release: prepare v1.2.29

* fix: merge account and mailbox forwarding

* docs: prepare v1.2.20 release

---------

Co-authored-by: zxyszx <299979470+zxyszx@users.noreply.github.com>

.github/release-notes/v1.2.20.md

@@ -0,0 +1,3 @@
+- 调整邮件转发规则：账号级转发固定作用于所有邮箱，并与单个邮箱追加的转发目标同时生效。
+- 优化单个邮箱转发设置：账号级目标默认勾选、置顶并锁定，邮箱及转发地址按数字和字母排序，目标较多时可查看完整列表。
+- 优化 Telegram 版本频道通知排版：使用精简标题、分层说明和完整更新链接，提升手机端阅读体验。

.github/release-notes/v1.2.21.md

@@ -0,0 +1,8 @@
+- 优化登录与会话流程：登录后完整返回原页面及查询条件，区分未登录、超时、取消和网络故障，并为服务不可用状态提供明确的重新连接入口。
+- 完善后台与邮箱错误处理：管理员设置、邮件列表、邮件详情、发送队列、个人资料、签名、DNS 检查及注册流程均增加真实失败提示和重试反馈，避免静默失败或错误成功提示。
+- 优化邮箱与个人设置：恢复显示名称编辑，新增可持久化的标准/紧凑邮件布局，移除无效时区和模拟资料，修正发信成功后草稿删除失败的提示逻辑。
+- 保持并强化转发规则：账号级转发目标在所有邮箱中默认勾选、置顶且不可取消，单邮箱可继续追加独立目标，现有单邮箱配置不受影响，目标按数字和字母排序。
+- 统一界面视觉与交互：采用更清晰的中性色、文字层级、焦点状态和紧凑圆角，补充图标按钮名称、工具提示及全屏页面主区域，改善桌面与移动端可访问性。
+- 优化前端加载与开发体验：拆分邮件编辑器相关代码包，控制单个构建文件体积，并支持通过 `VITE_API_TARGET` 指定本地后端代理地址。
+- 加固邮件 HTML 安全：升级 DOMPurify 至已修复版本，依赖审计无已知漏洞；同步清理过时演示数据、无效状态和旧页面逻辑。
+- 完成全量质量复核：前后端构建、Go 全量及竞态测试、SMTP、外部 IMAP、OAuth、Telegram、Webhook、转发、队列、权限隔离、安装、备份、回滚和 DKIM 同步测试均已通过。

.github/release-notes/v1.2.22.md

@@ -0,0 +1,5 @@
+- 修复 QQ 邮箱、网易邮箱、Gmail 等第三方客户端可以收信但无法发信的问题。
+- SMTP 提交服务新增 `AUTH LOGIN` 认证支持，并继续兼容 `AUTH PLAIN`；两种方式均只允许在 TLS 加密连接中使用。
+- 兼容带初始用户名和标准两步用户名/密码挑战的 LOGIN 流程，适配常见手机邮箱、Apple Mail 和 Thunderbird。
+- 客户端配置保持 IMAP 993/SSL、POP3 995/SSL、SMTP 465/SSL，不增加额外服务器地址或备用配置。
+- 新增 SMTP 能力声明、LOGIN 认证、STARTTLS、隐式 TLS 和完整发信回归测试。

.github/release-notes/v1.2.23.md

@@ -0,0 +1,5 @@
+- 优化转发验证完成页：移除“返回邮箱”入口，外部收件人确认 Netflix、ChatGPT 等验证码转发授权后不会进入邮箱登录页，只显示验证结果和关闭页面提示。
+- 合并验证邮箱搜索与添加入口：输入内容会实时筛选已添加地址，输入新邮箱时可直接发送验证邮件，已存在地址会明确显示为“已添加”。
+- 重整验证邮箱管理列表：待验证邮箱置顶展示，已验证邮箱按数字和字母排序并聚合为可折叠分组，邮箱数量较多时仍便于查找和管理。
+- 精简邮件转发主页面：不再平铺全部验证邮箱标签，改为显示已验证与待验证数量汇总，点击即可进入管理列表。
+- 补充验证完成页回归测试，确保页面不再出现邮箱首页或登录入口，并完成前端构建、组件规范、后端全量测试与静态检查。

.github/release-notes/v1.2.24.md

@@ -0,0 +1,3 @@
+- 精简邮件转发页面入口，移除右上角重复的“管理验证邮箱”按钮。
+- 保留下方汇总入口并统一命名为“管理验证邮箱”，继续显示已验证与待验证邮箱数量。
+- 没有验证邮箱时仍显示该入口，用户可直接进入添加和验证邮箱。

.github/release-notes/v1.2.25.md

@@ -0,0 +1,9 @@
+- 修复收信规则移动到自定义文件夹时被错误归入“已归档”的问题，现在会按规则名称真实创建目标文件夹。
+- 修正发件人、附件名、邮件大小和日期条件的匹配边界，拒绝字段不支持的运算符，避免规则保存后永远无法命中。
+- “应用到现有邮件”不再处理已发送和草稿邮件，规则暂停启用时也可执行用户明确选择的现有邮件处理。
+- 完善规则动作失败处理：失败的动作不再误中止后续规则，归档、删除和移动错误不再被静默忽略。
+- 收信规则列表新增适用邮箱显示，并提供独立的上移、下移按钮，多条规则时可完整调整优先级。
+- 新增自定义文件夹图标，支持按名称自动匹配、手动选择以及上传小图标，并内置 Netflix、ChatGPT、账单、购物、旅行、工作等常用类型。
+- 上传图标会在浏览器本地缩放为 64×64 PNG，服务端校验 PNG 文件头并限制在 32 KB；不联网查询品牌，不保留上传原图。
+- 文件夹图标已在侧栏、桌面端与移动端移动菜单中统一显示，数据库升级会自动为旧文件夹补充默认图标。
+- 补充收信规则、自定义文件夹、图标自动匹配、手动图标保留和上传格式安全边界的回归测试。

.github/release-notes/v1.2.26.md

@@ -0,0 +1,7 @@
+- 修复手机端删除自定义文件夹时菜单先消失、确认框无法显示的问题，文件夹菜单现在与移动侧栏保持在同一交互层中。
+- 删除文件夹前会稳定显示确认信息，提交后显示处理中状态，避免重复操作；文件夹内邮件仍会安全移回收件箱。
+- 修复手机侧栏中新建文件夹弹窗被侧栏遮挡或立即关闭的问题，侧栏退出后再打开创建界面。
+- 重做手机端“新建规则 / 编辑规则”布局：标题、表单与底部操作区改为纵向结构，内容区域可独立滚动。
+- 优化规则条件与动作的窄屏排列，字段和运算符并排、输入框独占一行，添加与删除按钮保持易点击且不会挤出屏幕。
+- 规则底部创建和取消按钮固定可见并适配手机安全区域，多条件、多动作时仍可顺畅滚动和提交。
+- 优化通用确认弹窗的手机宽度和按钮触控尺寸，减少误触并避免贴边显示。

.github/release-notes/v1.2.27.md

@@ -0,0 +1,6 @@
+- 修复收信规则选择“移动到自定义文件夹”后立即跳回归档的问题。
+- 移除移动动作右侧显示 `Archive` 等英文内部值的旧输入框，避免系统值与中文选项重复出现。
+- 将移动目标整合为一个文件夹选择器，系统文件夹统一显示中文名称。
+- 文件夹选择器新增“系统文件夹”和“自定义文件夹”分组，自动列出当前邮箱或全部邮箱中已经创建的自定义文件夹。
+- 选择 Netflix、amazon 等自定义文件夹后会直接保存真实文件夹名称，不再错误保存为归档。
+- 已验证规则创建、列表摘要和后端数据均保留所选自定义文件夹。

.github/release-notes/v1.2.28.md

@@ -0,0 +1,8 @@
+- 收信规则页新增规则名称搜索，支持按字母或完整名称快速筛选，并提供清空搜索和空结果提示。
+- 优化规则列表的桌面端与手机端布局，规则名称、适用邮箱、条件和动作可完整换行显示，操作按钮不再挤压内容。
+- 调整新建规则工具栏与表单对齐，搜索框与规则列表等宽，“所有条件”选择器与下方条件字段保持同一左边界。
+- 邮箱侧栏的“文件夹”和“标签”支持点击展开或收起，桌面端和手机侧栏保持一致交互。
+- 降低所有对话框的背景遮罩深度，手机端和桌面端分别使用更轻的灰色层级，避免打开弹窗后页面过黑。
+- 重排“被拦截邮件”页面，统一标题、统计和新增入口，长邮箱地址与拦截原因会自动换行，不再超出边框。
+- 重排“邮件清理”页面的统计卡片和清理操作，修复窄屏文字截断、按钮挤压和横向溢出。
+- 统一前后台文字按钮样式，移除“新建规则”、“新增拦截”、权限配置、账号、域名、邮箱和转发等命令前多余的加号图标。

.github/release-notes/v1.2.29.md

@@ -0,0 +1,13 @@
+- 重构后台账号管理：新增账号统一使用“邮箱前缀 + 已有域名”创建，支持显示名称、密码二次确认、邮箱数量上限、共享存储容量和权限配置。
+- 创建用户账号时自动生成同地址默认邮箱；账号与全部绑定邮箱共用登录密码，账号重置密码后会同步更新所属邮箱。
+- 存储容量改为账号级共享：管理员默认 1 GB，普通用户默认 100 MB，最低可设置 100 MB；新增邮箱不再重复增加容量，容量检查会统计账号下全部邮箱。
+- 在账号编辑中集中管理共享存储容量，并在账号列表显示邮箱数量、共享容量、邮箱搜索与复制入口；移除邮箱地址前多余图标和重复身份标签。
+- 重做邮箱管理页面：按归属账号聚合子邮箱，支持账号或邮箱搜索、展开收起、邮箱数量统计及按地址排序，邮箱较多时仍可快速定位。
+- 默认邮箱与所属账号绑定并受到保护，管理员账号、用户默认邮箱和管理员账号下的默认邮箱均不能删除；默认邮箱也不能单独改归属或停用。
+- 普通子邮箱支持在三点菜单中启用、停用和删除；启用状态使用绿色高亮，停用状态使用红色提示，删除前必须二次确认。
+- 后台与 Open API 创建或改绑邮箱时统一继承所属账号密码和共享容量，修复遗漏容量参数时意外清零及接口绕过默认邮箱保护的问题。
+- 优化权限配置：管理员权限固定只读，普通用户系统权限和使用限制可以编辑，同时保留系统名称与说明，避免系统身份被误改。
+- 每个权限配置均提供“查看全部权限”入口，按分类展示完整权限清单，已开启项目显示勾选，未开启项目保持空框。
+- 统一后台九个功能页的卡片、表格、侧栏选中态、状态文字、操作菜单和空状态，减少重复标签、图标与视觉噪音。
+- 完善桌面端和手机端响应式布局，账号、邮箱和权限页面在窄屏下保持可读、可操作且无横向溢出。
+- 补充账号默认邮箱、管理员保护、共享容量、密码继承、Open API 兼容和权限编辑等回归测试。

.github/workflows/docker.yml

@@ -289,18 +289,20 @@ jobs:
 
           sections = []
           for index, entry in enumerate(entries, 1):
+              parts = re.split(r"[：:]", entry, maxsplit=1)
+              if len(parts) == 1:
                   parts = re.split(r"[，；。]", entry, maxsplit=1)
               title = parts[0].strip()
               description = parts[1].strip() if len(parts) > 1 else ""
-              section = f"<b>{index:02d}  {html.escape(title)}</b>"
+              section = f"<b>{index:02d} · {html.escape(title)}</b>"
               if description:
-                  section += "\n" + html.escape(description.rstrip("。") + "。")
+                  section += "\n<blockquote>" + html.escape(description.rstrip("。") + "。") + "</blockquote>"
               sections.append(section)
 
           tag = os.environ["RELEASE_TAG"]
-          prefix = f"<b>NewSzxcn Email {html.escape(tag)}</b>\n新版本现已发布\n\n<b>本次更新</b>\n\n"
+          prefix = f"<b>NewSzxcn Email {html.escape(tag)}</b>\n<i>新版本现已发布</i>\n\n<b>更新内容 · {len(sections)} 项</b>\n\n"
           release_url = html.escape(os.environ["RELEASE_URL"], quote=True)
-          footer = f'\n\n🔗 <a href="{release_url}">查看本次更新</a>'
+          footer = f'\n\n<a href="{release_url}">查看完整更新说明 ↗</a>'
           available = max(0, 3600 - len(prefix) - len(footer))
           visible_sections = []
           used = 0

README.md

@@ -231,6 +231,8 @@ pnpm install
 pnpm run dev
 ```
 
+后端不在默认的 `http://localhost:8080` 时，可通过 `VITE_API_TARGET=http://localhost:18080 pnpm run dev` 指定本地代理目标。
+
 提交前建议运行：
 
 ```bash

VERSION

@@ -1 +1 @@
-1.2.15
+1.2.29

apps/api/internal/app/admin_handlers.go

@@ -49,9 +49,9 @@ func (a *App) handleAdminOverview(w http.ResponseWriter, r *http.Request) {
 }
 
 func (a *App) handleListUsers(w http.ResponseWriter, r *http.Request) {
-	rows, err := a.db.QueryContext(r.Context(), `SELECT u.id,u.login_name,u.email,u.display_name,u.role,u.disabled,u.two_factor_enabled,u.mailbox_limit_override,u.created_at,COUNT(mb.id),COALESCE(GROUP_CONCAT(mb.address), '')
+	rows, err := a.db.QueryContext(r.Context(), `SELECT u.id,u.login_name,u.email,u.display_name,u.role,u.disabled,u.two_factor_enabled,u.mailbox_limit_override,u.storage_quota_mb,u.created_at,COUNT(mb.id),COALESCE(GROUP_CONCAT(mb.address), '')
 		FROM users u LEFT JOIN mailboxes mb ON mb.user_id=u.id
-		GROUP BY u.id,u.login_name,u.email,u.display_name,u.role,u.disabled,u.two_factor_enabled,u.mailbox_limit_override,u.created_at
+		GROUP BY u.id,u.login_name,u.email,u.display_name,u.role,u.disabled,u.two_factor_enabled,u.mailbox_limit_override,u.storage_quota_mb,u.created_at
 		ORDER BY CASE WHEN u.role='admin' THEN 0 ELSE 1 END, lower(COALESCE(NULLIF(u.email,''),u.login_name)), lower(u.display_name), u.created_at`)
 	if err != nil {
 		respondError(w, http.StatusInternalServerError, "failed to list users")
@@ -64,7 +64,7 @@ func (a *App) handleListUsers(w http.ResponseWriter, r *http.Request) {
 		var disabled, twoFactorEnabled int
 		var mailboxLimitOverride sql.NullInt64
 		var created, mailboxCSV string
-		if err := rows.Scan(&item.ID, &item.LoginName, &item.Email, &item.DisplayName, &item.Role, &disabled, &twoFactorEnabled, &mailboxLimitOverride, &created, &item.MailboxCount, &mailboxCSV); err != nil {
+		if err := rows.Scan(&item.ID, &item.LoginName, &item.Email, &item.DisplayName, &item.Role, &disabled, &twoFactorEnabled, &mailboxLimitOverride, &item.StorageQuotaMB, &created, &item.MailboxCount, &mailboxCSV); err != nil {
 			respondError(w, http.StatusInternalServerError, "failed to scan users")
 			return
 		}
@@ -101,6 +101,7 @@ func (a *App) handleCreateUser(w http.ResponseWriter, r *http.Request) {
 		Password             string   `json:"password"`
 		Disabled             bool     `json:"disabled"`
 		MailboxLimitOverride *int     `json:"mailboxLimitOverride"`
+		StorageQuotaMB       int      `json:"storageQuotaMb"`
 		PermissionGroupIDs   []string `json:"permissionGroupIds"`
 	}
 	if err := decodeJSON(r, &req); err != nil {
@@ -142,6 +143,14 @@ func (a *App) handleCreateUser(w http.ResponseWriter, r *http.Request) {
 	if role == "admin" {
 		mailboxLimitOverride = nil
 	}
+	storageQuotaMB := req.StorageQuotaMB
+	if storageQuotaMB > 0 && storageQuotaMB < minimumStorageQuotaMB {
+		badRequest(w, errors.New("共享存储容量不能小于 100 MB"))
+		return
+	}
+	if storageQuotaMB == 0 {
+		storageQuotaMB = defaultUserStorageQuotaMB
+	}
 	if !hasMinimumPasswordLength(req.Password) {
 		badRequest(w, errors.New("password must be at least 6 characters"))
 		return
@@ -159,11 +168,22 @@ func (a *App) handleCreateUser(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	defer tx.Rollback()
-	if _, err = tx.ExecContext(r.Context(), `INSERT INTO users(id,login_name,email,display_name,role,password_hash,disabled,mailbox_limit_override,created_at,updated_at)
-		VALUES(?,?,?,?,?,?,?,?,?,?)`, id, primaryEmail, primaryEmail, displayName, role, string(passwordHash), boolInt(req.Disabled), nullableInt(mailboxLimitOverride), now, now); err != nil {
+	if _, err = tx.ExecContext(r.Context(), `INSERT INTO users(id,login_name,email,display_name,role,password_hash,disabled,mailbox_limit_override,storage_quota_mb,created_at,updated_at)
+		VALUES(?,?,?,?,?,?,?,?,?,?,?)`, id, primaryEmail, primaryEmail, displayName, role, string(passwordHash), boolInt(req.Disabled), nullableInt(mailboxLimitOverride), storageQuotaMB, now, now); err != nil {
 		badRequest(w, err)
 		return
 	}
+	localPart, domainName, _ := strings.Cut(primaryEmail, "@")
+	var primaryDomainID string
+	if err := tx.QueryRowContext(r.Context(), `SELECT id FROM domains WHERE lower(name)=lower(?)`, domainName).Scan(&primaryDomainID); err == nil {
+		if _, err := a.createMailboxWithPasswordHashTx(r.Context(), tx, id, primaryDomainID, localPart, displayName, string(passwordHash), storageQuotaMB, "active"); err != nil {
+			badRequest(w, err)
+			return
+		}
+	} else if !errors.Is(err, sql.ErrNoRows) {
+		respondError(w, http.StatusInternalServerError, "failed to load account domain")
+		return
+	}
 	permissionGroupIDs := req.PermissionGroupIDs
 	if role == "admin" {
 		permissionGroupIDs = nil
@@ -194,6 +214,7 @@ func (a *App) handleUpdateUser(w http.ResponseWriter, r *http.Request) {
 		Role                 string    `json:"role"`
 		Disabled             *bool     `json:"disabled"`
 		MailboxLimitOverride *int      `json:"mailboxLimitOverride"`
+		StorageQuotaMB       *int      `json:"storageQuotaMb"`
 		PermissionGroupIDs   *[]string `json:"permissionGroupIds"`
 	}
 	if err := decodeJSON(r, &req); err != nil {
@@ -267,6 +288,18 @@ func (a *App) handleUpdateUser(w http.ResponseWriter, r *http.Request) {
 	if role == "admin" {
 		mailboxLimitOverride = nil
 	}
+	var storageQuotaMB int
+	if err := a.db.QueryRowContext(r.Context(), `SELECT storage_quota_mb FROM users WHERE id=?`, id).Scan(&storageQuotaMB); err != nil {
+		respondError(w, http.StatusInternalServerError, "failed to load storage quota")
+		return
+	}
+	if req.StorageQuotaMB != nil {
+		storageQuotaMB = *req.StorageQuotaMB
+	}
+	if storageQuotaMB < 100 {
+		badRequest(w, errors.New("共享存储容量不能小于 100 MB"))
+		return
+	}
 	if err := a.ensureAdminRemains(r.Context(), id, role, disabled); err != nil {
 		badRequest(w, err)
 		return
@@ -311,8 +344,8 @@ func (a *App) handleUpdateUser(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	defer tx.Rollback()
-	if _, err := tx.ExecContext(r.Context(), `UPDATE users SET login_name=?, email=?, display_name=?, role=?, disabled=?, mailbox_limit_override=?, updated_at=? WHERE id=?`,
-		loginName, primaryEmail, displayName, role, boolInt(disabled), nullableInt(mailboxLimitOverride), a.now().UTC().Format(time.RFC3339Nano), id); err != nil {
+	if _, err := tx.ExecContext(r.Context(), `UPDATE users SET login_name=?, email=?, display_name=?, role=?, disabled=?, mailbox_limit_override=?, storage_quota_mb=?, updated_at=? WHERE id=?`,
+		loginName, primaryEmail, displayName, role, boolInt(disabled), nullableInt(mailboxLimitOverride), storageQuotaMB, a.now().UTC().Format(time.RFC3339Nano), id); err != nil {
 		if strings.Contains(strings.ToLower(err.Error()), "unique") {
 			badRequest(w, errors.New("主登录邮箱已被使用"))
 			return
@@ -409,11 +442,8 @@ func (a *App) handleDeleteUser(w http.ResponseWriter, r *http.Request) {
 	if target, err := a.userByID(r.Context(), id); err != nil {
 		respondError(w, http.StatusNotFound, "user not found")
 		return
-	} else if a.isDefaultAdminUser(target) {
-		badRequest(w, errors.New("default administrator cannot be deleted"))
-		return
-	} else if target.Role == "admin" && (current == nil || current.Role != "admin") {
-		respondError(w, http.StatusForbidden, "only administrators can delete administrator users")
+	} else if target.Role == "admin" {
+		badRequest(w, errors.New("administrator accounts cannot be deleted"))
 		return
 	}
 	if err := a.ensureAdminRemains(r.Context(), id, "user", true); err != nil {
@@ -553,6 +583,7 @@ func (a *App) handleListMailboxes(w http.ResponseWriter, r *http.Request) {
 		m.CreatedAt = parseTime(created)
 		items = append(items, m)
 	}
+	markPrimaryMailboxes(items)
 	respondJSON(w, http.StatusOK, map[string]any{"items": items})
 }
 
@@ -563,7 +594,6 @@ func (a *App) handleCreateMailbox(w http.ResponseWriter, r *http.Request) {
 		DisplayName    string `json:"displayName"`
 		Password       string `json:"password"`
 		QuotaMB        int    `json:"quotaMb"`
-		Role           string `json:"role"`
 		OwnerLoginName string `json:"ownerLoginName"`
 		OwnerEmail     string `json:"ownerEmail"`
 		UserID         string `json:"userId"`
@@ -580,20 +610,9 @@ func (a *App) handleCreateMailbox(w http.ResponseWriter, r *http.Request) {
 		badRequest(w, err)
 		return
 	}
-	if !hasMinimumPasswordLength(req.Password) {
-		badRequest(w, errors.New("password must be at least 6 characters"))
-		return
-	}
-	role := req.Role
-	if role == "" {
-		role = "user"
-	}
-	if role != "user" && role != "admin" {
-		badRequest(w, errors.New("invalid role"))
-		return
-	}
-	if role == "admin" {
-		respondError(w, http.StatusForbidden, "管理员只能由安装流程创建")
+	userID := strings.TrimSpace(req.UserID)
+	if req.QuotaMB < 0 {
+		badRequest(w, errors.New("quotaMb must be zero or greater"))
 		return
 	}
 
@@ -611,15 +630,14 @@ func (a *App) handleCreateMailbox(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	defer tx.Rollback()
-	now := a.now().UTC().Format(time.RFC3339Nano)
-	userID := strings.TrimSpace(req.UserID)
 	displayName := req.DisplayName
 	if displayName == "" {
 		displayName = address
 	}
+	var disabled, ownerStorageQuotaMB int
+	var passwordHash, ownerRole string
 	if userID != "" {
-		var disabled int
-		if err := tx.QueryRowContext(r.Context(), `SELECT disabled FROM users WHERE id=?`, userID).Scan(&disabled); err != nil {
+		if err := tx.QueryRowContext(r.Context(), `SELECT disabled,password_hash,role,storage_quota_mb FROM users WHERE id=?`, userID).Scan(&disabled, &passwordHash, &ownerRole, &ownerStorageQuotaMB); err != nil {
 			if errors.Is(err, sql.ErrNoRows) {
 				respondError(w, http.StatusNotFound, "owner user not found")
 			} else {
@@ -627,11 +645,11 @@ func (a *App) handleCreateMailbox(w http.ResponseWriter, r *http.Request) {
 			}
 			return
 		}
-		if intBool(disabled) {
-			badRequest(w, errors.New("owner user is disabled"))
+	} else {
+		if !hasMinimumPasswordLength(req.Password) {
+			badRequest(w, errors.New("password must be at least 6 characters"))
 			return
 		}
-	} else {
 		ownerEmailInput := req.OwnerEmail
 		if strings.TrimSpace(ownerEmailInput) == "" && strings.Contains(strings.TrimSpace(req.OwnerLoginName), "@") {
 			ownerEmailInput = req.OwnerLoginName
@@ -641,21 +659,20 @@ func (a *App) handleCreateMailbox(w http.ResponseWriter, r *http.Request) {
 			badRequest(w, err)
 			return
 		}
-		err = tx.QueryRowContext(r.Context(), `SELECT id FROM users WHERE email=? AND disabled=0`, ownerEmail).Scan(&userID)
+		err = tx.QueryRowContext(r.Context(), `SELECT id,disabled,password_hash,role,storage_quota_mb FROM users WHERE email=?`, ownerEmail).Scan(&userID, &disabled, &passwordHash, &ownerRole, &ownerStorageQuotaMB)
 		if errors.Is(err, sql.ErrNoRows) {
-			passwordHash, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
-			if err != nil {
+			hash, hashErr := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
+			if hashErr != nil {
 				respondError(w, http.StatusInternalServerError, "failed to hash password")
 				return
 			}
 			userID = newID("usr")
-			ownerDisplayName := displayName
-			if !strings.EqualFold(ownerEmail, address) {
-				ownerDisplayName = ownerEmail
-			}
-			_, err = tx.ExecContext(r.Context(), `INSERT INTO users(id,login_name,email,display_name,role,password_hash,disabled,created_at,updated_at)
-				VALUES(?,?,?,?,?,?,?,?,?)`, userID, ownerEmail, ownerEmail, ownerDisplayName, role, string(passwordHash), 0, now, now)
-			if err != nil {
+			passwordHash = string(hash)
+			ownerRole = "user"
+			ownerStorageQuotaMB = defaultUserStorageQuotaMB
+			now := a.now().UTC().Format(time.RFC3339Nano)
+			if _, err = tx.ExecContext(r.Context(), `INSERT INTO users(id,login_name,email,display_name,role,password_hash,disabled,storage_quota_mb,created_at,updated_at)
+				VALUES(?,?,?,?,?,?,?,?,?,?)`, userID, ownerEmail, ownerEmail, displayName, ownerRole, passwordHash, 0, ownerStorageQuotaMB, now, now); err != nil {
 				badRequest(w, err)
 				return
 			}
@@ -664,16 +681,26 @@ func (a *App) handleCreateMailbox(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 	}
-	if err := tx.Commit(); err != nil {
-		respondError(w, http.StatusInternalServerError, "failed to prepare owner user")
+	if intBool(disabled) {
+		badRequest(w, errors.New("owner user is disabled"))
 		return
 	}
-
-	mailboxID, err := a.createMailbox(r.Context(), userID, req.DomainID, local, displayName, req.Password, req.QuotaMB, "active")
+	quotaMB := req.QuotaMB
+	if quotaMB == 0 {
+		quotaMB = ownerStorageQuotaMB
+	}
+	if ownerRole == "admin" {
+		quotaMB = 0
+	}
+	mailboxID, err := a.createMailboxWithPasswordHashTx(r.Context(), tx, userID, req.DomainID, local, displayName, passwordHash, quotaMB, "active")
 	if err != nil {
 		badRequest(w, err)
 		return
 	}
+	if err := tx.Commit(); err != nil {
+		respondError(w, http.StatusInternalServerError, "failed to create mailbox")
+		return
+	}
 	m, err := a.mailboxByID(r.Context(), mailboxID)
 	if err != nil {
 		respondError(w, http.StatusInternalServerError, "failed to load mailbox")
@@ -699,8 +726,9 @@ func (a *App) handleUpdateMailbox(w http.ResponseWriter, r *http.Request) {
 		badRequest(w, errors.New("displayName is required"))
 		return
 	}
-	if req.QuotaMB <= 0 {
-		req.QuotaMB = 1024
+	if req.QuotaMB < 0 {
+		badRequest(w, errors.New("quotaMb must be zero or greater"))
+		return
 	}
 	status := strings.TrimSpace(req.Status)
 	if status == "" {
@@ -710,13 +738,27 @@ func (a *App) handleUpdateMailbox(w http.ResponseWriter, r *http.Request) {
 		badRequest(w, errors.New("invalid status"))
 		return
 	}
+	existingMailbox, err := a.mailboxByID(r.Context(), id)
+	if err != nil {
+		respondError(w, http.StatusNotFound, "mailbox not found")
+		return
+	}
+	if existingMailbox.Primary && status != existingMailbox.Status {
+		badRequest(w, errors.New("用户默认邮箱状态由所属账号管理，不能单独修改"))
+		return
+	}
 	userID := strings.TrimSpace(req.UserID)
 	if userID == "" {
 		badRequest(w, errors.New("userId is required"))
 		return
 	}
+	if existingMailbox.Primary && userID != existingMailbox.UserID {
+		badRequest(w, errors.New("用户默认邮箱归属由所属账号管理，不能单独修改"))
+		return
+	}
 	var disabled int
-	if err := a.db.QueryRowContext(r.Context(), `SELECT disabled FROM users WHERE id=?`, userID).Scan(&disabled); err != nil {
+	var ownerRole, ownerPasswordHash string
+	if err := a.db.QueryRowContext(r.Context(), `SELECT disabled,role,password_hash FROM users WHERE id=?`, userID).Scan(&disabled, &ownerRole, &ownerPasswordHash); err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
 			respondError(w, http.StatusNotFound, "owner user not found")
 		} else {
@@ -728,8 +770,11 @@ func (a *App) handleUpdateMailbox(w http.ResponseWriter, r *http.Request) {
 		badRequest(w, errors.New("owner user is disabled"))
 		return
 	}
-	res, err := a.db.ExecContext(r.Context(), `UPDATE mailboxes SET user_id=?,display_name=?,quota_mb=?,status=?,updated_at=? WHERE id=?`,
-		userID, displayName, req.QuotaMB, status, a.now().UTC().Format(time.RFC3339Nano), id)
+	if ownerRole == "admin" {
+		req.QuotaMB = 0
+	}
+	res, err := a.db.ExecContext(r.Context(), `UPDATE mailboxes SET user_id=?,display_name=?,password_hash=?,quota_mb=?,status=?,updated_at=? WHERE id=?`,
+		userID, displayName, ownerPasswordHash, req.QuotaMB, status, a.now().UTC().Format(time.RFC3339Nano), id)
 	if err != nil {
 		respondError(w, http.StatusInternalServerError, "failed to update mailbox")
 		return
@@ -749,6 +794,14 @@ func (a *App) handleUpdateMailbox(w http.ResponseWriter, r *http.Request) {
 
 func (a *App) handleDeleteMailbox(w http.ResponseWriter, r *http.Request) {
 	id := chi.URLParam(r, "id")
+	if err := a.ensureMailboxDeletable(r.Context(), id); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			respondError(w, http.StatusNotFound, "邮箱不存在或已被删除")
+		} else {
+			badRequest(w, err)
+		}
+		return
+	}
 	rows, err := a.db.QueryContext(r.Context(), `SELECT id FROM messages WHERE mailbox_id=?`, id)
 	if err != nil {
 		respondError(w, http.StatusInternalServerError, "加载邮箱邮件失败")
@@ -1118,15 +1171,15 @@ func (a *App) domainByID(ctx context.Context, id string) (*Domain, error) {
 }
 
 func (a *App) adminUserByID(ctx context.Context, id string) (*AdminUser, error) {
-	row := a.db.QueryRowContext(ctx, `SELECT u.id,u.login_name,u.email,u.display_name,u.role,u.disabled,u.two_factor_enabled,u.mailbox_limit_override,u.created_at,COUNT(mb.id),COALESCE(GROUP_CONCAT(mb.address), '')
+	row := a.db.QueryRowContext(ctx, `SELECT u.id,u.login_name,u.email,u.display_name,u.role,u.disabled,u.two_factor_enabled,u.mailbox_limit_override,u.storage_quota_mb,u.created_at,COUNT(mb.id),COALESCE(GROUP_CONCAT(mb.address), '')
 		FROM users u LEFT JOIN mailboxes mb ON mb.user_id=u.id
 		WHERE u.id=?
-		GROUP BY u.id,u.login_name,u.email,u.display_name,u.role,u.disabled,u.two_factor_enabled,u.mailbox_limit_override,u.created_at`, id)
+		GROUP BY u.id,u.login_name,u.email,u.display_name,u.role,u.disabled,u.two_factor_enabled,u.mailbox_limit_override,u.storage_quota_mb,u.created_at`, id)
 	var item AdminUser
 	var disabled, twoFactorEnabled int
 	var mailboxLimitOverride sql.NullInt64
 	var created, mailboxCSV string
-	if err := row.Scan(&item.ID, &item.LoginName, &item.Email, &item.DisplayName, &item.Role, &disabled, &twoFactorEnabled, &mailboxLimitOverride, &created, &item.MailboxCount, &mailboxCSV); err != nil {
+	if err := row.Scan(&item.ID, &item.LoginName, &item.Email, &item.DisplayName, &item.Role, &disabled, &twoFactorEnabled, &mailboxLimitOverride, &item.StorageQuotaMB, &created, &item.MailboxCount, &mailboxCSV); err != nil {
 		return nil, err
 	}
 	item.Disabled = intBool(disabled)
@@ -1191,9 +1244,48 @@ func (a *App) mailboxByID(ctx context.Context, id string) (*Mailbox, error) {
 		return nil, err
 	}
 	m.CreatedAt = parseTime(created)
+	if err := a.markMailboxPrimary(ctx, &m); err != nil {
+		return nil, err
+	}
 	return &m, nil
 }
 
+func markPrimaryMailboxes(items []Mailbox) {
+	primaryByUser := make(map[string]int)
+	for i := range items {
+		candidate, ok := primaryByUser[items[i].UserID]
+		if !ok || strings.EqualFold(items[i].Address, items[i].UserEmail) || (!strings.EqualFold(items[candidate].Address, items[candidate].UserEmail) && (items[i].CreatedAt.Before(items[candidate].CreatedAt) || (items[i].CreatedAt.Equal(items[candidate].CreatedAt) && items[i].ID < items[candidate].ID))) {
+			primaryByUser[items[i].UserID] = i
+		}
+	}
+	for _, index := range primaryByUser {
+		items[index].Primary = true
+	}
+}
+
+func (a *App) markMailboxPrimary(ctx context.Context, mailbox *Mailbox) error {
+	var primaryID string
+	err := a.db.QueryRowContext(ctx, `SELECT mb.id FROM mailboxes mb JOIN users u ON u.id=mb.user_id
+		WHERE mb.user_id=?
+		ORDER BY CASE WHEN lower(mb.address)=lower(u.email) THEN 0 ELSE 1 END, mb.created_at, mb.id LIMIT 1`, mailbox.UserID).Scan(&primaryID)
+	if err != nil {
+		return err
+	}
+	mailbox.Primary = mailbox.ID == primaryID
+	return nil
+}
+
+func (a *App) ensureMailboxDeletable(ctx context.Context, id string) error {
+	mailbox, err := a.mailboxByID(ctx, id)
+	if err != nil {
+		return err
+	}
+	if mailbox.Primary {
+		return errors.New("用户默认邮箱不能删除")
+	}
+	return nil
+}
+
 func (a *App) mailboxForUser(ctx context.Context, userID string) (*Mailbox, error) {
 	row := a.db.QueryRowContext(ctx, `SELECT id,user_id,domain_id,local_part,address,display_name,quota_mb,status,created_at FROM mailboxes WHERE user_id=? AND status='active' ORDER BY created_at LIMIT 1`, userID)
 	var m Mailbox

apps/api/internal/app/app.go

@@ -40,6 +40,12 @@ type App struct {
 	telegramDeliveryMu sync.Mutex
 }
 
+const (
+	defaultUserStorageQuotaMB  = 100
+	defaultAdminStorageQuotaMB = 1024
+	minimumStorageQuotaMB      = 100
+)
+
 func (a *App) config() Config {
 	a.cfgMu.RLock()
 	defer a.cfgMu.RUnlock()
@@ -97,6 +103,10 @@ func New(cfg Config, logger *slog.Logger) (*App, error) {
 		db.Close()
 		return nil, err
 	}
+	if err := a.normalizeAdministratorMailboxQuotas(context.Background()); err != nil {
+		db.Close()
+		return nil, err
+	}
 	if err := a.initializeTelegramNotificationDefaults(context.Background()); err != nil {
 		db.Close()
 		return nil, err
@@ -168,6 +178,7 @@ func (a *App) migrate(ctx context.Context) error {
 			two_factor_secret TEXT NOT NULL DEFAULT '',
 			two_factor_enabled INTEGER NOT NULL DEFAULT 0,
 			mailbox_limit_override INTEGER,
+			storage_quota_mb INTEGER NOT NULL DEFAULT 100,
 			disabled INTEGER NOT NULL DEFAULT 0,
 			created_at TEXT NOT NULL,
 			updated_at TEXT NOT NULL
@@ -317,6 +328,7 @@ func (a *App) migrate(ctx context.Context) error {
 			mailbox_id TEXT NOT NULL REFERENCES mailboxes(id) ON DELETE CASCADE,
 			name TEXT NOT NULL,
 			role TEXT NOT NULL,
+			icon TEXT NOT NULL DEFAULT 'folder',
 			sort_order INTEGER NOT NULL DEFAULT 0,
 			uid_validity INTEGER NOT NULL DEFAULT 0,
 			uid_next INTEGER NOT NULL DEFAULT 1,
@@ -672,6 +684,9 @@ func (a *App) migrate(ctx context.Context) error {
 	if err := a.migrateUserMailboxLimitOverride(ctx); err != nil {
 		return err
 	}
+	if err := a.migrateUserStorageQuota(ctx); err != nil {
+		return err
+	}
 	if err := a.migrateMailRulesBuilder(ctx); err != nil {
 		return err
 	}
@@ -690,6 +705,9 @@ func (a *App) migrate(ctx context.Context) error {
 	if err := a.migrateFolderSortOrder(ctx); err != nil {
 		return err
 	}
+	if err := a.migrateFolderIcons(ctx); err != nil {
+		return err
+	}
 	if err := a.migrateExternalIMAP(ctx); err != nil {
 		return err
 	}
@@ -1331,6 +1349,39 @@ func (a *App) migrateUserMailboxLimitOverride(ctx context.Context) error {
 	return err
 }
 
