chore(mail): classify permission identifiers for scanners

README.md

@@ -11,7 +11,7 @@ GovOPlaN Mail is the mail transport module. It owns reusable SMTP/IMAP profile m
 This repository owns:
 
 - backend module manifest `mail`
-- mail permissions such as `mail:profile:read`, `mail:profile:write`, `mail:profile:use`, `mail:profile:test`, and `mail:mailbox:read`
+- mail permissions such as `mail:profile:read`, `mail:profile:write_own`, `mail:profile:write`, `mail:profile:use`, `mail:profile:test`, and `mail:mailbox:read`
 - SMTP/IMAP profile models, policy checks, encrypted credential storage, and profile resolution
 - SMTP send and IMAP append adapters, including mock transports for development
 - development mock mailbox endpoints used by test-send flows
@@ -19,9 +19,51 @@ This repository owns:
 
 Core owns auth, tenants, RBAC evaluation, database/session primitives, secret helpers, CSRF/API helpers, and shell layout.
 
-## Credential inheritance policy
+## Profile and credential ownership
 
-SMTP and IMAP each have one credential inheritance decision: descendants inherit profile credentials, may inherit profile credentials, or must provide local credentials. The lower-level override switch for `smtp_credentials.inherit` and `imap_credentials.inherit` decides whether child scopes may change that decision. There is no separate "override the override" credential policy field.
+Mail profiles are separate governed definitions. Mail owns their SMTP/IMAP
+endpoints, encrypted credentials, tests, scope, and policy. Consumers such as
+Campaign store only a stable profile identifier and resolve the authorized,
+active profile through `mail.campaign_delivery`; they never copy or override
+transport settings or credentials in their own JSON.
+
+The campaign capability returns read-only availability flags and random,
+persisted Mail-owned transport revisions without decrypting secrets. Effect calls perform authorization,
+revision comparison, credential resolution, policy checks, and SMTP/IMAP
+effects inside Mail. Consumer-visible outcomes are sanitized: provider banners,
+raw response bytes, hosts, account identities, and credentials are not returned.
+
+A remaining observability slice, tracked in [govoplan-mail#17](https://git.add-ideas.de/add-ideas/govoplan-mail/issues/17), is a Mail-owned durable outbox and transport-attempt store with
+restricted diagnostic access, retention controls, and correlation identifiers.
+Until that exists, Campaign retains only sanitized delivery evidence; raw
+provider diagnostics must not be copied into consumer records.
+
+SMTP effects decrypt only SMTP credentials; Sent-folder effects decrypt only
+IMAP credentials. A connection loss after an effect starts is surfaced as an
+unknown outcome. Campaign does not automatically retry an unknown IMAP append,
+preventing silent duplicate Sent copies while an operator inspects the mailbox.
+
+The existing SMTP/IMAP credential-inheritance policy remains part of the Mail
+policy model for compatibility. Campaign delivery requires effective
+inheritance: a policy that requires campaign-local credentials now fails
+closed with guidance to store those credentials on a Mail profile and enable
+inheritance.
+
+Deleting a profile deactivates its non-secret tombstone metadata and scrubs
+both encrypted SMTP and IMAP passwords immediately in the same transaction as
+a non-secret audit event. Destructive module retirement applies the same rule
+to every remaining profile before any Mail table is dropped; a scrub or audit
+failure blocks retirement.
+
+Personal profile self-service is a distinct authorization path. An actor with
+`mail:profile:write_own` can mutate only a user-scoped profile whose scope id is
+their current tenant membership id; `mail:secret:manage_own` applies the same
+ownership check to credentials. Neither scope permits profile-policy changes or
+management of tenant, group, campaign, system, or another user's profiles.
+Changing an SMTP/IMAP endpoint while a stored password remains is a secret
+operation and requires the matching credential permission. Deactivating a
+credential-free profile needs only profile-write authority; if a password will
+be scrubbed, credential authority is required and the deletion is audited.
 
 ## Development
 
@@ -54,8 +96,9 @@ Frontend package:
 @govoplan/mail-webui
 ```
 
-The campaign module consumes `mail.campaign_delivery` for sending,
+The campaign module consumes `mail.campaign_delivery` for authorized runtime
-append-to-Sent behavior, profile selection, and policy checks. Mail does not
+profile resolution, sending, append-to-Sent behavior, profile selection, and
+policy checks. Mail does not
 import campaign internals; campaign-scoped policy and owner context are resolved
 through the core `campaigns.mailPolicyContext` capability when the campaign
 module is installed.
@@ -70,6 +113,8 @@ SMTP/IMAP first, prefer JMAP for modern mailbox sync/search later, and add POP3
 only for explicit legacy-download requirements.
 
 Platform RBAC and governance rules are documented in `govoplan-core/docs/`.
+The [Mail handbook](docs/MAIL_HANDBOOK.md) provides the adaptive user,
+governance, technical, security, and operations perspectives.
 
 ## Release packaging
 

docs/MAIL_HANDBOOK.md

@@ -0,0 +1,405 @@
+# Mail Handbook
+
+## Purpose and status
+
+This handbook is the canonical multi-perspective description of the GovOPlaN
+Mail module. Mail is a governed transport and mailbox capability. It is not a
+campaign definition, contact database, or general records store.
+
+| Perspective | Start here |
+| --- | --- |
+| User selecting a profile or reading a mailbox | [User tasks](#user-tasks) |
+| Mail profile administrator | [Profile administration](#profile-administration) |
+| Policy or tenant administrator | [Policy hierarchy](#policy-hierarchy) |
+| Delivery operator | [Operations and recovery](#operations-and-recovery) |
+| Integrator | [Capability contract](#capability-contract) |
+| Security or audit reviewer | [Security, deletion, and audit](#security-deletion-and-audit) |
+| Release reviewer | [Acceptance checklist](#acceptance-checklist) |
+
+See also [Mail protocol roadmap](MAIL_PROTOCOL_ROADMAP.md) and the Campaign
+[Mail profile boundary](https://git.add-ideas.de/add-ideas/govoplan-campaign/src/branch/main/docs/MAIL_PROFILE_BOUNDARY.md).
+
+## Domain ownership
+
+Mail owns:
+
+- reusable SMTP/IMAP profile definitions and scope;
+- encrypted SMTP/IMAP credentials and safe credential replacement;
+- effective profile policy and visibility/authorization decisions;
+- connection tests and protocol adapters;
+- SMTP send and IMAP append operations exposed to consumers;
+- read-only mailbox folder/message access and its bounded indexes; and
+- the transport sanitization boundary and throttling behavior. A general
+  Mail-owned provider-attempt/diagnostic ledger remains planned.
+
+Consumers own their business intent. For example, Campaign owns message
+content, recipients, approval, jobs, and delivery evidence, while Mail owns the
+profile and performs the provider operation. A consumer stores only a stable
+Mail profile reference and non-secret evidence returned by Mail. It never
+receives decrypted credentials or a raw resolved transport configuration.
+
+Core owns authentication, tenant context, permission evaluation, database
+session primitives, cryptographic secret helpers, audit infrastructure, and the
+module registry. Optional consumers provide narrow context through capabilities;
+Mail does not import their ORM or service implementations.
+
+## Concepts
+
+### Profile
+
+A profile is a reusable, named delivery identity with optional SMTP and IMAP
+configuration. It has a stable id, lifecycle state, scope, owner context, and
+non-secret connection metadata. Passwords are write-only encrypted values and
+are never returned through list/read/capability responses.
+
+Profiles may be scoped to system, tenant, user, group, or campaign context.
+Scope controls where a profile can be discovered; effective policy can narrow
+that further. A visible profile is not automatically authorized for every
+operation: using, testing, managing, and managing secrets are separate rights.
+
+### Policy
+
+Mail policy controls approved profile ids, which lower scopes may define
+profiles, allowed/denied hosts and addressing patterns, credential inheritance,
+and lower-level limits. The effective result is assembled from applicable
+system, tenant, user/group, and campaign context. Denials and locked parent
+limits cannot be relaxed by a lower scope.
+
+### Transport identity and revision
+
+Mail owns opaque random revisions for relevant SMTP/IMAP identity and
+configuration. They are concurrency tokens, not deterministic hashes that a
+consumer could use to guess a host or account. Credentials are excluded. A
+consumer can freeze these revisions at build time and ask Mail to require the
+same identity when the effect is later performed. Credential rotation alone
+therefore need not invalidate prepared work, while a host/account/protocol
+identity change does.
+
+The revision is evidence and a concurrency guard, not a substitute for
+authorization. Mail re-evaluates profile activity, visibility, policy, and
+revision immediately before it resolves credentials and performs the
+effect.
+
+### Provider outcomes
+
+SMTP acceptance, recipient refusal, temporary/permanent failure, connection
+loss, and unknown outcome are distinct. IMAP append is a separate operation and
+outcome. Mail returns a sanitized transport result; the consuming domain owns
+the durable business job and its retry/reconciliation semantics.
+
+## User tasks
+
+### Choose a profile
+
+1. Open the task that requires mail, such as Campaign **Mail settings**.
+2. Choose from the profiles visible and authorized for the current tenant,
+   owner, group, and task context. Never enter or copy a profile id manually
+   when the UI can present a picker.
+3. Review the safe summary: name, scope, active state, SMTP/IMAP availability,
+   and policy-relevant sender identity. Credentials and raw provider internals
+   are not visible.
+4. Save the reference in the consuming module. If ownership or policy changes,
+   select and validate again.
+
+The user needs `mail:profile:use`; reading profile summaries and testing may
+require their own scopes. The consuming module still requires its own action
+permission.
+
+### Test a profile
+
+An authorized profile test verifies connection and authentication for the
+selected active/visible SMTP or IMAP profile using Mail-owned credentials. The
+consumer-use path evaluates effective Mail policy separately. Use a
+non-production provider and mailbox first. A successful connection test does
+not prove policy authorization for a later Campaign context, deliverability,
+recipient acceptance, SPF/DKIM/DMARC alignment, or future availability.
+
+Testing a saved profile requires both `mail:profile:test` and
+`mail:profile:use`, and the profile must be active. Profile creation or test
+authority alone is not enough.
+
+Raw settings test endpoints accept new settings only for actors who may both
+test profiles and manage secrets. They are an administration aid, not a way for
+ordinary consumers to bypass reusable profiles.
+
+### Read a mailbox
+
+The current mailbox UI and API are read-only. An authorized user can list IMAP
+folders, page through messages, and inspect a bounded full message. Folder
+names are parsed and quoted defensively; Sent-folder discovery uses provider
+flags and common names.
+
+Mailbox access requires both `mail:mailbox:read` and `mail:profile:use`. It must
+not mutate read/unread, delete, move, or reply state. Message responses are
+bounded by the deployment response policy; ordinary UI should avoid loading a
+whole large mailbox or attachment merely to show a list.
+
+## Profile administration
+
+### Roles
+
+The supplied templates are:
+
+- **Mail profile user:** read/use/test approved profiles and read permitted
+  mailboxes without reading secrets.
+- **Mail profile self-service user:** additionally create, edit, deactivate,
+  and manage credentials only for the current account's own user-scoped
+  profiles, subject to the effective Mail policy.
+- **Mail profile administrator:** additionally create/update profiles and
+  create/replace encrypted credentials across tenant-owned scopes.
+
+The specific permissions are `mail:profile:read`, `mail:profile:use`,
+`mail:profile:test`, `mail:mailbox:read`, `mail:profile:write_own`,
+`mail:secret:manage_own`, `mail:profile:write`, and `mail:secret:manage`.
+The `_own` permissions are enforced against the authenticated membership id and
+never authorize a tenant, group, campaign, system, or another user's profile.
+They also do not authorize profile-policy changes. System-scoped definitions
+use the corresponding system settings authority. Keep secret management
+separate when an institution wants profile metadata administrators not to know
+or replace credentials.
+
+That separation is fail-closed for transport rebinding: changing an SMTP or
+IMAP host, port, or security mode while the profile retains a stored password
+requires the matching secret-management permission. A credential-free profile
+can be deactivated with profile-write authority alone; deactivation that
+scrubs a stored password also requires secret-management authority and records
+the deletion in the audit log.
+
+### Create or change a profile
+
+The configured Help Center exposes **Create a custom Mail profile** only when
+the current actor has broad or self-service profile-write authority and the
+effective user-scope policy permits user profiles. It states the active SMTP/IMAP hostname
+allow-list groups and deny rules, plus the actor's separate credential, test,
+use, and approval requirements. The Settings task creates in the current
+account's user scope. Grant `mail:profile:write_own` for self-service;
+`mail:profile:write` remains broad profile administration authority.
+
+1. Choose the narrowest suitable scope and a stable, descriptive name/slug.
+2. Configure SMTP, optional IMAP, TLS mode, account identity, Sent-folder
+   behavior, and timeouts. Sender/envelope/recipient constraints belong to
+   effective Mail policy; Campaign rate limits remain delivery configuration.
+3. Enter credentials only in the dedicated credential fields. Returned profile
+   data indicates whether credentials are configured without returning them.
+4. Save and run SMTP/IMAP tests against a non-production target.
+5. Verify the effective policy for every intended consumer context.
+6. Communicate changes that alter the non-secret transport identity; prepared
+   consumer snapshots will deliberately stop until rebuilt.
+
+An update that omits a password preserves the current encrypted password. A
+credential replacement never depends on reading the old cleartext value back.
+
+### Delete a profile
+
+Profile deletion is immediate for Mail-owned secrets and audit evidence:
+
+1. Mail clears both encrypted SMTP and IMAP passwords in the same transaction.
+2. It deactivates the remaining non-secret tombstone state so historical stable
+   references can fail safely rather than resolve to another profile.
+3. When owned encrypted secrets existed, it emits
+   `mail.profile_credentials_deleted` with profile id, scope, reason, and the
+   kinds of secret removed—never values, usernames/passwords, or raw
+   configuration.
+4. If scrubbing or audit insertion fails, the transaction rolls back and the
+   deletion fails.
+5. Repeating deletion after the secrets are gone is an idempotent no-op for the
+   secret-deletion effect.
+
+Consumers that still reference the profile fail closed at validation or
+execution. Deletion does not silently rebind them to a default profile.
+
+## Policy hierarchy
+
+Effective policy is contextual. Administrators should document:
+
+- which profile ids are approved globally or for a tenant;
+- whether tenant, user, group, or campaign-scoped profiles may be created;
+- allowed and denied SMTP/IMAP hosts;
+- permitted From, envelope sender (including bounce address), and envelope
+  recipient-domain patterns;
+- whether SMTP/IMAP credentials inherit from the reusable profile; and
+- which lower-level settings are locked by a parent policy.
+
+Campaign delivery requires reusable profile credentials. A legacy policy that
+requires campaign-local credentials fails closed with guidance to store them on
+the Mail profile and enable effective inheritance. This preserves compatibility
+of the policy model without reopening a consumer-owned secret store.
+
+Policy reads are available through system/tenant/context routes to suitably
+authorized actors. Adaptive Docs exposes a safe explanation of the effective
+tenant posture; it does not expose credential material.
+
+## Operations and recovery
+
+### Deployment egress policy
+
+Private-network connector access is controlled deployment-wide by
+`GOVOPLAN_CONNECTOR_ALLOW_PRIVATE_NETWORKS`. Whether private or public targets
+are allowed, SMTP and IMAP resolve, validate, and connect to the exact approved
+address records at connection time while retaining the original hostname for
+TLS SNI and certificate verification. A DNS change cannot redirect the socket
+after validation.
+
+Transports that cannot pin every connection peer or revalidate protocol-managed
+redirects/referrals must fail before client construction. Do not weaken this
+rule to make a target test pass; change the connector implementation or the
+target topology.
+
+### Response and time bounds
+
+The shared defaults are 16 MiB for structured connector responses and 512 MiB
+for file transfers. Mailbox full-message fetch additionally uses bounded IMAP
+ranges and the applicable deployment limit. Operators may lower limits for
+their environment. A declared or streamed over-limit response fails visibly
+rather than being retained partially as if complete.
+
+Configure connection/read timeouts and provider-specific message/attachment
+limits. A timeout after the SMTP effect may be an unknown outcome; it must not
+be flattened into a safe-to-retry connection failure.
+
+### Throttling
+
+Mail rate limiting uses a Redis lock and next-allowed timestamp across worker
+processes when worker mode is enabled. Direct development uses a process-local
+limiter. If Redis fails in worker mode, the current implementation silently
+falls back to a limiter that protects only that process; it does not provide
+cluster-wide coordination or emit its own health signal. Production operators
+must therefore monitor Redis independently and should stop or restrict
+multi-worker delivery during an outage until explicit degradation telemetry is
+implemented.
+
+### SMTP/IMAP incidents
+
+1. Stop new consumer work if duplicate effects or credential compromise are
+   possible.
+2. Preserve safe Mail, consumer-job, worker, and provider evidence.
+3. Rotate credentials in Mail. Rebuild consumers only if the revisioned
+   non-secret identity also changed.
+4. Treat post-command connection loss as potentially unknown until provider
+   evidence establishes whether SMTP accepted the message.
+5. Handle IMAP append failure independently; do not resend an accepted message
+   merely to recreate a Sent copy.
+6. Record the incident/reconciliation reference in the consuming domain's audit
+   trail without copying raw provider secrets or message content unnecessarily.
+
+### Backup, restore, and retirement
+
+Backups contain encrypted credentials and therefore need the same protection as
+the live database and key material. Restoring a Mail database without the
+matching encryption key makes credentials unusable; restoring it with keys can
+reactivate sensitive historical state and must be controlled.
+
+Destructive module retirement first applies the same immediate credential
+scrub/audit rule to every remaining profile, then drops Mail-owned tables after
+the installer snapshot/confirmation gate. Any scrub or audit failure blocks
+retirement. Historical backups are separate retained copies and require the
+deployment's approved backup-destruction policy.
+
+## Capability contract
+
+Mail provides `mail.campaign_delivery` version `0.2.x`. This version is a
+breaking ownership boundary: it exposes reference-oriented operations, not raw
+resolved configuration or credentials.
+
+The Mail REST API supplies the profile list used by pickers. Given a stable
+profile reference, the capability supports these kinds of operation:
+
+- resolve a profile reference and evaluate its Mail context/policy to produce a
+  non-secret delivery summary and
+  opaque Mail-owned revisions;
+- send Campaign-owned RFC message bytes using the selected profile;
+- optionally append an accepted message to Sent; and
+- return sanitized outcome/revision evidence.
+
+For a real effect, one Mail call must:
+
+1. resolve current campaign/tenant/owner context through the optional narrow
+   context capability;
+2. load the selected active profile;
+3. evaluate profile-scope eligibility and effective policy;
+4. compare the consumer's expected opaque transport revision;
+5. decrypt credentials in Mail memory;
+6. perform the SMTP or IMAP operation; and
+7. return only the safe result.
+
+Keeping comparison, credential resolution, and transport inside one operation
+avoids a time-of-check/time-of-use gap and prevents the consumer from becoming
+a credential-processing boundary. The capability does not receive the acting
+principal: the Campaign route must first enforce `mail:profile:use`, while Mail
+still re-evaluates active profile scope and contextual policy inside the call.
+
+Mail optionally consumes `campaigns.mail_policy_context` and
+`addresses.lookup`. Their physical absence must leave Mail installable and its
+unrelated profile/mailbox behavior usable. Interface-version compatibility is a
+mandatory release gate.
+
+## Security, deletion, and audit
+
+Security invariants:
+
+- Decrypted SMTP/IMAP passwords never cross the Mail capability/API boundary.
+- Password fields are write-only and encrypted at rest; safe responses expose
+  configuration state, not values.
+- Consumers persist stable profile references, not transport copies.
+- Host policy is deployment-wide and every supported connection is DNS/IP
+  pinned at socket creation.
+- Redirect/referral-capable transports fail closed unless every peer can be
+  revalidated and pinned.
+- Profile deletion and destructive retirement scrub every Mail-owned encrypted
+  password and emit non-secret audit in the same lifecycle action.
+- Mailbox reads are separately authorized, read-only, paginated, and bounded.
+- Logs/audit/results minimize message content, addresses, provider responses,
+  and secret-like values.
+
+Credential replacement/deletion emits canonical non-secret Mail audit events.
+Profile/policy create/update/deactivate currently emits change-feed evidence,
+but connection tests and the complete administrative lifecycle do not yet have
+equivalent canonical audit events. Consumer send/retry/reconciliation evidence
+belongs primarily to the consuming module today. A Mail-owned restricted
+provider-attempt ledger with correlation, retention, and unknown-outcome
+reconciliation remains part of the durable outbox work in
+[`govoplan-mail#17`](https://git.add-ideas.de/add-ideas/govoplan-mail/issues/17).
+
+## Acceptance checklist
+
+Before claiming a Mail composition is production-ready:
+
+1. Install Mail alone with Core and with each optional consumer absent.
+2. Prove profile scope, visibility, use, test, write, and secret permissions for
+   representative tenant/user/group contexts.
+3. Prove policy deny precedence, locked lower limits, approved-profile mode, and
+   the campaign-local-credential fail-closed path.
+4. Verify all read/list/capability/audit/log responses contain no plaintext or
+   encrypted password, raw credential token, or consumer-owned inline config.
+5. Test DNS rebinding resistance and private/public deployment policy for SMTP
+   and IMAP.
+6. Test SMTP acceptance, refusal, temporary/permanent failure, timeout/unknown
+   outcome, and IMAP append success/failure against the target provider.
+7. Test Redis worker throttling and prove that independent infrastructure
+   monitoring detects Redis loss; restrict multi-worker delivery during the
+   current silent local-only fallback.
+8. Delete tenant and system profiles, inject audit failure, repeat deletion, and
+   prove transactional scrub/rollback/idempotency.
+9. Run destructive-retirement preflight on a snapshot and prove credentials are
+   scrubbed/audited before table drop.
+10. Pass module permutations, interface/version alignment, WebUI/i18n, full
+    security audit, backup/restore, and target-environment release checks.
+
+## Explicitly planned, not yet claimed
+
+- Durable, idempotent Campaign report delivery with Mail-owned attempts,
+  unknown-outcome reconciliation, and partial-refusal evidence
+  ([`govoplan-mail#17`](https://git.add-ideas.de/add-ideas/govoplan-mail/issues/17)).
+- Canonical audit events for profile tests and the remaining profile/policy
+  administration lifecycle, plus an operator-visible Redis-throttling
+  degradation signal.
+- Reusable SMTP batch sessions and their final connection/error/isolation
+  semantics (`govoplan-mail#16`).
+- Final Campaign **test / single send / single resend** semantics; those are a
+  Campaign business-action contract built on Mail transport operations.
+- JMAP mailbox synchronization/search; it is preferred only after the IMAP MVP
+  is stable.
+- POP3 except for a future explicit legacy download/import requirement.
+- A full mail client with compose/reply/move/delete/read-state mutation.
+- Proof that process-local throttling coordinates multiple workers when Redis
+  is unavailable; it deliberately does not.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@govoplan/mail-webui",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "private": true,
   "type": "module",
   "main": "webui/src/index.ts",
@@ -19,7 +19,7 @@
     "LICENSE"
   ],
   "peerDependencies": {
-    "@govoplan/core-webui": "^0.1.8",
+    "@govoplan/core-webui": "^0.1.10",
     "lucide-react": "^1.23.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",

pyproject.toml

@@ -4,14 +4,14 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "govoplan-mail"
-version = "0.1.8"
+version = "0.1.10"
 description = "GovOPlaN mail module with backend and WebUI integration."
 readme = "README.md"
 requires-python = ">=3.12"
 license = { file = "LICENSE" }
 authors = [{ name = "GovOPlaN" }]
 dependencies = [
-  "govoplan-core>=0.1.8",
+  "govoplan-core>=0.1.9",
   "pydantic>=2,<3",
   "redis>=5,<6",
   "SQLAlchemy>=2,<3",

src/govoplan_mail/backend/capabilities.py

@@ -1,22 +1,299 @@
 from __future__ import annotations
 
+from dataclasses import dataclass
+from typing import Any
+
+from sqlalchemy.orm import Session
+
 from govoplan_core.core.modules import ModuleContext
-from govoplan_mail.backend.runtime import configure_runtime
 from govoplan_mail.backend.mail_profiles import (
     MailProfileError,
-    apply_campaign_credentials,
+    _assert_campaign_inherits_profile_credentials,
     assert_campaign_mail_policy_allows_json,
     assert_mail_policy_allows_send,
-    effective_profile_credentials_inherited,
+    campaign_profile_transport_revisions,
+    effective_mail_profile_policy,
     ensure_mail_profile_allowed_for_campaign,
+    get_mail_server_profile,
     imap_config_from_profile,
     mail_profile_id_from_campaign_json,
-    materialize_campaign_mail_profile_config,
     smtp_config_from_profile,
 )
-from govoplan_mail.backend.sending.imap import ImapAppendError, ImapConfigurationError, append_message_to_sent
+from govoplan_mail.backend.runtime import configure_runtime
+from govoplan_mail.backend.sending.imap import (
+    ImapAppendError,
+    ImapConfigurationError,
+    append_message_to_sent,
+)
 from govoplan_mail.backend.sending.rate_limit import wait_for_rate_limit
-from govoplan_mail.backend.sending.smtp import SmtpConfigurationError, SmtpSendError, send_email_bytes, send_email_message
+from govoplan_mail.backend.sending.smtp import SmtpConfigurationError, SmtpSendError, send_email_bytes
+
+
+@dataclass(frozen=True, slots=True)
+class CampaignSmtpDeliveryResult:
+    envelope_recipients: list[str]
+    refused_recipients: dict[str, dict[str, int | str]]
+
+    @property
+    def accepted_count(self) -> int:
+        return len(self.envelope_recipients) - len(self.refused_recipients)
+
+
+@dataclass(frozen=True, slots=True)
+class CampaignImapAppendResult:
+    folder: str
+
+
+def _sanitized_refusals(
+    refused_recipients: dict[str, tuple[int, bytes | str]],
+) -> dict[str, dict[str, int | str]]:
+    sanitized: dict[str, dict[str, int | str]] = {}
+    for recipient, (raw_code, _provider_message) in refused_recipients.items():
+        try:
+            code = int(raw_code)
+        except (TypeError, ValueError):
+            code = 0
+        if 400 <= code < 500:
+            classification = "temporary"
+            message = "Temporary recipient rejection"
+        elif 500 <= code < 600:
+            classification = "permanent"
+            message = "Permanent recipient rejection"
+        else:
+            classification = "unknown"
+            message = "Recipient rejected"
+        sanitized[str(recipient)] = {
+            "status_code": code,
+            "classification": classification,
+            "message": message,
+        }
+    return sanitized
+
+
+def _sanitized_smtp_error(exc: SmtpSendError) -> SmtpSendError:
+    if exc.outcome_unknown:
+        message = "Mail delivery outcome is unknown after transmission started."
+    elif exc.temporary:
+        message = "Mail delivery failed temporarily."
+    else:
+        message = "Mail delivery was rejected."
+    return SmtpSendError(
+        message,
+        temporary=exc.temporary,
+        outcome_unknown=exc.outcome_unknown,
+    )
+
+
+def _sanitized_imap_error(exc: ImapAppendError) -> ImapAppendError:
+    if exc.outcome_unknown:
+        message = "The Sent-folder append outcome is unknown; inspect the mailbox before retrying."
+    elif exc.temporary:
+        message = "Appending the sent message failed temporarily."
+    else:
+        message = "Appending the sent message was rejected."
+    return ImapAppendError(
+        message,
+        temporary=exc.temporary,
+        outcome_unknown=exc.outcome_unknown,
+    )
+
+
+def _authorized_campaign_profile(
+    session: Session,
+    *,
+    tenant_id: str,
+    campaign_id: str,
+    profile_id: str,
+):
+    profile = ensure_mail_profile_allowed_for_campaign(
+        session,
+        tenant_id=tenant_id,
+        campaign_id=campaign_id,
+        profile_id=profile_id,
+        require_active=True,
+    )
+    policy = effective_mail_profile_policy(session, tenant_id=tenant_id, campaign_id=campaign_id)
+    _assert_campaign_inherits_profile_credentials(profile, policy)
+    return profile
+
+
+def campaign_profile_delivery_summary(
+    session: Session,
+    *,
+    tenant_id: str,
+    profile_id: str,
+    campaign_id: str | None = None,
+    owner_user_id: str | None = None,
+    owner_group_id: str | None = None,
+) -> dict[str, Any]:
+    """Return only non-secret capabilities and opaque drift evidence."""
+
+    if campaign_id:
+        profile = _authorized_campaign_profile(
+            session,
+            tenant_id=tenant_id,
+            campaign_id=campaign_id,
+            profile_id=profile_id,
+        )
+    else:
+        assert_campaign_mail_policy_allows_json(
+            session,
+            tenant_id=tenant_id,
+            raw_json={"server": {"mail_profile_id": profile_id}},
+            owner_user_id=owner_user_id,
+            owner_group_id=owner_group_id,
+        )
+        profile = get_mail_server_profile(
+            session,
+            tenant_id=tenant_id,
+            profile_id=profile_id,
+            require_active=True,
+        )
+    revisions = campaign_profile_transport_revisions(profile)
+    smtp = profile.smtp_config or {}
+    imap = profile.imap_config or {}
+    return {
+        "mail_profile_id": profile_id,
+        "smtp_available": bool(smtp.get("host") and smtp.get("port")),
+        "imap_available": bool(imap.get("host") and imap.get("port")),
+        "smtp_transport_revision": revisions["smtp"],
+        "imap_transport_revision": revisions["imap"],
+    }
+
+
+def send_campaign_email_bytes(
+    session: Session,
+    *,
+    tenant_id: str,
+    campaign_id: str,
+    profile_id: str,
+    message_bytes: bytes,
+    envelope_from: str,
+    envelope_recipients: list[str],
+    from_header: str | None,
+    expected_smtp_transport_revision: str,
+) -> CampaignSmtpDeliveryResult:
+    try:
+        profile = _authorized_campaign_profile(
+            session,
+            tenant_id=tenant_id,
+            campaign_id=campaign_id,
+            profile_id=profile_id,
+        )
+    except MailProfileError:
+        raise
+    except Exception:
+        raise SmtpConfigurationError("The selected Mail profile's SMTP configuration is unusable.") from None
+    revisions = campaign_profile_transport_revisions(profile)
+    if revisions["smtp"] != expected_smtp_transport_revision:
+        raise MailProfileError(
+            "The selected Mail profile's SMTP settings changed after this campaign was built. "
+            "Revalidate and rebuild the campaign before delivery."
+        )
+    try:
+        smtp = smtp_config_from_profile(profile)
+    except MailProfileError:
+        raise
+    except Exception:
+        raise SmtpConfigurationError("The selected Mail profile's SMTP configuration is unusable.") from None
+    try:
+        assert_mail_policy_allows_send(
+            session,
+            tenant_id=tenant_id,
+            campaign_id=campaign_id,
+            smtp=smtp,
+            imap=profile.imap_config or None,
+            envelope_sender=envelope_from,
+            from_header=from_header,
+            recipients=envelope_recipients,
+        )
+    except MailProfileError:
+        raise MailProfileError("Mail delivery is blocked by the effective Mail policy.") from None
+    try:
+        result = send_email_bytes(
+            message_bytes,
+            smtp_config=smtp,
+            envelope_from=envelope_from,
+            envelope_recipients=envelope_recipients,
+        )
+    except SmtpSendError as exc:
+        raise _sanitized_smtp_error(exc) from None
+    except SmtpConfigurationError:
+        raise SmtpConfigurationError("The selected Mail profile's SMTP configuration is unusable.") from None
+    except Exception:
+        raise SmtpSendError(
+            "Mail delivery outcome is unknown after the provider effect started.",
+            outcome_unknown=True,
+        ) from None
+    return CampaignSmtpDeliveryResult(
+        envelope_recipients=list(result.envelope_recipients),
+        refused_recipients=_sanitized_refusals(result.refused_recipients),
+    )
+
+
+def append_campaign_message_to_sent(
+    session: Session,
+    *,
+    tenant_id: str,
+    campaign_id: str,
+    profile_id: str,
+    message_bytes: bytes,
+    folder: str | None,
+    expected_smtp_transport_revision: str,
+    expected_imap_transport_revision: str | None,
+) -> CampaignImapAppendResult:
+    try:
+        profile = _authorized_campaign_profile(
+            session,
+            tenant_id=tenant_id,
+            campaign_id=campaign_id,
+            profile_id=profile_id,
+        )
+    except MailProfileError:
+        raise
+    except Exception:
+        raise ImapConfigurationError("The selected Mail profile's IMAP configuration is unusable.") from None
+    revisions = campaign_profile_transport_revisions(profile)
+    if revisions["smtp"] != expected_smtp_transport_revision:
+        raise MailProfileError(
+            "The selected Mail profile's SMTP settings changed after this campaign was built. "
+            "Revalidate and rebuild the campaign before append-to-Sent delivery."
+        )
+    if revisions["imap"] != expected_imap_transport_revision:
+        raise MailProfileError(
+            "The selected Mail profile's IMAP settings changed after this campaign was built. "
+            "Revalidate and rebuild the campaign before append-to-Sent delivery."
