title="退出登录">
+                <svg width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4"/><polyline points="16 17 21 12 16 7"/><line x1="21" y1="12" x2="9" y2="12"/></svg>
+            </button>
         </form>
     </div>
-</nav>
+</header>
 {{end}}
 {{end}}
+
+{{define "sidebar"}}
+<aside class="mail-sidebar">
+    <a href="/compose" class="compose-btn">
+        <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M11 4H4a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2v-7"/><path d="M18.5 2.5a2.121 2.121 0 0 1 3 3L12 15l-4 1 1-4 9.5-9.5z"/></svg>
+        写信
+    </a>
+    <nav class="folder-nav">
+        <a class="folder {{if eq .activeFolder `inbox`}}active{{end}}" href="/inbox">
+            <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="22 12 16 12 14 15 10 15 8 12 2 12"/><path d="M5.45 5.11L2 12v6a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2v-6l-3.45-6.89A2 2 0 0 0 16.76 4H7.24a2 2 0 0 0-1.79 1.11z"/></svg>
+            收件箱
+            {{if .inboxUnread}}<span class="badge">{{.inboxUnread}}</span>{{end}}
+        </a>
+        <a class="folder {{if eq .activeFolder `drafts`}}active{{end}}" href="/drafts">
+            <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"/><polyline points="14 2 14 8 20 8"/><line x1="16" y1="13" x2="8" y2="13"/><line x1="16" y1="17" x2="8" y2="17"/></svg>
+            草稿箱
+            {{if .draftsTotal}}<span class="count">{{.draftsTotal}}</span>{{end}}
+        </a>
+        <a class="folder {{if eq .activeFolder `sent`}}active{{end}}" href="/sent">
+            <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="22" y1="2" x2="11" y2="13"/><polygon points="22 2 15 22 11 13 2 9 22 2"/></svg>
+            已发送
+            {{if .sentTotal}}<span class="count">{{.sentTotal}}</span>{{end}}
+        </a>
+    </nav>
+    <div class="sidebar-footer">
+        {{if .currentUser.IsAdmin}}
+        <a class="folder" href="/admin">
+            <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+            管理后台
+        </a>
+        {{end}}
+    </div>
+</aside>
+{{end}}
+
+{{define "listjs"}}
+<script>
+(function () {
+    var searchInput = document.getElementById('mail-search');
+    var rows = Array.prototype.slice.call(document.querySelectorAll('.mail-row'));
+    var selectAll = document.getElementById('select-all');
+    var btnDelete = document.getElementById('btn-delete');
+
+    // 行点击跳转（复选框 / 行内删除按钮除外）
+    rows.forEach(function (row) {
+        row.addEventListener('click', function (e) {
+            if (e.target.closest('.cell-check') || e.target.closest('.row-del')) return;
+            var link = row.querySelector('.cell-subject');
+            if (link) window.location.href = link.getAttribute('href');
+        });
+    });
+
+    // 全选
+    selectAll && selectAll.addEventListener('change', function () {
+        rows.forEach(function (row) {
+            var cb = row.querySelector('.row-check');
+            cb.checked = selectAll.checked;
+            row.classList.toggle('selected', cb.checked);
+        });
+        updateDeleteState();
+    });
+    rows.forEach(function (row) {
+        var cb = row.querySelector('.row-check');
+        cb.addEventListener('change', function () {
+            row.classList.toggle('selected', cb.checked);
+            if (!cb.checked && selectAll) selectAll.checked = false;
+            updateDeleteState();
+        });
+    });
+
+    function updateDeleteState() {
+        if (!btnDelete) return;
+        var n = rows.filter(function (r) { return r.isConnected && r.querySelector('.row-check').checked; }).length;
+        btnDelete.disabled = n === 0;
+    }
+
+    // 批量删除
+    btnDelete && btnDelete.addEventListener('click', function () {
+        var ids = rows.filter(function (r) { return r.isConnected && r.querySelector('.row-check').checked; })
+                      .map(function (r) { return r.dataset.id; });
+        if (!ids.length) return;
+        if (!confirm('确定要删除选中的 ' + ids.length + ' 封邮件吗？')) return;
+        var done = 0;
+        ids.forEach(function (id) {
+            fetch('/mail/delete/' + id, { method: 'POST', body: new FormData() })
+                .then(function () { if (++done === ids.length) window.location.reload(); })
+                .catch(function () { if (++done === ids.length) window.location.reload(); });
+        });
+    });
+
+    // 刷新
+    var btnRefresh = document.getElementById('btn-refresh');
+    btnRefresh && btnRefresh.addEventListener('click', function () { window.location.reload(); });
+
+    // 搜索过滤（发件人 / 主题 / 摘要）
+    searchInput && searchInput.addEventListener('input', function () {
+        var q = searchInput.value.trim().toLowerCase();
+        rows.forEach(function (row) {
+            if (!row.isConnected) return;
+            var text = row.textContent.toLowerCase();
+            row.style.display = (!q || text.indexOf(q) !== -1) ? '' : 'none';
+        });
+    });
+
+    // 从 BFCache（往返缓存）恢复时静默同步最新列表状态：
+    // 阅读页已把邮件标记为已读/删除，恢复的旧 DOM 需要与服务端对齐，
+    // 避免“返回后仍是未读/已删邮件仍显示”。
+    // 真实浏览器在 BFCache 恢复时会触发 pageshow(persisted=true)；
+    // visibilitychange 作为兜底（页面重新可见时也同步一次）。
+    var syncing = false;
+    function syncFromServer(forceReloadOnError) {
+        if (syncing) return;
+        syncing = true;
+        fetch(window.location.href, { headers: { 'Accept': 'text/html' }, credentials: 'same-origin' })
+            .then(function (r) { return r.text(); })
+            .then(function (html) {
+                var doc = new DOMParser().parseFromString(html, 'text/html');
+                var fresh = {};
+                doc.querySelectorAll('.mail-row').forEach(function (r) { fresh[r.dataset.id] = r.classList.contains('unread'); });
+                rows.forEach(function (row) {
+                    var id = row.dataset.id;
+                    if (!(id in fresh)) { row.remove(); return; } // 已被删除
+                    row.classList.toggle('unread', fresh[id]);
+                    var wrap = row.querySelector('.cell-subject-wrap');
+                    var dot = row.querySelector('.unread-dot');
+                    if (fresh[id] && !dot && wrap) {
+                        var s = document.createElement('span');
+                        s.className = 'unread-dot';
+                        wrap.insertBefore(s, wrap.firstChild);
+                    } else if (!fresh[id] && dot) {
+                        dot.remove();
+                    }
+                });
+                // 同步“共 N 封”与侧栏未读角标
+                var total = doc.querySelector('.page-info');
+                var curTotal = document.querySelector('.page-info');
+                if (total && curTotal) curTotal.textContent = total.textContent;
+                var badge = doc.querySelector('.folder.active .badge');
+                var curBadge = document.querySelector('.folder.active .badge');
+                if (badge && curBadge) curBadge.textContent = badge.textContent;
+                else if (!badge && curBadge) curBadge.remove();
+            })
+            .catch(function () {
+                // BFCache 恢复时 DOM 是旧的，同步失败只能整页刷新兜底；
+                // 标签页切回触发的同步失败则静默忽略（可能只是离线）。
+                if (forceReloadOnError) window.location.reload();
+            })
+            .then(function () { syncing = false; });
+    }
+    window.addEventListener('pageshow', function (e) {
+        if (e.persisted) syncFromServer(true);
+    });
+    document.addEventListener('visibilitychange', function () {
+        if (document.visibilityState === 'visible') syncFromServer(false);
+    });
+})();
+</script>
+{{end}}