+func (a *App) migrateUserStorageQuota(ctx context.Context) error {
+	rows, err := a.db.QueryContext(ctx, `PRAGMA table_info(users)`)
+	if err != nil {
+		return err
+	}
+	hasColumn := false
+	for rows.Next() {
+		var cid int
+		var name, typ string
+		var notnull int
+		var dflt any
+		var pk int
+		if err := rows.Scan(&cid, &name, &typ, &notnull, &dflt, &pk); err != nil {
+			rows.Close()
+			return err
+		}
+		if name == "storage_quota_mb" {
+			hasColumn = true
+		}
+	}
+	if err := rows.Close(); err != nil {
+		return err
+	}
+	if hasColumn {
+		return nil
+	}
+	if _, err := a.db.ExecContext(ctx, `ALTER TABLE users ADD COLUMN storage_quota_mb INTEGER NOT NULL DEFAULT 100`); err != nil {
+		return err
+	}
+	_, err = a.db.ExecContext(ctx, `UPDATE users SET storage_quota_mb=? WHERE role='admin'`, defaultAdminStorageQuotaMB)
+	return err
+}
+
 func (a *App) migrateMessagesForUnregistered(ctx context.Context) error {
 	rows, err := a.db.QueryContext(ctx, `PRAGMA table_info(messages)`)
 	if err != nil {
@@ -1509,8 +1560,8 @@ func (a *App) seed(ctx context.Context) error {
 	}
 	now := a.now().UTC().Format(time.RFC3339Nano)
 	userID := newID("usr")
-	if _, err := a.db.ExecContext(ctx, `INSERT INTO users(id,login_name,email,display_name,role,password_hash,disabled,created_at,updated_at)
-		VALUES(?,?,?,?,?,?,?,?,?)`, userID, adminEmail, adminEmail, "NewSzxcn Admin", "admin", string(passwordHash), 0, now, now); err != nil {
+	if _, err := a.db.ExecContext(ctx, `INSERT INTO users(id,login_name,email,display_name,role,password_hash,disabled,storage_quota_mb,created_at,updated_at)
+		VALUES(?,?,?,?,?,?,?,?,?,?)`, userID, adminEmail, adminEmail, "NewSzxcn Admin", "admin", string(passwordHash), 0, defaultAdminStorageQuotaMB, now, now); err != nil {
 		return err
 	}
 	a.log.Warn("created default administrator; change LANQIN_ADMIN_PASSWORD in production", "email", adminEmail)
@@ -1531,7 +1582,7 @@ func (a *App) seed(ctx context.Context) error {
 	}
 
 	// Create mailbox for admin
-	mailboxID, err := a.createMailboxWithPasswordHash(ctx, userID, domainID, localPart, adminEmail, string(passwordHash), 1024, "active")
+	mailboxID, err := a.createMailboxWithPasswordHash(ctx, userID, domainID, localPart, adminEmail, string(passwordHash), 0, "active")
 	if err != nil {
 		return err
 	}
@@ -1652,7 +1703,7 @@ func (a *App) migrateConfiguredAdministratorIdentity(ctx context.Context) error
 		if !errors.Is(err, sql.ErrNoRows) {
 			return err
 		}
-		mailboxID, err = a.createMailboxWithPasswordHashTx(ctx, tx, keeper.ID, domainID, localPart, adminEmail, keeper.PasswordHash, 1024, "active")
+		mailboxID, err = a.createMailboxWithPasswordHashTx(ctx, tx, keeper.ID, domainID, localPart, adminEmail, keeper.PasswordHash, 0, "active")
 		if err != nil {
 			return err
 		}
@@ -1867,8 +1918,15 @@ func (a *App) createMailboxWithPasswordHashTx(ctx context.Context, tx *sql.Tx, u
 	if localPart == "" {
 		return "", errors.New("invalid local part")
 	}
-	if quotaMB <= 0 {
-		quotaMB = 1024
+	if quotaMB < 0 {
+		return "", errors.New("quotaMb must be zero or greater")
+	}
+	var ownerRole string
+	if err := tx.QueryRowContext(ctx, `SELECT role FROM users WHERE id=?`, userID).Scan(&ownerRole); err != nil {
+		return "", err
+	}
+	if ownerRole == "admin" {
+		quotaMB = 0
 	}
 	if status == "" {
 		status = "active"
@@ -1901,6 +1959,17 @@ func (a *App) createMailboxWithPasswordHashTx(ctx context.Context, tx *sql.Tx, u
 	return id, nil
 }
 
+func (a *App) normalizeAdministratorMailboxQuotas(ctx context.Context) error {
+	now := a.now().UTC().Format(time.RFC3339Nano)
+	if _, err := a.db.ExecContext(ctx, `UPDATE users SET storage_quota_mb=CASE WHEN role='admin' THEN ? ELSE ? END, updated_at=? WHERE storage_quota_mb<?`, defaultAdminStorageQuotaMB, defaultUserStorageQuotaMB, now, minimumStorageQuotaMB); err != nil {
+		return err
+	}
+	_, err := a.db.ExecContext(ctx, `UPDATE mailboxes
+		SET quota_mb=0, updated_at=?
+		WHERE quota_mb<>0 AND user_id IN (SELECT id FROM users WHERE role='admin')`, now)
+	return err
+}
+
 func (a *App) seedWelcomeMessage(ctx context.Context, mailboxID string) error {
 	cfg := a.config()
 	folderID, err := a.ensureFolder(ctx, mailboxID, "Inbox")

apps/api/internal/app/app_test.go

@@ -363,6 +363,147 @@ func createTestMailbox(t *testing.T, admin *testClient, domainID, localPart, dis
 	return mailbox
 }
 
+func TestAdminMailboxCreationUsesOwnerPasswordAndQuota(t *testing.T) {
+	a := newTestApp(t)
+	ts := httptest.NewServer(a.Router())
+	defer ts.Close()
+	admin := &testClient{t: t, server: ts}
+	var login map[string]any
+	if code := admin.do("POST", "/api/auth/login", map[string]string{"email": "admin@lanqin.local", "password": "ChangeMe123!"}, &login); code != http.StatusOK {
+		t.Fatalf("login code=%d body=%v", code, login)
+	}
+	adminUser, adminMailbox := defaultAdminUserAndMailbox(t, a)
+	adminDetails, err := a.adminUserByID(context.Background(), adminUser.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if adminDetails.StorageQuotaMB != defaultAdminStorageQuotaMB {
+		t.Fatalf("administrator storage quota=%d, want %d", adminDetails.StorageQuotaMB, defaultAdminStorageQuotaMB)
+	}
+	domainID := mustDefaultDomainID(t, a)
+
+	var secondary Mailbox
+	if code := admin.do("POST", "/api/admin/mailboxes", map[string]any{
+		"domainId":  domainID,
+		"localPart": "admin-secondary",
+		"userId":    adminUser.ID,
+	}, &secondary); code != http.StatusCreated {
+		t.Fatalf("create admin secondary mailbox code=%d", code)
+	}
+	if secondary.QuotaMB != 0 {
+		t.Fatalf("admin secondary quota=%d, want unlimited", secondary.QuotaMB)
+	}
+
+	var primaryHash, secondaryHash string
+	if err := a.db.QueryRow(`SELECT password_hash FROM mailboxes WHERE id=?`, adminMailbox.ID).Scan(&primaryHash); err != nil {
+		t.Fatal(err)
+	}
+	if err := a.db.QueryRow(`SELECT password_hash FROM mailboxes WHERE id=?`, secondary.ID).Scan(&secondaryHash); err != nil {
+		t.Fatal(err)
+	}
+	if primaryHash != secondaryHash {
+		t.Fatal("admin secondary mailbox did not inherit the owner password")
+	}
+
+	var regular AdminUser
+	if code := admin.do("POST", "/api/admin/users", map[string]any{
+		"email":       "owner@lanqin.local",
+		"displayName": "Owner",
+		"password":    "OwnerPassword123!",
+		"role":        "user",
+	}, &regular); code != http.StatusCreated {
+		t.Fatalf("create regular owner code=%d", code)
+	}
+	if regular.MailboxCount != 1 {
+		t.Fatalf("new account mailbox count=%d, want one protected primary mailbox", regular.MailboxCount)
+	}
+	if regular.StorageQuotaMB != defaultUserStorageQuotaMB {
+		t.Fatalf("regular account storage quota=%d, want %d", regular.StorageQuotaMB, defaultUserStorageQuotaMB)
+	}
+	if _, err := a.mailboxByAddress(context.Background(), regular.Email); err != nil {
+		t.Fatalf("new account primary mailbox missing: %v", err)
+	}
+	var primaryStatusErr map[string]any
+	primaryMailbox, err := a.mailboxByAddress(context.Background(), regular.Email)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if code := admin.do("POST", "/api/admin/mailboxes/"+primaryMailbox.ID, map[string]any{
+		"userId": regular.ID, "displayName": primaryMailbox.DisplayName, "quotaMb": primaryMailbox.QuotaMB, "status": "disabled",
+	}, &primaryStatusErr); code != http.StatusBadRequest {
+		t.Fatalf("primary mailbox status update code=%d body=%v", code, primaryStatusErr)
+	}
+	var regularMailbox Mailbox
+	if code := admin.do("POST", "/api/admin/mailboxes", map[string]any{
+		"domainId":  domainID,
+		"localPart": "owner-secondary",
+		"userId":    regular.ID,
+	}, &regularMailbox); code != http.StatusCreated {
+		t.Fatalf("create regular secondary mailbox code=%d", code)
+	}
+	if regularMailbox.QuotaMB != defaultUserStorageQuotaMB {
+		t.Fatalf("regular secondary quota=%d, want %d", regularMailbox.QuotaMB, defaultUserStorageQuotaMB)
+	}
+	var userHash, mailboxHash string
+	if err := a.db.QueryRow(`SELECT password_hash FROM users WHERE id=?`, regular.ID).Scan(&userHash); err != nil {
+		t.Fatal(err)
+	}
+	if err := a.db.QueryRow(`SELECT password_hash FROM mailboxes WHERE id=?`, regularMailbox.ID).Scan(&mailboxHash); err != nil {
+		t.Fatal(err)
+	}
+	if userHash != mailboxHash {
+		t.Fatal("regular secondary mailbox did not inherit the owner password")
+	}
+}
+
+func TestAdministratorAccountAndPrimaryMailboxesCannotBeDeleted(t *testing.T) {
+	a := newTestApp(t)
+	ts := httptest.NewServer(a.Router())
+	defer ts.Close()
+	admin := &testClient{t: t, server: ts}
+	var login map[string]any
+	if code := admin.do("POST", "/api/auth/login", map[string]string{"email": "admin@lanqin.local", "password": "ChangeMe123!"}, &login); code != http.StatusOK {
+		t.Fatalf("login code=%d body=%v", code, login)
+	}
+	adminUser, adminMailbox := defaultAdminUserAndMailbox(t, a)
+	var errBody map[string]any
+	if code := admin.do("DELETE", "/api/admin/users/"+adminUser.ID, nil, &errBody); code != http.StatusBadRequest {
+		t.Fatalf("administrator account delete code=%d body=%v", code, errBody)
+	}
+	if code := admin.do("DELETE", "/api/admin/mailboxes/"+adminMailbox.ID, nil, &errBody); code != http.StatusBadRequest {
+		t.Fatalf("administrator primary mailbox delete code=%d body=%v", code, errBody)
+	}
+	if code := admin.do("POST", "/api/admin/users/"+adminUser.ID, map[string]any{
+		"email": adminUser.Email, "displayName": adminUser.DisplayName, "role": "admin", "disabled": false, "storageQuotaMb": 99,
+	}, &errBody); code != http.StatusBadRequest {
+		t.Fatalf("storage quota below 100 MB code=%d body=%v", code, errBody)
+	}
+	var updatedAdmin AdminUser
+	if code := admin.do("POST", "/api/admin/users/"+adminUser.ID, map[string]any{
+		"email": adminUser.Email, "displayName": adminUser.DisplayName, "role": "admin", "disabled": false, "storageQuotaMb": 100,
+	}, &updatedAdmin); code != http.StatusOK || updatedAdmin.StorageQuotaMB != 100 {
+		t.Fatalf("administrator storage quota code=%d user=%+v", code, updatedAdmin)
+	}
+
+	var regular AdminUser
+	if code := admin.do("POST", "/api/admin/users", map[string]any{
+		"email": "protected-primary@lanqin.local", "displayName": "Protected Primary", "role": "user", "password": "Password123!",
+	}, &regular); code != http.StatusCreated {
+		t.Fatalf("create regular user code=%d user=%+v", code, regular)
+	}
+	primary, err := a.mailboxByAddress(context.Background(), regular.Email)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if code := admin.do("DELETE", "/api/admin/mailboxes/"+primary.ID, nil, &errBody); code != http.StatusBadRequest {
+		t.Fatalf("regular primary mailbox delete code=%d body=%v", code, errBody)
+	}
+	secondary := createTestMailbox(t, admin, primary.DomainID, "deletable-secondary", "Secondary", "", map[string]any{"userId": regular.ID})
+	if code := admin.do("DELETE", "/api/admin/mailboxes/"+secondary.ID, nil, &errBody); code != http.StatusOK {
+		t.Fatalf("secondary mailbox delete code=%d body=%v", code, errBody)
+	}
+}
+
 func createTestAPIToken(t *testing.T, client *testClient, name string) string {
 	return createTestAPITokenWithScopes(t, client, name, nil)
 }
@@ -1050,6 +1191,191 @@ func TestMailRulesForwardingAction(t *testing.T) {
 	}
 }
 
+func TestMailRulesExactSenderCustomFolderAndStopProcessing(t *testing.T) {
+	a := newTestApp(t)
+	ts := httptest.NewServer(a.Router())
+	defer ts.Close()
+	admin := &testClient{t: t, server: ts}
+
+	var login map[string]any
+	if code := admin.do("POST", "/api/auth/login", map[string]string{"email": "admin@lanqin.local", "password": "ChangeMe123!"}, &login); code != http.StatusOK {
+		t.Fatalf("admin login code=%d", code)
+	}
+	domainID := mustDefaultDomainID(t, a)
+	sender := createTestMailbox(t, admin, domainID, "rule-exact-sender", "Sender With Name", "Password123!", nil)
+	recipient := createTestMailbox(t, admin, domainID, "rule-custom-target", "Rule Target", "Password123!", nil)
+
+	rcpt := &testClient{t: t, server: ts}
+	if code := rcpt.do("POST", "/api/auth/login", map[string]string{"email": recipient.Address, "password": "Password123!"}, &login); code != http.StatusOK {
+		t.Fatalf("recipient login=%d", code)
+	}
+	var bad map[string]any
+	if code := rcpt.do("POST", "/api/me/rules", map[string]any{
+		"mailboxId":  recipient.ID,
+		"conditions": []map[string]string{{"field": "size", "operator": "contains", "value": "10"}},
+		"actions":    []map[string]string{{"type": "archive"}},
+	}, &bad); code != http.StatusBadRequest {
+		t.Fatalf("invalid field operator should be rejected code=%d body=%v", code, bad)
+	}
+
+	createRule := func(name string, action map[string]string, stop bool) {
+		t.Helper()
+		var rule MailRule
+		if code := rcpt.do("POST", "/api/me/rules", map[string]any{
+			"mailboxId":      recipient.ID,
+			"name":           name,
+			"conditions":     []map[string]string{{"field": "from", "operator": "equals", "value": sender.Address}},
+			"actions":        []map[string]string{action},
+			"stopProcessing": stop,
+		}, &rule); code != http.StatusCreated {
+			t.Fatalf("create rule %s code=%d rule=%+v", name, code, rule)
+		}
+	}
+	createRule("fallback archive", map[string]string{"type": "archive"}, false)
+	createRule("Netflix folder", map[string]string{"type": "move", "value": "Netflix 验证码"}, true)
+
+	senderClient := &testClient{t: t, server: ts}
+	if code := senderClient.do("POST", "/api/auth/login", map[string]string{"email": sender.Address, "password": "Password123!"}, &login); code != http.StatusOK {
+		t.Fatalf("sender login=%d", code)
+	}
+	var sent MailMessage
+	if code := senderClient.do("POST", "/api/mail/send", map[string]any{"to": []string{recipient.Address}, "subject": "Netflix code", "text": "123456"}, &sent); code != http.StatusCreated {
+		t.Fatalf("send code=%d sent=%+v", code, sent)
+	}
+	var custom struct {
+		Items []MailMessage `json:"items"`
+	}
+	if code := rcpt.do("GET", "/api/mail/messages?mailboxId="+recipient.ID+"&folder="+url.QueryEscape("Netflix 验证码"), nil, &custom); code != http.StatusOK || len(custom.Items) != 1 {
+		t.Fatalf("custom rule folder code=%d items=%+v", code, custom.Items)
+	}
+	var archived struct {
+		Items []MailMessage `json:"items"`
+	}
+	if code := rcpt.do("GET", "/api/mail/messages?mailboxId="+recipient.ID+"&folder=Archive", nil, &archived); code != http.StatusOK || len(archived.Items) != 0 {
+		t.Fatalf("stop processing should prevent fallback archive code=%d items=%+v", code, archived.Items)
+	}
+	var icon string
+	if err := a.db.QueryRow(`SELECT icon FROM folders WHERE mailbox_id=? AND name=?`, recipient.ID, "Netflix 验证码").Scan(&icon); err != nil || icon != "netflix" {
+		t.Fatalf("rule-created folder icon=%q err=%v", icon, err)
+	}
+}
+
+func TestFolderIconForName(t *testing.T) {
+	tests := []struct {
+		name      string
+		requested string
+		want      string
+	}{
+		{name: "Netflix 验证码", requested: "auto", want: "netflix"},
+		{name: "ChatGPT 通知", want: "chatgpt"},
+		{name: "OpenAI 账单", want: "chatgpt"},
+		{name: "项目归档", want: "briefcase"},
+		{name: "其他", want: "folder"},
+		{name: "Netflix", requested: "heart", want: "heart"},
+		{name: "Netflix", requested: "unknown", want: "folder"},
+		{name: "Custom", requested: "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=", want: "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII="},
+		{name: "Egypt archive", want: "folder"},
+		{name: "Custom", requested: "data:image/svg+xml;base64,PHN2Zz4=", want: "folder"},
+		{name: "Custom", requested: "data:image/png;base64,SGVsbG8=", want: "folder"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name+"/"+tt.requested, func(t *testing.T) {
+			if got := folderIconForName(tt.name, tt.requested); got != tt.want {
+				t.Fatalf("folderIconForName(%q, %q)=%q want %q", tt.name, tt.requested, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestRuleFolderAutoIconPreservesManualSelection(t *testing.T) {
+	a := newTestApp(t)
+	ctx := context.Background()
+	admin := &testClient{t: t, server: httptest.NewServer(a.Router())}
+	defer admin.server.Close()
+
+	var login map[string]any
+	if code := admin.do("POST", "/api/auth/login", map[string]string{"email": "admin@lanqin.local", "password": "ChangeMe123!"}, &login); code != http.StatusOK {
+		t.Fatalf("admin login code=%d", code)
+	}
+	domainID := createTestDomain(t, admin, "manual-icon.test")
+	mailbox := createTestMailbox(t, admin, domainID.ID, "rules", "Rules", "Password123!", nil)
+	if _, err := a.ensureCustomFolder(ctx, mailbox.ID, "Netflix", "heart"); err != nil {
+		t.Fatalf("create custom folder: %v", err)
+	}
+	if _, err := a.ensureCustomFolder(ctx, mailbox.ID, "Netflix", "auto"); err != nil {
+		t.Fatalf("reuse custom folder: %v", err)
+	}
+	var icon string
+	if err := a.db.QueryRowContext(ctx, `SELECT icon FROM folders WHERE mailbox_id=? AND name='Netflix'`, mailbox.ID).Scan(&icon); err != nil || icon != "heart" {
+		t.Fatalf("manual icon should be preserved icon=%q err=%v", icon, err)
+	}
+}
+
+func TestMailRuleApplyExistingWhenDisabledExcludesSent(t *testing.T) {
+	a := newTestApp(t)
+	ts := httptest.NewServer(a.Router())
+	defer ts.Close()
+	admin := &testClient{t: t, server: ts}
+
+	var login map[string]any
+	if code := admin.do("POST", "/api/auth/login", map[string]string{"email": "admin@lanqin.local", "password": "ChangeMe123!"}, &login); code != http.StatusOK {
+		t.Fatalf("admin login code=%d", code)
+	}
+	domainID := mustDefaultDomainID(t, a)
+	sender := createTestMailbox(t, admin, domainID, "rule-existing-sender", "Existing Sender", "Password123!", nil)
+	recipient := createTestMailbox(t, admin, domainID, "rule-existing-recipient", "Existing Recipient", "Password123!", nil)
+	subject := "same inbound and sent subject"
+
+	senderClient := &testClient{t: t, server: ts}
+	if code := senderClient.do("POST", "/api/auth/login", map[string]string{"email": sender.Address, "password": "Password123!"}, &login); code != http.StatusOK {
+		t.Fatalf("sender login=%d", code)
+	}
+	var incomingSend MailMessage
+	if code := senderClient.do("POST", "/api/mail/send", map[string]any{"to": []string{recipient.Address}, "subject": subject, "text": "incoming"}, &incomingSend); code != http.StatusCreated {
+		t.Fatalf("incoming send code=%d", code)
+	}
+
+	rcpt := &testClient{t: t, server: ts}
+	if code := rcpt.do("POST", "/api/auth/login", map[string]string{"email": recipient.Address, "password": "Password123!"}, &login); code != http.StatusOK {
+		t.Fatalf("recipient login=%d", code)
+	}
+	var outgoing MailMessage
+	if code := rcpt.do("POST", "/api/mail/send", map[string]any{"to": []string{sender.Address}, "subject": subject, "text": "outgoing"}, &outgoing); code != http.StatusCreated {
+		t.Fatalf("outgoing send code=%d", code)
+	}
+	var rule MailRule
+	if code := rcpt.do("POST", "/api/me/rules", map[string]any{
+		"mailboxId":       recipient.ID,
+		"name":            "existing disabled",
+		"conditions":      []map[string]string{{"field": "subject", "operator": "equals", "value": subject}},
+		"actions":         []map[string]string{{"type": "star"}},
+		"applyToExisting": true,
+		"enabled":         false,
+	}, &rule); code != http.StatusCreated || rule.AppliedExistingCount != 1 || rule.Enabled {
+		t.Fatalf("create disabled existing rule code=%d rule=%+v", code, rule)
+	}
+	var inboundStarred, sentStarred int
+	if err := a.db.QueryRow(`SELECT is_starred FROM messages WHERE mailbox_id=? AND subject=? AND folder_id IN (SELECT id FROM folders WHERE mailbox_id=? AND lower(name)='inbox')`, recipient.ID, subject, recipient.ID).Scan(&inboundStarred); err != nil {
+		t.Fatal(err)
+	}
+	if err := a.db.QueryRow(`SELECT is_starred FROM messages WHERE id=?`, outgoing.ID).Scan(&sentStarred); err != nil {
+		t.Fatal(err)
+	}
+	if inboundStarred != 1 || sentStarred != 0 {
+		t.Fatalf("existing rule starred inbound=%d sent=%d", inboundStarred, sentStarred)
+	}
+}
+
+func TestRuleAttachmentConditionUsesFilenameOnly(t *testing.T) {
+	msg := ruleMessage{AttachmentNames: "notes.txt"}
+	if ruleConditionMatches(MailRuleCondition{Field: "attachment", Operator: "contains", Value: "pdf"}, msg) {
+		t.Fatal("attachment condition must not match MIME type or unrelated extension")
+	}
+	if !ruleConditionMatches(MailRuleCondition{Field: "attachment", Operator: "ends-with", Value: ".txt"}, msg) {
+		t.Fatal("attachment condition should match filename")
+	}
+}
+
 func TestMailRulesMailboxIsolation(t *testing.T) {
 	a := newTestApp(t)
 	ts := httptest.NewServer(a.Router())
@@ -1389,6 +1715,13 @@ func TestOpenRegistrationAtomicallyCreatesLoginUserAndMailbox(t *testing.T) {
 	if code := client.do("POST", "/api/auth/register", registration, &registered); code != http.StatusCreated || registered.User.Email != "newuser@lanqin.local" || registered.User.Role != "user" {
 		t.Fatalf("register code=%d user=%+v", code, registered.User)
 	}
+	var storageQuotaMB int
+	if err := a.db.QueryRow(`SELECT storage_quota_mb FROM users WHERE id=?`, registered.User.ID).Scan(&storageQuotaMB); err != nil {
+		t.Fatal(err)
+	}
+	if storageQuotaMB != defaultUserStorageQuotaMB {
+		t.Fatalf("registered account storage quota=%d, want %d", storageQuotaMB, defaultUserStorageQuotaMB)
+	}
 	var me struct {
 		User User `json:"user"`
 	}
@@ -2293,7 +2626,7 @@ func TestCustomMailFoldersCreateAndMove(t *testing.T) {
 	}
 
 	var custom MailFolder
-	if code := admin.do("POST", "/api/mail/folders", map[string]string{"name": "客户归档"}, &custom); code != http.StatusCreated || custom.Name != "客户归档" || custom.Role != "客户归档" {
+	if code := admin.do("POST", "/api/mail/folders", map[string]string{"name": "客户归档", "icon": "netflix"}, &custom); code != http.StatusCreated || custom.Name != "客户归档" || custom.Role != "客户归档" || custom.Icon != "netflix" {
 		t.Fatalf("custom folder create code=%d folder=%+v", code, custom)
 	}
 	var folders struct {
@@ -2302,6 +2635,15 @@ func TestCustomMailFoldersCreateAndMove(t *testing.T) {
 	if code := admin.do("GET", "/api/mail/folders", nil, &folders); code != http.StatusOK || !folderListContains(folders.Items, "客户归档") {
 		t.Fatalf("folder list code=%d items=%+v", code, folders.Items)
 	}
+	foundIcon := ""
+	for _, folder := range folders.Items {
+		if folder.Name == "客户归档" {
+			foundIcon = folder.Icon
+		}
+	}
+	if foundIcon != "netflix" {
+		t.Fatalf("folder icon=%q, want netflix", foundIcon)
+	}
 
 	var sent MailMessage
 	if code := admin.do("POST", "/api/mail/send", map[string]any{"to": []string{"person@example.test"}, "subject": "custom folder", "text": "body"}, &sent); code != http.StatusCreated {
@@ -2613,6 +2955,25 @@ func TestMailSendQueuesSMTPFailureForRetry(t *testing.T) {
 	}
 }
 
+func TestForwardingVerificationPageDoesNotLinkToMailbox(t *testing.T) {
+	a := newTestApp(t)
+	recorder := httptest.NewRecorder()
+
+	a.renderForwardingVerificationPage(recorder, http.StatusOK, true, "friend@example.test", "该邮箱已通过转发验证")
+	body := recorder.Body.String()
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("status=%d", recorder.Code)
+	}
+	for _, forbidden := range []string{`href="/"`, "返回邮箱", "登录"} {
+		if strings.Contains(body, forbidden) {
+			t.Fatalf("verification page contains forbidden navigation %q: %s", forbidden, body)
+		}
+	}
+	if !strings.Contains(body, "可以关闭此页面") {
+		t.Fatalf("verification page is missing close guidance: %s", body)
+	}
+}
+
 func TestInboundForwardingSettingsAndDelivery(t *testing.T) {
 	a := newTestApp(t)
 	stopTestWorkers(a)
@@ -2756,8 +3117,20 @@ func TestInboundForwardingSettingsAndDelivery(t *testing.T) {
 	if err := a.db.QueryRow(`SELECT recipients_json FROM send_queue WHERE source=? AND sent_message_id=?`, sendSourceForwarding, secondID).Scan(&recipientsJSON); err != nil {
 		t.Fatal(err)
 	}
-	if !strings.Contains(recipientsJSON, "mailbox-forward@example.test") || !strings.Contains(recipientsJSON, "mailbox-forward-two@example.test") || strings.Contains(recipientsJSON, "account-forward@example.test") || strings.Contains(recipientsJSON, "account-forward-two@example.test") {
-		t.Fatalf("mailbox forwarding should override account target, recipients=%s", recipientsJSON)
+	if !strings.Contains(recipientsJSON, "account-forward@example.test") || !strings.Contains(recipientsJSON, "account-forward-two@example.test") || !strings.Contains(recipientsJSON, "mailbox-forward@example.test") || !strings.Contains(recipientsJSON, "mailbox-forward-two@example.test") {
+		t.Fatalf("mailbox forwarding should include account and mailbox targets, recipients=%s", recipientsJSON)
+	}
+
+	if code := admin.do("POST", "/api/me/forwarding/account", map[string]any{"targetEmails": []string{"account-forward-two@example.test"}}, &settings); code != http.StatusOK {
+		t.Fatalf("update account forwarding after mailbox forwarding code=%d settings=%+v", code, settings)
+	}
+	raw = []byte("From: sender@example.test\r\nTo: admin@lanqin.local\r\nSubject: account changed\r\nMessage-ID: <account-changed@example.test>\r\n\r\nbody")
+	thirdID := insertInbound("<account-changed@example.test>", "account changed", raw)
+	if err := a.db.QueryRow(`SELECT recipients_json FROM send_queue WHERE source=? AND sent_message_id=?`, sendSourceForwarding, thirdID).Scan(&recipientsJSON); err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(recipientsJSON, "account-forward@example.test") || !strings.Contains(recipientsJSON, "account-forward-two@example.test") || !strings.Contains(recipientsJSON, "mailbox-forward@example.test") || !strings.Contains(recipientsJSON, "mailbox-forward-two@example.test") {
+		t.Fatalf("changing account forwarding should preserve mailbox targets, recipients=%s", recipientsJSON)
 	}
 
 	loopRaw := []byte("From: sender@example.test\r\nTo: admin@lanqin.local\r\nSubject: loop\r\n" + forwardingHeaderName + ": mail.example.test\r\nMessage-ID: <forward-loop@example.test>\r\n\r\nbody")
@@ -2766,8 +3139,8 @@ func TestInboundForwardingSettingsAndDelivery(t *testing.T) {
 	if err := a.db.QueryRow(`SELECT COUNT(1) FROM send_queue WHERE source=?`, sendSourceForwarding).Scan(&queueCount); err != nil {
 		t.Fatal(err)
 	}
-	if queueCount != 2 {
-		t.Fatalf("forwarding queue count=%d, want 2", queueCount)
+	if queueCount != 3 {
+		t.Fatalf("forwarding queue count=%d, want 3", queueCount)
 	}
 }
 
@@ -2952,20 +3325,45 @@ func TestOpenAPIDomainAndMailboxCRUD(t *testing.T) {
 	if code := openAdmin.do("POST", "/api/open/domains/"+domain.ID, map[string]string{"status": "active"}, &domain); code != http.StatusOK {
 		t.Fatalf("reactivate open api domain code=%d domain=%+v", code, domain)
 	}
+	var owner AdminUser
+	if code := admin.do("POST", "/api/admin/users", map[string]any{
+		"email": "open-api-owner@lanqin.local", "displayName": "Open API Owner", "role": "user", "password": "Password123!",
+	}, &owner); code != http.StatusCreated {
+		t.Fatalf("create open api mailbox owner code=%d owner=%+v", code, owner)
+	}
 
 	var mailbox Mailbox
 	if code := openAdmin.do("POST", "/api/open/mailboxes", map[string]any{
 		"domainId":    domain.ID,
 		"localPart":   "api-user",
 		"displayName": "API User",
-		"password":    "Password123!",
+		"password":    "DifferentPassword123!",
 		"quotaMb":     256,
+		"userId":      owner.ID,
 	}, &mailbox); code != http.StatusCreated {
 		t.Fatalf("create open api mailbox code=%d mailbox=%+v", code, mailbox)
 	}
+	ownerPrimary, err := a.mailboxByAddress(context.Background(), owner.Email)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var protectedMailboxErr map[string]any
+	if code := openAdmin.do("POST", "/api/open/mailboxes/"+ownerPrimary.ID, map[string]any{"status": "disabled"}, &protectedMailboxErr); code != http.StatusBadRequest {
+		t.Fatalf("open api primary mailbox status update code=%d body=%v", code, protectedMailboxErr)
+	}
 	if mailbox.Address != "api-user@api.example.test" || mailbox.QuotaMB != 256 {
 		t.Fatalf("mailbox=%+v", mailbox)
 	}
+	var ownerPasswordHash, mailboxPasswordHash string
+	if err := a.db.QueryRowContext(context.Background(), `SELECT password_hash FROM users WHERE id=?`, owner.ID).Scan(&ownerPasswordHash); err != nil {
+		t.Fatal(err)
+	}
+	if err := a.db.QueryRowContext(context.Background(), `SELECT password_hash FROM mailboxes WHERE id=?`, mailbox.ID).Scan(&mailboxPasswordHash); err != nil {
+		t.Fatal(err)
+	}
+	if mailboxPasswordHash != ownerPasswordHash {
+		t.Fatal("open api mailbox did not inherit the owner password")
+	}
 	var mailboxes struct {
 		Items []Mailbox `json:"items"`
 	}
@@ -2982,6 +3380,9 @@ func TestOpenAPIDomainAndMailboxCRUD(t *testing.T) {
 	if updated.DisplayName != "Renamed API User" || updated.QuotaMB != 512 || updated.Status != "disabled" {
 		t.Fatalf("updated mailbox=%+v", updated)
 	}
+	if code := openAdmin.do("POST", "/api/open/mailboxes/"+mailbox.ID, map[string]any{"status": "active"}, &updated); code != http.StatusOK || updated.QuotaMB != 512 {
+		t.Fatalf("open api mailbox omitted quota should preserve 512 MB: code=%d mailbox=%+v", code, updated)
+	}
 	var ok map[string]any
 	if code := openAdmin.do("DELETE", "/api/open/mailboxes/"+mailbox.ID, nil, &ok); code != http.StatusOK {
 		t.Fatalf("delete open api mailbox code=%d body=%v", code, ok)
@@ -4480,6 +4881,49 @@ func TestSubmissionTLSConfigReloadsCertificateFiles(t *testing.T) {
 	}
 }
 
