chore: Colorado Bridge 3.13.0 changelog.

(cherry picked from commit ed5adb18fb)

.gitlab-ci.yml

@@ -25,11 +25,16 @@ variables:
   GOMAXPROCS: $(( ${CI_TAG_CPU} / 2 ))
 
 before_script:
-  - apt update && apt-get -y install libsecret-1-dev
-  - git config --global url.https://gitlab-ci-token:${CI_JOB_TOKEN}@${CI_SERVER_HOST}.insteadOf https://${CI_SERVER_HOST}
+  - |
+    if [ "$CI_JOB_NAME" != "grype-scan-code-dependencies" ]; then
+      apt update && apt-get -y install libsecret-1-dev
+      git config --global url.https://gitlab-ci-token:${CI_JOB_TOKEN}@${CI_SERVER_HOST}.insteadOf https://${CI_SERVER_HOST}
+    fi
 
 stages:
+  - analyse
   - test
+  - report
   - build
 
 include:
@@ -37,5 +42,9 @@ include:
   - local: ci/rules.yml
   - local: ci/env.yml
   - local: ci/test.yml
+  - local: ci/report.yml
   - local: ci/build.yml
+  - component: gitlab.protontech.ch/proton/devops/cicd-components/kits/devsecops/go@~latest
+    inputs:
+      stage: analyse
 

.golangci.yml

@@ -2,11 +2,12 @@
 run:
   timeout: 10m
   skip-dirs:
-    - pkg/mime
-    - extern
 
 issues:
   exclude-use-default: false
+  exclude-dirs:
+    - pkg/mime
+    - extern
   exclude:
     - Using the variable on range scope `tt` in function literal
     # For now we are missing a lot of comments.

.grype.yaml

@@ -0,0 +1,2 @@
+# Check out for configuration details: https://github.com/anchore/grype?tab=readme-ov-file#configuration
+fail-on-severity: "medium"

BUILDS.md

@@ -3,7 +3,7 @@
 ## Prerequisites
 * 64-bit OS:
     - the go-rfc5322 module cannot currently be compiled for 32-bit OSes
-* Go 1.21.6
+* Go 1.21.9
 * Bash with basic build utils: make, gcc, sed, find, grep, ...
   - For Windows, it is recommended to use MinGW 64bit shell from [MSYS2](https://www.msys2.org/)
 * GCC (Linux), msvc (Windows) or Xcode (macOS)

Changelog.md

@@ -3,6 +3,86 @@
 Changelog [format](http://keepachangelog.com/en/1.0.0/)
 
 
+## Colorado Bridge 3.13.0
+
+### Added
+* BRIDGE-37: added message broadcasting functionality.
+* BRIDGE-122: added observability service.
+* BRIDGE-119: added support for Feature Flags.
+* BRIDGE-116: added command-line switches to enable/disable keychain check on macOS.
+* BRIDGE-88: added context menu for quick actions on input labels: cut, copy, paste.
+
+### Changed
+* BRIDGE-81: KB article suggestion updates + more weight for long keywords.
+
+### Fixed
+* BRIDGE-67: Added detection for username changes on macOS & automatic reconfiguration.
+* BRIDGE-138: Remove deprecated doc.
+
+
+## Bastei Bridge 3.12.0
+
+### Added
+* BRIDGE-75: Bridge repair button.
+* BRIDGE-79: Add New Outlook for Mac KB disclaimer.
+
+### Changed
+* BRIDGE-16: Bump version Go 1.21.9 Qt 6.4.3.
+* BRIDGE-23: Update gluon to go 1.21.
+* BRIDGE-22: Update gpa to go 1.21.
+
+### Fixed
+* BRIDGE-90: Disable repair button when bridge cannot connect to proton servers; bump GPA.
+* BRIDGE-69: Explicitly handle semver panic for last bridge version from vault.
+* BRIDGE-29: Bump gluon version.
+* BRIDGE-49: Configure gitleaks baseline and grype config.
+* BRIDGE-21: Missing panic handling.
+* BRIDGE-17: Broken telemetry heartbeat test.
+* BRIDGE-10: Bumped gluon version.
+
+
+## Alcantara Bridge 3.11.1
+
+### Fixed
+* BRIDGE-70: Hotfix for blocked smtp/imap port causing bridge to quit.
+
+
+## Alcantara Bridge 3.11.0
+
+### Added
+* GODT-3185: Report cases which leads to wrong address key used.
+
+### Changed
+* BRIDGE-14: HV3 implementation.
+* BRIDGE-15: Certificate install is now also done during Outlook setup on macOS.
+* GODT-3146: Start servers on startup, keep running even when no users are active.
+* BRIDGE-19: Update checksum validation use warning instead of error on non-existing files.
+
+### Fixed
+* BRIDGE-8: Fix bridge double sessionID issue in logs.
+* BRIDGE-7: Modify keychain test on macOS.
+* BRIDGE-4: Logs not being created when invalid flag is passed.
+* BRIDGE-5: Add tooltip to tray icon.
+* GODT-3163: Filter MBOX format delimiter.
+
+
+## Zaehringen Bridge 3.10.0
+
+### Added
+* GODT-3199: Add package log field.
+* GODT-3220: Add more test scenarios.
+
+### Changed
+* GODT-3193: Preserve attachment encoding.
+* GODT-3214: Encrypt only with primary key.
+* GODT-2662: Use tart runner for darwin jobs.
+* GODT-1602: Test: run integration tests against black 🖤.
+* GODT-3257: Test: quad9 provider test not working on CI.
+
+### Fixed
+* GODT-3290: Fix test failing because of leap day.
+
+
 ## Ypsilon Bridge 3.9.1
 
 ### Fixed

Makefile

@@ -1,17 +1,18 @@
 export GO111MODULE=on
+export CGO_ENABLED=1
 
 # By default, the target OS is the same as the host OS,
 # but this can be overridden by setting TARGET_OS to "windows"/"darwin"/"linux".
 GOOS:=$(shell go env GOOS)
 TARGET_CMD?=Desktop-Bridge
 TARGET_OS?=${GOOS}
-ROOT_DIR:=$(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))
+ROOT_DIR:=$(realpath .)
 
 ## Build
 .PHONY: build build-gui build-nogui build-launcher versioner hasher
 
 # Keep version hardcoded so app build works also without Git repository.
-BRIDGE_APP_VERSION?=3.9.1+git
+BRIDGE_APP_VERSION?=3.13.0+git
 APP_VERSION:=${BRIDGE_APP_VERSION}
 APP_FULL_NAME:=Proton Mail Bridge
 APP_VENDOR:=Proton AG
@@ -19,8 +20,8 @@ SRC_ICO:=bridge.ico
 SRC_ICNS:=Bridge.icns
 SRC_SVG:=bridge.svg
 EXE_NAME:=proton-bridge
-REVISION:=$(shell ./utils/get_revision.sh)
-TAG:=$(shell ./utils/get_revision.sh tag)
+REVISION:=$(shell "${ROOT_DIR}/utils/get_revision.sh" rev)
+TAG:=$(shell "${ROOT_DIR}/utils/get_revision.sh" tag)
 BUILD_TIME:=$(shell date +%FT%T%z)
 MACOS_MIN_VERSION_ARM64=11.0
 MACOS_MIN_VERSION_AMD64=10.15
@@ -101,9 +102,9 @@ endif
 
 ifeq "${GOOS}" "windows"
 	go-build-finalize= \
-		$(if $(4),powershell Copy-Item ${ROOT_DIR}/${RESOURCE_FILE} ${4}  &&,) \
+		$(if $(4),cp "${ROOT_DIR}/${RESOURCE_FILE}" ${4}  &&,) \
 		$(call go-build,$(1),$(2),$(3)) \
-		$(if $(4), && powershell Remove-Item ${4} -Force,)
+		$(if $(4), && rm -f ${4},)
 endif
 
 ${EXE_NAME}: gofiles  ${RESOURCE_FILE}
@@ -117,7 +118,10 @@ versioner:
 	go build ${BUILD_FLAGS} -o versioner utils/versioner/main.go
 
 vault-editor:
-	$(call go-build-finalize,"-tags=debug","vault-editor","./utils/vault-editor/main.go")
+	$(call go-build-finalize,-tags=debug,"vault-editor","./utils/vault-editor/main.go")
+
+bridge-rollout:
+	$(call go-build-finalize,, "bridge-rollout","./utils/bridge-rollout/bridge-rollout.go")
 
 hasher:
 	go build -o hasher utils/hasher/main.go
@@ -164,7 +168,7 @@ ${EXE_TARGET}: check-build-essentials ${EXE_NAME}
  		BRIDGE_BUILD_TIME=${BUILD_TIME} \
 		BRIDGE_GUI_BUILD_CONFIG=Release \
 		BRIDGE_BUILD_ENV=${BUILD_ENV} \
-		BRIDGE_INSTALL_PATH=${ROOT_DIR}/${DEPLOY_DIR}/${GOOS} \
+		BRIDGE_INSTALL_PATH="${ROOT_DIR}/${DEPLOY_DIR}/${GOOS}" \
 		./build.sh install
 	mv "${ROOT_DIR}/${BRIDGE_EXE}" "$(ROOT_DIR)/${EXE_TARGET}"
 
@@ -185,7 +189,7 @@ ${RESOURCE_FILE}: ./dist/info.rc ./dist/${SRC_ICO} .FORCE
 
 ## Dev dependencies
 .PHONY: install-devel-tools install-linter install-go-mod-outdated install-git-hooks
-LINTVER:="v1.55.2"
+LINTVER:="v1.59.1"
 LINTSRC:="https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh"
 
 install-dev-dependencies: install-devel-tools install-linter install-go-mod-outdated
@@ -260,7 +264,8 @@ test-integration-race: gofiles
 
 test-integration-nightly: gofiles
 	mkdir -p coverage/integration
-	go test \
+	gotestsum \
+		--junitfile tests/result/feature-tests.xml -- \
 		-v -timeout=90m -p=1 -count=1 -tags=test_integration \
 		${GOCOVERAGE} \
 		github.com/ProtonMail/proton-bridge/v3/tests \

ci/build.yml

@@ -1,4 +1,3 @@
-
 ---
 
 .script-build:
@@ -7,9 +6,14 @@
   extends:
     - .rules-branch-and-MR-manual
   script:
+    - which go && go version
+    - which gcc && gcc --version
+    - which qmake && qmake --version
+    - git rev-parse --short=10 HEAD
     - make build
     - git diff && git diff-index --quiet HEAD
     - make vault-editor
+    - make bridge-rollout
   artifacts:
     expire_in: 1 day
     when: always
@@ -17,7 +21,7 @@
     paths:
       - bridge_*.tgz
       - vault-editor
-
+      - bridge-rollout
 build-linux:
   extends:
     - .script-build
@@ -66,4 +70,3 @@ trigger-qa-installer:
   trigger:
     project: "jcuth/bridge-release"
     branch: master
-

ci/env.yml

@@ -2,27 +2,35 @@
 ---
 
 .env-windows:
+  extends:
+    - .image-windows-virt-build
   before_script:
-    - export BRIDGE_SYNC_FORCE_MINIMUM_SPEC=1
-    - !reference [.before-script-windows-aws-build, before_script]
+    - !reference [.before-script-windows-virt-build, before_script]
     - !reference [.before-script-git-config, before_script]
-    - git config --global safe.directory '*'
-    - git status --porcelain
-  cache: {}
-  tags:
-    - windows-bridge
+    - mkdir -p .cache/bin
+    - export PATH=$(pwd)/.cache/bin:$PATH
+    - export GOPATH="$CI_PROJECT_DIR/.cache"
+  variables:
+    GOARCH: amd64
+    BRIDGE_SYNC_FORCE_MINIMUM_SPEC: 1
+    VCPKG_DEFAULT_BINARY_CACHE: ${CI_PROJECT_DIR}/.cache
+  cache:
+    key: windows-vcpkg-go-0
+    paths:
+      - .cache
+    when: 'always'
 
 .env-darwin:
   extends:
     - .image-darwin-build
   before_script:
-    - export BRIDGE_SYNC_FORCE_MINIMUM_SPEC=1
     - !reference [.before-script-darwin-tart-build, before_script]
     - !reference [.before-script-git-config, before_script]
     - mkdir -p .cache/bin
     - export PATH=$(pwd)/.cache/bin:$PATH
     - export GOPATH="$CI_PROJECT_DIR/.cache"
   variables:
+    BRIDGE_SYNC_FORCE_MINIMUM_SPEC: 1
     VCPKG_DEFAULT_BINARY_CACHE: ${CI_PROJECT_DIR}/.cache
   cache:
     key: darwin-go-and-vcpkg

ci/report.yml

@@ -0,0 +1,25 @@
+
+---
+
+include:
+  - project: 'tpe/testmo-reporter'
+    ref: master
+    file: '/scenarios/testmo-script.yml'
+
+testmo-upload:
+    stage: report
+    extends:
+      - .testmo-upload
+      - .rules-branch-manual-scheduled-and-test-branch-always
+    needs:
+      - test-integration-nightly
+    before_script: []
+    variables:
+      TESTMO_TOKEN: "$TESTMO_TOKEN"
+      TESTMO_URL: "https://proton.testmo.net"
+      PROJECT_ID: "9"
+      NAME: "Nightly integration tests"
+      MILESTONE: "Nightly integration tests"
+      SOURCE: "test-integration-nightly"
+      TAGS: "$CI_COMMIT_REF_SLUG"
+      RESULT_FOLDER: "tests/result/*.xml"

ci/test.yml

@@ -26,11 +26,15 @@ lint-bug-report-preview:
   extends:
     - .rules-branch-manual-MR-and-devel-always
   script:
+    - which go && go version
+    - which gcc && gcc --version
     - make test
   artifacts:
     paths:
       - coverage/**
 
+
+
 test-linux:
   extends:
     - .image-linux-test
@@ -70,6 +74,9 @@ test-integration:
     - test-linux
   script:
     - make test-integration | tee -a integration-job.log
+  after_script:
+    - |
+      grep "Error: " integration-job.log
   artifacts:
     when: always
     paths:
@@ -95,9 +102,13 @@ test-integration-nightly:
     - test-integration
   script:
     - make test-integration-nightly | tee -a nightly-job.log
+  after_script:
+    - |
+      grep "Error: " nightly-job.log
   artifacts:
     when: always
     paths:
+      - tests/result/feature-tests.xml
       - nightly-job.log
 
 test-coverage:

cmd/Desktop-Bridge/main.go

@@ -19,8 +19,15 @@ package main
 
 import (
 	"os"
+	"runtime"
 	"strings"
 
+	"github.com/ProtonMail/proton-bridge/v3/internal/constants"
+	"github.com/ProtonMail/proton-bridge/v3/internal/locations"
+	"github.com/ProtonMail/proton-bridge/v3/internal/logging"
+	"github.com/ProtonMail/proton-bridge/v3/internal/sentry"
+	"github.com/sirupsen/logrus"
+
 	"github.com/ProtonMail/proton-bridge/v3/internal/app"
 	"github.com/bradenaw/juniper/xslices"
 )
@@ -43,5 +50,72 @@ import (
 */
 
 func main() {
-	_ = app.New().Run(xslices.Filter(os.Args, func(arg string) bool { return !strings.Contains(arg, "-psn_") }))
+	appErr := app.New().Run(xslices.Filter(os.Args, func(arg string) bool { return !strings.Contains(arg, "-psn_") }))
+	if appErr != nil {
+		_ = app.WithLocations(func(l *locations.Locations) error {
+			logsPath, err := l.ProvideLogsPath()
+			if err != nil {
+				return err
+			}
+
+			// Get the session ID if its specified
+			var sessionID logging.SessionID
+			if flagVal, found := getFlagValue(os.Args, app.FlagSessionID); found {
+				sessionID = logging.SessionID(flagVal)
+			} else {
+				sessionID = logging.NewSessionID()
+			}
+
+			closer, err := logging.Init(
+				logsPath,
+				sessionID,
+				logging.BridgeShortAppName,
+				logging.DefaultMaxLogFileSize,
+				logging.DefaultPruningSize,
+				"",
+			)
+			if err != nil {
+				return err
+			}
+
+			defer func() {
+				_ = logging.Close(closer)
+			}()
+
+			logrus.
+				WithField("appName", constants.FullAppName).
+				WithField("version", constants.Version).
+				WithField("revision", constants.Revision).
+				WithField("tag", constants.Tag).
+				WithField("build", constants.BuildTime).
+				WithField("runtime", runtime.GOOS).
+				WithField("args", os.Args).
+				WithField("SentryID", sentry.GetProtectedHostname()).WithError(appErr).Error("Failed to initialize bridge")
+			return nil
+		})
+	}
+}
+
+// getFlagValue - obtains the value of a specified tag
+// The flag can be of the following form `-flag value`, `--flag value`, `-flag=value` or `--flags=value`.
+func getFlagValue(argList []string, flag string) (string, bool) {
+	eqPrefix1 := "-" + flag + "="
+	eqPrefix2 := "--" + flag + "="
+
+	for i := 0; i < len(argList); i++ {
+		arg := argList[i]
+		if strings.HasPrefix(arg, eqPrefix1) {
+			val := strings.TrimPrefix(arg, eqPrefix1)
+			return val, len(val) > 0
+		}
+		if strings.HasPrefix(arg, eqPrefix2) {
+			val := strings.TrimPrefix(arg, eqPrefix2)
+			return val, len(val) > 0
+		}
+		if (arg == "-"+flag || arg == "--"+flag) && i+1 < len(argList) {
+			return argList[i+1], true
+		}
+	}
+
+	return "", false
 }

cmd/Desktop-Bridge/main_test.go

@@ -0,0 +1,47 @@
+// Copyright (c) 2024 Proton AG
+//
+// This file is part of Proton Mail Bridge.
+//
+// Proton Mail Bridge is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Proton Mail Bridge is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Proton Mail Bridge. If not, see <https://www.gnu.org/licenses/>.
+
+package main
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetFlagValue(t *testing.T) {
+	tests := []struct {
+		args     []string
+		flag     string
+		expected string
+	}{
+		{[]string{"session-id", ""}, "session-id", ""},
+		{[]string{"-session-id", ""}, "session-id", ""},
+		{[]string{"--session-id", ""}, "session-id", ""},
+		{[]string{"session-id", "test"}, "session-id", ""},
+		{[]string{"-session-id", "test"}, "session-id", "test"},
+		{[]string{"--session-id", "test"}, "session-id", "test"},
+		{[]string{"session-id=test"}, "session-id", ""},
+		{[]string{"-session-id=test"}, "session-id", "test"},
+		{[]string{"--session-id=test"}, "session-id", "test"},
+	}
+
+	for _, tt := range tests {
+		val, _ := getFlagValue(tt.args, tt.flag)
+		require.Equal(t, val, tt.expected)
+	}
+}

cmd/launcher/main.go

@@ -40,6 +40,7 @@ import (
 	"github.com/elastic/go-sysinfo/types"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
+	"golang.org/x/exp/slices"
 	"golang.org/x/sys/execabs"
 )
 
@@ -53,9 +54,12 @@ const (
 	FlagCLIShort            = "c"
 	FlagNonInteractive      = "noninteractive"
 	FlagNonInteractiveShort = "n"
-	FlagLauncher            = "--launcher"
-	FlagWait                = "--wait"
-	FlagSessionID           = "--session-id"
+	FlagLauncher            = "launcher"
+	FlagWait                = "wait"
+	FlagSessionID           = "session-id"
+	HyphenatedFlagLauncher  = "--" + FlagLauncher
+	HyphenatedFlagWait      = "--" + FlagWait
+	HyphenatedFlagSessionID = "--" + FlagSessionID
 )
 
 func main() { //nolint:funlen
@@ -151,7 +155,7 @@ func main() { //nolint:funlen
 		}
 	}
 
-	cmd := execabs.Command(exe, appendLauncherPath(launcher, append(args, FlagSessionID, string(sessionID)))...) //nolint:gosec
+	cmd := execabs.Command(exe, appendLauncherPath(launcher, appendOrModifySessionID(args, string(sessionID)))...) //nolint:gosec
 
 	cmd.Stdin = os.Stdin
 	cmd.Stdout = os.Stdout
@@ -173,19 +177,14 @@ func main() { //nolint:funlen
 
 // appendLauncherPath add launcher path if missing.
 func appendLauncherPath(path string, args []string) []string {
-	if !sliceContains(args, FlagLauncher) {
+	if !slices.Contains(args, HyphenatedFlagLauncher) {
 		res := append([]string{}, args...)
-		res = append(res, FlagLauncher, path)
+		res = append(res, HyphenatedFlagLauncher, path)
 		return res
 	}
 	return args
 }
 
-// sliceContains checks if a value is present in a list.
-func sliceContains[T comparable](list []T, s T) bool {
-	return xslices.Any(list, func(arg T) bool { return arg == s })
-}
-
 // inCLIMode detect if CLI mode is asked.
 func inCLIMode(args []string) bool {
 	return hasFlag(args, FlagCLI) || hasFlag(args, FlagCLIShort) || hasFlag(args, FlagNonInteractive) || hasFlag(args, FlagNonInteractiveShort)
@@ -193,7 +192,12 @@ func inCLIMode(args []string) bool {
 
 // hasFlag checks if a flag is present in a list.
 func hasFlag(args []string, flag string) bool {
-	return xslices.Any(args, func(arg string) bool { return (arg == "-"+flag) || (arg == "--"+flag) })
+	return flagIndex(args, flag) >= 0
+}
+
+// flagIndex returns the position of the first occurrence of a flag int args, or -1 if the flag is not present.
+func flagIndex(args []string, flag string) int {
+	return slices.IndexFunc(args, func(arg string) bool { return (arg == "-"+flag) || (arg == "--"+flag) })
 }
 
 // findAndStrip check if a value is present in s list and remove all occurrences of the value from this list.
@@ -211,7 +215,7 @@ func findAndStripWait(args []string) ([]string, bool, []string) {
 	hasFlag := false
 	values := make([]string, 0)
 	for k, v := range res {
-		if v != FlagWait {
+		if v != HyphenatedFlagWait {
 			continue
 		}
 		if k+1 >= len(res) {
@@ -222,7 +226,7 @@ func findAndStripWait(args []string) ([]string, bool, []string) {
 	}
 
 	if hasFlag {
-		res, _ = findAndStrip(res, FlagWait)
+		res, _ = findAndStrip(res, HyphenatedFlagWait)
 		for _, v := range values {
 			res, _ = findAndStrip(res, v)
 		}
@@ -230,6 +234,23 @@ func findAndStripWait(args []string) ([]string, bool, []string) {
 	return res, hasFlag, values
 }
 
+// return args with the sessionID flag and value added or modified. The original slice is not modified.
+func appendOrModifySessionID(args []string, sessionID string) []string {
+	index := flagIndex(args, FlagSessionID)
+	if index < 0 {
+		return append(args, HyphenatedFlagSessionID, sessionID)
+	}
+
+	if index == len(args)-1 {
+		return append(args, sessionID)
+	}
+
+	res := slices.Clone(args)
+	res[index+1] = sessionID
+
+	return res
+}
+
 func getPathToUpdatedExecutable(
 	name string,
 	ver *versioner.Versioner,

cmd/launcher/main_test.go

@@ -20,61 +20,62 @@ package main
 import (
 	"testing"
 
-	"github.com/bradenaw/juniper/xslices"
+	"github.com/ProtonMail/proton-bridge/v3/internal/logging"
 	"github.com/stretchr/testify/assert"
 )
 
-func TestSliceContains(t *testing.T) {
-	assert.True(t, sliceContains([]string{"a", "b", "c"}, "a"))
-	assert.True(t, sliceContains([]int{1, 2, 3}, 2))
-	assert.False(t, sliceContains([]string{"a", "b", "c"}, "A"))
-	assert.False(t, sliceContains([]int{1, 2, 3}, 4))
-	assert.False(t, sliceContains([]string{}, "a"))
-	assert.True(t, sliceContains([]string{"a", "a"}, "a"))
-}
-
 func TestFindAndStrip(t *testing.T) {
 	list := []string{"a", "b", "c", "c", "b", "c"}
 
 	result, found := findAndStrip(list, "a")
 	assert.True(t, found)
-	assert.True(t, xslices.Equal(result, []string{"b", "c", "c", "b", "c"}))
+	assert.Equal(t, result, []string{"b", "c", "c", "b", "c"})
 
 	result, found = findAndStrip(list, "c")
 	assert.True(t, found)
-	assert.True(t, xslices.Equal(result, []string{"a", "b", "b"}))
+	assert.Equal(t, result, []string{"a", "b", "b"})
 
 	result, found = findAndStrip([]string{"c", "c", "c"}, "c")
 	assert.True(t, found)
-	assert.True(t, xslices.Equal(result, []string{}))
+	assert.Equal(t, result, []string{})
 
 	result, found = findAndStrip(list, "A")
 	assert.False(t, found)
-	assert.True(t, xslices.Equal(result, list))
+	assert.Equal(t, result, list)
 
 	result, found = findAndStrip([]string{}, "a")
 	assert.False(t, found)
-	assert.True(t, xslices.Equal(result, []string{}))
+	assert.Equal(t, result, []string{})
 }
 
 func TestFindAndStripWait(t *testing.T) {
 	result, found, values := findAndStripWait([]string{"a", "b", "c"})
 	assert.False(t, found)
-	assert.True(t, xslices.Equal(result, []string{"a", "b", "c"}))
-	assert.True(t, xslices.Equal(values, []string{}))
+	assert.Equal(t, result, []string{"a", "b", "c"})
+	assert.Equal(t, values, []string{})
 
 	result, found, values = findAndStripWait([]string{"a", "--wait", "b"})
 	assert.True(t, found)
-	assert.True(t, xslices.Equal(result, []string{"a"}))
-	assert.True(t, xslices.Equal(values, []string{"b"}))
+	assert.Equal(t, result, []string{"a"})
+	assert.Equal(t, values, []string{"b"})
 
 	result, found, values = findAndStripWait([]string{"a", "--wait", "b", "--wait", "c"})
 	assert.True(t, found)
-	assert.True(t, xslices.Equal(result, []string{"a"}))
-	assert.True(t, xslices.Equal(values, []string{"b", "c"}))
+	assert.Equal(t, result, []string{"a"})
+	assert.Equal(t, values, []string{"b", "c"})
 
 	result, found, values = findAndStripWait([]string{"a", "--wait", "b", "--wait", "c", "--wait", "d"})
 	assert.True(t, found)
-	assert.True(t, xslices.Equal(result, []string{"a"}))
-	assert.True(t, xslices.Equal(values, []string{"b", "c", "d"}))
+	assert.Equal(t, result, []string{"a"})
+	assert.Equal(t, values, []string{"b", "c", "d"})
+}
+
+func TestAppendOrModifySessionID(t *testing.T) {
+	sessionID := string(logging.NewSessionID())
+	assert.Equal(t, appendOrModifySessionID(nil, sessionID), []string{"--session-id", sessionID})
+	assert.Equal(t, appendOrModifySessionID([]string{}, sessionID), []string{"--session-id", sessionID})
+	assert.Equal(t, appendOrModifySessionID([]string{"--cli"}, sessionID), []string{"--cli", "--session-id", sessionID})
+	assert.Equal(t, appendOrModifySessionID([]string{"--cli", "--session-id"}, sessionID), []string{"--cli", "--session-id", sessionID})
+	assert.Equal(t, appendOrModifySessionID([]string{"--cli", "--session-id"}, sessionID), []string{"--cli", "--session-id", sessionID})
+	assert.Equal(t, appendOrModifySessionID([]string{"--session-id", "<oldID>", "--cli"}, sessionID), []string{"--session-id", sessionID, "--cli"})
 }

doc/bridge.md

@@ -1,135 +0,0 @@
-# Bridge
-
-## Main blocks
-
-This is basic overview of the main bridge blocks.
-
-Note connection between IMAP/SMTP and PMAPI. IMAP and SMTP packages are in the queue to be refactored
-and we would like to try to have functionality in bridge core or bridge utilities (such as messages)
-than direct usage of PMAPI from IMAP or SMTP. Also database (BoltDB) should be moved to bridge core.
-
-```mermaid
-graph LR
-    S[Server]
-    C[Client]
-    U[User]
-
-    subgraph "Bridge app"
-        Core[Bridge core]
-        API[PMAPI]
-        Store
-        DB[BoltDB]
-        Frontend["Qt / CLI"]
-        IMAP
-        SMTP
-
-        IMAP --> Store
-        IMAP --> Core
-        SMTP --> Core
-        SMTP --> API
-        Core --> API
-        Core --> Store
-        Store --> API
-        Store --> DB
-        Frontend --> Core
-
-    end
-
-    C --> IMAP
-    C --> SMTP
-    U --> Frontend
-    API --> S
-```
-
-## Code structure
-
-More detailed graph of main types used in Bridge app and connection between them. Here is already
-communication to PMAPI only from bridge core which is not true, yet. IMAP and SMTP are still calling
-PMAPI directly.
-
-```mermaid
-graph TD
-
-    C["Client (e.g. Thunderbird)"]
-    PM[Proton Mail Server]
-
-    subgraph "Bridge app"
-        subgraph "Bridge core"
-            B[Bridge]
-            U[User]
-
-            B --> U
-        end
-
-        subgraph Store
-            StoreU[Store User]
-            StoreA[Address]
-            StoreM[Mailbox]
-
-            StoreU --> StoreA
-            StoreA --> StoreM
-        end
-
-        subgraph Credentials
-            CredStore[Store]
-            Creds[Credentials]
-
-            CredStore --> Creds
-        end
-
-        subgraph Frontend
-            CLI
-            Qt
-        end
-
-        subgraph IMAP
-            IB[IMAP backend]
-            IA[IMAP address]
-            IM[IMAP mailbox]
-
-            IB --> B
-            IB --> IA
-            IA --> IM
-            IA --> U
-            IA --> StoreA
-            IM --> StoreM
-        end
-
-        subgraph SMTP
-            SB[SMTP backend]
-            SS[SMTP session]
-
-            SB --> B
-            SB --> SS
-            SS --> U
-        end
-    end
-
-    subgraph PMAPI
-        AC[Client]
-    end
-
-    C --> IB
-    C --> SB
-
-    CLI --> B
-    Qt --> B
-
-    U --> CredStore
-    U --> Creds
-
-    U --> StoreU
-
-    StoreU --> AC
-    StoreA --> AC
-    StoreM --> AC
-
-    B --> AC
-    U --> AC
-
-    AC --> PM
-```
-
-## How to debug
-
-Run `make run-debug` which starts [Delve](https://github.com/go-delve/delve).

doc/communication.md

@@ -1,114 +0,0 @@
-# Communication
-
-## First login and sync
-
-When user logs in to the bridge for the first time, immediately starts the first sync.
-First sync downloads all headers of all e-mails and creates database to have proper UIDs
-and indexes for IMAP. See [database](database.md) for more information.
-
-By default, whenever it's possible, sync downloads only all e-mails maiblox which already
-have list of labels so we can construct all mailboxes (inbox, sent, trash, custom folders
-and labels) without need to download each e-mail headers many times.
-
-Note that we need to download also bodies to calculate size of the e-mail and set proper
-content type (clients uses content type for guess if e-mail contains attachment)--but only
-body, not attachment. Also it's downloaded only for the first time. After that we store
-those information in our database so next time we only sync headers, labels and so on.
-
-First sync takes some time. List of 150 messages takes about second and then we need to
-download bodies for each message. We still need to do some optimalizations. Anyway, if
-user has reasonable amount of e-mails, there is good chance user will see e-mails in the
-client right after adding account.
-
-When account is added to client, client start the sync. This sync will ask Bridge app
-for all headers (done quickly) and then starts to download all bodies and attachment.
-Unfortunately for some e-mail more than once if the same e-mail is in more mailboxes
-(e.g. inbox and all mail)--there is no way to tell over IMAP it's the same message.
-
-After successful login of client to IMAP, Bridge starts event loop. That periodicly ask
-servers (each 30 seconds) for new updates (new message, keys, …).
-
-```mermaid
-sequenceDiagram
-    participant S as Server
-    participant B as Bridge
-    participant C as Client
-
-    Note right of B: Set up PM account<br/>by user
-
-    loop First sync
-        B ->> S: Fetch body and attachments
-        Note right of B: Build local database<br/>(e-mail UIDs)
-    end
-
-    Note right of C: Set up IMAP/SMTP<br/>by user
-
-    C ->> B: IMAP login
-    B ->> S: Authenticate user
-    Note right of B: Create IMAP user
-
-    loop Event loop, every 30 sec
-        B ->> S: Fetch e-mail headers
-        B ->> C: Send IMAP IDLE response
-    end
-
-    C ->> B: IMAP LIST directories
-
-    loop Client sync
-        C ->> B: IMAP SELECT directory
-        C ->> B: IMAP SEARCH e-mails UIDs
-        C ->> B: IMAP FETCH of e-mail UID
-        B ->> S: Fetch body and attachments
-        Note right of B: Decrypt message<br/>and attachment
-        B ->> C: IMAP response
-    end
-```
-
-## IMAP IDLE extension
-
-IMAP IDLE is extension, it has to be supported by both client and server. IMAP server (in our case
-the bridge) supports it so clients can use it. It works by issuing `IDLE` command by the client and
-keeps the connection open. When the server has some update, server (the bridge) will respond to that
-by `EXISTS` (new message), `APPEND` (imported message), `EXPUNGE` (deleted message) or `MOVE` response.
-
-Even when there is connection with IDLE open, server can mark the client as inactive. Therefore,
-it's recommended the client should reissue the connection after each 29 minutes. This is not the
-real push and can fail!
-
-Our event loop is also simple pull and it will trigger IMAP IDLE when we get some new update from 
-the server. Would be good to have push from the server, but we need to wait for the support on API.
-
-RFC: https://tools.ietf.org/html/rfc2177
-
-```mermaid
-sequenceDiagram
-    participant S as Server
-    participant B as Bridge
-    participant C as Client
-
-    C ->> B: IMAP IDLE
-
-    loop Every 30 seconds
-        S ->> B: Checking events
-        B ->> C: IMAP response
-    end
-```
-
-## Sending e-mails
-
-E-mail are sent over standard SMTP protocol. Our bridge takes the message, encrypts and sent it
-further to our server which will then send the message to its final destination. The important
-and tricky part is encryption. See [encryption](encryption.md) or [PMEL document](https://docs.google.com/document/d/1lEBkG0DC5FOWlumInKtu4a9Cc1Eszp48ZhFy9UpPQso/edit)
-for more information.
-
-```mermaid
-sequenceDiagram
-    participant S as Server
-    participant B as Bridge
-    participant C as Client
-
-    C ->> B: SMTP send e-mail
-    Note right of B: Encrypt messages
-    B ->> S: Send encrypted e-mail
-    B ->> C: Respond OK
-```

doc/database.md

@@ -1,27 +0,0 @@
-# Database
-
-Bridge needs to have a small database to pair our IDs with IMAP UIDs and indexes. IMAP protocol
-requires every message to have an unique UID in mailbox. In this context, mailbox is not an account,
-but a folder or label. This means that one message can have more UIDs, one for each mailbox (folder), 
-and that two messages can have the same UID, but each for different mailbox (folder).
-
-IMAP index is just an index. Look at it like to an array: `["UID1", "UID2", "UID3"]`. We can access
-message by UID or index; for example index 2 and UID `UID2`. When this message is deleted, we need
-to re-index all following messages. The array will look now like `["UID1", "UID3"]` and the last
-message can be accessed by index 2 or UID `UID3`.
-
-See RFCs for more information:
-
-* https://tools.ietf.org/html/rfc822
-* https://tools.ietf.org/html/rfc3501
-
-Our database is currently built on BBolt and have those buckets (key-value storage):
-
-* Message metadata bucket:
-
-    * `[metadataBucket][API_ID] -> pmapi.Message{subject, from, to, size, other headers...}` (without body or attachment)
-
-* Mapping buckets
-
-    * `[mailboxesBucket][addressID-mailboxID][api_ids][API_ID] -> UID`
-    * `[mailboxesBucket][addressID-mailboxID][imap_ids][UID] -> API_ID`

doc/encryption.md

@@ -1,12 +0,0 @@
-# Encryption
-
-Encryption is done in PMAPI, bridge utils and bridge itself. The best would be to keep encryption
-in PMAPI and bridge utils (in package such as messages). All packages are using our high-level
-GopenPGP library on top of OpenPGP.
-
-## `gopenpgp.KeyRing`
-
-We use one `KeyRing` per address. Our usage then contains all keys for specific address. Primary
-key is always on the first position, then there old ones to be able to decrypt last e-mail.
-OpenPGP encrypts given message with all available keys, so we need to first get first (primary)
-key for encryption to have message encrypted only once with primary key.

