fix: refine mail export and mailbox deletion

.github/release-notes/v1.2.10.md

@@ -0,0 +1,13 @@
+## 本次更新
+
+### 优化邮箱选择器动态宽度
+
+- 选择“全部邮箱”、正在加载或尚未注册邮箱时，邮箱选择框占满侧栏整行，不再为隐藏按钮预留空白。
+- 选择具体邮箱后，选择框自动向左收窄，并在右侧显示复制邮箱地址按钮。
+- 邮箱下拉菜单始终与当前选择框等宽，避免展开前后宽度不一致。
+
+### 验证
+
+- 已通过前端 TypeScript 检查、生产构建和 shadcn/ui 检查。
+
+**完整更新日志**：[v1.2.9...v1.2.10](https://github.com/zxyszx/NewSzxcn-Email/compare/v1.2.9...v1.2.10)

.github/release-notes/v1.2.11.md

@@ -0,0 +1,13 @@
+## 本次更新
+
+### 移除“加载邮箱”过渡文案
+
+- 刷新邮箱页面时，邮箱选择器从第一帧开始显示“全部邮箱”。
+- 邮箱列表在后台加载，不再显示不存在的“加载邮箱...”状态。
+- 接口确认当前账号没有邮箱后，选择器才显示“未注册邮箱”。
+
+### 验证
+
+- 已通过前端 TypeScript 检查、生产构建和 shadcn/ui 检查。
+
+**完整更新日志**：[v1.2.10...v1.2.11](https://github.com/zxyszx/NewSzxcn-Email/compare/v1.2.10...v1.2.11)

.github/release-notes/v1.2.12.md

@@ -0,0 +1,33 @@
+## 本次更新
+
+### 修复文件夹管理
+
+- “全部邮箱”模式现在可以新建文件夹，并在账号下每个邮箱中创建同名文件夹。
+- “全部邮箱”模式可以删除自定义文件夹，原有邮件会分别移回各自邮箱的收件箱，不会删除邮件。
+- 文件夹排序仍限定在单个邮箱中，避免不同邮箱之间出现错误顺序。
+
+### 修复导入邮件的存储显示
+
+- 账号设置中的存储容量改为统计“全部邮箱”，不再因为默认选中空邮箱而显示 `0 B`。
+- 数据统计默认显示“全部邮箱”，并新增邮箱选择器，可查看单个邮箱的数据。
+- 已导入邮件及附件继续保留原始数据，现有邮件无需重新导入。
+
+### 改进邮件下载
+
+- 下载邮件改为浏览器直接流式下载，不再等整个压缩包载入页面内存后才开始保存。
+- 点击后立即显示下载提示，大邮箱可直接查看浏览器下载进度。
+- 下载格式为 ZIP，压缩包内每封邮件均为标准 EML 文件，保留邮件原始内容和历史时间。
+
+### 优化设置与后台切换
+
+- 邮箱页面空闲时预加载设置和后台页面，减少首次点击齿轮时的等待。
+- 设置页只加载当前栏目需要的数据，降低无关接口并发请求。
+- 管理员可从邮箱页面和设置侧栏直接进入后台管理，普通用户不会显示该入口。
+
+### 验证
+
+- 已通过完整 Go 测试、前端 TypeScript 检查、生产构建和 shadcn/ui 检查。
+- 已通过安装脚本语法和自动化回归测试。
+- 已在桌面端和移动端实测统计页、文件夹创建/删除、ZIP 下载和管理员后台跳转。
+
+**完整更新日志**：[v1.2.11...v1.2.12](https://github.com/zxyszx/NewSzxcn-Email/compare/v1.2.11...v1.2.12)

.github/release-notes/v1.2.13.md

@@ -0,0 +1,30 @@
+## 本次更新
+
+### 修复选中邮件下载
+
+- 勾选邮件后点击下载，只导出当前选中的邮件；未勾选时仍导出当前邮箱视图。
+- 下载接口继续校验邮箱归属和当前视图，不能通过邮件 ID 下载其他账号的邮件。
+
+### 改进 EML 文件信息
+
+- 压缩包内文件名改为“邮件标题 (接收日期).eml”，保留中文标题，不再出现乱码式名称。
+- EML 文件修改时间使用邮件接收时间，与邮件详情中的“接收时间”保持一致。
+- 邮件原始正文、附件和邮件头保持不变；同名文件会自动添加序号。
+
+### 调整邮箱与设置交互
+
+- 移除邮箱页面头部的后台管理图标，后台管理入口仅保留在设置页面。
+- 设置页面提前加载并在加载完成后切换，避免首次点击齿轮时出现整页加载闪烁。
+- 邮箱页面不再预加载后台管理代码，减少无用网络请求和解析开销。
+
+### 修复最后一个邮箱删除
+
+- 管理员现在可以删除账号的最后一个邮箱，账号本身和登录状态不会被删除。
+- 删除邮箱流程的错误提示改为简体中文。
+
+### 验证
+
+- 已通过完整 Go 测试、Go 静态检查、前端 TypeScript 检查、生产构建和 shadcn/ui 检查。
+- 已实测管理员删除最后一个邮箱、设置页面切换和后台入口显示。
+
+**完整更新日志**：[v1.2.12...v1.2.13](https://github.com/zxyszx/NewSzxcn-Email/compare/v1.2.12...v1.2.13)

.github/workflows/docker.yml

@@ -205,11 +205,8 @@ jobs:
         shell: bash
         run: |
           tag="${{ needs.release.outputs.tag }}"
-          version="${{ needs.release.outputs.version }}"
           repo="${GITHUB_REPOSITORY}"
           repo_url="https://github.com/${repo}"
-          image_base="${REGISTRY}/${repo}"
-          image_base="${image_base,,}"
           current_commit="$(git rev-list -n 1 "${tag}")"
           previous_tag="$(git describe --tags --abbrev=0 "${current_commit}^" 2>/dev/null || true)"
           version_notes=".github/release-notes/${tag}.md"
@@ -240,36 +237,7 @@ jobs:
             fi
           fi
 
-          cat > release-notes.md <<EOF
-          自建邮箱 Webmail 全栈方案，包含 Web、API、Postfix、Dovecot、Rspamd 等组件。
-
-          ## 注意
-
-          如果需要公网正常收发邮件，请确保已正确配置 MX、SPF、DKIM、DMARC 以及 25 / 587 / 993 等端口。
-
-          ## 使用文档
-
-          - [项目文档](${repo_url}#readme)
-          - [开源协议](${repo_url}/blob/main/LICENSE)
-
-          ## Docker 镜像
-
-          | 组件 | 镜像 |
-          |------|------|
-          | All-in-one | \`${image_base}:${tag}\` |
-          | API | \`${image_base}-api:${tag}\` |
-          | Web | \`${image_base}-web:${tag}\` |
-          | Postfix | \`${image_base}-postfix:${tag}\` |
-          | Dovecot | \`${image_base}-dovecot:${tag}\` |
-          | Rspamd | \`${image_base}-rspamd:${tag}\` |
-
-          同时也会发布 \`${version}\`、\`latest\` 和 \`sha-*\` 标签。
-          EOF
-
-          {
-            echo
-            cat generated-release-notes.md
-          } >> release-notes.md
+          cp generated-release-notes.md release-notes.md
 
       - name: Create or update GitHub release
         env:

VERSION

@@ -1 +1 @@
-1.2.9
+1.2.13

apps/api/internal/app/admin_handlers.go

@@ -730,26 +730,9 @@ func (a *App) handleUpdateMailbox(w http.ResponseWriter, r *http.Request) {
 
 func (a *App) handleDeleteMailbox(w http.ResponseWriter, r *http.Request) {
 	id := chi.URLParam(r, "id")
-	current := currentUser(r)
-	var owner string
-	if err := a.db.QueryRowContext(r.Context(), `SELECT user_id FROM mailboxes WHERE id=?`, id).Scan(&owner); err != nil {
-		respondError(w, http.StatusNotFound, "mailbox not found")
-		return
-	}
-	var count int
-	if current != nil && owner == current.ID {
-		if err := a.db.QueryRowContext(r.Context(), `SELECT COUNT(*) FROM mailboxes WHERE user_id=?`, owner).Scan(&count); err != nil {
-			respondError(w, http.StatusInternalServerError, "failed to check mailbox")
-			return
-		}
-		if count <= 1 {
-			badRequest(w, errors.New("cannot delete your last mailbox"))
-			return
-		}
-	}
 	rows, err := a.db.QueryContext(r.Context(), `SELECT id FROM messages WHERE mailbox_id=?`, id)
 	if err != nil {
-		respondError(w, http.StatusInternalServerError, "failed to load mailbox messages")
+		respondError(w, http.StatusInternalServerError, "加载邮箱邮件失败")
 		return
 	}
 	messageIDs := []string{}
@@ -765,12 +748,12 @@ func (a *App) handleDeleteMailbox(w http.ResponseWriter, r *http.Request) {
 	}
 	res, err := a.db.ExecContext(r.Context(), `DELETE FROM mailboxes WHERE id=?`, id)
 	if err != nil {
-		respondError(w, http.StatusInternalServerError, "failed to delete mailbox")
+		respondError(w, http.StatusInternalServerError, "删除邮箱失败")
 		return
 	}
 	affected, _ := res.RowsAffected()
 	if affected == 0 {
-		respondError(w, http.StatusNotFound, "mailbox not found")
+		respondError(w, http.StatusNotFound, "邮箱不存在或已被删除")
 		return
 	}
 	respondJSON(w, http.StatusOK, map[string]any{"ok": true})

apps/api/internal/app/app_test.go

@@ -1648,6 +1648,45 @@ func TestUserCanSelectMultipleMailboxes(t *testing.T) {
 		t.Fatalf("folders for selected mailbox code=%d", code)
 	}
 