internal/web/templates/compose.html

@@ -3,64 +3,68 @@
 <html lang="zh-CN">
 <head>
     <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>撰写邮件 - MailGo</title>
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
+    <title>写信 - MailGo</title>
     <link href="https://cdn.quilljs.com/1.3.7/quill.snow.css" rel="stylesheet">
     {{template "styles" .}}
 </head>
-<body>
+<body class="page-compose">
     {{template "navbar" .}}
-    <div class="container">
-        <div class="clearfix">
-            <div class="sidebar">
-                <a href="/inbox" class="{{if eq .activeFolder `inbox`}}active{{end}}">收件箱</a>
-                <a href="/drafts" class="{{if eq .activeFolder `drafts`}}active{{end}}">草稿箱</a>
-                <a href="/sent" class="{{if eq .activeFolder `sent`}}active{{end}}">发件箱</a>
-                <a href="/compose" class="{{if eq .activeFolder `compose`}}active{{end}}">撰写邮件</a>
-                <a href="/settings" class="{{if eq .activeFolder `settings`}}active{{end}}">设置</a>
+    <div class="app-body">
+        {{template "sidebar" .}}
+        <main class="mail-main">
+            <div class="compose-toolbar">
+                <button type="submit" form="compose-form" class="btn btn-primary">
+                    <svg width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="vertical-align:-2px;margin-right:4px;"><line x1="22" y1="2" x2="11" y2="13"/><polygon points="22 2 15 22 11 13 2 9 22 2"/></svg>
+                    发送
+                </button>
+                <label class="tb-btn" style="cursor:pointer;">
+                    <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21.44 11.05l-9.19 9.19a6 6 0 0 1-8.49-8.49l9.19-9.19a4 4 0 0 1 5.66 5.66l-9.2 9.19a2 2 0 0 1-2.83-2.83l8.49-8.48"/></svg>
+                    附件
+                    <input type="file" name="attachments" id="attach-input" multiple style="display:none;">
+                </label>
+                <a href="/inbox" class="tb-btn">取消</a>
+                <div class="toolbar-spacer"></div>
+                <span class="page-info">撰写新邮件</span>
             </div>
-            <div class="content">
-                <div class="card">
-                    <h2 style="margin-bottom:16px;">撰写邮件</h2>
-                    {{if .error}}<div class="alert alert-error">{{.error}}</div>{{end}}
-                    <form method="POST" action="/compose" enctype="multipart/form-data">
-                        <div class="form-group">
-                            <label>收件人</label>
-                            <input type="email" name="to" required value="{{.to}}" placeholder="user@example.com">
-                        </div>
-                        <div class="form-group">
-                            <label>抄送（可选）</label>
-                            <input type="text" name="cc" value="{{.cc}}" placeholder="cc@example.com">
-                        </div>
-                        <div class="form-group">
-                            <label>主题</label>
-                            <input type="text" name="subject" value="{{.subject}}" placeholder="邮件主题">
-                        </div>
-                        <div class="form-group">
-                            <label>正文</label>
-                            <div id="editor" style="height:300px;"></div>
-                            <input type="hidden" name="body" id="body-hidden">
-                            <input type="hidden" name="html_body" id="html-body-hidden">
-                        </div>
-                        <div class="form-group">
-                            <label>附件</label>
-                            <input type="file" name="attachments" multiple>
-                        </div>
-                        <div class="form-group" style="color:#7f8c8d;font-size:12px;">
-                            配额: {{formatBytes .usedBytes}} / {{formatBytes .quotaBytes}}
-                        </div>
-                        <button type="submit" class="btn btn-primary">发送邮件</button>
-                        <a href="/inbox" class="btn" style="margin-left:8px;">取消</a>
-                    </form>
+
+            {{if .error}}<div class="alert alert-error" style="margin:12px 18px 0;">{{.error}}</div>{{end}}
+
+            <form id="compose-form" class="compose-form" method="POST" action="/compose" enctype="multipart/form-data">
+                <div class="compose-field">
+                    <label>收件人</label>
+                    <input type="email" name="to" required value="{{.to}}" placeholder="输入收件人邮箱地址">
                 </div>
-            </div>
-        </div>
+                <div class="compose-field">
+                    <label>抄送</label>
+                    <input type="text" name="cc" value="{{.cc}}" placeholder="多个地址用逗号分隔（可选）">
+                </div>
+                <div class="compose-field">
+                    <label>主题</label>
+                    <input type="text" name="subject" value="{{.subject}}" placeholder="输入邮件主题">
+                </div>
+
+                <div id="attach-chips" class="attach-chips" style="{{if not .attachments}}display:none;{{end}}"></div>
+
+                <div class="editor-wrap">
+                    <div id="editor" data-placeholder="请输入邮件内容..."></div>
+                    <input type="hidden" name="body" id="body-hidden">
+                    <input type="hidden" name="html_body" id="html-body-hidden">
+                </div>
+
+                <div class="compose-footer">
+                    <span>附件配额</span>
+                    <span class="quota-bar" id="quota-bar" data-used="{{.usedBytes}}" data-quota="{{.quotaBytes}}"><i></i></span>
+                    <span id="quota-text">{{formatBytes .usedBytes}} / {{formatBytes .quotaBytes}}</span>
+                </div>
+            </form>
+        </main>
     </div>
     <script src="https://cdn.quilljs.com/1.3.7/quill.min.js"></script>
     <script>
     var quill = new Quill('#editor', {
         theme: 'snow',
-        placeholder: '请输入邮件内容...',
+        placeholder: document.getElementById('editor').dataset.placeholder || '请输入邮件内容...',
         modules: {
             toolbar: [
                 [{ 'header': [1, 2, 3, false] }],
@@ -72,13 +76,54 @@
             ]
         }
     });
-    document.querySelector('form').addEventListener('submit', function() {
-        document.getElementById('body-hidden').value = quill.getText();
-        document.getElementById('html-body-hidden').value = quill.root.innerHTML;
-    });
     {{if .bodyContent}}
     quill.root.innerHTML = {{.bodyContent | safeJS}};
     {{end}}
+
+    document.getElementById('compose-form').addEventListener('submit', function () {
+        document.getElementById('body-hidden').value = quill.getText();
+        document.getElementById('html-body-hidden').value = quill.root.innerHTML;
+    });
+
+    // 附件选择预览
+    var attachInput = document.getElementById('attach-input');
+    var chipsBox = document.getElementById('attach-chips');
+    var files = [];
+    function renderChips() {
+        chipsBox.innerHTML = '';
+        chipsBox.style.display = files.length ? 'flex' : 'none';
+        files.forEach(function (f, i) {
+            var chip = document.createElement('span');
+            chip.className = 'attach-chip';
+            chip.innerHTML = '📎 ' + f.name + ' (' + (f.size / 1024).toFixed(1) + ' KB)' +
+                '<button type="button" class="chip-del" data-i="' + i + '" title="移除">✕</button>';
+            chipsBox.appendChild(chip);
+        });
+    }
+    attachInput.addEventListener('change', function () {
+        files = Array.prototype.slice.call(attachInput.files);
+        renderChips();
+    });
+    chipsBox.addEventListener('click', function (e) {
+        var del = e.target.closest('.chip-del');
+        if (!del) return;
+        files.splice(parseInt(del.dataset.i, 10), 1);
+        var dt = new DataTransfer();
+        files.forEach(function (f) { dt.items.add(f); });
+        attachInput.files = dt.files;
+        renderChips();
+    });
+
+    // 配额进度条
+    var bar = document.getElementById('quota-bar');
+    if (bar) {
+        var used = parseInt(bar.dataset.used, 10) || 0;
+        var quota = parseInt(bar.dataset.quota, 10) || 1;
+        var pct = Math.min(100, Math.round(used / quota * 100));
+        bar.querySelector('i').style.width = pct + '%';
+        if (pct >= 90) bar.classList.add('warn');
+        if (pct >= 100) bar.classList.add('over');
+    }
     </script>
 </body>
 </html>

internal/web/templates/drafts.html

@@ -3,72 +3,91 @@
 <html lang="zh-CN">
 <head>
     <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
     <title>草稿箱 - MailGo</title>
     {{template "styles" .}}
 </head>
-<body>
+<body class="page-list">
     {{template "navbar" .}}
-    <div class="container">
-        <div class="clearfix">
-            <div class="sidebar">
-                <a href="/inbox" class="{{if eq .activeFolder `inbox`}}active{{end}}">收件箱</a>
-                <a href="/drafts" class="{{if eq .activeFolder `drafts`}}active{{end}}">草稿箱</a>
-                <a href="/sent" class="{{if eq .activeFolder `sent`}}active{{end}}">发件箱</a>
-                <a href="/compose" class="{{if eq .activeFolder `compose`}}active{{end}}">撰写邮件</a>
-                <a href="/settings" class="{{if eq .activeFolder `settings`}}active{{end}}">设置</a>
+    <div class="app-body">
+        {{template "sidebar" .}}
+        <main class="mail-main">
+            <div class="list-toolbar">
+                <label class="check-all" title="全选/取消全选">
+                    <input type="checkbox" id="select-all">
+                    全选
+                </label>
+                <button type="button" class="tb-btn" id="btn-refresh" title="刷新">
+                    <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="23 4 23 10 17 10"/><path d="M20.49 15a9 9 0 1 1-2.12-9.36L23 10"/></svg>
+                    刷新
+                </button>
+                <button type="button" class="tb-btn danger" id="btn-delete" disabled>
+                    <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="3 6 5 6 21 6"/><path d="M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6m3 0V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2"/></svg>
+                    删除
+                </button>
+                <div class="toolbar-spacer"></div>
+                <span class="page-info">共 {{.total}} 封</span>
             </div>
-            <div class="content">
-                <div class="card">
-                    <h2 style="margin-bottom:16px;">草稿箱</h2>
-                    {{if not .messages}}
-                    <p style="color:#7f8c8d;text-align:center;padding:40px 0;">暂无草稿邮件</p>
-                    {{else}}
-                    <table>
-                        <thead>
-                            <tr>
-                                <th style="width:25%;">发件人/收件人</th>
-                                <th style="width:45%;">主题</th>
-                                <th style="width:20%;">时间</th>
-                                <th style="width:10%;">操作</th>
-                            </tr>
-                        </thead>
-                        <tbody>
-                        {{range .messages}}
-                            <tr>
-                                <td>{{.ToAddr}}</td>
-                                <td>
-                                    <a href="/drafts/{{.ID}}" class="message-subject">
-                                        {{if .Subject}}{{.Subject}}{{else}}(无主题){{end}}
-                                    </a>
-                                </td>
-                                <td>{{.Date.Format "2006-01-02 15:04"}}</td>
-                                <td>
-                                    <form method="POST" action="/mail/delete/{{.ID}}" style="display:inline;"
-                                          onsubmit="return confirm('确定要删除这封邮件吗？');">
-                                        <button type="submit" class="btn btn-danger btn-sm">删除</button>
-                                    </form>
-                                </td>
-                            </tr>
-                        {{end}}
-                        </tbody>
-                    </table>
-                    {{end}}
-                </div>
-                {{if .totalPages}}
-                <div class="pagination">
-                    {{if gt .page 1}}
-                    <a href="/drafts?page={{sub .page 1}}">上一页</a>
-                    {{end}}
-                    <span>第 {{.page}} / {{.totalPages}} 页</span>
-                    {{if lt .page .totalPages}}
-                    <a href="/drafts?page={{add .page 1}}">下一页</a>
-                    {{end}}
-                </div>
+
+            {{if not .messages}}
+            <div class="mail-list">
+                <div class="empty-tip"><span class="empty-icon">📝</span>草稿箱暂无邮件</div>
+            </div>
+            {{else}}
+            <ul class="mail-list">
+                {{range .messages}}
+                <li class="mail-row" data-id="{{.ID}}">
+                    <label class="cell-check" onclick="event.stopPropagation()">
+                        <input type="checkbox" class="row-check" data-id="{{.ID}}">
+                    </label>
+                    <span class="cell-avatar">
+                        <span class="avatar" style="{{avatarStyle .ToAddr}}">{{initial (mailName .ToAddr)}}</span>
+                    </span>
+                    <span class="cell-from" title="收件人：{{.ToAddr}}">致：{{mailName .ToAddr}}</span>
+                    <span class="cell-subject-wrap">
+                        <a class="cell-subject" href="/drafts/{{.ID}}">
+                            {{if .Subject}}{{.Subject}}{{else}}(无主题){{end}}
+                        </a>
+                    </span>
+                    <span class="cell-snippet">
+                        {{if .TextBody}}{{truncate .TextBody 80}}{{else if .HtmlBody}}[HTML 邮件]{{end}}
+                    </span>
+                    <span class="cell-date">{{shortDate .Date}}</span>
+                    <form method="POST" action="/mail/delete/{{.ID}}" class="row-del"
+                          onsubmit="return confirm('确定要删除这封草稿吗？');">
+                        <button type="submit" class="icon-btn" title="删除">
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="3 6 5 6 21 6"/><path d="M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6m3 0V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2"/></svg>
+                        </button>
+                    </form>
+                </li>
                 {{end}}
+            </ul>
+            {{end}}
+
+            <div class="list-footer">
+                <span class="page-num">第 {{.page}} / {{if .totalPages}}{{.totalPages}}{{else}}1{{end}} 页</span>
+                <div class="pager">
+                    {{if gt .page 1}}
+                    <a class="page-btn" href="/drafts?page={{sub .page 1}}">
+                        <svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+                        上一页
+                    </a>
+                    {{else}}
+                    <span class="page-btn disabled">上一页</span>
+                    {{end}}
+                    {{if lt .page .totalPages}}
+                    <a class="page-btn" href="/drafts?page={{add .page 1}}">
+                        下一页
+                        <svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                    </a>
+                    {{else}}
+                    <span class="page-btn disabled">下一页</span>
+                    {{end}}
+                </div>
             </div>
-        </div>
+        </main>
     </div>
+    {{template "listjs" .}}
 </body>
 </html>
 {{end}}