doc/index.md

@@ -1,9 +0,0 @@
-# Bridge Documentation
-
-Documentation pages in order to read for a novice:
-
-* [Bridge code](bridge.md)
-* [Internal Bridge database](database.md)
-* [Communication between Bridge, Client and Server](communication.md)
-* [Encryption](encryption.md)
-

doc/updates.md

@@ -1,103 +0,0 @@
-# Update mechanism of Bridge
-
-There are multiple options how to change version of application:
-* Automatic in-app update
-* Manual in-app update
-* Manual install
-
-In-app update ends with restarting bridge into new version. Automatic in-app
-update is downloading, verifying and installing the new version immediately
-without user confirmation. For manual in-app update user needs to confirm first.
-Update is done from special update file published on website.
-
-The manual installation requires user to download, verify and install manually
-using installer for given OS.
-
-The bridge is installed and executed differently for given OS:
-
-* Windows and Linux apps are using launcher mechanism:
-    * There is system protected installation path which is created on first
-      install. It contains bridge exe and launcher exe. When users starts
-      bridge the launcher is executed first. It will check update path compare
-      version with installed one. The newer version then is then executed.
-    * Update mechanism means to replace files in update folder which is located
-      in user space.
-
-* macOS app does not use launcher
-    * No launcher, only one executable
-    * In-App update replaces the bridge files in installation path directly
-
-
-```mermaid
-flowchart LR
-    subgraph Frontend
-    U[User requests<br>version check]
-    ManIns((Notify user about<br>manual install<br>is needed))
-    R((Notify user<br>about restart))
-    ManUp((Notify user about<br>manual update))
-    NF((Notify user about<br>force update))
-
-    ManUp -->|Install| InstFront[Install]
-    InstFront -->|Ok| R
-    InstFront -->|Error| ManIns
-
-    U --> CheckFront[Check online]
-    CheckFront -->|Ok| IAFront{Is new version<br>and applicable?}
-    CheckFront -->|Error| ManIns
-
-    IAFront -->|No| Latest((Notify user<br>has latest version))
-    IAFront -->|Yes| CanInstall{Can update?}
-    CanInstall -->|No| ManIns
-    CanInstall -->|Yes| NotifOrInstall{Is automatic<br>update enabled?}
-    NotifOrInstall -->|Manual| ManUp
-    end
-
-
-    subgraph Backend
-    W[Wait for next check]
-
-    W --> Check[Check online]
-
-    Check --> NV{Has new<br>version?}
-    Check -->|Error| W
-    NV -->|No new version| W
-    IA{Is install<br>applicable?}
-    NV -->|New version<br>available| IA
-    IA -->|Local rollout<br>not enough| W
-    IA -->|Yes| AU{Is automatic\nupdate enabled?}
-
-    AU -->|Yes| CanUp{Can update?}
-    CanUp -->|No| ManIns
-
-    CanUp -->|Yes| Ins[Install]
-    Ins -->|Error| ManIns
-    Ins -->|Ok| R
-
-    AU -->|No| ManUp
-    ManUp -->|Ignore| W
-
-
-    F[Force update]
-    F --> NF
-    end
-
-    ManIns --> Web[Open web page]
-    NF --> Web
-    ManUp --> Web
-    R --> Re[Restart]
-    NF --> Q[Quit bridge]
-    NotifOrInstall -->|Automatic| W
-```
-
-
-The non-trivial is to combine the update with setting change:
-* turn off/on automatic in-app updates
-* change from stable to beta or back
-
-_TODO fill flow chart details_
-
-
-We are not support downgrade functionality. Only some circumstances can lead to
-downgrading the app version.
-
-_TODO fill flow chart details_

go.mod

@@ -2,12 +2,14 @@ module github.com/ProtonMail/proton-bridge/v3
 
 go 1.21
 
+toolchain go1.21.9
+
 require (
 	github.com/0xAX/notificator v0.0.0-20220220101646-ee9b8921e557
 	github.com/Masterminds/semver/v3 v3.2.0
-	github.com/ProtonMail/gluon v0.17.1-0.20240227105633-3734c7694bcd
+	github.com/ProtonMail/gluon v0.17.1-0.20240514133734-79cdd0fec41c
 	github.com/ProtonMail/go-autostart v0.0.0-20210130080809-00ed301c8e9a
-	github.com/ProtonMail/go-proton-api v0.4.1-0.20240226161523-ec58ed7ea4b9
+	github.com/ProtonMail/go-proton-api v0.4.1-0.20240829112804-d663a2ef90c2
 	github.com/ProtonMail/gopenpgp/v2 v2.7.4-proton
 	github.com/PuerkitoBio/goquery v1.8.1
 	github.com/abiosoft/ishell v2.0.0+incompatible
@@ -44,11 +46,11 @@ require (
 	github.com/vmihailenco/msgpack/v5 v5.3.5
 	go.uber.org/goleak v1.2.1
 	golang.org/x/exp v0.0.0-20230522175609-2e198f4a06a1
-	golang.org/x/net v0.17.0
-	golang.org/x/sys v0.16.0
+	golang.org/x/net v0.24.0
+	golang.org/x/sys v0.19.0
 	golang.org/x/text v0.14.0
 	google.golang.org/grpc v1.56.3
-	google.golang.org/protobuf v1.31.0
+	google.golang.org/protobuf v1.33.0
 	howett.net/plist v1.0.0
 )
 
@@ -62,7 +64,7 @@ require (
 	github.com/bytedance/sonic v1.9.1 // indirect
 	github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311 // indirect
 	github.com/chzyer/test v1.0.0 // indirect
-	github.com/cloudflare/circl v1.3.3 // indirect
+	github.com/cloudflare/circl v1.3.7 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
 	github.com/cronokirby/saferith v0.33.0 // indirect
 	github.com/cucumber/gherkin-go/v19 v19.0.3 // indirect
@@ -93,7 +95,7 @@ require (
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.19 // indirect
 	github.com/mattn/go-runewidth v0.0.14 // indirect
-	github.com/mattn/go-sqlite3 v1.14.17 // indirect
+	github.com/mattn/go-sqlite3 v1.14.22 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/olekukonko/tablewriter v0.0.5 // indirect
@@ -111,7 +113,7 @@ require (
 	github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
 	gitlab.com/c0b/go-ordered-json v0.0.0-20201030195603-febf46534d5a // indirect
 	golang.org/x/arch v0.3.0 // indirect
-	golang.org/x/crypto v0.18.0 // indirect
+	golang.org/x/crypto v0.22.0 // indirect
 	golang.org/x/mod v0.8.0 // indirect
 	golang.org/x/sync v0.3.0 // indirect
 	golang.org/x/tools v0.6.0 // indirect

go.sum

@@ -27,8 +27,8 @@ github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAE
 github.com/ProtonMail/bcrypt v0.0.0-20210511135022-227b4adcab57/go.mod h1:HecWFHognK8GfRDGnFQbW/LiV7A3MX3gZVs45vk5h8I=
 github.com/ProtonMail/bcrypt v0.0.0-20211005172633-e235017c1baf h1:yc9daCCYUefEs69zUkSzubzjBbL+cmOXgnmt9Fyd9ug=
 github.com/ProtonMail/bcrypt v0.0.0-20211005172633-e235017c1baf/go.mod h1:o0ESU9p83twszAU8LBeJKFAAMX14tISa0yk4Oo5TOqo=
-github.com/ProtonMail/gluon v0.17.1-0.20240227105633-3734c7694bcd h1:AjJsf5xQGmZPg6GLn+wB+eBoGRopJlG70lQBfSyfX+M=
-github.com/ProtonMail/gluon v0.17.1-0.20240227105633-3734c7694bcd/go.mod h1:Og5/Dz1MiGpCJn51XujZwxiLG7WzvvjE5PRpZBQmAHo=
+github.com/ProtonMail/gluon v0.17.1-0.20240514133734-79cdd0fec41c h1:P3SvCACt13Zqdj0IRDB4bgwqI68+oMB2j0uVuPQyoTw=
+github.com/ProtonMail/gluon v0.17.1-0.20240514133734-79cdd0fec41c/go.mod h1:0/c03TzZPNiSgY5UDJK1iRDkjlDPwWugxTT6et2qDu8=
 github.com/ProtonMail/go-autostart v0.0.0-20210130080809-00ed301c8e9a h1:D+aZah+k14Gn6kmL7eKxoo/4Dr/lK3ChBcwce2+SQP4=
 github.com/ProtonMail/go-autostart v0.0.0-20210130080809-00ed301c8e9a/go.mod h1:oTGdE7/DlWIr23G0IKW3OXK9wZ5Hw1GGiaJFccTvZi4=
 github.com/ProtonMail/go-crypto v0.0.0-20230321155629-9a39f2531310/go.mod h1:8TI4H3IbrackdNgv+92dI+rhpCaLqM0IfpgCgenFvRE=
@@ -38,8 +38,24 @@ github.com/ProtonMail/go-message v0.13.1-0.20230526094639-b62c999c85b7 h1:+j+Kd/
 github.com/ProtonMail/go-message v0.13.1-0.20230526094639-b62c999c85b7/go.mod h1:NBAn21zgCJ/52WLDyed18YvYFm5tEoeDauubFqLokM4=
 github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f h1:tCbYj7/299ekTTXpdwKYF8eBlsYsDVoggDAuAjoK66k=
 github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f/go.mod h1:gcr0kNtGBqin9zDW9GOHcVntrwnjrK+qdJ06mWYBybw=
-github.com/ProtonMail/go-proton-api v0.4.1-0.20240226161523-ec58ed7ea4b9 h1:tcQpGQljNsZmfuA6L4hAzio8/AIx5OXcU2JUdyX/qxw=
-github.com/ProtonMail/go-proton-api v0.4.1-0.20240226161523-ec58ed7ea4b9/go.mod h1:t+hb0BfkmZ9fpvzVRpHC7limoowym6ln/j0XL9a8DDw=
+github.com/ProtonMail/go-proton-api v0.4.1-0.20240612082117-0f92424eed80 h1:cP4+6RFn9vVgYnoDwxBU4EtIAZA+eM4rzOaSZNqZ1xg=
+github.com/ProtonMail/go-proton-api v0.4.1-0.20240612082117-0f92424eed80/go.mod h1:3A0cpdo0BIenIPjTG6u8EbzJ8uuJy7rVvM/NaynjCKA=
+github.com/ProtonMail/go-proton-api v0.4.1-0.20240808145610-88df257767f6 h1:nERxOYS4ndSgWEr834YYkb1j0bZK/dJAmhoyYB1MtNY=
+github.com/ProtonMail/go-proton-api v0.4.1-0.20240808145610-88df257767f6/go.mod h1:3A0cpdo0BIenIPjTG6u8EbzJ8uuJy7rVvM/NaynjCKA=
+github.com/ProtonMail/go-proton-api v0.4.1-0.20240819131705-149e50199c5b h1:zifGh4LS5HwQIaVCccSe5/oJGTOjFeVObMRl3QJoJ3k=
+github.com/ProtonMail/go-proton-api v0.4.1-0.20240819131705-149e50199c5b/go.mod h1:3A0cpdo0BIenIPjTG6u8EbzJ8uuJy7rVvM/NaynjCKA=
+github.com/ProtonMail/go-proton-api v0.4.1-0.20240821081056-dd607af0f917 h1:Ma6PfXFDuw7rYYq28FXNW6ubhYquRUmBuLyZrjJWHUE=
+github.com/ProtonMail/go-proton-api v0.4.1-0.20240821081056-dd607af0f917/go.mod h1:3A0cpdo0BIenIPjTG6u8EbzJ8uuJy7rVvM/NaynjCKA=
+github.com/ProtonMail/go-proton-api v0.4.1-0.20240822150235-7a6190889179 h1:6Xo0iRYa4GBgZ2HA+IR3KdqiML8Z10h2F9TYe+9n1+M=
+github.com/ProtonMail/go-proton-api v0.4.1-0.20240822150235-7a6190889179/go.mod h1:3A0cpdo0BIenIPjTG6u8EbzJ8uuJy7rVvM/NaynjCKA=
+github.com/ProtonMail/go-proton-api v0.4.1-0.20240827084449-71096377c391 h1:PW6bE+mhsfAx4+wDCCNjhFrCNiiuMjY6j7RwqRUdPKI=
+github.com/ProtonMail/go-proton-api v0.4.1-0.20240827084449-71096377c391/go.mod h1:3A0cpdo0BIenIPjTG6u8EbzJ8uuJy7rVvM/NaynjCKA=
+github.com/ProtonMail/go-proton-api v0.4.1-0.20240827122236-ca6bb6449bba h1:QtDxgIbgPqRQg7VT+nIUJlaOyNFAoGyg59oW3Hji/0A=
+github.com/ProtonMail/go-proton-api v0.4.1-0.20240827122236-ca6bb6449bba/go.mod h1:3A0cpdo0BIenIPjTG6u8EbzJ8uuJy7rVvM/NaynjCKA=
+github.com/ProtonMail/go-proton-api v0.4.1-0.20240827132526-849231fc34a1 h1:gATlMoj4raG32WyGGh8SpipoQeR2AlU7g+8NAMicTcw=
+github.com/ProtonMail/go-proton-api v0.4.1-0.20240827132526-849231fc34a1/go.mod h1:3A0cpdo0BIenIPjTG6u8EbzJ8uuJy7rVvM/NaynjCKA=
+github.com/ProtonMail/go-proton-api v0.4.1-0.20240829112804-d663a2ef90c2 h1:yx0iejqB5c21HIN5jn9IsbyzUns0dPUUaGfyUHF3TmQ=
+github.com/ProtonMail/go-proton-api v0.4.1-0.20240829112804-d663a2ef90c2/go.mod h1:3A0cpdo0BIenIPjTG6u8EbzJ8uuJy7rVvM/NaynjCKA=
 github.com/ProtonMail/go-smtp v0.0.0-20231109081432-2b3d50599865 h1:EP1gnxLL5Z7xBSymE9nSTM27nRYINuvssAtDmG0suD8=
 github.com/ProtonMail/go-smtp v0.0.0-20231109081432-2b3d50599865/go.mod h1:qm27SGYgoIPRot6ubfQ/GpiPy/g3PaZAVRxiO/sDUgQ=
 github.com/ProtonMail/go-srp v0.0.7 h1:Sos3Qk+th4tQR64vsxGIxYpN3rdnG9Wf9K4ZloC1JrI=
@@ -87,8 +103,9 @@ github.com/chzyer/test v1.0.0 h1:p3BQDXSxOhOG0P9z6/hGnII4LGiEPOYBhs8asl/fC04=
 github.com/chzyer/test v1.0.0/go.mod h1:2JlltgoNkt4TW/z9V/IzDdFaMTM2JPIi26O1pF38GC8=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cloudflare/circl v1.1.0/go.mod h1:prBCrKB9DV4poKZY1l9zBXg2QJY7mvgRvtMxxK7fi4I=
-github.com/cloudflare/circl v1.3.3 h1:fE/Qz0QdIGqeWfnwq0RE0R7MI51s0M2E4Ga9kq5AEMs=
 github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
+github.com/cloudflare/circl v1.3.7 h1:qlCDlTPz2n9fu58M0Nh1J/JzcFpfgkFHHX3O35r5vcU=
+github.com/cloudflare/circl v1.3.7/go.mod h1:sRTcRWXGLrKw6yIGJ+l7amYJFfAXbZG0kBSc8r4zxgA=
 github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
 github.com/coreos/etcd v3.3.13+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
@@ -312,8 +329,8 @@ github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mattn/go-runewidth v0.0.14 h1:+xnbZSEeDbOIg5/mE6JF0w6n9duR1l3/WmbinWVwUuU=
 github.com/mattn/go-runewidth v0.0.14/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
-github.com/mattn/go-sqlite3 v1.14.17 h1:mCRHCLDUBXgpKAqIKsaAaAsrAlbkeomtRFKXh2L6YIM=
-github.com/mattn/go-sqlite3 v1.14.17/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
+github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
+github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
 github.com/miekg/dns v1.1.50 h1:DQUfb9uc6smULcREF09Uc+/Gd46YWqJd5DbpPE9xkcA=
@@ -465,8 +482,8 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
 golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
-golang.org/x/crypto v0.18.0 h1:PGVlW0xEltQnzFZ55hkuX5+KLyrMYhHld1YHO4AKcdc=
-golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
+golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
+golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -520,8 +537,9 @@ golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
 golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
+golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w=
+golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -575,8 +593,8 @@ golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.16.0 h1:xWw16ngr6ZMtmxDyKyIgsE93KNKz5HKmMa3b8ALHidU=
-golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
+golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
@@ -660,8 +678,8 @@ google.golang.org/grpc v1.56.3 h1:8I4C0Yq1EjstUzUJzpcRVbuYA2mODtEmpWiQoN/b2nc=
 google.golang.org/grpc v1.56.3/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
-google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
+google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

internal/app/app.go

@@ -79,11 +79,13 @@ const (
 
 // Hidden flags.
 const (
-	flagLauncher         = "launcher"
-	flagNoWindow         = "no-window"
-	flagParentPID        = "parent-pid"
-	flagSoftwareRenderer = "software-renderer"
-	flagSessionID        = "session-id"
+	flagLauncher            = "launcher"
+	flagNoWindow            = "no-window"
+	flagParentPID           = "parent-pid"
+	flagSoftwareRenderer    = "software-renderer"
+	flagEnableKeychainTest  = "enable-keychain-test"
+	flagDisableKeychainTest = "disable-keychain-test"
+	FlagSessionID           = "session-id"
 )
 
 const (
@@ -91,6 +93,20 @@ const (
 	appShortName = "bridge"
 )
 
+var cliFlagEnableKeychainTest = &cli.BoolFlag{ //nolint:gochecknoglobals
+	Name:   flagEnableKeychainTest,
+	Usage:  "Enable the keychain test",
+	Hidden: true,
+	Value:  false,
+} //nolint:gochecknoglobals
+
+var cliFlagDisableKeychainTest = &cli.BoolFlag{ //nolint:gochecknoglobals
+	Name:   flagDisableKeychainTest,
+	Usage:  "Disable the keychain test",
+	Hidden: true,
+	Value:  false,
+}
+
 func New() *cli.App {
 	app := cli.NewApp()
 
@@ -165,9 +181,12 @@ func New() *cli.App {
 			Value:  false,
 		},
 		&cli.StringFlag{
-			Name:   flagSessionID,
+			Name:   FlagSessionID,
 			Hidden: true,
 		},
+		// the two flags below were introduced by BRIDGE-116
+		cliFlagEnableKeychainTest,
+		cliFlagDisableKeychainTest,
 	}
 
 	app.Action = run
@@ -238,7 +257,8 @@ func run(c *cli.Context) error {
 
 						return withSingleInstance(settings, locations.GetLockFile(), version, func() error {
 							// Look for available keychains
-							return WithKeychainList(crashHandler, func(keychains *keychain.List) error {
+							skipKeychainTest := checkSkipKeychainTest(c, settings)
+							return WithKeychainList(crashHandler, skipKeychainTest, func(keychains *keychain.List) error {
 								// Unlock the encrypted vault.
 								return WithVault(locations, keychains, crashHandler, func(v *vault.Vault, insecure, corrupt bool) error {
 									if !v.Migrated() {
@@ -346,7 +366,7 @@ func withLogging(c *cli.Context, crashHandler *crash.Handler, locations *locatio
 	logrus.WithField("path", logsPath).Debug("Received logs path")
 
 	// Initialize logging.
-	sessionID := logging.NewSessionIDFromString(c.String(flagSessionID))
+	sessionID := logging.NewSessionIDFromString(c.String(FlagSessionID))
 	var closer io.Closer
 	if closer, err = logging.Init(
 		logsPath,
@@ -502,11 +522,11 @@ func withCookieJar(vault *vault.Vault, fn func(http.CookieJar) error) error {
 }
 
 // WithKeychainList init the list of usable keychains.
-func WithKeychainList(panicHandler async.PanicHandler, fn func(*keychain.List) error) error {
+func WithKeychainList(panicHandler async.PanicHandler, skipKeychainTest bool, fn func(*keychain.List) error) error {
 	logrus.Debug("Creating keychain list")
 	defer logrus.Debug("Keychain list stop")
 	defer async.HandlePanic(panicHandler)
-	return fn(keychain.NewList())
+	return fn(keychain.NewList(skipKeychainTest))
 }
 
 func setDeviceCookies(jar *cookies.Jar) error {
@@ -526,3 +546,35 @@ func setDeviceCookies(jar *cookies.Jar) error {
 
 	return nil
 }
+
+func checkSkipKeychainTest(c *cli.Context, settingsDir string) bool {
+	if runtime.GOOS != "darwin" {
+		return false
+	}
+
+	enable := c.Bool(flagEnableKeychainTest)
+	disable := c.Bool(flagDisableKeychainTest)
+
+	skip, err := vault.GetShouldSkipKeychainTest(settingsDir)
+	if err != nil {
+		logrus.WithError(err).Error("Could not load keychain settings.")
+	}
+
+	if (!enable) && (!disable) {
+		return skip
+	}
+
+	// if both switches are passed, 'enable' has priority
+	if disable {
+		skip = true
+	}
+	if enable {
+		skip = false
+	}
+
+	if err := vault.SetShouldSkipKeychainTest(settingsDir, skip); err != nil {
+		logrus.WithError(err).Error("Could not save keychain settings.")
+	}
+
+	return skip
+}

internal/app/app_test.go

@@ -0,0 +1,65 @@
+// Copyright (c) 2024 Proton AG
+//
+// This file is part of Proton Mail Bridge.
+//
+// Proton Mail Bridge is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Proton Mail Bridge is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Proton Mail Bridge. If not, see <https://www.gnu.org/licenses/>.
+
+package app
+
+import (
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"github.com/urfave/cli/v2"
+)
+
+func TestCheckSkipKeychainTest(t *testing.T) {
+	var expectedResult bool
+	dir := t.TempDir()
+	app := cli.App{
+		Flags: []cli.Flag{
+			cliFlagEnableKeychainTest,
+			cliFlagDisableKeychainTest,
+		},
+		Action: func(c *cli.Context) error {
+			require.Equal(t, expectedResult, checkSkipKeychainTest(c, dir))
+			return nil
+		},
+	}
+
+	noArgs := []string{"appName"}
+	enableArgs := []string{"appName", "-" + flagEnableKeychainTest}
+	disableArgs := []string{"appName", "-" + flagDisableKeychainTest}
+	bothArgs := []string{"appName", "-" + flagDisableKeychainTest, "-" + flagEnableKeychainTest}
+
+	const trueOnlyOnMac = runtime.GOOS == "darwin"
+
+	expectedResult = false
+	require.NoError(t, app.Run(noArgs))
+
+	expectedResult = trueOnlyOnMac
+	require.NoError(t, app.Run(disableArgs))
+	require.NoError(t, app.Run(noArgs))
+
+	expectedResult = false
+	require.NoError(t, app.Run(enableArgs))
+	require.NoError(t, app.Run(noArgs))
+
+	expectedResult = trueOnlyOnMac
+	require.NoError(t, app.Run(disableArgs))
+
+	expectedResult = false
+	require.NoError(t, app.Run(bothArgs))
+}

internal/app/migration.go

@@ -43,7 +43,7 @@ import (
 
 // nolint:gosec
 func migrateKeychainHelper(locations *locations.Locations) error {
-	logrus.Info("Migrating keychain helper")
+	logrus.Trace("Checking if keychain helper needs to be migrated")
 
 	settings, err := locations.ProvideSettingsPath()
 	if err != nil {
@@ -75,7 +75,11 @@ func migrateKeychainHelper(locations *locations.Locations) error {
 		return fmt.Errorf("failed to unmarshal old prefs file: %w", err)
 	}
 
-	return vault.SetHelper(settings, prefs.Helper)
+	err = vault.SetHelper(settings, prefs.Helper)
+	if err == nil {
+		logrus.Info("Keychain helper has been migrated")
+	}
+	return err
 }
 
 // nolint:gosec

internal/bridge/bridge.go

@@ -24,6 +24,10 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"os"
+	"regexp"
+	"runtime"
+	"strings"
 	"sync"
 	"time"
 
@@ -41,8 +45,11 @@ import (
 	"github.com/ProtonMail/proton-bridge/v3/internal/safe"
 	"github.com/ProtonMail/proton-bridge/v3/internal/sentry"
 	"github.com/ProtonMail/proton-bridge/v3/internal/services/imapsmtpserver"
+	"github.com/ProtonMail/proton-bridge/v3/internal/services/notifications"
+	"github.com/ProtonMail/proton-bridge/v3/internal/services/observability"
 	"github.com/ProtonMail/proton-bridge/v3/internal/services/syncservice"
 	"github.com/ProtonMail/proton-bridge/v3/internal/telemetry"
+	"github.com/ProtonMail/proton-bridge/v3/internal/unleash"
 	"github.com/ProtonMail/proton-bridge/v3/internal/user"
 	"github.com/ProtonMail/proton-bridge/v3/internal/vault"
 	"github.com/ProtonMail/proton-bridge/v3/pkg/keychain"
@@ -51,6 +58,8 @@ import (
 	"github.com/sirupsen/logrus"
 )
 
+var usernameChangeRegex = regexp.MustCompile(`^/Users/([^/]+)/`)
+
 type Bridge struct {
 	// vault holds bridge-specific data, such as preferences and known users (authorized or not).
 	vault *vault.Vault
@@ -130,6 +139,15 @@ type Bridge struct {
 
 	serverManager *imapsmtpserver.Service
 	syncService   *syncservice.Service
+
+	// unleashService is responsible for polling the feature flags and caching
+	unleashService *unleash.Service
+
+	// observabilityService is responsible for handling calls to the observability system
+	observabilityService *observability.Service
+
+	// notificationStore is used for notification deduplication
+	notificationStore *notifications.Store
 }
 
 var logPkg = logrus.WithField("pkg", "bridge") //nolint:gochecknoglobals
@@ -247,6 +265,8 @@ func newBridge(
 		return nil, fmt.Errorf("failed to create focus service: %w", err)
 	}
 
+	unleashService := unleash.NewBridgeService(ctx, api, locator, panicHandler)
+
 	bridge := &Bridge{
 		vault: vault,
 
@@ -287,6 +307,12 @@ func newBridge(
 
 		tasks:       tasks,
 		syncService: syncservice.NewService(reporter, panicHandler),
+
+		unleashService: unleashService,
+
+		observabilityService: observability.NewService(ctx, panicHandler),
+
+		notificationStore: notifications.NewStore(locator.ProvideNotificationsCachePath),
 	}
 
 	bridge.serverManager = imapsmtpserver.NewService(context.Background(),
@@ -299,6 +325,9 @@ func newBridge(
 		&bridgeIMAPSMTPTelemetry{b: bridge},
 	)
 
+	// Check whether username has changed and correct (macOS only)
+	bridge.verifyUsernameChange()
+
 	if err := bridge.serverManager.Init(context.Background(), bridge.tasks, &bridgeEventSubscription{b: bridge}); err != nil {
 		return nil, err
 	}
@@ -311,6 +340,10 @@ func newBridge(
 
 	bridge.syncService.Run()
 
+	bridge.unleashService.Run()
+
+	bridge.observabilityService.Run()
+
 	return bridge, nil
 }
 
@@ -438,6 +471,9 @@ func (bridge *Bridge) GetErrors() []error {
 func (bridge *Bridge) Close(ctx context.Context) {
 	logPkg.Info("Closing bridge")
 
+	// Stop observability service
+	bridge.observabilityService.Stop()
+
 	// Stop heart beat before closing users.
 	bridge.heartbeat.stop()
 
@@ -461,6 +497,9 @@ func (bridge *Bridge) Close(ctx context.Context) {
 	// Close the focus service.
 	bridge.focusService.Close()
 
+	// Close the unleash service.
+	bridge.unleashService.Close()
+
 	// Close the watchers.
 	bridge.watchersLock.Lock()
 	defer bridge.watchersLock.Unlock()
@@ -539,6 +578,49 @@ func (bridge *Bridge) onStatusDown(ctx context.Context) {
 	}
 }
 
+func (bridge *Bridge) Repair() {
+	var wg sync.WaitGroup
+	userIDs := bridge.GetUserIDs()
+
+	for _, userID := range userIDs {
+		logPkg.Info("Initiating repair for userID:", userID)
+
+		userInfo, err := bridge.GetUserInfo(userID)
+		if err != nil {
+			logPkg.WithError(err).Error("Failed getting user info for repair; ID:", userID)
+			continue
+		}
+
+		if userInfo.State != Connected {
+			logPkg.Info("User is not connected. Repair will be executed on following successful log in.", userID)
+			if err := bridge.vault.GetUser(userID, func(user *vault.User) {
+				if err := user.SetShouldSync(true); err != nil {
+					logPkg.WithError(err).Error("Failed setting vault should sync for user:", userID)
+				}
+			}); err != nil {
+				logPkg.WithError(err).Error("Unable to get user vault when scheduling repair:", userID)
+			}
+			continue
+		}
+
+		bridgeUser, ok := bridge.users[userID]
+		if !ok {
+			logPkg.Info("UserID does not exist in bridge user map", userID)
+			continue
+		}
+
+		wg.Add(1)
+		go func(userID string) {
+			defer wg.Done()
+			if err = bridgeUser.TriggerRepair(); err != nil {
+				logPkg.WithError(err).Error("Failed re-syncing IMAP for userID", userID)
+			}
+		}(userID)
+	}
+
+	wg.Wait()
+}
+
 func loadTLSConfig(vault *vault.Vault) (*tls.Config, error) {
 	cert, err := tls.X509KeyPair(vault.GetBridgeTLSCert())
 	if err != nil {
@@ -558,3 +640,75 @@ func min(a, b time.Duration) time.Duration {
 
 	return b
 }
+
+func (bridge *Bridge) HasAPIConnection() bool {
+	return bridge.api.GetStatus() == proton.StatusUp
+}
+
+// verifyUsernameChange - works only on macOS
+// it attempts to check whether a username change has taken place by comparing the gluon DB path (which is static and provided by bridge)
+// to the gluon Cache path - which can be modified by the user and is stored in the vault;
+// if a username discrepancy is detected, and the cache folder does not exist with the "old" username
+// then we verify whether the gluon cache exists using the "new" username (provided by the DB path in this case)
+// if so we modify the cache directory in the user vault.
+func (bridge *Bridge) verifyUsernameChange() {
+	if runtime.GOOS != "darwin" {
+		return
+	}
+
+	gluonDBPath, err := bridge.GetGluonDataDir()
+	if err != nil {
+		logPkg.WithError(err).Error("Failed to get gluon db path")
+		return
+	}
+
+	gluonCachePath := bridge.GetGluonCacheDir()
+	// If the cache folder exists even on another user account or is in `/Users/Shared` we would still be able to access it
+	// though it depends on the permissions; this is an edge-case.
+	if _, err := os.Stat(gluonCachePath); err == nil {
+		return
+	}
+
+	newCacheDir := GetUpdatedCachePath(gluonDBPath, gluonCachePath)
+	if newCacheDir == "" {
+		return
+	}
+
+	if _, err := os.Stat(newCacheDir); err == nil {
+		logPkg.Info("Username change detected. Trying to restore gluon cache directory")
+		if err = bridge.vault.SetGluonDir(newCacheDir); err != nil {
+			logPkg.WithError(err).Error("Failed to restore gluon cache directory")
+			return
+		}
+		logPkg.Info("Successfully restored gluon cache directory")
+	}
+}
+
+func GetUpdatedCachePath(gluonDBPath, gluonCachePath string) string {
+	// If gluon cache is moved to an external drive; regex find will fail; as is expected
+	cachePathMatches := usernameChangeRegex.FindStringSubmatch(gluonCachePath)
+	if cachePathMatches == nil || len(cachePathMatches) < 2 {
+		return ""
+	}
+
+	cacheUsername := cachePathMatches[1]
+	dbPathMatches := usernameChangeRegex.FindStringSubmatch(gluonDBPath)
+	if dbPathMatches == nil || len(dbPathMatches) < 2 {
+		return ""
+	}
+
+	dbUsername := dbPathMatches[1]
+	if cacheUsername == dbUsername {
+		return ""
+	}
+
+	return strings.Replace(gluonCachePath, "/Users/"+cacheUsername+"/", "/Users/"+dbUsername+"/", 1)
+}
+
+func (bridge *Bridge) GetFeatureFlagValue(key string) bool {
+	return bridge.unleashService.GetFlagValue(key)
+}
+
+func (bridge *Bridge) PushObservabilityMetric(metric proton.ObservabilityMetric) {
+	bridge.observabilityService.AddMetric(metric)
+}

internal/bridge/bridge_test.go

@@ -76,7 +76,7 @@ func init() {
 
 func TestBridge_ConnStatus(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, vaultKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Get a stream of connection status events.
 			eventCh, done := bridge.GetEvents(events.ConnStatusUp{}, events.ConnStatusDown{})
 			defer done()
@@ -125,7 +125,7 @@ func TestBridge_TLSIssue(t *testing.T) {
 
 func TestBridge_Focus(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, vaultKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Get a stream of TLS issue events.
 			raiseCh, done := bridge.GetEvents(events.Raise{})
 			defer done()
@@ -156,7 +156,7 @@ func TestBridge_UserAgent(t *testing.T) {
 			calls = append(calls, call)
 		})
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Set the platform to something other than the default.
 			bridge.SetCurrentPlatform("platform")
 
@@ -183,21 +183,12 @@ func TestBridge_UserAgent_Persistence(t *testing.T) {
 		_, _, err := s.CreateUser(otherUser, otherPassword)
 		require.NoError(t, err)
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(b *bridge.Bridge, mocks *bridge.Mocks) {
-			imapWaiter := waitForIMAPServerReady(b)
-			defer imapWaiter.Done()
-
-			smtpWaiter := waitForSMTPServerReady(b)
-			defer smtpWaiter.Done()
-
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(b *bridge.Bridge, _ *bridge.Mocks) {
 			currentUserAgent := b.GetCurrentUserAgent()
 			require.Contains(t, currentUserAgent, useragent.DefaultUserAgent)
 
 			require.NoError(t, getErr(b.LoginFull(ctx, otherUser, otherPassword, nil, nil)))
 
-			imapWaiter.Wait()
-			smtpWaiter.Wait()
-
 			imapClient, err := eventuallyDial(fmt.Sprintf("%v:%v", constants.Host, b.GetIMAPPort()))
 			require.NoError(t, err)
 			defer func() { _ = imapClient.Logout() }()
@@ -220,7 +211,7 @@ func TestBridge_UserAgent_Persistence(t *testing.T) {
 			require.Contains(t, b.GetCurrentUserAgent(), "MyFancyClient/0.1.2")
 		})
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			currentUserAgent := bridge.GetCurrentUserAgent()
 			require.Contains(t, currentUserAgent, "MyFancyClient/0.1.2")
 		})
@@ -234,22 +225,13 @@ func TestBridge_UserAgentFromUnknownClient(t *testing.T) {
 		_, _, err := s.CreateUser(otherUser, otherPassword)
 		require.NoError(t, err)
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(b *bridge.Bridge, mocks *bridge.Mocks) {
-			imapWaiter := waitForIMAPServerReady(b)
-			defer imapWaiter.Done()
-
-			smtpWaiter := waitForSMTPServerReady(b)
-			defer smtpWaiter.Done()
-
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(b *bridge.Bridge, _ *bridge.Mocks) {
 			currentUserAgent := b.GetCurrentUserAgent()
 			require.Contains(t, currentUserAgent, useragent.DefaultUserAgent)
 
 			userID, err := b.LoginFull(context.Background(), username, password, nil, nil)
 			require.NoError(t, err)
 