+        )
+    try:
+        imap = imap_config_from_profile(profile)
+    except MailProfileError:
+        raise
+    except Exception:
+        raise ImapConfigurationError("The selected Mail profile's IMAP configuration is unusable.") from None
+    if imap is None:
+        raise ImapConfigurationError("The selected Mail profile has no IMAP configuration")
+    try:
+        assert_mail_policy_allows_send(
+            session,
+            tenant_id=tenant_id,
+            campaign_id=campaign_id,
+            smtp=profile.smtp_config or None,
+            imap=imap,
+        )
+    except MailProfileError:
+        raise MailProfileError("Appending to Sent is blocked by the effective Mail policy.") from None
+    try:
+        result = append_message_to_sent(message_bytes, imap_config=imap, folder=folder)
+    except ImapAppendError as exc:
+        raise _sanitized_imap_error(exc) from None
+    except ImapConfigurationError:
+        raise ImapConfigurationError("The selected Mail profile's IMAP configuration is unusable.") from None
+    except Exception:
+        raise ImapAppendError(
+            "The Sent-folder append outcome is unknown; inspect the mailbox before retrying.",
+            outcome_unknown=True,
+        ) from None
+    return CampaignImapAppendResult(folder=result.folder)
 
 
 class MailCampaignCapability:
@@ -25,19 +302,12 @@ class MailCampaignCapability:
     SmtpSendError = SmtpSendError
     ImapConfigurationError = ImapConfigurationError
     ImapAppendError = ImapAppendError
-    materialize_campaign_mail_profile_config = staticmethod(materialize_campaign_mail_profile_config)
     assert_campaign_mail_policy_allows_json = staticmethod(assert_campaign_mail_policy_allows_json)
-    assert_mail_policy_allows_send = staticmethod(assert_mail_policy_allows_send)
     mail_profile_id_from_campaign_json = staticmethod(mail_profile_id_from_campaign_json)
-    ensure_mail_profile_allowed_for_campaign = staticmethod(ensure_mail_profile_allowed_for_campaign)
+    campaign_profile_delivery_summary = staticmethod(campaign_profile_delivery_summary)
-    smtp_config_from_profile = staticmethod(smtp_config_from_profile)
+    send_campaign_email_bytes = staticmethod(send_campaign_email_bytes)
-    imap_config_from_profile = staticmethod(imap_config_from_profile)
+    append_campaign_message_to_sent = staticmethod(append_campaign_message_to_sent)
-    effective_profile_credentials_inherited = staticmethod(effective_profile_credentials_inherited)
-    apply_campaign_credentials = staticmethod(apply_campaign_credentials)
     wait_for_rate_limit = staticmethod(wait_for_rate_limit)
-    send_email_bytes = staticmethod(send_email_bytes)
-    append_message_to_sent = staticmethod(append_message_to_sent)
-    send_email_message = staticmethod(send_email_message)
 
     @staticmethod
     def mock_mailbox():

src/govoplan_mail/backend/db/models.py

@@ -33,9 +33,11 @@ class MailServerProfile(Base, TimestampMixin):
     smtp_config: Mapped[dict[str, Any]] = mapped_column(JSON, default=dict, nullable=False)
     smtp_username: Mapped[str | None] = mapped_column(String(320))
     smtp_password_encrypted: Mapped[str | None] = mapped_column(Text)
+    smtp_transport_revision: Mapped[str] = mapped_column(String(36), default=new_uuid, nullable=False)
     imap_config: Mapped[dict[str, Any] | None] = mapped_column(JSON, nullable=True)
     imap_username: Mapped[str | None] = mapped_column(String(320))
     imap_password_encrypted: Mapped[str | None] = mapped_column(Text)
+    imap_transport_revision: Mapped[str] = mapped_column(String(36), default=new_uuid, nullable=False)
     created_by_user_id: Mapped[str | None] = mapped_column(ForeignKey("access_users.id", ondelete="SET NULL"), nullable=True, index=True)
     updated_by_user_id: Mapped[str | None] = mapped_column(ForeignKey("access_users.id", ondelete="SET NULL"), nullable=True, index=True)
 

src/govoplan_mail/backend/documentation.py

@@ -4,15 +4,35 @@ from typing import Any
 
 from sqlalchemy.orm import Session
 
-from govoplan_core.core.modules import DocumentationContext, DocumentationLink, DocumentationTopic
+from govoplan_core.core.modules import DocumentationCondition, DocumentationContext, DocumentationLink, DocumentationTopic
-from govoplan_mail.backend.mail_profiles import MailProfileError, effective_mail_profile_policy_for_scope
+from govoplan_mail.backend.mail_profiles import (
+    EffectiveMailProfilePolicy,
+    MailProfileError,
+    effective_mail_profile_policy_for_scope,
+)
 
 MAIL_POLICY_DOC_SCOPES = ("mail:profile:read", "admin:policies:read", "system:settings:read")
+MAIL_PROFILE_READ_SCOPE = "mail:profile:read"
+MAIL_PROFILE_WRITE_SCOPE = "mail:profile:write"
+MAIL_PROFILE_WRITE_OWN_SCOPE = "mail:profile:write_own"
+# RBAC permission identifiers; neither value is a stored credential.
+MAIL_SECRET_MANAGE_SCOPE = "mail:secret:manage"  # noqa: S105  # nosec B105
+MAIL_SECRET_MANAGE_OWN_SCOPE = "mail:secret:manage_own"  # noqa: S105  # nosec B105
+MAIL_PROFILE_TEST_SCOPE = "mail:profile:test"
+MAIL_PROFILE_USE_SCOPE = "mail:profile:use"
+_HOST_POLICY_FIELDS = (("SMTP", "smtp_hosts"), ("IMAP", "imap_hosts"))
 
 
 def documentation_topics(context: DocumentationContext) -> tuple[DocumentationTopic, ...]:
-    topic = _tenant_mail_policy_topic(context)
+    topics = [
-    return (topic,) if topic is not None else ()
+        topic
+        for topic in (
+            _tenant_mail_policy_topic(context),
+            _custom_mail_profile_topic(context),
+        )
+        if topic is not None
+    ]
+    return tuple(topics)
 
 
 def _tenant_mail_policy_topic(context: DocumentationContext) -> DocumentationTopic | None:
@@ -29,17 +49,26 @@ def _tenant_mail_policy_topic(context: DocumentationContext) -> DocumentationTop
     try:
         policy = effective_mail_profile_policy_for_scope(session, tenant_id=tenant_id, scope_type="tenant")
     except MailProfileError as exc:
+        user_documentation = context.documentation_type == "user"
         return DocumentationTopic(
             id="mail.tenant-profile-policy-unavailable",
             title="Mail server policy could not be evaluated",
             summary="Mail profile documentation is installed, but the tenant-level effective policy could not be read for this request.",
-            body=str(exc),
+            body=(
+                "The current Mail policy could not be loaded. Try again or ask a Mail administrator for help."
+                if user_documentation
+                else str(exc)
+            ),
             layer="available",
             documentation_types=(context.documentation_type,),
             source_module_id="mail",
             order=41,
-            links=(_mail_policy_api_link(),),
+            links=(
-            metadata={"error_type": type(exc).__name__},
+                (DocumentationLink(label="Public mail help", href="https://govplan.add-ideas.de/modules/mail", kind="public"),)
+                if user_documentation
+                else (_mail_policy_api_link(),)
+            ),
+            metadata={} if user_documentation else {"error_type": type(exc).__name__},
         )
 
     effective = policy.as_dict()
@@ -90,6 +119,243 @@ def _tenant_mail_policy_topic(context: DocumentationContext) -> DocumentationTop
     )
 
 
+def _custom_mail_profile_topic(context: DocumentationContext) -> DocumentationTopic | None:
+    if context.documentation_type != "user":
+        return None
+    principal = context.principal
+    if not _has_any_scope(principal, (MAIL_PROFILE_WRITE_SCOPE, MAIL_PROFILE_WRITE_OWN_SCOPE)):
+        return None
+    if not _has_all_scopes(principal, (MAIL_PROFILE_READ_SCOPE,)):
+        return None
+    tenant_id = str(getattr(principal, "tenant_id", "") or "")
+    user_id = str(getattr(getattr(principal, "user", None), "id", "") or "")
+    session = context.session
+    if not tenant_id or not user_id or not isinstance(session, Session):
+        return None
+
+    try:
+        policy = effective_mail_profile_policy_for_scope(
+            session,
+            tenant_id=tenant_id,
+            scope_type="user",
+            scope_id=user_id,
+        )
+    except MailProfileError:
+        # A user-facing runtime topic must not turn internal policy resolution
+        # details into documentation output. The task simply remains absent
+        # until its effective policy can be proven.
+        return None
+    if not policy.allow_user_profiles:
+        return None
+
+    can_manage_credentials = _has_any_scope(
+        principal,
+        (MAIL_SECRET_MANAGE_SCOPE, MAIL_SECRET_MANAGE_OWN_SCOPE),
+    )
+    can_test_profile = _has_all_scopes(principal, (MAIL_PROFILE_TEST_SCOPE, MAIL_PROFILE_USE_SCOPE))
+    can_use_profile = _has_any_scope(principal, (MAIL_PROFILE_USE_SCOPE,))
+    approval_required = bool(policy.allowed_profile_id_sets)
+    constraints = _host_policy_constraint_records(policy)
+    authority_lines = _custom_profile_authority_lines(
+        can_manage_credentials=can_manage_credentials,
+        can_test_profile=can_test_profile,
+        can_use_profile=can_use_profile,
+        approval_required=approval_required,
+    )
+    steps = _custom_profile_steps(
+        can_manage_credentials=can_manage_credentials,
+        can_test_profile=can_test_profile,
+        can_use_profile=can_use_profile,
+        approval_required=approval_required,
+    )
+    return DocumentationTopic(
+        id="mail.workflow.create-custom-profile",
+        title="Create a custom Mail profile",
+        summary=(
+            "Create a reusable profile in the current account's user-scoped Settings view, "
+            "within the active SMTP and IMAP hostname policy."
+        ),
+        body="\n".join(authority_lines),
+        layer="configured",
+        documentation_types=("user",),
+        audience=("mail_profile_author", "campaign_manager"),
+        order=41,
+        conditions=(
+            DocumentationCondition(
+                required_modules=("mail",),
+                required_scopes=(MAIL_PROFILE_READ_SCOPE,),
+                any_scopes=(MAIL_PROFILE_WRITE_SCOPE, MAIL_PROFILE_WRITE_OWN_SCOPE),
+                configuration_keys=("mail_profile_policy",),
+            ),
+        ),
+        links=(
+            DocumentationLink(label="My Mail profiles", href="/settings?section=mail-profiles", kind="runtime"),
+            DocumentationLink(label="Public mail help", href="https://govplan.add-ideas.de/modules/mail", kind="public"),
+        ),
+        related_modules=("campaigns",),
+        unlocks=("A custom Mail-owned transport definition that authorized tasks can reference after all policy checks pass.",),
+        configuration_keys=("mail_profile_policy",),
+        i18n_key="mail.topic.create_custom_profile",
+        source_module_id="mail",
+        metadata={
+            "kind": "workflow",
+            "route": "/settings?section=mail-profiles",
+            "screen": "My Mail profiles",
+            "help_contexts": ["mail.profiles", "app.settings"],
+            "prerequisites": [
+                "The Mail profile editor is available in Settings and opens in the current account's user scope.",
+                "The effective Mail policy permits user-scoped profiles.",
+            ],
+            "steps": list(steps),
+            "outcome": "A user-scoped custom Mail profile is saved without copying its credentials into a consuming module.",
+            "current_configuration": list(authority_lines),
+            "constraints": list(constraints),
+            "verification": _custom_profile_verification(
+                can_test_profile=can_test_profile,
+                can_use_profile=can_use_profile,
+                approval_required=approval_required,
+            ),
+            "can_manage_credentials": can_manage_credentials,
+            "can_test_profile": can_test_profile,
+            "can_use_profile": can_use_profile,
+            "approval_required_before_use": approval_required,
+            "related_topic_ids": [
+                "mail.workflow.choose-and-test-profile",
+                "mail.profile-ownership-and-consumers",
+                "mail.profiles-and-policy",
+            ],
+        },
+    )
+
+
+def _host_policy_constraint_records(policy: EffectiveMailProfilePolicy) -> tuple[dict[str, Any], ...]:
+    constraints: list[dict[str, Any]] = []
+    for label, key in _HOST_POLICY_FIELDS:
+        prefix = label.casefold()
+        denied = _display_patterns(policy.blacklist_patterns.get(key, []))
+        constraints.append({
+            "id": f"{prefix}-host-deny",
+            "label": f"{label} denied hosts",
+            "description": (
+                "Deny rules are checked first. The hostname must not match any listed pattern."
+                if denied
+                else "Deny rules are checked first. No hostname deny pattern is active."
+            ),
+            **({"values": list(denied)} if denied else {}),
+        })
+        allowed_groups = tuple(
+            group
+            for group in (_display_patterns(items) for items in policy.whitelist_groups.get(key, []))
+            if group
+        )
+        if not allowed_groups:
+            constraints.append({
+                "id": f"{prefix}-host-allow",
+                "label": f"{label} allowed hosts",
+                "description": "After deny checks, no hostname allow-list group is active.",
+            })
+            continue
+        for index, group in enumerate(allowed_groups, start=1):
+            constraints.append({
+                "id": f"{prefix}-host-allow-{index}",
+                "label": f"{label} allowed hosts — group {index}",
+                "description": (
+                    "After deny checks, the hostname must match at least one pattern in this group. "
+                    "It must satisfy every active allow-list group shown for this protocol."
+                ),
+                "values": list(group),
+            })
+    return tuple(constraints)
+
+
+def _display_patterns(patterns: list[str]) -> tuple[str, ...]:
+    result: list[str] = []
+    for pattern in patterns:
+        value = str(pattern).strip()
+        if value and value not in result:
+            result.append(value)
+    return tuple(result)
+
+
+def _custom_profile_authority_lines(
+    *,
+    can_manage_credentials: bool,
+    can_test_profile: bool,
+    can_use_profile: bool,
+    approval_required: bool,
+) -> tuple[str, ...]:
+    credentials = (
+        "Credential authority: you may save or replace Mail-owned SMTP/IMAP passwords."
+        if can_manage_credentials
+        else "Credential authority: you may define the profile, but you cannot save or replace passwords; an actor with both profile-write and secret-management authority must do that when authentication requires one."
+    )
+    testing = (
+        "Test authority: you may run the profile's SMTP/IMAP connection tests after saving it as active."
+        if can_test_profile
+        else "Test authority: creating the profile does not let you run connection tests; ask an actor with both profile-test and profile-use authority to verify an active profile."
+    )
+    use = (
+        "Use authority: you may select the profile in an authorized task after its contextual policy checks pass."
+        if can_use_profile
+        else "Use authority: creating the profile does not let you select or use it; separate Mail profile use authority is required."
+    )
+    approval = (
+        "Approval: an approved-profile list is active. A newly generated profile reference must be approved before the profile can be selected or used."
+        if approval_required
+        else "Approval: no approved-profile list currently blocks a newly created profile, but each consuming task still rechecks its contextual policy."
+    )
+    return credentials, testing, use, approval
+
+
+def _custom_profile_steps(
+    *,
+    can_manage_credentials: bool,
+    can_test_profile: bool,
+    can_use_profile: bool,
+    approval_required: bool,
+) -> tuple[str, ...]:
+    steps = [
+        "Open Settings, choose Mail profiles, and select Add profile in the current account's user-scoped view.",
+        "Enter a stable name and configure SMTP plus optional IMAP hostnames that satisfy every host-policy statement shown above.",
+    ]
+    steps.append(
+        "Enter the required SMTP/IMAP credentials in the dedicated password fields."
+        if can_manage_credentials
+        else "Save the non-secret profile definition, then ask an actor with both profile-write and secret-management authority to add credentials if the server requires authentication."
+    )
+    steps.append("Save the profile; Mail validates the effective user-scope host policy again on the server.")
+    steps.append(
+        "Save the profile as active, then run the available SMTP and IMAP connection tests."
+        if can_test_profile
+        else "Ask an actor with both profile-test and profile-use authority to run the SMTP and IMAP connection tests after the profile is active."
+    )
+    if approval_required:
+        steps.append("Ask a Mail administrator to add the new profile to the active approved-profile list.")
+    steps.append(
+        "Select the profile from the consuming task's picker and complete that task's contextual validation."
+        if can_use_profile
+        else "Ask an actor with Mail profile use authority to select it in the consuming task after approval and testing."
+    )
+    return tuple(steps)
+
+
+def _custom_profile_verification(*, can_test_profile: bool, can_use_profile: bool, approval_required: bool) -> str:
+    checks = ["Reopen My Mail profiles and confirm the saved profile remains in the current account's user-scoped view."]
+    checks.append(
+        "Confirm the authorized SMTP/IMAP tests succeed."
+        if can_test_profile
+        else "Have an authorized tester confirm the SMTP/IMAP tests succeed."
+    )
+    if approval_required:
+        checks.append("Confirm an administrator approved the generated profile reference before expecting it in a picker.")
+    checks.append(
+        "Confirm the intended task can select it and passes its own policy validation."
+        if can_use_profile
+        else "Confirm a separately authorized user can select it and passes the consuming task's policy validation."
+    )
+    return " ".join(checks)
+
+
 def _mail_policy_admin_text(policy: dict[str, Any], *, source_count: int) -> tuple[str, str]:
     allowed_profile_ids = policy.get("allowed_profile_ids")
     lower_scopes = _allowed_lower_scopes(policy)
@@ -124,11 +390,11 @@ def _mail_policy_user_text(policy: dict[str, Any]) -> tuple[str, str]:
         summary = "You can choose from approved mail servers, but you cannot add your own mail server for this tenant."
         body = "This is set by tenant policy. If the mail server you need is not offered, ask an administrator to add it as an approved mail profile."
     elif approved_profile_limit:
-        summary = "You can use approved mail servers. Some local mail-server settings may also be allowed, depending on where you work."
+        summary = "You can use approved Mail profiles. Some scopes may also define additional reusable profiles."
-        body = "The available choices are limited by tenant policy. If you are working in a user, group, or campaign area that allows local settings, GovOPlaN still checks the server, sender, recipient, and credential rules."
+        body = "The available profiles are limited by tenant policy. Campaigns select one profile by reference; SMTP/IMAP settings and credentials remain managed in Mail."
     elif lower_scopes:
-        summary = "You may be able to add a mail server in selected areas, as long as it follows the active tenant rules."
+        summary = "You may be able to define reusable Mail profiles in selected scopes, subject to tenant rules."
-        body = "GovOPlaN checks mail server settings before they are used. If a setting is blocked, it usually means the tenant has limited hosts, senders, recipients, or credentials."
+        body = "GovOPlaN checks each profile before use. Campaigns reference an available profile and never store its SMTP/IMAP settings or credentials."
     else:
         summary = "Mail servers are managed centrally for this tenant."
         body = "You cannot add a personal, group, or campaign mail server here. Choose one of the configured options or ask an administrator to add another approved profile."
@@ -151,16 +417,16 @@ def _user_mail_policy_translations(policy: dict[str, Any]) -> dict[str, dict[str
         return {
             "de": {
                 "title": "Mailserver auswaehlen",
-                "summary": "Sie koennen freigegebene Mailserver nutzen. In manchen Bereichen koennen zusaetzliche lokale Einstellungen erlaubt sein.",
+                "summary": "Sie koennen freigegebene Mailprofile nutzen. In manchen Bereichen koennen weitere wiederverwendbare Profile angelegt werden.",
-                "body": "Die Auswahl wird durch Tenant-Regeln begrenzt. Auch wenn lokale Einstellungen erlaubt sind, prueft GovOPlaN Server, Absender, Empfaenger und Zugangsdaten.",
+                "body": "Die Auswahl wird durch Tenant-Regeln begrenzt. Kampagnen speichern nur die Profilreferenz; SMTP-/IMAP-Einstellungen und Zugangsdaten verbleiben im Mail-Modul.",
             },
         }
     if lower_scopes:
         return {
             "de": {
                 "title": "Mailserver auswaehlen",
-                "summary": "In bestimmten Bereichen koennen Sie einen Mailserver eintragen, solange die aktiven Tenant-Regeln eingehalten werden.",
+                "summary": "In bestimmten Bereichen koennen Sie wiederverwendbare Mailprofile anlegen, solange die aktiven Tenant-Regeln eingehalten werden.",
-                "body": "GovOPlaN prueft Mailserver-Einstellungen, bevor sie verwendet werden. Wenn eine Einstellung blockiert wird, begrenzen die Tenant-Regeln meist Server, Absender, Empfaenger oder Zugangsdaten.",
+                "body": "GovOPlaN prueft jedes Profil vor der Verwendung. Kampagnen referenzieren ein freigegebenes Profil und speichern keine SMTP-/IMAP-Einstellungen oder Zugangsdaten.",
             },
         }
     return {
@@ -190,7 +456,11 @@ def _lower_scope_line(lower_scopes: tuple[str, ...]) -> str:
 def _credential_line(policy: dict[str, Any]) -> str:
     smtp_inherit = bool((policy.get("smtp_credentials") or {}).get("inherit", True))
     imap_inherit = bool((policy.get("imap_credentials") or {}).get("inherit", True))
-    return f"Credential inheritance: SMTP {'inherits' if smtp_inherit else 'requires local credentials'}; IMAP {'inherits' if imap_inherit else 'requires local credentials'}."
+    return (
+        f"Credential inheritance: SMTP {'inherits' if smtp_inherit else 'requires local credentials'}; "
+        f"IMAP {'inherits' if imap_inherit else 'requires local credentials'}. "
+        "Campaign delivery is available only for protocols that inherit credentials from the selected Mail profile."
+    )
 
 
 def _allowed_lower_scopes(policy: dict[str, Any]) -> tuple[str, ...]:
@@ -255,5 +525,16 @@ def _has_any_scope(principal: object | None, scopes: tuple[str, ...]) -> bool:
     return "*" in principal_scopes or any(scope in principal_scopes for scope in scopes)
 
 
+def _has_all_scopes(principal: object | None, scopes: tuple[str, ...]) -> bool:
+    has = getattr(principal, "has", None)
+    if callable(has):
+        try:
+            return all(bool(has(scope)) for scope in scopes)
+        except Exception:
+            return False
+    principal_scopes = set(getattr(principal, "scopes", ()) or ())
+    return "*" in principal_scopes or all(scope in principal_scopes for scope in scopes)
+
+
 def _mail_policy_api_link() -> DocumentationLink:
     return DocumentationLink(label="Tenant mail policy API", href="/api/v1/mail/policies/tenant", kind="api")

src/govoplan_mail/backend/mailbox_index.py

@@ -36,6 +36,27 @@ class CachedMessagePage:
     stale: bool
 
 
+def clear_mailbox_index(session: Session, *, profile_id: str) -> tuple[int, int]:
+    """Remove every cached mailbox row for a profile in the caller's transaction.
+
+    System profiles can be used by more than one tenant, so invalidation is
+    intentionally profile-wide rather than limited to the tenant making the
+    transport change. Message rows are removed before their folder metadata.
+    """
+
+    deleted_messages = (
+        session.query(MailMailboxMessageIndex)
+        .filter(MailMailboxMessageIndex.profile_id == profile_id)
+        .delete(synchronize_session=False)
+    )
+    deleted_folders = (
+        session.query(MailMailboxFolderIndex)
+        .filter(MailMailboxFolderIndex.profile_id == profile_id)
+        .delete(synchronize_session=False)
+    )
+    return int(deleted_folders or 0), int(deleted_messages or 0)
+
+
 def begin_mailbox_refresh(tenant_id: str, profile_id: str, folder: str) -> bool:
     key = (tenant_id, profile_id, folder)
     with _refresh_lock:

src/govoplan_mail/backend/manifest.py

@@ -1,7 +1,10 @@
 from __future__ import annotations
 
+from dataclasses import replace
 from pathlib import Path
 
+from sqlalchemy import inspect
+
 from govoplan_core.core.access import CAPABILITY_AUTH_PERMISSION_EVALUATOR, CAPABILITY_AUTH_PRINCIPAL_RESOLVER
 from govoplan_core.core.module_guards import drop_table_retirement_provider, persistent_table_uninstall_guard
 from govoplan_core.core.modules import (
@@ -23,6 +26,40 @@ from govoplan_mail.backend.documentation import documentation_topics
 from govoplan_mail.backend.db import models as mail_models  # noqa: F401 - populate Mail ORM metadata
 
 
+_mail_table_retirement_provider = drop_table_retirement_provider(
+    mail_models.MailServerProfile,
+    mail_models.MailProfilePolicy,
+    mail_models.MailMailboxFolderIndex,
+    mail_models.MailMailboxMessageIndex,
+    label="Mail",
+)
+
+
+def _mail_retirement_provider(session: object | None, module_id: str):
+    plan = _mail_table_retirement_provider(session, module_id)
+    base_executor = plan.destroy_data_executor
+    if base_executor is None:
+        return plan
+
+    def executor(execute_session: object, execute_module_id: str) -> None:
+        if not hasattr(execute_session, "get_bind") or not hasattr(execute_session, "query"):
+            raise RuntimeError("No database session is available for Mail credential retirement.")
+        if inspect(execute_session.get_bind()).has_table(mail_models.MailServerProfile.__tablename__):
+            from govoplan_mail.backend.mail_profiles import delete_mail_profile_credentials_for_retirement
+
+            delete_mail_profile_credentials_for_retirement(execute_session)
+        base_executor(execute_session, execute_module_id)
+
+    return replace(
+        plan,
+        destroy_data_warnings=(
+            *plan.destroy_data_warnings,
+            "Mail-owned encrypted SMTP/IMAP passwords are scrubbed with non-secret audit records immediately before tables are dropped; any scrub or audit failure blocks retirement.",
+        ),
+        destroy_data_executor=executor,
+    )
+
+
 def _permission(scope: str, label: str, description: str) -> PermissionDefinition:
     module_id, resource, action = scope.split(":", 2)
     return PermissionDefinition(
@@ -43,7 +80,17 @@ PERMISSIONS = (
     _permission("mail:profile:test", "Test mail profiles", "Run SMTP/IMAP connection tests."),
     _permission("mail:mailbox:read", "Read mailboxes", "List IMAP folders and inspect messages without mutating mailbox state."),
     _permission("mail:profile:write", "Manage mail profiles", "Create and edit reusable mail profiles."),
+    _permission(
+        "mail:profile:write_own",
+        "Manage own mail profiles",
+        "Create, edit, and deactivate only the current account's user-scoped mail profiles within effective policy.",
+    ),
     _permission("mail:secret:manage", "Manage mail secrets", "Create or replace stored SMTP/IMAP credentials."),
+    _permission(
+        "mail:secret:manage_own",
+        "Manage own mail secrets",
+        "Create, replace, and delete credentials only for the current account's user-scoped mail profiles.",
+    ),
 )
 
 ROLE_TEMPLATES = (
@@ -66,6 +113,19 @@ ROLE_TEMPLATES = (
         description="Use and test approved mail profiles without reading secrets.",
         permissions=("mail:profile:read", "mail:profile:use", "mail:profile:test", "mail:mailbox:read"),
     ),
+    RoleTemplate(
+        slug="mail_profile_self_service",
+        name="Mail profile self-service user",
+        description="Create and manage only personal Mail profiles and credentials within effective policy.",
+        permissions=(
+            "mail:profile:read",
+            "mail:profile:use",
+            "mail:profile:test",
+            "mail:mailbox:read",
+            "mail:profile:write_own",
+            "mail:secret:manage_own",
+        ),
+    ),
 )
 
 
@@ -89,13 +149,19 @@ def _mail_router(context: ModuleContext):
 manifest = ModuleManifest(
     id="mail",
     name="Mail",
-    version="0.1.8",
+    version="0.1.10",
     required_capabilities=(CAPABILITY_AUTH_PRINCIPAL_RESOLVER, CAPABILITY_AUTH_PERMISSION_EVALUATOR),
     optional_dependencies=("campaigns", "addresses"),
     provides_interfaces=(
-        ModuleInterfaceProvider(name="mail.campaign_delivery", version="0.1.6"),
+        ModuleInterfaceProvider(name="mail.campaign_delivery", version="0.2.0"),
     ),
     requires_interfaces=(
+        ModuleInterfaceRequirement(
+            name="campaigns.access",
+            version_min="0.1.0",
+            version_max_exclusive="0.2.0",
+            optional=True,
+        ),
         ModuleInterfaceRequirement(
             name="campaigns.mail_policy_context",
             version_min="0.1.0",
@@ -123,14 +189,8 @@ manifest = ModuleManifest(
         metadata=Base.metadata,
         script_location=str(Path(__file__).with_name("migrations") / "versions"),
         retirement_supported=True,
-        retirement_provider=drop_table_retirement_provider(
+        retirement_provider=_mail_retirement_provider,
-            mail_models.MailServerProfile,
+        retirement_notes="Destructive retirement first scrubs and audits Mail-owned credentials, then drops Mail-owned database tables after the installer captures a database snapshot.",
-            mail_models.MailProfilePolicy,
-            mail_models.MailMailboxFolderIndex,
-            mail_models.MailMailboxMessageIndex,
-            label="Mail",
-        ),
-        retirement_notes="Destructive retirement drops mail-owned database tables after the installer captures a database snapshot.",
     ),
     uninstall_guard_providers=(
         persistent_table_uninstall_guard(
@@ -149,7 +209,7 @@ manifest = ModuleManifest(
             id="mail.profiles-and-policy",
             title="Mail profiles and policy hierarchy",
             summary="Mail sending is configured through reusable SMTP/IMAP profiles and an effective policy assembled from system, tenant, owner, and campaign scope where applicable.",
-            body="The active policy decides whether users can only choose approved profiles or whether user, group, and campaign scopes may define their own mail-server settings. Runtime documentation adds the current tenant posture when the actor may read mail profile policy.",
+            body="The active policy decides whether users can only choose approved profiles or whether user, group, and campaign scopes may define additional reusable profiles. Runtime documentation adds the current tenant posture when the actor may read mail profile policy.",
             layer="configured",
             documentation_types=("admin",),
             audience=("tenant_admin", "mail_admin", "campaign_admin"),
@@ -165,11 +225,217 @@ manifest = ModuleManifest(
             links=(
                 DocumentationLink(label="Mail profiles", href="/api/v1/mail/profiles", kind="api"),
                 DocumentationLink(label="Tenant mail policy", href="/api/v1/mail/policies/tenant", kind="api"),
+                DocumentationLink(label="Mail handbook", href="govoplan-mail/docs/MAIL_HANDBOOK.md", kind="repository"),
                 DocumentationLink(label="Public mail module documentation", href="https://govplan.add-ideas.de/modules/mail", kind="public"),
             ),
             related_modules=("campaigns",),
             unlocks=("Campaign-local delivery rules become visible when govoplan-campaign is installed.",),
             configuration_keys=("mail_profile_policy",),
+            metadata={
+                "kind": "reference",
+                "route": "/settings?section=mail-profiles",
+                "screen": "Mail profiles and policy",
+                "section": "Effective profile policy",
+                "related_topic_ids": [
+                    "mail.profile-ownership-and-consumers",
+                    "campaigns.mail-profile-governance",
+                ],
+            },
+        ),
+        DocumentationTopic(
+            id="mail.profile-ownership-and-consumers",
+            title="Mail owns transport profiles and credentials",
+            summary="Other modules select authorized Mail profiles by stable identifier; they do not copy SMTP/IMAP settings or secrets.",
+            body="Mail encrypts credentials, tests connections, evaluates profile scope and policy, and performs revision-gated transport effects without returning resolved configuration. Random persisted revisions rotate when normalized transport or account identity changes, while password-only rotation remains transparent to built business intent. Campaign stores only server.mail_profile_id plus sanitized delivery evidence. Campaign-local transport fields are rejected, and legacy campaign records fail closed until an explicit profile migration preserves the source audit record and updates an editable version.",
+            layer="available",
+            documentation_types=("admin", "user"),
+            audience=("mail_user", "mail_admin", "campaign_manager", "campaign_sender"),
+            order=40,
+            conditions=(
+                DocumentationCondition(
+                    required_modules=("mail",),
+                    any_scopes=(
+                        "mail:profile:read",
+                        "mail:profile:use",
+                        "mail:profile:write",
+                        "mail:profile:write_own",
+                    ),
+                ),
+            ),
+            links=(
+                DocumentationLink(label="Mail profiles", href="/settings?section=mail-profiles", kind="runtime"),
+                DocumentationLink(label="Mail profiles API", href="/api/v1/mail/profiles", kind="api"),
+                DocumentationLink(label="Mail handbook", href="govoplan-mail/docs/MAIL_HANDBOOK.md", kind="repository"),
+            ),
+            related_modules=("campaigns", "access"),
+            unlocks=("Reusable, governed delivery identities without cross-module secret duplication.",),
+            metadata={
+                "kind": "reference",
+                "route": "/settings?section=mail-profiles",
+                "screen": "Mail profiles",
+                "section": "Profile ownership, credentials, and consumers",
+                "related_topic_ids": [
+                    "mail.profiles-and-policy",
+                    "campaigns.mail-profile-user-journey",
+                    "campaigns.mail-profile-governance",
+                    "campaigns.mail-profile-operations",
+                ],
+            },
+        ),
+        DocumentationTopic(
+            id="mail.workflow.choose-and-test-profile",
+            title="Choose and test a reusable Mail profile",
+            summary="Select a profile visible in the current context, test its SMTP or IMAP connection, and let the consuming task store only its stable reference.",
+            body="Profile tests verify current connection and authentication using Mail-owned credentials. They do not prove later Campaign policy authorization, deliverability, recipient acceptance, or future availability. Use the picker rather than entering identifiers or copying transport settings into another module.",
+            layer="configured",
+            documentation_types=("user",),
+            audience=("mail_user", "campaign_manager"),
+            order=41,
+            conditions=(
+                DocumentationCondition(
+                    required_modules=("mail",),
+                    required_scopes=("mail:profile:read", "mail:profile:use", "mail:profile:test"),
+                ),
+            ),
+            links=(
+                DocumentationLink(label="Mail profiles", href="/settings?section=mail-profiles", kind="runtime"),
+                DocumentationLink(label="Mail handbook", href="govoplan-mail/docs/MAIL_HANDBOOK.md", kind="repository"),
+            ),
+            related_modules=("campaigns",),
+            unlocks=("Reusable SMTP/IMAP identities that consumers can reference without handling credentials.",),
+            metadata={
+                "kind": "workflow",
+                "route": "/settings?section=mail-profiles",
+                "screen": "Mail profiles",
+                "help_contexts": ["mail.profiles", "app.settings"],
+                "prerequisites": [
+                    "Mail is installed and you may read, use, and test profiles visible in the current context.",
+                    "A profile administrator has configured credentials and effective policy.",
+                ],
+                "steps": [
+                    "Open Mail profiles and choose a visible active profile.",
+                    "Review its safe scope, SMTP/IMAP availability, and sender identity without expecting credential values.",
+                    "Run the relevant SMTP or IMAP connectivity/authentication test against a non-production target first.",
+                    "Return to the consuming task and select the same profile through its picker.",
+                ],
+                "outcome": "The consuming task references an available Mail-owned profile and contains no copied transport configuration or credentials.",
+                "verification": "Reload both surfaces, confirm only the stable reference is retained by the consumer, and perform the consumer's own contextual policy validation.",
+                "related_topic_ids": [
+                    "mail.profile-ownership-and-consumers",
+                    "mail.reference.campaign-delivery-contract",
+                ],
+            },
+        ),
+        DocumentationTopic(
+            id="mail.workflow.read-mailbox",
+            title="Read a permitted mailbox without changing it",
+            summary="Choose an IMAP-enabled profile, browse folders, and inspect bounded message content through the read-only mailbox surface.",
+            body="Mailbox access requires both mailbox-read and profile-use authority for a profile visible in the actor's scope. Listing folders or messages must not mark mail read, move it, delete it, or expose unbounded content.",
+            layer="configured",
+            documentation_types=("user",),
+            audience=("mail_user",),
+            order=42,
+            conditions=(
+                DocumentationCondition(