internal/web/templates/inbox.html

@@ -3,73 +3,86 @@
 <html lang="zh-CN">
 <head>
     <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
     <title>收件箱 - MailGo</title>
     {{template "styles" .}}
 </head>
-<body>
+<body class="page-list">
     {{template "navbar" .}}
-    <div class="container">
-        <div class="clearfix">
-            <div class="sidebar">
-                <a href="/inbox" class="{{if eq .activeFolder `inbox`}}active{{end}}">收件箱</a>
-                <a href="/drafts" class="{{if eq .activeFolder `drafts`}}active{{end}}">草稿箱</a>
-                <a href="/sent" class="{{if eq .activeFolder `sent`}}active{{end}}">发件箱</a>
-                <a href="/compose" class="{{if eq .activeFolder `compose`}}active{{end}}">撰写邮件</a>
-                <a href="/settings" class="{{if eq .activeFolder `settings`}}active{{end}}">设置</a>
+    <div class="app-body">
+        {{template "sidebar" .}}
+        <main class="mail-main">
+            <div class="list-toolbar">
+                <label class="check-all" title="全选/取消全选">
+                    <input type="checkbox" id="select-all">
+                    全选
+                </label>
+                <button type="button" class="tb-btn" id="btn-refresh" title="刷新">
+                    <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="23 4 23 10 17 10"/><path d="M20.49 15a9 9 0 1 1-2.12-9.36L23 10"/></svg>
+                    刷新
+                </button>
+                <button type="button" class="tb-btn danger" id="btn-delete" disabled>
+                    <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="3 6 5 6 21 6"/><path d="M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6m3 0V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2"/></svg>
+                    删除
+                </button>
+                <div class="toolbar-spacer"></div>
+                <span class="page-info">共 {{.total}} 封</span>
             </div>
-            <div class="content">
-                <div class="card">
-                    <h2 style="margin-bottom:16px;">收件箱</h2>
-                    {{if not .messages}}
-                    <p style="color:#7f8c8d;text-align:center;padding:40px 0;">暂无邮件</p>
-                    {{else}}
-                    <table>
-                        <thead>
-                            <tr>
-                                <th style="width:25%;">发件人</th>
-                                <th style="width:45%;">主题</th>
-                                <th style="width:20%;">时间</th>
-                                <th style="width:10%;">操作</th>
-                            </tr>
-                        </thead>
-                        <tbody>
-                        {{range .messages}}
-                            <tr class="{{if not .IsRead}}unread{{end}}">
-                                <td>{{decodeHeader .FromAddr}}</td>
-                                <td>
-                                    <a href="/inbox/{{.ID}}" class="message-subject">
-                                        {{if .Subject}}{{.Subject}}{{else}}(无主题){{end}}
-                                    </a>
-                                </td>
-                                <td>{{.Date.Format "2006-01-02 15:04"}}</td>
-                                <td>
-                                    {{if not .IsRead}}
-                                    <form method="POST" action="/mail/read/{{.ID}}" style="display:inline;">
-                                        <button type="submit" class="btn btn-primary btn-sm">已读</button>
-                                    </form>
-                                    {{end}}
-                                </td>
-                            </tr>
-                        {{end}}
-                        </tbody>
-                    </table>
-                    {{end}}
-                </div>
-                {{if .totalPages}}
-                <div class="pagination">
-                    {{if gt .page 1}}
-                    <a href="/inbox?page={{sub .page 1}}">上一页</a>
-                    {{end}}
-                    <span>第 {{.page}} / {{.totalPages}} 页</span>
-                    {{if lt .page .totalPages}}
-                    <a href="/inbox?page={{add .page 1}}">下一页</a>
-                    {{end}}
-                </div>
+
+            {{if not .messages}}
+            <div class="mail-list">
+                <div class="empty-tip"><span class="empty-icon">📭</span>收件箱暂无邮件</div>
+            </div>
+            {{else}}
+            <ul class="mail-list">
+                {{range .messages}}
+                <li class="mail-row {{if not .IsRead}}unread{{end}}" data-id="{{.ID}}">
+                    <label class="cell-check" onclick="event.stopPropagation()">
+                        <input type="checkbox" class="row-check" data-id="{{.ID}}">
+                    </label>
+                    <span class="cell-avatar">
+                        <span class="avatar" style="{{avatarStyle .FromAddr}}">{{initial (mailName (decodeHeader .FromAddr))}}</span>
+                    </span>
+                    <span class="cell-from" title="{{decodeHeader .FromAddr}}">{{mailName (decodeHeader .FromAddr)}}</span>
+                    <span class="cell-subject-wrap">
+                        {{if not .IsRead}}<span class="unread-dot"></span>{{end}}
+                        <a class="cell-subject" href="/inbox/{{.ID}}">
+                            {{if .Subject}}{{.Subject}}{{else}}(无主题){{end}}
+                        </a>
+                    </span>
+                    <span class="cell-snippet">
+                        {{if .TextBody}}{{truncate .TextBody 80}}{{else if .HtmlBody}}[HTML 邮件]{{end}}
+                    </span>
+                    <span class="cell-date">{{shortDate .Date}}</span>
+                </li>
                 {{end}}
+            </ul>
+            {{end}}
+
+            <div class="list-footer">
+                <span class="page-num">第 {{.page}} / {{if .totalPages}}{{.totalPages}}{{else}}1{{end}} 页</span>
+                <div class="pager">
+                    {{if gt .page 1}}
+                    <a class="page-btn" href="/inbox?page={{sub .page 1}}">
+                        <svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+                        上一页
+                    </a>
+                    {{else}}
+                    <span class="page-btn disabled">上一页</span>
+                    {{end}}
+                    {{if lt .page .totalPages}}
+                    <a class="page-btn" href="/inbox?page={{add .page 1}}">
+                        下一页
+                        <svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                    </a>
+                    {{else}}
+                    <span class="page-btn disabled">下一页</span>
+                    {{end}}
+                </div>
             </div>
-        </div>
+        </main>
     </div>
+    {{template "listjs" .}}
 </body>
 </html>
 {{end}}

internal/web/templates/login.html

@@ -3,54 +3,55 @@
 <html lang="zh-CN">
 <head>
     <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>登录 - MailGo</title>
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
+    <title>登录 - MailGo 邮箱</title>
     {{template "styles" .}}
 </head>
-<body>
-    {{template "navbar" .}}
-    <div class="container">
-        <div style="max-width:400px;margin:80px auto;">
-            <div class="card">
-                <h2 style="text-align:center;margin-bottom:24px;">MailGo 登录</h2>
-                {{if .error}}<div class="alert alert-error">{{.error}}</div>{{end}}
-                <form method="POST" action="/login">
-                    <div class="form-group">
-                        <label>邮箱地址</label>
-                        <input type="email" name="email" required autofocus placeholder="admin@example.com">
-                    </div>
-                    <div class="form-group">
-                        <label>密码</label>
-                        <input type="password" name="password" required placeholder="请输入密码">
-                    </div>
-                    <button type="submit" class="btn btn-primary" style="width:100%;">登录</button>
-                </form>
-
-                {{if or .oauth2Enabled .ldapEnabled}}
-                <div style="text-align:center;margin:16px 0;color:#7f8c8d;">─── 或 ───</div>
-                {{end}}
-
-                {{if .ldapEnabled}}
-                <form method="POST" action="/login/ldap">
-                    <div class="form-group">
-                        <label>LDAP 用户名</label>
-                        <input type="text" name="username" placeholder="LDAP 用户名">
-                    </div>
-                    <div class="form-group">
-                        <label>LDAP 密码</label>
-                        <input type="password" name="password" placeholder="LDAP 密码">
-                    </div>
-                    <button type="submit" class="btn" style="width:100%;background:#8e44ad;color:#fff;">LDAP 登录</button>
-                </form>
-                {{end}}
-
-                {{if .oauth2Enabled}}
-                <a href="/auth/oauth2" class="btn" style="width:100%;background:#3498db;color:#fff;text-align:center;display:block;margin-top:8px;">
-                    {{if eq .oauth2Provider "google"}}Google{{else if eq .oauth2Provider "github"}}GitHub{{else}}OAuth2{{end}} 登录
-                </a>
-                {{end}}
-            </div>
+<body class="login-page">
+    <div class="login-card">
+        <div class="login-logo">
+            <span class="logo-icon" style="width:44px;height:44px;font-size:22px;border-radius:12px;">✉</span>
+            <span style="font-size:26px;font-weight:700;color:var(--primary);">MailGo<em style="font-style:normal;font-weight:400;font-size:15px;color:var(--text-2);margin-left:4px;">邮箱</em></span>
         </div>
+        <div class="login-sub">登录您的邮箱账户</div>
+
+        {{if .error}}<div class="alert alert-error">{{.error}}</div>{{end}}
+
+        <form method="POST" action="/login">
+            <div class="form-group">
+                <label>邮箱地址</label>
+                <input type="email" name="email" required autofocus placeholder="user@example.com" style="padding:11px 14px;border-radius:8px;">
+            </div>
+            <div class="form-group">
+                <label>密码</label>
+                <input type="password" name="password" required placeholder="请输入密码" style="padding:11px 14px;border-radius:8px;">
+            </div>
+            <button type="submit" class="btn btn-primary" style="width:100%;padding:11px 16px;font-size:15px;border-radius:8px;">登 录</button>
+        </form>
+
+        {{if or .oauth2Enabled .ldapEnabled}}
+        <div class="divider">或</div>
+        {{end}}
+
+        {{if .ldapEnabled}}
+        <form method="POST" action="/login/ldap" style="margin-bottom:10px;">
+            <div class="form-group">
+                <label>LDAP 用户名</label>
+                <input type="text" name="username" placeholder="LDAP 用户名">
+            </div>
+            <div class="form-group">
+                <label>LDAP 密码</label>
+                <input type="password" name="password" placeholder="LDAP 密码">
+            </div>
+            <button type="submit" class="btn" style="width:100%;background:#7b5cd6;color:#fff;">LDAP 登录</button>
+        </form>
+        {{end}}
+
+        {{if .oauth2Enabled}}
+        <a href="/auth/oauth2" class="btn btn-primary" style="width:100%;text-align:center;display:block;margin-top:4px;">
+            {{if eq .oauth2Provider "google"}}Google{{else if eq .oauth2Provider "github"}}GitHub{{else}}OAuth2{{end}} 登录
+        </a>
+        {{end}}
     </div>
 </body>
 </html>

