cesnimda a3785a45cb
CI / backend (pull_request) Successful in 1m0s
CI / frontend (pull_request) Successful in 13s
CI / format (pull_request) Failing after 53s
CI / db-tests (pull_request) Successful in 52s
Security / secrets (pull_request) Successful in 4s
Security / dependencies (pull_request) Successful in 57s
Security / sast (pull_request) Successful in 42s
fix(auth): login 500 — DataProtection key ring unreadable on root-owned keys volume
Root cause: a 'keys' Docker volume created by an older root-running image is owned
by root, but the container now runs as the non-root 'app' user (uid 1654). The API
can't read/write its DataProtection key ring, so encrypting the OAuth correlation
cookie fails and /api/v1/auth/login returns 500. (Staging was unaffected only because
its volumes were recreated fresh during the pgvector swap.)

Fixes:
- compose: a one-shot 'init-keys' service (root busybox) chowns the keys volume to
  1654:1654 before the api starts (depends_on service_completed_successfully). Auto-heals
  any pre-existing root-owned volume — local, staging, and future deployments.
- Dockerfile: install libgssapi-krb5-2 — the slim aspnet:10.0 image dropped it and
  Npgsql logged 'Cannot load library libgssapi_krb5.so.2' on every connection.

Verified on a clean local stack: 0 key-ring errors, 0 krb5 errors, login now 302.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-04 16:05:56 +02:00
2026-06-30 15:53:32 +02:00
2026-06-30 15:53:32 +02:00

InboxIntel — Inbox Intelligence Platform

A Gmail analytics, cleanup, and automation app. Connects via Google OAuth2, syncs your inbox into PostgreSQL, and gives you a draggable analytics dashboard, safe bulk cleanup, unsubscribe management, optional AI analysis, advanced search, and PDF/CSV/JSON exports.

This repository is a full-stack scaffold structured for the 15-step implementation plan. Every layer is wired and compiles; the business logic is functional, with a few integration points (Gmail parsing edge cases, AI prompt tuning) intentionally left as clearly-marked extension points.

Architecture

Clean Architecture across four backend projects plus a React SPA:

src/
  InboxIntel.Domain          Entities + enums. No external dependencies.
  InboxIntel.Application      Service interfaces, DTOs, validators, query parser.
  InboxIntel.Infrastructure   EF Core, Gmail client, sync worker, AI, export.
  InboxIntel.Api              ASP.NET Core Web API: auth, controllers, DI, Serilog.
frontend/                     React + Vite dashboard (Chart.js, react-grid-layout).
tests/                        Unit + integration test projects.

Dependency rule: Api -> Infrastructure -> Application -> Domain. Controllers contain no business logic; they delegate to Application-layer service interfaces resolved through DI.

See docs/ARCHITECTURE.md for the full design, data model, and request flow.

Tech stack

.NET 8 / ASP.NET Core, EF Core + Npgsql (PostgreSQL), Hosted background worker, Serilog, FluentValidation, Polly (retry + backoff), Google.Apis.Gmail, QuestPDF/CsvHelper for exports, React 18 + Vite + Chart.js + react-grid-layout.

cp .env.example .env          # then fill in Google OAuth credentials
docker compose up --build

Services: PostgreSQL (5432), API (8080), frontend (8081). Optional reverse proxy:

docker compose --profile proxy up --build   # everything on port 80

The API applies EF migrations automatically on startup (Database:AutoMigrate).

Running locally (without Docker)

  1. Start PostgreSQL and set the connection string in src/InboxIntel.Api/appsettings.Development.json.

  2. Create the initial migration and database:

    dotnet tool install --global dotnet-ef
    dotnet ef migrations add InitialCreate \
      -p src/InboxIntel.Infrastructure -s src/InboxIntel.Api
    dotnet ef database update -p src/InboxIntel.Infrastructure -s src/InboxIntel.Api
    
  3. Run the API and the frontend:

    dotnet run --project src/InboxIntel.Api        # http://localhost:5080
    cd frontend && npm install && npm run dev      # http://localhost:5173
    

Google OAuth2 setup

Create an OAuth client (type: Web application) in the Google Cloud Console. Add the Gmail API. Authorized redirect URI: http://localhost:5080/signin-google (dev) and your production URL. Put the client id/secret in .env or user-secrets. Scopes requested: openid email profile gmail.readonly gmail.modify (no send scope).

Security notes

OAuth refresh tokens are encrypted at rest with the ASP.NET Core Data Protection API (AES) and never logged. Keys persist to a mounted /keys volume. All destructive cleanup and unsubscribe actions require an explicit Confirmed flag and a server-side preview. The AI layer is advisory only — it never performs destructive actions.

Tests

dotnet test

Unit tests cover the Gmail query parser and unsubscribe extraction; integration tests boot the API host and assert authorization is enforced.

S
Description
No description provided
Readme 1.2 MiB
Languages
C# 63.4%
JavaScript 29.5%
CSS 5.6%
PowerShell 0.6%
Dockerfile 0.4%
Other 0.5%