+                    required_modules=("mail",),
+                    required_scopes=("mail:mailbox:read", "mail:profile:use"),
+                ),
+            ),
+            links=(
+                DocumentationLink(label="Mail", href="/mail", kind="runtime"),
+                DocumentationLink(label="Mail handbook", href="govoplan-mail/docs/MAIL_HANDBOOK.md", kind="repository"),
+            ),
+            unlocks=("Read-only access to an authorized operational mailbox without broadening profile administration rights.",),
+            metadata={
+                "kind": "workflow",
+                "route": "/mail",
+                "screen": "Mail",
+                "help_contexts": ["mail.list"],
+                "prerequisites": [
+                    "An active visible profile has IMAP configured.",
+                    "You may both use that profile and read its mailbox.",
+                ],
+                "steps": [
+                    "Open Mail and choose an authorized IMAP-enabled profile.",
+                    "Select a folder and page through its bounded message index.",
+                    "Open only the message needed for the task and close it when finished.",
+                ],
+                "outcome": "The required message was inspected without changing provider mailbox state.",
+                "verification": "Refresh the provider mailbox independently and confirm no read, move, delete, reply, or flag mutation was caused by GovOPlaN.",
+                "related_topic_ids": [
+                    "mail.workflow.choose-and-test-profile",
+                    "mail.reference.credentials-egress-retirement",
+                ],
+            },
+        ),
+        DocumentationTopic(
+            id="mail.reference.credentials-egress-retirement",
+            title="Protect Mail credentials, network egress, and retirement",
+            summary="Keep secrets Mail-owned, pin every SMTP/IMAP peer, bound responses, and delete owned credentials immediately with non-secret audit evidence.",
+            body="Private-network connector access is deployment-wide, but every allowed hostname still resolves to an approved peer that is pinned at socket creation. Unsupported transports fail before connection. Deleting a profile immediately scrubs its owned encrypted SMTP/IMAP passwords and records non-secret audit when secrets existed; a scrub or audit failure rolls the action back. Destructive module retirement applies the same rule before table drop.",
+            layer="evidence",
+            documentation_types=("admin",),
+            audience=("mail_admin", "platform_operator", "security_reviewer", "release_reviewer"),
+            order=43,
+            conditions=(
+                DocumentationCondition(
+                    required_modules=("mail",),
+                    any_scopes=("mail:secret:manage", "mail:profile:write", "system:settings:read"),
+                ),
+            ),
+            links=(
+                DocumentationLink(label="Mail handbook", href="govoplan-mail/docs/MAIL_HANDBOOK.md", kind="repository"),
+                DocumentationLink(label="Mail profiles API", href="/api/v1/mail/profiles", kind="api"),
+            ),
+            related_modules=("audit",),
+            unlocks=("A testable Mail trust boundary with fail-closed egress and auditable secret disposal.",),
+            metadata={
+                "kind": "reference",
+                "route": "/settings?section=mail-profiles",
+                "screen": "Mail profiles",
+                "section": "Credentials, network egress, deletion, and retirement",
+                "verification": "Test DNS rebinding and denied addresses, prove the connected peer is pinned, inject credential-scrub and audit failures, repeat deletion for idempotency, and run the retirement preflight against a snapshot.",
+                "related_topic_ids": [
+                    "mail.workflow.choose-and-test-profile",
+                    "mail.reference.campaign-delivery-contract",
+                    "campaigns.reference.composition-assurance",
+                ],
+            },
+        ),
+        DocumentationTopic(
+            id="mail.reference.campaign-delivery-contract",
+            title="Integrate Campaign through the Mail delivery contract",
+            summary="Campaign freezes a Mail profile reference and opaque revision; Mail re-authorizes, revision-checks, resolves credentials, and performs the effect in one call.",
+            body="The mail.campaign_delivery 0.2 contract never returns decrypted credentials or resolved SMTP/IMAP configuration. Mail compares the expected random transport revision before decrypting protocol-specific credentials and returns only bounded sanitized outcomes. Campaign owns durable recipient jobs, retry, and reconciliation. Live report emailing remains disabled until the planned Mail-owned idempotent outbox and attempt ledger are implemented.",
+            layer="available",
+            documentation_types=("admin", "user"),
+            audience=("integrator", "campaign_manager", "campaign_sender", "release_reviewer"),
+            order=44,
+            conditions=(
+                DocumentationCondition(
+                    required_modules=("mail", "campaigns"),
+                    required_scopes=("mail:profile:use", "campaigns:campaign:read"),
+                ),
+            ),
+            links=(
+                DocumentationLink(label="Campaigns", href="/campaigns", kind="runtime"),
+                DocumentationLink(label="Mail handbook", href="govoplan-mail/docs/MAIL_HANDBOOK.md", kind="repository"),
+                DocumentationLink(label="Campaign Mail profile boundary", href="govoplan-campaign/docs/MAIL_PROFILE_BOUNDARY.md", kind="repository"),
+            ),
+            related_modules=("campaigns", "audit"),
+            unlocks=("Profile-backed campaign delivery without cross-module credential or configuration copies.",),
+            metadata={
+                "kind": "reference",
+                "route": "/campaigns/{campaign_id}/mail-settings",
+                "screen": "Campaign Mail settings",
+                "section": "Mail-owned profile and transport boundary",
+                "verification": "Prove stale revisions fail before credential decryption, SMTP never decrypts IMAP credentials, IMAP never decrypts SMTP credentials, provider details are sanitized, and the interface/version gate passes.",
+                "related_topic_ids": [
+                    "mail.profile-ownership-and-consumers",
+                    "campaigns.mail-profile-user-journey",
+                    "campaigns.workflow.retry-and-reconcile",
+                ],
+            },
         ),
     ),
     documentation_providers=(documentation_topics,),

src/govoplan_mail/backend/migrations/dev_versions/608192abcdef_mail_transport_revisions.py

@@ -0,0 +1,78 @@
+"""add opaque Mail-owned transport revisions
+
+Revision ID: 608192abcdef
+Revises: 5f708192abcd
+Create Date: 2026-07-21 00:00:00.000000
+"""
+from __future__ import annotations
+
+import uuid
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "608192abcdef"
+down_revision = "5f708192abcd"
+branch_labels = None
+depends_on = None
+
+
+_SMTP_COLUMN = "smtp_transport_revision"
+_IMAP_COLUMN = "imap_transport_revision"
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+    if "mail_server_profiles" not in inspector.get_table_names():
+        return
+    columns = {column["name"] for column in inspector.get_columns("mail_server_profiles")}
+    with op.batch_alter_table("mail_server_profiles") as batch:
+        if _SMTP_COLUMN not in columns:
+            batch.add_column(sa.Column(_SMTP_COLUMN, sa.String(length=36), nullable=True))
+        if _IMAP_COLUMN not in columns:
+            batch.add_column(sa.Column(_IMAP_COLUMN, sa.String(length=36), nullable=True))
+
+    rows = list(bind.execute(
+        sa.text(
+            "SELECT id, smtp_transport_revision, imap_transport_revision "
+            "FROM mail_server_profiles"
+        )
+    ).mappings())
+    for row in rows:
+        values: dict[str, str] = {}
+        if not row[_SMTP_COLUMN]:
+            values[_SMTP_COLUMN] = str(uuid.uuid4())
+        if not row[_IMAP_COLUMN]:
+            values[_IMAP_COLUMN] = str(uuid.uuid4())
+        if values:
+            bind.execute(
+                sa.text(
+                    "UPDATE mail_server_profiles "
+                    "SET smtp_transport_revision = COALESCE(:smtp_revision, smtp_transport_revision), "
+                    "imap_transport_revision = COALESCE(:imap_revision, imap_transport_revision) "
+                    "WHERE id = :profile_id"
+                ),
+                {
+                    "profile_id": row["id"],
+                    "smtp_revision": values.get(_SMTP_COLUMN),
+                    "imap_revision": values.get(_IMAP_COLUMN),
+                },
+            )
+
+    with op.batch_alter_table("mail_server_profiles") as batch:
+        batch.alter_column(_SMTP_COLUMN, existing_type=sa.String(length=36), nullable=False)
+        batch.alter_column(_IMAP_COLUMN, existing_type=sa.String(length=36), nullable=False)
+
+
+def downgrade() -> None:
+    inspector = sa.inspect(op.get_bind())
+    if "mail_server_profiles" not in inspector.get_table_names():
+        return
+    columns = {column["name"] for column in inspector.get_columns("mail_server_profiles")}
+    with op.batch_alter_table("mail_server_profiles") as batch:
+        if _IMAP_COLUMN in columns:
+            batch.drop_column(_IMAP_COLUMN)
+        if _SMTP_COLUMN in columns:
+            batch.drop_column(_SMTP_COLUMN)

src/govoplan_mail/backend/migrations/versions/608192abcdef_mail_transport_revisions.py

@@ -0,0 +1,78 @@
+"""add opaque Mail-owned transport revisions
+
+Revision ID: 608192abcdef
+Revises: 5f708192abcd
+Create Date: 2026-07-21 00:00:00.000000
+"""
+from __future__ import annotations
+
+import uuid
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "608192abcdef"
+down_revision = "5f708192abcd"
+branch_labels = None
+depends_on = None
+
+
+_SMTP_COLUMN = "smtp_transport_revision"
+_IMAP_COLUMN = "imap_transport_revision"
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+    if "mail_server_profiles" not in inspector.get_table_names():
+        return
+    columns = {column["name"] for column in inspector.get_columns("mail_server_profiles")}
+    with op.batch_alter_table("mail_server_profiles") as batch:
+        if _SMTP_COLUMN not in columns:
+            batch.add_column(sa.Column(_SMTP_COLUMN, sa.String(length=36), nullable=True))
+        if _IMAP_COLUMN not in columns:
+            batch.add_column(sa.Column(_IMAP_COLUMN, sa.String(length=36), nullable=True))
+
+    rows = list(bind.execute(
+        sa.text(
+            "SELECT id, smtp_transport_revision, imap_transport_revision "
+            "FROM mail_server_profiles"
+        )
+    ).mappings())
+    for row in rows:
+        values: dict[str, str] = {}
+        if not row[_SMTP_COLUMN]:
+            values[_SMTP_COLUMN] = str(uuid.uuid4())
+        if not row[_IMAP_COLUMN]:
+            values[_IMAP_COLUMN] = str(uuid.uuid4())
+        if values:
+            bind.execute(
+                sa.text(
+                    "UPDATE mail_server_profiles "
+                    "SET smtp_transport_revision = COALESCE(:smtp_revision, smtp_transport_revision), "
+                    "imap_transport_revision = COALESCE(:imap_revision, imap_transport_revision) "
+                    "WHERE id = :profile_id"
+                ),
+                {
+                    "profile_id": row["id"],
+                    "smtp_revision": values.get(_SMTP_COLUMN),
+                    "imap_revision": values.get(_IMAP_COLUMN),
+                },
+            )
+
+    with op.batch_alter_table("mail_server_profiles") as batch:
+        batch.alter_column(_SMTP_COLUMN, existing_type=sa.String(length=36), nullable=False)
+        batch.alter_column(_IMAP_COLUMN, existing_type=sa.String(length=36), nullable=False)
+
+
+def downgrade() -> None:
+    inspector = sa.inspect(op.get_bind())
+    if "mail_server_profiles" not in inspector.get_table_names():
+        return
+    columns = {column["name"] for column in inspector.get_columns("mail_server_profiles")}
+    with op.batch_alter_table("mail_server_profiles") as batch:
+        if _IMAP_COLUMN in columns:
+            batch.drop_column(_IMAP_COLUMN)
+        if _SMTP_COLUMN in columns:
+            batch.drop_column(_SMTP_COLUMN)

src/govoplan_mail/backend/router.py

@@ -1,11 +1,10 @@
 from __future__ import annotations
 
 import dataclasses
-import logging
 from types import SimpleNamespace
 from typing import Any
 
-from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException, Query, status
+from fastapi import APIRouter, Depends, HTTPException, Query, status
 from sqlalchemy import func, or_
 from sqlalchemy.orm import Session
 
@@ -41,23 +40,27 @@ from govoplan_core.core.change_sequence import (
     sequence_watermark_is_expired,
 )
 from govoplan_core.core.pagination import KeysetCursorError, decode_keyset_cursor, encode_keyset_cursor, keyset_query_fingerprint
-from govoplan_core.db.session import get_database, get_session
+from govoplan_core.db.session import get_session
 from govoplan_mail.backend.mailbox_index import (
-    begin_mailbox_refresh,
     cache_mailbox_folders,
     cache_mailbox_messages,
     cached_mailbox_folders,
     cached_mailbox_message_page,
-    finish_mailbox_refresh,
+    clear_mailbox_index,
 )
 from govoplan_mail.backend.mail_profiles import (
     MailProfileError,
+    campaign_mail_context_visible_to_actor,
     create_mail_server_profile,
+    delete_mail_profile_credentials,
     effective_mail_profile_policy_for_scope,
     get_mail_profile_policy,
     get_mail_server_profile,
+    get_mail_server_profile_for_actor,
     imap_config_from_profile,
     list_mail_server_profiles,
+    mail_profile_visible_to_actor,
+    mail_profile_scope_visible_to_actor,
     parent_mail_profile_policy,
     profile_response_payload,
     set_mail_profile_policy,
@@ -70,7 +73,6 @@ from govoplan_mail.backend.sending.imap import ImapAppendError, ImapConfiguratio
 from govoplan_mail.backend.sending.smtp import test_smtp_login
 
 router = APIRouter(prefix="/mail", tags=["mail"])
-logger = logging.getLogger(__name__)
 
 MAIL_MODULE_ID = "mail"
 MAIL_PROFILES_COLLECTION = "mail.profiles"
@@ -125,18 +127,133 @@ def _require_any_scope(principal: ApiPrincipal, *scopes: str) -> None:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Requires one of: " + ", ".join(scopes))
 
 
-def _require_profile_write_scope(principal: ApiPrincipal, scope_type: str) -> None:
+def _is_own_user_scope(principal: ApiPrincipal, scope_type: str, scope_id: str | None) -> bool:
-    if scope_type == "system":
+    return scope_type == "user" and scope_id == principal.user.id
-        _require_scope(principal, "system:settings:write")
-    else:
-        _require_scope(principal, "mail:profile:write")
 
 
-def _require_profile_credentials_scope(principal: ApiPrincipal, scope_type: str) -> None:
+def _require_profile_write_scope(
+    principal: ApiPrincipal,
+    scope_type: str,
+    scope_id: str | None = None,
+) -> None:
     if scope_type == "system":
         _require_scope(principal, "system:settings:write")
-    else:
+        return
-        _require_scope(principal, "mail:secret:manage")
+    if has_scope(principal, "mail:profile:write"):
+        return
+    if _is_own_user_scope(principal, scope_type, scope_id) and has_scope(
+        principal, "mail:profile:write_own"
+    ):
+        return
+    raise HTTPException(
+        status_code=status.HTTP_403_FORBIDDEN,
+        detail="Missing scope: mail:profile:write",
+    )
+
+
+def _require_profile_credentials_scope(
+    principal: ApiPrincipal,
+    scope_type: str,
+    scope_id: str | None = None,
+) -> None:
+    if scope_type == "system":
+        _require_scope(principal, "system:settings:write")
+        return
+    if has_scope(principal, "mail:secret:manage"):
+        return
+    if _is_own_user_scope(principal, scope_type, scope_id) and has_scope(
+        principal, "mail:secret:manage_own"
+    ):
+        return
+    raise HTTPException(
+        status_code=status.HTTP_403_FORBIDDEN,
+        detail="Missing scope: mail:secret:manage",
+    )
+
+
+def _profile_for_mutation(
+    session: Session,
+    *,
+    principal: ApiPrincipal,
+    profile_id: str,
+):
+    """Resolve a profile through the actor's mutation boundary.
+
+    Mutation routes deliberately do not apply effective transport policy here:
+    an owner must still be able to repair or deactivate a profile after policy
+    becomes more restrictive.  Missing and non-owned identifiers are kept
+    indistinguishable for self-service actors.
+    """
+
+    try:
+        profile = get_mail_server_profile(
+            session,
+            tenant_id=principal.tenant_id,
+            profile_id=profile_id,
+            for_update=True,
+            mutation_owner_user_id=(
+                principal.user.id
+                if has_scope(principal, "mail:profile:write_own")
+                else None
+            ),
+            can_manage_tenant_profiles=_principal_can_manage_tenant_profiles(principal),
+            can_manage_system_profiles=_principal_can_manage_system_profiles(principal),
+        )
+        _require_profile_write_scope(
+            principal,
+            profile.scope_type or "tenant",
+            profile.scope_id,
+        )
+    except (MailProfileError, HTTPException) as exc:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Mail-server profile not found",
+        ) from exc
+    return profile
+
+
+_TRANSPORT_ENDPOINT_FIELDS = ("host", "port", "security")
+
+
+def _transport_endpoint_changed(
+    current: dict[str, Any] | None,
+    updated: SmtpConfig | ImapConfig,
+) -> bool:
+    current_payload = current or {}
+    updated_payload = updated.model_dump(mode="json")
+    return any(
+        current_payload.get(field) != updated_payload.get(field)
+        for field in _TRANSPORT_ENDPOINT_FIELDS
+    )
+
+
+def _profile_update_requires_credentials_scope(
+    profile,
+    *,
+    payload: MailServerProfileUpdateRequest,
+    smtp: SmtpConfig | None,
+    imap: ImapConfig | None,
+) -> bool:
+    if payload.credentials_supplied() or payload.clear_imap:
+        return True
+    if (
+        smtp is not None
+        and getattr(profile, "smtp_password_encrypted", None)
+        and _transport_endpoint_changed(profile.smtp_config, smtp)
+    ):
+        return True
+    return bool(
+        imap is not None
+        and getattr(profile, "imap_password_encrypted", None)
+        and _transport_endpoint_changed(profile.imap_config, imap)
+    )
+
+
+def _profile_has_stored_credentials(profile) -> bool:
+    return bool(
+        getattr(profile, "smtp_password_encrypted", None)
+        or getattr(profile, "imap_password_encrypted", None)
+    )
 
 
 def _require_mailbox_read_scope(principal: ApiPrincipal) -> None:
@@ -144,6 +261,61 @@ def _require_mailbox_read_scope(principal: ApiPrincipal) -> None:
     _require_scope(principal, "mail:profile:use")
 
 
+def _principal_is_tenant_admin(principal: ApiPrincipal) -> bool:
+    return has_scope(principal, "tenant:*")
+
+
+def _principal_can_manage_tenant_profiles(principal: ApiPrincipal) -> bool:
+    return has_scope(principal, "mail:profile:write")
+
+
+def _principal_can_manage_own_profiles(principal: ApiPrincipal) -> bool:
+    return has_scope(principal, "mail:profile:write_own")
+
+
+def _principal_can_manage_system_profiles(principal: ApiPrincipal) -> bool:
+    return has_scope(principal, "system:settings:write")
+
+
+def _profile_actor_kwargs(
+    principal: ApiPrincipal,
+    *,
+    administrative_visibility: bool,
+) -> dict[str, object]:
+    return {
+        "actor_user_id": principal.user.id,
+        "actor_group_ids": principal.group_ids,
+        "actor_can_manage_own_profiles": _principal_can_manage_own_profiles(principal),
+        "actor_can_manage_tenant_profiles": _principal_can_manage_tenant_profiles(principal),
+        "actor_can_manage_system_profiles": _principal_can_manage_system_profiles(principal),
+        "actor_tenant_admin": _principal_is_tenant_admin(principal),
+        "actor_administrative_visibility": administrative_visibility,
+    }
+
+
+def _get_profile_for_principal(
+    session: Session,
+    *,
+    principal: ApiPrincipal,
+    profile_id: str,
+    require_active: bool = False,
+    administrative_visibility: bool = False,
+):
+    return get_mail_server_profile_for_actor(
+        session,
+        tenant_id=principal.tenant_id,
+        profile_id=profile_id,
+        user_id=principal.user.id,
+        group_ids=principal.group_ids,
+        can_manage_own_profiles=_principal_can_manage_own_profiles(principal),
+        can_manage_tenant_profiles=_principal_can_manage_tenant_profiles(principal),
+        can_manage_system_profiles=_principal_can_manage_system_profiles(principal),
+        tenant_admin=_principal_is_tenant_admin(principal),
+        administrative_visibility=administrative_visibility,
+        require_active=require_active,
+    )
+
+
 def _require_policy_read_scope(principal: ApiPrincipal, scope_type: str) -> None:
     if scope_type == "system":
         _require_scope(principal, "system:settings:read")
@@ -162,6 +334,86 @@ def _require_policy_write_scope(principal: ApiPrincipal, scope_type: str) -> Non
         _require_any_scope(principal, "admin:policies:write", "mail:profile:write")
 
 
+def _require_policy_scope_visibility(
+    session: Session,
+    *,
+    principal: ApiPrincipal,
+    scope_type: str,
+    scope_id: str | None,
+) -> None:
+    if scope_type in {"system", "tenant"}:
+        return
+    if has_scope(principal, "admin:policies:read"):
+        return
+    if not mail_profile_scope_visible_to_actor(
+        session,
+        scope_type=scope_type,
+        scope_id=scope_id,
+        profile_tenant_id=principal.tenant_id,
+        tenant_id=principal.tenant_id,
+        user_id=principal.user.id,
+        group_ids=principal.group_ids,
+        can_manage_tenant_profiles=_principal_can_manage_tenant_profiles(principal),
+        tenant_admin=_principal_is_tenant_admin(principal),
+    ):
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Mail profile policy not found")
+
+
+def _require_campaign_context_visibility(
+    session: Session,
+    *,
+    principal: ApiPrincipal,
+    campaign_id: str | None,
+) -> None:
+    if not campaign_id:
+        return
+    if not campaign_mail_context_visible_to_actor(
+        session,
+        tenant_id=principal.tenant_id,
+        campaign_id=campaign_id,
+        user_id=principal.user.id,
+        group_ids=principal.group_ids,
+        tenant_admin=_principal_is_tenant_admin(principal),
+    ):
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Campaign not found")
+
+
+def _require_policy_campaign_context(
+    session: Session,
+    *,
+    principal: ApiPrincipal,
+    scope_type: str,
+    scope_id: str | None,
+    campaign_id: str | None,
+) -> None:
+    if scope_type == "campaign" and campaign_id and campaign_id != scope_id:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail="campaign_id must match the campaign policy scope_id",
+        )
+    _require_campaign_context_visibility(
+        session,
+        principal=principal,
+        campaign_id=campaign_id or (scope_id if scope_type == "campaign" else None),
+    )
+
+
+def _require_campaign_profile_mutation_access(
+    session: Session,
+    *,
+    principal: ApiPrincipal,
+    scope_type: str,
+    scope_id: str | None,
+) -> None:
+    if scope_type != "campaign":
+        return
+    _require_campaign_context_visibility(
+        session,
+        principal=principal,
+        campaign_id=scope_id,
+    )
+
+
 def _profile_response(profile) -> MailServerProfileResponse:
     return MailServerProfileResponse.model_validate(profile_response_payload(profile))
 
@@ -282,6 +534,46 @@ def _mail_deleted_item(entry) -> DeltaDeletedItem:
     )
 
 
+def _profile_change_visible_to_principal(
+    session: Session,
+    *,
+    entry: ChangeSequenceEntry,
+    principal: ApiPrincipal,
+) -> bool:
+    try:
+        profile = get_mail_server_profile(
+            session,
+            tenant_id=principal.tenant_id,
+            profile_id=entry.resource_id,
+        )
+    except MailProfileError:
+        payload = entry.payload if isinstance(entry.payload, dict) else {}
+        return mail_profile_scope_visible_to_actor(
+            session,
+            scope_type=str(payload.get("scope_type") or "tenant"),
+            scope_id=str(payload["scope_id"]) if payload.get("scope_id") else None,
+            profile_tenant_id=entry.tenant_id,
+            tenant_id=principal.tenant_id,
+            user_id=principal.user.id,
+            group_ids=principal.group_ids,
+            can_manage_tenant_profiles=_principal_can_manage_tenant_profiles(principal),
+            tenant_admin=_principal_is_tenant_admin(principal),
+        )
+    return mail_profile_visible_to_actor(
+        session,
+        profile=profile,
+        tenant_id=principal.tenant_id,
+        user_id=principal.user.id,
+        group_ids=principal.group_ids,
+        can_manage_own_profiles=_principal_can_manage_own_profiles(principal),
+        can_manage_tenant_profiles=_principal_can_manage_tenant_profiles(principal),
+        can_manage_system_profiles=_principal_can_manage_system_profiles(principal),
+        tenant_admin=_principal_is_tenant_admin(principal),
+        administrative_visibility=True,
+        require_active=False,
+    )
+
+
 def _mailbox_summary_response(message) -> MailMailboxMessageSummaryResponse:
     return MailMailboxMessageSummaryResponse(
         uid=message.uid,
@@ -450,65 +742,6 @@ def _mailbox_messages_response(
     )
 
 
-def _schedule_mailbox_refresh(
-    background_tasks: BackgroundTasks,
-    *,
-    tenant_id: str,
-    profile_id: str,
-    folder: str,
-    limit: int,
-    offset: int = 0,
-    include_folder_status: bool = False,
-) -> bool:
-    if not begin_mailbox_refresh(tenant_id, profile_id, folder):
-        return False
-    background_tasks.add_task(
-        _refresh_mailbox_index_task,
-        tenant_id=tenant_id,
-        profile_id=profile_id,
-        folder=folder,
-        limit=limit,
-        offset=offset,
-        include_folder_status=include_folder_status,
-    )
-    return True
-
-
-def _refresh_mailbox_index_task(
-    *,
-    tenant_id: str,
-    profile_id: str,
-    folder: str,
-    limit: int,
-    offset: int,
-    include_folder_status: bool,
-) -> None:
-    try:
-        with get_database().session() as session:
-            imap = _imap_config_for_profile(session, tenant_id=tenant_id, profile_id=profile_id)
-            result = load_imap_mailbox_bootstrap(
-                imap_config=imap,
-                folder=folder,
-                limit=limit,
-                offset=offset,
-                include_folder_status=include_folder_status,
-            )
-            cache_mailbox_folders(session, tenant_id=tenant_id, profile_id=profile_id, result=result.folders)
-            cache_mailbox_messages(session, tenant_id=tenant_id, profile_id=profile_id, result=result.messages)
-            session.commit()
-    except Exception:
-        # Background refresh is opportunistic. Foreground requests will surface
-        # concrete IMAP errors when no usable cache is available.
-        logger.debug(
-            "Background mailbox index refresh failed (profile_id=%r, folder=%r)",
-            profile_id,
-            folder,
-            exc_info=True,
-        )
-    finally:
-        finish_mailbox_refresh(tenant_id, profile_id, folder)
-
-
 def _cached_folder_selection(folders, requested: str, detected_sent_folder: str | None = None) -> str:
     names = {folder.name for folder in folders}
     if requested in names:
@@ -520,8 +753,13 @@ def _cached_folder_selection(folders, requested: str, detected_sent_folder: str
     return folders[0].name if folders else requested
 
 
-def _imap_config_for_profile(session: Session, *, tenant_id: str, profile_id: str):
+def _imap_config_for_principal(session: Session, *, principal: ApiPrincipal, profile_id: str):
-    profile = get_mail_server_profile(session, tenant_id=tenant_id, profile_id=profile_id, require_active=True)
+    profile = _get_profile_for_principal(
+        session,
+        principal=principal,
+        profile_id=profile_id,
+        require_active=True,
+    )
     imap = imap_config_from_profile(profile)
     if imap is None:
         raise MailProfileError("Mail-server profile has no IMAP configuration")
@@ -537,7 +775,7 @@ def _parent_mail_profile_policy_payload(session: Session, *, tenant_id: str, sco
 def _full_mail_settings_delta_response(
     session: Session,
     *,
-    tenant_id: str,
+    principal: ApiPrincipal,
     scope_type: str,
     scope_id: str | None,
     include_inactive: bool,
@@ -545,16 +783,17 @@ def _full_mail_settings_delta_response(
 ) -> MailSettingsDeltaResponse:
     profiles = list_mail_server_profiles(
         session,
-        tenant_id=tenant_id,
+        tenant_id=principal.tenant_id,
         include_inactive=include_inactive,
         campaign_id=campaign_id,
+        **_profile_actor_kwargs(principal, administrative_visibility=True),
     )
     return MailSettingsDeltaResponse(
         profiles=[_profile_response(profile) for profile in profiles],
-        policy=_policy_response(session, tenant_id=tenant_id, scope_type=scope_type, scope_id=scope_id, campaign_id=campaign_id),
+        policy=_policy_response(session, tenant_id=principal.tenant_id, scope_type=scope_type, scope_id=scope_id, campaign_id=campaign_id),
         changed_sections=["profiles", "policy"],
         deleted=[],
-        watermark=_mail_settings_watermark(session, tenant_id=tenant_id),
+        watermark=_mail_settings_watermark(session, tenant_id=principal.tenant_id),
         has_more=False,
         full=True,
     )
@@ -592,10 +831,23 @@ def mail_settings_delta(
     clean_scope_type = scope_type.strip().casefold()
     _require_any_scope(principal, "mail:profile:read", "system:settings:read")
     _require_policy_read_scope(principal, clean_scope_type)
+    _require_policy_scope_visibility(
+        session,
+        principal=principal,
+        scope_type=clean_scope_type,
+        scope_id=scope_id,
+    )
+    _require_policy_campaign_context(
+        session,
+        principal=principal,
+        scope_type=clean_scope_type,
+        scope_id=scope_id,
+        campaign_id=campaign_id,
+    )
     if since is None:
         return _full_mail_settings_delta_response(
             session,
-            tenant_id=principal.tenant_id,
+            principal=principal,
             scope_type=clean_scope_type,
             scope_id=scope_id,
             include_inactive=include_inactive,
@@ -605,16 +857,22 @@ def mail_settings_delta(
     if entries is None:
         return _full_mail_settings_delta_response(
             session,
-            tenant_id=principal.tenant_id,
+            principal=principal,
             scope_type=clean_scope_type,
             scope_id=scope_id,
             include_inactive=include_inactive,
             campaign_id=campaign_id,
         )
+    visible_profile_entries = [
+        entry
+        for entry in entries
+        if entry.collection == MAIL_PROFILES_COLLECTION
+        and entry.resource_type == MAIL_PROFILE_RESOURCE
+        and _profile_change_visible_to_principal(session, entry=entry, principal=principal)
+    ]
     changed_profile_ids = {
         entry.resource_id
-        for entry in entries
+        for entry in visible_profile_entries
-        if entry.collection == MAIL_PROFILES_COLLECTION and entry.resource_type == MAIL_PROFILE_RESOURCE
     }
     visible_profiles = {
         profile.id: profile
@@ -623,6 +881,7 @@ def mail_settings_delta(
             tenant_id=principal.tenant_id,
             include_inactive=include_inactive,
             campaign_id=campaign_id,
+            **_profile_actor_kwargs(principal, administrative_visibility=True),
         )
         if profile.id in changed_profile_ids
     }
@@ -634,10 +893,8 @@ def mail_settings_delta(
         changed_sections.append("policy")
     deleted = [
         _mail_deleted_item(entry)
-        for entry in entries
+        for entry in visible_profile_entries
-        if entry.collection == MAIL_PROFILES_COLLECTION
+        if entry.resource_id not in visible_profiles
-        and entry.resource_type == MAIL_PROFILE_RESOURCE
-        and entry.resource_id not in visible_profiles
     ]
     return MailSettingsDeltaResponse(
         profiles=[_profile_response(profile) for profile in visible_profiles.values()],
@@ -664,6 +921,7 @@ def list_profiles(
             tenant_id=principal.tenant_id,
             include_inactive=include_inactive,
             campaign_id=campaign_id,
+            **_profile_actor_kwargs(principal, administrative_visibility=True),
         )
         return MailServerProfileListResponse(profiles=[_profile_response(profile) for profile in profiles])
     except MailProfileError as exc:
@@ -676,9 +934,24 @@ def create_profile(
     principal: ApiPrincipal = Depends(get_api_principal),
     session: Session = Depends(get_session),
 ):
-    _require_profile_write_scope(principal, payload.scope_type)
+    authorization_scope_id = (
+        payload.scope_id or principal.user.id
+        if payload.scope_type == "user"
+        else payload.scope_id
+    )
+    _require_profile_write_scope(principal, payload.scope_type, authorization_scope_id)
+    _require_campaign_profile_mutation_access(
+        session,
+        principal=principal,
+        scope_type=payload.scope_type,
+        scope_id=payload.scope_id,
+    )
     if payload.credentials_supplied():
-        _require_profile_credentials_scope(principal, payload.scope_type)
+        _require_profile_credentials_scope(
+            principal,
+            payload.scope_type,
+            authorization_scope_id,
+        )
     try:
         profile = create_mail_server_profile(
             session,
@@ -700,7 +973,7 @@ def create_profile(
             resource_id=profile.id,
             operation="created",
             principal=principal,
-            tenant_id=profile.tenant_id or principal.tenant_id,
+            tenant_id=profile.tenant_id,
             payload={"scope_type": profile.scope_type, "scope_id": profile.scope_id},
         )
         session.commit()
@@ -719,7 +992,14 @@ def get_profile(
 ):
     _require_any_scope(principal, "mail:profile:read", "system:settings:read")
     try:
-        return _profile_response(get_mail_server_profile(session, tenant_id=principal.tenant_id, profile_id=profile_id))
+        return _profile_response(
+            _get_profile_for_principal(
+                session,
+                principal=principal,
+                profile_id=profile_id,
+                administrative_visibility=True,
+            )
+        )
     except MailProfileError as exc:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(exc)) from exc
 
@@ -732,10 +1012,17 @@ def update_profile(
     session: Session = Depends(get_session),
 ):
     try:
-        profile = get_mail_server_profile(session, tenant_id=principal.tenant_id, profile_id=profile_id)
+        profile = _profile_for_mutation(
-        _require_profile_write_scope(principal, profile.scope_type or "tenant")
+            session,
-        if payload.credentials_supplied() or payload.clear_imap:
+            principal=principal,
-            _require_profile_credentials_scope(principal, profile.scope_type or "tenant")
+            profile_id=profile_id,
+        )
+        _require_campaign_profile_mutation_access(
+            session,
+            principal=principal,
+            scope_type=profile.scope_type or "tenant",
+            scope_id=profile.scope_id,
+        )
         smtp_config = payload.smtp_config()
         if payload.smtp is None and "smtp" in payload.credentials.model_fields_set:
             smtp_data = dict(profile.smtp_config or {})
@@ -746,11 +1033,23 @@ def update_profile(
             imap_data = dict(profile.imap_config or {})
             imap_data.update(payload.credentials.imap.model_dump(mode="json", exclude_unset=True))
             imap_config = ImapConfig.model_validate(imap_data)
+        if _profile_update_requires_credentials_scope(
+            profile,
+            payload=payload,
+            smtp=smtp_config,
+            imap=imap_config,
+        ):
+            _require_profile_credentials_scope(
+                principal,
+                profile.scope_type or "tenant",
+                profile.scope_id,
+            )
         update_mail_server_profile(
             session,
             profile,
             tenant_id=principal.tenant_id,
             user_id=principal.user.id,
+            api_key_id=principal.api_key_id,
             name=payload.name,
             slug=payload.slug,
             description=payload.description if "description" in payload.model_fields_set else None,
@@ -766,7 +1065,7 @@ def update_profile(
             resource_id=profile.id,
             operation="updated",
             principal=principal,
-            tenant_id=profile.tenant_id or principal.tenant_id,
+            tenant_id=profile.tenant_id,
             payload={"scope_type": profile.scope_type, "scope_id": profile.scope_id},
         )
         session.commit()
@@ -775,6 +1074,9 @@ def update_profile(
     except MailProfileError as exc:
         session.rollback()
         raise HTTPException(status_code=status.HTTP_422_UNPROCESSABLE_CONTENT, detail=str(exc)) from exc
+    except Exception:
+        session.rollback()
+        raise
 
 
 @router.delete("/profiles/{profile_id}", response_model=MailServerProfileResponse)
@@ -784,10 +1086,38 @@ def deactivate_profile(
     session: Session = Depends(get_session),
 ):
     try:
-        profile = get_mail_server_profile(session, tenant_id=principal.tenant_id, profile_id=profile_id)
+        profile = _profile_for_mutation(
-        _require_profile_write_scope(principal, profile.scope_type or "tenant")
+            session,
+            principal=principal,
+            profile_id=profile_id,
+        )
+        _require_campaign_profile_mutation_access(
+            session,
+            principal=principal,
+            scope_type=profile.scope_type or "tenant",
+            scope_id=profile.scope_id,
+        )
+        if _profile_has_stored_credentials(profile):
+            _require_profile_credentials_scope(
+                principal,
+                profile.scope_type or "tenant",
+                profile.scope_id,
+            )
+        was_active = bool(profile.is_active)
         profile.is_active = False
+        deleted_protocols = delete_mail_profile_credentials(
+            session,
+            profile=profile,
+            deletion_reason="profile_deactivated",
+            user_id=principal.user.id,
+            api_key_id=principal.api_key_id,
+        )
+        # Deactivation invalidates unauthenticated IMAP profiles too. Keep the
+        # cache deletion in this transaction so a failed audit/change record
+        # cannot leave profile state and cached mailbox data out of sync.