-			imapWaiter.Wait()
-			smtpWaiter.Wait()
-
 			imapClient, err := eventuallyDial(fmt.Sprintf("%v:%v", constants.Host, b.GetIMAPPort()))
 			require.NoError(t, err)
 			defer func() { _ = imapClient.Logout() }()
@@ -273,22 +255,13 @@ func TestBridge_UserAgentFromSMTPClient(t *testing.T) {
 		_, _, err := s.CreateUser(otherUser, otherPassword)
 		require.NoError(t, err)
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(b *bridge.Bridge, mocks *bridge.Mocks) {
-			imapWaiter := waitForIMAPServerReady(b)
-			defer imapWaiter.Done()
-
-			smtpWaiter := waitForSMTPServerReady(b)
-			defer smtpWaiter.Done()
-
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(b *bridge.Bridge, _ *bridge.Mocks) {
 			currentUserAgent := b.GetCurrentUserAgent()
 			require.Contains(t, currentUserAgent, useragent.DefaultUserAgent)
 
 			userID, err := b.LoginFull(context.Background(), username, password, nil, nil)
 			require.NoError(t, err)
 
-			imapWaiter.Wait()
-			smtpWaiter.Wait()
-
 			client, err := smtp.Dial(net.JoinHostPort(constants.Host, fmt.Sprint(b.GetSMTPPort())))
 			require.NoError(t, err)
 			defer client.Close() //nolint:errcheck
@@ -332,18 +305,9 @@ func TestBridge_UserAgentFromIMAPID(t *testing.T) {
 		_, _, err := s.CreateUser(otherUser, otherPassword)
 		require.NoError(t, err)
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(b *bridge.Bridge, mocks *bridge.Mocks) {
-			imapWaiter := waitForIMAPServerReady(b)
-			defer imapWaiter.Done()
-
-			smtpWaiter := waitForSMTPServerReady(b)
-			defer smtpWaiter.Done()
-
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(b *bridge.Bridge, _ *bridge.Mocks) {
 			require.NoError(t, getErr(b.LoginFull(ctx, otherUser, otherPassword, nil, nil)))
 
-			imapWaiter.Wait()
-			smtpWaiter.Wait()
-
 			imapClient, err := eventuallyDial(fmt.Sprintf("%v:%v", constants.Host, b.GetIMAPPort()))
 			require.NoError(t, err)
 			defer func() { _ = imapClient.Logout() }()
@@ -401,13 +365,13 @@ func TestBridge_Cookies(t *testing.T) {
 		})
 
 		// Start bridge and add a user so that API assigns us a session ID via cookie.
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			_, err := bridge.LoginFull(context.Background(), username, password, nil, nil)
 			require.NoError(t, err)
 		})
 
 		// Start bridge again and check that it uses the same session ID.
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(_ *bridge.Bridge, _ *bridge.Mocks) {
 			// ...
 		})
 
@@ -520,7 +484,7 @@ func TestBridge_ManualUpdate(t *testing.T) {
 
 func TestBridge_ForceUpdate(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, vaultKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Get a stream of update events.
 			updateCh, done := bridge.GetEvents(events.UpdateForced{})
 			defer done()
@@ -543,7 +507,7 @@ func TestBridge_BadVaultKey(t *testing.T) {
 		var userID string
 
 		// Login a user.
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			newUserID, err := bridge.LoginFull(context.Background(), username, password, nil, nil)
 			require.NoError(t, err)
 
@@ -551,17 +515,17 @@ func TestBridge_BadVaultKey(t *testing.T) {
 		})
 
 		// Start bridge with the correct vault key -- it should load the users correctly.
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			require.ElementsMatch(t, []string{userID}, bridge.GetUserIDs())
 		})
 
 		// Start bridge with a bad vault key, the vault will be wiped and bridge will show no users.
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, []byte("bad"), func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, []byte("bad"), func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			require.Empty(t, bridge.GetUserIDs())
 		})
 
 		// Start bridge with a nil vault key, the vault will be wiped and bridge will show no users.
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, nil, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, nil, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			require.Empty(t, bridge.GetUserIDs())
 		})
 	})
@@ -571,7 +535,7 @@ func TestBridge_MissingGluonStore(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, vaultKey []byte) {
 		var gluonDir string
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			_, err := bridge.LoginFull(context.Background(), username, password, nil, nil)
 			require.NoError(t, err)
 
@@ -586,7 +550,7 @@ func TestBridge_MissingGluonStore(t *testing.T) {
 		require.NoError(t, os.RemoveAll(gluonDir))
 
 		// Bridge starts but can't find the gluon store dir; there should be no error.
-		withBridgeWaitForServers(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridgeWaitForServers(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(_ *bridge.Bridge, _ *bridge.Mocks) {
 			// ...
 		})
 	})
@@ -596,7 +560,7 @@ func TestBridge_MissingGluonDatabase(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, vaultKey []byte) {
 		var gluonDir string
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			_, err := bridge.LoginFull(context.Background(), username, password, nil, nil)
 			require.NoError(t, err)
 
@@ -609,7 +573,7 @@ func TestBridge_MissingGluonDatabase(t *testing.T) {
 		require.NoError(t, os.RemoveAll(gluonDir))
 
 		// Bridge starts but can't find the gluon database dir; there should be no error.
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(_ *bridge.Bridge, _ *bridge.Mocks) {
 			// ...
 		})
 	})
@@ -623,7 +587,7 @@ func TestBridge_AddressWithoutKeys(t *testing.T) {
 		)
 		defer m.Close()
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Watch for sync finished event.
 			syncCh, done := chToType[events.Event, events.SyncFinished](bridge.GetEvents(events.SyncFinished{}))
 			defer done()
@@ -699,7 +663,7 @@ func TestBridge_FactoryReset(t *testing.T) {
 
 func TestBridge_InitGluonDirectory(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, vaultKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(b *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(b *bridge.Bridge, _ *bridge.Mocks) {
 			configDir, err := b.GetGluonDataDir()
 			require.NoError(t, err)
 
@@ -714,22 +678,13 @@ func TestBridge_InitGluonDirectory(t *testing.T) {
 
 func TestBridge_LoginFailed(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, vaultKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
-			imapWaiter := waitForIMAPServerReady(bridge)
-			defer imapWaiter.Done()
-
-			smtpWaiter := waitForSMTPServerReady(bridge)
-			defer smtpWaiter.Done()
-
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			failCh, done := chToType[events.Event, events.IMAPLoginFailed](bridge.GetEvents(events.IMAPLoginFailed{}))
 			defer done()
 
 			_, err := bridge.LoginFull(ctx, username, password, nil, nil)
 			require.NoError(t, err)
 
-			imapWaiter.Wait()
-			smtpWaiter.Wait()
-
 			imapClient, err := eventuallyDial(net.JoinHostPort(constants.Host, fmt.Sprint(bridge.GetIMAPPort())))
 			require.NoError(t, err)
 
@@ -751,18 +706,12 @@ func TestBridge_ChangeCacheDirectory(t *testing.T) {
 			createNumMessages(ctx, t, c, addrID, labelID, 10)
 		})
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(b *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(b *bridge.Bridge, _ *bridge.Mocks) {
 			newCacheDir := t.TempDir()
 			currentCacheDir := b.GetGluonCacheDir()
 			configDir, err := b.GetGluonDataDir()
 			require.NoError(t, err)
 
-			imapWaiter := waitForIMAPServerReady(b)
-			defer imapWaiter.Done()
-
-			smtpWaiter := waitForSMTPServerReady(b)
-			defer smtpWaiter.Done()
-
 			// Login the user.
 			syncCh, done := chToType[events.Event, events.SyncFinished](b.GetEvents(events.SyncFinished{}))
 			defer done()
@@ -796,9 +745,6 @@ func TestBridge_ChangeCacheDirectory(t *testing.T) {
 			require.NoError(t, err)
 			require.True(t, info.State == bridge.Connected)
 
-			imapWaiter.Wait()
-			smtpWaiter.Wait()
-
 			client, err := eventuallyDial(fmt.Sprintf("%v:%v", constants.Host, b.GetIMAPPort()))
 			require.NoError(t, err)
 			require.NoError(t, client.Login(info.Addresses[0], string(info.BridgePass)))
@@ -826,7 +772,7 @@ func TestBridge_ChangeAddressOrder(t *testing.T) {
 			createNumMessages(ctx, t, c, addrID, proton.InboxLabel, 10)
 		})
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(b *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(b *bridge.Bridge, _ *bridge.Mocks) {
 			// Log the user in with its first address.
 			syncCh, done := chToType[events.Event, events.SyncFinished](b.GetEvents(events.SyncFinished{}))
 			defer done()
@@ -854,7 +800,7 @@ func TestBridge_ChangeAddressOrder(t *testing.T) {
 			require.NoError(t, c.OrderAddresses(ctx, proton.OrderAddressesReq{AddressIDs: []string{aliasID, addrID}}))
 		})
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(b *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(b *bridge.Bridge, _ *bridge.Mocks) {
 			// We should still see 10 messages in the inbox.
 			info, err := b.GetUserInfo(userID)
 			require.NoError(t, err)
@@ -1131,3 +1077,57 @@ func waitForIMAPServerStopped(b *bridge.Bridge) *eventWaiter {
 		cancel: cancel,
 	}
 }
+
+func TestBridge_GetUpdatedCachePath(t *testing.T) {
+	type TestData struct {
+		gluonDBPath    string
+		gluonCachePath string
+		shouldChange   bool
+	}
+
+	dataArr := []TestData{
+		{
+			gluonDBPath:    "/Users/test/",
+			gluonCachePath: "/Users/test/gluon",
+			shouldChange:   false,
+		}, {
+			gluonDBPath:    "/Users/test/",
+			gluonCachePath: "/Users/tester/gluon",
+			shouldChange:   true,
+		}, {
+			gluonDBPath:    "/Users/testing/",
+			gluonCachePath: "/Users/test/gluon",
+			shouldChange:   true,
+		},
+		{
+			gluonDBPath:    "/Users/testing/",
+			gluonCachePath: "/Users/test/gluon",
+			shouldChange:   true,
+		},
+		{
+			gluonDBPath:    "/Users/testing/",
+			gluonCachePath: "/Volumes/test/gluon",
+			shouldChange:   false,
+		},
+		{
+			gluonDBPath:    "/Volumes/test/",
+			gluonCachePath: "/Users/test/gluon",
+			shouldChange:   false,
+		},
+		{
+			gluonDBPath:    "/XXX/test/",
+			gluonCachePath: "/Users/test/gluon",
+			shouldChange:   false,
+		},
+		{
+			gluonDBPath:    "/XXX/test/",
+			gluonCachePath: "/YYY/test/gluon",
+			shouldChange:   false,
+		},
+	}
+
+	for _, el := range dataArr {
+		newCachePath := bridge.GetUpdatedCachePath(el.gluonDBPath, el.gluonCachePath)
+		require.Equal(t, el.shouldChange, newCachePath != "" && newCachePath != el.gluonCachePath)
+	}
+}

internal/bridge/draft_test.go

@@ -64,9 +64,6 @@ func TestBridge_HandleDraftsSendFromOtherClient(t *testing.T) {
 
 		// The initial user should be fully synced.
 		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(b *bridge.Bridge, _ *bridge.Mocks) {
-			waiter := waitForIMAPServerReady(b)
-			defer waiter.Done()
-
 			syncCh, done := chToType[events.Event, events.SyncFinished](b.GetEvents(events.SyncFinished{}))
 			defer done()
 
@@ -74,7 +71,6 @@ func TestBridge_HandleDraftsSendFromOtherClient(t *testing.T) {
 			require.NoError(t, err)
 
 			require.Equal(t, userID, (<-syncCh).UserID)
-			waiter.Wait()
 
 			info, err := b.GetUserInfo(userID)
 			require.NoError(t, err)

internal/bridge/observability_test.go

@@ -0,0 +1,97 @@
+// Copyright (c) 2024 Proton AG
+//
+// This file is part of Proton Mail Bridge.
+//
+// Proton Mail Bridge is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Proton Mail Bridge is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Proton Mail Bridge.  If not, see <https://www.gnu.org/licenses/>.
+
+package bridge_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/ProtonMail/go-proton-api"
+	"github.com/ProtonMail/go-proton-api/server"
+	"github.com/ProtonMail/proton-bridge/v3/internal/bridge"
+	"github.com/ProtonMail/proton-bridge/v3/internal/services/observability"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/net/context"
+)
+
+func TestBridge_Observability(t *testing.T) {
+	testMetric := proton.ObservabilityMetric{
+		Name:      "test1",
+		Version:   1,
+		Timestamp: time.Now().Unix(),
+		Data:      nil,
+	}
+
+	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, vaultKey []byte) {
+		throttlePeriod := time.Millisecond * 500
+		observability.ModifyThrottlePeriod(throttlePeriod)
+
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
+			require.NoError(t, getErr(bridge.LoginFull(ctx, username, password, nil, nil)))
+
+			bridge.PushObservabilityMetric(testMetric)
+			time.Sleep(time.Millisecond * 50) // Wait for the metric to be sent
+			require.Equal(t, 1, len(s.GetObservabilityStatistics().Metrics))
+
+			for i := 0; i < 10; i++ {
+				time.Sleep(time.Millisecond * 5) // Minor delay between each so our tests aren't flaky
+				bridge.PushObservabilityMetric(testMetric)
+			}
+			// We should still have only 1 metric sent as the throttleDuration has not passed
+			require.Equal(t, 1, len(s.GetObservabilityStatistics().Metrics))
+
+			// Wait for throttle duration to pass; we should have our remaining metrics posted
+			time.Sleep(throttlePeriod)
+			require.Equal(t, 11, len(s.GetObservabilityStatistics().Metrics))
+
+			// Wait for the throttle duration to reset; i.e. so we have enough time to send a request immediately
+			time.Sleep(throttlePeriod)
+			for i := 0; i < 10; i++ {
+				time.Sleep(time.Millisecond * 5)
+				bridge.PushObservabilityMetric(testMetric)
+			}
+			// We should only have one additional metric sent immediately
+			require.Equal(t, 12, len(s.GetObservabilityStatistics().Metrics))
+
+			// Wait for the others to be sent
+			time.Sleep(throttlePeriod)
+			require.Equal(t, 21, len(s.GetObservabilityStatistics().Metrics))
+
+			// Spam the endpoint a bit
+			for i := 0; i < 300; i++ {
+				if i < 200 {
+					time.Sleep(time.Millisecond * 10)
+				}
+				bridge.PushObservabilityMetric(testMetric)
+			}
+
+			// Ensure we've sent all metrics
+			time.Sleep(throttlePeriod)
+
+			observabilityStats := s.GetObservabilityStatistics()
+			require.Equal(t, 321, len(observabilityStats.Metrics))
+
+			// Verify that each request had a throttleDuration time difference between each request
+			for i := 0; i < len(observabilityStats.RequestTime)-1; i++ {
+				tOne := observabilityStats.RequestTime[i]
+				tTwo := observabilityStats.RequestTime[i+1]
+				require.True(t, tTwo.Sub(tOne).Abs() > throttlePeriod)
+			}
+		})
+	})
+}

internal/bridge/send_test.go

@@ -46,17 +46,12 @@ func TestBridge_Send(t *testing.T) {
 		require.NoError(t, err)
 
 		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
-			smtpWaiter := waitForSMTPServerReady(bridge)
-			defer smtpWaiter.Done()
-
 			senderUserID, err := bridge.LoginFull(ctx, username, password, nil, nil)
 			require.NoError(t, err)
 
 			recipientUserID, err := bridge.LoginFull(ctx, "recipient", password, nil, nil)
 			require.NoError(t, err)
 
-			smtpWaiter.Wait()
-
 			senderInfo, err := bridge.GetUserInfo(senderUserID)
 			require.NoError(t, err)
 
@@ -409,9 +404,6 @@ SGVsbG8gd29ybGQK
 		require.NoError(t, err)
 
 		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
-			smtpWaiter := waitForSMTPServerReady(bridge)
-			defer smtpWaiter.Done()
-
 			senderUserID, err := bridge.LoginFull(ctx, username, password, nil, nil)
 			require.NoError(t, err)
 
@@ -431,8 +423,6 @@ SGVsbG8gd29ybGQK
 				messageMultipartWithoutTextWithTextAttachment,
 			}
 
-			smtpWaiter.Wait()
-
 			for _, m := range messages {
 				// Dial the server.
 				client, err := smtp.Dial(net.JoinHostPort(constants.Host, fmt.Sprint(bridge.GetSMTPPort())))
@@ -617,9 +607,6 @@ Hello world
 		require.NoError(t, err)
 
 		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
-			smtpWaiter := waitForSMTPServerReady(bridge)
-			defer smtpWaiter.Done()
-
 			senderUserID, err := bridge.LoginFull(ctx, username, password, nil, nil)
 			require.NoError(t, err)
 
@@ -639,8 +626,6 @@ Hello world
 				messageInlineImageFollowedByText,
 			}
 
-			smtpWaiter.Wait()
-
 			for _, m := range messages {
 				// Dial the server.
 				client, err := smtp.Dial(net.JoinHostPort(constants.Host, fmt.Sprint(bridge.GetSMTPPort())))
@@ -714,17 +699,12 @@ func TestBridge_SendAddressDisabled(t *testing.T) {
 		require.NoError(t, s.ChangeAddressAllowSend(senderUserID, addrID, false))
 
 		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
-			smtpWaiter := waitForSMTPServerReady(bridge)
-			defer smtpWaiter.Done()
-
 			senderUserID, err := bridge.LoginFull(ctx, "sender", password, nil, nil)
 			require.NoError(t, err)
 
 			_, err = bridge.LoginFull(ctx, "recipient", password, nil, nil)
 			require.NoError(t, err)
 
-			smtpWaiter.Wait()
-
 			recipientInfo, err := bridge.GetUserInfo(recipientUserID)
 			require.NoError(t, err)
 
@@ -750,7 +730,7 @@ func TestBridge_SendAddressDisabled(t *testing.T) {
 				strings.NewReader("Subject: Test 1\r\n\r\nHello world!"),
 			)
 
-			smtpErr := smtpservice.NewErrCanNotSendOnAddress(senderInfo.Addresses[0])
+			smtpErr := smtpservice.NewErrCannotSendFromAddress(senderInfo.Addresses[0])
 			require.Equal(t, fmt.Sprintf("Error: %v", smtpErr.Error()), err.Error())
 		})
 	})

internal/bridge/sentry_test.go

@@ -36,9 +36,6 @@ import (
 func TestBridge_Report(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
 		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(b *bridge.Bridge, mocks *bridge.Mocks) {
-			imapWaiter := waitForIMAPServerReady(b)
-			defer imapWaiter.Done()
-
 			syncCh, done := chToType[events.Event, events.SyncFinished](b.GetEvents(events.SyncFinished{}))
 			defer done()
 
@@ -54,8 +51,6 @@ func TestBridge_Report(t *testing.T) {
 			require.NoError(t, err)
 			require.True(t, info.State == bridge.Connected)
 
-			imapWaiter.Wait()
-
 			// Dial the IMAP port.
 			conn, err := net.Dial("tcp", fmt.Sprintf("%v:%v", constants.Host, b.GetIMAPPort()))
 			require.NoError(t, err)

internal/bridge/server_manager_test.go

@@ -20,6 +20,7 @@ package bridge_test
 import (
 	"context"
 	"fmt"
+	"net"
 	"testing"
 
 	"github.com/ProtonMail/go-proton-api"
@@ -27,57 +28,39 @@ import (
 	"github.com/ProtonMail/proton-bridge/v3/internal/bridge"
 	"github.com/ProtonMail/proton-bridge/v3/internal/constants"
 	"github.com/ProtonMail/proton-bridge/v3/internal/events"
+	"github.com/emersion/go-smtp"
 	"github.com/stretchr/testify/require"
 )
 
-func TestServerManager_NoLoadedUsersNoServers(t *testing.T) {
+func TestServerManager_ServersStartWithBridge(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
-			_, err := eventuallyDial(fmt.Sprintf("%v:%v", constants.Host, bridge.GetIMAPPort()))
-			require.Error(t, err)
-		})
-	})
-}
-
-func TestServerManager_ServersStartAfterFirstConnectedUser(t *testing.T) {
-	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
-			imapWaiter := waitForIMAPServerReady(bridge)
-			defer imapWaiter.Done()
-
-			smtpWaiter := waitForSMTPServerReady(bridge)
-			defer smtpWaiter.Done()
-
-			_, err := bridge.LoginFull(ctx, username, password, nil, nil)
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
+			imapClient, err := eventuallyDial(fmt.Sprintf("%v:%v", constants.Host, bridge.GetIMAPPort()))
 			require.NoError(t, err)
+			require.NoError(t, imapClient.Logout())
 
-			imapWaiter.Wait()
-			smtpWaiter.Wait()
+			smtpClient, err := smtp.Dial(net.JoinHostPort(constants.Host, fmt.Sprint(bridge.GetSMTPPort())))
+			require.NoError(t, err)
+			smtpClient.Close() //nolint:errcheck
 		})
 	})
 }
 
-func TestServerManager_ServersStopsAfterUserLogsOut(t *testing.T) {
+func TestServerManager_ServersKeepsRunningfterUserLogsOut(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
-			imapWaiter := waitForIMAPServerReady(bridge)
-			defer imapWaiter.Done()
-
-			smtpWaiter := waitForSMTPServerReady(bridge)
-			defer smtpWaiter.Done()
-
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			userID, err := bridge.LoginFull(ctx, username, password, nil, nil)
 			require.NoError(t, err)
 
-			imapWaiter.Wait()
-			smtpWaiter.Wait()
-
-			imapWaiterStopped := waitForIMAPServerStopped(bridge)
-			defer imapWaiterStopped.Done()
-
 			require.NoError(t, bridge.LogoutUser(ctx, userID))
 
-			imapWaiterStopped.Wait()
+			imapClient, err := eventuallyDial(fmt.Sprintf("%v:%v", constants.Host, bridge.GetIMAPPort()))
+			require.NoError(t, err)
+			require.NoError(t, imapClient.Logout())
+
+			smtpClient, err := smtp.Dial(net.JoinHostPort(constants.Host, fmt.Sprint(bridge.GetSMTPPort())))
+			require.NoError(t, err)
+			smtpClient.Close() //nolint:errcheck
 		})
 	})
 }
@@ -89,22 +72,13 @@ func TestServerManager_ServersDoNotStopWhenThereIsStillOneActiveUser(t *testing.
 		_, _, err := s.CreateUser(otherUser, otherPassword)
 		require.NoError(t, err)
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
-			imapWaiter := waitForIMAPServerReady(bridge)
-			defer imapWaiter.Done()
-
-			smtpWaiter := waitForSMTPServerReady(bridge)
-			defer smtpWaiter.Done()
-
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			_, err := bridge.LoginFull(ctx, username, password, nil, nil)
 			require.NoError(t, err)
 
 			userIDOther, err := bridge.LoginFull(ctx, otherUser, otherPassword, nil, nil)
 			require.NoError(t, err)
 
-			imapWaiter.Wait()
-			smtpWaiter.Wait()
-
 			evtCh, cancel := bridge.GetEvents(events.UserDeauth{})
 			defer cancel()
 
@@ -115,38 +89,17 @@ func TestServerManager_ServersDoNotStopWhenThereIsStillOneActiveUser(t *testing.
 			imapClient, err := eventuallyDial(fmt.Sprintf("%v:%v", constants.Host, bridge.GetIMAPPort()))
 			require.NoError(t, err)
 			require.NoError(t, imapClient.Logout())
-		})
-	})
-}
 
-func TestServerManager_ServersStartIfAtLeastOneUserIsLoggedIn(t *testing.T) {
-	otherPassword := []byte("bar")
-	otherUser := "foo"
-	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
-		userIDOther, _, err := s.CreateUser(otherUser, otherPassword)
-		require.NoError(t, err)
-
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
-			_, err := bridge.LoginFull(ctx, username, password, nil, nil)
+			smtpClient, err := smtp.Dial(net.JoinHostPort(constants.Host, fmt.Sprint(bridge.GetSMTPPort())))
 			require.NoError(t, err)
-
-			_, err = bridge.LoginFull(ctx, otherUser, otherPassword, nil, nil)
-			require.NoError(t, err)
-		})
-
-		require.NoError(t, s.RevokeUser(userIDOther))
-
-		withBridgeWaitForServers(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
-			imapClient, err := eventuallyDial(fmt.Sprintf("%v:%v", constants.Host, bridge.GetIMAPPort()))
-			require.NoError(t, err)
-			require.NoError(t, imapClient.Logout())
+			smtpClient.Close() //nolint:errcheck
 		})
 	})
 }
 
 func TestServerManager_NetworkLossStopsServers(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			imapWaiter := waitForIMAPServerReady(bridge)
 			defer imapWaiter.Done()
 
@@ -162,8 +115,13 @@ func TestServerManager_NetworkLossStopsServers(t *testing.T) {
 			_, err := bridge.LoginFull(ctx, username, password, nil, nil)
 			require.NoError(t, err)
 
-			imapWaiter.Wait()
-			smtpWaiter.Wait()
+			imapClient, err := eventuallyDial(fmt.Sprintf("%v:%v", constants.Host, bridge.GetIMAPPort()))
+			require.NoError(t, err)
+			require.NoError(t, imapClient.Logout())
+
+			smtpClient, err := smtp.Dial(net.JoinHostPort(constants.Host, fmt.Sprint(bridge.GetSMTPPort())))
+			require.NoError(t, err)
+			smtpClient.Close() //nolint:errcheck
 
 			netCtl.Disable()
 

internal/bridge/settings_test.go

@@ -31,7 +31,7 @@ import (
 
 func TestBridge_Settings_GluonDir(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Create a user.
 			_, err := bridge.LoginFull(context.Background(), username, password, nil, nil)
 			require.NoError(t, err)
@@ -57,7 +57,7 @@ func TestBridge_Settings_GluonDirWithOnGoingEvents(t *testing.T) {
 		userID, addrID, err := s.CreateUser("imap", password)
 		require.NoError(t, err)
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			syncCh, done := chToType[events.Event, events.SyncFinished](bridge.GetEvents(events.SyncFinished{}))
 			defer done()
 
@@ -74,7 +74,7 @@ func TestBridge_Settings_GluonDirWithOnGoingEvents(t *testing.T) {
 			createNumMessages(ctx, t, c, addrID, labelID, 200)
 		})
 
-		withBridgeWaitForServers(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridgeWaitForServers(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Create a new location for the Gluon data.
 			newGluonDir := t.TempDir()
 
@@ -93,7 +93,7 @@ func TestBridge_Settings_GluonDirWithOnGoingEvents(t *testing.T) {
 
 func TestBridge_Settings_IMAPPort(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			curPort := bridge.GetIMAPPort()
 
 			// Set the port to 1144.
@@ -110,7 +110,7 @@ func TestBridge_Settings_IMAPPort(t *testing.T) {
 
 func TestBridge_Settings_IMAPSSL(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// By default, IMAP SSL is disabled.
 			require.False(t, bridge.GetIMAPSSL())
 
@@ -125,7 +125,7 @@ func TestBridge_Settings_IMAPSSL(t *testing.T) {
 
 func TestBridge_Settings_SMTPPort(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			curPort := bridge.GetSMTPPort()
 
 			// Set the port to 1024.
@@ -142,7 +142,7 @@ func TestBridge_Settings_SMTPPort(t *testing.T) {
 
 func TestBridge_Settings_SMTPSSL(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// By default, SMTP SSL is disabled.
 			require.False(t, bridge.GetSMTPSSL())
 
@@ -198,7 +198,7 @@ func TestBridge_Settings_Autostart(t *testing.T) {
 
 func TestBridge_Settings_FirstStart(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// By default, first start is true.
 			require.True(t, bridge.GetFirstStart())
 

internal/bridge/sync_test.go

@@ -232,7 +232,7 @@ func TestBridge_SyncWithOngoingEvents(t *testing.T) {
 		var total uint64
 
 		// The initial user should be fully synced.
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			syncCh, done := chToType[events.Event, events.SyncFinished](bridge.GetEvents(events.SyncFinished{}))
 			defer done()
 
@@ -246,7 +246,7 @@ func TestBridge_SyncWithOngoingEvents(t *testing.T) {
 		})
 
 		// Now let's remove the user and stop the network at 2/3 of the data.
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			require.NoError(t, bridge.DeleteUser(ctx, userID))
 		})
 
@@ -254,7 +254,7 @@ func TestBridge_SyncWithOngoingEvents(t *testing.T) {
 		netCtl.SetReadLimit(2 * total / 3)
 
 		// Login the user; its sync should fail.
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(b *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(b *bridge.Bridge, _ *bridge.Mocks) {
 			syncCh, done := chToType[events.Event, events.SyncFinished](b.GetEvents(events.SyncFinished{}))
 			defer done()
 
@@ -592,7 +592,7 @@ func TestBridge_CorruptedVaultClearsPreviousIMAPSyncState(t *testing.T) {
 			createNumMessages(ctx, t, c, addrID, labelID, 100)
 		})
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			syncCh, done := chToType[events.Event, events.SyncFinished](bridge.GetEvents(events.SyncFinished{}))
 			defer done()
 
@@ -625,7 +625,7 @@ func TestBridge_CorruptedVaultClearsPreviousIMAPSyncState(t *testing.T) {
 		require.NoError(t, os.WriteFile(filepath.Join(settingsPath, "vault.enc"), []byte("Trash!"), 0o600))
 
 		// Bridge starts but can't find the gluon database dir; there should be no error.
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			_, err := bridge.LoginFull(context.Background(), "imap", password, nil, nil)
 			require.NoError(t, err)
 		})

internal/bridge/types.go

@@ -33,6 +33,8 @@ type Locator interface {
 	GetDependencyLicensesLink() string
 	Clear(...string) error
 	ProvideIMAPSyncConfigPath() (string, error)
+	ProvideUnleashCachePath() (string, error)
+	ProvideNotificationsCachePath() (string, error)
 }
 
 type ProxyController interface {

internal/bridge/unleash_test.go

@@ -0,0 +1,90 @@
+// Copyright (c) 2024 Proton AG
+//
+// This file is part of Proton Mail Bridge.
+//
+// Proton Mail Bridge is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Proton Mail Bridge is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Proton Mail Bridge. If not, see <https://www.gnu.org/licenses/>.
+
+package bridge_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/ProtonMail/go-proton-api"
+	"github.com/ProtonMail/go-proton-api/server"
+	"github.com/ProtonMail/proton-bridge/v3/internal/bridge"
+	"github.com/ProtonMail/proton-bridge/v3/internal/unleash"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_UnleashService(t *testing.T) {
+	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
+		unleash.ModifyPollPeriodAndJitter(500*time.Millisecond, 0)
+
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(b *bridge.Bridge, _ *bridge.Mocks) {
+			// Initial startup assumes there is no cached feature flags.
+			require.Equal(t, b.GetFeatureFlagValue("test-1"), false)
+			require.Equal(t, b.GetFeatureFlagValue("test-2"), false)
+			require.Equal(t, b.GetFeatureFlagValue("test-3"), false)
+
+			s.PushFeatureFlag("test-1")
+			s.PushFeatureFlag("test-2")
+
+			// Wait for poll.
+			time.Sleep(time.Millisecond * 700)
+			require.Equal(t, b.GetFeatureFlagValue("test-1"), true)
+			require.Equal(t, b.GetFeatureFlagValue("test-2"), true)
+			require.Equal(t, b.GetFeatureFlagValue("test-3"), false)
+
+			s.PushFeatureFlag("test-3")
+			time.Sleep(time.Millisecond * 700) // Wait for poll again
+			require.Equal(t, b.GetFeatureFlagValue("test-1"), true)
+			require.Equal(t, b.GetFeatureFlagValue("test-2"), true)
+			require.Equal(t, b.GetFeatureFlagValue("test-3"), true)
+		})
+
+		// Wait for Bridge to close.
+		time.Sleep(time.Millisecond * 500)
+
+		// Second instance should have a feature flag cache file available. Therefore, all of the flags should evaluate to true on startup.
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(b *bridge.Bridge, _ *bridge.Mocks) {
+			require.Equal(t, b.GetFeatureFlagValue("test-1"), true)
+			require.Equal(t, b.GetFeatureFlagValue("test-2"), true)
+			require.Equal(t, b.GetFeatureFlagValue("test-3"), true)
+
+			s.DeleteFeatureFlags()
+
+			require.Equal(t, b.GetFeatureFlagValue("test-1"), true)
+			require.Equal(t, b.GetFeatureFlagValue("test-2"), true)
+			require.Equal(t, b.GetFeatureFlagValue("test-3"), true)
+
+			time.Sleep(time.Millisecond * 700)
+
+			require.Equal(t, b.GetFeatureFlagValue("test-1"), false)
+			require.Equal(t, b.GetFeatureFlagValue("test-2"), false)
+			require.Equal(t, b.GetFeatureFlagValue("test-3"), false)
+
+			s.PushFeatureFlag("test-3")
+			require.Equal(t, b.GetFeatureFlagValue("test-1"), false)
+			require.Equal(t, b.GetFeatureFlagValue("test-2"), false)
+			require.Equal(t, b.GetFeatureFlagValue("test-3"), false)
+
+			time.Sleep(time.Millisecond * 700)
+			require.Equal(t, b.GetFeatureFlagValue("test-1"), false)
+			require.Equal(t, b.GetFeatureFlagValue("test-2"), false)
+			require.Equal(t, b.GetFeatureFlagValue("test-3"), true)
+		})
+	})
+}

internal/bridge/user.go

@@ -28,6 +28,7 @@ import (
 	"github.com/ProtonMail/gluon/reporter"
 	"github.com/ProtonMail/go-proton-api"
 	"github.com/ProtonMail/proton-bridge/v3/internal/events"
+	"github.com/ProtonMail/proton-bridge/v3/internal/hv"
 	"github.com/ProtonMail/proton-bridge/v3/internal/logging"
 	"github.com/ProtonMail/proton-bridge/v3/internal/safe"
 	"github.com/ProtonMail/proton-bridge/v3/internal/services/imapservice"
@@ -123,15 +124,20 @@ func (bridge *Bridge) QueryUserInfo(query string) (UserInfo, error) {
 }
 
 // LoginAuth begins the login process. It returns an authorized client that might need 2FA.
-func (bridge *Bridge) LoginAuth(ctx context.Context, username string, password []byte) (*proton.Client, proton.Auth, error) {
+func (bridge *Bridge) LoginAuth(ctx context.Context, username string, password []byte, hvDetails *proton.APIHVDetails) (*proton.Client, proton.Auth, error) {
 	logUser.WithField("username", logging.Sensitive(username)).Info("Authorizing user for login")
 
 	if username == "crash@bandicoot" {
 		panic("Your wish is my command.. I crash!")
 	}
-
-	client, auth, err := bridge.api.NewClientWithLogin(ctx, username, password)
+	client, auth, err := bridge.api.NewClientWithLoginWithHVToken(ctx, username, password, hvDetails)
 	if err != nil {
+		if hv.IsHvRequest(err) {
+			logUser.WithFields(logrus.Fields{"username": logging.Sensitive(username),
+				"loginError": err.Error()}).Info("Human Verification requested for login")
+			return nil, proton.Auth{}, err
+		}
+
 		return nil, proton.Auth{}, fmt.Errorf("failed to create new API client: %w", err)
 	}
 
