fix: Folder limit cannot be empty #97

chore(release): package bichonctl together with bichon binaries
feat(mailbox): support mailbox cleanup #96
2026-08-31 01:52:30 +00:00 · 2026-01-05 21:32:00 +08:00 · 2026-01-05 18:38:34 +08:00 · 2026-01-05 18:27:40 +08:00 · 2026-01-05 14:31:47 +08:00 · 2026-01-05 14:31:04 +08:00
257 changed files with 30594 additions and 4190 deletions
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,6 +6,7 @@ on:
      - '[0-9]+.[0-9]+.[0-9]+'
 env:
  BINARY_NAME: bichon
+  BINARY_CTL: bichonctl

 permissions:
  contents: write
@@ -34,6 +35,22 @@ jobs:
      - name: Checkout code
        uses: actions/checkout@v4

+      - name: Verify Cargo.toml version matches git tag
+        shell: bash
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME}"
+
+          CARGO_VERSION=$(grep '^version' Cargo.toml | head -n1 | cut -d '"' -f2)
+
+          echo "Git tag version:    $TAG_VERSION"
+          echo "Cargo.toml version: $CARGO_VERSION"
+
+          if [ "$TAG_VERSION" != "$CARGO_VERSION" ]; then
+            echo "::error::Version mismatch! Git tag ($TAG_VERSION) does not match Cargo.toml version ($CARGO_VERSION)"
+            exit 1
+          fi
+
+
      - name: Install Rust
        uses: actions-rs/toolchain@v1
        with:
@@ -75,6 +92,7 @@ jobs:
        if: matrix.os != 'windows-latest' && matrix.target != 'aarch64-unknown-linux-gnu'
        run: |
          strip target/${{ matrix.target }}/release/${{ env.BINARY_NAME }}
+          strip target/${{ matrix.target }}/release/${{ env.BINARY_CTL }}

      - name: Pack artifact (Linux/macOS)
        if: matrix.os != 'windows-latest'
@@ -83,7 +101,8 @@ jobs:
          mkdir -p release
          BINARY="target/${{ matrix.target }}/release/${{ env.BINARY_NAME }}"
          cp README.md LICENSE release/
-          cp "$BINARY" release/
+          cp target/${{ matrix.target }}/release/${{ env.BINARY_NAME }} release/
+          cp target/${{ matrix.target }}/release/${{ env.BINARY_CTL }} release/
          tar -czvf "${{ env.BINARY_NAME }}-${{ github.ref_name }}-${{ matrix.target }}.tar.gz" -C release .
          mv "${{ env.BINARY_NAME }}-${{ github.ref_name }}-${{ matrix.target }}.tar.gz" release/

@@ -99,10 +118,13 @@ jobs:
        shell: pwsh
        run: |
          mkdir -p release
-          $BINARY = "target/${{ matrix.target }}/release/${{ env.BINARY_NAME }}.exe"
-          Copy-Item -Path $BINARY -Destination release/
+
+          Copy-Item "target/${{ matrix.target }}/release/${{ env.BINARY_NAME }}.exe" release/
+          Copy-Item "target/${{ matrix.target }}/release/${{ env.BINARY_CTL }}.exe" release/
+
          Copy-Item -Path README.md -Destination release/
          Copy-Item -Path LICENSE -Destination release/
+          
          Compress-Archive -Path release\* -DestinationPath "release/${{ env.BINARY_NAME }}-${{ github.ref_name }}-${{ matrix.target }}.zip" -Force

      - name: Upload build artifact
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -424,7 +424,7 @@ dependencies = [

 [[package]]
 name = "bichon"
-version = "0.1.1"
+version = "0.3.0"
 dependencies = [
 "ahash",
 "async-imap",
@@ -435,7 +435,9 @@ dependencies = [
 "cacache",
 "chrono",
 "clap",
+ "console",
 "dashmap",
+ "dialoguer",
 "email_address",
 "encoding_rs",
 "futures",
@@ -449,6 +451,7 @@ dependencies = [
 "itoa",
 "lru 0.16.2",
 "mail-parser",
+ "memmap2 0.9.9",
 "mimalloc",
 "mime_guess",
 "murmur3",
@@ -480,6 +483,7 @@ dependencies = [
 "tokio-io-timeout",
 "tokio-rustls",
 "tokio-socks",
+ "toml",
 "tracing",
 "tracing-appender",
 "tracing-subscriber",
@@ -815,6 +819,19 @@ dependencies = [
 "crossbeam-utils",
 ]

+[[package]]
+name = "console"
+version = "0.16.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03e45a4a8926227e4197636ba97a9fc9b00477e9f4bd711395687c5f0734bec4"
+dependencies = [
+ "encode_unicode",
+ "libc",
+ "once_cell",
+ "unicode-width 0.2.2",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "const_fn"
 version = "0.4.11"
@@ -1089,6 +1106,18 @@ dependencies = [
 "unicode-xid",
 ]

+[[package]]
+name = "dialoguer"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25f104b501bf2364e78d0d3974cbc774f738f5865306ed128e1e0d7499c0ad96"
+dependencies = [
+ "console",
+ "shell-words",
+ "tempfile",
+ "zeroize",
+]
+
 [[package]]
 name = "digest"
 version = "0.9.0"
@@ -1152,6 +1181,12 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "encode_unicode"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
+
 [[package]]
 name = "encoding_rs"
 version = "0.8.35"
@@ -1537,9 +1572,9 @@ dependencies = [

 [[package]]
 name = "governor"
-version = "0.10.2"
+version = "0.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e23d5986fd4364c2fb7498523540618b4b8d92eec6c36a02e565f66748e2f79"
+checksum = "9efcab3c1958580ff1f25a2a41be1668f7603d849bb63af523b208a3cc1223b8"
 dependencies = [
 "cfg-if",
 "dashmap",
@@ -1686,9 +1721,9 @@ dependencies = [

 [[package]]
 name = "html2text"
-version = "0.16.4"
+version = "0.16.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1418e1f5886c4a3ac23a22a5590a4907935f13edb0526593dc02a769eecefdbe"
+checksum = "89f3074c1e4a7c4b4f7aca411a610e0f2f27e16d571d0e584524b66c93204100"
 dependencies = [
 "html5ever",
 "tendril",
@@ -2131,9 +2166,9 @@ dependencies = [

 [[package]]
 name = "itoa"
-version = "1.0.15"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
+checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"

 [[package]]
 name = "jobserver"
@@ -3498,9 +3533,9 @@ dependencies = [

 [[package]]
 name = "rustix"
-version = "1.1.2"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd15f8a2c5551a84d56efdc1cd049089e409ac19a3072d5037a17fd70719ff3e"
+checksum = "146c9e247ccc180c1f61615433868c99f3de3ae256a30a43b49f67c2d9171f34"
 dependencies = [
 "bitflags",
 "errno",
@@ -3536,9 +3571,9 @@ dependencies = [

 [[package]]
 name = "rustls-pki-types"
-version = "1.13.1"
+version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "708c0f9d5f54ba0272468c1d306a52c495b31fa155e91bc25371e6df7996908c"
+checksum = "21e6f2ab2928ca4291b86736a8bd920a277a399bba1589409d72154ff87c1282"
 dependencies = [
 "web-time",
 "zeroize",
@@ -3667,15 +3702,15 @@ dependencies = [

 [[package]]
 name = "serde_json"
-version = "1.0.145"
+version = "1.0.148"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "402a6f66d8c709116cf22f558eab210f5a50187f702eb4d7e5ef38d9a7f1c79c"
+checksum = "3084b546a1dd6289475996f182a22aba973866ea8e8b02c51d9f46b1336a22da"
 dependencies = [
 "itoa",
 "memchr",
- "ryu",
 "serde",
 "serde_core",
+ "zmij",
 ]

 [[package]]
@@ -3700,6 +3735,15 @@ dependencies = [
 "thiserror 1.0.69",
 ]

+[[package]]
+name = "serde_spanned"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8bbf91e5a4d6315eee45e704372590b30e260ee83af6639d64557f51b067776"
+dependencies = [
+ "serde_core",
+]
+
 [[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
@@ -3795,6 +3839,12 @@ dependencies = [
 "lazy_static",
 ]

+[[package]]
+name = "shell-words"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc6fe69c597f9c37bfeeeeeb33da3530379845f10be461a66d16d03eca2ded77"
+
 [[package]]
 name = "shlex"
 version = "1.3.0"
@@ -4295,9 +4345,9 @@ dependencies = [

 [[package]]
 name = "tempfile"
-version = "3.23.0"
+version = "3.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16"
+checksum = "655da9c7eb6305c55742045d5a8d2037996d61d8de95806335c7c86ce0f82e9c"
 dependencies = [
 "fastrand 2.3.0",
 "getrandom 0.3.4",
@@ -4557,10 +4607,25 @@ dependencies = [
 ]

 [[package]]
-name = "toml_datetime"
-version = "0.7.3"
+name = "toml"
+version = "0.9.10+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2cdb639ebbc97961c51720f858597f7f24c4fc295327923af55b74c3c724533"
+checksum = "0825052159284a1a8b4d6c0c86cbc801f2da5afd2b225fa548c72f2e74002f48"
+dependencies = [
+ "indexmap",
+ "serde_core",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_parser",
+ "toml_writer",
+ "winnow",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.7.5+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
 dependencies = [
 "serde_core",
 ]
@@ -4579,13 +4644,19 @@ dependencies = [

 [[package]]
 name = "toml_parser"
-version = "1.0.4"
+version = "1.0.6+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0cbe268d35bdb4bb5a56a2de88d0ad0eb70af5384a99d648cd4b3d04039800e"
+checksum = "a3198b4b0a8e11f09dd03e133c0280504d0801269e9afa46362ffde1cbeebf44"
 dependencies = [
 "winnow",
 ]

+[[package]]
+name = "toml_writer"
+version = "1.0.6+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab16f14aed21ee8bfd8ec22513f7287cd4a91aa92e44edfe2c17ddd004e92607"
+
 [[package]]
 name = "tower"
 version = "0.5.2"
@@ -4633,9 +4704,9 @@ checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"

 [[package]]
 name = "tracing"
-version = "0.1.43"
+version = "0.1.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d15d90a0b5c19378952d479dc858407149d7bb45a14de0142f6c534b16fc647"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
 dependencies = [
 "log",
 "pin-project-lite",
@@ -4668,9 +4739,9 @@ dependencies = [

 [[package]]
 name = "tracing-core"
-version = "0.1.35"
+version = "0.1.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a04e24fab5c89c6a36eb8558c9656f30d81de51dfa4d3b45f26b21d61fa0a6c"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
 dependencies = [
 "once_cell",
 "valuable",
@@ -5727,6 +5798,12 @@ dependencies = [
 "syn 2.0.111",
 ]

+[[package]]
+name = "zmij"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3280a1b827474fcd5dbef4b35a674deb52ba5c312363aef9135317df179d81b"
+
 [[package]]
 name = "zstd"
 version = "0.13.3"
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,12 +1,15 @@
 [package]
 name = "bichon"
-version = "0.1.1"
+version = "0.3.0"
 edition = "2021"

 [[bin]]
 name = "bichon"
 path = "src/main.rs"

+[[bin]]
+name = "bichonctl"
+path = "src/bin/bichonctl.rs"

 [features]
 default = []
@@ -37,9 +40,9 @@ poem-openapi = { version = "5.1.16", features = [
 ] }
 ring = { version = "0.17.14", features = ["std"] }
 serde = { version = "1.0.228", features = ["derive"] }
-serde_json = "1.0.145"
+serde_json = "1.0.148"
 tokio = { version = "1.48.0", features = ["full"] }
-tracing = "0.1.43"
+tracing = "0.1.44"
 tracing-appender = "0.2.3"
 tracing-subscriber = { version = "0.3.22", features = ["env-filter", "json"] }
 base64 = "0.22.1"
@@ -83,11 +86,11 @@ async-imap = { version = "0.11.1", default-features = false, features = [
 ] }
 webpki-roots = "1.0.4"
 rustls = { version = "0.23.35", default-features = false, features = ["ring"] }
-rustls-pki-types = "1.13.1"
+rustls-pki-types = "1.13.2"
 tokio-io-timeout = "1.2.1"
 bb8 = "0.9.1"
 semver = "1.0.27"
-governor = "0.10.2"
+governor = "0.10.4"
 lru = "0.16.2"
 mime_guess = "2.0.5"
 hex = "0.4.3"
@@ -105,10 +108,14 @@ dashmap = "6.1.0"
 openssl-sys = { version = "0.9.111", optional = true, features = ["vendored"] }
 gethostname = "1.1.0"
 tantivy = { version = "0.25.0", features = ["quickwit", "zstd-compression"] }
-itoa = "1.0.15"
-html2text = "0.16.4"
+itoa = "1.0.17"
+html2text = "0.16.5"
 bytes = "1.11.0"
+dialoguer = "0.12.0"
+console = "0.16.2"
+toml = "0.9.8"
+memmap2 = "0.9.9"
 [dev-dependencies]
 #bincode = "1.3.3"
 #secret-lib = "1.0.0"
-tempfile = "3.23.0"
+tempfile = "3.24.0"
--- a/README.md
+++ b/README.md
@@ -22,7 +22,7 @@
    <img src="https://img.shields.io/badge/license-AGPLv3-blue.svg" alt="License">
  </a>
  <a href="https://deepwiki.com/rustmailer/bichon"><img src="https://deepwiki.com/badge.svg" alt="Ask DeepWiki"></a>
-  <a href="https://discord.gg/evFnSpdpaE">
+  <a href="https://discord.gg/Bq4M2cDmF4">
    <img src="https://img.shields.io/badge/Discord-Join%20Server-7289DA?logo=discord&logoColor=white" alt="Discord">
  </a>
  <a href="https://x.com/rustmailer">
@@ -52,49 +52,20 @@ Built in Rust, it requires no external dependencies and provides fast, efficient

 ## 🚀 Features

-### ⚡ Lightweight & Standalone
- Pure Rust, single-machine application.  
- No external database required.  
- Includes **WebUI** for intuitive management.
+* **Lightweight & Standalone** — Pure Rust, no external database, with built-in WebUI
+* **Multi-Account Sync** — Download and manage emails from multiple accounts
+* **Flexible Fetching** — Sync by date range, email count, or specific mailboxes
+* **IMAP & OAuth2 Auth** — Password or OAuth2 login with automatic token refresh
+* **Proxy & Auto Config** — Supports network proxies and automatic IMAP discovery
+* **Unified Search** — Search across all accounts by sender, subject, body, date, size, attachments, and more
+* **Tags & Facets** — Organize emails using Tantivy facet-based tags
+* **Compressed Storage** — Transparent compression and deduplication for efficient storage
+* **Email Management** — Browse, view threads, bulk clean up, export EML or attachments
+* **Dashboard & Analytics** — Visual insights into email volume, trends, and top senders
+* **Internationalized WebUI** — Frontend available in 18 languages
+* **OpenAPI Access** — OpenAPI docs with access-token authentication
+* **Multi-User & Role-Based Access Control (RBAC)** — Supports multiple users with fine-grained, role-based permissions

-### 📬 Multi-Account Management
- Synchronize and download emails from multiple accounts.  
- Flexible selection: by **date range**, **number of emails**, or **specific mailboxes**.
-
-### 🔑 IMAP & OAuth2 Authentication
- Supports **IMAP password** or **OAuth2** login.  
- Built-in WebUI for **OAuth2 authorization**, including **automatic token refresh** (e.g., Gmail, Outlook).  
- Supports **network proxy** for IMAP and OAuth2.  
- Automatic IMAP server discovery and configuration.
-
-### 🔍 Unified Multi-Account Search
- Powerful search across all accounts:  
-  **account**, **mailbox**, **sender**, **attachment name**, **has attachments**, **size**, **date**, **subject**, **body**.
-
-### 🏷️ Tags & Facets
- Organize archived emails using **tags** backed by Tantivy **facets**.  
- Efficiently filter and locate emails based on these facet-based tags.
-
-### 💾 Compressed & Deduplicated Storage
- Store emails efficiently with **transparent compression** and **deduplication**—emails can be read directly without any extra steps.
-
-### 📂 Email Management & Viewing
- Bulk cleanup of local archives.  
- Download emails as **EML** or **attachments separately**.  
- View and browse emails directly.
- View the full **conversation thread** of any email.
-
-### 📊 Dashboard & Analytics
- Visualize email statistics: **counts**, **time distribution**, **top senders**, **largest emails**, **account rankings**.
-
-### 🌐 Internationalization (i18n)
-* WebUI fully supports **17 languages** for all interface elements.
-* Backend responses (e.g., system messages, API data) are **not yet internationalized**.
-* Frontend is ready to support more languages in the future with minimal effort.
-
-### 🛠️ OpenAPI Support
- Provides **OpenAPI documentation**.  
- **Access token authentication** for programmatic access.

 ## 🐾 Why Create Bichon?

@@ -151,41 +122,116 @@ docker run -d \
  rustmailer/bichon:latest
 ```

+## CORS Configuration (Important for Browser Access)

-* **Accessing Bichon from a browser:**
-  You need to add the exact address you use in your browser to `BICHON_CORS_ORIGINS`.
+Starting from **v0.1.4**, Bichon changes how `BICHON_CORS_ORIGINS` works:

-  * If you access via **IP**, add `IP:port`, e.g.:
+### **🔄 New Behavior in v0.1.4**

-    ```
-    http://192.168.1.16:15630
-    ```
-  * If you access via **hostname**, add `hostname:port`, e.g.:
+* If **`BICHON_CORS_ORIGINS` is not set**, Bichon now **allows all origins**.
+  This makes local testing and simple deployments much easier.
+* If you **do set** `BICHON_CORS_ORIGINS`, then **you must explicitly list each allowed origin**.
+* `*` is **not supported** and will **not work** — you must provide exact URLs.

-    ```
-    http://myserver.local:15630
-    ```
-  * If you access via **domain name**, add the domain, e.g.:
+#### How CORS Matching Works

-    ```
-    http://mydomain.com
-    ```
-  * **If Bichon is running on port 80**, you **do not need to include the port**.
-  * If you want to access Bichon in **multiple ways**, include all of them separated by commas.
+When a browser accesses Bichon, it will send an `Origin` header.

-Example Docker run:
+* **Incoming Origin** = the exact address the browser is using
+* **Configured origins** = the list you passed to `BICHON_CORS_ORIGINS`
+
+If Configured origins does not contain the Incoming Origin exactly as a full string match, the browser request will be rejected.
+
+Example debug log:
+
+```
+2025-12-06T23:56:30.422+08:00 DEBUG bichon::modules::rest: CORS: Incoming Origin = "http://localhost:15630"
+2025-12-06T23:56:30.422+08:00 DEBUG bichon::modules::rest: CORS: Configured origins = ["http://192.168.3.2:15630"]
+```
+
+In this example:
+
+* Browser is using `http://localhost:15630`
+* But the configured origin is `http://192.168.3.2:15630`
+
+→ **CORS will fail**, and you can immediately see why.
+
+#### When Should You Configure CORS?
+
+It is strongly recommended to configure CORS in production environments to ensure that only trusted browser origins can access Bichon.
+If you want to access Bichon from a browser:
+
+* Add the exact **IP** with port
+* Or the exact **hostname** with port
+* Or the **domain** (port optional if it's 80)
+
+Examples:
+
+```
+http://192.168.1.16:15630
+http://myserver.local:15630
+http://mydomain.com
+```
+
+If you access Bichon in **multiple different ways**, list all of them:
+
+```
+-e BICHON_CORS_ORIGINS="http://192.168.1.16:15630,http://myserver.local:15630,http://mydomain.com"
+```
+
+> **Do not add a trailing slash**
+> (`http://192.168.1.16:15630/` will not match)
+>
+> **Do not use `*`**, it is not supported.
+
+#### How to Enable Debug Logs (Highly Recommended for CORS Issues)
+
+Set environment variable:
+
+```
+BICHON_LOG_LEVEL=debug
+```
+
+Or via command-line:
+
+```
+--bichon-log-level debug
+```
+
+Default is `info`, so CORS logs will not appear unless debug logging is enabled.
+
+---
+
+#### ⚠️ Note on Running Bichon in a Container
+
+> ⚠️ **Note:** If you are running Bichon in a container (via **Docker Compose** or **docker run**), be careful with **quotes in environment variable values**.
+
+For example, **do not** write:

 ```bash
-docker run -d \
-  --name bichon \
-  -p 15630:15630 \
-  -v $(pwd)/bichon-data:/data \
-  -e BICHON_LOG_LEVEL=info \
-  -e BICHON_ROOT_DIR=/data \
-  -e BICHON_CORS_ORIGINS="http://192.168.1.16:15630,http://myserver.local:15630,http://mydomain.com" \
-  rustmailer/bichon:latest
+-e BICHON_CORS_ORIGINS="http://localhost:15630,http://myserver.local:15630"
 ```
-> **Tip:** Do not add a trailing `/`. Using `*` allows all addresses, but is **not recommended** for security.
+
+* The outer quotes (`"`) will be passed literally into the container and may cause CORS misconfiguration.
+
+**Correct way:**
+
+```bash
+-e BICHON_CORS_ORIGINS=http://localhost:15630,http://myserver.local:15630
+```
+
+Or using YAML literal style for Docker Compose:
+
+```yaml
+environment:
+  BICHON_CORS_ORIGINS: |
+    http://localhost:15630,http://myserver.local:15630
+```
+
+This ensures that the configured origins are interpreted correctly inside the container.
+
+> ⚠️ **Note:** This fucking problem I actually didn’t know about myself; thanks to [gall-1](https://github.com/gall-1) for pointing it out.
+

 ### Binary Deployment

@@ -210,85 +256,116 @@ Extract and run:

 * If you are accessing Bichon from a proxy domain **mydomain** argument --bichon-cors-origins="https://mydomain" is required.
  
-## Setting the Bichon Encryption Password
+## 🔐 Setting the Bichon Encryption Password

-Bichon uses an encryption password to secure sensitive data. **You must set it before first use**, when no data exists.
+Please refer to the following documentation for detailed instructions on how to set the Bichon encryption password:

-Once set, it **cannot be changed**. Changing it later will make all encrypted data unreadable. To start over, you would need to **reinitialize Bichon and clear all emails and metadata**.
+👉 [https://github.com/rustmailer/bichon/wiki/Setting-the-Bichon-Encryption-Password](https://github.com/rustmailer/bichon/wiki/Setting-the-Bichon-Encryption-Password)

-### How to Set the Password
+All configuration methods, including command-line options, environment variables, and password file support (v0.2.0+), are documented there.

-You can set the password **via command-line or environment variable**:
+## 🔑 User Authentication & Admin Account

-### Command-Line
+Starting from **Bichon v0.2.0**, the authentication model has been updated.

-```bash
-bichon --bichon-encrypt-password "your-strong-password"
-```
+### Built-in Admin User (v0.2.0+)

-### Environment Variable
+* Bichon no longer uses the legacy single-account `root / root` login.
+* The system now ships with a built-in **admin** user by default.
+* **Default credentials:**

-```bash
-export BICHON_ENCRYPT_PASSWORD="your-strong-password"
-bichon
-```
+  * **Username:** `admin`
+  * **Password:** `admin@bichon`

-**Tip:** Use a strong, secure password and keep it safe, as it cannot be changed later.
+> The legacy `root` account and the `root / root` default credentials **no longer exist**.

-## 🔑 Root User Login Information

-**Bichon currently supports a single Root user login for system access and management.**
+### Mandatory Access Token Authentication

-### First Login and Enabling Access
+* From **v0.2.0 onward**, **access-token–based authentication is always enabled**.
+* The startup flag and environment variable
+  `--bichon-enable-access-token` / `BICHON_ENABLE_ACCESS_TOKEN`
+  are **deprecated and no longer used**.
+* No additional configuration is required to enable authentication.

-To enable the login feature, you must specify a command-line argument or set an environment variable when starting Bichon.

-#### 1\. Command-Line Argument
+### Managing Account Information

-Add the `--bichon-enable-access-token` flag to your startup command:
+After logging in, the admin user can manage their profile directly in the WebUI:

-```bash
-# Linux/macOS Binary Deployment Example
-./bichon --bichon-root-dir /tmp/bichon-data --bichon-enable-access-token
-```
+1. Log in to the WebUI using the default admin credentials.
+2. Navigate to **Settings → Profile**.
+3. Update:

-#### 2\. Environment Variable (Recommended for Docker)
-
-Set the environment variable `BICHON_ENABLE_ACCESS_TOKEN` to `true`:
-
-```bash
-# Docker Deployment Example
-docker run -d \
-  --name bichon \
-  -p 15630:15630 \
-  -v $(pwd)/bichon-data:/data \
-  -e BICHON_LOG_LEVEL=info \
-  -e BICHON_ROOT_DIR=/data \
-  -e BICHON_ENABLE_ACCESS_TOKEN=true \
-  rustmailer/bichon:latest
-```
-
-### Default Credentials
-
-  * **Initial Login Account:** `root`
-  * **Initial Password:** `root`
-
-### Changing the Password
-
-**It is strongly recommended that you change the default password immediately after your first login.**
-
-You can change the password via the WebUI:
-
-1.  Log in to the WebUI.
-2.  Navigate to the **Settings** page.
-3.  Use the **Reset Root Password** option to modify your password.
+   * Username
+   * Password
+   * Avatar and other profile information

+⚠️ **Security Notice:**
+For security reasons, you should **change the default admin password immediately after the first login**.

 ## 📖 Documentation

 > Under construction. Documentation will be available soon.
 [Bichon Wiki](https://github.com/rustmailer/bichon/wiki).

+## FAQ
+
+please see the FAQ in the project Wiki:
+
+👉 [https://github.com/rustmailer/bichon/wiki/FAQ](https://github.com/rustmailer/bichon/wiki/FAQ-(Frequently-Asked-Questions))
+
+
+## 💡 User Case Showcase
+
+We have collected a real-world case study from a user processing email data, which demonstrates Bichon's performance and storage efficiency in a live environment.
+This case involves ingesting and indexing data from **126 email accounts**. The total original data volume was **229 GB**, comprising **460,000 emails**.
+
+### 📊 Performance Data Overview
+
+<img width="945" height="582" alt="image" src="https://github.com/user-attachments/assets/934ed6dd-c1da-4483-84fa-6d5b1bf6ca72" />
+
+A special thank you to **[@rallisf1](https://github.com/rallisf1)** for sharing this usage scenario and the detailed data.
+
+#### 🤝 Open Invitation
+
+This data is provided solely as a **reference** for real-world usage. We encourage more users to share their Bichon usage screenshots and metrics (e.g., ingestion volume, compression ratio, search speed, etc.) to help the community conduct a more comprehensive assessment of Bichon's suitability and performance.
+
+---
+
+## Roadmap
+
+- ✓ Multi-user support with account/password login  
+  - System-level roles (admin / user)  
+  - Per-mail-account permissions
+
+* [ ] `bichon-cli` command-line tool
+
+  * Import emails from `eml`, `mbox`, `msg`, `pst`
+
+* [ ] Manual sync controls
+
+  * Sync on demand
+  * Sync a single folder
+  * Verify completeness by comparing with the mail server
+
+* [ ] Post-sync server cleanup
+
+  * Clean up server-side emails after successful sync
+  * Free up mailbox space (e.g. Gmail)
+
+* [ ] Email export
+
+  * Export by folder
+  * Export by entire account
+
+* [ ] Account-to-account email sync
+
+  * Sync emails to a specified target account
+  * Support mailbox migration
+
+---
+
 ## 🛠️ Tech Stack

 - **Backend**: Rust + Poem
@@ -304,7 +381,7 @@ You can change the password via the WebUI:
 Contributions of all kinds are welcome!
 Whether you’d like to submit code, report a bug, or share practical suggestions that can help improve the project, your input is highly appreciated.
 Feel free to open an Issue or a Pull Request anytime. You can also reach out on Discord if you’d like to discuss ideas or improvements.
-<a href="https://discord.gg/evFnSpdpaE">
+<a href="https://discord.gg/Bq4M2cDmF4">
    <img src="https://img.shields.io/badge/Discord-Join%20Server-7289DA?logo=discord&logoColor=white" alt="Discord">
 </a>

@@ -351,9 +428,12 @@ cargo build
 Or run directly:

 ```bash
+export BICHON_ENCRYPT_PASSWORD=dummy-password-for-testing
 cargo run -- --bichon-root-dir e:\bichon-data
 ```
+
 `--bichon-root-dir` specifies the directory where **all Bichon data** will be stored.
+`BICHON_ENCRYPT_PASSWORD` is the password used to encrypt the sensitive data (see `cargo run -- --help` for alternative ways to specify this).

 ### WebUI Access

@@ -370,7 +450,7 @@ This project is licensed under [AGPLv3](LICENSE).

 - [Docker Hub](https://hub.docker.com/r/rustmailer/bichon)
 - [Issue Tracker](https://github.com/rustmailer/bichon/issues)
- [Discord](https://discord.gg/evFnSpdpaE)
+- [Discord](https://discord.gg/Bq4M2cDmF4)


 ## 💖 Support & Promotion
--- a/config.toml
+++ b/config.toml
@@ -0,0 +1,2 @@
+base_url = "http://localhost:15630"
+api_token = "UvkGJO0Mn1tO6igGZwQnTtI2"
--- a/src/bin/bichonctl.rs
+++ b/src/bin/bichonctl.rs
@@ -0,0 +1,95 @@
+use bichon::modules::cli::{
+    auth::verify_user_and_get_account, eml::handle_eml_directory_import,
+    mbox::handle_mbox_single_file_import, thunderbird::handle_thunderbird_import, BichonCli,
+    BichonCtlConfig,
+};
+use clap::Parser;
+use console::style;
+use dialoguer::{theme::ColorfulTheme, Confirm, Input, Select};
+use std::fs;
+
+#[tokio::main]
+async fn main() {
+    let cli = BichonCli::parse();
+    let theme = ColorfulTheme::default();
+    let config_path = &cli.config;
+    let mut current_config: Option<BichonCtlConfig> = None;
+
+    if config_path.exists() {
+        if let Ok(content) = fs::read_to_string(config_path) {
+            if let Ok(config) = toml::from_str::<BichonCtlConfig>(&content) {
+                println!("{}", style("✔ Existing configuration found:").green());
+                println!("  Base URL: {}", style(&config.base_url).yellow());
+                println!(" API Token: {}", style(&config.api_token).yellow());
+
+                // Confirm with user
+                if Confirm::with_theme(&theme)
+                    .with_prompt("Do you want to use this configuration?")
+                    .default(true)
+                    .interact()
+                    .unwrap()
+                {
+                    current_config = Some(config);
+                }
+            }
+        }
+    }
+
+    let final_config = match current_config {
+        Some(conf) => conf,
+        None => {
+            println!("\n{}", style("Please enter Bichon service details:").bold());
+
+            let url: String = Input::with_theme(&theme)
+                .with_prompt("Bichon Base URL")
+                .default("http://localhost:15630".into())
+                .interact_text()
+                .unwrap();
+
+            let token: String = Input::with_theme(&theme)
+                .with_prompt("API Token")
+                .interact_text()
+                .unwrap();
+
+            let conf = BichonCtlConfig {
+                base_url: url,
+                api_token: token,
+            };
+
+            // 3. Offer to save the new configuration
+            if Confirm::with_theme(&theme)
+                .with_prompt("Save this configuration for future use?")
+                .default(true)
+                .interact()
+                .unwrap()
+            {
+                let toml_str = toml::to_string(&conf).unwrap();
+                fs::write(config_path, toml_str).expect("Failed to save config file");
+                println!("{}", style("Configuration saved successfully!").green());
+            }
+            conf
+        }
+    };
+
+    let target_account_id = verify_user_and_get_account(&final_config, &theme).await;
+
+    let import_modes = &[
+        "EML: Scan directory recursively (Maintains folder structure)",
+        "MBOX: Single archive file (Stream from one file)",
+        "Thunderbird: Import from local profile directory",
+    ];
+
+    let mode_idx = Select::with_theme(&theme)
+        .with_prompt("Select import method")
+        .items(import_modes)
+        .default(0)
+        .interact()
+        .unwrap();
+
+    match mode_idx {
+        0 => handle_eml_directory_import(&final_config, target_account_id, &theme).await,
+        1 => handle_mbox_single_file_import(&final_config, target_account_id, &theme).await,
+        2 => handle_thunderbird_import(&final_config, target_account_id, &theme).await,
+        _ => unreachable!(),
+    }
+}
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -0,0 +1 @@
+pub mod modules;
--- a/src/main.rs
+++ b/src/main.rs
@@ -16,22 +16,23 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
-use mimalloc::MiMalloc;
-use modules::{
-    common::rustls::RustMailerTls,
-    context::{executors::EmailClientExecutors, Initialize},
-    error::BichonResult,
-    logger,
-    rest::start_http_server,
-    tasks::PeriodicTasks,
-    token::root::ensure_root_token,
+use bichon::{
+    bichon_version,
+    modules::{
+        common::rustls::RustMailerTls,
+        context::{executors::EmailClientExecutors, Initialize},
+        error::BichonResult,
+        logger,
+        rest::start_http_server,
+        tasks::PeriodicTasks,
+    },
 };
+use mimalloc::MiMalloc;
 use tracing::info;

-use crate::modules::{common::signal::SignalManager, settings::dir::DataDirManager};
-
-mod modules;
+use bichon::modules::{
+    common::signal::SignalManager, settings::dir::DataDirManager, users::manager::UserManager,
+};

 #[global_allocator]
 static GLOBAL: MiMalloc = MiMalloc;
@@ -68,7 +69,7 @@ async fn initialize() -> BichonResult<()> {
    // SETTINGS.validate()?;
    SignalManager::initialize().await?;
    DataDirManager::initialize().await?;
-    ensure_root_token().await?;
+    UserManager::initialize().await?;
    RustMailerTls::initialize().await?;
    EmailClientExecutors::initialize().await?;
    PeriodicTasks::start_background_tasks();
--- a/src/modules/account/grant.rs
+++ b/src/modules/account/grant.rs
@@ -0,0 +1,160 @@
+//
+// Copyright (c) 2025 rustmailer.com (https://rustmailer.com)
+//
+// This file is part of the Bichon Email Archiving Project
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+use poem_openapi::Object;
+use serde::{Deserialize, Serialize};
+
+use crate::{
+    modules::{
+        account::migration::AccountModel,
+        common::auth::ClientContext,
+        database::{manager::DB_MANAGER, with_transaction},
+        error::{code::ErrorCode, BichonResult},
+        users::{
+            permissions::Permission,
+            role::{RoleType, UserRole},
+            UserModel,
+        },
+    },
+    raise_error, utc_now,
+};
+
+#[derive(Clone, Debug, Default, Eq, PartialEq, Deserialize, Serialize, Object)]
+pub struct BatchAccountRoleRequest {
+    pub account_ids: Vec<u64>,
+    pub user_ids: Vec<u64>,
+    pub role_id: u64,
+}
+
+impl BatchAccountRoleRequest {
+    pub async fn validate_existence(&self) -> BichonResult<()> {
+        let role = UserRole::find(self.role_id).await?.ok_or_else(|| {
+            raise_error!(
+                format!("Role ID {} not found", self.role_id),
+                ErrorCode::ResourceNotFound
+            )
+        })?;
+
+        if !matches!(role.role_type, RoleType::Account) {
+            return Err(raise_error!(
+                "Only Account roles can be assigned to individual account".into(),
+                ErrorCode::InvalidParameter
+            ));
+        }
+
+        for id in &self.account_ids {
+            let exists = AccountModel::find(*id).await?; // Assuming an exists helper
+            if exists.is_none() {
+                return Err(raise_error!(
+                    format!("Account ID {} not found", id),
+                    ErrorCode::ResourceNotFound
+                ));
+            }
+        }
+
+        for id in &self.user_ids {
+            let exists = UserModel::find(*id).await?; // Assuming an exists helper
+            if exists.is_none() {
+                return Err(raise_error!(
+                    format!("User ID {} not found", id),
+                    ErrorCode::ResourceNotFound
+                ));
+            }
+        }
+
+        Ok(())
+    }
+
+    async fn grant_batch_account_access(
+        account_ids: Vec<u64>,
+        user_ids: Vec<u64>,
+        role_id: u64,
+    ) -> BichonResult<()> {
+        with_transaction(DB_MANAGER.meta_db(), move |rw| {
+            for &uid in &user_ids {
+                // Fetch the current user record from the database
+                let user = rw
+                    .get()
+                    .primary::<UserModel>(uid)
+                    .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
+                    .ok_or_else(|| {
+                        raise_error!(
+                            format!("User with id={} not found.", uid),
+                            ErrorCode::ResourceNotFound
+                        )
+                    })?;
+
+                let mut updated_user = user.clone();
+
+                // Apply the role to each specified account_id
+                for &aid in &account_ids {
+                    updated_user.account_access_map.insert(aid, role_id);
+                }
+
+                updated_user.updated_at = utc_now!();
+
+                // Save the updated user back to the database within the transaction
+                rw.update(user, updated_user)
+                    .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+            }
+            Ok(())
+        })
+        .await
+    }
+
+    pub async fn do_assign(self, context: &ClientContext) -> BichonResult<()> {
+        for account_id in &self.account_ids {
+            // Get the user's specific access for this account
+            let assigned_role_id =
+                context
+                    .user
+                    .account_access_map
+                    .get(account_id)
+                    .ok_or_else(|| {
+                        raise_error!(
+                            format!("No access to account {}", account_id),
+                            ErrorCode::Forbidden
+                        )
+                    })?;
+
+            // Fetch the role definition from the database
+            let user_scoped_role = UserRole::find(*assigned_role_id).await?.ok_or_else(|| {
+                raise_error!(
+                    "Assigned account role no longer exists".into(),
+                    ErrorCode::InternalError
+                )
+            })?;
+
+            // Critical Check: Does this role grant management/sharing rights?
+            if !user_scoped_role
+                .permissions
+                .contains(Permission::ACCOUNT_MANAGE)
+            {
+                return Err(raise_error!(
+                    format!("Your role on account {} does not allow sharing", account_id),
+                    ErrorCode::Forbidden
+                ));
+            }
+
+            // Optional: Ensure manager isn't giving away perms they don't have
+            // This is where you'd compare target_role.permissions vs manager's perms
+        }
+
+        Self::grant_batch_account_access(self.account_ids, self.user_ids, self.role_id).await
+    }
+}
--- a/src/modules/account/migration.rs
+++ b/src/modules/account/migration.rs
@@ -27,11 +27,16 @@ use tracing::info;
 use crate::{
    encrypt,
    modules::{
-        account::{entity::ImapConfig, since::DateSince, state::AccountRunningState},
+        account::{
+            entity::ImapConfig,
+            since::{DateSince, RelativeDate},
+            state::AccountRunningState,
+        },
        cache::imap::mailbox::MailBox,
-        database::{insert_impl, list_all_impl},
+        database::{list_all_impl, with_transaction},
        error::BichonResult,
        indexer::manager::{EML_INDEX_MANAGER, ENVELOPE_INDEX_MANAGER},
+        users::{role::DEFAULT_ACCOUNT_MANAGER_ROLE_ID, UserModel, DEFAULT_ADMIN_USER_ID},
    },
    utc_now,
 };
@@ -52,10 +57,9 @@ use crate::modules::database::{
 use crate::modules::error::code::ErrorCode;
 use crate::modules::oauth2::token::OAuth2AccessToken;
 use crate::modules::rest::response::DataPage;
-use crate::modules::token::AccessToken;
 use crate::raise_error;

-pub type AccountModel = AccountV2;
+pub type AccountModel = AccountV3;

 #[derive(Clone, Debug, Default, Eq, PartialEq, Deserialize, Serialize, Enum)]
 pub enum AccountType {
@@ -121,8 +125,42 @@ impl AccountV2 {
    fn pk(&self) -> String {
        format!("{}_{}", self.created_at, self.id)
    }
+}

-    pub fn new(request: AccountCreateRequest) -> BichonResult<Self> {
+#[derive(Clone, Debug, Default, Eq, PartialEq, Deserialize, Serialize, Object)]
+#[native_model(id = 4, version = 3, from = AccountV2)]
+#[native_db(primary_key(pk -> String))]
+pub struct AccountV3 {
+    #[secondary_key(unique)]
+    pub id: u64,
+    pub imap: Option<ImapConfig>,
+    pub enabled: bool,
+    #[oai(validator(custom = "crate::modules::common::validator::EmailValidator"))]
+    pub email: String,
+    pub name: Option<String>,
+    pub capabilities: Option<Vec<String>>,
+    pub date_since: Option<DateSince>,
+    pub date_before: Option<RelativeDate>,
+    pub folder_limit: Option<u32>,
+    pub sync_folders: Option<Vec<String>>,
+    pub account_type: AccountType,
+    pub sync_interval_min: Option<i64>,
+    pub sync_batch_size: Option<u32>,
+    pub known_folders: Option<BTreeSet<String>>,
+    pub created_at: i64,
+    pub updated_at: i64,
+    pub created_by: u64, //user id
+    pub use_proxy: Option<u64>,
+    pub use_dangerous: bool,
+    pub pgp_key: Option<String>,
+}
+
+impl AccountV3 {
+    fn pk(&self) -> String {
+        format!("{}_{}", self.created_at, self.id)
+    }
+
+    pub fn new(user_id: u64, request: AccountCreateRequest) -> BichonResult<Self> {
        Ok(Self {
            id: id!(64),
            email: request.email,
@@ -141,12 +179,15 @@ impl AccountV2 {
            folder_limit: request.folder_limit,
            use_dangerous: request.use_dangerous,
            pgp_key: request.pgp_key,
+            created_by: user_id,
+            sync_batch_size: request.sync_batch_size,
+            date_before: request.date_before,
        })
    }

    pub async fn check_account_exists(account_id: u64) -> BichonResult<AccountModel> {
        let account =
-            secondary_find_impl::<AccountModel>(DB_MANAGER.meta_db(), AccountV2Key::id, account_id)
+            secondary_find_impl::<AccountModel>(DB_MANAGER.meta_db(), AccountV3Key::id, account_id)
                .await?
                .ok_or_else(|| {
                    raise_error!(
@@ -154,13 +195,6 @@ impl AccountV2 {
                        ErrorCode::ResourceNotFound
                    )
                })?;
-
-        // if !account.enabled {
-        //     return Err(raise_error!(
-        //         format!("Account id='{account_id}' is disabled"),
-        //         ErrorCode::AccountDisabled
-        //     ));
-        // }
        Ok(account)
    }

@@ -176,24 +210,48 @@ impl AccountV2 {
    }

    pub async fn find(account_id: u64) -> BichonResult<Option<AccountModel>> {
-        secondary_find_impl::<AccountModel>(DB_MANAGER.meta_db(), AccountV2Key::id, account_id)
+        secondary_find_impl::<AccountModel>(DB_MANAGER.meta_db(), AccountV3Key::id, account_id)
            .await
    }

-    /// Saves the current `AccountEntity` by persisting it to storage.
-    pub async fn save(&self) -> BichonResult<()> {
-        insert_impl(DB_MANAGER.meta_db(), self.to_owned()).await
-    }
+    pub async fn create_account(
+        user_id: u64,
+        request: AccountCreateRequest,
+    ) -> BichonResult<AccountModel> {
+        let entity = request.create_entity(user_id)?;
+        let cloned = entity.clone();
+        with_transaction(DB_MANAGER.meta_db(), move |rw| {
+            let account_id = entity.id;
+            rw.insert::<AccountModel>(entity)
+                .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+            let user = rw
+                .get()
+                .primary::<UserModel>(user_id)
+                .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
+                .ok_or_else(|| {
+                    raise_error!(
+                        format!("User with id={} not found.", user_id),
+                        ErrorCode::ResourceNotFound
+                    )
+                })?;

-    pub async fn create_account(request: AccountCreateRequest) -> BichonResult<AccountModel> {
-        let entity = request.create_entity()?;
-        entity.save().await?;
-        if matches!(entity.account_type, AccountType::IMAP) {
+            let mut updated = user.clone();
+            updated
+                .account_access_map
+                .insert(account_id, DEFAULT_ACCOUNT_MANAGER_ROLE_ID);
+            updated.updated_at = utc_now!();
+            rw.update(user, updated)
+                .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+            Ok(())
+        })
+        .await?;
+
+        if matches!(cloned.account_type, AccountType::IMAP) {
            SYNC_CONTROLLER
-                .trigger_start(entity.id, entity.email.clone())
+                .trigger_start(cloned.id, cloned.email.clone())
                .await;
        }
-        Ok(entity)
+        Ok(cloned)
    }

    pub async fn update(
@@ -230,7 +288,7 @@ impl AccountV2 {

    async fn delete_account(account_id: u64) -> BichonResult<()> {
        delete_impl(DB_MANAGER.meta_db(), move|rw|{
-            rw.get().secondary::<AccountModel>(AccountV2Key::id, account_id).map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
+            rw.get().secondary::<AccountModel>(AccountV3Key::id, account_id).map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
            .ok_or_else(||raise_error!(format!("The account entity with id={account_id} that you want to delete was not found."), ErrorCode::ResourceNotFound))
        }).await
    }
@@ -242,7 +300,7 @@ impl AccountV2 {
            MAIL_CONTEXT.clean_account(account.id).await?;
        }
        OAuth2AccessToken::try_delete(account.id).await?;
-        AccessToken::cleanup_account(account.id).await?;
+        UserModel::cleanup_account(account.id).await?;
        MailBox::clean(account.id).await?;
        ENVELOPE_INDEX_MANAGER
            .delete_account_envelopes(account.id)
@@ -260,7 +318,7 @@ impl AccountV2 {
        sync_folders: Vec<String>,
    ) -> BichonResult<()> {
        update_impl(DB_MANAGER.meta_db(), move |rw| {
-            rw.get().secondary::<AccountModel>(AccountV2Key::id, account_id).map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
+            rw.get().secondary::<AccountModel>(AccountV3Key::id, account_id).map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
            .ok_or_else(|| raise_error!(format!("When trying to update account sync_folders, the corresponding record was not found. account_id={}", account_id), ErrorCode::ResourceNotFound))
        }, |current|{
            let mut updated = current.clone();
@@ -275,7 +333,7 @@ impl AccountV2 {
        known_folders: BTreeSet<String>,
    ) -> BichonResult<()> {
        update_impl(DB_MANAGER.meta_db(), move |rw| {
-            rw.get().secondary::<AccountModel>(AccountV2Key::id, account_id).map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
+            rw.get().secondary::<AccountModel>(AccountV3Key::id, account_id).map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
            .ok_or_else(|| raise_error!(format!("When trying to update account known_folders, the corresponding record was not found. account_id={}", account_id), ErrorCode::ResourceNotFound))
        }, |current|{
            let mut updated = current.clone();
@@ -290,7 +348,7 @@ impl AccountV2 {
        capabilities: Vec<String>,
    ) -> BichonResult<()> {
        update_impl(DB_MANAGER.meta_db(), move |rw| {
-            rw.get().secondary::<AccountModel>(AccountV2Key::id, account_id).map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
+            rw.get().secondary::<AccountModel>(AccountV3Key::id, account_id).map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
            .ok_or_else(|| raise_error!(format!("When trying to update account capabilities, the corresponding record was not found. account_id={}", account_id), ErrorCode::ResourceNotFound))
        }, |current|{
            let mut updated = current.clone();
@@ -305,11 +363,13 @@ impl AccountV2 {
        list_all_impl(DB_MANAGER.meta_db()).await
    }

-    pub async fn minimal_list() -> BichonResult<Vec<MinimalAccount>> {
+    pub async fn minimal_list(only_nosync: bool) -> BichonResult<Vec<MinimalAccount>> {
        let result = list_all_impl(DB_MANAGER.meta_db())
            .await?
            .into_iter()
-            //.filter(|a: &AccountModel| a.enabled)
+            .filter(|account: &AccountModel| {
+                !only_nosync || matches!(account.account_type, AccountType::NoSync)
+            })
            .map(|account: AccountModel| MinimalAccount {
                id: account.id,
                email: account.email,
@@ -319,7 +379,7 @@ impl AccountV2 {
    }

    pub async fn count() -> BichonResult<usize> {
-        count_by_unique_secondary_key_impl::<AccountModel>(DB_MANAGER.meta_db(), AccountV2Key::id)
+        count_by_unique_secondary_key_impl::<AccountModel>(DB_MANAGER.meta_db(), AccountV3Key::id)
            .await
    }

@@ -342,14 +402,37 @@ impl AccountV2 {

        if let Some(date_since) = request.date_since {
            new.date_since = Some(date_since);
+            new.date_before = None;
+        }
+
+        if let Some(date_before) = request.date_before {
+            new.date_before = Some(date_before);
+            new.date_since = None;
+        }
+
+        if let Some(clear_date_range) = request.clear_date_range {
+            if clear_date_range {
+                new.date_since = None;
+                new.date_before = None;
+            }
        }

        if let Some(folder_limit) = request.folder_limit {
            new.folder_limit = Some(folder_limit);
        }

+        if let Some(clear_folder_limit) = request.clear_folder_limit {
+            if clear_folder_limit {
+                new.folder_limit = None;
+            }
+        }
+
        if let Some(name) = &request.name {
-            new.name = Some(name.clone());
+            if name.trim().is_empty() {
+                new.name = None;
+            } else {
+                new.name = Some(name.clone());
+            }
        }

        if matches!(old.account_type, AccountType::IMAP) {
@@ -373,6 +456,11 @@ impl AccountV2 {
            if let Some(sync_interval_min) = &request.sync_interval_min {
                new.sync_interval_min = Some(*sync_interval_min);
            }
+
+            if let Some(sync_batch_size) = &request.sync_batch_size {
+                new.sync_batch_size = Some(*sync_batch_size);
+            }
+
            if let Some(use_proxy) = request.use_proxy {
                new.use_proxy = Some(use_proxy);
            }
@@ -446,3 +534,54 @@ impl From<AccountV2> for AccountV1 {
        }
    }
 }
+
+impl From<AccountV3> for AccountV2 {
+    fn from(value: AccountV3) -> Self {
+        Self {
+            id: value.id,
+            imap: value.imap,
+            enabled: value.enabled,
+            email: value.email,
+            name: value.name,
+            capabilities: value.capabilities,
+            date_since: value.date_since,
+            folder_limit: value.folder_limit,
+            sync_folders: value.sync_folders,
+            account_type: value.account_type,
+            sync_interval_min: value.sync_interval_min,
+            known_folders: value.known_folders,
+            created_at: value.created_at,
+            updated_at: value.updated_at,
+            use_proxy: value.use_proxy,
+            use_dangerous: value.use_dangerous,
+            pgp_key: value.pgp_key,
+        }
+    }
+}
+
+impl From<AccountV2> for AccountV3 {
+    fn from(value: AccountV2) -> Self {
+        Self {
+            id: value.id,
+            imap: value.imap,
+            enabled: value.enabled,
+            email: value.email,
+            name: value.name,
+            capabilities: value.capabilities,
+            date_since: value.date_since,
+            folder_limit: value.folder_limit,
+            sync_folders: value.sync_folders,
+            account_type: value.account_type,
+            sync_interval_min: value.sync_interval_min,
+            known_folders: value.known_folders,
+            created_at: value.created_at,
+            updated_at: value.updated_at,
+            created_by: DEFAULT_ADMIN_USER_ID,
+            use_proxy: value.use_proxy,
+            use_dangerous: value.use_dangerous,
+            pgp_key: value.pgp_key,
+            sync_batch_size: None,
+            date_before: None,
+        }
+    }
+}
--- a/src/modules/account/mod.rs
+++ b/src/modules/account/mod.rs
@@ -16,10 +16,11 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 pub mod dispatcher;
 pub mod entity;
+pub mod grant;
+pub mod migration;
 pub mod payload;
 pub mod since;
 pub mod state;
-pub mod migration;
+pub mod view;
--- a/src/modules/account/payload.rs
+++ b/src/modules/account/payload.rs
@@ -16,14 +16,11 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-use std::collections::BTreeSet;
-
 use crate::modules::account::entity::ImapConfig;
 use crate::modules::account::migration::{AccountModel, AccountType};
-use crate::modules::account::since::DateSince;
+use crate::modules::account::since::{DateSince, RelativeDate};
 use crate::modules::error::code::ErrorCode;
 use crate::modules::error::BichonResult;
-use crate::modules::token::AccountInfo;
 use crate::{raise_error, validate_email};
 use poem_openapi::Object;
 use serde::{Deserialize, Serialize};
@@ -36,21 +33,37 @@ pub struct AccountCreateRequest {
    pub imap: Option<ImapConfig>,
    pub enabled: bool,
    pub date_since: Option<DateSince>,
+    pub date_before: Option<RelativeDate>,
    pub account_type: AccountType,
    #[oai(validator(minimum(value = "100")))]
    pub folder_limit: Option<u32>,
    #[oai(validator(minimum(value = "10"), maximum(value = "480")))]
    pub sync_interval_min: Option<i64>,
+    #[oai(validator(minimum(value = "30"), maximum(value = "200")))]
+    pub sync_batch_size: Option<u32>,
    pub use_proxy: Option<u64>,
    pub use_dangerous: bool,
    pub pgp_key: Option<String>,
 }

 impl AccountCreateRequest {
-    pub fn create_entity(self) -> BichonResult<AccountModel> {
+    pub fn create_entity(self, user_id: u64) -> BichonResult<AccountModel> {
+        if self.date_before.is_some() && self.date_since.is_some() {
+            return Err(raise_error!(
+                "date_before and date_since are mutually exclusive; specify only one time boundary"
+                    .into(),
+                ErrorCode::InvalidParameter
+            ));
+        }
+
        if let Some(date_since) = self.date_since.as_ref() {
            date_since.validate()?;
        }
+
+        if let Some(date_before) = self.date_before.as_ref() {
+            date_before.validate_date()?;
+        }
+
        match self.account_type {
            AccountType::IMAP => {
                match &self.imap {
@@ -71,7 +84,7 @@ impl AccountCreateRequest {
            }
            AccountType::NoSync => {}
        }
-        Ok(AccountModel::new(self)?)
+        Ok(AccountModel::new(user_id, self)?)
    }

    fn validate_request(imap: &ImapConfig, email: &str) -> BichonResult<()> {
@@ -107,11 +120,14 @@ pub struct AccountUpdateRequest {
    /// - First-time sync optimization for large accounts
    /// - Reducing server load during resyncs
    pub date_since: Option<DateSince>,
+    pub date_before: Option<RelativeDate>,
+    pub clear_date_range: Option<bool>,
    /// Max emails to sync for this folder.  
    /// If not set, sync all emails.  
    /// otherwise sync up to `n` most recent emails (min 10).
    #[oai(validator(minimum(value = "100")))]
    pub folder_limit: Option<u32>,
+    pub clear_folder_limit: Option<bool>,
    /// Configuration for selective folder (mailbox/label) synchronization
    ///
    /// - For IMAP/SMTP accounts:
@@ -129,6 +145,8 @@ pub struct AccountUpdateRequest {
    /// Incremental sync interval (seconds)
    #[oai(validator(minimum(value = "10"), maximum(value = "480")))]
    pub sync_interval_min: Option<i64>,
+    #[oai(validator(minimum(value = "30"), maximum(value = "200")))]
+    pub sync_batch_size: Option<u32>,
    /// Optional proxy ID for establishing the connection to external APIs (e.g., Gmail, Outlook).
    /// - If `None` or not provided, the client will connect directly to the API server.
    /// - If `Some(proxy_id)`, the client will use the pre-configured proxy with the given ID for API requests.
@@ -141,9 +159,38 @@ pub struct AccountUpdateRequest {

 impl AccountUpdateRequest {
    pub fn validate_update_request(&self, account: &AccountModel) -> BichonResult<()> {
+        if self.date_before.is_some() && self.date_since.is_some() {
+            return Err(raise_error!(
+                "date_before and date_since are mutually exclusive; specify only one time boundary"
+                    .into(),
+                ErrorCode::InvalidParameter
+            ));
+        }
+
+        if self.clear_folder_limit == Some(true) && self.folder_limit.is_some() {
+            return Err(raise_error!(
+                "clear_folder_limit cannot be combined with folder_limit".into(),
+                ErrorCode::InvalidParameter
+            ));
+        }
+
+        if self.clear_date_range == Some(true)
+            && (self.date_since.is_some() || self.date_before.is_some())
+        {
+            return Err(raise_error!(
+                "clear_date_range cannot be combined with date_since or date_before".into(),
+                ErrorCode::InvalidParameter
+            ));
+        }
+
        if let Some(date_since) = self.date_since.as_ref() {
            date_since.validate()?;
        }
+
+        if let Some(date_before) = self.date_before.as_ref() {
+            date_before.validate_date()?;
+        }
+
        if matches!(account.account_type, AccountType::IMAP) {
            if let Some(mailboxes) = self.sync_folders.as_ref() {
                if mailboxes.is_empty() {
@@ -167,11 +214,11 @@ pub struct MinimalAccount {

 pub fn filter_accessible_accounts<'a>(
    all_accounts: &'a [MinimalAccount],
-    allowed: &BTreeSet<AccountInfo>,
+    allowed: &Vec<u64>,
 ) -> Vec<MinimalAccount> {
    all_accounts
        .iter()
-        .filter(|acct| allowed.iter().any(|a| a.id == acct.id))
+        .filter(|acct| allowed.contains(&acct.id))
        .cloned()
        .collect()
 }
--- a/src/modules/account/since.rs
+++ b/src/modules/account/since.rs
@@ -16,7 +16,6 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use crate::{
    modules::error::{code::ErrorCode, BichonResult},
    raise_error,
--- a/src/modules/account/state.rs
+++ b/src/modules/account/state.rs
@@ -69,7 +69,7 @@ impl AccountRunningState {
            errors: vec![],
            is_initial_sync_completed: false,
            progress: None,
-            initial_sync_start_time: None,
+            initial_sync_start_time: Some(utc_now!()),
            initial_sync_end_time: None,
            initial_sync_failed_time: None,
        };
@@ -125,14 +125,14 @@ impl AccountRunningState {
        .await
    }

-    pub async fn set_initial_sync_start(account_id: u64) -> BichonResult<()> {
-        Self::update_account_running_state(account_id, move |current| {
-            let mut updated = current.clone();
-            updated.initial_sync_start_time = Some(utc_now!());
-            Ok(updated)
-        })
-        .await
-    }
+    // pub async fn set_initial_sync_start(account_id: u64) -> BichonResult<()> {
+    //     Self::update_account_running_state(account_id, move |current| {
+    //         let mut updated = current.clone();
+    //         updated.initial_sync_start_time = Some(utc_now!());
+    //         Ok(updated)
+    //     })
+    //     .await
+    // }

    pub async fn set_initial_sync_completed(account_id: u64) -> BichonResult<()> {
        Self::update_account_running_state(account_id, move |current| {
--- a/src/modules/account/view.rs
+++ b/src/modules/account/view.rs
@@ -0,0 +1,91 @@
+//
+// Copyright (c) 2025 rustmailer.com (https://rustmailer.com)
+//
+// This file is part of the Bichon Email Archiving Project
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+use std::collections::{BTreeSet, HashMap};
+
+use poem_openapi::Object;
+use serde::{Deserialize, Serialize};
+
+use crate::modules::{
+    account::{
+        entity::ImapConfig,
+        migration::{AccountModel, AccountType},
+        since::{DateSince, RelativeDate},
+    },
+    users::UserModel,
+};
+
+#[derive(Clone, Debug, Default, Eq, PartialEq, Deserialize, Serialize, Object)]
+pub struct AccountResp {
+    pub id: u64,
+    pub imap: Option<ImapConfig>,
+    pub enabled: bool,
+    pub email: String,
+    pub name: Option<String>,
+    pub capabilities: Option<Vec<String>>,
+    pub date_since: Option<DateSince>,
+    pub date_before: Option<RelativeDate>,
+    pub folder_limit: Option<u32>,
+    pub sync_folders: Option<Vec<String>>,
+    pub account_type: AccountType,
+    pub sync_interval_min: Option<i64>,
+    pub sync_batch_size: Option<u32>,
+    pub known_folders: Option<BTreeSet<String>>,
+    pub created_at: i64,
+    pub updated_at: i64,
+    pub created_by: u64, //user id
+    pub created_user_name: String,
+    pub created_user_email: String,
+    pub use_proxy: Option<u64>,
+    pub use_dangerous: bool,
+    pub pgp_key: Option<String>,
+}
+
+impl AccountResp {
+    pub fn from_model(account: AccountModel, user_map: &HashMap<u64, UserModel>) -> AccountResp {
+        let user = user_map.get(&account.created_by);
+        AccountResp {
+            id: account.id,
+            imap: account.imap,
+            enabled: account.enabled,
+            email: account.email,
+            name: account.name,
+            capabilities: account.capabilities,
+            date_since: account.date_since,
+            date_before: account.date_before,
+            folder_limit: account.folder_limit,
+            sync_folders: account.sync_folders,
+            account_type: account.account_type,
+            sync_interval_min: account.sync_interval_min,
+            sync_batch_size: account.sync_batch_size,
+            known_folders: account.known_folders,
+            created_at: account.created_at,
+            updated_at: account.updated_at,
+            created_by: account.created_by,
+            created_user_name: user
+                .map(|u| u.username.clone())
+                .unwrap_or_else(|| "Unknown".to_string()),
+            created_user_email: user
+                .map(|u| u.email.clone())
+                .unwrap_or_else(|| "N/A".to_string()),
+            use_proxy: account.use_proxy,
+            use_dangerous: account.use_dangerous,
+            pgp_key: account.pgp_key,
+        }
+    }
+}
--- a/src/modules/cache/imap/mailbox.rs
+++ b/src/modules/cache/imap/mailbox.rs
@@ -16,13 +16,12 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use crate::{
    decode_mailbox_name, encode_mailbox_name,
    modules::{
        database::{
-            batch_delete_impl, batch_insert_impl, batch_upsert_impl, filter_by_secondary_key_impl,
-            manager::DB_MANAGER,
+            async_find_impl, batch_delete_impl, batch_insert_impl, batch_upsert_impl, delete_impl,
+            filter_by_secondary_key_impl, manager::DB_MANAGER,
        },
        error::{code::ErrorCode, BichonResult},