+func TestSubmissionLoginAuthenticationWithAndWithoutInitialResponse(t *testing.T) {
+	a := newTestApp(t)
+	for _, withInitialResponse := range []bool{false, true} {
+		t.Run(fmt.Sprintf("initial-response-%t", withInitialResponse), func(t *testing.T) {
+			session := &submissionSession{app: a}
+			if mechanisms := strings.Join(session.AuthMechanisms(), " "); mechanisms != "PLAIN LOGIN" {
+				t.Fatalf("submission auth mechanisms=%q", mechanisms)
+			}
+			server, err := session.Auth(sasl.Login)
+			if err != nil {
+				t.Fatal(err)
+			}
+			var response []byte
+			if withInitialResponse {
+				response = []byte("admin@lanqin.local")
+			}
+			challenge, done, err := server.Next(response)
+			if err != nil || done {
+				t.Fatalf("initial LOGIN response err=%v done=%t", err, done)
+			}
+			if !withInitialResponse {
+				if string(challenge) != "Username:" {
+					t.Fatalf("username challenge=%q", challenge)
+				}
+				challenge, done, err = server.Next([]byte("admin@lanqin.local"))
+				if err != nil || done {
+					t.Fatalf("username response err=%v done=%t", err, done)
+				}
+			}
+			if string(challenge) != "Password:" {
+				t.Fatalf("password challenge=%q", challenge)
+			}
+			challenge, done, err = server.Next([]byte("ChangeMe123!"))
+			if err != nil || !done || challenge != nil {
+				t.Fatalf("password response challenge=%q err=%v done=%t", challenge, err, done)
+			}
+			if session.user == nil || session.mailbox == nil {
+				t.Fatal("LOGIN authentication did not populate submission session")
+			}
+		})
+	}
+}
+
 func TestSubmissionServersAcceptStartTLSAndImplicitTLS(t *testing.T) {
 	a := newTestApp(t)
 	host, port, received := startCapturingSMTP(t, 2)
@@ -4517,7 +4961,7 @@ func TestSubmissionServersAcceptStartTLSAndImplicitTLS(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err := client.Auth(sasl.NewPlainClient("", "admin@lanqin.local", "ChangeMe123!")); err != nil {
+	if err := client.Auth(sasl.NewLoginClient("admin@lanqin.local", "ChangeMe123!")); err != nil {
 		t.Fatal(err)
 	}
 	if err := client.SendMail("admin@lanqin.local", []string{"person@example.com"}, strings.NewReader(raw)); err != nil {
@@ -4927,20 +5371,24 @@ func TestFixedRolesProtectAdminRoutesAndDefaultAdmin(t *testing.T) {
 	}, &errBody); code != http.StatusForbidden {
 		t.Fatalf("system permission group update should be forbidden code=%d body=%v", code, errBody)
 	}
-	var regularUpdateErr map[string]any
+	var updatedRegular PermissionGroup
 	if code := admin.do("POST", "/api/admin/permission-groups/"+PermissionGroupRegular, map[string]any{
 		"name":        "Changed Regular",
 		"description": "Should not change",
-		"permissions": []string{PermissionAdminOverview},
-	}, &regularUpdateErr); code != http.StatusForbidden {
-		t.Fatalf("regular system permission group update should be forbidden code=%d body=%v", code, regularUpdateErr)
+		"permissions": regularUserDefaultPermissions(),
+		"limits":      defaultPermissionLimits(),
+	}, &updatedRegular); code != http.StatusOK {
+		t.Fatalf("regular system permission group update code=%d group=%+v", code, updatedRegular)
+	}
+	if updatedRegular.Name != "普通用户" || updatedRegular.Description != "仅可使用自己的邮箱功能，不包含后台权限。" {
+		t.Fatalf("regular system permission group identity changed: %+v", updatedRegular)
 	}
 	regularGroup, err := a.permissionGroupByID(context.Background(), PermissionGroupRegular)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if !regularGroup.System || !userHasPermission(&User{Role: "user", Permissions: regularGroup.Permissions}, PermissionMailAccess) || userHasPermission(&User{Role: "user", Permissions: regularGroup.Permissions}, PermissionAdminOverview) {
-		t.Fatalf("regular group should stay locked with default permissions=%+v", regularGroup)
+		t.Fatalf("regular group should retain the saved default permissions=%+v", regularGroup)
 	}
 	if code := admin.do("DELETE", "/api/admin/permission-groups/"+PermissionGroupSuperAdmin, nil, &errBody); code != http.StatusForbidden {
 		t.Fatalf("system permission group delete should be forbidden code=%d body=%v", code, errBody)
@@ -6089,7 +6537,7 @@ func TestMailboxQuotaRejectsNewMessage(t *testing.T) {
 	ctx := context.Background()
 	user, mb := defaultAdminUserAndMailbox(t, a)
 	clearMailboxMessagesForTest(t, a, mb.ID)
-	if _, err := a.db.ExecContext(ctx, `UPDATE mailboxes SET quota_mb=1 WHERE id=?`, mb.ID); err != nil {
+	if _, err := a.db.ExecContext(ctx, `UPDATE users SET storage_quota_mb=1 WHERE id=?`, user.ID); err != nil {
 		t.Fatal(err)
 	}
 	_, err := a.sendMailNow(ctx, user, mb, mailComposeInput{
@@ -6165,7 +6613,11 @@ func TestMailStatsQuotaAndCleanupIsolation(t *testing.T) {
 	if code := alice.do("GET", "/api/me/stats?mailboxId="+aliceMB.ID+"&days=7", nil, &stats); code != http.StatusOK {
 		t.Fatalf("stats code=%d stats=%+v", code, stats)
 	}
-	if stats.QuotaBytes != int64(aliceMB.QuotaMB)*1024*1024 || stats.AttachmentBytes == 0 || stats.QuotaUsedPct <= 0 {
+	var aliceStorageQuotaMB int64
+	if err := a.db.QueryRowContext(ctx, `SELECT storage_quota_mb FROM users WHERE id=?`, aliceUser.ID).Scan(&aliceStorageQuotaMB); err != nil {
+		t.Fatal(err)
+	}
+	if stats.QuotaBytes != aliceStorageQuotaMB*1024*1024 || stats.AttachmentBytes == 0 || stats.QuotaUsedPct <= 0 {
 		t.Fatalf("stats quota/attachment not populated: %+v", stats)
 	}
 	if stats.TotalIncoming != 1 || stats.TotalOutgoing != 0 || stats.AverageMessageBytes <= 0 {

apps/api/internal/app/auth_handlers.go

@@ -177,8 +177,8 @@ func (a *App) handleRegister(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	defer tx.Rollback()
-	if _, err := tx.ExecContext(r.Context(), `INSERT INTO users(id,login_name,email,display_name,role,password_hash,disabled,created_at,updated_at)
-		VALUES(?,?,?,?,?,?,?,?,?)`, userID, email, email, displayName, "user", string(passwordHash), 0, now, now); err != nil {
+	if _, err := tx.ExecContext(r.Context(), `INSERT INTO users(id,login_name,email,display_name,role,password_hash,disabled,storage_quota_mb,created_at,updated_at)
+		VALUES(?,?,?,?,?,?,?,?,?,?)`, userID, email, email, displayName, "user", string(passwordHash), 0, defaultUserStorageQuotaMB, now, now); err != nil {
 		if strings.Contains(strings.ToLower(err.Error()), "unique") {
 			respondError(w, http.StatusConflict, "该邮箱已被注册")
 			return
@@ -186,7 +186,7 @@ func (a *App) handleRegister(w http.ResponseWriter, r *http.Request) {
 		respondError(w, http.StatusInternalServerError, "注册失败，请稍后重试")
 		return
 	}
-	if _, err := a.createMailboxWithPasswordHashTx(r.Context(), tx, userID, mailboxDomainID, mailboxLocalPart, displayName, string(passwordHash), 1024, "active"); err != nil {
+	if _, err := a.createMailboxWithPasswordHashTx(r.Context(), tx, userID, mailboxDomainID, mailboxLocalPart, displayName, string(passwordHash), defaultUserStorageQuotaMB, "active"); err != nil {
 		if strings.Contains(strings.ToLower(err.Error()), "unique") {
 			respondError(w, http.StatusConflict, "该邮箱已被注册")
 		} else {

apps/api/internal/app/forwarding_delivery.go

@@ -138,10 +138,7 @@ func (a *App) inboundForwardingTargets(ctx context.Context, mailboxID string) (t
 	if err != nil {
 		return nil, "", "", err
 	}
-	targets := forwardingTargetsFromStored(mailboxTarget, mailboxTargetsJSON)
-	if len(targets) == 0 {
-		targets = forwardingTargetsFromStored(accountTarget, accountTargetsJSON)
-	}
+	targets := dedupeEmails(append(forwardingTargetsFromStored(accountTarget, accountTargetsJSON), forwardingTargetsFromStored(mailboxTarget, mailboxTargetsJSON)...))
 	if len(targets) == 0 {
 		return nil, userID, mailboxAddress, nil
 	}

apps/api/internal/app/forwarding_handlers.go

@@ -165,7 +165,7 @@ func (a *App) handleVerifyForwardingEmail(w http.ResponseWriter, r *http.Request
 		a.renderForwardingVerificationPage(w, http.StatusInternalServerError, false, email, "验证失败，请稍后重试")
 		return
 	}
-	a.renderForwardingVerificationPage(w, http.StatusOK, true, email, "验证完成，可以回到设置页选择此转发目标")
+	a.renderForwardingVerificationPage(w, http.StatusOK, true, email, "该邮箱已通过转发验证")
 }
 
 func (a *App) handleDeleteForwardingVerifiedEmail(w http.ResponseWriter, r *http.Request) {
@@ -439,14 +439,18 @@ func (a *App) renderForwardingVerificationPage(w http.ResponseWriter, status int
 	title := "邮箱转发验证"
 	heading := "验证失败"
 	color := "#dc2626"
+	statusMark := "!"
+	closingMessage := "请联系验证发起人重新发送链接"
 	if ok {
 		heading = "验证完成"
-		color = "#2563eb"
+		color = "#16a34a"
+		statusMark = "✓"
+		closingMessage = "验证结果已记录，可以关闭此页面"
 	}
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	w.WriteHeader(status)
-	_, _ = fmt.Fprintf(w, `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>%s</title></head><body style="margin:0;background:#f8fafc;color:#0f172a;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Arial,sans-serif"><main style="min-height:100vh;display:grid;place-items:center;padding:24px"><section style="width:min(100%%,520px);background:white;border:1px solid #e2e8f0;border-radius:14px;padding:34px 30px;box-shadow:0 18px 45px rgba(15,23,42,.08)"><h1 style="margin:0 0 14px;font-size:28px">%s</h1><p style="margin:0 0 10px;font-size:17px;color:#475569">%s</p><p style="margin:0 0 26px;font-size:15px;color:#64748b">%s</p><a href="/" style="display:inline-block;border-radius:8px;background:%s;color:white;text-decoration:none;padding:12px 18px;font-weight:700">返回邮箱</a></section></main></body></html>`,
-		title, heading, htmlEscape(message), htmlEscape(email), color)
+	_, _ = fmt.Fprintf(w, `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>%s</title></head><body style="margin:0;background:#f8fafc;color:#0f172a;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Arial,sans-serif"><main style="min-height:100vh;display:grid;place-items:center;padding:24px"><section style="width:min(100%%,520px);background:white;border:1px solid #e2e8f0;border-radius:8px;padding:34px 30px;box-shadow:0 18px 45px rgba(15,23,42,.08)"><div aria-hidden="true" style="display:grid;place-items:center;width:44px;height:44px;margin:0 0 20px;border-radius:50%%;background:%s;color:white;font-size:24px;font-weight:700">%s</div><h1 style="margin:0 0 14px;font-size:28px">%s</h1><p style="margin:0 0 10px;font-size:17px;color:#475569">%s</p><p style="margin:0 0 24px;font-size:15px;color:#64748b;word-break:break-all">%s</p><p style="margin:0;padding-top:20px;border-top:1px solid #e2e8f0;font-size:15px;color:#64748b">%s</p></section></main></body></html>`,
+		title, color, statusMark, heading, htmlEscape(message), htmlEscape(email), htmlEscape(closingMessage))
 }
 
 func (a *App) cleanForwardingVerificationEmail(w http.ResponseWriter, r *http.Request, userID, value string) (string, bool) {

apps/api/internal/app/imap_metadata.go

@@ -76,6 +76,10 @@ func (a *App) migrateFolderSortOrder(ctx context.Context) error {
 	return nil
 }
 
+func (a *App) migrateFolderIcons(ctx context.Context) error {
+	return a.ensureTableColumn(ctx, "folders", "icon", `ALTER TABLE folders ADD COLUMN icon TEXT NOT NULL DEFAULT 'folder'`)
+}
+
 func (a *App) ensureTableColumn(ctx context.Context, table, column, alterSQL string) error {
 	rows, err := a.db.QueryContext(ctx, `PRAGMA table_info(`+table+`)`)
 	if err != nil {

apps/api/internal/app/mail_handlers.go

@@ -1,12 +1,14 @@
 package app
 
 import (
+	"bytes"
 	"context"
 	"database/sql"
 	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"fmt"
+	"image/png"
 	"io"
 	"net/http"
 	"net/textproto"
@@ -85,6 +87,7 @@ func (a *App) handleMyMailboxes(w http.ResponseWriter, r *http.Request) {
 		m.CreatedAt = parseTime(created)
 		items = append(items, m)
 	}
+	markPrimaryMailboxes(items)
 	respondJSON(w, http.StatusOK, map[string]any{"items": items})
 }
 
@@ -98,12 +101,12 @@ func (a *App) handleMailFolders(w http.ResponseWriter, r *http.Request) {
 		respondError(w, http.StatusNotFound, "mailbox not found")
 		return
 	}
-	rows, err := a.db.QueryContext(r.Context(), `SELECT f.id,f.name,f.role,
+	rows, err := a.db.QueryContext(r.Context(), `SELECT f.id,f.name,f.role,f.icon,
 		COALESCE(SUM(CASE WHEN m.is_read=0 THEN 1 ELSE 0 END),0) AS unread,
 		COUNT(m.id) AS total,
 		f.sort_order,f.uid_validity,f.uid_next,f.highest_modseq
 		FROM folders f LEFT JOIN messages m ON m.folder_id=f.id
-		WHERE f.mailbox_id=? GROUP BY f.id,f.name,f.role,f.sort_order,f.uid_validity,f.uid_next,f.highest_modseq
+		WHERE f.mailbox_id=? GROUP BY f.id,f.name,f.role,f.icon,f.sort_order,f.uid_validity,f.uid_next,f.highest_modseq
 		ORDER BY CASE
 			WHEN lower(f.name)='inbox' THEN 1000
 			WHEN lower(f.name)='sent' THEN 5000
@@ -121,7 +124,7 @@ func (a *App) handleMailFolders(w http.ResponseWriter, r *http.Request) {
 	items := []MailFolder{}
 	for rows.Next() {
 		var f MailFolder
-		if err := rows.Scan(&f.ID, &f.Name, &f.Role, &f.UnreadCount, &f.TotalCount, &f.SortOrder, &f.UIDValidity, &f.UIDNext, &f.HighestModSeq); err != nil {
+		if err := rows.Scan(&f.ID, &f.Name, &f.Role, &f.Icon, &f.UnreadCount, &f.TotalCount, &f.SortOrder, &f.UIDValidity, &f.UIDNext, &f.HighestModSeq); err != nil {
 			respondError(w, http.StatusInternalServerError, "failed to scan folders")
 			return
 		}
@@ -132,7 +135,7 @@ func (a *App) handleMailFolders(w http.ResponseWriter, r *http.Request) {
 
 func (a *App) handleAllMailFolders(w http.ResponseWriter, r *http.Request) {
 	user := currentUser(r)
-	rows, err := a.db.QueryContext(r.Context(), `SELECT 'all-' || lower(f.name),f.name,f.role,
+	rows, err := a.db.QueryContext(r.Context(), `SELECT 'all-' || lower(f.name),f.name,f.role,MIN(f.icon),
 		COALESCE(SUM(CASE WHEN m.is_read=0 THEN 1 ELSE 0 END),0) AS unread,
 		COUNT(m.id) AS total,
 		MIN(f.sort_order),MAX(f.uid_validity),MAX(f.uid_next),MAX(f.highest_modseq)
@@ -158,7 +161,7 @@ func (a *App) handleAllMailFolders(w http.ResponseWriter, r *http.Request) {
 	items := []MailFolder{}
 	for rows.Next() {
 		var f MailFolder
-		if err := rows.Scan(&f.ID, &f.Name, &f.Role, &f.UnreadCount, &f.TotalCount, &f.SortOrder, &f.UIDValidity, &f.UIDNext, &f.HighestModSeq); err != nil {
+		if err := rows.Scan(&f.ID, &f.Name, &f.Role, &f.Icon, &f.UnreadCount, &f.TotalCount, &f.SortOrder, &f.UIDValidity, &f.UIDNext, &f.HighestModSeq); err != nil {
 			respondError(w, http.StatusInternalServerError, "failed to scan folders")
 			return
 		}
@@ -266,6 +269,7 @@ func (a *App) handleReorderMailFolders(w http.ResponseWriter, r *http.Request) {
 func (a *App) handleCreateMailFolder(w http.ResponseWriter, r *http.Request) {
 	var req struct {
 		Name string `json:"name"`
+		Icon string `json:"icon"`
 	}
 	if err := decodeJSON(r, &req); err != nil {
 		badRequest(w, err)
@@ -280,6 +284,7 @@ func (a *App) handleCreateMailFolder(w http.ResponseWriter, r *http.Request) {
 		badRequest(w, errors.New("system folder already exists"))
 		return
 	}
+	icon := folderIconForName(name, req.Icon)
 	if isAllMailboxID(r.URL.Query().Get("mailboxId")) {
 		user := currentUser(r)
 		rows, err := a.db.QueryContext(r.Context(), `SELECT id FROM mailboxes WHERE user_id=? AND status='active' ORDER BY created_at,id`, user.ID)
@@ -308,12 +313,12 @@ func (a *App) handleCreateMailFolder(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 		for _, mailboxID := range mailboxIDs {
-			if _, err := a.ensureCustomFolder(r.Context(), mailboxID, name); err != nil {
+			if _, err := a.ensureCustomFolder(r.Context(), mailboxID, name, icon); err != nil {
 				respondError(w, http.StatusInternalServerError, "failed to create folder")
 				return
 			}
 		}
-		respondJSON(w, http.StatusCreated, MailFolder{ID: "all-" + strings.ToLower(name), Name: name, Role: strings.ToLower(name), SortOrder: customFolderDefaultSortOrderBase})
+		respondJSON(w, http.StatusCreated, MailFolder{ID: "all-" + strings.ToLower(name), Name: name, Role: strings.ToLower(name), Icon: icon, SortOrder: customFolderDefaultSortOrderBase})
 		return
 	}
 	mb, err := a.mailboxForCurrentUser(r)
@@ -321,7 +326,7 @@ func (a *App) handleCreateMailFolder(w http.ResponseWriter, r *http.Request) {
 		respondError(w, http.StatusNotFound, "mailbox not found")
 		return
 	}
-	folderID, err := a.ensureCustomFolder(r.Context(), mb.ID, name)
+	folderID, err := a.ensureCustomFolder(r.Context(), mb.ID, name, icon)
 	if err != nil {
 		respondError(w, http.StatusInternalServerError, "failed to create folder")
 		return
@@ -527,8 +532,88 @@ func (a *App) handleDeleteAllMailFolders(w http.ResponseWriter, r *http.Request,
 	respondJSON(w, http.StatusOK, map[string]any{"ok": true, "moved": moved})
 }
 
-func (a *App) ensureCustomFolder(ctx context.Context, mailboxID, name string) (string, error) {
-	return a.ensureFolder(ctx, mailboxID, name)
+func (a *App) ensureCustomFolder(ctx context.Context, mailboxID, name, icon string) (string, error) {
+	var existingID string
+	err := a.db.QueryRowContext(ctx, `SELECT id FROM folders WHERE mailbox_id=? AND lower(name)=lower(?)`, mailboxID, name).Scan(&existingID)
+	if err == nil && (strings.TrimSpace(icon) == "" || strings.EqualFold(strings.TrimSpace(icon), "auto")) {
+		return existingID, nil
+	}
+	if err != nil && !errors.Is(err, sql.ErrNoRows) {
+		return "", err
+	}
+	id, err := a.ensureFolder(ctx, mailboxID, name)
+	if err != nil {
+		return "", err
+	}
+	_, err = a.db.ExecContext(ctx, `UPDATE folders SET icon=? WHERE id=? AND mailbox_id=?`, folderIconForName(name, icon), id, mailboxID)
+	return id, err
+}
+
+func folderIconForName(name, requested string) string {
+	if icon := strings.TrimSpace(requested); icon != "" && !strings.EqualFold(icon, "auto") {
+		return normalizeFolderIcon(icon)
+	}
+	value := strings.ToLower(strings.TrimSpace(name))
+	for _, match := range []struct {
+		icon  string
+		terms []string
+	}{
+		{"netflix", []string{"netflix", "奈飞", "网飞"}},
+		{"chatgpt", []string{"chatgpt", "openai", "gpt"}},
+		{"receipt", []string{"账单", "发票", "收据", "bill", "invoice", "receipt"}},
+		{"shopping", []string{"购物", "订单", "快递", "shop", "order", "delivery"}},
+		{"plane", []string{"旅行", "旅游", "机票", "酒店", "travel", "trip", "flight", "hotel"}},
+		{"graduation", []string{"学习", "教育", "课程", "学校", "study", "school", "course"}},
+		{"users", []string{"联系人", "团队", "用户", "contact", "team", "people"}},
+		{"briefcase", []string{"工作", "项目", "客户", "work", "project", "business", "client"}},
+		{"heart", []string{"收藏", "喜欢", "favorite", "favourite"}},
+		{"star", []string{"重要", "紧急", "important", "urgent"}},
+		{"shield", []string{"安全", "验证", "密码", "登录", "security", "verify", "password", "login"}},
+		{"bell", []string{"提醒", "通知", "remind", "notification"}},
+		{"mail", []string{"邮件", "邮箱", "mail", "email"}},
+	} {
+		for _, term := range match.terms {
+			if folderNameContainsTerm(value, term) {
+				return match.icon
+			}
+		}
+	}
+	return "folder"
+}
+
+func folderNameContainsTerm(value, term string) bool {
+	if term != "gpt" {
+		return strings.Contains(value, term)
+	}
+	for _, token := range strings.FieldsFunc(value, func(r rune) bool {
+		return (r < 'a' || r > 'z') && (r < '0' || r > '9')
+	}) {
+		if token == term {
+			return true
+		}
+	}
+	return false
+}
+
+func normalizeFolderIcon(raw string) string {
+	icon := strings.TrimSpace(raw)
+	const customPrefix = "data:image/png;base64,"
+	if strings.HasPrefix(icon, customPrefix) {
+		data, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(icon, customPrefix))
+		config, configErr := png.DecodeConfig(bytes.NewReader(data))
+		validDimensions := config.Width > 0 && config.Width <= 128 && config.Height > 0 && config.Height <= 128
+		if err == nil && configErr == nil && validDimensions && len(data) <= 32*1024 {
+			return icon
+		}
+		return "folder"
+	}
+	icon = strings.ToLower(icon)
+	switch icon {
+	case "folder", "mail", "briefcase", "users", "receipt", "shopping", "plane", "graduation", "heart", "star", "bell", "shield", "tag", "netflix", "chatgpt":
+		return icon
+	default:
+		return "folder"
+	}
 }
 
 func (a *App) nextCustomFolderSortOrder(ctx context.Context, mailboxID string) (int, error) {
@@ -2232,14 +2317,14 @@ func (a *App) handleBulkMove(w http.ResponseWriter, r *http.Request) {
 }
 
 func (a *App) folderByID(ctx context.Context, folderID, mailboxID string) (*MailFolder, error) {
-	row := a.db.QueryRowContext(ctx, `SELECT f.id,f.name,f.role,
+	row := a.db.QueryRowContext(ctx, `SELECT f.id,f.name,f.role,f.icon,
 		COALESCE(SUM(CASE WHEN m.is_read=0 THEN 1 ELSE 0 END),0) AS unread,
 		COUNT(m.id) AS total,
 		f.sort_order,f.uid_validity,f.uid_next,f.highest_modseq
 		FROM folders f LEFT JOIN messages m ON m.folder_id=f.id
-		WHERE f.id=? AND f.mailbox_id=? GROUP BY f.id,f.name,f.role,f.sort_order,f.uid_validity,f.uid_next,f.highest_modseq`, folderID, mailboxID)
+		WHERE f.id=? AND f.mailbox_id=? GROUP BY f.id,f.name,f.role,f.icon,f.sort_order,f.uid_validity,f.uid_next,f.highest_modseq`, folderID, mailboxID)
 	var f MailFolder
-	if err := row.Scan(&f.ID, &f.Name, &f.Role, &f.UnreadCount, &f.TotalCount, &f.SortOrder, &f.UIDValidity, &f.UIDNext, &f.HighestModSeq); err != nil {
+	if err := row.Scan(&f.ID, &f.Name, &f.Role, &f.Icon, &f.UnreadCount, &f.TotalCount, &f.SortOrder, &f.UIDValidity, &f.UIDNext, &f.HighestModSeq); err != nil {
 		return nil, err
 	}
 	return &f, nil
@@ -2535,14 +2620,15 @@ func (a *App) ensureMailboxQuotaAvailable(ctx context.Context, db dbExecutor, ma
 		return nil
 	}
 	var quotaMB int64
-	if err := rowDB.QueryRowContext(ctx, `SELECT quota_mb FROM mailboxes WHERE id=? AND status='active'`, mailboxID).Scan(&quotaMB); err != nil {
+	var userID string
+	if err := rowDB.QueryRowContext(ctx, `SELECT u.storage_quota_mb,mb.user_id FROM mailboxes mb JOIN users u ON u.id=mb.user_id WHERE mb.id=? AND mb.status='active'`, mailboxID).Scan(&quotaMB, &userID); err != nil {
 		return err
 	}
 	if quotaMB <= 0 {
 		return nil
 	}
 	var used int64
-	if err := rowDB.QueryRowContext(ctx, `SELECT COALESCE(SUM(size_bytes),0) FROM messages WHERE mailbox_id=?`, mailboxID).Scan(&used); err != nil {
+	if err := rowDB.QueryRowContext(ctx, `SELECT COALESCE(SUM(m.size_bytes),0) FROM messages m JOIN mailboxes mb ON mb.id=m.mailbox_id WHERE mb.user_id=?`, userID).Scan(&used); err != nil {
 		return err
 	}
 	quotaBytes := quotaMB * 1024 * 1024

apps/api/internal/app/mailbox_delete_test.go

@@ -6,7 +6,7 @@ import (
 	"testing"
 )
 
-func TestAdminCanDeleteOwnLastMailboxWithoutDeletingAccount(t *testing.T) {
+func TestAdminCannotDeleteOwnPrimaryMailbox(t *testing.T) {
 	a := newTestApp(t)
 	ts := httptest.NewServer(a.Router())
 	defer ts.Close()
@@ -21,10 +21,13 @@ func TestAdminCanDeleteOwnLastMailboxWithoutDeletingAccount(t *testing.T) {
 	if code := admin.do("GET", "/api/mail/mailboxes", nil, &mailboxes); code != http.StatusOK || len(mailboxes.Items) != 1 {
 		t.Fatalf("mailboxes code=%d items=%d", code, len(mailboxes.Items))
 	}
-	if code := admin.do("DELETE", "/api/admin/mailboxes/"+mailboxes.Items[0].ID, nil, &map[string]any{}); code != http.StatusOK {
-		t.Fatalf("delete final mailbox code=%d", code)
+	if !mailboxes.Items[0].Primary {
+		t.Fatal("administrator mailbox should be marked as primary")
 	}
-	if code := admin.do("GET", "/api/mail/mailboxes", nil, &mailboxes); code != http.StatusOK || len(mailboxes.Items) != 0 {
+	if code := admin.do("DELETE", "/api/admin/mailboxes/"+mailboxes.Items[0].ID, nil, &map[string]any{}); code != http.StatusBadRequest {
+		t.Fatalf("delete primary mailbox code=%d", code)
+	}
+	if code := admin.do("GET", "/api/mail/mailboxes", nil, &mailboxes); code != http.StatusOK || len(mailboxes.Items) != 1 {
 		t.Fatalf("mailboxes after delete code=%d items=%d", code, len(mailboxes.Items))
 	}
 	var me map[string]any

apps/api/internal/app/open_api_handlers.go

@@ -200,6 +200,10 @@ func (a *App) handleOpenAPICreateMailbox(w http.ResponseWriter, r *http.Request)
 		badRequest(w, errors.New("password must be at least 6 characters"))
 		return
 	}
+	if req.QuotaMB < 0 {
+		badRequest(w, errors.New("quotaMb must be zero or greater"))
+		return
+	}
 	domain, err := a.domainByID(r.Context(), req.DomainID)
 	if err != nil {
 		respondError(w, http.StatusNotFound, "domain not found")
@@ -231,7 +235,20 @@ func (a *App) handleOpenAPICreateMailbox(w http.ResponseWriter, r *http.Request)
 		respondMailboxOwnerError(w, err)
 		return
 	}
-	mailboxID, err := a.createMailboxWithPasswordHashTx(r.Context(), tx, userID, req.DomainID, localPart, displayName, string(passwordHash), req.QuotaMB, "active")
+	var ownerPasswordHash, ownerRole string
+	var ownerStorageQuotaMB int
+	if err := tx.QueryRowContext(r.Context(), `SELECT password_hash,role,storage_quota_mb FROM users WHERE id=?`, userID).Scan(&ownerPasswordHash, &ownerRole, &ownerStorageQuotaMB); err != nil {
+		respondError(w, http.StatusInternalServerError, "failed to load owner user")
+		return
+	}
+	quotaMB := req.QuotaMB
+	if quotaMB == 0 {
+		quotaMB = ownerStorageQuotaMB
+	}
+	if ownerRole == "admin" {
+		quotaMB = 0
+	}
+	mailboxID, err := a.createMailboxWithPasswordHashTx(r.Context(), tx, userID, req.DomainID, localPart, displayName, ownerPasswordHash, quotaMB, "active")
 	if err != nil {
 		badRequest(w, err)
 		return
@@ -279,7 +296,11 @@ func (a *App) handleOpenAPIUpdateMailbox(w http.ResponseWriter, r *http.Request)
 		displayName = current.DisplayName
 	}
 	quotaMB := req.QuotaMB
-	if quotaMB <= 0 {
+	if quotaMB < 0 {
+		badRequest(w, errors.New("quotaMb must be zero or greater"))
+		return
+	}
+	if quotaMB == 0 {
 		quotaMB = current.QuotaMB
 	}
 	status := strings.TrimSpace(req.Status)
@@ -294,12 +315,28 @@ func (a *App) handleOpenAPIUpdateMailbox(w http.ResponseWriter, r *http.Request)
 	if userID == "" {
 		userID = current.UserID
 	}
+	if current.Primary && userID != current.UserID {
+		badRequest(w, errors.New("用户默认邮箱归属由所属账号管理，不能单独修改"))
+		return
+	}
+	if current.Primary && status != current.Status {
+		badRequest(w, errors.New("用户默认邮箱状态由所属账号管理，不能单独修改"))
+		return
+	}
 	if err := a.ensureActiveUserExists(r.Context(), userID); err != nil {
 		respondMailboxOwnerError(w, err)
 		return
 	}
-	res, err := a.db.ExecContext(r.Context(), `UPDATE mailboxes SET user_id=?,display_name=?,quota_mb=?,status=?,updated_at=? WHERE id=?`,
-		userID, displayName, quotaMB, status, a.now().UTC().Format(time.RFC3339Nano), id)
+	var ownerRole, ownerPasswordHash string
+	if err := a.db.QueryRowContext(r.Context(), `SELECT role,password_hash FROM users WHERE id=?`, userID).Scan(&ownerRole, &ownerPasswordHash); err != nil {
+		respondError(w, http.StatusInternalServerError, "failed to load owner user")
+		return
+	}
+	if ownerRole == "admin" {
+		quotaMB = 0
+	}
+	res, err := a.db.ExecContext(r.Context(), `UPDATE mailboxes SET user_id=?,display_name=?,password_hash=?,quota_mb=?,status=?,updated_at=? WHERE id=?`,
+		userID, displayName, ownerPasswordHash, quotaMB, status, a.now().UTC().Format(time.RFC3339Nano), id)
 	if err != nil {
 		respondError(w, http.StatusInternalServerError, "failed to update mailbox")
 		return
@@ -318,6 +355,14 @@ func (a *App) handleOpenAPIUpdateMailbox(w http.ResponseWriter, r *http.Request)
 
 func (a *App) handleOpenAPIDeleteMailbox(w http.ResponseWriter, r *http.Request) {
 	id := chi.URLParam(r, "id")
+	if err := a.ensureMailboxDeletable(r.Context(), id); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			respondError(w, http.StatusNotFound, "邮箱不存在或已被删除")
+		} else {
+			badRequest(w, err)
+		}
+		return
+	}
 	rows, err := a.db.QueryContext(r.Context(), `SELECT id FROM messages WHERE mailbox_id=?`, id)
 	if err != nil {
 		respondError(w, http.StatusInternalServerError, "加载邮箱邮件失败")
@@ -821,8 +866,8 @@ func (a *App) resolveMailboxOwnerTx(ctx context.Context, tx *sql.Tx, userID, own
 	if displayName == "" {
 		displayName = email
 	}
-	_, err = tx.ExecContext(ctx, `INSERT INTO users(id,login_name,email,display_name,role,password_hash,disabled,created_at,updated_at)
-		VALUES(?,?,?,?,?,?,?,?,?)`, userID, email, email, displayName, "user", passwordHash, 0, now, now)
+	_, err = tx.ExecContext(ctx, `INSERT INTO users(id,login_name,email,display_name,role,password_hash,disabled,storage_quota_mb,created_at,updated_at)
+		VALUES(?,?,?,?,?,?,?,?,?,?)`, userID, email, email, displayName, "user", passwordHash, 0, defaultUserStorageQuotaMB, now, now)
 	return userID, err
 }
 

apps/api/internal/app/permission_group_handlers.go

@@ -142,11 +142,12 @@ func (a *App) handleCreatePermissionGroup(w http.ResponseWriter, r *http.Request
 func (a *App) handleUpdatePermissionGroup(w http.ResponseWriter, r *http.Request) {
 	id := chi.URLParam(r, "id")
 	var existingSystem int
-	if err := a.db.QueryRowContext(r.Context(), `SELECT system FROM permission_groups WHERE id=?`, id).Scan(&existingSystem); err != nil {
+	var existingName, existingDescription string
+	if err := a.db.QueryRowContext(r.Context(), `SELECT system,name,description FROM permission_groups WHERE id=?`, id).Scan(&existingSystem, &existingName, &existingDescription); err != nil {
 		respondError(w, http.StatusNotFound, "permission group not found")
 		return
 	}
-	if intBool(existingSystem) {
+	if intBool(existingSystem) && id != PermissionGroupRegular {
 		respondError(w, http.StatusForbidden, "system permission groups cannot be edited")
 		return
 	}
@@ -161,6 +162,10 @@ func (a *App) handleUpdatePermissionGroup(w http.ResponseWriter, r *http.Request
 		return
 	}
 	name := strings.TrimSpace(req.Name)
+	if id == PermissionGroupRegular {
+		name = existingName
+		req.Description = existingDescription
+	}
 	if name == "" {
 		badRequest(w, errors.New("name is required"))
 		return

apps/api/internal/app/personal_handlers.go

@@ -111,7 +111,11 @@ func (a *App) handleApplyMailbox(w http.ResponseWriter, r *http.Request) {
 		badRequest(w, errors.New("displayName must be at most 80 characters"))
 		return
 	}
-	mailboxID, err := a.createMailboxWithPasswordHash(r.Context(), user.ID, domainID, localPart, displayName, passwordHash, 1024, "active")
+	quotaMB := defaultUserStorageQuotaMB
+	if user.Role == "admin" {
+		quotaMB = 0
+	}
+	mailboxID, err := a.createMailboxWithPasswordHash(r.Context(), user.ID, domainID, localPart, displayName, passwordHash, quotaMB, "active")
 	if err != nil {
 		if strings.Contains(strings.ToLower(err.Error()), "unique") {
 			respondError(w, http.StatusConflict, "该邮箱地址已被占用")
@@ -534,12 +538,16 @@ func (a *App) handleCreateRule(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	appliedCount := int64(0)
-	if req.ApplyToExisting && enabled {
-		appliedCount, _ = a.applyRuleToExistingMessages(r.Context(), user.ID, mailboxID, MailRule{
+	if req.ApplyToExisting {
+		appliedCount, err = a.applyRuleToExistingMessages(r.Context(), user.ID, mailboxID, MailRule{
 			ID: id, UserID: user.ID, MailboxID: mailboxID, Name: name, MatchMode: matchMode,
 			Conditions: conditions, Actions: actions, ApplyToExisting: req.ApplyToExisting, StopProcessing: req.StopProcessing,
 			FromContains: fromContains, SubjectContains: subjectContains, Action: action, Enabled: enabled,
 		})
+		if err != nil {
+			respondError(w, http.StatusInternalServerError, "rule saved but failed to apply to existing messages")
+			return
+		}
 	}
 	row := a.db.QueryRowContext(r.Context(), `SELECT id,user_id,mailbox_id,name,match_mode,conditions_json,actions_json,from_contains,subject_contains,action,apply_to_existing,stop_processing,enabled,created_at FROM mail_rules WHERE id=?`, id)
 	item, err := scanRule(row)
@@ -896,9 +904,8 @@ func (a *App) handleMailStats(w http.ResponseWriter, r *http.Request) {
 		respondError(w, http.StatusInternalServerError, "failed to load send queue stats")
 		return
 	}
-	if mailboxID != "" && !isAllMailboxID(mailboxID) {
 	var quotaMB int64
-		if err := a.db.QueryRowContext(r.Context(), `SELECT quota_mb FROM mailboxes WHERE id=? AND user_id=?`, mailboxID, user.ID).Scan(&quotaMB); err != nil {
+	if err := a.db.QueryRowContext(r.Context(), `SELECT storage_quota_mb FROM users WHERE id=?`, user.ID).Scan(&quotaMB); err != nil {
 		respondError(w, http.StatusInternalServerError, "failed to load quota")
 		return
 	}
@@ -906,17 +913,6 @@ func (a *App) handleMailStats(w http.ResponseWriter, r *http.Request) {
 	if stats.QuotaBytes > 0 {
 		stats.QuotaUsedPct = float64(stats.StorageBytes) / float64(stats.QuotaBytes) * 100
 	}
-	} else {
-		var quotaMB int64
-		if err := a.db.QueryRowContext(r.Context(), `SELECT COALESCE(SUM(mb.quota_mb),0) FROM mailboxes mb WHERE `+where, args...).Scan(&quotaMB); err != nil {
-			respondError(w, http.StatusInternalServerError, "failed to load quota")
-			return
-		}
-		stats.QuotaBytes = quotaMB * 1024 * 1024
-		if stats.QuotaBytes > 0 {
-			stats.QuotaUsedPct = float64(stats.StorageBytes) / float64(stats.QuotaBytes) * 100
-		}
-	}
 	rows, err := a.db.QueryContext(r.Context(), `SELECT f.name,f.role,COUNT(m.id),COALESCE(SUM(CASE WHEN m.is_read=0 THEN 1 ELSE 0 END),0),COALESCE(SUM(m.size_bytes),0)
 		FROM mailboxes mb JOIN folders f ON f.mailbox_id=mb.id LEFT JOIN messages m ON m.folder_id=f.id
 		WHERE `+where+` GROUP BY f.id,f.name,f.role ORDER BY CASE f.role WHEN 'inbox' THEN 1 WHEN 'sent' THEN 2 WHEN 'drafts' THEN 3 WHEN 'archive' THEN 4 WHEN 'spam' THEN 5 WHEN 'trash' THEN 6 ELSE 99 END`, args...)
@@ -1330,7 +1326,9 @@ func (a *App) applyInboundControls(ctx context.Context, messageID, mailboxID, fr
 		if !ruleMatches(rule, msg) {
 			continue
 		}
-		_ = a.applyRuleActions(ctx, mailboxID, messageID, rule.Actions)
+		if err := a.applyRuleActions(ctx, mailboxID, messageID, rule.Actions); err != nil {
+			continue
+		}
 		if rule.StopProcessing {
 			break
 		}
@@ -1375,7 +1373,7 @@ type ruleMessage struct {
 func (a *App) ruleMessageByID(ctx context.Context, messageID string) (ruleMessage, bool) {
 	var msg ruleMessage
 	var toAddrs, ccAddrs, receivedAt string
-	err := a.db.QueryRowContext(ctx, `SELECT id,COALESCE(mailbox_id,''),trim(from_addr || ' ' || COALESCE(from_name,'')),to_addrs,cc_addrs,subject,snippet,body_text,size_bytes,received_at FROM messages WHERE id=?`, messageID).
+	err := a.db.QueryRowContext(ctx, `SELECT id,COALESCE(mailbox_id,''),from_addr,to_addrs,cc_addrs,subject,snippet,body_text,size_bytes,received_at FROM messages WHERE id=?`, messageID).
 		Scan(&msg.ID, &msg.MailboxID, &msg.From, &toAddrs, &ccAddrs, &msg.Subject, &msg.Snippet, &msg.BodyText, &msg.SizeBytes, &receivedAt)
 	if err != nil {
 		return ruleMessage{}, false
@@ -1407,7 +1405,7 @@ func (a *App) ruleAttachmentNames(ctx context.Context, messageID string) string
 		if err := rows.Scan(&filename, &contentType); err != nil {
 			return strings.Join(parts, " ")
 		}
-		parts = append(parts, filename, contentType)
+		parts = append(parts, filename)
 	}
 	return strings.Join(parts, " ")
 }
@@ -1453,15 +1451,23 @@ func normalizeRuleCondition(item MailRuleCondition) (MailRuleCondition, bool) {
 	if operator == "" {
 		operator = "contains"
 	}
-	switch operator {
-	case "contains", "not-contains", "equals", "not-equals", "starts-with", "ends-with":
-	case "gt", "gte", "lt", "lte", "before", "after", "on":
-	default:
+	if !validRuleConditionOperator(field, operator) {
 		return MailRuleCondition{}, false
 	}
 	return MailRuleCondition{Field: field, Operator: operator, Value: value}, true
 }
 