+	var sharedFolder MailFolder
+	if code := userClient.do("POST", "/api/mail/folders?mailboxId=all", map[string]string{"name": "Shared Project"}, &sharedFolder); code != http.StatusCreated {
+		t.Fatalf("create shared folder code=%d folder=%+v", code, sharedFolder)
+	}
+	var primarySharedID, secondarySharedID string
+	if err := a.db.QueryRowContext(ctx, `SELECT id FROM folders WHERE mailbox_id=? AND name=?`, primary.ID, "Shared Project").Scan(&primarySharedID); err != nil {
+		t.Fatalf("primary shared folder: %v", err)
+	}
+	if err := a.db.QueryRowContext(ctx, `SELECT id FROM folders WHERE mailbox_id=? AND name=?`, secondary.ID, "Shared Project").Scan(&secondarySharedID); err != nil {
+		t.Fatalf("secondary shared folder: %v", err)
+	}
+	if _, err := a.db.ExecContext(ctx, `UPDATE messages SET folder_id=? WHERE id=?`, primarySharedID, "msg_multi_primary_read"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := a.db.ExecContext(ctx, `UPDATE messages SET folder_id=? WHERE id=?`, secondarySharedID, "msg_multi_secondary_unread"); err != nil {
+		t.Fatal(err)
+	}
+	var deleted struct {
+		Moved int `json:"moved"`
+	}
+	deletePath := "/api/mail/folders/" + url.PathEscape(sharedFolder.ID) + "?mailboxId=all&folderName=" + url.QueryEscape(sharedFolder.Name)
+	if code := userClient.do("DELETE", deletePath, nil, &deleted); code != http.StatusOK || deleted.Moved != 2 {
+		t.Fatalf("delete shared folders code=%d moved=%d", code, deleted.Moved)
+	}
+	var sharedCount int
+	if err := a.db.QueryRowContext(ctx, `SELECT COUNT(*) FROM folders WHERE mailbox_id IN (?,?) AND name=?`, primary.ID, secondary.ID, "Shared Project").Scan(&sharedCount); err != nil || sharedCount != 0 {
+		t.Fatalf("shared folders remaining=%d err=%v", sharedCount, err)
+	}
+	var restoredPrimaryFolder, restoredSecondaryFolder string
+	if err := a.db.QueryRowContext(ctx, `SELECT folder_id FROM messages WHERE id=?`, "msg_multi_primary_read").Scan(&restoredPrimaryFolder); err != nil {
+		t.Fatal(err)
+	}
+	if err := a.db.QueryRowContext(ctx, `SELECT folder_id FROM messages WHERE id=?`, "msg_multi_secondary_unread").Scan(&restoredSecondaryFolder); err != nil {
+		t.Fatal(err)
+	}
+	if restoredPrimaryFolder != primaryInboxID || restoredSecondaryFolder != secondaryInboxID {
+		t.Fatalf("restored folders primary=%s secondary=%s", restoredPrimaryFolder, restoredSecondaryFolder)
+	}
+
 	var sent MailMessage
 	payload := map[string]any{
 		"mailboxId": secondary.ID,

apps/api/internal/app/mail_handlers.go

@@ -264,11 +264,6 @@ func (a *App) handleReorderMailFolders(w http.ResponseWriter, r *http.Request) {
 }
 
 func (a *App) handleCreateMailFolder(w http.ResponseWriter, r *http.Request) {
-	mb, err := a.mailboxForCurrentUser(r)
-	if err != nil {
-		respondError(w, http.StatusNotFound, "mailbox not found")
-		return
-	}
 	var req struct {
 		Name string `json:"name"`
 	}
@@ -285,6 +280,47 @@ func (a *App) handleCreateMailFolder(w http.ResponseWriter, r *http.Request) {
 		badRequest(w, errors.New("system folder already exists"))
 		return
 	}
+	if isAllMailboxID(r.URL.Query().Get("mailboxId")) {
+		user := currentUser(r)
+		rows, err := a.db.QueryContext(r.Context(), `SELECT id FROM mailboxes WHERE user_id=? AND status='active' ORDER BY created_at,id`, user.ID)
+		if err != nil {
+			respondError(w, http.StatusInternalServerError, "failed to load mailboxes")
+			return
+		}
+		mailboxIDs := []string{}
+		for rows.Next() {
+			var mailboxID string
+			if err := rows.Scan(&mailboxID); err != nil {
+				rows.Close()
+				respondError(w, http.StatusInternalServerError, "failed to scan mailboxes")
+				return
+			}
+			mailboxIDs = append(mailboxIDs, mailboxID)
+		}
+		if err := rows.Err(); err != nil {
+			rows.Close()
+			respondError(w, http.StatusInternalServerError, "failed to scan mailboxes")
+			return
+		}
+		rows.Close()
+		if len(mailboxIDs) == 0 {
+			respondError(w, http.StatusNotFound, "mailbox not found")
+			return
+		}
+		for _, mailboxID := range mailboxIDs {
+			if _, err := a.ensureCustomFolder(r.Context(), mailboxID, name); err != nil {
+				respondError(w, http.StatusInternalServerError, "failed to create folder")
+				return
+			}
+		}
+		respondJSON(w, http.StatusCreated, MailFolder{ID: "all-" + strings.ToLower(name), Name: name, Role: strings.ToLower(name), SortOrder: customFolderDefaultSortOrderBase})
+		return
+	}
+	mb, err := a.mailboxForCurrentUser(r)
+	if err != nil {
+		respondError(w, http.StatusNotFound, "mailbox not found")
+		return
+	}
 	folderID, err := a.ensureCustomFolder(r.Context(), mb.ID, name)
 	if err != nil {
 		respondError(w, http.StatusInternalServerError, "failed to create folder")
@@ -299,16 +335,20 @@ func (a *App) handleCreateMailFolder(w http.ResponseWriter, r *http.Request) {
 }
 
 func (a *App) handleDeleteMailFolder(w http.ResponseWriter, r *http.Request) {
-	mb, err := a.mailboxForCurrentUser(r)
-	if err != nil {
-		respondError(w, http.StatusNotFound, "mailbox not found")
-		return
-	}
 	folderID := strings.TrimSpace(chi.URLParam(r, "id"))
 	if folderID == "" {
 		badRequest(w, errors.New("folder id is required"))
 		return
 	}
+	if isAllMailboxID(r.URL.Query().Get("mailboxId")) {
+		a.handleDeleteAllMailFolders(w, r, folderID)
+		return
+	}
+	mb, err := a.mailboxForCurrentUser(r)
+	if err != nil {
+		respondError(w, http.StatusNotFound, "mailbox not found")
+		return
+	}
 	var folderName string
 	if err := a.db.QueryRowContext(r.Context(), `SELECT name FROM folders WHERE id=? AND mailbox_id=?`, folderID, mb.ID).Scan(&folderName); err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
@@ -378,6 +418,115 @@ func (a *App) handleDeleteMailFolder(w http.ResponseWriter, r *http.Request) {
 	respondJSON(w, http.StatusOK, map[string]any{"ok": true, "moved": len(messageIDs)})
 }
 
+func (a *App) handleDeleteAllMailFolders(w http.ResponseWriter, r *http.Request, folderID string) {
+	folderName := strings.TrimSpace(r.URL.Query().Get("folderName"))
+	if folderName == "" && strings.HasPrefix(strings.ToLower(folderID), "all-") {
+		folderName = strings.TrimSpace(folderID[4:])
+	}
+	name, err := normalizeCustomFolderName(folderName)
+	if err != nil {
+		badRequest(w, err)
+		return
+	}
+	if isSystemFolderName(name) {
+		badRequest(w, errors.New("system folders cannot be deleted"))
+		return
+	}
+	user := currentUser(r)
+	type folderTarget struct {
+		folderID  string
+		mailboxID string
+		inboxID   string
+	}
+	rows, err := a.db.QueryContext(r.Context(), `SELECT f.id,f.mailbox_id FROM folders f JOIN mailboxes mb ON mb.id=f.mailbox_id WHERE mb.user_id=? AND mb.status='active' AND lower(f.name)=lower(?)`, user.ID, name)
+	if err != nil {
+		respondError(w, http.StatusInternalServerError, "failed to load folders")
+		return
+	}
+	targets := []folderTarget{}
+	for rows.Next() {
+		var target folderTarget
+		if err := rows.Scan(&target.folderID, &target.mailboxID); err != nil {
+			rows.Close()
+			respondError(w, http.StatusInternalServerError, "failed to scan folders")
+			return
+		}
+		targets = append(targets, target)
+	}
+	if err := rows.Err(); err != nil {
+		rows.Close()
+		respondError(w, http.StatusInternalServerError, "failed to scan folders")
+		return
+	}
+	rows.Close()
+	if len(targets) == 0 {
+		respondError(w, http.StatusNotFound, "folder not found")
+		return
+	}
+	for i := range targets {
+		targets[i].inboxID, err = a.ensureFolder(r.Context(), targets[i].mailboxID, "Inbox")
+		if err != nil {
+			respondError(w, http.StatusInternalServerError, "failed to load inbox")
+			return
+		}
+	}
+	tx, err := a.db.BeginTx(r.Context(), nil)
+	if err != nil {
+		respondError(w, http.StatusInternalServerError, "failed to delete folder")
+		return
+	}
+	defer tx.Rollback()
+	now := a.now().UTC().Format(time.RFC3339Nano)
+	moved := 0
+	for _, target := range targets {
+		messageRows, err := tx.QueryContext(r.Context(), `SELECT id FROM messages WHERE mailbox_id=? AND folder_id=? ORDER BY received_at,id`, target.mailboxID, target.folderID)
+		if err != nil {
+			respondError(w, http.StatusInternalServerError, "failed to load folder messages")
+			return
+		}
+		messageIDs := []string{}
+		for messageRows.Next() {
+			var messageID string
+			if err := messageRows.Scan(&messageID); err != nil {
+				messageRows.Close()
+				respondError(w, http.StatusInternalServerError, "failed to scan folder messages")
+				return
+			}
+			messageIDs = append(messageIDs, messageID)
+		}
+		if err := messageRows.Err(); err != nil {
+			messageRows.Close()
+			respondError(w, http.StatusInternalServerError, "failed to scan folder messages")
+			return
+		}
+		messageRows.Close()
+		for _, messageID := range messageIDs {
+			meta, err := a.nextIMAPMetadata(r.Context(), tx, target.inboxID)
+			if err != nil {
+				respondError(w, http.StatusInternalServerError, "failed to allocate message uid")
+				return
+			}
+			if _, err := tx.ExecContext(r.Context(), `UPDATE messages SET folder_id=?,imap_uid=?,imap_modseq=?,updated_at=? WHERE id=?`, target.inboxID, meta.UID, meta.ModSeq, now, messageID); err != nil {
+				respondError(w, http.StatusInternalServerError, "failed to move folder messages")
+				return
+			}
+			moved++
+		}
+		if _, err := tx.ExecContext(r.Context(), `DELETE FROM folders WHERE id=? AND mailbox_id=?`, target.folderID, target.mailboxID); err != nil {
+			respondError(w, http.StatusInternalServerError, "failed to delete folder")
+			return
+		}
+	}
+	if err := tx.Commit(); err != nil {
+		respondError(w, http.StatusInternalServerError, "failed to delete folder")
+		return
+	}
+	for _, target := range targets {
+		_, _ = a.bumpFolderModSeq(r.Context(), target.inboxID)
+	}
+	respondJSON(w, http.StatusOK, map[string]any{"ok": true, "moved": moved})
+}
+
 func (a *App) ensureCustomFolder(ctx context.Context, mailboxID, name string) (string, error) {
 	return a.ensureFolder(ctx, mailboxID, name)
 }

