Milestone 1 scaffold: binary skeleton, schema, deploy, Mox spike

- Confirmed core bet via spike/mimecheck: mox/message parses a messy multipart message standalone (envelope, MIME tree, attachment, body) with only an io.ReaderAt — no mox store/config. Option B is viable. - cmd/openmail single binary: serve|migrate|smtpd|sender|version subcommands. - internal/api: chi router, constant-time bearer auth, /healthz, stubbed v0 AgentMail-shaped routes (501 until core services land). - internal/store: pgxpool + embedded, idempotent, tracked SQL migrations. - internal/store/migrations/0001_init.sql: full native schema (pods, inboxes, threads, messages, attachments, drafts, api_keys, webhooks, outbox, events, domains) with FTS + GIN indexes. Validated end-to-end against Postgres 16. - deploy/: docker-compose (postgres+minio+openmail+caddy), Caddyfile, DNS.md (MX/SPF/DKIM/DMARC/DANE/MTA-STS). Makefile, .gitignore. - Verified: go vet clean; build OK; health/auth smoke tests; migrate idempotent. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-21 12:16:51 -07:00
parent aab2a8558e
commit 551739baa3
15 changed files with 889 additions and 2 deletions
@@ -0,0 +1,30 @@
+package api
+
+import (
+	"crypto/subtle"
+	"net/http"
+	"strings"
+)
+
+// bearerAuth is a bootstrap bearer-token gate against the configured admin
+// token. Milestone 1+: replace with DB-backed api_keys lookup (hash compare,
+// per-pod scoping). Until OPENMAIL_ADMIN_TOKEN is set, the API is closed.
+func (s *Server) bearerAuth(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if s.cfg.AdminToken == "" {
+			writeJSON(w, http.StatusServiceUnavailable, map[string]string{
+				"error":   "auth_unconfigured",
+				"message": "OPENMAIL_ADMIN_TOKEN not set; API is closed",
+			})
+			return
+		}
+		const prefix = "Bearer "
+		h := r.Header.Get("Authorization")
+		if !strings.HasPrefix(h, prefix) ||
+			subtle.ConstantTimeCompare([]byte(strings.TrimPrefix(h, prefix)), []byte(s.cfg.AdminToken)) != 1 {
+			writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "unauthorized"})
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
@@ -0,0 +1,82 @@
+// Package api is OpenMail's agent-facing HTTP surface: the AgentMail-shaped v0
+// REST API (see ARCHITECTURE.md §4). v0 routes are stubbed pending the core
+// services; health and auth are real.
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/chi/v5/middleware"
+
+	"github.com/karti-ai/openmail/internal/config"
+	"github.com/karti-ai/openmail/internal/store"
+)
+
+type Server struct {
+	cfg   config.Config
+	store *store.Store
+}
+
+func New(cfg config.Config, st *store.Store) *Server {
+	return &Server{cfg: cfg, store: st}
+}
+
+func (s *Server) Router() http.Handler {
+	r := chi.NewRouter()
+	r.Use(middleware.RequestID)
+	r.Use(middleware.RealIP)
+	r.Use(middleware.Recoverer)
+
+	// Unauthenticated liveness/readiness.
+	r.Get("/healthz", s.handleHealth)
+
+	// Authenticated v0 surface.