+        clear_mailbox_index(session, profile_id=profile.id)
         session.add(profile)
+        if was_active or deleted_protocols:
             _record_mail_change(
                 session,
                 collection=MAIL_PROFILES_COLLECTION,
@@ -795,8 +1125,13 @@ def deactivate_profile(
                 resource_id=profile.id,
                 operation="deleted",
                 principal=principal,
-            tenant_id=profile.tenant_id or principal.tenant_id,
+                tenant_id=profile.tenant_id,
-            payload={"scope_type": profile.scope_type, "scope_id": profile.scope_id},
+                payload={
+                    "scope_type": profile.scope_type,
+                    "scope_id": profile.scope_id,
+                    "credentials_deleted": bool(deleted_protocols),
+                    "deleted_credential_protocols": list(deleted_protocols),
+                },
             )
         session.commit()
         session.refresh(profile)
@@ -804,6 +1139,9 @@ def deactivate_profile(
     except MailProfileError as exc:
         session.rollback()
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(exc)) from exc
+    except Exception:
+        session.rollback()
+        raise
 
 
 @router.get("/policies/{scope_type}", response_model=MailProfilePolicyResponse)
@@ -816,6 +1154,19 @@ def read_mail_profile_policy(
 ):
     scope_type = scope_type.strip().casefold()
     _require_policy_read_scope(principal, scope_type)
+    _require_policy_scope_visibility(
+        session,
+        principal=principal,
+        scope_type=scope_type,
+        scope_id=scope_id,
+    )
+    _require_policy_campaign_context(
+        session,
+        principal=principal,
+        scope_type=scope_type,
+        scope_id=scope_id,
+        campaign_id=campaign_id,
+    )
     try:
         return _policy_response(session, tenant_id=principal.tenant_id, scope_type=scope_type, scope_id=scope_id, campaign_id=campaign_id)
     except MailProfileError as exc:
@@ -832,6 +1183,19 @@ def write_mail_profile_policy(
 ):
     scope_type = scope_type.strip().casefold()
     _require_policy_write_scope(principal, scope_type)
+    _require_policy_scope_visibility(
+        session,
+        principal=principal,
+        scope_type=scope_type,
+        scope_id=scope_id,
+    )
+    _require_policy_campaign_context(
+        session,
+        principal=principal,
+        scope_type=scope_type,
+        scope_id=scope_id,
+        campaign_id=None,
+    )
     try:
         set_mail_profile_policy(
             session,
@@ -866,7 +1230,12 @@ def test_profile_smtp(
     _require_scope(principal, "mail:profile:test")
     _require_scope(principal, "mail:profile:use")
     try:
-        profile = get_mail_server_profile(session, tenant_id=principal.tenant_id, profile_id=profile_id, require_active=True)
+        profile = _get_profile_for_principal(
+            session,
+            principal=principal,
+            profile_id=profile_id,
+            require_active=True,
+        )
         smtp = smtp_config_from_profile(profile)
         result = test_smtp_login(smtp_config=smtp)
         return MailConnectionTestResponse(ok=True, protocol="smtp", host=result.host, port=result.port, security=result.security, message="SMTP connection successful.", details={"authenticated": result.authenticated})
@@ -885,7 +1254,12 @@ def test_profile_imap(
     _require_scope(principal, "mail:profile:test")
     _require_scope(principal, "mail:profile:use")
     try:
-        profile = get_mail_server_profile(session, tenant_id=principal.tenant_id, profile_id=profile_id, require_active=True)
+        profile = _get_profile_for_principal(
+            session,
+            principal=principal,
+            profile_id=profile_id,
+            require_active=True,
+        )
         imap = imap_config_from_profile(profile)
         if imap is None:
             raise MailProfileError("Mail-server profile has no IMAP configuration")
@@ -906,7 +1280,12 @@ def list_profile_imap_folders(
     _require_scope(principal, "mail:profile:test")
     _require_scope(principal, "mail:profile:use")
     try:
-        profile = get_mail_server_profile(session, tenant_id=principal.tenant_id, profile_id=profile_id, require_active=True)
+        profile = _get_profile_for_principal(
+            session,
+            principal=principal,
+            profile_id=profile_id,
+            require_active=True,
+        )
         imap = imap_config_from_profile(profile)
         if imap is None:
             raise MailProfileError("Mail-server profile has no IMAP configuration")
@@ -921,7 +1300,6 @@ def list_profile_imap_folders(
 @router.get("/profiles/{profile_id}/mailbox/folders", response_model=MailImapFolderListResponse)
 def list_profile_mailbox_folders(
     profile_id: str,
-    background_tasks: BackgroundTasks,
     include_status: bool = Query(default=False),
     refresh: bool = False,
     principal: ApiPrincipal = Depends(get_api_principal),
@@ -929,18 +1307,10 @@ def list_profile_mailbox_folders(
 ):
     _require_mailbox_read_scope(principal)
     try:
-        imap = _imap_config_for_profile(session, tenant_id=principal.tenant_id, profile_id=profile_id)
+        imap = _imap_config_for_principal(session, principal=principal, profile_id=profile_id)
         if not include_status and not refresh:
             cached = cached_mailbox_folders(session, tenant_id=principal.tenant_id, profile_id=profile_id)
-            if cached is not None:
+            if cached is not None and not cached.stale:
-                refreshing = cached.stale and _schedule_mailbox_refresh(
-                    background_tasks,
-                    tenant_id=principal.tenant_id,
-                    profile_id=profile_id,
-                    folder="INBOX",
-                    limit=DEFAULT_MAILBOX_MESSAGE_LIMIT,
-                    include_folder_status=include_status,
-                )
                 result = SimpleNamespace(
                     host=imap.host,
                     port=imap.port,
@@ -948,7 +1318,7 @@ def list_profile_mailbox_folders(
                     folders=cached.folders,
                     detected_sent_folder=None,
                 )
-                return _mailbox_folder_response(result, from_cache=True, refreshing=refreshing, indexed_at=cached.indexed_at)
+                return _mailbox_folder_response(result, from_cache=True, refreshing=False, indexed_at=cached.indexed_at)
         result = list_imap_folders(imap_config=imap, include_status=include_status)
         cache_mailbox_folders(session, tenant_id=principal.tenant_id, profile_id=profile_id, result=result)
         session.commit()
@@ -964,7 +1334,6 @@ def list_profile_mailbox_folders(
 @router.get("/profiles/{profile_id}/mailbox/bootstrap", response_model=MailMailboxBootstrapResponse)
 def bootstrap_profile_mailbox(
     profile_id: str,
-    background_tasks: BackgroundTasks,
     folder: str = Query(default="INBOX", min_length=1, max_length=255),
     limit: int = Query(default=DEFAULT_MAILBOX_MESSAGE_LIMIT, ge=1, le=100),
     offset: int = Query(default=0, ge=0, le=100000),
@@ -975,10 +1344,10 @@ def bootstrap_profile_mailbox(
 ) -> MailMailboxBootstrapResponse:
     _require_mailbox_read_scope(principal)
     try:
-        imap = _imap_config_for_profile(session, tenant_id=principal.tenant_id, profile_id=profile_id)
+        imap = _imap_config_for_principal(session, principal=principal, profile_id=profile_id)
         if not refresh:
             cached_folders = cached_mailbox_folders(session, tenant_id=principal.tenant_id, profile_id=profile_id)
-            if cached_folders is not None:
+            if cached_folders is not None and not cached_folders.stale:
                 selected_folder = _cached_folder_selection(cached_folders.folders, folder)
                 cached_messages = cached_mailbox_message_page(
                     session,
@@ -988,16 +1357,7 @@ def bootstrap_profile_mailbox(
                     limit=limit,
                     offset=offset,
                 )
-                if cached_messages is not None:
+                if cached_messages is not None and not cached_messages.stale:
-                    refreshing = (cached_folders.stale or cached_messages.stale) and _schedule_mailbox_refresh(
-                        background_tasks,
-                        tenant_id=principal.tenant_id,
-                        profile_id=profile_id,
-                        folder=selected_folder,
-                        limit=limit,
-                        offset=offset,
-                        include_folder_status=include_status,
-                    )
                     folder_result = SimpleNamespace(
                         host=imap.host,
                         port=imap.port,
@@ -1021,7 +1381,7 @@ def bootstrap_profile_mailbox(
                         folders=_mailbox_folder_response(
                             folder_result,
                             from_cache=True,
-                            refreshing=refreshing,
+                            refreshing=False,
                             indexed_at=cached_folders.indexed_at,
                         ),
                         messages=_mailbox_messages_response(
@@ -1039,7 +1399,7 @@ def bootstrap_profile_mailbox(
                             full=not cursor_stable,
                             messages=cached_messages.messages,
                             from_cache=True,
-                            refreshing=refreshing,
+                            refreshing=False,
                             indexed_at=cached_messages.indexed_at,
                         ),
                     )
@@ -1095,7 +1455,6 @@ def bootstrap_profile_mailbox(
 @router.get("/profiles/{profile_id}/mailbox/messages", response_model=MailMailboxMessageListResponse)
 def list_profile_mailbox_messages(
     profile_id: str,
-    background_tasks: BackgroundTasks,
     folder: str = Query(default="INBOX", min_length=1, max_length=255),
     limit: int | None = Query(default=None, ge=1, le=100),
     offset: int = Query(default=0, ge=0, le=100000),
@@ -1106,7 +1465,7 @@ def list_profile_mailbox_messages(
 ):
     _require_mailbox_read_scope(principal)
     try:
-        imap = _imap_config_for_profile(session, tenant_id=principal.tenant_id, profile_id=profile_id)
+        imap = _imap_config_for_principal(session, principal=principal, profile_id=profile_id)
         effective_limit = _mailbox_cursor_limit(cursor, limit)
         fingerprint = _mailbox_cursor_fingerprint(tenant_id=principal.tenant_id, profile_id=profile_id, folder=folder, limit=effective_limit)
         effective_offset, after_uid, expected_uidvalidity, cursor_values = _mailbox_cursor_position(cursor, fingerprint=fingerprint, offset=offset)
@@ -1122,15 +1481,7 @@ def list_profile_mailbox_messages(
             cache_matches_cursor = cached is not None and (
                 cursor is None or (expected_uidvalidity is not None and cached.uidvalidity == expected_uidvalidity)
             )
-            if cached is not None and cache_matches_cursor:
+            if cached is not None and cache_matches_cursor and not cached.stale:
-                refreshing = cached.stale and _schedule_mailbox_refresh(
-                    background_tasks,
-                    tenant_id=principal.tenant_id,
-                    profile_id=profile_id,
-                    folder=folder,
-                    limit=effective_limit,
-                    offset=effective_offset,
-                )
                 next_cursor, cursor_stable = _next_mailbox_cursor(
                     tenant_id=principal.tenant_id,
                     profile_id=profile_id,
@@ -1156,7 +1507,7 @@ def list_profile_mailbox_messages(
                     full=not cursor_stable,
                     messages=cached.messages,
                     from_cache=True,
-                    refreshing=refreshing,
+                    refreshing=False,
                     indexed_at=cached.indexed_at,
                 )
         result = list_imap_messages(
@@ -1213,7 +1564,7 @@ def get_profile_mailbox_message(
 ):
     _require_mailbox_read_scope(principal)
     try:
-        imap = _imap_config_for_profile(session, tenant_id=principal.tenant_id, profile_id=profile_id)
+        imap = _imap_config_for_principal(session, principal=principal, profile_id=profile_id)
         result = get_imap_message(imap_config=imap, folder=folder, uid=message_uid)
         return MailMailboxMessageResponse(
             profile_id=profile_id,

src/govoplan_mail/backend/sending/imap.py

@@ -12,6 +12,13 @@ from email.message import EmailMessage
 from email.parser import BytesParser
 from typing import Any
 
+from govoplan_core.security.outbound_http import (
+    OutboundHttpError,
+    create_outbound_connection,
+    response_limit,
+    validate_outbound_host,
+)
+
 from govoplan_mail.backend.config import ImapConfig, TransportSecurity
 from govoplan_mail.backend.dev.mock_mailbox import (
     MOCK_IMAP_FOLDERS,
@@ -25,6 +32,31 @@ from govoplan_mail.backend.dev.mock_mailbox import (
 logger = logging.getLogger(__name__)
 
 
+class _OutboundPolicyIMAP4(imaplib.IMAP4):
+    def _create_socket(self, timeout: float | None):  # type: ignore[no-untyped-def]
+        return create_outbound_connection(
+            self.host,
+            self.port,
+            timeout=timeout,
+            label="IMAP connector",
+        )
+
+
+class _OutboundPolicyIMAP4SSL(imaplib.IMAP4_SSL):
+    def _create_socket(self, timeout: float | None):  # type: ignore[no-untyped-def]
+        sock = create_outbound_connection(
+            self.host,
+            self.port,
+            timeout=timeout,
+            label="IMAP connector",
+        )
+        try:
+            return self.ssl_context.wrap_socket(sock, server_hostname=self.host)
+        except Exception:
+            sock.close()
+            raise
+
+
 class ImapConfigurationError(ValueError):
     """Raised when IMAP settings are incomplete or inconsistent."""
 
@@ -36,9 +68,16 @@ class ImapAppendError(RuntimeError):
     configuration or mailbox choice probably needs user/admin attention.
     """
 
-    def __init__(self, message: str, *, temporary: bool | None = None):
+    def __init__(
+        self,
+        message: str,
+        *,
+        temporary: bool | None = None,
+        outcome_unknown: bool = False,
+    ):
         super().__init__(message)
         self.temporary = temporary
+        self.outcome_unknown = outcome_unknown
 
 
 @dataclass(frozen=True, slots=True)
@@ -163,13 +202,22 @@ def _require_imap_config(config: ImapConfig) -> tuple[str, int]:
 
 def _open_imap(config: ImapConfig) -> imaplib.IMAP4:
     host, port = _require_imap_config(config)
+    try:
+        validate_outbound_host(host, port=port, label="IMAP connector")
+    except OutboundHttpError as exc:
+        raise ImapConfigurationError(str(exc)) from exc
     context = ssl.create_default_context()
 
     try:
         if config.security == TransportSecurity.TLS:
-            client: imaplib.IMAP4 = imaplib.IMAP4_SSL(host=host, port=port, timeout=config.timeout_seconds, ssl_context=context)
+            client: imaplib.IMAP4 = _OutboundPolicyIMAP4SSL(
+                host=host,
+                port=port,
+                timeout=config.timeout_seconds,
+                ssl_context=context,
+            )
         else:
-            client = imaplib.IMAP4(host=host, port=port, timeout=config.timeout_seconds)
+            client = _OutboundPolicyIMAP4(host=host, port=port, timeout=config.timeout_seconds)
             if config.security == TransportSecurity.STARTTLS:
                 typ, data = client.starttls(ssl_context=context)
                 if typ != "OK":
@@ -704,18 +752,22 @@ def _select_readonly(client: imaplib.IMAP4, folder: str) -> tuple[int, str | Non
 
 
 def _fetch_message_by_uid(client: imaplib.IMAP4, uid: str) -> tuple[str, list[str], int | None, bytes]:
-    typ, data = client.uid("fetch", str(uid), "(UID FLAGS RFC822.SIZE BODY.PEEK[])")
+    max_bytes = response_limit("file")
+    typ, data = client.uid("fetch", str(uid), f"(UID FLAGS RFC822.SIZE BODY.PEEK[]<0.{max_bytes + 1}>)")
     if typ != "OK":
         raise ImapAppendError(f"IMAP message {uid!r} fetch failed: {data!r}", temporary=True)
     fetched_uid, flags, size_bytes, raw = _parse_fetch_response(data)
+    _ensure_imap_payload_within_limit(raw, declared_size=size_bytes, max_bytes=max_bytes, label="IMAP message")
     return fetched_uid or str(uid), flags, size_bytes, raw
 
 
 def _fetch_message_by_sequence(client: imaplib.IMAP4, sequence: str) -> tuple[str, list[str], int | None, bytes]:
-    typ, data = client.fetch(str(sequence), "(UID FLAGS RFC822.SIZE BODY.PEEK[])")
+    max_bytes = response_limit("file")
+    typ, data = client.fetch(str(sequence), f"(UID FLAGS RFC822.SIZE BODY.PEEK[]<0.{max_bytes + 1}>)")
     if typ != "OK":
         raise ImapAppendError(f"IMAP message sequence {sequence!r} fetch failed: {data!r}", temporary=True)
     fetched_uid, flags, size_bytes, raw = _parse_fetch_response(data)
+    _ensure_imap_payload_within_limit(raw, declared_size=size_bytes, max_bytes=max_bytes, label="IMAP message")
     if not fetched_uid:
         raise ImapAppendError(f"IMAP message sequence {sequence!r} fetch returned no UID", temporary=True)
     return fetched_uid, flags, size_bytes, raw
@@ -734,12 +786,19 @@ def _sequence_set(sequences: list[str]) -> str:
 def _fetch_message_summaries_by_sequence(client: imaplib.IMAP4, sequences: list[str], folder: str) -> list[ImapMailboxMessageSummary]:
     if not sequences:
         return []
-    typ, data = client.fetch(_sequence_set(sequences), "(UID FLAGS RFC822.SIZE BODY.PEEK[HEADER.FIELDS (SUBJECT FROM TO CC DATE MESSAGE-ID)])")
+    max_bytes = response_limit("structured")
+    per_message_bytes = max(1, max_bytes // len(sequences)) + 1
+    typ, data = client.fetch(
+        _sequence_set(sequences),
+        f"(UID FLAGS RFC822.SIZE BODY.PEEK[HEADER.FIELDS (SUBJECT FROM TO CC DATE MESSAGE-ID)]<0.{per_message_bytes}>)",
+    )
     if typ != "OK":
         raise ImapAppendError(f"IMAP message summary fetch failed: {data!r}", temporary=True)
 
     by_sequence: dict[str, ImapMailboxMessageSummary] = {}
-    for sequence, fetched_uid, flags, size_bytes, headers in _parse_fetch_parts_with_sequence(data):
+    parsed_parts = _parse_fetch_parts_with_sequence(data)
+    _ensure_imap_batch_within_limit(parsed_parts, max_bytes=max_bytes, label="IMAP message summary response")
+    for sequence, fetched_uid, flags, size_bytes, headers in parsed_parts:
         if not sequence or not fetched_uid:
             continue
         by_sequence[sequence] = _message_summary_from_headers(uid=fetched_uid, folder=folder, headers=headers, flags=flags, size_bytes=size_bytes)
@@ -791,12 +850,20 @@ def _paged_descending_uids(
 def _fetch_message_summaries_by_uid(client: imaplib.IMAP4, uids: list[str], folder: str) -> list[ImapMailboxMessageSummary]:
     if not uids:
         return []
-    typ, data = client.uid("fetch", _sequence_set(uids), "(UID FLAGS RFC822.SIZE BODY.PEEK[HEADER.FIELDS (SUBJECT FROM TO CC DATE MESSAGE-ID)])")
+    max_bytes = response_limit("structured")
+    per_message_bytes = max(1, max_bytes // len(uids)) + 1
+    typ, data = client.uid(
+        "fetch",
+        _sequence_set(uids),
+        f"(UID FLAGS RFC822.SIZE BODY.PEEK[HEADER.FIELDS (SUBJECT FROM TO CC DATE MESSAGE-ID)]<0.{per_message_bytes}>)",
+    )
     if typ != "OK":
         raise ImapAppendError(f"IMAP message summary fetch failed: {data!r}", temporary=True)
 
     by_uid: dict[str, ImapMailboxMessageSummary] = {}
-    for _sequence, fetched_uid, flags, size_bytes, headers in _parse_fetch_parts_with_sequence(data):
+    parsed_parts = _parse_fetch_parts_with_sequence(data)
+    _ensure_imap_batch_within_limit(parsed_parts, max_bytes=max_bytes, label="IMAP message summary response")
+    for _sequence, fetched_uid, flags, size_bytes, headers in parsed_parts:
         if not fetched_uid:
             continue
         by_uid[fetched_uid] = _message_summary_from_headers(uid=fetched_uid, folder=folder, headers=headers, flags=flags, size_bytes=size_bytes)
@@ -812,6 +879,27 @@ def _fetch_message_summaries_by_uid(client: imaplib.IMAP4, uids: list[str], fold
     return summaries
 
 
+def _ensure_imap_payload_within_limit(
+    payload: bytes,
+    *,
+    declared_size: int | None,
+    max_bytes: int,
+    label: str,
+) -> None:
+    if (declared_size is not None and declared_size > max_bytes) or len(payload) > max_bytes:
+        raise ImapAppendError(f"{label} exceeds the deployment limit of {max_bytes} bytes", temporary=False)
+
+
+def _ensure_imap_batch_within_limit(
+    parts: list[tuple[str | None, str | None, list[str], int | None, bytes]],
+    *,
+    max_bytes: int,
+    label: str,
+) -> None:
+    if sum(len(part[4]) for part in parts) > max_bytes:
+        raise ImapAppendError(f"{label} exceeds the deployment limit of {max_bytes} bytes", temporary=False)
+
+
 def _mock_record_folder(record: dict[str, Any]) -> str:
     folder = str(record.get("folder") or "").strip()
     if folder:
@@ -834,6 +922,71 @@ def _mock_raw_bytes(record: dict[str, Any]) -> bytes:
     return "\n".join(lines).encode("utf-8", errors="replace")
 
 
+def _mock_mailbox_page_offset(
+    records: list[dict[str, Any]],
+    *,
+    offset: int,
+    after_uid: str | None,
+    expected_uidvalidity: str | None,
+) -> tuple[int, bool]:
+    if expected_uidvalidity and expected_uidvalidity != "mock-v1":
+        return 0, True
+    if after_uid:
+        record_ids = [str(record.get("id") or "") for record in records]
+        try:
+            return record_ids.index(str(after_uid)) + 1, False
+        except ValueError:
+            return 0, True
+    return min(offset, len(records)), False
+
+
+def _mock_message_summary(record: dict[str, Any]) -> ImapMailboxMessageSummary:
+    return _message_summary_from_raw(
+        uid=str(record.get("id") or ""),
+        folder=_mock_record_folder(record),
+        raw=_mock_raw_bytes(record),
+        flags=["\\Seen"] if record.get("kind") == "imap_append" else [],
+        size_bytes=int(record.get("size_bytes") or 0) or None,
+    )
+
+
+def _list_mock_imap_messages(
+    *,
+    host: str,
+    port: int,
+    security: str,
+    folder: str,
+    limit: int,
+    offset: int,
+    after_uid: str | None,
+    expected_uidvalidity: str | None,
+) -> ImapMailboxMessageListResult:
+    records = [
+        record
+        for record in list_records(limit=500)
+        if _mock_folder_matches(record, folder)
+    ]
+    effective_offset, cursor_reset = _mock_mailbox_page_offset(
+        records,
+        offset=offset,
+        after_uid=after_uid,
+        expected_uidvalidity=expected_uidvalidity,
+    )
+    page_records = records[effective_offset : effective_offset + limit]
+    return ImapMailboxMessageListResult(
+        host=host,
+        port=port,
+        security=security,
+        folder=folder,
+        messages=[_mock_message_summary(record) for record in page_records],
+        total_count=len(records),
+        offset=effective_offset,
+        limit=limit,
+        uidvalidity="mock-v1",
+        cursor_reset=cursor_reset,
+    )
+
+
 def list_imap_messages(
     *,
     imap_config: ImapConfig,
@@ -848,88 +1001,29 @@ def list_imap_messages(
     host, port = _require_imap_config(imap_config)
     folder, limit, offset = _normalize_mailbox_page(folder=folder, limit=limit, offset=offset)
     if is_mock_imap_host(imap_config.host):
-        records = [record for record in list_records(limit=500) if _mock_folder_matches(record, folder)]
+        return _list_mock_imap_messages(
-        cursor_reset = False
-        if expected_uidvalidity and expected_uidvalidity != "mock-v1":
-            effective_offset = 0
-            cursor_reset = True
-        elif after_uid:
-            record_ids = [str(record.get("id") or "") for record in records]
-            try:
-                effective_offset = record_ids.index(str(after_uid)) + 1
-            except ValueError:
-                effective_offset = 0
-                cursor_reset = True
-        else:
-            effective_offset = min(offset, len(records))
-        page_records = records[effective_offset:effective_offset + limit]
-        messages = [
-            _message_summary_from_raw(
-                uid=str(record.get("id") or ""),
-                folder=_mock_record_folder(record),
-                raw=_mock_raw_bytes(record),
-                flags=["\\Seen"] if record.get("kind") == "imap_append" else [],
-                size_bytes=int(record.get("size_bytes") or 0) or None,
-            )
-            for record in page_records
-        ]
-        return ImapMailboxMessageListResult(
             host=host,
             port=port,
             security=imap_config.security.value,
             folder=folder,
-            messages=messages,
-            total_count=len(records),
-            offset=effective_offset,
             limit=limit,
-            uidvalidity="mock-v1",
+            offset=offset,
-            cursor_reset=cursor_reset,
+            after_uid=after_uid,
+            expected_uidvalidity=expected_uidvalidity,
         )
 
     client = _open_imap(imap_config)
     try:
-        total_count, uidvalidity = _select_readonly(client, folder)
+        return _list_imap_messages_on_client(
-        if after_uid is None and expected_uidvalidity is None:
+            client,
-            page_sequences = _paged_descending_sequences(total_count, offset=offset, limit=limit)
-            messages = _fetch_message_summaries_by_sequence(client, page_sequences, folder)
-            return ImapMailboxMessageListResult(
             host=host,
             port=port,
             security=imap_config.security.value,
             folder=folder,
-                messages=messages,
+            limit=limit,
-                total_count=total_count,
             offset=offset,
-                limit=limit,
+            after_uid=after_uid,
-                uidvalidity=None,
+            expected_uidvalidity=expected_uidvalidity,
-                cursor_reset=False,
-            )
-        uids = _search_message_uids(client)
-        cursor_reset = False
-        effective_after_uid = after_uid
-        effective_offset = offset
-        if expected_uidvalidity and expected_uidvalidity != uidvalidity:
-            effective_after_uid = None
-            effective_offset = 0
-            cursor_reset = True
-        page_uids, effective_offset, anchor_missing = _paged_descending_uids(
-            uids,
-            offset=effective_offset,
-            limit=limit,
-            after_uid=effective_after_uid,
-        )
-        messages = _fetch_message_summaries_by_uid(client, page_uids, folder)
-        return ImapMailboxMessageListResult(
-            host=host,
-            port=port,
-            security=imap_config.security.value,
-            folder=folder,
-            messages=messages,
-            total_count=len(uids) if uids else total_count,
-            offset=effective_offset,
-            limit=limit,
-            uidvalidity=uidvalidity,
-            cursor_reset=cursor_reset or anchor_missing,
         )
     finally:
         try:
@@ -1013,10 +1107,12 @@ def append_message_to_sent(
         )
 
     client: imaplib.IMAP4 | None = None
+    append_started = False
     try:
         client = _open_imap(imap_config)
         target_folder = _effective_sent_folder(config=imap_config, requested_folder=folder, client=client)
         internal_date = imaplib.Time2Internaldate(time.time())
+        append_started = True
         typ, data = client.append(_quote_mailbox_name(target_folder), "\\Seen", internal_date, message_bytes)
         if typ != "OK":
             raise ImapAppendError(f"IMAP APPEND failed for folder {target_folder!r}: {data!r}", temporary=False)
@@ -1032,9 +1128,17 @@ def append_message_to_sent(
     except ImapAppendError:
         raise
     except (OSError, socket.timeout, imaplib.IMAP4.abort) as exc:
-        raise ImapAppendError(f"IMAP append failed: {exc}", temporary=True) from exc
+        raise ImapAppendError(
+            f"IMAP append failed: {exc}",
+            temporary=not append_started,
+            outcome_unknown=append_started,
+        ) from exc
     except imaplib.IMAP4.error as exc:
-        raise ImapAppendError(f"IMAP append failed: {exc}", temporary=False) from exc
+        raise ImapAppendError(
+            f"IMAP append failed: {exc}",
+            temporary=False,
+            outcome_unknown=append_started,
+        ) from exc
     finally:
         if client is not None:
             try:

src/govoplan_mail/backend/sending/smtp.py

@@ -8,6 +8,12 @@ from dataclasses import dataclass
 from email.message import EmailMessage
 from email.utils import formataddr
 
+from govoplan_core.security.outbound_http import (
+    OutboundHttpError,
+    create_outbound_connection,
+    validate_outbound_host,
+)
+
 from govoplan_mail.backend.config import SmtpConfig, TransportSecurity
 from govoplan_mail.backend.dev.mock_mailbox import (
     consume_fail_next_smtp,
@@ -19,6 +25,33 @@ from govoplan_mail.backend.dev.mock_mailbox import (
 logger = logging.getLogger(__name__)
 
 
+class _OutboundPolicySMTP(smtplib.SMTP):
+    def _get_socket(self, host: str, port: int, timeout: float | None):  # type: ignore[no-untyped-def]
+        return create_outbound_connection(
+            host,
+            port,
+            timeout=timeout,
+            source_address=self.source_address,
+            label="SMTP connector",
+        )
+
+
+class _OutboundPolicySMTPSSL(smtplib.SMTP_SSL):
+    def _get_socket(self, host: str, port: int, timeout: float | None):  # type: ignore[no-untyped-def]
+        sock = create_outbound_connection(
+            host,
+            port,
+            timeout=timeout,
+            source_address=self.source_address,
+            label="SMTP connector",
+        )
+        try:
+            return self.context.wrap_socket(sock, server_hostname=self._host)
+        except Exception:
+            sock.close()
+            raise
+
+
 class SmtpConfigurationError(ValueError):
     """Raised when SMTP settings are incomplete or inconsistent."""