    },
@@ -90,25 +89,25 @@ impl MailBox {
    //     Ok(())
    // }

-    // pub async fn get(id: u64) -> RustMailerResult<MailBox> {
-    //     let result = async_find_impl::<MailBox>(DB_MANAGER.envelope_db(), id).await?;
-    //     Ok(result.ok_or_else(|| {
-    //         raise_error!(
-    //             format!("mailbox {} not found", id),
-    //             ErrorCode::InternalError
-    //         )
-    //     })?)
-    // }
+    pub async fn get(id: u64) -> BichonResult<MailBox> {
+        let result = async_find_impl::<MailBox>(DB_MANAGER.envelope_db(), id).await?;
+        Ok(result.ok_or_else(|| {
+            raise_error!(
+                format!("mailbox {} not found", id),
+                ErrorCode::InternalError
+            )
+        })?)
+    }

-    // pub async fn delete(id: u64) -> BichonResult<()> {
-    //     delete_impl(DB_MANAGER.envelope_db(), move |rw| {
-    //         rw.get()
-    //             .primary::<MailBox>(id)
-    //             .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
-    //             .ok_or_else(|| raise_error!("mailbox missing".into(), ErrorCode::InternalError))
-    //     })
-    //     .await
-    // }
+    pub async fn delete(id: u64) -> BichonResult<()> {
+        delete_impl(DB_MANAGER.envelope_db(), move |rw| {
+            rw.get()
+                .primary::<MailBox>(id)
+                .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
+                .ok_or_else(|| raise_error!("mailbox missing".into(), ErrorCode::InternalError))
+        })
+        .await
+    }

    pub async fn list_all(account_id: u64) -> BichonResult<Vec<MailBox>> {
        filter_by_secondary_key_impl(DB_MANAGER.envelope_db(), MailBoxKey::account_id, account_id)
--- a/src/modules/cache/imap/sync/flow.rs
+++ b/src/modules/cache/imap/sync/flow.rs
@@ -16,7 +16,6 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use crate::{
    modules::{
        account::{migration::AccountModel, state::AccountRunningState},
@@ -24,7 +23,7 @@ use crate::{
            imap::{
                find_intersecting_mailboxes, find_missing_mailboxes,
                mailbox::MailBox,
-                sync::rebuild::{rebuild_mailbox_cache, rebuild_mailbox_cache_since_date},
+                sync::rebuild::{rebuild_mailbox_cache, rebuild_mailbox_cache_by_date},
            },
            SEMAPHORE,
        },
@@ -37,17 +36,30 @@ use crate::{
 use std::time::Instant;
 use tracing::{debug, error, info, warn};

-pub const BATCH_SIZE: u32 = 50;
+pub const DEFAULT_BATCH_SIZE: u32 = 50;

-pub async fn fetch_and_save_since_date(
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum FetchDirection {
+    Since,
+    Before,
+}
+
+pub async fn fetch_and_save_by_date(
    account: &AccountModel,
    date: &str,
    mailbox: &MailBox,
+    direction: FetchDirection,
 ) -> BichonResult<usize> {
    let account_id = account.id;
    let executor = MAIL_CONTEXT.imap(account_id).await?;
+
+    let search_criteria = match direction {
+        FetchDirection::Since => format!("SINCE {date}"),
+        FetchDirection::Before => format!("BEFORE {date}"),
+    };
+
    let uid_list = executor
-        .uid_search(&mailbox.encoded_name(), format!("SINCE {date}").as_str())
+        .uid_search(&mailbox.encoded_name(), &search_criteria)
        .await?;

    let len = uid_list.len();
@@ -63,13 +75,23 @@ pub async fn fetch_and_save_since_date(
    if let Some(limit) = folder_limit {
        let limit = limit.max(100) as usize;
        if len > limit {
-            uid_vec = uid_vec.split_off(len - limit as usize);
+            uid_vec = match direction {
+                FetchDirection::Since => uid_vec.split_off(len - limit),
+                FetchDirection::Before => {
+                    uid_vec.truncate(limit);
+                    uid_vec
+                }
+            };
        }
    }

    // let semaphore = Arc::new(Semaphore::new(5));

-    let uid_batches = generate_uid_sequence_hashset(uid_vec, BATCH_SIZE as usize, false);
+    let uid_batches = generate_uid_sequence_hashset(
+        uid_vec,
+        account.sync_batch_size.unwrap_or(DEFAULT_BATCH_SIZE) as usize,
+        false,
+    );
    AccountRunningState::set_initial_current_syncing_folder(
        account_id,
        mailbox.name.clone(),
@@ -105,9 +127,11 @@ pub async fn fetch_and_save_full_mailbox(
        _ => total,
    };
    let page_size = if let Some(limit) = folder_limit {
-        limit.max(100).min(BATCH_SIZE as u32)
+        limit
+            .max(100)
+            .min(account.sync_batch_size.unwrap_or(DEFAULT_BATCH_SIZE))
    } else {
-        BATCH_SIZE as u32
+        account.sync_batch_size.unwrap_or(DEFAULT_BATCH_SIZE)
    };

    let total_batches = total_to_fetch.div_ceil(page_size);
@@ -251,17 +275,30 @@ pub async fn reconcile_mailboxes(

                match &account.date_since {
                    Some(date_since) => {
-                        rebuild_mailbox_cache_since_date(
+                        rebuild_mailbox_cache_by_date(
                            account,
                            local_mailbox.id,
-                            date_since,
+                            &date_since.since_date()?,
                            remote_mailbox,
+                            FetchDirection::Since,
                        )
                        .await?;
                    }
-                    None => {
-                        rebuild_mailbox_cache(account, local_mailbox, remote_mailbox).await?;
-                    }
+                    None => match &account.date_before {
+                        Some(r) => {
+                            rebuild_mailbox_cache_by_date(
+                                account,
+                                local_mailbox.id,
+                                &r.calculate_date()?,
+                                remote_mailbox,
+                                FetchDirection::Before,
+                            )
+                            .await?;
+                        }
+                        None => {
+                            rebuild_mailbox_cache(account, local_mailbox, remote_mailbox).await?
+                        }
+                    },
                }
            } else {
                perform_incremental_sync(account, local_mailbox, remote_mailbox).await?;
@@ -305,14 +342,31 @@ pub async fn reconcile_mailboxes(
                                let _permit = permit;
                                match &account.date_since {
                                    Some(date_since) => {
-                                        rebuild_mailbox_cache_since_date(
-                                            &account, mailbox.id, date_since, &mailbox,
+                                        rebuild_mailbox_cache_by_date(
+                                            &account,
+                                            mailbox.id,
+                                            &date_since.since_date()?,
+                                            &mailbox,
+                                            FetchDirection::Since,
                                        )
                                        .await
                                    }
-                                    None => {
-                                        rebuild_mailbox_cache(&account, &mailbox, &mailbox).await
-                                    }
+                                    None => match &account.date_before {
+                                        Some(r) => {
+                                            rebuild_mailbox_cache_by_date(
+                                                &account,
+                                                mailbox.id,
+                                                &r.calculate_date()?,
+                                                &mailbox,
+                                                FetchDirection::Before,
+                                            )
+                                            .await
+                                        }
+                                        None => {
+                                            rebuild_mailbox_cache(&account, &mailbox, &mailbox)
+                                                .await
+                                        }
+                                    },
                                }
                            });
                        handles.push(handle);
@@ -348,8 +402,14 @@ async fn perform_incremental_sync(
        match local_max_uid {
            Some(max_uid) => {
                let executor = MAIL_CONTEXT.imap(account.id).await?;
+                let before_date = account
+                    .date_before
+                    .as_ref()
+                    .map(|r| r.calculate_date())
+                    .transpose()?;
+
                executor
-                    .fetch_new_mail(account.id, local_mailbox, max_uid + 1)
+                    .fetch_new_mail(account, local_mailbox, max_uid + 1, before_date.as_deref())
                    .await?;
            }
            None => {
@@ -359,10 +419,11 @@ async fn perform_incremental_sync(

                match &account.date_since {
                    Some(date_since) => {
-                        fetch_and_save_since_date(
+                        fetch_and_save_by_date(
                            account,
                            date_since.since_date()?.as_str(),
                            remote_mailbox,
+                            FetchDirection::Since,
                        )
                        .await?;
                    }
--- a/src/modules/cache/imap/sync/mod.rs
+++ b/src/modules/cache/imap/sync/mod.rs
@@ -16,7 +16,6 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use crate::{
    modules::{
        account::{
@@ -24,13 +23,13 @@ use crate::{
            migration::{AccountModel, AccountType},
            state::AccountRunningState,
        },
-        cache::imap::mailbox::MailBox,
+        cache::imap::{mailbox::MailBox, sync::flow::FetchDirection},
        error::BichonResult,
    },
    utc_now,
 };
 use flow::reconcile_mailboxes;
-use rebuild::{rebuild_cache, rebuild_cache_since_date};
+use rebuild::{rebuild_cache, rebuild_cache_by_date};
 use std::time::Instant;
 use sync_folders::get_sync_folders;
 use sync_type::{determine_sync_type, SyncType};
@@ -46,18 +45,35 @@ pub async fn execute_imap_sync(account: &AccountModel) -> BichonResult<()> {
    let start_time = Instant::now();
    let account_id = account.id;
    let sync_type = determine_sync_type(account).await?;
-
    if matches!(sync_type, SyncType::SkipSync) {
        return Ok(());
    }
    let remote_mailboxes = get_sync_folders(account).await?;
    if matches!(sync_type, SyncType::InitialSync) {
-        AccountRunningState::set_initial_sync_start(account_id).await?;
+        AccountRunningState::add(account.id).await?;
+        // AccountRunningState::set_initial_sync_start(account_id).await?;
        let result = match &account.date_since {
            Some(date_since) => {
-                rebuild_cache_since_date(account, &remote_mailboxes, date_since).await
+                rebuild_cache_by_date(
+                    account,
+                    &remote_mailboxes,
+                    &date_since.since_date()?,
+                    FetchDirection::Since,
+                )
+                .await
            }
-            None => rebuild_cache(account, &remote_mailboxes).await,
+            None => match &account.date_before {
+                Some(r) => {
+                    rebuild_cache_by_date(
+                        account,
+                        &remote_mailboxes,
+                        &r.calculate_date()?,
+                        FetchDirection::Before,
+                    )
+                    .await
+                }
+                None => rebuild_cache(account, &remote_mailboxes).await,
+            },
        };
        match result {
            Ok(_) => {
--- a/src/modules/cache/imap/sync/rebuild.rs
+++ b/src/modules/cache/imap/sync/rebuild.rs
@@ -16,14 +16,13 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use crate::{
    modules::{
-        account::{migration::AccountModel, since::DateSince},
+        account::migration::AccountModel,
        cache::{
            imap::{
                mailbox::MailBox,
-                sync::flow::{fetch_and_save_full_mailbox, fetch_and_save_since_date},
+                sync::flow::{fetch_and_save_by_date, fetch_and_save_full_mailbox, FetchDirection},
            },
            SEMAPHORE,
        },
@@ -86,14 +85,14 @@ pub async fn rebuild_cache(
    Ok(())
 }

-pub async fn rebuild_cache_since_date(
+pub async fn rebuild_cache_by_date(
    account: &AccountModel,
    remote_mailboxes: &[MailBox],
-    date_since: &DateSince,
+    date: &str,
+    direction: FetchDirection,
 ) -> BichonResult<()> {
    let start_time = Instant::now();
    let mut total_inserted = 0;
-    let date = date_since.since_date()?;
    MailBox::batch_insert(remote_mailboxes).await?;

    let mut handles = Vec::new();
@@ -107,13 +106,14 @@ pub async fn rebuild_cache_since_date(
        }
        let account = account.clone();
        let mailbox = mailbox.clone();
-        let date = date.clone();
+        let date = date.to_string();
+        let direction = direction.clone();
        match SEMAPHORE.clone().acquire_owned().await {
            Ok(permit) => {
                let handle: tokio::task::JoinHandle<Result<usize, BichonError>> =
                    tokio::spawn(async move {
                        let _permit = permit; // Ensure permit is released when task finishes
-                        fetch_and_save_since_date(&account, date.as_str(), &mailbox).await
+                        fetch_and_save_by_date(&account, date.as_str(), &mailbox, direction).await
                    });
                handles.push(handle);
            }
@@ -132,10 +132,14 @@ pub async fn rebuild_cache_since_date(
        }
    }
    let elapsed_time = start_time.elapsed().as_secs();
+    let direction_desc = match direction {
+        FetchDirection::Since => "starting from the specified date",
+        FetchDirection::Before => "ending before the specified date",
+    };
    info!(
        "Rebuild account cache completed: {} envelopes inserted. {} secs elapsed. \
-        Data fetched from server starting from the specified date: {}.",
-        total_inserted, elapsed_time, date
+     Data fetched from server {}: {}.",
+        total_inserted, elapsed_time, direction_desc, date
    );
    Ok(())
 }
@@ -169,11 +173,12 @@ pub async fn rebuild_mailbox_cache(
    Ok(())
 }

-pub async fn rebuild_mailbox_cache_since_date(
+pub async fn rebuild_mailbox_cache_by_date(
    account: &AccountModel,
    local_mailbox_id: u64,
-    date_since: &DateSince,
+    date: &str,
    remote: &MailBox,
+    direction: FetchDirection,
 ) -> BichonResult<()> {
    ENVELOPE_INDEX_MANAGER
        .delete_mailbox_envelopes(account.id, vec![local_mailbox_id])
@@ -190,8 +195,7 @@ pub async fn rebuild_mailbox_cache_since_date(
        return Ok(()); // Skip if the mailbox has no emails
    }

-    let count =
-        fetch_and_save_since_date(account, date_since.since_date()?.as_str(), remote).await?;
+    let count = fetch_and_save_by_date(account, date, remote, direction).await?;
    info!(
        "Account {}: Successfully rebuild mailbox cache, inserted {} envelopes for mailbox '{}'.",
        account.id, count, &remote.name
--- a/src/modules/cache/imap/sync/sync_type.rs
+++ b/src/modules/cache/imap/sync/sync_type.rs
@@ -16,7 +16,6 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use crate::{
    modules::{
        account::{migration::AccountModel, state::AccountRunningState},
@@ -51,10 +50,7 @@ pub async fn determine_sync_type(account: &AccountModel) -> BichonResult<SyncTyp
                SyncType::SkipSync
            }
        }
-        None => {
-            AccountRunningState::add(account.id).await?;
-            SyncType::InitialSync
-        }
+        None => SyncType::InitialSync,
    })
 }

--- a/src/modules/cli/auth.rs
+++ b/src/modules/cli/auth.rs
@@ -0,0 +1,169 @@
+use std::process;
+
+use console::style;
+use dialoguer::{theme::ColorfulTheme, Select};
+use reqwest::Client;
+
+use crate::modules::{
+    account::payload::MinimalAccount,
+    cli::BichonCtlConfig,
+    users::{permissions::Permission, view::UserView},
+};
+
+pub async fn verify_user_and_get_account(config: &BichonCtlConfig, theme: &ColorfulTheme) -> u64 {
+    let client = Client::new();
+    let url = format!("{}/api/v1/current-user", config.base_url);
+
+    let response = match client
+        .get(&url)
+        .header("Authorization", format!("Bearer {}", config.api_token))
+        .send()
+        .await
+    {
+        Ok(res) => res,
+        Err(e) => {
+            eprintln!(
+                "\n{} {}",
+                style("✘ Network Error:").red().bold(),
+                "Could not connect to Bichon service."
+            );
+            eprintln!("{} {}", style("Details:").dim(), e);
+            eprintln!(
+                "\n{} Please check if the Base URL is correct and the server is running.",
+                style("Tip:").cyan()
+            );
+            process::exit(1);
+        }
+    };
+
+    if !response.status().is_success() {
+        let status = response.status();
+        let error_body = response
+            .text()
+            .await
+            .unwrap_or_else(|_| "No error detail provided".to_string());
+
+        eprintln!(
+            "\n{} Server returned an error (Status: {})",
+            style("✘ API Error:").red().bold(),
+            style(status).yellow()
+        );
+
+        if status == 401 {
+            eprintln!(
+                "{} Your API Token seems to be invalid or expired.",
+                style("Context:").dim()
+            );
+        } else if status == 404 {
+            eprintln!(
+                "{} The endpoint was not found. Please check your Base URL.",
+                style("Context:").dim()
+            );
+        }
+
+        eprintln!("{} {}", style("Response:").dim(), error_body);
+        process::exit(1);
+    }
+
+    let user: UserView = response.json().await.expect("Failed to parse user data");
+    println!("Welcome, {}!", style(&user.username).cyan());
+
+    let account_list_url = format!(
+        "{}/api/v1/minimal-account-list?only_nosync=true",
+        config.base_url
+    );
+    let acc_response = client
+        .get(&account_list_url)
+        .header("Authorization", format!("Bearer {}", config.api_token))
+        .send()
+        .await
+        .expect("Failed to fetch account list");
+
+    if !acc_response.status().is_success() {
+        panic!(
+            "Failed to retrieve accounts. Status: {}",
+            acc_response.status()
+        );
+    }
+
+    let accounts: Vec<MinimalAccount> = acc_response
+        .json()
+        .await
+        .expect("Failed to parse minimal account list");
+
+    if accounts.is_empty() {
+        println!(
+            "\n{}",
+            style("Error: No 'nosync' accounts found.").red().bold()
+        );
+        println!(
+            "{}",
+            style("Mail import is only supported for 'nosync' type accounts.").dim()
+        );
+        println!(
+            "Please create a new {} account in the Bichon web interface first.",
+            style("Nosync").bold().yellow()
+        );
+        process::exit(1);
+    }
+    let required_permission = Permission::DATA_IMPORT_BATCH;
+    let mut selectable_accounts = Vec::new();
+    let mut options = Vec::new();
+
+    for acc in accounts {
+        let has_permission = if let Some(perms) = user.account_permissions.get(&acc.id) {
+            perms.iter().any(|p| p == required_permission)
+        } else {
+            user.global_permissions
+                .iter()
+                .any(|p| p == Permission::DATA_MANAGE_ALL || p == Permission::ROOT)
+        };
+
+        let status_prefix = if has_permission {
+            style(" [READY] ").green()
+        } else {
+            style(" [NO PERMISSION] ").red()
+        };
+
+        options.push(format!(
+            "{}{} - {}",
+            status_prefix,
+            style(&acc.email).bold(),
+            style(format!("ID: {}", acc.id)).dim()
+        ));
+
+        selectable_accounts.push((acc, has_permission));
+    }
+
+    let selection = Select::with_theme(theme)
+        .with_prompt("Select the target account for import")
+        .items(&options)
+        .default(0)
+        .max_length(10)
+        .interact()
+        .unwrap();
+
+    let (selected_acc, can_import) = &selectable_accounts[selection];
+
+    if !*can_import {
+        eprintln!(
+            "\n{} You do not have '{}' permission for account {}.",
+            style("✘ Permission Denied:").red().bold(),
+            style(required_permission).yellow(),
+            style(&selected_acc.email).cyan()
+        );
+        eprintln!(
+            "{} Please contact your administrator to upgrade your role for this account.",
+            style("Tip:").dim()
+        );
+        process::exit(1);
+    }
+
+    println!(
+        "{} Targeting account: {}",
+        style("✔").green(),
+        style(&selected_acc.email).cyan().bold()
+    );
+
+    selected_acc.id
+}
--- a/src/modules/cli/eml/mod.rs
+++ b/src/modules/cli/eml/mod.rs
@@ -0,0 +1,133 @@
+use std::{
+    collections::HashMap,
+    fs,
+    path::{Path, PathBuf},
+};
+
+use console::style;
+use dialoguer::{theme::ColorfulTheme, Input};
+use mail_parser::MessageParser;
+use reqwest::Client;
+
+use crate::{
+    base64_encode_url_safe,
+    modules::cli::{sender::send_batch_request, BichonCtlConfig},
+};
+
+pub async fn handle_eml_directory_import(
+    config: &BichonCtlConfig,
+    account_id: u64,
+    theme: &ColorfulTheme,
+) {
+    let root_str: String = Input::with_theme(theme)
+        .with_prompt("Enter the ROOT directory to scan for .eml files")
+        .validate_with(|input: &String| {
+            let p = std::path::Path::new(input);
+            if p.exists() && p.is_dir() {
+                Ok(())
+            } else {
+                Err("Directory not found.")
+            }
+        })
+        .interact_text()
+        .unwrap();
+
+    let root_path = std::path::PathBuf::from(root_str);
+    let mut tasks: HashMap<String, Vec<PathBuf>> = HashMap::new();
+    println!(
+        "{}",
+        style("🔍 Scanning recursively using std::fs...").dim()
+    );
+    if let Err(e) = scan_dir(&root_path, &root_path, &mut tasks) {
+        eprintln!("Error scanning directory: {}", e);
+        return;
+    }
+
+    if tasks.is_empty() {
+        println!("{}", style("No .eml files found.").yellow());
+    } else {
+        process_and_upload(config, account_id, tasks).await;
+    }
+}
+
+fn scan_dir(
+    root: &Path,
+    current: &Path,
+    tasks: &mut HashMap<String, Vec<PathBuf>>,
+) -> std::io::Result<()> {
+    if current.is_dir() {
+        for entry in fs::read_dir(current)? {
+            let entry = entry?;
+            let path = entry.path();
+
+            if path.is_dir() {
+                scan_dir(root, &path, tasks)?;
+            } else if path.is_file() {
+                if path.extension().and_then(|s| s.to_str()) == Some("eml") {
+                    let rel_path = path.strip_prefix(root).unwrap_or(Path::new(""));
+                    let mailbox_name = rel_path
+                        .parent()
+                        .map(|p| p.to_string_lossy().replace('\\', "/"))
+                        .unwrap_or_default();
+                    let folder = if mailbox_name.is_empty() {
+                        "Inbox".to_string()
+                    } else {
+                        mailbox_name
+                    };
+                    tasks.entry(folder).or_insert_with(|| Vec::new()).push(path);
+                }
+            }
+        }
+    }
+    Ok(())
+}
+
+async fn process_and_upload(
+    config: &BichonCtlConfig,
+    account_id: u64,
+    tasks: HashMap<String, Vec<PathBuf>>,
+) {
+    let client = Client::new();
+    let batch_size = 50;
+
+    for (mailbox, files) in tasks {
+        println!("\n🚀 Processing mailbox: {}", style(&mailbox).cyan().bold());
+
+        let mut current_batch = Vec::new();
+
+        for file_path in files {
+            let body = match fs::read(&file_path) {
+                Ok(b) => b,
+                Err(e) => {
+                    eprintln!(
+                        "  {} Failed to read file {:?}: {}",
+                        style("✘").red(),
+                        file_path,
+                        e
+                    );
+                    continue;
+                }
+            };
+
+            if MessageParser::new().parse(&body).is_some() {
+                let b64_content = base64_encode_url_safe!(&body);
+                current_batch.push(b64_content);
+
+                if current_batch.len() >= batch_size {
+                    let to_send = current_batch;
+                    current_batch = Vec::with_capacity(batch_size);
+                    send_batch_request(&client, config, account_id, &mailbox, to_send).await;
+                }
+            } else {
+                eprintln!(
+                    "  {} Invalid format, skipping: {:?}",
+                    style("⚠").yellow(),
+                    file_path
+                );
+            }
+        }
+        if !current_batch.is_empty() {
+            send_batch_request(&client, config, account_id, &mailbox, current_batch).await;
+        }
+    }
+}
--- a/src/modules/cli/mbox/gmail.rs
+++ b/src/modules/cli/mbox/gmail.rs
@@ -0,0 +1,43 @@
+use std::collections::HashSet;
+
+pub fn determine_folder(labels_raw: &str) -> String {
+    let mut status_blacklist = HashSet::new();
+    status_blacklist.insert("Opened");
+    status_blacklist.insert("Unread");
+    status_blacklist.insert("Archived");
+
+    let all_labels: Vec<&str> = labels_raw
+        .split(',')
+        .map(|s| s.trim())
+        .filter(|s| !s.is_empty())
+        .collect();
+
+    if all_labels.is_empty() {
+        return "Unknown".to_string();
+    }
+
+    let filtered: Vec<&str> = all_labels
+        .iter()
+        .filter(|&&l| !status_blacklist.contains(l))
+        .cloned()
+        .collect();
+
+    match filtered.len() {
+        // Case A: If all labels were status labels, fallback to the first original label
+        0 => all_labels[0].to_string(),
+        // Case B: If only one label remains, that's our target destination
+        1 => filtered[0].to_string(),
+        // Case C: Multiple labels remain (e.g., ["Inbox", "medium"])
+        _ => {
+            // Prioritize custom business labels by excluding generic locations like "Inbox" or "Sent"
+            let business_label = filtered.iter().find(|&&l| l != "Inbox" && l != "Sent");
+
+            match business_label {
+                // Return the first non-generic label found
+                Some(label) => label.to_string(),
+                // If only generic labels remain (e.g., ["Sent", "Inbox"]), pick the first available
+                None => filtered[0].to_string(),
+            }
+        }
+    }
+}
--- a/src/modules/cli/mbox/mod.rs
+++ b/src/modules/cli/mbox/mod.rs
@@ -0,0 +1,145 @@
+use std::collections::HashMap;
+use std::path::PathBuf;
+
+use crate::base64_encode_url_safe;
+use crate::modules::cli::mbox::gmail::determine_folder;
+use crate::modules::cli::mbox::reader::MboxFile;
+use crate::modules::cli::sender::send_batch_request;
+use crate::modules::cli::BichonCtlConfig;
+use console::style;
+use dialoguer::{theme::ColorfulTheme, Input};
+use dialoguer::{Confirm, Select};
+use mail_parser::MessageParser;
+use reqwest::Client;
+
+pub mod gmail;
+pub mod reader;
+
+pub async fn handle_mbox_single_file_import(
+    config: &BichonCtlConfig,
+    account_id: u64,
+    theme: &ColorfulTheme,
+) {
+    let path_str: String = Input::with_theme(theme)
+        .with_prompt("Enter the path to your SINGLE .mbox file")
+        .validate_with(|input: &String| {
+            let p = std::path::Path::new(input);
+            if !p.exists() {
+                return Err("The specified path does not exist.");
+            }
+            if !p.is_file() {
+                return Err("MBOX mode requires a SINGLE file, not a directory.");
+            }
+            Ok(())
+        })
+        .interact_text()
+        .unwrap();
+
+    let mbox_path = PathBuf::from(path_str);
+
+    let options = vec![
+        "Use labels from mail headers (X-Gmail-Labels)",
+        "Specify a single target folder for all emails",
+    ];
+
+    let selection = Select::with_theme(theme)
+        .with_prompt("How should we determine the target folder?")
+        .items(&options)
+        .default(0)
+        .interact()
+        .unwrap();
+
+    let target_folder: Option<String> = match selection {
+        0 => None,
+        1 => {
+            let folder: String = Input::with_theme(theme)
+                .with_prompt("Target folder name")
+                .default("INBOX".into())
+                .interact_text()
+                .unwrap();
+            Some(folder)
+        }
+        _ => unreachable!(),
+    };
+
+    if let Some(ref folder) = target_folder {
+        println!(
+            "{}",
+            style(format!("Mode: Fixed folder ({})", folder)).dim()
+        );
+    } else {
+        println!("{}", style("Mode: Dynamic (header-based)").dim());
+    }
+
+    println!(
+        "\n{} Ready to process MBOX file: {}",
+        style("✔").green(),
+        style(mbox_path.display()).cyan()
+    );
+
+    if let Ok(meta) = std::fs::metadata(&mbox_path) {
+        let size_mb = meta.len() as f64 / 1024.0 / 1024.0;
+        println!(
+            "{}",
+            style(format!("Processing file: {:.1} MB", size_mb)).dim()
+        );
+    }
+
+    if Confirm::with_theme(theme)
+        .with_prompt("Start importing?")
+        .default(true)
+        .interact()
+        .unwrap()
+    {
+        run_import(account_id, &mbox_path, config, target_folder).await
+    }
+}
+
+pub async fn run_import(
+    account_id: u64,
+    mbox_path: &PathBuf,
+    config: &BichonCtlConfig,
+    target_folder: Option<String>,
+) {
+    let client = Client::new();
+    let mbox = MboxFile::from_file(mbox_path).unwrap();
+
+    let mut folder_buffers: HashMap<String, Vec<String>> = HashMap::new();
+    let batch_limit = 50;
+
+    println!("Starting import process...");
+
+    for e in mbox.iter() {
+        let body = e.data;
+        let message = MessageParser::new().parse(body).unwrap();
+
+        let folder_name = match target_folder {
+            Some(ref folder_name) => folder_name.clone(),
+            None => {
+                let labels = message
+                    .header("X-Gmail-Labels")
+                    .and_then(|h| h.as_text())
+                    .unwrap_or("Inbox");
+                determine_folder(labels)
+            }
+        };
+        let b64_eml = base64_encode_url_safe!(&body);
+        let buffer = folder_buffers
+            .entry(folder_name.clone())
+            .or_insert_with(|| Vec::new());
+        buffer.push(b64_eml);
+
+        if buffer.len() >= batch_limit {
+            let emls_to_send = folder_buffers.remove(&folder_name).unwrap();
+            send_batch_request(&client, config, account_id, &folder_name, emls_to_send).await;
+        }
+    }
+
+    for (folder_name, emls) in folder_buffers {
+        if !emls.is_empty() {
+            send_batch_request(&client, config, account_id, &folder_name, emls).await;
+        }
+    }
+
+    println!("{}", style("Import completed successfully!").green().bold());
+}
--- a/src/modules/cli/mbox/reader.rs
+++ b/src/modules/cli/mbox/reader.rs
@@ -0,0 +1,210 @@
+use memmap2::Mmap;
+use std::fs;
+use std::io;
+use std::path::Path;
+
+pub struct MboxFile {
+    map: Mmap,
+}
+
+impl MboxFile {
+    pub fn from_file(name: &Path) -> io::Result<Self> {
+        let file = fs::File::open(name)?;
+        let metadata = file.metadata()?;
+        if metadata.len() == 0 {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                "Empty MBOX file",
+            ));
+        }
+        let map = unsafe { Mmap::map(&file)? };
+        Ok(Self { map })
+    }
+
+    pub fn iter(&self) -> MboxReader<'_> {
+        MboxReader::new(&self.map)
+    }
+}
+
+pub struct Entry<'a> {
+    pub offset: usize,
+    pub data: &'a [u8],
+}
+
+pub struct MboxReader<'a> {
+    data: &'a [u8],
+    len: usize,
+    scan_pos: usize,
+    body_start: Option<usize>,
+}
+
+impl<'a> MboxReader<'a> {
+    fn new(data: &'a [u8]) -> Self {
+        Self {
+            data,
+            len: data.len(),
+            scan_pos: 0,
+            body_start: None,
+        }
+    }
+
+    fn is_from_line(&self, i: usize) -> bool {
+        if i + 5 > self.len {
+            return false;
+        }
+
+        if i == 0 {
+            &self.data[0..5] == b"From "
+        } else {
+            self.data[i - 1] == b'\n' && &self.data[i..i + 5] == b"From "
+        }
+    }
+
+    fn skip_from_line(&self, mut i: usize) -> usize {
+        while i < self.len && self.data[i] != b'\n' {
+            i += 1;
+        }
+        if i < self.len {
+            i += 1;
+        }
+        i
+    }
+}
+
+impl<'a> Iterator for MboxReader<'a> {
+    type Item = Entry<'a>;
+
+    fn next(&mut self) -> Option<Self::Item> {
+        while self.scan_pos < self.len {
+            if self.is_from_line(self.scan_pos) {
+                let from_pos = self.scan_pos;
+                let body_pos = self.skip_from_line(from_pos);
+
+                if let Some(start) = self.body_start {
+                    let entry = Entry {
+                        offset: start,
+                        data: &self.data[start..from_pos],
+                    };
+                    self.body_start = Some(body_pos);
+                    self.scan_pos = body_pos;
+                    return Some(entry);
+                } else {
+                    self.body_start = Some(body_pos);
+                    self.scan_pos = body_pos;
+                    continue;
+                }
+            }
+
+            self.scan_pos += 1;
+        }
+        if let Some(start) = self.body_start.take() {
+            return Some(Entry {
+                offset: start,
+                data: &self.data[start..self.len],
+            });
+        }
+        None
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use mail_parser::MessageParser;
+
+    use crate::modules::cli::mbox::gmail::determine_folder;
+
+    use super::*;
+
+    fn collect_entries(data: &[u8]) -> Vec<&[u8]> {
+        let reader = MboxReader::new(data);
+        reader.map(|e| e.data).collect()
+    }
+
+    #[test]
+    fn two_mails() {
+        let data = b"From a\nmail1\nFrom b\nmail2\n";
+        let e = collect_entries(data);
+        assert_eq!(e, vec![b"mail1\n", b"mail2\n"]);
+    }
+    #[test]
+    fn no_trailing_newline() {
+        let data = b"From a\nmail1";
+        let e = collect_entries(data);
+        assert_eq!(e, vec![b"mail1"]);
+    }
+
+    #[test]
+    fn from_inside_body() {
+        let data = b"From a\nhello\nFrom is here\nbye\n";
+        let e = collect_entries(data);
+        assert_eq!(e.len(), 2);
+    }
+
+    #[test]
+    fn inline_from_not_separator() {
+        let data = b"From a\nhello From world\n";
+        let e = collect_entries(data);