apps/api/internal/app/mail_transfer_handlers.go

@@ -13,13 +13,20 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
-	"regexp"
 	"strings"
+	"time"
+	"unicode"
 )
 
 const maxMailImportBytes int64 = 256 << 20
 
-var exportFilenameUnsafe = regexp.MustCompile(`[^a-zA-Z0-9._-]+`)
+const maxSelectedMailExport = 200
+
+type exportedMessage struct {
+	raw     []byte
+	subject string
+	date    time.Time
+}
 
 func (a *App) handleExportMail(w http.ResponseWriter, r *http.Request) {
 	ids, err := a.exportMessageIDs(r)
@@ -43,19 +50,21 @@ func (a *App) handleExportMail(w http.ResponseWriter, r *http.Request) {
 
 	zw := zip.NewWriter(w)
 	usedNames := make(map[string]int, len(ids))
-	for index, id := range ids {
-		raw, subject, err := a.rawMessageForExport(r.Context(), id)
+	for _, id := range ids {
+		message, err := a.rawMessageForExport(r.Context(), id)
 		if err != nil {
 			_ = zw.Close()
 			return
 		}
-		entryName := uniqueExportFilename(exportMessageFilename(subject, id, index), usedNames)
-		entry, err := zw.CreateHeader(&zip.FileHeader{Name: entryName, Method: zip.Deflate})
+		entryName := uniqueExportFilename(exportMessageFilename(message.subject, message.date), usedNames)
+		header := &zip.FileHeader{Name: entryName, Method: zip.Deflate}
+		header.SetModTime(message.date)
+		entry, err := zw.CreateHeader(header)
 		if err != nil {
 			_ = zw.Close()
 			return
 		}
-		if _, err := entry.Write(raw); err != nil {
+		if _, err := entry.Write(message.raw); err != nil {
 			_ = zw.Close()
 			return
 		}
@@ -74,6 +83,10 @@ func (a *App) exportMessageIDs(r *http.Request) ([]string, error) {
 	mailboxID := strings.TrimSpace(r.URL.Query().Get("mailboxId"))
 	where := []string{}
 	args := []any{}
+	selectedIDs, err := selectedExportMessageIDs(r)
+	if err != nil {
+		return nil, err
+	}
 
 	if view == "unknown" {
 		if user.Role != "admin" {
@@ -115,6 +128,14 @@ func (a *App) exportMessageIDs(r *http.Request) ([]string, error) {
 			return nil, errors.New("unsupported mail view")
 		}
 	}
+	if len(selectedIDs) > 0 {
+		placeholders := make([]string, 0, len(selectedIDs))
+		for _, id := range selectedIDs {
+			placeholders = append(placeholders, "?")
+			args = append(args, id)
+		}
+		where = append(where, "m.id IN ("+strings.Join(placeholders, ",")+")")
+	}
 
 	rows, err := a.db.QueryContext(r.Context(), `SELECT m.id FROM messages m LEFT JOIN folders f ON f.id=m.folder_id WHERE `+strings.Join(where, " AND ")+` ORDER BY m.received_at DESC,m.id`, args...)
 	if err != nil {
@@ -132,40 +153,77 @@ func (a *App) exportMessageIDs(r *http.Request) ([]string, error) {
 	return ids, rows.Err()
 }
 
-func (a *App) rawMessageForExport(ctx context.Context, id string) ([]byte, string, error) {
+func selectedExportMessageIDs(r *http.Request) ([]string, error) {
+	values := r.URL.Query()["messageId"]
+	if len(values) == 0 {
+		return nil, nil
+	}
+	seen := make(map[string]struct{}, len(values))
+	ids := make([]string, 0, len(values))
+	for _, value := range values {
+		id := strings.TrimSpace(value)
+		if id == "" {
+			continue
+		}
+		if _, exists := seen[id]; exists {
+			continue
+		}
+		seen[id] = struct{}{}
+		ids = append(ids, id)
+		if len(ids) > maxSelectedMailExport {
+			return nil, fmt.Errorf("最多一次下载 %d 封邮件", maxSelectedMailExport)
+		}
+	}
+	return ids, nil
+}
+
+func (a *App) rawMessageForExport(ctx context.Context, id string) (exportedMessage, error) {
 	msg, err := a.storedMessageByID(ctx, id)
 	if err != nil {
-		return nil, "", err
+		return exportedMessage{}, err
+	}
+	exportDate := msg.ReceivedAt
+	if exportDate.IsZero() {
+		exportDate = messageDate(msg)
 	}
 	if msg.RawPath != "" {
 		if ok, pathErr := a.pathIsUnderMaildirRoot(msg.RawPath); pathErr == nil && ok {
 			if raw, readErr := os.ReadFile(msg.RawPath); readErr == nil {
-				return raw, msg.Subject, nil
+				return exportedMessage{raw: raw, subject: msg.Subject, date: exportDate}, nil
 			}
 		}
 	}
 	attachments, err := a.attachmentInputsForMessage(ctx, id)
 	if err != nil {
-		return nil, "", err
+		return exportedMessage{}, err
 	}
 	raw, err := BuildMIME(MIMEMessage{
 		From: msg.From, FromName: msg.FromName, To: msg.To, CC: msg.CC, BCC: msg.BCC,
 		Subject: msg.Subject, Text: msg.BodyText, HTML: msg.BodyHTML, MessageID: msg.MessageID,
 		Date: messageDate(msg), Attachments: attachments,
 	})
-	return raw, msg.Subject, err
+	return exportedMessage{raw: raw, subject: msg.Subject, date: exportDate}, err
 }
 
-func exportMessageFilename(subject, id string, index int) string {
-	name := exportFilenameUnsafe.ReplaceAllString(strings.TrimSpace(subject), "-")
-	name = strings.Trim(name, ".-_")
+func exportMessageFilename(subject string, date time.Time) string {
+	name := strings.Map(func(r rune) rune {
+		if unicode.IsControl(r) || strings.ContainsRune(`<>:"/\\|?*`, r) {
+			return '-'
+		}
+		return r
+	}, strings.TrimSpace(subject))
+	name = strings.Trim(name, " .-_")
 	if name == "" {
-		name = "message"
+		name = "无主题"
 	}
-	if len(name) > 80 {
-		name = name[:80]
+	runes := []rune(name)
+	if len(runes) > 80 {
+		name = string(runes[:80])
 	}
-	return fmt.Sprintf("%04d-%s-%s.eml", index+1, name, id)
+	if date.IsZero() {
+		return name + ".eml"
+	}
+	return fmt.Sprintf("%s (%s).eml", name, date.Format("20060102"))
 }
 
 func uniqueExportFilename(name string, used map[string]int) string {

apps/api/internal/app/mail_transfer_handlers_test.go

@@ -5,11 +5,15 @@ import (
 	"bytes"
 	"encoding/json"
 	"io"
+	"mime"
 	"mime/multipart"
 	"net/http"
 	"net/http/httptest"
+	stdmail "net/mail"
+	"net/url"
 	"strings"
 	"testing"
+	"time"
 )
 
 func TestParseMBOXMultipleMessages(t *testing.T) {
@@ -65,7 +69,7 @@ func TestMailImportExportAndOwnership(t *testing.T) {
 		t.Fatalf("owner login=%d", code)
 	}
 
