# Webmail-only Readiness

This checklist tracks the `webmail-only` release target. It covers core mail
behavior only. Google Calendar, Google Drive, native Zimbra calendar/briefcase,
superadmin, billing, and SaaS-only flows must stay outside this release target
unless explicitly requested.

## Scope

`webmail-only` includes:

- Login, logout, session refresh, and 2FA user recovery support.
- Inbox, folders, search, message list, reader, conversation mode, and actions.
- Compose, reply, forward, draft save/update, send, and attachments.
- Zimbra-native advanced search, saved searches, high-priority mail, and read receipts.
- Contacts, signatures, filters, tags, starred state, and preferences.
- Branding and tenant/admin mailbox support needed to operate mail.
- Mobile and tablet layouts for core mail workflows.

## Recently Fixed

- Drafts use the SOAP API as the source of truth when editing existing drafts.
- Draft save/update includes To, Cc, Bcc, subject, body, and attachments.
- Sending drafts with attachments works through the mail server upload flow.
- Sent messages preserve To, Cc, Bcc display information in reader views.
- Sent draft cleanup behavior was corrected after successful send.
- Conversation mode supports starred state and tag changes.
- Tag folder views refresh after tag changes.
- Message list date display shows year for older messages according to the
  current product rule.
- Message list header search clear duplication was removed.
- Session warning/extension behavior was corrected so active use extends the
  session instead of warning during work.
- Local storage use was reduced; view mode and filter rules were moved to SOAP
  backed behavior where required.
- Preferences Contacts mail action opens compose correctly.
- Signature preview was removed.
- Admin 2FA status now reads from mailbox security state, and postmaster admin
  can disable mailbox 2FA when a user loses authenticator access.
- Out of Office date validation now renders inline in the settings form instead
  of using browser alert dialogs.

## Current Test Status

The main webmail workflows have been manually tested on the production-style
deployment by the product owner. Treat the current state as a good candidate for
release regression rather than as unfinished feature work.

Keep this status scoped to the `webmail-only` edition:

- `PRODUCT_EDITION=mail_only`
- Calendar add-ons disabled.
- Drive add-ons disabled.
- Native add-on tabs disabled.
- Billing and platform operator controls out of the customer webmail UI.

Before packaging or handing off a build, rerun the release regression checklist
below after the final frontend/backend restart.

## Regression Checklist

### Release Regression

- Login without 2FA.
- Login with 2FA.
- Session remains active during normal use.
- Logout clears the active session.
- Message list loads Inbox, Sent, Drafts, Trash, custom folders, and tag folders.
- Message list date/year display is correct for recent and older messages.
- Message reader shows From, To, Cc, and Bcc consistently across folders.
- Conversation mode opens the clicked message and does not confuse row id with
  conversation id.
- Star/unstar works in message mode and conversation mode.
- Add/remove tags works in message mode and conversation mode.
- Tag folder updates immediately after tag changes.
- Search and clear search behave predictably.
- Advanced Search combines sender, recipient, subject, date, attachment and unread criteria through Zimbra search.
- Advanced Search does not show a duplicate Starred/Flag criterion; Starred remains a dedicated sidebar view.
- Saved Searches are created as Zimbra search folders, persist after a new session, reopen correctly, and can be deleted safely.
- Starred in Zimphony matches Zimbra Flagged in both directions and is not stored as a separate local state.
- High Priority persists through draft save/send and is visible on the recipient copy and in Zimbra.
- Read Receipt request reaches the recipient; both Send receipt and Do not send paths are verified with two accounts.
- Compose new message with To only.
- Compose with Cc and Bcc.
- Compose with subject and body.
- Compose without subject shows the confirmation flow.
- Attach local files and send.
- Attach local files and save/update draft.
- Edit draft reloads latest subject, body, To, Cc, Bcc, and attachments from the
  mail server.
- Send a draft with attachments.
- Send a draft without attachments and verify the draft is removed after send.
- Reply and forward preserve expected quoted content.
- Contacts list, contact create/edit/delete, and "send mail" action work.
- Signatures apply to new mail and replies without preview UI.
- Filter rules load, save, and clear through the mail server.
- Mobile compose layout scrolls to the bottom of the message body and footer.
- Tablet message list, reader, and compose remain usable.
- Admin mailbox list shows accurate 2FA state.
- Admin can disable 2FA by clicking the `Enabled` pill for the target mailbox.
- Each of the 12 supported webmail languages is selectable and persists after refresh/login.
- Advanced Search, Saved Searches, High Priority, Read Receipt, 2FA/license notices and existing core mail UI do not fall back to English in non-English webmail locales.
- `/admin` and `/admin/login` remain English-only regardless of the mailbox webmail language.

### Branding Regression

- Change tenant logo, brand name, and tagline from customer admin.
- Confirm the webmail login screen uses the updated logo and copy.
- Confirm the mailbox sidebar uses the updated logo.
- Confirm favicon behavior is correct for the installation.
- Refresh the browser after a logo update and confirm the old logo is not stuck
  in cache.

### Mobile and Tablet Regression

- Open and close the mailbox sidebar drawer.
- Switch between Email, Contact, and Preferences from compact navigation.
- Open message reader from the list, then return to the list.
- Compose a new message and confirm the message body and footer remain
  reachable.
- Add an attachment from the compact compose view.
- Open Preferences and save Out of Office settings with valid dates.
- Try invalid Out of Office dates and confirm the inline validation message is
  shown without a browser alert.

## Attachment Size Behavior

Current behavior:

- The backend exposes `/mail/limits` for authenticated users.
- The app tries to read mail server size limits from admin SOAP config:
  `zimbraFileUploadMaxSize`, `zimbraMtaMaxMessageSize`, and
  `zimbraMailContentMaxSize`.
- Compose validates upload-style attachments before adding files, sending, or
  saving a draft when a limit is available.
- If the message exceeds the detected limit, compose shows:
  `This message is larger than the mail server limit...`
- If the mail server still rejects the upload or send, the backend returns that
  error to the compose dialog and the footer displays it beside the send/save
  controls.

Current limitation:

- If the admin SOAP config is unavailable and account info does not expose a
  limit, the app cannot proactively block the send.
- The exact wording depends on the mail server response. Backend fault handling
  hides vendor naming and returns neutral "mail server" wording where SOAP
  faults are parsed.

Recommended follow-up:

- Verify the detected limit against the production mail server configuration.
- Add coverage for inline images embedded in the HTML body if they are expected
  to count toward the same message-size limit.

## Remaining Polish

No known blocker remains for the `webmail-only` core workflow after the current
manual test pass. Remaining work should be treated as release hardening:

- Run the release regression checklist after the final production build.
- Keep visible copy vendor-neutral in the mail-only edition.
- Recheck mobile and tablet layouts after any change to compose, reader,
  preferences, or navigation.
- Document any customer-specific branding or mail server limit assumptions in
  the deployment notes for that customer.

## Release Gate

Do not treat `webmail-only` as ready until:

- The regression checklist above passes on desktop.
- Mobile and tablet compose/list/reader flows are verified.
- Frontend and backend production services are restarted after the final build.
- No Google Drive, Google Calendar, native Zimbra calendar/briefcase, billing, or
  superadmin-only UI is required for the core mail release.

For the Google add-on edition, see [Google add-on integration](google-addon-integration.md).