+        assert_eq!(e.len(), 1);
+    }
+
+    #[test]
+    fn realistic_mbox() {
+        let data = b"From a\nH:1\n\nbody1\nFrom b\nH:2\n\nbody2\n";
+        let e = collect_entries(data);
+        assert_eq!(e.len(), 2);
+    }
+
+    #[test]
+    fn empty_body() {
+        let data = b"From a\nFrom b\nbody\n";
+        let e = collect_entries(data);
+        assert_eq!(e[0], b"");
+        assert_eq!(e[1], b"body\n");
+    }
+
+    #[test]
+    fn only_from_line() {
+        let data = b"From a\n";
+        let e = collect_entries(data);
+        assert_eq!(e.len(), 1);
+        assert_eq!(e[0], b"");
+    }
+
+    #[test]
+    fn windows_newlines() {
+        let data = b"From a\r\nbody\r\nFrom b\r\nbody2\r\n";
+        let e = collect_entries(data);
+        assert_eq!(e.len(), 2);
+    }
+
+    #[test]
+    fn many_small_mails() {
+        let mut data = Vec::new();
+        for i in 0..1000 {
+            data.extend_from_slice(b"From a\nx\n");
+        }
+        let e = collect_entries(&data);
+        assert_eq!(e.len(), 1000);
+    }
+
+    #[test]
+    fn test11() {
+        let mbox = MboxFile::from_file(Path::new("e:\\test.mbox")).unwrap();
+
+        for e in mbox.iter() {
+            let body = e.data;
+
+            let message = MessageParser::new().parse(body).unwrap();
+            let labels = message.header("X-Gmail-Labels").unwrap().as_text().unwrap();
+            //println!("offset={} X-Gmail-Labels={:?}", e.offset, labels);
+            println!(
+                "X-Gmail-Labels={:?}, determine_folder={}",
+                labels,
+                determine_folder(labels)
+            )
+
+
+            
+        }
+    }
+}
--- a/src/modules/cli/mod.rs
+++ b/src/modules/cli/mod.rs
@@ -0,0 +1,34 @@
+use clap::Parser;
+use serde::{Deserialize, Serialize};
+
+use crate::bichon_version;
+
+pub mod auth;
+pub mod eml;
+pub mod mbox;
+pub mod sender;
+pub mod thunderbird;
+#[derive(Parser, Debug)]
+#[command(
+    name = "bichonctl",
+    author = "rustmailer",
+    version = bichon_version!(),
+    about = "A CLI tool to import email data into Bichon service"
+)]
+pub struct BichonCli {
+    /// Path to the configuration file
+    #[arg(
+        short,
+        long,
+        default_value = "config.toml",
+        value_name = "FILE",
+        help = "Sets a custom config file"
+    )]
+    pub config: std::path::PathBuf,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct BichonCtlConfig {
+    pub base_url: String,
+    pub api_token: String,
+}
--- a/src/modules/cli/sender.rs
+++ b/src/modules/cli/sender.rs
@@ -0,0 +1,54 @@
+use console::style;
+use reqwest::Client;
+
+use crate::modules::{cli::BichonCtlConfig, import::BatchEmlRequest};
+
+pub async fn send_batch_request(
+    client: &Client,
+    config: &BichonCtlConfig,
+    account_id: u64,
+    folder: &str,
+    emls: Vec<String>,
+) {
+    let url = format!("{}/api/v1/import", config.base_url);
+    let payload = BatchEmlRequest {
+        account_id,
+        mail_folder: folder.to_string(),
+        emls,
+    };
+
+    let count = payload.emls.len();
+
+    match client
+        .post(&url)
+        .header("Authorization", format!("Bearer {}", config.api_token))
+        .json(&payload)
+        .send()
+        .await
+    {
+        Ok(res) if res.status().is_success() => {
+            println!(
+                "  {} Sent {} emails to [{}]",
+                style("✔").green(),
+                count,
+                folder
+            );
+        }
+        Ok(res) => {
+            eprintln!(
+                "  {} Failed to send to [{}]. Status: {}",
+                style("✘").red(),
+                folder,
+                res.status()
+            );
+        }
+        Err(e) => {
+            eprintln!(
+                "  {} Network error on [{}]: {}",
+                style("✘").red(),
+                folder,
+                e
+            );
+        }
+    }
+}
--- a/src/modules/cli/thunderbird/mod.rs
+++ b/src/modules/cli/thunderbird/mod.rs
@@ -0,0 +1,114 @@
+use std::{collections::HashMap, path::PathBuf};
+
+use crate::modules::cli::{mbox::run_import, BichonCtlConfig};
+use console::style;
+use dialoguer::{theme::ColorfulTheme, Confirm, Input};
+
+pub async fn handle_thunderbird_import(
+    config: &BichonCtlConfig,
+    account_id: u64,
+    theme: &ColorfulTheme,
+) {
+    let root_str: String = Input::with_theme(theme)
+        .with_prompt("Enter your Thunderbird Mail/ImapMail directory")
+        .validate_with(|input: &String| {
+            let p = std::path::Path::new(input);
+            if p.exists() && p.is_dir() {
+                Ok(())
+            } else {
+                Err("Directory not found.")
+            }
+        })
+        .interact_text()
+        .unwrap();
+
+    let root_path = std::path::PathBuf::from(&root_str);
+    println!("{}", style("🔍 Scanning Thunderbird structure...").dim());
+
+    let mut mbox_tasks: HashMap<String, PathBuf> = HashMap::new();
+
+    fn scan_thunderbird_dir(
+        root: &std::path::Path,
+        current: &std::path::Path,
+        tasks: &mut HashMap<String, PathBuf>,
+    ) {
+        if let Ok(entries) = std::fs::read_dir(current) {
+            for entry in entries.flatten() {
+                let path = entry.path();
+                let file_name = path.file_name().and_then(|s| s.to_str()).unwrap_or("");
+
+                if path.is_dir() {
+                    scan_thunderbird_dir(root, &path, tasks);
+                } else {
+                    let extension = path.extension().and_then(|s| s.to_str()).unwrap_or("");
+                    match extension {
+                        "msf" | "dat" | "html" | "json" | "txt" | "sqlite" => continue,
+                        _ => {}
+                    }
+
+                    if file_name == "filterlog.html" || file_name == "msgFilterRules.dat" {
+                        continue;
+                    }
+
+                    if !extension.is_empty() {
+                        continue;
+                    }
+
+                    if let Ok(rel) = path.strip_prefix(root) {
+                        let mailbox = rel.to_string_lossy().replace(".sbd", "").replace('\\', "/");
+                        tasks.insert(mailbox, path);
+                    }
+                }
+            }
+        }
+    }
+
+    scan_thunderbird_dir(&root_path, &root_path, &mut mbox_tasks);
+    if mbox_tasks.is_empty() {
+        println!(
+            "{}",
+            style("No mailboxes found in the specified directory.").yellow()
+        );
+        return;
+    }
+
+    println!("\n{}", style("🔍 Scanned Mailboxes:").bold().underlined());
+    let mut sorted_keys: Vec<_> = mbox_tasks.keys().collect();
+    sorted_keys.sort();
+
+    for name in &sorted_keys {
+        let path = &mbox_tasks[*name];
+        let file_size = std::fs::metadata(path).map(|m| m.len()).unwrap_or(0);
+        let size_mb = file_size as f64 / 1024.0 / 1024.0;
+
+        println!(
+            "  {} {} ({:.2} MB)",
+            style("•").dim(),
+            style(name).cyan(),
+            size_mb
+        );
+    }
+
+    println!();
+    let prompt = format!("Ready to import {} mailboxes. Proceed?", mbox_tasks.len());
+    if Confirm::with_theme(theme)
+        .with_prompt(prompt)
+        .default(true)
+        .interact()
+        .unwrap()
+    {
+        // 3. 执行导入
+        for (mailbox_name, mbox_file) in mbox_tasks {
+            println!("\n🚀 Importing: {}", style(&mailbox_name).cyan().bold());
+            run_import(account_id, &mbox_file, config, Some(mailbox_name)).await;
+        }
+        println!(
+            "\n{}",
+            style("✨ All mailboxes imported successfully!")
+                .green()
+                .bold()
+        );
+    } else {
+        println!("{}", style("Import cancelled.").yellow());
+    }
+}
--- a/src/modules/common/auth.rs
+++ b/src/modules/common/auth.rs
@@ -16,12 +16,11 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use crate::{
    modules::{
        error::{code::ErrorCode, BichonResult},
-        settings::{cli::SETTINGS, system::SystemSetting},
-        token::{root::ROOT_TOKEN, AccessToken, AccountInfo},
+        token::AccessTokenModel,
+        users::{permissions::Permission, role::UserRole, UserModel},
        utils::rate_limit::RATE_LIMITER_MANAGER,
    },
    raise_error,
@@ -35,7 +34,11 @@ use poem::{
    Endpoint, FromRequest, Middleware, Request, RequestBody, Result,
 };
 use serde::Deserialize;
-use std::{collections::BTreeSet, net::IpAddr, sync::Arc};
+use std::{
+    collections::{BTreeSet, HashSet},
+    net::IpAddr,
+    sync::Arc,
+};

 use super::create_api_error_response;

@@ -68,62 +71,101 @@ impl<E: Endpoint> Endpoint for ApiGuardEndpoint<E> {
    }
 }

-#[derive(Clone, Debug, Default)]
+#[derive(Clone, Debug)]
 pub struct ClientContext {
    pub ip_addr: Option<IpAddr>,
-    pub access_token: Option<AccessToken>,
-    pub is_root: bool,
+    pub user: UserModel,
 }

 impl ClientContext {
-    pub fn require_root(&self) -> BichonResult<()> {
-        if !SETTINGS.bichon_enable_access_token || self.is_root {
-            Ok(())
-        } else {
-            Err(raise_error!(
-                "Root access required".into(),
-                ErrorCode::PermissionDenied
-            ))
-        }
-    }
-
-    pub fn require_authorized(&self) -> BichonResult<()> {
-        if !SETTINGS.bichon_enable_access_token || self.is_root || self.access_token.is_some() {
-            Ok(())
-        } else {
-            Err(raise_error!(
-                "Authorization required".into(),
-                ErrorCode::PermissionDenied
-            ))
-        }
-    }
-
-    pub fn require_account_access(&self, account_id: u64) -> BichonResult<()> {
-        if !SETTINGS.bichon_enable_access_token || self.is_root {
-            return Ok(());
-        }
-
-        match &self.access_token {
-            Some(token) if token.can_access_account(account_id) => Ok(()),
-            _ => Err(raise_error!(format!(
-                "You do not have permission to access the requested email account (ID: {}). Please check your access rights or contact the administrator.",
-                account_id
-            ), ErrorCode::PermissionDenied)),
-        }
-    }
-
-    pub fn accessible_accounts(&self) -> BichonResult<Option<&BTreeSet<AccountInfo>>> {
-        if !SETTINGS.bichon_enable_access_token || self.is_root {
-            Ok(None) // All accounts are accessible
-        } else {
-            match &self.access_token {
-                Some(token) => Ok(Some(&token.accounts)),
-                None => Err(raise_error!(
-                    "Missing access token".into(),
-                    ErrorCode::PermissionDenied
-                )),
+    pub async fn require_any_permission(
+        &self,
+        requirements: Vec<(Option<u64>, &str)>,
+    ) -> BichonResult<()> {
+        for (account_id, permission) in requirements {
+            if self.has_permission(account_id, permission).await {
+                return Ok(());
            }
        }
+        Err(raise_error!(
+            "Access denied: Insufficient permissions to perform this action.".into(),
+            ErrorCode::Forbidden
+        ))
+    }
+
+    pub async fn has_permission(&self, account_id: Option<u64>, permission: &str) -> bool {
+        if self.user.is_admin().await {
+            return true;
+        }
+
+        let mut global_perms = HashSet::new();
+        for rid in &self.user.global_roles {
+            if let Some(role) = UserRole::find(*rid).await.ok().flatten() {
+                global_perms.extend(role.permissions);
+            }
+        }
+
+        if self.check_global_logic(&global_perms, permission) {
+            return true;
+        }
+
+        if let Some(aid) = account_id {
+            if let Some(role_id) = self.user.account_access_map.get(&aid) {
+                if let Some(role) = UserRole::find(*role_id).await.ok().flatten() {
+                    if role.permissions.contains(&permission.to_string())
+                        || self.check_account_logic(&role.permissions, permission)
+                    {
+                        return true;
+                    }
+                }
+            }
+        }
+
+        false
+    }
+
+    fn check_global_logic(&self, global: &HashSet<String>, perm: &str) -> bool {
+        if global.contains(perm) {
+            return true;
+        }
+
+        match perm {
+            Permission::DATA_READ => global.contains(Permission::DATA_READ_ALL),
+            Permission::DATA_DELETE => global.contains(Permission::DATA_DELETE_ALL),
+            Permission::DATA_RAW_DOWNLOAD => global.contains(Permission::DATA_RAW_DOWNLOAD_ALL),
+            Permission::DATA_EXPORT_BATCH => global.contains(Permission::DATA_EXPORT_BATCH_ALL),
+            Permission::ACCOUNT_MANAGE | Permission::ACCOUNT_READ_DETAILS => {
+                global.contains(Permission::ACCOUNT_MANAGE_ALL)
+            }
+            _ => false,
+        }
+    }
+
+    fn check_account_logic(&self, scoped_perms: &BTreeSet<String>, perm: &str) -> bool {
+        if scoped_perms.contains(perm) {
+            return true;
+        }
+        match perm {
+            Permission::DATA_READ | Permission::ACCOUNT_READ_DETAILS => {
+                scoped_perms.contains(Permission::ACCOUNT_MANAGE)
+            }
+            _ => false,
+        }
+    }
+
+    pub async fn require_permission(
+        &self,
+        account_id: Option<u64>,
+        permission: &str,
+    ) -> BichonResult<()> {
+        if self.has_permission(account_id, permission).await {
+            Ok(())
+        } else {
+            Err(raise_error!(
+                format!("Access Denied: Missing permission '{}'", permission),
+                ErrorCode::Forbidden
+            ))
+        }
    }
 }

@@ -134,98 +176,76 @@ impl<'a> FromRequest<'a> for ClientContext {
 }

 pub async fn extract_client_context(req: &Request) -> Result<ClientContext> {
-    if SETTINGS.bichon_enable_access_token {
-        let ip_addr = RealIp::from_request_without_body(req)
-            .await
-            .map_err(|_| {
-                create_api_error_response(
-                    "Failed to parse client IP address",
-                    ErrorCode::InvalidParameter,
-                )
-            })?
-            .0
-            .ok_or_else(|| {
-                create_api_error_response(
-                    "Failed to parse client IP address",
-                    ErrorCode::InvalidParameter,
-                )
-            })?;
-        // Extract access token from Bearer header or query params
-        let bearer = req
-            .headers()
-            .typed_get::<Authorization<Bearer>>()
-            .map(|auth| auth.0.token().to_string())
-            .or_else(|| req.params::<Param>().ok().map(|param| param.access_token));
+    let ip_addr = RealIp::from_request_without_body(req)
+        .await
+        .map_err(|_| {
+            create_api_error_response(
+                "Failed to parse client IP address",
+                ErrorCode::InvalidParameter,
+            )
+        })?
+        .0
+        .ok_or_else(|| {
+            create_api_error_response(
+                "Failed to parse client IP address",
+                ErrorCode::InvalidParameter,
+            )
+        })?;
+    // Extract access token from Bearer header or query params
+    let bearer = req
+        .headers()
+        .typed_get::<Authorization<Bearer>>()
+        .map(|auth| auth.0.token().to_string())
+        .or_else(|| req.params::<Param>().ok().map(|param| param.access_token));

-        let token = bearer.ok_or_else(|| {
-            create_api_error_response("Valid access token not found", ErrorCode::PermissionDenied)
+    let token = bearer.ok_or_else(|| {
+        create_api_error_response("Valid access token not found", ErrorCode::PermissionDenied)
+    })?;
+
+    // Validate and update access token
+    let user = AccessTokenModel::resolve_user_from_token(&token)
+        .await
+        .map_err(|e| {
+            create_api_error_response(&format!("{:#?}", e), ErrorCode::PermissionDenied)
        })?;

-        // Check for root token
-        if let Ok(Some(root)) = SystemSetting::get(ROOT_TOKEN) {
-            if root.value == token {
-                return Ok(ClientContext {
-                    ip_addr: Some(ip_addr),
-                    access_token: None,
-                    is_root: true,
-                });
-            }
-        }
-
-        // Validate and update access token
-        let validated_token = AccessToken::try_update_access_timestamp(&token)
-            .await
-            .map_err(|_| {
-                create_api_error_response("Invalid access token", ErrorCode::PermissionDenied)
-            })?;
-
-        return Ok(ClientContext {
-            ip_addr: Some(ip_addr),
-            access_token: Some(validated_token),
-            is_root: false,
-        });
-    }
-
-    Ok(Default::default())
+    return Ok(ClientContext {
+        ip_addr: Some(ip_addr),
+        user,
+    });
 }

 pub async fn authorize_access(req: &Request) -> Result<ClientContext, poem::Error> {
    let context = extract_client_context(&req).await?;
-    context.require_authorized().map_err(|error| {
-        create_api_error_response(&error.to_string(), ErrorCode::PermissionDenied)
-    })?;
-
-    if let Some(access_token) = &context.access_token {
-        if let Some(access_control) = &access_token.acl {
-            if let Some(ip_addr) = context.ip_addr {
-                if let Some(whitelist) = &access_control.ip_whitelist {
-                    if !whitelist.contains(&ip_addr.to_string()) {
-                        return Err(create_api_error_response(
-                            &format!("IP {} not in whitelist", ip_addr),
-                            ErrorCode::PermissionDenied,
-                        ));
-                    }
-                }
-            }
-
-            if let Some(rate_limit) = &access_control.rate_limit {
-                if let Err(not_until) = RATE_LIMITER_MANAGER
-                    .check(&access_token.token, rate_limit.clone())
-                    .await
-                {
-                    let wait_duration = not_until.wait_time_from(QuantaClock::default().now());
+    if let Some(access_control) = &context.user.acl {
+        if let Some(ip_addr) = context.ip_addr {
+            if let Some(whitelist) = &access_control.ip_whitelist {
+                if !whitelist.contains(&ip_addr.to_string()) {
                    return Err(create_api_error_response(
-                        &format!(
-                            "Rate limit: {}/{}s. Retry after {}s",
-                            rate_limit.quota,
-                            rate_limit.interval,
-                            wait_duration.as_secs()
-                        ),
-                        ErrorCode::TooManyRequest,
+                        &format!("IP {} not in whitelist", ip_addr),
+                        ErrorCode::Forbidden,
                    ));
                }
            }
        }
+
+        if let Some(rate_limit) = &access_control.rate_limit {
+            if let Err(not_until) = RATE_LIMITER_MANAGER
+                .check(context.user.id, rate_limit.clone())
+                .await
+            {
+                let wait_duration = not_until.wait_time_from(QuantaClock::default().now());
+                return Err(create_api_error_response(
+                    &format!(
+                        "Rate limit: {}/{}s. Retry after {}s",
+                        rate_limit.quota,
+                        rate_limit.interval,
+                        wait_duration.as_secs()
+                    ),
+                    ErrorCode::TooManyRequest,
+                ));
+            }
+        }
    }

    Ok(context)
--- a/src/modules/common/timeout.rs
+++ b/src/modules/common/timeout.rs
@@ -25,7 +25,7 @@ use crate::modules::error::code::ErrorCode;

 use super::create_api_error_response;

-pub const TIMEOUT_HEADER: &str = "X-RustMailer-Timeout-Seconds";
+pub const TIMEOUT_HEADER: &str = "X-Bichon-Timeout-Seconds";

 pub struct Timeout;

@@ -63,7 +63,7 @@ impl<E: Endpoint> Endpoint for TimeoutEndpoint<E> {
                error!("Request timed out after {} seconds", seconds);
                Err(create_api_error_response(
                    &format!(
-                        "Request timed out after {} seconds (timeout set via X-RustMailer-Timeout-Seconds header, max allowed: 600 seconds)",
+                        "Request timed out after {} seconds (timeout set via X-Bichon-Timeout-Seconds header, max allowed: 600 seconds)",
                        seconds
                    ),
                    ErrorCode::RequestTimeout,
--- a/src/modules/context/executors.rs
+++ b/src/modules/context/executors.rs
@@ -63,7 +63,7 @@ impl EmailClientExecutors {
        }

        let pool = build_imap_pool(account_id).await?;
-        let new_executor = Arc::new(ImapExecutor::new(pool));
+        let new_executor = Arc::new(ImapExecutor::new(account_id, pool));

        match self.imap.try_entry(account_id) {
            Some(dashmap::mapref::entry::Entry::Occupied(entry)) => Ok(entry.get().clone()),
--- a/src/modules/context/mod.rs
+++ b/src/modules/context/mod.rs
@@ -16,13 +16,13 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use crate::modules::error::BichonResult;

 pub mod controller;
 pub mod executors;
 pub mod status;

+#[allow(async_fn_in_trait)]
 pub trait Initialize {
    async fn initialize() -> BichonResult<()>;
 }
--- a/src/modules/dashboard/mod.rs
+++ b/src/modules/dashboard/mod.rs
@@ -16,14 +16,17 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

+use crate::modules::users::permissions::Permission;
 use poem_openapi::Object;
 use serde::{Deserialize, Serialize};
+use std::collections::HashSet;
 use tantivy::{schema::Value, TantivyDocument};

 use crate::{
    bichon_version,
    modules::{
        account::migration::AccountModel,
+        common::auth::ClientContext,
        error::{code::ErrorCode, BichonResult},
        indexer::{manager::ENVELOPE_INDEX_MANAGER, schema::SchemaTools},
        settings::dir::DATA_DIR_MANAGER,
@@ -50,17 +53,47 @@ pub struct DashboardStats {
 }

 impl DashboardStats {
-    pub async fn get() -> BichonResult<Self> {
-        let mut stat = ENVELOPE_INDEX_MANAGER.get_dashboard_stats().await?;
-        stat.top_largest_emails = ENVELOPE_INDEX_MANAGER.top_10_largest_emails().await?;
-        stat.email_count = ENVELOPE_INDEX_MANAGER.total_emails()?;
-        stat.account_count = AccountModel::count().await?;
-        stat.storage_usage_bytes = get_total_size(&DATA_DIR_MANAGER.eml_dir)
-            .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
-        stat.index_usage_bytes = get_total_size(&DATA_DIR_MANAGER.envelope_dir)
-            .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+    pub async fn get(context: ClientContext) -> BichonResult<Self> {
+        let has_all_accounts = context
+            .has_permission(None, Permission::ACCOUNT_MANAGE_ALL)
+            .await;
+
+        let authorized_ids: Option<HashSet<u64>> = if has_all_accounts {
+            None
+        } else {
+            Some(context.user.account_access_map.keys().cloned().collect())
+        };
+
+        let mut stat = ENVELOPE_INDEX_MANAGER
+            .get_dashboard_stats(&authorized_ids)
+            .await?;
+
+        stat.top_largest_emails = ENVELOPE_INDEX_MANAGER
+            .top_10_largest_emails(&authorized_ids)
+            .await?;
+
+        stat.account_count = if has_all_accounts {
+            AccountModel::count().await?
+        } else {
+            authorized_ids.as_ref().map(|ids| ids.len()).unwrap_or(0)
+        };
+
+        stat.email_count = ENVELOPE_INDEX_MANAGER.total_emails(&authorized_ids)?;
+
+        if has_all_accounts {
+            stat.storage_usage_bytes = get_total_size(&DATA_DIR_MANAGER.eml_dir)
+                .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+
+            stat.index_usage_bytes = get_total_size(&DATA_DIR_MANAGER.envelope_dir)
+                .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+        } else {
+            stat.storage_usage_bytes = 0;
+            stat.index_usage_bytes = 0;
+        }
+
        stat.system_version = bichon_version!().to_string();
        stat.commit_hash = env!("GIT_HASH").to_string();
+
        Ok(stat)
    }
 }
--- a/src/modules/database/manager.rs
+++ b/src/modules/database/manager.rs
@@ -21,6 +21,7 @@ use crate::modules::cache::imap::MAILBOX_MODELS;
 use crate::modules::error::{code::ErrorCode, BichonError};
 use crate::modules::settings::cli::SETTINGS;
 use crate::modules::settings::dir::DATA_DIR_MANAGER;
+use crate::modules::users::UserModel;
 use crate::modules::{database::META_MODELS, error::BichonResult};
 use crate::raise_error;
 use native_db::{Builder, Database};
@@ -73,6 +74,8 @@ impl DatabaseManager {
            .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
        rw.migrate::<AccountModel>()
            .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+        rw.migrate::<UserModel>()
+            .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
        rw.commit()
            .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;

--- a/src/modules/database/mod.rs
+++ b/src/modules/database/mod.rs
@@ -16,7 +16,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-use crate::modules::account::migration::{AccountV1, AccountV2};
+use crate::modules::account::migration::{AccountV1, AccountV2, AccountV3};
 use crate::modules::autoconfig::CachedMailSettings;
 use crate::modules::error::code::ErrorCode;
 use crate::modules::error::BichonResult;
@@ -25,7 +25,9 @@ use crate::modules::oauth2::pending::OAuth2PendingEntity;
 use crate::modules::oauth2::token::OAuth2AccessToken;
 use crate::modules::settings::proxy::Proxy;
 use crate::modules::settings::system::SystemSetting;
-use crate::modules::token::AccessToken;
+use crate::modules::token::AccessTokenModel;
+use crate::modules::users::role::UserRole;
+use crate::modules::users::{BichonUser, BichonUserV2};
 use crate::raise_error;
 use db_type::{KeyOptions, ToKeyDefinition};
 use itertools::Itertools;
@@ -58,15 +60,21 @@ impl ModelsAdapter {
    }

    pub fn register_metadata_models(&mut self) {
-        self.register_model::<AccessToken>();
+        //Starting from version 0.2.0, `AccessToken` is deprecated/no longer used, but its ID must not be reused, otherwise it may cause model errors.
+        //self.register_model::<AccessToken>();
        self.register_model::<SystemSetting>();
        self.register_model::<CachedMailSettings>();
        self.register_model::<AccountV1>();
        self.register_model::<AccountV2>();
+        self.register_model::<AccountV3>();
        self.register_model::<OAuth2>();
        self.register_model::<OAuth2PendingEntity>();
        self.register_model::<OAuth2AccessToken>();
        self.register_model::<Proxy>();
+        self.register_model::<UserRole>();
+        self.register_model::<BichonUser>();
+        self.register_model::<BichonUserV2>();
+        self.register_model::<AccessTokenModel>();
    }
 }

@@ -170,11 +178,11 @@ pub async fn update_impl<T: ToInput + Clone + std::fmt::Debug + Send + 'static>(
            .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
        let current_item = current(&rw)?;
        let updated_item = updated(&current_item)?;
-        rw.update(current_item.clone(), updated_item)
+        rw.update(current_item, updated_item.clone())
            .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
        rw.commit()
            .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
-        Ok(current_item)
+        Ok(updated_item)
    })
    .await
    .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
@@ -223,20 +231,20 @@ pub async fn async_find_impl<T: ToInput + Clone + Send + 'static>(
    .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
 }

-pub fn find_impl<T: ToInput + Clone + Send + 'static>(
-    database: &Arc<Database<'static>>,
-    key: &str,
-) -> BichonResult<Option<T>> {
-    let db = database.clone();
-    let r_transaction = db
-        .r_transaction()
-        .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
-    let entity: Option<T> = r_transaction
-        .get()
-        .primary(key)
-        .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
-    Ok(entity)
-}
+// pub fn find_impl<T: ToInput + Clone + Send + 'static>(
+//     database: &Arc<Database<'static>>,
+//     key: &str,
+// ) -> BichonResult<Option<T>> {
+//     let db = database.clone();
+//     let r_transaction = db
+//         .r_transaction()
+//         .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+//     let entity: Option<T> = r_transaction
+//         .get()
+//         .primary(key)
+//         .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+//     Ok(entity)
+// }

 pub async fn delete_impl<T: ToInput + Clone + Send + 'static>(
    database: &Arc<Database<'static>>,
@@ -307,6 +315,25 @@ pub async fn list_all_impl<T: ToInput + Clone + Send + 'static>(
    .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
 }

+pub async fn with_transaction(
+    database: &Arc<Database<'static>>,
+    f: impl FnOnce(&RwTransaction) -> BichonResult<()> + Send + 'static,
+) -> BichonResult<()> {
+    let db: Arc<Database<'_>> = database.clone();
+    tokio::task::spawn_blocking(move || {
+        let rw_transaction = db
+            .rw_transaction()
+            .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+        f(&rw_transaction)?;
+        rw_transaction
+            .commit()
+            .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+        Ok(())
+    })
+    .await
+    .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
+}
+
 // For tables with a creation timestamp, place the creation time at the front of the primary key.
 // This allows sorting by time, as the data is stored in dictionary order based on the primary key.
 // If reverse sorting by time is needed, the iterator can be reversed.
--- a/src/modules/envelope/extractor.rs
+++ b/src/modules/envelope/extractor.rs
@@ -17,14 +17,14 @@
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

 use crate::modules::common::AddrVec;
+use crate::modules::envelope::utils::normalize_subject;
 use crate::modules::error::code::ErrorCode;
 use crate::modules::error::BichonResult;
 use crate::modules::utils::create_hash;
 use crate::{calculate_hash, raise_error, utc_now};
 use crate::{id, modules::indexer::envelope::Envelope};
 use async_imap::types::Fetch;
-use html2text::from_read;
-use mail_parser::{Message, MessageParser, MimeHeaders};
+use mail_parser::{HeaderName, Message, MessageParser, MimeHeaders};

 pub fn extract_envelope(fetch: &Fetch, account_id: u64, mailbox_id: u64) -> BichonResult<Envelope> {
    let internal_date = fetch
@@ -48,7 +48,9 @@ pub fn extract_envelope(fetch: &Fetch, account_id: u64, mailbox_id: u64) -> Bich
    let text = if let Some(text) = message.body_text(0).map(|cow| cow.into_owned()) {
        text
    } else if let Some(html) = message.body_html(0).map(|cow| cow.into_owned()) {
-        from_read(html.as_bytes(), 0)
+        html2text::config::plain()
+            .allow_width_overflow()
+            .string_from_read(html.as_bytes(), 100)
            .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
    } else {
        String::new()
@@ -61,7 +63,13 @@ pub fn extract_envelope(fetch: &Fetch, account_id: u64, mailbox_id: u64) -> Bich
    let in_reply_to = message.in_reply_to().as_text().map(String::from);
    let references = extract_references(&message);
    let thread_id = compute_thread_id(in_reply_to, references, &message_id);
-    let subject = message.subject().map(String::from).unwrap_or("".into());
+
+    let mut subject = message.subject().map(String::from).unwrap_or_default();
+
+    if subject.contains('\u{FFFD}') {
+        subject = normalize_subject(message.header_raw(HeaderName::Subject));
+    }
+
    let date = message.date().map(|d| d.to_timestamp() * 1000).unwrap_or(0);
    let bcc: Option<Vec<String>> = message.bcc().map(|addr| {
        AddrVec::from(addr)
@@ -113,6 +121,8 @@ pub fn extract_envelope(fetch: &Fetch, account_id: u64, mailbox_id: u64) -> Bich
        thread_id,
        attachments,
        tags: None,
+        account_email: None,
+        mailbox_name: None,
    };
    Ok(envelope)
 }
@@ -134,7 +144,9 @@ pub fn extract_envelope_from_eml(
    let text = if let Some(text) = message.body_text(0).map(|cow| cow.into_owned()) {
        text
    } else if let Some(html) = message.body_html(0).map(|cow| cow.into_owned()) {
-        from_read(html.as_bytes(), 0)
+        html2text::config::plain()
+            .allow_width_overflow()
+            .string_from_read(html.as_bytes(), 100)
            .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
    } else {
        String::new()
@@ -147,7 +159,12 @@ pub fn extract_envelope_from_eml(
    let in_reply_to = message.in_reply_to().as_text().map(String::from);
    let references = extract_references(&message);
    let thread_id = compute_thread_id(in_reply_to, references, &message_id);
-    let subject = message.subject().map(String::from).unwrap_or("".into());
+
+    let mut subject = message.subject().map(String::from).unwrap_or_default();
+    if subject.contains('\u{FFFD}') {
+        subject = normalize_subject(message.header_raw(HeaderName::Subject));
+    }
+
    let date = message.date().map(|d| d.to_timestamp() * 1000).unwrap_or(0);
    let bcc: Option<Vec<String>> = message.bcc().map(|addr| {
        AddrVec::from(addr)
@@ -199,6 +216,8 @@ pub fn extract_envelope_from_eml(
        thread_id,
        attachments,
        tags: None,
+        account_email: None,
+        mailbox_name: None,
    };
    Ok(envelope)
 }
@@ -229,3 +248,52 @@ fn extract_references(message: &Message<'_>) -> Option<Vec<String>> {
        _ => None,
    }
 }
+
+#[cfg(test)]
+mod test {
+    use html2text::config;
+
+    #[test]
+    fn test_various_html_with_overflow_enabled() {
+        let cases = [
+            ("<p>Hello World</p>", "Simple paragraph"),
+            ("<h1>Title</h1><p>Content</p>", "Heading + paragraph"),
+            ("<ul><li>Item1</li><li>Item2</li></ul>", "Unordered list"),
+            (
+                "<strong>Bold</strong> and <em>italic</em>",
+                "Inline formatting",
+            ),
+            (
+                "<div><span>Nested</span> elements</div>",
+                "Nested inline elements inside block",
+            ),
+            (
+                "<table><tr><td>A</td><td>B</td></tr></table>",
+                "Simple table",
+            ),
+            (
+                "<pre>  preformatted text\n  line2</pre>",
+                "Preformatted block",
+            ),
+            ("😃 emoji test", "Wide emoji"),
+            ("<a href=\"#\">link</a>", "Anchor tag"),
+            (
+                "<blockquote><p>Quoted text</p></blockquote>",
+                "Blockquote with paragraph",
+            ),
+        ];
+
+        for (html, desc) in cases {
+            let result = config::plain()
+                .allow_width_overflow()
+                .string_from_read(html.as_bytes(), 100);
+
+            match result {
+                Ok(output) => {
+                    println!("✓ Rendered ({}) =>\n{}", desc, output);
+                }