-	eml := []byte("From: sender@example.com\r\nTo: " + ownerMailbox.Address + "\r\nSubject: imported message\r\nDate: Tue, 2 Jan 2024 12:00:00 +0000\r\nMessage-ID: <imported@example.com>\r\nContent-Type: text/plain; charset=utf-8\r\n\r\nhello import")
+	eml := []byte("From: sender@example.com\r\nTo: " + ownerMailbox.Address + "\r\nSubject: 中文标题\r\nDate: Tue, 2 Jan 2024 12:00:00 +0000\r\nMessage-ID: <imported@example.com>\r\nContent-Type: text/plain; charset=utf-8\r\n\r\nhello import")
 	olderEML := []byte("From: sender@example.com\r\nTo: " + ownerMailbox.Address + "\r\nSubject: older imported message\r\nDate: Mon, 1 Jan 2024 12:00:00 +0000\r\nMessage-ID: <older-imported@example.com>\r\nContent-Type: text/plain; charset=utf-8\r\n\r\nolder import")
 	var imported struct {
 		Imported int      `json:"imported"`
@@ -79,9 +83,13 @@ func TestMailImportExportAndOwnership(t *testing.T) {
 	var list struct {
 		Items []MailMessage `json:"items"`
 	}
-	if code := owner.do("GET", "/api/mail/messages?folder=Inbox&mailboxId="+ownerMailbox.ID, nil, &list); code != http.StatusOK || len(list.Items) != 2 || list.Items[0].Subject != "imported message" || list.Items[1].Subject != "older imported message" {
+	if code := owner.do("GET", "/api/mail/messages?folder=Inbox&mailboxId="+ownerMailbox.ID, nil, &list); code != http.StatusOK || len(list.Items) != 2 || list.Items[0].Subject != "中文标题" || list.Items[1].Subject != "older imported message" {
 		t.Fatalf("list code=%d items=%+v", code, list.Items)
 	}
+	receivedAt := time.Date(2024, time.January, 3, 8, 30, 0, 0, time.UTC)
+	if _, err := a.db.Exec(`UPDATE messages SET received_at=? WHERE id=?`, receivedAt.Format(time.RFC3339Nano), list.Items[0].ID); err != nil {
+		t.Fatal(err)
+	}
 
 	status, archive := getMailExport(t, owner, "/api/mail/export?view=folder&folder=Inbox&mailboxId="+ownerMailbox.ID)
 	if status != http.StatusOK {
@@ -94,15 +102,47 @@ func TestMailImportExportAndOwnership(t *testing.T) {
 	if len(zr.File) != 2 {
 		t.Fatalf("zip entries=%d", len(zr.File))
 	}
+	if zr.File[0].Name != "中文标题 (20240103).eml" {
+		t.Fatalf("first filename=%q", zr.File[0].Name)
+	}
+	wantModified := receivedAt
+	if !zr.File[0].Modified.Equal(wantModified) {
+		t.Fatalf("first modified=%s want=%s", zr.File[0].Modified, wantModified)
+	}
 	entry, err := zr.File[0].Open()
 	if err != nil {
 		t.Fatal(err)
 	}
 	exported, err := io.ReadAll(entry)
 	entry.Close()
-	if err != nil || !bytes.Contains(exported, []byte("Subject: imported message")) {
+	if err != nil {
 		t.Fatalf("exported message err=%v raw=%q", err, exported)
 	}
+	parsed, err := stdmail.ReadMessage(bytes.NewReader(exported))
+	if err != nil {
+		t.Fatal(err)
+	}
+	decodedSubject, err := new(mime.WordDecoder).DecodeHeader(parsed.Header.Get("Subject"))
+	if err != nil || decodedSubject != "中文标题" {
+		t.Fatalf("decoded subject=%q err=%v", decodedSubject, err)
+	}
+	messageDate, err := parsed.Header.Date()
+	if err != nil || !messageDate.Equal(time.Date(2024, time.January, 2, 12, 0, 0, 0, time.UTC)) {
+		t.Fatalf("message date=%s err=%v", messageDate, err)
+	}
+
+	selectedPath := "/api/mail/export?view=folder&folder=Inbox&mailboxId=" + ownerMailbox.ID + "&messageId=" + url.QueryEscape(list.Items[1].ID)
+	status, selectedArchive := getMailExport(t, owner, selectedPath)
+	if status != http.StatusOK {
+		t.Fatalf("selected export status=%d body=%q", status, selectedArchive)
+	}
+	selectedZip, err := zip.NewReader(bytes.NewReader(selectedArchive), int64(len(selectedArchive)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(selectedZip.File) != 1 || selectedZip.File[0].Name != "older imported message (20240101).eml" {
+		t.Fatalf("selected entries=%v", exportEntryNames(selectedZip.File))
+	}
 
 	var denied map[string]any
 	if code := doMailImport(t, owner, otherMailbox.ID, "Inbox", map[string][]byte{"message.eml": eml}, &denied); code != http.StatusNotFound {
@@ -114,6 +154,64 @@ func TestMailImportExportAndOwnership(t *testing.T) {
 	}
 }
 
+func TestSelectedMailExportStillEnforcesOwnership(t *testing.T) {
+	a := newTestApp(t)
+	ts := httptest.NewServer(a.Router())
+	defer ts.Close()
+	admin := &testClient{t: t, server: ts}
+	var login map[string]any
+	if code := admin.do("POST", "/api/auth/login", map[string]string{"email": "admin@lanqin.local", "password": "ChangeMe123!"}, &login); code != http.StatusOK {
+		t.Fatalf("admin login=%d", code)
+	}
+	var domains struct {
+		Items []Domain `json:"items"`
+	}
+	if code := admin.do("GET", "/api/admin/domains", nil, &domains); code != http.StatusOK || len(domains.Items) == 0 {
+		t.Fatalf("domains code=%d items=%d", code, len(domains.Items))
+	}
+	ownerMailbox := createTestMailbox(t, admin, domains.Items[0].ID, "export-owner", "Export Owner", "Password123!", nil)
+	otherMailbox := createTestMailbox(t, admin, domains.Items[0].ID, "export-other", "Export Other", "Password123!", nil)
+	owner := &testClient{t: t, server: ts}
+	other := &testClient{t: t, server: ts}
+	if code := owner.do("POST", "/api/auth/login", map[string]string{"email": ownerMailbox.Address, "password": "Password123!"}, &login); code != http.StatusOK {
+		t.Fatalf("owner login=%d", code)
+	}
+	if code := other.do("POST", "/api/auth/login", map[string]string{"email": otherMailbox.Address, "password": "Password123!"}, &login); code != http.StatusOK {
+		t.Fatalf("other login=%d", code)
+	}
+	otherEML := []byte("From: sender@example.com\r\nTo: " + otherMailbox.Address + "\r\nSubject: private message\r\nDate: Tue, 2 Jan 2024 12:00:00 +0000\r\nMessage-ID: <private@example.com>\r\n\r\nprivate")
+	var imported map[string]any
+	if code := doMailImport(t, other, otherMailbox.ID, "Inbox", map[string][]byte{"private.eml": otherEML}, &imported); code != http.StatusOK {
+		t.Fatalf("other import=%d response=%v", code, imported)
+	}
+	var otherList struct {
+		Items []MailMessage `json:"items"`
+	}
+	if code := other.do("GET", "/api/mail/messages?folder=Inbox&mailboxId="+otherMailbox.ID, nil, &otherList); code != http.StatusOK || len(otherList.Items) != 1 {
+		t.Fatalf("other list code=%d items=%d", code, len(otherList.Items))
+	}
+	path := "/api/mail/export?view=folder&folder=Inbox&mailboxId=" + ownerMailbox.ID + "&messageId=" + url.QueryEscape(otherList.Items[0].ID)
+	status, archive := getMailExport(t, owner, path)
+	if status != http.StatusOK {
+		t.Fatalf("cross-owner export status=%d body=%q", status, archive)
+	}
+	zr, err := zip.NewReader(bytes.NewReader(archive), int64(len(archive)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(zr.File) != 0 {
+		t.Fatalf("cross-owner export leaked entries=%v", exportEntryNames(zr.File))
+	}
+}
+
+func exportEntryNames(files []*zip.File) []string {
+	names := make([]string, 0, len(files))
+	for _, file := range files {
+		names = append(names, file.Name)
+	}
+	return names
+}
+
 func doMailImport(t *testing.T, client *testClient, mailboxID, folder string, files map[string][]byte, out any) int {
 	t.Helper()
 	var body bytes.Buffer

apps/api/internal/app/mailbox_delete_test.go

@@ -0,0 +1,34 @@
+package app
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestAdminCanDeleteOwnLastMailboxWithoutDeletingAccount(t *testing.T) {
+	a := newTestApp(t)
+	ts := httptest.NewServer(a.Router())
+	defer ts.Close()
+	admin := &testClient{t: t, server: ts}
+	var login map[string]any
+	if code := admin.do("POST", "/api/auth/login", map[string]string{"email": "admin@lanqin.local", "password": "ChangeMe123!"}, &login); code != http.StatusOK {
+		t.Fatalf("admin login=%d", code)
+	}
+	var mailboxes struct {
+		Items []Mailbox `json:"items"`
+	}
+	if code := admin.do("GET", "/api/mail/mailboxes", nil, &mailboxes); code != http.StatusOK || len(mailboxes.Items) != 1 {
+		t.Fatalf("mailboxes code=%d items=%d", code, len(mailboxes.Items))
+	}
+	if code := admin.do("DELETE", "/api/admin/mailboxes/"+mailboxes.Items[0].ID, nil, &map[string]any{}); code != http.StatusOK {
+		t.Fatalf("delete final mailbox code=%d", code)
+	}
+	if code := admin.do("GET", "/api/mail/mailboxes", nil, &mailboxes); code != http.StatusOK || len(mailboxes.Items) != 0 {
+		t.Fatalf("mailboxes after delete code=%d items=%d", code, len(mailboxes.Items))
+	}
+	var me map[string]any
+	if code := admin.do("GET", "/api/me", nil, &me); code != http.StatusOK {
+		t.Fatalf("account was not preserved code=%d", code)
+	}
+}

