MessageWeave/docs
anonsaber dda8e084ae fix(jmap): trust the configured origin host so Stalwart's session redirect is followed
jmap-client refuses to follow any redirect unless the target host is on a
trust list that defaults to empty. Stalwart 307-redirects /.well-known/jmap
to /jmap/session, so connect() aborted with "Aborting redirect request to
unknown host 'mail.motofans.club'" and PUT /api/business-config failed with
a 503 carrying no usable detail.

connect_with_runtime now passes the origin host parsed from the normalized
session URL to follow_redirects, trusting that host only -- a target host the
server invents is still refused. An unparseable base yields an empty host,
which matches no target and preserves the previous fail-closed behaviour.

Verified against a real Stalwart instance both ways: the ignored smoke test
session_list_and_read_smoke now passes (session -> folders -> email list ->
read) and fails with the redirect error when the change is reverted.

docs: record the redirect trust under SAF-JMAP-URL, mark G1/D-G1-1 verified
after the real-server run, and refresh two shifted line anchors in client.rs.
2026-09-29 16:30:55 +08:00
..
charter.md feat(debug): 开关信号改为 DEBUG_ENABLED 环境变量,启动命令不再需要改动 2026-09-29 12:54:06 +08:00
deployment.md fix(notify): stop exposing the business and admin routes in configuration-setup mode 2026-09-29 15:26:54 +08:00
design.md fix(jmap): trust the configured origin host so Stalwart's session redirect is followed 2026-09-29 16:30:55 +08:00
reference.md fix(jmap): trust the configured origin host so Stalwart's session redirect is followed 2026-09-29 16:30:55 +08:00
retired.md fix(notify): stop exposing the business and admin routes in configuration-setup mode 2026-09-29 15:26:54 +08:00
roadmap.md docs: bump verification baselines to b2dbe7c 2026-09-29 02:24:17 +08:00