 
@@ -75,14 +108,23 @@ def _require_smtp_config(config: SmtpConfig) -> tuple[str, int]:
 
 def _open_smtp(config: SmtpConfig) -> smtplib.SMTP:
     host, port = _require_smtp_config(config)
+    try:
+        validate_outbound_host(host, port=port, label="SMTP connector")
+    except OutboundHttpError as exc:
+        raise SmtpConfigurationError(str(exc)) from exc
     context = ssl.create_default_context()
 
     try:
         if config.security == TransportSecurity.TLS:
-            smtp: smtplib.SMTP = smtplib.SMTP_SSL(host=host, port=port, timeout=config.timeout_seconds, context=context)
+            smtp: smtplib.SMTP = _OutboundPolicySMTPSSL(
+                host=host,
+                port=port,
+                timeout=config.timeout_seconds,
+                context=context,
+            )
             smtp.ehlo()
         else:
-            smtp = smtplib.SMTP(host=host, port=port, timeout=config.timeout_seconds)
+            smtp = _OutboundPolicySMTP(host=host, port=port, timeout=config.timeout_seconds)
             smtp.ehlo()
             if config.security == TransportSecurity.STARTTLS:
                 smtp.starttls(context=context)

tests/test_campaign_capability.py

@@ -0,0 +1,322 @@
+from __future__ import annotations
+
+import json
+import unittest
+from dataclasses import asdict
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from govoplan_mail.backend.capabilities import (
+    MailCampaignCapability,
+    append_campaign_message_to_sent,
+    campaign_profile_delivery_summary,
+    send_campaign_email_bytes,
+)
+from govoplan_mail.backend.config import ImapConfig, SmtpConfig
+from govoplan_mail.backend.mail_profiles import MailProfileError
+from govoplan_mail.backend.sending.imap import ImapAppendError
+from govoplan_mail.backend.sending.smtp import SmtpSendError
+
+
+def _profile() -> SimpleNamespace:
+    return SimpleNamespace(
+        smtp_config={
+            "host": "smtp.internal.example",
+            "port": 587,
+            "security": "starttls",
+        },
+        smtp_username="service-account",
+        smtp_password_encrypted="encrypted-secret",
+        smtp_transport_revision="smtp-revision",
+        imap_config=None,
+        imap_username=None,
+        imap_password_encrypted=None,
+        imap_transport_revision="imap-revision",
+    )
+
+
+class CampaignMailCapabilityTests(unittest.TestCase):
+    def test_summary_does_not_materialize_or_decrypt_credentials(self) -> None:
+        profile = _profile()
+        with (
+            patch(
+                "govoplan_mail.backend.capabilities.ensure_mail_profile_allowed_for_campaign",
+                return_value=profile,
+            ),
+            patch("govoplan_mail.backend.capabilities.effective_mail_profile_policy", return_value=object()),
+            patch("govoplan_mail.backend.capabilities._assert_campaign_inherits_profile_credentials"),
+            patch(
+                "govoplan_mail.backend.capabilities.smtp_config_from_profile",
+                side_effect=AssertionError("summary must not decrypt SMTP credentials"),
+            ),
+            patch(
+                "govoplan_mail.backend.capabilities.imap_config_from_profile",
+                side_effect=AssertionError("summary must not decrypt IMAP credentials"),
+            ),
+        ):
+            summary = campaign_profile_delivery_summary(
+                object(),  # type: ignore[arg-type]
+                tenant_id="tenant-1",
+                campaign_id="campaign-1",
+                profile_id="profile-1",
+            )
+
+        self.assertTrue(summary["smtp_available"])
+        self.assertFalse(summary["imap_available"])
+        self.assertNotIn("service-account", repr(summary))
+        self.assertNotIn("internal.example", repr(summary))
+        self.assertNotIn("secret", repr(summary))
+
+    def test_send_compares_revision_before_provider_effect(self) -> None:
+        profile = _profile()
+        with (
+            patch(
+                "govoplan_mail.backend.capabilities._authorized_campaign_profile",
+                return_value=profile,
+            ),
+            patch(
+                "govoplan_mail.backend.capabilities.smtp_config_from_profile",
+                side_effect=AssertionError("stale revisions must be rejected before SMTP credential decryption"),
+            ),
+            patch(
+                "govoplan_mail.backend.capabilities.campaign_profile_transport_revisions",
+                return_value={"smtp": "current", "imap": None},
+            ),
+            patch("govoplan_mail.backend.capabilities.send_email_bytes") as provider_send,
+        ):
+            with self.assertRaisesRegex(MailProfileError, "changed after this campaign was built"):
+                send_campaign_email_bytes(
+                    object(),  # type: ignore[arg-type]
+                    tenant_id="tenant-1",
+                    campaign_id="campaign-1",
+                    profile_id="profile-1",
+                    message_bytes=b"message",
+                    envelope_from="sender@example.test",
+                    envelope_recipients=["recipient@example.test"],
+                    from_header="sender@example.test",
+                    expected_smtp_transport_revision="stale",
+                )
+
+        provider_send.assert_not_called()
+
+    def test_stale_imap_revision_is_rejected_before_credential_decryption(self) -> None:
+        profile = _profile()
+        profile.imap_config = {
+            "host": "imap.internal.example",
+            "port": 993,
+            "security": "tls",
+        }
+        with (
+            patch(
+                "govoplan_mail.backend.capabilities._authorized_campaign_profile",
+                return_value=profile,
+            ),
+            patch(
+                "govoplan_mail.backend.capabilities.campaign_profile_transport_revisions",
+                return_value={"smtp": "smtp-current", "imap": "imap-current"},
+            ),
+            patch(
+                "govoplan_mail.backend.capabilities.imap_config_from_profile",
+                side_effect=AssertionError("stale revisions must be rejected before IMAP credential decryption"),
+            ),
+            patch("govoplan_mail.backend.capabilities.append_message_to_sent") as provider_append,
+        ):
+            with self.assertRaisesRegex(MailProfileError, "changed after this campaign was built"):
+                append_campaign_message_to_sent(
+                    object(),  # type: ignore[arg-type]
+                    tenant_id="tenant-1",
+                    campaign_id="campaign-1",
+                    profile_id="profile-1",
+                    message_bytes=b"message",
+                    folder="Sent",
+                    expected_smtp_transport_revision="smtp-current",
+                    expected_imap_transport_revision="imap-stale",
+                )
+
+        provider_append.assert_not_called()
+
+    def test_provider_response_is_sanitized_before_campaign_evidence(self) -> None:
+        profile = _profile()
+        smtp = SmtpConfig(host="smtp.internal.example", port=587)
+        provider_secret = b"smtp.internal.example says credential=provider-secret"
+        provider_result = SimpleNamespace(
+            envelope_recipients=["ok@example.test", "blocked@example.test"],
+            refused_recipients={"blocked@example.test": (550, provider_secret)},
+        )
+        with (
+            patch(
+                "govoplan_mail.backend.capabilities._authorized_campaign_profile",
+                return_value=profile,
+            ),
+            patch("govoplan_mail.backend.capabilities.smtp_config_from_profile", return_value=smtp),
+            patch(
+                "govoplan_mail.backend.capabilities.imap_config_from_profile",
+                side_effect=AssertionError("SMTP delivery must not decrypt IMAP credentials"),
+            ),
+            patch(
+                "govoplan_mail.backend.capabilities.campaign_profile_transport_revisions",
+                return_value={"smtp": "current", "imap": None},
+            ),
+            patch("govoplan_mail.backend.capabilities.assert_mail_policy_allows_send"),
+            patch("govoplan_mail.backend.capabilities.send_email_bytes", return_value=provider_result),
+        ):
+            result = send_campaign_email_bytes(
+                object(),  # type: ignore[arg-type]
+                tenant_id="tenant-1",
+                campaign_id="campaign-1",
+                profile_id="profile-1",
+                message_bytes=b"message",
+                envelope_from="sender@example.test",
+                envelope_recipients=provider_result.envelope_recipients,
+                from_header="sender@example.test",
+                expected_smtp_transport_revision="current",
+            )
+
+        evidence = json.dumps(asdict(result), sort_keys=True)
+        self.assertEqual(result.accepted_count, 1)
+        self.assertIn('"status_code": 550', evidence)
+        self.assertIn('"classification": "permanent"', evidence)
+        self.assertNotIn("smtp.internal.example", evidence)
+        self.assertNotIn("provider-secret", evidence)
+
+    def test_append_materializes_only_imap_credentials_and_preserves_unknown_outcome(self) -> None:
+        profile = _profile()
+        profile.imap_config = {
+            "host": "imap.internal.example",
+            "port": 993,
+            "security": "tls",
+        }
+        imap = ImapConfig(host="imap.internal.example", port=993)
+        with (
+            patch(
+                "govoplan_mail.backend.capabilities._authorized_campaign_profile",
+                return_value=profile,
+            ),
+            patch("govoplan_mail.backend.capabilities.imap_config_from_profile", return_value=imap),
+            patch(
+                "govoplan_mail.backend.capabilities.smtp_config_from_profile",
+                side_effect=AssertionError("IMAP append must not decrypt SMTP credentials"),
+            ),
+            patch(
+                "govoplan_mail.backend.capabilities.campaign_profile_transport_revisions",
+                return_value={"smtp": "smtp-current", "imap": "imap-current"},
+            ),
+            patch("govoplan_mail.backend.capabilities.assert_mail_policy_allows_send"),
+            patch(
+                "govoplan_mail.backend.capabilities.append_message_to_sent",
+                side_effect=ImapAppendError(
+                    "imap.internal.example provider-secret",
+                    outcome_unknown=True,
+                ),
+            ),
+        ):
+            with self.assertRaises(ImapAppendError) as captured:
+                append_campaign_message_to_sent(
+                    object(),  # type: ignore[arg-type]
+                    tenant_id="tenant-1",
+                    campaign_id="campaign-1",
+                    profile_id="profile-1",
+                    message_bytes=b"message",
+                    folder="Sent",
+                    expected_smtp_transport_revision="smtp-current",
+                    expected_imap_transport_revision="imap-current",
+                )
+
+        self.assertTrue(captured.exception.outcome_unknown)
+        self.assertFalse(captured.exception.temporary)
+        self.assertIn("inspect the mailbox", str(captured.exception))
+        self.assertNotIn("internal.example", str(captured.exception))
+        self.assertNotIn("provider-secret", str(captured.exception))
+
+    def test_provider_exception_is_sanitized_and_bounded(self) -> None:
+        profile = _profile()
+        smtp = SmtpConfig(host="smtp.internal.example", port=587)
+        with (
+            patch(
+                "govoplan_mail.backend.capabilities._authorized_campaign_profile",
+                return_value=profile,
+            ),
+            patch("govoplan_mail.backend.capabilities.smtp_config_from_profile", return_value=smtp),
+            patch(
+                "govoplan_mail.backend.capabilities.campaign_profile_transport_revisions",
+                return_value={"smtp": "current", "imap": None},
+            ),
+            patch("govoplan_mail.backend.capabilities.assert_mail_policy_allows_send"),
+            patch(
+                "govoplan_mail.backend.capabilities.send_email_bytes",
+                side_effect=SmtpSendError(
+                    "smtp.internal.example provider-secret " + ("x" * 1_000),
+                    temporary=True,
+                ),
+            ),
+        ):
+            with self.assertRaises(SmtpSendError) as captured:
+                send_campaign_email_bytes(
+                    object(),  # type: ignore[arg-type]
+                    tenant_id="tenant-1",
+                    campaign_id="campaign-1",
+                    profile_id="profile-1",
+                    message_bytes=b"message",
+                    envelope_from="sender@example.test",
+                    envelope_recipients=["recipient@example.test"],
+                    from_header="sender@example.test",
+                    expected_smtp_transport_revision="current",
+                )
+
+        message = str(captured.exception)
+        self.assertEqual(message, "Mail delivery failed temporarily.")
+        self.assertNotIn("internal.example", message)
+        self.assertLessEqual(len(message), 80)
+        self.assertIsNone(captured.exception.__cause__)
+
+    def test_unclassified_provider_exception_is_outcome_unknown(self) -> None:
+        profile = _profile()
+        smtp = SmtpConfig(host="smtp.internal.example", port=587)
+        with (
+            patch(
+                "govoplan_mail.backend.capabilities._authorized_campaign_profile",
+                return_value=profile,
+            ),
+            patch("govoplan_mail.backend.capabilities.smtp_config_from_profile", return_value=smtp),
+            patch(
+                "govoplan_mail.backend.capabilities.campaign_profile_transport_revisions",
+                return_value={"smtp": "current", "imap": None},
+            ),
+            patch("govoplan_mail.backend.capabilities.assert_mail_policy_allows_send"),
+            patch(
+                "govoplan_mail.backend.capabilities.send_email_bytes",
+                side_effect=RuntimeError("smtp.internal.example provider-secret"),
+            ),
+        ):
+            with self.assertRaises(SmtpSendError) as captured:
+                send_campaign_email_bytes(
+                    object(),  # type: ignore[arg-type]
+                    tenant_id="tenant-1",
+                    campaign_id="campaign-1",
+                    profile_id="profile-1",
+                    message_bytes=b"message",
+                    envelope_from="sender@example.test",
+                    envelope_recipients=["recipient@example.test"],
+                    from_header="sender@example.test",
+                    expected_smtp_transport_revision="current",
+                )
+
+        self.assertTrue(captured.exception.outcome_unknown)
+        self.assertNotIn("internal.example", str(captured.exception))
+        self.assertIsNone(captured.exception.__cause__)
+
+    def test_capability_does_not_export_raw_profile_or_transport_helpers(self) -> None:
+        capability = MailCampaignCapability()
+
+        for name in (
+            "smtp_config_from_profile",
+            "imap_config_from_profile",
+            "send_email_bytes",
+            "send_email_message",
+            "materialize_campaign_mail_profile_config",
+        ):
+            self.assertFalse(hasattr(capability, name), name)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_documentation.py

@@ -0,0 +1,186 @@
+from __future__ import annotations
+
+import unittest
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from sqlalchemy.orm import Session
+
+from govoplan_core.core.modules import DocumentationContext
+from govoplan_mail.backend.documentation import documentation_topics
+from govoplan_mail.backend.mail_profiles import EffectiveMailProfilePolicy, MailProfileError
+
+
+class _Principal:
+    tenant_id = "tenant-1"
+    user = SimpleNamespace(id="user-1")
+
+    def __init__(self, scopes: set[str]) -> None:
+        self.scopes = frozenset(scopes)
+
+    def has(self, scope: str) -> bool:
+        return scope in self.scopes
+
+
+class MailRuntimeDocumentationTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self.session = Session()
+
+    def tearDown(self) -> None:
+        self.session.close()
+
+    def context(self, scopes: set[str], *, documentation_type: str = "user") -> DocumentationContext:
+        return DocumentationContext(
+            registry=object(),
+            principal=_Principal(scopes),
+            settings=None,
+            session=self.session,
+            documentation_type=documentation_type,  # type: ignore[arg-type]
+        )
+
+    def topics(self, context: DocumentationContext, user_policy: EffectiveMailProfilePolicy) -> dict[str, object]:
+        tenant_policy = EffectiveMailProfilePolicy()
+
+        def effective_policy(_session, *, scope_type, **_kwargs):
+            return user_policy if scope_type == "user" else tenant_policy
+
+        with patch(
+            "govoplan_mail.backend.documentation.effective_mail_profile_policy_for_scope",
+            side_effect=effective_policy,
+        ):
+            return {topic.id: topic for topic in documentation_topics(context)}
+
+    def test_custom_profile_task_requires_write_authority_and_enabled_user_profiles(self) -> None:
+        enabled = EffectiveMailProfilePolicy(allow_user_profiles=True)
+        without_write = self.topics(self.context({"mail:profile:read"}), enabled)
+        self.assertNotIn("mail.workflow.create-custom-profile", without_write)
+
+        without_read = self.topics(self.context({"mail:profile:write"}), enabled)
+        self.assertNotIn("mail.workflow.create-custom-profile", without_read)
+
+        disabled = EffectiveMailProfilePolicy(allow_user_profiles=False)
+        blocked = self.topics(self.context({"mail:profile:read", "mail:profile:write"}), disabled)
+        self.assertNotIn("mail.workflow.create-custom-profile", blocked)
+
+        available = self.topics(self.context({"mail:profile:read", "mail:profile:write"}), enabled)
+        self.assertIn("mail.workflow.create-custom-profile", available)
+        task = available["mail.workflow.create-custom-profile"]
+        self.assertEqual(task.title, "Create a custom Mail profile")
+        self.assertEqual(task.metadata["route"], "/settings?section=mail-profiles")
+        self.assertEqual(task.metadata["help_contexts"], ["mail.profiles", "app.settings"])
+        self.assertIn("current account's user scope", task.metadata["prerequisites"][0])
+
+        self_service = self.topics(
+            self.context(
+                {"mail:profile:read", "mail:profile:write_own"}
+            ),
+            enabled,
+        )
+        self.assertIn("mail.workflow.create-custom-profile", self_service)
+        condition = self_service["mail.workflow.create-custom-profile"].conditions[0]
+        self.assertEqual(condition.required_scopes, ("mail:profile:read",))
+        self.assertEqual(
+            condition.any_scopes,
+            ("mail:profile:write", "mail:profile:write_own"),
+        )
+
+    def test_custom_profile_task_distinguishes_secret_test_and_use_authority(self) -> None:
+        policy = EffectiveMailProfilePolicy()
+        cases = (
+            (set(), False, False, False),
+            ({"mail:secret:manage"}, True, False, False),
+            ({"mail:profile:test"}, False, False, False),
+            ({"mail:profile:use"}, False, False, True),
+            ({"mail:profile:test", "mail:profile:use"}, False, True, True),
+            ({"mail:secret:manage", "mail:profile:test", "mail:profile:use"}, True, True, True),
+            ({"mail:secret:manage_own"}, True, False, False),
+        )
+        for extra_scopes, credentials, testing, use in cases:
+            with self.subTest(extra_scopes=extra_scopes):
+                topics = self.topics(self.context({"mail:profile:read", "mail:profile:write", *extra_scopes}), policy)
+                task = topics["mail.workflow.create-custom-profile"]
+                self.assertEqual(task.metadata["can_manage_credentials"], credentials)
+                self.assertEqual(task.metadata["can_test_profile"], testing)
+                self.assertEqual(task.metadata["can_use_profile"], use)
+                self.assertIn(
+                    "you may save or replace" if credentials else "you cannot save or replace passwords",
+                    task.body,
+                )
+                self.assertIn(
+                    "you may run" if testing else "does not let you run connection tests",
+                    task.body,
+                )
+                self.assertIn(
+                    "you may select" if use else "does not let you select or use it",
+                    task.body,
+                )
+
+    def test_custom_profile_task_preserves_host_allow_group_and_deny_precedence(self) -> None:
+        policy = EffectiveMailProfilePolicy(
+            whitelist_groups={
+                "smtp_hosts": [
+                    ["*.example.edu", "smtp.shared.test"],
+                    ["smtp-*.example.edu"],
+                ],
+                "imap_hosts": [["imap.example.edu"]],
+            },
+            blacklist_patterns={
+                "smtp_hosts": ["smtp-blocked.example.edu"],
+                "imap_hosts": ["imap-legacy.example.edu"],
+            },
+            allowed_profile_id_sets=[{"private-profile-id"}],
+        )
+        topics = self.topics(
+            self.context({"mail:profile:read", "mail:profile:write", "mail:secret:manage", "mail:profile:test", "mail:profile:use"}),
+            policy,
+        )
+        task = topics["mail.workflow.create-custom-profile"]
+        constraints = {item["id"]: item for item in task.metadata["constraints"]}
+        constraints_text = " ".join(item["description"] for item in task.metadata["constraints"])
+
+        self.assertIn("Deny rules are checked first", constraints_text)
+        self.assertEqual(constraints["smtp-host-deny"]["values"], ["smtp-blocked.example.edu"])
+        self.assertEqual(constraints["smtp-host-allow-1"]["values"], ["*.example.edu", "smtp.shared.test"])
+        self.assertEqual(constraints["smtp-host-allow-2"]["values"], ["smtp-*.example.edu"])
+        self.assertIn("every active allow-list group", constraints_text)
+        self.assertEqual(constraints["imap-host-allow-1"]["values"], ["imap.example.edu"])
+        self.assertTrue(task.metadata["approval_required_before_use"])
+        self.assertIn("must be approved before the profile can be selected or used", task.body)
+        self.assertNotIn("private-profile-id", repr(task))
+        self.assertIn("every active allow-list group", constraints["smtp-host-allow-1"]["description"])
+
+    def test_custom_profile_task_explains_when_no_approval_list_is_active(self) -> None:
+        topics = self.topics(
+            self.context({"mail:profile:read", "mail:profile:write", "mail:profile:use"}),
+            EffectiveMailProfilePolicy(),
+        )
+        task = topics["mail.workflow.create-custom-profile"]
+        self.assertFalse(task.metadata["approval_required_before_use"])
+        self.assertIn("no approved-profile list currently blocks", task.body)
+
+    def test_user_policy_errors_are_generic_and_never_create_a_task(self) -> None:
+        context = self.context({"mail:profile:read", "mail:profile:write"})
+        with patch(
+            "govoplan_mail.backend.documentation.effective_mail_profile_policy_for_scope",
+            side_effect=MailProfileError("sensitive source-id profile-id username secret"),
+        ):
+            topics = {topic.id: topic for topic in documentation_topics(context)}
+
+        self.assertNotIn("mail.workflow.create-custom-profile", topics)
+        unavailable = topics["mail.tenant-profile-policy-unavailable"]
+        self.assertEqual(
+            unavailable.body,
+            "The current Mail policy could not be loaded. Try again or ask a Mail administrator for help.",
+        )
+        self.assertNotIn("sensitive", repr(unavailable))
+
+    def test_manifest_workflows_declare_contextual_help_targets(self) -> None:
+        from govoplan_mail.backend.manifest import get_manifest
+
+        topics = {topic.id: topic for topic in get_manifest().documentation}
+        self.assertEqual(topics["mail.workflow.choose-and-test-profile"].metadata["help_contexts"], ["mail.profiles", "app.settings"])
+        self.assertEqual(topics["mail.workflow.read-mailbox"].metadata["help_contexts"], ["mail.list"])
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_imap_parser.py

@@ -3,20 +3,51 @@ from __future__ import annotations
 import unittest
 from unittest.mock import patch
 
+from govoplan_core.security.outbound_http import OutboundHttpBlocked
 from govoplan_mail.backend.config import ImapConfig
 from govoplan_mail.backend.sending.imap import (
+    ImapAppendError,
+    ImapConfigurationError,
     _detect_sent_folder,
     _extract_mailbox_name,
+    _fetch_message_by_uid,
     _normalize_mailbox_page,
+    _open_imap,
     _paged_descending_sequences,
     _parse_fetch_sequence,
     _select_readonly,
     _sequence_set,
     append_message_to_sent,
+    list_imap_messages,
 )
 
 
 class ImapFolderParserTests(unittest.TestCase):
+    def test_real_imap_connections_honor_deployment_egress_policy(self):
+        config = ImapConfig(host="imap.internal", port=993, security="tls")
+        with patch(
+            "govoplan_mail.backend.sending.imap.validate_outbound_host",
+            side_effect=OutboundHttpBlocked("private network blocked"),
+        ), self.assertRaisesRegex(ImapConfigurationError, "private network blocked"):
+            _open_imap(config)
+
+    def test_imap_revalidates_and_pins_at_connection_time(self):
+        config = ImapConfig(host="imap.example.test", port=993, security="tls")
+        public = [(2, 1, 6, "", ("93.184.216.34", 993))]
+        private = [(2, 1, 6, "", ("127.0.0.1", 993))]
+        with patch.dict(
+            "os.environ",
+            {"APP_ENV": "production", "GOVOPLAN_CONNECTOR_ALLOW_PRIVATE_NETWORKS": "false"},
+        ), patch(
+            "govoplan_core.security.outbound_http.socket.getaddrinfo",
+            side_effect=(public, private),
+        ), patch("govoplan_core.security.outbound_http.socket.socket") as socket_factory, self.assertRaisesRegex(
+            OutboundHttpBlocked,
+            "non-public network",
+        ):
+            _open_imap(config)
+        socket_factory.assert_not_called()
+
     def test_extracts_quoted_mailbox_after_quoted_delimiter(self):
         self.assertEqual(
             _extract_mailbox_name(b'(\\HasNoChildren \\Sent) "/" "Sent Items"'),
@@ -49,6 +80,108 @@ class ImapFolderParserTests(unittest.TestCase):
 
 
 class ImapMessagePaginationTests(unittest.TestCase):
+    def test_mock_message_cursor_preserves_order_and_resets_when_stale(self):
+        records = [
+            {
+                "id": "3",
+                "kind": "smtp",
+                "raw_eml": "Subject: Three\r\n\r\nBody",
+                "size_bytes": 26,
+            },
+            {
+                "id": "2",
+                "kind": "smtp",
+                "raw_eml": "Subject: Two\r\n\r\nBody",
+                "size_bytes": 24,
+            },
+        ]
+        config = ImapConfig(host="mock.imap.local")
+
+        with patch(
+            "govoplan_mail.backend.sending.imap.list_records",
+            return_value=records,
+        ):
+            page = list_imap_messages(
+                imap_config=config,
+                after_uid="3",
+                expected_uidvalidity="mock-v1",
+                limit=1,
+            )
+            reset_page = list_imap_messages(
+                imap_config=config,
+                after_uid="3",
+                expected_uidvalidity="stale",
+                limit=1,
+            )
+
+        self.assertEqual([message.uid for message in page.messages], ["2"])
+        self.assertEqual(page.offset, 1)
+        self.assertFalse(page.cursor_reset)
+        self.assertEqual([message.uid for message in reset_page.messages], ["3"])
+        self.assertEqual(reset_page.offset, 0)
+        self.assertTrue(reset_page.cursor_reset)
+
+    def test_real_message_listing_delegates_to_shared_client_path(self):
+        class Client:
+            logged_out = False
+
+            def logout(self):
+                self.logged_out = True
+
+        client = Client()
+        expected = object()
+        config = ImapConfig(host="imap.example.org")
+
+        with (
+            patch(
+                "govoplan_mail.backend.sending.imap._open_imap",
+                return_value=client,
+            ),
+            patch(
+                "govoplan_mail.backend.sending.imap._list_imap_messages_on_client",
+                return_value=expected,
+            ) as list_on_client,
+        ):
+            result = list_imap_messages(
+                imap_config=config,
+                folder=" Archive ",
+                limit=25,
+                offset=5,
+                after_uid="42",
+                expected_uidvalidity="7",
+            )
+
+        self.assertIs(result, expected)
+        self.assertTrue(client.logged_out)
+        list_on_client.assert_called_once_with(
+            client,
+            host="imap.example.org",
+            port=993,
+            security="tls",
+            folder="Archive",
+            limit=25,
+            offset=5,
+            after_uid="42",
+            expected_uidvalidity="7",
+        )
+
+    def test_full_message_fetch_uses_partial_range_and_deployment_limit(self):
+        class Client:
+            command = ""
+
+            def uid(self, command, uid, fetch_spec):
+                del command, uid
+                self.command = fetch_spec
+                return "OK", [(b"1 (UID 1 RFC822.SIZE 11)", b"12345678901")]
+
+        client = Client()
+        with patch.dict("os.environ", {"GOVOPLAN_CONNECTOR_MAX_FILE_TRANSFER_BYTES": "10"}), self.assertRaisesRegex(
+            ImapAppendError,
+            "deployment limit",
+        ):
+            _fetch_message_by_uid(client, "1")
+        self.assertIn("BODY.PEEK[]<0.11>", client.command)
+
     def test_paginates_sequence_numbers_newest_first(self):
         self.assertEqual(
             _paged_descending_sequences(120, offset=0, limit=5),
@@ -114,6 +247,22 @@ class ImapMailboxCommandTests(unittest.TestCase):
         self.assertEqual(result.folder, "Gesendete Elemente")
         self.assertEqual(result.bytes_appended, len(b"Subject: test\r\n\r\nBody"))
 
+    def test_connection_loss_after_append_starts_has_unknown_outcome(self):
+        class Client:
+            def append(self, _mailbox, _flags, _date_time, _message):
+                raise OSError("provider detail")
+
+            def logout(self):
+                return "BYE", [b"logged out"]
+
+        config = ImapConfig(host="imap.example.org", username="user", password="secret", sent_folder="Sent")
+        with patch("govoplan_mail.backend.sending.imap._open_imap", return_value=Client()):
+            with self.assertRaises(ImapAppendError) as captured:
+                append_message_to_sent(b"Subject: test\r\n\r\nBody", imap_config=config, folder="Sent")
+
+        self.assertTrue(captured.exception.outcome_unknown)
+        self.assertFalse(captured.exception.temporary)
+
 
 if __name__ == "__main__":
     unittest.main()

tests/test_mail_profile_helpers.py

@@ -2,21 +2,205 @@ from __future__ import annotations
 
 import unittest
 from types import SimpleNamespace
+from unittest.mock import patch
 
 from govoplan_core.security.secrets import decrypt_secret, encrypt_secret
 from govoplan_mail.backend.config import ImapConfig, SmtpConfig
 from govoplan_mail.backend.mail_profiles import (
+    EffectiveCredentialPolicy,
     EffectiveMailProfilePolicy,
+    MailProfileError,
+    _assert_campaign_inherits_profile_credentials,
+    _campaign_mail_profile_reference_id,
     _apply_profile_transport_update,
+    campaign_profile_transport_revisions,
+    create_mail_server_profile,
     _merge_policy,
     _next_profile_transport_state,
     _policy_parent_lock_message,
     _policy_parent_lock_violations,
+    delete_mail_profile_credentials,
+    update_mail_server_profile,
 )
 
 
 class MailProfileTransportHelperTests(unittest.TestCase):
-    def test_next_transport_state_uses_saved_profile_credentials(self):
+    def test_inactive_profile_creation_rejects_dormant_credentials(self):
+        session = SimpleNamespace()
+        with (
+            patch(
+                "govoplan_mail.backend.mail_profiles._scope_tuple_for_create",
+                return_value=("tenant-1", "tenant", "tenant-1"),
+            ),
+            patch("govoplan_mail.backend.mail_profiles._ensure_scope_allows_profile_creation"),
+            patch("govoplan_mail.backend.mail_profiles.assert_mail_policy_allows_transport"),
+            patch("govoplan_mail.backend.mail_profiles._ensure_unique_slug"),
+            self.assertRaisesRegex(MailProfileError, "cannot retain credentials"),
+        ):
+            create_mail_server_profile(
+                session,  # type: ignore[arg-type]
+                tenant_id="tenant-1",
+                user_id="user-1",
+                name="Dormant secret",
+                slug=None,
+                description=None,
+                smtp=SmtpConfig(host="smtp.example.test", password="secret"),
+                imap=None,
+                is_active=False,
+            )
+
+    def test_inactive_profile_cannot_retain_or_recreate_dormant_credentials(self):
+        session = SimpleNamespace()
+        legacy = SimpleNamespace(
+            is_active=False,
+            smtp_password_encrypted="legacy-ciphertext",
+            imap_password_encrypted=None,
+        )
+        with self.assertRaisesRegex(MailProfileError, "use DELETE to scrub"):
+            update_mail_server_profile(
+                session,  # type: ignore[arg-type]
+                legacy,  # type: ignore[arg-type]
+                tenant_id="tenant-1",
+                user_id="user-1",
+                is_active=True,
+            )
+        self.assertFalse(legacy.is_active)
+        self.assertEqual(legacy.smtp_password_encrypted, "legacy-ciphertext")
+
+        scrubbed = SimpleNamespace(
+            is_active=False,
+            smtp_password_encrypted=None,
+            imap_password_encrypted=None,
+        )
+        with self.assertRaisesRegex(MailProfileError, "activated in the same update"):
+            update_mail_server_profile(
+                session,  # type: ignore[arg-type]
+                scrubbed,  # type: ignore[arg-type]
+                tenant_id="tenant-1",
+                user_id="user-1",
+                smtp=SmtpConfig(host="smtp.example.test", password="new-secret"),
+            )
+        self.assertFalse(scrubbed.is_active)
+        self.assertIsNone(scrubbed.smtp_password_encrypted)
+
+    def test_campaign_transport_revisions_are_random_opaque_values(self):
+        profile = SimpleNamespace(
+            smtp_config={"host": "smtp.example.org", "port": 587, "security": "starttls", "timeout_seconds": 30},
+            smtp_username="first-user",
+            smtp_password_encrypted="first-secret-ciphertext",
+            smtp_transport_revision="032837ce-fd97-401a-8a9f-8df67f3ab41d",
+            imap_config=None,
+            imap_username=None,
+            imap_password_encrypted=None,
+            imap_transport_revision="9ca09521-c543-42ed-a8f2-f06783f1ebd3",
+        )
+
+        original = campaign_profile_transport_revisions(profile)
+        profile.smtp_password_encrypted = "second-secret-ciphertext"
+
+        self.assertEqual(campaign_profile_transport_revisions(profile), original)
+        self.assertNotIn("smtp.example.org", repr(original))
+        self.assertEqual(original["smtp"], profile.smtp_transport_revision)
+
+    def test_profile_deletion_scrubs_both_passwords_and_writes_non_secret_audit(self):
+        profile = SimpleNamespace(
+            id="profile-1",
+            tenant_id="tenant-1",
+            scope_type="tenant",
+            scope_id="tenant-1",
+            smtp_password_encrypted="smtp-ciphertext",
+            imap_password_encrypted="imap-ciphertext",
+        )
+        session = SimpleNamespace(add=lambda _value: None, flush=lambda: None)
+
+        with patch("govoplan_mail.backend.mail_profiles.audit_event") as audit:
+            deleted = delete_mail_profile_credentials(
+                session,  # type: ignore[arg-type]
+                profile=profile,  # type: ignore[arg-type]
+                deletion_reason="profile_deactivated",
+                user_id="user-1",
+            )
+
+        self.assertEqual(deleted, ("smtp", "imap"))
+        self.assertIsNone(profile.smtp_password_encrypted)
+        self.assertIsNone(profile.imap_password_encrypted)
+        self.assertEqual(audit.call_count, 1)
+        self.assertEqual(audit.call_args.kwargs["action"], "mail.profile_credentials_deleted")
+        self.assertEqual(audit.call_args.kwargs["scope"], "tenant")
+        self.assertEqual(audit.call_args.kwargs["details"]["deletion_reason"], "profile_deactivated")
+        self.assertNotIn("ciphertext", repr(audit.call_args.kwargs))
+
+    def test_system_profile_secret_deletion_uses_system_audit_scope(self):
+        profile = SimpleNamespace(
+            id="profile-system",
+            tenant_id=None,
+            scope_type="system",
+            scope_id=None,
+            smtp_password_encrypted="smtp-ciphertext",
+            imap_password_encrypted=None,
+        )
+        session = SimpleNamespace(add=lambda _value: None, flush=lambda: None)
+
+        with patch("govoplan_mail.backend.mail_profiles.audit_event") as audit:
+            delete_mail_profile_credentials(
+                session,  # type: ignore[arg-type]