apps/api/internal/app/open_api_handlers.go

@@ -318,26 +318,9 @@ func (a *App) handleOpenAPIUpdateMailbox(w http.ResponseWriter, r *http.Request)
 
 func (a *App) handleOpenAPIDeleteMailbox(w http.ResponseWriter, r *http.Request) {
 	id := chi.URLParam(r, "id")
-	var owner string
-	if err := a.db.QueryRowContext(r.Context(), `SELECT user_id FROM mailboxes WHERE id=?`, id).Scan(&owner); err != nil {
-		respondError(w, http.StatusNotFound, "mailbox not found")
-		return
-	}
-	current := currentUser(r)
-	if current != nil && owner == current.ID {
-		var count int
-		if err := a.db.QueryRowContext(r.Context(), `SELECT COUNT(*) FROM mailboxes WHERE user_id=?`, owner).Scan(&count); err != nil {
-			respondError(w, http.StatusInternalServerError, "failed to check mailbox")
-			return
-		}
-		if count <= 1 {
-			badRequest(w, errors.New("cannot delete your last mailbox"))
-			return
-		}
-	}
 	rows, err := a.db.QueryContext(r.Context(), `SELECT id FROM messages WHERE mailbox_id=?`, id)
 	if err != nil {
-		respondError(w, http.StatusInternalServerError, "failed to load mailbox messages")
+		respondError(w, http.StatusInternalServerError, "加载邮箱邮件失败")
 		return
 	}
 	messageIDs := []string{}
@@ -353,11 +336,11 @@ func (a *App) handleOpenAPIDeleteMailbox(w http.ResponseWriter, r *http.Request)
 	}
 	res, err := a.db.ExecContext(r.Context(), `DELETE FROM mailboxes WHERE id=?`, id)
 	if err != nil {
-		respondError(w, http.StatusInternalServerError, "failed to delete mailbox")
+		respondError(w, http.StatusInternalServerError, "删除邮箱失败")
 		return
 	}
 	if affected, _ := res.RowsAffected(); affected == 0 {
-		respondError(w, http.StatusNotFound, "mailbox not found")
+		respondError(w, http.StatusNotFound, "邮箱不存在或已被删除")
 		return
 	}
 	respondJSON(w, http.StatusOK, map[string]any{"ok": true})

apps/web/src/lib/api.ts

@@ -69,16 +69,6 @@ async function request<T>(path: string, init: RequestInit & { timeoutMs?: number
   }
 }
 
-async function requestFile(path: string): Promise<Blob> {
-  const res = await fetch(path, { credentials: "include" })
-  if (!res.ok) {
-    let message = `${res.status} ${res.statusText}`
-    try { const body = await res.json(); message = body.error || message } catch {}
-    throw new Error(message)
-  }
-  return res.blob()
-}
-
 async function uploadForm<T>(path: string, form: FormData): Promise<T> {
   const controller = new AbortController()
   const timeout = window.setTimeout(() => controller.abort(), 5 * 60_000)
@@ -230,7 +220,13 @@ export const api = {
     const query = payload.mailboxId ? `?mailboxId=${encodeURIComponent(payload.mailboxId)}` : ""
     return request<{ ok: boolean }>(`/api/mail/folders/reorder${query}`, { method: "POST", body: JSON.stringify(payload.folders ? { folders: payload.folders } : { folderIds: payload.folderIds }) })
   },
-  deleteFolder: (id: string, mailboxId?: string) => request<{ ok: boolean; moved: number }>(`/api/mail/folders/${id}${mailboxId ? `?mailboxId=${encodeURIComponent(mailboxId)}` : ""}`, { method: "DELETE" }),
+  deleteFolder: (id: string, mailboxId?: string, folderName?: string) => {
+    const query = new URLSearchParams()
+    if (mailboxId) query.set("mailboxId", mailboxId)
+    if (folderName) query.set("folderName", folderName)
+    const suffix = query.toString()
+    return request<{ ok: boolean; moved: number }>(`/api/mail/folders/${id}${suffix ? `?${suffix}` : ""}`, { method: "DELETE" })
+  },
   labels: (mailboxId?: string) => request<ListResponse<MailLabel>>(`/api/mail/labels${mailboxId ? `?mailboxId=${encodeURIComponent(mailboxId)}` : ""}`),
   createLabel: (payload: { mailboxId?: string; name: string; color?: string }) => {
     const query = payload.mailboxId ? `?mailboxId=${encodeURIComponent(payload.mailboxId)}` : ""
@@ -255,12 +251,13 @@ export const api = {
     if (mailboxId) params.set("mailboxId", mailboxId)
     return request<ListResponse<MailMessage>>(`/api/mail/starred?${params.toString()}`)
   },
-  exportMail: (params: { view: "folder" | "starred" | "label" | "unknown"; mailboxId?: string; folder?: string; labelId?: string }) => {
+  exportMailUrl: (params: { view: "folder" | "starred" | "label" | "unknown"; mailboxId?: string; folder?: string; labelId?: string; messageIds?: string[] }) => {
     const query = new URLSearchParams({ view: params.view })
     if (params.mailboxId) query.set("mailboxId", params.mailboxId)
     if (params.folder) query.set("folder", params.folder)
     if (params.labelId) query.set("labelId", params.labelId)
-    return requestFile(`/api/mail/export?${query.toString()}`)
+    params.messageIds?.forEach((id) => query.append("messageId", id))
+    return `/api/mail/export?${query.toString()}`
   },
   importMail: (files: File[], payload: { mailboxId: string; folder: string }) => {
     const form = new FormData()

apps/web/src/lib/language.tsx

@@ -69,7 +69,6 @@ const exactTranslations: Record<string, Translation> = {
   "暂无标签": { "zh-TW": "暫無標籤", en: "No labels" },
   "收起侧栏": { "zh-TW": "收合側欄", en: "Collapse sidebar" },
   "选择邮箱": { "zh-TW": "選擇信箱", en: "Select mailbox" },
-  "加载邮箱...": { "zh-TW": "載入信箱...", en: "Loading mailboxes..." },
   "未注册邮箱": { "zh-TW": "未註冊信箱", en: "Unregistered mailbox" },
   "没有可用邮箱": { "zh-TW": "沒有可用信箱", en: "No mailboxes available" },
   "邮箱地址已复制": { "zh-TW": "信箱地址已複製", en: "Mailbox address copied" },

apps/web/src/pages/mail.tsx

@@ -192,6 +192,11 @@ export function MailPage() {
   const publicSettings = useQuery({ queryKey: ["public-settings"], queryFn: api.publicSettings })
   const externalImapEnabled = publicSettings.data?.externalImapEnabled ?? false
 