@@ -154,12 +160,13 @@ func (bridge *Bridge) LoginUser(
 	client *proton.Client,
 	auth proton.Auth,
 	keyPass []byte,
+	hvDetails *proton.APIHVDetails,
 ) (string, error) {
 	logUser.WithField("userID", auth.UserID).Info("Logging in authorized user")
 
 	userID, err := try.CatchVal(
 		func() (string, error) {
-			return bridge.loginUser(ctx, client, auth.UID, auth.RefreshToken, keyPass)
+			return bridge.loginUser(ctx, client, auth.UID, auth.RefreshToken, keyPass, hvDetails)
 		},
 	)
 
@@ -192,7 +199,8 @@ func (bridge *Bridge) LoginFull(
 ) (string, error) {
 	logUser.WithField("username", logging.Sensitive(username)).Info("Performing full user login")
 
-	client, auth, err := bridge.LoginAuth(ctx, username, password)
+	// (atanas) the following may need to be modified once HV is merged (its used only for testing; and depends on whether we will test HV related logic)
+	client, auth, err := bridge.LoginAuth(ctx, username, password, nil)
 	if err != nil {
 		return "", fmt.Errorf("failed to begin login process: %w", err)
 	}
@@ -225,7 +233,7 @@ func (bridge *Bridge) LoginFull(
 		keyPass = password
 	}
 
-	userID, err := bridge.LoginUser(ctx, client, auth, keyPass)
+	userID, err := bridge.LoginUser(ctx, client, auth, keyPass, nil)
 	if err != nil {
 		if deleteErr := client.AuthDelete(ctx); deleteErr != nil {
 			logUser.WithError(err).Error("Failed to delete auth")
@@ -374,8 +382,8 @@ func (bridge *Bridge) SendBadEventUserFeedback(_ context.Context, userID string,
 	}, bridge.usersLock)
 }
 
-func (bridge *Bridge) loginUser(ctx context.Context, client *proton.Client, authUID, authRef string, keyPass []byte) (string, error) {
-	apiUser, err := client.GetUser(ctx)
+func (bridge *Bridge) loginUser(ctx context.Context, client *proton.Client, authUID, authRef string, keyPass []byte, hvDetails *proton.APIHVDetails) (string, error) {
+	apiUser, err := client.GetUserWithHV(ctx, hvDetails)
 	if err != nil {
 		return "", fmt.Errorf("failed to get API user: %w", err)
 	}
@@ -558,8 +566,12 @@ func (bridge *Bridge) addUserWithVault(
 		bridge.serverManager,
 		&bridgeEventSubscription{b: bridge},
 		bridge.syncService,
+		bridge.observabilityService,
 		syncSettingsPath,
 		isNew,
+		bridge.notificationStore,
+		bridge.unleashService.GetFlagValue,
+		bridge.observabilityService.AddMetric,
 	)
 	if err != nil {
 		return fmt.Errorf("failed to create user: %w", err)
@@ -598,6 +610,8 @@ func (bridge *Bridge) addUserWithVault(
 	// As we need at least one user to send heartbeat, try to send it.
 	bridge.heartbeat.start()
 
+	user.PublishEvent(ctx, events.UserLoadedCheckResync{UserID: user.ID()})
+
 	return nil
 }
 

internal/bridge/user_event_test.go

@@ -62,7 +62,7 @@ func TestBridge_User_RefreshEvent(t *testing.T) {
 			messageIDs = createNumMessages(ctx, t, c, addrID, labelID, 10)
 		})
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			userLoginAndSync(ctx, t, bridge, "user", password)
 		})
 
@@ -73,7 +73,7 @@ func TestBridge_User_RefreshEvent(t *testing.T) {
 
 		require.NoError(t, s.RefreshUser(userID, proton.RefreshMail))
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			syncCh, closeCh := chToType[events.Event, events.SyncFinished](bridge.GetEvents(events.SyncFinished{}))
 
 			require.Equal(t, userID, (<-syncCh).UserID)
@@ -82,7 +82,7 @@ func TestBridge_User_RefreshEvent(t *testing.T) {
 			userContinueEventProcess(ctx, t, s, bridge)
 		})
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			withClient(ctx, t, s, "user", password, func(ctx context.Context, c *proton.Client) {
 				createNumMessages(ctx, t, c, addrID, labelID, 10)
 			})
@@ -139,9 +139,6 @@ func test_badMessage_badEvent(userFeedback func(t *testing.T, ctx context.Contex
 			})
 
 			withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
-				smtpWaiter := waitForSMTPServerReady(bridge)
-				defer smtpWaiter.Done()
-
 				userLoginAndSync(ctx, t, bridge, "user", password)
 
 				var messageIDs []string
@@ -177,8 +174,6 @@ func test_badMessage_badEvent(userFeedback func(t *testing.T, ctx context.Contex
 
 				userFeedback(t, ctx, bridge, badUserID)
 
-				smtpWaiter.Wait()
-
 				userContinueEventProcess(ctx, t, s, bridge)
 			})
 		})
@@ -196,10 +191,7 @@ func TestBridge_User_BadMessage_NoBadEvent(t *testing.T) {
 			createNumMessages(ctx, t, c, addrID, proton.InboxLabel, 10)
 		})
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
-			smtpWaiter := waitForSMTPServerReady(bridge)
-			defer smtpWaiter.Done()
-
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			userLoginAndSync(ctx, t, bridge, "user", password)
 
 			var messageIDs []string
@@ -223,7 +215,6 @@ func TestBridge_User_BadMessage_NoBadEvent(t *testing.T) {
 				require.NoError(t, c.DeleteMessage(ctx, messageIDs...))
 			})
 
-			smtpWaiter.Wait()
 			userContinueEventProcess(ctx, t, s, bridge)
 		})
 	})
@@ -377,7 +368,7 @@ func TestBridge_User_Network_NoBadEvents(t *testing.T) {
 		_, addrID, err := s.CreateUser("user", password)
 		require.NoError(t, err)
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			userLoginAndSync(ctx, t, bridge, "user", password)
 
 			// Create 10 more messages for the user, generating events.
@@ -463,7 +454,7 @@ func TestBridge_User_UpdateDraft(t *testing.T) {
 		require.NoError(t, err)
 
 		// Initially sync the user.
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			userLoginAndSync(ctx, t, bridge, "user", password)
 		})
 
@@ -496,7 +487,7 @@ func TestBridge_User_UpdateDraft(t *testing.T) {
 			require.Empty(t, draft.ReplyTos)
 
 			// Process those events
-			withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+			withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 				userContinueEventProcess(ctx, t, s, bridge)
 			})
 
@@ -522,7 +513,7 @@ func TestBridge_User_UpdateDraftAndCreateOtherMessage(t *testing.T) {
 		require.NoError(t, err)
 
 		// Initially sync the user.
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			userLoginAndSync(ctx, t, bridge, "user", password)
 		})
 
@@ -554,7 +545,7 @@ func TestBridge_User_UpdateDraftAndCreateOtherMessage(t *testing.T) {
 			require.NoError(t, err)
 
 			// Process those events
-			withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+			withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 				userContinueEventProcess(ctx, t, s, bridge)
 			})
 
@@ -582,7 +573,7 @@ func TestBridge_User_UpdateDraftAndCreateOtherMessage(t *testing.T) {
 			require.NoError(t, err)
 
 			// Process those events.
-			withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+			withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 				userContinueEventProcess(ctx, t, s, bridge)
 			})
 
@@ -590,7 +581,7 @@ func TestBridge_User_UpdateDraftAndCreateOtherMessage(t *testing.T) {
 			require.NoError(t, c.MarkMessagesUnread(ctx, res[0].MessageID))
 
 			// Process those events.
-			withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+			withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 				userContinueEventProcess(ctx, t, s, bridge)
 			})
 		})
@@ -604,7 +595,7 @@ func TestBridge_User_SendDraftRemoveDraftFlag(t *testing.T) {
 		require.NoError(t, err)
 
 		// Initially sync the user.
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			userLoginAndSync(ctx, t, bridge, "user", password)
 		})
 
@@ -637,7 +628,7 @@ func TestBridge_User_SendDraftRemoveDraftFlag(t *testing.T) {
 			require.NoError(t, err)
 
 			// Process those events
-			withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+			withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 				userContinueEventProcess(ctx, t, s, bridge)
 
 				info, err := bridge.QueryUserInfo("user")
@@ -676,7 +667,7 @@ func TestBridge_User_SendDraftRemoveDraftFlag(t *testing.T) {
 			}
 
 			// Process those events; the draft will move to the sent folder and lose the draft flag.
-			withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+			withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 				userContinueEventProcess(ctx, t, s, bridge)
 
 				info, err := bridge.QueryUserInfo("user")
@@ -706,7 +697,7 @@ func TestBridge_User_DisableEnableAddress(t *testing.T) {
 		aliasID, err := s.CreateAddress(userID, "alias@"+s.GetDomain(), password)
 		require.NoError(t, err)
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			require.NoError(t, getErr(bridge.LoginFull(ctx, "user", password, nil, nil)))
 
 			// Initially we should list the address.
@@ -720,7 +711,7 @@ func TestBridge_User_DisableEnableAddress(t *testing.T) {
 			require.NoError(t, c.DisableAddress(ctx, aliasID))
 		})
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Eventually we shouldn't list the address.
 			require.Eventually(t, func() bool {
 				info, err := bridge.QueryUserInfo("user")
@@ -735,7 +726,7 @@ func TestBridge_User_DisableEnableAddress(t *testing.T) {
 			require.NoError(t, c.EnableAddress(ctx, aliasID))
 		})
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Eventually we should list the address.
 			require.Eventually(t, func() bool {
 				info, err := bridge.QueryUserInfo("user")
@@ -762,7 +753,7 @@ func TestBridge_User_CreateDisabledAddress(t *testing.T) {
 			require.NoError(t, c.DisableAddress(ctx, aliasID))
 		})
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			require.NoError(t, getErr(bridge.LoginFull(ctx, "user", password, nil, nil)))
 
 			// Initially we shouldn't list the address.
@@ -775,21 +766,12 @@ func TestBridge_User_CreateDisabledAddress(t *testing.T) {
 
 func TestBridge_User_HandleParentLabelRename(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
-			imapWaiter := waitForIMAPServerReady(bridge)
-			defer imapWaiter.Done()
-
-			smtpWaiter := waitForSMTPServerReady(bridge)
-			defer smtpWaiter.Done()
-
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			require.NoError(t, getErr(bridge.LoginFull(ctx, username, password, nil, nil)))
 
 			info, err := bridge.QueryUserInfo(username)
 			require.NoError(t, err)
 
-			imapWaiter.Wait()
-			smtpWaiter.Wait()
-
 			cli, err := eventuallyDial(fmt.Sprintf("%v:%v", constants.Host, bridge.GetIMAPPort()))
 			require.NoError(t, err)
 			require.NoError(t, cli.Login(info.Addresses[0], string(info.BridgePass)))

internal/bridge/user_events.go

@@ -36,6 +36,9 @@ func (bridge *Bridge) handleUserEvent(ctx context.Context, user *user.User, even
 	case events.UserBadEvent:
 		bridge.handleUserBadEvent(ctx, user, event)
 
+	case events.UserLoadedCheckResync:
+		user.VerifyResyncAndExecute()
+
 	case events.UncategorizedEventError:
 		bridge.handleUncategorizedErrorEvent(event)
 	}

internal/bridge/user_test.go

@@ -35,12 +35,12 @@ import (
 
 func TestBridge_WithoutUsers(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			require.Empty(t, bridge.GetUserIDs())
 			require.Empty(t, getConnectedUserIDs(t, bridge))
 		})
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			require.Empty(t, bridge.GetUserIDs())
 			require.Empty(t, getConnectedUserIDs(t, bridge))
 		})
@@ -49,7 +49,7 @@ func TestBridge_WithoutUsers(t *testing.T) {
 
 func TestBridge_Login(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Login the user.
 			userID, err := bridge.LoginFull(ctx, username, password, nil, nil)
 			require.NoError(t, err)
@@ -69,7 +69,7 @@ func TestBridge_Login_DropConn(t *testing.T) {
 	defer func() { _ = dropListener.Close() }()
 
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Login the user.
 			userID, err := bridge.LoginFull(ctx, username, password, nil, nil)
 			require.NoError(t, err)
@@ -96,7 +96,7 @@ func TestBridge_Login_DropConn(t *testing.T) {
 			return 0, false
 		})
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// The user is eventually connected.
 			require.Eventually(t, func() bool {
 				return len(bridge.GetUserIDs()) == 1 && len(getConnectedUserIDs(t, bridge)) == 1
@@ -107,7 +107,7 @@ func TestBridge_Login_DropConn(t *testing.T) {
 
 func TestBridge_LoginTwice(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Login the user.
 			userID, err := bridge.LoginFull(ctx, username, password, nil, nil)
 			require.NoError(t, err)
@@ -125,7 +125,7 @@ func TestBridge_LoginTwice(t *testing.T) {
 
 func TestBridge_LoginLogoutLogin(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Login the user.
 			userID := must(bridge.LoginFull(ctx, username, password, nil, nil))
 
@@ -153,7 +153,7 @@ func TestBridge_LoginLogoutLogin(t *testing.T) {
 
 func TestBridge_LoginDeleteLogin(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Login the user.
 			userID := must(bridge.LoginFull(ctx, username, password, nil, nil))
 
@@ -181,7 +181,7 @@ func TestBridge_LoginDeleteLogin(t *testing.T) {
 
 func TestBridge_LoginDeauthLogin(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Login the user.
 			userID := must(bridge.LoginFull(ctx, username, password, nil, nil))
 
@@ -215,7 +215,7 @@ func TestBridge_LoginDeauthRestartLogin(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
 		var userID string
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Login the user.
 			userID = must(bridge.LoginFull(ctx, username, password, nil, nil))
 
@@ -235,7 +235,7 @@ func TestBridge_LoginDeauthRestartLogin(t *testing.T) {
 			require.IsType(t, events.UserDeauth{}, <-eventCh)
 		})
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// The user should be disconnected at startup.
 			require.Equal(t, []string{userID}, bridge.GetUserIDs())
 			require.Empty(t, getConnectedUserIDs(t, bridge))
@@ -257,7 +257,7 @@ func TestBridge_LoginExpireLogin(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
 		s.SetAuthLife(authLife)
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Login the user. Its auth will only be valid for a short time.
 			userID := must(bridge.LoginFull(ctx, username, password, nil, nil))
 
@@ -275,7 +275,7 @@ func TestBridge_FailToLoad(t *testing.T) {
 		var userID string
 
 		// Login the user.
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			userID = must(bridge.LoginFull(ctx, username, password, nil, nil))
 		})
 
@@ -283,7 +283,7 @@ func TestBridge_FailToLoad(t *testing.T) {
 		require.NoError(t, s.RevokeUser(userID))
 
 		// When bridge starts, the user will not be logged in.
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			require.Equal(t, []string{userID}, bridge.GetUserIDs())
 			require.Empty(t, getConnectedUserIDs(t, bridge))
 		})
@@ -295,7 +295,7 @@ func TestBridge_LoadWithoutInternet(t *testing.T) {
 		var userID string
 
 		// Login the user.
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			userID = must(bridge.LoginFull(ctx, username, password, nil, nil))
 		})
 
@@ -303,7 +303,7 @@ func TestBridge_LoadWithoutInternet(t *testing.T) {
 		netCtl.Disable()
 
 		// Start bridge without internet.
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Initially, users are not connected.
 			require.Equal(t, []string{userID}, bridge.GetUserIDs())
 			require.Empty(t, getConnectedUserIDs(t, bridge))
@@ -325,11 +325,11 @@ func TestBridge_LoginRestart(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
 		var userID string
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			userID = must(bridge.LoginFull(ctx, username, password, nil, nil))
 		})
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			require.Equal(t, []string{userID}, bridge.GetUserIDs())
 			require.Equal(t, []string{userID}, getConnectedUserIDs(t, bridge))
 		})
@@ -340,7 +340,7 @@ func TestBridge_LoginLogoutRestart(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
 		var userID string
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Login the user.
 			userID = must(bridge.LoginFull(ctx, username, password, nil, nil))
 
@@ -348,7 +348,7 @@ func TestBridge_LoginLogoutRestart(t *testing.T) {
 			require.NoError(t, bridge.LogoutUser(ctx, userID))
 		})
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// The user is still disconnected.
 			require.Equal(t, []string{userID}, bridge.GetUserIDs())
 			require.Empty(t, getConnectedUserIDs(t, bridge))
@@ -360,7 +360,7 @@ func TestBridge_LoginDeleteRestart(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
 		var userID string
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Login the user.
 			userID = must(bridge.LoginFull(ctx, username, password, nil, nil))
 
@@ -368,7 +368,7 @@ func TestBridge_LoginDeleteRestart(t *testing.T) {
 			require.NoError(t, bridge.DeleteUser(ctx, userID))
 		})
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// The user is still gone.
 			require.Empty(t, bridge.GetUserIDs())
 			require.Empty(t, getConnectedUserIDs(t, bridge))
@@ -384,7 +384,7 @@ func TestBridge_FailLoginRecover(t *testing.T) {
 
 				// Log the user in, wait for it to sync, then log it out.
 				// (We don't want to count message sync data in the test.)
-				withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+				withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 					syncCh, done := chToType[events.Event, events.SyncFinished](bridge.GetEvents(events.SyncFinished{}))
 					defer done()
 
@@ -396,7 +396,7 @@ func TestBridge_FailLoginRecover(t *testing.T) {
 				var total uint64
 
 				// Now that the user is synced, we can measure exactly how much data is needed during login.
-				withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+				withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 					total = countBytesRead(netCtl, func() {
 						must(bridge.LoginFull(ctx, username, password, nil, nil))
 					})
@@ -405,7 +405,7 @@ func TestBridge_FailLoginRecover(t *testing.T) {
 				})
 
 				// Now simulate failing to login.
-				withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+				withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 					// Simulate a partial read.
 					netCtl.SetReadLimit(i * total / 10)
 
@@ -421,7 +421,7 @@ func TestBridge_FailLoginRecover(t *testing.T) {
 				netCtl.SetReadLimit(0)
 
 				// We should now be able to log the user in.
-				withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+				withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 					require.NoError(t, getErr(bridge.LoginFull(ctx, username, password, nil, nil)))
 
 					// The user should be there, now connected.
@@ -441,7 +441,7 @@ func TestBridge_FailLoadRecover(t *testing.T) {
 
 				// Log the user in and wait for it to sync.
 				// (We don't want to count message sync data in the test.)
-				withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+				withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 					syncCh, done := chToType[events.Event, events.SyncFinished](bridge.GetEvents(events.SyncFinished{}))
 					defer done()
 
@@ -451,7 +451,7 @@ func TestBridge_FailLoadRecover(t *testing.T) {
 
 				// See how much data it takes to load the user at startup.
 				total := countBytesRead(netCtl, func() {
-					withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+					withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(_ *bridge.Bridge, _ *bridge.Mocks) {
 						// ...
 					})
 				})
@@ -460,7 +460,7 @@ func TestBridge_FailLoadRecover(t *testing.T) {
 				netCtl.SetReadLimit(i * total / 10)
 
 				// We should fail to load the user; it should be listed but disconnected.
-				withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+				withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 					require.Equal(t, []string{userID}, bridge.GetUserIDs())
 					require.Empty(t, getConnectedUserIDs(t, bridge))
 				})
@@ -469,7 +469,7 @@ func TestBridge_FailLoadRecover(t *testing.T) {
 				netCtl.SetReadLimit(0)
 
 				// We should now be able to load the user.
-				withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+				withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 					require.Equal(t, []string{userID}, bridge.GetUserIDs())
 					require.Equal(t, []string{userID}, getConnectedUserIDs(t, bridge))
 				})
@@ -484,7 +484,7 @@ func TestBridge_BridgePass(t *testing.T) {
 
 		var pass []byte
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Login the user.
 			userID = must(bridge.LoginFull(ctx, username, password, nil, nil))
 
@@ -501,7 +501,7 @@ func TestBridge_BridgePass(t *testing.T) {
 			require.Equal(t, pass, pass)
 		})
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// The bridge should load the user.
 			require.Equal(t, []string{userID}, bridge.GetUserIDs())
 			require.Equal(t, []string{userID}, getConnectedUserIDs(t, bridge))
@@ -514,7 +514,7 @@ func TestBridge_BridgePass(t *testing.T) {
 
 func TestBridge_AddressMode(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Login the user.
 			userID, err := bridge.LoginFull(ctx, username, password, nil, nil)
 			require.NoError(t, err)
@@ -552,7 +552,7 @@ func TestBridge_AddressMode(t *testing.T) {
 
 func TestBridge_LoginLogoutRepeated(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			for i := 0; i < 10; i++ {
 				// Log the user in.
 				userID := must(bridge.LoginFull(ctx, username, password, nil, nil))
@@ -568,7 +568,7 @@ func TestBridge_LogoutOffline(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
 		var userID string
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Login the user.
 			userID = must(bridge.LoginFull(ctx, username, password, nil, nil))
 
@@ -590,7 +590,7 @@ func TestBridge_LogoutOffline(t *testing.T) {
 		// Go back online.
 		netCtl.Enable()
 
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// The user is still disconnected.
 			require.Equal(t, []string{userID}, bridge.GetUserIDs())
 			require.Empty(t, getConnectedUserIDs(t, bridge))
@@ -600,7 +600,7 @@ func TestBridge_LogoutOffline(t *testing.T) {
 
 func TestBridge_DeleteDisconnected(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Login the user.
 			userID, err := bridge.LoginFull(ctx, username, password, nil, nil)
 			require.NoError(t, err)
@@ -628,7 +628,7 @@ func TestBridge_DeleteDisconnected(t *testing.T) {
 
 func TestBridge_DeleteOffline(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Login the user.
 			userID, err := bridge.LoginFull(ctx, username, password, nil, nil)
 			require.NoError(t, err)
@@ -652,7 +652,7 @@ func TestBridge_DeleteOffline(t *testing.T) {
 
 func TestBridge_UserInfo_Alias(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, vaultKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Create a new user.
 			userID, _, err := s.CreateUser("primary", []byte("password"))
 			require.NoError(t, err)
@@ -675,7 +675,7 @@ func TestBridge_UserInfo_Alias(t *testing.T) {
 
 func TestBridge_User_Refresh(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, vaultKey []byte) {
-		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
+		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, vaultKey, func(bridge *bridge.Bridge, _ *bridge.Mocks) {
 			// Get a channel of sync started events.
 			syncStartCh, done := chToType[events.Event, events.SyncStarted](bridge.GetEvents(events.SyncStarted{}))
 			defer done()

internal/cookies/jar_test.go

@@ -151,7 +151,7 @@ func getClientWithJar(t *testing.T, persister Persister) (*http.Client, *Jar) {
 func getTestServer(t *testing.T, wantCookies []testCookie) *httptest.Server {
 	mux := http.NewServeMux()
 
-	mux.HandleFunc("/set", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	mux.HandleFunc("/set", http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		for _, cookie := range wantCookies {
 			http.SetCookie(w, &http.Cookie{
 				Name:   cookie.name,

internal/crash/actions.go

@@ -26,7 +26,7 @@ import (
 // ShowErrorNotification shows a system notification that the app with the given appName has crashed.
 // NOTE: Icons shouldn't be hardcoded.
 func ShowErrorNotification(appName string) RecoveryAction {
-	return func(r interface{}) error {
+	return func(_ interface{}) error {
 		notify := notificator.New(notificator.Options{
 			DefaultIcon: "../frontend/ui/icon/icon.png",
 			AppName:     appName,

internal/dialer/dialer_pinning_reporter_test.go

@@ -31,7 +31,7 @@ import (
 func TestTLSReporter_DoubleReport(t *testing.T) {
 	reportCounter := 0
 
-	reportServer := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	reportServer := httptest.NewTLSServer(http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
 		reportCounter++
 	}))
 

internal/dialer/dialer_pinning_test.go

@@ -64,7 +64,8 @@ func TestTLSPinInvalid(t *testing.T) {
 	checkTLSIssueHandler(t, 1, called)
 }
 
-func TestTLSPinNoMatch(t *testing.T) {
+// Disabled for now we'll need to patch this up.
+func _TestTLSPinNoMatch(t *testing.T) { //nolint:unused
 	skipIfProxyIsSet(t)
 
 	called, _, reporter, checker, cm := createClientWithPinningDialer(getRootURL())

internal/dialer/dialer_proxy_provider_test.go

@@ -33,7 +33,7 @@ func TestProxyProvider_FindProxy(t *testing.T) {
 	defer closeServer(proxy)
 
 	p := newProxyProvider(NewBasicTLSDialer(""), "", []string{"not used"}, async.NoopPanicHandler{})
-	p.dohLookup = func(ctx context.Context, q, p string) ([]string, error) { return []string{proxy.URL}, nil }
+	p.dohLookup = func(_ context.Context, _, _ string) ([]string, error) { return []string{proxy.URL}, nil }
 
 	url, err := p.findReachableServer()
 	r.NoError(t, err)
@@ -49,7 +49,7 @@ func TestProxyProvider_FindProxy_ChooseReachableProxy(t *testing.T) {
 	closeServer(unreachableProxy)
 
 	p := newProxyProvider(NewBasicTLSDialer(""), "", []string{"not used"}, async.NoopPanicHandler{})
-	p.dohLookup = func(ctx context.Context, q, p string) ([]string, error) {
+	p.dohLookup = func(_ context.Context, _, _ string) ([]string, error) {
 		return []string{reachableProxy.URL, unreachableProxy.URL}, nil
 	}
 
@@ -70,7 +70,7 @@ func TestProxyProvider_FindProxy_ChooseTrustedProxy(t *testing.T) {
 	dialer := NewPinningTLSDialer(NewBasicTLSDialer(""), reporter, checker)
 
 	p := newProxyProvider(dialer, "", []string{"not used"}, async.NoopPanicHandler{})
-	p.dohLookup = func(ctx context.Context, q, p string) ([]string, error) {
+	p.dohLookup = func(_ context.Context, _, _ string) ([]string, error) {
 		return []string{untrustedProxy.URL, trustedProxy.URL}, nil
 	}
 
@@ -87,7 +87,7 @@ func TestProxyProvider_FindProxy_FailIfNoneReachable(t *testing.T) {
 	closeServer(unreachableProxy2)
 
 	p := newProxyProvider(NewBasicTLSDialer(""), "", []string{"not used"}, async.NoopPanicHandler{})
-	p.dohLookup = func(ctx context.Context, q, p string) ([]string, error) {
+	p.dohLookup = func(_ context.Context, _, _ string) ([]string, error) {
 		return []string{unreachableProxy1.URL, unreachableProxy2.URL}, nil
 	}
 
@@ -107,7 +107,7 @@ func TestProxyProvider_FindProxy_FailIfNoneTrusted(t *testing.T) {
 	dialer := NewPinningTLSDialer(NewBasicTLSDialer(""), reporter, checker)
 
 	p := newProxyProvider(dialer, "", []string{"not used"}, async.NoopPanicHandler{})
-	p.dohLookup = func(ctx context.Context, q, p string) ([]string, error) {
+	p.dohLookup = func(_ context.Context, _, _ string) ([]string, error) {
 		return []string{untrustedProxy1.URL, untrustedProxy2.URL}, nil
 	}
 
@@ -118,7 +118,7 @@ func TestProxyProvider_FindProxy_FailIfNoneTrusted(t *testing.T) {
 func TestProxyProvider_FindProxy_RefreshCacheTimeout(t *testing.T) {
 	p := newProxyProvider(NewBasicTLSDialer(""), "", []string{"not used"}, async.NoopPanicHandler{})
 	p.cacheRefreshTimeout = 1 * time.Second
-	p.dohLookup = func(ctx context.Context, q, p string) ([]string, error) { time.Sleep(2 * time.Second); return nil, nil }
+	p.dohLookup = func(_ context.Context, _, _ string) ([]string, error) { time.Sleep(2 * time.Second); return nil, nil }
 
 	// We should fail to refresh the proxy cache because the doh provider
 	// takes 2 seconds to respond but we timeout after just 1 second.
@@ -135,7 +135,7 @@ func TestProxyProvider_FindProxy_CanReachTimeout(t *testing.T) {
 
 	p := newProxyProvider(NewBasicTLSDialer(""), "", []string{"not used"}, async.NoopPanicHandler{})
 	p.canReachTimeout = 1 * time.Second
-	p.dohLookup = func(ctx context.Context, q, p string) ([]string, error) { return []string{slowProxy.URL}, nil }
+	p.dohLookup = func(_ context.Context, _, _ string) ([]string, error) { return []string{slowProxy.URL}, nil }
 
 	// We should fail to reach the returned proxy because it takes 2 seconds
 	// to reach it and we only allow 1.

internal/dialer/dialer_proxy_test.go

@@ -112,7 +112,7 @@ vwRMog6lPhlRhHh/FZ43Cg==
 
 // getUntrustedServer returns a server but it doesn't add its public key to the list of pinned ones.
 func getUntrustedServer() *httptest.Server {
-	server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
+	server := httptest.NewUnstartedServer(http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {}))
 
 	cert, err := tls.X509KeyPair([]byte(servercrt), []byte(serverkey))
 	if err != nil {
@@ -145,7 +145,7 @@ func TestProxyDialer_UseProxy(t *testing.T) {
 	provider := newProxyProvider(NewBasicTLSDialer(""), "", DoHProviders, async.NoopPanicHandler{})
 	d := NewProxyTLSDialer(NewBasicTLSDialer(""), "", async.NoopPanicHandler{})
 	d.proxyProvider = provider
-	provider.dohLookup = func(ctx context.Context, q, p string) ([]string, error) { return []string{trustedProxy.URL}, nil }
+	provider.dohLookup = func(_ context.Context, _, _ string) ([]string, error) { return []string{trustedProxy.URL}, nil }
 
 	err := d.switchToReachableServer()
 	require.NoError(t, err)
@@ -163,7 +163,7 @@ func TestProxyDialer_UseProxy_MultipleTimes(t *testing.T) {
 	provider := newProxyProvider(NewBasicTLSDialer(""), "", DoHProviders, async.NoopPanicHandler{})
 	d := NewProxyTLSDialer(NewBasicTLSDialer(""), "", async.NoopPanicHandler{})
 	d.proxyProvider = provider
-	provider.dohLookup = func(ctx context.Context, q, p string) ([]string, error) { return []string{proxy1.URL}, nil }
+	provider.dohLookup = func(_ context.Context, _, _ string) ([]string, error) { return []string{proxy1.URL}, nil }
 
 	err := d.switchToReachableServer()
 	require.NoError(t, err)
@@ -172,7 +172,7 @@ func TestProxyDialer_UseProxy_MultipleTimes(t *testing.T) {
 	// Have to wait so as to not get rejected.
 	time.Sleep(proxyLookupWait)
 
-	provider.dohLookup = func(ctx context.Context, q, p string) ([]string, error) { return []string{proxy2.URL}, nil }
+	provider.dohLookup = func(_ context.Context, _, _ string) ([]string, error) { return []string{proxy2.URL}, nil }
 	err = d.switchToReachableServer()
 	require.NoError(t, err)
 	require.Equal(t, formatAsAddress(proxy2.URL), d.proxyAddress)
@@ -180,7 +180,7 @@ func TestProxyDialer_UseProxy_MultipleTimes(t *testing.T) {
 	// Have to wait so as to not get rejected.
 	time.Sleep(proxyLookupWait)
 
-	provider.dohLookup = func(ctx context.Context, q, p string) ([]string, error) { return []string{proxy3.URL}, nil }
+	provider.dohLookup = func(_ context.Context, _, _ string) ([]string, error) { return []string{proxy3.URL}, nil }
 	err = d.switchToReachableServer()
 	require.NoError(t, err)
 	require.Equal(t, formatAsAddress(proxy3.URL), d.proxyAddress)
@@ -195,7 +195,7 @@ func TestProxyDialer_UseProxy_RevertAfterTime(t *testing.T) {
 	d.proxyProvider = provider
 	d.proxyUseDuration = time.Second
 
-	provider.dohLookup = func(ctx context.Context, q, p string) ([]string, error) { return []string{trustedProxy.URL}, nil }
+	provider.dohLookup = func(_ context.Context, _, _ string) ([]string, error) { return []string{trustedProxy.URL}, nil }
 	err := d.switchToReachableServer()
 	require.NoError(t, err)
 
@@ -216,7 +216,7 @@ func TestProxyDialer_UseProxy_RevertIfProxyStopsWorkingAndOriginalAPIIsReachable
 	provider := newProxyProvider(NewBasicTLSDialer(""), "", DoHProviders, async.NoopPanicHandler{})
 	d := NewProxyTLSDialer(NewBasicTLSDialer(""), "", async.NoopPanicHandler{})
 	d.proxyProvider = provider
-	provider.dohLookup = func(ctx context.Context, q, p string) ([]string, error) { return []string{trustedProxy.URL}, nil }
+	provider.dohLookup = func(_ context.Context, _, _ string) ([]string, error) { return []string{trustedProxy.URL}, nil }
 
 	err := d.switchToReachableServer()
 	require.NoError(t, err)
@@ -246,7 +246,7 @@ func TestProxyDialer_UseProxy_FindSecondAlternativeIfFirstFailsAndAPIIsStillBloc
 	provider := newProxyProvider(NewBasicTLSDialer(""), "", DoHProviders, async.NoopPanicHandler{})
 	d := NewProxyTLSDialer(NewBasicTLSDialer(""), "", async.NoopPanicHandler{})
 	d.proxyProvider = provider
-	provider.dohLookup = func(ctx context.Context, q, p string) ([]string, error) { return []string{proxy1.URL, proxy2.URL}, nil }
+	provider.dohLookup = func(_ context.Context, _, _ string) ([]string, error) { return []string{proxy1.URL, proxy2.URL}, nil }
 
 	err := d.switchToReachableServer()
 	require.NoError(t, err)

internal/events/user.go

@@ -202,3 +202,26 @@ type UncategorizedEventError struct {
 func (event UncategorizedEventError) String() string {
 	return fmt.Sprintf("UncategorizedEventError: UserID: %s, Source:%T, Error: %s", event.UserID, event.Error, event.Error)
 }
+
+type UserLoadedCheckResync struct {
+	eventBase
+
+	UserID string
+}
+
+func (event UserLoadedCheckResync) String() string {
+	return fmt.Sprintf("UserLoadedCheckResync: UserID: %s", event.UserID)
+}
+
+type UserNotification struct {
+	eventBase
+
+	UserID   string
+	Title    string
+	Subtitle string
+	Body     string
+}
+
+func (event UserNotification) String() string {
+	return fmt.Sprintf("UserNotification: UserID: %s, Title: %s, Subtitle: %s, Body: %s", event.UserID, event.Title, event.Subtitle, event.Body)
+}

internal/frontend/bridge-gui/bridge-gui-tester/GRPCService.cpp

@@ -29,13 +29,11 @@ using namespace bridgepp;
 
 namespace {
 
-
 QString const defaultKeychain = "defaultKeychain"; ///< The default keychain.
-
+QString const HV_ERROR_TEMPLATE = "failed to create new API client: 422 POST https://mail-api.proton.me/auth/v4: CAPTCHA validation failed (Code=12087, Status=422)";
 
 }
 
-
 //****************************************************************************************************************************************************
 //
 //****************************************************************************************************************************************************
@@ -349,6 +347,7 @@ Status GRPCService::ForceLauncher(ServerContext *, StringValue const *request, E
 /// \return The status for the call.
 //****************************************************************************************************************************************************
 Status GRPCService::SetMainExecutable(ServerContext *, StringValue const *request, Empty *) {
+    resetHv();
     app().log().debug(__FUNCTION__);
     app().log().info(QString("SetMainExecutable: %1").arg(QString::fromStdString(request->value())));
     return Status::OK;
@@ -418,7 +417,19 @@ Status GRPCService::Login(ServerContext *, LoginRequest const *request, Empty *)
         return Status::OK;
     }
 