internal/web/templates/sent.html

@@ -3,72 +3,91 @@
 <html lang="zh-CN">
 <head>
     <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>发件箱 - MailGo</title>
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
+    <title>已发送 - MailGo</title>
     {{template "styles" .}}
 </head>
-<body>
+<body class="page-list">
     {{template "navbar" .}}
-    <div class="container">
-        <div class="clearfix">
-            <div class="sidebar">
-                <a href="/inbox" class="{{if eq .activeFolder `inbox`}}active{{end}}">收件箱</a>
-                <a href="/drafts" class="{{if eq .activeFolder `drafts`}}active{{end}}">草稿箱</a>
-                <a href="/sent" class="{{if eq .activeFolder `sent`}}active{{end}}">发件箱</a>
-                <a href="/compose" class="{{if eq .activeFolder `compose`}}active{{end}}">撰写邮件</a>
-                <a href="/settings" class="{{if eq .activeFolder `settings`}}active{{end}}">设置</a>
+    <div class="app-body">
+        {{template "sidebar" .}}
+        <main class="mail-main">
+            <div class="list-toolbar">
+                <label class="check-all" title="全选/取消全选">
+                    <input type="checkbox" id="select-all">
+                    全选
+                </label>
+                <button type="button" class="tb-btn" id="btn-refresh" title="刷新">
+                    <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="23 4 23 10 17 10"/><path d="M20.49 15a9 9 0 1 1-2.12-9.36L23 10"/></svg>
+                    刷新
+                </button>
+                <button type="button" class="tb-btn danger" id="btn-delete" disabled>
+                    <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="3 6 5 6 21 6"/><path d="M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6m3 0V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2"/></svg>
+                    删除
+                </button>
+                <div class="toolbar-spacer"></div>
+                <span class="page-info">共 {{.total}} 封</span>
             </div>
-            <div class="content">
-                <div class="card">
-                    <h2 style="margin-bottom:16px;">发件箱</h2>
-                    {{if not .messages}}
-                    <p style="color:#7f8c8d;text-align:center;padding:40px 0;">暂无已发送邮件</p>
-                    {{else}}
-                    <table>
-                        <thead>
-                            <tr>
-                                <th style="width:25%;">收件人</th>
-                                <th style="width:45%;">主题</th>
-                                <th style="width:20%;">时间</th>
-                                <th style="width:10%;">操作</th>
-                            </tr>
-                        </thead>
-                        <tbody>
-                        {{range .messages}}
-                            <tr>
-                                <td>{{.ToAddr}}</td>
-                                <td>
-                                    <a href="/sent/{{.ID}}" class="message-subject">
-                                        {{if .Subject}}{{.Subject}}{{else}}(无主题){{end}}
-                                    </a>
-                                </td>
-                                <td>{{.Date.Format "2006-01-02 15:04"}}</td>
-                                <td>
-                                    <form method="POST" action="/mail/delete/{{.ID}}" style="display:inline;"
-                                          onsubmit="return confirm('确定要删除这封邮件吗？');">
-                                        <button type="submit" class="btn btn-danger btn-sm">删除</button>
-                                    </form>
-                                </td>
-                            </tr>
-                        {{end}}
-                        </tbody>
-                    </table>
-                    {{end}}
-                </div>
-                {{if .totalPages}}
-                <div class="pagination">
-                    {{if gt .page 1}}
-                    <a href="/sent?page={{sub .page 1}}">上一页</a>
-                    {{end}}
-                    <span>第 {{.page}} / {{.totalPages}} 页</span>
-                    {{if lt .page .totalPages}}
-                    <a href="/sent?page={{add .page 1}}">下一页</a>
-                    {{end}}
-                </div>
+
+            {{if not .messages}}
+            <div class="mail-list">
+                <div class="empty-tip"><span class="empty-icon">📤</span>已发送暂无邮件</div>
+            </div>
+            {{else}}
+            <ul class="mail-list">
+                {{range .messages}}
+                <li class="mail-row" data-id="{{.ID}}">
+                    <label class="cell-check" onclick="event.stopPropagation()">
+                        <input type="checkbox" class="row-check" data-id="{{.ID}}">
+                    </label>
+                    <span class="cell-avatar">
+                        <span class="avatar" style="{{avatarStyle .ToAddr}}">{{initial (mailName .ToAddr)}}</span>
+                    </span>
+                    <span class="cell-from" title="收件人：{{.ToAddr}}">{{mailName .ToAddr}}</span>
+                    <span class="cell-subject-wrap">
+                        <a class="cell-subject" href="/sent/{{.ID}}">
+                            {{if .Subject}}{{.Subject}}{{else}}(无主题){{end}}
+                        </a>
+                    </span>
+                    <span class="cell-snippet">
+                        {{if .TextBody}}{{truncate .TextBody 80}}{{else if .HtmlBody}}[HTML 邮件]{{end}}
+                    </span>
+                    <span class="cell-date">{{shortDate .Date}}</span>
+                    <form method="POST" action="/mail/delete/{{.ID}}" class="row-del"
+                          onsubmit="return confirm('确定要删除这封邮件吗？');">
+                        <button type="submit" class="icon-btn" title="删除">
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="3 6 5 6 21 6"/><path d="M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6m3 0V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2"/></svg>
+                        </button>
+                    </form>
+                </li>
                 {{end}}
+            </ul>
+            {{end}}
+
+            <div class="list-footer">
+                <span class="page-num">第 {{.page}} / {{if .totalPages}}{{.totalPages}}{{else}}1{{end}} 页</span>
+                <div class="pager">
+                    {{if gt .page 1}}
+                    <a class="page-btn" href="/sent?page={{sub .page 1}}">
+                        <svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg>
+                        上一页
+                    </a>
+                    {{else}}
+                    <span class="page-btn disabled">上一页</span>
+                    {{end}}
+                    {{if lt .page .totalPages}}
+                    <a class="page-btn" href="/sent?page={{add .page 1}}">
+                        下一页
+                        <svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+                    </a>
+                    {{else}}
+                    <span class="page-btn disabled">下一页</span>
+                    {{end}}
+                </div>
             </div>
-        </div>
+        </main>
     </div>
+    {{template "listjs" .}}
 </body>
 </html>
 {{end}}