+  React.useEffect(() => {
+    if (!user) return
+    void import("@/pages/profile")
+  }, [user])
+
   const mailboxList = useQuery({ queryKey: ["mailboxes", "mine"], queryFn: api.myMailboxes, enabled: canAccessMail })
   const externalMailAccounts = useQuery({ queryKey: ["mail-external-accounts"], queryFn: api.externalMailAccounts, enabled: canAccessMail && canReadMail && externalImapEnabled })
   const selectedExternalAccount = React.useMemo(() => externalImapEnabled ? externalMailAccounts.data?.items.find((item) => item.id === selectedExternalAccountId) : undefined, [externalImapEnabled, externalMailAccounts.data?.items, selectedExternalAccountId])
@@ -205,6 +210,8 @@ export function MailPage() {
   const activeMailboxId = selectedMailboxId === "all" ? "all" : selectedMailbox?.id || ""
   const selectedComposeMailbox = selectedMailbox || (isAllMailboxSelected ? mailboxList.data?.items?.[0] : undefined)
   const hasMailboxes = (mailboxList.data?.items.length || 0) > 0
+  const canManageFolders = canOrganizeMail && hasMailboxes
+  const showMailboxCopy = !!selectedMailbox && !isAllMailboxSelected
   const folders = useQuery({ queryKey: ["folders", activeMailboxId], queryFn: () => api.folders(activeMailboxId), enabled: !!activeMailboxId && canReadMail })
   const labels = useQuery({ queryKey: ["labels", activeMailboxId], queryFn: () => api.labels(activeMailboxId), enabled: !!activeMailboxId && (canReadMail || canManageLabels) })
   const mailStats = useQuery({ queryKey: ["mail-stats", activeMailboxId], queryFn: () => api.mailStats(activeMailboxId), enabled: !!activeMailboxId && hasPermission(user, "mail.stats.view") })
@@ -459,7 +466,7 @@ export function MailPage() {
     onSettled: () => qc.invalidateQueries({ queryKey: ["folders", activeMailboxId] }),
   })
   const deleteFolder = useMutation({
-    mutationFn: (item: Extract<MailMenuItem, { type: "folder" }>) => api.deleteFolder(item.folderId, activeMailboxId),
+    mutationFn: (item: Extract<MailMenuItem, { type: "folder" }>) => api.deleteFolder(item.folderId, activeMailboxId, item.folderName),
     onSuccess: async (result, item) => {
       setPendingConfirm(null)
       if (mailView === "folder" && folder === item.folderName) {
@@ -966,7 +973,9 @@ export function MailPage() {
     if (item.type !== "folder" || !item.custom) return
     setPendingConfirm({
       title: `删除文件夹“${item.label}”？`,
-      description: "文件夹内的邮件会移回收件箱，不会被删除。",
+      description: isAllMailboxSelected
+        ? "所有邮箱中的同名文件夹都会删除，文件夹内邮件会移回各自的收件箱。"
+        : "文件夹内的邮件会移回收件箱，不会被删除。",
       confirmText: "删除文件夹",
       onConfirm: () => deleteFolder.mutate(item),
     })
@@ -1095,28 +1104,22 @@ export function MailPage() {
   async function exportCurrentMail() {
     if (!canExportCurrentView || exportingMail) return
     setExportingMail(true)
-    try {
-      const exportView = mailView === "unknown" ? "unknown" : mailView === "starred" ? "starred" : mailView === "label" ? "label" : "folder"
-      const blob = await api.exportMail({
-        view: exportView,
-        mailboxId: mailView === "unknown" ? undefined : activeMailboxId,
-        folder: exportView === "folder" ? folder : undefined,
-        labelId: exportView === "label" ? selectedLabelId : undefined,
-      })
-      const href = URL.createObjectURL(blob)
-      const anchor = document.createElement("a")
-      anchor.href = href
-      anchor.download = `${viewTitle.replace(/[\\/:*?"<>|]+/g, "-") || "邮件"}-${new Date().toISOString().slice(0, 10)}.zip`
-      document.body.appendChild(anchor)
-      anchor.click()
-      anchor.remove()
-      window.setTimeout(() => URL.revokeObjectURL(href), 1000)
-      toast({ title: "邮件已导出", description: `${viewTitle} 已打包为 ZIP` })
-    } catch (error) {
-      toast({ title: "导出失败", description: error instanceof Error ? error.message : "请稍后重试" })
-    } finally {
-      setExportingMail(false)
-    }
+    const exportView = mailView === "unknown" ? "unknown" : mailView === "starred" ? "starred" : mailView === "label" ? "label" : "folder"
+    const selectedMessageIds = compactSelectedIds.filter((id) => visibleMessageIds.includes(id))
+    const anchor = document.createElement("a")
+    anchor.href = api.exportMailUrl({
+      view: exportView,
+      mailboxId: mailView === "unknown" ? undefined : activeMailboxId,
+      folder: exportView === "folder" ? folder : undefined,
+      labelId: exportView === "label" ? selectedLabelId : undefined,
+      messageIds: selectedMessageIds.length > 0 ? selectedMessageIds : undefined,
+    })
+    anchor.download = `${viewTitle.replace(/[\\/:*?"<>|]+/g, "-") || "邮件"}-${new Date().toISOString().slice(0, 10)}.zip`
+    document.body.appendChild(anchor)
+    anchor.click()
+    anchor.remove()
+    toast({ title: "已开始下载", description: selectedMessageIds.length > 0 ? `正在打包选中的 ${selectedMessageIds.length} 封邮件。` : "邮件将打包为 ZIP，压缩包内为标准 EML 文件；邮件较多时请查看浏览器下载进度。" })
+    window.setTimeout(() => setExportingMail(false), 1000)
   }
   function chooseMailImport() {
     if (!canImportCurrentView || importingMail) {
@@ -1163,7 +1166,7 @@ export function MailPage() {
     toast({ title: "邮箱地址已复制" })
   }
   function openSettings() {
-    navigate("/profile")
+    void import("@/pages/profile").then(() => navigate("/profile"))
   }
   function toggleAdvancedSearch() {
     setAdvancedSearchDraft(advancedSearch)
@@ -1216,7 +1219,7 @@ export function MailPage() {
           onLanguageChange={setLanguage}
           onSettings={openSettings}
         />
-        <div className={cn("mt-2 gap-1.5", sidebarCollapsed ? "flex justify-center" : "grid grid-cols-[minmax(0,1fr)_2rem]")}>
+        <div className={cn("mt-2 gap-1.5", sidebarCollapsed ? "flex justify-center" : showMailboxCopy ? "grid grid-cols-[minmax(0,1fr)_2rem]" : "grid grid-cols-1")}>
           <MailboxSwitcher
             collapsed={sidebarCollapsed}
             mailboxes={mailboxList.data?.items || []}
@@ -1226,17 +1229,15 @@ export function MailPage() {
             unreadCount={mailboxUnreadCount}
             onSelect={switchMailbox}
           />
-          {!sidebarCollapsed && (
+          {!sidebarCollapsed && showMailboxCopy && (
             <Button
               type="button"
               variant="outline"
               size="icon"
-              className={cn("h-8 w-8 shrink-0 rounded-md bg-background shadow-none hover:bg-background", isAllMailboxSelected && "invisible pointer-events-none")}
+              className="h-8 w-8 shrink-0 rounded-md bg-background shadow-none hover:bg-background"
               onClick={copyCurrentMailbox}
-              disabled={!selectedMailbox || isAllMailboxSelected}
+              disabled={!selectedMailbox}
               aria-label="复制邮箱地址"
-              aria-hidden={isAllMailboxSelected}
-              tabIndex={isAllMailboxSelected ? -1 : 0}
               title="复制邮箱地址"
             >
               <Copy className="h-3.5 w-3.5" />
@@ -1353,12 +1354,12 @@ export function MailPage() {
             </SidebarMenu>
           </SidebarGroupContent>
         </SidebarGroup>}
-        {(customMailMenuItems.length > 0 || canOrganizeMail) && <SidebarGroup>
+        {(customMailMenuItems.length > 0 || canManageFolders) && <SidebarGroup>
           {!sidebarCollapsed && (
             <div className="flex items-center justify-between px-2 py-1">
               <SidebarGroupLabel className="m-0 h-auto gap-1 p-0 text-xs font-semibold text-muted-foreground"><ChevronDown className="h-3 w-3" />文件夹</SidebarGroupLabel>
-              {canOrganizeCurrentMailbox && (
-                <Button type="button" variant="ghost" size="icon" className="h-5 w-5 text-muted-foreground hover:bg-transparent hover:text-foreground" onClick={() => setFolderDialogOpen(true)} disabled={!selectedMailbox}>
+              {canManageFolders && (
+                <Button type="button" variant="ghost" size="icon" className="h-5 w-5 text-muted-foreground hover:bg-transparent hover:text-foreground" onClick={() => setFolderDialogOpen(true)}>
                   <Plus className="h-3.5 w-3.5" />
                 </Button>
               )}
@@ -1483,7 +1484,7 @@ export function MailPage() {
 
   const mailTransferTools = isTransferView ? (
     <div className="flex shrink-0 items-center gap-0.5">
-      <Button type="button" size="icon" variant="ghost" onClick={() => void exportCurrentMail()} disabled={!canExportCurrentView || exportingMail} className="h-8 w-8 text-muted-foreground hover:text-foreground" title="导出当前邮箱邮件为 ZIP" aria-label="导出当前邮箱邮件为 ZIP">
+      <Button type="button" size="icon" variant="ghost" onClick={() => void exportCurrentMail()} disabled={!canExportCurrentView || exportingMail} className="h-8 w-8 text-muted-foreground hover:text-foreground" title={selectedCountOnPage > 0 ? `下载选中的 ${selectedCountOnPage} 封邮件` : "导出当前邮箱邮件为 ZIP"} aria-label={selectedCountOnPage > 0 ? `下载选中的 ${selectedCountOnPage} 封邮件` : "导出当前邮箱邮件为 ZIP"}>
         <Download className={cn("h-4 w-4", exportingMail && "animate-pulse")} />
       </Button>
       {mailView !== "unknown" && (
@@ -1785,8 +1786,10 @@ export function MailPage() {
       />
       <SidebarContextMenu
         state={sidebarContextMenu}
-        canOrganize={canOrganizeMail}
-        pending={reorderFolders.isPending}
+        canCreate={canManageFolders}
+        canReorder={canOrganizeCurrentMailbox}
+        canDelete={canManageFolders}
+        pending={reorderFolders.isPending || deleteFolder.isPending}
         onClose={closeSidebarContextMenu}
         onOpen={(item) => {
           closeSidebarContextMenu()
@@ -2456,7 +2459,7 @@ function BulkActionToolbar({ pending, currentFolder, folders = [], readAction =
   )
 }
 