-
+    if (usersTab.nextUserHvRequired() && !hvWasRequested_ && previousHvUsername_ != QString::fromStdString(request->username())) {
+        hvWasRequested_ = true;
+        previousHvUsername_ = QString::fromStdString(request->username());
+        qtProxy_.sendDelayedEvent(newLoginHvRequestedEvent());
+        return Status::OK;
+    } else {
+        hvWasRequested_ = false;
+        previousHvUsername_ = "";
+    }
+    if (usersTab.nextUserHvError()) {
+        qtProxy_.sendDelayedEvent(newLoginError(LoginErrorType::HV_ERROR, HV_ERROR_TEMPLATE));
+        return Status::OK;
+    }
     if (usersTab.nextUserUsernamePasswordError()) {
         qtProxy_.sendDelayedEvent(newLoginError(LoginErrorType::USERNAME_PASSWORD_ERROR, usersTab.usernamePasswordErrorMessage()));
         return Status::OK;
@@ -495,6 +506,7 @@ Status GRPCService::Login2Passwords(ServerContext *, LoginRequest const *request
 //****************************************************************************************************************************************************
 Status GRPCService::LoginAbort(ServerContext *, LoginAbortRequest const *request, Empty *) {
     app().log().debug(__FUNCTION__);
+    this->resetHv();
     loginUsername_ = QString();
     return Status::OK;
 }
@@ -953,3 +965,11 @@ void GRPCService::finishLogin() {
 
     qtProxy_.sendDelayedEvent(newLoginFinishedEvent(user->id(), alreadyExist));
 }
+
+//****************************************************************************************************************************************************
+//
+//****************************************************************************************************************************************************
+void GRPCService::resetHv() {
+    hvWasRequested_ = false;
+    previousHvUsername_ = "";
+}

internal/frontend/bridge-gui/bridge-gui-tester/GRPCService.h

@@ -106,6 +106,7 @@ public: // member functions.
 
 private: // member functions
     void finishLogin(); ///< finish the login procedure once the credentials have been validated.
+    void resetHv(); ///< Resets the human verification state.
 
 private: // data member
     mutable QMutex eventStreamMutex_; ///< Mutex used to access eventQueue_, isStreaming_ and shouldStopStreaming_;
@@ -113,6 +114,8 @@ private: // data member
     bool isStreaming_; ///< Is the gRPC stream running. Access protected by eventStreamMutex_;
     bool eventStreamShouldStop_; ///< Should the stream be stopped? Access protected by eventStreamMutex
     QString loginUsername_; ///< The username used for the current login procedure.
+    QString previousHvUsername_; ///< The previous username used for HV.
+    bool hvWasRequested_ {false}; ///< Was human verification requested.
     GRPCQtProxy qtProxy_; ///< Qt Proxy used to send signals, as this class is not a QObject.
 };
 

internal/frontend/bridge-gui/bridge-gui-tester/Tabs/UsersTab.cpp

@@ -57,6 +57,7 @@ UsersTab::UsersTab(QWidget *parent)
     connect(ui_.checkUsernamePasswordError, &QCheckBox::toggled, this, &UsersTab::updateGUIState);
     connect(ui_.checkSync, &QCheckBox::toggled, this, &UsersTab::onCheckSyncToggled);
     connect(ui_.sliderSync, &QSlider::valueChanged, this, &UsersTab::onSliderSyncValueChanged);
+    connect(ui_.sendNotificationButton, &QPushButton::clicked, this, &UsersTab::onSendUserNotification);
 
     users_.append(defaultUser());
 
@@ -216,6 +217,7 @@ void UsersTab::updateGUIState() {
     ui_.editUsernamePasswordError->setEnabled(ui_.checkUsernamePasswordError->isChecked());
     ui_.spinUsedBytes->setValue(user ? user->usedBytes() : 0.0);
     ui_.groupboxSync->setEnabled(user.get());
+    ui_.groupBoxNotification->setEnabled(hasSelectedUser && (UserState::Connected == state));
 
     if (user)
         ui_.editIMAPLoginFailedUsername->setText(user->primaryEmailOrUsername());
@@ -277,6 +279,22 @@ bridgepp::SPUser UsersTab::userWithUsernameOrEmail(QString const &username) {
 }
 
 
+//****************************************************************************************************************************************************
+/// \return true if the next login attempt should trigger a human verification request
+//****************************************************************************************************************************************************
+bool UsersTab::nextUserHvRequired() const {
+    return ui_.checkHV3Required->isChecked();
+}
+
+
+//****************************************************************************************************************************************************
+/// \return true if the next login attempt should trigger a human verification error
+//****************************************************************************************************************************************************
+bool UsersTab::nextUserHvError() const {
+    return ui_.checkHV3Error->isChecked();
+}
+
+
 //****************************************************************************************************************************************************
 /// \return true iff the next login attempt should trigger a username/password error.
 //****************************************************************************************************************************************************
@@ -473,3 +491,41 @@ void UsersTab::onSliderSyncValueChanged(int value) {
     app().grpc().sendEvent(newSyncProgressEvent(user->id(), progress, 1, 1));  // we do not simulate elapsed & remaining.
     this->updateGUIState();
 }
+
+//****************************************************************************************************************************************************
+/// \return the title for the notification.
+//****************************************************************************************************************************************************
+QString UsersTab::notificationTitle() const {
+    return ui_.notificationTitle->text();
+}
+
+//****************************************************************************************************************************************************
+/// \return the subtitle for the notification.
+//****************************************************************************************************************************************************
+QString UsersTab::notificationSubtitle() const {
+    return ui_.notificationSubtitleText->text();
+}
+
+//****************************************************************************************************************************************************
+/// \return the body for the notification.
+//****************************************************************************************************************************************************
+QString UsersTab::notificationBody() const {
+    return ui_.notticationBodyText->text();
+}
+
+
+void UsersTab::onSendUserNotification() {
+    SPUser const user = selectedUser();
+    if (!user) {
+        app().log().error(QString("%1 failed. Unkown user.").arg(__FUNCTION__));
+        return;
+    }
+
+    GRPCService &grpc = app().grpc();
+
+    if (grpc.isStreaming()) {
+        QString const userID = user->id();
+        grpc.sendEvent(newUserNotificationEvent(userID, notificationTitle(), notificationSubtitle(), notificationBody()));
+    }
+}
+

internal/frontend/bridge-gui/bridge-gui-tester/Tabs/UsersTab.h

@@ -23,7 +23,6 @@
 #include "Tabs/ui_UsersTab.h"
 #include "UserTable.h"
 
-
 //****************************************************************************************************************************************************
 /// \brief The 'Users' tab of the main window.
 //****************************************************************************************************************************************************
@@ -39,6 +38,8 @@ public: // member functions.
     UserTable &userTable(); ///< Returns a reference to the user table.
     bridgepp::SPUser userWithID(QString const &userID); ///< Get the user with the given ID.
     bridgepp::SPUser userWithUsernameOrEmail(QString const &username); ///< Get the user with the given username.
+    bool nextUserHvRequired() const; ///< Check if next user login should trigger HV
+    bool nextUserHvError() const; ///< Check if next user login should trigger HV error
     bool nextUserUsernamePasswordError() const; ///< Check if next user login should trigger a username/password error.
     bool nextUserFreeUserError() const; ///< Check if next user login should trigger a Free user error.
     bool nextUserTFARequired() const; ///< Check if next user login should requires 2FA.
@@ -48,12 +49,15 @@ public: // member functions.
     bool nextUserTwoPasswordsError() const; ///< Check if next user login should trigger 2nd password error.
     bool nextUserTwoPasswordsAbort() const; ///< Check if next user login should trigger 2nd password abort.
     QString usernamePasswordErrorMessage() const; ///< Return the username password error message.
+    QString notificationTitle() const; ///< Return the user notification title.
+    QString notificationSubtitle() const; ///< Return the user notification subtitle.
+    QString notificationBody() const; ///< Return the user notification body.
 
 public slots:
     void setUserSplitMode(QString const &userID, bool makeItActive); ///< Slot for the split mode.
     void logoutUser(QString const &userID); ///< slot for the logging out of a user.
     void removeUser(QString const &userID); ///< Slot for the removal of a user.
-static void configureUserAppleMail(QString const &userID, QString const &address); ///< Slot for the configuration of Apple mail.
+    static void configureUserAppleMail(QString const &userID, QString const &address); ///< Slot for the configuration of Apple mail.
     void processBadEventUserFeedback(QString const& userID, bool doResync); ///< Slot for the reception of a bad event user feedback.
 
 private slots:
@@ -67,6 +71,7 @@ private slots:
     void onCheckSyncToggled(bool checked); ///< Slot for the 'Synchronizing' check box.
     void onSliderSyncValueChanged(int value); ///< Slot for the sync 'Progress' slider.
     void updateGUIState(); ///< Update the GUI state.
+    void onSendUserNotification(); ///< Send a user notification event to the GUI.
 
 private: // member functions.
     qint32 selectedIndex() const; ///< Get the index of the selected row.

internal/frontend/bridge-gui/bridge-gui-tester/Tabs/UsersTab.ui

@@ -7,13 +7,19 @@
     <x>0</x>
     <y>0</y>
     <width>1221</width>
-    <height>894</height>
+    <height>408</height>
    </rect>
   </property>
+  <property name="sizePolicy">
+   <sizepolicy hsizetype="Minimum" vsizetype="Minimum">
+    <horstretch>0</horstretch>
+    <verstretch>0</verstretch>
+   </sizepolicy>
+  </property>
   <property name="windowTitle">
    <string>Form</string>
   </property>
-  <layout class="QHBoxLayout" name="horizontalLayout" stretch="1,0">
+  <layout class="QHBoxLayout" name="horizontalLayout" stretch="0,0">
    <item>
     <widget class="QTableView" name="tableUserList">
      <property name="selectionMode">
@@ -31,318 +37,419 @@
     </widget>
    </item>
    <item>
-    <layout class="QVBoxLayout" name="verticalLayout">
-     <item>
-      <widget class="QPushButton" name="buttonNewUser">
-       <property name="text">
-        <string>New User</string>
-       </property>
-      </widget>
-     </item>
-     <item>
-      <widget class="QPushButton" name="buttonEditUser">
-       <property name="text">
-        <string>Edit User</string>
-       </property>
-      </widget>
-     </item>
-     <item>
-      <widget class="QPushButton" name="buttonRemoveUser">
-       <property name="text">
-        <string>Remove User</string>
-       </property>
-      </widget>
-     </item>
-     <item>
-      <spacer name="verticalSpacer">
-       <property name="orientation">
-        <enum>Qt::Vertical</enum>
-       </property>
-       <property name="sizeHint" stdset="0">
-        <size>
-         <width>20</width>
-         <height>40</height>
-        </size>
-       </property>
-      </spacer>
-     </item>
-     <item>
-      <widget class="QGroupBox" name="groupboxSync">
-       <property name="minimumSize">
-        <size>
-         <width>0</width>
-         <height>0</height>
-        </size>
-       </property>
-       <property name="title">
-        <string>Sync</string>
-       </property>
-       <layout class="QVBoxLayout" name="verticalLayout_5">
-        <item>
-         <layout class="QHBoxLayout" name="horizontalLayout_4" stretch="1,0">
-          <item>
-           <widget class="QCheckBox" name="checkSync">
-            <property name="text">
-             <string>Synchronizing</string>
-            </property>
-           </widget>
-          </item>
-          <item>
-           <widget class="QLabel" name="labelSync">
-            <property name="text">
-             <string>0%</string>
-            </property>
-           </widget>
-          </item>
-         </layout>
-        </item>
-        <item>
-         <widget class="QSlider" name="sliderSync">
-          <property name="maximum">
-           <number>100</number>
-          </property>
-          <property name="orientation">
-           <enum>Qt::Horizontal</enum>
-          </property>
-          <property name="tickInterval">
-           <number>10</number>
-          </property>
-         </widget>
-        </item>
-       </layout>
-      </widget>
-     </item>
-     <item>
-      <widget class="QGroupBox" name="groupBoxBadEvent">
-       <property name="minimumSize">
-        <size>
-         <width>0</width>
-         <height>0</height>
-        </size>
-       </property>
-       <property name="title">
-        <string>Bad Event</string>
-       </property>
-       <layout class="QVBoxLayout" name="verticalLayout_3">
-        <item>
-         <layout class="QHBoxLayout" name="horizontalLayout_3">
-          <item>
-           <widget class="QLineEdit" name="editUserBadEvent">
-            <property name="minimumSize">
-             <size>
-              <width>200</width>
-              <height>0</height>
-             </size>
-            </property>
-            <property name="text">
-             <string/>
-            </property>
-            <property name="placeholderText">
-             <string>error message</string>
-            </property>
-           </widget>
-          </item>
-          <item>
-           <widget class="QPushButton" name="buttonUserBadEvent">
-            <property name="text">
-             <string>Send</string>
-            </property>
-           </widget>
-          </item>
-         </layout>
-        </item>
-       </layout>
-      </widget>
-     </item>
-     <item>
-      <widget class="QGroupBox" name="groupBoxUsedSpace">
-       <property name="minimumSize">
-        <size>
-         <width>0</width>
-         <height>0</height>
-        </size>
-       </property>
-       <property name="title">
-        <string>Used Bytes Changed</string>
-       </property>
-       <layout class="QVBoxLayout" name="verticalLayout_4">
-        <item>
-         <layout class="QHBoxLayout" name="hBoxUsedBytes" stretch="1,0">
-          <item>
-           <widget class="QDoubleSpinBox" name="spinUsedBytes">
-            <property name="buttonSymbols">
-             <enum>QAbstractSpinBox::NoButtons</enum>
-            </property>
-            <property name="decimals">
-             <number>0</number>
-            </property>
-            <property name="maximum">
-             <double>1000000000000000.000000000000000</double>
-            </property>
-           </widget>
-          </item>
-          <item>
-           <widget class="QPushButton" name="buttonUsedBytesChanged">
-            <property name="text">
-             <string>Send</string>
-            </property>
-           </widget>
-          </item>
-         </layout>
-        </item>
-       </layout>
-      </widget>
-     </item>
-     <item>
-      <widget class="QGroupBox" name="groupBoxIMAPLoginFailed">
-       <property name="minimumSize">
-        <size>
-         <width>0</width>
-         <height>0</height>
-        </size>
-       </property>
-       <property name="title">
-        <string>IMAP Login Failure</string>
-       </property>
-       <layout class="QVBoxLayout" name="verticalLayout_8">
-        <item>
-         <layout class="QHBoxLayout" name="horizontalLayout_7">
-          <item>
-           <widget class="QLineEdit" name="editIMAPLoginFailedUsername">
-            <property name="minimumSize">
-             <size>
-              <width>200</width>
-              <height>0</height>
-             </size>
-            </property>
-            <property name="text">
-             <string/>
-            </property>
-            <property name="placeholderText">
-             <string>username or primary email</string>
-            </property>
-           </widget>
-          </item>
-          <item>
-           <widget class="QPushButton" name="buttonImapLoginFailed">
-            <property name="text">
-             <string>Send</string>
-            </property>
-           </widget>
-          </item>
-         </layout>
-        </item>
-       </layout>
-      </widget>
-     </item>
-     <item>
-      <widget class="QGroupBox" name="groupBoxNextLogin">
-       <property name="minimumSize">
-        <size>
-         <width>0</width>
-         <height>100</height>
-        </size>
-       </property>
-       <property name="title">
-        <string>Next Login Attempt</string>
-       </property>
-       <layout class="QVBoxLayout" name="verticalLayout_2">
-        <item>
-         <widget class="QCheckBox" name="checkUsernamePasswordError">
-          <property name="text">
-           <string>Username/password error:</string>
-          </property>
-         </widget>
-        </item>
-        <item>
-         <layout class="QHBoxLayout" name="horizontalLayout_2">
-          <property name="spacing">
-           <number>0</number>
-          </property>
-          <item>
-           <spacer name="horizontalSpacer">
-            <property name="orientation">
-             <enum>Qt::Horizontal</enum>
-            </property>
-            <property name="sizeType">
-             <enum>QSizePolicy::Fixed</enum>
-            </property>
-            <property name="sizeHint" stdset="0">
-             <size>
-              <width>20</width>
-              <height>10</height>
-             </size>
-            </property>
-           </spacer>
-          </item>
-          <item>
-           <widget class="QLineEdit" name="editUsernamePasswordError">
-            <property name="minimumSize">
-             <size>
-              <width>200</width>
-              <height>0</height>
-             </size>
-            </property>
-            <property name="text">
-             <string>Username/password error.</string>
-            </property>
-           </widget>
-          </item>
-         </layout>
-        </item>
-        <item>
-         <widget class="QCheckBox" name="checkFreeUserError">
-          <property name="text">
-           <string>Free user error</string>
-          </property>
-         </widget>
-        </item>
-        <item>
-         <widget class="QCheckBox" name="checkTFARequired">
-          <property name="text">
-           <string>2FA required</string>
-          </property>
-         </widget>
-        </item>
-        <item>
-         <widget class="QCheckBox" name="checkTFAError">
-          <property name="text">
-           <string>2FA error</string>
-          </property>
-         </widget>
-        </item>
-        <item>
-         <widget class="QCheckBox" name="checkTFAAbort">
-          <property name="text">
-           <string>2FA abort</string>
-          </property>
-         </widget>
-        </item>
-        <item>
-         <widget class="QCheckBox" name="checkTwoPasswordsRequired">
-          <property name="text">
-           <string>2nd password required</string>
-          </property>
-         </widget>
-        </item>
-        <item>
-         <widget class="QCheckBox" name="checkTwoPasswordsError">
-          <property name="text">
-           <string>2nd password error</string>
-          </property>
-         </widget>
-        </item>
-        <item>
-         <widget class="QCheckBox" name="checkTwoPasswordsAbort">
-          <property name="text">
-           <string>2nd password abort</string>
-          </property>
-         </widget>
-        </item>
-       </layout>
-      </widget>
-     </item>
-    </layout>
+    <widget class="QScrollArea" name="scrollArea">
+     <property name="sizePolicy">
+      <sizepolicy hsizetype="Minimum" vsizetype="Minimum">
+       <horstretch>0</horstretch>
+       <verstretch>0</verstretch>
+      </sizepolicy>
+     </property>
+     <property name="widgetResizable">
+      <bool>true</bool>
+     </property>
+     <widget class="QWidget" name="scrollAreaWidgetContents">
+      <property name="geometry">
+       <rect>
+        <x>0</x>
+        <y>0</y>
+        <width>327</width>
+        <height>905</height>
+       </rect>
+      </property>
+      <layout class="QHBoxLayout" name="horizontalLayout_6">
+       <item>
+        <layout class="QVBoxLayout" name="verticalLayout">
+         <item>
+          <widget class="QPushButton" name="buttonNewUser">
+           <property name="text">
+            <string>New User</string>
+           </property>
+          </widget>
+         </item>
+         <item>
+          <widget class="QPushButton" name="buttonEditUser">
+           <property name="text">
+            <string>Edit User</string>
+           </property>
+          </widget>
+         </item>
+         <item>
+          <widget class="QPushButton" name="buttonRemoveUser">
+           <property name="text">
+            <string>Remove User</string>
+           </property>
+          </widget>
+         </item>
+         <item>
+          <spacer name="verticalSpacer">
+           <property name="orientation">
+            <enum>Qt::Vertical</enum>
+           </property>
+           <property name="sizeHint" stdset="0">
+            <size>
+             <width>20</width>
+             <height>40</height>
+            </size>
+           </property>
+          </spacer>
+         </item>
+         <item>
+          <widget class="QGroupBox" name="groupBoxNotification">
+           <property name="enabled">
+            <bool>true</bool>
+           </property>
+           <property name="minimumSize">
+            <size>
+             <width>300</width>
+             <height>0</height>
+            </size>
+           </property>
+           <property name="maximumSize">
+            <size>
+             <width>300</width>
+             <height>400</height>
+            </size>
+           </property>
+           <property name="title">
+            <string>Notification</string>
+           </property>
+           <layout class="QVBoxLayout" name="verticalLayout_9">
+            <item>
+             <layout class="QVBoxLayout" name="verticalLayout_6" stretch="0,0,0,0">
+              <item>
+               <widget class="QLineEdit" name="notificationTitle">
+                <property name="placeholderText">
+                 <string>Title</string>
+                </property>
+               </widget>
+              </item>
+              <item>
+               <widget class="QLineEdit" name="notificationSubtitleText">
+                <property name="minimumSize">
+                 <size>
+                  <width>0</width>
+                  <height>0</height>
+                 </size>
+                </property>
+                <property name="placeholderText">
+                 <string>Subtitle</string>
+                </property>
+               </widget>
+              </item>
+              <item>
+               <widget class="QLineEdit" name="notticationBodyText">
+                <property name="placeholderText">
+                 <string>Body</string>
+                </property>
+               </widget>
+              </item>
+              <item>
+               <widget class="QPushButton" name="sendNotificationButton">
+                <property name="text">
+                 <string>Send</string>
+                </property>
+               </widget>
+              </item>
+             </layout>
+            </item>
+           </layout>
+          </widget>
+         </item>
+         <item>
+          <widget class="QGroupBox" name="groupboxSync">
+           <property name="minimumSize">
+            <size>
+             <width>0</width>
+             <height>0</height>
+            </size>
+           </property>
+           <property name="title">
+            <string>Sync</string>
+           </property>
+           <layout class="QVBoxLayout" name="verticalLayout_5">
+            <item>
+             <layout class="QHBoxLayout" name="horizontalLayout_4" stretch="1,0">
+              <item>
+               <widget class="QCheckBox" name="checkSync">
+                <property name="text">
+                 <string>Synchronizing</string>
+                </property>
+               </widget>
+              </item>
+              <item>
+               <widget class="QLabel" name="labelSync">
+                <property name="text">
+                 <string>0%</string>
+                </property>
+               </widget>
+              </item>
+             </layout>
+            </item>
+            <item>
+             <widget class="QSlider" name="sliderSync">
+              <property name="maximum">
+               <number>100</number>
+              </property>
+              <property name="orientation">
+               <enum>Qt::Horizontal</enum>
+              </property>
+              <property name="tickInterval">
+               <number>10</number>
+              </property>
+             </widget>
+            </item>
+           </layout>
+          </widget>
+         </item>
+         <item>
+          <widget class="QGroupBox" name="groupBoxBadEvent">
+           <property name="minimumSize">
+            <size>
+             <width>0</width>
+             <height>0</height>
+            </size>
+           </property>
+           <property name="title">
+            <string>Bad Event</string>
+           </property>
+           <layout class="QVBoxLayout" name="verticalLayout_3">
+            <item>
+             <layout class="QHBoxLayout" name="horizontalLayout_3">
+              <item>
+               <widget class="QLineEdit" name="editUserBadEvent">
+                <property name="minimumSize">
+                 <size>
+                  <width>200</width>
+                  <height>0</height>
+                 </size>
+                </property>
+                <property name="text">
+                 <string/>
+                </property>
+                <property name="placeholderText">
+                 <string>error message</string>
+                </property>
+               </widget>
+              </item>
+              <item>
+               <widget class="QPushButton" name="buttonUserBadEvent">
+                <property name="text">
+                 <string>Send</string>
+                </property>
+               </widget>
+              </item>
+             </layout>
+            </item>
+           </layout>
+          </widget>
+         </item>
+         <item>
+          <widget class="QGroupBox" name="groupBoxUsedSpace">
+           <property name="minimumSize">
+            <size>
+             <width>0</width>
+             <height>0</height>
+            </size>
+           </property>
+           <property name="title">
+            <string>Used Bytes Changed</string>
+           </property>
+           <layout class="QVBoxLayout" name="verticalLayout_4">
+            <item>
+             <layout class="QHBoxLayout" name="hBoxUsedBytes" stretch="1,0">
+              <item>
+               <widget class="QDoubleSpinBox" name="spinUsedBytes">
+                <property name="buttonSymbols">
+                 <enum>QAbstractSpinBox::NoButtons</enum>
+                </property>
+                <property name="decimals">
+                 <number>0</number>
+                </property>
+                <property name="maximum">
+                 <double>1000000000000000.000000000000000</double>
+                </property>
+               </widget>
+              </item>
+              <item>
+               <widget class="QPushButton" name="buttonUsedBytesChanged">
+                <property name="text">
+                 <string>Send</string>
+                </property>
+               </widget>
+              </item>
+             </layout>
+            </item>
+           </layout>
+          </widget>
+         </item>
+         <item>
+          <widget class="QGroupBox" name="groupBoxIMAPLoginFailed">
+           <property name="minimumSize">
+            <size>
+             <width>0</width>
+             <height>0</height>
+            </size>
+           </property>
+           <property name="title">
+            <string>IMAP Login Failure</string>
+           </property>
+           <layout class="QVBoxLayout" name="verticalLayout_8">
+            <item>
+             <layout class="QHBoxLayout" name="horizontalLayout_7">
+              <item>
+               <widget class="QLineEdit" name="editIMAPLoginFailedUsername">
+                <property name="minimumSize">
+                 <size>
+                  <width>200</width>
+                  <height>0</height>
+                 </size>
+                </property>
+                <property name="text">
+                 <string/>
+                </property>
+                <property name="placeholderText">
+                 <string>username or primary email</string>
+                </property>
+               </widget>
+              </item>
+              <item>
+               <widget class="QPushButton" name="buttonImapLoginFailed">
+                <property name="text">
+                 <string>Send</string>
+                </property>
+               </widget>
+              </item>
+             </layout>
+            </item>
+           </layout>
+          </widget>
+         </item>
+         <item>
+          <widget class="QGroupBox" name="groupBoxNextLogin">
+           <property name="minimumSize">
+            <size>
+             <width>0</width>
+             <height>250</height>
+            </size>
+           </property>
+           <property name="title">
+            <string>Next Login Attempt</string>
+           </property>
+           <layout class="QVBoxLayout" name="verticalLayout_2">
+            <item>
+             <widget class="QCheckBox" name="checkUsernamePasswordError">
+              <property name="text">
+               <string>Username/password error:</string>
+              </property>
+             </widget>
+            </item>
+            <item>
+             <layout class="QHBoxLayout" name="horizontalLayout_2">
+              <property name="spacing">
+               <number>0</number>
+              </property>
+              <item>
+               <spacer name="horizontalSpacer">
+                <property name="orientation">
+                 <enum>Qt::Horizontal</enum>
+                </property>
+                <property name="sizeType">
+                 <enum>QSizePolicy::Fixed</enum>
+                </property>
+                <property name="sizeHint" stdset="0">
+                 <size>
+                  <width>20</width>
+                  <height>10</height>
+                 </size>
+                </property>
+               </spacer>
+              </item>
+              <item>
+               <widget class="QLineEdit" name="editUsernamePasswordError">
+                <property name="minimumSize">
+                 <size>
+                  <width>200</width>
+                  <height>0</height>
+                 </size>
+                </property>
+                <property name="text">
+                 <string>Username/password error.</string>
+                </property>
+               </widget>
+              </item>
+             </layout>
+            </item>
+            <item>
+             <widget class="QCheckBox" name="checkHV3Required">
+              <property name="text">
+               <string>HV3 required</string>
+              </property>
+             </widget>
+            </item>
+            <item>
+             <widget class="QCheckBox" name="checkHV3Error">
+              <property name="text">
+               <string>HV3 error</string>
+              </property>
+             </widget>
+            </item>
+            <item>
+             <widget class="QCheckBox" name="checkFreeUserError">
+              <property name="text">
+               <string>Free user error</string>
+              </property>
+             </widget>
+            </item>
+            <item>
+             <widget class="QCheckBox" name="checkTFARequired">
+              <property name="text">
+               <string>2FA required</string>
+              </property>
+             </widget>
+            </item>
+            <item>
+             <widget class="QCheckBox" name="checkTFAError">
+              <property name="text">
+               <string>2FA error</string>
+              </property>
+             </widget>
+            </item>
+            <item>
+             <widget class="QCheckBox" name="checkTFAAbort">
+              <property name="text">
+               <string>2FA abort</string>
+              </property>
+             </widget>
+            </item>
+            <item>
+             <widget class="QCheckBox" name="checkTwoPasswordsRequired">
+              <property name="text">
+               <string>2nd password required</string>
+              </property>
+             </widget>
+            </item>
+            <item>
+             <widget class="QCheckBox" name="checkTwoPasswordsError">
+              <property name="text">
+               <string>2nd password error</string>
+              </property>
+             </widget>
+            </item>
+            <item>
+             <widget class="QCheckBox" name="checkTwoPasswordsAbort">
+              <property name="text">
+               <string>2nd password abort</string>
+              </property>
+             </widget>
+            </item>
+           </layout>
+          </widget>
+         </item>
+        </layout>
+       </item>
+      </layout>
+     </widget>
+    </widget>
    </item>
   </layout>
  </widget>

internal/frontend/bridge-gui/bridge-gui/CMakeLists.txt

@@ -75,7 +75,7 @@ if(NOT UNIX)
     set(CMAKE_INSTALL_BINDIR ".")
 endif(NOT UNIX)
 
-find_package(Qt6 COMPONENTS Core Quick Qml QuickControls2 Widgets Svg REQUIRED)
+find_package(Qt6 COMPONENTS Core Quick Qml QuickControls2 Widgets Svg Gui REQUIRED)
 qt_standard_project_setup()
 set(CMAKE_AUTORCC ON)
 message(STATUS "Using Qt ${Qt6_VERSION}")
@@ -120,6 +120,7 @@ add_executable(bridge-gui
     UserList.cpp UserList.h
     SentryUtils.cpp SentryUtils.h
     Settings.cpp Settings.h
+    ClipboardProxy.cpp ClipboardProxy.h
     ${DOCK_ICON_SRC_FILE} MacOS/DockIcon.h
     )
 
@@ -140,7 +141,7 @@ if (WIN32) # on Windows, we add a (non-Qt) resource file that contains the appli
 endif()
 
 target_precompile_headers(bridge-gui PRIVATE Pch.h)
-target_include_directories(bridge-gui PRIVATE ${CMAKE_CURRENT_SOURCE_DIR} ${SENTRY_CONFIG_GENERATED_FILE_DIR})
+target_include_directories(bridge-gui PRIVATE "${CMAKE_CURRENT_SOURCE_DIR}" ${SENTRY_CONFIG_GENERATED_FILE_DIR})
 target_link_libraries(bridge-gui
     Qt6::Widgets
     Qt6::Core
@@ -148,6 +149,7 @@ target_link_libraries(bridge-gui
     Qt6::Qml
     Qt6::QuickControls2
     Qt6::Svg
+    Qt6::Gui
     sentry::sentry
     bridgepp
     )

internal/frontend/bridge-gui/bridge-gui/ClipboardProxy.cpp

@@ -0,0 +1,25 @@
+// Copyright (c) 2024 Proton AG
+// This file is part of Proton Mail Bridge.
+// Proton Mail Bridge is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+// Proton Mail Bridge is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+// You should have received a copy of the GNU General Public License
+// along with Proton Mail Bridge. If not, see <https://www.gnu.org/licenses/>.
+#include "ClipboardProxy.h"
+
+// The following definitions were taken and adapted from:
+// https://stackoverflow.com/questions/40092352/passing-qclipboard-to-qml
+// Author: krzaq
+
+ClipboardProxy::ClipboardProxy(QClipboard* c) : clipboard(c) {
+    connect(clipboard, &QClipboard::dataChanged, this, &ClipboardProxy::textChanged);
+}
+
+QString ClipboardProxy::text() const {
+    return clipboard->text();
+}

internal/frontend/bridge-gui/bridge-gui/ClipboardProxy.h

@@ -0,0 +1,38 @@
+// Copyright (c) 2024 Proton AG
+// This file is part of Proton Mail Bridge.
+// Proton Mail Bridge is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+// Proton Mail Bridge is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+// You should have received a copy of the GNU General Public License
+// along with Proton Mail Bridge. If not, see <https://www.gnu.org/licenses/>.
+#ifndef BRIDGE_GUI_CLIPBOARDPROXY_H
+#define BRIDGE_GUI_CLIPBOARDPROXY_H
+
+// The following class declarations were taken and adapted from:
+// https://stackoverflow.com/questions/40092352/passing-qclipboard-to-qml
+// Author: krzaq
+
+
+class ClipboardProxy : public QObject
+{
+Q_OBJECT
+    Q_PROPERTY(QString text READ text NOTIFY textChanged)
+public:
+    explicit ClipboardProxy(QClipboard*);
+
+    QString text() const;
+
+signals:
+    void textChanged();
+
+private:
+    QClipboard* clipboard;
+};
+
+
+#endif //BRIDGE_GUI_CLIPBOARDPROXY_H

internal/frontend/bridge-gui/bridge-gui/CommandLine.cpp

@@ -15,113 +15,85 @@
 // You should have received a copy of the GNU General Public License
 // along with Proton Mail Bridge. If not, see <https://www.gnu.org/licenses/>.
 
-
 #include "Pch.h"
 #include "CommandLine.h"
 #include "Settings.h"
+#include <bridgepp/CLI/CLIUtils.h>
 #include <bridgepp/SessionID/SessionID.h>
 
-
 using namespace bridgepp;
 
-
 namespace {
 
-
-QString const launcherFlag = "--launcher"; ///< launcher flag parameter used for bridge.
-QString const noWindowFlag = "--no-window"; ///< The no-window command-line flag.
-QString const softwareRendererFlag = "--software-renderer"; ///< The 'software-renderer' command-line flag. enable software rendering for a single execution
-QString const setSoftwareRendererFlag = "--set-software-renderer"; ///< The 'set-software-renderer' command-line flag. Software rendering will be used for all subsequent executions of the application.
-QString const setHardwareRendererFlag = "--set-hardware-renderer"; ///< The 'set-hardware-renderer' command-line flag. Hardware rendering will be used for all subsequent executions of the application.
-
-
-//****************************************************************************************************************************************************
-/// \brief parse a command-line string argument as expected by go's CLI package.
-/// \param[in] argc The number of arguments passed to the application.
-/// \param[in] argv The list of arguments passed to the application.
-/// \param[in] paramNames the list of names for the parameter
-//****************************************************************************************************************************************************
-QString parseGoCLIStringArgument(int argc, char *argv[], QStringList paramNames) {
-    // go cli package is pretty permissive when it comes to parsing arguments. For each name 'param', all the following seems to be accepted:
-    // -param value
-    // --param value
-    // -param=value
-    // --param=value
-    for (QString const &paramName: paramNames) {
-        for (qsizetype i = 1; i < argc; ++i) {
-            QString const arg(QString::fromLocal8Bit(argv[i]));
-            if ((i < argc - 1) && ((arg == "-" + paramName) || (arg == "--" + paramName))) {
-                return QString(argv[i + 1]);
-            }
-
-            QRegularExpressionMatch match = QRegularExpression(QString("^-{1,2}%1=(.+)$").arg(paramName)).match(arg);
-            if (match.hasMatch()) {
-                return match.captured(1);
-            }
-        }
-    }
-
-    return QString();
-}
-
+QString const hyphenatedLauncherFlag = "--launcher"; ///< launcher flag parameter used for bridge.
+QString const hyphenatedWindowFlag = "--no-window"; ///< The no-window command-line flag.
+QString const hyphenatedSoftwareRendererFlag = "--software-renderer"; ///< The 'software-renderer' command-line flag. enable software rendering for a single execution
+QString const hyphenatedSetSoftwareRendererFlag = "--set-software-renderer"; ///< The 'set-software-renderer' command-line flag. Software rendering will be used for all subsequent executions of the application.
+QString const hyphenatedSetHardwareRendererFlag = "--set-hardware-renderer"; ///< The 'set-hardware-renderer' command-line flag. Hardware rendering will be used for all subsequent executions of the application.
 