internal/web/templates/settings.html

@@ -3,46 +3,81 @@
 <html lang="zh-CN">
 <head>
     <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
     <title>设置 - MailGo</title>
     {{template "styles" .}}
 </head>
-<body>
+<body class="page-settings">
     {{template "navbar" .}}
-    <div class="container">
-        <div class="clearfix">
-            <div class="sidebar">
-                <a href="/inbox" class="{{if eq .activeFolder `inbox`}}active{{end}}">收件箱</a>
-                <a href="/drafts" class="{{if eq .activeFolder `drafts`}}active{{end}}">草稿箱</a>
-                <a href="/sent" class="{{if eq .activeFolder `sent`}}active{{end}}">发件箱</a>
-                <a href="/compose" class="{{if eq .activeFolder `compose`}}active{{end}}">撰写邮件</a>
-                <a href="/settings" class="{{if eq .activeFolder `settings`}}active{{end}}">设置</a>
-            </div>
-            <div class="content">
-                <div class="card">
-                    <h2 style="margin-bottom:16px;">设置</h2>
-                    {{if .error}}<div class="alert alert-error">{{.error}}</div>{{end}}
-                    {{if .success}}<div class="alert alert-success">{{.success}}</div>{{end}}
-                    <h3 style="margin-bottom:12px;">修改密码</h3>
-                    <form method="POST" action="/settings">
-                        <div class="form-group">
-                            <label>当前密码</label>
-                            <input type="password" name="old_password" required placeholder="请输入当前密码">
+    <div class="app-body">
+        {{template "sidebar" .}}
+        <main class="mail-main settings-main">
+            {{if .error}}<div class="alert alert-error">{{.error}}</div>{{end}}
+            {{if .success}}<div class="alert alert-success">{{.success}}</div>{{end}}
+            {{if .mustChange}}<div class="alert" style="border:1px solid #ffa940;background:#fff7e6;color:#d46b08;border-radius:8px;padding:12px 16px;margin-bottom:16px;font-size:13.5px;">
+                ⚠️ 首次登录/密码已被重置，请立即修改密码后再继续使用邮箱功能。
+            </div>{{end}}
+
+            <div class="card" style="max-width:720px;">
+                <h2 style="font-size:17px;margin-bottom:18px;display:flex;align-items:center;gap:10px;">
+                    <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="#1677ff" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="3"/><path d="M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 0 1 0 2.83 2 2 0 0 1-2.83 0l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 0 1-2 2 2 2 0 0 1-2-2v-.09A1.65 1.65 0 0 0 9 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 0 1-2.83 0 2 2 0 0 1 0-2.83l.06-.06a1.65 1.65 0 0 0 .33-1.82 1.65 1.65 0 0 0-1.51-1H3a2 2 0 0 1-2-2 2 2 0 0 1 2-2h.09A1.65 1.65 0 0 0 4.6 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 0 1 0-2.83 2 2 0 0 1 2.83 0l.06.06a1.65 1.65 0 0 0 1.82.33H9a1.65 1.65 0 0 0 1-1.51V3a2 2 0 0 1 2-2 2 2 0 0 1 2 2v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 0 1 2.83 0 2 2 0 0 1 0 2.83l-.06.06a1.65 1.65 0 0 0-.33 1.82V9a1.65 1.65 0 0 0 1.51 1H21a2 2 0 0 1 2 2 2 2 0 0 1-2 2h-.09a1.65 1.65 0 0 0-1.51 1z"/></svg>
+                    账号信息
+                </h2>
+                <div style="display:flex;align-items:center;gap:14px;margin-bottom:20px;">
+                    <span class="avatar" style="width:52px;height:52px;font-size:22px;{{avatarStyle .currentUser.Username}}">{{initial .currentUser.Username}}</span>
+                    <div>
+                        <div style="font-size:16px;font-weight:600;">{{.currentUser.Username}}@{{.currentUser.Domain.Name}}</div>
+                        <div style="color:var(--text-3);font-size:12.5px;margin-top:3px;">
+                            已用 {{formatBytes .currentUser.UsedBytes}} / 配额 {{formatBytes .currentUser.QuotaBytes}}
+                            {{if .currentUser.IsAdmin}} · 管理员{{end}}
                         </div>
-                        <div class="form-group">
-                            <label>新密码</label>
-                            <input type="password" name="new_password" required placeholder="请输入新密码">
-                        </div>
-                        <div class="form-group">
-                            <label>确认新密码</label>
-                            <input type="password" name="confirm_password" required placeholder="请再次输入新密码">
-                        </div>
-                        <button type="submit" class="btn btn-primary">修改密码</button>
-                    </form>
+                    </div>
                 </div>
+                <div class="quota-bar" style="width:100%;" data-used="{{.currentUser.UsedBytes}}" data-quota="{{.currentUser.QuotaBytes}}"><i></i></div>
             </div>
-        </div>
+
+            <div class="card" style="max-width:720px;">
+                <h2 style="font-size:17px;margin-bottom:18px;">修改密码</h2>
+                <form method="POST" action="/settings" style="max-width:420px;">
+                    <div class="form-group">
+                        <label>当前密码</label>
+                        <input type="password" name="old_password" required placeholder="请输入当前密码" autocomplete="current-password">
+                    </div>
+                    <div class="form-group">
+                        <label>新密码</label>
+                        <input type="password" name="new_password" required placeholder="请输入新密码" autocomplete="new-password">
+                    </div>
+                    <div class="form-group">
+                        <label>确认新密码</label>
+                        <input type="password" name="confirm_password" required placeholder="请再次输入新密码" autocomplete="new-password">
+                    </div>
+                    <button type="submit" class="btn btn-primary">修改密码</button>
+                </form>
+            </div>
+
+            <div class="card" style="max-width:720px;">
+                <h2 style="font-size:17px;margin-bottom:10px;">帮助</h2>
+                <p style="color:var(--text-2);font-size:13.5px;line-height:1.9;">
+                    客户端收发信（IMAP / SMTP）配置：<br>
+                    IMAP 服务器：{{.currentUser.Domain.Name}} 端口 143 / SSL 993<br>
+                    SMTP 服务器：{{.currentUser.Domain.Name}} 端口 587（提交）/ SSL 465
+                </p>
+            </div>
+        </main>
     </div>
+    <script>
+    (function () {
+        var bar = document.querySelector('.quota-bar[data-quota]');
+        if (bar) {
+            var used = parseInt(bar.dataset.used, 10) || 0;
+            var quota = parseInt(bar.dataset.quota, 10) || 1;
+            var pct = Math.min(100, Math.round(used / quota * 100));
+            bar.querySelector('i').style.width = pct + '%';
+            if (pct >= 90) bar.classList.add('warn');
+            if (pct >= 100) bar.classList.add('over');
+        }
+    })();
+    </script>
 </body>
 </html>
 {{end}}

internal/web/templates/view.html

@@ -3,70 +3,86 @@
 <html lang="zh-CN">
 <head>
     <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
     <title>查看邮件 - MailGo</title>
     {{template "styles" .}}
-    <style>
-        .mail-body-iframe {
-            width: 100%;
-            min-height: 300px;
-            border: 1px solid #e0e0e0;
-            border-radius: 4px;
-            background: #fff;
-        }
-    </style>
 </head>
-<body>
+<body class="page-view">
     {{template "navbar" .}}
-    <div class="container">
-        <div class="clearfix">
-            <div class="sidebar">
-                <a href="/inbox" class="{{if eq .activeFolder `inbox`}}active{{end}}">收件箱</a>
-                <a href="/drafts" class="{{if eq .activeFolder `drafts`}}active{{end}}">草稿箱</a>
-                <a href="/sent" class="{{if eq .activeFolder `sent`}}active{{end}}">发件箱</a>
-                <a href="/compose" class="{{if eq .activeFolder `compose`}}active{{end}}">撰写邮件</a>
-                <a href="/settings" class="{{if eq .activeFolder `settings`}}active{{end}}">设置</a>
+    <div class="app-body">
+        {{template "sidebar" .}}
+        <main class="mail-main">
+            <div class="view-toolbar">
+                <a href="javascript:history.back()" class="tb-btn">
+                    <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="19" y1="12" x2="5" y2="12"/><polyline points="12 19 5 12 12 5"/></svg>
+                    返回
+                </a>
+                <a href="/compose?to={{mailEmail .message.FromAddr}}&subject={{if .message.Subject}}Re: {{.message.Subject}}{{end}}" class="tb-btn">
+                    <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 17 4 12 9 7"/><path d="M20 18v-2a4 4 0 0 0-4-4H4"/></svg>
+                    回复
+                </a>
+                <form method="POST" action="/mail/delete/{{.message.ID}}" style="display:inline;"
+                      onsubmit="return confirm('确定要删除这封邮件吗？');">
+                    <button type="submit" class="tb-btn danger">
+                        <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="3 6 5 6 21 6"/><path d="M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6m3 0V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2"/></svg>
+                        删除
+                    </button>
+                </form>
             </div>
-            <div class="content">
-                <div class="card">
-                    <div style="margin-bottom:16px;">
-                        <a href="javascript:history.back()" class="btn" style="background:#bdc3c7;color:#fff;">返回</a>
-                    </div>
-                    <h2>{{if .message.Subject}}{{.message.Subject}}{{else}}(无主题){{end}}</h2>
-                    <div class="mail-meta" style="margin-top:12px;">
-                        <p><strong>发件人:</strong> {{decodeHeader .message.FromAddr}}</p>
-                        <p><strong>收件人:</strong> {{.message.ToAddr}}</p>
-                        {{if .message.CcAddr}}<p><strong>抄送:</strong> {{.message.CcAddr}}</p>{{end}}
-                        <p><strong>时间:</strong> {{.message.Date.Format "2006-01-02 15:04:05"}}</p>
-                    </div>
-                    <div class="mail-body">
-                        {{if .message.HtmlBody}}
-                        <iframe class="mail-body-iframe" srcdoc="{{.message.HtmlBody | safeJS}}" sandbox="allow-same-origin" onload="this.style.height=this.contentDocument.body.scrollHeight+20+'px'"></iframe>
-                        {{else}}
-                        <pre style="white-space:pre-wrap;font-family:inherit;">{{.message.TextBody}}</pre>
-                        {{end}}
-                    </div>
-                    {{if .attachments}}
-                    <div class="attachment-list">
-                        <h4 style="margin-bottom:8px;">附件</h4>
-                        {{range .attachments}}
-                        <div class="attachment-item">
-                            📎 <a href="/attachment/{{.ID}}">{{.FileName}}</a>
-                            <span style="color:#7f8c8d;font-size:12px;">({{formatBytes .FileSize}})</span>
-                        </div>
-                        {{end}}
-                    </div>
-                    {{end}}
-                    <div style="margin-top:20px;padding-top:16px;border-top:1px solid #eee;">
-                        <form method="POST" action="/mail/delete/{{.message.ID}}" style="display:inline;"
-                              onsubmit="return confirm('确定要删除这封邮件吗？');">
-                            <button type="submit" class="btn btn-danger">删除邮件</button>
-                        </form>
-                        <a href="/compose?to={{decodeHeader .message.FromAddr}}&subject={{if .message.Subject}}Re: {{.message.Subject}}{{end}}" class="btn btn-primary" style="margin-left:8px;">回复</a>
+
+            <div class="mail-head">
+                <h1 class="mail-title">{{if .message.Subject}}{{.message.Subject}}{{else}}(无主题){{end}}</h1>
+                <div class="mail-from-row">
+                    <span class="avatar" style="{{avatarStyle .message.FromAddr}}">{{initial (mailName (decodeHeader .message.FromAddr))}}</span>
+                    <div>
+                        <div class="mail-from-name">{{mailName (decodeHeader .message.FromAddr)}}</div>
+                        <div class="mail-from-addr" title="{{decodeHeader .message.FromAddr}}">{{mailEmail .message.FromAddr}}</div>
                     </div>
+                    <span class="mail-date">{{.message.Date.Format "2006-01-02 15:04:05"}}</span>
                 </div>
+                {{if .message.CcAddr}}
+                <div class="mail-from-addr" style="margin:-8px 0 16px 48px;">
+                    抄送：{{.message.CcAddr}}
+                </div>
+                {{end}}
             </div>
-        </div>
+
+            <div class="mail-body-wrap">
+                <div class="mail-body">
+                    {{if .message.HtmlBody}}
+                    <iframe class="mail-body-iframe" srcdoc="{{.message.HtmlBody | safeJS}}" sandbox="allow-same-origin" onload="this.style.height=this.contentDocument.body.scrollHeight+20+'px'"></iframe>
+                    {{else}}
+                    <pre>{{.message.TextBody}}</pre>
+                    {{end}}
+                </div>
+
+                {{if .attachments}}
+                <div class="attachment-list">
+                    {{range .attachments}}
+                    <span class="attachment-item">
+                        <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21.44 11.05l-9.19 9.19a6 6 0 0 1-8.49-8.49l9.19-9.19a4 4 0 0 1 5.66 5.66l-9.2 9.19a2 2 0 0 1-2.83-2.83l8.49-8.48"/></svg>
+                        <a href="/attachment/{{.ID}}">{{.FileName}}</a>
+                        <span style="color:var(--text-3);font-size:12px;">({{formatBytes .FileSize}})</span>
+                    </span>
+                    {{end}}
+                </div>
+                {{end}}
+            </div>
+
+            <div class="view-actions">
+                <a href="/compose?to={{mailEmail .message.FromAddr}}&subject={{if .message.Subject}}Re: {{.message.Subject}}{{end}}" class="btn btn-primary">
+                    <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="vertical-align:-2px;margin-right:4px;"><polyline points="9 17 4 12 9 7"/><path d="M20 18v-2a4 4 0 0 0-4-4H4"/></svg>
+                    回复
+                </a>
+                <form method="POST" action="/mail/delete/{{.message.ID}}" style="display:inline;"
+                      onsubmit="return confirm('确定要删除这封邮件吗？');">
+                    <button type="submit" class="btn btn-danger">
+                        <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="vertical-align:-2px;margin-right:4px;"><polyline points="3 6 5 6 21 6"/><path d="M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6m3 0V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2"/></svg>
+                        删除邮件
+                    </button>
+                </form>
+            </div>
+        </main>
     </div>
 </body>
 </html>