+func validRuleConditionOperator(field, operator string) bool {
+	switch field {
+	case "size":
+		return operator == "gt" || operator == "gte" || operator == "lt" || operator == "lte" || operator == "equals" || operator == "not-equals"
+	case "date":
+		return operator == "before" || operator == "after" || operator == "on" || operator == "equals" || operator == "not-equals"
+	default:
+		return operator == "contains" || operator == "not-contains" || operator == "equals" || operator == "not-equals" || operator == "starts-with" || operator == "ends-with"
+	}
+}
+
 func normalizeRuleMatchMode(matchMode string) string {
 	switch strings.ToLower(strings.TrimSpace(matchMode)) {
 	case "any", "or":
@@ -1710,23 +1716,37 @@ func (a *App) applyRuleActions(ctx context.Context, mailboxID, messageID string,
 	for _, action := range normalizeRuleActions(actions, "") {
 		switch action.Type {
 		case "archive":
-			if folderID, err := a.ensureFolder(ctx, mailboxID, "Archive"); err == nil {
-				if err := a.moveMessageMaildir(ctx, messageID, folderID); err != nil {
+			folderID, err := a.ensureFolder(ctx, mailboxID, "Archive")
+			if err != nil {
 				return err
 			}
+			if err := a.moveMessageMaildir(ctx, messageID, folderID); err != nil {
+				return err
 			}
 		case "trash":
-			if folderID, err := a.ensureFolder(ctx, mailboxID, "Trash"); err == nil {
-				if err := a.moveMessageMaildir(ctx, messageID, folderID); err != nil {
+			folderID, err := a.ensureFolder(ctx, mailboxID, "Trash")
+			if err != nil {
 				return err
 			}
+			if err := a.moveMessageMaildir(ctx, messageID, folderID); err != nil {
+				return err
 			}
 		case "move":
-			target := ruleTargetFolder(action.Value)
-			if folderID, err := a.ensureFolder(ctx, mailboxID, target); err == nil {
-				if err := a.moveMessageMaildir(ctx, messageID, folderID); err != nil {
+			target, err := normalizeFolderNameForUser(action.Value)
+			if err != nil {
 				return err
 			}
+			var folderID string
+			if isSystemFolderName(target) {
+				folderID, err = a.ensureFolder(ctx, mailboxID, target)
+			} else {
+				folderID, err = a.ensureCustomFolder(ctx, mailboxID, target, "auto")
+			}
+			if err != nil {
+				return err
+			}
+			if err := a.moveMessageMaildir(ctx, messageID, folderID); err != nil {
+				return err
 			}
 		case "star":
 			starred := true
@@ -1789,21 +1809,6 @@ func (a *App) applyRuleLabel(ctx context.Context, mailboxID, messageID string, a
 	return err
 }
 
-func ruleTargetFolder(value string) string {
-	switch strings.ToLower(strings.TrimSpace(value)) {
-	case "inbox":
-		return "Inbox"
-	case "archive":
-		return "Archive"
-	case "spam":
-		return "Spam"
-	case "trash":
-		return "Trash"
-	default:
-		return "Archive"
-	}
-}
-
 func (a *App) applyRuleToExistingMessages(ctx context.Context, userID, mailboxID string, rule MailRule) (int64, error) {
 	args := []any{userID}
 	where := `mb.user_id=?`
@@ -1811,7 +1816,7 @@ func (a *App) applyRuleToExistingMessages(ctx context.Context, userID, mailboxID
 		where += ` AND m.mailbox_id=?`
 		args = append(args, mailboxID)
 	}
-	rows, err := a.db.QueryContext(ctx, `SELECT m.id FROM messages m JOIN mailboxes mb ON mb.id=m.mailbox_id WHERE `+where, args...)
+	rows, err := a.db.QueryContext(ctx, `SELECT m.id FROM messages m JOIN mailboxes mb ON mb.id=m.mailbox_id JOIN folders f ON f.id=m.folder_id WHERE `+where+` AND lower(f.name) NOT IN ('sent','drafts')`, args...)
 	if err != nil {
 		return 0, err
 	}

apps/api/internal/app/submission.go

@@ -121,21 +121,59 @@ type submissionSession struct {
 }
 
 func (s *submissionSession) AuthMechanisms() []string {
-	return []string{sasl.Plain}
+	return []string{sasl.Plain, sasl.Login}
 }
 
 func (s *submissionSession) Auth(mech string) (sasl.Server, error) {
-	if !strings.EqualFold(mech, sasl.Plain) {
-		return nil, smtpserver.ErrAuthUnknownMechanism
-	}
-	return sasl.NewPlainServer(func(identity, username, password string) error {
+	authenticate := func(username, password string) error {
 		user, mailbox, err := s.app.authenticateSubmission(context.Background(), username, password)
 		if err != nil {
 			return smtpserver.ErrAuthFailed
 		}
 		s.user, s.mailbox = user, mailbox
 		return nil
+	}
+	switch {
+	case strings.EqualFold(mech, sasl.Plain):
+		return sasl.NewPlainServer(func(_, username, password string) error {
+			return authenticate(username, password)
 		}), nil
+	case strings.EqualFold(mech, sasl.Login):
+		return &submissionLoginServer{authenticate: authenticate}, nil
+	default:
+		return nil, smtpserver.ErrAuthUnknownMechanism
+	}
+}
+
+type submissionLoginServer struct {
+	authenticate func(username, password string) error
+	username     string
+	step         int
+}
+
+func (s *submissionLoginServer) Next(response []byte) ([]byte, bool, error) {
+	switch s.step {
+	case 0:
+		if response == nil {
+			s.step = 1
+			return []byte("Username:"), false, nil
+		}
+		s.username = string(response)
+		s.step = 2
+		return []byte("Password:"), false, nil
+	case 1:
+		s.username = string(response)
+		s.step = 2
+		return []byte("Password:"), false, nil
+	case 2:
+		if err := s.authenticate(s.username, string(response)); err != nil {
+			return nil, false, err
+		}
+		s.step = 3
+		return nil, true, nil
+	default:
+		return nil, false, sasl.ErrUnexpectedClientResponse
+	}
 }
 
 func (s *submissionSession) Mail(from string, _ *smtpserver.MailOptions) error {

apps/api/internal/app/types.go

@@ -23,6 +23,7 @@ type AdminUser struct {
 	User
 	MailboxCount   int      `json:"mailboxCount"`
 	Mailboxes      []string `json:"mailboxes"`
+	StorageQuotaMB int      `json:"storageQuotaMb"`
 }
 
 type APIToken struct {
@@ -71,6 +72,7 @@ type Mailbox struct {
 	DisplayName string    `json:"displayName"`
 	QuotaMB     int       `json:"quotaMb"`
 	Status      string    `json:"status"`
+	Primary     bool      `json:"primary"`
 	UnreadCount int       `json:"unreadCount"`
 	CreatedAt   time.Time `json:"createdAt"`
 }
@@ -88,6 +90,7 @@ type MailFolder struct {
 	ID            string `json:"id"`
 	Name          string `json:"name"`
 	Role          string `json:"role"`
+	Icon          string `json:"icon"`
 	SortOrder     int    `json:"sortOrder"`
 	UnreadCount   int    `json:"unreadCount"`
 	TotalCount    int    `json:"totalCount"`

apps/web/package.json

@@ -36,7 +36,7 @@
     "@tiptap/starter-kit": "^3.27.0",
     "class-variance-authority": "^0.7.0",
     "clsx": "2.1.1",
-    "dompurify": "3.4.12",
+    "dompurify": "3.4.13",
     "lucide-react": "^0.468.0",
     "qrcode.react": "^4.2.0",
     "react": "18.3.1",

apps/web/src/components/auth-guard.tsx

@@ -1,15 +1,19 @@
 import React from "react"
 import { Navigate, useLocation } from "react-router-dom"
-import { useMe, isTimeoutError } from "@/hooks/use-me"
+import { useMe } from "@/hooks/use-me"
 import { AuthLoading, AuthError } from "@/components/auth-states"
+import { isUnauthorizedError } from "@/lib/api"
 
 export function AuthGuard({ children }: { children: React.ReactNode }) {
   const me = useMe()
   const location = useLocation()
 
   if (me.isLoading) return <AuthLoading />
-  if (me.isError && isTimeoutError(me.error)) return <AuthError message={me.error.message} onRetry={() => me.refetch()} />
-  if (me.isError || !me.data?.user) return <Navigate to="/login" replace state={{ from: location.pathname }} />
+  if (me.isError && !isUnauthorizedError(me.error)) return <AuthError message={me.error.message} onRetry={() => me.refetch()} />
+  if (me.isError || !me.data?.user) {
+    const from = `${location.pathname}${location.search}${location.hash}`
+    return <Navigate to="/login" replace state={{ from }} />
+  }
 
   return <>{children}</>
 }

apps/web/src/components/auth-states.tsx

@@ -1,17 +1,17 @@
 import { Button } from "@/components/ui/button"
 
 export function AuthLoading() {
-  return <div className="grid min-h-screen place-items-center text-muted-foreground">加载中...</div>
+  return <main className="grid min-h-screen place-items-center text-muted-foreground">加载中...</main>
 }
 
 export function AuthError({ message, onRetry }: { message: string; onRetry: () => void }) {
   return (
-    <div className="grid min-h-screen place-items-center bg-background px-4">
+    <main className="grid min-h-screen place-items-center bg-background px-4">
       <div className="w-full max-w-sm space-y-4 text-center">
-        <div className="text-sm font-medium">无法连接后端服务</div>
+        <div className="text-sm font-medium">服务暂时不可用</div>
         <div className="text-sm text-muted-foreground">{message}</div>
-        <Button type="button" variant="outline" onClick={onRetry}>重新加载</Button>
-      </div>
+        <Button type="button" variant="outline" onClick={onRetry}>重新连接</Button>
       </div>
+    </main>
   )
 }

apps/web/src/components/confirm-dialog.tsx

@@ -26,12 +26,12 @@ export function ConfirmDialog({
 }: ConfirmDialogProps) {
   return (
     <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent>
+      <DialogContent className="w-[calc(100vw-2rem)] max-w-lg rounded-lg">
         <DialogHeader>
           <DialogTitle>{title}</DialogTitle>
         </DialogHeader>
         {description && <div className="text-sm text-muted-foreground">{description}</div>}
-        <DialogFooter>
+        <DialogFooter className="gap-2 [&>button]:min-h-11 sm:[&>button]:min-h-9">
           <Button type="button" variant="outline" onClick={() => onOpenChange(false)} disabled={pending}>
             {cancelText}
           </Button>

apps/web/src/components/protected-layout.tsx

@@ -5,7 +5,6 @@ import { useMe } from "@/hooks/use-me"
 import { useLogout } from "@/hooks/use-logout"
 import { AuthGuard } from "@/components/auth-guard"
 import { Button } from "@/components/ui/button"
-import { Badge } from "@/components/ui/badge"
 import { Avatar, AvatarFallback } from "@/components/ui/avatar"
 import { SystemVersionDialog } from "@/components/system-version-dialog"
 import { hasAnyPermission } from "@/lib/permissions"
@@ -110,9 +109,6 @@ function ProtectedContent() {
                     <span className="truncate font-semibold">{user.displayName}</span>
                     <span className="truncate text-xs text-muted-foreground">{user.email}</span>
                   </div>
-                  <Badge variant={user.role === "admin" ? "default" : "secondary"} className="ml-auto text-[10px]">
-                    {user.role === "admin" ? "管理员" : "普通用户"}
-                  </Badge>
                 </Link>
               </SidebarMenuButton>
             </SidebarMenuItem>

apps/web/src/components/ui/button.tsx

@@ -5,18 +5,18 @@ import { cva, type VariantProps } from "class-variance-authority"
 import { cn } from "@/lib/utils"
 
 const buttonVariants = cva(
-  "inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:size-4 [&_svg]:shrink-0",
+  "inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:size-4 [&_svg]:shrink-0",
   {
     variants: {
       variant: {
         default:
-          "bg-primary text-primary-foreground shadow hover:bg-primary/90",
+          "bg-primary text-primary-foreground hover:bg-primary/90",
         destructive:
-          "bg-destructive text-destructive-foreground shadow-sm hover:bg-destructive/90",
+          "bg-destructive text-destructive-foreground hover:bg-destructive/90",
         outline:
-          "border border-input bg-background shadow-sm hover:bg-accent hover:text-accent-foreground",
+          "border border-input bg-background hover:bg-accent hover:text-accent-foreground",
         secondary:
-          "bg-secondary text-secondary-foreground shadow-sm hover:bg-secondary/80",
+          "bg-secondary text-secondary-foreground hover:bg-secondary/80",
         ghost: "hover:bg-accent hover:text-accent-foreground",
         link: "text-primary underline-offset-4 hover:underline",
       },

apps/web/src/components/ui/card.tsx

@@ -8,8 +8,9 @@ const Card = React.forwardRef<
 >(({ className, ...props }, ref) => (
   <div
     ref={ref}
+    data-slot="card"
     className={cn(
-      "rounded-xl border bg-card text-card-foreground shadow",
+      "rounded-lg border bg-card text-card-foreground shadow-sm",
       className
     )}
     {...props}
@@ -23,6 +24,7 @@ const CardHeader = React.forwardRef<
 >(({ className, ...props }, ref) => (
   <div
     ref={ref}
+    data-slot="card-header"
     className={cn("flex flex-col space-y-1.5 p-6", className)}
     {...props}
   />
@@ -35,6 +37,7 @@ const CardTitle = React.forwardRef<
 >(({ className, ...props }, ref) => (
   <div
     ref={ref}
+    data-slot="card-title"
     className={cn("font-semibold leading-none tracking-tight", className)}
     {...props}
   />
@@ -57,7 +60,7 @@ const CardContent = React.forwardRef<
   HTMLDivElement,
   React.HTMLAttributes<HTMLDivElement>
 >(({ className, ...props }, ref) => (
-  <div ref={ref} className={cn("p-6 pt-0", className)} {...props} />
+  <div ref={ref} data-slot="card-content" className={cn("p-6 pt-0", className)} {...props} />
 ))
 CardContent.displayName = "CardContent"
 

apps/web/src/components/ui/dialog.tsx

@@ -19,7 +19,7 @@ const DialogOverlay = React.forwardRef<
   <DialogPrimitive.Overlay
     ref={ref}
     className={cn(
-      "fixed inset-0 z-50 bg-black/80  data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0",
+      "fixed inset-0 z-50 bg-black/35 data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 sm:bg-black/45",
       className
     )}
     {...props}

apps/web/src/components/ui/input.tsx

@@ -8,7 +8,7 @@ const Input = React.forwardRef<HTMLInputElement, React.ComponentProps<"input">>(
       <input
         type={type}
         className={cn(
-          "flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors file:border-0 file:bg-transparent file:text-sm file:font-medium file:text-foreground placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm",
+          "flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors file:border-0 file:bg-transparent file:text-sm file:font-medium file:text-foreground placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background disabled:cursor-not-allowed disabled:opacity-50 md:text-sm",
           className
         )}
         ref={ref}

apps/web/src/components/ui/select.tsx

@@ -17,7 +17,7 @@ const SelectTrigger = React.forwardRef<
   <SelectPrimitive.Trigger
     ref={ref}
     className={cn(
-      "flex h-9 w-full items-center justify-between whitespace-nowrap rounded-md border border-input bg-transparent px-3 py-2 text-sm shadow-sm ring-offset-background data-[placeholder]:text-muted-foreground focus:outline-none focus:ring-1 focus:ring-ring disabled:cursor-not-allowed disabled:opacity-50 [&>span]:line-clamp-1",
+      "flex h-9 w-full items-center justify-between whitespace-nowrap rounded-md border border-input bg-transparent px-3 py-2 text-sm shadow-sm ring-offset-background data-[placeholder]:text-muted-foreground focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50 [&>span]:line-clamp-1",
       className
     )}
     {...props}

apps/web/src/components/ui/table.tsx

@@ -20,7 +20,7 @@ const TableHeader = React.forwardRef<
   HTMLTableSectionElement,
   React.HTMLAttributes<HTMLTableSectionElement>
 >(({ className, ...props }, ref) => (
-  <thead ref={ref} className={cn("[&_tr]:border-b", className)} {...props} />
+  <thead ref={ref} data-slot="table-header" className={cn("[&_tr]:border-b", className)} {...props} />
 ))
 TableHeader.displayName = "TableHeader"
 
@@ -57,6 +57,7 @@ const TableRow = React.forwardRef<
 >(({ className, ...props }, ref) => (
   <tr
     ref={ref}
+    data-slot="table-row"
     className={cn(
       "border-b transition-colors hover:bg-muted/50 data-[state=selected]:bg-muted",
       className
@@ -72,6 +73,7 @@ const TableHead = React.forwardRef<
 >(({ className, ...props }, ref) => (
   <th
     ref={ref}
+    data-slot="table-head"
     className={cn(
       "h-10 px-2 text-left align-middle font-medium text-muted-foreground [&:has([role=checkbox])]:pr-0 [&>[role=checkbox]]:translate-y-[2px]",
       className
@@ -87,6 +89,7 @@ const TableCell = React.forwardRef<
 >(({ className, ...props }, ref) => (
   <td
     ref={ref}
+    data-slot="table-cell"
     className={cn(
       "p-2 align-middle [&:has([role=checkbox])]:pr-0 [&>[role=checkbox]]:translate-y-[2px]",
       className

apps/web/src/components/ui/textarea.tsx

@@ -9,7 +9,7 @@ const Textarea = React.forwardRef<
   return (
     <textarea
       className={cn(
-        "flex min-h-[60px] w-full rounded-md border border-input bg-transparent px-3 py-2 text-base shadow-sm placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm",
+        "flex min-h-[60px] w-full rounded-md border border-input bg-transparent px-3 py-2 text-base shadow-sm placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background disabled:cursor-not-allowed disabled:opacity-50 md:text-sm",
         className
       )}
       ref={ref}

apps/web/src/hooks/use-me.ts

@@ -1,5 +1,5 @@
 import { useQuery, type UseQueryOptions } from "@tanstack/react-query"
-import { api } from "@/lib/api"
+import { api, isUnauthorizedError } from "@/lib/api"
 import type { User } from "@/lib/api"
 
 type MeResponse = { user: User }
@@ -10,11 +10,7 @@ export function useMe(
   return useQuery({
     queryKey: ["me"],
     queryFn: api.me,
-    retry: 1,
+    retry: (failureCount, error) => !isUnauthorizedError(error) && failureCount < 1,
     ...options,
   })
 }
-
-export function isTimeoutError(error: unknown): boolean {
-  return error instanceof Error && error.message.includes("请求超时")
-}

apps/web/src/index.css

@@ -5,34 +5,34 @@
 @layer base {
   :root {
     --background: 0 0% 100%;
-    --foreground: 222.2 84% 4.9%;
+    --foreground: 0 0% 9%;
     --card: 0 0% 100%;
-    --card-foreground: 222.2 84% 4.9%;
+    --card-foreground: 0 0% 9%;
     --popover: 0 0% 100%;
-    --popover-foreground: 222.2 84% 4.9%;
-    --primary: 224 44% 12%;
+    --popover-foreground: 0 0% 9%;
+    --primary: 0 0% 12%;
     --primary-foreground: 0 0% 98%;
-    --secondary: 210 40% 96.1%;
-    --secondary-foreground: 222.2 84% 4.9%;
-    --muted: 210 40% 96.1%;
-    --muted-foreground: 215.4 16.3% 46.9%;
-    --accent: 210 40% 96.1%;
-    --accent-foreground: 222.2 84% 4.9%;
+    --secondary: 0 0% 96.1%;
+    --secondary-foreground: 0 0% 12%;
+    --muted: 0 0% 96.1%;
+    --muted-foreground: 0 0% 42%;
+    --accent: 0 0% 95%;
+    --accent-foreground: 0 0% 12%;
     --destructive: 358 88% 61%;
     --destructive-foreground: 0 0% 98%;
-    --border: 214.3 31.8% 91.4%;
-    --input: 214.3 31.8% 91.4%;
-    --ring: 216 22% 42%;
+    --border: 0 0% 89.8%;
+    --input: 0 0% 82%;
+    --ring: 0 0% 32%;
     --radius: 0.5rem;
     --app-sidebar-width: 18rem;
     --sidebar-background: 0 0% 100%;
-    --sidebar-foreground: 222.2 84% 4.9%;
-    --sidebar-primary: 224 44% 12%;
+    --sidebar-foreground: 0 0% 16%;
+    --sidebar-primary: 0 0% 12%;
     --sidebar-primary-foreground: 0 0% 98%;
-    --sidebar-accent: 210 40% 96.1%;
-    --sidebar-accent-foreground: 222.2 84% 4.9%;
-    --sidebar-border: 214.3 31.8% 91.4%;
-    --sidebar-ring: 215.4 16.3% 46.9%;
+    --sidebar-accent: 0 0% 95%;
+    --sidebar-accent-foreground: 0 0% 12%;
+    --sidebar-border: 0 0% 89.8%;
+    --sidebar-ring: 0 0% 42%;
   }
 
   * { @apply border-border; }
@@ -140,12 +140,50 @@
   }
 
   [data-sidebar="menu-button"][data-active="true"] {
-    background: hsl(var(--sidebar-accent));
+    background: hsl(var(--sidebar-accent) / 0.82);
     color: hsl(var(--sidebar-accent-foreground));
+    box-shadow: inset 2px 0 0 hsl(var(--foreground));
   }
 
   [data-sidebar="menu-button"][data-active="true"] svg {
-    color: hsl(var(--muted-foreground));
+    color: hsl(var(--foreground));
+  }
+
+  .admin-page [data-slot="card"] {
+    border-radius: 0.5rem;
+    box-shadow: none;
+  }
+
+  .admin-page [data-slot="card-header"] {
+    padding: 1.25rem;
+  }
+
+  .admin-page [data-slot="card-content"] {
+    padding: 0 1.25rem 1.25rem;
+  }
+
+  .admin-page [data-slot="card-title"] {
+    font-size: 0.9375rem;
+    line-height: 1.4;
+  }
+
+  .admin-page [data-slot="table-header"] {
+    background: hsl(var(--muted) / 0.48);
+  }
+
+  .admin-page [data-slot="table-head"] {
+    height: 2.5rem;
+    padding-left: 0.75rem;
+    padding-right: 0.75rem;
+    font-size: 0.75rem;
+  }
+
+  .admin-page [data-slot="table-cell"] {
+    padding: 0.75rem;
+  }
+
+  .admin-page [data-slot="table-row"]:hover {
+    background: hsl(var(--muted) / 0.32);
   }
 }
 

apps/web/src/lib/api-types.ts

@@ -52,12 +52,12 @@ export type PermissionGroupSummary = { id: string; name: string }
 export type PermissionGroup = { id: string; name: string; description: string; permissions: PermissionKey[]; limits: PermissionLimits; system: boolean; userCount: number; createdAt: string; updatedAt: string }
 export type User = { id: string; loginName?: string; email: string; displayName: string; role: "admin" | "user"; disabled: boolean; protected: boolean; twoFactorEnabled: boolean; mailboxLimitOverride?: number | null; permissions: PermissionKey[]; limits: PermissionLimits; permissionGroupIds: string[]; permissionGroups: PermissionGroupSummary[]; createdAt: string }
 export type APIToken = { id: string; name: string; lastUsedAt?: string; expiresAt?: string; disabled: boolean; scopes: string[]; createdAt: string; updatedAt: string }
-export type AdminUser = User & { mailboxCount: number; mailboxes?: string[] }
+export type AdminUser = User & { mailboxCount: number; mailboxes?: string[]; storageQuotaMb: number }
 export type AdminOverview = { users: number; activeUsers: number; domains: number; mailboxes: number; activeMailboxes: number; aliases: number; messages: number; unreadMessages: number; storageBytes: number }
 export type Domain = { id: string; name: string; status: string; dkimSelector: string; dkimPublicKey?: string; dnsStatus: string; dnsCheckedAt?: string; createdAt: string }
-export type Mailbox = { id: string; userId: string; userEmail?: string; domainId: string; localPart: string; address: string; displayName: string; quotaMb: number; status: string; unreadCount?: number; createdAt: string }
+export type Mailbox = { id: string; userId: string; userEmail?: string; domainId: string; localPart: string; address: string; displayName: string; quotaMb: number; status: string; primary?: boolean; unreadCount?: number; createdAt: string }
 export type Alias = { id: string; domainId: string; source: string; destination: string; enabled: boolean; createdAt: string }
-export type MailFolder = { id: string; name: string; role: string; sortOrder: number; unreadCount: number; totalCount: number; uidValidity: number; uidNext: number; highestModseq: number }
+export type MailFolder = { id: string; name: string; role: string; icon: string; sortOrder: number; unreadCount: number; totalCount: number; uidValidity: number; uidNext: number; highestModseq: number }
 export type Attachment = { id: string; messageId: string; filename: string; contentType: string; sizeBytes: number; createdAt: string }
 export type MailLabel = { id: string; mailboxId?: string; name: string; color: string; messageCount?: number }
 export type MailMessage = {

apps/web/src/lib/api.ts

@@ -4,6 +4,17 @@ export * from "./api-types"
 const REQUEST_TIMEOUT_MS = 15_000
 const MAIL_DELIVERY_TIMEOUT_MS = 60_000
 
+export class ApiError extends Error {
+  constructor(message: string, readonly status: number) {
+    super(message)
+    this.name = "ApiError"
+  }
+}
+
+export function isUnauthorizedError(error: unknown): boolean {
+  return error instanceof ApiError && error.status === 401
+}
+
 export type MailSearchParams = {
   q?: string
   from?: string
@@ -45,27 +56,34 @@ function appendMailSearchParams(params: URLSearchParams, search: MailSearchParam
 async function request<T>(path: string, init: RequestInit & { timeoutMs?: number } = {}): Promise<T> {
   const { timeoutMs, ...requestInit } = init
   const controller = new AbortController()
-  const timeout = window.setTimeout(() => controller.abort(), timeoutMs || REQUEST_TIMEOUT_MS)
+  let timedOut = false
+  const timeout = window.setTimeout(() => {
+    timedOut = true
+    controller.abort()
+  }, timeoutMs || REQUEST_TIMEOUT_MS)
   const externalSignal = requestInit.signal
+  const abortFromExternalSignal = () => controller.abort()
   if (externalSignal) {
     if (externalSignal.aborted) controller.abort()
-    else externalSignal.addEventListener("abort", () => controller.abort(), { once: true })
+    else externalSignal.addEventListener("abort", abortFromExternalSignal, { once: true })
   }
   try {
     const res = await fetch(path, { credentials: "include", headers: { "Content-Type": "application/json", ...(requestInit.headers || {}) }, ...requestInit, signal: controller.signal })
     if (!res.ok) {
       let message = `${res.status} ${res.statusText}`
       try { const body = await res.json(); message = body.error || message } catch {}
-      throw new Error(message)
+      throw new ApiError(message, res.status)
     }
     return res.json() as Promise<T>
   } catch (error) {
     if (error instanceof DOMException && error.name === "AbortError") {
-      throw new Error("请求超时，请检查后端服务是否正常")
+      throw new Error(timedOut ? "请求超时，请检查后端服务是否正常" : "请求已取消")
     }
+    if (error instanceof TypeError) throw new Error("无法连接后端服务，请检查服务状态")
     throw error instanceof Error ? error : new Error("网络请求失败")
   } finally {
     window.clearTimeout(timeout)
+    externalSignal?.removeEventListener("abort", abortFromExternalSignal)
   }
 }
 
@@ -154,8 +172,8 @@ export const api = {
   updatePermissionGroup: (id: string, payload: { name: string; description: string; permissions: PermissionKey[]; limits: PermissionLimits }) => request<PermissionGroup>(`/api/admin/permission-groups/${id}`, { method: "POST", body: JSON.stringify(payload) }),
   defaultPermissionLimits: () => request<PermissionLimits>("/api/admin/permission-limits/defaults"),
   deletePermissionGroup: (id: string) => request<{ ok: boolean }>(`/api/admin/permission-groups/${id}`, { method: "DELETE" }),
-  createUser: (payload: { email: string; displayName: string; role: "user"; password: string; disabled: boolean; mailboxLimitOverride?: number }) => request<AdminUser>("/api/admin/users", { method: "POST", body: JSON.stringify(payload) }),
-  updateUser: (id: string, payload: { email?: string; displayName: string; role: "admin" | "user"; disabled: boolean; mailboxLimitOverride?: number; permissionGroupIds?: string[] }) => request<AdminUser>(`/api/admin/users/${id}`, { method: "POST", body: JSON.stringify(payload) }),
+  createUser: (payload: { email: string; displayName: string; role: "user"; password: string; disabled: boolean; mailboxLimitOverride?: number; storageQuotaMb?: number; permissionGroupIds?: string[] }) => request<AdminUser>("/api/admin/users", { method: "POST", body: JSON.stringify(payload) }),
+  updateUser: (id: string, payload: { email?: string; displayName: string; role: "admin" | "user"; disabled: boolean; mailboxLimitOverride?: number; storageQuotaMb?: number; permissionGroupIds?: string[] }) => request<AdminUser>(`/api/admin/users/${id}`, { method: "POST", body: JSON.stringify(payload) }),
   resetUserPassword: (id: string, password: string) => request<{ ok: boolean }>(`/api/admin/users/${id}/password`, { method: "POST", body: JSON.stringify({ password }) }),
   deleteUser: (id: string) => request<{ ok: boolean }>(`/api/admin/users/${id}`, { method: "DELETE" }),
   domains: () => request<ListResponse<Domain>>("/api/admin/domains"),
@@ -163,7 +181,7 @@ export const api = {
   updateDomain: (id: string, payload: { status: string }) => request<Domain>(`/api/admin/domains/${id}`, { method: "POST", body: JSON.stringify(payload) }),
   deleteDomain: (id: string) => request<{ ok: boolean }>(`/api/admin/domains/${id}`, { method: "DELETE" }),
   mailboxes: () => request<ListResponse<Mailbox>>("/api/admin/mailboxes"),
-  createMailbox: (payload: { domainId: string; localPart: string; displayName: string; password: string; quotaMb: number; role: "user"; ownerEmail?: string; userId?: string }) => request<Mailbox>("/api/admin/mailboxes", { method: "POST", body: JSON.stringify(payload) }),
+  createMailbox: (payload: { domainId: string; localPart: string; displayName?: string; userId: string }) => request<Mailbox>("/api/admin/mailboxes", { method: "POST", body: JSON.stringify(payload) }),
   updateMailbox: (id: string, payload: { userId: string; displayName: string; quotaMb: number; status: string }) => request<Mailbox>(`/api/admin/mailboxes/${id}`, { method: "POST", body: JSON.stringify(payload) }),
   deleteMailbox: (id: string) => request<{ ok: boolean }>(`/api/admin/mailboxes/${id}`, { method: "DELETE" }),
   aliases: () => request<ListResponse<Alias>>("/api/admin/aliases"),
@@ -215,9 +233,9 @@ export const api = {
   externalMessage: (id: string, remoteId: string) => request<MailMessage>(`/api/mail/external-accounts/${id}/messages/${encodeURIComponent(remoteId)}`),
   markExternalRead: (id: string, remoteId: string, read: boolean) => request<{ ok: boolean }>(`/api/mail/external-accounts/${id}/messages/${encodeURIComponent(remoteId)}/mark-read`, { method: "POST", body: JSON.stringify({ read }) }),
   folders: (mailboxId?: string) => request<ListResponse<MailFolder>>(`/api/mail/folders${mailboxId ? `?mailboxId=${encodeURIComponent(mailboxId)}` : ""}`),
-  createFolder: (payload: { mailboxId?: string; name: string }) => {
+  createFolder: (payload: { mailboxId?: string; name: string; icon?: string }) => {
     const query = payload.mailboxId ? `?mailboxId=${encodeURIComponent(payload.mailboxId)}` : ""
-    return request<MailFolder>(`/api/mail/folders${query}`, { method: "POST", body: JSON.stringify({ name: payload.name }) })
+    return request<MailFolder>(`/api/mail/folders${query}`, { method: "POST", body: JSON.stringify({ name: payload.name, icon: payload.icon }) })
   },
   reorderFolders: (payload: { mailboxId?: string; folderIds: string[]; folders?: { id: string; sortOrder: number }[] }) => {
     const query = payload.mailboxId ? `?mailboxId=${encodeURIComponent(payload.mailboxId)}` : ""

apps/web/src/lib/navigation.ts

@@ -0,0 +1,4 @@
+export function safeReturnPath(value: unknown, fallback = "/"): string {
+  if (typeof value !== "string" || !value.startsWith("/") || value.startsWith("//")) return fallback
+  return value
+}

apps/web/src/pages/admin.tsx

@@ -2,7 +2,7 @@ import * as React from "react"
 import DOMPurify from "dompurify"
 import { useSearchParams } from "react-router-dom"
 import { useInfiniteQuery, useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
-import { ArrowRight, BookOpen, CheckCircle2, ChevronDown, Circle, ClipboardList, Copy, ExternalLink, Github, Globe2, Mail, Mailbox, MoreHorizontal, Plus, RefreshCcw, Scale, Search, ShieldCheck, Star, Trash2, Users } from "lucide-react"
+import { ArrowRight, BookOpen, CheckCircle2, ChevronDown, Circle, ClipboardList, Copy, ExternalLink, Github, Globe2, Mail, Mailbox, MoreHorizontal, RefreshCcw, Scale, Search, ShieldCheck, Star, Trash2, Users } from "lucide-react"
 import { api, AdminUser, Alias, DNSRecord, Domain, Mailbox as MailboxType, MailMessage, MailTemplate, MaildirSyncHealth, PermissionGroup, PermissionInfo, PermissionLimits, SystemSettings } from "@/lib/api"
 import { cn, decodeMimeHeader, formatBytes, formatDate } from "@/lib/utils"
 import { Button } from "@/components/ui/button"
@@ -32,10 +32,10 @@ type PendingConfirm = { title: string; description?: string; confirmText: string
 
 const sectionMeta: Record<Section, { label: string; frontLabel: string; description: string }> = {
   overview: { label: "数据总览", frontLabel: "数据统计", description: "系统运行、DNS、邮箱和消息状态集中查看。" },
-  users: { label: "账号管理", frontLabel: "账号设置", description: "管理登录账号、身份状态、邮箱数量上限和绑定邮箱。" },
+  users: { label: "账号管理", frontLabel: "账号设置", description: "管理登录账号、身份状态、邮箱数量上限和共享存储容量。" },
   permissionGroups: { label: "权限配置", frontLabel: "账号权限", description: "配置自定义权限、发信频率、附件和邮箱创建额度。" },
   domains: { label: "域名管理", frontLabel: "邮箱地址", description: "维护邮件域名、DKIM 和 DNS 检测。" },
-  mailboxes: { label: "邮箱管理", frontLabel: "邮箱管理", description: "创建、分配、停用邮箱，保持与前台邮箱列表一致。" },
+  mailboxes: { label: "邮箱管理", frontLabel: "邮箱管理", description: "按归属账号查看和管理子邮箱，默认邮箱受保护。" },
   aliases: { label: "邮件转发", frontLabel: "邮件转发", description: "管理域名转发规则。" },
   messages: { label: "全部邮件", frontLabel: "全部邮箱", description: "按邮箱、文件夹和关键词查看全站邮件。" },
   sendAudit: { label: "发送队列", frontLabel: "发送队列", description: "查看发信投递、重试和失败记录。" },
@@ -58,8 +58,12 @@ const projectRepositoryUrl = "https://github.com/zxyszx/NewSzxcn-Email"
 const projectTelegramUrl = "https://t.me/+EhII7MSyi3QwNDQ5"
 const defaultPermissionLimits: PermissionLimits = { maxAttachmentMb: 25, maxMailboxCount: 9, smtpDailyLimit: 200, smtpMinuteLimit: 20, imapMinuteLimit: 200, pop3MinuteLimit: 150 }
 const defaultMailboxLimitOverride = 9
+const defaultUserStorageQuotaMb = 100
+const defaultAdminStorageQuotaMb = 1024
+const superAdminPermissionGroupId = "pg_super_admin"
+const regularUserPermissionGroupId = "pg_regular_user"
+const defaultStorageQuotaMb = (role: AdminUser["role"]) => role === "admin" ? defaultAdminStorageQuotaMb : defaultUserStorageQuotaMb
 const accountPrimaryEmail = (user: Pick<AdminUser, "email" | "loginName">) => user.email || user.loginName || ""
-
 function compareAdminUsers(left: AdminUser, right: AdminUser) {
   if (left.role === "admin" && right.role !== "admin") return -1
   if (left.role !== "admin" && right.role === "admin") return 1
@@ -86,7 +90,7 @@ export function AdminPage() {
   const overview = useQuery({ queryKey: ["admin", "overview"], queryFn: api.adminOverview, enabled: !!user && canOverview })
   const users = useQuery({ queryKey: ["admin", "users"], queryFn: api.users, enabled: !!user && (canUsersView || canMailboxesView) })
   const permissionGroups = useQuery({ queryKey: ["admin", "permission-groups"], queryFn: api.permissionGroups, enabled: !!user && (canPermissionGroupsView || canUsersView) })
-  const domains = useQuery({ queryKey: ["admin", "domains"], queryFn: api.domains, enabled: !!user && (canDomainsView || canDNSView || canMailboxesView || canAliasesView || canSettingsView || canTemplatesView) })
+  const domains = useQuery({ queryKey: ["admin", "domains"], queryFn: api.domains, enabled: !!user && (canUsersView || canDomainsView || canDNSView || canMailboxesView || canAliasesView || canSettingsView || canTemplatesView) })
   const mailboxes = useQuery({ queryKey: ["admin", "mailboxes"], queryFn: api.mailboxes, enabled: !!user && (canMailboxesView || canMessagesView || canSettingsView) })
   const aliases = useQuery({ queryKey: ["admin", "aliases"], queryFn: api.aliases, enabled: !!user && canAliasesView })
   const settings = useQuery({ queryKey: ["admin", "settings"], queryFn: api.systemSettings, enabled: !!user && canSettingsView })
@@ -97,10 +101,18 @@ export function AdminPage() {
   const mailboxItems = mailboxes.data?.items || []
   const aliasItems = aliases.data?.items || []
   const userItems = users.data?.items || []
-  const assignablePermissionGroups = (permissionGroups.data?.items || []).filter((group) => group.id !== "pg_super_admin" && group.id !== "pg_regular_user")
+  const assignablePermissionGroups = (permissionGroups.data?.items || []).filter((group) => group.id !== superAdminPermissionGroupId && group.id !== regularUserPermissionGroupId)
   const visibleSections = sectionKeys.filter((key) => hasAnyPermission(user, sectionPermissions[key]))
   const rawSection = params.get("section") as Section | null
   const section: Section = rawSection && visibleSections.includes(rawSection) ? rawSection : visibleSections[0] || "overview"
+  const sectionQuery = section === "overview" ? overview
+    : section === "users" ? users
+      : section === "permissionGroups" ? permissionGroups
+        : section === "domains" ? domains
+          : section === "mailboxes" ? mailboxes
+            : section === "aliases" ? aliases
+              : section === "settings" ? settings
+                : null
 
   async function refreshAdminPage() {
     if (refreshing) return
@@ -121,9 +133,11 @@ export function AdminPage() {
 
   return (
     <ScrollArea className="h-[calc(100svh-3rem)] md:h-svh">
-      <main className="mx-auto w-full max-w-[1180px] px-3 pb-10 pt-3 sm:px-4 sm:pt-4">
+      <main className="admin-page mx-auto w-full max-w-[1180px] px-3 pb-10 pt-3 sm:px-4 sm:pt-4">
         <AdminPageHeader section={section} refreshing={refreshing} onRefresh={refreshAdminPage} />
 