+                profile=profile,  # type: ignore[arg-type]
+                deletion_reason="module_data_retired",
+            )
+
+        self.assertEqual(audit.call_args.kwargs["scope"], "system")
+        self.assertIsNone(audit.call_args.kwargs["tenant_id"])
+        self.assertNotIn("ciphertext", repr(audit.call_args.kwargs))
+
+    def test_repeated_profile_secret_deletion_is_an_idempotent_no_op(self):
+        profile = SimpleNamespace(
+            id="profile-1",
+            tenant_id="tenant-1",
+            scope_type="tenant",
+            scope_id="tenant-1",
+            smtp_password_encrypted=None,
+            imap_password_encrypted=None,
+        )
+        session = SimpleNamespace(add=lambda _value: self.fail("no-op must not add"), flush=lambda: self.fail("no-op must not flush"))
+
+        with patch("govoplan_mail.backend.mail_profiles.audit_event") as audit:
+            deleted = delete_mail_profile_credentials(
+                session,  # type: ignore[arg-type]
+                profile=profile,  # type: ignore[arg-type]
+                deletion_reason="profile_deactivated",
+            )
+
+        self.assertEqual(deleted, ())
+        audit.assert_not_called()
+
+    def test_profile_secret_deletion_does_not_mutate_ciphertext_when_audit_fails(self):
+        profile = SimpleNamespace(
+            id="profile-1",
+            tenant_id="tenant-1",
+            scope_type="tenant",
+            scope_id="tenant-1",
+            smtp_password_encrypted="smtp-ciphertext",
+            imap_password_encrypted="imap-ciphertext",
+        )
+        session = SimpleNamespace(add=lambda _value: None, flush=lambda: None)
+
+        with (
+            patch(
+                "govoplan_mail.backend.mail_profiles.audit_event",
+                side_effect=RuntimeError("audit unavailable"),
+            ),
+            self.assertRaisesRegex(RuntimeError, "audit unavailable"),
+        ):
+            delete_mail_profile_credentials(
+                session,  # type: ignore[arg-type]
+                profile=profile,  # type: ignore[arg-type]
+                deletion_reason="profile_deactivated",
+            )
+
+        self.assertEqual(profile.smtp_password_encrypted, "smtp-ciphertext")
+        self.assertEqual(profile.imap_password_encrypted, "imap-ciphertext")
+
+    def test_next_transport_state_uses_only_saved_non_secret_metadata(self):
         profile = SimpleNamespace(
             tenant_id="tenant-1",
             scope_type="tenant",
@@ -29,32 +213,51 @@ class MailProfileTransportHelperTests(unittest.TestCase):
             imap_password_encrypted=encrypt_secret("imap-secret"),
         )
 
+        with patch(
+            "govoplan_mail.backend.mail_profiles.decrypt_secret",
+            side_effect=AssertionError("policy validation must not decrypt credentials"),
+        ):
             smtp, imap = _next_profile_transport_state(profile, smtp=None, imap=None, clear_imap=False)
-        self.assertEqual(smtp.username, "saved-smtp")
+        self.assertEqual(smtp["host"], "smtp.example.org")
-        self.assertEqual(smtp.password, "smtp-secret")
+        self.assertNotIn("username", smtp)
+        self.assertNotIn("password", smtp)
         self.assertIsNotNone(imap)
-        self.assertEqual(imap.username, "saved-imap")
+        assert imap is not None
-        self.assertEqual(imap.password, "imap-secret")
+        self.assertEqual(imap["host"], "imap.example.org")
+        self.assertNotIn("username", imap)
+        self.assertNotIn("password", imap)
 
         _, cleared_imap = _next_profile_transport_state(profile, smtp=None, imap=None, clear_imap=True)
         self.assertIsNone(cleared_imap)
 
     def test_apply_transport_update_preserves_unsupplied_passwords(self):
         profile = SimpleNamespace(
+            id="profile-1",
+            tenant_id="tenant-1",
+            scope_type="tenant",
+            scope_id="tenant-1",
             smtp_config={"host": "smtp.example.org", "port": 587, "security": "starttls", "timeout_seconds": 30},
             smtp_username="saved-smtp",
             smtp_password_encrypted=encrypt_secret("smtp-secret"),
+            smtp_transport_revision="smtp-before",
             imap_config={"host": "imap.example.org", "port": 993, "security": "tls", "sent_folder": "Sent", "timeout_seconds": 30},
             imap_username="saved-imap",
             imap_password_encrypted=encrypt_secret("imap-secret"),
+            imap_transport_revision="imap-before",
         )
+        session = SimpleNamespace(flush=lambda: None)
 
+        with patch("govoplan_mail.backend.mail_profiles.clear_mailbox_index") as clear_index:
             _apply_profile_transport_update(
+                session,  # type: ignore[arg-type]
                 profile,
+                user_id="user-1",
+                api_key_id=None,
                 smtp=SmtpConfig(host="smtp2.example.org", username="new-smtp"),
                 imap=ImapConfig(host="imap2.example.org", username="new-imap"),
                 clear_imap=False,
             )
+        clear_index.assert_called_once_with(session, profile_id="profile-1")
 
         self.assertEqual(profile.smtp_config["host"], "smtp2.example.org")
         self.assertEqual(profile.smtp_username, "new-smtp")
@@ -62,14 +265,255 @@ class MailProfileTransportHelperTests(unittest.TestCase):
         self.assertEqual(profile.imap_config["host"], "imap2.example.org")
         self.assertEqual(profile.imap_username, "new-imap")
         self.assertEqual(decrypt_secret(profile.imap_password_encrypted), "imap-secret")
+        self.assertNotEqual(profile.smtp_transport_revision, "smtp-before")
+        self.assertNotEqual(profile.imap_transport_revision, "imap-before")
 
-        _apply_profile_transport_update(profile, smtp=None, imap=None, clear_imap=True)
+        with (
+            patch("govoplan_mail.backend.mail_profiles.audit_event") as audit,
+            patch("govoplan_mail.backend.mail_profiles.clear_mailbox_index") as clear_index,
+        ):
+            _apply_profile_transport_update(
+                session,  # type: ignore[arg-type]
+                profile,
+                user_id="user-1",
+                api_key_id=None,
+                smtp=None,
+                imap=None,
+                clear_imap=True,
+            )
+        clear_index.assert_called_once_with(session, profile_id="profile-1")
         self.assertIsNone(profile.imap_config)
         self.assertIsNone(profile.imap_username)
         self.assertIsNone(profile.imap_password_encrypted)
+        self.assertEqual(audit.call_args.kwargs["action"], "mail.profile_credentials_deleted")
+        self.assertEqual(audit.call_args.kwargs["details"]["protocol"], "imap")
+        self.assertNotIn("imap-secret", repr(audit.call_args.kwargs))
+
+    def test_imap_password_replacement_clears_cache_without_rotating_identity_revision(self):
+        profile = SimpleNamespace(
+            id="profile-1",
+            tenant_id="tenant-1",
+            scope_type="tenant",
+            scope_id="tenant-1",
+            smtp_config={"host": "smtp.example.org"},
+            smtp_username=None,
+            smtp_password_encrypted=None,
+            smtp_transport_revision="smtp-before",
+            imap_config={
+                "host": "imap.example.org",
+                "port": 993,
+                "security": "tls",
+                "sent_folder": "auto",
+                "timeout_seconds": 30,
+            },
+            imap_username="saved-imap",
+            imap_password_encrypted=encrypt_secret("old-secret"),
+            imap_transport_revision="imap-before",
+        )
+        session = SimpleNamespace(flush=lambda: None)
+
+        with (
+            patch("govoplan_mail.backend.mail_profiles.audit_event"),
+            patch("govoplan_mail.backend.mail_profiles.clear_mailbox_index") as clear_index,
+        ):
+            _apply_profile_transport_update(
+                session,  # type: ignore[arg-type]
+                profile,
+                user_id="user-1",
+                api_key_id=None,
+                smtp=None,
+                imap=ImapConfig(
+                    host="imap.example.org",
+                    port=993,
+                    security="tls",
+                    timeout_seconds=30,
+                    password="new-secret",
+                ),
+                clear_imap=False,
+            )
+
+        clear_index.assert_called_once_with(session, profile_id="profile-1")
+        self.assertEqual(profile.imap_transport_revision, "imap-before")
+        self.assertEqual(decrypt_secret(profile.imap_password_encrypted), "new-secret")
+
+    def test_password_replacement_preserves_revision_and_is_audited_without_secret(self):
+        profile = SimpleNamespace(
+            id="profile-1",
+            tenant_id="tenant-1",
+            scope_type="tenant",
+            scope_id="tenant-1",
+            smtp_config={"host": "smtp.example.org", "port": 587, "security": "starttls", "timeout_seconds": 30},
+            smtp_username="saved-smtp",
+            smtp_password_encrypted=encrypt_secret("old-secret"),
+            smtp_transport_revision="smtp-before",
+            imap_config=None,
+            imap_username=None,
+            imap_password_encrypted=None,
+            imap_transport_revision="imap-before",
+        )
+        session = SimpleNamespace(flush=lambda: None)
+
+        with patch("govoplan_mail.backend.mail_profiles.audit_event") as audit:
+            _apply_profile_transport_update(
+                session,  # type: ignore[arg-type]
+                profile,
+                user_id="user-1",
+                api_key_id="key-1",
+                smtp=SmtpConfig(
+                    host="smtp.example.org",
+                    port=587,
+                    security="starttls",
+                    timeout_seconds=30,
+                    password="new-secret",
+                ),
+                imap=None,
+                clear_imap=False,
+            )
+
+        self.assertEqual(decrypt_secret(profile.smtp_password_encrypted), "new-secret")
+        self.assertEqual(profile.smtp_transport_revision, "smtp-before")
+        self.assertEqual(audit.call_args.kwargs["action"], "mail.profile_credentials_replaced")
+        self.assertEqual(audit.call_args.kwargs["details"]["protocol"], "smtp")
+        self.assertNotIn("old-secret", repr(audit.call_args.kwargs))
+        self.assertNotIn("new-secret", repr(audit.call_args.kwargs))
+
+    def test_audit_failure_leaves_existing_ciphertext_and_revision_unchanged(self):
+        encrypted = encrypt_secret("old-secret")
+        profile = SimpleNamespace(
+            id="profile-1",
+            tenant_id="tenant-1",
+            scope_type="tenant",
+            scope_id="tenant-1",
+            smtp_config={"host": "smtp.example.org", "port": 587, "security": "starttls", "timeout_seconds": 30},
+            smtp_username="saved-smtp",
+            smtp_password_encrypted=encrypted,
+            smtp_transport_revision="smtp-before",
+            imap_config=None,
+            imap_username=None,
+            imap_password_encrypted=None,
+            imap_transport_revision="imap-before",
+        )
+        session = SimpleNamespace(flush=lambda: None)
+
+        with (
+            patch(
+                "govoplan_mail.backend.mail_profiles.audit_event",
+                side_effect=RuntimeError("audit unavailable"),
+            ),
+            self.assertRaisesRegex(RuntimeError, "audit unavailable"),
+        ):
+            _apply_profile_transport_update(
+                session,  # type: ignore[arg-type]
+                profile,
+                user_id="user-1",
+                api_key_id=None,
+                smtp=SmtpConfig(host="smtp.example.org", password="new-secret"),
+                imap=None,
+                clear_imap=False,
+            )
+
+        self.assertEqual(profile.smtp_password_encrypted, encrypted)
+        self.assertEqual(profile.smtp_transport_revision, "smtp-before")
+
+    def test_supplied_password_is_replaced_without_decrypting_old_ciphertext(self):
+        encrypted = encrypt_secret("same-secret")
+        profile = SimpleNamespace(
+            id="profile-1",
+            tenant_id="tenant-1",
+            scope_type="tenant",
+            scope_id="tenant-1",
+            smtp_config={"host": "smtp.example.org", "port": 587, "security": "starttls", "timeout_seconds": 30},
+            smtp_username="saved-smtp",
+            smtp_password_encrypted=encrypted,
+            smtp_transport_revision="smtp-before",
+            imap_config=None,
+            imap_username=None,
+            imap_password_encrypted=None,
+            imap_transport_revision="imap-before",
+        )
+        session = SimpleNamespace(flush=lambda: None)
+
+        with (
+            patch("govoplan_mail.backend.mail_profiles.audit_event") as audit,
+            patch(
+                "govoplan_mail.backend.mail_profiles.decrypt_secret",
+                side_effect=AssertionError("replacement must not decrypt old ciphertext"),
+            ),
+        ):
+            _apply_profile_transport_update(
+                session,  # type: ignore[arg-type]
+                profile,
+                user_id="user-1",
+                api_key_id=None,
+                smtp=SmtpConfig(host="smtp.example.org", password="same-secret"),
+                imap=None,
+                clear_imap=False,
+            )
+
+        self.assertNotEqual(profile.smtp_password_encrypted, encrypted)
+        self.assertEqual(decrypt_secret(profile.smtp_password_encrypted), "same-secret")
+        self.assertEqual(profile.smtp_transport_revision, "smtp-before")
+        self.assertEqual(audit.call_args.kwargs["action"], "mail.profile_credentials_replaced")
+
+    def test_metadata_update_does_not_decrypt_unrelated_transport_credentials(self):
+        profile = SimpleNamespace(
+            id="profile-1",
+            tenant_id="tenant-1",
+            scope_type="tenant",
+            scope_id="tenant-1",
+            smtp_config={"host": "smtp.example.org", "port": 587, "security": "starttls", "timeout_seconds": 30},
+            smtp_username="saved-smtp",
+            smtp_password_encrypted="corrupt-smtp-ciphertext",
+            smtp_transport_revision="smtp-before",
+            imap_config={"host": "imap.example.org", "port": 993, "security": "tls", "sent_folder": "Sent", "timeout_seconds": 30},
+            imap_username="saved-imap",
+            imap_password_encrypted="corrupt-imap-ciphertext",
+            imap_transport_revision="imap-before",
+            name="Profile",
+            slug="profile",
+            description=None,
+            is_active=True,
+            updated_by_user_id=None,
+        )
+        session = SimpleNamespace(add=lambda _value: None, flush=lambda: None)
+
+        with (
+            patch("govoplan_mail.backend.mail_profiles.decrypt_secret", side_effect=AssertionError("must not decrypt")),
+            patch("govoplan_mail.backend.mail_profiles._assert_profile_transport_allowed") as policy_check,
+        ):
+            update_mail_server_profile(
+                session,  # type: ignore[arg-type]
+                profile,
+                tenant_id="tenant-1",
+                user_id="user-1",
+                description="Updated",
+            )
+
+        policy_check.assert_called_once()
+        self.assertEqual(profile.description, "Updated")
+        self.assertEqual(profile.smtp_password_encrypted, "corrupt-smtp-ciphertext")
+        self.assertEqual(profile.imap_password_encrypted, "corrupt-imap-ciphertext")
 
 
 class MailProfilePolicyHelperTests(unittest.TestCase):
+    def test_campaign_contract_accepts_only_mail_profile_reference(self):
+        self.assertEqual(
+            _campaign_mail_profile_reference_id({"mail_profile_id": " profile-1 "}),
+            "profile-1",
+        )
+        for legacy in ("smtp", "imap", "credentials", "inherit_smtp_credentials"):
+            with self.subTest(legacy=legacy), self.assertRaisesRegex(MailProfileError, "select a Mail profile"):
+                _campaign_mail_profile_reference_id({"mail_profile_id": "profile-1", legacy: {}})
+
+    def test_campaign_delivery_fails_when_policy_requires_local_credentials(self):
+        profile = SimpleNamespace(imap_config=None)
+        policy = EffectiveMailProfilePolicy(
+            smtp_credentials=EffectiveCredentialPolicy(inherit=False),
+        )
+
+        with self.assertRaisesRegex(MailProfileError, "Store the credentials on a Mail profile"):
+            _assert_campaign_inherits_profile_credentials(profile, policy)
+
     def test_merge_policy_respects_locked_lower_level_limits(self):
         policy = EffectiveMailProfilePolicy()
         _merge_policy(

tests/test_mailbox_index.py

@@ -0,0 +1,49 @@
+from __future__ import annotations
+
+import unittest
+
+from govoplan_mail.backend.db.models import MailMailboxFolderIndex, MailMailboxMessageIndex
+from govoplan_mail.backend.mailbox_index import clear_mailbox_index
+
+
+class _DeleteQuery:
+    def __init__(self, model: type, deleted_models: list[type]) -> None:
+        self.model = model
+        self.deleted_models = deleted_models
+
+    def filter(self, *_criteria):
+        return self
+
+    def delete(self, *, synchronize_session: bool) -> int:
+        if synchronize_session is not False:
+            raise AssertionError("bulk invalidation must not synchronize loaded cache rows")
+        self.deleted_models.append(self.model)
+        return 2 if self.model is MailMailboxMessageIndex else 1
+
+
+class _Session:
+    def __init__(self) -> None:
+        self.deleted_models: list[type] = []
+
+    def query(self, model: type) -> _DeleteQuery:
+        return _DeleteQuery(model, self.deleted_models)
+
+
+class MailboxIndexInvalidationTests(unittest.TestCase):
+    def test_profile_wide_invalidation_deletes_messages_before_folders(self) -> None:
+        session = _Session()
+
+        deleted_folders, deleted_messages = clear_mailbox_index(
+            session,  # type: ignore[arg-type]
+            profile_id="profile-1",
+        )
+
+        self.assertEqual(
+            session.deleted_models,
+            [MailMailboxMessageIndex, MailMailboxFolderIndex],
+        )
+        self.assertEqual((deleted_folders, deleted_messages), (1, 2))
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_manifest.py

@@ -1,9 +1,11 @@
 from __future__ import annotations
 
 import unittest
+from types import SimpleNamespace
+from unittest.mock import patch
 
-from govoplan_core.core.modules import ModuleManifest
+from govoplan_core.core.modules import MigrationRetirementPlan, ModuleManifest
-from govoplan_mail.backend.manifest import get_manifest
+from govoplan_mail.backend.manifest import _mail_retirement_provider, get_manifest
 
 
 class MailManifestTests(unittest.TestCase):
@@ -14,6 +16,112 @@ class MailManifestTests(unittest.TestCase):
         self.assertEqual(manifest.id, "mail")
         self.assertIn("addresses", manifest.optional_dependencies)
         self.assertIn("addresses.lookup", {interface.name for interface in manifest.requires_interfaces})
+        self.assertIn(
+            {
+                "name": "campaigns.access",
+                "version_min": "0.1.0",
+                "version_max_exclusive": "0.2.0",
+                "optional": True,
+            },
+            [
+                {
+                    "name": interface.name,
+                    "version_min": interface.version_min,
+                    "version_max_exclusive": interface.version_max_exclusive,
+                    "optional": interface.optional,
+                }
+                for interface in manifest.requires_interfaces
+            ],
+        )
+        self.assertIn(
+            {"name": "mail.campaign_delivery", "version": "0.2.0"},
+            [
+                {"name": interface.name, "version": interface.version}
+                for interface in manifest.provides_interfaces
+            ],
+        )
+        permissions = {permission.scope for permission in manifest.permissions}
+        self.assertIn("mail:profile:write_own", permissions)
+        self.assertIn("mail:secret:manage_own", permissions)
+        roles = {template.slug: template for template in manifest.role_templates}
+        self.assertEqual(
+            set(roles["mail_profile_self_service"].permissions),
+            {
+                "mail:profile:read",
+                "mail:profile:use",
+                "mail:profile:test",
+                "mail:mailbox:read",
+                "mail:profile:write_own",
+                "mail:secret:manage_own",
+            },
+        )
+        topics = {topic.id: topic for topic in manifest.documentation}
+        self.assertTrue(
+            {
+                "mail.workflow.choose-and-test-profile",
+                "mail.workflow.read-mailbox",
+                "mail.reference.credentials-egress-retirement",
+                "mail.reference.campaign-delivery-contract",
+            }.issubset(topics)
+        )
+        ownership = topics["mail.profile-ownership-and-consumers"]
+        self.assertEqual(ownership.metadata["kind"], "reference")
+        self.assertEqual(ownership.metadata["route"], "/settings?section=mail-profiles")
+        self.assertIn("campaigns.mail-profile-user-journey", ownership.metadata["related_topic_ids"])
+
+        mailbox = topics["mail.workflow.read-mailbox"]
+        self.assertEqual(mailbox.metadata["route"], "/mail")
+        self.assertEqual(
+            mailbox.conditions[0].required_scopes,
+            ("mail:mailbox:read", "mail:profile:use"),
+        )
+
+        campaign_contract = topics["mail.reference.campaign-delivery-contract"]
+        self.assertEqual(campaign_contract.conditions[0].required_modules, ("mail", "campaigns"))
+
+    def test_retirement_scrubs_credentials_before_dropping_mail_tables(self) -> None:
+        events: list[str] = []
+
+        def table_provider(_session, _module_id):
+            return MigrationRetirementPlan(
+                supported=True,
+                summary="Mail tables",
+                destroy_data_supported=True,
+                destroy_data_executor=lambda _execute_session, _execute_module_id: events.append("drop"),
+            )
+
+        session = SimpleNamespace(get_bind=lambda: object(), query=lambda *_args: None)
+        inspector = SimpleNamespace(has_table=lambda _name: True)
+        with (
+            patch("govoplan_mail.backend.manifest._mail_table_retirement_provider", table_provider),
+            patch("govoplan_mail.backend.manifest.inspect", return_value=inspector),
+            patch(
+                "govoplan_mail.backend.mail_profiles.delete_mail_profile_credentials_for_retirement",
+                side_effect=lambda _session: events.append("scrub"),
+            ),
+        ):
+            plan = _mail_retirement_provider(session, "mail")
+            assert plan.destroy_data_executor is not None
+            plan.destroy_data_executor(session, "mail")
+
+        self.assertEqual(events, ["scrub", "drop"])
+        self.assertTrue(any("audit" in warning for warning in plan.destroy_data_warnings))
+
+        events.clear()
+        with (
+            patch("govoplan_mail.backend.manifest._mail_table_retirement_provider", table_provider),
+            patch("govoplan_mail.backend.manifest.inspect", return_value=inspector),
+            patch(
+                "govoplan_mail.backend.mail_profiles.delete_mail_profile_credentials_for_retirement",
+                side_effect=RuntimeError("audit unavailable"),
+            ),
+        ):
+            blocked_plan = _mail_retirement_provider(session, "mail")
+            assert blocked_plan.destroy_data_executor is not None
+            with self.assertRaisesRegex(RuntimeError, "audit unavailable"):
+                blocked_plan.destroy_data_executor(session, "mail")
+
+        self.assertEqual(events, [])
 
 
 if __name__ == "__main__":

tests/test_profile_actor_authorization.py

@@ -0,0 +1,852 @@
+from __future__ import annotations
+
+import unittest
+from types import SimpleNamespace
+from unittest.mock import ANY, patch
+
+from fastapi import HTTPException
+from sqlalchemy.dialects import postgresql
+
+from govoplan_mail.backend import router
+from govoplan_mail.backend import mail_profiles
+from govoplan_mail.backend.mail_profiles import (
+    EffectiveMailProfilePolicy,
+    MailProfileError,
+    get_mail_server_profile_for_actor,
+    list_mail_server_profiles,
+    mail_profile_visible_to_actor,
+)
+from govoplan_mail.backend.schemas import (
+    MailServerProfileCreateRequest,
+    MailServerProfileUpdateRequest,
+)
+
+
+def _profile(
+    profile_id: str,
+    *,
+    scope_type: str,
+    scope_id: str | None,
+    tenant_id: str | None = "tenant-1",
+):
+    return SimpleNamespace(
+        id=profile_id,
+        tenant_id=tenant_id,
+        scope_type=scope_type,
+        scope_id=scope_id,
+        is_active=True,
+        name=profile_id,
+        smtp_config={"host": "smtp.example.test"},
+        imap_config={"host": "imap.example.test"},
+        smtp_password_encrypted=None,
+        imap_password_encrypted=None,
+    )
+
+
+class _Query:
+    def __init__(self, profiles):
+        self._profiles = profiles
+
+    def filter(self, *_args):
+        return self
+
+    def all(self):
+        return list(self._profiles)
+
+
+class _Session:
+    def __init__(self, profiles=()):
+        self.profiles = list(profiles)
+        self.commits = 0
+        self.rollbacks = 0
+
+    def query(self, _model):
+        return _Query(self.profiles)
+
+    def get(self, _model, profile_id):
+        return next((profile for profile in self.profiles if profile.id == profile_id), None)
+
+    def commit(self):
+        self.commits += 1
+
+    def rollback(self):
+        self.rollbacks += 1
+
+    def refresh(self, _value):
+        return None
+
+
+class _Principal:
+    tenant_id = "tenant-1"
+    user = SimpleNamespace(id="user-1")
+    group_ids = frozenset({"group-1"})
+    api_key_id = None
+
+    def __init__(self, scopes):
+        self._scopes = frozenset(scopes)
+
+    def has(self, scope: str) -> bool:
+        return scope in self._scopes
+
+
+class ProfileActorAuthorizationTests(unittest.TestCase):
+    def test_profile_mutation_selector_is_owner_bounded_and_row_locked(self) -> None:
+        statement = mail_profiles._mail_server_profile_mutation_statement(  # noqa: SLF001
+            tenant_id="tenant-1",
+            profile_id="profile-1",
+            owner_user_id="user-1",
+            can_manage_tenant_profiles=False,
+            can_manage_system_profiles=False,
+        )
+
+        sql = str(statement.compile(dialect=postgresql.dialect()))
+        self.assertIn("FOR UPDATE", sql)
+        self.assertIn("mail_server_profiles.tenant_id =", sql)
+        self.assertIn("mail_server_profiles.scope_type =", sql)
+        self.assertIn("mail_server_profiles.scope_id =", sql)
+        self.assertTrue(statement.get_execution_options()["populate_existing"])
+
+    def test_profile_mutation_selector_without_authority_cannot_lock_a_row(self) -> None:
+        statement = mail_profiles._mail_server_profile_mutation_statement(  # noqa: SLF001
+            tenant_id="tenant-1",
+            profile_id="profile-1",
+            owner_user_id=None,
+            can_manage_tenant_profiles=False,
+            can_manage_system_profiles=False,
+        )
+
+        sql = str(statement.compile(dialect=postgresql.dialect()))
+        self.assertIn("mail_server_profiles.id IS NULL", sql)
+        self.assertIn("FOR UPDATE", sql)
+
+    def test_self_service_profile_permissions_are_limited_to_own_user_scope(self) -> None:
+        principal = _Principal(
+            {"mail:profile:write_own", "mail:secret:manage_own"}
+        )
+
+        router._require_profile_write_scope(  # noqa: SLF001 - authorization seam
+            principal,  # type: ignore[arg-type]
+            "user",
+            "user-1",
+        )
+        router._require_profile_credentials_scope(  # noqa: SLF001 - authorization seam
+            principal,  # type: ignore[arg-type]
+            "user",
+            "user-1",
+        )
+
+        for scope_type, scope_id in (
+            ("user", "user-2"),
+            ("tenant", "tenant-1"),
+            ("group", "group-1"),
+            ("campaign", "campaign-1"),
+            ("system", None),
+        ):
+            with self.subTest(scope_type=scope_type, scope_id=scope_id):
+                with self.assertRaises(HTTPException) as write_denied:
+                    router._require_profile_write_scope(  # noqa: SLF001
+                        principal,  # type: ignore[arg-type]
+                        scope_type,
+                        scope_id,
+                    )
+                self.assertEqual(write_denied.exception.status_code, 403)
+
+                with self.assertRaises(HTTPException) as secret_denied:
+                    router._require_profile_credentials_scope(  # noqa: SLF001
+                        principal,  # type: ignore[arg-type]
+                        scope_type,
+                        scope_id,
+                    )
+                self.assertEqual(secret_denied.exception.status_code, 403)
+
+    def test_self_service_create_rejects_another_user_before_persistence(self) -> None:
+        principal = _Principal(
+            {
+                "mail:profile:read",
+                "mail:profile:write_own",
+                "mail:secret:manage_own",
+            }
+        )
+        payload = MailServerProfileCreateRequest.model_validate(
+            {
+                "name": "Other user's profile",
+                "scope_type": "user",
+                "scope_id": "user-2",
+                "smtp": {
+                    "host": "smtp.example.test",
+                    "password": "not-persisted",
+                },
+            }
+        )
+        with (
+            patch("govoplan_mail.backend.router.create_mail_server_profile") as create,
+            self.assertRaises(HTTPException) as denied,
+        ):
+            router.create_profile(
+                payload,
+                principal=principal,  # type: ignore[arg-type]
+                session=_Session(),  # type: ignore[arg-type]
+            )
+
+        self.assertEqual(denied.exception.status_code, 403)
+        create.assert_not_called()
+
+    def test_self_service_update_hides_another_user_before_mutation(self) -> None:
+        principal = _Principal(
+            {"mail:profile:write_own", "mail:secret:manage_own"}
+        )
+        profile = _profile(
+            "other-user-profile",
+            scope_type="user",
+            scope_id="user-2",
+        )
+        with (
+            patch(
+                "govoplan_mail.backend.router.get_mail_server_profile",
+                return_value=profile,
+            ),
+            patch("govoplan_mail.backend.router.update_mail_server_profile") as update,
+            self.assertRaises(HTTPException) as denied,
+        ):
+            router.update_profile(
+                profile.id,
+                MailServerProfileUpdateRequest(name="Must not change"),
+                principal=principal,  # type: ignore[arg-type]
+                session=_Session(),  # type: ignore[arg-type]
+            )
+
+        self.assertEqual(denied.exception.status_code, 404)
+        update.assert_not_called()
+
+    def test_self_service_delete_hides_another_user_before_mutation(self) -> None:
+        principal = _Principal(
+            {"mail:profile:write_own", "mail:secret:manage_own"}
+        )
+        profile = _profile(
+            "other-user-profile",
+            scope_type="user",
+            scope_id="user-2",
+        )
+        with (
+            patch(
+                "govoplan_mail.backend.router.get_mail_server_profile",
+                return_value=profile,
+            ),
+            patch("govoplan_mail.backend.router.delete_mail_profile_credentials") as delete,
+            self.assertRaises(HTTPException) as denied,
+        ):
+            router.deactivate_profile(
+                profile.id,
+                principal=principal,  # type: ignore[arg-type]
+                session=_Session(),  # type: ignore[arg-type]
+            )
+
+        self.assertEqual(denied.exception.status_code, 404)
+        delete.assert_not_called()
+
+    def test_mutation_lookup_returns_the_same_not_found_for_missing_and_non_owned(self) -> None:
+        principal = _Principal({"mail:profile:write_own"})
+        other_profile = _profile(
+            "other-user-profile",
+            scope_type="user",
+            scope_id="user-2",
+        )
+        cases = (
+            (other_profile, None),
+            (None, MailProfileError("Mail-server profile not found")),
+        )
+        for returned, failure in cases:
+            with self.subTest(failure=failure is not None):
+                kwargs = {"side_effect": failure} if failure else {"return_value": returned}
+                with (
+                    patch(
+                        "govoplan_mail.backend.router.get_mail_server_profile",
+                        **kwargs,
+                    ),
+                    self.assertRaises(HTTPException) as denied,
+                ):
+                    router._profile_for_mutation(  # noqa: SLF001 - authorization seam
+                        _Session(),  # type: ignore[arg-type]
+                        principal=principal,  # type: ignore[arg-type]
+                        profile_id="candidate-id",
+                    )
+
+                self.assertEqual(denied.exception.status_code, 404)
+                self.assertEqual(denied.exception.detail, "Mail-server profile not found")
+
+    def test_broad_profile_admin_retains_cross_owner_mutation_access(self) -> None:
+        principal = _Principal({"mail:profile:write"})
+        profile = _profile(
+            "other-user-profile",
+            scope_type="user",
+            scope_id="user-2",
+        )
+        with patch(
+            "govoplan_mail.backend.router.get_mail_server_profile",
+            return_value=profile,
+        ) as get_profile:
+            resolved = router._profile_for_mutation(  # noqa: SLF001 - authorization seam
+                _Session(),  # type: ignore[arg-type]
+                principal=principal,  # type: ignore[arg-type]
+                profile_id=profile.id,
+            )
+
+        self.assertIs(resolved, profile)
+        get_profile.assert_called_once_with(
+            ANY,
+            tenant_id="tenant-1",
+            profile_id=profile.id,
+            for_update=True,
+            mutation_owner_user_id=None,
+            can_manage_tenant_profiles=True,
+            can_manage_system_profiles=False,
+        )
+
+    def test_self_service_transport_rebind_requires_own_secret_authority(self) -> None:
+        principal = _Principal({"mail:profile:write_own"})
+        profile = _profile(
+            "own-user-profile",
+            scope_type="user",
+            scope_id="user-1",
+        )
+        profile.smtp_config = {
+            "host": "smtp.example.test",
+            "port": 587,
+            "security": "starttls",
+            "timeout_seconds": 30,
+        }
+        profile.smtp_password_encrypted = "existing-ciphertext"
+        payload = MailServerProfileUpdateRequest.model_validate(
+            {"smtp": {"host": "smtp.attacker.test"}}
+        )
+        session = _Session()
+        with (
+            patch(
+                "govoplan_mail.backend.router.get_mail_server_profile",
+                return_value=profile,
+            ),
+            patch("govoplan_mail.backend.router.update_mail_server_profile") as update,
+            self.assertRaises(HTTPException) as denied,
+        ):
+            router.update_profile(
+                profile.id,
+                payload,
+                principal=principal,  # type: ignore[arg-type]
+                session=session,  # type: ignore[arg-type]
+            )
+
+        self.assertEqual(denied.exception.status_code, 403)
+        self.assertEqual(session.rollbacks, 1)
+        update.assert_not_called()
+
+    def test_self_service_imap_rebind_requires_own_secret_authority(self) -> None:
+        principal = _Principal({"mail:profile:write_own"})
+        profile = _profile(
+            "own-user-profile",
+            scope_type="user",
+            scope_id="user-1",
+        )
+        profile.imap_config = {
+            "host": "imap.example.test",
+            "port": 993,
+            "security": "tls",
+            "sent_folder": "auto",
+            "timeout_seconds": 30,
+        }
+        profile.imap_password_encrypted = "existing-ciphertext"
+        payload = MailServerProfileUpdateRequest.model_validate(
+            {"imap": {"host": "imap.attacker.test"}}
+        )
+        with (
+            patch(
+                "govoplan_mail.backend.router.get_mail_server_profile",
+                return_value=profile,
+            ),
+            patch("govoplan_mail.backend.router.update_mail_server_profile") as update,
+            self.assertRaises(HTTPException) as denied,
+        ):
+            router.update_profile(
+                profile.id,
+                payload,
+                principal=principal,  # type: ignore[arg-type]
+                session=_Session(),  # type: ignore[arg-type]
+            )
+
+        self.assertEqual(denied.exception.status_code, 403)
+        update.assert_not_called()
+
+    def test_self_service_transport_rebind_is_allowed_with_own_secret_authority(self) -> None:
+        principal = _Principal(
+            {"mail:profile:write_own", "mail:secret:manage_own"}
+        )
+        profile = _profile(
+            "own-user-profile",
+            scope_type="user",
+            scope_id="user-1",
+        )
+        profile.smtp_config = {
+            "host": "smtp.example.test",
+            "port": 587,
+            "security": "starttls",