+	r.Group(func(r chi.Router) {
+		r.Use(s.bearerAuth)
+
+		r.Route("/v0/inboxes", func(r chi.Router) {
+			r.Post("/", notImplemented)        // create inbox
+			r.Get("/", notImplemented)         // list inboxes
+			r.Get("/{id}", notImplemented)     // get inbox
+			r.Post("/{id}/messages/send", notImplemented)
+			r.Get("/{id}/messages", notImplemented)
+			r.Get("/{id}/messages/{msgID}", notImplemented)
+			r.Post("/{id}/messages/{msgID}/reply", notImplemented)
+			r.Get("/{id}/threads", notImplemented)
+			r.Get("/{id}/threads/{threadID}", notImplemented)
+		})
+	})
+
+	return r
+}
+
+func (s *Server) handleHealth(w http.ResponseWriter, r *http.Request) {
+	status := map[string]any{"status": "ok"}
+	if s.store != nil {
+		if err := s.store.Pool.Ping(r.Context()); err != nil {
+			status["status"] = "degraded"
+			status["db"] = err.Error()
+			writeJSON(w, http.StatusServiceUnavailable, status)
+			return
+		}
+		status["db"] = "ok"
+	} else {
+		status["db"] = "not configured"
+	}
+	writeJSON(w, http.StatusOK, status)
+}
+
+func notImplemented(w http.ResponseWriter, r *http.Request) {
+	writeJSON(w, http.StatusNotImplemented, map[string]string{
+		"error":   "not_implemented",
+		"message": "endpoint scaffolded; core service pending (milestone 1)",
+	})
+}
+
+func writeJSON(w http.ResponseWriter, code int, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(code)
+	_ = json.NewEncoder(w).Encode(v)
+}
@@ -0,0 +1,30 @@
+// Package config loads OpenMail configuration from the environment.
+// Twelve-factor style: everything via env vars, sane defaults for local dev.
+package config
+
+import (
+	"os"
+)
+
+type Config struct {
+	HTTPAddr    string // OPENMAIL_HTTP_ADDR, e.g. ":8080"
+	DatabaseURL string // DATABASE_URL, e.g. postgres://user:pass@host:5432/openmail
+	SMTPAddr    string // OPENMAIL_SMTP_ADDR, inbound :25 listener
+	AdminToken  string // OPENMAIL_ADMIN_TOKEN, bootstrap bearer until DB-backed api_keys land
+}
+
+func Load() Config {
+	return Config{
+		HTTPAddr:    envOr("OPENMAIL_HTTP_ADDR", ":8080"),
+		DatabaseURL: os.Getenv("DATABASE_URL"),
+		SMTPAddr:    envOr("OPENMAIL_SMTP_ADDR", ":25"),
+		AdminToken:  os.Getenv("OPENMAIL_ADMIN_TOKEN"),
+	}
+}
+
+func envOr(key, def string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return def
+}
@@ -0,0 +1,148 @@
+-- OpenMail initial schema. See ARCHITECTURE.md §3.
+-- Native, agent-shaped data model (not Mox's per-account bbolt index).
+
+CREATE EXTENSION IF NOT EXISTS pgcrypto;  -- gen_random_uuid()
+
+-- Tenant isolation.
+CREATE TABLE IF NOT EXISTS pods (
+    id          uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    name        text NOT NULL,
+    created_at  timestamptz NOT NULL DEFAULT now()
+);
+
+-- Per-domain DKIM keys + DNS verification state.
+CREATE TABLE IF NOT EXISTS domains (
+    id              uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    pod_id          uuid NOT NULL REFERENCES pods(id) ON DELETE CASCADE,
+    name            text NOT NULL,
+    dkim_selector   text,
+    dkim_privkey_ref text,            -- pointer to key in secret store; never the key itself
+    verified        boolean NOT NULL DEFAULT false,
+    created_at      timestamptz NOT NULL DEFAULT now(),
+    UNIQUE (name)
+);
+
+-- An agent-owned address; first-class API resource.