+                Err(e) => panic!("Unexpected error for {}: {:?}", desc, e),
+            }
+        }
+    }
+}
--- a/src/modules/envelope/mod.rs
+++ b/src/modules/envelope/mod.rs
@@ -16,5 +16,5 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 pub mod extractor;
+pub mod utils;
--- a/src/modules/envelope/utils.rs
+++ b/src/modules/envelope/utils.rs
@@ -0,0 +1,114 @@
+use mail_parser::parsers::MessageStream;
+use regex::{Captures, Regex};
+
+fn merge_contiguous_encoded_words(input: &str) -> String {
+    let block_re =
+        Regex::new(r"(?:=\?[^?]+\?[bBqQ]\?[^?]+\?=)(?:\s+(?:=\?[^?]+\?[bBqQ]\?[^?]+\?=))+")
+            .unwrap();
+
+    let word_re = Regex::new(r"=\?([^?]+)\?([bBqQ])\?([^?]+)\?=").unwrap();
+
+    block_re
+        .replace_all(input, |caps: &Captures| {
+            let whole = caps.get(0).unwrap().as_str();
+
+            let mut charset: Option<String> = None;
+            let mut encoding: Option<String> = None;
+            let mut combined = String::new();
+            let mut ok = true;
+
+            for cap in word_re.captures_iter(whole) {
+                let cs = &cap[1];
+                let enc = cap[2].to_ascii_uppercase();
+                let text = &cap[3];
+
+                if let Some(ref c) = charset {
+                    if c != cs {
+                        ok = false;
+                        break;
+                    }
+                } else {
+                    charset = Some(cs.to_string());
+                }
+
+                if let Some(ref e) = encoding {
+                    if e != &enc {
+                        ok = false;
+                        break;
+                    }
+                } else {
+                    encoding = Some(enc);
+                }
+
+                combined.push_str(text);
+            }
+
+            if ok {
+                format!(
+                    "=?{}?{}?{}?=",
+                    charset.unwrap(),
+                    encoding.unwrap(),
+                    combined
+                )
+            } else {
+                whole.to_string()
+            }
+        })
+        .to_string()
+}
+
+pub fn normalize_subject(raw_subject: Option<&str>) -> String {
+    let subject = match raw_subject {
+        Some(subject) => merge_contiguous_encoded_words(subject),
+        None => return String::new(),
+    };
+
+    MessageStream::new(subject.as_bytes())
+        .parse_unstructured()
+        .as_text()
+        .map(String::from)
+        .unwrap_or_default()
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::modules::envelope::utils::merge_contiguous_encoded_words;
+
+
+    #[tokio::test]
+    async fn test3() {
+        let s = "Hello =?UTF-8?B?SGVsbG8=?= =?UTF-8?B?V29ybGQ=?= !!!";
+        assert_eq!(
+            merge_contiguous_encoded_words(s),
+            "Hello =?UTF-8?B?SGVsbG8=V29ybGQ=?= !!!"
+        );
+
+        let s = "=?UTF-8?B?QQ==?= =?UTF-8?B?Qg==?= =?UTF-8?B?Qw==?=";
+        assert_eq!(
+            merge_contiguous_encoded_words(s),
+            "=?UTF-8?B?QQ==Qg==Qw==?="
+        );
+
+        let s = "=?UTF-8?B?QQ==?= =?UTF-8?B?Qg==?= test =?UTF-8?B?Qw==?= =?UTF-8?B?RA==?=";
+        assert_eq!(
+            merge_contiguous_encoded_words(s),
+            "=?UTF-8?B?QQ==Qg==?= test =?UTF-8?B?Qw==RA==?="
+        );
+
+        let s = "=?UTF-8?B?QQ==?= =?GBK?B?Qg==?=";
+        assert_eq!(merge_contiguous_encoded_words(s), s);
+        let s = "=?UTF-8?B?QQ==?= =?UTF-8?Q?Qg?=";
+        assert_eq!(merge_contiguous_encoded_words(s), s);
+
+        let s = "=?UTF-8?b?QQ==?= =?UTF-8?B?Qg==?=";
+        assert_eq!(merge_contiguous_encoded_words(s), "=?UTF-8?B?QQ==Qg==?=");
+        let s = "Hello =?UTF-8?B?SGVsbG8=?= !!!";
+        assert_eq!(merge_contiguous_encoded_words(s), s);
+        let s = "=?UTF-8?B?QQ==?=    =?UTF-8?B?Qg==?=";
+        assert_eq!(merge_contiguous_encoded_words(s), "=?UTF-8?B?QQ==Qg==?=");
+        let s = "Just a normal subject line";
+        assert_eq!(merge_contiguous_encoded_words(s), s);
+        let s = "=?UTF-8?Q?Hello_?= =?UTF-8?Q?World?=";
+        assert_eq!(merge_contiguous_encoded_words(s), "=?UTF-8?Q?Hello_World?=");
+    }
+}
--- a/src/modules/error/code.rs
+++ b/src/modules/error/code.rs
@@ -16,7 +16,6 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use poem::http::StatusCode;
 use poem_openapi::Enum;

@@ -34,12 +33,14 @@ pub enum ErrorCode {
    // Authentication and authorization errors (20000–20999)
    PermissionDenied = 20000,
    AccountDisabled = 20010,
+    Forbidden = 20020,
    OAuth2ItemDisabled = 20050,
    MissingRefreshToken = 20060,

    // Resource errors (30000–30999)
    ResourceNotFound = 30000,
    TooManyRequest = 30020,
+    AlreadyExists = 30030,

    // Network connection errors (40000–40999)
    NetworkError = 40000,
@@ -64,11 +65,14 @@ impl ErrorCode {
            | ErrorCode::MissingConfiguration
            | ErrorCode::Incompatible => StatusCode::BAD_REQUEST,
            ErrorCode::PermissionDenied => StatusCode::UNAUTHORIZED,
-            ErrorCode::AccountDisabled | ErrorCode::OAuth2ItemDisabled => StatusCode::FORBIDDEN,
+            ErrorCode::AccountDisabled | ErrorCode::OAuth2ItemDisabled | ErrorCode::Forbidden => {
+                StatusCode::FORBIDDEN
+            }
            ErrorCode::ResourceNotFound => StatusCode::NOT_FOUND,
            ErrorCode::RequestTimeout => StatusCode::REQUEST_TIMEOUT,
            ErrorCode::PayloadTooLarge => StatusCode::PAYLOAD_TOO_LARGE,
            ErrorCode::TooManyRequest => StatusCode::TOO_MANY_REQUESTS,
+            ErrorCode::AlreadyExists => StatusCode::CONFLICT,
            ErrorCode::InternalError
            | ErrorCode::AutoconfigFetchFailed
            | ErrorCode::ImapCommandFailed
--- a/src/modules/error/mod.rs
+++ b/src/modules/error/mod.rs
@@ -16,15 +16,11 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
-use std::{fmt::Formatter, u32};
-
-use crate::raise_error;
-use bb8::RunError;
 use code::ErrorCode;
 use poem::http::StatusCode;
 use poem_openapi::{payload::Json, ApiResponse, Object};
 use snafu::{Location, Snafu};
+use std::{fmt::Formatter, u32};

 pub mod code;
 pub mod handler;
@@ -43,17 +39,6 @@ pub enum BichonError {

 pub type BichonResult<T, E = BichonError> = std::result::Result<T, E>;

-impl From<RunError<BichonError>> for BichonError {
-    fn from(e: RunError<BichonError>) -> Self {
-        match e {
-            RunError::User(e) => e,
-            RunError::TimedOut => raise_error!(
-                "Timed out while attempting to acquire a connection from the pool".into(),
-                ErrorCode::ConnectionPoolTimeout
-            ),
-        }
-    }
-}
 #[derive(Debug, Clone, Object)]
 pub struct ApiError {
    pub message: String,
--- a/src/modules/imap/capabilities.rs
+++ b/src/modules/imap/capabilities.rs
@@ -16,7 +16,6 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use crate::modules::error::code::ErrorCode;
 use crate::modules::imap::session::SessionStream;
 use crate::{modules::error::BichonResult, raise_error};
--- a/src/modules/imap/executor.rs
+++ b/src/modules/imap/executor.rs
@@ -16,10 +16,10 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
+use crate::modules::account::migration::AccountModel;
 use crate::modules::account::state::AccountRunningState;
 use crate::modules::cache::imap::mailbox::MailBox;
-use crate::modules::cache::imap::sync::flow::{generate_uid_sequence_hashset, BATCH_SIZE};
+use crate::modules::cache::imap::sync::flow::{generate_uid_sequence_hashset, DEFAULT_BATCH_SIZE};
 use crate::modules::envelope::extractor::extract_envelope;
 use crate::modules::error::code::ErrorCode;
 use crate::modules::indexer::manager::{EML_INDEX_MANAGER, ENVELOPE_INDEX_MANAGER};
@@ -27,7 +27,7 @@ use crate::modules::indexer::schema::SchemaTools;
 use crate::modules::{error::BichonResult, imap::manager::ImapConnectionManager};
 use crate::raise_error;
 use async_imap::types::{Mailbox, Name};
-use bb8::Pool;
+use bb8::{Pool, RunError};
 use futures::TryStreamExt;
 use std::collections::HashSet;
 use tantivy::doc;
@@ -36,16 +36,17 @@ use tracing::info;
 const BODY_FETCH_COMMAND: &str = "(UID INTERNALDATE RFC822.SIZE BODY.PEEK[])";

 pub struct ImapExecutor {
+    account_id: u64,
    pool: Pool<ImapConnectionManager>,
 }

 impl ImapExecutor {
-    pub fn new(pool: Pool<ImapConnectionManager>) -> Self {
-        Self { pool }
+    pub fn new(account_id: u64, pool: Pool<ImapConnectionManager>) -> Self {
+        Self { account_id, pool }
    }

    pub async fn list_all_mailboxes(&self) -> BichonResult<Vec<Name>> {
-        let mut session = self.pool.get().await?;
+        let mut session = self.get_connection().await?;
        let list = session
            .list(Some(""), Some("*"))
            .await
@@ -58,7 +59,7 @@ impl ImapExecutor {
    }

    pub async fn examine_mailbox(&self, mailbox_name: &str) -> BichonResult<Mailbox> {
-        let mut session = self.pool.get().await?;
+        let mut session = self.get_connection().await?;
        session
            .examine(mailbox_name)
            .await
@@ -66,7 +67,7 @@ impl ImapExecutor {
    }

    pub async fn uid_search(&self, mailbox_name: &str, query: &str) -> BichonResult<HashSet<u32>> {
-        let mut session = self.pool.get().await?;
+        let mut session = self.get_connection().await?;
        session
            .examine(mailbox_name)
            .await
@@ -78,19 +79,35 @@ impl ImapExecutor {
        Ok(result)
    }

+    pub async fn append(
+        &self,
+        mailbox_name: impl AsRef<str>,
+        flags: Option<&str>,
+        internaldate: Option<&str>,
+        content: impl AsRef<[u8]>,
+    ) -> BichonResult<()> {
+        let mut session = self.get_connection().await?;
+        session
+            .append(mailbox_name, flags, internaldate, content)
+            .await
+            .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::ImapCommandFailed))
+    }
+
    pub async fn fetch_new_mail(
        &self,
-        account_id: u64,
+        account: &AccountModel,
        mailbox: &MailBox,
        start_uid: u64,
+        before: Option<&str>,
    ) -> BichonResult<()> {
        assert!(start_uid > 0, "start_uid must be greater than 0");
-        let uid_list = self
-            .uid_search(
-                &mailbox.encoded_name(),
-                format!("UID {start_uid}:*").as_str(),
-            )
-            .await?;
+
+        let query = match before {
+            Some(date) => format!("UID {start_uid}:* BEFORE {date}"),
+            None => format!("UID {start_uid}:*"),
+        };
+
+        let uid_list = self.uid_search(&mailbox.encoded_name(), &query).await?;

        let len = uid_list.len();
        if len == 0 {
@@ -98,17 +115,21 @@ impl ImapExecutor {
        }
        info!(
            "[account {}][mailbox {}] {} envelopes need to be fetched",
-            account_id, mailbox.name, len
+            account.id, mailbox.name, len
        );

        let mut uid_vec: Vec<u32> = uid_list.into_iter().collect();
        uid_vec.sort();
-        let uid_batches = generate_uid_sequence_hashset(uid_vec, BATCH_SIZE as usize, false);
+        let uid_batches = generate_uid_sequence_hashset(
+            uid_vec,
+            account.sync_batch_size.unwrap_or(DEFAULT_BATCH_SIZE) as usize,
+            false,
+        );

-        let too_many = len as u32 > 10 * BATCH_SIZE;
+        let too_many = len as u32 > 5 * account.sync_batch_size.unwrap_or(DEFAULT_BATCH_SIZE);
        if too_many {
            AccountRunningState::set_initial_current_syncing_folder(
-                account_id,
+                account.id,
                mailbox.name.clone(),
                uid_batches.len() as u32,
            )
@@ -118,13 +139,13 @@ impl ImapExecutor {
        for (index, batch) in uid_batches.into_iter().enumerate() {
            if too_many {
                AccountRunningState::set_current_sync_batch_number(
-                    account_id,
+                    account.id,
                    mailbox.name.clone(),
                    (index + 1) as u32,
                )
                .await?;
            }
-            self.uid_batch_retrieve_emails(account_id, mailbox.id, &batch, &mailbox.encoded_name())
+            self.uid_batch_retrieve_emails(account.id, mailbox.id, &batch, &mailbox.encoded_name())
                .await?;
        }
        Ok(())
@@ -142,7 +163,7 @@ impl ImapExecutor {
        assert!(page > 0, "Page number must be greater than 0");
        assert!(page_size > 0, "Page size must be greater than 0");

-        let mut session = self.pool.get().await?;
+        let mut session = self.get_connection().await?;
        let total = session
            .examine(encoded_mailbox_name)
            .await
@@ -211,7 +232,7 @@ impl ImapExecutor {
        uid_set: &str,
        encoded_mailbox_name: &str,
    ) -> BichonResult<()> {
-        let mut session = self.pool.get().await?;
+        let mut session = self.get_connection().await?;
        session
            .examine(encoded_mailbox_name)
            .await
@@ -238,4 +259,41 @@ impl ImapExecutor {
        }
        Ok(())
    }
+
+    async fn get_connection(
+        &self,
+    ) -> BichonResult<bb8::PooledConnection<'_, ImapConnectionManager>> {
+        match self.pool.get().await {
+            Ok(connection) => Ok(connection),
+            Err(e) => match e {
+                RunError::User(e) => Err(e),
+                RunError::TimedOut => {
+                    let state = self.pool.state();
+                    tracing::warn!(
+                        "{}: connections={}, idle={}, \
+                        get_started={}, get_direct={}, get_waited={}, get_timed_out={}, \
+                        wait_time_ms={}, created={}, closed_broken={}, closed_invalid={}, \
+                        closed_lifetime={}, closed_idle={}",
+                        self.account_id,
+                        state.connections,
+                        state.idle_connections,
+                        state.statistics.get_started,
+                        state.statistics.get_direct,
+                        state.statistics.get_waited,
+                        state.statistics.get_timed_out,
+                        state.statistics.get_wait_time.as_millis(),
+                        state.statistics.connections_created,
+                        state.statistics.connections_closed_broken,
+                        state.statistics.connections_closed_invalid,
+                        state.statistics.connections_closed_max_lifetime,
+                        state.statistics.connections_closed_idle_timeout,
+                    );
+                    return Err(raise_error!(
+                        "Timed out while attempting to acquire a connection from the pool".into(),
+                        ErrorCode::ConnectionPoolTimeout
+                    ));
+                }
+            },
+        }
+    }
 }
--- a/src/modules/imap/manager.rs
+++ b/src/modules/imap/manager.rs
@@ -28,7 +28,7 @@ use crate::modules::imap::client::Client;
 use crate::modules::imap::oauth2::OAuth2;
 use crate::modules::imap::session::SessionStream;
 use crate::modules::oauth2::token::OAuth2AccessToken;
-use crate::{decrypt, raise_error};
+use crate::{bichon_version, decrypt, raise_error};
 use async_imap::Session;
 use tracing::error;

@@ -67,6 +67,7 @@ impl ImapConnectionManager {
    ) -> BichonResult<Session<Box<dyn SessionStream>>> {
        assert_eq!(account.account_type, AccountType::IMAP);
        let imap = account.imap.as_ref().unwrap();
+        let username = account.name.clone().unwrap_or(account.email.clone());
        match &imap.auth.auth_type {
            AuthType::Password => {
                let password = &imap.auth.password.clone().ok_or_else(|| {
@@ -77,7 +78,13 @@ impl ImapConnectionManager {
                })?;

                let password = decrypt!(&password)?;
-                client.login(&account.email, &password).await
+                client.login(&username, &password).await.map_err(|e| {
+                    error!(
+                        "IMAP password auth failed for username '{}': {}",
+                        username, e
+                    );
+                    e
+                })
            }
            AuthType::OAuth2 => {
                let record = OAuth2AccessToken::get(self.account_id).await?;
@@ -89,8 +96,12 @@ impl ImapConnectionManager {
                    )
                })?;
                client
-                    .authenticate(OAuth2::new(account.email.clone(), access_token))
+                    .authenticate(OAuth2::new(username.clone(), access_token))
                    .await
+                    .map_err(|e| {
+                        error!("IMAP OAuth2 auth failed for username '{}': {}", username, e);
+                        e
+                    })
            }
        }
    }
@@ -143,6 +154,19 @@ impl ImapConnectionManager {
                        .await;
                    return Err(error);
                }
+
+                if capabilities.has_str("ID") || capabilities.has_str("id") {
+                    session
+                        .id([
+                            ("name", Some("bichon")),
+                            ("version", Some(bichon_version!())),
+                            ("vendor", Some("rustmailer")),
+                        ])
+                        .await
+                        .map_err(|e| {
+                            raise_error!(format!("{:#?}", e), ErrorCode::ImapCommandFailed)
+                        })?;
+                }
            }
            Err(error) => {
                error!("Failed to fetch IMAP capabilities: {:#?}", error);
--- a/src/modules/imap/pool.rs
+++ b/src/modules/imap/pool.rs
@@ -16,7 +16,6 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use crate::modules::error::code::ErrorCode;
 use crate::modules::error::{BichonError, BichonResult};
 use crate::modules::imap::{manager::ImapConnectionManager, session::SessionStream};
@@ -49,7 +48,7 @@ pub async fn build_imap_pool(account_id: u64) -> BichonResult<Pool<ImapConnectio
    let manager = ImapConnectionManager::new(account_id);
    let pool = Pool::builder()
        .connection_timeout(Duration::from_secs(30))
-        .idle_timeout(Duration::from_secs(120))
+        //.idle_timeout(Duration::from_secs(120))
        .retry_connection(true)
        .max_size(10)
        .test_on_check_out(true)
--- a/src/modules/imap/tests.rs
+++ b/src/modules/imap/tests.rs
@@ -16,11 +16,13 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-use mail_parser::MessageParser;
+use mail_parser::{parsers::MessageStream, HeaderName, MessageParser};

 use crate::{
    base64_encode_url_safe,
-    modules::{account::entity::Encryption, imap::client::Client},
+    modules::{
+        account::entity::Encryption, envelope::utils::normalize_subject, imap::client::Client,
+    },
 };

 #[tokio::test]
@@ -48,3 +50,72 @@ async fn test1() {
        println!("{}", part.is_multipart());
    }
 }
+
+#[tokio::test]
+async fn test2() {
+    const MESSAGE: &str = r#"From: Art Vandelay <art@vandelay.com> (Vandelay Industries)
+To: "Colleagues": "James Smythe" <james@vandelay.com>; Friends:
+    jane@example.com, =?UTF-8?Q?John_Sm=C3=AEth?= <john@example.com>;
+Date: Sat, 20 Nov 2021 14:22:01 -0800
+Subject: =?utf-8?B?SnVzdCAxNSBkYXlzIGxlZnQgdG8gdmlzaXQgTkFSTklBISDinYTvuI/wn462?=
+Content-Type: multipart/mixed; boundary="festivus";
+
+--festivus
+Content-Type: text/html; charset="us-ascii"
+Content-Transfer-Encoding: base64
+
+PGh0bWw+PHA+SSB3YXMgdGhpbmtpbmcgYWJvdXQgcXVpdHRpbmcgdGhlICZsZHF1bztle
+HBvcnRpbmcmcmRxdW87IHRvIGZvY3VzIGp1c3Qgb24gdGhlICZsZHF1bztpbXBvcnRpbm
+cmcmRxdW87LDwvcD48cD5idXQgdGhlbiBJIHRob3VnaHQsIHdoeSBub3QgZG8gYm90aD8
+gJiN4MjYzQTs8L3A+PC9odG1sPg==
+--festivus
+Content-Type: message/rfc822
+
+From: "Cosmo Kramer" <kramer@kramerica.com>
+Subject: Exporting my book about coffee tables
+Content-Type: multipart/mixed; boundary="giddyup";
+
+--giddyup
+Content-Type: text/plain; charset="utf-16"
+Content-Transfer-Encoding: quoted-printable
+
+=FF=FE=0C!5=D8"=DD5=D8)=DD5=D8-=DD =005=D8*=DD5=D8"=DD =005=D8"=
+=DD5=D85=DD5=D8-=DD5=D8,=DD5=D8/=DD5=D81=DD =005=D8*=DD5=D86=DD =
+=005=D8=1F=DD5=D8,=DD5=D8,=DD5=D8(=DD =005=D8-=DD5=D8)=DD5=D8"=
+=DD5=D8=1E=DD5=D80=DD5=D8"=DD!=00
+--giddyup
+Content-Type: image/gif; name*1="about "; name*0="Book ";
+              name*2*=utf-8''%e2%98%95 tables.gif
+Content-Transfer-Encoding: Base64
+Content-Disposition: attachment
+
+R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7
+--giddyup--
+--festivus--
+"#;
+
+    let message = MessageParser::default().parse(MESSAGE).unwrap();
+    let raw_subject = message.header_raw("Subject").unwrap().as_bytes();
+
+    let data = MessageStream::new(raw_subject)
+        .parse_unstructured()
+        .unwrap_text()
+        .to_string();
+
+    println!("{}", data);
+    // RFC2047 support for encoded text in message readers
+    println!("{}", message.subject().unwrap());
+}
+
+#[tokio::test]
+async fn test44() {
+    let path = r"C:\Users\polly\Downloads\test222.eml";
+    let input = std::fs::read(path).unwrap();
+    let message = MessageParser::default().parse(&input).unwrap();
+    let subject = message.subject().unwrap();
+    println!("Subject: {}", subject);
+    if subject.contains('\u{FFFD}') {
+        let subject = normalize_subject(message.header_raw(HeaderName::Subject));
+        println!("Subject: {}", subject);
+    }
+}
--- a/src/modules/indexer/envelope.rs
+++ b/src/modules/indexer/envelope.rs
@@ -16,7 +16,8 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
+use crate::modules::account::migration::AccountModel;
+use crate::modules::cache::imap::mailbox::MailBox;
 use crate::modules::error::code::ErrorCode;
 use crate::modules::utils::create_hash;
 use crate::modules::{error::BichonResult, indexer::schema::SchemaTools};
@@ -31,7 +32,9 @@ pub struct Envelope {
    pub id: u64,
    pub message_id: String,
    pub account_id: u64,
+    pub account_email: Option<String>,
    pub mailbox_id: u64,
+    pub mailbox_name: Option<String>,
    pub uid: u32,
    pub subject: String,
    pub text: String,
@@ -169,11 +172,20 @@ impl Envelope {
            })
            .flatten()
            .collect();
+        let account_email = AccountModel::find(account_id).await?.map(|a| a.email);
+
+        let mailboxes = MailBox::list_all(account_id).await?;
+        let mailbox_name = mailboxes
+            .iter()
+            .find(|m| m.id == mailbox_id)
+            .map(|m| m.name.clone());

        let envelope = Envelope {
            id,
            account_id,
+            account_email,
            mailbox_id,
+            mailbox_name,
            message_id: extract_string_field(doc, fields.f_message_id)?,
            uid: extract_u64_field(doc, fields.f_uid)? as u32,
            subject: extract_string_field(doc, fields.f_subject)?,
--- a/src/modules/indexer/manager.rs
+++ b/src/modules/indexer/manager.rs
@@ -16,7 +16,6 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use std::{
    collections::{HashMap, HashSet},
    ops::Bound,
@@ -35,8 +34,8 @@ use crate::{
        indexer::{
            envelope::Envelope,
            fields::{
-                F_ACCOUNT_ID, F_FROM, F_HAS_ATTACHMENT, F_INTERNAL_DATE, F_MAILBOX_ID, F_SIZE,
-                F_TAGS, F_THREAD_ID, F_UID,
+                F_ACCOUNT_ID, F_DATE, F_FROM, F_HAS_ATTACHMENT, F_MAILBOX_ID, F_SIZE, F_TAGS,
+                F_THREAD_ID, F_UID,
            },
            schema::SchemaTools,
        },
@@ -58,7 +57,7 @@ use tantivy::{
        AggregationCollector, Key,
    },
    collector::{Count, FacetCollector, TopDocs},
-    query::{AllQuery, BooleanQuery, Occur, Query, QueryParser, RangeQuery, TermQuery},
+    query::{AllQuery, BooleanQuery, EmptyQuery, Occur, Query, QueryParser, RangeQuery, TermQuery},
    schema::{Facet, IndexRecordOption, Value},
    store::{Compressor, ZstdCompressor},
    DocAddress, Index, IndexBuilder, IndexReader, IndexSettings, IndexWriter, Order,
@@ -194,9 +193,29 @@ impl EnvelopeIndexManager {
        }
    }

-    pub fn total_emails(&self) -> BichonResult<u64> {
+    pub fn total_emails(&self, accounts: &Option<HashSet<u64>>) -> BichonResult<u64> {
        let searcher = self.create_searcher()?;
-        Ok(searcher.num_docs())
+
+        match accounts {
+            Some(ref ids) if !ids.is_empty() => {
+                let mut subqueries = Vec::new();
+                for &id in ids {
+                    let term =
+                        Term::from_field_u64(SchemaTools::envelope_fields().f_account_id, id);
+                    subqueries.push((
+                        Occur::Should,
+                        Box::new(TermQuery::new(term, IndexRecordOption::Basic)) as Box<dyn Query>,
+                    ));
+                }
+                let query = Box::new(BooleanQuery::new(subqueries)) as Box<dyn Query>;
+                let count = searcher
+                    .search(&query, &Count)
+                    .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+                Ok(count as u64)
+            }
+            Some(_) => Ok(0),
+            None => Ok(searcher.num_docs()),
+        }
    }

    fn account_query(&self, account_id: u64) -> Box<TermQuery> {
@@ -223,12 +242,36 @@ impl EnvelopeIndexManager {

    fn filter_query(
        &self,
+        accounts: Option<HashSet<u64>>,
        filter: SearchFilter,
        parser: QueryParser,
    ) -> BichonResult<Box<dyn Query>> {
        let f = SchemaTools::envelope_fields();
        let mut subqueries: Vec<(Occur, Box<dyn Query>)> = Vec::new();

+        if let Some(authorized_ids) = accounts {
+            if authorized_ids.is_empty() {
+                let term = Term::from_field_u64(f.f_account_id, u64::MAX);
+                subqueries.push((
+                    Occur::Must,
+                    Box::new(TermQuery::new(term, IndexRecordOption::Basic)),
+                ));
+            } else {
+                let mut account_must_queries = Vec::new();
+                for id in authorized_ids {
+                    let term = Term::from_field_u64(f.f_account_id, id);
+                    account_must_queries.push((
+                        Occur::Should,
+                        Box::new(TermQuery::new(term, IndexRecordOption::Basic)) as Box<dyn Query>,
+                    ));
+                }
+                subqueries.push((
+                    Occur::Must,
+                    Box::new(BooleanQuery::new(account_must_queries)),
+                ));
+            }
+        }
+
        if let Some(ref text) = filter.text {
            let query = parser
                .parse_query(text)
@@ -292,13 +335,13 @@ impl EnvelopeIndexManager {
        }

        let start_bound = if let Some(from) = filter.since {
-            Bound::Included(Term::from_field_i64(f.f_internal_date, from))
+            Bound::Included(Term::from_field_i64(f.f_date, from))
        } else {
            Bound::Unbounded
        };

        let end_bound = if let Some(to) = filter.before {
-            Bound::Included(Term::from_field_i64(f.f_internal_date, to))
+            Bound::Included(Term::from_field_i64(f.f_date, to))
        } else {
            Bound::Unbounded
        };
@@ -426,14 +469,16 @@ impl EnvelopeIndexManager {
    }

    fn collect_facets_recursive(
+        query: &dyn Query,
        searcher: &Searcher,
        parent_facet: &str,
        all_facets: &mut Vec<TagCount>,
    ) -> BichonResult<()> {
        let mut facet_collector = FacetCollector::for_field(F_TAGS);
        facet_collector.add_facet(parent_facet);
+
        let facet_counts = searcher
-            .search(&AllQuery, &facet_collector)
+            .search(query, &facet_collector)
            .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;

        for (facet, count) in facet_counts.get(parent_facet) {
@@ -441,16 +486,37 @@ impl EnvelopeIndexManager {
                tag: facet.to_string(),
                count,
            });
-            Self::collect_facets_recursive(searcher, &facet.to_string(), all_facets)?;
+            Self::collect_facets_recursive(query, searcher, &facet.to_string(), all_facets)?;
        }

        Ok(())
    }

-    pub async fn get_all_tags(&self) -> BichonResult<Vec<TagCount>> {
+    pub async fn get_all_tags(
+        &self,
+        accounts: Option<HashSet<u64>>,
+    ) -> BichonResult<Vec<TagCount>> {
        let searcher = self.reader.searcher();
+
+        let query: Box<dyn Query> = match accounts {
+            Some(ref ids) if !ids.is_empty() => {
+                let mut subqueries = Vec::new();
+                for &id in ids {
+                    let term =
+                        Term::from_field_u64(SchemaTools::envelope_fields().f_account_id, id);
+                    subqueries.push((
+                        Occur::Should,
+                        Box::new(TermQuery::new(term, IndexRecordOption::Basic)) as Box<dyn Query>,
+                    ));
+                }
+                Box::new(BooleanQuery::new(subqueries))
+            }
+            Some(_) => Box::new(EmptyQuery),
+            None => Box::new(AllQuery),
+        };
+
        let mut all_facets = Vec::new();
-        Self::collect_facets_recursive(&searcher, "/", &mut all_facets)?;
+        Self::collect_facets_recursive(&query, &searcher, "/", &mut all_facets)?;
        Ok(all_facets)
    }

@@ -550,6 +616,7 @@ impl EnvelopeIndexManager {

    pub async fn search(
        &self,
+        accounts: Option<HashSet<u64>>,
        filter: SearchFilter,
        page: u64,
        page_size: u64,
@@ -557,7 +624,7 @@ impl EnvelopeIndexManager {
    ) -> BichonResult<DataPage<Envelope>> {
        assert!(page > 0, "Page number must be greater than 0");
        assert!(page_size > 0, "Page size must be greater than 0");
-        let query = self.filter_query(filter, self.query_parser.clone())?;
+        let query = self.filter_query(accounts, filter, self.query_parser.clone())?;
        let searcher = self.create_searcher()?;
        let total = searcher
            .search(&query, &Count)
@@ -591,7 +658,7 @@ impl EnvelopeIndexManager {
                &query,
                &TopDocs::with_limit(page_size as usize)
                    .and_offset(offset as usize)
-                    .order_by_fast_field(F_INTERNAL_DATE, order),
+                    .order_by_fast_field(F_DATE, order),
            )
            .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
        let mut result = Vec::new();
@@ -654,7 +721,7 @@ impl EnvelopeIndexManager {
                query.as_ref(),
                &TopDocs::with_limit(page_size as usize)
                    .and_offset(offset as usize)
-                    .order_by_fast_field(F_INTERNAL_DATE, order),
+                    .order_by_fast_field(F_DATE, order),
            )
            .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
        let mut result = Vec::new();
@@ -719,7 +786,7 @@ impl EnvelopeIndexManager {
                query.as_ref(),
                &TopDocs::with_limit(page_size as usize)
                    .and_offset(offset as usize)
-                    .order_by_fast_field(F_INTERNAL_DATE, order),
+                    .order_by_fast_field(F_DATE, order),
            )
            .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
        let mut result = Vec::new();
@@ -741,15 +808,77 @@ impl EnvelopeIndexManager {
        })
    }

-    pub async fn top_10_largest_emails(&self) -> BichonResult<Vec<LargestEmail>> {
+    pub async fn get_envelope_by_id(
+        &self,
+        account_id: u64,
+        message_id: u64,
+    ) -> BichonResult<Option<Envelope>> {
+        let searcher = self.create_searcher()?;
+        let f = SchemaTools::envelope_fields();
+
+        let query = BooleanQuery::new(vec![
+            (
+                Occur::Must,
+                Box::new(TermQuery::new(
+                    Term::from_field_u64(f.f_account_id, account_id),
+                    IndexRecordOption::Basic,
+                )),
+            ),
+            (
+                Occur::Must,
+                Box::new(TermQuery::new(
+                    Term::from_field_u64(f.f_id, message_id),
+                    IndexRecordOption::Basic,
+                )),
+            ),
+        ]);
+
+        let docs: Vec<(f32, DocAddress)> = searcher
+            .search(&query, &TopDocs::with_limit(1))
+            .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+
+        if let Some((_, doc_address)) = docs.first() {
+            let doc: TantivyDocument = searcher
+                .doc_async(*doc_address)
+                .await
+                .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+            let envelope = Envelope::from_tantivy_doc(&doc).await?;
+            Ok(Some(envelope))
+        } else {
+            Ok(None)
+        }
+    }
+
+
+    pub async fn top_10_largest_emails(
+        &self,
+        accounts: &Option<HashSet<u64>>,
+    ) -> BichonResult<Vec<LargestEmail>> {
        self.reader
            .reload()
            .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
        let searcher = self.reader.searcher();

+        let query: Box<dyn Query> = match accounts {
+            Some(ref ids) if !ids.is_empty() => {
+                let mut subqueries = Vec::new();
+                for &id in ids {
+                    let term =
+                        Term::from_field_u64(SchemaTools::envelope_fields().f_account_id, id);
+                    subqueries.push((
+                        Occur::Should,
+                        Box::new(TermQuery::new(term, IndexRecordOption::Basic)) as Box<dyn Query>,
+                    ));
+                }
+                Box::new(BooleanQuery::new(subqueries))
+            }
+            Some(_) => Box::new(EmptyQuery),
+            None => Box::new(AllQuery),
+        };
+
        let mailbox_docs: Vec<(u64, DocAddress)> = searcher
            .search(
-                &AllQuery,
+                &query,
                &TopDocs::with_limit(10).order_by_fast_field(F_SIZE, Order::Desc),
            )
            .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
@@ -905,7 +1034,10 @@ impl EnvelopeIndexManager {
        Ok(self.reader.searcher())
    }

-    pub async fn get_dashboard_stats(&self) -> BichonResult<DashboardStats> {
+    pub async fn get_dashboard_stats(
+        &self,
+        accounts: &Option<HashSet<u64>>,
+    ) -> BichonResult<DashboardStats> {
        let searcher = self.create_searcher()?;
        let now_ms = utc_now!();
        let week_ago_ms = (Utc::now() - Duration::from_secs(60 * 60 * 24 * 30)).timestamp_millis();
@@ -916,7 +1048,7 @@ impl EnvelopeIndexManager {
            },
            "recent_30d_histogram": {
                "histogram": {
-                    "field": F_INTERNAL_DATE,
+                    "field": F_DATE,
                    "interval": 86400000,
                    "hard_bounds": {
                        "min": week_ago_ms,
@@ -944,7 +1076,23 @@ impl EnvelopeIndexManager {
        }))
        .unwrap();

-        let query = AllQuery;
+        let query: Box<dyn Query> = match accounts {
+            Some(ref ids) if !ids.is_empty() => {
+                let mut subqueries = Vec::new();
+                for &id in ids {
+                    let term =
+                        Term::from_field_u64(SchemaTools::envelope_fields().f_account_id, id);
+                    subqueries.push((
+                        Occur::Should,