+        {sectionQuery?.isError && <QueryFailure error={sectionQuery.error} onRetry={() => { void sectionQuery.refetch() }} />}
+
         {section === "overview" && canOverview && (
           <div className="mb-4 grid gap-3 sm:grid-cols-2 xl:grid-cols-4">
             <Stat icon={<Users />} label="账号" value={overview.data?.users || 0} />
@@ -134,7 +148,7 @@ export function AdminPage() {
         )}
 
         {section === "overview" && <OverviewSection overview={overview.data} domains={domainItems} settings={settings.data} visibleSections={visibleSections} onSectionChange={(next) => setParams(next === "overview" ? {} : { section: next })} />}
-        {section === "users" && <UsersSection users={userItems} permissionGroups={assignablePermissionGroups} />}
+        {section === "users" && <UsersSection users={userItems} permissionGroups={assignablePermissionGroups} domains={domainItems} />}
         {section === "permissionGroups" && <PermissionGroupsSection groups={permissionGroups.data?.items || []} catalog={permissionGroups.data?.catalog || []} />}
         {section === "domains" && <DomainsSection domains={domainItems} />}
         {section === "mailboxes" && <MailboxesSection mailboxes={mailboxItems} users={userItems} domains={domainItems} />}
@@ -165,7 +179,6 @@ function AdminPageHeader({ section, refreshing, onRefresh }: { section: Section;
           <Button type="button" variant="outline" size="icon" className="h-8 w-8 shadow-none" onClick={onRefresh} disabled={refreshing} aria-label="刷新后台数据" title="刷新后台数据">
             <RefreshCcw className={cn("h-4 w-4", refreshing && "animate-spin")} />
           </Button>
-          <Badge variant="outline" className="h-7 rounded-md px-2.5 font-normal">NewSzxcn</Badge>
         </div>
       </div>
     </div>
@@ -242,7 +255,7 @@ function InfoLine({ label, value }: { label: string; value: React.ReactNode }) {
   return <div className="flex items-center justify-between gap-3 rounded-md border px-3 py-2"><span>{label}</span><span className="min-w-0 truncate font-medium text-foreground">{value}</span></div>
 }
 
-function UsersSection({ users, permissionGroups }: { users: AdminUser[]; permissionGroups: PermissionGroup[] }) {
+function UsersSection({ users, permissionGroups, domains }: { users: AdminUser[]; permissionGroups: PermissionGroup[]; domains: Domain[] }) {
   const me = useMe()
   const user = me.data?.user
   const qc = useQueryClient()
@@ -269,7 +282,9 @@ function UsersSection({ users, permissionGroups }: { users: AdminUser[]; permiss
       <CardHeader>
         <div className="flex flex-col gap-3 md:flex-row md:items-center md:justify-between">
           <CardTitle>账号管理</CardTitle>
-          {canCreate && <CreateUserDialog permissionGroups={permissionGroups} />}
+          <div className="flex flex-wrap gap-2">
+            {canCreate && <CreateUserDialog permissionGroups={permissionGroups} domains={domains} />}
+          </div>
         </div>
       </CardHeader>
       <CardContent className="space-y-4">
@@ -307,8 +322,8 @@ function UsersSection({ users, permissionGroups }: { users: AdminUser[]; permiss
               </div>
               <div className="mt-3 flex flex-wrap gap-2">
                 <RoleBadge user={user} />
-                <Badge variant={user.disabled ? "secondary" : "default"}>{user.disabled ? "停用" : "正常"}</Badge>
-                <Badge variant="outline">{new Date(user.createdAt).toLocaleDateString()}</Badge>
+                <AccountStatus user={user} />
+                <span className="text-xs text-muted-foreground">{new Date(user.createdAt).toLocaleDateString()}</span>
               </div>
               <div className="mt-3"><UserPermissionGroupsCell user={user} /></div>
               <div className="mt-3"><UserMailboxCell user={user} /></div>
@@ -328,7 +343,7 @@ function UsersSection({ users, permissionGroups }: { users: AdminUser[]; permiss
                   <TableCell><RoleBadge user={user} /></TableCell>
                   <TableCell><UserPermissionGroupsCell user={user} /></TableCell>
                   <TableCell className="w-[22rem] max-w-[22rem]"><UserMailboxCell user={user} /></TableCell>
-                  <TableCell><Badge variant={user.disabled ? "secondary" : "default"}>{user.disabled ? "停用" : "正常"}</Badge></TableCell>
+                  <TableCell><AccountStatus user={user} /></TableCell>
                   <TableCell className="text-muted-foreground">{new Date(user.createdAt).toLocaleDateString()}</TableCell>
                   <TableCell><UserActions user={user} permissionGroups={permissionGroups} onDelete={canDelete ? () => setPendingConfirm({ title: "删除账号？", description: `将删除 ${accountPrimaryEmail(user)} 及其关联数据。`, confirmText: "删除账号", onConfirm: () => remove.mutate(user.id) }) : undefined} /></TableCell>
                 </TableRow>
@@ -350,6 +365,7 @@ function PermissionGroupsSection({ groups, catalog }: { groups: PermissionGroup[
   const { toast } = useToast()
   const [query, setQuery] = React.useState("")
   const [editing, setEditing] = React.useState<PermissionGroup | null>(null)
+  const [viewing, setViewing] = React.useState<PermissionGroup | null>(null)
   const [pendingConfirm, setPendingConfirm] = React.useState<PendingConfirm | null>(null)
   const canCreate = hasPermission(user, "admin.permission_groups.create")
   const canUpdate = hasPermission(user, "admin.permission_groups.update")
@@ -368,15 +384,17 @@ function PermissionGroupsSection({ groups, catalog }: { groups: PermissionGroup[
     if (!keyword) return true
     return [group.name, group.description, ...group.permissions].some((value) => value.toLowerCase().includes(keyword))
   })
-  const isEditable = (group: PermissionGroup) => !group.system
+  const isEditable = (group: PermissionGroup) => !group.system || group.id === regularUserPermissionGroupId
   const isDeletable = (group: PermissionGroup) => !group.system && group.userCount === 0
   return (
     <Card>
       <CardHeader>
         <div className="flex flex-col gap-3 md:flex-row md:items-center md:justify-between">
           <CardTitle>权限配置</CardTitle>
+          <div className="flex flex-wrap gap-2">
             {canCreate && <PermissionGroupDialog catalog={catalog} />}
           </div>
+        </div>
       </CardHeader>
       <CardContent className="space-y-4">
         <div className="relative">
@@ -390,27 +408,22 @@ function PermissionGroupsSection({ groups, catalog }: { groups: PermissionGroup[
                 <div className="min-w-0">
                   <div className="flex flex-wrap items-center gap-2">
                     <div className="font-medium">{group.name}</div>
-                    {group.system && <Badge variant="outline">系统组</Badge>}
-                    {!group.system && <Badge variant="secondary">自定义</Badge>}
-                    <Badge variant="outline">{group.userCount} 人</Badge>
+                    <span className="text-xs text-muted-foreground">{group.system ? "系统配置" : "自定义配置"} · {group.userCount} 个账号</span>
                   </div>
                   <div className="mt-1 line-clamp-2 text-sm text-muted-foreground">{group.description || "未填写说明"}</div>
                 </div>
-                {(canUpdate || canDelete) && <DropdownMenu>
-                  <DropdownMenuTrigger asChild><Button variant="ghost" size="icon"><MoreHorizontal className="h-4 w-4" /></Button></DropdownMenuTrigger>
+                <div className="flex shrink-0 items-center gap-1">
+                  <Button type="button" variant="outline" size="sm" onClick={() => setViewing(group)}>查看全部权限</Button>
+                  {((isEditable(group) && canUpdate) || (isDeletable(group) && canDelete)) && <DropdownMenu>
+                    <DropdownMenuTrigger asChild><Button variant="ghost" size="icon" aria-label={`管理权限配置 ${group.name}`} title="更多操作"><MoreHorizontal className="h-4 w-4" /></Button></DropdownMenuTrigger>
                     <DropdownMenuContent align="end">
-                    <DropdownMenuItem disabled={!isEditable(group) || !canUpdate} onSelect={() => setEditing(group)}>编辑权限配置</DropdownMenuItem>
-                    <DropdownMenuSeparator />
-                    <DropdownMenuItem
-                      className="text-destructive"
-                      disabled={!isDeletable(group) || !canDelete}
-                      onSelect={() => setPendingConfirm({ title: "删除权限配置？", description: `${group.name} 删除后不能再分配给账号。`, confirmText: "删除权限配置", onConfirm: () => remove.mutate(group.id) })}
-                    >
-                      删除权限配置
-                    </DropdownMenuItem>
+                      {isEditable(group) && canUpdate && <DropdownMenuItem onSelect={() => setEditing(group)}>{group.id === regularUserPermissionGroupId ? "编辑普通用户权限" : "编辑权限配置"}</DropdownMenuItem>}
+                      {isEditable(group) && canUpdate && isDeletable(group) && canDelete && <DropdownMenuSeparator />}
+                      {isDeletable(group) && canDelete && <DropdownMenuItem className="text-destructive" onSelect={() => setPendingConfirm({ title: "删除权限配置？", description: `${group.name} 删除后不能再分配给账号。`, confirmText: "删除权限配置", onConfirm: () => remove.mutate(group.id) })}>删除权限配置</DropdownMenuItem>}
                     </DropdownMenuContent>
                   </DropdownMenu>}
                 </div>
+              </div>
               <PermissionBadges permissions={group.permissions} catalog={catalog} />
               <PermissionLimitBadges limits={group.limits} />
             </div>
@@ -419,6 +432,7 @@ function PermissionGroupsSection({ groups, catalog }: { groups: PermissionGroup[
         {filtered.length === 0 && <Empty text="暂无匹配的权限配置" />}
       </CardContent>
       {editing && <PermissionGroupDialog group={editing} catalog={catalog} open={!!editing} onOpenChange={(open) => { if (!open) setEditing(null) }} />}
+      {viewing && <PermissionGroupDetailsDialog group={viewing} catalog={catalog} open={!!viewing} onOpenChange={(open) => { if (!open) setViewing(null) }} />}
       <ConfirmDialog open={!!pendingConfirm} title={pendingConfirm?.title || ""} description={pendingConfirm?.description} confirmText={pendingConfirm?.confirmText || "删除"} destructive pending={remove.isPending} onOpenChange={(open) => { if (!open) setPendingConfirm(null) }} onConfirm={() => pendingConfirm?.onConfirm()} />
     </Card>
   )
@@ -430,6 +444,7 @@ function PermissionGroupDialog({ group, catalog, open, onOpenChange }: { group?:
   const [internalOpen, setInternalOpen] = React.useState(false)
   const dialogOpen = open ?? internalOpen
   const setDialogOpen = onOpenChange ?? setInternalOpen
+  const fixedIdentity = group?.id === regularUserPermissionGroupId
   const defaultLimitsQuery = useQuery({ queryKey: ["admin", "permission-limits", "defaults"], queryFn: api.defaultPermissionLimits, enabled: dialogOpen })
   const defaultLimits = defaultLimitsQuery.data || defaultPermissionLimits
   const [permissions, setPermissions] = React.useState<PermissionKey[]>(group?.permissions || [])
@@ -459,18 +474,18 @@ function PermissionGroupDialog({ group, catalog, open, onOpenChange }: { group?:
   })
   const trigger = group ? null : (
     <DialogTrigger asChild>
-      <Button size="sm"><Plus className="h-4 w-4" />权限配置</Button>
+      <Button size="sm" className="self-start">添加权限配置</Button>
     </DialogTrigger>
   )
   return (
     <Dialog open={dialogOpen} onOpenChange={setDialogOpen}>
       {trigger}
       <DialogContent className="max-h-[86vh] overflow-y-auto sm:max-w-3xl">
-        <DialogHeader><DialogTitle>{group ? "编辑权限配置" : "创建权限配置"}</DialogTitle></DialogHeader>
+        <DialogHeader><DialogTitle>{fixedIdentity ? "编辑普通用户权限" : group ? "编辑权限配置" : "创建权限配置"}</DialogTitle></DialogHeader>
         <form className="space-y-4" onSubmit={(event) => { event.preventDefault(); mutation.mutate(new FormData(event.currentTarget)) }}>
           <div className="grid gap-4 md:grid-cols-2">
-            <Field name="name" label="名称" defaultValue={group?.name || ""} placeholder="例如：客服主管" />
-            <Field name="description" label="说明" defaultValue={group?.description || ""} required={false} />
+            <Field name="name" label="名称" defaultValue={group?.name || ""} placeholder="例如：客服主管" readOnly={fixedIdentity} />
+            <Field name="description" label="说明" defaultValue={group?.description || ""} required={false} readOnly={fixedIdentity} />
           </div>
           <PermissionLimitEditor value={limits} onChange={setLimits} />
           <PermissionPicker catalog={catalog} value={permissions} onChange={setPermissions} />
@@ -481,7 +496,20 @@ function PermissionGroupDialog({ group, catalog, open, onOpenChange }: { group?:
   )
 }
 
-function PermissionPicker({ catalog, value, onChange }: { catalog: PermissionInfo[]; value: PermissionKey[]; onChange: (value: PermissionKey[]) => void }) {
+function PermissionGroupDetailsDialog({ group, catalog, open, onOpenChange }: { group: PermissionGroup; catalog: PermissionInfo[]; open: boolean; onOpenChange: (open: boolean) => void }) {
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="max-h-[86vh] overflow-y-auto sm:max-w-3xl">
+        <DialogHeader><DialogTitle>{group.name}的全部权限</DialogTitle></DialogHeader>
+        <p className="text-sm text-muted-foreground">共 {group.permissions.length} 项权限。{group.id === superAdminPermissionGroupId ? "管理员权限由账号身份决定，不能修改。" : ""}</p>
+        <PermissionLimitBadges limits={group.limits} />
+        <PermissionPicker catalog={catalog} value={group.permissions} onChange={() => undefined} readOnly />
+      </DialogContent>
+    </Dialog>
+  )
+}
+
+function PermissionPicker({ catalog, value, onChange, readOnly = false }: { catalog: PermissionInfo[]; value: PermissionKey[]; onChange: (value: PermissionKey[]) => void; readOnly?: boolean }) {
   const grouped = groupPermissionCatalog(catalog)
   function toggle(permission: PermissionKey, checked: boolean) {
     onChange(checked ? Array.from(new Set([...value, permission])) : value.filter((item) => item !== permission))
@@ -494,24 +522,25 @@ function PermissionPicker({ catalog, value, onChange }: { catalog: PermissionInf
     <div className="space-y-3">
       <div className="flex items-center justify-between gap-3">
         <Label>菜单与操作权限</Label>
-        <Badge variant="outline">{value.length} 项</Badge>
+        <span className="text-xs tabular-nums text-muted-foreground">已选 {value.length} 项</span>
       </div>
       <div className="space-y-3">
         {grouped.map(({ category, items }) => {
           const allChecked = items.every((item) => value.includes(item.key))
+          const selectedCount = items.filter((item) => value.includes(item.key)).length
           return (
             <div key={category} className="rounded-lg border">
               <div className="flex items-center justify-between gap-3 border-b px-3 py-2">
-                <label className="flex items-center gap-2 font-medium">
-                  <Checkbox checked={allChecked} onCheckedChange={(next) => toggleCategory(items, next === true)} />
+                <label className={cn("flex items-center gap-2 font-medium", readOnly && "cursor-default")}>
+                  <Checkbox className={cn(readOnly && "disabled:opacity-100")} disabled={readOnly} checked={allChecked ? true : selectedCount > 0 ? "indeterminate" : false} onCheckedChange={(next) => toggleCategory(items, next === true)} />
                   {category}
                 </label>
-                <span className="text-xs text-muted-foreground">{items.filter((item) => value.includes(item.key)).length}/{items.length}</span>
+                <span className="text-xs text-muted-foreground">{selectedCount}/{items.length}</span>
               </div>
               <div className="grid gap-2 p-3 md:grid-cols-2">
                 {items.map((item) => (
-                  <label key={item.key} className="flex min-h-16 items-start gap-3 rounded-md border px-3 py-2">
-                    <Checkbox checked={value.includes(item.key)} onCheckedChange={(next) => toggle(item.key, next === true)} />
+                  <label key={item.key} className={cn("flex min-h-16 items-start gap-3 rounded-md border px-3 py-2", readOnly && "cursor-default")}>
+                    <Checkbox className={cn(readOnly && "disabled:opacity-100")} disabled={readOnly} checked={value.includes(item.key)} onCheckedChange={(next) => toggle(item.key, next === true)} />
                     <span className="min-w-0">
                       <span className="block text-sm font-medium">{item.label}</span>
                       <span className="line-clamp-2 text-xs text-muted-foreground">{item.description}</span>
@@ -535,7 +564,7 @@ function PermissionLimitEditor({ value, onChange }: { value: PermissionLimits; o
   return (
     <div className="space-y-3 rounded-lg border p-3">
       <div className="flex flex-col gap-1 sm:flex-row sm:items-center sm:justify-between">
-        <Label>账号配额</Label>
+        <Label>使用限制</Label>
         <span className="text-xs text-muted-foreground">填 0 表示不限制</span>
       </div>
       <div className="grid gap-3 md:grid-cols-3">
@@ -571,29 +600,14 @@ function PermissionLimitEditor({ value, onChange }: { value: PermissionLimits; o
 function PermissionBadges({ permissions, catalog }: { permissions: PermissionKey[]; catalog: PermissionInfo[] }) {
   const labelByKey = new Map(catalog.map((item) => [item.key, item.label]))
   if (permissions.length === 0) return <div className="mt-3 text-sm text-muted-foreground">无后台权限</div>
-  return (
-    <div className="mt-3 flex flex-wrap gap-1.5">
-      {permissions.slice(0, 10).map((permission) => (
-        <Badge key={permission} variant="outline" className="font-normal">{labelByKey.get(permission) || permission}</Badge>
-      ))}
-      {permissions.length > 10 && <Badge variant="secondary">+{permissions.length - 10}</Badge>}
-    </div>
-  )
+  const visible = permissions.slice(0, 5).map((permission) => labelByKey.get(permission) || permission)
+  return <div className="mt-3 line-clamp-2 text-sm leading-6 text-muted-foreground">权限：{visible.join("、")}{permissions.length > visible.length ? ` 等 ${permissions.length} 项` : ""}</div>
 }
 
 function PermissionLimitBadges({ limits }: { limits?: PermissionLimits }) {
   const defaultLimitsQuery = useQuery({ queryKey: ["admin", "permission-limits", "defaults"], queryFn: api.defaultPermissionLimits })
   const value = limits || defaultLimitsQuery.data || defaultPermissionLimits
-  return (
-    <div className="mt-3 flex flex-wrap gap-1.5">
-      <Badge variant="secondary" className="font-normal">附件 {limitText(value.maxAttachmentMb, "MB")}</Badge>
-      <Badge variant="secondary" className="font-normal">邮箱 {limitText(value.maxMailboxCount, "个")}</Badge>
-      <Badge variant="secondary" className="font-normal">SMTP 每日 {limitText(value.smtpDailyLimit, "封")}</Badge>
-      <Badge variant="secondary" className="font-normal">SMTP 每分钟 {limitText(value.smtpMinuteLimit, "封")}</Badge>
-      <Badge variant="secondary" className="font-normal">IMAP 每分钟 {limitText(value.imapMinuteLimit, "次")}</Badge>
-      <Badge variant="secondary" className="font-normal">POP3 每分钟 {limitText(value.pop3MinuteLimit, "次")}</Badge>
-    </div>
-  )
+  return <div className="mt-2 text-xs leading-5 text-muted-foreground">限制：邮箱 {limitText(value.maxMailboxCount, "个")} · 附件 {limitText(value.maxAttachmentMb, "MB")} · SMTP {limitText(value.smtpDailyLimit, "封/日")} · IMAP {limitText(value.imapMinuteLimit, "次/分钟")} · POP3 {limitText(value.pop3MinuteLimit, "次/分钟")}</div>
 }
 
 function limitText(value: number, unit: string) {
@@ -641,8 +655,8 @@ function DomainsSection({ domains }: { domains: Domain[] }) {
               <div className="text-xs text-muted-foreground">selector: {domain.dkimSelector}</div>
             </div>
             <div className="flex flex-wrap items-center gap-2">
-              <Badge variant={domain.status === "active" ? "default" : "secondary"}>{domain.status === "active" ? "启用" : "停用"}</Badge>
-              <Badge variant={domain.dnsStatus === "ok" ? "default" : "secondary"}>{domain.dnsStatus === "ok" ? "DNS 正常" : domain.dnsStatus}</Badge>
+              <StatusText active={domain.status === "active"} activeLabel="启用" inactiveLabel="停用" />
+              <StatusText active={domain.dnsStatus === "ok"} activeLabel="DNS 正常" inactiveLabel={domain.dnsStatus || "未检测"} />
               {canViewDNS && <DomainDNSDialog domain={domain} />}
               {canUpdate && <Button variant="outline" size="sm" onClick={() => update.mutate({ id: domain.id, status: domain.status === "active" ? "disabled" : "active" })}>{domain.status === "active" ? "停用" : "启用"}</Button>}
               {canDelete && <Button variant="outline" size="sm" onClick={() => setPendingConfirm({ title: "删除域名？", description: `将删除 ${domain.name}，相关邮箱、转发和邮件也可能受影响。`, confirmText: "删除域名", onConfirm: () => remove.mutate(domain.id) })}><Trash2 className="h-4 w-4" />删除</Button>}
@@ -675,56 +689,96 @@ function MailboxesSection({ mailboxes, users, domains }: { mailboxes: MailboxTyp
   const user = me.data?.user
   const qc = useQueryClient()
   const { toast } = useToast()
+  const [query, setQuery] = React.useState("")
+  const [expandedOwners, setExpandedOwners] = React.useState<string[]>([])
   const [pendingConfirm, setPendingConfirm] = React.useState<PendingConfirm | null>(null)
   const canCreate = hasPermission(user, "admin.mailboxes.create")
   const canUpdate = hasPermission(user, "admin.mailboxes.update")
   const canDelete = hasPermission(user, "admin.mailboxes.delete")
+  const update = useMutation({
+    mutationFn: ({ mailbox, status }: { mailbox: MailboxType; status: "active" | "disabled" }) => api.updateMailbox(mailbox.id, { userId: mailbox.userId, displayName: mailbox.displayName || mailbox.address, quotaMb: mailbox.quotaMb, status }),
+    onSuccess: (mailbox) => { invalidateAdmin(qc); toast({ title: mailbox.status === "active" ? "邮箱已启用" : "邮箱已停用" }) },
+    onError: (e) => toast({ title: "状态更新失败", description: e.message }),
+  })
   const remove = useMutation({ mutationFn: api.deleteMailbox, onSuccess: () => { setPendingConfirm(null); invalidateAdmin(qc); toast({ title: "邮箱已删除" }) }, onError: (e) => toast({ title: "删除失败", description: e.message }) })
+  const keyword = query.trim().toLowerCase()
+  const knownOwnerIDs = new Set(users.map((item) => item.id))
+  const mailboxGroups: Array<{ owner?: AdminUser; mailboxes: MailboxType[] }> = [
+    ...users.slice().sort(compareAdminUsers).map((owner) => ({ owner, mailboxes: mailboxes.filter((mailbox) => mailbox.userId === owner.id).sort((left, right) => left.address.localeCompare(right.address, "en")) })),
+    ...mailboxes.filter((mailbox) => !knownOwnerIDs.has(mailbox.userId)).map((mailbox) => ({ owner: undefined, mailboxes: [mailbox] })),
+  ]
+    .filter((group) => group.mailboxes.length > 0)
+    .filter((group) => !keyword || [group.owner ? accountPrimaryEmail(group.owner) : "", group.owner?.displayName || "", ...group.mailboxes.map((mailbox) => mailbox.address)].some((value) => value.toLowerCase().includes(keyword)))
+  const toggleOwner = (ownerID: string) => setExpandedOwners((current) => current.includes(ownerID) ? current.filter((id) => id !== ownerID) : [...current, ownerID])
   return (
     <Card>
       <CardHeader>
         <div className="flex flex-col gap-3 md:flex-row md:items-center md:justify-between">
           <CardTitle>邮箱管理</CardTitle>
+          <div className="flex items-center gap-2">
+            <span className="text-sm tabular-nums text-muted-foreground">{mailboxes.length} 个邮箱</span>
             {canCreate && <CreateMailboxDialog domains={domains} users={users} />}
           </div>
+        </div>
       </CardHeader>
-      <CardContent>
-        <div className="space-y-3 md:hidden">
-          {mailboxes.map((mailbox) => (
-            <div key={mailbox.id} className="rounded-lg border p-4">
-              <div className="flex items-start justify-between gap-3">
-                <div className="min-w-0">
-                  <div className="truncate font-medium">{mailbox.address}</div>
-                  <div className="truncate text-xs text-muted-foreground">{mailbox.userEmail || mailbox.userId}</div>
+      <CardContent className="space-y-4">
+        <div className="relative">
+          <Search className="absolute left-3 top-2.5 h-4 w-4 text-muted-foreground" />
+          <Input value={query} onChange={(event) => setQuery(event.target.value)} placeholder="搜索账号或邮箱" className="pl-9" />
         </div>
-                <MailboxActions mailbox={mailbox} users={users} canUpdate={canUpdate} onDelete={canDelete ? () => setPendingConfirm({ title: "删除邮箱？", description: `将删除 ${mailbox.address} 和其中邮件。`, confirmText: "删除邮箱", onConfirm: () => remove.mutate(mailbox.id) }) : undefined} />
+        <div className="divide-y overflow-hidden rounded-md border">
+          <div className="hidden grid-cols-[minmax(0,1fr)_9rem_8rem] gap-4 bg-muted/40 px-11 py-2 text-xs font-medium text-muted-foreground sm:grid">
+            <span>归属账号</span><span>权限管理</span><span>子邮箱</span>
           </div>
-              <div className="mt-3 flex flex-wrap gap-2">
-                <Badge variant={mailbox.status === "active" ? "default" : "secondary"}>{mailbox.status === "active" ? "启用" : "停用"}</Badge>
-                <Badge variant="outline">{mailbox.quotaMb} MB</Badge>
-                <Badge variant="outline">{mailbox.displayName || "未命名"}</Badge>
+          {mailboxGroups.map((group) => {
+            const ownerID = group.owner?.id || group.mailboxes[0].userId
+            const expanded = expandedOwners.includes(ownerID) || !!keyword
+            return (
+              <div key={ownerID}>
+                <Button type="button" variant="ghost" className="grid h-auto min-h-16 w-full grid-cols-[auto_minmax(0,1fr)_auto] gap-3 rounded-none px-4 py-3 text-left font-normal sm:grid-cols-[auto_minmax(0,1fr)_9rem_8rem]" onClick={() => toggleOwner(ownerID)} aria-expanded={expanded}>
+                  <ChevronDown className={cn("h-4 w-4 shrink-0 text-muted-foreground transition-transform", !expanded && "-rotate-90")} />
+                  <div className="min-w-0 flex-1">
+                    <div className="truncate font-medium">{group.owner ? accountPrimaryEmail(group.owner) : group.mailboxes[0].userEmail || "未知账号"}</div>
+                    <div className="truncate text-xs text-muted-foreground">{group.owner?.displayName || "账号信息不可用"}</div>
+                  </div>
+                  <span className="hidden sm:block">{group.owner ? <RoleBadge user={group.owner} /> : "-"}</span>
+                  <span className="flex items-center justify-end gap-2 text-sm tabular-nums text-muted-foreground"><span>{group.mailboxes.length} 个</span><span className="hidden text-xs lg:inline">查看邮箱</span></span>
+                </Button>
+                {expanded && (
+                  <div className="border-t bg-muted/20 px-4 py-2 sm:pl-11">
+                    {group.mailboxes.map((mailbox) => (
+                      <div key={mailbox.id} className="flex min-h-14 items-center gap-3 border-b py-2 last:border-b-0">
+                        <Mail className="hidden h-4 w-4 shrink-0 text-muted-foreground sm:block" />
+                        <div className="min-w-0 flex-1">
+                          <div className="truncate text-sm font-medium">{mailbox.address}</div>
+                          <div className="flex min-w-0 items-center gap-2 text-xs text-muted-foreground">
+                            <span className="truncate">{mailbox.displayName || "未命名"}</span>
+                            {mailbox.primary && <span className="shrink-0">默认邮箱</span>}
+                          </div>
+                        </div>
+                        <span className={cn("w-10 shrink-0 text-right text-xs font-medium", mailbox.status === "active" ? "text-emerald-600 dark:text-emerald-400" : "text-destructive")}>{mailbox.status === "active" ? "启用" : "停用"}</span>
+                        <div className="flex h-8 w-8 shrink-0 items-center justify-center">
+                          {!mailbox.primary && (canUpdate || canDelete) && (
+                            <DropdownMenu>
+                              <DropdownMenuTrigger asChild><Button type="button" variant="ghost" size="icon" className="h-8 w-8" aria-label={`管理邮箱 ${mailbox.address}`} title="更多操作"><MoreHorizontal className="h-4 w-4" /></Button></DropdownMenuTrigger>
+                              <DropdownMenuContent align="end">
+                                {canUpdate && <DropdownMenuItem disabled={mailbox.status === "active" || update.isPending} onSelect={() => update.mutate({ mailbox, status: "active" })}>启用</DropdownMenuItem>}
+                                {canUpdate && <DropdownMenuItem disabled={mailbox.status === "disabled" || update.isPending} onSelect={() => update.mutate({ mailbox, status: "disabled" })}>停用</DropdownMenuItem>}
+                                {canUpdate && canDelete && !mailbox.primary && <DropdownMenuSeparator />}
+                                {canDelete && !mailbox.primary && <DropdownMenuItem className="text-destructive" onSelect={() => setPendingConfirm({ title: "删除邮箱？", description: `将删除 ${mailbox.address} 和其中邮件。此操作无法撤销。`, confirmText: "确认删除", onConfirm: () => remove.mutate(mailbox.id) })}>删除邮箱</DropdownMenuItem>}
+                              </DropdownMenuContent>
+                            </DropdownMenu>
+                          )}
                         </div>
                       </div>
                     ))}
                   </div>
-        <div className="hidden md:block">
-          <Table>
-            <TableHeader><TableRow><TableHead>地址</TableHead><TableHead>归属账号</TableHead><TableHead>名称</TableHead><TableHead>配额</TableHead><TableHead>状态</TableHead><TableHead className="w-16"></TableHead></TableRow></TableHeader>
-            <TableBody>
-              {mailboxes.map((mailbox) => (
-                <TableRow key={mailbox.id}>
-                  <TableCell className="font-medium">{mailbox.address}</TableCell>
-                  <TableCell className="text-muted-foreground">{mailbox.userEmail || mailbox.userId}</TableCell>
-                  <TableCell>{mailbox.displayName}</TableCell>
-                  <TableCell>{mailbox.quotaMb} MB</TableCell>
-                  <TableCell><Badge variant={mailbox.status === "active" ? "default" : "secondary"}>{mailbox.status === "active" ? "启用" : "停用"}</Badge></TableCell>
-                  <TableCell><MailboxActions mailbox={mailbox} users={users} canUpdate={canUpdate} onDelete={canDelete ? () => setPendingConfirm({ title: "删除邮箱？", description: `将删除 ${mailbox.address} 和其中邮件。`, confirmText: "删除邮箱", onConfirm: () => remove.mutate(mailbox.id) }) : undefined} /></TableCell>
-                </TableRow>
-              ))}
-            </TableBody>
-          </Table>
+                )}
               </div>
-        {mailboxes.length === 0 && <Empty text="暂无邮箱" />}
+            )
+          })}
+        </div>
+        {mailboxGroups.length === 0 && <Empty text={query ? "没有匹配的账号或邮箱" : "暂无邮箱"} />}
       </CardContent>
       <ConfirmDialog open={!!pendingConfirm} title={pendingConfirm?.title || ""} description={pendingConfirm?.description} confirmText={pendingConfirm?.confirmText || "删除"} destructive pending={remove.isPending} onOpenChange={(open) => { if (!open) setPendingConfirm(null) }} onConfirm={() => pendingConfirm?.onConfirm()} />
     </Card>
@@ -762,7 +816,7 @@ function AliasesSection({ aliases, domains }: { aliases: Alias[]; domains: Domai
                 <AliasActions alias={alias} onToggle={canUpdate ? () => update.mutate({ id: alias.id, payload: { source: alias.source, destination: alias.destination, enabled: !alias.enabled } }) : undefined} onDelete={canDelete ? () => setPendingConfirm({ title: "删除转发？", description: `${alias.source} 将不再转发到 ${alias.destination}。`, confirmText: "删除转发", onConfirm: () => remove.mutate(alias.id) }) : undefined} />
               </div>
               <div className="mt-3 flex flex-wrap gap-2">
-                <Badge variant={alias.enabled ? "default" : "secondary"}>{alias.enabled ? "启用" : "停用"}</Badge>
+                <StatusText active={alias.enabled} activeLabel="启用" inactiveLabel="停用" />
                 <Badge variant="outline">{domains.find((d) => d.id === alias.domainId)?.name || alias.domainId}</Badge>
               </div>
             </div>
@@ -777,7 +831,7 @@ function AliasesSection({ aliases, domains }: { aliases: Alias[]; domains: Domai
                   <TableCell className="font-medium">{alias.source}</TableCell>
                   <TableCell>{alias.destination}</TableCell>
                   <TableCell className="text-muted-foreground">{domains.find((d) => d.id === alias.domainId)?.name || alias.domainId}</TableCell>
-                  <TableCell><Badge variant={alias.enabled ? "default" : "secondary"}>{alias.enabled ? "启用" : "停用"}</Badge></TableCell>
+                  <TableCell><StatusText active={alias.enabled} activeLabel="启用" inactiveLabel="停用" /></TableCell>
                   <TableCell><AliasActions alias={alias} onToggle={canUpdate ? () => update.mutate({ id: alias.id, payload: { source: alias.source, destination: alias.destination, enabled: !alias.enabled } }) : undefined} onDelete={canDelete ? () => setPendingConfirm({ title: "删除转发？", description: `${alias.source} 将不再转发到 ${alias.destination}。`, confirmText: "删除转发", onConfirm: () => remove.mutate(alias.id) }) : undefined} /></TableCell>
                 </TableRow>
               ))}
@@ -903,7 +957,8 @@ function AdminMessagesSection({ mailboxes, systemAdmin }: { mailboxes: MailboxTy
           </Table>
         </div>
         {messages.isLoading && <Empty text="加载中..." />}
-        {!messages.isLoading && items.length === 0 && <Empty text="暂无邮件" />}
+        {messages.isError && <QueryFailure error={messages.error} onRetry={() => { void messages.refetch() }} compact />}
+        {!messages.isLoading && !messages.isError && items.length === 0 && <Empty text="暂无邮件" />}
         {!messages.isLoading && messages.hasNextPage && (
           <div className="flex justify-center">
             <Button variant="outline" size="sm" disabled={messages.isFetchingNextPage} onClick={() => messages.fetchNextPage()}>
@@ -1016,7 +1071,8 @@ function AdminSendAuditSection({ mailboxes }: { mailboxes: MailboxType[] }) {
           </Table>
         </div>
         {audit.isLoading && <Empty text="加载中..." />}
-        {!audit.isLoading && items.length === 0 && <Empty text="暂无发送记录" />}
+        {audit.isError && <QueryFailure error={audit.error} onRetry={() => { void audit.refetch() }} compact />}
+        {!audit.isLoading && !audit.isError && items.length === 0 && <Empty text="暂无发送记录" />}
         {!audit.isLoading && audit.hasNextPage && (
           <div className="flex justify-center">
             <Button variant="outline" size="sm" disabled={audit.isFetchingNextPage} onClick={() => audit.fetchNextPage()}>
@@ -1330,7 +1386,7 @@ function SystemSettingsSection({ settings, domains, mailboxes, initialTab }: { s
                     <div className="space-y-3 border-l-2 border-primary/50 py-1 pl-3">
                       <div className="flex items-center gap-2">
                         <code className="min-w-0 flex-1 font-mono text-sm font-semibold">{telegramPairing.code}</code>
-                        <Button type="button" variant="ghost" size="icon" title="复制绑定码" onClick={() => navigator.clipboard.writeText(telegramPairing.code)}>
+                        <Button type="button" variant="ghost" size="icon" aria-label="复制绑定码" title="复制绑定码" onClick={() => navigator.clipboard.writeText(telegramPairing.code)}>
                           <Copy className="h-4 w-4" />
                         </Button>
                       </div>
@@ -1429,7 +1485,8 @@ function SystemSettingsSection({ settings, domains, mailboxes, initialTab }: { s
         </CardContent>
       </Card>}
 