+CREATE TABLE IF NOT EXISTS inboxes (
+    id            uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    pod_id        uuid NOT NULL REFERENCES pods(id) ON DELETE CASCADE,
+    address       text NOT NULL,
+    display_name  text,
+    metadata      jsonb NOT NULL DEFAULT '{}'::jsonb,
+    created_at    timestamptz NOT NULL DEFAULT now(),
+    updated_at    timestamptz NOT NULL DEFAULT now(),
+    UNIQUE (address)
+);
+
+CREATE TABLE IF NOT EXISTS threads (
+    id              uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    inbox_id        uuid NOT NULL REFERENCES inboxes(id) ON DELETE CASCADE,
+    subject         text,
+    last_message_id uuid,
+    message_count   integer NOT NULL DEFAULT 0,
+    labels          text[] NOT NULL DEFAULT '{}',
+    created_at      timestamptz NOT NULL DEFAULT now(),
+    updated_at      timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS messages (
+    id              uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    inbox_id        uuid NOT NULL REFERENCES inboxes(id) ON DELETE CASCADE,
+    thread_id       uuid REFERENCES threads(id) ON DELETE SET NULL,
+    message_id_hdr  text,                       -- RFC 5322 Message-ID
+    in_reply_to     text,
+    "references"    text[] NOT NULL DEFAULT '{}',
+    from_addr       text,
+    to_addrs        text[] NOT NULL DEFAULT '{}',
+    cc              text[] NOT NULL DEFAULT '{}',
+    bcc             text[] NOT NULL DEFAULT '{}',
+    subject         text,
+    preview         text,
+    text            text,
+    html            text,
+    extracted_text  text,                       -- quoted history stripped
+    extracted_html  text,
+    raw_object_key  text,                       -- pointer to raw .eml in object store
+    spf             text,                       -- inbound auth verdicts (from mox pkgs)
+    dkim            text,
+    dmarc           text,
+    junk_score      real,
+    labels          text[] NOT NULL DEFAULT '{}',
+    size_bytes      bigint,
+    headers         jsonb NOT NULL DEFAULT '{}'::jsonb,
+    ts              tsvector,                   -- full-text search
+    created_at      timestamptz NOT NULL DEFAULT now(),
+    updated_at      timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS attachments (
+    id            uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    message_id    uuid NOT NULL REFERENCES messages(id) ON DELETE CASCADE,
+    filename      text,
+    content_type  text,
+    size_bytes    bigint,
+    object_key    text NOT NULL,
+    inline        boolean NOT NULL DEFAULT false,
+    content_id    text
+);
+
+CREATE TABLE IF NOT EXISTS drafts (
+    id          uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    inbox_id    uuid NOT NULL REFERENCES inboxes(id) ON DELETE CASCADE,
+    thread_id   uuid REFERENCES threads(id) ON DELETE SET NULL,
+    to_addrs    text[] NOT NULL DEFAULT '{}',
+    cc          text[] NOT NULL DEFAULT '{}',
+    bcc         text[] NOT NULL DEFAULT '{}',
+    subject     text,
+    text        text,
+    html        text,
+    send_at     timestamptz,
+    client_id   text,
+    created_at  timestamptz NOT NULL DEFAULT now()
+);
+
+-- Bearer tokens; only the hash is stored.
+CREATE TABLE IF NOT EXISTS api_keys (
+    id          uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    pod_id      uuid NOT NULL REFERENCES pods(id) ON DELETE CASCADE,
+    hash        bytea NOT NULL,
+    scopes      text[] NOT NULL DEFAULT '{}',
+    created_at  timestamptz NOT NULL DEFAULT now(),
+    UNIQUE (hash)
+);
+
+CREATE TABLE IF NOT EXISTS webhooks (
+    id           uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    pod_id       uuid NOT NULL REFERENCES pods(id) ON DELETE CASCADE,
+    url          text NOT NULL,
+    event_types  text[] NOT NULL DEFAULT '{}',
+    secret       text NOT NULL,
+    created_at   timestamptz NOT NULL DEFAULT now()
+);
+
+-- Outbound send queue + retries.
+CREATE TABLE IF NOT EXISTS outbox (
+    id              uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    message_id      uuid NOT NULL REFERENCES messages(id) ON DELETE CASCADE,
+    status          text NOT NULL DEFAULT 'queued',   -- queued|sending|sent|failed
+    attempts        integer NOT NULL DEFAULT 0,
+    last_error      text,
+    next_attempt_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS events (
+    id          uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    inbox_id    uuid REFERENCES inboxes(id) ON DELETE CASCADE,
+    type        text NOT NULL,
+    payload     jsonb NOT NULL DEFAULT '{}'::jsonb,
+    created_at  timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_inboxes_pod          ON inboxes(pod_id);
+CREATE INDEX IF NOT EXISTS idx_threads_inbox        ON threads(inbox_id);
+CREATE INDEX IF NOT EXISTS idx_messages_thread      ON messages(thread_id);
+CREATE INDEX IF NOT EXISTS idx_messages_inbox_time  ON messages(inbox_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_messages_ts          ON messages USING gin(ts);
+CREATE INDEX IF NOT EXISTS idx_messages_labels      ON messages USING gin(labels);
+CREATE INDEX IF NOT EXISTS idx_threads_labels       ON threads USING gin(labels);
+CREATE INDEX IF NOT EXISTS idx_outbox_due           ON outbox(next_attempt_at) WHERE status = 'queued';
@@ -0,0 +1,100 @@
+// Package store owns OpenMail's Postgres-backed persistence. This is the
+// deliberate divergence from Mox: OpenMail keeps its own native, agent-shaped
+// data model (see ARCHITECTURE.md §3) rather than embedding Mox's bstore/bbolt
+// account store.