-function SidebarContextMenu({ state, canOrganize, pending, onClose, onOpen, onRefresh, onCreateFolder, onMove, onDelete }: { state: SidebarContextMenuState | null; canOrganize: boolean; pending: boolean; onClose: () => void; onOpen: (item: MailMenuItem) => void; onRefresh: () => void; onCreateFolder: () => void; onMove: (item: MailMenuItem, action: "top" | "up" | "down" | "bottom") => void; onDelete: (item: MailMenuItem) => void }) {
+function SidebarContextMenu({ state, canCreate, canReorder, canDelete, pending, onClose, onOpen, onRefresh, onCreateFolder, onMove, onDelete }: { state: SidebarContextMenuState | null; canCreate: boolean; canReorder: boolean; canDelete: boolean; pending: boolean; onClose: () => void; onOpen: (item: MailMenuItem) => void; onRefresh: () => void; onCreateFolder: () => void; onMove: (item: MailMenuItem, action: "top" | "up" | "down" | "bottom") => void; onDelete: (item: MailMenuItem) => void }) {
   React.useEffect(() => {
     if (!state) return
     const close = () => onClose()
@@ -2494,30 +2497,32 @@ function SidebarContextMenu({ state, canOrganize, pending, onClose, onOpen, onRe
       <Button type="button" variant="ghost" className={itemClass} onClick={onRefresh}>
         <RefreshCcw className="h-4 w-4" />刷新
       </Button>
-      {canOrganize && (
+      {canCreate && (
         <Button type="button" variant="ghost" className={itemClass} onClick={onCreateFolder}>
           <Plus className="h-4 w-4" />新建文件夹
         </Button>
       )}
-      {canOrganize && customFolder && (
+      {customFolder && (canReorder || canDelete) && (
         <>
           <div className="my-1 h-px bg-border" />
-          <Button type="button" variant="ghost" className={itemClass} disabled={pending} onClick={() => onMove(item, "top")}>
-            <ArrowLeft className="h-4 w-4 rotate-90" />移到最上
-          </Button>
-          <Button type="button" variant="ghost" className={itemClass} disabled={pending} onClick={() => onMove(item, "up")}>
-            <ChevronDown className="h-4 w-4 rotate-180" />上移一位
-          </Button>
-          <Button type="button" variant="ghost" className={itemClass} disabled={pending} onClick={() => onMove(item, "down")}>
-            <ChevronDown className="h-4 w-4" />下移一位
-          </Button>
-          <Button type="button" variant="ghost" className={itemClass} disabled={pending} onClick={() => onMove(item, "bottom")}>
-            <ArrowLeft className="h-4 w-4 -rotate-90" />移到最下
-          </Button>
-          <div className="my-1 h-px bg-border" />
-          <Button type="button" variant="ghost" className={cn(itemClass, "text-destructive hover:bg-destructive/10 hover:text-destructive")} onClick={() => onDelete(item)}>
-            <Trash2 className="h-4 w-4" />删除文件夹
-          </Button>
+          {canReorder && <>
+            <Button type="button" variant="ghost" className={itemClass} disabled={pending} onClick={() => onMove(item, "top")}>
+              <ArrowLeft className="h-4 w-4 rotate-90" />移到最上
+            </Button>
+            <Button type="button" variant="ghost" className={itemClass} disabled={pending} onClick={() => onMove(item, "up")}>
+              <ChevronDown className="h-4 w-4 rotate-180" />上移一位
+            </Button>
+            <Button type="button" variant="ghost" className={itemClass} disabled={pending} onClick={() => onMove(item, "down")}>
+              <ChevronDown className="h-4 w-4" />下移一位
+            </Button>
+            <Button type="button" variant="ghost" className={itemClass} disabled={pending} onClick={() => onMove(item, "bottom")}>
+              <ArrowLeft className="h-4 w-4 -rotate-90" />移到最下
+            </Button>
+          </>}
+          {canReorder && canDelete && <div className="my-1 h-px bg-border" />}
+          {canDelete && <Button type="button" variant="ghost" className={cn(itemClass, "text-destructive hover:bg-destructive/10 hover:text-destructive")} disabled={pending} onClick={() => onDelete(item)}>
+              <Trash2 className="h-4 w-4" />删除文件夹
+          </Button>}
         </>
       )}
     </div>
@@ -3211,7 +3216,7 @@ function AccountHeader({ collapsed, name, email, darkMode, language, onToggleThe
         </div>
       </div>
       <div className="flex shrink-0 items-center gap-1">
-        <Button type="button" variant="ghost" size="icon" className="size-7 rounded-md text-muted-foreground hover:bg-transparent hover:text-foreground" onClick={onToggleTheme}>
+        <Button type="button" variant="ghost" size="icon" className="size-7 rounded-md text-muted-foreground hover:bg-transparent hover:text-foreground" onClick={onToggleTheme} title={darkMode ? "切换到浅色模式" : "切换到深色模式"} aria-label={darkMode ? "切换到浅色模式" : "切换到深色模式"}>
           {darkMode ? <Sun className="h-3.5 w-3.5" /> : <Moon className="h-3.5 w-3.5" />}
         </Button>
         <DropdownMenu>
@@ -3229,7 +3234,7 @@ function AccountHeader({ collapsed, name, email, darkMode, language, onToggleThe
             ))}
           </DropdownMenuContent>
         </DropdownMenu>
-        <Button type="button" variant="ghost" size="icon" className="size-7 rounded-md text-muted-foreground hover:bg-transparent hover:text-foreground" onClick={onSettings}>
+        <Button type="button" variant="ghost" size="icon" className="size-7 rounded-md text-muted-foreground hover:bg-transparent hover:text-foreground" onClick={onSettings} title="设置" aria-label="设置">
           <Settings className="h-3.5 w-3.5" />
         </Button>
       </div>
@@ -3253,7 +3258,7 @@ function MailboxSwitcher({ collapsed, mailboxes, loading, selectedMailboxId, sel
   const [mailboxQuery, setMailboxQuery] = React.useState("")
   const isAllSelected = selectedMailboxId === "all"
   const mailboxUnavailable = loading || mailboxes.length === 0
-  const displayAddress = loading ? "加载邮箱..." : mailboxes.length === 0 ? "未注册邮箱" : isAllSelected ? "全部邮箱" : selectedMailbox?.address || "选择邮箱"
+  const displayAddress = loading ? "全部邮箱" : mailboxes.length === 0 ? "未注册邮箱" : isAllSelected ? "全部邮箱" : selectedMailbox?.address || "选择邮箱"
   const selectedUnreadCount = isAllSelected ? unreadCount : (selectedMailbox?.unreadCount ?? unreadCount)
   const normalizedQuery = mailboxQuery.trim().toLowerCase()
   const showAllMailboxOption = !normalizedQuery || "全部邮箱".includes(normalizedQuery) || "all".includes(normalizedQuery)

apps/web/src/pages/profile.tsx

@@ -59,6 +59,7 @@ export function ProfilePage() {
   const passwordFormRef = React.useRef<HTMLFormElement>(null)
   const twoFactorFormRef = React.useRef<HTMLFormElement>(null)
   const [mailboxId, setMailboxId] = React.useState(() => localStorage.getItem("lanqin:selected-mailbox") || "")
+  const [statsMailboxId, setStatsMailboxId] = React.useState("all")
   const [statsRangeDays, setStatsRangeDays] = React.useState(30)
   const [darkMode, setDarkMode] = React.useState(getInitialTheme)
   const [displayMode, setDisplayMode] = useDisplayMode()
@@ -98,29 +99,32 @@ export function ProfilePage() {
   const tab: Tab = rawTab && visibleTabKeys.includes(rawTab) ? rawTab : "profile"
   const accountTab: AccountSettingsTab = rawAccountTab && accountSettingTabs.some((item) => item.key === rawAccountTab) ? rawAccountTab : "account"
   const mailboxes = useQuery({ queryKey: ["mailboxes", "mine"], queryFn: api.myMailboxes, enabled: canAccessMail })
-  const mailboxApplyOptions = useQuery({ queryKey: ["mailbox-apply-options"], queryFn: api.mailboxApplyOptions, enabled: canApplyMailbox })
-  const publicSettings = useQuery({ queryKey: ["public-settings"], queryFn: api.publicSettings })
-  const apiTokens = useQuery({ queryKey: ["api-tokens"], queryFn: api.apiTokens })
-  const contacts = useQuery({ queryKey: ["contacts"], queryFn: api.contacts, enabled: canManageContacts })
-  const signatures = useQuery({ queryKey: ["signatures"], queryFn: api.signatures, enabled: canManageSignatures })
-  const rules = useQuery({ queryKey: ["rules"], queryFn: api.rules, enabled: canManageRules })
-  const ruleForwarding = useQuery({ queryKey: ["forwarding-settings"], queryFn: api.forwardingSettings, enabled: canManageRules && canAccessMail })
+  const mailboxApplyOptions = useQuery({ queryKey: ["mailbox-apply-options"], queryFn: api.mailboxApplyOptions, enabled: canApplyMailbox && tab === "mailboxes" })
+  const publicSettings = useQuery({ queryKey: ["public-settings"], queryFn: api.publicSettings, enabled: tab === "mailboxes" || (tab === "profile" && accountTab === "clients") })
+  const apiTokens = useQuery({ queryKey: ["api-tokens"], queryFn: api.apiTokens, enabled: tab === "apiTokens" })
+  const contacts = useQuery({ queryKey: ["contacts"], queryFn: api.contacts, enabled: canManageContacts && tab === "contacts" })
+  const signatures = useQuery({ queryKey: ["signatures"], queryFn: api.signatures, enabled: canManageSignatures && tab === "profile" && accountTab === "mail" })
+  const rules = useQuery({ queryKey: ["rules"], queryFn: api.rules, enabled: canManageRules && tab === "rules" })
+  const ruleForwarding = useQuery({ queryKey: ["forwarding-settings"], queryFn: api.forwardingSettings, enabled: canManageRules && canAccessMail && tab === "rules" })
   const ruleVerifiedEmails = React.useMemo(() => ruleForwarding.data?.verifiedEmails.filter((item) => item.verified).map((item) => item.email) || [], [ruleForwarding.data?.verifiedEmails])
-  const blocked = useQuery({ queryKey: ["blocked-senders"], queryFn: api.blockedSenders, enabled: canManageBlocked })
+  const blocked = useQuery({ queryKey: ["blocked-senders"], queryFn: api.blockedSenders, enabled: canManageBlocked && tab === "blocked" })
   const selectedMailbox = React.useMemo(() => mailboxes.data?.items.find((m) => m.id === mailboxId), [mailboxes.data?.items, mailboxId])
   const activeMailboxId = selectedMailbox?.id || ""
   const externalImapEnabled = publicSettings.data?.externalImapEnabled ?? false
-  const externalImapAccounts = useQuery({ queryKey: ["external-imap-accounts", activeMailboxId], queryFn: () => api.externalImapAccounts(activeMailboxId), enabled: !!activeMailboxId && canAccessMail && externalImapEnabled })
+  const externalImapAccounts = useQuery({ queryKey: ["external-imap-accounts", activeMailboxId], queryFn: () => api.externalImapAccounts(activeMailboxId), enabled: tab === "mailboxes" && !!activeMailboxId && canAccessMail && externalImapEnabled })
   React.useEffect(() => {
     if (!externalRunAccountId) return
     if (externalImapAccounts.data?.items.some((item) => item.id === externalRunAccountId)) return
     setExternalRunAccountId("")
   }, [externalImapAccounts.data?.items, externalRunAccountId])
   const selectedExternalRunAccount = externalImapAccounts.data?.items.find((item) => item.id === externalRunAccountId)
-  const externalRunFolders = useQuery({ queryKey: ["external-imap-run-folders", externalRunAccountId], queryFn: () => api.externalFolders(externalRunAccountId), enabled: !!externalRunAccountId && !!selectedExternalRunAccount && canAccessMail && externalImapEnabled })
-  const externalSyncRuns = useQuery({ queryKey: ["external-imap-sync-runs", externalRunAccountId], queryFn: () => api.externalImapSyncRuns(externalRunAccountId), enabled: !!externalRunAccountId && !!selectedExternalRunAccount && canAccessMail && externalImapEnabled })
-  const labels = useQuery({ queryKey: ["labels", activeMailboxId], queryFn: () => api.labels(activeMailboxId), enabled: !!activeMailboxId && (canReadMail || canManageLabels || canManageRules) })
-  const stats = useQuery({ queryKey: ["mail-stats", activeMailboxId, statsRangeDays], queryFn: () => api.mailStats(activeMailboxId, statsRangeDays), enabled: !!activeMailboxId && canViewStats })
+  const externalRunFolders = useQuery({ queryKey: ["external-imap-run-folders", externalRunAccountId], queryFn: () => api.externalFolders(externalRunAccountId), enabled: tab === "mailboxes" && !!externalRunAccountId && !!selectedExternalRunAccount && canAccessMail && externalImapEnabled })
+  const externalSyncRuns = useQuery({ queryKey: ["external-imap-sync-runs", externalRunAccountId], queryFn: () => api.externalImapSyncRuns(externalRunAccountId), enabled: tab === "mailboxes" && !!externalRunAccountId && !!selectedExternalRunAccount && canAccessMail && externalImapEnabled })
+  const labels = useQuery({ queryKey: ["labels", activeMailboxId], queryFn: () => api.labels(activeMailboxId), enabled: !!activeMailboxId && ((tab === "profile" && accountTab === "mail" && (canReadMail || canManageLabels)) || (tab === "rules" && canManageRules)) })
+  const accountStats = useQuery({ queryKey: ["mail-stats", "all", 30], queryFn: () => api.mailStats("all", 30), enabled: canViewStats && tab === "profile" && accountTab === "account" })
+  const mailboxStats = useQuery({ queryKey: ["mail-stats", activeMailboxId, 30], queryFn: () => api.mailStats(activeMailboxId, 30), enabled: !!activeMailboxId && canViewStats && (tab === "cleanup" || tab === "cleanupQueue") })
+  const blockedStats = useQuery({ queryKey: ["mail-stats", blockedMailboxId, 30], queryFn: () => api.mailStats(blockedMailboxId, 30), enabled: canViewStats && tab === "blocked" })
+  const dashboardStats = useQuery({ queryKey: ["mail-stats", statsMailboxId, statsRangeDays], queryFn: () => api.mailStats(statsMailboxId, statsRangeDays), enabled: canViewStats && tab === "stats" })
 