-      {settingsTab === "templates" && canViewTemplates && <MailTemplatesPanel templates={templates.data?.items || []} loading={templates.isLoading} canUpdate={canUpdateTemplates} canReset={canResetTemplates} />}
+      {settingsTab === "templates" && canViewTemplates && templates.isError && <QueryFailure error={templates.error} onRetry={() => { void templates.refetch() }} />}
+      {settingsTab === "templates" && canViewTemplates && !templates.isError && <MailTemplatesPanel templates={templates.data?.items || []} loading={templates.isLoading} canUpdate={canUpdateTemplates} canReset={canResetTemplates} />}
 
       {settingsTab === "security" && <Card>
         <CardHeader><CardTitle>安全设置</CardTitle></CardHeader>
@@ -1808,6 +1865,18 @@ function Stat({ icon, label, value }: { icon: React.ReactNode; label: string; va
 }
 function InfoBox({ label, value }: { label: string; value: React.ReactNode }) { return <div className="rounded-lg border p-4"><div className="text-xl font-semibold tracking-tight sm:text-2xl">{value}</div><div className="text-xs text-muted-foreground">{label}</div></div> }
 function Empty({ text }: { text: string }) { return <div className="rounded-lg border border-dashed p-8 text-center text-sm text-muted-foreground">{text}</div> }
+
+function QueryFailure({ error, onRetry, compact = false }: { error: unknown; onRetry: () => void; compact?: boolean }) {
+  return (
+    <div className={cn("mb-4 flex flex-col gap-3 rounded-lg border border-destructive/40 bg-destructive/5 p-4 sm:flex-row sm:items-center sm:justify-between", compact && "mb-0")} role="alert">
+      <div className="min-w-0">
+        <div className="text-sm font-semibold text-destructive">数据读取失败</div>
+        <div className="mt-1 break-words text-sm text-muted-foreground">{queryErrorMessage(error)}</div>
+      </div>
+      <Button type="button" variant="outline" size="sm" className="shrink-0" onClick={onRetry}><RefreshCcw className="h-4 w-4" />重试</Button>
+    </div>
+  )
+}
 function DomainBadgeRow({ domain }: { domain: Domain }) { return <div className="flex items-center justify-between rounded-lg border p-3"><span className="font-medium">{domain.name}</span><Badge variant={domain.dnsStatus === "ok" ? "default" : "secondary"}>{domain.dnsStatus === "ok" ? "正常" : domain.dnsStatus}</Badge></div> }
 function invalidateAdmin(qc: ReturnType<typeof useQueryClient>) { qc.invalidateQueries({ queryKey: ["admin"] }); qc.invalidateQueries({ queryKey: ["mailboxes"] }); qc.invalidateQueries({ queryKey: ["me"] }) }
 
@@ -1830,7 +1899,8 @@ function UserMailboxCell({ user }: { user: AdminUser }) {
     return sortedMailboxes.filter((mailbox) => mailbox.toLowerCase().includes(normalizedQuery))
   }, [normalizedQuery, sortedMailboxes])
   const limit = user.role === "admin" ? "不限" : limitText(user.limits?.maxMailboxCount ?? defaultMailboxLimitOverride, "个")
-  const quota = <div className="text-[11px] text-muted-foreground">邮箱 {user.mailboxCount}/{limit}</div>
+  const storage = formatBytes((user.storageQuotaMb || defaultStorageQuotaMb(user.role)) * 1024 * 1024)
+  const quota = <div className="text-[11px] text-muted-foreground">邮箱 {user.mailboxCount}/{limit} · 共享存储容量 {storage}</div>
   async function copyMailbox(address: string) {
     if (!address) return
     await navigator.clipboard.writeText(address)
@@ -1847,7 +1917,6 @@ function UserMailboxCell({ user }: { user: AdminUser }) {
               className="h-8 min-w-0 flex-1 justify-start gap-1.5 overflow-hidden rounded-md border-input bg-background px-2 text-left font-normal shadow-none hover:bg-background"
               title={selectedAddress}
             >
-              <Mail className="h-3.5 w-3.5 shrink-0 text-muted-foreground" />
               <span className="min-w-0 flex-1 truncate text-[13px] font-medium">{selectedAddress}</span>
               {sortedMailboxes.length > 0 && <span className="shrink-0 rounded bg-muted px-1.5 py-0.5 text-[11px] font-medium text-muted-foreground">{sortedMailboxes.length} 个</span>}
               <ChevronDown className="h-3.5 w-3.5 shrink-0 text-muted-foreground" />
@@ -1873,7 +1942,6 @@ function UserMailboxCell({ user }: { user: AdminUser }) {
                 onSelect={() => setSelectedAddress(mailbox)}
                 className={cn("h-8 min-w-0 gap-2 rounded-sm px-2 text-[13px] font-normal", selectedAddress === mailbox && "bg-accent text-accent-foreground")}
               >
-                <Mail className="h-3.5 w-3.5 shrink-0 text-muted-foreground" />
                 <span className="min-w-0 flex-1 truncate" title={mailbox}>{mailbox}</span>
               </DropdownMenuItem>
             ))}
@@ -1891,17 +1959,10 @@ function UserMailboxCell({ user }: { user: AdminUser }) {
 }
 
 function UserPermissionGroupsCell({ user }: { user: AdminUser }) {
-  const groups = user.permissionGroups || []
-  if (groups.length === 0) return <span className="text-muted-foreground">普通用户</span>
-  return (
-    <div className="flex max-w-md flex-wrap gap-1">
-      {groups.map((group) => (
-        <Badge key={group.id} variant={group.id === "pg_super_admin" ? "default" : "secondary"} className="font-normal">
-          {group.name}
-        </Badge>
-      ))}
-    </div>
-  )
+  const groups = (user.permissionGroups || []).filter((group) => group.id !== "pg_regular_user")
+  if (user.role === "admin") return <span className="text-sm text-muted-foreground">全部权限</span>
+  if (groups.length === 0) return <span className="text-muted-foreground">默认权限</span>
+  return <span className="line-clamp-2 text-sm text-muted-foreground">{groups.map((group) => group.name).join("、")}</span>
 }
 
 function assignableUserGroupIDs(user: AdminUser) {
@@ -1909,6 +1970,7 @@ function assignableUserGroupIDs(user: AdminUser) {
 }
 
 function PermissionGroupPicker({ groups, value, onChange }: { groups: PermissionGroup[]; value: string[]; onChange: (value: string[]) => void }) {
+  if (groups.length === 0) return null
   function toggle(groupID: string, checked: boolean) {
     onChange(checked ? Array.from(new Set([...value, groupID])) : value.filter((id) => id !== groupID))
   }
@@ -1929,18 +1991,20 @@ function PermissionGroupPicker({ groups, value, onChange }: { groups: Permission
           )
         })}
       </div>
-      {groups.length === 0 && <Empty text="暂无可分配自定义权限配置" />}
     </div>
   )
 }
 
 function RoleBadge({ user }: { user: AdminUser }) {
-  return (
-    <div className="flex flex-wrap gap-1">
-      <Badge variant={user.role === "admin" ? "default" : "secondary"}>{user.role === "admin" ? "管理员" : "普通用户"}</Badge>
-      {user.protected && <Badge variant="outline">默认账号</Badge>}
-    </div>
-  )
+  return <span className="text-sm font-medium">{user.role === "admin" ? "管理员" : "普通用户"}</span>
+}
+
+function AccountStatus({ user }: { user: AdminUser }) {
+  return <StatusText active={!user.disabled} activeLabel="正常" inactiveLabel="停用" />
+}
+
+function StatusText({ active, activeLabel, inactiveLabel }: { active: boolean; activeLabel: string; inactiveLabel: string }) {
+  return <span className="inline-flex items-center gap-2 whitespace-nowrap text-sm"><span className={cn("h-1.5 w-1.5 rounded-full", active ? "bg-emerald-600" : "bg-muted-foreground")} />{active ? activeLabel : inactiveLabel}</span>
 }
 
 function UserActions({ user, permissionGroups, onDelete }: { user: AdminUser; permissionGroups: PermissionGroup[]; onDelete?: () => void }) {
@@ -1968,56 +2032,64 @@ function UserActions({ user, permissionGroups, onDelete }: { user: AdminUser; pe
     })
   }
   if (!canUpdate && !canResetPassword && !onDelete) return null
-  return <><DropdownMenu><DropdownMenuTrigger asChild><Button variant="ghost" size="icon"><MoreHorizontal className="h-4 w-4" /></Button></DropdownMenuTrigger><DropdownMenuContent align="end">{canUpdate && <DropdownMenuItem onSelect={() => setEditOpen(true)}>编辑账号</DropdownMenuItem>}{canResetPassword && <DropdownMenuItem onSelect={() => setPasswordOpen(true)}>重置密码</DropdownMenuItem>}{!user.protected && user.role !== "admin" && canUpdate && <><DropdownMenuSeparator /><DropdownMenuItem onSelect={() => quickPatch({ disabled: !user.disabled })}>{user.disabled ? "启用账号" : "停用账号"}</DropdownMenuItem></>}{!user.protected && user.role !== "admin" && onDelete && <><DropdownMenuSeparator /><DropdownMenuItem className="text-destructive" onSelect={onDelete}>删除账号</DropdownMenuItem></>}</DropdownMenuContent></DropdownMenu>{canUpdate && <EditUserDialog user={user} permissionGroups={permissionGroups} open={editOpen} onOpenChange={setEditOpen} />}{canResetPassword && <ResetPasswordDialog user={user} open={passwordOpen} onOpenChange={setPasswordOpen} />}</>
+  return <><DropdownMenu><DropdownMenuTrigger asChild><Button variant="ghost" size="icon" aria-label={`管理账号 ${accountPrimaryEmail(user)}`} title="更多操作"><MoreHorizontal className="h-4 w-4" /></Button></DropdownMenuTrigger><DropdownMenuContent align="end">{canUpdate && <DropdownMenuItem onSelect={() => setEditOpen(true)}>编辑账号</DropdownMenuItem>}{canResetPassword && <DropdownMenuItem onSelect={() => setPasswordOpen(true)}>重置密码</DropdownMenuItem>}{!user.protected && user.role !== "admin" && canUpdate && <><DropdownMenuSeparator /><DropdownMenuItem onSelect={() => quickPatch({ disabled: !user.disabled })}>{user.disabled ? "启用账号" : "停用账号"}</DropdownMenuItem></>}{!user.protected && user.role !== "admin" && onDelete && <><DropdownMenuSeparator /><DropdownMenuItem className="text-destructive" onSelect={onDelete}>删除账号</DropdownMenuItem></>}</DropdownMenuContent></DropdownMenu>{canUpdate && <EditUserDialog user={user} permissionGroups={permissionGroups} open={editOpen} onOpenChange={setEditOpen} />}{canResetPassword && <ResetPasswordDialog user={user} open={passwordOpen} onOpenChange={setPasswordOpen} />}</>
 }
 
-function CreateUserDialog(_props: { permissionGroups: PermissionGroup[] }) {
+function CreateUserDialog({ permissionGroups, domains }: { permissionGroups: PermissionGroup[]; domains: Domain[] }) {
   const qc = useQueryClient()
   const { toast } = useToast()
   const [open, setOpen] = React.useState(false)
-  const [status, setStatus] = React.useState("active")
+  const [domainId, setDomainId] = React.useState("")
+  const [permissionGroupIds, setPermissionGroupIds] = React.useState<string[]>([])
+  React.useEffect(() => { if (!domainId && domains[0]) setDomainId(domains[0].id) }, [domainId, domains])
   const create = useMutation({
-    mutationFn: (form: FormData) => api.createUser({
-      email: String(form.get("email") || ""),
-      displayName: String(form.get("displayName") || ""),
-      password: String(form.get("password") || ""),
-      role: "user",
-      disabled: status === "disabled",
-      mailboxLimitOverride: mailboxLimitFromForm(form),
-    }),
+    mutationFn: (form: FormData) => {
+      const domain = domains.find((item) => item.id === domainId)
+      if (!domain) throw new Error("请选择邮箱域名")
+      const localPart = String(form.get("localPart") || "").trim()
+      if (!localPart) throw new Error("请输入邮箱前缀")
+      const email = `${localPart}@${domain.name}`
+      const inputPassword = String(form.get("password") || "")
+      const confirmPassword = String(form.get("confirmPassword") || "")
+      if (inputPassword !== confirmPassword) throw new Error("两次输入的密码不一致")
+      const password = inputPassword || email
+      if (password.length < 6) throw new Error("密码至少需要 6 位")
+      return api.createUser({ email, displayName: String(form.get("displayName") || ""), password, role: "user", disabled: false, mailboxLimitOverride: mailboxLimitFromForm(form), storageQuotaMb: Number(form.get("storageQuotaMb") || defaultUserStorageQuotaMb), permissionGroupIds })
+    },
     onSuccess: () => { invalidateAdmin(qc); setOpen(false); toast({ title: "账号已创建" }) },
     onError: (e) => toast({ title: "创建失败", description: e.message }),
   })
   return (
     <Dialog open={open} onOpenChange={setOpen}>
-      <DialogTrigger asChild><Button size="sm"><Plus className="h-4 w-4" />账号</Button></DialogTrigger>
+      <DialogTrigger asChild><Button size="sm">添加账号</Button></DialogTrigger>
       <DialogContent>
-        <DialogHeader><DialogTitle>创建账号</DialogTitle></DialogHeader>
+        <DialogHeader><DialogTitle>创建用户账号</DialogTitle></DialogHeader>
         <form className="space-y-4" onSubmit={(event) => { event.preventDefault(); create.mutate(new FormData(event.currentTarget)) }}>
-          <Field name="email" label="主登录邮箱" type="email" autoComplete="off" placeholder="user@example.com" />
-          <Field name="displayName" label="显示名称" placeholder="账号名称" />
-          <Field name="password" label="初始密码" type="password" minLength={6} />
+          <DomainSelect domains={domains} value={domainId} onChange={setDomainId} />
           <div className="grid grid-cols-2 gap-3">
-            <SelectField label="身份" value="user" onValueChange={() => undefined} items={[["user", "普通用户"]]} disabled />
-            <SelectField label="状态" value={status} onValueChange={setStatus} items={[["active", "正常"], ["disabled", "停用"]]} />
+            <Field name="localPart" label="邮箱前缀" placeholder="user" />
+            <Field name="displayName" label="显示名称" placeholder="例如：SZX" />
           </div>
+          <div className="grid grid-cols-1 gap-3 sm:grid-cols-2">
+            <Field name="password" label="密码（留空则使用邮箱账号）" type="password" required={false} autoComplete="new-password" />
+            <Field name="confirmPassword" label="再次输入密码" type="password" required={false} autoComplete="new-password" />
+          </div>
+          <SelectField label="身份" value="user" onValueChange={() => undefined} items={[["user", "普通用户"]]} disabled />
+          <div className="grid grid-cols-1 gap-3 sm:grid-cols-2">
             <MailboxLimitField defaultValue={defaultMailboxLimitOverride} />
-          <DialogFooter><Button disabled={create.isPending}>{create.isPending ? "创建中..." : "创建"}</Button></DialogFooter>
+            <Field name="storageQuotaMb" label="共享存储容量（MB）" type="number" min={100} defaultValue={String(defaultUserStorageQuotaMb)} />
+          </div>
+          <PermissionGroupPicker groups={permissionGroups} value={permissionGroupIds} onChange={setPermissionGroupIds} />
+          <DialogFooter><Button disabled={create.isPending || !domainId}>{create.isPending ? "创建中..." : "创建用户账号"}</Button></DialogFooter>
         </form>
       </DialogContent>
     </Dialog>
   )
 }
 
-function MailboxActions({ mailbox, users, canUpdate, onDelete }: { mailbox: MailboxType; users: AdminUser[]; canUpdate: boolean; onDelete?: () => void }) {
-  const [open, setOpen] = React.useState(false)
-  if (!canUpdate && !onDelete) return null
-  return <><DropdownMenu><DropdownMenuTrigger asChild><Button variant="ghost" size="icon"><MoreHorizontal className="h-4 w-4" /></Button></DropdownMenuTrigger><DropdownMenuContent align="end">{canUpdate && <DropdownMenuItem onSelect={() => setOpen(true)}>编辑邮箱</DropdownMenuItem>}{canUpdate && onDelete && <DropdownMenuSeparator />}{onDelete && <DropdownMenuItem className="text-destructive" onSelect={onDelete}>删除邮箱</DropdownMenuItem>}</DropdownMenuContent></DropdownMenu>{canUpdate && <EditMailboxDialog mailbox={mailbox} users={users} open={open} onOpenChange={setOpen} />}</>
-}
-
 function AliasActions({ alias, onToggle, onDelete }: { alias: Alias; onToggle?: () => void; onDelete?: () => void }) {
   if (!onToggle && !onDelete) return null
-  return <DropdownMenu><DropdownMenuTrigger asChild><Button variant="ghost" size="icon"><MoreHorizontal className="h-4 w-4" /></Button></DropdownMenuTrigger><DropdownMenuContent align="end">{onToggle && <DropdownMenuItem onSelect={onToggle}>{alias.enabled ? "停用" : "启用"}</DropdownMenuItem>}{onToggle && onDelete && <DropdownMenuSeparator />}{onDelete && <DropdownMenuItem className="text-destructive" onSelect={onDelete}>删除转发</DropdownMenuItem>}</DropdownMenuContent></DropdownMenu>
+  return <DropdownMenu><DropdownMenuTrigger asChild><Button variant="ghost" size="icon" aria-label={`管理转发 ${alias.source}`} title="更多操作"><MoreHorizontal className="h-4 w-4" /></Button></DropdownMenuTrigger><DropdownMenuContent align="end">{onToggle && <DropdownMenuItem onSelect={onToggle}>{alias.enabled ? "停用" : "启用"}</DropdownMenuItem>}{onToggle && onDelete && <DropdownMenuSeparator />}{onDelete && <DropdownMenuItem className="text-destructive" onSelect={onDelete}>删除转发</DropdownMenuItem>}</DropdownMenuContent></DropdownMenu>
 }
 
 function EditUserDialog({ user, permissionGroups, open, onOpenChange }: { user: AdminUser; permissionGroups: PermissionGroup[]; open: boolean; onOpenChange: (open: boolean) => void }) {
@@ -2038,6 +2110,7 @@ function EditUserDialog({ user, permissionGroups, open, onOpenChange }: { user:
       role,
       disabled: disabled === "disabled",
       mailboxLimitOverride: role === "user" ? mailboxLimitFromForm(form, effectiveMailboxLimit(user)) : undefined,
+      storageQuotaMb: Number(form.get("storageQuotaMb") || user.storageQuotaMb || defaultStorageQuotaMb(user.role)),
       permissionGroupIds: role === "user" ? permissionGroupIds : [],
     }),
     onSuccess: () => { invalidateAdmin(qc); onOpenChange(false); toast({ title: "账号已更新" }) },
@@ -2054,7 +2127,10 @@ function EditUserDialog({ user, permissionGroups, open, onOpenChange }: { user:
             <SelectField label="身份" value={role} onValueChange={(value) => setRole(value as "admin" | "user")} items={user.role === "admin" ? [["admin", "管理员"]] : [["user", "普通用户"]]} disabled />
             <SelectField label="状态" value={disabled} onValueChange={setDisabled} items={[["active", "正常"], ["disabled", "停用"]]} disabled={user.protected || user.role === "admin"} />
           </div>
+          <div className="grid grid-cols-1 gap-3 sm:grid-cols-2">
             {role === "user" && !user.protected && <MailboxLimitField defaultValue={effectiveMailboxLimit(user)} />}
+            <Field name="storageQuotaMb" label="共享存储容量（MB）" type="number" min={100} defaultValue={String(user.storageQuotaMb || defaultStorageQuotaMb(user.role))} />
+          </div>
           {role === "user" && !user.protected && <PermissionGroupPicker groups={permissionGroups} value={permissionGroupIds} onChange={setPermissionGroupIds} />}
           <DialogFooter><Button disabled={mut.isPending}>{mut.isPending ? "保存中..." : "保存"}</Button></DialogFooter>
         </form>
@@ -2068,17 +2144,10 @@ function ResetPasswordDialog({ user, open, onOpenChange }: { user: AdminUser; op
   return <Dialog open={open} onOpenChange={onOpenChange}><DialogContent><DialogHeader><DialogTitle>重置密码</DialogTitle></DialogHeader><form className="space-y-4" onSubmit={(e) => { e.preventDefault(); mut.mutate(new FormData(e.currentTarget)); e.currentTarget.reset() }}><Field name="email" label="主登录邮箱" value={accountPrimaryEmail(user)} readOnly /><Field name="password" label="新密码" type="password" minLength={6} /><DialogFooter><Button disabled={mut.isPending}>{mut.isPending ? "重置中..." : "重置"}</Button></DialogFooter></form></DialogContent></Dialog>
 }
 
-function EditMailboxDialog({ mailbox, users, open, onOpenChange }: { mailbox: MailboxType; users: AdminUser[]; open: boolean; onOpenChange: (open: boolean) => void }) {
-  const qc = useQueryClient(); const { toast } = useToast(); const [userId, setUserId] = React.useState(mailbox.userId); const [status, setStatus] = React.useState(mailbox.status)
-  React.useEffect(() => { setUserId(mailbox.userId); setStatus(mailbox.status) }, [mailbox, open])
-  const mut = useMutation({ mutationFn: (form: FormData) => api.updateMailbox(mailbox.id, { userId, displayName: String(form.get("displayName") || ""), quotaMb: Number(form.get("quotaMb") || 1024), status }), onSuccess: () => { invalidateAdmin(qc); onOpenChange(false); toast({ title: "邮箱已更新" }) }, onError: (e) => toast({ title: "更新失败", description: e.message }) })
-  return <Dialog open={open} onOpenChange={onOpenChange}><DialogContent><DialogHeader><DialogTitle>编辑邮箱</DialogTitle></DialogHeader><form className="space-y-4" onSubmit={(e) => { e.preventDefault(); mut.mutate(new FormData(e.currentTarget)) }}><Field name="address" label="邮箱地址" value={mailbox.address} readOnly /><SelectField label="归属账号" value={userId} onValueChange={setUserId} items={users.filter((u) => !u.disabled).map((u) => [u.id, u.email])} /><div className="grid grid-cols-2 gap-3"><Field name="displayName" label="显示名称" defaultValue={mailbox.displayName} /><Field name="quotaMb" label="配额 MB" type="number" defaultValue={String(mailbox.quotaMb)} /></div><SelectField label="状态" value={status} onValueChange={setStatus} items={[['active','启用'],['disabled','停用']]} /><DialogFooter><Button disabled={mut.isPending}>{mut.isPending ? "保存中..." : "保存"}</Button></DialogFooter></form></DialogContent></Dialog>
-}
-
 function CreateDomainDialog() {
   const qc = useQueryClient(); const { toast } = useToast(); const [open, setOpen] = React.useState(false)
   const mut = useMutation({ mutationFn: (form: FormData) => api.createDomain(String(form.get("name"))), onSuccess: () => { invalidateAdmin(qc); setOpen(false); toast({ title: "域名已创建" }) }, onError: (e) => toast({ title: "创建失败", description: e.message }) })
-  return <Dialog open={open} onOpenChange={setOpen}><DialogTrigger asChild><Button variant="outline"><Plus className="h-4 w-4" />域名</Button></DialogTrigger><DialogContent><DialogHeader><DialogTitle>添加域名</DialogTitle></DialogHeader><form className="space-y-4" onSubmit={(e) => { e.preventDefault(); mut.mutate(new FormData(e.currentTarget)) }}><Field name="name" label="域名" placeholder="example.com" /><DialogFooter><Button disabled={mut.isPending}>创建</Button></DialogFooter></form></DialogContent></Dialog>
+  return <Dialog open={open} onOpenChange={setOpen}><DialogTrigger asChild><Button className="self-start">添加域名</Button></DialogTrigger><DialogContent><DialogHeader><DialogTitle>添加域名</DialogTitle></DialogHeader><form className="space-y-4" onSubmit={(e) => { e.preventDefault(); mut.mutate(new FormData(e.currentTarget)) }}><Field name="name" label="域名" placeholder="example.com" /><DialogFooter><Button disabled={mut.isPending}>创建</Button></DialogFooter></form></DialogContent></Dialog>
 }
 
 function CreateMailboxDialog({ domains, users }: { domains: Domain[]; users: AdminUser[] }) {
@@ -2086,7 +2155,6 @@ function CreateMailboxDialog({ domains, users }: { domains: Domain[]; users: Adm
   const { toast } = useToast()
   const [open, setOpen] = React.useState(false)
   const [domainId, setDomainId] = React.useState("")
-  const [ownerMode, setOwnerMode] = React.useState("new")
   const [userId, setUserId] = React.useState("")
   React.useEffect(() => {
     if (!domainId && domains[0]) setDomainId(domains[0].id)
@@ -2096,38 +2164,22 @@ function CreateMailboxDialog({ domains, users }: { domains: Domain[]; users: Adm
     mutationFn: (form: FormData) => api.createMailbox({
       domainId,
       localPart: String(form.get("localPart")),
-      displayName: String(form.get("displayName")),
-      password: String(form.get("password")),
-      quotaMb: Number(form.get("quotaMb") || 1024),
-      role: "user",
-      ownerEmail: String(form.get("ownerEmail") || ""),
-      userId: ownerMode === "existing" ? userId : "",
+      userId,
     }),
     onSuccess: () => { invalidateAdmin(qc); setOpen(false); toast({ title: "邮箱已创建" }) },
     onError: (e) => toast({ title: "创建失败", description: e.message }),
   })
   return (
     <Dialog open={open} onOpenChange={setOpen}>
-      <DialogTrigger asChild><Button><Plus className="h-4 w-4" />邮箱</Button></DialogTrigger>
+      <DialogTrigger asChild><Button>添加邮箱</Button></DialogTrigger>
       <DialogContent>
         <DialogHeader><DialogTitle>创建邮箱</DialogTitle></DialogHeader>
         <form className="space-y-4" onSubmit={(e) => { e.preventDefault(); mut.mutate(new FormData(e.currentTarget)) }}>
           <DomainSelect domains={domains} value={domainId} onChange={setDomainId} />
-          <div className="grid grid-cols-2 gap-3">
           <Field name="localPart" label="邮箱前缀" placeholder="alice" />
-            <Field name="displayName" label="显示名" placeholder="Alice" />
-          </div>
-          <SelectField label="归属方式" value={ownerMode} onValueChange={setOwnerMode} items={[["new", "新建/按主登录邮箱匹配账号"], ["existing", "追加到已有账号"]]} />
-          {ownerMode === "existing" ? (
-            <SelectField label="已有账号" value={userId} onValueChange={setUserId} items={users.filter((u) => !u.disabled).map((u) => [u.id, accountPrimaryEmail(u)])} />
-          ) : (
-            <Field name="ownerEmail" label="主登录邮箱" placeholder="留空则使用新邮箱地址" required={false} />
-          )}
-          <div className="grid grid-cols-2 gap-3">
-            <Field name="password" label="密码" type="password" placeholder="至少 6 位" />
-            <Field name="quotaMb" label="配额 MB" type="number" defaultValue="1024" />
-          </div>
-          <DialogFooter><Button disabled={mut.isPending || !domainId}>创建</Button></DialogFooter>
+          <SelectField label="绑定用户账号" value={userId} onValueChange={setUserId} items={users.filter((item) => !item.disabled).sort(compareAdminUsers).map((item) => [item.id, accountPrimaryEmail(item)])} />
+          <p className="text-xs text-muted-foreground">该邮箱使用绑定账号的登录密码；账号修改密码后会自动同步。</p>
+          <DialogFooter><Button disabled={mut.isPending || !domainId || !userId}>{mut.isPending ? "创建中..." : "创建邮箱"}</Button></DialogFooter>
         </form>
       </DialogContent>
     </Dialog>
@@ -2138,7 +2190,7 @@ function CreateAliasDialog({ domains }: { domains: Domain[] }) {
   const qc = useQueryClient(); const { toast } = useToast(); const [open, setOpen] = React.useState(false); const [domainId, setDomainId] = React.useState("")
   React.useEffect(() => { if (!domainId && domains[0]) setDomainId(domains[0].id) }, [domains, domainId])
   const mut = useMutation({ mutationFn: (form: FormData) => api.createAlias({ domainId, source: String(form.get("source")), destination: String(form.get("destination")), enabled: true }), onSuccess: () => { invalidateAdmin(qc); setOpen(false); toast({ title: "转发已创建" }) }, onError: (e) => toast({ title: "创建失败", description: e.message }) })
-  return <Dialog open={open} onOpenChange={setOpen}><DialogTrigger asChild><Button variant="outline"><Plus className="h-4 w-4" />转发</Button></DialogTrigger><DialogContent><DialogHeader><DialogTitle>创建邮件转发</DialogTitle></DialogHeader><form className="space-y-4" onSubmit={(e) => { e.preventDefault(); mut.mutate(new FormData(e.currentTarget)) }}><DomainSelect domains={domains} value={domainId} onChange={setDomainId} /><Field name="source" label="来源" placeholder="sales 或 sales@example.com" /><Field name="destination" label="目标邮箱" placeholder="alice@example.com" /><DialogFooter><Button disabled={mut.isPending || !domainId}>创建</Button></DialogFooter></form></DialogContent></Dialog>
+  return <Dialog open={open} onOpenChange={setOpen}><DialogTrigger asChild><Button className="self-start">添加转发</Button></DialogTrigger><DialogContent><DialogHeader><DialogTitle>创建邮件转发</DialogTitle></DialogHeader><form className="space-y-4" onSubmit={(e) => { e.preventDefault(); mut.mutate(new FormData(e.currentTarget)) }}><DomainSelect domains={domains} value={domainId} onChange={setDomainId} /><Field name="source" label="来源" placeholder="sales 或 sales@example.com" /><Field name="destination" label="目标邮箱" placeholder="alice@example.com" /><DialogFooter><Button disabled={mut.isPending || !domainId}>创建</Button></DialogFooter></form></DialogContent></Dialog>
 }
 
 function DNSPanel({ domain, embedded = false }: { domain?: Domain; embedded?: boolean }) {
@@ -2146,15 +2198,15 @@ function DNSPanel({ domain, embedded = false }: { domain?: Domain; embedded?: bo
   const user = me.data?.user
   const canCheckDNS = hasPermission(user, "admin.dns.check")
   const { toast } = useToast(); const qc = useQueryClient(); const records = useQuery({ queryKey: ["dns-records", domain?.id], queryFn: () => api.dnsRecords(domain!.id), enabled: !!domain })
-  const check = useMutation({ mutationFn: () => api.checkDns(domain!.id), onSuccess: (res) => { qc.invalidateQueries({ queryKey: ["admin", "domains"] }); toast({ title: res.status === "ok" ? "DNS 检测通过" : "DNS 检测未通过", description: Object.values(res.checks).map((c) => c.message).join("；") }) } })
+  const check = useMutation({ mutationFn: () => api.checkDns(domain!.id), onSuccess: (res) => { qc.invalidateQueries({ queryKey: ["admin", "domains"] }); toast({ title: res.status === "ok" ? "DNS 检测通过" : "DNS 检测未通过", description: Object.values(res.checks).map((c) => c.message).join("；") }) }, onError: (error) => toast({ title: "DNS 检测失败", description: error.message }) })
   if (!domain) return <Card><CardContent className="p-6 text-muted-foreground">请选择域名</CardContent></Card>
   const content = <>
     <p className="mb-3 text-sm text-muted-foreground">以下为需要在域名 DNS 管理中添加的记录：</p>
-    <div className="space-y-3">{records.data?.items.map((r) => <DNSRecordRow key={`${r.type}-${r.name}`} record={r} />)}</div>
+    {records.isError ? <QueryFailure error={records.error} onRetry={() => { void records.refetch() }} compact /> : <div className="space-y-3">{records.data?.items.map((r) => <DNSRecordRow key={`${r.type}-${r.name}`} record={r} />)}</div>}
     {check.data && <>
       <Separator className="my-4" />
       <div className="flex items-center gap-2 text-sm font-medium text-muted-foreground"><CheckCircle2 className="h-4 w-4" />检测结果</div>
-      <div className="mt-2 space-y-2">{Object.entries(check.data.checks).map(([k, v]) => <div key={k} className="flex items-center gap-2 text-sm"><CheckCircle2 className={`h-4 w-4 shrink-0 ${v.ok ? "text-green-600" : "text-destructive"}`} /><span className="font-medium">{k.toUpperCase()}:</span> {v.message}</div>)}</div>
+      <div className="mt-2 space-y-2">{Object.entries(check.data.checks).map(([k, v]) => <DNSCheckRow key={k} name={k} check={v} />)}</div>
     </>}</>
   const checkButton = canCheckDNS ? <Button variant="outline" size="sm" onClick={() => check.mutate()} disabled={check.isPending}><RefreshCcw className="h-4 w-4" />检测</Button> : null
   const header = <div className="flex items-center justify-between"><CardTitle>DNS 记录</CardTitle>{checkButton}</div>
@@ -2162,6 +2214,20 @@ function DNSPanel({ domain, embedded = false }: { domain?: Domain; embedded?: bo
   return <Card><CardHeader>{header}</CardHeader><CardContent>{content}</CardContent></Card>
 }
 