+                        Box::new(TermQuery::new(term, IndexRecordOption::Basic)) as Box<dyn Query>,
+                    ));
+                }
+                Box::new(BooleanQuery::new(subqueries))
+            }
+            Some(_) => Box::new(EmptyQuery),
+            None => Box::new(AllQuery),
+        };
+
        let agg_collector = AggregationCollector::from_aggs(aggregations, Default::default());
        let agg_results = searcher
            .search(&query, &agg_collector)
--- a/src/modules/logger/mod.rs
+++ b/src/modules/logger/mod.rs
@@ -16,8 +16,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
-use crate::logger::file::setup_file_logger;
+use crate::modules::logger::file::setup_file_logger;
 use crate::modules::settings::cli::SETTINGS;
 use chrono::Local;
 use std::process;
--- a/src/modules/mailbox/delete.rs
+++ b/src/modules/mailbox/delete.rs
@@ -0,0 +1,38 @@
+use crate::modules::{
+    cache::imap::mailbox::MailBox,
+    error::BichonResult,
+    indexer::manager::{EML_INDEX_MANAGER, ENVELOPE_INDEX_MANAGER},
+};
+
+pub async fn delete_mailbox_impl(account_id: u64, mailbox_id: u64) -> BichonResult<()> {
+    let mailbox = MailBox::get(mailbox_id).await?;
+
+    let name = mailbox.name;
+    let delimiter = mailbox.delimiter.unwrap_or("/".to_owned());
+    let all_mailboxes = MailBox::list_all(account_id).await?;
+
+    let prefix = format!("{}{}", name, delimiter);
+    let ids_to_delete: Vec<u64> = all_mailboxes
+        .into_iter()
+        .filter(|m| m.id == mailbox_id || m.name.starts_with(&prefix))
+        .map(|m| m.id)
+        .collect();
+
+    if ids_to_delete.is_empty() {
+        return Ok(());
+    }
+
+    for id in &ids_to_delete {
+        MailBox::delete(*id).await?;
+    }
+
+    ENVELOPE_INDEX_MANAGER
+        .delete_mailbox_envelopes(account_id, ids_to_delete.clone())
+        .await?;
+
+    EML_INDEX_MANAGER
+        .delete_mailbox_envelopes(account_id, ids_to_delete)
+        .await?;
+
+    Ok(())
+}
--- a/src/modules/mailbox/list.rs
+++ b/src/modules/mailbox/list.rs
@@ -16,7 +16,6 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use crate::modules::account::migration::{AccountModel, AccountType};
 use crate::modules::cache::imap::mailbox::{Attribute, AttributeEnum, MailBox};
 use crate::modules::context::executors::MAIL_CONTEXT;
@@ -64,8 +63,15 @@ pub async fn convert_names_to_mailboxes(
    for name in names.into_iter() {
        // Convert the name into a MailBox structure
        let mailbox_name = name.name().to_string();
+
        let mut mailbox: MailBox = name.into();

+        tracing::debug!(
+            raw = &mailbox_name,
+            decoded = &mailbox.name,
+            "mailbox name comparison"
+        );
+
        if contains_no_select(&mailbox.attributes) {
            continue;
        }
--- a/src/modules/mailbox/mod.rs
+++ b/src/modules/mailbox/mod.rs
@@ -16,5 +16,5 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
+pub mod delete;
 pub mod list;
--- a/src/modules/message/append.rs
+++ b/src/modules/message/append.rs
@@ -0,0 +1,104 @@
+use crate::{
+    encode_mailbox_name,
+    modules::{
+        account::migration::{AccountModel, AccountType},
+        context::executors::MAIL_CONTEXT,
+        error::{code::ErrorCode, BichonResult},
+        indexer::manager::{EML_INDEX_MANAGER, ENVELOPE_INDEX_MANAGER},
+    },
+    raise_error,
+};
+use poem_openapi::Object;
+use serde::{Deserialize, Serialize};
+
+const MAX_RESTORE_COUNT: usize = 100;
+
+#[derive(Clone, Debug, Default, Eq, PartialEq, Deserialize, Serialize, Object)]
+pub struct RestoreMessagesRequest {
+    /// Message IDs to restore (max 100)
+    pub message_ids: Vec<u64>,
+}
+
+pub async fn restore_emails(account_id: u64, message_ids: Vec<u64>) -> BichonResult<()> {
+    if message_ids.len() > MAX_RESTORE_COUNT {
+        return Err(raise_error!(
+            format!(
+                "Too many messages to restore: {} (max {})",
+                message_ids.len(),
+                MAX_RESTORE_COUNT
+            ),
+            ErrorCode::InvalidParameter
+        ));
+    }
+
+    let account = AccountModel::check_account_exists(account_id).await?;
+    if !matches!(account.account_type, AccountType::IMAP) {
+        return Err(raise_error!(
+            "Account type is not IMAP".into(),
+            ErrorCode::Incompatible
+        ));
+    }
+    let executor = MAIL_CONTEXT.imap(account.id).await?;
+
+    let mut failed = Vec::new();
+
+    for message_id in message_ids {
+        let result: BichonResult<()> = async {
+            let envelope = ENVELOPE_INDEX_MANAGER
+                .get_envelope_by_id(account_id, message_id)
+                .await?
+                .ok_or_else(|| {
+                    raise_error!(
+                        format!(
+                            "Envelope not found: account_id={} message_id={}",
+                            account_id, message_id
+                        ),
+                        ErrorCode::ResourceNotFound
+                    )
+                })?;
+
+            let eml = EML_INDEX_MANAGER
+                .get(account_id, message_id)
+                .await?
+                .ok_or_else(|| {
+                    raise_error!(
+                        format!(
+                            "Email record not found: account_id={} id={}",
+                            account_id, message_id
+                        ),
+                        ErrorCode::ResourceNotFound
+                    )
+                })?;
+
+            if let Some(mailbox_name) = envelope.mailbox_name {
+                executor
+                    .append(encode_mailbox_name!(&mailbox_name), None, None, &eml)
+                    .await?;
+            }
+
+            Ok(())
+        }
+        .await;
+
+        if let Err(err) = result {
+            failed.push(message_id);
+            tracing::warn!(
+                account_id = account_id,
+                message_id = message_id,
+                error = ?err,
+                "Failed to restore email"
+            );
+        }
+    }
+
+    if !failed.is_empty() {
+        tracing::info!(
+            account_id = account_id,
+            failed_count = failed.len(),
+            failed_message_ids = ?failed,
+            "Restore emails finished with partial failures"
+        );
+    }
+
+    Ok(())
+}
--- a/src/modules/message/mod.rs
+++ b/src/modules/message/mod.rs
@@ -16,7 +16,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
+pub mod append;
 pub mod content;
 pub mod delete;
 pub mod list;
--- a/src/modules/message/search.rs
+++ b/src/modules/message/search.rs
@@ -16,6 +16,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

+use std::collections::HashSet;

 use poem_openapi::Object;
 use serde::{Deserialize, Serialize};
@@ -72,9 +73,18 @@ impl SearchRequest {
    }
 }

-pub async fn search_messages_impl(request: SearchRequest) -> BichonResult<DataPage<Envelope>> {
+pub async fn search_messages_impl(
+    accounts: Option<HashSet<u64>>,
+    request: SearchRequest,
+) -> BichonResult<DataPage<Envelope>> {
    request.validate()?;
    ENVELOPE_INDEX_MANAGER
-        .search(request.filter, request.page, request.page_size, true)
+        .search(
+            accounts,
+            request.filter,
+            request.page,
+            request.page_size,
+            true,
+        )
        .await
 }
--- a/src/modules/mod.rs
+++ b/src/modules/mod.rs
@@ -19,6 +19,7 @@
 pub mod account;
 pub mod autoconfig;
 pub mod cache;
+pub mod cli;
 pub mod common;
 pub mod context;
 pub mod dashboard;
@@ -36,5 +37,6 @@ pub mod rest;
 pub mod settings;
 pub mod tasks;
 pub mod token;
+pub mod users;
 pub mod utils;
 pub mod version;
--- a/src/modules/oauth2/entity.rs
+++ b/src/modules/oauth2/entity.rs
@@ -16,7 +16,6 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use crate::{
    encrypt, id,
    modules::{
@@ -97,6 +96,27 @@ impl OAuth2 {
        })
    }

+    pub fn scrub_sensitive_fields(&mut self) {
+        let mask = "********";
+        let notice =
+            " [REDACTED: You do not have permission to view sensitive configuration details]";
+
+        let original_desc = self
+            .description
+            .clone()
+            .unwrap_or_else(|| "OAuth2 Config".to_string());
+        self.description = Some(format!("{}{}", original_desc, notice));
+
+        self.client_id = mask.to_string();
+        self.client_secret = mask.to_string();
+        self.auth_url = mask.to_string();
+        self.token_url = mask.to_string();
+        self.redirect_uri = mask.to_string();
+
+        self.scopes = None;
+        self.extra_params = None;
+    }
+
    pub async fn save(&self) -> BichonResult<()> {
        insert_impl(DB_MANAGER.meta_db(), self.to_owned()).await?;
        Ok(())
--- a/src/modules/rest/api/access_token.rs
+++ b/src/modules/rest/api/access_token.rs
@@ -16,16 +16,12 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use crate::modules::common::auth::ClientContext;
 use crate::modules::rest::api::ApiTags;
 use crate::modules::rest::ApiResult;
-use crate::modules::token::payload::AccessTokenUpdateRequest;
-use crate::modules::token::root::set_root_password;
-use crate::modules::{
-    token::payload::AccessTokenCreateRequest,
-    token::{root::reset_root_token, AccessToken},
-};
+use crate::modules::token::view::AccessTokenResp;
+use crate::modules::users::permissions::Permission;
+use crate::modules::{token::payload::AccessTokenCreateRequest, token::AccessTokenModel};
 use poem_openapi::payload::PlainText;
 use poem_openapi::{param::Path, payload::Json, OpenApi};

@@ -33,9 +29,6 @@ pub struct AccessTokenApi;

 #[OpenApi(prefix_path = "/api/v1", tag = "ApiTags::AccessToken")]
 impl AccessTokenApi {
-    /// Lists all access tokens in the system.
-    ///
-    /// Requires root privileges.
    #[oai(
        path = "/access-token-list",
        method = "get",
@@ -44,31 +37,15 @@ impl AccessTokenApi {
    async fn list_access_tokens(
        &self,
        context: ClientContext,
-    ) -> ApiResult<Json<Vec<AccessToken>>> {
-        context.require_root()?;
-        Ok(Json(AccessToken::list_all().await?))
+    ) -> ApiResult<Json<Vec<AccessTokenResp>>> {
+        context
+            .require_permission(None, Permission::TOKEN_MANAGE)
+            .await?;
+
+        Ok(Json(AccessTokenModel::list_all_api_tokens().await?))
    }

-    /// Lists access tokens for a specific account.
-    ///
-    /// Requires root privileges.
-    #[oai(
-        path = "/access-token-list/:account_id",
-        method = "get",
-        operation_id = "list_account_access_tokens"
-    )]
-    async fn list_account_access_tokens(
-        &self,
-        /// The ID of the account whose tokens are to be retrieved.
-        account_id: Path<u64>,
-        context: ClientContext,
-    ) -> ApiResult<Json<Vec<AccessToken>>> {
-        context.require_root()?;
-        Ok(Json(AccessToken::list_account_tokens(account_id.0).await?))
-    }
    /// Deletes a specific access token.
-    ///
-    /// Requires root privileges.
    #[oai(
        path = "/access-token/:token",
        method = "delete",
@@ -80,13 +57,18 @@ impl AccessTokenApi {
        token: Path<String>,
        context: ClientContext,
    ) -> ApiResult<()> {
-        context.require_root()?;
-        Ok(AccessToken::delete(token.0.trim()).await?)
+        let token = token.0.trim();
+        let token = AccessTokenModel::get_token(token).await?;
+        if context.user.id != token.user_id {
+            context
+                .require_permission(None, Permission::TOKEN_MANAGE)
+                .await?;
+        }
+
+        Ok(AccessTokenModel::delete(&token.token).await?)
    }

-    /// Creates a new access token.
-    ///
-    /// Requires root privileges.
+    /// Creates a new api token.
    #[oai(
        path = "/access-token",
        method = "post",
@@ -98,59 +80,15 @@ impl AccessTokenApi {
        /// The request payload
        payload: Json<AccessTokenCreateRequest>,
    ) -> ApiResult<PlainText<String>> {
-        context.require_root()?;
-        Ok(PlainText(AccessToken::create(payload.0).await?))
-    }
+        let current_user_id = context.user.id;
+        let target_user_id = payload.0.user_id.unwrap_or(current_user_id);
+        if target_user_id != current_user_id {
+            context
+                .require_permission(None, Permission::USER_MANAGE)
+                .await?;
+        }

-    /// Updates an existing access token.
-    ///
-    /// Requires root privileges.
-    #[oai(
-        path = "/access-token/:token",
-        method = "post",
-        operation_id = "update_access_token"
-    )]
-    async fn update_access_token(
-        &self,
-        context: ClientContext,
-        /// The access token to be updated.
-        token: Path<String>,
-        /// The request payload.
-        payload: Json<AccessTokenUpdateRequest>,
-    ) -> ApiResult<()> {
-        context.require_root()?;
-        Ok(AccessToken::update(token.0.trim(), payload.0).await?)
-    }
-
-    /// Regenerates the root access token.
-    ///
-    /// Requires root privileges.
-    #[oai(
-        path = "/reset-root-token",
-        method = "post",
-        operation_id = "regenerate_root_token"
-    )]
-    async fn regenerate_root_token(&self, context: ClientContext) -> ApiResult<PlainText<String>> {
-        context.require_root()?;
-        Ok(PlainText(reset_root_token().await?))
-    }
-
-    /// Reset the Root user's password.
-    ///
-    /// Only callable by an already authenticated Root user.
-    /// This endpoint updates the Root password to `password_str`
-    /// and regenerates the `root_token`, invalidating any previous token.
-    #[oai(
-        path = "/reset-root-password",
-        method = "post",
-        operation_id = "reset_root_password"
-    )]
-    async fn reset_root_password(
-        &self,
-        password_str: PlainText<String>,
-        context: ClientContext,
-    ) -> ApiResult<()> {
-        context.require_root()?;
-        Ok(set_root_password(password_str.0.trim()).await?)
+        let token_string = AccessTokenModel::create_api_token(target_user_id, payload.0).await?;
+        Ok(PlainText(token_string))
    }
 }
--- a/src/modules/rest/api/account.rs
+++ b/src/modules/rest/api/account.rs
@@ -16,23 +16,25 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-use std::collections::BTreeSet;
+use std::collections::{HashMap, HashSet};

+use crate::modules::account::grant::BatchAccountRoleRequest;
 use crate::modules::account::migration::AccountModel;
 use crate::modules::account::payload::{
    filter_accessible_accounts, AccountCreateRequest, AccountUpdateRequest, MinimalAccount,
 };
 use crate::modules::account::state::AccountRunningState;
+use crate::modules::account::view::AccountResp;
 use crate::modules::common::auth::ClientContext;
 use crate::modules::common::paginated::paginate_vec;
 use crate::modules::error::code::ErrorCode;
 use crate::modules::rest::api::ApiTags;
 use crate::modules::rest::response::DataPage;
 use crate::modules::rest::ApiResult;
-use crate::modules::token::{AccessToken, AccountInfo};
+use crate::modules::users::permissions::Permission;
+use crate::modules::users::UserModel;
 use crate::raise_error;
-use poem::web::Path;
-use poem_openapi::param::Query;
+use poem_openapi::param::{Path, Query};
 use poem_openapi::payload::Json;
 use poem_openapi::OpenApi;

@@ -53,7 +55,9 @@ impl AccountApi {
        context: ClientContext,
    ) -> ApiResult<Json<AccountModel>> {
        let account_id = account_id.0;
-        context.require_account_access(account_id)?;
+        context
+            .require_permission(Some(account_id), Permission::ACCOUNT_READ_DETAILS)
+            .await?;
        Ok(Json(AccountModel::get(account_id).await?))
    }

@@ -70,7 +74,9 @@ impl AccountApi {
        context: ClientContext,
    ) -> ApiResult<()> {
        let account_id = account_id.0;
-        context.require_account_access(account_id)?;
+        context
+            .require_permission(Some(account_id), Permission::ACCOUNT_MANAGE)
+            .await?;
        Ok(AccountModel::delete(account_id).await?)
    }

@@ -82,14 +88,10 @@ impl AccountApi {
        payload: Json<AccountCreateRequest>,
        context: ClientContext,
    ) -> ApiResult<Json<AccountModel>> {
-        let account = AccountModel::create_account(payload.0).await?;
-        if let Some(access_token) = &context.access_token {
-            let account_info = AccountInfo {
-                id: account.id,
-                email: account.email.clone(),
-            };
-            AccessToken::grant_account_access(&access_token.token, account_info).await?;
-        }
+        context
+            .require_permission(None, Permission::ACCOUNT_CREATE)
+            .await?;
+        let account = AccountModel::create_account(context.user.id, payload.0).await?;
        Ok(Json(account))
    }

@@ -108,7 +110,9 @@ impl AccountApi {
        context: ClientContext,
    ) -> ApiResult<()> {
        let account_id = account_id.0;
-        context.require_account_access(account_id)?;
+        context
+            .require_permission(Some(account_id), Permission::ACCOUNT_MANAGE)
+            .await?;
        Ok(AccountModel::update(account_id, payload.0, true).await?)
    }

@@ -123,35 +127,61 @@ impl AccountApi {
        /// Optional. Whether to sort the list in descending order.
        desc: Query<Option<bool>>,
        context: ClientContext,
-    ) -> ApiResult<Json<DataPage<AccountModel>>> {
-        let accessible_accounts = context.accessible_accounts()?;
+    ) -> ApiResult<Json<DataPage<AccountResp>>> {
+        let is_admin = context.user.is_admin().await;
+        let sort_desc = desc.0.unwrap_or(true);

-        if accessible_accounts.is_none() {
-            return Ok(Json(
-                AccountModel::paginate_list(page.0, page_size.0, desc.0).await?,
-            ));
-        }
-
-        let all_accounts = AccountModel::list_all().await?;
-        let allowed_ids: BTreeSet<u64> =
-            accessible_accounts.unwrap().iter().map(|a| a.id).collect();
-
-        let mut filtered_accounts: Vec<AccountModel> = all_accounts
+        let user_map: HashMap<u64, UserModel> = UserModel::list_all()
+            .await?
            .into_iter()
-            .filter(|acct| allowed_ids.contains(&acct.id))
+            .map(|u| (u.id, u))
+            .collect();
+        let page_data: DataPage<AccountModel> = if is_admin {
+            AccountModel::paginate_list(page.0, page_size.0, desc.0).await?
+        } else {
+            let authorized_ids: HashSet<u64> =
+                context.user.account_access_map.keys().cloned().collect();
+
+            if authorized_ids.is_empty() {
+                return Ok(Json(DataPage {
+                    current_page: page.0,
+                    page_size: page_size.0,
+                    total_items: 0,
+                    items: vec![],
+                    total_pages: Some(0),
+                }));
+            }
+
+            let mut accounts: Vec<AccountModel> = AccountModel::list_all()
+                .await?
+                .into_iter()
+                .filter(|acct| authorized_ids.contains(&acct.id))
+                .collect();
+
+            accounts.sort_by(|a, b| {
+                if sort_desc {
+                    b.created_at.cmp(&a.created_at)
+                } else {
+                    a.created_at.cmp(&b.created_at)
+                }
+            });
+
+            paginate_vec(&accounts, page.0, page_size.0).map(DataPage::from)?
+        };
+
+        let items = page_data
+            .items
+            .into_iter()
+            .map(|account| AccountResp::from_model(account, &user_map))
            .collect();

-        let sort_desc = desc.0.unwrap_or(true);
-        filtered_accounts.sort_by(|a, b| {
-            if sort_desc {
-                b.created_at.cmp(&a.created_at)
-            } else {
-                a.created_at.cmp(&b.created_at)
-            }
-        });
-        let page_data =
-            paginate_vec(&filtered_accounts, page.0, page_size.0).map(DataPage::from)?;
-        Ok(Json(page_data))
+        Ok(Json(DataPage {
+            current_page: page_data.current_page,
+            page_size: page_data.page_size,
+            total_items: page_data.total_items,
+            total_pages: page_data.total_pages,
+            items,
+        }))
    }

    /// Get the running state of an account
@@ -168,7 +198,9 @@ impl AccountApi {
    ) -> ApiResult<Json<AccountRunningState>> {
        let account_id = account_id.0;
        AccountModel::check_account_exists(account_id).await?;
-        context.require_account_access(account_id)?;
+        context
+            .require_permission(Some(account_id), Permission::ACCOUNT_READ_DETAILS)
+            .await?;
        let state = AccountRunningState::get(account_id).await?.ok_or_else(|| {
            raise_error!(
                "account running state is not found".into(),
@@ -189,15 +221,30 @@ impl AccountApi {
    )]
    async fn minimal_accounts_list(
        &self,
+        only_nosync: Query<Option<bool>>,
        context: ClientContext,
    ) -> ApiResult<Json<Vec<MinimalAccount>>> {
-        let accessible_accounts = context.accessible_accounts()?;
+        let is_admin = context.user.is_admin().await;
+        let only_nosync = only_nosync.0.unwrap_or_default();

-        let minimal_list = AccountModel::minimal_list().await?;
-        let result = match accessible_accounts {
-            Some(set) => filter_accessible_accounts(&minimal_list, set),
-            None => minimal_list,
-        };
+        let minimal_list = AccountModel::minimal_list(only_nosync).await?;
+        if is_admin {
+            return Ok(Json(minimal_list));
+        }
+
+        let authorized_ids: Vec<u64> = context.user.account_access_map.keys().cloned().collect();
+        let result = filter_accessible_accounts(&minimal_list, &authorized_ids);
        Ok(Json(result))
    }
+
+    #[oai(path = "/accounts/access/assignments", method = "post")]
+    async fn batch_assign_account_role(
+        &self,
+        req: Json<BatchAccountRoleRequest>,
+        context: ClientContext,
+    ) -> ApiResult<()> {
+        req.validate_existence().await?;
+        req.0.do_assign(&context).await?;
+        Ok(())
+    }
 }
--- a/src/modules/rest/api/auto_config.rs
+++ b/src/modules/rest/api/auto_config.rs
@@ -16,14 +16,15 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use crate::modules::autoconfig::entity::MailServerConfig;
 use crate::modules::autoconfig::load::resolve_autoconfig;
+use crate::modules::common::auth::ClientContext;
 use crate::modules::error::code::ErrorCode;
 use crate::modules::rest::api::ApiTags;
 use crate::modules::rest::ApiResult;
+use crate::modules::users::permissions::Permission;
 use crate::raise_error;
-use poem::web::Path;
+use poem_openapi::param::Path;
 use poem_openapi::payload::Json;
 use poem_openapi::OpenApi;

@@ -40,8 +41,13 @@ impl AutoConfigApi {
    async fn autoconfig(
        &self,
        /// The email address to lookup configuration for
-        email_address: Path<String>
+        email_address: Path<String>,
+        context: ClientContext,
    ) -> ApiResult<Json<MailServerConfig>> {
+        context
+            .require_permission(None, Permission::ACCOUNT_CREATE)
+            .await?;
+
        let result = resolve_autoconfig(email_address.0.trim())
            .await?
            .ok_or_else(|| {
--- a/src/modules/rest/api/import.rs
+++ b/src/modules/rest/api/import.rs
@@ -21,6 +21,7 @@ use crate::modules::import::BatchEmlResult;
 use crate::modules::import::{BatchEmlRequest, ImportEmls};
 use crate::modules::rest::api::ApiTags;
 use crate::modules::rest::ApiResult;
+use crate::modules::users::permissions::Permission;
 use poem_openapi::payload::Json;
 use poem_openapi::OpenApi;

@@ -43,7 +44,9 @@ impl ImportApi {
        payload: Json<BatchEmlRequest>,
        context: ClientContext,
    ) -> ApiResult<Json<BatchEmlResult>> {
-        context.require_root()?;
+        context
+            .require_permission(Some(payload.0.account_id), Permission::DATA_IMPORT_BATCH)
+            .await?;
        Ok(Json(ImportEmls::do_import(payload.0).await?))
    }
 }
--- a/src/modules/rest/api/mailbox.rs
+++ b/src/modules/rest/api/mailbox.rs
@@ -16,14 +16,14 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use crate::modules::cache::imap::mailbox::MailBox;
 use crate::modules::common::auth::ClientContext;
+use crate::modules::mailbox::delete::delete_mailbox_impl;
 use crate::modules::mailbox::list::get_account_mailboxes;
 use crate::modules::rest::api::ApiTags;
 use crate::modules::rest::ApiResult;
-use poem::web::Path;
-use poem_openapi::param::Query;
+use crate::modules::users::permissions::Permission;
+use poem_openapi::param::{Path, Query};
 use poem_openapi::payload::Json;
 use poem_openapi::OpenApi;

@@ -53,8 +53,38 @@ impl MailBoxApi {
        context: ClientContext,
    ) -> ApiResult<Json<Vec<MailBox>>> {
        let account_id = account_id.0;
-        context.require_account_access(account_id)?;
+        context
+            .require_permission(Some(account_id), Permission::ACCOUNT_READ_DETAILS)
+            .await?;
        let remote = remote.0.unwrap_or(false);
        Ok(Json(get_account_mailboxes(account_id, remote).await?))
    }
+
+    /// Deletes a mailbox for the specified account.
+    ///
+    /// Requires `DATA_DELETE` permission on the target account.
+    ///
+    /// # Parameters
+    /// - `account_id`: Account identifier.
+    /// - `mailbox_id`: Mailbox identifier.
+    ///
+    #[oai(
+        path = "/delete-mailbox/:account_id/:mailbox_id",
+        method = "delete",
+        operation_id = "delete_mailbox"
+    )]
+    async fn delete_mailbox(
+        &self,
+        /// The unique identifier of the account.
+        account_id: Path<u64>,
+        mailbox_id: Path<u64>,
+        context: ClientContext,
+    ) -> ApiResult<()> {
+        let account_id = account_id.0;
+        let mailbox_id = mailbox_id.0;
+        context
+            .require_permission(Some(account_id), Permission::DATA_DELETE)
+            .await?;
+        Ok(delete_mailbox_impl(account_id, mailbox_id).await?)
+    }
 }
--- a/src/modules/rest/api/message.rs
+++ b/src/modules/rest/api/message.rs
@@ -21,6 +21,8 @@ use crate::modules::common::auth::ClientContext;
 use crate::modules::indexer::envelope::Envelope;
 use crate::modules::indexer::manager::EML_INDEX_MANAGER;
 use crate::modules::indexer::manager::ENVELOPE_INDEX_MANAGER;
+use crate::modules::message::append::restore_emails;
+use crate::modules::message::append::RestoreMessagesRequest;
 use crate::modules::message::content::{retrieve_email_content, FullMessageContent};
 use crate::modules::message::delete::delete_messages_impl;
 use crate::modules::message::list::{get_thread_messages, list_messages_impl};
@@ -31,13 +33,14 @@ use crate::modules::rest::api::ApiTags;
 use crate::modules::rest::response::DataPage;
 use crate::modules::rest::ApiResult;
 use crate::modules::rest::ErrorCode;
+use crate::modules::users::permissions::Permission;
 use crate::raise_error;
-use poem::web::Path;
 use poem::Body;
-use poem_openapi::param::Query;
+use poem_openapi::param::{Path, Query};
 use poem_openapi::payload::{Attachment, AttachmentType, Json};
 use poem_openapi::OpenApi;
 use std::collections::HashMap;
+use std::collections::HashSet;
 use tantivy::schema::Facet;

 pub struct MessageApi;
@@ -58,12 +61,14 @@ impl MessageApi {
    ) -> ApiResult<()> {
        let request = payload.0;
        for account_id in request.keys() {
-            context.require_account_access(*account_id)?;
+            context
+                .require_permission(Some(*account_id), Permission::DATA_DELETE)
+                .await?;
        }
        Ok(delete_messages_impl(request).await?)
    }

-    /// Lists messages in a specified mailbox for the given account.
+    /// Lists messages in a mailbox. Requires `mailbox_id`, `page`, and `page_size` query parameters.
    #[oai(
        path = "/list-messages/:account_id",
        method = "get",
@@ -71,7 +76,9 @@ impl MessageApi {
    )]
    async fn list_messages(
        &self,
+        /// The ID of the account.
        account_id: Path<u64>,
+        /// The ID of the mailbox to list messages from.
        mailbox_id: Query<u64>,
        page: Query<u64>,
        page_size: Query<u64>,
@@ -79,13 +86,16 @@ impl MessageApi {
    ) -> ApiResult<Json<DataPage<Envelope>>> {
        let account_id = account_id.0;
        let mailbox_id = mailbox_id.0;
-        context.require_account_access(account_id)?;
+        context
+            .require_permission(Some(account_id), Permission::DATA_READ)
+            .await?;
        Ok(Json(
            list_messages_impl(account_id, mailbox_id, page.0, page_size.0).await?,
        ))
    }

-    /// Lists messages in a specified mailbox for the given account.
+    /// Searches messages across all mailboxes using various filter criteria.
+    /// The search filters are provided in the request body.
    #[oai(
        path = "/search-messages",
        method = "post",
@@ -96,11 +106,18 @@ impl MessageApi {
        payload: Json<SearchRequest>,
        context: ClientContext,
    ) -> ApiResult<Json<DataPage<Envelope>>> {
-        context.require_root()?;
-        Ok(Json(search_messages_impl(payload.0).await?))
+        let authorized_ids: Option<HashSet<u64>> = if context
+            .has_permission(None, Permission::DATA_READ_ALL)
+            .await
+        {
+            None
+        } else {
+            Some(context.user.account_access_map.keys().cloned().collect())
+        };
+        Ok(Json(search_messages_impl(authorized_ids, payload.0).await?))
    }

-    /// Get thread's envelopes in a specified mailbox for the given account.
+    /// Retrieves all messages belonging to a specific thread. Requires `thread_id`, `page`, and `page_size` query parameters.
    #[oai(
        path = "/get-thread-messages/:account_id",
        method = "get",
@@ -120,73 +137,141 @@ impl MessageApi {
    ) -> ApiResult<Json<DataPage<Envelope>>> {
        let account_id = account_id.0;
        let thread_id = thread_id.0;
-        context.require_account_access(account_id)?;
+        context
+            .require_permission(Some(account_id), Permission::DATA_READ)
+            .await?;
        Ok(Json(
            get_thread_messages(account_id, thread_id, page.0, page_size.0).await?,
        ))
    }

-    /// Fetches the content of a specific email for the given account.
+    /// Fetches the content of a specific email.
    #[oai(
-        path = "/message-content/:account_id",
+        path = "/message-content/:account_id/:message_id",
        method = "get",
        operation_id = "fetch_message_content"
    )]
    async fn fetch_message_content(
        &self,
+        /// The ID of the account.
        account_id: Path<u64>,
-        id: Query<u64>,
+        /// The ID of the message to fetch.
+        message_id: Path<u64>,
        context: ClientContext,
    ) -> ApiResult<Json<FullMessageContent>> {
        let account_id = account_id.0;
-        context.require_account_access(account_id)?;
-        Ok(Json(retrieve_email_content(account_id, id.0).await?))
+        context
+            .require_permission(Some(account_id), Permission::DATA_READ)
+            .await?;
+        Ok(Json(
+            retrieve_email_content(account_id, message_id.0).await?,
+        ))
    }

-    /// Fetches the full content of a specific email for the given account.
+    /// Retrieves the envelope (metadata) of a specific message.
    #[oai(
-        path = "/download-message/:account_id",
+        path = "/envelope/:account_id/:message_id",
+        method = "get",
+        operation_id = "get_envelope"
+    )]
+    async fn get_envelope(
+        &self,
+        /// The ID of the account.
+        account_id: Path<u64>,
+        /// The ID of the message.
+        message_id: Path<u64>,
+        context: ClientContext,
+    ) -> ApiResult<Json<Envelope>> {
+        let account_id = account_id.0;
+        context
+            .require_permission(Some(account_id), Permission::DATA_READ)
+            .await?;
+        let envelope = ENVELOPE_INDEX_MANAGER
+            .get_envelope_by_id(account_id, message_id.0)
+            .await?
+            .ok_or_else(|| {
+                raise_error!(
+                    format!(
+                        "Envelope not found: account_id={} message_id={}",
+                        account_id, message_id.0
+                    ),
+                    ErrorCode::ResourceNotFound
+                )
+            })?;
+        Ok(Json(envelope))
+    }
+
+    /// Downloads the raw EML file of a specific email.
+    #[oai(
+        path = "/download-message/:account_id/:message_id",
        method = "get",
        operation_id = "download_message"
    )]
    async fn download_message(
        &self,
+        /// The ID of the account.
        account_id: Path<u64>,
-        id: Query<u64>,
+        /// The ID of the message to download.
+        message_id: Path<u64>,
        context: ClientContext,
    ) -> ApiResult<Attachment<Body>> {
        let account_id = account_id.0;
        AccountModel::check_account_exists(account_id).await?;
-        context.require_account_access(account_id)?;
-        let id = id.0;
-        let reader = EML_INDEX_MANAGER.get_reader(account_id, id).await?;
+        context
+            .require_permission(Some(account_id), Permission::DATA_RAW_DOWNLOAD)
+            .await?;
+        let message_id = message_id.0;
+        let reader = EML_INDEX_MANAGER.get_reader(account_id, message_id).await?;
        let body = Body::from_async_read(reader);
        let attachment = Attachment::new(body)
            .attachment_type(AttachmentType::Attachment)
-            .filename(format!("{id}.eml"));
+            .filename(format!("{message_id}.eml"));
        Ok(attachment)
    }

-    /// Downloads a specific attachment by filename.
    #[oai(
-        path = "/download-attachment/:account_id",
+        path = "/restore-messages/:account_id",
+        method = "post",
+        operation_id = "restore_messages"
+    )]
+    async fn restore_messages(
+        &self,
+        account_id: Path<u64>,
+        /// Message IDs to restore.
+        payload: Json<RestoreMessagesRequest>,
+        context: ClientContext,
+    ) -> ApiResult<()> {
+        let account_id = account_id.0;
+        context
+            .require_permission(Some(account_id), Permission::DATA_EXPORT_BATCH)
+            .await?;
+        Ok(restore_emails(account_id, payload.0.message_ids).await?)
+    }
+
+    /// Downloads a specific attachment from an email. Requires `name` query parameter.
+    #[oai(
+        path = "/download-attachment/:account_id/:message_id",
        method = "get",
        operation_id = "download_attachment"
    )]
    async fn download_attachment(
        &self,
+        /// The ID of the account.
        account_id: Path<u64>,
-        id: Query<u64>,
+        /// The ID of the message containing the attachment.
+        message_id: Path<u64>,
+        /// The filename of the attachment to download.
        name: Query<String>,
        context: ClientContext,
    ) -> ApiResult<Attachment<Body>> {
        let account_id = account_id.0;
        AccountModel::check_account_exists(account_id).await?;
-        context.require_account_access(account_id)?;
-        let email_id = id.0;
+        context