   const profile = useMutation({
     mutationFn: (form: FormData) => api.updateProfile({ displayName: String(form.get("displayName") || "") }),
@@ -356,6 +360,16 @@ export function ProfilePage() {
               <span className="truncate">{tabs[key].label}</span>
             </button>
           ))}
+          {user.role === "admin" && (
+            <button
+              type="button"
+              className="flex h-9 w-full items-center gap-2 rounded-md px-3 text-left text-sm text-muted-foreground transition-colors hover:bg-muted/70 hover:text-foreground"
+              onClick={() => navigate("/admin")}
+            >
+              <ShieldCheck className="h-4 w-4 stroke-[1.8]" />
+              <span className="truncate">后台管理</span>
+            </button>
+          )}
         </div>
       </nav>
       <div className="border-t p-2">
@@ -370,7 +384,10 @@ export function ProfilePage() {
   const pageTitle = tabs[tab].label
   const pageSubtitle = tab === "stats" ? "查看邮件收发趋势、分布情况和常用联系人。" : undefined
   const pageAction = tab === "stats"
-    ? <StatsRangeTabs rangeDays={statsRangeDays} onRangeChange={setStatsRangeDays} />
+    ? <div className="flex flex-col gap-2 sm:flex-row sm:items-center">
+        <div className="w-full sm:w-[220px]"><MailboxSelect value={statsMailboxId} mailboxes={mailboxes.data?.items || []} onChange={setStatsMailboxId} /></div>
+        <StatsRangeTabs rangeDays={statsRangeDays} onRangeChange={setStatsRangeDays} />
+      </div>
     : tab === "apiTokens"
       ? <Button asChild variant="outline" size="sm" className="h-8 px-3 text-xs"><a href="https://github.com/zxyszx/NewSzxcn-Email/blob/main/docs/API.md" target="_blank" rel="noreferrer"><BookOpen className="h-4 w-4" />API 文档</a></Button>
       : undefined
@@ -420,7 +437,7 @@ export function ProfilePage() {
         profile={profile}
         password={password}
         passwordFormRef={passwordFormRef}
-        stats={canViewStats ? stats.data : undefined}
+        stats={canViewStats ? accountStats.data : undefined}
         showStats={canViewStats}
         displayMode={displayMode}
         onDisplayModeChange={setDisplayMode}
@@ -477,11 +494,11 @@ export function ProfilePage() {
       />
     )
     if (tab === "contacts") return <ContactsSection items={contacts.data?.items || []} loading={contacts.isLoading} pending={createContact.isPending} onCreate={(form) => createContact.mutate(form)} onDelete={(id) => deleteContact.mutate(id)} onCopy={copy} />
-    if (tab === "cleanup") return <CleanupSection mailbox={selectedMailbox} stats={canViewStats ? stats.data : undefined} showStats={canViewStats} pending={cleanup.isPending} onCleanup={(target) => cleanup.mutate(target)} />
-    if (tab === "cleanupQueue") return <CleanupQueueSection mailbox={selectedMailbox} stats={canViewStats ? stats.data : undefined} />
+    if (tab === "cleanup") return <CleanupSection mailbox={selectedMailbox} stats={canViewStats ? mailboxStats.data : undefined} showStats={canViewStats} pending={cleanup.isPending} onCleanup={(target) => cleanup.mutate(target)} />
+    if (tab === "cleanupQueue") return <CleanupQueueSection mailbox={selectedMailbox} stats={canViewStats ? mailboxStats.data : undefined} />
     if (tab === "rules") return <RulesSection items={rules.data?.items || []} mailboxes={mailboxes.data?.items || []} labels={labels.data?.items || []} verifiedEmails={ruleVerifiedEmails} open={ruleDialogOpen} onOpenChange={setRuleDialogOpen} onCreate={(payload) => createRule.mutate(payload)} onUpdate={(id, payload) => updateRule.mutate({ id, payload })} onToggle={(item) => updateRule.mutate({ id: item.id, payload: { enabled: !item.enabled } })} onMove={(id, direction) => moveRule.mutate({ id, direction })} onApply={(id) => applyRule.mutate(id)} onDelete={(id) => deleteRule.mutate(id)} pending={createRule.isPending || updateRule.isPending || moveRule.isPending || applyRule.isPending} />
-    if (tab === "blocked") return <BlockedSection items={blocked.data?.items || []} mailboxes={mailboxes.data?.items || []} mailboxId={blockedMailboxId} spamCount={canViewStats ? stats.data?.byFolder.find((f) => f.role === "spam")?.count || 0 : 0} onMailboxChange={setBlockedMailboxId} onCreate={(form) => createBlocked.mutate(form)} onDelete={(id) => deleteBlocked.mutate(id)} pending={createBlocked.isPending} />
-    if (tab === "stats") return <StatsSection stats={stats.data} mailbox={selectedMailbox} rangeDays={statsRangeDays} onRangeChange={setStatsRangeDays} onRefresh={() => stats.refetch()} />
+    if (tab === "blocked") return <BlockedSection items={blocked.data?.items || []} mailboxes={mailboxes.data?.items || []} mailboxId={blockedMailboxId} spamCount={canViewStats ? blockedStats.data?.byFolder.find((f) => f.role === "spam")?.count || 0 : 0} onMailboxChange={setBlockedMailboxId} onCreate={(form) => createBlocked.mutate(form)} onDelete={(id) => deleteBlocked.mutate(id)} pending={createBlocked.isPending} />
+    if (tab === "stats") return <StatsSection stats={dashboardStats.data} />
     if (tab === "apiTokens") return <ApiTokensSection items={apiTokens.data?.items || []} loading={apiTokens.isLoading} pending={createApiToken.isPending || updateApiToken.isPending || deleteApiToken.isPending} onCreate={(payload) => createApiToken.mutateAsync(payload)} onUpdate={(id, payload) => updateApiToken.mutate({ id, payload })} onDelete={(id) => deleteApiToken.mutate(id)} onCopy={copy} />
     return null
   }
@@ -2394,7 +2411,7 @@ function BlockedSection({ items, mailboxes, mailboxId, spamCount, onMailboxChang
   )
 }
 
-function StatsSection({ stats }: { stats?: MailStats; mailbox?: Mailbox; rangeDays: number; onRangeChange: (days: number) => void; onRefresh: () => void }) {
+function StatsSection({ stats }: { stats?: MailStats }) {
   const quotaLabel = stats?.quotaBytes ? `${formatBytes(stats.storageBytes || 0)} / ${formatBytes(stats.quotaBytes)}` : formatBytes(stats?.storageBytes || 0)
   const quotaPct = Math.min(stats?.quotaUsedPct || 0, 100)
   const primaryCards = [