chore: wip

Author: chrisbbreuer

config/email.ts

@@ -18,7 +18,21 @@ export default {
 
   domain: envVars.MAIL_DOMAIN || 'stacksjs.com',
 
-  mailboxes: ['[email protected]', '[email protected]', '[email protected]'],
+  /**
+   * Mailbox users for IMAP/SMTP access.
+   * Passwords are automatically looked up from MAIL_PASSWORD_<USERNAME> env vars.
+   * After first deploy, passwords are synced to AWS Secrets Manager.
+   *
+   * Supported formats:
+   * - Simple usernames: ['chris', 'blake'] -> chris@{domain}, blake@{domain}
+   * - Full emails: ['[email protected]']
+   * - Objects: [{ email: 'chris', password: '...' }]
+   */
+  mailboxes: [
+    'chris',
+    'blake',
+    'glenn',
+  ],
 
   url: envVars.APP_URL || 'https://stacksjs.com',
   charset: 'UTF-8',

storage/framework/core/cloud/src/cloud/mail-server.ts

@@ -180,6 +180,21 @@ export class MailServerStack {
       resources: ['*'],
     }))
 
+    // Grant Secrets Manager access for IMAP credentials
+    // This allows the mail server to fetch credentials from the secret
+    // created by deploy-imap.ts or stored in stacks/mail-server/credentials
+    instanceRole.addToPolicy(new iam.PolicyStatement({
+      effect: iam.Effect.ALLOW,
+      actions: [
+        'secretsmanager:GetSecretValue',
+        'secretsmanager:DescribeSecret',
+      ],
+      resources: [
+        `arn:aws:secretsmanager:${Stack.of(scope).region}:${Stack.of(scope).account}:secret:stacks/*`,
+        `arn:aws:secretsmanager:${Stack.of(scope).region}:${Stack.of(scope).account}:secret:${props.slug}-${props.appEnv}-imap-passwords*`,
+      ],
+    }))
+
     // Create secrets for IMAP passwords
     const imapPasswordsSecret = new secretsmanager.Secret(scope, 'ImapPasswordsSecret', {
       secretName: `${props.slug}-${props.appEnv}-imap-passwords`,

storage/framework/core/types/src/email.ts

@@ -19,8 +19,17 @@ export interface EmailFilterRule {
 }
 
 export interface MailboxConfig {
-  address: string
+  /** Email address (preferred) - e.g., '[email protected]' */
+  email?: string
+  /** @deprecated Use 'email' instead */
+  address?: string
   displayName?: string
+  /**
+   * Password for IMAP/SMTP authentication.
+   * If not provided, will be looked up from MAIL_PASSWORD_<USERNAME> env var.
+   * Passwords are stored in AWS Secrets Manager after first deploy.
+   */
+  password?: string
   forwardTo?: string[]
   autoResponder?: AutoResponderConfig
   filters?: EmailFilterRule[]