internal/web/trustedproxy_test.go

@@ -0,0 +1,67 @@
+package web
+
+// P1 #3 回归测试：客户端 IP 不可通过 X-Forwarded-For 伪造。
+// 外部直连时伪造头必须被忽略（防绕过登录封禁/恶意封禁他人），
+// 本机回环（反向代理）转发时必须取 X-Forwarded-For 中的真实客户端 IP。
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// doLoginFailure 触发一次登录失败（使 BanStore 按 ClientIP 记录失败计数），
+// 返回使用的请求。
+func doLoginFailure(t *testing.T, ws *WebServer, remoteAddr, xff string) {
+	t.Helper()
+	form := strings.NewReader("email=nobody@example.com&password=wrong")
+	req := httptest.NewRequest(http.MethodPost, "/login", form)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.RemoteAddr = remoteAddr
+	if xff != "" {
+		req.Header.Set("X-Forwarded-For", xff)
+	}
+	w := httptest.NewRecorder()
+	ws.Handler().ServeHTTP(w, req)
+	if w.Code != http.StatusOK { // 登录失败重渲染登录页
+		t.Fatalf("login failure status = %d, want 200", w.Code)
+	}
+}
+
+func TestExternalClientIPCannotBeSpoofed(t *testing.T) {
+	ws, stores := newTestWebServer(t, "0123456789abcdef0123456789abcdef")
+
+	// 模拟外部攻击者直连 8080 端口，伪造 X-Forwarded-For
+	doLoginFailure(t, ws, "203.0.113.99:5555", "1.2.3.4")
+
+	// 失败计数必须记在真实来源 IP 上
+	if _, err := stores.Bans.GetByIP("1.2.3.4"); err == nil {
+		t.Fatal("spoofed X-Forwarded-For IP must not be recorded")
+	}
+	entry, err := stores.Bans.GetByIP("203.0.113.99")
+	if err != nil {
+		t.Fatalf("real client IP should be recorded: %v", err)
+	}
+	if entry.FailCount != 1 {
+		t.Fatalf("fail count = %d, want 1", entry.FailCount)
+	}
+}
+
+func TestLoopbackProxyXFFIsHonored(t *testing.T) {
+	ws, stores := newTestWebServer(t, "0123456789abcdef0123456789abcdef")
+
+	// 模拟本机 Caddy/Nginx 转发：RemoteAddr 是回环，XFF 是真实客户端
+	doLoginFailure(t, ws, "127.0.0.1:5555", "198.51.100.7")
+
+	entry, err := stores.Bans.GetByIP("198.51.100.7")
+	if err != nil {
+		t.Fatalf("proxied client IP should be recorded: %v", err)
+	}
+	if entry.FailCount != 1 {
+		t.Fatalf("fail count = %d, want 1", entry.FailCount)
+	}
+	if _, err := stores.Bans.GetByIP("127.0.0.1"); err == nil {
+		t.Fatal("proxy's own IP should not be recorded")
+	}
+}

main.go

@@ -12,6 +12,7 @@ import (
 	"net"
 	"os"
 	"path/filepath"
+	"sync"
 	"time"
 
 	"mail_go/config"
@@ -22,6 +23,7 @@ import (
 	"mail_go/internal/smtp_server"
 	"mail_go/internal/storage"
 	"mail_go/internal/store"
+	"mail_go/internal/tlsutil"
 	"mail_go/internal/web"
 
 	"golang.org/x/crypto/bcrypt"
@@ -35,7 +37,7 @@ func applyDomainTLSConfig(stores *store.Stores, cfg *config.Config) {
 
 	applied := applyTLSCertPaths(cfg, domain.TlsCertPath, domain.TlsKeyPath)
 	if applied {
-		log.Printf("使用域名 %s 的 TLS 证书；更新证书后需重启服务生效", domain.Name)
+		log.Printf("使用域名 %s 的 TLS 证书；证书更新后自动热加载，无需重启服务", domain.Name)
 	}
 }
 
@@ -59,6 +61,49 @@ func applyTLSCertPaths(cfg *config.Config, certPath, keyPath string) bool {
 	return applied
 }
 
+// tlsSource 返回证书路径来源：协议在 toml 中显式配置的证书优先；
+// 否则取第一个启用 TLS 且有证书的域名（管理后台一键导入证书后自动
+// 切换，无需重启）。结果缓存 10 秒，避免每次握手都查询数据库。
+func tlsSource(explicitCert, explicitKey string, stores *store.Stores) tlsutil.Source {
+	var (
+		mu         sync.Mutex
+		lastCheck  time.Time
+		cachedCert string
+		cachedKey  string
+	)
+	return func() (string, string) {
+		mu.Lock()
+		defer mu.Unlock()
+		if time.Since(lastCheck) < 10*time.Second {
+			return cachedCert, cachedKey
+		}
+		lastCheck = time.Now()
+		if explicitCert != "" && explicitKey != "" {
+			cachedCert, cachedKey = explicitCert, explicitKey
+		} else if d, err := stores.Domains.GetFirstTLSEnabledWithCert(); err == nil {
+			cachedCert, cachedKey = d.TlsCertPath, d.TlsKeyPath
+		} else {
+			cachedCert, cachedKey = "", ""
+		}
+		return cachedCert, cachedKey
+	}
+}
+
+// newTLSCertLoader 创建带热加载的 TLS 证书加载器（每次握手自动重载）。
+// 初始路径取显式配置或启动时填充的路径；source 允许后续动态切换
+// 证书来源。加载失败返回 nil，对应协议将不启用 TLS。
+func newTLSCertLoader(explicitCert, explicitKey, initCert, initKey string, stores *store.Stores, proto string) *tlsutil.Loader {
+	if initCert == "" || initKey == "" {
+		initCert, initKey = explicitCert, explicitKey
+	}
+	loader, err := tlsutil.NewLoader(initCert, initKey, tlsSource(explicitCert, explicitKey, stores), log.Printf)
+	if err != nil {
+		log.Printf("%s TLS 证书初始化失败: %v（该协议将不启用 TLS）", proto, err)
+		return nil
+	}
+	return loader
+}
+
 func ensureSelfSignedTLSConfig(cfg *config.Config) {
 	if cfg.SMTP.TLSCert != "" && cfg.SMTP.TLSKey != "" && cfg.IMAP.TLSCert != "" && cfg.IMAP.TLSKey != "" && cfg.POP3.TLSCert != "" && cfg.POP3.TLSKey != "" {
 		return
@@ -168,9 +213,21 @@ func main() {
 
 	// 5. Initialize attachment storage
 	attStorage := storage.NewAttachmentStorage(cfg.Storage.AttachDir)
+
+	// 记录 toml 中显式配置的证书路径；此后 applyDomainTLSConfig 会用
+	// 域名证书填充空值，需要原始值来判断“显式配置优先”。
+	explicitSMTPCert, explicitSMTPKey := cfg.SMTP.TLSCert, cfg.SMTP.TLSKey
+	explicitIMAPCert, explicitIMAPKey := cfg.IMAP.TLSCert, cfg.IMAP.TLSKey
+	explicitPOP3Cert, explicitPOP3Key := cfg.POP3.TLSCert, cfg.POP3.TLSKey
+
 	applyDomainTLSConfig(stores, cfg)
 	ensureSelfSignedTLSConfig(cfg)
 
+	// 证书热加载器：每次 TLS 握手自动重载证书文件，证书更新后无需重启
+	smtpTLS := newTLSCertLoader(explicitSMTPCert, explicitSMTPKey, cfg.SMTP.TLSCert, cfg.SMTP.TLSKey, stores, "SMTP")
+	imapTLS := newTLSCertLoader(explicitIMAPCert, explicitIMAPKey, cfg.IMAP.TLSCert, cfg.IMAP.TLSKey, stores, "IMAP")
+	pop3TLS := newTLSCertLoader(explicitPOP3Cert, explicitPOP3Key, cfg.POP3.TLSCert, cfg.POP3.TLSKey, stores, "POP3")
+
 	// 6. Outbound delivery manager (external mail queue + worker)
 	outboundMgr := outbound.NewManager(cfg.Outbound, cfg.SMTP.Domain, stores)
 	if outboundMgr.Enabled() {
@@ -181,7 +238,7 @@ func main() {
 	}
 