+            .require_permission(Some(account_id), Permission::DATA_READ)
+            .await?;
        let name = name.0.trim();
        let reader = EML_INDEX_MANAGER
-            .get_attachment(account_id, email_id, name)
+            .get_attachment(account_id, message_id.0, name)
            .await?;
        let body = Body::from_async_read(reader);
        let attachment = Attachment::new(body)
@@ -196,8 +281,18 @@ impl MessageApi {
    }
    /// Returns all facets in the index along with their document counts.
    #[oai(path = "/all-tags", method = "get", operation_id = "get_all_tags")]
-    async fn get_all_tags(&self) -> ApiResult<Json<Vec<TagCount>>> {
-        Ok(Json(ENVELOPE_INDEX_MANAGER.get_all_tags().await?))
+    async fn get_all_tags(&self, context: ClientContext) -> ApiResult<Json<Vec<TagCount>>> {
+        let authorized_ids: Option<HashSet<u64>> = if context
+            .has_permission(None, Permission::DATA_READ_ALL)
+            .await
+        {
+            None
+        } else {
+            Some(context.user.account_access_map.keys().cloned().collect())
+        };
+        Ok(Json(
+            ENVELOPE_INDEX_MANAGER.get_all_tags(authorized_ids).await?,
+        ))
    }

    /// Adds or removes facet tags for multiple emails across accounts.
@@ -206,12 +301,23 @@ impl MessageApi {
        method = "post",
        operation_id = "update_envelope_tags"
    )]
-    async fn update_envelope_tags(&self, req: Json<UpdateTagsRequest>) -> ApiResult<()> {
+    async fn update_envelope_tags(
+        &self,
+        req: Json<UpdateTagsRequest>,
+        context: ClientContext,
+    ) -> ApiResult<()> {
        let req = req.0;
        for tag in &req.tags {
            Facet::from_text(tag)
                .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InvalidParameter))?;
        }
+
+        for account_id in req.updates.keys() {
+            context
+                .require_permission(Some(*account_id), Permission::DATA_MANAGE)
+                .await?;
+        }
+
        ENVELOPE_INDEX_MANAGER
            .update_envelope_tags(req.updates, req.tags)
            .await?;
--- a/src/modules/rest/api/mod.rs
+++ b/src/modules/rest/api/mod.rs
@@ -25,7 +25,10 @@ use oauth2::OAuth2Api;
 use poem_openapi::{OpenApiService, Tags};
 use system::SystemApi;

-use crate::{bichon_version, modules::rest::api::import::ImportApi};
+use crate::{
+    bichon_version,
+    modules::rest::api::{import::ImportApi, users::UsersApi},
+};

 pub mod access_token;
 pub mod account;
@@ -35,6 +38,7 @@ pub mod mailbox;
 pub mod message;
 pub mod oauth2;
 pub mod system;
+pub mod users;

 #[derive(Tags)]
 pub enum ApiTags {
@@ -46,6 +50,7 @@ pub enum ApiTags {
    Message,
    System,
    Import,
+    Users,
 }

 type RustMailOpenApi = (
@@ -57,6 +62,7 @@ type RustMailOpenApi = (
    OAuth2Api,
    MessageApi,
    ImportApi,
+    UsersApi,
 );

 pub fn create_openapi_service() -> OpenApiService<RustMailOpenApi, ()> {
@@ -70,6 +76,7 @@ pub fn create_openapi_service() -> OpenApiService<RustMailOpenApi, ()> {
            OAuth2Api,
            MessageApi,
            ImportApi,
+            UsersApi,
        ),
        "BichonApi",
        bichon_version!(),
--- a/src/modules/rest/api/oauth2.rs
+++ b/src/modules/rest/api/oauth2.rs
@@ -16,7 +16,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
+use crate::modules::account::migration::AccountModel;
 use crate::modules::common::auth::ClientContext;
 use crate::modules::error::code::ErrorCode;
 use crate::modules::oauth2::entity::{OAuth2, OAuth2CreateRequest, OAuth2UpdateRequest};
@@ -25,9 +25,9 @@ use crate::modules::oauth2::token::{ExternalOAuth2Request, OAuth2AccessToken};
 use crate::modules::rest::api::ApiTags;
 use crate::modules::rest::response::DataPage;
 use crate::modules::rest::ApiResult;
+use crate::modules::users::permissions::Permission;
 use crate::raise_error;
-use poem::web::Path;
-use poem_openapi::param::Query;
+use poem_openapi::param::{Path, Query};
 use poem_openapi::payload::{Json, PlainText};
 use poem_openapi::OpenApi;

@@ -50,14 +50,26 @@ impl OAuth2Api {
        id: Path<u64>,
        context: ClientContext,
    ) -> ApiResult<Json<OAuth2>> {
-        context.require_root()?;
        let id = id.0;
-        Ok(Json(OAuth2::get(id).await?.ok_or_else(|| {
+        let mut oauth2 = OAuth2::get(id).await?.ok_or_else(|| {
            raise_error!(
                format!("OAuth2 configuration id='{id}' not found"),
                ErrorCode::ResourceNotFound
            )
-        })?))
+        })?;
+        if context
+            .has_permission(None, Permission::ROOT)
+            .await
+        {
+            return Ok(Json(oauth2));
+        }
+
+        context
+            .require_permission(None, Permission::ACCOUNT_CREATE)
+            .await?;
+
+        oauth2.scrub_sensitive_fields();
+        Ok(Json(oauth2))
    }

    /// Deletes an OAuth2 configuration by name.
@@ -75,7 +87,9 @@ impl OAuth2Api {
        id: Path<u64>,
        context: ClientContext,
    ) -> ApiResult<()> {
-        context.require_root()?;
+        context
+            .require_permission(None, Permission::ROOT)
+            .await?;
        Ok(OAuth2::delete(id.0).await?)
    }

@@ -94,7 +108,9 @@ impl OAuth2Api {
        request: Json<OAuth2CreateRequest>,
        context: ClientContext,
    ) -> ApiResult<()> {
-        context.require_root()?;
+        context
+            .require_permission(None, Permission::ROOT)
+            .await?;
        let entity = OAuth2::new(request.0)?;
        Ok(entity.save().await?)
    }
@@ -116,7 +132,9 @@ impl OAuth2Api {
        payload: Json<OAuth2UpdateRequest>,
        context: ClientContext,
    ) -> ApiResult<()> {
-        context.require_root()?;
+        context
+            .require_permission(None, Permission::ROOT)
+            .await?;
        Ok(OAuth2::update(id.0, payload.0).await?)
    }

@@ -139,10 +157,23 @@ impl OAuth2Api {
        desc: Query<Option<bool>>,
        context: ClientContext,
    ) -> ApiResult<Json<DataPage<OAuth2>>> {
-        context.require_root()?;
-        Ok(Json(
-            OAuth2::paginate_list(page.0, page_size.0, desc.0).await?,
-        ))
+        let mut list = OAuth2::paginate_list(page.0, page_size.0, desc.0).await?;
+        if context
+            .has_permission(None, Permission::ROOT)
+            .await
+        {
+            return Ok(Json(list));
+        }
+
+        context
+            .require_permission(None, Permission::ACCOUNT_CREATE)
+            .await?;
+
+        for item in &mut list.items {
+            item.scrub_sensitive_fields();
+        }
+
+        Ok(Json(list))
    }

    /// Generates an OAuth2 authorization URL for a specific account.
@@ -160,8 +191,14 @@ impl OAuth2Api {
        request: Json<AuthorizeUrlRequest>,
        context: ClientContext,
    ) -> ApiResult<PlainText<String>> {
-        context.require_root()?;
        let request = request.0;
+        context
+            .require_any_permission(vec![
+                (None, Permission::ACCOUNT_CREATE),
+                (Some(request.account_id), Permission::ACCOUNT_MANAGE),
+            ])
+            .await?;
+
        let flow = OAuth2Flow::new(request.oauth2_id);
        Ok(PlainText(flow.authorize_url(request.account_id).await?))
    }
@@ -181,7 +218,9 @@ impl OAuth2Api {
        context: ClientContext,
    ) -> ApiResult<Json<OAuth2AccessToken>> {
        let account = account_id.0;
-        context.require_account_access(account)?;
+        context
+            .require_permission(Some(account), Permission::ACCOUNT_MANAGE)
+            .await?;
        Ok(Json(OAuth2AccessToken::get(account).await?.ok_or_else(
            || {
                raise_error!(
@@ -219,10 +258,13 @@ impl OAuth2Api {
        request: Json<ExternalOAuth2Request>,
        context: ClientContext,
    ) -> ApiResult<()> {
-        let account = account_id.0;
+        let account_id = account_id.0;
+        AccountModel::check_account_exists(account_id).await?;
        // Check account access permissions
-        context.require_account_access(account)?;
-        OAuth2AccessToken::upsert_external_oauth_token(account, request.0).await?;
+        context
+            .require_permission(Some(account_id), Permission::ACCOUNT_MANAGE)
+            .await?;
+        OAuth2AccessToken::upsert_external_oauth_token(account_id, request.0).await?;
        Ok(())
    }
 }
--- a/src/modules/rest/api/system.rs
+++ b/src/modules/rest/api/system.rs
@@ -16,13 +16,15 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use crate::modules::common::auth::ClientContext;
 use crate::modules::dashboard::DashboardStats;
 use crate::modules::error::code::ErrorCode;
 use crate::modules::rest::api::ApiTags;
 use crate::modules::rest::ApiResult;
+use crate::modules::settings::cli::SETTINGS;
 use crate::modules::settings::proxy::Proxy;
+use crate::modules::settings::SystemConfigurations;
+use crate::modules::users::permissions::Permission;
 use crate::modules::version::{fetch_notifications, Notifications};
 use crate::raise_error;
 use poem_openapi::param::Path;
@@ -60,14 +62,20 @@ impl SystemApi {
        path = "/dashboard-stats",
        operation_id = "get_dashboard_stats"
    )]
-    async fn get_dashboard_stats(&self) -> ApiResult<Json<DashboardStats>> {
-        let stats = DashboardStats::get().await?;
+    async fn get_dashboard_stats(&self, context: ClientContext) -> ApiResult<Json<DashboardStats>> {
+        let stats = DashboardStats::get(context).await?;
        Ok(Json(stats))
    }

    /// Get the full list of SOCKS5 proxy configurations.
    #[oai(method = "get", path = "/list-proxy", operation_id = "list_proxy")]
-    async fn list_proxy(&self) -> ApiResult<Json<Vec<Proxy>>> {
+    async fn list_proxy(&self, context: ClientContext) -> ApiResult<Json<Vec<Proxy>>> {
+        context
+            .require_any_permission(vec![
+                (None, Permission::ACCOUNT_CREATE),
+                (None, Permission::ROOT),
+            ])
+            .await?;
        let proxies = Proxy::list_all()
            .await
            .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
@@ -78,30 +86,36 @@ impl SystemApi {
    #[oai(path = "/proxy/:id", method = "delete", operation_id = "remove_proxy")]
    async fn remove_proxy(
        &self,
-        /// The name of the OAuth2 configuration to retrieve
+        /// The ID of the proxy configuration to delete.
        id: Path<u64>,
        context: ClientContext,
    ) -> ApiResult<()> {
-        context.require_root()?;
+        context
+            .require_permission(None, Permission::ROOT)
+            .await?;
        Ok(Proxy::delete(id.0).await?)
    }

-    /// Retrieve a specific proxy configuration by ID
+    /// Retrieve a specific proxy configuration by ID. Requires root permission.
    #[oai(path = "/proxy/:id", method = "get", operation_id = "get_proxy")]
    async fn get_proxy(
        &self,
-        /// The name of the OAuth2 configuration to retrieve
+        /// The ID of the proxy configuration to retrieve.
        id: Path<u64>,
        context: ClientContext,
    ) -> ApiResult<Json<Proxy>> {
-        context.require_root()?;
+        context
+            .require_permission(None, Permission::ROOT)
+            .await?;
        Ok(Json(Proxy::get(id.0).await?))
    }

    /// Create a new proxy configuration. Requires root permission.
    #[oai(path = "/proxy", method = "post", operation_id = "create_proxy")]
    async fn create_proxy(&self, url: PlainText<String>, context: ClientContext) -> ApiResult<()> {
-        context.require_root()?;
+        context
+            .require_permission(None, Permission::ROOT)
+            .await?;
        let entity = Proxy::new(url.0);
        Ok(entity.save().await?)
    }
@@ -114,7 +128,28 @@ impl SystemApi {
        url: PlainText<String>,
        context: ClientContext,
    ) -> ApiResult<()> {
-        context.require_root()?;
+        context
+            .require_permission(None, Permission::ROOT)
+            .await?;
        Ok(Proxy::update(id.0, url.0).await?)
    }
+    /// Get system configurations.
+    ///
+    /// Returns a read-only snapshot of the server configuration
+    /// resolved at startup. Sensitive values are not exposed.
+    #[oai(
+        method = "get",
+        path = "/system-configurations",
+        operation_id = "get_system_configurations"
+    )]
+    async fn get_system_configurations(
+        &self,
+        context: ClientContext,
+    ) -> ApiResult<Json<SystemConfigurations>> {
+        context
+            .require_permission(None, Permission::ROOT)
+            .await?;
+        let config: SystemConfigurations = SystemConfigurations::from(&*SETTINGS);
+        Ok(Json(config))
+    }
 }
--- a/src/modules/rest/api/users.rs
+++ b/src/modules/rest/api/users.rs
@@ -0,0 +1,217 @@
+//
+// Copyright (c) 2025 rustmailer.com (https://rustmailer.com)
+//
+// This file is part of the Bichon Email Archiving Project
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+use std::collections::BTreeMap;
+
+use crate::modules::common::auth::ClientContext;
+use crate::modules::rest::api::ApiTags;
+use crate::modules::rest::ApiResult;
+use crate::modules::token::AccessTokenModel;
+use crate::modules::users::minimal::MinimalUser;
+use crate::modules::users::payload::{
+    RoleCreateRequest, RoleUpdateRequest, UserCreateRequest, UserUpdateRequest,
+};
+use crate::modules::users::permissions::Permission;
+use crate::modules::users::role::UserRole;
+use crate::modules::users::view::UserView;
+use crate::modules::users::UserModel;
+use poem::web::Path;
+use poem_openapi::payload::Json;
+use poem_openapi::OpenApi;
+
+pub struct UsersApi;
+
+#[OpenApi(prefix_path = "/api/v1", tag = "ApiTags::Users")]
+impl UsersApi {
+    #[oai(path = "/list-roles", method = "get", operation_id = "list_roles")]
+    async fn list_roles(&self, context: ClientContext) -> ApiResult<Json<Vec<UserRole>>> {
+        context
+            .require_permission(None, Permission::USER_MANAGE)
+            .await?;
+
+        Ok(Json(UserRole::list_all().await?))
+    }
+
+    #[oai(path = "/roles/:id", method = "delete", operation_id = "remove_role")]
+    async fn remove_role(
+        &self,
+        /// The Role ID to delete
+        id: Path<u64>,
+        context: ClientContext,
+    ) -> ApiResult<()> {
+        let id = id.0;
+        context
+            .require_permission(None, Permission::USER_MANAGE)
+            .await?;
+        Ok(UserRole::delete(id).await?)
+    }
+
+    /// Create a new account
+    #[oai(path = "/roles", method = "post", operation_id = "create_role")]
+    async fn create_role(
+        &self,
+        /// Role creation request payload
+        payload: Json<RoleCreateRequest>,
+        context: ClientContext,
+    ) -> ApiResult<Json<UserRole>> {
+        context
+            .require_permission(None, Permission::USER_MANAGE)
+            .await?;
+        let role = UserRole::create(payload.0).await?;
+        Ok(Json(role))
+    }
+
+    /// Update an existing account
+    #[oai(path = "/roles/:id", method = "post", operation_id = "update_role")]
+    async fn update_role(
+        &self,
+        /// The Role ID to update
+        id: Path<u64>,
+        /// Role update request payload
+        payload: Json<RoleUpdateRequest>,
+        context: ClientContext,
+    ) -> ApiResult<()> {
+        let id = id.0;
+        context
+            .require_permission(None, Permission::USER_MANAGE)
+            .await?;
+        Ok(UserRole::update(id, payload.0).await?)
+    }
+
+    #[oai(path = "/list-users", method = "get", operation_id = "list_users")]
+    async fn list_users(&self, context: ClientContext) -> ApiResult<Json<Vec<UserView>>> {
+        context
+            .require_permission(None, Permission::USER_MANAGE)
+            .await?;
+        let roles = UserRole::list_all().await?;
+        let role_lookup: BTreeMap<u64, UserRole> = roles.into_iter().map(|r| (r.id, r)).collect();
+        let users = UserModel::list_all().await?;
+        let users = users
+            .into_iter()
+            .map(|u| u.to_view(&role_lookup))
+            .collect();
+        Ok(Json(users))
+    }
+
+    #[oai(
+        path = "/user-tokens/:id",
+        method = "get",
+        operation_id = "get_user_tokens"
+    )]
+    async fn get_user_tokens(
+        &self,
+        id: Path<u64>,
+        context: ClientContext,
+    ) -> ApiResult<Json<Vec<AccessTokenModel>>> {
+        let target_user_id = id.0;
+        let tokens = AccessTokenModel::get_user_api_tokens(target_user_id).await?;
+        if context.user.id == target_user_id {
+            return Ok(Json(tokens));
+        }
+        context
+            .require_permission(None, Permission::USER_MANAGE)
+            .await?;
+        Ok(Json(tokens))
+    }
+
+    #[oai(path = "/users/:id", method = "delete", operation_id = "remove_user")]
+    async fn remove_user(
+        &self,
+        /// The User ID to delete
+        id: Path<u64>,
+        context: ClientContext,
+    ) -> ApiResult<()> {
+        let id = id.0;
+        context
+            .require_permission(None, Permission::USER_MANAGE)
+            .await?;
+        Ok(UserModel::remove(id).await?)
+    }
+
+    #[oai(path = "/users", method = "post", operation_id = "create_user")]
+    async fn create_user(
+        &self,
+        payload: Json<UserCreateRequest>,
+        context: ClientContext,
+    ) -> ApiResult<Json<UserView>> {
+        context
+            .require_permission(None, Permission::USER_MANAGE)
+            .await?;
+        let user = UserModel::create(payload.0).await?;
+        let roles = UserRole::list_all().await?;
+        let role_lookup: BTreeMap<u64, UserRole> = roles.into_iter().map(|r| (r.id, r)).collect();
+        Ok(Json(user.to_view(&role_lookup)))
+    }
+
+    #[oai(path = "/users/:id", method = "post", operation_id = "update_user")]
+    async fn update_user(
+        &self,
+        id: Path<u64>,
+        payload: Json<UserUpdateRequest>,
+        context: ClientContext,
+    ) -> ApiResult<()> {
+        let target_id = id.0;
+        let current_user_id = context.user.id;
+        if current_user_id != target_id {
+            context
+                .require_permission(None, Permission::USER_MANAGE)
+                .await?;
+        }
+        let mut update_data = payload.0;
+        if current_user_id == target_id
+            && !context.has_permission(None, Permission::USER_MANAGE).await
+        {
+            update_data.global_roles = None;
+            update_data.account_access_map = None;
+            update_data.acl = None;
+        }
+        Ok(UserModel::update(target_id, update_data).await?)
+    }
+
+    #[oai(
+        path = "/current-user",
+        method = "get",
+        operation_id = "get_current_user"
+    )]
+    async fn get_current_user(&self, context: ClientContext) -> ApiResult<Json<UserView>> {
+        let roles = UserRole::list_all().await?;
+        let role_lookup: BTreeMap<u64, UserRole> = roles.into_iter().map(|r| (r.id, r)).collect();
+        Ok(Json(context.user.to_view(&role_lookup)))
+    }
+
+    #[oai(
+        path = "/minimal-user-list",
+        method = "get",
+        operation_id = "get_minimal_user_list"
+    )]
+    async fn get_minimal_user_list(
+        &self,
+        context: ClientContext,
+    ) -> ApiResult<Json<Vec<MinimalUser>>> {
+        let is_admin = context.user.is_admin().await;
+        let minimal_list = MinimalUser::list_all().await?;
+        if is_admin {
+            return Ok(Json(minimal_list));
+        }
+        context
+            .require_permission(None, Permission::USER_VIEW)
+            .await?;
+
+        Ok(Json(minimal_list))
+    }
+}
--- a/src/modules/rest/mod.rs
+++ b/src/modules/rest/mod.rs
@@ -16,7 +16,6 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use crate::modules::common::error::ErrorCapture;
 use crate::modules::common::log::Tracing;
 use crate::modules::common::tls::rustls_config;
@@ -33,13 +32,14 @@ use crate::modules::common::timeout::{Timeout, TIMEOUT_HEADER};
 use crate::raise_error;
 use api::create_openapi_service;
 use assets::FrontEndAssets;
-use http::HeaderValue;
+use http::{HeaderValue, Method};
 use poem::endpoint::EmbeddedFilesEndpoint;
 use poem::listener::{Listener, TcpListener};
 use poem::middleware::{CatchPanic, Compression, SetHeader};
 use poem::{endpoint::EmbeddedFileEndpoint, middleware::Cors, EndpointExt, Route, Server};
 use poem::{get, post};
 use public::oauth2::oauth2_callback;
+use std::collections::HashSet;
 use std::time::Duration;

 pub mod api;
@@ -62,7 +62,7 @@ pub async fn start_http_server() -> BichonResult<()> {
    };

    let api_service = create_openapi_service()
-        .summary("A self-hosted IMAP/SMTP middleware designed for developers");
+        .summary("A lightweight, high-performance Rust email archiver with WebUI");

    let swagger = api_service.swagger_ui();
    let redoc = api_service.redoc();
@@ -78,10 +78,34 @@ pub async fn start_http_server() -> BichonResult<()> {
        .with(Timeout)
        .with(Tracing);

-    let mut cors_origins = SETTINGS.bichon_cors_origins.clone();
-    if cors_origins.is_empty() {
-        cors_origins = ["*".to_string()].into_iter().collect();
-    }
+    let cors_origins: Option<HashSet<String>> = SETTINGS.bichon_cors_origins.clone();
+
+    let cors_origins: Vec<String> = cors_origins.unwrap_or_default().into_iter().collect();
+
+    let cors = Cors::new()
+        .allow_origins_fn(move |origin| {
+            tracing::debug!("CORS: Incoming Origin = {:?}", origin);
+            tracing::debug!("CORS: Configured origins = {:?}", cors_origins);
+            if cors_origins.is_empty() {
+                tracing::debug!("CORS: No origins configured, allowing all");
+                return true;
+            }
+            cors_origins.iter().any(|o| o == origin)
+        })
+        //.allow_origins(cors_origins)
+        .allow_credentials(true)
+        .allow_methods(&[
+            Method::GET,
+            Method::POST,
+            Method::PUT,
+            Method::DELETE,
+            Method::OPTIONS,
+            Method::HEAD,
+            Method::PATCH,
+        ])
+        .allow_headers(vec!["Content-Type", "Authorization", TIMEOUT_HEADER])
+        .expose_headers(vec!["Accept"])
+        .max_age(SETTINGS.bichon_cors_max_age);

    let cache_static = || {
        SetHeader::new().overriding(
@@ -90,14 +114,6 @@ pub async fn start_http_server() -> BichonResult<()> {
        )
    };

-    let cors = Cors::new()
-        .allow_origins(cors_origins)
-        .allow_credentials(true)
-        .allow_methods(vec!["GET", "POST", "PUT", "DELETE", "OPTIONS", "HEAD"])
-        .allow_headers(vec!["Content-Type", "Authorization", TIMEOUT_HEADER])
-        .expose_headers(vec!["Accept"])
-        .max_age(SETTINGS.bichon_cors_max_age);
-
    let route = Route::new()
        .nest("/api-docs/swagger", swagger)
        .nest("/api-docs/redoc", redoc)
--- a/src/modules/rest/public/login.rs
+++ b/src/modules/rest/public/login.rs
@@ -16,29 +16,41 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
-use crate::modules::token::root::check_root_password;
-use poem::{handler, IntoResponse, Response};
+use crate::modules::users::UserModel;
+use poem::{handler, web::Json, IntoResponse, Response};
+use serde::Deserialize;
 use tracing::error;

-/// Login endpoint for Root user
+#[derive(Deserialize)]
+pub struct LoginPayload {
+    pub username: String,
+    pub password: String,
+}
+
+/// Login endpoint
 ///
 /// Accepts a plain text password and returns the `root_token`
 /// on successful authentication.
 #[handler]
-pub async fn login(password: String) -> Response {
-    match check_root_password(&password) {
-        Ok(root_token) => Response::builder()
-            .status(http::StatusCode::OK)
-            .content_type("text/plain")
-            .body(root_token)
-            .into_response(),
+pub async fn login(payload: Json<LoginPayload>) -> Response {
+    let payload = payload.0;
+    match UserModel::authenticate_user(payload.username, payload.password).await {
+        Ok(result) => match serde_json::to_string(&result) {
+            Ok(json_string) => Response::builder()
+                .status(http::StatusCode::OK)
+                .content_type("application/json")
+                .body(json_string)
+                .into_response(),
+            Err(_) => Response::builder()
+                .status(http::StatusCode::INTERNAL_SERVER_ERROR)
+                .body("Internal server error during response serialization.")
+                .into_response(),
+        },
        Err(e) => {
-            error!("Root login failed: {:?}", e);
+            error!("Authentication failed with system error: {:?}", e);
            Response::builder()
-                .status(http::StatusCode::UNAUTHORIZED)
-                .content_type("text/plain")
-                .body(e.to_string())
+                .status(http::StatusCode::INTERNAL_SERVER_ERROR)
+                .body("Authentication system failed.".to_string())
                .into_response()
        }
    }
--- a/src/modules/settings/cli.rs
+++ b/src/modules/settings/cli.rs
@@ -16,11 +16,10 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use clap::{builder::ValueParser, Parser, ValueEnum};
 use std::{collections::HashSet, env, fmt, path::PathBuf, sync::LazyLock};

-pub static SETTINGS: LazyLock<Settings> = LazyLock::new(Settings::parse);
+pub static SETTINGS: LazyLock<Settings> = LazyLock::new(Settings::init);

 #[derive(Debug, Parser)]
 #[clap(
@@ -77,7 +76,6 @@ pub struct Settings {
    /// CORS allowed origins (default: "*")
    #[clap(
        long,
-        default_value = "http://localhost:5173, http://localhost:15630, *",
        env,
        help = "Set the allowed CORS origins (comma-separated list, e.g., \"https://example.com, https://another.com\")",
        value_parser = ValueParser::new(|s: &str| -> Result<HashSet<String>, String> {
@@ -88,7 +86,7 @@ pub struct Settings {
            Ok(set)
        })
    )]
-    pub bichon_cors_origins: HashSet<String>,
+    pub bichon_cors_origins: Option<HashSet<String>>,

    /// CORS max age in seconds (default: 86400)
    #[clap(
@@ -134,11 +132,27 @@ pub struct Settings {
    /// bichon encryption password
    #[clap(
        long,
-        default_value = "change-this-default-password-now",
        env,
-        help = "Set the encryption password for bichon. ⚠️ Change this default in production!"
+        default_value = "change-this-default-password-now",
+        help = "Set the encryption password for bichon. Alternatively, you can use --bichon-encrypt-password-file. If both are set, this parameter takes precedence over the file."
    )]
-    pub bichon_encrypt_password: String,
+    pub bichon_encrypt_password: Option<String>,
+
+    #[clap(
+        long,
+        env,
+        help = "The file containing the encryption password. An alternative to --bichon-encrypt-password."
+    )]
+    pub bichon_encrypt_password_file: Option<String>,
+
+    /// WebUI token expiration time in seconds (default: 7 days)
+    #[clap(
+        long,
+        default_value = "168",
+        env,
+        help = "Set the WebUI token expiration time in hours"
+    )]
+    pub bichon_webui_token_expiration_hours: u32,

    #[clap(
        long,
@@ -176,19 +190,6 @@ pub struct Settings {
    )]
    pub bichon_envelope_cache_size: Option<usize>,

-    /// Enables or disables the access token mechanism for HTTP endpoints.
-    ///
-    /// When set to `true`, HTTP requests will be subject to access token validation.
-    /// If the `Authorization` header is missing or the token is invalid, the service will return a 401 Unauthorized response.
-    /// When set to `false`, access token validation will be skipped.
-    #[clap(
-        long,
-        default_value = "false",
-        env,
-        help = "Enables or disables the access token mechanism for HTTP endpoints."
-    )]
-    pub bichon_enable_access_token: bool,
-
    /// Enables or disables HTTPS for REST API endpoints.
    ///
    /// When set to `true`, the REST API will use HTTPS with a valid SSL/TLS certificate for secure communication.
@@ -219,6 +220,18 @@ pub struct Settings {
    pub bichon_sync_concurrency: Option<u16>,
 }

+impl Settings {
+    pub fn init() -> Self {
+        let s = Self::parse();
+        if s.bichon_encrypt_password.is_none() && s.bichon_encrypt_password_file.is_none() {
+            panic!(
+                "One of --bichon_encrypt_password or --bichon_encrypt_password_file has to be set"
+            );
+        }
+        s
+    }
+}
+
 #[derive(Clone, Copy, Debug, PartialEq, ValueEnum)]
 pub enum CompressionAlgorithm {
    #[clap(name = "none")]
--- a/src/modules/settings/mod.rs
+++ b/src/modules/settings/mod.rs
@@ -16,8 +16,68 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

+use poem_openapi::Object;
+use serde::{Deserialize, Serialize};
+
+use crate::modules::settings::cli::Settings;

 pub mod cli;
 pub mod dir;
 pub mod proxy;
 pub mod system;
+
+#[derive(Clone, Debug, Default, Eq, PartialEq, Deserialize, Serialize, Object)]
+pub struct SystemConfigurations {
+    pub bichon_log_level: String,
+    pub bichon_http_port: i32,
+    pub bichon_bind_ip: Option<String>,
+    pub bichon_public_url: String,
+
+    pub bichon_cors_origins: Option<Vec<String>>,
+    pub bichon_cors_max_age: i32,
+
+    pub bichon_ansi_logs: bool,
+    pub bichon_log_to_file: bool,
+    pub bichon_json_logs: bool,
+    pub bichon_max_server_log_files: usize,
+
+    pub bichon_encrypt_password_set: bool,
+    pub bichon_webui_token_expiration_hours: u32,
+
+    pub bichon_root_dir: String,
+    pub bichon_metadata_cache_size: Option<usize>,
+    pub bichon_envelope_cache_size: Option<usize>,
+
+    pub bichon_enable_rest_https: bool,
+    pub bichon_http_compression_enabled: bool,
+    pub bichon_sync_concurrency: Option<u16>,
+}
+
+impl From<&Settings> for SystemConfigurations {
+    fn from(s: &Settings) -> Self {
+        Self {
+            bichon_log_level: s.bichon_log_level.clone(),
+            bichon_http_port: s.bichon_http_port,
+            bichon_bind_ip: s.bichon_bind_ip.clone(),
+            bichon_public_url: s.bichon_public_url.clone(),
+            bichon_cors_origins: s
+                .bichon_cors_origins
+                .as_ref()
+                .map(|set| set.iter().cloned().collect()),
+            bichon_cors_max_age: s.bichon_cors_max_age,
+            bichon_ansi_logs: s.bichon_ansi_logs,
+            bichon_log_to_file: s.bichon_log_to_file,
+            bichon_json_logs: s.bichon_json_logs,
+            bichon_max_server_log_files: s.bichon_max_server_log_files,
+            bichon_encrypt_password_set: s.bichon_encrypt_password.is_some()
+                || s.bichon_encrypt_password_file.is_some(),
+            bichon_webui_token_expiration_hours: s.bichon_webui_token_expiration_hours,
+            bichon_root_dir: s.bichon_root_dir.clone(),
+            bichon_metadata_cache_size: s.bichon_metadata_cache_size,
+            bichon_envelope_cache_size: s.bichon_envelope_cache_size,
+            bichon_enable_rest_https: s.bichon_enable_rest_https,
+            bichon_http_compression_enabled: s.bichon_http_compression_enabled,
+            bichon_sync_concurrency: s.bichon_sync_concurrency,
+        }
+    }
+}
--- a/src/modules/settings/proxy.rs
+++ b/src/modules/settings/proxy.rs
@@ -16,7 +16,6 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use native_db::*;
 use native_model::{native_model, Model};
 use poem_openapi::Object;
@@ -132,10 +131,7 @@ mod tests {

    #[test]
    fn test_valid_proxy_urls() {
-        let urls = vec![
-            "socks5://127.0.0.1:1080",
-            "http://127.0.0.1:8080",
-        ];
+        let urls = vec!["socks5://127.0.0.1:1080", "http://127.0.0.1:8080"];

        for url in urls {
            let proxy = Proxy::new(url.to_string());
--- a/src/modules/settings/system.rs
+++ b/src/modules/settings/system.rs
@@ -17,10 +17,10 @@
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.


-use crate::modules::database::manager::DB_MANAGER;
-use crate::modules::database::{find_impl, upsert_impl};
-use crate::modules::error::BichonResult;
-use crate::utc_now;
+// use crate::modules::database::manager::DB_MANAGER;
+// use crate::modules::database::{find_impl, upsert_impl};
+// use crate::modules::error::BichonResult;
+// use crate::utc_now;
 use native_db::*;
 use native_model::{native_model, Model};
 use serde::{Deserialize, Serialize};
@@ -37,34 +37,34 @@ pub struct SystemSetting {
 }

 impl SystemSetting {
-    pub fn new(key: String, value: String) -> Self {
-        Self {
-            key,
-            value,
-            created_at: utc_now!(),
-            updated_at: utc_now!(),
-        }
-    }
+    // pub fn new(key: String, value: String) -> Self {
+    //     Self {
+    //         key,
+    //         value,
+    //         created_at: utc_now!(),
+    //         updated_at: utc_now!(),
+    //     }
+    // }
    //overwrite
-    pub async fn set(&self) -> BichonResult<()> {
-        upsert_impl(DB_MANAGER.meta_db(), self.to_owned()).await
-    }
+    // pub async fn set(&self) -> BichonResult<()> {
+    //     upsert_impl(DB_MANAGER.meta_db(), self.to_owned()).await
+    // }

-    pub fn get(key: &str) -> BichonResult<Option<SystemSetting>> {
-        find_impl(DB_MANAGER.meta_db(), key)
-    }
+    // pub fn get(key: &str) -> BichonResult<Option<SystemSetting>> {
+    //     find_impl(DB_MANAGER.meta_db(), key)
+    // }

    // pub async fn list() -> RustMailerResult<Vec<SystemSetting>> {
    //     list_all_impl(DB_MANAGER.metadata_db()).await
    // }

-    pub fn get_existing_value(key: &str) -> BichonResult<Option<String>> {
-        let setting = Self::get(key)?;
-        Ok(setting.map(|s| s.value))
-    }
+    // pub fn get_existing_value(key: &str) -> BichonResult<Option<String>> {
+    //     let setting = Self::get(key)?;
+    //     Ok(setting.map(|s| s.value))
+    // }

-    pub async fn set_value(key: &str, value: String) -> BichonResult<()> {
-        let setting = Self::new(key.to_string(), value);
-        setting.set().await
-    }
+    // pub async fn set_value(key: &str, value: String) -> BichonResult<()> {
+    //     let setting = Self::new(key.to_string(), value);
+    //     setting.set().await
+    // }
 }
--- a/src/modules/token/mod.rs
+++ b/src/modules/token/mod.rs
@@ -16,12 +16,17 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

+use std::collections::HashMap;

-use crate::modules::account::migration::AccountModel;
-use crate::modules::database::delete_impl;
+use super::error::code::ErrorCode;
 use crate::modules::database::manager::DB_MANAGER;
+use crate::modules::database::{
+    async_find_impl, delete_impl, filter_by_secondary_key_impl, with_transaction,
+};
 use crate::modules::database::{insert_impl, list_all_impl, update_impl};
-use crate::modules::token::payload::AccessTokenUpdateRequest;
+use crate::modules::settings::cli::SETTINGS;
+use crate::modules::token::view::AccessTokenResp;
+use crate::modules::users::UserModel;
 use crate::raise_error;
 use crate::{
    generate_token, modules::error::BichonResult,
@@ -29,259 +34,227 @@ use crate::{
 };
 use native_db::*;
 use native_model::{native_model, Model};
-use poem_openapi::Object;
+use poem_openapi::{Enum, Object};
 use serde::{Deserialize, Serialize};
-use std::collections::BTreeSet;
-use std::net::IpAddr;
-
-use super::error::code::ErrorCode;

