Ящики из веб-почты: администратор создаёт no-reply@, monitor@, support@, задаёт новый пароль, выключает

Регистрация остаётся закрытой. Администраторы — MAIL_ADMINS (по умолчанию первый ящик);
роль не в базе, укравший ящик себя админом не сделает. API /api/admin/mailboxes,
сгенерированный пароль — один раз в ответе, в лог не пишется. Настройки → MAILBOXES
(видно только администратору). Тесты: MailboxAdminControllerTest (5), всего 73.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/src/test/java/com/mailserver/controller/AuthenticationControllerTest.java

@@ -34,7 +34,7 @@ class AuthenticationControllerTest {
     private final LoginGuard guard = new LoginGuard(new LoginGuard.Settings(true, 3, 100, Duration.ofMinutes(15),
             Duration.ofMinutes(15), Duration.ofHours(24), Duration.ofDays(30), Set.of(), Duration.ZERO));
     private final AuthenticationController controller = new AuthenticationController(users, mock(MailService.class), jwt,
-            mock(MailDomains.class), false, guard);
+            mock(MailDomains.class), false, guard, mock(com.mailserver.config.MailAdmins.class));
 
     private final User alice = new User();
 

backend/src/test/java/com/mailserver/controller/MailboxAdminControllerTest.java

@@ -0,0 +1,129 @@
+package com.mailserver.controller;
+
+import com.mailserver.config.MailAdmins;
+import com.mailserver.config.MailDomains;
+import com.mailserver.domain.User;
+import com.mailserver.service.MailService;
+import com.mailserver.service.UserService;
+import org.junit.jupiter.api.Test;
+import org.springframework.http.HttpStatus;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.web.server.ResponseStatusException;
+import reactor.core.publisher.Flux;
+import reactor.core.publisher.Mono;
+
+import java.util.List;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+/** Settings → Mailboxes: only administrators; mailboxes only in our domains; a generated password comes back once. */
+class MailboxAdminControllerTest {
+
+    private final UserService users = mock(UserService.class);
+    private final MailService mail = mock(MailService.class);
+    private final MailDomains domains = new MailDomains("jambocheck.com", "");
+    private final MailAdmins admins = new MailAdmins("", "", domains);
+    private final MailboxAdminController controller = new MailboxAdminController(users, mail, domains, admins);
+
+    private final User admin = user(1L, "admin@jambocheck.com");
+    private final User alice = user(2L, "alice@jambocheck.com");
+
+    MailboxAdminControllerTest() {
+        when(mail.usedBytes(anyLong())).thenReturn(Mono.just(0L));
+        when(users.all()).thenReturn(Flux.just(alice, admin));
+        when(users.byId(1L)).thenReturn(Mono.just(admin));
+        when(users.byId(2L)).thenReturn(Mono.just(alice));
+        when(users.register(anyString(), anyString(), any())).thenAnswer(i -> Mono.just(user(3L, i.getArgument(0))));
+        when(users.setPassword(any(), anyString())).thenAnswer(i -> Mono.just((User) i.getArgument(0)));
+        when(users.setActive(any(), any(Boolean.class))).thenAnswer(i -> {
+            User u = i.getArgument(0);
+            u.setActive(i.getArgument(1));
+            return Mono.just(u);
+        });
+    }
+
+    @Test
+    void administratorIsTheFirstMailboxByDefault() {
+        assertThat(admins.isAdmin("ADMIN@jambocheck.com")).isTrue();
+        assertThat(admins.isAdmin("alice@jambocheck.com")).isFalse();
+        assertThat(new MailAdmins("ops@jambocheck.com, root@jambocheck.com", "admin@jambocheck.com", domains).isAdmin("admin@jambocheck.com")).isFalse();
+    }
+
+    @Test
+    void listsMailboxesSortedForAnAdministratorOnly() {
+        List<MailboxAdminController.MailboxView> list = controller.list(as("admin@jambocheck.com")).collectList().block();