+            "timeout_seconds": 30,
+        }
+        profile.smtp_password_encrypted = "existing-ciphertext"
+        payload = MailServerProfileUpdateRequest.model_validate(
+            {"smtp": {"host": "smtp.allowed.test"}}
+        )
+        session = _Session()
+        with (
+            patch(
+                "govoplan_mail.backend.router.get_mail_server_profile",
+                return_value=profile,
+            ),
+            patch(
+                "govoplan_mail.backend.router.update_mail_server_profile",
+                return_value=profile,
+            ) as update,
+            patch("govoplan_mail.backend.router._record_mail_change"),
+            patch(
+                "govoplan_mail.backend.router._profile_response",
+                return_value=profile,
+            ),
+        ):
+            result = router.update_profile(
+                profile.id,
+                payload,
+                principal=principal,  # type: ignore[arg-type]
+                session=session,  # type: ignore[arg-type]
+            )
+
+        self.assertIs(result, profile)
+        self.assertEqual(session.commits, 1)
+        update.assert_called_once()
+
+    def test_transport_endpoint_change_without_stored_secret_needs_only_write_authority(self) -> None:
+        principal = _Principal({"mail:profile:write_own"})
+        profile = _profile(
+            "own-user-profile",
+            scope_type="user",
+            scope_id="user-1",
+        )
+        payload = MailServerProfileUpdateRequest.model_validate(
+            {"smtp": {"host": "smtp.allowed.test"}}
+        )
+        session = _Session()
+        with (
+            patch(
+                "govoplan_mail.backend.router.get_mail_server_profile",
+                return_value=profile,
+            ),
+            patch(
+                "govoplan_mail.backend.router.update_mail_server_profile",
+                return_value=profile,
+            ) as update,
+            patch("govoplan_mail.backend.router._record_mail_change"),
+            patch(
+                "govoplan_mail.backend.router._profile_response",
+                return_value=profile,
+            ),
+        ):
+            router.update_profile(
+                profile.id,
+                payload,
+                principal=principal,  # type: ignore[arg-type]
+                session=session,  # type: ignore[arg-type]
+            )
+
+        self.assertEqual(session.commits, 1)
+        update.assert_called_once()
+
+    def test_general_profile_list_hides_other_owner_contexts(self) -> None:
+        profiles = [
+            _profile("system", scope_type="system", scope_id=None, tenant_id=None),
+            _profile("tenant", scope_type="tenant", scope_id="tenant-1"),
+            _profile("own-user", scope_type="user", scope_id="user-1"),
+            _profile("other-user", scope_type="user", scope_id="user-2"),
+            _profile("own-group", scope_type="group", scope_id="group-1"),
+            _profile("other-group", scope_type="group", scope_id="group-2"),
+        ]
+        session = _Session(profiles)
+        with patch(
+            "govoplan_mail.backend.mail_profiles.effective_mail_profile_policy",
+            return_value=EffectiveMailProfilePolicy(),
+        ):
+            visible = list_mail_server_profiles(
+                session,  # type: ignore[arg-type]
+                tenant_id="tenant-1",
+                actor_user_id="user-1",
+                actor_group_ids=(group_id for group_id in ("group-1",)),
+            )
+
+        self.assertEqual(
+            {profile.id for profile in visible},
+            {"system", "tenant", "own-user", "own-group"},
+        )
+
+    def test_general_access_denies_shared_profile_excluded_by_effective_policy(self) -> None:
+        denied = EffectiveMailProfilePolicy(allowed_profile_id_sets=[{"approved"}])
+        cases = (("system", None), ("tenant", "tenant-1"))
+        for scope_type, tenant_id in cases:
+            with self.subTest(scope_type=scope_type):
+                profile = _profile("denied", scope_type=scope_type, scope_id=tenant_id, tenant_id=tenant_id)
+                with patch("govoplan_mail.backend.mail_profiles.effective_mail_profile_policy", return_value=denied):
+                    visible = mail_profile_visible_to_actor(
+                        _Session(),  # type: ignore[arg-type]
+                        profile=profile,
+                        tenant_id="tenant-1",
+                        user_id="user-1",
+                        group_ids={"group-1"},
+                    )
+                self.assertFalse(visible)
+
+    def test_administrative_list_can_include_inactive_visible_profiles(self) -> None:
+        profile = _profile("inactive", scope_type="tenant", scope_id="tenant-1")
+        profile.is_active = False
+        session = _Session([profile])
+        with patch(
+            "govoplan_mail.backend.mail_profiles.effective_mail_profile_policy",
+            return_value=EffectiveMailProfilePolicy(),
+        ):
+            visible = list_mail_server_profiles(
+                session,  # type: ignore[arg-type]
+                tenant_id="tenant-1",
+                include_inactive=True,
+                actor_user_id="user-1",
+                actor_can_manage_tenant_profiles=True,
+                actor_administrative_visibility=True,
+            )
+
+        self.assertEqual([item.id for item in visible], ["inactive"])
+
+    def test_self_service_repair_visibility_is_limited_to_the_exact_owner(self) -> None:
+        own_profile = _profile(
+            "own-policy-invalid",
+            scope_type="user",
+            scope_id="user-1",
+        )
+        other_profile = _profile(
+            "other-policy-invalid",
+            scope_type="user",
+            scope_id="user-2",
+        )
+        denied = EffectiveMailProfilePolicy(
+            allowed_profile_id_sets=[{"different-profile"}]
+        )
+        session = _Session([own_profile, other_profile])
+
+        with patch(
+            "govoplan_mail.backend.mail_profiles.effective_mail_profile_policy",
+            return_value=denied,
+        ):
+            ordinary_visible = list_mail_server_profiles(
+                session,  # type: ignore[arg-type]
+                tenant_id="tenant-1",
+                include_inactive=True,
+                actor_user_id="user-1",
+                actor_administrative_visibility=True,
+            )
+            repair_visible = list_mail_server_profiles(
+                session,  # type: ignore[arg-type]
+                tenant_id="tenant-1",
+                include_inactive=True,
+                actor_user_id="user-1",
+                actor_can_manage_own_profiles=True,
+                actor_administrative_visibility=True,
+            )
+            resolved = get_mail_server_profile_for_actor(
+                session,  # type: ignore[arg-type]
+                tenant_id="tenant-1",
+                profile_id=own_profile.id,
+                user_id="user-1",
+                can_manage_own_profiles=True,
+                administrative_visibility=True,
+            )
+            with self.assertRaises(MailProfileError):
+                get_mail_server_profile_for_actor(
+                    session,  # type: ignore[arg-type]
+                    tenant_id="tenant-1",
+                    profile_id=other_profile.id,
+                    user_id="user-1",
+                    can_manage_own_profiles=True,
+                    administrative_visibility=True,
+                )
+
+        self.assertEqual(ordinary_visible, [])
+        self.assertEqual([item.id for item in repair_visible], [own_profile.id])
+        self.assertIs(resolved, own_profile)
+
+    def test_profile_admin_can_list_but_not_use_a_policy_denied_profile(self) -> None:
+        profile = _profile("denied", scope_type="tenant", scope_id="tenant-1")
+        session = _Session([profile])
+        denied = EffectiveMailProfilePolicy(allowed_profile_id_sets=[{"approved"}])
+        with patch("govoplan_mail.backend.mail_profiles.effective_mail_profile_policy", return_value=denied):
+            listed = list_mail_server_profiles(
+                session,  # type: ignore[arg-type]
+                tenant_id="tenant-1",
+                actor_user_id="user-1",
+                actor_group_ids={"group-1"},
+                actor_can_manage_tenant_profiles=True,
+                actor_administrative_visibility=True,
+            )
+            self.assertEqual([item.id for item in listed], ["denied"])
+
+            principal = _Principal(
+                {"mail:profile:write", "mail:profile:test", "mail:profile:use"}
+            )
+            with (
+                patch("govoplan_mail.backend.router.smtp_config_from_profile") as materialize,
+                patch("govoplan_mail.backend.router.test_smtp_login") as provider,
+                self.assertRaises(HTTPException) as captured,
+            ):
+                router.test_profile_smtp(
+                    "denied",
+                    principal=principal,  # type: ignore[arg-type]
+                    session=session,  # type: ignore[arg-type]
+                )
+
+        self.assertEqual(captured.exception.status_code, 404)
+        materialize.assert_not_called()
+        provider.assert_not_called()
+
+    def test_campaign_scoped_profile_requires_campaign_acl_before_policy_resolution(self) -> None:
+        profile = _profile("campaign-profile", scope_type="campaign", scope_id="campaign-1")
+        access = SimpleNamespace(can_read_campaign=lambda *_args, **_kwargs: False)
+        with (
+            patch("govoplan_mail.backend.mail_profiles._campaign_access_provider", return_value=access),
+            patch("govoplan_mail.backend.mail_profiles._campaign_policy_context") as policy_context,
+        ):
+            visible = mail_profile_visible_to_actor(
+                _Session(),  # type: ignore[arg-type]
+                profile=profile,
+                tenant_id="tenant-1",
+                user_id="user-1",
+            )
+        self.assertFalse(visible)
+        policy_context.assert_not_called()
+
+    def test_mail_profile_admin_does_not_bypass_campaign_acl_but_tenant_admin_does(self) -> None:
+        profile = _profile("campaign-profile", scope_type="campaign", scope_id="campaign-1")
+        tenant_admin_values: list[bool] = []
+
+        def can_read(*_args, **kwargs):
+            tenant_admin_values.append(bool(kwargs["tenant_admin"]))
+            return bool(kwargs["tenant_admin"])
+
+        access = SimpleNamespace(can_read_campaign=can_read)
+        with (
+            patch("govoplan_mail.backend.mail_profiles._campaign_access_provider", return_value=access),
+            patch("govoplan_mail.backend.mail_profiles._campaign_policy_context") as policy_context,
+        ):
+            mail_admin_visible = mail_profile_visible_to_actor(
+                _Session(),  # type: ignore[arg-type]
+                profile=profile,
+                tenant_id="tenant-1",
+                user_id="user-1",
+                can_manage_tenant_profiles=True,
+                administrative_visibility=True,
+            )
+            tenant_admin_visible = mail_profile_visible_to_actor(
+                _Session(),  # type: ignore[arg-type]
+                profile=profile,
+                tenant_id="tenant-1",
+                user_id="user-1",
+                can_manage_tenant_profiles=True,
+                tenant_admin=True,
+                administrative_visibility=True,
+            )
+
+        self.assertFalse(mail_admin_visible)
+        self.assertTrue(tenant_admin_visible)
+        self.assertEqual(tenant_admin_values, [False, True])
+        policy_context.assert_not_called()
+
+    def test_policy_read_rejects_unshared_and_mismatched_campaign_contexts(self) -> None:
+        principal = _Principal({"mail:profile:read"})
+        with (
+            patch(
+                "govoplan_mail.backend.router.campaign_mail_context_visible_to_actor",
+                return_value=False,
+            ),
+            patch("govoplan_mail.backend.router._policy_response") as policy_response,
+            self.assertRaises(HTTPException) as unshared,
+        ):
+            router.read_mail_profile_policy(
+                "tenant",
+                scope_id="tenant-1",
+                campaign_id="campaign-1",
+                principal=principal,  # type: ignore[arg-type]
+                session=_Session(),  # type: ignore[arg-type]
+            )
+        self.assertEqual(unshared.exception.status_code, 404)
+        policy_response.assert_not_called()
+
+        with self.assertRaises(HTTPException) as mismatched:
+            router._require_policy_campaign_context(  # noqa: SLF001 - authorization seam regression
+                _Session(),  # type: ignore[arg-type]
+                principal=principal,  # type: ignore[arg-type]
+                scope_type="campaign",
+                scope_id="campaign-1",
+                campaign_id="campaign-2",
+            )
+        self.assertEqual(mismatched.exception.status_code, 422)
+
+    def test_campaign_profile_crud_requires_campaign_acl(self) -> None:
+        principal = _Principal({"mail:profile:write", "mail:secret:manage"})
+        profile = _profile("campaign-profile", scope_type="campaign", scope_id="campaign-1")
+        create_payload = MailServerProfileCreateRequest.model_validate(
+            {
+                "name": "Campaign profile",
+                "scope_type": "campaign",
+                "scope_id": "campaign-1",
+                "smtp": {"host": "smtp.example.test"},
+            }
+        )
+        with (
+            patch(
+                "govoplan_mail.backend.router.campaign_mail_context_visible_to_actor",
+                return_value=False,
+            ),
+            patch("govoplan_mail.backend.router.create_mail_server_profile") as create,
+            self.assertRaises(HTTPException) as create_denied,
+        ):
+            router.create_profile(
+                create_payload,
+                principal=principal,  # type: ignore[arg-type]
+                session=_Session(),  # type: ignore[arg-type]
+            )
+        self.assertEqual(create_denied.exception.status_code, 404)
+        create.assert_not_called()
+
+        for operation in ("update", "delete"):
+            with (
+                self.subTest(operation=operation),
+                patch("govoplan_mail.backend.router.get_mail_server_profile", return_value=profile),
+                patch(
+                    "govoplan_mail.backend.router.campaign_mail_context_visible_to_actor",
+                    return_value=False,
+                ),
+                patch("govoplan_mail.backend.router.update_mail_server_profile") as update,
+                patch("govoplan_mail.backend.router.delete_mail_profile_credentials") as delete,
+                self.assertRaises(HTTPException) as denied,
+            ):
+                if operation == "update":
+                    router.update_profile(
+                        profile.id,
+                        MailServerProfileUpdateRequest(name="Renamed"),
+                        principal=principal,  # type: ignore[arg-type]
+                        session=_Session(),  # type: ignore[arg-type]
+                    )
+                else:
+                    router.deactivate_profile(
+                        profile.id,
+                        principal=principal,  # type: ignore[arg-type]
+                        session=_Session(),  # type: ignore[arg-type]
+                    )
+            self.assertEqual(denied.exception.status_code, 404)
+            update.assert_not_called()
+            delete.assert_not_called()
+
+    def test_inactive_visible_profile_change_remains_a_tombstone_candidate(self) -> None:
+        profile = _profile("deactivated", scope_type="tenant", scope_id="tenant-1")
+        profile.is_active = False
+        entry = SimpleNamespace(
+            resource_id=profile.id,
+            tenant_id="tenant-1",
+            payload={"scope_type": "tenant", "scope_id": "tenant-1"},
+        )
+        principal = _Principal({"mail:profile:read"})
+        with patch(
+            "govoplan_mail.backend.mail_profiles.effective_mail_profile_policy",
+            return_value=EffectiveMailProfilePolicy(),
+        ):
+            visible = router._profile_change_visible_to_principal(  # noqa: SLF001
+                _Session([profile]),  # type: ignore[arg-type]
+                entry=entry,  # type: ignore[arg-type]
+                principal=principal,  # type: ignore[arg-type]
+            )
+        self.assertTrue(visible)
+
+    def test_stale_mailbox_cache_refreshes_synchronously_under_request_authorization(self) -> None:
+        principal = _Principal({"mail:mailbox:read", "mail:profile:use"})
+        session = _Session()
+        imap = SimpleNamespace(
+            host="imap.example.test",
+            port=993,
+            security=SimpleNamespace(value="tls"),
+        )
+        stale = SimpleNamespace(stale=True)
+        provider_result = SimpleNamespace(
+            host="imap.example.test",
+            port=993,
+            security="tls",
+            folders=[
+                SimpleNamespace(
+                    name="INBOX",
+                    flags=[],
+                    message_count=0,
+                    unseen_count=0,
+                )
+            ],
+            detected_sent_folder=None,
+        )
+        with (
+            patch("govoplan_mail.backend.router._imap_config_for_principal", return_value=imap),
+            patch("govoplan_mail.backend.router.cached_mailbox_folders", return_value=stale),
+            patch("govoplan_mail.backend.router.list_imap_folders", return_value=provider_result) as provider,
+            patch("govoplan_mail.backend.router.cache_mailbox_folders") as cache,
+        ):
+            response = router.list_profile_mailbox_folders(
+                "profile-1",
+                include_status=False,
+                refresh=False,
+                principal=principal,  # type: ignore[arg-type]
+                session=session,  # type: ignore[arg-type]
+            )
+
+        provider.assert_called_once_with(imap_config=imap, include_status=False)
+        cache.assert_called_once()
+        self.assertFalse(response.from_cache)
+        self.assertFalse(response.refreshing)
+        self.assertEqual(session.commits, 1)
+
+    def test_unauthorized_profile_test_fails_before_credentials_or_provider_effect(self) -> None:
+        principal = _Principal({"mail:profile:test", "mail:profile:use"})
+        with (
+            patch(
+                "govoplan_mail.backend.router.get_mail_server_profile_for_actor",
+                side_effect=MailProfileError("Mail-server profile not found"),
+            ),
+            patch("govoplan_mail.backend.router.smtp_config_from_profile") as materialize,
+            patch("govoplan_mail.backend.router.test_smtp_login") as provider,
+        ):
+            with self.assertRaises(HTTPException) as captured:
+                router.test_profile_smtp(
+                    "other-user-profile",
+                    principal=principal,  # type: ignore[arg-type]
+                    session=_Session(),  # type: ignore[arg-type]
+                )
+
+        self.assertEqual(captured.exception.status_code, 404)
+        materialize.assert_not_called()
+        provider.assert_not_called()
+
+    def test_unauthorized_mailbox_read_fails_before_credential_decryption(self) -> None:
+        principal = _Principal({"mail:mailbox:read", "mail:profile:use"})
+        with (
+            patch(
+                "govoplan_mail.backend.router.get_mail_server_profile_for_actor",
+                side_effect=MailProfileError("Mail-server profile not found"),
+            ),
+            patch("govoplan_mail.backend.router.imap_config_from_profile") as materialize,
+        ):
+            with self.assertRaisesRegex(MailProfileError, "not found"):
+                router._imap_config_for_principal(  # noqa: SLF001 - authorization seam regression
+                    _Session(),  # type: ignore[arg-type]
+                    principal=principal,  # type: ignore[arg-type]
+                    profile_id="other-group-profile",
+                )
+        materialize.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_router_profile_deletion.py

@@ -0,0 +1,200 @@
+from __future__ import annotations
+
+import unittest
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from fastapi import HTTPException
+
+from govoplan_mail.backend.router import create_profile, deactivate_profile, update_profile
+from govoplan_mail.backend.schemas import MailServerProfileCreateRequest, MailServerProfileUpdateRequest
+
+
+class _Session:
+    def __init__(self) -> None:
+        self.commits = 0
+        self.rollbacks = 0
+
+    def add(self, _value) -> None:
+        return None
+
+    def commit(self) -> None:
+        self.commits += 1
+
+    def rollback(self) -> None:
+        self.rollbacks += 1
+
+    def refresh(self, _value) -> None:
+        return None
+
+
+class MailProfileDeletionRouteTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self.principal = SimpleNamespace(
+            tenant_id="tenant-1",
+            user=SimpleNamespace(id="user-1"),
+            api_key_id=None,
+            has=lambda _scope: False,
+        )
+        self.profile = SimpleNamespace(
+            id="profile-1",
+            tenant_id="tenant-1",
+            scope_type="tenant",
+            scope_id="tenant-1",
+            is_active=False,
+        )
+
+    def test_repeated_delete_does_not_emit_a_false_change(self) -> None:
+        session = _Session()
+        with (
+            patch("govoplan_mail.backend.router.get_mail_server_profile", return_value=self.profile),
+            patch("govoplan_mail.backend.router._require_profile_write_scope"),
+            patch("govoplan_mail.backend.router._require_profile_credentials_scope") as require_credentials,
+            patch("govoplan_mail.backend.router.delete_mail_profile_credentials", return_value=()),
+            patch("govoplan_mail.backend.router.clear_mailbox_index") as clear_index,
+            patch("govoplan_mail.backend.router._record_mail_change") as record_change,
+            patch("govoplan_mail.backend.router._profile_response", return_value=self.profile),
+        ):
+            result = deactivate_profile("profile-1", principal=self.principal, session=session)
+
+        self.assertIs(result, self.profile)
+        self.assertEqual(session.commits, 1)
+        self.assertEqual(session.rollbacks, 0)
+        clear_index.assert_called_once_with(session, profile_id="profile-1")
+        record_change.assert_not_called()
+        require_credentials.assert_not_called()
+
+    def test_delete_requires_secret_authority_when_credentials_will_be_deleted(self) -> None:
+        self.profile.is_active = True
+        self.profile.smtp_password_encrypted = "existing-ciphertext"
+        self.profile.imap_password_encrypted = None
+        session = _Session()
+        with (
+            patch("govoplan_mail.backend.router.get_mail_server_profile", return_value=self.profile),
+            patch("govoplan_mail.backend.router._require_profile_write_scope"),
+            patch("govoplan_mail.backend.router._require_profile_credentials_scope") as require_credentials,
+            patch(
+                "govoplan_mail.backend.router.delete_mail_profile_credentials",
+                return_value=("smtp",),
+            ),
+            patch("govoplan_mail.backend.router.clear_mailbox_index"),
+            patch("govoplan_mail.backend.router._record_mail_change"),
+            patch("govoplan_mail.backend.router._profile_response", return_value=self.profile),
+        ):
+            deactivate_profile("profile-1", principal=self.principal, session=session)
+
+        require_credentials.assert_called_once_with(
+            self.principal,
+            "tenant",
+            "tenant-1",
+        )
+
+    def test_change_feed_reports_whether_credentials_were_deleted(self) -> None:
+        self.profile.is_active = True
+        session = _Session()
+        with (
+            patch("govoplan_mail.backend.router.get_mail_server_profile", return_value=self.profile),
+            patch("govoplan_mail.backend.router._require_profile_write_scope"),
+            patch("govoplan_mail.backend.router._require_profile_credentials_scope"),
+            patch("govoplan_mail.backend.router.delete_mail_profile_credentials", return_value=()),
+            patch("govoplan_mail.backend.router.clear_mailbox_index") as clear_index,
+            patch("govoplan_mail.backend.router._record_mail_change") as record_change,
+            patch("govoplan_mail.backend.router._profile_response", return_value=self.profile),
+        ):
+            deactivate_profile("profile-1", principal=self.principal, session=session)
+
+        self.assertFalse(record_change.call_args.kwargs["payload"]["credentials_deleted"])
+        self.assertEqual(record_change.call_args.kwargs["payload"]["deleted_credential_protocols"], [])
+        clear_index.assert_called_once_with(session, profile_id="profile-1")
+
+    def test_generic_secret_deletion_failure_rolls_back(self) -> None:
+        self.profile.is_active = True
+        session = _Session()
+        with (
+            patch("govoplan_mail.backend.router.get_mail_server_profile", return_value=self.profile),
+            patch("govoplan_mail.backend.router._require_profile_write_scope"),
+            patch("govoplan_mail.backend.router._require_profile_credentials_scope"),
+            patch("govoplan_mail.backend.router.delete_mail_profile_credentials", side_effect=RuntimeError("audit unavailable")),
+        ):
+            with self.assertRaisesRegex(RuntimeError, "audit unavailable"):
+                deactivate_profile("profile-1", principal=self.principal, session=session)
+
+        self.assertEqual(session.commits, 0)
+        self.assertEqual(session.rollbacks, 1)
+
+    def test_patch_deactivation_is_rejected_in_favor_of_audited_delete(self) -> None:
+        self.profile.is_active = True
+        self.profile.smtp_password_encrypted = "existing-ciphertext"
+        session = _Session()
+        payload = MailServerProfileUpdateRequest(is_active=False)
+        with (
+            patch("govoplan_mail.backend.router.get_mail_server_profile", return_value=self.profile),
+            patch("govoplan_mail.backend.router._require_profile_write_scope"),
+            self.assertRaises(HTTPException) as captured,
+        ):
+            update_profile(
+                self.profile.id,
+                payload,
+                principal=self.principal,
+                session=session,
+            )
+
+        self.assertEqual(captured.exception.status_code, 422)
+        self.assertTrue(self.profile.is_active)
+        self.assertEqual(self.profile.smtp_password_encrypted, "existing-ciphertext")
+        self.assertEqual(session.commits, 0)
+        self.assertEqual(session.rollbacks, 1)
+
+    def test_system_profile_changes_are_instance_wide_in_the_change_feed(self) -> None:
+        system_profile = SimpleNamespace(
+            id="profile-system",
+            tenant_id=None,
+            scope_type="system",
+            scope_id=None,
+            is_active=True,
+            smtp_config={"host": "smtp.example.test"},
+            imap_config=None,
+        )
+        session = _Session()
+        create_payload = MailServerProfileCreateRequest.model_validate(
+            {
+                "name": "System profile",
+                "scope_type": "system",
+                "smtp": {"host": "smtp.example.test"},
+            }
+        )
+        with (
+            patch("govoplan_mail.backend.router._require_profile_write_scope"),
+            patch("govoplan_mail.backend.router.create_mail_server_profile", return_value=system_profile),
+            patch("govoplan_mail.backend.router._record_mail_change") as create_change,
+            patch("govoplan_mail.backend.router._profile_response", return_value=system_profile),
+        ):
+            create_profile(create_payload, principal=self.principal, session=session)
+        self.assertIsNone(create_change.call_args.kwargs["tenant_id"])
+
+        update_payload = MailServerProfileUpdateRequest(name="Renamed system profile")
+        with (
+            patch("govoplan_mail.backend.router.get_mail_server_profile", return_value=system_profile),
+            patch("govoplan_mail.backend.router._require_profile_write_scope"),
+            patch("govoplan_mail.backend.router.update_mail_server_profile", return_value=system_profile),
+            patch("govoplan_mail.backend.router._record_mail_change") as update_change,
+            patch("govoplan_mail.backend.router._profile_response", return_value=system_profile),
+        ):
+            update_profile("profile-system", update_payload, principal=self.principal, session=session)
+        self.assertIsNone(update_change.call_args.kwargs["tenant_id"])
+
+        with (
+            patch("govoplan_mail.backend.router.get_mail_server_profile", return_value=system_profile),
+            patch("govoplan_mail.backend.router._require_profile_write_scope"),
+            patch("govoplan_mail.backend.router._require_profile_credentials_scope"),
+            patch("govoplan_mail.backend.router.delete_mail_profile_credentials", return_value=()),
+            patch("govoplan_mail.backend.router.clear_mailbox_index"),
+            patch("govoplan_mail.backend.router._record_mail_change") as delete_change,
+            patch("govoplan_mail.backend.router._profile_response", return_value=system_profile),
+        ):
+            deactivate_profile("profile-system", principal=self.principal, session=session)
+        self.assertIsNone(delete_change.call_args.kwargs["tenant_id"])
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_smtp_helpers.py

@@ -1,16 +1,44 @@
 from __future__ import annotations
 
 import unittest
+from unittest.mock import patch
 
+from govoplan_core.security.outbound_http import OutboundHttpBlocked
 from govoplan_mail.backend.config import SmtpConfig
 from govoplan_mail.backend.sending.smtp import (
     SmtpConfigurationError,
+    _open_smtp,
     _prepare_smtp_send,
     _smtp_send_result,
 )
 
 
 class SmtpSendHelperTests(unittest.TestCase):
+    def test_real_smtp_connections_honor_deployment_egress_policy(self):
+        config = SmtpConfig(host="smtp.internal", port=587, security="starttls")
+        with patch(
+            "govoplan_mail.backend.sending.smtp.validate_outbound_host",
+            side_effect=OutboundHttpBlocked("private network blocked"),
+        ), self.assertRaisesRegex(SmtpConfigurationError, "private network blocked"):
+            _open_smtp(config)
+
+    def test_smtp_revalidates_and_pins_at_connection_time(self):
+        config = SmtpConfig(host="smtp.example.test", port=587, security="starttls")
+        public = [(2, 1, 6, "", ("93.184.216.34", 587))]
+        private = [(2, 1, 6, "", ("127.0.0.1", 587))]
+        with patch.dict(
+            "os.environ",
+            {"APP_ENV": "production", "GOVOPLAN_CONNECTOR_ALLOW_PRIVATE_NETWORKS": "false"},
+        ), patch(
+            "govoplan_core.security.outbound_http.socket.getaddrinfo",
+            side_effect=(public, private),
+        ), patch("govoplan_core.security.outbound_http.socket.socket") as socket_factory, self.assertRaisesRegex(
+            OutboundHttpBlocked,
+            "non-public network",
+        ):
+            _open_smtp(config)
+        socket_factory.assert_not_called()
+
     def test_prepare_smtp_send_validates_envelope(self):
         config = SmtpConfig(host="smtp.example.org", port=587, security="starttls")
         with self.assertRaisesRegex(SmtpConfigurationError, "envelope sender"):
@@ -45,4 +73,3 @@ class SmtpSendHelperTests(unittest.TestCase):
 
 if __name__ == "__main__":
     unittest.main()
-

webui/package-lock.json

@@ -1,17 +1,17 @@
 {
   "name": "@govoplan/mail-webui",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@govoplan/mail-webui",
-      "version": "0.1.8",
+      "version": "0.1.10",
       "devDependencies": {
         "typescript": "^5.7.2"
       },
       "peerDependencies": {
-        "@govoplan/core-webui": "^0.1.8",
+        "@govoplan/core-webui": "^0.1.10",
         "lucide-react": "^1.23.0",
         "react": "^19.0.0",
         "react-dom": "^19.0.0",

webui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@govoplan/mail-webui",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "private": true,
   "type": "module",
   "main": "src/index.ts",
@@ -14,7 +14,7 @@
     "./styles/mail-profiles.css": "./src/styles/mail-profiles.css"
   },
   "peerDependencies": {
-    "@govoplan/core-webui": "^0.1.8",
+    "@govoplan/core-webui": "^0.1.10",
     "lucide-react": "^1.23.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
@@ -26,7 +26,7 @@
     }
   },
   "scripts": {
-    "test:mail-ui": "rm -rf .mail-test-build && mkdir -p .mail-test-build && printf '{\"type\":\"commonjs\"}\\n' > .mail-test-build/package.json && tsc -p tsconfig.mail-tests.json && node .mail-test-build/tests/mailbox-folders.test.js && node .mail-test-build/tests/mail-profile-editor-model.test.js && node .mail-test-build/tests/mail-policy-validation.test.js"
+    "test:mail-ui": "rm -rf .mail-test-build && mkdir -p .mail-test-build && printf '{\"type\":\"commonjs\"}\\n' > .mail-test-build/package.json && tsc -p tsconfig.mail-tests.json && node .mail-test-build/tests/mailbox-folders.test.js && node .mail-test-build/tests/mail-profile-editor-model.test.js && node .mail-test-build/tests/mail-policy-validation.test.js && node scripts/test-mailbox-icon-button-structure.mjs"
   },
   "devDependencies": {
     "typescript": "^5.7.2"

webui/scripts/test-mailbox-icon-button-structure.mjs

@@ -0,0 +1,25 @@
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const webuiDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const source = fs.readFileSync(path.join(webuiDir, "src/features/mail/MailboxPage.tsx"), "utf8");
+const styles = fs.readFileSync(path.join(webuiDir, "src/styles/mail-profiles.css"), "utf8");
+
+function assert(condition, message) {
+  if (!condition) throw new Error(message);
+}
+
+assert(source.includes("IconButton,"), "MailboxPage must import the central IconButton");
+assert(
+  source.includes('<IconButton label="i18n:govoplan-mail.clear_message_search.cc9f2800"'),
+  "the clear-search action must use the central IconButton"
+);
+assert(
+  !source.includes('<button type="button" onClick={() => setMessageQuery("")}'),
+  "the raw clear-search button must not return"
+);
+assert(
+  !styles.includes(".mailbox-search-field button"),
+  "Mail must not redefine the central icon-button appearance"
+);

webui/src/components/table/DataGrid.tsx

@@ -1,4 +0,0 @@
-import { DataGrid, DataGridEmptyAction, DataGridRowActions } from "@govoplan/core-webui";
-export type { DataGridColumn, DataGridListOption, DataGridPagination, DataGridQueryState, DataGridSortDirection } from "@govoplan/core-webui";
-export { DataGridEmptyAction, DataGridRowActions };
-export default DataGrid;

webui/src/features/mail/MailProfileManagement.tsx

@@ -1,5 +1,5 @@
 import { useEffect, useMemo, useState, type ReactNode } from "react";
-import { ConnectionTree, FieldLabel, LoadingFrame, MailServerSettingsPanel, PolicyLockedHint, PolicyPathHelp, PolicyRow, PolicySourcePath, PolicyTable, ToggleSwitch, hasMailImapSettings, mailImapSettingsPayload, mailServerSecurityOptions, mailSmtpSettingsPayload, mailTextOrNull, mailTransportCredentialsPayload, mergeDeltaRows, normalizeMailServerSecurity, normalizePolicySourcePathItems, useDeltaWatermarks, type ConnectionTreeColumn, type MailServerConnectionTestResult, type MailServerCredentialSettings, type MailServerImapSettings, type MailServerSmtpSettings, type NormalizedPolicySourcePathItem, type PolicySourcePathItem } from "@govoplan/core-webui";
+import { AdminSelectionList, ConnectionTree, FieldLabel, LoadingFrame, MailServerSettingsPanel, PolicyLockedHint, PolicyPathHelp, PolicyRow, PolicySourcePath, PolicyTable, StatusBadge, TableActionGroup, ToggleSwitch, hasMailImapSettings, mailImapSettingsPayload, mailServerSecurityOptions, mailSmtpSettingsPayload, mailTextOrNull, mailTransportCredentialsPayload, mergeDeltaRows, normalizeMailServerSecurity, normalizePolicySourcePathItems, useDeltaWatermarks, type ConnectionTreeColumn, type MailServerConnectionTestResult, type MailServerCredentialSettings, type MailServerImapSettings, type MailServerSmtpSettings, type NormalizedPolicySourcePathItem, type PolicySourcePathItem } from "@govoplan/core-webui";
 import { Pencil, Plus, Trash2 } from "lucide-react";
 import type { ApiSettings } from "../../types";
 import {
@@ -42,6 +42,8 @@ import {
   mailProfileEditTargetShowsProfileFields,
   mailProfileEditTargetShowsSettingsPanel,
   mailProfileEditTargetVisibleSections,
+  mailProfileCreateCredentialsPayload,
+  mailProfileTargetedUpdatePayload,
   type MailProfileEditTarget,
   type MailProfileProtocol
 } from "./mailProfileEditorModel";
@@ -278,7 +280,7 @@ export function MailProfileScopeManager({
         const created = await createMailServerProfile(settings, payload);
         setSuccess(i18nMessage("i18n:govoplan-mail.profile_value_created.2a088d8d", { value0: created.name }));
       } else {
-        const payload = updateProfilePayload(draft, editing);
+        const payload = updateProfilePayload(draft, editing, editingTarget);
         const updated = await updateMailServerProfile(settings, editing.id, payload);
         setSuccess(i18nMessage("i18n:govoplan-mail.profile_value_updated.fdbad0ea", { value0: updated.name }));
       }
@@ -344,10 +346,10 @@ export function MailProfileScopeManager({
     header: "i18n:govoplan-mail.status.bae7d5be",
     width: "110px",
     render: (row) => row.kind === "profile" ?