+function DNSCheckRow({ name, check }: { name: string; check: { ok: boolean; message: string; found?: string[] } }) {
+  const visibleRecords = check.found?.filter(Boolean) ?? []
+  return <div className="space-y-1 text-sm">
+    <div className="flex items-start gap-2">
+      <CheckCircle2 className={`mt-0.5 h-4 w-4 shrink-0 ${check.ok ? "text-green-600" : "text-destructive"}`} />
+      <div className="min-w-0"><span className="font-medium">{name.toUpperCase()}:</span> {check.message}</div>
+    </div>
+    {!check.ok && visibleRecords.length > 0 && <div className="ml-6 rounded-md bg-muted/60 px-3 py-2 font-mono text-xs text-muted-foreground">
+      <div className="mb-1 font-sans text-foreground">当前解析</div>
+      <div className="space-y-1">{visibleRecords.map((record, index) => <div key={`${name}-${index}`} className="break-all">{record}</div>)}</div>
+    </div>}
+  </div>
+}
+
 function dnsDescription(record: DNSRecord): string {
   if (record.type === "TXT" && record.name.startsWith("_dmarc")) return "声明域名的 DMARC 策略（如何处理未通过 SPF/DKIM 验证的邮件）。"
   if (record.type === "TXT" && record.value.includes("DKIM1")) return "DKIM 公钥。收件服务器用此密钥验证邮件是否由你发出。"
@@ -2212,19 +2278,25 @@ function fieldNumber(form: FormData, name: string, fallback: number) {
   return Number.isFinite(n) && n > 0 ? n : fallback
 }
 function SwitchRow({ label, checked, onCheckedChange, className = "" }: { label: string; checked: boolean; onCheckedChange: (checked: boolean) => void; className?: string }) {
+  const id = React.useId()
   return (
     <div className={`flex min-h-14 items-center justify-between gap-4 ${className}`}>
-      <Label className="text-base font-medium">{label}</Label>
-      <Switch checked={checked} onCheckedChange={onCheckedChange} />
+      <Label htmlFor={id} className="text-base font-medium">{label}</Label>
+      <Switch id={id} checked={checked} onCheckedChange={onCheckedChange} />
     </div>
   )
 }
-function Field({ label, required = true, ...props }: React.InputHTMLAttributes<HTMLInputElement> & { label: string }) { return <div className="space-y-2"><Label>{label}</Label><Input required={required} {...props} /></div> }
+function Field({ label, required = true, id: suppliedId, ...props }: React.InputHTMLAttributes<HTMLInputElement> & { label: string }) {
+  const generatedId = React.useId()
+  const id = suppliedId || generatedId
+  return <div className="space-y-2"><Label htmlFor={id}>{label}</Label><Input id={id} required={required} {...props} /></div>
+}
 function MailboxLimitField({ defaultValue }: { defaultValue: number }) {
+  const id = React.useId()
   return (
     <div className="space-y-2">
-      <Label>邮箱数量上限</Label>
-      <Input name="mailboxLimitOverride" type="number" min={0} step={1} defaultValue={String(defaultValue)} />
+      <Label htmlFor={id}>邮箱数量上限</Label>
+      <Input id={id} name="mailboxLimitOverride" type="number" min={0} step={1} defaultValue={String(defaultValue)} />
       <div className="text-xs text-muted-foreground">普通用户默认 9 个，填 0 表示不限制。</div>
     </div>
   )
@@ -2236,5 +2308,8 @@ function mailboxLimitFromForm(form: FormData, fallback = defaultMailboxLimitOver
 function effectiveMailboxLimit(user: AdminUser) {
   return user.mailboxLimitOverride ?? user.limits?.maxMailboxCount ?? defaultMailboxLimitOverride
 }
-function SelectField({ label, value, onValueChange, items, disabled = false }: { label: string; value: string; onValueChange: (value: string) => void; items: string[][]; disabled?: boolean }) { return <div className="space-y-2"><Label>{label}</Label><Select value={value} onValueChange={onValueChange} disabled={disabled}><SelectTrigger><SelectValue /></SelectTrigger><SelectContent>{items.map(([value, label]) => <SelectItem key={value} value={value}>{label}</SelectItem>)}</SelectContent></Select></div> }
+function SelectField({ label, value, onValueChange, items, disabled = false }: { label: string; value: string; onValueChange: (value: string) => void; items: string[][]; disabled?: boolean }) {
+  const id = React.useId()
+  return <div className="space-y-2"><Label htmlFor={id}>{label}</Label><Select value={value} onValueChange={onValueChange} disabled={disabled}><SelectTrigger id={id}><SelectValue /></SelectTrigger><SelectContent>{items.map(([value, itemLabel]) => <SelectItem key={value} value={value}>{itemLabel}</SelectItem>)}</SelectContent></Select></div>
+}
 function DomainSelect({ domains, value, onChange }: { domains: Domain[]; value: string; onChange: (value: string) => void }) { return <div className="space-y-2"><Label>域名</Label><Select value={value} onValueChange={onChange}><SelectTrigger><SelectValue placeholder="选择域名" /></SelectTrigger><SelectContent>{domains.map((d) => <SelectItem key={d.id} value={d.id}>{d.name}</SelectItem>)}</SelectContent></Select></div> }

apps/web/src/pages/login.tsx

@@ -1,5 +1,5 @@
 import * as React from "react"
-import { Link, Navigate } from "react-router-dom"
+import { Link, Navigate, useLocation } from "react-router-dom"
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
 import { ArrowRight, KeyRound, LockKeyhole } from "lucide-react"
 import { api } from "@/lib/api"
@@ -10,9 +10,12 @@ import { Button } from "@/components/ui/button"
 import { Input } from "@/components/ui/input"
 import { Label } from "@/components/ui/label"
 import { useToast } from "@/hooks/use-toast"
+import { safeReturnPath } from "@/lib/navigation"
+import { AuthError, AuthLoading } from "@/components/auth-states"
 
 export function LoginPage() {
   const me = useMe()
+  const location = useLocation()
   const qc = useQueryClient()
   const { toast } = useToast()
   const publicSettings = useQuery({ queryKey: ["public-settings"], queryFn: api.publicSettings })
@@ -33,9 +36,12 @@ export function LoginPage() {
     onError: (e) => toast({ title: "登录失败", description: e.message }),
   })
   const turnstileRequired = !!publicSettings.data?.turnstileEnabled
-  if (me.data?.user) return <Navigate to="/" replace />
+  const returnPath = safeReturnPath((location.state as { from?: unknown } | null)?.from)
+  if (me.data?.user) return <Navigate to={returnPath} replace />
+  if (publicSettings.isLoading) return <AuthLoading />
+  if (publicSettings.isError) return <AuthError message={publicSettings.error.message} onRetry={() => { void publicSettings.refetch() }} />
   return (
-    <div className="flex min-h-screen items-center justify-center bg-muted/20 px-4 py-10">
+    <main className="flex min-h-screen items-center justify-center bg-muted/20 px-4 py-10">
       <div className="w-full max-w-[420px]">
         <div className="mb-7 text-center">
           <h1 className="text-3xl font-semibold tracking-tight">NewSzxcn 邮箱</h1>
@@ -82,6 +88,6 @@ export function LoginPage() {
           </div>
         )}
       </div>
-    </div>
+    </main>
   )
 }

apps/web/src/pages/mail.tsx

@@ -11,7 +11,7 @@ import TextAlign from "@tiptap/extension-text-align"
 import Placeholder from "@tiptap/extension-placeholder"
 import { BackgroundColor, Color, FontFamily, FontSize, TextStyle } from "@tiptap/extension-text-style"
 import { useNavigate } from "react-router-dom"
-import { AlignCenter, AlignLeft, AlignRight, Archive, ArrowLeft, Ban, Bold, Calendar, Check, ChevronDown, Clock3, Code2, Copy, Download, Ellipsis, Eraser, Eye, FileText, Folder, Forward, Highlighter, History, Image, Inbox, IndentDecrease, IndentIncrease, Italic, Link, List, ListOrdered, Mail, Mailbox as MailboxIcon, MailCheck, MailQuestion, Moon, PanelLeftOpen, Paperclip, PencilLine, Plus, Quote, Redo2, RefreshCcw, Reply, RotateCcw, Search, Send, Settings, ShieldCheck, Signature, SlidersHorizontal, Smile, Star, Strikethrough, Sun, Trash2, Type, Underline, Undo2, Upload, X } from "lucide-react"
+import { AlignCenter, AlignLeft, AlignRight, Archive, ArrowLeft, Ban, Bell, Bold, Bot, Briefcase, Calendar, Check, ChevronDown, Clock3, Code2, Copy, Download, Ellipsis, Eraser, Eye, FileText, Folder, Forward, GraduationCap, Heart, Highlighter, History, Image, Inbox, IndentDecrease, IndentIncrease, Italic, Link, List, ListOrdered, Mail, Mailbox as MailboxIcon, MailCheck, MailQuestion, Moon, PanelLeftOpen, Paperclip, PencilLine, Plane, Plus, Quote, Receipt, Redo2, RefreshCcw, Reply, RotateCcw, Search, Send, Settings, ShieldCheck, ShoppingBag, Signature, SlidersHorizontal, Smile, Sparkles, Star, Strikethrough, Sun, Tag, Trash2, Type, Underline, Undo2, Upload, Users, X } from "lucide-react"
 import { api, ExternalImapAccount, ListResponse, Mailbox, MailFolder, MailLabel, MailMessage, MailSearchParams, SendPayload, DraftPayload, ScheduledSend, SendQueueItem, SendQueueAuditEvent, SendQueueStatus, PermissionLimits } from "@/lib/api"
 import { cn, decodeMimeHeader, formatBytes, formatDate, formatDateTime, generateLabelColor } from "@/lib/utils"
 import { applyTheme, getInitialTheme } from "@/lib/theme"
@@ -49,6 +49,65 @@ import { useToast } from "@/hooks/use-toast"
 import { hasPermission } from "@/lib/permissions"
 
 const folderIcons: Record<string, React.ReactNode> = { inbox: <Inbox className="h-4 w-4" />, sent: <Send className="h-4 w-4" />, drafts: <FileText className="h-4 w-4" />, archive: <Archive className="h-4 w-4" />, spam: <Ban className="h-4 w-4" />, trash: <Trash2 className="h-4 w-4" /> }
+function NetflixFolderIcon({ className }: { className?: string }) {
+  return <span aria-hidden="true" className={cn("inline-flex items-center justify-center font-black text-red-600", className)}>N</span>
+}
+const customFolderIconOptions = [
+  { key: "folder", label: "文件夹", icon: Folder },
+  { key: "mail", label: "邮件", icon: Mail },
+  { key: "briefcase", label: "工作", icon: Briefcase },
+  { key: "users", label: "联系人", icon: Users },
+  { key: "receipt", label: "账单", icon: Receipt },
+  { key: "shopping", label: "购物", icon: ShoppingBag },
+  { key: "plane", label: "旅行", icon: Plane },
+  { key: "graduation", label: "学习", icon: GraduationCap },
+  { key: "heart", label: "收藏", icon: Heart },
+  { key: "star", label: "重要", icon: Star },
+  { key: "bell", label: "提醒", icon: Bell },
+  { key: "shield", label: "安全", icon: ShieldCheck },
+  { key: "tag", label: "分类", icon: Tag },
+  { key: "netflix", label: "Netflix", icon: NetflixFolderIcon },
+  { key: "chatgpt", label: "ChatGPT", icon: Bot },
+] as const
+function suggestedFolderIcon(name: string) {
+  const value = name.trim().toLocaleLowerCase()
+  if (/netflix|奈飞|网飞/.test(value)) return "netflix"
+  if (/chatgpt|openai|\bgpt\b/.test(value)) return "chatgpt"
+  if (/账单|发票|收据|bill|invoice|receipt/.test(value)) return "receipt"
+  if (/购物|订单|快递|shop|order|delivery/.test(value)) return "shopping"
+  if (/旅行|旅游|机票|酒店|travel|trip|flight|hotel/.test(value)) return "plane"
+  if (/学习|教育|课程|学校|study|school|course/.test(value)) return "graduation"
+  if (/联系人|团队|用户|contact|team|people/.test(value)) return "users"
+  if (/工作|项目|客户|work|project|business|client/.test(value)) return "briefcase"
+  if (/收藏|喜欢|favorite|favourite/.test(value)) return "heart"
+  if (/重要|紧急|important|urgent/.test(value)) return "star"
+  if (/安全|验证|密码|登录|security|verify|password|login/.test(value)) return "shield"
+  if (/提醒|通知|remind|notification/.test(value)) return "bell"
+  if (/邮件|邮箱|mail|email/.test(value)) return "mail"
+  return "folder"
+}
+
+async function prepareFolderIcon(file: File) {
+  if (!/^image\/(png|jpe?g|webp)$/i.test(file.type)) throw new Error("仅支持 PNG、JPG 或 WebP 图片")
+  if (file.size > 2 * 1024 * 1024) throw new Error("原图不能超过 2 MB")
+  const bitmap = await createImageBitmap(file)
+  try {
+    const canvas = document.createElement("canvas")
+    canvas.width = 64
+    canvas.height = 64
+    const context = canvas.getContext("2d")
+    if (!context) throw new Error("无法处理该图片")
+    const scale = Math.min(64 / bitmap.width, 64 / bitmap.height)
+    const width = Math.max(1, Math.round(bitmap.width * scale))
+    const height = Math.max(1, Math.round(bitmap.height * scale))
+    context.drawImage(bitmap, Math.round((64 - width) / 2), Math.round((64 - height) / 2), width, height)
+    const result = canvas.toDataURL("image/png")
+    if (result.length > 44_000) throw new Error("处理后的图标过大")
+    return result
+  } finally {
+    bitmap.close()
+  }
+}
 const folderLabels: Record<string, string> = {
   Inbox: "收件箱",
   Sent: "已发送",
@@ -143,6 +202,8 @@ export function MailPage() {
   const [selectedMailboxId, setSelectedMailboxId] = React.useState("all")
   const [selectedExternalAccountId, setSelectedExternalAccountId] = React.useState("")
   const [expandedExternalAccountIds, setExpandedExternalAccountIds] = React.useState<string[]>([])
+  const [foldersExpanded, setFoldersExpanded] = React.useState(true)
+  const [labelsExpanded, setLabelsExpanded] = React.useState(true)
   const [externalFolder, setExternalFolder] = React.useState("INBOX")
   const [darkMode, setDarkMode] = React.useState(getInitialTheme)
   const [language, setLanguage] = useLanguage()
@@ -155,7 +216,6 @@ export function MailPage() {
   const [autoRefreshing, setAutoRefreshing] = React.useState(false)
   const [exportingMail, setExportingMail] = React.useState(false)
   const [importingMail, setImportingMail] = React.useState(false)
-  const [, setLastAutoRefreshAt] = React.useState<Date | null>(null)
   const [bulkPending, setBulkPending] = React.useState(false)
   const [pendingConfirm, setPendingConfirm] = React.useState<PendingConfirm | null>(null)
   const [cancelingScheduledId, setCancelingScheduledId] = React.useState("")
@@ -427,7 +487,7 @@ export function MailPage() {
     onSettled: () => { qc.invalidateQueries({ queryKey: ["labels"] }); qc.invalidateQueries({ queryKey: ["messages"] }) },
   })
   const del = useMutation({ mutationFn: (id: string) => api.delete(id), onSuccess: async () => { setSelectedId(null); setPendingConfirm(null); await qc.invalidateQueries({ queryKey: ["messages"] }); await qc.invalidateQueries({ queryKey: ["folders"] }); await qc.invalidateQueries({ queryKey: ["mailboxes"] }); await qc.invalidateQueries({ queryKey: ["mail-stats"] }); await qc.invalidateQueries({ queryKey: ["labels"] }); toast({ title: "已删除" }) }, onError: (error) => toast({ title: "删除失败", description: error.message }) })
-  const move = useMutation({ mutationFn: ({ id, folder }: { id: string; folder: string }) => api.move(id, folder), onSuccess: async () => { setSelectedId(null); await qc.invalidateQueries({ queryKey: ["messages"] }); await qc.invalidateQueries({ queryKey: ["folders"] }); await qc.invalidateQueries({ queryKey: ["mailboxes"] }); await qc.invalidateQueries({ queryKey: ["mail-stats"] }); await qc.invalidateQueries({ queryKey: ["labels"] }); toast({ title: "已移动" }) } })
+  const move = useMutation({ mutationFn: ({ id, folder }: { id: string; folder: string }) => api.move(id, folder), onSuccess: async () => { setSelectedId(null); await qc.invalidateQueries({ queryKey: ["messages"] }); await qc.invalidateQueries({ queryKey: ["folders"] }); await qc.invalidateQueries({ queryKey: ["mailboxes"] }); await qc.invalidateQueries({ queryKey: ["mail-stats"] }); await qc.invalidateQueries({ queryKey: ["labels"] }); toast({ title: "已移动" }) }, onError: (error) => toast({ title: "移动失败", description: error.message }) })
   const cancelScheduledSend = useMutation({
     mutationFn: (item: ScheduledSend) => api.cancelScheduledSend(item.id),
     onMutate: (item) => setCancelingScheduledId(item.id),
@@ -439,7 +499,7 @@ export function MailPage() {
     onSettled: () => setCancelingScheduledId(""),
   })
   const createFolder = useMutation({
-    mutationFn: (name: string) => api.createFolder({ mailboxId: activeMailboxId, name }),
+    mutationFn: ({ name, icon }: { name: string; icon: string }) => api.createFolder({ mailboxId: activeMailboxId, name, icon }),
     onSuccess: (created) => {
       qc.invalidateQueries({ queryKey: ["folders"] })
       setFolderDialogOpen(false)
@@ -646,7 +706,6 @@ export function MailPage() {
         qc.invalidateQueries({ queryKey: ["send-queue"] }),
         qc.invalidateQueries({ queryKey: ["mail-notifications"] }),
       ]).finally(() => {
-        setLastAutoRefreshAt(new Date())
         window.setTimeout(() => setAutoRefreshing(false), 600)
       })
     }, mailRefreshInterval || 30000)
@@ -700,10 +759,12 @@ export function MailPage() {
   const compactAllSelected = visibleMessageIds.length > 0 && selectedCountOnPage === visibleMessageIds.length
   const compactSomeSelected = selectedCountOnPage > 0 && !compactAllSelected
   const mailMessagesLoading = mailView === "external" ? externalMessages.isLoading : mailView === "unknown" ? unknownMessages.isLoading : messages.isLoading
+  const mailMessagesError = mailView === "external" ? externalMessages.error : mailView === "unknown" ? unknownMessages.error : messages.error
   const mailMessagesLoadingMore = mailView === "external" ? externalMessages.isFetchingNextPage : mailView === "unknown" ? unknownMessages.isFetchingNextPage : messages.isFetchingNextPage
   const hasMoreMessages = mailView === "external" ? !!externalMessages.hasNextPage : mailView === "unknown" ? !!unknownMessages.hasNextPage : !!messages.hasNextPage
   const canLoadMore = hasMoreMessages && !mailMessagesLoadingMore
   const loadMoreMessages = () => mailView === "external" ? externalMessages.fetchNextPage() : mailView === "unknown" ? unknownMessages.fetchNextPage() : messages.fetchNextPage()
+  const refetchMessages = () => mailView === "external" ? externalMessages.refetch() : mailView === "unknown" ? unknownMessages.refetch() : messages.refetch()
   function toggleCompactSelectAll(checked: boolean) {
     setCompactSelectedIds(checked ? visibleMessageIds : [])
   }
@@ -902,6 +963,14 @@ export function MailPage() {
   function closeSidebarContextMenu() {
     setSidebarContextMenu(null)
   }
+  function runAfterClosingMobileSidebar(action: () => void) {
+    if (!isMobile) {
+      action()
+      return
+    }
+    if (mobileSidebarOpen) setMobileSidebarOpen(false)
+    window.setTimeout(action, 250)
+  }
   function activateSidebarItem(item: MailMenuItem) {
     if (item.type === "starred") openStarred()
     else if (item.type === "scheduled") openScheduled()
@@ -1103,7 +1172,6 @@ export function MailPage() {
     try {
       await refreshMailData()
       const refreshedAt = new Date()
-      setLastAutoRefreshAt(refreshedAt)
       toast({ title: "邮件已刷新", description: `更新于 ${refreshedAt.toLocaleTimeString([], { hour: "2-digit", minute: "2-digit", second: "2-digit" })}` })
     } catch (error) {
       toast({ title: "刷新失败", description: error instanceof Error ? error.message : "请稍后重试" })
@@ -1263,6 +1331,7 @@ export function MailPage() {
         )}
       </SidebarHeader>
       <SidebarContent className="px-1">
+        {!sidebarCollapsed && publicSettings.isError && <SidebarQueryFailure label="邮箱设置读取失败" onRetry={() => { void publicSettings.refetch() }} />}
         <SidebarGroup>
           {!sidebarCollapsed && (
             <div className="flex items-center justify-between px-2 py-1">
@@ -1316,8 +1385,10 @@ export function MailPage() {
               )}
             </SidebarMenu>
             {folders.isLoading && <FolderSkeleton />}
+            {!sidebarCollapsed && folders.isError && <SidebarQueryFailure label="文件夹读取失败" onRetry={() => { void folders.refetch() }} />}
           </SidebarGroupContent>
         </SidebarGroup>
+        {!sidebarCollapsed && externalImapEnabled && externalMailAccounts.isError && <SidebarQueryFailure label="外部邮箱读取失败" onRetry={() => { void externalMailAccounts.refetch() }} />}
         {externalAccountItems.length > 0 && <SidebarGroup>
           {!sidebarCollapsed && <SidebarGroupLabel>外部邮箱</SidebarGroupLabel>}
           <SidebarGroupContent>
@@ -1360,6 +1431,7 @@ export function MailPage() {
                     </SidebarMenuItem>
                   ))}
                   {!sidebarCollapsed && expanded && externalFolders.isLoading && <FolderSkeleton />}
+                  {!sidebarCollapsed && expanded && account.id === selectedExternalAccountId && externalFolders.isError && <SidebarQueryFailure label="远端文件夹读取失败" onRetry={() => { void externalFolders.refetch() }} />}
                 </React.Fragment>
               )})}
             </SidebarMenu>
@@ -1368,15 +1440,18 @@ export function MailPage() {
         {(customMailMenuItems.length > 0 || canManageFolders) && <SidebarGroup>
           {!sidebarCollapsed && (
             <div className="flex items-center justify-between px-2 py-1">
-              <SidebarGroupLabel className="m-0 h-auto gap-1 p-0 text-xs font-semibold text-muted-foreground"><ChevronDown className="h-3 w-3" />文件夹</SidebarGroupLabel>
+              <Button type="button" variant="ghost" className="h-auto min-w-0 justify-start gap-1 p-0 text-xs font-semibold text-muted-foreground hover:bg-transparent hover:text-foreground" aria-expanded={foldersExpanded} aria-controls="mail-sidebar-folders" onClick={() => setFoldersExpanded((value) => !value)}>
+                <ChevronDown className={cn("h-3 w-3 shrink-0 transition-transform", !foldersExpanded && "-rotate-90")} />
+                <span>文件夹</span>
+              </Button>
               {canManageFolders && (
-                <Button type="button" variant="ghost" size="icon" className="h-5 w-5 text-muted-foreground hover:bg-transparent hover:text-foreground" onClick={() => setFolderDialogOpen(true)}>
+                <Button type="button" variant="ghost" size="icon" className="h-5 w-5 text-muted-foreground hover:bg-transparent hover:text-foreground" aria-label="新建文件夹" title="新建文件夹" onClick={() => runAfterClosingMobileSidebar(() => setFolderDialogOpen(true))}>
                   <Plus className="h-3.5 w-3.5" />
                 </Button>
               )}
             </div>
           )}
-          <SidebarGroupContent>
+          {foldersExpanded && <SidebarGroupContent id="mail-sidebar-folders">
             <SidebarMenu>
               {customMailMenuItems.map((item) => (
                 <SidebarMenuItem
@@ -1422,19 +1497,22 @@ export function MailPage() {
                 />
               )}
             </SidebarMenu>
-          </SidebarGroupContent>
+          </SidebarGroupContent>}
         </SidebarGroup>}
         {(canReadMail || canManageLabels) && <SidebarGroup>
           {!sidebarCollapsed && (
             <div className="flex items-center justify-between px-2 py-1">
-              <SidebarGroupLabel className="m-0 h-auto gap-1 p-0 text-xs font-semibold text-muted-foreground"><ChevronDown className="h-3 w-3" />标签</SidebarGroupLabel>
+              <Button type="button" variant="ghost" className="h-auto min-w-0 justify-start gap-1 p-0 text-xs font-semibold text-muted-foreground hover:bg-transparent hover:text-foreground" aria-expanded={labelsExpanded} aria-controls="mail-sidebar-labels" onClick={() => setLabelsExpanded((value) => !value)}>
+                <ChevronDown className={cn("h-3 w-3 shrink-0 transition-transform", !labelsExpanded && "-rotate-90")} />
+                <span>标签</span>
+              </Button>
               {canManageCurrentMailboxLabels && (
                 <div className="flex items-center gap-0.5">
-                <Button type="button" variant="ghost" size="icon" className="h-5 w-5 text-muted-foreground hover:bg-transparent hover:text-foreground" onClick={() => { setNewLabelEditing(true); setLabelEditMode(true) }}>
+                <Button type="button" variant="ghost" size="icon" className="h-5 w-5 text-muted-foreground hover:bg-transparent hover:text-foreground" aria-label="新建标签" title="新建标签" onClick={() => { setNewLabelEditing(true); setLabelEditMode(true) }}>
                   <Plus className="h-3.5 w-3.5" />
                 </Button>
                 {labelEditMode && (
-                  <Button type="button" variant="ghost" size="icon" className="h-5 w-5 text-muted-foreground hover:bg-transparent hover:text-foreground" onClick={() => setLabelEditMode((v) => !v)}>
+                  <Button type="button" variant="ghost" size="icon" className="h-5 w-5 text-muted-foreground hover:bg-transparent hover:text-foreground" aria-label="完成标签编辑" title="完成编辑" onClick={() => setLabelEditMode((v) => !v)}>
                     <Check className="h-3 w-3" />
                   </Button>
                 )}
@@ -1442,7 +1520,7 @@ export function MailPage() {
               )}
             </div>
           )}
-          <SidebarGroupContent>
+          {labelsExpanded && <SidebarGroupContent id="mail-sidebar-labels">
             <SidebarMenu>
               {canReadMail && labelItems.map((label) => {
                 const dotColor = labelDotColor(label)
@@ -1479,7 +1557,7 @@ export function MailPage() {
                   </SidebarMenuItem>
                 )
               })}
-              {canReadMail && !sidebarCollapsed && !labels.isLoading && labelItems.length === 0 && <div className="px-2 py-1 text-xs text-muted-foreground">暂无标签</div>}
+              {canReadMail && !sidebarCollapsed && !labels.isLoading && !labels.isError && labelItems.length === 0 && <div className="px-2 py-1 text-xs text-muted-foreground">暂无标签</div>}
               {canManageCurrentMailboxLabels && labelEditMode && newLabelEditing && (
                 <SidebarMenuItem>
                   <NewLabelButton collapsed={sidebarCollapsed} pending={createLabel.isPending} onCreate={(name) => { createLabel.mutate(name); setNewLabelEditing(false) }} editing={newLabelEditing} onEditingChange={setNewLabelEditing} />
@@ -1487,9 +1565,38 @@ export function MailPage() {
               )}
             </SidebarMenu>
             {labels.isLoading && <FolderSkeleton />}
-          </SidebarGroupContent>
+            {!sidebarCollapsed && labels.isError && <SidebarQueryFailure label="标签读取失败" onRetry={() => { void labels.refetch() }} />}
+          </SidebarGroupContent>}
         </SidebarGroup>}
       </SidebarContent>
+      <SidebarContextMenu
+        state={sidebarContextMenu}
+        canCreate={canManageFolders}
+        canReorder={canOrganizeCurrentMailbox}
+        canDelete={canManageFolders}
+        pending={reorderFolders.isPending || deleteFolder.isPending}
+        onClose={closeSidebarContextMenu}
+        onOpen={(item) => {
+          closeSidebarContextMenu()
+          activateSidebarItem(item)
+        }}
+        onRefresh={() => {
+          closeSidebarContextMenu()
+          void refreshMailData()
+        }}
+        onCreateFolder={() => {
+          closeSidebarContextMenu()
+          runAfterClosingMobileSidebar(() => setFolderDialogOpen(true))
+        }}
+        onMove={(item, action) => {
+          closeSidebarContextMenu()
+          moveSidebarFolder(item, action)
+        }}
+        onDelete={(item) => {
+          closeSidebarContextMenu()
+          runAfterClosingMobileSidebar(() => confirmDeleteFolder(item))
+        }}
+      />
     </Sidebar>
   )
 
@@ -1513,8 +1620,12 @@ export function MailPage() {
     <PermissionEmptyState title="无邮箱前台权限" description="当前账号未开启邮箱前台访问权限。" onOpenSettings={openSettings} />
   ) : !canReadMail ? (
     <PermissionEmptyState title="无邮件查看权限" description="当前账号可以访问邮箱前台，但未开启邮件查看权限。" onOpenSettings={openSettings} />
+  ) : mailboxList.isError ? (
+    <MailQueryFailure error={mailboxList.error} onRetry={() => { void mailboxList.refetch() }} />
   ) : !mailboxList.isLoading && !hasMailboxes && mailView !== "unknown" ? (
     <NoMailboxState onManageMailboxes={() => navigate("/profile?tab=mailboxes")} />
+  ) : mailView === "scheduled" && scheduledSends.isError ? (
+    <MailQueryFailure error={scheduledSends.error} onRetry={() => { void scheduledSends.refetch() }} />
   ) : mailView === "scheduled" && canScheduleMail ? (
     <ScheduledSendView
       compact={compactMailLayout}
@@ -1527,6 +1638,8 @@ export function MailPage() {
     />
   ) : mailView === "scheduled" ? (
     <PermissionEmptyState title="无定时发送权限" description="当前账号不能查看或管理定时发送任务。" onOpenSettings={openSettings} />
+  ) : mailView === "sendQueue" && sendQueue.isError ? (
+    <MailQueryFailure error={sendQueue.error} onRetry={() => { void sendQueue.refetch() }} />
   ) : mailView === "sendQueue" && canViewSendQueue ? (
     <SendQueueView
       compact={compactMailLayout}
@@ -1552,6 +1665,8 @@ export function MailPage() {
     />
   ) : mailView === "sendQueue" ? (
     <PermissionEmptyState title="无发送队列权限" description="当前账号不能查看发送队列。" onOpenSettings={openSettings} />
+  ) : mailMessagesError ? (
+    <MailQueryFailure error={mailMessagesError} onRetry={() => { void refetchMessages() }} />
   ) : compactMailLayout ? (
     <CompactMailView
       title={viewTitle}
@@ -1569,6 +1684,8 @@ export function MailPage() {
       selectedId={selectedId}
       selected={selected}
       detailLoading={detail.isLoading}
+      detailError={detail.error}
+      onRetryDetail={() => { void detail.refetch() }}
       labels={labelItems}
       labelPending={addLabel.isPending || removeLabel.isPending}
       onSelect={openMessage}
@@ -1690,7 +1807,8 @@ export function MailPage() {
             </div>
           )}
           {detail.isLoading && <div className="space-y-4 p-6"><Skeleton className="h-8 w-2/3" /><Skeleton className="h-4 w-1/3" /><Separator /><Skeleton className="h-40 w-full" /></div>}
-          {selected && <div className="flex h-full min-h-0 flex-col">
+          {detail.isError && <MailDetailFailure error={detail.error} onRetry={() => { void detail.refetch() }} />}
+          {!detail.isError && selected && <div className="flex h-full min-h-0 flex-col">
             <div className="border-b p-5">
               {isTwoPaneMailViewport && (
                 <Button variant="ghost" size="sm" className="-ml-2 mb-3 h-8 px-2 text-[13px] font-normal" onClick={() => setSelectedId(null)}>
@@ -1773,7 +1891,9 @@ export function MailPage() {
       <SendQueueAuditDialog
         open={!!sendQueueAuditId}
         loading={sendQueueAudit.isLoading}
+        error={sendQueueAudit.error}
         events={sendQueueAudit.data?.items || []}
+        onRetry={() => { void sendQueueAudit.refetch() }}
         onOpenChange={(open) => { if (!open) setSendQueueAuditId("") }}
       />
       <MessageContextMenu
@@ -1795,39 +1915,11 @@ export function MailPage() {
           active ? removeLabel.mutate({ id: message.id, labelId: label.id }) : addLabel.mutate({ id: message.id, label })
         }}
       />
-      <SidebarContextMenu
-        state={sidebarContextMenu}
-        canCreate={canManageFolders}
-        canReorder={canOrganizeCurrentMailbox}
-        canDelete={canManageFolders}
-        pending={reorderFolders.isPending || deleteFolder.isPending}
-        onClose={closeSidebarContextMenu}
-        onOpen={(item) => {
-          closeSidebarContextMenu()
-          activateSidebarItem(item)
-        }}
-        onRefresh={() => {
-          closeSidebarContextMenu()
-          void refreshMailData()
-        }}
-        onCreateFolder={() => {
-          closeSidebarContextMenu()
-          setFolderDialogOpen(true)
-        }}
-        onMove={(item, action) => {
-          closeSidebarContextMenu()
-          moveSidebarFolder(item, action)
-        }}
-        onDelete={(item) => {
-          closeSidebarContextMenu()
-          confirmDeleteFolder(item)
-        }}
-      />
       <CreateFolderDialog
         open={folderDialogOpen}
         pending={createFolder.isPending}
         onOpenChange={setFolderDialogOpen}
-        onCreate={(name) => createFolder.mutate(name)}
+        onCreate={(payload) => createFolder.mutate(payload)}
       />
       <ConfirmDialog
         open={!!pendingConfirm}
@@ -1835,7 +1927,7 @@ export function MailPage() {
         description={pendingConfirm?.description}
         confirmText={pendingConfirm?.confirmText || "确认"}
         destructive
-        pending={del.isPending || bulkPending}
+        pending={del.isPending || bulkPending || deleteFolder.isPending}
         onOpenChange={(open) => { if (!open) setPendingConfirm(null) }}
         onConfirm={() => pendingConfirm?.onConfirm()}
       />
@@ -1845,7 +1937,7 @@ export function MailPage() {
 
 function buildMailMenuItems(folders: MailFolder[], starredCount: number, scheduledCount: number, includeScheduled: boolean, sendQueueCount: number, includeSendQueue: boolean, includeUnknown: boolean): MailMenuItem[] {
   const byName = new Map(folders.map((item) => [item.name, item]))
-  const normalizedFolders = ["Inbox", "Drafts", "Sent", "Archive", "Spam", "Trash"].map((name) => byName.get(name) || { id: `virtual-${name}`, name, role: name.toLowerCase(), sortOrder: 0, unreadCount: 0, totalCount: 0, uidValidity: 0, uidNext: 1, highestModseq: 1 })
+  const normalizedFolders = ["Inbox", "Drafts", "Sent", "Archive", "Spam", "Trash"].map((name) => byName.get(name) || { id: `virtual-${name}`, name, role: name.toLowerCase(), icon: "folder", sortOrder: 0, unreadCount: 0, totalCount: 0, uidValidity: 0, uidNext: 1, highestModseq: 1 })
   for (const item of folders) {
     if (!normalizedFolders.some((folder) => folder.name === item.name)) normalizedFolders.push(item)
   }
@@ -1855,7 +1947,7 @@ function buildMailMenuItems(folders: MailFolder[], starredCount: number, schedul
     folderId: item.id,
     folderName: item.name,
     label: folderLabels[item.name] || item.name,
-    icon: isCustomMailFolder(item) ? <Folder className="h-4 w-4" /> : folderIcons[item.role] || <Inbox className="h-4 w-4" />,
+    icon: isCustomMailFolder(item) ? customFolderIcon(item.icon) : folderIcons[item.role] || <Inbox className="h-4 w-4" />,
     count: item.name === "Drafts" ? item.totalCount : item.unreadCount,
     custom: isCustomMailFolder(item),
     order: isCustomMailFolder(item) ? item.sortOrder || 100000 : menuAnchorOrder(item.name),
@@ -1875,6 +1967,13 @@ function isCustomMailFolder(folder: Pick<MailFolder, "name" | "id">) {
   return !folder.id.startsWith("virtual-") && !["inbox", "sent", "drafts", "archive", "spam", "trash"].includes(folder.name.trim().toLowerCase())
 }
 
+function customFolderIcon(iconKey: string | undefined, className = "h-4 w-4") {
+  if (iconKey?.startsWith("data:image/png;base64,")) return <img src={iconKey} alt="" className={cn("shrink-0 object-contain", className)} />
+  const option = customFolderIconOptions.find((item) => item.key === iconKey) || customFolderIconOptions[0]
+  const Icon = option.icon
+  return <Icon className={className} />
+}
+
 function compareMailFolders(a: MailFolder, b: MailFolder) {
   return (isCustomMailFolder(a) ? a.sortOrder || 100000 : menuAnchorOrder(a.name)) - (isCustomMailFolder(b) ? b.sortOrder || 100000 : menuAnchorOrder(b.name)) || a.name.localeCompare(b.name)
 }
@@ -2143,6 +2242,45 @@ function PermissionEmptyState({ title, description, onOpenSettings }: { title: s
   )
 }
 