 	// 7. Start SMTP server
-	smtpSrv := smtp_server.NewSMTPServer(cfg.SMTP, stores, attStorage, outboundMgr)
+	smtpSrv := smtp_server.NewSMTPServer(cfg.SMTP, stores, attStorage, outboundMgr, smtpTLS, cfg.Ban)
 	go func() {
 		if err := smtpSrv.Start(); err != nil {
 			log.Printf("SMTP 服务启动失败: %v", err)
@@ -202,7 +259,7 @@ func main() {
 	}
 
 	// 7. Start IMAP server
-	imapSrv := imap_server.NewIMAPServer(cfg.IMAP, stores)
+	imapSrv := imap_server.NewIMAPServer(cfg.IMAP, stores, imapTLS, cfg.Ban)
 	go func() {
 		if err := imapSrv.Start(); err != nil {
 			log.Printf("IMAP 服务启动失败: %v", err)
@@ -218,7 +275,7 @@ func main() {
 	}
 
 	// 8. Start POP3 server
-	pop3Srv := pop3_server.NewPOP3Server(cfg.POP3, stores)
+	pop3Srv := pop3_server.NewPOP3Server(cfg.POP3, stores, pop3TLS, cfg.Ban)
 	go func() {
 		if err := pop3Srv.Start(); err != nil {
 			log.Printf("POP3 服务启动失败: %v", err)
@@ -234,7 +291,10 @@ func main() {
 	}
 
 	// 10. Start Web server
-	webServer := web.NewWebServer(cfg.Web, stores, attStorage, cfg.Storage, cfg.Auth, cfg.Ban, outboundMgr)
+	webServer, err := web.NewWebServer(cfg.Web, stores, attStorage, cfg.Storage, cfg.Auth, cfg.Ban, cfg.Caddy, outboundMgr)
+	if err != nil {
+		log.Fatalf("Web 服务初始化失败: %v", err)
+	}
 	fmt.Printf("Web 服务启动在 %s\n", cfg.Web.Addr)
 	go func() {
 		if err := webServer.Start(); err != nil {
@@ -274,8 +334,18 @@ func ensureAdminUser(stores *store.Stores, cfg *config.Config) {
 		fmt.Println("默认域名 example.com 创建成功")
 	}
 
-	// Hash the default admin password
-	hashedPassword, err := bcrypt.GenerateFromPassword([]byte("admin"), bcrypt.DefaultCost)
+	// 初始密码：优先取环境变量 MAILGO_ADMIN_PASSWORD；
+	// 否则生成随机密码并打印一次（只能在本机启动日志中看到）。
+	// 无论哪种方式都会标记首次登录必须改密，杜绝默认口令。
+	adminPassword := os.Getenv("MAILGO_ADMIN_PASSWORD")
+	generated := false
+	if adminPassword == "" {
+		adminPassword = randomPassword()
+		generated = true
+	}
+
+	// Hash the admin password
+	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(adminPassword), bcrypt.DefaultCost)
 	if err != nil {
 		log.Printf("密码哈希失败: %v", err)
 		return
@@ -283,13 +353,14 @@ func ensureAdminUser(stores *store.Stores, cfg *config.Config) {
 
 	// Create the admin user
 	adminUser := &db.User{
-		Username:     "admin",
-		PasswordHash: string(hashedPassword),
-		DomainID:     domain.ID,
-		QuotaBytes:   5 * 1024 * 1024 * 1024, // 5GB
-		UsedBytes:    0,
-		IsActive:     true,
-		IsAdmin:      true,
+		Username:             "admin",
+		PasswordHash:         string(hashedPassword),
+		DomainID:             domain.ID,
+		QuotaBytes:           5 * 1024 * 1024 * 1024, // 5GB
+		UsedBytes:            0,
+		IsActive:             true,
+		IsAdmin:              true,
+		MustChangePassword:   true,
 	}
 
 	if createErr := stores.Users.Create(adminUser); createErr != nil {
@@ -297,5 +368,29 @@ func ensureAdminUser(stores *store.Stores, cfg *config.Config) {
 		return
 	}
 
-	fmt.Println("管理员账户 admin@example.com 创建成功（密码: admin）")
+	if generated {
+		fmt.Printf("管理员账户 admin@example.com 创建成功，初始密码: %s\n", adminPassword)
+	} else {
+		fmt.Println("管理员账户 admin@example.com 创建成功（密码来自 MAILGO_ADMIN_PASSWORD）")
+	}
+	fmt.Println("安全提示：该账户已被标记为“首次登录必须修改密码”，请登录后立即在 设置 页面修改。")
+}
+
+// randomPassword 生成 16 位随机密码（数字+大小写字母），用于初始管理员账户。
+func randomPassword() string {
+	const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
+	buf := make([]byte, 16)
+	if _, err := rand.Read(buf); err != nil {
+		// crypto/rand 失败极罕见；退化为时间种子以避免空密码
+		log.Printf("生成随机密码失败: %v，使用弱随机回退", err)
+		n := time.Now().UnixNano()
+		for i := range buf {
+			buf[i] = charset[(n>>(uint(i)*4))%int64(len(charset))]
+		}
+		return string(buf)
+	}
+	for i := range buf {
+		buf[i] = charset[int(buf[i])%len(charset)]
+	}
+	return string(buf)
 }