-    <span className={`status-badge ${row.profile.is_active ? "success" : "neutral"}`}>{row.profile.is_active ? "i18n:govoplan-mail.active.a733b809" : "i18n:govoplan-mail.inactive.09af574c"}</span> :
+    <StatusBadge status={row.profile.is_active ? "active" : "inactive"} label={row.profile.is_active ? "i18n:govoplan-mail.active.a733b809" : "i18n:govoplan-mail.inactive.09af574c"} /> :
     row.kind === "server" ?
-    <span className={`status-badge ${transportConfigured(row.profile, row.protocol) ? "success" : "neutral"}`}>{transportConfigured(row.profile, row.protocol) ? "i18n:govoplan-core.configured.668c5fff" : "i18n:govoplan-core.not_configured.811931bb"}</span> :
+    <StatusBadge status={transportConfigured(row.profile, row.protocol) ? "success" : "inactive"} label={transportConfigured(row.profile, row.protocol) ? "i18n:govoplan-core.configured.668c5fff" : "i18n:govoplan-core.not_configured.811931bb"} /> :
-    <span className={`status-badge ${mailCredentialConfigured(row.profile, row.protocol) ? "success" : "neutral"}`}>{mailCredentialConfigured(row.profile, row.protocol) ? "i18n:govoplan-mail.saved.c0ae8f6e" : "i18n:govoplan-mail.local.dc99d54d"}</span>
+    <StatusBadge status={mailCredentialConfigured(row.profile, row.protocol) ? "success" : "inactive"} label={mailCredentialConfigured(row.profile, row.protocol) ? "i18n:govoplan-mail.saved.c0ae8f6e" : "i18n:govoplan-mail.local.dc99d54d"} />
   }],
   [profileEffectivePolicy]);
 
@@ -362,24 +364,24 @@ export function MailProfileScopeManager({
   function renderMailProfileActions(row: MailProfileTreeRow) {
     if (row.kind === "server") {
       const label = `Edit ${row.protocol.toUpperCase()} server`;
-      return (
+      return <TableActionGroup actions={[{
-        <div className="admin-icon-actions">
+        id: "edit-server", label, icon: <Pencil size={16} />, disabled: !canWriteProfiles || busy, onClick: () => openEdit(row.profile, { kind: "server", protocol: row.protocol })
-          <Button type="button" className="admin-icon-button" title={label} aria-label={label} onClick={() => openEdit(row.profile, { kind: "server", protocol: row.protocol })} disabled={!canWriteProfiles || busy}><Pencil size={16} /></Button>
+      }]} />;
-        </div>);
 
     }
     if (row.kind === "credential") {
-      return (
+      return <TableActionGroup actions={[{
-        <div className="admin-icon-actions">
+        id: "edit-credentials", label: i18nMessage("i18n:govoplan-mail.edit_value_credentials.1e2dc4f6", { value0: row.protocol.toUpperCase() }), icon: <Pencil size={16} />, disabled: !canWriteProfiles || !canManageCredentials || busy, onClick: () => openEdit(row.profile, { kind: "credentials", protocol: row.protocol })
-          <Button type="button" className="admin-icon-button" title={i18nMessage("i18n:govoplan-mail.edit_value_credentials.1e2dc4f6", { value0: row.protocol.toUpperCase() })} aria-label={i18nMessage("i18n:govoplan-mail.edit_value_credentials.1e2dc4f6", { value0: row.protocol.toUpperCase() })} onClick={() => openEdit(row.profile, { kind: "credentials", protocol: row.protocol })} disabled={!canWriteProfiles || busy}><Pencil size={16} /></Button>
+      }]} />;
-        </div>);
 
     }
-    return (
+    const deactivationDeletesCredentials = Boolean(
-      <div className="admin-icon-actions">
+      row.profile.smtp_password_configured || row.profile.imap_password_configured
-        <Button type="button" className="admin-icon-button" title={i18nMessage("i18n:govoplan-mail.edit_value.fad75899", { value0: row.profile.name })} aria-label={i18nMessage("i18n:govoplan-mail.edit_value.fad75899", { value0: row.profile.name })} onClick={() => openEdit(row.profile)} disabled={!canWriteProfiles || busy}><Pencil size={16} /></Button>
+    );
-        <Button type="button" variant="danger" className="admin-icon-button" title={i18nMessage("i18n:govoplan-mail.deactivate_value.a276a667", { value0: row.profile.name })} aria-label={i18nMessage("i18n:govoplan-mail.deactivate_value.a276a667", { value0: row.profile.name })} onClick={() => setDeactivating(row.profile)} disabled={!canWriteProfiles || busy || !row.profile.is_active}><Trash2 size={16} /></Button>
+    return <TableActionGroup actions={[
-      </div>);
+      { id: "edit", label: i18nMessage("i18n:govoplan-mail.edit_value.fad75899", { value0: row.profile.name }), icon: <Pencil size={16} />, disabled: !canWriteProfiles || busy, onClick: () => openEdit(row.profile) },
+      { id: "deactivate", label: i18nMessage("i18n:govoplan-mail.deactivate_value.a276a667", { value0: row.profile.name }), icon: <Trash2 size={16} />, variant: "danger", applicable: row.profile.is_active, disabled: !canWriteProfiles || busy || (deactivationDeletesCredentials && !canManageCredentials), onClick: () => setDeactivating(row.profile) }
+    ]} />;
 
   }
 
@@ -387,7 +389,7 @@ export function MailProfileScopeManager({
     <div className="mail-profile-manager">
       {targetSelectionRequired &&
       <Card title={i18nMessage("i18n:govoplan-mail.value_scope", { value0: targetLabel })}>
-          <div className="mail-profile-target-row">
+          <div className="settings-target-row">
             <FormField label={targetLabel}>
               <select value={selectedTargetId} onChange={(event) => setSelectedTargetId(event.target.value)} disabled={loading || busy || !hasSelectableTarget}>
                 {!hasSelectableTarget && <option value="">{targetEmptyText}</option>}
@@ -405,7 +407,7 @@ export function MailProfileScopeManager({
           actions={
           <div className="button-row compact-actions">
                 <Button onClick={() => void loadProfiles()} disabled={loading}>{loading ? "i18n:govoplan-mail.loading.33ce4174" : "i18n:govoplan-mail.reload.cce71553"}</Button>
-                <Button variant="primary" onClick={openCreate} disabled={!canWriteProfiles || busy}><span className="button-icon-label"><Plus size={16} />i18n:govoplan-mail.new_profile.ca36da25</span></Button>
+                <Button variant="primary" onClick={openCreate} disabled={!canWriteProfiles || busy}><Plus size={16} />i18n:govoplan-mail.new_profile.ca36da25</Button>
               </div>
           }>
 
@@ -582,13 +584,6 @@ export function MailProfilePolicyEditor({
     setPolicy((current) => normalizePolicy({ ...current, ...patch }));
   }
 
-  function toggleAllowedProfile(profileId: string, checked: boolean) {
-    const next = new Set(policy.allowed_profile_ids ?? []);
-    if (checked) next.add(profileId);else
-    next.delete(profileId);
-    patchPolicy({ allowed_profile_ids: [...next].sort() });
-  }
-
   function setFlag(key: "allow_user_profiles" | "allow_group_profiles" | "allow_campaign_profiles", value: PolicyFlagValue) {
     patchPolicy({ [key]: flagToBoolean(value) });
   }
@@ -658,15 +653,17 @@ export function MailProfilePolicyEditor({
             </div>
           </div>
           <p className="muted small-note">{selectedProfileIds.size === 0 ? "i18n:govoplan-mail.no_local_profile_allow_list_is_set.31072e39" : i18nMessage("i18n:govoplan-mail.value_profile_s_allowed_by_this_scope.6fe9ba44", { value0: selectedProfileIds.size })}</p>
-          <div className="mail-profile-checkbox-grid">
+          <AdminSelectionList
-            {candidateProfiles.map((profile) =>
+            options={candidateProfiles.map((profile) => ({
-            <label className="mail-profile-checkbox" key={profile.id}>
+              id: profile.id,
-                <input type="checkbox" checked={selectedProfileIds.has(profile.id)} disabled={disabled || profileAllowListLocked || Boolean(parentAllowedProfileIds && !parentAllowedProfileIds.has(profile.id) && !selectedProfileIds.has(profile.id))} onChange={(event) => toggleAllowedProfile(profile.id, event.target.checked)} />
+              label: profile.name,
-                <span><strong>{profile.name}</strong><small>{scopeLabel(profile)} · {transportLabel(profile.smtp)}</small></span>
+              description: `${scopeLabel(profile)} · ${transportLabel(profile.smtp)}`,
-              </label>
+              disabled: disabled || profileAllowListLocked || Boolean(parentAllowedProfileIds && !parentAllowedProfileIds.has(profile.id) && !selectedProfileIds.has(profile.id))
-            )}
+            }))}
-            {candidateProfiles.length === 0 && <p className="muted small-note">i18n:govoplan-mail.no_profiles_are_visible_for_this_policy_scope.1ec7bd85</p>}
+            selected={[...selectedProfileIds]}
-          </div>
+            onChange={(allowedProfileIds) => patchPolicy({ allowed_profile_ids: [...allowedProfileIds].sort() })}
+            emptyText="i18n:govoplan-mail.no_profiles_are_visible_for_this_policy_scope.1ec7bd85"
+          />
           {parentAllowedProfileIds && <p className="muted small-note">i18n:govoplan-mail.an_ancestor_allow_list_limits_selectable_profile.499ec179 {parentAllowedProfileIds.size} i18n:govoplan-mail.profile_s.742e9200</p>}
         </section>
 
@@ -1100,6 +1097,7 @@ function profileToDraft(profile: MailServerProfile): ProfileDraft {
 }
 
 function createProfilePayload(draft: ProfileDraft, scopeType: MailProfileScope, scopeId: string | null): MailServerProfilePayload {
+  const credentials = profileCreateCredentialsPayload(draft);
   return {
     name: draft.name.trim(),
     slug: mailTextOrNull(draft.slug),
@@ -1109,21 +1107,27 @@ function createProfilePayload(draft: ProfileDraft, scopeType: MailProfileScope,
     scope_id: scopeId,
     smtp: smtpServerPayload(draft),
     imap: hasDraftImapSettings(draft) ? imapServerPayload(draft) : null,
-    credentials: profileCredentialsPayload(draft, false)
+    ...(credentials ? { credentials } : {})
   };
 }
 
-function updateProfilePayload(draft: ProfileDraft, profile: MailServerProfile): MailServerProfileUpdatePayload {
+function updateProfilePayload(
-  return {
+  draft: ProfileDraft,
+  profile: MailServerProfile,
+  target: MailProfileEditTarget
+): MailServerProfileUpdatePayload {
+  return mailProfileTargetedUpdatePayload(target, {
+    profile: {
       name: draft.name.trim(),
       slug: mailTextOrNull(draft.slug),
       description: draft.description.trim(),
-    is_active: draft.isActive,
+      is_active: draft.isActive
+    },
     smtp: smtpServerPayload(draft),
     imap: hasDraftImapSettings(draft) ? imapServerPayload(draft) : null,
     credentials: profileCredentialsPayload(draft, true),
-    clear_imap: !hasDraftImapSettings(draft) && Boolean(profile.imap)
+    clearImap: !hasDraftImapSettings(draft) && Boolean(profile.imap)
-  };
+  }) as MailServerProfileUpdatePayload;
 }
 
 function smtpServerPayload(draft: ProfileDraft): MailSmtpTestPayload {
@@ -1147,6 +1151,13 @@ function profileCredentialsPayload(draft: ProfileDraft, preserveBlankPassword: b
   };
 }
 
+function profileCreateCredentialsPayload(draft: ProfileDraft) {
+  return mailProfileCreateCredentialsPayload(
+    mailTransportCredentialsPayload(draft.smtpUsername, draft.smtpPassword, true),
+    mailTransportCredentialsPayload(draft.imapUsername, draft.imapPassword, true)
+  );
+}
+
 function rawSmtpPayload(draft: ProfileDraft, preserveBlankPassword: boolean): MailSmtpTestPayload {
   return { ...smtpServerPayload(draft), ...mailTransportCredentialsPayload(draft.smtpUsername, draft.smtpPassword, preserveBlankPassword) };
 }

webui/src/features/mail/MailboxPage.tsx

@@ -1,9 +1,11 @@
 import { useEffect, useMemo, useRef, useState } from "react";
-import { ChevronLeft, ChevronRight, ChevronsLeft, ChevronsRight, Home, Mail, Paperclip, RefreshCw, Search, X } from "lucide-react";
+import { ChevronRight, Home, Mail, Paperclip, RefreshCw, Search, X } from "lucide-react";
 import {
   Button,
+  DataGridPaginationBar,
   DismissibleAlert,
   ExplorerTree,
+  IconButton,
   LoadingIndicator,
   MessageDisplayPanel,
   formatDateTime,
@@ -415,7 +417,7 @@ export default function MailboxPage({ settings }: {settings: ApiSettings;}) {
               <label className="mailbox-search-field">
                 <Search size={15} aria-hidden="true" />
                 <input value={messageQuery} onChange={(event) => setMessageQuery(event.target.value)} placeholder="i18n:govoplan-mail.search_messages.abea65ae" />
-                {messageQuery && <button type="button" onClick={() => setMessageQuery("")} aria-label="i18n:govoplan-mail.clear_message_search.cc9f2800"><X size={14} /></button>}
+                {messageQuery && <IconButton label="i18n:govoplan-mail.clear_message_search.cc9f2800" icon={<X />} variant="ghost" onClick={() => setMessageQuery("")} />}
               </label>
             </div>
 
@@ -474,10 +476,12 @@ export default function MailboxPage({ settings }: {settings: ApiSettings;}) {
               })}
             </div>
           </div>
-          <MailboxPagination
+          <DataGridPaginationBar
             page={messagePage}
             pageSize={messagePageSize}
             totalRows={messageTotalCount ?? 0}
+            className="mailbox-pagination"
+            ariaLabel="i18n:govoplan-mail.mailbox_message_pagination.965407bf"
             disabled={loadingMessages || !foldersReady}
             onPageChange={changeMessagePage}
             onPageSizeChange={changeMessagePageSize} />
@@ -521,31 +525,6 @@ export default function MailboxPage({ settings }: {settings: ApiSettings;}) {
 }
 
 
-function MailboxPagination({ page, pageSize, totalRows, disabled, onPageChange, onPageSizeChange }: {page: number;pageSize: number;totalRows: number;disabled: boolean;onPageChange: (page: number) => void;onPageSizeChange: (pageSize: number) => void;}) {
-  const pageCount = Math.max(1, Math.ceil(totalRows / pageSize));
-  const first = totalRows === 0 ? 0 : (page - 1) * pageSize + 1;
-  const last = Math.min(totalRows, page * pageSize);
-  const options = [10, 25, 50, 100];
-  return (
-    <div className="data-grid-pagination mailbox-pagination" aria-label="i18n:govoplan-mail.mailbox_message_pagination.965407bf">
-      <div className="data-grid-pagination-summary">{first}-{last} of {totalRows}</div>
-      <label className="data-grid-page-size">
-        <span>i18n:govoplan-mail.rows_per_page.af2f9c1b</span>
-        <select value={pageSize} disabled={disabled} onChange={(event) => onPageSizeChange(Number(event.target.value))}>
-          {options.map((value) => <option key={value} value={value}>{value}</option>)}
-        </select>
-      </label>
-      <div className="data-grid-page-controls">
-        <button type="button" aria-label="i18n:govoplan-mail.first_page.49d74b49" disabled={disabled || page <= 1} onClick={() => onPageChange(1)}><ChevronsLeft size={16} /></button>
-        <button type="button" aria-label="i18n:govoplan-mail.previous_page.81f54719" disabled={disabled || page <= 1} onClick={() => onPageChange(page - 1)}><ChevronLeft size={16} /></button>
-        <span>i18n:govoplan-mail.page.fb06270f {page} of {pageCount}</span>
-        <button type="button" aria-label="i18n:govoplan-mail.next_page.4bfc194b" disabled={disabled || page >= pageCount} onClick={() => onPageChange(page + 1)}><ChevronRight size={16} /></button>
-        <button type="button" aria-label="i18n:govoplan-mail.last_page.b01f16ae" disabled={disabled || page >= pageCount} onClick={() => onPageChange(pageCount)}><ChevronsRight size={16} /></button>
-      </div>
-    </div>);
-
-}
-
 function mailboxMessageKey(folder: string, uid: string): string {
   return `${folder || "INBOX"}::${uid}`;
 }

webui/src/features/mail/mailProfileEditorModel.ts

@@ -23,6 +23,22 @@ export type MailProfileChildDescriptor = {
   protocol: MailProfileProtocol;
 };
 
+export type MailProfileTransportCredentialsLike = {
+  username?: string | null;
+  password?: string | null;
+};
+
+export type MailProfileTargetedUpdateParts = {
+  profile: Record<string, unknown>;
+  smtp: Record<string, unknown>;
+  imap: Record<string, unknown> | null;
+  credentials: {
+    smtp: MailProfileTransportCredentialsLike;
+    imap: MailProfileTransportCredentialsLike;
+  };
+  clearImap: boolean;
+};
+
 export function mailProfileChildDescriptors(profile: MailProfileTreeProfileLike): MailProfileChildDescriptor[] {
   const children: MailProfileChildDescriptor[] = [
     { kind: "server", id: `server:${profile.id}:smtp`, protocol: "smtp" },
@@ -58,3 +74,42 @@ export function mailProfileEditTargetShowsProfileFields(target: MailProfileEditT
 export function mailProfileEditTargetShowsSettingsPanel(target: MailProfileEditTarget): boolean {
   return target.kind !== "profile";
 }
+
+/**
+ * Keep the PATCH authority surface equal to the focused editor. Profile and
+ * server edits must not accidentally replay credential fields merely because
+ * the form draft contains their displayed values.
+ */
+export function mailProfileTargetedUpdatePayload(
+  target: MailProfileEditTarget,
+  parts: MailProfileTargetedUpdateParts
+): Record<string, unknown> {
+  if (target.kind === "profile") return parts.profile;
+  if (target.kind === "server") {
+    if (target.protocol === "smtp") return { smtp: parts.smtp };
+    return parts.imap === null
+      ? { imap: null, clear_imap: parts.clearImap }
+      : { imap: parts.imap };
+  }
+  if (target.kind === "credentials") {
+    return { credentials: { [target.protocol]: parts.credentials[target.protocol] } };
+  }
+  throw new Error("Create is not an update target");
+}
+
+/** Omit blank create credentials so profile-write remains independent. */
+export function mailProfileCreateCredentialsPayload(
+  smtp: MailProfileTransportCredentialsLike,
+  imap: MailProfileTransportCredentialsLike
+): {smtp?: MailProfileTransportCredentialsLike;imap?: MailProfileTransportCredentialsLike;} | undefined {
+  const populated = (value: MailProfileTransportCredentialsLike): MailProfileTransportCredentialsLike =>
+    Object.fromEntries(
+      Object.entries(value).filter(([, item]) => item !== null && item !== undefined && item !== "")
+    );
+  const smtpCredentials = populated(smtp);
+  const imapCredentials = populated(imap);
+  const result: {smtp?: MailProfileTransportCredentialsLike;imap?: MailProfileTransportCredentialsLike;} = {};
+  if (Object.keys(smtpCredentials).length > 0) result.smtp = smtpCredentials;
+  if (Object.keys(imapCredentials).length > 0) result.imap = imapCredentials;
+  return Object.keys(result).length > 0 ? result : undefined;
+}

webui/src/i18n/generatedTranslations.ts

@@ -17,15 +17,15 @@ export const generatedTranslations: PlatformTranslations = {
     "i18n:govoplan-mail.bytes_b": "{value0} B",
     "i18n:govoplan-mail.bytes_kb": "{value0} KB",
     "i18n:govoplan-mail.bytes_mb": "{value0} MB",
-    "i18n:govoplan-mail.campaign_local_settings.920ecb62": "campaign-local settings",
+    "i18n:govoplan-mail.campaign_local_settings.920ecb62": "campaign-scoped profiles",
-    "i18n:govoplan-mail.campaign_local_settings.eb0f1061": "Campaign-local settings",
+    "i18n:govoplan-mail.campaign_local_settings.eb0f1061": "Campaign-scoped profiles",
     "i18n:govoplan-mail.campaigns": "Campaigns",
     "i18n:govoplan-mail.campaign.69390e16": "Campaign",
     "i18n:govoplan-mail.cancel.77dfd213": "Cancel",
     "i18n:govoplan-mail.cc.1fd6a880": "Cc",
     "i18n:govoplan-mail.clear_allow_list.f69c8c67": "Clear allow-list",
     "i18n:govoplan-mail.clear_message_search.cc9f2800": "Clear message search",
-    "i18n:govoplan-mail.controls_whether_campaigns_may_use_inline_smtp_i.fa45cbbc": "Controls whether campaigns may use inline SMTP/IMAP settings instead of reusable profiles.",
+    "i18n:govoplan-mail.controls_whether_campaigns_may_use_inline_smtp_i.fa45cbbc": "Controls whether reusable campaign-scoped Mail profiles may be defined below this scope.",
     "i18n:govoplan-mail.controls_whether_group_scoped_mail_profiles_may_.0b832ea4": "Controls whether group-scoped mail profiles may be defined below this scope.",
     "i18n:govoplan-mail.controls_whether_user_scoped_mail_profiles_may_b.00c0e0e7": "Controls whether user-scoped mail profiles may be defined below this scope.",
     "i18n:govoplan-mail.create_mail_profile.4d2f8f9f": "Create mail profile",
@@ -37,8 +37,8 @@ export const generatedTranslations: PlatformTranslations = {
     "i18n:govoplan-mail.deactivate_value_campaign_drafts_using_it_will_n.656f1b9e": "Deactivate {value0}? Campaign drafts using it will need another allowed profile before sending.",
     "i18n:govoplan-mail.deactivate_value.a276a667": "Deactivate {value0}",
     "i18n:govoplan-mail.deactivate.d65ded94": "Deactivate",
-    "i18n:govoplan-mail.decides_whether_lower_scopes_inherit_saved_imap_.ac607ee3": "Decides whether lower scopes inherit saved IMAP credentials from a selected profile or must provide local IMAP credentials.",
+    "i18n:govoplan-mail.decides_whether_lower_scopes_inherit_saved_imap_.ac607ee3": "Controls credential inheritance for compatible consumers. Campaign delivery requires credentials to remain on and inherit from the selected Mail profile.",
-    "i18n:govoplan-mail.decides_whether_lower_scopes_inherit_saved_smtp_.93f1c4d0": "Decides whether lower scopes inherit saved SMTP credentials from a selected profile or must provide local SMTP credentials.",
+    "i18n:govoplan-mail.decides_whether_lower_scopes_inherit_saved_smtp_.93f1c4d0": "Controls credential inheritance for compatible consumers. Campaign delivery requires credentials to remain on and inherit from the selected Mail profile.",
     "i18n:govoplan-mail.deny.53577bb5": "Deny",
     "i18n:govoplan-mail.description.55f8ebc8": "Description",
     "i18n:govoplan-mail.development_mock_mailbox.1a379865": "Development mock mailbox",
@@ -214,15 +214,15 @@ export const generatedTranslations: PlatformTranslations = {
     "i18n:govoplan-mail.bytes_b": "{value0} B",
     "i18n:govoplan-mail.bytes_kb": "{value0} KB",
     "i18n:govoplan-mail.bytes_mb": "{value0} MB",
-    "i18n:govoplan-mail.campaign_local_settings.920ecb62": "campaign-local settings",
+    "i18n:govoplan-mail.campaign_local_settings.920ecb62": "kampagnenbezogene Profile",
-    "i18n:govoplan-mail.campaign_local_settings.eb0f1061": "Campaign-local settings",
+    "i18n:govoplan-mail.campaign_local_settings.eb0f1061": "Kampagnenbezogene Profile",
     "i18n:govoplan-mail.campaigns": "Kampagnen",
     "i18n:govoplan-mail.campaign.69390e16": "Campaign",
     "i18n:govoplan-mail.cancel.77dfd213": "Abbrechen",
     "i18n:govoplan-mail.cc.1fd6a880": "Cc",
     "i18n:govoplan-mail.clear_allow_list.f69c8c67": "Clear allow-list",
     "i18n:govoplan-mail.clear_message_search.cc9f2800": "Clear message search",
-    "i18n:govoplan-mail.controls_whether_campaigns_may_use_inline_smtp_i.fa45cbbc": "Controls whether campaigns may use inline SMTP/IMAP settings instead of reusable profiles.",
+    "i18n:govoplan-mail.controls_whether_campaigns_may_use_inline_smtp_i.fa45cbbc": "Legt fest, ob unterhalb dieses Bereichs wiederverwendbare kampagnenbezogene Mailprofile angelegt werden duerfen.",
     "i18n:govoplan-mail.controls_whether_group_scoped_mail_profiles_may_.0b832ea4": "Controls whether group-scoped mail profiles may be defined below this scope.",
     "i18n:govoplan-mail.controls_whether_user_scoped_mail_profiles_may_b.00c0e0e7": "Controls whether user-scoped mail profiles may be defined below this scope.",
     "i18n:govoplan-mail.create_mail_profile.4d2f8f9f": "Create mail profile",
@@ -234,8 +234,8 @@ export const generatedTranslations: PlatformTranslations = {
     "i18n:govoplan-mail.deactivate_value_campaign_drafts_using_it_will_n.656f1b9e": "Deactivate {value0}? Campaign drafts using it will need another allowed profile before sending.",
     "i18n:govoplan-mail.deactivate_value.a276a667": "Deactivate {value0}",
     "i18n:govoplan-mail.deactivate.d65ded94": "Deactivate",
-    "i18n:govoplan-mail.decides_whether_lower_scopes_inherit_saved_imap_.ac607ee3": "Decides whether lower scopes inherit saved IMAP credentials from a selected profile or must provide local IMAP credentials.",
+    "i18n:govoplan-mail.decides_whether_lower_scopes_inherit_saved_imap_.ac607ee3": "Steuert die Vererbung fuer kompatible Verbraucher. Kampagnen muessen die Zugangsdaten aus dem ausgewaehlten Mailprofil erben.",
-    "i18n:govoplan-mail.decides_whether_lower_scopes_inherit_saved_smtp_.93f1c4d0": "Decides whether lower scopes inherit saved SMTP credentials from a selected profile or must provide local SMTP credentials.",
+    "i18n:govoplan-mail.decides_whether_lower_scopes_inherit_saved_smtp_.93f1c4d0": "Steuert die Vererbung fuer kompatible Verbraucher. Kampagnen muessen die Zugangsdaten aus dem ausgewaehlten Mailprofil erben.",
     "i18n:govoplan-mail.deny.53577bb5": "Deny",
     "i18n:govoplan-mail.description.55f8ebc8": "Beschreibung",
     "i18n:govoplan-mail.development_mock_mailbox.1a379865": "Entwicklungs-Mailbox",

webui/src/styles/mail-profiles.css

@@ -1,23 +1,8 @@
-.admin-form-grid.three-columns {
-  grid-template-columns: repeat(3, minmax(0, 1fr));
-}
-
-.button-icon-label {
-  display: inline-flex;
-  align-items: center;
-  gap: 7px;
-}
-
 .mail-profile-manager {
   display: grid;
   gap: 18px;
 }
 
-
-.mail-profile-target-row {
-  max-width: 520px;
-}
-
 .mail-profile-dialog .dialog-body {
   max-height: min(76vh, 820px);
   overflow: auto;
@@ -91,40 +76,6 @@
   margin: 0;
 }
 
-.mail-profile-checkbox-grid {
-  display: grid;
-  grid-template-columns: repeat(auto-fit, minmax(240px, 1fr));
-  gap: 10px;
-}
-
-.mail-profile-checkbox {
-  display: grid;
-  grid-template-columns: auto minmax(0, 1fr);
-  align-items: start;
-  gap: 10px;
-  padding: 10px 12px;
-  border: var(--border-line);
-  border-radius: var(--radius-sm);
-  background: var(--surface);
-}
-
-.mail-profile-checkbox input {
-  width: auto;
-  margin-top: 3px;
-  box-shadow: none;
-}
-
-.mail-profile-checkbox span {
-  display: grid;
-  gap: 2px;
-  min-width: 0;
-}
-
-.mail-profile-checkbox small {
-  color: var(--muted);
-  overflow-wrap: anywhere;
-}
-
 .mail-policy-row {
   grid-template-columns: minmax(190px, .9fr) minmax(210px, .75fr);
 }
@@ -204,18 +155,7 @@
   color: var(--text-strong);
 }
 
-.status-badge.success {
-  background: var(--success-bg);
-  color: var(--success-text);
-}
-
-.status-badge.neutral {
-  background: var(--status-neutral-bg);
-  color: var(--text-soft);
-}
-
 @media (max-width: 900px) {
-  .admin-form-grid.three-columns,
   .mail-policy-pattern-grid,
   .mail-policy-effective-grid,
   .mail-profile-transport-summary,
@@ -469,15 +409,6 @@
 
 
 /* Mailbox work surface: shared explorer/list pattern with mail-specific columns. */
-.mailbox-page.file-manager-fullscreen {
-  position: relative;
-  display: grid;
-  grid-template-rows: 1fr;
-  height: calc(100vh - 115px);
-  padding: 0;
-  overflow: hidden;
-}
-
 .mailbox-shell.file-manager-shell {
   position: relative;
   grid-template-columns: minmax(230px, 290px) minmax(390px, 1fr) minmax(340px, .82fr);
@@ -616,25 +547,6 @@
   padding: 6px 0;
 }
 
-.mailbox-search-field button {
-  display: inline-grid;
-  place-items: center;
-  width: 24px;
-  height: 24px;
-  padding: 0;
-  border: 0;
-  border-radius: var(--radius-xs, 5px);
-  background: transparent;
-  color: var(--muted);
-  cursor: pointer;
-}
-
-.mailbox-search-field button:hover,
-.mailbox-search-field button:focus-visible {
-  background: var(--surface-subtle);
-  color: var(--text-strong);
-}
-
 .mailbox-error-state {
   color: var(--danger-text);
 }

webui/tests/mail-profile-editor-model.test.ts

@@ -18,7 +18,9 @@ import {
   mailProfileEditTargetPanelMode,
   mailProfileEditTargetShowsProfileFields,
   mailProfileEditTargetShowsSettingsPanel,
-  mailProfileEditTargetVisibleSections
+  mailProfileEditTargetVisibleSections,
+  mailProfileCreateCredentialsPayload,
+  mailProfileTargetedUpdatePayload
 } from "../src/features/mail/mailProfileEditorModel";
 
 const smtpOnlyChildren = mailProfileChildDescriptors({ id: "profile-1", imap: null });
@@ -46,3 +48,42 @@ assertEqual(mailProfileEditTargetShowsProfileFields({ kind: "profile" }), true);
 assertEqual(mailProfileEditTargetShowsProfileFields({ kind: "server", protocol: "smtp" }), false);
 assertEqual(mailProfileEditTargetShowsSettingsPanel({ kind: "profile" }), false);
 assertEqual(mailProfileEditTargetShowsSettingsPanel({ kind: "create" }), true);
+
+const updateParts = {
+  profile: { name: "Renamed" },
+  smtp: { host: "smtp.example.org" },
+  imap: { host: "imap.example.org" },
+  credentials: {
+    smtp: { username: "smtp-user", password: "smtp-secret" },
+    imap: { username: "imap-user", password: "imap-secret" }
+  },
+  clearImap: false
+};
+assertDeepEqual(
+  mailProfileTargetedUpdatePayload({ kind: "profile" }, updateParts),
+  { name: "Renamed" },
+  "profile edits do not replay transport or credential fields"
+);
+assertDeepEqual(
+  mailProfileTargetedUpdatePayload({ kind: "server", protocol: "smtp" }, updateParts),
+  { smtp: { host: "smtp.example.org" } },
+  "server edits do not replay credential fields"
+);
+assertDeepEqual(
+  mailProfileTargetedUpdatePayload({ kind: "credentials", protocol: "imap" }, updateParts),
+  { credentials: { imap: { username: "imap-user", password: "imap-secret" } } },
+  "credential edits send only the selected protocol"
+);
+assertEqual(
+  mailProfileCreateCredentialsPayload({ username: null }, { password: "" }),
+  undefined,
+  "credential-free creates omit the credential object"
+);
+assertDeepEqual(
+  mailProfileCreateCredentialsPayload(
+    { username: "smtp-user", password: null },
+    { username: null, password: "imap-secret" }
+  ),
+  { smtp: { username: "smtp-user" }, imap: { password: "imap-secret" } },
+  "create payloads retain only explicitly populated credential fields"
+);