+function MailQueryFailure({ error, onRetry }: { error: Error; onRetry: () => void }) {
+  return (
+    <div className="grid min-h-0 flex-1 place-items-center p-6" role="alert">
+      <div className="w-full max-w-md rounded-lg border border-destructive/40 bg-destructive/5 p-8 text-center">
+        <div className="text-lg font-semibold text-destructive">邮件数据读取失败</div>
+        <div className="mt-2 break-words text-sm text-muted-foreground">{error.message || "请检查网络连接后重试"}</div>
+        <Button type="button" variant="outline" className="mt-5" onClick={onRetry}>
+          <RefreshCcw className="h-4 w-4" />重新读取
+        </Button>
+      </div>
+    </div>
+  )
+}
+
+function MailDetailFailure({ error, onRetry }: { error: Error; onRetry: () => void }) {
+  return (
+    <div className="grid h-full min-h-[240px] place-items-center p-6" role="alert">
+      <div className="max-w-md text-center">
+        <div className="font-semibold text-destructive">邮件详情读取失败</div>
+        <div className="mt-2 break-words text-sm text-muted-foreground">{error.message || "请检查网络连接后重试"}</div>
+        <Button type="button" variant="outline" size="sm" className="mt-4" onClick={onRetry}>
+          <RefreshCcw className="h-4 w-4" />重新读取
+        </Button>
+      </div>
+    </div>
+  )
+}
+
+function SidebarQueryFailure({ label, onRetry }: { label: string; onRetry: () => void }) {
+  return (
+    <div className="mx-2 my-1 flex min-h-8 items-center gap-2 rounded-md border border-destructive/30 bg-destructive/5 px-2 text-xs text-destructive" role="alert">
+      <span className="min-w-0 flex-1 truncate">{label}</span>
+      <Button type="button" variant="ghost" size="icon" className="h-6 w-6 shrink-0 text-destructive hover:text-destructive" aria-label={`重试${label}`} title="重新读取" onClick={onRetry}>
+        <RefreshCcw className="h-3.5 w-3.5" />
+      </Button>
+    </div>
+  )
+}
+
 function ScheduledSendView({ compact, items, total, loading, query, cancelingId, onCancel }: { compact: boolean; items: ScheduledSend[]; total: number; loading: boolean; query: string; cancelingId: string; onCancel: (item: ScheduledSend) => void }) {
   const empty = query.trim() ? "当前搜索没有匹配的定时邮件" : "没有待发送邮件"
   return (
@@ -2378,7 +2516,7 @@ function SendQueueStatusBadge({ status }: { status: SendQueueStatus }) {
   )
 }
 
-function SendQueueAuditDialog({ open, loading, events, onOpenChange }: { open: boolean; loading: boolean; events: SendQueueAuditEvent[]; onOpenChange: (open: boolean) => void }) {
+function SendQueueAuditDialog({ open, loading, error, events, onRetry, onOpenChange }: { open: boolean; loading: boolean; error: Error | null; events: SendQueueAuditEvent[]; onRetry: () => void; onOpenChange: (open: boolean) => void }) {
   return (
     <Dialog open={open} onOpenChange={onOpenChange}>
       <DialogContent className="w-[min(92vw,42rem)] max-w-none">
@@ -2387,8 +2525,9 @@ function SendQueueAuditDialog({ open, loading, events, onOpenChange }: { open: b
         </DialogHeader>
         <div className="max-h-[60vh] overflow-auto pr-1">
           {loading && <div className="space-y-3">{Array.from({ length: 4 }).map((_, index) => <Skeleton key={index} className="h-14 w-full" />)}</div>}
-          {!loading && events.length === 0 && <div className="rounded-lg border border-dashed p-6 text-center text-sm text-muted-foreground">暂无投递事件</div>}
-          {!loading && events.length > 0 && (
+          {!loading && error && <div className="rounded-lg border border-destructive/40 bg-destructive/5 p-6 text-center" role="alert"><div className="text-sm font-medium text-destructive">投递记录读取失败</div><div className="mt-1 break-words text-xs text-muted-foreground">{error.message}</div><Button type="button" variant="outline" size="sm" className="mt-4" onClick={onRetry}><RefreshCcw className="h-4 w-4" />重新读取</Button></div>}
+          {!loading && !error && events.length === 0 && <div className="rounded-lg border border-dashed p-6 text-center text-sm text-muted-foreground">暂无投递事件</div>}
+          {!loading && !error && events.length > 0 && (
             <div className="space-y-3">
               {events.map((event) => (
                 <div key={event.id} className="rounded-lg border p-3">
@@ -2456,7 +2595,7 @@ function BulkActionToolbar({ pending, currentFolder, folders = [], readAction =
           <DropdownMenuContent align="end" className="w-44">
             {movableFolders.map((folder) => (
               <DropdownMenuItem key={folder.id} onSelect={() => onMoveToFolder(folder.name)}>
-                {folderIcons[folder.role] || <Folder className="h-4 w-4" />}
+                {isCustomMailFolder(folder) ? customFolderIcon(folder.icon) : folderIcons[folder.role] || <Folder className="h-4 w-4" />}
                 <span className="min-w-0 flex-1 truncate">{folderLabels[folder.name] || folder.name}</span>
               </DropdownMenuItem>
             ))}
@@ -2510,7 +2649,7 @@ function SidebarContextMenu({ state, canCreate, canReorder, canDelete, pending,
       </Button>
       {canCreate && (
         <Button type="button" variant="ghost" className={itemClass} onClick={onCreateFolder}>
-          <Plus className="h-4 w-4" />新建文件夹
+          新建文件夹
         </Button>
       )}
       {customFolder && (canReorder || canDelete) && (
@@ -2616,7 +2755,7 @@ function MessageContextMenu({ state, labels, folders, canSend, canOrganize, canM
           <div className="max-h-44 overflow-y-auto">
             {movableFolders.map((folder) => (
               <Button key={folder.id} type="button" variant="ghost" className={itemClass} onClick={() => moveToFolder(folder.name)}>
-                {folderIcons[folder.role] || <Inbox className="h-4 w-4" />}
+                {isCustomMailFolder(folder) ? customFolderIcon(folder.icon) : folderIcons[folder.role] || <Inbox className="h-4 w-4" />}
                 <span className="min-w-0 flex-1 truncate text-left">{folderLabels[folder.name] || folder.name}</span>
                 {folder.totalCount > 0 && <span className="text-xs text-muted-foreground">{folder.totalCount}</span>}
               </Button>
@@ -2661,12 +2800,21 @@ function contextMenuPosition(x: number, y: number) {
   return { x: Math.min(Math.max(x, padding), maxX), y: Math.min(Math.max(y, padding), maxY) }
 }
 
-function CreateFolderDialog({ open, pending, onOpenChange, onCreate }: { open: boolean; pending: boolean; onOpenChange: (open: boolean) => void; onCreate: (name: string) => void }) {
+function CreateFolderDialog({ open, pending, onOpenChange, onCreate }: { open: boolean; pending: boolean; onOpenChange: (open: boolean) => void; onCreate: (payload: { name: string; icon: string }) => void }) {
   const [name, setName] = React.useState("")
+  const [icon, setIcon] = React.useState("auto")
+  const [uploadError, setUploadError] = React.useState("")
+  const iconInputRef = React.useRef<HTMLInputElement>(null)
   React.useEffect(() => {
-    if (open) setName("")
+    if (open) {
+      setName("")
+      setIcon("auto")
+      setUploadError("")
+    }
   }, [open])
   const trimmed = name.trim()
+  const suggestedIcon = suggestedFolderIcon(trimmed)
+  const resolvedIcon = icon === "auto" ? suggestedIcon : icon
   return (
     <Dialog open={open} onOpenChange={onOpenChange}>
       <DialogContent className="w-[min(92vw,28rem)] max-w-none">
@@ -2677,13 +2825,51 @@ function CreateFolderDialog({ open, pending, onOpenChange, onCreate }: { open: b
           className="space-y-4"
           onSubmit={(event) => {
             event.preventDefault()
-            if (trimmed) onCreate(trimmed)
+            if (trimmed) onCreate({ name: trimmed, icon: resolvedIcon })
           }}
         >
           <div className="space-y-2">
             <Label htmlFor="new-folder-name">文件夹名称</Label>
             <Input id="new-folder-name" autoFocus value={name} onChange={(event) => setName(event.target.value)} placeholder="例如：客户、账单、项目归档" />
           </div>
+          <fieldset className="space-y-2">
+            <legend className="text-sm font-medium">图标</legend>
+            <div className="grid grid-cols-7 gap-2">
+              <Button type="button" variant="outline" size="icon" className={cn("relative size-10 shadow-none", icon === "auto" && "border-primary bg-primary/10 text-primary ring-1 ring-primary")} onClick={() => setIcon("auto")} aria-label={`自动匹配：${customFolderIconOptions.find((item) => item.key === suggestedIcon)?.label || "文件夹"}`} title={`自动匹配：${customFolderIconOptions.find((item) => item.key === suggestedIcon)?.label || "文件夹"}`} aria-pressed={icon === "auto"}>
+                {customFolderIcon(suggestedIcon)}
+                <Sparkles className="absolute -right-1 -top-1 h-3 w-3 rounded-full bg-background" />
+              </Button>
+              {customFolderIconOptions.map((option) => {
+                const Icon = option.icon
+                return (
+                  <Button key={option.key} type="button" variant="outline" size="icon" className={cn("size-10 shadow-none", icon === option.key && "border-primary bg-primary/10 text-primary ring-1 ring-primary")} onClick={() => setIcon(option.key)} aria-label={option.label} title={option.label} aria-pressed={icon === option.key}>
+                    <Icon className="h-4 w-4" />
+                  </Button>
+                )
+              })}
+              <Button type="button" variant="outline" size="icon" className={cn("size-10 shadow-none", icon.startsWith("data:image/png;base64,") && "border-primary bg-primary/10 text-primary ring-1 ring-primary")} onClick={() => iconInputRef.current?.click()} aria-label="上传自定义图标" title="上传自定义图标" aria-pressed={icon.startsWith("data:image/png;base64,")}>
+                {icon.startsWith("data:image/png;base64,") ? customFolderIcon(icon) : <Upload className="h-4 w-4" />}
+              </Button>
+              <input
+                ref={iconInputRef}
+                type="file"
+                accept="image/png,image/jpeg,image/webp"
+                className="hidden"
+                onChange={async (event) => {
+                  const file = event.target.files?.[0]
+                  event.target.value = ""
+                  if (!file) return
+                  try {
+                    setUploadError("")
+                    setIcon(await prepareFolderIcon(file))
+                  } catch (error) {
+                    setUploadError(error instanceof Error ? error.message : "无法处理该图片")
+                  }
+                }}
+              />
+            </div>
+            {uploadError && <p role="alert" className="text-xs text-destructive">{uploadError}</p>}
+          </fieldset>
           <DialogFooter className="gap-2">
             <Button type="button" variant="outline" onClick={() => onOpenChange(false)}>取消</Button>
             <Button disabled={!trimmed || pending}>{pending ? "创建中..." : "创建"}</Button>
@@ -2709,6 +2895,7 @@ function CompactMailView({
   selectedId,
   selected,
   detailLoading,
+  detailError,
   labels,
   labelPending,
   onSelect,
@@ -2716,6 +2903,7 @@ function CompactMailView({
   onToggleSelected,
   scheduledDraftIds,
   onLoadMore,
+  onRetryDetail,
   onCloseReader,
   onStar,
   onReply,
@@ -2750,6 +2938,7 @@ function CompactMailView({
   selectedId: string | null
   selected?: MailMessage
   detailLoading: boolean
+  detailError: Error | null
   labels: MailLabel[]
   labelPending: boolean
   onSelect: (id: string | null) => void
@@ -2757,6 +2946,7 @@ function CompactMailView({
   onToggleSelected: (id: string, checked: boolean) => void
   scheduledDraftIds: Set<string>
   onLoadMore: () => void
+  onRetryDetail: () => void
   onCloseReader: () => void
   onStar: (message: MailMessage) => void
   onReply: (message: MailMessage) => void
@@ -2786,11 +2976,13 @@ function CompactMailView({
       <CompactMessageDetail
         selected={selected}
         loading={detailLoading}
+        error={detailError}
         labels={labels}
         labelPending={labelPending}
         previousMessage={previousMessage}
         nextMessage={nextMessage}
         onBack={onCloseReader}
+        onRetry={onRetryDetail}
         onSelect={onSelect}
         onStar={onStar}
         onReply={onReply}
@@ -2853,11 +3045,13 @@ function CompactMailView({
 function CompactMessageDetail({
   selected,
   loading,
+  error,
   labels,
   labelPending,
   previousMessage,
   nextMessage,
   onBack,
+  onRetry,
   onSelect,
   onStar,
   onReply,
@@ -2876,11 +3070,13 @@ function CompactMessageDetail({
 }: {
   selected?: MailMessage
   loading: boolean
+  error: Error | null
   labels: MailLabel[]
   labelPending: boolean
   previousMessage?: MailMessage
   nextMessage?: MailMessage
   onBack: () => void
+  onRetry: () => void
   onSelect: (id: string | null) => void
   onStar: (message: MailMessage) => void
   onReply: (message: MailMessage) => void
@@ -2960,8 +3156,9 @@ function CompactMessageDetail({
         </div>
       </div>
         {loading && <div className="space-y-4 p-8"><Skeleton className="h-8 w-2/3" /><Skeleton className="h-4 w-1/3" /><Separator /><Skeleton className="h-64 w-full" /></div>}
-        {!loading && !selected && <div className="grid flex-1 place-items-center text-sm text-muted-foreground">邮件不存在</div>}
-        {selected && (
+        {!loading && error && <MailDetailFailure error={error} onRetry={onRetry} />}
+        {!loading && !error && !selected && <div className="grid flex-1 place-items-center text-sm text-muted-foreground">邮件不存在</div>}
+        {!error && selected && (
           <ScrollArea className="min-h-0 flex-1">
             <div className="w-full px-4 py-4 sm:px-8 sm:py-6">
               <div className="space-y-5 border-b pb-5">
@@ -3197,7 +3394,6 @@ function NewLabelButton({ collapsed, pending, onCreate, editing, onEditingChange
   }
   return (
     <SidebarMenuButton className="text-muted-foreground" onClick={() => setEditingState(true)}>
-      <Plus className="h-4 w-4" />
       <span>新建标签</span>
     </SidebarMenuButton>
   )
@@ -3682,12 +3878,15 @@ function ComposeDialog({ mailboxes, mailbox, open, draft, limits, canSend, canMa
       return sent
     },
     onSuccess: async (_, payloads) => {
+      let draftDeleteFailed = false
       if (draftId) {
         try {
           await api.deleteDraft(draftId)
-        } catch {}
+        } catch {
+          draftDeleteFailed = true
         }
-      toast({ title: payloads.length > 1 ? `已分别发送 ${payloads.length} 封邮件` : "发送成功" })
+      }
+      toast({ title: payloads.length > 1 ? `已分别发送 ${payloads.length} 封邮件` : "发送成功", description: draftDeleteFailed ? "邮件已发送，但原草稿未能自动删除" : undefined })
       setFiles([])
       setDraftId("")
       onSent()
@@ -3952,6 +4151,14 @@ function ComposeDialog({ mailboxes, mailbox, open, draft, limits, canSend, canMa
             <ComposeField label="主　题">
               <Input name="subject" placeholder="输入主题" value={subjectValue} onChange={(event) => setSubjectValue(event.target.value)} className="h-10 flex-1 rounded-none border-0 px-0 shadow-none focus-visible:ring-0" />
             </ComposeField>
+            {defaultSignature.isError && (
+              <div className="flex items-center justify-between gap-3 border-b bg-destructive/5 px-4 py-2 text-xs text-destructive sm:px-6" role="alert">
+                <span>默认签名读取失败</span>
+                <Button type="button" variant="ghost" size="sm" className="h-7 text-destructive hover:text-destructive" onClick={() => { void defaultSignature.refetch() }}>
+                  <RefreshCcw className="h-3.5 w-3.5" />重新读取
+                </Button>
+              </div>
+            )}
             <MailBodyComposer
               defaultValue={composerText}
               defaultHtml={draft?.html}
@@ -4383,7 +4590,7 @@ function MailBodyComposer({ defaultValue, defaultHtml, files, signatureText, max
           <DropdownMenuContent align="start" className="w-64 p-2">
             <div className="grid grid-cols-8 gap-1">
               {composerEmojiOptions.map((emoji) => (
-                <Button key={emoji} type="button" variant="ghost" size="icon" className="h-8 w-8 rounded-md text-lg" onClick={() => insertEmoji(emoji)}>
+                <Button key={emoji} type="button" variant="ghost" size="icon" className="h-8 w-8 rounded-md text-lg" aria-label={`插入表情 ${emoji}`} title={`插入 ${emoji}`} onClick={() => insertEmoji(emoji)}>
                   {emoji}
                 </Button>
               ))}
@@ -4495,7 +4702,7 @@ function MailBodyComposer({ defaultValue, defaultHtml, files, signatureText, max
                 <Paperclip className="h-3.5 w-3.5" />
                 <span className="max-w-48 truncate">{file.name}</span>
                 <span className="text-muted-foreground">{formatBytes(file.size)}</span>
-                <Button type="button" variant="ghost" size="icon" className="h-5 w-5 rounded-md" onClick={() => onRemoveFile(index)}>
+                <Button type="button" variant="ghost" size="icon" className="h-5 w-5 rounded-md" aria-label={`移除附件 ${file.name}`} title="移除附件" onClick={() => onRemoveFile(index)}>
                   <X className="h-3.5 w-3.5" />
                 </Button>
               </Badge>

apps/web/src/pages/not-found.tsx

@@ -4,7 +4,7 @@ import { Home, MailQuestion } from "lucide-react"
 
 export function NotFoundPage() {
   return (
-    <div className="grid min-h-screen place-items-center bg-background px-4">
+    <main className="grid min-h-screen place-items-center bg-background px-4">
       <div className="w-full max-w-sm text-center">
         <div className="mb-6 flex justify-center">
           <div className="flex h-20 w-20 items-center justify-center rounded-full bg-muted">
@@ -24,6 +24,6 @@ export function NotFoundPage() {
           </Button>
         </div>
       </div>
-    </div>
+    </main>
   )
 }

apps/web/src/pages/register.tsx

@@ -13,6 +13,7 @@ import { useToast } from "@/hooks/use-toast"
 import { PasswordInput } from "@/components/ui/password-input"
 import { TurnstileBox } from "@/components/turnstile-box"
 import { validatePasswordConfirm } from "@/lib/validation"
+import { AuthError, AuthLoading } from "@/components/auth-states"
 
 export function RegisterPage() {
   const me = useMe()
@@ -57,8 +58,10 @@ export function RegisterPage() {
   })
   const turnstileRequired = !!publicSettings.data?.turnstileEnabled
   if (me.data?.user) return <Navigate to="/" replace />
+  if (publicSettings.isLoading) return <AuthLoading />
+  if (publicSettings.isError) return <AuthError message={publicSettings.error.message} onRetry={() => { void publicSettings.refetch() }} />
   return (
-    <div className="flex min-h-screen items-center justify-center bg-muted/20 px-4 py-10">
+    <main className="flex min-h-screen items-center justify-center bg-muted/20 px-4 py-10">
       <div className="w-full max-w-[420px]">
         <div className="mb-7 text-center">
           <h1 className="text-3xl font-semibold tracking-tight">NewSzxcn 邮箱</h1>
@@ -103,7 +106,6 @@ export function RegisterPage() {
               <div className="space-y-2">
                 <Label htmlFor="displayName" className="text-sm font-medium">显示名称</Label>
                 <Input id="displayName" name="displayName" autoComplete="name" required className="h-11 text-base" />
-                <p className="text-xs leading-5 text-muted-foreground">显示名称注册后不可自行修改，如需更换请联系管理员。</p>
               </div>
               <div className="space-y-2">
                 <Label htmlFor="password" className="text-sm font-medium">密码</Label>
@@ -130,6 +132,6 @@ export function RegisterPage() {
           </div>
         )}
       </div>
-    </div>
+    </main>
   )
 }

apps/web/vite.config.ts

@@ -1,8 +1,12 @@
 import path from "node:path"
 import react from "@vitejs/plugin-react"
-import { defineConfig } from "vite"
+import { defineConfig, loadEnv } from "vite"
 
-export default defineConfig({
+export default defineConfig(({ mode }) => {
+  const env = loadEnv(mode, process.cwd(), "")
+  const apiTarget = env.VITE_API_TARGET || "http://localhost:8080"
+
+  return {
     plugins: [react()],
     resolve: {
       alias: {
@@ -12,8 +16,29 @@ export default defineConfig({
     server: {
       port: 5173,
       proxy: {
-      "/api": "http://localhost:8080",
-      "/healthz": "http://localhost:8080",
+        "/api": apiTarget,
+        "/healthz": apiTarget,
       },
     },
+    build: {
+      rolldownOptions: {
+        output: {
+          codeSplitting: {
+            groups: [
+              {
+                name: "prosemirror",
+                test: /node_modules[\\/]prosemirror-/,
+                priority: 30,
+              },
+              {
+                name: "tiptap",
+                test: /node_modules[\\/]@tiptap/,
+                priority: 20,
+              },
+            ],
+          },
+        },
+      },
+    },
+  }
 })

docs/ISSUE_LEDGER.md

@@ -42,12 +42,12 @@
 | NSX-20260806-005 | 2026-08-06 | 已完成 | 后端/通知；前端/设置；部署运维/CI | Telegram 私聊邮件通知与 Release 频道通知 | S3 | v1.2.16 | 随 v1.2.16 发布 |
 | NSX-20260806-006 | 2026-08-06 | 已完成 | 后端/通知；邮件核心；前端/设置；质量复核 | Telegram 邮件通知安全、验证码复制和可靠性复核 | S2 | v1.2.17 | 随 v1.2.17 发布 |
 | NSX-20260806-007 | 2026-08-06 | 已完成 | 前端/UI；后端/通知；部署运维/CI | 邮箱下拉层越界、验证码漏识别、邮件与版本通知链接样式 | S3 | v1.2.18 | 随 v1.2.18 发布 |
-| NSX-20260807-008 | 2026-08-07 | 待验收 | 前端/UI；邮件发送；部署运维/安装 | 全部邮箱写信无法选择发件邮箱且默认项错误，写信窗口过宽；安装管理员邮箱流程需明确 | S3 | v1.2.19 | 待发布 |
-| NSX-20260807-009 | 2026-08-07 | 待验收 | 部署运维/安装；文档；质量复核 | 一键安装主菜单未按安装状态区分，命令前置条件和状态显示需复核 | S2 | v1.2.19 | 待发布 |
-| NSX-20260807-010 | 2026-08-07 | 待验收 | 邮件投递；DKIM；部署运维；质量复核 | Rspamd 在域名密钥变化后继续使用旧私钥，导致外发邮件 DKIM 验证失败 | S2 | v1.2.19 | 待发布 |
-| NSX-20260807-011 | 2026-08-07 | 待验收 | 后端/通知；验证码识别；质量复核 | 邮件地址中的字母数字片段触发验证码候选冲突，导致 Telegram 不显示验证码与复制按钮 | S3 | v1.2.19 | 待发布 |
-| NSX-20260807-012 | 2026-08-07 | 待验收 | 前端/UI；域名管理；质量复核 | DNS 记录复制按钮把类型、名称和值拼成整行，无法直接粘贴到域名服务商对应字段 | S3 | v1.2.19 | 待发布 |
-| NSX-20260807-013 | 2026-08-07 | 待验收 | 邮件核心；前端/标签；数据迁移；质量复核 | 邮箱创建后没有常用默认标签，需要手动逐个建立 | S3 | v1.2.19 | 待发布 |
+| NSX-20260807-008 | 2026-08-07 | 已完成 | 前端/UI；邮件发送；部署运维/安装 | 全部邮箱写信无法选择发件邮箱且默认项错误，写信窗口过宽；安装管理员邮箱流程需明确 | S3 | v1.2.19 | 随 v1.2.19 发布 |
+| NSX-20260807-009 | 2026-08-07 | 已完成 | 部署运维/安装；文档；质量复核 | 一键安装主菜单未按安装状态区分，命令前置条件和状态显示需复核 | S2 | v1.2.19 | 随 v1.2.19 发布 |
+| NSX-20260807-010 | 2026-08-07 | 已完成 | 邮件投递；DKIM；部署运维；质量复核 | Rspamd 在域名密钥变化后继续使用旧私钥，导致外发邮件 DKIM 验证失败 | S2 | v1.2.19 | 随 v1.2.19 发布，线上 DKIM 已验收通过 |
+| NSX-20260807-011 | 2026-08-07 | 已完成 | 后端/通知；验证码识别；质量复核 | 邮件地址中的字母数字片段触发验证码候选冲突，导致 Telegram 不显示验证码与复制按钮 | S3 | v1.2.19 | 随 v1.2.19 发布 |
+| NSX-20260807-012 | 2026-08-07 | 已完成 | 前端/UI；域名管理；质量复核 | DNS 记录复制按钮把类型、名称和值拼成整行，无法直接粘贴到域名服务商对应字段 | S3 | v1.2.19 | 随 v1.2.19 发布 |
+| NSX-20260807-013 | 2026-08-07 | 已完成 | 邮件核心；前端/标签；数据迁移；质量复核 | 邮箱创建后没有常用默认标签，需要手动逐个建立 | S3 | v1.2.19 | 随 v1.2.19 发布 |
 
 ## NSX-20260804-001
 
@@ -289,14 +289,14 @@
 | --- | --- |
 | 编号 | NSX-20260807-008 |
 | 日期 | 2026-08-07 |
-| 状态 | 待验收 |
+| 状态 | 已完成 |
 | 模块 | 前端/UI；邮件发送；部署运维/安装；质量复核 |
 | 现象 | “全部邮箱”状态写信时固定使用列表第一项，无法选择发件邮箱；写信窗口在桌面端过宽；安装时邮件服务器域名、邮箱地址域名和管理员邮箱前缀的关系不够直观。 |
 | 根因 | 全部邮箱状态直接将邮箱列表第一项传入写信组件，组件只支持只读展示单个邮箱；窗口最大宽度为 82rem。 |
 | 实现 | “全部邮箱”写信默认优先匹配当前登录邮箱，并可在全部有效邮箱中切换；回复、转发沿用原邮件所属邮箱；发送、定时发送和草稿自动保存统一使用当前选择的发件邮箱；桌面写信窗口参照 Seek 收窄至最大 72rem；表单仅在新写信会话开始时初始化，切换邮箱或加载签名不会清空已填写内容；安装脚本回归测试明确覆盖 mail.newszxcn.com 对应 admin@newszxcn.com。 |
 | 目标版本 | v1.2.19 |
 | 测试结果 | 前端 check/build、Go 全量测试与 go vet、安装脚本测试、bash 语法检查、ShellCheck、git diff 检查均通过；本地双邮箱页面实测默认选择登录邮箱，下拉项完整，切换邮箱后收件人、主题、正文均保留，数据库确认草稿保存到新选择的邮箱；桌面截图确认写信窗口无溢出和遮挡。 |
-| 发布状态 | 待发布。 |
+| 发布状态 | 随 v1.2.19 发布。 |
 
 ### 历史
 
@@ -304,6 +304,7 @@
 | --- | --- |
 | 2026-08-07 | 用户反馈全部邮箱写信的默认发件箱、邮箱选择和窗口宽度问题，进入处理中。 |
 | 2026-08-07 | 完成写信邮箱选择、默认项、回复/转发邮箱、草稿归属、窗口宽度和安装管理员邮箱交互修改；自动化与页面验收通过，状态流转为待验收。 |
+| 2026-08-07 | v1.2.19 检查、六个 Docker 镜像、GitHub Release 和 Telegram 频道通知全部成功，状态流转为已完成。 |
 
 ## NSX-20260807-009
 
@@ -311,7 +312,7 @@
 | --- | --- |
 | 编号 | NSX-20260807-009 |
 | 日期 | 2026-08-07 |
-| 状态 | 待验收 |
+| 状态 | 已完成 |
 | 模块 | 部署运维/安装；文档；质量复核 |
 | 现象 | 空白服务器仍显示更新、回滚、重启等不可用操作；已安装菜单没有运行状态和实际版本；部分直接命令缺少统一安装前置检查；安装残缺时没有明确修复入口。 |
 | 根因 | 主菜单只根据 `.env` 切换默认选项，所有状态共用一套菜单；运行状态、镜像版本和安装完整性没有独立判断；部分前置检查散落在菜单分发层。 |
@@ -319,7 +320,7 @@
 | 兼容性 | 保持既有菜单编号 `1–12` 和 `ns` 快捷命令；现有配置、数据库、邮件、证书和更新流程不变。 |
 | 测试结果 | Bash 语法检查、ShellCheck、安装脚本全量测试、菜单渲染/范围/分发/状态/版本/残缺安装/前置条件测试、前端 check/build、Go 全量测试和 go vet 均通过。 |
 | 目标版本 | v1.2.19 |
-| 发布状态 | 待发布。 |
+| 发布状态 | 随 v1.2.19 发布。 |
 
 ### 历史
 
@@ -327,6 +328,7 @@
 | --- | --- |
 | 2026-08-07 | 用户确认按安装状态拆分主菜单，并要求写入仓库介绍、复核全部命令逻辑。 |
 | 2026-08-07 | 完成动态菜单、命令前置条件、残缺安装修复入口、README 和自动化回归，状态流转为待验收。 |
+| 2026-08-07 | 随 v1.2.19 完成发布，状态流转为已完成。 |
 
 ## NSX-20260807-010
 
@@ -334,16 +336,16 @@
 | --- | --- |
 | 编号 | NSX-20260807-010 |
 | 日期 | 2026-08-07 |
-| 状态 | 待验收 |
+| 状态 | 已完成 |
 | 模块 | 邮件投递；DKIM；部署运维；质量复核 |
 | 现象 | Gmail 显示 SPF 和 DMARC 通过，但 NewSzxcn 发出的邮件 DKIM 验证失败；同内容的 NodeSeek 对照邮件三项认证均通过。 |
 | 诊断 | NewSzxcn 邮件的 relaxed 正文哈希与 Gmail 收到的 `bh` 精确一致，排除正文传输修改；邮件签名无法由当前 DNS 公钥验证，说明发信时使用了不同私钥。`key not secure` 仅表示 DNSSEC 未验证，TXT 分段也属于正常 DNS 表示。 |
 | 根因 | DKIM 同步任务会覆盖容器内密钥文件，但 Rspamd 已载入的签名密钥不会随文件替换自动更新，域名重建或密钥变化后可能继续使用内存中的旧私钥。 |
 | 实现 | DKIM 同步改为先比较密钥内容；相同密钥不再重复替换，密钥新增或变化后立即重新载入 Rspamd；后台 DNS 检查从“仅判断 DKIM 记录存在”升级为核对实际 `p=` 公钥，明确区分缺失与公钥不一致；新增密钥同步和 DNS 公钥匹配回归，并纳入 CI 与发布检查。 |
 | 兼容性 | 不轮换现有 DKIM 密钥、不修改 DNS；已有数据库、邮件和域名配置保持不变。 |
-| 测试结果 | DKIM 同步专项测试、DNS 公钥匹配测试、Go 全量测试与 vet、安装脚本回归均通过；线上仍需升级后重新发信，确认 Gmail 原始邮件显示 `dkim=pass`。 |
+| 测试结果 | DKIM 同步专项测试、DNS 公钥匹配测试、Go 全量测试与 vet、安装脚本回归均通过；线上 DKIM 已验收通过。 |
 | 目标版本 | v1.2.19 |
-| 发布状态 | 待发布。 |
+| 发布状态 | 已随 v1.2.19 发布，线上 DKIM 已验收通过。 |
 
 ### 历史
 
@@ -351,6 +353,8 @@
 | --- | --- |
 | 2026-08-07 | 用户提供 Gmail 原始邮件和 NodeSeek 对照邮件，完成正文哈希、签名公钥和认证结果比对。 |
 | 2026-08-07 | 完成 DKIM 密钥热更新修复和专项回归，等待服务器实发验收。 |
+| 2026-08-07 | 修复已随 v1.2.19 发布；保留待验收状态，需升级后确认 Gmail 原始邮件显示 `dkim=pass`。 |
+| 2026-08-08 | 用户确认 DKIM 已通过，状态流转为已完成。 |
 
 ## NSX-20260807-011
 
@@ -358,14 +362,14 @@
 | --- | --- |
 | 编号 | NSX-20260807-011 |
 | 日期 | 2026-08-07 |
-| 状态 | 待验收 |
+| 状态 | 已完成 |
 | 模块 | 后端/通知；验证码识别；质量复核 |
 | 现象 | 爱奇艺邮件的主题和正文均包含验证码 `825534`，Telegram 通知却没有独立验证码区域和“复制验证码”按钮。 |
 | 根因 | 正文开头的收件地址 `iqiyi02@newszxcn.com` 被拆成 `iqiyi02`、`newszxcn` 两个候选；它们与主题中的“验证码”距离较近，触发多候选歧义保护后返回空结果。 |
 | 实现 | 验证码评分前排除邮箱地址和 HTTP/HTTPS 链接范围内的字母数字片段，保留真实正文与主题候选；新增爱奇艺原始场景回归，同时检查独立验证码区域和复制按钮。 |
 | 测试结果 | 爱奇艺原始场景、Gate 验证码与链接、Telegram 消息预算专项测试及 Go 全量测试均通过。 |
 | 目标版本 | v1.2.19 |
-| 发布状态 | 待发布。 |
+| 发布状态 | 随 v1.2.19 发布。 |
 
 ### 历史
 
@@ -373,6 +377,7 @@
 | --- | --- |
 | 2026-08-07 | 用户提供 Telegram 实际通知截图，完成邮箱地址候选冲突复现。 |
 | 2026-08-07 | 修复邮箱和链接候选排除逻辑，加入爱奇艺验证码专项回归。 |
+| 2026-08-07 | 随 v1.2.19 完成发布，状态流转为已完成。 |
 
 ## NSX-20260807-012
 
@@ -380,13 +385,13 @@
 | --- | --- |
 | 编号 | NSX-20260807-012 |
 | 日期 | 2026-08-07 |
-| 状态 | 待验收 |
+| 状态 | 已完成 |
 | 模块 | 前端/UI；域名管理；质量复核 |
 | 现象 | DNS 记录顶部“复制”会得到 `TXT newszxcn.com v=spf1 mx -all`，不能直接粘贴到域名服务商的主机记录和记录值输入框。 |
 | 实现 | 删除整行复制；每条记录明确展示记录类型、主机记录、记录值和 TTL；主机记录与记录值分别提供图标复制和对应成功提示，TTL 仅展示。 |
 | 测试结果 | 前端 check/build 通过；本地页面确认 SPF 主机记录和记录值分别复制为 `lanqin.local` 与 `v=spf1 mx -all`，DKIM 长记录正常换行且弹窗没有横向溢出。 |
 | 目标版本 | v1.2.19 |
-| 发布状态 | 待发布。 |
+| 发布状态 | 随 v1.2.19 发布。 |
 
 ### 历史
 
@@ -394,6 +399,7 @@
 | --- | --- |
 | 2026-08-07 | 用户提供 DNS 弹窗截图并指出整行复制无法直接用于 DNS 面板。 |
 | 2026-08-07 | 完成主机记录和记录值分离复制。 |
+| 2026-08-07 | 随 v1.2.19 完成发布，状态流转为已完成。 |
 
 ## NSX-20260807-013
 
@@ -401,14 +407,14 @@
 | --- | --- |
 | 编号 | NSX-20260807-013 |
 | 日期 | 2026-08-07 |
-| 状态 | 待验收 |
+| 状态 | 已完成 |
 | 模块 | 邮件核心；前端/标签；数据迁移；质量复核 |
 | 需求 | 邮箱默认增加个人、家人、朋友、工作、重要五个常用标签，并按名称使用容易辨认的颜色。 |
 | 实现 | 新邮箱创建时由后端事务生成五个标签；已有邮箱升级时一次性补齐；固定顺序为个人、家人、朋友、工作、重要，颜色依次为绿色、玫红、青色、蓝色、橙色；用户后续删除标签不会在重启时恢复；“全部邮箱”按名称合并同名标签并汇总数量，点击或导出时覆盖用户名下所有邮箱。 |
 | 兼容性 | 使用 `INSERT OR IGNORE` 保留已有同名标签及其颜色和邮件关联；不修改用户自建标签。 |
 | 测试结果 | 新邮箱创建、旧邮箱补齐、删除后不重建、多邮箱同名汇总与跨邮箱筛选专项测试，以及 Go 全量测试和 vet 均通过；页面确认五个标签各显示一次、顺序正确，颜色与侧栏宽度正确且无越界。 |
 | 目标版本 | v1.2.19 |
-| 发布状态 | 待发布。 |
+| 发布状态 | 随 v1.2.19 发布。 |
 
 ### 历史
 
@@ -416,3 +422,4 @@
 | --- | --- |
 | 2026-08-07 | 用户提供标签侧栏参考并指定五个默认标签。 |
 | 2026-08-07 | 完成新邮箱默认生成、已有邮箱一次性补齐、固定排序和颜色回归；页面复核时发现全部邮箱重复显示，继续完成同名汇总、跨邮箱筛选与导出回归。 |
+| 2026-08-07 | 随 v1.2.19 完成发布，状态流转为已完成。 |

pnpm-lock.yaml

@@ -81,8 +81,8 @@ importers:
         specifier: 2.1.1
         version: 2.1.1
       dompurify:
-        specifier: 3.4.12
-        version: 3.4.12
+        specifier: 3.4.13
+        version: 3.4.13
       lucide-react:
         specifier: ^0.468.0
         version: 0.468.0(react@18.3.1)
@@ -1022,8 +1022,8 @@ packages:
   dlv@1.1.3:
     resolution: {integrity: sha512-+HlytyjlPKnIG8XuRG8WvmBP8xs8P71y+SKKS6ZXWoEgLuePxtDoUEiH7WkdePWrQ5JBpE6aoVqfZfJUQkjXwA==}
 
-  dompurify@3.4.12:
-    resolution: {integrity: sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==}
+  dompurify@3.4.13:
+    resolution: {integrity: sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ==}
 
   electron-to-chromium@1.5.375:
     resolution: {integrity: sha512-ZWP5eB4BVPW/ZYo9252hQZHZ5XavtsTgpbhcmMmRwymavC5AsLWQWBPaKMeNd2LW0KGby5HPXvj7+sr4ta5j/Q==}
@@ -2447,7 +2447,7 @@ snapshots:
 
   dlv@1.1.3: {}
 
-  dompurify@3.4.12:
+  dompurify@3.4.13:
     optionalDependencies:
       '@types/trusted-types': 2.0.7