 //****************************************************************************************************************************************************
 /// \brief Parse the log level from the command-line arguments.
 ///
-/// \param[in] argc The number of arguments passed to the application.
-/// \param[in] argv The list of arguments passed to the application.
+/// \param[in] args The command-line arguments.
 /// \return The log level. if not specified on the command-line, the default log level is returned.
 //****************************************************************************************************************************************************
-Log::Level parseLogLevel(int argc, char *argv[]) {
-    QString levelStr = parseGoCLIStringArgument(argc, argv, { "l", "log-level" });
+Log::Level parseLogLevel(QStringList const &args) {
+    QStringList levelStr = parseGoCLIStringArgument(args, {"l", "log-level"});
     if (levelStr.isEmpty()) {
         return Log::defaultLevel;
     }
 
     Log::Level level = Log::defaultLevel;
-    Log::stringToLevel(levelStr, level);
+    Log::stringToLevel(levelStr.back(), level);
     return level;
 }
 
-
 } // anonymous namespace
 
-
 //****************************************************************************************************************************************************
-/// \param[in]  argc number of arguments passed to the application.
-/// \param[in]  argv list of arguments passed to the application.
+/// \param[in]  argv list of arguments passed to the application, including the exe name/path at index 0.
 /// \return The parsed options.
 //****************************************************************************************************************************************************
-CommandLineOptions parseCommandLine(int argc, char *argv[]) {
+CommandLineOptions parseCommandLine(QStringList const &argv) {
     CommandLineOptions options;
-    bool flagFound = false;
-    options.launcher = QString::fromLocal8Bit(argv[0]);
+    bool launcherFlagFound = false;
+    options.launcher = argv[0];
     // for unknown reasons, on Windows QCoreApplication::arguments() frequently returns an empty list, which is incorrect, so we rebuild the argument
     // list from the original argc and argv values.
-    for (int i = 1; i < argc; i++) {
-        QString const &arg = QString::fromLocal8Bit(argv[i]);
+    for (int i = 1; i < argv.count(); i++) {
+        QString const &arg = argv[i];
         // we can't use QCommandLineParser here since it will fail on unknown options.
+
+        // we skip session-id for now we'll process it later, with a special treatment for duplicates
+        if (arg == hyphenatedSessionIDFlag) {
+            i++; // we skip the next param, which if the flag's value.
+            continue;
+        }
+        if (arg.startsWith(hyphenatedSessionIDFlag + "=")) {
+            continue;
+        }
+        
         // Arguments may contain some bridge flags.
-        if (arg == softwareRendererFlag) {
+        if (arg == hyphenatedSoftwareRendererFlag) {
             options.bridgeGuiArgs.append(arg);
             options.useSoftwareRenderer = true;
         }
-        if (arg == setSoftwareRendererFlag) {
+        if (arg == hyphenatedSetSoftwareRendererFlag) {
             app().settings().setUseSoftwareRenderer(true);
             continue; // setting is permanent. no need to keep/pass it to bridge for restart.
         }
-        if (arg == setHardwareRendererFlag) {
+        if (arg == hyphenatedSetHardwareRendererFlag) {
             app().settings().setUseSoftwareRenderer(false);
             continue; // setting is permanent. no need to keep/pass it to bridge for restart.
         }
-        if (arg == noWindowFlag) {
+        if (arg == hyphenatedWindowFlag) {
             options.noWindow = true;
         }
-        if (arg == launcherFlag) {
+        if (arg == hyphenatedLauncherFlag) {
             options.bridgeArgs.append(arg);
-            options.launcher = QString::fromLocal8Bit(argv[++i]);
+            options.launcher = argv[++i];
             options.bridgeArgs.append(options.launcher);
-            flagFound = true;
+            launcherFlagFound = true;
         }
 #ifdef QT_DEBUG
         else if (arg == "--attach" || arg == "-a") {
@@ -135,22 +107,24 @@ CommandLineOptions parseCommandLine(int argc, char *argv[]) {
             options.bridgeGuiArgs.append(arg);
         }
     }
-    if (!flagFound) {
+    if (!launcherFlagFound) {
         // add bridge-gui as launcher
-        options.bridgeArgs.append(launcherFlag);
+        options.bridgeArgs.append(hyphenatedLauncherFlag);
         options.bridgeArgs.append(options.launcher);
     }
 
-    options.logLevel = parseLogLevel(argc, argv);
-
-    QString sessionID = parseGoCLIStringArgument(argc, argv, { "session-id" });
-    if (sessionID.isEmpty()) {
-        // The session ID was not passed to us on the command-line -> create one and add to the command-line for bridge
-        sessionID = newSessionID();
-        options.bridgeArgs.append("--session-id");
-        options.bridgeArgs.append(sessionID);
+    QStringList args;
+    if (!argv.isEmpty()) {
+        args = argv.last(argv.count() - 1);
     }
+
+    options.logLevel = parseLogLevel(args);
+
+    QString const sessionID = mostRecentSessionID(args);
+    options.bridgeArgs.append(hyphenatedSessionIDFlag);
+    options.bridgeArgs.append(sessionID);
     app().setSessionID(sessionID);
 
     return options;
 }
+

internal/frontend/bridge-gui/bridge-gui/CommandLine.h

@@ -37,7 +37,7 @@ struct CommandLineOptions {
 };
 
 
-CommandLineOptions parseCommandLine(int argc, char *argv[]); ///< Parse the command-line arguments
+CommandLineOptions parseCommandLine(QStringList const &argv); ///< Parse the command-line arguments
 
 
 #endif //BRIDGE_GUI_COMMAND_LINE_H

internal/frontend/bridge-gui/bridge-gui/DeployWindows.cmake

@@ -31,7 +31,7 @@ macro( AppendLib LIB_NAME HINT_PATH)
     if( ${PATH_${UP_NAME}} STREQUAL "PATH_${UP_NAME}-NOTFOUND")
         message(SEND_ERROR "${LIB_NAME} was not found in ${HINT_PATH}")
     else()
-        list(APPEND DEPLOY_LIBS ${PATH_${UP_NAME}})
+        list(APPEND DEPLOY_LIBS "${PATH_${UP_NAME}}")
     endif()
 endmacro()
 

internal/frontend/bridge-gui/bridge-gui/Pch.h

@@ -26,6 +26,7 @@
 #include <QtWidgets>
 #include <QtQuickControls2>
 #include <QtSvg>
+#include <QtGui>
 #include <AppController.h>
 
 

internal/frontend/bridge-gui/bridge-gui/QMLBackend.cpp

@@ -810,6 +810,18 @@ void QMLBackend::login(QString const &username, QString const &password) const {
     )
 }
 
+void QMLBackend::loginHv(QString const &username, QString const &password) const {
+    HANDLE_EXCEPTION(
+            if (username.compare("coco@bandicoot", Qt::CaseInsensitive) == 0) {
+                throw Exception("User requested bridge-gui to crash by trying to log as coco@bandicoot",
+                                "This error exists for test purposes and should be ignored.", __func__, tailOfLatestBridgeLog(app().sessionID()));
+            }
+            app().grpc().loginHv(username, password);
+    )
+}
+
+
+
 
 //****************************************************************************************************************************************************
 /// \param[in] username The username.
@@ -1316,6 +1328,9 @@ void QMLBackend::connectGrpcEvents() {
     connect(client, &GRPCClient::certificateInstallFailed, this, &QMLBackend::certificateInstallFailed);
     connect(client, &GRPCClient::showMainWindow, [&]() { this->showMainWindow("gRPC showMainWindow event"); });
     connect(client, &GRPCClient::knowledgeBasSuggestionsReceived, this, &QMLBackend::receivedKnowledgeBaseSuggestions);
+    connect(client, &GRPCClient::repairStarted, this, &QMLBackend::repairStarted);
+    connect(client, &GRPCClient::allUsersLoaded, this, &QMLBackend::allUsersLoaded);
+    connect(client, &GRPCClient::userNotificationReceived, this, &QMLBackend::processUserNotification);
 
     // cache events
     connect(client, &GRPCClient::cantMoveDiskCache, this, &QMLBackend::cantMoveDiskCache);
@@ -1334,6 +1349,8 @@ void QMLBackend::connectGrpcEvents() {
     connect(client, &GRPCClient::login2PasswordErrorAbort, this, &QMLBackend::login2PasswordErrorAbort);
     connect(client, &GRPCClient::loginFinished, this, &QMLBackend::onLoginFinished);
     connect(client, &GRPCClient::loginAlreadyLoggedIn, this, &QMLBackend::onLoginAlreadyLoggedIn);
+    connect(client, &GRPCClient::loginHvRequested, this, &QMLBackend::loginHvRequested);
+    connect(client, &GRPCClient::loginHvError, this, &QMLBackend::loginHvError);
 
     // update events
     connect(client, &GRPCClient::updateManualError, this, &QMLBackend::updateManualError);
@@ -1396,3 +1413,31 @@ void QMLBackend::displayBadEventDialog(QString const &userID) {
         emit showMainWindow();
     )
 }
+
+void QMLBackend::triggerRepair() const {
+    HANDLE_EXCEPTION(
+            app().grpc().triggerRepair();
+    )
+}
+
+//****************************************************************************************************************************************************
+/// \param[in] notification The user notification received from the event loop.
+//****************************************************************************************************************************************************
+void QMLBackend::processUserNotification(bridgepp::UserNotification const& notification) {
+    this->userNotificationStack_.push(notification);
+    trayIcon_->showUserNotification(notification.title, notification.subtitle);
+    emit receivedUserNotification(notification);
+}
+
+void QMLBackend::userNotificationDismissed() {
+    if (!this->userNotificationStack_.size()) return;
+
+    // Remove the user notification from the top of the queue as it has been dismissed.
+    this->userNotificationStack_.pop();
+    if (!this->userNotificationStack_.size()) return;
+
+    // Display the user notification that is on top of the queue, if there is one.
+    auto notification = this->userNotificationStack_.top();
+    emit receivedUserNotification(notification);
+}
+

internal/frontend/bridge-gui/bridge-gui/QMLBackend.h

@@ -28,6 +28,7 @@
 #include <bridgepp/GRPC/GRPCClient.h>
 #include <bridgepp/GRPC/GRPCUtils.h>
 #include <bridgepp/Worker/Overseer.h>
+#include <stack>
 
 
 //****************************************************************************************************************************************************
@@ -174,6 +175,8 @@ signals: // Signal used by the Qt property system. Many of them are unused but r
     void isAutostartOnChanged(bool value); ///<Signal for the change of the 'isAutostartOn' property.
     void usersChanged(UserList *users); ///<Signal for the change of the 'users' property.
     void dockIconVisibleChanged(bool value); ///<Signal for the change of the 'dockIconVisible' property.
+    void receivedUserNotification(bridgepp::UserNotification const& notification); ///< Signal to display the userNotification modal
+
 
 public slots: // slot for signals received from QML -> To be forwarded to Bridge via RPC Client calls.
     void toggleAutostart(bool active); ///< Slot for the autostart toggle.
@@ -183,6 +186,7 @@ public slots: // slot for signals received from QML -> To be forwarded to Bridge
     void changeColorScheme(QString const &scheme); ///< Slot for the change of the theme.
     void setDiskCachePath(QUrl const &path) const; ///< Slot for the change of the disk cache path.
     void login(QString const &username, QString const &password) const; ///< Slot for the login button (initial login).
+    void loginHv(QString const &username, QString const &password) const; ///< Slot for the login button (after HV challenge completed).
     void login2FA(QString const &username, QString const &code) const; ///< Slot for the login button (2FA login).
     void login2Password(QString const &username, QString const &password) const; ///< Slot for the login button (mailbox password login).
     void loginAbort(QString const &username) const; ///< Slot for the login abort procedure.
@@ -207,6 +211,8 @@ public slots: // slot for signals received from QML -> To be forwarded to Bridge
     void notifyReportBugClicked() const; ///< Slot for the ReportBugClicked gRPC event.
     void notifyAutoconfigClicked(QString const &client) const; ///< Slot for gAutoconfigClicked gRPC event.
     void notifyExternalLinkClicked(QString const &article) const; ///< Slot for KBArticleClicked gRPC event.
+    void triggerRepair() const; ///< Slot for the triggering of the bridge repair function i.e. 'resync'.
+    void userNotificationDismissed(); ///< Slot to pop the notification from the stack and display the rest.
 
 public slots: // slots for functions that need to be processed locally.
     void setNormalTrayIcon(); ///< Set the tray icon to normal.
@@ -222,6 +228,7 @@ public slots: // slot for signals received from gRPC that need transformation in
     void onLoginAlreadyLoggedIn(QString const &userID); ///< Slot for the LoginAlreadyLoggedIn gRPC event.
     void onUserBadEvent(QString const& userID, QString const& errorMessage); ///< Slot for the userBadEvent gRPC event.
     void onIMAPLoginFailed(QString const& username); ///< Slot the the imapLoginFailed event.
+    void processUserNotification(bridgepp::UserNotification const& notification); ///< Slot for the userNotificationReceived gRCP event.
 
 signals: // Signals received from the Go backend, to be forwarded to QML
     void toggleAutostartFinished(); ///< Signal for the 'toggleAutostartFinished' gRPC stream event.
@@ -238,6 +245,8 @@ signals: // Signals received from the Go backend, to be forwarded to QML
     void login2PasswordErrorAbort(QString const &errorMsg); ///< Signal for the 'login2PasswordErrorAbort' gRPC stream event.
     void loginFinished(int index, bool wasSignedOut); ///< Signal for the 'loginFinished' gRPC stream event.
     void loginAlreadyLoggedIn(int index); ///< Signal for the 'loginAlreadyLoggedIn' gRPC stream event.
+    void loginHvRequested(QString const &hvUrl); ///< Signal for the 'loginHvRequested' gRPC stream event.
+    void loginHvError(QString const &errorMsg); ///< Signal for the 'loginHvError' gRPC stream event.
     void updateManualReady(QString const &version); ///< Signal for the 'updateManualReady' gRPC stream event.
     void updateManualRestartNeeded(); ///< Signal for the 'updateManualRestartNeeded' gRPC stream event.
     void updateManualError(); ///< Signal for the 'updateManualError' gRPC stream event.
@@ -279,7 +288,9 @@ signals: // Signals received from the Go backend, to be forwarded to QML
     void selectUser(QString const& userID, bool forceShowWindow); ///< Signal emitted in order to selected a user with a given ID in the list.
     void genericError(QString const &title, QString const &description); ///< Signal for the 'genericError' gRPC stream event.
     void imapLoginWhileSignedOut(QString const& username); ///< Signal for the notification of IMAP login attempt on a signed out account.
-    void receivedKnowledgeBaseSuggestions(QList<bridgepp::KnowledgeBaseSuggestion> const& suggestions); ///< Signal for the reception of knowledgebase article suggestions.
+    void receivedKnowledgeBaseSuggestions(QList<bridgepp::KnowledgeBaseSuggestion> const& suggestions); ///< Signal for the reception of knowledge base article suggestions.
+    void repairStarted(); ///< Signal for the 'repairStarted' gRPC stream event.
+    void allUsersLoaded(); ///< Signal for the 'allUsersLoaded' gRPC stream event
 
     // This signal is emitted when an exception is intercepted is calls triggered by QML. QML engine would intercept the exception otherwise.
     void fatalError(bridgepp::Exception const& e) const; ///< Signal emitted when an fatal error occurs.
@@ -304,6 +315,7 @@ private: // data members
     QList<QString> badEventDisplayQueue_; ///< THe queue for displaying 'bad event feedback request dialog'.
     std::unique_ptr<TrayIcon> trayIcon_; ///< The tray icon for the application.
     bridgepp::BugReportFlow reportFlow_;  ///< The bug report flow.
+    std::stack<bridgepp::UserNotification> userNotificationStack_; ///< The stack which holds all of the active notifications that the user needs to acknowledge.
     friend class AppController;
 };
 

internal/frontend/bridge-gui/bridge-gui/Resources.qrc

@@ -71,6 +71,7 @@
         <file>qml/icons/systray-mono-update.png</file>
         <file>qml/icons/systray-mono-warn.png</file>
         <file>qml/icons/systray.svg</file>
+        <file>qml/icons/ic-notification-bell.svg</file>
         <file alias="bridge.svg">../../../../dist/bridge.svg</file>
         <file alias="bridgeMacOS.svg">../../../../dist/bridgeMacOS.svg</file>
         <file>qml/KeychainSettings.qml</file>
@@ -78,6 +79,7 @@
         <file>qml/MainWindow.qml</file>
         <file>qml/NoAccountView.qml</file>
         <file>qml/NotificationDialog.qml</file>
+        <file>qml/UserNotificationDialog.qml</file>
         <file>qml/NotificationPopups.qml</file>
         <file>qml/Notifications/Notification.qml</file>
         <file>qml/Notifications/NotificationFilter.qml</file>
@@ -117,6 +119,7 @@
         <file>qml/Resources/Help/WhyProfileWarning.html</file>
         <file>qml/SettingsItem.qml</file>
         <file>qml/SettingsView.qml</file>
+        <file>qml/SetupWizard/ClientConfigCertInstall.qml</file>
         <file>qml/SetupWizard/ClientListItem.qml</file>
         <file>qml/SetupWizard/LeftPane.qml</file>
         <file>qml/SetupWizard/ClientConfigAppleMail.qml</file>
@@ -131,5 +134,6 @@
         <file>qml/ConnectionModeSettings.qml</file>
         <file>qml/SplashScreen.qml</file>
         <file>qml/Status.qml</file>
+        <file>qml/Proton/ContextMenu.qml</file>
     </qresource>
 </RCC>

internal/frontend/bridge-gui/bridge-gui/TrayIcon.cpp

@@ -182,6 +182,7 @@ TrayIcon::TrayIcon()
     , notificationErrorIcon_(loadIconFromSVG(":/qml/icons/ic-alert.svg")) {
     this->generateDotIcons();
     this->setContextMenu(menu_.get());
+    this->setToolTip(PROJECT_FULL_NAME);
 
     connect(menu_.get(), &QMenu::aboutToShow, this, &TrayIcon::onMenuAboutToShow);
     connect(this, &TrayIcon::selectUser, &app().backend(), [](QString const& userID, bool forceShowWindow) {
@@ -330,6 +331,15 @@ void TrayIcon::showErrorPopupNotification(QString const &title, QString const &m
     this->showMessage(title, message, notificationErrorIcon_);
 }
 
+//****************************************************************************************************************************************************
+/// Used only by user notifications received from the event loop
+/// \param[in] title The title.
+/// \param[in] subtitle The subtitle.
+//****************************************************************************************************************************************************
+void TrayIcon::showUserNotification(QString const &title, QString const &subtitle) {
+    this->showMessage(title, subtitle, QSystemTrayIcon::NoIcon);
+}
+
 
 //****************************************************************************************************************************************************
 /// \param[in] svgPath The path of the SVG file for the icon.

internal/frontend/bridge-gui/bridge-gui/TrayIcon.h

@@ -42,6 +42,8 @@ public: // data members
     TrayIcon& operator=(TrayIcon&&) = delete; ///< Disabled move assignment operator.
     void setState(State state, QString const& stateString, QString const &statusIconPath); ///< Set the state of the icon
     void showErrorPopupNotification(QString const& title, QString const &message); ///< Display a pop up notification.
+    void showUserNotification(QString const& title, QString const &subtitle); ///< Display an OS pop up notification (without icon).
+
 
 signals:
     void selectUser(QString const& userID, bool forceShowWindow); ///< Signal for selecting a user with a given userID

internal/frontend/bridge-gui/bridge-gui/build.ps1

@@ -102,6 +102,7 @@ git submodule update --init --recursive $vcpkgRoot
                                        -S . -B $buildDir
 
 check_exit "CMake failed"
+
 . $cmakeExe --build $buildDir --config "$buildConfig"
 check_exit "Build failed"
 
@@ -109,7 +110,7 @@ if  ($($args.count) -gt 0 )
 {
     if ($args[0] = "install")
     {
-        . $cmakeExe --install $buildDir
+        . $cmakeExe --install "$buildDir" -v
         check_exit "Install failed"
     }
 }

internal/frontend/bridge-gui/bridge-gui/main.cpp

@@ -15,7 +15,6 @@
 // You should have received a copy of the GNU General Public License
 // along with Proton Mail Bridge. If not, see <https://www.gnu.org/licenses/>.
 
-
 #include "BridgeApp.h"
 #include "BuildConfig.h"
 #include "CommandLine.h"
@@ -29,14 +28,14 @@
 #include <bridgepp/Log/Log.h>
 #include <bridgepp/Log/LogUtils.h>
 #include <bridgepp/ProcessMonitor.h>
+#include <ClipboardProxy.h>
 
+#include "bridgepp/CLI/CLIUtils.h"
 
 #ifdef Q_OS_MACOS
 
-
 #include "MacOS/SecondInstance.h"
 
-
 #endif
 
 using namespace bridgepp;
@@ -50,17 +49,14 @@ QString const exeSuffix = ".exe";
 QString const exeSuffix;
 #endif
 
-
 QString const bridgeLock = "bridge-v3.lock"; ///< The file name used for the bridge-gui lock file.
 QString const bridgeGUILock = "bridge-v3-gui.lock"; ///< The file name used for the bridge-gui lock file.
 QString const exeName = "bridge" + exeSuffix; ///< The bridge executable file name.*
-qint64 const grpcServiceConfigWaitDelayMs = 180000; ///< The wait delay for the gRPC config file in milliseconds.
+qint64 constexpr grpcServiceConfigWaitDelayMs = 180000; ///< The wait delay for the gRPC config file in milliseconds.
 QString const waitFlag = "--wait"; ///< The wait command-line flag.
 
-
 } // anonymous namespace
 
-
 //****************************************************************************************************************************************************
 /// \return The path of the bridge executable.
 /// \return A null string if the executable could not be located.
@@ -70,7 +66,6 @@ QString locateBridgeExe() {
     return (fileInfo.exists() && fileInfo.isFile() && fileInfo.isExecutable()) ? fileInfo.absoluteFilePath() : QString();
 }
 
-
 //****************************************************************************************************************************************************
 /// // initialize the Qt application.
 //****************************************************************************************************************************************************
@@ -97,8 +92,6 @@ void initQtApplication() {
 #endif // #ifdef Q_OS_MACOS
 }
 
-
-
 //****************************************************************************************************************************************************
 /// \param[in] engine The QML component.
 //****************************************************************************************************************************************************
@@ -118,13 +111,12 @@ QQmlComponent *createRootQmlComponent(QQmlApplicationEngine &engine) {
     rootComponent->loadUrl(QUrl(qrcQmlDir + "/Bridge.qml"));
     if (rootComponent->status() != QQmlComponent::Status::Ready) {
         QString const &err = rootComponent->errorString();
-            app().log().error(err);
+        app().log().error(err);
         throw Exception("Could not load QML component", err);
     }
     return rootComponent;
 }
 
-
 //****************************************************************************************************************************************************
 /// \param[in] lock The lock file to be checked.
 /// \return True if the lock can be taken, false otherwise.
@@ -155,7 +147,6 @@ bool checkSingleInstance(QLockFile &lock) {
     return true;
 }
 
-
 //****************************************************************************************************************************************************
 /// \return QUrl to reach the bridge API.
 //****************************************************************************************************************************************************
@@ -184,7 +175,6 @@ QUrl getApiUrl() {
     return url;
 }
 
-
 //****************************************************************************************************************************************************
 /// \brief Check if bridge is running.
 ///
@@ -199,7 +189,6 @@ bool isBridgeRunning() {
     return (!lockFile.tryLock()) && (lockFile.error() == QLockFile::LockFailedError);
 }
 
-
 //****************************************************************************************************************************************************
 /// \brief Use api to bring focus on existing bridge instance.
 //****************************************************************************************************************************************************
@@ -213,8 +202,7 @@ void focusOtherInstance() {
             if (!sc.load(path)) {
                 throw Exception("The gRPC focus service configuration file is invalid.");
             }
-        }
-        else {
+        } else {
             throw Exception("Server did not provide gRPC Focus service configuration.");
         }
 
@@ -225,20 +213,18 @@ void focusOtherInstance() {
         if (!client.raise("focusOtherInstance").ok()) {
             throw Exception(QString("The raise call to the bridge focus service failed."));
         }
-    }
-    catch (Exception const &e) {
+    } catch (Exception const &e) {
         app().log().error(e.qwhat());
         auto uuid = reportSentryException("Exception occurred during focusOtherInstance()", e);
         app().log().fatal(QString("reportID: %1 Captured exception: %2").arg(QByteArray(uuid.bytes, 16).toHex(), e.qwhat()));
     }
 }
 
-
 //****************************************************************************************************************************************************
 /// \param [in] args list of arguments to pass to bridge.
 /// \return bridge executable path
 //****************************************************************************************************************************************************
-const QString launchBridge(QStringList const &args) {
+QString launchBridge(QStringList const &args) {
     UPOverseer &overseer = app().bridgeOverseer();
     overseer.reset();
 
@@ -251,26 +237,38 @@ const QString launchBridge(QStringList const &args) {
     }
 
     qint64 const pid = qApp->applicationPid();
-    QStringList const params = QStringList { "--grpc", "--parent-pid", QString::number(pid) } + args;
+    QStringList const params = QStringList{"--grpc", "--parent-pid", QString::number(pid)} + args;
     app().log().info(QString("Launching bridge process with command \"%1\" %2").arg(bridgeExePath, params.join(" ")));
     overseer = std::make_unique<Overseer>(new ProcessMonitor(bridgeExePath, params, nullptr), nullptr);
     overseer->startWorker(true);
     return bridgeExePath;
 }
 
-
 //****************************************************************************************************************************************************
 //
 //****************************************************************************************************************************************************
 void closeBridgeApp() {
     app().grpc().quit(); // this will cause the grpc service and the bridge app to close.
 
-    UPOverseer &overseer = app().bridgeOverseer();
-    if (overseer) {  // A null overseer means the app was run in 'attach' mode. We're not monitoring it.
+    UPOverseer const &overseer = app().bridgeOverseer();
+    if (overseer) {
+        // A null overseer means the app was run in 'attach' mode. We're not monitoring it.
+        // ReSharper disable once CppExpressionWithoutSideEffects
         overseer->wait(Overseer::maxTerminationWaitTimeMs);
     }
 }
 
+//****************************************************************************************************************************************************
+/// \param[in] argv The command-line argments, including the application name at index 0.
+//****************************************************************************************************************************************************
+void logCommandLineInvocation(QStringList argv) {
+    Log &log = app().log();
+    if (argv.isEmpty()) {
+        log.error("The command line is empty");
+    }
+    log.info("bridge-gui executable: " + argv.front());
+    log.info("Command-line invocation: " + (argv.size() > 1 ? argv.last(argv.size() - 1).join(" ") : "<none>"));
+}
 
 //****************************************************************************************************************************************************
 /// \param[in] argc The number of command-line arguments.
@@ -289,12 +287,11 @@ int main(int argc, char *argv[]) {
     auto sentryCloser = qScopeGuard([] { sentry_close(); });
 
     try {
-        QString const& configDir = bridgepp::userConfigDir();
-
+        QString const &configDir = bridgepp::userConfigDir();
 
         initQtApplication();
-
-        CommandLineOptions const cliOptions = parseCommandLine(argc, argv);
+        QStringList const argvList = cliArgsToStringList(argc, argv);
+        CommandLineOptions const cliOptions = parseCommandLine(argvList);
         Log &log = initLog();
         log.setLevel(cliOptions.logLevel);
 
@@ -309,6 +306,8 @@ int main(int argc, char *argv[]) {
         setDockIconVisibleState(!cliOptions.noWindow);
 #endif
 
+        logCommandLineInvocation(argvList);
+
         // In attached mode, we do not intercept stderr and stdout of bridge, as we did not launch it ourselves, so we output the log to the console.
         // When not in attached mode, log entries are forwarded to bridge, which output it on stdout/stderr. bridge-gui's process monitor intercept
         // these outputs and output them on the command-line.
@@ -348,8 +347,9 @@ int main(int argc, char *argv[]) {
         QQuickWindow::setSceneGraphBackend((app().settings().useSoftwareRenderer() || cliOptions.useSoftwareRenderer) ? "software" : "rhi");
         log.info(QString("Qt Quick renderer: %1").arg(QQuickWindow::sceneGraphBackend()));
 
-
         QQmlApplicationEngine engine;
+        // Set up clipboard
+        engine.rootContext()->setContextProperty("clipboard", new ClipboardProxy(QGuiApplication::clipboard()));
         std::unique_ptr<QQmlComponent> rootComponent(createRootQmlComponent(engine));
         std::unique_ptr<QObject> rootObject(rootComponent->create(engine.rootContext()));
         if (!rootObject) {
@@ -374,7 +374,7 @@ int main(int argc, char *argv[]) {
                 app().log().debug(QString("Monitoring Bridge PID : %1").arg(status.pid));
 
                 connection = QObject::connect(bridgeMonitor, &ProcessMonitor::processExited, [&](int returnCode) {
-                    bridgeExited = true;// clazy:exclude=lambda-in-connect
+                    bridgeExited = true; // clazy:exclude=lambda-in-connect
                     qGuiApp->exit(returnCode);
                 });
             }
@@ -383,7 +383,7 @@ int main(int argc, char *argv[]) {
         int result = 0;
         if (!startError) {
             // we succeeded in launching bridge, so we can be set as mainExecutable.
-            QString mainexec = QString::fromLocal8Bit(argv[0]);
+            QString const mainexec = argvList[0];
             app().grpc().setMainExecutable(mainexec);
             QStringList args = cliOptions.bridgeGuiArgs;
             args.append(waitFlag);
@@ -412,8 +412,7 @@ int main(int argc, char *argv[]) {
         // release the lock file
         lock.unlock();
         return result;
-    }
-    catch (Exception const &e) {
+    } catch (Exception const &e) {
         sentry_uuid_s const uuid = reportSentryException("Exception occurred during main", e);
         QString message = e.qwhat();
         if (e.showSupportLink()) {

internal/frontend/bridge-gui/bridge-gui/qml/GeneralSettings.qml

@@ -21,6 +21,8 @@ SettingsView {
 
     property bool _isAdvancedShown: false
     property var notifications
+    property var allUsersLoaded: false
+    property var hasInternetConnection: true
 
     fillHeight: false
 
@@ -219,6 +221,37 @@ SettingsView {
             Backend.exportTLSCertificates();
         }
     }
+    SettingsItem {
+        id: repair
+        Layout.fillWidth: true
+        actionText: qsTr("Repair")
+        colorScheme: root.colorScheme
+        description: qsTr("Reload all accounts, cached data, and download all emails again. Email clients stay connected to Bridge.")
+        text: qsTr("Repair Bridge")
+        type: SettingsItem.Button
+        visible: root._isAdvancedShown
+        enabled: root.allUsersLoaded && Backend.users.count && root.hasInternetConnection
+
+        onClicked: {
+            root.notifications.askRepairBridge();
+        }
+
+        Connections {
+            function onInternetOff() {
+                root.hasInternetConnection = false;
+                repair.description = qsTr("This feature requires internet access to the Proton servers.")
+
+            }
+            function onInternetOn() {
+                root.hasInternetConnection = true;
+                repair.description = qsTr("Reload all accounts, cached data, and download all emails again. Email clients stay connected to Bridge.")
+            }
+            function onAllUsersLoaded() {
+                root.allUsersLoaded = true;
+            }
+            target: Backend
+        }
+    }
     SettingsItem {
         id: reset
         Layout.fillWidth: true

internal/frontend/bridge-gui/bridge-gui/qml/NotificationDialog.qml

@@ -22,6 +22,7 @@ Dialog {
 
     default property alias data: additionalChildrenContainer.children
     property var notification
+    property bool isUserNotification: false
 
     modal: true
     shouldShow: notification && notification.active && !notification.dismissed
@@ -39,13 +40,13 @@ Dialog {
                     return "";
                 }
                 switch (root.notification.type) {
-                case Notification.NotificationType.Info:
-                    return "/qml/icons/ic-info.svg";
-                case Notification.NotificationType.Success:
-                    return "/qml/icons/ic-success.svg";
-                case Notification.NotificationType.Warning:
-                case Notification.NotificationType.Danger:
-                    return "/qml/icons/ic-alert.svg";
+                    case Notification.NotificationType.Info:
+                        return "/qml/icons/ic-info.svg";
+                    case Notification.NotificationType.Success:
+                        return "/qml/icons/ic-success.svg";
+                    case Notification.NotificationType.Warning:
+                    case Notification.NotificationType.Danger:
+                        return "/qml/icons/ic-alert.svg";
                 }
             }
             sourceSize.height: 64

internal/frontend/bridge-gui/bridge-gui/qml/NotificationPopups.qml

@@ -105,4 +105,12 @@ Item {
         colorScheme: root.colorScheme
         notification: root.notifications.genericQuestion
     }
+    NotificationDialog {
+        colorScheme: root.colorScheme
+        notification: root.notifications.repairBridge
+    }
+    UserNotificationDialog {
+        colorScheme: root.colorScheme
+        notification: root.notifications.userNotification
+    }
 }

internal/frontend/bridge-gui/bridge-gui/qml/Notifications/Notification.qml

@@ -19,7 +19,8 @@ QtObject {
         Info,
         Success,
         Warning,
-        Danger
+        Danger,
+        UserNotification
     }
 
     property list<Action> action
@@ -36,6 +37,9 @@ QtObject {
     readonly property var occurred: active ? new Date() : undefined
     property string title // title is used in dialogs only
     property int type
+    property string subtitle
+    property string username
+
 
     onActiveChanged: {
         dismissed = false;

internal/frontend/bridge-gui/bridge-gui/qml/Notifications/Notifications.qml

@@ -13,6 +13,8 @@
 import QtQml
 import Qt.labs.platform
 import QtQuick.Controls
+import QtQuick.Layouts
+import QtQuick
 import "../"
 