+package store
+
+import (
+	"context"
+	"embed"
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+//go:embed migrations/*.sql
+var migrationsFS embed.FS
+
+type Store struct {
+	Pool *pgxpool.Pool
+}
+
+// Open connects to Postgres and verifies the connection.
+func Open(ctx context.Context, databaseURL string) (*Store, error) {
+	if databaseURL == "" {
+		return nil, fmt.Errorf("store: DATABASE_URL is empty")
+	}
+	pool, err := pgxpool.New(ctx, databaseURL)
+	if err != nil {
+		return nil, fmt.Errorf("store: connect: %w", err)
+	}
+	if err := pool.Ping(ctx); err != nil {
+		pool.Close()
+		return nil, fmt.Errorf("store: ping: %w", err)
+	}
+	return &Store{Pool: pool}, nil
+}
+
+func (s *Store) Close() {
+	if s.Pool != nil {
+		s.Pool.Close()
+	}
+}
+
+// Migrate applies any embedded migrations not yet recorded in schema_migrations,
+// in filename order. Each migration runs in its own transaction.
+func (s *Store) Migrate(ctx context.Context) error {
+	_, err := s.Pool.Exec(ctx, `CREATE TABLE IF NOT EXISTS schema_migrations (
+		version text PRIMARY KEY,
+		applied_at timestamptz NOT NULL DEFAULT now()
+	)`)
+	if err != nil {
+		return fmt.Errorf("migrate: ensure schema_migrations: %w", err)
+	}
+
+	entries, err := migrationsFS.ReadDir("migrations")
+	if err != nil {
+		return fmt.Errorf("migrate: read embedded migrations: %w", err)
+	}
+	names := make([]string, 0, len(entries))
+	for _, e := range entries {
+		if strings.HasSuffix(e.Name(), ".sql") {
+			names = append(names, e.Name())
+		}
+	}
+	sort.Strings(names)
+
+	for _, name := range names {
+		var exists bool
+		if err := s.Pool.QueryRow(ctx,
+			`SELECT EXISTS(SELECT 1 FROM schema_migrations WHERE version=$1)`, name,
+		).Scan(&exists); err != nil {
+			return fmt.Errorf("migrate: check %s: %w", name, err)
+		}
+		if exists {
+			continue
+		}
+		sqlBytes, err := migrationsFS.ReadFile("migrations/" + name)
+		if err != nil {
+			return fmt.Errorf("migrate: read %s: %w", name, err)
+		}
+		tx, err := s.Pool.Begin(ctx)
+		if err != nil {
+			return fmt.Errorf("migrate: begin %s: %w", name, err)
+		}
+		if _, err := tx.Exec(ctx, string(sqlBytes)); err != nil {
+			_ = tx.Rollback(ctx)
+			return fmt.Errorf("migrate: apply %s: %w", name, err)
+		}
+		if _, err := tx.Exec(ctx, `INSERT INTO schema_migrations(version) VALUES($1)`, name); err != nil {
+			_ = tx.Rollback(ctx)
+			return fmt.Errorf("migrate: record %s: %w", name, err)
+		}
+		if err := tx.Commit(ctx); err != nil {
+			return fmt.Errorf("migrate: commit %s: %w", name, err)
+		}
+	}
+	return nil
+}