security_todo.md

@@ -0,0 +1,180 @@
+# 安全漏洞修复 TODO
+
+依据 2026-08-19 的安全审计结果（代码静态审计 + mail.lmve.net 线上验证）整理。
+
+按优先级排列：P0 立即修复，P1 尽快修复，P2 排期修复，P3 加固项。
+
+## P0 严重：可被完全接管
+
+### 1. 会话签名密钥硬编码，可伪造任意管理员会话
+
+- [x] 位置：`internal/web/server.go:176`
+- 现状：`cookie.NewStore([]byte("mail-go-secret-key-change-in-production"))`，密钥写死在源码中且无配置项可更换。源码公开 = 任何人可签发 `userID=1, isAdmin=true` 的合法 cookie，直接以管理员身份进入线上后台。
+- 修复方案：
+  - [x] `config.Config` 新增 `[web] secret_key` 字段。
+  - [x] `LoadConfig()` 首次启动时用 `crypto/rand` 生成 32 字节随机密钥（hex 编码）写入配置文件；配置文件权限收紧为 0600（兼顾原有的中继密码等敏感字段）。
+  - [x] 支持环境变量 `MAILGO_SECRET_KEY` 覆盖（覆盖值不落盘，便于容器部署）。
+  - [x] 启动时校验：密钥为空 / 等于旧硬编码默认值 / 短于 16 字节时拒绝启动（`config.ValidateSecretKey` + `NewWebServer` 返回 error）。
+- 验证：
+  - [x] 重启后旧 cookie 全部失效（登录态被踢下线）。
+  - [x] 用旧硬编码密钥手工签发的 cookie 无法通过认证（`TestLegacyHardcodedKeyCannotForgeSession`：伪造 `userID=1, isAdmin=true` 的 cookie 被拒，302 回登录页）。
+  - [x] `config.LoadConfig()` 单测：首启生成、二次读取保持不变、旧配置补全、旧默认值替换、env 覆盖不落盘、文件权限 0600（`config/config_test.go`）。
+- 已完成（2026-08-19）。注：部署新版后所有用户需重新登录；配置文件权限由 0644 收紧为 0600。
+
+## P1 高危
+
+### 2. OAuth2 state 固定值且回调不校验（登录 CSRF / 授权码注入）
+
+- [x] 位置：`internal/web/handlers/auth.go`（原硬编码 `mailgo_oauth2_state`、`OAuth2Callback` 不校验 state）
+- 现状：当前部署未启用 OAuth2，属休眠漏洞，启用前必须修复。
+- 修复方案：
+  - [x] `OAuth2Start` 用 `crypto/rand` 生成 16 字节随机 state，写入独立的短期 SameSite=Lax cookie（`mail_go_oauth2_state`，10 分钟过期，HttpOnly+Secure）。注意主会话 cookie 是 SameSite=Strict，跨站回调导航不会携带，故不能放主会话。
+  - [x] `OAuth2Callback` 读取 `c.Query("state")` 与 cookie 值做 `subtle.ConstantTimeCompare` 比对，缺失/不匹配返回 403。
+  - [x] 比对后立即清除 cookie（`MaxAge=-1`），保证一次性使用。
+- 验证：
+  - [x] 单测：state 缺失/不匹配/无 cookie 均 403；start 设置的 cookie 与 URL state 一致且每次不同；有效 state 通过校验进入后续流程（`oauth2_state_test.go`）。
+  - [ ] 手工走完一次 OAuth2 流程（Google/GitHub）确认正常登录。
+
+### 3. Gin 信任所有代理，`ClientIP()` 可伪造（封禁绕过 / 爆破）
+
+- [x] 位置：`internal/web/server.go`（未调用 `SetTrustedProxies`）
+- 现状：gin 默认信任 0.0.0.0/0，`X-Forwarded-For` 可任意伪造。线上 8080 端口当前被防火墙挡住，属纵深防御缺失；一旦 8080/socket 可达：伪造不同 IP 即可绕过登录失败封禁无限爆破，也可恶意封禁任意 IP 造成 DoS。
+- 修复方案：
+  - [x] 统一 `engine.SetTrustedProxies([]string{"127.0.0.1", "::1"})`：外部直连时 XFF 完全不可信（防伪造/防封禁污染）；本机 Caddy/Nginx 转发时 XFF 仍可信（保留真实客户端 IP）。注意 gin 对 Unix socket 监听无条件信任转发头，socket 必须保持仅本机可达。
+  - [ ] install.sh 文档注明：8080 端口必须保持仅本机可达（防火墙/绑定 127.0.0.1）。
+- 验证：
+  - [x] 单测：外部直连 + 伪造 `X-Forwarded-For` 时封禁记录落在真实 IP 上；回环代理 + XFF 时记录 XFF 中的真实客户端 IP（`trustedproxy_test.go`）。
+  - [ ] 线上回归：Caddy 反代路径下管理后台封禁列表仍显示真实客户端 IP。
+
+### 4. Web 写信 CRLF 邮件头注入
+
+- [x] 位置：`internal/web/handlers/mail.go`（原 `to`/`cc`/`subject` 直接拼头、附件文件名拼进 `Content-Disposition`/`Content-Type`）
+- 现状：信封收件人经 `ParseAddress` 校验无法注入，但注入的头（如 `Reply-To`）会随邮件存储并外发，可被用于钓鱼。
+- 修复方案：
+  - [x] 新增 `sanitizeHeaderField`：strip `\r`、`\n`、NUL，应用于 From/To/Cc 头。
+  - [x] `subject` 经 `sanitizeHeaderField` + RFC 2047（`mime.QEncoding`）编码非 ASCII 内容。
+  - [x] 附件名经 `mime.FormatMediaType` 生成 `Content-Disposition`/`Content-Type name` 参数（RFC 2231 编码，中和 CRLF 注入）。
+  - [x] 消息构建抽出为 `buildOutgoingMessage` 纯函数（可单测）；`DownloadAttachment`/`AdminDownloadAttachment` 的响应头同步改用 `formatContentDisposition`。
+- 验证：
+  - [x] 单测：`to`/`cc`/`subject` 携带 CRLF 注入载荷时 RawData 无独立注入头；文件名含 CRLF/引号时头结构完好；非 ASCII 主题正确编码（`mail_injection_test.go`）。
+  - [ ] 含特殊字符附件名的邮件实测收发正常。
+
+## P2 中危
+
+### 5. 会话 Cookie 缺 Secure 标志
+
+- [x] 位置：`internal/web/server.go`
+- 修复方案：
+  - [x] `sessions.Options` 增加 `Secure: cfg.CookieSecure`；新增配置项 `[web].cookie_secure`（默认 true，仅本地 HTTP 调试时改 false；缺失字段按默认 true 处理，参照 relay_starttls 的原始文件检查）。
+  - [x] 修正 SameSite 注释（3 = Strict）。
+  - [x] 测试：会话 cookie 断言 HttpOnly+Secure+SameSite=Strict。
+- 验证：
+  - [x] 测试断言 cookie 标志。
+  - [ ] 线上登录后检查 `Set-Cookie` 包含 `Secure; HttpOnly; SameSite=Strict`。
+
+### 6. SMTP/IMAP/POP3 认证无速率限制
+
+- [x] 位置：`internal/smtp_server/server.go`、`internal/imap_server/`、`internal/pop3_server/server.go`
+- 修复方案：
+  - [x] `store.RecordAuthFailure(ip, maxFail, minutes)`：认证失败计数复用 BanStore，达到 `ban.max_fail_attempts` 阈值即封禁 `ban.ban_duration_min` 分钟（与 Web 登录共用封禁记录）。
+  - [x] SMTP：`NewSession` 记录 `c.Conn().RemoteAddr()` 提取 IP；Auth 回调失败计数 + 封禁 IP 拒绝认证。
+  - [x] IMAP：`Login(connInfo,...)` 从 `connInfo.RemoteAddr` 取 IP；失败计数 + 封禁拒绝。
+  - [x] POP3：`handleConn` 开头检查封禁直接拒绝；`handlePASS` 失败计数。
+  - [x] 三个服务器构造函数注入 `config.BanConfig`。
+- 验证：
+  - [x] store 层单测：达到阈值封禁、空 IP 无副作用、与 Web 共用封禁记录（`auth_guard_test.go`）。
+  - [ ] 线上用错误密码连续尝试触发封禁后，SMTP/IMAP/POP3 认证被拒。
+
+### 7. 附件存储路径遍历防护无效
+
+- [x] 位置：`internal/storage/attachment.go`
+- 修复方案：
+  - [x] `FullPath` 改为白名单校验（UUID 文件名正则），非法路径返回错误；兜底校验最终路径仍在 baseDir 内。
+  - [x] `Save` 的扩展名白名单化（`safeExt`，丢弃 CR/LF、路径分隔符等）。
+- 验证：
+  - [x] 单测：`../`、绝对路径、Windows 分隔符、空路径、注入文件名全部拒绝；合法文件名正常读写删（`attachment_test.go`）。
+
+### 8. 默认管理员 admin@example.com/admin
+
+- [x] 位置：`main.go`（`ensureAdminUser`）
+- 修复方案：
+  - [x] 初始密码改为：环境变量 `MAILGO_ADMIN_PASSWORD` 显式指定，否则生成 16 位随机密码打印一次。
+  - [x] User 模型新增 `MustChangePassword`：初始管理员、管理员重置密码的用户在登录后强制跳转设置页改密，改密后清除标记（`UpdatePassword` 顺带清除）。
+  - [x] AuthMiddleware 拦截（除 /settings、/logout），settings 页显示提示横幅。
+- 验证：
+  - [x] 全新数据库启动后 admin/admin 无法登录（密码为随机值）；登录后强制改密流程生效。
+  - [ ] 线上验证新装机流程。
+
+### 9. Smarthost 中继 TLS 不验证证书（凭据可被 MITM 截获）
+
+- [x] 位置：`internal/outbound/mailer.go`
+- 修复方案：
+  - [x] 直投 MX 保持机会式 TLS（`InsecureSkipVerify=true`，业界常规）；relay 路径默认验证证书（`InsecureSkipVerify=false`），IP literal 时以 IP 作为 ServerName 校验 IP SAN。
+  - [x] 新增配置 `outbound.relay_tls_insecure`（默认 false），供自签证书内网中继显式放行。
+- 验证：
+  - [x] 集成测试：自签证书 STARTTLS 中继默认握手失败（certificate 错误）、开启开关后完整 SMTP 流程成功（`mailer_test.go` 两个新测试）。
+
+### 10. 缺安全响应头（点击劫持/降级风险）
+
+- [x] 位置：`internal/web/middleware/security.go`（新中间件，全局注册）
+- 修复方案：
+  - [x] `Strict-Transport-Security: max-age=31536000; includeSubDomains`
+  - [x] `X-Frame-Options: DENY` + CSP `frame-ancestors 'none'`（点击劫持）
+  - [x] `X-Content-Type-Options: nosniff`
+  - [x] `Referrer-Policy: strict-origin-when-cross-origin`
+  - [x] 基础 CSP：`default-src 'self'` + 放宽项（内联脚本/样式必须 unsafe-inline；`img-src https:` 允许邮件远程图片；`connect-src 'self'`/`form-action 'self'` 防数据外泄）。CSP 具体策略在 `security.go` 顶部注释说明。
+- 验证：
+  - [x] 单测：5 个头均存在，关键值抽查（`security_test.go`）。
+  - [ ] 线上回归：登录/收件箱/管理页功能不受 CSP 影响；邮件远程图片正常加载。
+
+### 11. LDAP/OAuth 错误信息泄露与用户枚举
+
+- [x] 位置：`internal/web/handlers/auth.go`
+- 修复方案：
+  - [x] 错误提示统一为通用文案（"LDAP 认证失败…"、"LDAP 账号未接入本系统…"、"OAuth2 认证失败…"），原始 err 只写日志，不回显页面；不再在提示中回显用户邮箱。
+- 验证：
+  - [x] 现有 OAuth2 测试仍通过（错误页文案不含内部细节）。
+  - [ ] 线上（启用 LDAP/OAuth 后）验证失败页面不含内部地址/DN/原始错误串。
+
+## P3 低危 / 加固
+
+### 12. Referer 开放重定向
+
+- [ ] 位置：`internal/web/handlers/mail.go:567-571、591-595`
+- [ ] 修复：仅接受以 `/` 开头且非 `//` 的相对路径 Referer，否则回退 `/inbox`。
+
+### 13. Web 发信配额检查 TOCTOU
+
+- [ ] 位置：`internal/web/handlers/mail.go:209-263`
+- [ ] 修复：配额检查与 `UpdateUsedBytes` 改为单条原子 SQL（`WHERE used_bytes + ? <= quota_bytes` 式更新），失败即拒发。
+
+### 14. compose 页 safeJS 在 JS 上下文绕过转义（自 XSS）
+
+- [ ] 位置：`internal/web/templates/compose.html:80`
+- [ ] 修复：改为 `quill.root.innerHTML = {{.bodyContent | jsonify}};`（模板函数内用 `json.Marshal` 输出 JS 字符串字面量）。
+- [ ] 顺手评估移除 `templateFuncs` 中不再使用的 `safeHTML`，缩小危险面。
+
+### 15. Content-Disposition 文件名未编码
+
+- [ ] 位置：`internal/web/handlers/mail.go:626`、`internal/web/handlers/admin.go:863`
+- [ ] 修复：与 #4 一并改用 `mime.FormatMediaType`（RFC 5987 `filename*=`）。
+
+### 16. 会话治理
+
+- [ ] 登录成功后调用 `session.Clear()` 再写入新值（清掉可能的旧状态）。
+- [ ] 会话固定时长 24h 无任何续期/空闲过期策略，考虑加滑动过期与绝对过期。
+
+## 已确认安全、无需改动
+
+- bcrypt 密码哈希；GORM 全参数化查询（无 SQL 注入）。
+- SMTP 非开放中继、认证用户强制 From=登录身份。
+- LDAP 过滤器已 `EscapeFilter`。
+- 邮件 HTML 经 sandbox iframe（无 `allow-scripts`）渲染，`srcdoc` 属性转义经实测有效，无存储型 XSS。
+- Web 登录错误提示不区分用户是否存在（无枚举）。
+
+## 修复顺序建议
+
+1. ~~#1（P0）~~ 已完成 2026-08-19
+2. ~~#2、#3、#4（P1）~~ 已完成 2026-08-19
+3. ~~#5-#11（P2）~~ 已完成 2026-08-19
+4. 其余 P3 项随版本迭代