 QtObject {
@@ -60,7 +62,7 @@ QtObject {
             target: Backend
         }
     }
-    property var all: [root.noInternet, root.imapPortStartupError, root.smtpPortStartupError, root.imapPortChangeError, root.smtpPortChangeError, root.imapConnectionModeChangeError, root.smtpConnectionModeChangeError, root.updateManualReady, root.updateManualRestartNeeded, root.updateManualError, root.updateForce, root.updateForceError, root.updateSilentRestartNeeded, root.updateSilentError, root.updateIsLatestVersion, root.loginConnectionError, root.onlyPaidUsers, root.alreadyLoggedIn, root.enableBeta, root.bugReportSendSuccess, root.bugReportSendError, root.bugReportSendFallback, root.cacheCantMove, root.cacheLocationChangeSuccess, root.enableSplitMode, root.resetBridge, root.changeAllMailVisibility, root.deleteAccount, root.noKeychain, root.rebuildKeychain, root.addressChanged, root.apiCertIssue, root.userBadEvent, root.imapLoginWhileSignedOut, root.genericError, root.genericQuestion]
+    property var all: [root.noInternet, root.imapPortStartupError, root.smtpPortStartupError, root.imapPortChangeError, root.smtpPortChangeError, root.imapConnectionModeChangeError, root.smtpConnectionModeChangeError, root.updateManualReady, root.updateManualRestartNeeded, root.updateManualError, root.updateForce, root.updateForceError, root.updateSilentRestartNeeded, root.updateSilentError, root.updateIsLatestVersion, root.loginConnectionError, root.onlyPaidUsers, root.alreadyLoggedIn, root.enableBeta, root.bugReportSendSuccess, root.bugReportSendError, root.bugReportSendFallback, root.cacheCantMove, root.cacheLocationChangeSuccess, root.enableSplitMode, root.resetBridge, root.changeAllMailVisibility, root.deleteAccount, root.noKeychain, root.rebuildKeychain, root.addressChanged, root.apiCertIssue, root.userBadEvent, root.imapLoginWhileSignedOut, root.genericError, root.genericQuestion, root.hvErrorEvent, root.repairBridge, root.userNotification]
     property Notification alreadyLoggedIn: Notification {
         brief: qsTr("Already signed in")
         description: qsTr("This account is already signed in.")
@@ -1130,6 +1132,102 @@ QtObject {
             target: Backend
         }
     }
+    property Notification hvErrorEvent: Notification {
+        group: Notifications.Group.Configuration
+        icon: "./icons/ic-exclamation-circle-filled.svg"
+        type: Notification.NotificationType.Danger
+
+        action: Action {
+            text: qsTr("OK")
+            onTriggered: {
+                root.hvErrorEvent.active = false;
+            }
+        }
+
+        Connections {
+            function onLoginHvError(errorMsg) {
+                root.hvErrorEvent.active = true;
+                root.hvErrorEvent.description = errorMsg;
+            }
+            target: Backend
+        }
+
+    }
+    property Notification repairBridge: Notification {
+        brief: title
+        description: qsTr("This action will reload all accounts, cached data, and re-download emails. Messages may temporarily disappear but will reappear progressively. Email clients stay connected to Bridge.")
+        group: Notifications.Group.Configuration | Notifications.Group.Dialogs
+        icon: "./icons/ic-exclamation-circle-filled.svg"
+        title: qsTr("Repair Bridge?")
+        type: Notification.NotificationType.Danger
+
+        action: [
+            Action {
+                id: repairBridge_cancel
+                text: qsTr("Cancel")
+                onTriggered: {
+                    root.repairBridge.active = false;
+                }
+            },
+            Action {
+                id: repairBridge_repair
+                text: qsTr("Repair")
+                onTriggered: {
+                    repairBridge_repair.loading = true;
+                    repairBridge_repair.enabled = false;
+                    repairBridge_cancel.enabled = false;
+                    Backend.triggerRepair();
+                }
+            }
+        ]
+
+        Connections {
+            function onAskRepairBridge() {
+                root.repairBridge.active = true;
+            }
+            target: root
+        }
+
+        Connections {
+            function onRepairStarted() {
+                root.repairBridge.active = false;
+                repairBridge_repair.loading = false;
+                repairBridge_repair.enabled = true;
+                repairBridge_cancel.enabled = true;
+            }
+            target: Backend
+        }
+
+    }
+
+    property Notification userNotification: Notification {
+        brief: title
+        group: Notifications.Group.Dialogs
+        type: Notification.NotificationType.UserNotification
+        icon: "./icons/ic-exclamation-circle-filled.svg" // If it's not included QML complains
+
+        action: [
+            Action {
+                text: qsTr("Okay")
+                onTriggered: {
+                    root.userNotification.active = false;
+                    Backend.userNotificationDismissed();
+                }
+            }
+        ]
+
+        Connections {
+            function onReceivedUserNotification(notification) {
+                const userPrimaryEmailOrUsername = Backend.users.primaryEmailOrUsername(notification.userID)
+                root.userNotification.title = notification.title
+                root.userNotification.subtitle = notification.subtitle
+                root.userNotification.description = notification.body
+                root.userNotification.username = userPrimaryEmailOrUsername
+                root.userNotification.active = true
+            }
+            target: Backend
+        }
+    }
 
     signal askChangeAllMailVisibility(var isVisibleNow)
     signal askDeleteAccount(var user)
@@ -1137,4 +1235,5 @@ QtObject {
     signal askEnableSplitMode(var user)
     signal askQuestion(var title, var description, var option1, var option2, var action1, var action2)
     signal askResetBridge
+    signal askRepairBridge
 }

internal/frontend/bridge-gui/bridge-gui/qml/Proton/ApplicationWindow.qml

@@ -73,6 +73,11 @@ T.ApplicationWindow {
             if (obj.shouldShow === false) {
                 continue;
             }
+            // User notifications should have display priority
+            if (obj.shouldShow && obj.isUserNotification) {
+                topmost = obj;
+                break;
+            }
             if (topmost && (topmost.popupType > obj.popupType)) {
                 continue;
             }

internal/frontend/bridge-gui/bridge-gui/qml/Proton/ContextMenu.qml

@@ -0,0 +1,79 @@
+// Copyright (c) 2024 Proton AG
+// This file is part of Proton Mail Bridge.
+// Proton Mail Bridge is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+// Proton Mail Bridge is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+// You should have received a copy of the GNU General Public License
+// along with Proton Mail Bridge. If not, see <https://www.gnu.org/licenses/>.
+import QtQuick
+import QtQuick.Controls
+
+Item {
+    property var parentObject: null
+    property var colorScheme: null
+    property bool readOnly: false
+    property bool isPassword: false
+
+    MouseArea {
+        id: controlMouseArea
+        width: parentObject ? parentObject.width : 0
+        height: parentObject ? parentObject.height : 0
+        acceptedButtons: Qt.RightButton
+        onClicked: controlContextMenu.popup()
+
+        propagateComposedEvents: true
+    }
+
+    Menu {
+        id: controlContextMenu
+        colorScheme: root.colorScheme
+        onVisibleChanged: {
+            if (controlContextMenu.visible) {
+                const hasSelectedText = parentObject.selectedText.length > 0;
+                const hasClipboardText = clipboard.text.length > 0;
+
+                copyMenuItem.visible = hasSelectedText && !isPassword;
+                cutMenuItem.visible = hasSelectedText && !readOnly && !isPassword;
+                pasteMenuItem.visible = hasClipboardText && !readOnly;
+                controlContextMenu.visible = copyMenuItem.visible || cutMenuItem.visible || pasteMenuItem.visible;
+            }
+        }
+
+        MenuItem {
+            id: cutMenuItem
+            colorScheme: root.colorScheme
+            height: visible ? implicitHeight : 0
+            text: qsTr("Cut")
+
+            onClicked: {
+                parentObject.cut()
+            }
+        }
+        MenuItem {
+            id: copyMenuItem
+            colorScheme: root.colorScheme
+            height: visible ? implicitHeight : 0
+            text: qsTr("Copy")
+
+            onTriggered: {
+                parentObject.copy()
+            }
+        }
+        MenuItem {
+            id: pasteMenuItem
+            colorScheme: root.colorScheme
+            height: visible ? implicitHeight : 0
+
+            text: qsTr("Paste")
+            onTriggered: {
+                parentObject.paste()
+            }
+        }
+    }
+
+}

internal/frontend/bridge-gui/bridge-gui/qml/Proton/TextArea.qml

@@ -362,4 +362,9 @@ FocusScope {
             }
         }
     }
+
+    Proton.ContextMenu {
+        parentObject: root
+        colorScheme: root.colorScheme
+    }
 }

internal/frontend/bridge-gui/bridge-gui/qml/Proton/TextField.qml

@@ -331,6 +331,15 @@ FocusScope {
                         x: control.leftPadding
                         y: control.topPadding
                     }
+
+                    Proton.ContextMenu {
+                        parentObject: control
+                        colorScheme: root.colorScheme
+                        isPassword: control.echoMode === TextInput.Password
+                        readOnly: control.readOnly
+                    }
+
+
                 }
                 Proton.Button {
                     id: eyeButton

internal/frontend/bridge-gui/bridge-gui/qml/Proton/qmldir

@@ -39,3 +39,4 @@ TextArea 4.0 TextArea.qml
 TextField 4.0 TextField.qml
 Toggle 4.0 Toggle.qml
 WebFrame 4.0 WebFrame.qml
+ContextMenu 4.0 ContextMenu.qml

internal/frontend/bridge-gui/bridge-gui/qml/SetupWizard/ClientConfigAppleMail.qml

@@ -17,256 +17,77 @@ import QtQuick.Controls
 
 Item {
     id: root
-    enum Screen {
-        CertificateInstall,
-        ProfileInstall
-    }
 
     property var wizard
 
-    signal appleMailAutoconfigCertificateInstallPageShown
-    signal appleMailAutoconfigProfileInstallPageShow
+    property bool profilePaneLaunched: false
 
-    function showAutoconfig() {
-        if (Backend.isTLSCertificateInstalled()) {
-            showProfileInstall();
-        } else {
-            showCertificateInstall();
-        }
-    }
-    function showCertificateInstall() {
-        certificateInstall.reset();
-        stack.currentIndex = ClientConfigAppleMail.Screen.CertificateInstall;
-        appleMailAutoconfigCertificateInstallPageShown();
-    }
-    function showProfileInstall() {
-        profileInstall.reset();
-        stack.currentIndex = ClientConfigAppleMail.Screen.ProfileInstall;
-        appleMailAutoconfigProfileInstallPageShow();
+    function reset() {
+        profilePaneLaunched = false;
     }
 
-    StackLayout {
-        id: stack
-        anchors.fill: parent
+    ColumnLayout {
+        anchors.left: parent.left
+        anchors.right: parent.right
+        anchors.verticalCenter: parent.verticalCenter
+        spacing: ProtonStyle.wizard_spacing_large
 
-        // stack index 0
-        Item {
-            id: certificateInstall
-
-            property string errorString: ""
-            property bool showBugReportLink: false
-            property bool waitingForCert: false
-
-            function clearError() {
-                errorString = "";
-                showBugReportLink = false;
-            }
-            function reset() {
-                waitingForCert = false;
-                clearError();
-            }
-
-            Layout.fillHeight: true
+        ColumnLayout {
             Layout.fillWidth: true
+            spacing: ProtonStyle.wizard_spacing_medium
 
-            ColumnLayout {
-                anchors.left: parent.left
-                anchors.right: parent.right
-                anchors.verticalCenter: parent.verticalCenter
-                spacing: ProtonStyle.wizard_spacing_large
-
-                Connections {
-                    function onCertificateInstallCanceled() {
-                        certificateInstall.waitingForCert = false;
-                        certificateInstall.errorString = qsTr("Apple Mail cannot be configured if you do not install the certificate. Please retry.");
-                        certificateInstall.showBugReportLink = false;
-                    }
-                    function onCertificateInstallFailed() {
-                        certificateInstall.waitingForCert = false;
-                        certificateInstall.errorString = qsTr("An error occurred while installing the certificate.");
-                        certificateInstall.showBugReportLink = true;
-                    }
-                    function onCertificateInstallSuccess() {
-                        certificateInstall.reset();
-                        root.showAutoconfig();
-                    }
-
-                    target: Backend
-                }
-                ColumnLayout {
-                    Layout.fillWidth: true
-                    spacing: ProtonStyle.wizard_spacing_medium
-
-                    Label {
-                        Layout.alignment: Qt.AlignHCenter
-                        Layout.fillWidth: true
-                        colorScheme: wizard.colorScheme
-                        horizontalAlignment: Text.AlignHCenter
-                        text: qsTr("Install the bridge certificate")
-                        type: Label.LabelType.Title
-                        wrapMode: Text.WordWrap
-                    }
-                    Label {
-                        Layout.alignment: Qt.AlignHCenter
-                        Layout.fillWidth: true
-                        color: colorScheme.text_weak
-                        colorScheme: wizard.colorScheme
-                        horizontalAlignment: Text.AlignHCenter
-                        text: qsTr("After clicking on the button below, a system pop-up will ask you for your credentials, please enter your macOS user credentials (not your Proton account’s) and validate.")
-                        type: Label.LabelType.Body
-                        wrapMode: Text.WordWrap
-                    }
-                }
-                Image {
-                    Layout.alignment: Qt.AlignHCenter
-                    height: 182
-                    opacity: certificateInstall.waitingForCert ? 0.3 : 1.0
-                    source: "/qml/icons/img-macos-cert-screenshot.png"
-                    width: 140
-                }
-                ColumnLayout {
-                    Layout.fillWidth: true
-                    spacing: ProtonStyle.wizard_spacing_medium
-
-                    Button {
-                        Layout.fillWidth: true
-                        colorScheme: wizard.colorScheme
-                        enabled: !certificateInstall.waitingForCert
-                        loading: certificateInstall.waitingForCert
-                        text: qsTr("Install the certificate")
-
-                        onClicked: {
-                            certificateInstall.clearError();
-                            certificateInstall.waitingForCert = true;
-                            Backend.installTLSCertificate();
-                        }
-                    }
-                    Button {
-                        Layout.fillWidth: true
-                        colorScheme: wizard.colorScheme
-                        enabled: !certificateInstall.waitingForCert
-                        secondary: true
-                        text: qsTr("Cancel")
-
-                        onClicked: {
-                            wizard.closeWizard();
-                        }
-                    }
-                    ColumnLayout {
-                        Layout.fillWidth: true
-                        spacing: ProtonStyle.wizard_spacing_small
-
-                        RowLayout {
-                            Layout.fillWidth: true
-                            spacing: ProtonStyle.wizard_spacing_extra_small
-
-                            ColorImage {
-                                color: wizard.colorScheme.signal_danger
-                                height: errorLabel.lineHeight
-                                source: "/qml/icons/ic-exclamation-circle-filled.svg"
-                                sourceSize.height: errorLabel.lineHeight
-                                visible: certificateInstall.errorString.length > 0
-                            }
-                            Label {
-                                id: errorLabel
-                                Layout.fillWidth: true
-                                color: wizard.colorScheme.signal_danger
-                                colorScheme: wizard.colorScheme
-                                horizontalAlignment: Text.AlignHCenter
-                                text: certificateInstall.errorString
-                                type: Label.LabelType.Body_semibold
-                                wrapMode: Text.WordWrap
-                            }
-                        }
-                        LinkLabel {
-                            Layout.alignment: Qt.AlignHCenter
-                            callback: wizard.showBugReport
-                            colorScheme: wizard.colorScheme
-                            link: "#"
-                            text: qsTr("Report the problem")
-                            visible: certificateInstall.showBugReportLink
-                        }
-                    }
-                }
+            Label {
+                Layout.alignment: Qt.AlignHCenter
+                Layout.fillWidth: true
+                colorScheme: wizard.colorScheme
+                horizontalAlignment: Text.AlignHCenter
+                text: qsTr("Install the profile")
+                type: Label.LabelType.Title
+                wrapMode: Text.WordWrap
+            }
+            Label {
+                Layout.alignment: Qt.AlignHCenter
+                Layout.fillWidth: true
+                color: colorScheme.text_weak
+                colorScheme: wizard.colorScheme
+                horizontalAlignment: Text.AlignHCenter
+                text: qsTr("A system pop-up will appear. Double click on the entry with your email, and click ’Install’ in the dialog that appears.")
+                type: Label.LabelType.Body
+                wrapMode: Text.WordWrap
             }
         }
-        // stack index 1
-        Item {
-            id: profileInstall
-
-            property bool profilePaneLaunched: false
-
-            function reset() {
-                profilePaneLaunched = false;
-            }
-
-            Layout.fillHeight: true
+        Image {
+            Layout.alignment: Qt.AlignHCenter
+            height: 102
+            source: "/qml/icons/img-macos-profile-screenshot.png"
+            width: 364
+        }
+        ColumnLayout {
             Layout.fillWidth: true
+            spacing: ProtonStyle.wizard_spacing_medium
 
-            ColumnLayout {
-                anchors.left: parent.left
-                anchors.right: parent.right
-                anchors.verticalCenter: parent.verticalCenter
-                spacing: ProtonStyle.wizard_spacing_large
+            Button {
+                Layout.fillWidth: true
+                colorScheme: wizard.colorScheme
+                text: profilePaneLaunched ? qsTr("I have installed the profile") : qsTr("Install the profile")
 
-                ColumnLayout {
-                    Layout.fillWidth: true
-                    spacing: ProtonStyle.wizard_spacing_medium
-
-                    Label {
-                        Layout.alignment: Qt.AlignHCenter
-                        Layout.fillWidth: true
-                        colorScheme: wizard.colorScheme
-                        horizontalAlignment: Text.AlignHCenter
-                        text: qsTr("Install the profile")
-                        type: Label.LabelType.Title
-                        wrapMode: Text.WordWrap
-                    }
-                    Label {
-                        Layout.alignment: Qt.AlignHCenter
-                        Layout.fillWidth: true
-                        color: colorScheme.text_weak
-                        colorScheme: wizard.colorScheme
-                        horizontalAlignment: Text.AlignHCenter
-                        text: qsTr("A system pop-up will appear. Double click on the entry with your email, and click ’Install’ in the dialog that appears.")
-                        type: Label.LabelType.Body
-                        wrapMode: Text.WordWrap
+                onClicked: {
+                    if (profilePaneLaunched) {
+                        wizard.showClientConfigEnd();
+                    } else {
+                        wizard.user.configureAppleMail(wizard.address);
+                        profilePaneLaunched = true;
                     }
                 }
-                Image {
-                    Layout.alignment: Qt.AlignHCenter
-                    height: 102
-                    source: "/qml/icons/img-macos-profile-screenshot.png"
-                    width: 364
-                }
-                ColumnLayout {
-                    Layout.fillWidth: true
-                    spacing: ProtonStyle.wizard_spacing_medium
+            }
+            Button {
+                Layout.fillWidth: true
+                colorScheme: wizard.colorScheme
+                secondary: true
+                text: qsTr("Cancel")
 
-                    Button {
-                        Layout.fillWidth: true
-                        colorScheme: wizard.colorScheme
-                        text: profileInstall.profilePaneLaunched ? qsTr("I have installed the profile") : qsTr("Install the profile")
-
-                        onClicked: {
-                            if (profileInstall.profilePaneLaunched) {
-                                wizard.showClientConfigEnd();
-                            } else {
-                                wizard.user.configureAppleMail(wizard.address);
-                                profileInstall.profilePaneLaunched = true;
-                            }
-                        }
-                    }
-                    Button {
-                        Layout.fillWidth: true
-                        colorScheme: wizard.colorScheme
-                        secondary: true
-                        text: qsTr("Cancel")
-
-                        onClicked: {
-                            wizard.closeWizard();
-                        }
-                    }
+                onClicked: {
+                    wizard.closeWizard();
                 }
             }
         }

internal/frontend/bridge-gui/bridge-gui/qml/SetupWizard/ClientConfigCertInstall.qml

@@ -0,0 +1,153 @@
+// Copyright (c) 2024 Proton AG
+// This file is part of Proton Mail Bridge.
+// Proton Mail Bridge is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+// Proton Mail Bridge is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+// You should have received a copy of the GNU General Public License
+// along with Proton Mail Bridge. If not, see <https://www.gnu.org/licenses/>.
+
+import QtQml
+import QtQuick
+import QtQuick.Layouts
+import QtQuick.Controls
+
+Item {
+    id: root
+
+    property string errorString: ""
+    property bool showBugReportLink: false
+    property bool waitingForCert: false
+    property var wizard
+
+    function clearError() {
+        errorString = "";
+        showBugReportLink = false;
+    }
+    function reset() {
+        waitingForCert = false;
+        clearError();
+    }
+
+    ColumnLayout {
+        anchors.left: parent.left
+        anchors.right: parent.right
+        anchors.verticalCenter: parent.verticalCenter
+        spacing: ProtonStyle.wizard_spacing_large
+
+        Connections {
+            function onCertificateInstallCanceled() {
+                root.waitingForCert = false;
+                root.errorString = qsTr("%1 cannot be configured if you do not install the certificate. Please retry.").arg(wizard.clientName());
+                root.showBugReportLink = false;
+            }
+            function onCertificateInstallFailed() {
+                root.waitingForCert = false;
+                root.errorString = qsTr("An error occurred while installing the certificate.");
+                root.showBugReportLink = true;
+            }
+
+
+            target: Backend
+        }
+        ColumnLayout {
+            Layout.fillWidth: true
+            spacing: ProtonStyle.wizard_spacing_medium
+
+            Label {
+                Layout.alignment: Qt.AlignHCenter
+                Layout.fillWidth: true
+                colorScheme: wizard.colorScheme
+                horizontalAlignment: Text.AlignHCenter
+                text: qsTr("Install the bridge certificate")
+                type: Label.LabelType.Title
+                wrapMode: Text.WordWrap
+            }
+            Label {
+                Layout.alignment: Qt.AlignHCenter
+                Layout.fillWidth: true
+                color: colorScheme.text_weak
+                colorScheme: wizard.colorScheme
+                horizontalAlignment: Text.AlignHCenter
+                text: qsTr("After clicking on the button below, a system pop-up will ask you for your credentials, please enter your macOS user credentials (not your Proton account’s) and validate.")
+                type: Label.LabelType.Body
+                wrapMode: Text.WordWrap
+            }
+        }
+        Image {
+            Layout.alignment: Qt.AlignHCenter
+            height: 182
+            opacity: root.waitingForCert ? 0.3 : 1.0
+            source: "/qml/icons/img-macos-cert-screenshot.png"
+            width: 140
+        }
+        ColumnLayout {
+            Layout.fillWidth: true
+            spacing: ProtonStyle.wizard_spacing_medium
+
+            Button {
+                Layout.fillWidth: true
+                colorScheme: wizard.colorScheme
+                enabled: !root.waitingForCert
+                loading: root.waitingForCert
+                text: qsTr("Install the certificate")
+
+                onClicked: {
+                    root.clearError();
+                    root.waitingForCert = true;
+                    Backend.installTLSCertificate();
+                }
+            }
+            Button {
+                Layout.fillWidth: true
+                colorScheme: wizard.colorScheme
+                enabled: !root.waitingForCert
+                secondary: true
+                text: qsTr("Cancel")
+
+                onClicked: {
+                    wizard.closeWizard();
+                }
+            }
+            ColumnLayout {
+                Layout.fillWidth: true
+                spacing: ProtonStyle.wizard_spacing_small
+
+                RowLayout {
+                    Layout.fillWidth: true
+                    spacing: ProtonStyle.wizard_spacing_extra_small
+
+                    ColorImage {
+                        color: wizard.colorScheme.signal_danger
+                        height: errorLabel.lineHeight
+                        source: "/qml/icons/ic-exclamation-circle-filled.svg"
+                        sourceSize.height: errorLabel.lineHeight
+                        visible: root.errorString.length > 0
+                    }
+                    Label {
+                        id: errorLabel
+                        Layout.fillWidth: true
+                        color: wizard.colorScheme.signal_danger
+                        colorScheme: wizard.colorScheme
+                        horizontalAlignment: Text.AlignHCenter
+                        text: root.errorString
+                        type: Label.LabelType.Body_semibold
+                        wrapMode: Text.WordWrap
+                    }
+                }
+                LinkLabel {
+                    Layout.alignment: Qt.AlignHCenter
+                    callback: wizard.showBugReport
+                    colorScheme: wizard.colorScheme
+                    link: "#"
+                    text: qsTr("Report the problem")
+                    visible: root.showBugReportLink
+                }
+            }
+        }
+    }
+}

internal/frontend/bridge-gui/bridge-gui/qml/SetupWizard/ClientConfigSelector.qml

@@ -47,6 +47,10 @@ Item {
 
             onClicked: {
                 wizard.client = SetupWizard.Client.AppleMail;
+                if (!Backend.isTLSCertificateInstalled()) {
+                    wizard.showCertInstall();
+                    return
+                }
                 wizard.showAppleMailAutoConfig();
             }
         }
@@ -59,6 +63,10 @@ Item {
 
             onClicked: {
                 wizard.client = SetupWizard.Client.MicrosoftOutlook;
+                if (root.onMacOS && !Backend.isTLSCertificateInstalled()) {
+                    wizard.showCertInstall();
+                    return
+                }
                 wizard.showClientParams();
             }
         }

internal/frontend/bridge-gui/bridge-gui/qml/SetupWizard/LeftPane.qml

@@ -34,13 +34,23 @@ Item {
 
     signal startSetup()
 
-    function showAppleMailAutoconfigCertificateInstall() {
-        showAppleMailAutoconfigCommon();
-        descriptionLabel.text = qsTr("Apple Mail configuration is mostly automated, but in order to work, Bridge needs to install a certificate in your keychain.");
-        linkLabel1.setCallback(function() { Backend.openExternalLink("https://proton.me/support/apple-mail-certificate"); }, qsTr("Why is this certificate needed?"), true);
+    function showCertificateInstall() {
+        showClientConfigCommon();
+        if (wizard.client === SetupWizard.Client.AppleMail) {
+            descriptionLabel.text = qsTr("Apple Mail configuration is mostly automated, but in order to work, Bridge needs to install a certificate in your keychain.");
+            linkLabel1.setCallback(function () {
+                Backend.openExternalLink("https://proton.me/support/apple-mail-certificate");
+            }, qsTr("Why is this certificate needed?"), true);
+        } else {
+            descriptionLabel.text = qsTr("In order for Outlook to work, Bridge needs to install a certificate in your keychain.");
+            linkLabel1.setCallback(function () {
+                Backend.openExternalLink("https://proton.me/support/apple-mail-certificate");
+            }, qsTr("Why is this certificate needed?"), true);
+        }
         linkLabel2.clear();
     }
-    function showAppleMailAutoconfigCommon() {
+
+    function showClientConfigCommon() {
         titleLabel.text = "";
         linkLabel1.clear();
         linkLabel2.clear();
@@ -49,7 +59,7 @@ Item {
         iconWidth = 80;
     }
     function showAppleMailAutoconfigProfileInstall() {
-        showAppleMailAutoconfigCommon();
+        showClientConfigCommon();
         descriptionLabel.text = qsTr("The final step before you can start using Apple Mail is to install the Bridge server profile in the system preferences.\n\nAdding a server profile is necessary to ensure that your Mac can receive and send Proton Mails.");
         linkLabel1.setCallback(function() { Backend.openExternalLink("https://proton.me/support/macos-certificate-warning"); }, qsTr("Why is there a yellow warning sign?"), true);
         linkLabel2.setCallback(wizard.showClientParams, qsTr("Configure Apple Mail manually"), false);

internal/frontend/bridge-gui/bridge-gui/qml/SetupWizard/Login.qml

@@ -20,12 +20,14 @@ FocusScope {
     enum RootStack {
         Login,
         TOTP,
-        MailboxPassword
+        MailboxPassword,
+        HV
     }
 
     property alias currentIndex: stackLayout.currentIndex
     property alias username: usernameTextField.text
     property var wizard
+    property string hvLinkUrl: ""
 
     signal loginAbort(string username, bool wasSignedOut)
 
@@ -47,6 +49,14 @@ FocusScope {
         passwordTextField.hidePassword();
         secondPasswordTextField.hidePassword();
     }
+    function resetViaHv() {
+        usernameTextField.enabled = false;
+        passwordTextField.enabled = false;
+        signInButton.loading = true;
+        secondPasswordButton.loading = false;
+        secondPasswordTextField.enabled = true;
+        totpLayout.reset();
+    }
 
     StackLayout {
         id: stackLayout
@@ -124,6 +134,18 @@ FocusScope {
                 else
                     errorLabel.text = qsTr("Incorrect login credentials");
             }
+            function onLoginHvRequested(hvUrl) {
+                console.assert(stackLayout.currentIndex === Login.RootStack.Login || stackLayout.currentIndex === Login.RootStack.MailboxPassword, "Unexpected loginHvRequested");
+                stackLayout.currentIndex = Login.RootStack.HV;
+                hvUsernameLabel.text = usernameTextField.text;
+                hvLinkUrl = hvUrl;
+            }
+            function onLoginHvError(_) {
+                console.assert(stackLayout.currentIndex === Login.RootStack.Login || stackLayout.currentIndex === Login.RootStack.MailboxPassword, "Unexpected onLoginHvInvalidTokenError");
+                stackLayout.currentIndex = Login.RootStack.Login;
+                root.resetViaHv();
+                root.reset()
+            }
 
             target: Backend
         }
@@ -475,5 +497,112 @@ FocusScope {
                 }
             }
         }
+        Item {
+            id: hvLayout
+
+            ColumnLayout {
+                Layout.fillWidth: true
+                anchors.left: parent.left
+                anchors.right: parent.right
+                anchors.verticalCenter: parent.verticalCenter
+                spacing: ProtonStyle.wizard_spacing_extra_large
+
+                ColumnLayout {
+                    spacing: ProtonStyle.wizard_spacing_medium
+
+                    ColumnLayout {
+                        spacing: ProtonStyle.wizard_spacing_small
+
+                        Label {
+                            Layout.alignment: Qt.AlignHCenter
+                            Layout.fillWidth: true
+                            colorScheme: wizard.colorScheme
+                            horizontalAlignment: Text.AlignHCenter
+                            text: qsTr("Human verification")
+                            type: Label.LabelType.Title
+                            wrapMode: Text.WordWrap
+                        }
+
+                        Label {
+                            id: hvUsernameLabel
+                            Layout.alignment: Qt.AlignHCenter
+                            Layout.fillWidth: true
+                            color: wizard.colorScheme.text_weak
+                            colorScheme: wizard.colorScheme
+                            horizontalAlignment: Text.AlignHCenter
+                            type: Label.LabelType.Body
+                        }
+
+                    }
+
+                    Label {
+                        Layout.alignment: Qt.AlignHCenter
+                        Layout.fillWidth: true
+                        colorScheme: wizard.colorScheme
+                        horizontalAlignment: Text.AlignHCenter
+                        text: qsTr("Please open the following link in your favourite web browser to verify you are human.")
+                        type: Label.LabelType.Body
+                        wrapMode: Text.WordWrap
+                    }
+
+                }
+
+
+                Label {
+                    id: hvRequestedUrlText
+                    type: Label.LabelType.Lead
+                    Layout.alignment: Qt.AlignHCenter
+                    Layout.fillWidth: true
+                    colorScheme: wizard.colorScheme
+                    horizontalAlignment: Text.AlignLeft
+                    text: "<a href='" + hvLinkUrl + "'>" + hvLinkUrl.replace("&", "&amp;")+ "</a>"
+                    MouseArea {
+                        anchors.fill: parent
+                        cursorShape: Qt.PointingHandCursor
+                        onClicked: {
+                            Qt.openUrlExternally(hvLinkUrl);
+                        }
+                    }
+                }
+
+
+                ColumnLayout {
+                    spacing: ProtonStyle.wizard_spacing_medium
+
+                    Button {
+                        id: hVContinueButton
+                        Layout.fillWidth: true
+                        colorScheme: wizard.colorScheme
+                        text: qsTr("Continue")
+
+                        function checkAndSignInHv() {
+                            console.assert(stackLayout.currentIndex === Login.RootStack.HV ||  stackLayout.currentIndex === Login.RootStack.MailboxPassword, "Unexpected checkInAndSignInHv")
+                            stackLayout.currentIndex = Login.RootStack.Login
+                            usernameTextField.validate();
+                            passwordTextField.validate();
+                            if (usernameTextField.error || passwordTextField.error) {
+                                return;
+                            }
+                            root.resetViaHv();
+                            Backend.loginHv(usernameTextField.text, Qt.btoa(passwordTextField.text));
+                        }
+
+                        onClicked: {
+                            checkAndSignInHv()
+                        }
+                    }
+                    Button {
+                        Layout.fillWidth: true
+                        colorScheme: wizard.colorScheme
+                        secondary: true
+                        secondaryIsOpaque: true
+                        text: qsTr("Cancel")
+                        onClicked: {
+                            root.abort();
+                        }
+                    }
+                }
+            }
+        }
     }
 }

internal/frontend/bridge-gui/bridge-gui/qml/SetupWizard/SetupWizard.qml

@@ -27,6 +27,7 @@ Item {
         Onboarding,
         Login,
         ClientConfigSelector,
+        ClientConfigCertInstall,
         ClientConfigAppleMail
     }
     enum RootStack {
@@ -95,8 +96,9 @@ Item {
     function showAppleMailAutoConfig() {
         backAction = _showClientConfig;
         rootStackLayout.currentIndex = SetupWizard.RootStack.TwoPanesView;
+        clientConfigAppleMail.reset()
         rightContent.currentIndex = SetupWizard.ContentStack.ClientConfigAppleMail;
-        clientConfigAppleMail.showAutoconfig(); // This will trigger signals that will display the appropriate left content.
+        leftContent.showAppleMailAutoconfigProfileInstall();
     }
     function showBugReport() {
         closeWizard();
@@ -118,6 +120,15 @@ Item {
         backAction = _showClientConfig;
         rootStackLayout.currentIndex = SetupWizard.RootStack.ClientConfigParameters;
     }
+
+    function showCertInstall() {
+        backAction = _showClientConfig;
+        clientConfigCertInstall.reset();
+        rootStackLayout.currentIndex = SetupWizard.RootStack.TwoPanesView;
+        leftContent.showCertificateInstall()
+        rightContent.currentIndex = SetupWizard.ContentStack.ClientConfigCertInstall;
+    }
+
     function showLogin(username = "") {
         backAction = null;
         rootStackLayout.currentIndex = SetupWizard.RootStack.TwoPanesView;
@@ -146,7 +157,13 @@ Item {
             let address = user ? user.addresses[0] : "";
             showClientConfig(user, address, true);
         }
-
+        function onCertificateInstallSuccess() {
+            if (client === SetupWizard.Client.MicrosoftOutlook) {
+                showClientParams()
+            } else {
+                showAppleMailAutoConfig()
+            }
+        }
         target: Backend
     }
     StackLayout {
@@ -176,17 +193,6 @@ Item {
                     width: ProtonStyle.wizard_pane_width
                     wizard: root
 