+        assertThat(list).extracting(MailboxAdminController.MailboxView::email).containsExactly("admin@jambocheck.com", "alice@jambocheck.com");
+        assertThat(list.get(0).admin()).isTrue();
+
+        assertThat(status(() -> controller.list(as("alice@jambocheck.com")).collectList().block())).isEqualTo(HttpStatus.FORBIDDEN);
+    }
+
+    @Test
+    void createsReservedNamesWithAGeneratedPasswordShownOnce() {
+        var created = controller.create(as("admin@jambocheck.com"),
+                Mono.just(new MailboxAdminController.CreateRequest(" No-Reply@JamboCheck.com ", "Jambotron", ""))).block();
+
+        assertThat(created.mailbox().email()).isEqualTo("no-reply@jambocheck.com");
+        assertThat(created.password()).hasSizeGreaterThanOrEqualTo(20);
+        verify(users).register(eq("no-reply@jambocheck.com"), eq(created.password()), eq("Jambotron"));
+
+        var chosen = controller.create(as("admin@jambocheck.com"),
+                Mono.just(new MailboxAdminController.CreateRequest("monitor@jambocheck.com", null, "long-enough-1"))).block();
+        assertThat(chosen.password()).isNull();
+    }
+
+    @Test
+    void refusesOtherDomainsBadAddressesShortPasswordsAndNonAdmins() {
+        assertThat(status(() -> create("admin@jambocheck.com", "x@gmail.com", ""))).isEqualTo(HttpStatus.BAD_REQUEST);
+        assertThat(status(() -> create("admin@jambocheck.com", "bad address@jambocheck.com", ""))).isEqualTo(HttpStatus.BAD_REQUEST);
+        assertThat(status(() -> create("admin@jambocheck.com", "x@jambocheck.com", "short"))).isEqualTo(HttpStatus.BAD_REQUEST);
+        assertThat(status(() -> create("alice@jambocheck.com", "x@jambocheck.com", ""))).isEqualTo(HttpStatus.FORBIDDEN);
+        verify(users, never()).register(anyString(), anyString(), any());
+
+        when(users.register(eq("alice@jambocheck.com"), anyString(), any())).thenReturn(Mono.error(new IllegalArgumentException("exists")));
+        assertThat(status(() -> create("admin@jambocheck.com", "alice@jambocheck.com", ""))).isEqualTo(HttpStatus.CONFLICT);
+    }
+
+    @Test
+    void newPasswordAndSwitchOffButNotYourself() {
+        var reset = controller.password(as("admin@jambocheck.com"), 2L, Mono.just(new MailboxAdminController.PasswordRequest(null))).block();
+        assertThat(reset.password()).isNotBlank();
+        verify(users).setPassword(alice, reset.password());
+
+        assertThat(controller.active(as("admin@jambocheck.com"), 2L, Mono.just(new MailboxAdminController.ActiveRequest(false))).block().active()).isFalse();
+        assertThat(status(() -> controller.active(as("admin@jambocheck.com"), 1L, Mono.just(new MailboxAdminController.ActiveRequest(false))).block()))
+                .isEqualTo(HttpStatus.BAD_REQUEST);
+    }
+
+    private MailboxAdminController.Created create(String me, String email, String password) {
+        return controller.create(as(me), Mono.just(new MailboxAdminController.CreateRequest(email, null, password))).block();
+    }
+
+    private static Mono<Authentication> as(String email) {
+        return Mono.just(new UsernamePasswordAuthenticationToken(email, null, List.of()));
+    }
+
+    private static HttpStatus status(Runnable call) {
+        Throwable error = org.assertj.core.api.Assertions.catchThrowable(call::run);
+        assertThat(error).isInstanceOf(ResponseStatusException.class);
+        return HttpStatus.valueOf(((ResponseStatusException) error).getStatusCode().value());
+    }
+
+    private static User user(Long id, String email) {
+        User user = new User();
+        user.setId(id);
+        user.setEmail(email);
+        user.setPassword("hash");
+        return user;
+    }
+}