-                    Connections {
-                        function onAppleMailAutoconfigCertificateInstallPageShown() {
-                            leftContent.showAppleMailAutoconfigCertificateInstall();
-                        }
-                        function onAppleMailAutoconfigProfileInstallPageShow() {
-                            leftContent.showAppleMailAutoconfigProfileInstall();
-                        }
-
-                        target: clientConfigAppleMail
-                    }
-
                     Connections {
                         function onLogin2FARequested() {
                             leftContent.showLogin2FA();
@@ -247,7 +253,14 @@ Item {
                         id: clientConfigSelector
                         wizard: root
                     }
+
                     // rightContent stack index 3
+                    ClientConfigCertInstall {
+                        id: clientConfigCertInstall
+                        wizard: root
+                    }
+
+                    // rightContent stack index 4
                     ClientConfigAppleMail {
                         id: clientConfigAppleMail
                         wizard: root

internal/frontend/bridge-gui/bridge-gui/qml/UserNotificationDialog.qml

@@ -0,0 +1,120 @@
+// Copyright (c) 2024 Proton AG
+// This file is part of Proton Mail Bridge.
+// Proton Mail Bridge is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+// Proton Mail Bridge is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+// You should have received a copy of the GNU General Public License
+// along with Proton Mail Bridge. If not, see <https://www.gnu.org/licenses/>.
+import QtQml
+import QtQuick
+import QtQuick.Layouts
+import QtQuick.Controls
+import Proton
+import Notifications
+
+Dialog {
+    id: root
+
+    property var notification
+    property bool isUserNotification: true
+    padding: 40
+
+    modal: true
+    shouldShow: notification && notification.active && !notification.dismissed
+
+    ColumnLayout {
+        spacing: 0
+
+        Image {
+            Layout.alignment: Qt.AlignHCenter
+            Layout.bottomMargin: 16
+            Layout.preferredHeight: 64
+            Layout.preferredWidth: 64
+            source: {
+                if (!root.notification) {
+                    return "";
+                }
+                switch (root.notification.type) {
+                    case Notification.NotificationType.UserNotification:
+                        return "/qml/icons/ic-notification-bell.svg"
+                }
+            }
+            sourceSize.height: 64
+            sourceSize.width: 64
+            visible: source != ""
+        }
+        // Title Label
+        Label {
+            Layout.alignment: Qt.AlignHCenter
+            Layout.bottomMargin: 4
+            Layout.preferredWidth: 320
+            colorScheme: root.colorScheme
+            horizontalAlignment: Text.AlignHCenter
+            text: root.notification.title
+            wrapMode: Text.WordWrap
+            type: Label.LabelType.Title
+        }
+        // Username or primary email
+        Label {
+            Layout.alignment: Qt.AlignHCenter
+            Layout.bottomMargin: 24
+            Layout.preferredWidth: 320
+            colorScheme: root.colorScheme
+            horizontalAlignment: Text.AlignHCenter
+            text: root.notification.username
+            wrapMode: Text.WordWrap
+            visible: root.notification.username.length > 0
+            type: Label.LabelType.Caption
+        }
+        // Subtitle
+        Label {
+            Layout.alignment: Qt.AlignHCenter
+            Layout.bottomMargin: 24
+            Layout.fillWidth: true
+            Layout.preferredWidth: 320
+            colorScheme: root.colorScheme
+            horizontalAlignment: Text.AlignHCenter
+            text: root.notification.subtitle
+            wrapMode: Text.WordWrap
+            visible: root.notification.subtitle.length > 0
+            type: Label.LabelType.Lead
+            color: root.colorScheme.text_weak
+        }
+        Label {
+            Layout.bottomMargin: 24
+            Layout.fillWidth: true
+            Layout.preferredWidth: 320
+            colorScheme: root.colorScheme
+            horizontalAlignment: Text.AlignHCenter
+            text: root.notification.description
+            type: Label.LabelType.Body
+            wrapMode: Text.WordWrap
+
+            onLinkActivated: function (link) {
+                Backend.openExternalLink(link);
+            }
+        }
+
+
+        ColumnLayout {
+            spacing: 40
+
+            Repeater {
+                model: root.notification.action
+
+                delegate: Button {
+                    Layout.fillWidth: true
+                    action: modelData
+                    colorScheme: root.colorScheme
+                    loading: modelData.loading
+                    secondary: index > 0
+                }
+            }
+        }
+    }
+}

internal/frontend/bridge-gui/bridge-gui/qml/icons/ic-notification-bell.svg

@@ -0,0 +1,37 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="64" height="64" fill="none" viewBox="0 0 64 64">
+    <g clip-path="url(#a)">
+        <circle cx="13.031" cy="5.288" r="3.166" fill="#2C83DC" transform="rotate(-30 13.031 5.288)"/>
+        <path fill="url(#b)" d="M3.599 27.28A19.757 19.757 0 0 1 36.793 8.115L53.92 25.808a12.42 12.42 0 0 0 4.581 2.998c3.454 1.288 5.556 4.214 3.201 7.05-2.76 3.325-8.795 8.475-21.796 15.981S19.428 61.994 15.169 62.723c-3.634.621-5.117-2.662-4.506-6.298a12.422 12.422 0 0 0-.306-5.466L3.6 27.28Z"/>
+        <path fill="url(#c)" d="M3.599 27.28A19.757 19.757 0 0 1 36.793 8.115L53.92 25.808a12.42 12.42 0 0 0 4.581 2.998c3.454 1.288 5.556 4.214 3.201 7.05-2.76 3.325-8.795 8.475-21.796 15.981S19.428 61.994 15.169 62.723c-3.634.621-5.117-2.662-4.506-6.298a12.422 12.422 0 0 0-.306-5.466L3.6 27.28Z"/>
+        <ellipse cx="37.094" cy="46.965" fill="url(#d)" rx="26.875" ry="3.75" transform="rotate(-30 37.094 46.965)"/>
+        <ellipse cx="37.094" cy="46.965" fill="url(#e)" rx="26.875" ry="3.75" transform="rotate(-30 37.094 46.965)"/>
+        <path fill="#fff" fill-opacity=".2" d="m48.156 19.855-2.032-2.1c-6.302 1.79-12.908 4.57-19.41 8.324-7.591 4.383-14.103 9.553-19.19 14.959l.914 3.201c4.88-5.52 11.835-11.152 20.16-15.958 6.703-3.87 13.425-6.704 19.558-8.426Z"/>
+        <circle cx="36.469" cy="45.883" r="2.5" fill="url(#f)" transform="rotate(-30 36.469 45.883)"/>
+    </g>
+    <defs>
+        <linearGradient id="d" x1="49.16" x2="37.094" y1="30.878" y2="49.439" gradientUnits="userSpaceOnUse">
+            <stop stop-color="#256097"/>
+            <stop offset="1" stop-color="#2C83DC"/>
+        </linearGradient>
+        <linearGradient id="e" x1="49.68" x2="49.037" y1="46.478" y2="51.592" gradientUnits="userSpaceOnUse">
+            <stop stop-color="#27ABF4" stop-opacity="0"/>
+            <stop offset="1" stop-color="#27ABF4" stop-opacity=".5"/>
+        </linearGradient>
+        <linearGradient id="f" x1="35.719" x2="36.469" y1="43.133" y2="48.383" gradientUnits="userSpaceOnUse">
+            <stop offset=".345" stop-color="#B2EAFE" stop-opacity="0"/>
+            <stop offset="1" stop-color="#B2EAFE"/>
+        </linearGradient>
+        <radialGradient id="b" cx="0" cy="0" r="1" gradientTransform="rotate(131.347 12.11 6.294) scale(52.6374 54.7116)" gradientUnits="userSpaceOnUse">
+            <stop stop-color="#B2EAFE"/>
+            <stop offset="1" stop-color="#27ABF4"/>
+        </radialGradient>
+        <radialGradient id="c" cx="0" cy="0" r="1" gradientTransform="rotate(60 -23.22 57.501) scale(21.25 76.0937)" gradientUnits="userSpaceOnUse">
+            <stop stop-color="#fff" stop-opacity="0"/>
+            <stop offset=".46" stop-color="#fff" stop-opacity=".4"/>
+            <stop offset=".58" stop-color="#B2EAFE" stop-opacity=".5"/>
+        </radialGradient>
+        <clipPath id="a">
+            <path fill="#fff" d="M0 0h64v64H0z"/>
+        </clipPath>
+    </defs>
+</svg>

internal/frontend/bridge-gui/bridgepp/Test/TestCLI.cpp

@@ -17,22 +17,22 @@
 
 
 #include <bridgepp/CLI/CLIUtils.h>
+#include <bridgepp/SessionID/SessionID.h>
 #include <gtest/gtest.h>
 
 
 using namespace bridgepp;
 
 
-
 //****************************************************************************************************************************************************
 //
 //****************************************************************************************************************************************************
 TEST(CLI, stripStringParameterFromCommandLine) {
-    struct Test {
+    struct TestData {
         QStringList input;
         QStringList expectedOutput;
     };
-    QList<Test> const tests = {
+    QList<TestData> const tests = {
         {{}, {}},
         {{ "--a", "-b", "--C" }, { "--a", "-b", "--C" } },
         {{ "--string", "value" }, {} },
@@ -44,7 +44,45 @@ TEST(CLI, stripStringParameterFromCommandLine) {
         {{ "--string", "--string", "value", "-b", "--string"}, { "value", "-b" } },
     };
 
-    for (Test const& test: tests) {
+    for (TestData const& test: tests) {
         EXPECT_EQ(stripStringParameterFromCommandLine("--string", test.input), test.expectedOutput);
     }
 }
+
+
+TEST(CLI, parseGoCLIStringArgument) {
+    struct TestData {
+        QStringList args;
+        QStringList params;
+        QStringList expectedOutput;
+    };
+
+    QList<TestData> const tests = {
+        { {}, {}, {} },
+        { {"-param"}, {"param"}, {} },
+        { {"--param", "1"}, {"param"}, { "1" } },
+        { {"--param", "1","p", "-p", "2", "-flag", "-param=3", "--p=4"}, {"param", "p"}, { "1", "2", "3", "4" } },
+        { {"--param", "--param", "1"}, {"param"}, { "--param" } },
+    };
+
+    for (TestData const& test: tests) {
+        EXPECT_EQ(parseGoCLIStringArgument(test.args, test.params), test.expectedOutput);
+    }
+}
+
+TEST(CLI, cliArgsToStringList) {
+    int constexpr argc = 3;
+    char *argv[] = { const_cast<char *>("1"), const_cast<char *>("2"), const_cast<char *>("3") };
+    QStringList const strList { "1", "2", "3" };
+    EXPECT_EQ(cliArgsToStringList(argc,argv), strList);
+    EXPECT_EQ(cliArgsToStringList(0, nullptr), QStringList {});
+}
+
+TEST(CLI, mostRecentSessionID) {
+    QStringList const sessionIDs { "20220411_155931148", "20230411_155931148", "20240411_155931148" };
+    EXPECT_EQ(mostRecentSessionID({ hyphenatedSessionIDFlag, sessionIDs[0] }), sessionIDs[0]);
+    EXPECT_EQ(mostRecentSessionID({ hyphenatedSessionIDFlag, sessionIDs[1], hyphenatedSessionIDFlag, sessionIDs[2] }), sessionIDs[2]);
+    EXPECT_EQ(mostRecentSessionID({ hyphenatedSessionIDFlag, sessionIDs[2], hyphenatedSessionIDFlag, sessionIDs[1] }), sessionIDs[2]);
+    EXPECT_EQ(mostRecentSessionID({ hyphenatedSessionIDFlag, sessionIDs[1], hyphenatedSessionIDFlag, sessionIDs[2], hyphenatedSessionIDFlag,
+        sessionIDs[0] }), sessionIDs[2]);
+}

internal/frontend/bridge-gui/bridgepp/bridgepp/CLI/CLIUtils.cpp

@@ -16,7 +16,7 @@
 // along with Proton Mail Bridge. If not, see <https://www.gnu.org/licenses/>.
 
 #include "CLIUtils.h"
-
+#include "../SessionID/SessionID.h"
 
 namespace bridgepp {
 
@@ -42,4 +42,67 @@ QStringList stripStringParameterFromCommandLine(QString const &paramName, QStrin
 }
 
 
+//****************************************************************************************************************************************************
+/// The flags may be present more than once in the args. All values are returned in order of appearance.
+///
+/// \param[in] args The arguments
+/// \param[in] paramNames the list of names for the parameter, without any prefix hypen.
+/// \return The values found for the flag.
+//****************************************************************************************************************************************************
+QStringList parseGoCLIStringArgument(QStringList const &args, QStringList const& paramNames) {
+    // go cli package is pretty permissive when it comes to parsing arguments. For each name 'param', all the following seems to be accepted:
+    // -param value
+    // --param value
+    // -param=value
+    // --param=value
+
+    QStringList result;
+    qsizetype const argCount = args.count();
+    for (qsizetype i = 0; i < args.size(); ++i) {
+        for (QString const &paramName: paramNames) {
+            if ((i < argCount - 1) && ((args[i] == "-" + paramName) || (args[i] == "--" + paramName))) {
+                result.append(args[i + 1]);
+                i += 1;
+                continue;
+            }
+            if (QRegularExpressionMatch match = QRegularExpression(QString("^-{1,2}%1=(.+)$").arg(paramName)).match(args[i]); match.hasMatch()) {
+                result.append(match.captured(1));
+                continue;
+            }
+        }
+    }
+
+    return result;
+}
+
+//****************************************************************************************************************************************************
+/// \param[in] argc The number of command-line arguments.
+/// \param[in] argv The list of command-line arguments.
+/// \return A QStringList representing the arguments list.
+//****************************************************************************************************************************************************
+QStringList cliArgsToStringList(int argc, char **argv) {
+    QStringList result;
+    result.reserve(argc);
+    for (qsizetype i = 0; i < argc; ++i) {
+        result.append(QString::fromLocal8Bit(argv[i]));
+    }
+    return result;
+}
+
+//****************************************************************************************************************************************************
+/// \param[in] args The command-line arguments.
+/// \return The most recent sessionID in the list. If the list is empty, a new sessionID is created.
+//****************************************************************************************************************************************************
+    QString mostRecentSessionID(QStringList const& args) {
+    QStringList const sessionIDs = parseGoCLIStringArgument(args, {sessionIDFlag});
+    if (sessionIDs.isEmpty()) {
+        return newSessionID();
+    }
+
+    return *std::max_element(sessionIDs.constBegin(), sessionIDs.constEnd(), [](QString const &lhs, QString const &rhs) -> bool {
+        return sessionIDToDateTime(lhs) < sessionIDToDateTime(rhs);
+    });
+}
+
+
 } // namespace bridgepp

internal/frontend/bridge-gui/bridgepp/bridgepp/CLI/CLIUtils.h

@@ -15,18 +15,16 @@
 // You should have received a copy of the GNU General Public License
 // along with Proton Mail Bridge. If not, see <https://www.gnu.org/licenses/>.
 
-
 #ifndef BRIDGEPP_CLI_UTILS_H
 #define BRIDGEPP_CLI_UTILS_H
 
-
 namespace bridgepp {
 
-
 QStringList stripStringParameterFromCommandLine(QString const &paramName, QStringList const &commandLineParams); ///< Remove a string parameter from a list of command-line parameters.
-
+QStringList parseGoCLIStringArgument(QStringList const &args, QStringList const &paramNames); ///< Parse a command-line string argument as expected by go's CLI package.
+QStringList cliArgsToStringList(int argc, char **argv); ///< Converts C-style command-line arguments to a string list.
+QString mostRecentSessionID(QStringList const& args); ///< Returns the most recent sessionID parsed in command-line arguments.
 
 }
 
-
 #endif // BRIDGEPP_CLI_UTILS_H

internal/frontend/bridge-gui/bridgepp/bridgepp/GRPC/EventFactory.cpp

@@ -302,6 +302,18 @@ SPStreamEvent newLoginTfaRequestedEvent(QString const &username) {
 }
 
 
+//****************************************************************************************************************************************************
+/// \return The event.
+//****************************************************************************************************************************************************
+SPStreamEvent newLoginHvRequestedEvent() {
+        auto event = new ::grpc::LoginHvRequestedEvent;
+        event->set_hvurl("https://verify.proton.me/?methods=captcha&token=SOME_RANDOM_TOKEN");
+        auto loginEvent = new grpc::LoginEvent;
+        loginEvent->set_allocated_hvrequested(event);
+        return wrapLoginEvent(loginEvent);
+}
+
+
 //****************************************************************************************************************************************************
 /// \param[in] username The username.
 /// \return The event.
@@ -717,4 +729,23 @@ SPStreamEvent newGenericErrorEvent(grpc::ErrorCode errorCode) {
 }
 
 
+//****************************************************************************************************************************************************
+/// \param[in] userID The user ID that received the notification.
+/// \param[in] title The title of the notification.
+/// \param[in] subtitle The subtitle of the notification.
+/// \param[in] body The body of the notification.
+/// \return The event.
+//****************************************************************************************************************************************************
+SPStreamEvent newUserNotificationEvent(QString const &userID, QString const title, QString const subtitle, QString const body) {
+    auto event = new grpc::UserNotificationEvent;
+    event->set_userid(userID.toStdString());
+    event->set_body(body.toStdString());
+    event->set_subtitle(subtitle.toStdString());
+    event->set_title(title.toStdString());
+    auto appEvent = new grpc::AppEvent;
+    appEvent->set_allocated_usernotification(event);
+    return wrapAppEvent(appEvent);
+}
+
+
 } // namespace bridgepp

internal/frontend/bridge-gui/bridgepp/bridgepp/GRPC/EventFactory.h

@@ -48,6 +48,7 @@ SPStreamEvent newLoginTfaRequestedEvent(QString const &username); ///< Create a
 SPStreamEvent newLoginTwoPasswordsRequestedEvent(QString const &username); ///< Create a new LoginTwoPasswordsRequestedEvent event.
 SPStreamEvent newLoginFinishedEvent(QString const &userID, bool wasSignedOut); ///< Create a new LoginFinishedEvent event.
 SPStreamEvent newLoginAlreadyLoggedInEvent(QString const &userID); ///< Create a new LoginAlreadyLoggedInEvent event.
+SPStreamEvent newLoginHvRequestedEvent(); ///< Create a new LoginHvRequestedEvent
 
 // Update related events
 SPStreamEvent newUpdateErrorEvent(grpc::UpdateErrorType errorType); ///< Create a new UpdateErrorEvent event.
@@ -93,6 +94,9 @@ SPStreamEvent newSyncProgressEvent(QString const &userID, double progress, qint6
 // Generic error event
 SPStreamEvent newGenericErrorEvent(grpc::ErrorCode errorCode); ///< Create a new GenericErrrorEvent event.
 
+// User notification event
+SPStreamEvent newUserNotificationEvent(QString const &userID, QString const title, QString const subtitle, QString const body);
+
 } // namespace bridgepp
 
 

internal/frontend/bridge-gui/bridgepp/bridgepp/GRPC/GRPCClient.cpp

@@ -23,7 +23,6 @@
 #include "../ProcessMonitor.h"
 #include "../Log/LogUtils.h"
 
-
 using namespace google::protobuf;
 using namespace grpc;
 
@@ -607,6 +606,20 @@ grpc::Status GRPCClient::login(QString const &username, QString const &password)
 }
 
 
+//****************************************************************************************************************************************************
+/// \param[in] username The username.
+/// \param[in] password The password.
+/// \return the status for the gRPC call.
+//****************************************************************************************************************************************************
+grpc::Status GRPCClient::loginHv(QString const &username, QString const &password) {
+        LoginRequest request;
+        request.set_username(username.toStdString());
+        request.set_password(password.toStdString());
+        request.set_usehvdetails(true);
+        return this->logGRPCCallStatus(stub_->Login(this->clientContext().get(), request, &empty), __FUNCTION__);
+    }
+
+
 //****************************************************************************************************************************************************
 /// \param[in] username The username.
 /// \param[in] code The The 2FA code.
@@ -1185,6 +1198,25 @@ void GRPCClient::processAppEvent(AppEvent const &event) {
         emit knowledgeBasSuggestionsReceived(suggestions);
         break;
     }
+    case AppEvent::kRepairStarted:
+        this->logTrace("App event received: RepairStarted.");
+        emit repairStarted();
+        break;
+    case AppEvent::kAllUsersLoaded:
+        this->logTrace("App event received: AllUsersLoaded");
+        emit allUsersLoaded();
+        break;
+    case AppEvent::kUserNotification: {
+        this->logTrace("App event received: UserNotification");
+        UserNotification notification{
+                .title = QString::fromStdString(event.usernotification().title()),
+                .subtitle = QString::fromStdString(event.usernotification().subtitle()),
+                .body = QString::fromStdString(event.usernotification().body()),
+                .userID = QString::fromStdString(event.usernotification().userid()),
+        };
+        emit userNotificationReceived(notification);
+        break;
+    }
     default:
         this->logError("Unknown App event received.");
     }
@@ -1221,6 +1253,9 @@ void GRPCClient::processLoginEvent(LoginEvent const &event) {
         case TWO_PASSWORDS_ABORT:
             emit login2PasswordErrorAbort(QString::fromStdString(error.message()));
             break;
+        case HV_ERROR:
+            emit loginHvError(QString::fromStdString(error.message()));
+            break;
         default:
             this->logError("Unknown login error event received.");
             break;
@@ -1245,6 +1280,10 @@ void GRPCClient::processLoginEvent(LoginEvent const &event) {
         this->logTrace("Login event received: AlreadyLoggedIn.");
         emit loginAlreadyLoggedIn(QString::fromStdString(event.finished().userid()));
         break;
+    case LoginEvent::kHvRequested:
+        this->logTrace("Login event Received: HvRequested");
+        emit loginHvRequested(QString::fromStdString(event.hvrequested().hvurl()));
+        break;
     default:
         this->logError("Unknown Login event received.");
         break;
@@ -1560,5 +1599,12 @@ grpc::Status GRPCClient::externalLinkClicked(QString const &link) {
     return this->logGRPCCallStatus(stub_->ExternalLinkClicked(this->clientContext().get(), s, &empty), __FUNCTION__);
 }
 
+//****************************************************************************************************************************************************
+//
+//****************************************************************************************************************************************************
+grpc::Status GRPCClient::triggerRepair()  {
+    return this->logGRPCCallStatus(stub_->TriggerRepair(this->clientContext().get(), empty, &empty), __FUNCTION__ );
+}
+
 
 } // namespace bridgepp

internal/frontend/bridge-gui/bridgepp/bridgepp/GRPC/GRPCClient.h

@@ -56,6 +56,24 @@ public:
 };
 
 
+//****************************************************************************************************************************************************
+/// \brief A struct for user notitifications.
+//****************************************************************************************************************************************************
+    struct UserNotification {
+        //  The following lines make the type transmissible to QML (but not instanciable there)
+    Q_GADGET
+        Q_PROPERTY(QString title MEMBER title)
+        Q_PROPERTY(QString subtitle MEMBER subtitle)
+        Q_PROPERTY(QString body MEMBER body)
+        Q_PROPERTY(QString userID MEMBER userID)
+    public:
+        QString title; ///< The title of the notification.
+        QString subtitle; ///< The subtitle of the notification.
+        QString body; ///< The body of the notification.
+        QString userID; ///< The userID that received the notification.
+    };
+
+
 //****************************************************************************************************************************************************
 /// \brief gRPC client class. This class encapsulate the gRPC service, abstracting all data type conversions.
 //****************************************************************************************************************************************************
@@ -108,6 +126,7 @@ public: // member functions.
     grpc::Status landingPageLink(QUrl &outUrl); ///< Performs the 'landingPageLink' call.
     grpc::Status hostname(QString &outHostname); ///< Performs the 'Hostname' call.
     grpc::Status requestKnowledgeBaseSuggestions(QString const &input); ///< Performs the 'RequestKnowledgeBaseSuggestions' call.
+    grpc::Status triggerRepair(); ///< Performs the triggerRepair gRPC call.
 
 signals: // app related signals
     void internetStatus(bool isOn);
@@ -122,6 +141,9 @@ signals: // app related signals
     void certificateInstallFailed();
     void showMainWindow();
     void knowledgeBasSuggestionsReceived(QList<KnowledgeBaseSuggestion> const& suggestions);
+    void repairStarted();
+    void allUsersLoaded();
+    void userNotificationReceived(UserNotification const& notification);
 
 
 public: // cache related calls
@@ -155,6 +177,7 @@ public: // login related calls
     grpc::Status login2FA(QString const &username, QString const &code); ///< Performs the 'login2FA' call.
     grpc::Status login2Passwords(QString const &username, QString const &password); ///< Performs the 'login2Passwords' call.
     grpc::Status loginAbort(QString const &username); ///< Performs the 'loginAbort' call.
+    grpc::Status loginHv(QString const &username, QString const &password); ///< Performs the 'login' call with additional useHv flag
 
 signals:
     void loginUsernamePasswordError(QString const &errMsg);
@@ -168,6 +191,8 @@ signals:
     void login2PasswordErrorAbort(QString const &errMsg);
     void loginFinished(QString const &userID, bool wasSignedOut);
     void loginAlreadyLoggedIn(QString const &userID);
+    void loginHvRequested(QString const &hvUrl);
+    void loginHvError(QString const &errMsg);
 
 public: // Update related calls
     grpc::Status checkUpdate();

internal/frontend/bridge-gui/bridgepp/bridgepp/SessionID/SessionID.cpp

@@ -32,6 +32,10 @@ QString const dateTimeFormat = "yyyyMMdd_hhmmsszzz"; ///< The format string for
 namespace bridgepp {
 
 
+QString const sessionIDFlag = "session-id";
+QString const hyphenatedSessionIDFlag = "--" + sessionIDFlag;
+
+
 //****************************************************************************************************************************************************
 /// \return a new session ID based on the current local date/time
 //****************************************************************************************************************************************************

internal/frontend/bridge-gui/bridgepp/bridgepp/SessionID/SessionID.h

@@ -23,6 +23,10 @@
 namespace bridgepp {
 
 
+extern QString const sessionIDFlag; ///< The sessionID command-line flag (without hyphens)
+extern QString const hyphenatedSessionIDFlag; ///< The sessionID command-line flag (with two hyphens)
+
+
 QString newSessionID(); ///< Create a new sessions
 QDateTime sessionIDToDateTime(QString const &sessionID); ///< Parse the date/time from a sessionID.
 

internal/frontend/cli/accounts.go

@@ -19,12 +19,14 @@ package cli
 
 import (
 	"context"
+	"fmt"
 	"strings"
 
 	"github.com/ProtonMail/go-proton-api"
 	"github.com/ProtonMail/proton-bridge/v3/internal/bridge"
 	"github.com/ProtonMail/proton-bridge/v3/internal/certs"
 	"github.com/ProtonMail/proton-bridge/v3/internal/constants"
+	"github.com/ProtonMail/proton-bridge/v3/internal/hv"
 	"github.com/ProtonMail/proton-bridge/v3/internal/vault"
 	"github.com/abiosoft/ishell"
 )
@@ -116,6 +118,13 @@ func (f *frontendCLI) showAccountAddressInfo(user bridge.UserInfo, address strin
 	f.Println("")
 }
 
+func (f *frontendCLI) promptHvURL(details *proton.APIHVDetails) {
+	hvURL := hv.FormatHvURL(details)
+	fmt.Print("\nHuman Verification requested. Please open the URL below in a browser and press ENTER when the challenge has been completed.\n\n", hvURL+"\n")
+	f.ReadLine()
+	fmt.Println("Authenticating ...")
+}
+
 func (f *frontendCLI) loginAccount(c *ishell.Context) {
 	f.ShowPrompt(false)
 	defer f.ShowPrompt(true)
@@ -144,7 +153,19 @@ func (f *frontendCLI) loginAccount(c *ishell.Context) {
 
 	f.Println("Authenticating ... ")
 
-	client, auth, err := f.bridge.LoginAuth(context.Background(), loginName, []byte(password))
+	client, auth, err := f.bridge.LoginAuth(context.Background(), loginName, []byte(password), nil)
+
+	var hvDetails *proton.APIHVDetails
+	hvDetails, hvErr := hv.VerifyAndExtractHvRequest(err)
+	if hvErr != nil || hvDetails != nil {
+		if hvErr != nil {
+			f.printAndLogError("Cannot login", hvErr)
+			return
+		}
+		f.promptHvURL(hvDetails)
+		client, auth, err = f.bridge.LoginAuth(context.Background(), loginName, []byte(password), hvDetails)
+	}
+
 	if err != nil {
 		f.printAndLogError("Cannot login: ", err)
 		return
@@ -175,7 +196,55 @@ func (f *frontendCLI) loginAccount(c *ishell.Context) {
 		keyPass = []byte(password)
 	}
 
-	userID, err := f.bridge.LoginUser(context.Background(), client, auth, keyPass)
+	userID, err := f.bridge.LoginUser(context.Background(), client, auth, keyPass, hvDetails)
+
+	hvDetails, hvErr = hv.VerifyAndExtractHvRequest(err)
+	if hvDetails != nil || hvErr != nil {
+		if hvErr != nil {
+			f.printAndLogError("Cannot login: ", hvErr)
+			return
+		}
+		f.loginAccountHv(c, loginName, password, keyPass, hvDetails)
+		return
+	}
+
+	if err != nil {
+		f.processAPIError(err)
+		return
+	}
+
+	user, err := f.bridge.GetUserInfo(userID)
+	if err != nil {
+		panic(err)
+	}
+
+	f.Printf("Account %s was added successfully.\n", bold(user.Username))
+}
+
+func (f *frontendCLI) loginAccountHv(c *ishell.Context, loginName string, password string, keyPass []byte, hvDetails *proton.APIHVDetails) {
+	f.promptHvURL(hvDetails)
+	client, auth, err := f.bridge.LoginAuth(context.Background(), loginName, []byte(password), hvDetails)
+
+	if err != nil {
+		f.printAndLogError("Cannot login: ", err)
+		return
+	}
+
+	if auth.TwoFA.Enabled&proton.HasTOTP != 0 {
+		code := f.readStringInAttempts("Two factor code", c.ReadLine, isNotEmpty)
+		if code == "" {
+			f.printAndLogError("Cannot login: need two factor code")
+			return
+		}
+
+		if err := client.Auth2FA(context.Background(), proton.Auth2FAReq{TwoFactorCode: code}); err != nil {
+			f.printAndLogError("Cannot login: ", err)
+			return
+		}
+	}
+
+	userID, err := f.bridge.LoginUser(context.Background(), client, auth, keyPass, hvDetails)
+
 	if err != nil {
 		f.processAPIError(err)
 		return

internal/frontend/cli/frontend.go

@@ -20,6 +20,7 @@ package cli
 
 import (
 	"errors"
+	"fmt"
 	"os"
 	"runtime"
 
@@ -306,6 +307,12 @@ func New(
 		Aliases:   []string{"del", "rm", "remove"},
 		Completer: fe.completeUsernames,
 	})
+	fe.AddCmd(&ishell.Cmd{
+		Name:    "repair",
+		Help:    "reload all accounts and cached data, re-download emails. Email clients remain connected. Logged out users will be repaired on next login. (aliases: rep)",
+		Func:    fe.repair,
+		Aliases: []string{"rep"},
+	})
 
 	badEventCmd := &ishell.Cmd{
 		Name: "bad-event",
@@ -494,6 +501,18 @@ func (f *frontendCLI) watchEvents(eventCh <-chan events.Event) { // nolint:gocyc
 
 		case events.Raise:
 			f.Printf("Hello!")
+
+		case events.UserNotification:
+			user, err := f.bridge.GetUserInfo(event.UserID)
+			if err != nil {
+				return
+			}
+
+			fmt.Printf("\n--- NOTIFICATION ---\n\n")
+			fmt.Printf("Sent to: %s\n", user.Username)
+			fmt.Printf("Title: %s\n", event.Title)
+			fmt.Printf("Subtitle: %s\n", event.Subtitle)
+			fmt.Printf("Message: %s\n\n", event.Body)
 		}
 	}
 

internal/frontend/cli/system.go

@@ -359,3 +359,13 @@ func (f *frontendCLI) isFile(location string) bool {
 
 	return !stat.IsDir()
 }
+
+func (f *frontendCLI) repair(_ *ishell.Context) {
+	if f.bridge.HasAPIConnection() {
+		if f.yesNoQuestion("Are you sure you want to initialize a repair, this may take a while") {
+			f.bridge.Repair()
+		}
+	} else {
+		f.Println("Bridge cannot connect to the Proton servers. A connection is required to utilize this feature.")
+	}
+}

internal/frontend/grpc/bridge.proto

@@ -111,6 +111,9 @@ service Bridge {
   // Server -> Client event stream
   rpc RunEventStream(EventStreamRequest) returns (stream StreamEvent); // Keep streaming until StopEventStream is called.
   rpc StopEventStream(google.protobuf.Empty) returns (google.protobuf.Empty);
+
+  // Repair
+  rpc TriggerRepair(google.protobuf.Empty) returns (google.protobuf.Empty);
 }
 
 //**********************************************************************************************************************
@@ -168,6 +171,7 @@ message ReportBugRequest {
 message LoginRequest {
   string username = 1;
   bytes password = 2;
+  optional bool useHvDetails = 3;
 }
 
 message LoginAbortRequest {
@@ -271,6 +275,9 @@ message AppEvent {
     CertificateInstallCanceledEvent certificateInstallCanceled = 10;
     CertificateInstallFailedEvent certificateInstallFailed = 11;
     KnowledgeBaseSuggestionsEvent knowledgeBaseSuggestions = 12;
+    RepairStartedEvent repairStarted = 13;
+    AllUsersLoadedEvent allUsersLoaded = 14;
+    UserNotificationEvent userNotification = 15;
   }
 }
 
@@ -288,6 +295,8 @@ message ReportBugFallbackEvent {}
 message CertificateInstallSuccessEvent {}
 message CertificateInstallCanceledEvent {}
 message CertificateInstallFailedEvent {}
+message RepairStartedEvent {}
+message AllUsersLoadedEvent {}
 
 message KnowledgeBaseSuggestion {
   string url = 1;
@@ -308,6 +317,7 @@ message LoginEvent {
     LoginTwoPasswordsRequestedEvent twoPasswordRequested = 3;
     LoginFinishedEvent finished = 4;
     LoginFinishedEvent alreadyLoggedIn = 5;
+    LoginHvRequestedEvent hvRequested = 6;
   }
 }
 
@@ -319,6 +329,7 @@ enum LoginErrorType {
   TFA_ABORT = 4;
   TWO_PASSWORDS_ERROR = 5;
   TWO_PASSWORDS_ABORT = 6;
+  HV_ERROR = 7;
 }
 
 message LoginErrorEvent {
@@ -339,6 +350,10 @@ message LoginFinishedEvent {
   bool wasSignedOut = 2;
 }
 
+message LoginHvRequestedEvent {
+  string hvUrl = 1;
+}
+
 //**********************************************************
 // Update related events
 //**********************************************************
@@ -531,6 +546,14 @@ message SyncProgressEvent {
   int64 remainingMs = 4;
 }
 
+message UserNotificationEvent {
+  string title = 1;
+  string subtitle = 2;
+  string body = 3;
+  string userID = 4;
+}
+
+
 //**********************************************************
 // Generic errors
 //**********************************************************

internal/frontend/grpc/bridge_grpc.pb.go

@@ -101,6 +101,7 @@ const (
 	Bridge_ExportTLSCertificates_FullMethodName           = "/grpc.Bridge/ExportTLSCertificates"
 	Bridge_RunEventStream_FullMethodName                  = "/grpc.Bridge/RunEventStream"
 	Bridge_StopEventStream_FullMethodName                 = "/grpc.Bridge/StopEventStream"
+	Bridge_TriggerRepair_FullMethodName                   = "/grpc.Bridge/TriggerRepair"
 )
 
 // BridgeClient is the client API for Bridge service.
@@ -180,6 +181,8 @@ type BridgeClient interface {
 	// Server -> Client event stream
 	RunEventStream(ctx context.Context, in *EventStreamRequest, opts ...grpc.CallOption) (Bridge_RunEventStreamClient, error)
 	StopEventStream(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	// Repair
+	TriggerRepair(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*emptypb.Empty, error)
 }
 
 type bridgeClient struct {
@@ -780,6 +783,15 @@ func (c *bridgeClient) StopEventStream(ctx context.Context, in *emptypb.Empty, o
 	return out, nil
 }
 
+func (c *bridgeClient) TriggerRepair(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, Bridge_TriggerRepair_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // BridgeServer is the server API for Bridge service.
 // All implementations must embed UnimplementedBridgeServer
 // for forward compatibility
@@ -857,6 +869,8 @@ type BridgeServer interface {
 	// Server -> Client event stream
 	RunEventStream(*EventStreamRequest, Bridge_RunEventStreamServer) error
 	StopEventStream(context.Context, *emptypb.Empty) (*emptypb.Empty, error)
+	// Repair
+	TriggerRepair(context.Context, *emptypb.Empty) (*emptypb.Empty, error)
 	mustEmbedUnimplementedBridgeServer()
 }
 
@@ -1053,6 +1067,9 @@ func (UnimplementedBridgeServer) RunEventStream(*EventStreamRequest, Bridge_RunE
 func (UnimplementedBridgeServer) StopEventStream(context.Context, *emptypb.Empty) (*emptypb.Empty, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method StopEventStream not implemented")
 }
+func (UnimplementedBridgeServer) TriggerRepair(context.Context, *emptypb.Empty) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method TriggerRepair not implemented")
+}
 func (UnimplementedBridgeServer) mustEmbedUnimplementedBridgeServer() {}
 
 // UnsafeBridgeServer may be embedded to opt out of forward compatibility for this service.
@@ -2203,6 +2220,24 @@ func _Bridge_StopEventStream_Handler(srv interface{}, ctx context.Context, dec f
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Bridge_TriggerRepair_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(emptypb.Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(BridgeServer).TriggerRepair(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Bridge_TriggerRepair_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(BridgeServer).TriggerRepair(ctx, req.(*emptypb.Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // Bridge_ServiceDesc is the grpc.ServiceDesc for Bridge service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -2458,6 +2493,10 @@ var Bridge_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "StopEventStream",
 			Handler:    _Bridge_StopEventStream_Handler,
 		},
+		{
+			MethodName: "TriggerRepair",
+			Handler:    _Bridge_TriggerRepair_Handler,
+		},
 	},
 	Streams: []grpc.StreamDesc{
 		{