 pub mod payload;
 pub mod root;
+pub mod view;
+
+// Starting from version 0.2.0, this model is deprecated/no longer used
+// #[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize, Object)]
+// #[native_model(id = 1, version = 1)]
+// #[native_db]
+// pub struct AccessToken {
+//     /// The unique token string used for authentication
+//     #[primary_key]
+//     pub token: String,
+//     /// A set of account information associated with the token.
+//     pub accounts: BTreeSet<AccountInfo>,
+//     /// The timestamp (in milliseconds since epoch) when the token was created.
+//     pub created_at: i64,
+//     /// The timestamp (in milliseconds since epoch) when the token was last updated.
+//     pub updated_at: i64,
+//     /// An optional description of the token's purpose or usage.
+//     pub description: Option<String>,
+//     /// The timestamp (in milliseconds since epoch) when the token was last used.
+//     pub last_access_at: i64,
+//     /// Optional access control settings
+//     pub acl: Option<AccessControl>,
+// }
+
+#[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize, Enum)]
+pub enum TokenType {
+    WebUI,
+    Api,
+}

 #[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize, Object)]
-#[native_model(id = 1, version = 1)]
+#[native_model(id = 11, version = 1)]
 #[native_db]
-pub struct AccessToken {
+pub struct AccessTokenModel {
+    /// The ID of the user who owns this token
+    #[secondary_key]
+    pub user_id: u64,
    /// The unique token string used for authentication
    #[primary_key]
    pub token: String,
-    /// A set of account information associated with the token.
-    pub accounts: BTreeSet<AccountInfo>,
+    /// An optional name of the token.
+    pub name: Option<String>,
+    /// Token type: WebUI or API
+    pub token_type: TokenType,
    /// The timestamp (in milliseconds since epoch) when the token was created.
    pub created_at: i64,
    /// The timestamp (in milliseconds since epoch) when the token was last updated.
    pub updated_at: i64,
-    /// An optional description of the token's purpose or usage.
-    pub description: Option<String>,
+    /// The timestamp (in milliseconds since epoch) when the token expires.
+    /// None means the token does not expire (this applies only to API tokens).
+    pub expire_at: Option<i64>,
    /// The timestamp (in milliseconds since epoch) when the token was last used.
    pub last_access_at: i64,
-    /// Optional access control settings
-    pub acl: Option<AccessControl>,
 }

-#[derive(Clone, Debug, Hash, PartialEq, Eq, Deserialize, Serialize, Object)]
-pub struct AccountInfo {
-    /// The unique identifier for the account.
-    pub id: u64,
-    /// The email address associated with the account.
-    pub email: String,
-}
-
-impl Ord for AccountInfo {
-    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
-        self.id.cmp(&other.id)
-    }
-}
-
-impl PartialOrd for AccountInfo {
-    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
-        Some(self.cmp(other))
-    }
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize, Object)]
-pub struct AccessControl {
-    /// An optional set of valid IPv4 or IPv6 addresses allowed to use the access token.
-    pub ip_whitelist: Option<BTreeSet<String>>,
-    /// An optional rate limit configuration for the access token.
-    pub rate_limit: Option<RateLimit>,
-}
-
-impl AccessControl {
-    pub fn validate(&self) -> BichonResult<()> {
-        if let Some(ip_whitelist) = &self.ip_whitelist {
-            for ip in ip_whitelist {
-                if ip.parse::<IpAddr>().is_err() {
-                    return Err(raise_error!(
-                        format!("Invalid IP address: {}", ip),
-                        ErrorCode::InvalidParameter
-                    ));
-                }
-            }
-        }
-
-        // Validate rate limit
-        if let Some(rate_limit) = &self.rate_limit {
-            if rate_limit.interval < 1 {
-                return Err(raise_error!(
-                    "Rate limit interval must be at least 1 second".into(),
-                    ErrorCode::InvalidParameter
-                ));
-            }
-            if rate_limit.quota < 1 {
-                return Err(raise_error!(
-                    "Rate limit quota must be at least 1".into(),
-                    ErrorCode::InvalidParameter
-                ));
-            }
-        }
-
-        Ok(())
-    }
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize, Object)]
-pub struct RateLimit {
-    /// The time window in seconds for the rate limit.
-    pub interval: u64,
-    /// The maximum number of allowed requests within the time window.
-    pub quota: u32,
-}
-
-impl AccessToken {
-    pub fn new(
+impl AccessTokenModel {
+    pub fn new_api_token(
        token: String,
-        accounts: BTreeSet<AccountInfo>,
-        description: Option<String>,
-        acl: Option<AccessControl>,
+        user_id: u64,
+        name: Option<String>,
+        expire_at: Option<i64>,
    ) -> Self {
        Self {
            token,
-            accounts,
            created_at: utc_now!(),
            updated_at: utc_now!(),
-            description,
            last_access_at: Default::default(),
-            acl,
+            name,
+            user_id,
+            token_type: TokenType::Api,
+            expire_at,
        }
    }

-    pub async fn try_update_access_timestamp(token: &str) -> BichonResult<AccessToken> {
-        let token = token.to_string();
-        update_impl(
-            DB_MANAGER.meta_db(),
-            |rw| {
-                rw.get()
-                    .primary::<AccessToken>(token)
-                    .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
-                    .ok_or_else(|| {
-                        raise_error!("Token not exist.".into(), ErrorCode::ResourceNotFound)
-                    })
-            },
-            |current| {
-                let mut updated = current.clone();
-                updated.last_access_at = utc_now!();
-                Ok(updated)
-            },
-        )
-        .await
+    pub fn new_webui_token(user_id: u64) -> AccessTokenModel {
+        let now = utc_now!();
+        AccessTokenModel {
+            token: generate_token!(128),
+            created_at: now,
+            updated_at: now,
+            last_access_at: Default::default(),
+            name: None,
+            user_id,
+            token_type: TokenType::WebUI,
+            expire_at: None,
+        }
    }

-    pub async fn grant_account_access(token: &str, account: AccountInfo) -> BichonResult<()> {
-        let token = token.to_string();
-        update_impl(
+    pub async fn reset_webui_token(user_id: u64) -> BichonResult<String> {
+        let old_token = Self::get_user_webui_token(user_id).await?;
+        let new_token = Self::new_webui_token(user_id);
+        let new_token_str = new_token.token.clone();
+
+        match old_token {
+            Some(old) => {
+                with_transaction(DB_MANAGER.meta_db(), move |rw| {
+                    rw.remove(old)
+                        .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+
+                    rw.insert(new_token)
+                        .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+
+                    Ok(())
+                })
+                .await?;
+            }
+            None => {
+                insert_impl(DB_MANAGER.meta_db(), new_token).await?;
+            }
+        }
+
+        Ok(new_token_str)
+    }
+
+    pub async fn get_user_webui_token(user_id: u64) -> BichonResult<Option<AccessTokenModel>> {
+        let tokens = filter_by_secondary_key_impl::<AccessTokenModel>(
            DB_MANAGER.meta_db(),
-            move |rw| {
-                rw.get()
-                    .primary::<AccessToken>(token.clone())
-                    .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
-                    .ok_or_else(|| {
-                        raise_error!(
-                            format!(
-                            "The access token with token={} that you want to modify was not found.",
-                            token
-                        ),
-                            ErrorCode::ResourceNotFound
-                        )
-                    })
-            },
-            |current| {
-                let mut updated = current.clone();
-                updated.accounts.insert(account);
-                updated.updated_at = utc_now!();
-                Ok(updated)
-            },
+            AccessTokenModelKey::user_id,
+            user_id,
        )
        .await?;
-        Ok(())
+
+        Ok(tokens
+            .into_iter()
+            .find(|t| t.token_type == TokenType::WebUI))
    }

-    pub async fn update(token: &str, request: AccessTokenUpdateRequest) -> BichonResult<()> {
-        if request.should_skip_update() {
-            return Err(raise_error!(
-                "No changes detected in access scopes, description, or accounts. \
-                 Please modify at least one of these fields to perform an update."
-                    .into(),
-                ErrorCode::InvalidParameter
-            ));
-        }
-        request.validate().await?;
+    pub async fn get_user_api_tokens(user_id: u64) -> BichonResult<Vec<AccessTokenModel>> {
+        let tokens = filter_by_secondary_key_impl::<AccessTokenModel>(
+            DB_MANAGER.meta_db(),
+            AccessTokenModelKey::user_id,
+            user_id,
+        )
+        .await?;

-        let account_infos = if let Some(accounts) = &request.accounts {
-            let mut account_infos = BTreeSet::new();
-            for account_id in accounts {
-                let account = AccountModel::get(*account_id).await?;
-                account_infos.insert(AccountInfo {
-                    id: *account_id,
-                    email: account.email,
-                });
+        Ok(tokens
+            .into_iter()
+            .filter(|t| t.token_type == TokenType::Api)
+            .collect())
+    }
+
+    pub async fn resolve_user_from_token(token: &str) -> BichonResult<UserModel> {
+        let token = token.to_string();
+        let token_option = async_find_impl::<AccessTokenModel>(DB_MANAGER.meta_db(), token).await?;
+        let token = match token_option {
+            Some(token) => token,
+            None => {
+                return Err(raise_error!(
+                    "Permission denied: no valid access token provided.".into(),
+                    ErrorCode::PermissionDenied
+                ))
            }
-            account_infos
-        } else {
-            BTreeSet::new()
        };

-        let token = token.to_string();
-        update_impl(
-            DB_MANAGER.meta_db(),
-            move |rw| {
-                rw.get()
-                    .primary::<AccessToken>(token.clone())
-                    .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
-                    .ok_or_else(|| {
-                        raise_error!(
-                            format!(
-                            "The access token with token={} that you want to modify was not found.",
-                            token
-                        ),
-                            ErrorCode::ResourceNotFound
-                        )
-                    })
-            },
-            move |current| {
-                let mut updated = current.clone();
-                if let Some(description) = request.description {
-                    updated.description = Some(description);
-                }
+        if matches!(token.token_type, TokenType::WebUI) {
+            let life = utc_now!() - token.created_at;
+            let max_life = SETTINGS.bichon_webui_token_expiration_hours * 60 * 60 * 1000;

-                if request.accounts.is_some() {
-                    updated.accounts = account_infos;
-                }
-
-                if let Some(acl) = request.acl {
-                    updated.acl = Some(acl);
-                }
-
-                updated.updated_at = utc_now!();
-                Ok(updated)
-            },
-        )
-        .await?;
-        Ok(())
-    }
-
-    pub async fn create(request: AccessTokenCreateRequest) -> BichonResult<String> {
-        // Validate request parameters first
-        request.validate().await?;
-
-        let AccessTokenCreateRequest {
-            accounts,
-            description,
-            acl,
-        } = request;
-
-        let mut account_infos = BTreeSet::new();
-        for &account_id in &accounts {
-            let account = AccountModel::get(account_id).await?;
-            account_infos.insert(AccountInfo {
-                id: account_id,
-                email: account.email,
-            });
+            if life > (max_life as i64) {
+                return Err(raise_error!(
+                    "Permission denied: the WebUI token has expired.".into(),
+                    ErrorCode::PermissionDenied
+                ));
+            }
        }

+        if matches!(token.token_type, TokenType::Api) {
+            if let Some(expire_at) = token.expire_at {
+                if utc_now!() > expire_at {
+                    return Err(raise_error!(
+                        "Your API token has expired and is no longer valid.".into(),
+                        ErrorCode::PermissionDenied
+                    ));
+                }
+            }
+            let token = token.token.clone();
+            update_impl(
+                DB_MANAGER.meta_db(),
+                |rw| {
+                    rw.get()
+                        .primary::<AccessTokenModel>(token)
+                        .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
+                        .ok_or_else(|| {
+                            raise_error!(
+                                "The access token does not exist or has been reset.".into(),
+                                ErrorCode::ResourceNotFound
+                            )
+                        })
+                },
+                |current| {
+                    let mut updated = current.clone();
+                    updated.last_access_at = utc_now!();
+                    Ok(updated)
+                },
+            )
+            .await?;
+        }
+
+        let user = UserModel::find(token.user_id)
+            .await?
+            .ok_or_else(|| raise_error!("The user associated with this access token does not exist or may have been deleted.".into(), ErrorCode::ResourceNotFound))?;
+        Ok(user)
+    }
+
+    pub async fn create_api_token(
+        user_id: u64,
+        request: AccessTokenCreateRequest,
+    ) -> BichonResult<String> {
+        // Validate request parameters first
+        request.validate().await?;
+        let expire_at = request
+            .expire_in
+            .map(|hours| utc_now!() + (hours as i64) * 60 * 60 * 1000);
        let token = generate_token!(128);
-        let access_token = AccessToken::new(token.clone(), account_infos, description, acl);
+        let access_token =
+            AccessTokenModel::new_api_token(token.clone(), user_id, request.name, expire_at);
        insert_impl(DB_MANAGER.meta_db(), access_token).await?;
        Ok(token)
    }
@@ -290,7 +263,7 @@ impl AccessToken {
        let token = token.to_string();
        delete_impl(DB_MANAGER.meta_db(), move |rw| {
            rw.get()
-                .primary::<AccessToken>(token.clone())
+                .primary::<AccessTokenModel>(token.clone())
                .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
                .ok_or_else(|| {
                    raise_error!(
@@ -302,56 +275,47 @@ impl AccessToken {
        .await
    }

-    pub async fn list_all() -> BichonResult<Vec<AccessToken>> {
-        list_all_impl(DB_MANAGER.meta_db()).await
+    pub async fn get_token(token: &str) -> BichonResult<AccessTokenModel> {
+        async_find_impl(DB_MANAGER.meta_db(), token.to_string())
+            .await?
+            .ok_or_else(|| {
+                raise_error!(
+                    format!("Access token '{}' not found", token),
+                    ErrorCode::ResourceNotFound
+                )
+            })
    }

-    pub async fn list_account_tokens(account_id: u64) -> BichonResult<Vec<AccessToken>> {
-        let all = AccessToken::list_all().await?;
-        let result: Vec<AccessToken> = all
+    pub async fn list_all_api_tokens() -> BichonResult<Vec<AccessTokenResp>> {
+        let users = UserModel::list_all().await?;
+        let mut all = list_all_impl::<AccessTokenModel>(DB_MANAGER.meta_db()).await?;
+
+        all.retain(|t| t.token_type == TokenType::Api);
+        let user_map: HashMap<u64, UserModel> = users.into_iter().map(|u| (u.id, u)).collect();
+
+        let resp = all
            .into_iter()
-            .filter(|e| {
-                e.accounts
-                    .iter()
-                    .any(|account_info| account_info.id == account_id)
+            .map(|token| {
+                let user = user_map.get(&token.user_id);
+                AccessTokenResp {
+                    user_name: user
+                        .map(|u| u.username.clone())
+                        .unwrap_or_else(|| "Unknown".to_string()),
+                    user_email: user
+                        .map(|u| u.email.clone())
+                        .unwrap_or_else(|| "N/A".to_string()),
+                    user_id: token.user_id,
+                    name: token.name,
+                    token: token.token,
+                    token_type: token.token_type,
+                    created_at: token.created_at,
+                    updated_at: token.updated_at,
+                    expire_at: token.expire_at,
+                    last_access_at: token.last_access_at,
+                }
            })
            .collect();
-        Ok(result)
-    }

-    pub async fn cleanup_account(account_id: u64) -> BichonResult<()> {
-        let tokens = Self::list_account_tokens(account_id).await?;
-        if tokens.is_empty() {
-            return Ok(());
-        }
-
-        for token in tokens {
-            update_impl(
-                DB_MANAGER.meta_db(),
-                move |rw| {
-                    rw.get()
-                        .primary::<AccessToken>(token.token.clone())
-                        .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
-                        .ok_or_else(|| {
-                            raise_error!(
-                                format!("Cannot find access token, {}", token.token),
-                                ErrorCode::ResourceNotFound
-                            )
-                        })
-                },
-                move |current| {
-                    let mut updated = current.clone();
-                    updated.updated_at = utc_now!();
-                    updated.accounts.retain(|account| account.id != account_id);
-                    Ok(updated)
-                },
-            )
-            .await?;
-        }
-        Ok(())
-    }
-
-    pub fn can_access_account(&self, account_id: u64) -> bool {
-        self.accounts.iter().any(|account| account.id == account_id)
+        Ok(resp)
    }
 }
--- a/src/modules/token/payload.rs
+++ b/src/modules/token/payload.rs
@@ -16,15 +16,8 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
-use std::collections::BTreeSet;
-
 use crate::{
-    modules::{
-        account::migration::AccountModel,
-        error::{code::ErrorCode, BichonResult},
-        token::AccessControl,
-    },
+    modules::error::{code::ErrorCode, BichonResult},
    raise_error,
 };
 use poem_openapi::Object;
@@ -32,91 +25,28 @@ use serde::{Deserialize, Serialize};

 #[derive(Clone, Debug, Default, PartialEq, Deserialize, Serialize, Object)]
 pub struct AccessTokenCreateRequest {
-    /// A set of account information associated with the token.
-    pub accounts: BTreeSet<u64>,
    /// An optional description of the token's purpose or usage.
-    #[oai(validator(max_length = "255"))]
-    pub description: Option<String>,
-    /// Optional access control settings
-    pub acl: Option<AccessControl>,
+    #[oai(validator(max_length = "32"))]
+    pub name: Option<String>,
+    /// The expiration interval for this token, in hours.
+    /// None means the token does not expire (this applies only to API tokens).
+    pub expire_in: Option<u64>,
+    /// The ID of the user for whom the token is being created.
+    /// If not specified, the token will be created for the current authenticated user.
+    /// Accessing this for another user typically requires `USER_MANAGE` permissions.
+    pub user_id: Option<u64>,
 }

 impl AccessTokenCreateRequest {
    pub async fn validate(&self) -> BichonResult<()> {
-        if let Some(acl) = &self.acl {
-            acl.validate()?;
-        }
-
-        if self.accounts.is_empty() {
-            return Err(raise_error!(
-                "Account list cannot be empty. Please provide at least one valid account ID."
-                    .into(),
-                ErrorCode::InvalidParameter
-            ));
-        }
-
-        let mut not_found = Vec::new();
-        for account_id in &self.accounts {
-            if AccountModel::find(*account_id).await?.is_none() {
-                not_found.push(*account_id);
-            }
-        }
-        if !not_found.is_empty() {
-            return Err(raise_error!(
-                format!("The following account IDs were not found: {}. Please provide valid account IDs.", not_found.iter().map(u64::to_string).collect::<Vec<_>>().join(", ")).into(),
-                ErrorCode::InvalidParameter
-            ));
-        }
-
-        Ok(())
-    }
-}
-
-#[derive(Clone, Debug, PartialEq, Deserialize, Serialize, Object)]
-pub struct AccessTokenUpdateRequest {
-    /// A set of account information associated with the token.
-    pub accounts: Option<BTreeSet<u64>>,
-    /// An optional description of the token's purpose or usage.
-    #[oai(validator(max_length = "255"))]
-    pub description: Option<String>,
-    /// Optional access control settings
-    pub acl: Option<AccessControl>,
-}
-
-impl AccessTokenUpdateRequest {
-    pub async fn validate(&self) -> BichonResult<()> {
-        if let Some(acl) = &self.acl {
-            acl.validate()?;
-        }
-        if let Some(accounts) = &self.accounts {
-            if accounts.is_empty() {
+        if let Some(expire_in) = self.expire_in {
+            if expire_in == 0 {
                return Err(raise_error!(
-                    "Account list cannot be empty. Please provide at least one valid account ID."
-                        .into(),
+                    "expire_in must be a positive duration in hours; zero is not allowed.".into(),
                    ErrorCode::InvalidParameter
                ));
            }
-
-            let mut not_found = Vec::new();
-            for account_id in accounts {
-                if AccountModel::find(*account_id).await?.is_none() {
-                    not_found.push(*account_id);
-                }
-            }
-            if !not_found.is_empty() {
-                return Err(raise_error!(
-                format!("The following account IDs were not found: {}. Please provide valid account IDs.", not_found.iter().map(u64::to_string).collect::<Vec<_>>().join(", ")).into(),
-                ErrorCode::InvalidParameter
-            ));
-            }
        }
-
        Ok(())
    }
 }
-
-impl AccessTokenUpdateRequest {
-    pub fn should_skip_update(&self) -> bool {
-        self.description.is_none() && self.accounts.is_none() && self.acl.is_none()
-    }
-}
--- a/src/modules/token/root.rs
+++ b/src/modules/token/root.rs
@@ -16,110 +16,109 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

+// use crate::{
+//     decrypt, encrypt, generate_token,
+//     modules::{
+//         error::{code::ErrorCode, BichonResult},
+//         settings::{dir::DATA_DIR_MANAGER, system::SystemSetting},
+//     },
+//     raise_error,
+// };
+// use std::fs::File;
+// use std::io::Write;

-use crate::{
-    decrypt, encrypt, generate_token,
-    modules::{
-        error::{code::ErrorCode, BichonResult},
-        settings::{dir::DATA_DIR_MANAGER, system::SystemSetting},
-    },
-    raise_error,
-};
-use std::fs::File;
-use std::io::Write;
+// pub const ROOT_TOKEN: &str = "root-token";
+// pub const ROOT_PASSWORD: &str = "root-password";
+// pub const DEFAULT_ROOT_PASSWORD: &str = "root";
+// pub const ROOT_TOKEN_FILE: &str = "root";

-pub const ROOT_TOKEN: &str = "root-token";
-pub const ROOT_PASSWORD: &str = "root-password";
-pub const DEFAULT_ROOT_PASSWORD: &str = "root";
-pub const ROOT_TOKEN_FILE: &str = "root";
+// async fn get_or_generate(
+//     key: &str,
+//     generate: impl Fn() -> String,
+//     save_file_name: Option<&str>,
+//     force: bool,
+// ) -> BichonResult<String> {
+//     if let Some(existing_value) = SystemSetting::get_existing_value(key)? {
+//         if force {
+//             // If force is true, write the existing value to the file
+//             if let Some(filename) = save_file_name {
+//                 save_to_file(&existing_value.to_string(), filename).await?;
+//             }
+//         }
+//         Ok(existing_value)
+//     } else {
+//         // If no value exists, generate a new value
+//         let new_value = generate();
+//         SystemSetting::set_value(key, new_value.clone()).await?;

-async fn get_or_generate(
-    key: &str,
-    generate: impl Fn() -> String,
-    save_file_name: Option<&str>,
-    force: bool,
-) -> BichonResult<String> {
-    if let Some(existing_value) = SystemSetting::get_existing_value(key)? {
-        if force {
-            // If force is true, write the existing value to the file
-            if let Some(filename) = save_file_name {
-                save_to_file(&existing_value.to_string(), filename).await?;
-            }
-        }
-        Ok(existing_value)
-    } else {
-        // If no value exists, generate a new value
-        let new_value = generate();
-        SystemSetting::set_value(key, new_value.clone()).await?;
+//         // Write the new value to the file, if specified
+//         if let Some(filename) = save_file_name {
+//             save_to_file(&new_value.to_string(), filename).await?;
+//         }
+//         Ok(new_value)
+//     }
+// }

-        // Write the new value to the file, if specified
-        if let Some(filename) = save_file_name {
-            save_to_file(&new_value.to_string(), filename).await?;
-        }
-        Ok(new_value)
-    }
-}
+// pub async fn ensure_root_token() -> BichonResult<()> {
+//     get_or_generate(
+//         ROOT_TOKEN,
+//         || generate_token!(128),
+//         Some(ROOT_TOKEN_FILE),
+//         true,
+//     )
+//     .await?;
+//     Ok(())
+// }

-pub async fn ensure_root_token() -> BichonResult<()> {
-    get_or_generate(
-        ROOT_TOKEN,
-        || generate_token!(128),
-        Some(ROOT_TOKEN_FILE),
-        true,
-    )
-    .await?;
-    Ok(())
-}
+// pub async fn reset_root_token() -> BichonResult<String> {
+//     let new_token = generate_token!(128);
+//     save_new_token(&new_token).await?;
+//     save_to_file(&new_token, ROOT_TOKEN_FILE).await?;
+//     Ok(new_token)
+// }

-pub async fn reset_root_token() -> BichonResult<String> {
-    let new_token = generate_token!(128);
-    save_new_token(&new_token).await?;
-    save_to_file(&new_token, ROOT_TOKEN_FILE).await?;
-    Ok(new_token)
-}
+// async fn save_new_token(token: &str) -> BichonResult<()> {
+//     let setting = SystemSetting::new(ROOT_TOKEN.to_string(), token.to_string());
+//     setting.set().await
+// }

-async fn save_new_token(token: &str) -> BichonResult<()> {
-    let setting = SystemSetting::new(ROOT_TOKEN.to_string(), token.to_string());
-    setting.set().await
-}
+// async fn save_to_file(content: &str, filename: &str) -> BichonResult<()> {
+//     let file_path = DATA_DIR_MANAGER.root_dir.join(filename);
+//     let mut file = File::create(&file_path)
+//         .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+//     writeln!(file, "{}", content)
+//         .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+//     Ok(())
+// }

-async fn save_to_file(content: &str, filename: &str) -> BichonResult<()> {
-    let file_path = DATA_DIR_MANAGER.root_dir.join(filename);
-    let mut file = File::create(&file_path)
-        .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
-    writeln!(file, "{}", content)
-        .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
-    Ok(())
-}
+// pub fn check_root_password(password: &str) -> BichonResult<String> {
+//     let stored_encrypted_password = SystemSetting::get_existing_value(ROOT_PASSWORD)?;
+//     let matched = match stored_encrypted_password {
+//         Some(ref stored) => {
+//             let decrypted = decrypt!(stored)?;
+//             decrypted == password
+//         }
+//         None => DEFAULT_ROOT_PASSWORD == password,
+//     };

-pub fn check_root_password(password: &str) -> BichonResult<String> {
-    let stored_encrypted_password = SystemSetting::get_existing_value(ROOT_PASSWORD)?;
-    let matched = match stored_encrypted_password {
-        Some(ref stored) => {
-            let decrypted = decrypt!(stored)?;
-            decrypted == password
-        }
-        None => DEFAULT_ROOT_PASSWORD == password,
-    };
+//     if !matched {
+//         return Err(raise_error!(
+//             "Invalid password".into(),
+//             ErrorCode::PermissionDenied
+//         ));
+//     }

-    if !matched {
-        return Err(raise_error!(
-            "Invalid password".into(),
-            ErrorCode::PermissionDenied
-        ));
-    }
+//     let root_token = SystemSetting::get_existing_value(ROOT_TOKEN)?.ok_or_else(|| {
+//         raise_error!(
+//             "Root token not found — this should never happen".into(),
+//             ErrorCode::InternalError
+//         )
+//     })?;

-    let root_token = SystemSetting::get_existing_value(ROOT_TOKEN)?.ok_or_else(|| {
-        raise_error!(
-            "Root token not found — this should never happen".into(),
-            ErrorCode::InternalError
-        )
-    })?;
+//     Ok(root_token)
+// }

-    Ok(root_token)
-}
-
-pub async fn set_root_password(new_password: &str) -> BichonResult<()> {
-    let encrypted_password = encrypt!(new_password)?;
-    SystemSetting::set_value(ROOT_PASSWORD, encrypted_password).await
-}
+// pub async fn set_root_password(new_password: &str) -> BichonResult<()> {
+//     let encrypted_password = encrypt!(new_password)?;
+//     SystemSetting::set_value(ROOT_PASSWORD, encrypted_password).await
+// }
--- a/src/modules/token/view.rs
+++ b/src/modules/token/view.rs
@@ -0,0 +1,44 @@
+//
+// Copyright (c) 2025 rustmailer.com (https://rustmailer.com)
+//
+// This file is part of the Bichon Email Archiving Project
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+
+use crate::modules::token::TokenType;
+use poem_openapi::Object;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize, Object)]
+pub struct AccessTokenResp {
+    pub user_id: u64,
+    pub token: String,
+    /// An optional name of the token.
+    pub name: Option<String>,
+    /// Token type: WebUI or API
+    pub token_type: TokenType,
+    /// The timestamp (in milliseconds since epoch) when the token was created.
+    pub created_at: i64,
+    /// The timestamp (in milliseconds since epoch) when the token was last updated.
+    pub updated_at: i64,
+    /// The timestamp (in milliseconds since epoch) when the token expires.
+    /// None means the token does not expire (this applies only to API tokens).
+    pub expire_at: Option<i64>,
+    /// The timestamp (in milliseconds since epoch) when the token was last used.
+    pub last_access_at: i64,
+    
+    pub user_name: String,
+    pub user_email: String,
+}
--- a/src/modules/users/acl.rs
+++ b/src/modules/users/acl.rs
@@ -0,0 +1,73 @@
+//
+// Copyright (c) 2025 rustmailer.com (https://rustmailer.com)
+//
+// This file is part of the Bichon Email Archiving Project
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+use std::{collections::BTreeSet, net::IpAddr};
+
+use poem_openapi::Object;
+use serde::{Deserialize, Serialize};
+
+use crate::{modules::error::{BichonResult, code::ErrorCode}, raise_error};
+
+#[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize, Object)]
+pub struct RateLimit {
+    /// The time window in seconds for the rate limit.
+    pub interval: u64,
+    /// The maximum number of allowed requests within the time window.
+    pub quota: u32,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize, Object)]
+pub struct AccessControl {
+    /// An optional set of valid IPv4 or IPv6 addresses allowed to use the access token.
+    pub ip_whitelist: Option<BTreeSet<String>>,
+    /// An optional rate limit configuration for the access token.
+    pub rate_limit: Option<RateLimit>,
+}
+
+impl AccessControl {
+    pub fn validate(&self) -> BichonResult<()> {
+        if let Some(ip_whitelist) = &self.ip_whitelist {
+            for ip in ip_whitelist {
+                if ip.parse::<IpAddr>().is_err() {
+                    return Err(raise_error!(
+                        format!("Invalid IP address: {}", ip),
+                        ErrorCode::InvalidParameter
+                    ));
+                }
+            }
+        }
+
+        // Validate rate limit
+        if let Some(rate_limit) = &self.rate_limit {
+            if rate_limit.interval < 1 {
+                return Err(raise_error!(
+                    "Rate limit interval must be at least 1 second".into(),
+                    ErrorCode::InvalidParameter
+                ));
+            }
+            if rate_limit.quota < 1 {
+                return Err(raise_error!(
+                    "Rate limit quota must be at least 1".into(),
+                    ErrorCode::InvalidParameter
+                ));
+            }
+        }
+
+        Ok(())
+    }
+}
--- a/web/src/features/access-tokens/data/schema.ts
+++ b/web/src/features/access-tokens/data/schema.ts
@@ -16,30 +16,17 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

+use crate::modules::{
+    context::Initialize,
+    error::BichonResult,
+    users::{role::UserRole, UserModel},
+};

-interface AccountInfo {
-  id: number;
-  email: string;
+pub struct UserManager;
+
+impl Initialize for UserManager {
+    async fn initialize() -> BichonResult<()> {
+        UserRole::ensure_default_roles_exists().await?;
+        UserModel::ensure_default_admin_exists().await
+    }
 }
-
-interface RateLimit {
-  quota: number;
-  interval: number;
-}
-
-interface AccessControl {
-  ip_whitelist?: string[];
-  rate_limit?: RateLimit;
-}
-
-interface AccessToken {
-  token: string;
-  accounts: AccountInfo[];
-  created_at: number;
-  updated_at: number;
-  description?: string;
-  last_access_at: number;
-  acl?: AccessControl;
-}
-
-export type { AccessToken, AccountInfo, AccessControl, RateLimit };
--- a/src/modules/users/minimal.rs
+++ b/src/modules/users/minimal.rs
@@ -0,0 +1,49 @@
+//
+// Copyright (c) 2025 rustmailer.com (https://rustmailer.com)
+//
+// This file is part of the Bichon Email Archiving Project
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+use poem_openapi::Object;
+use serde::{Deserialize, Serialize};
+
+use crate::modules::{
+    database::{list_all_impl, manager::DB_MANAGER},
+    error::BichonResult,
+    users::UserModel,
+};
+
+#[derive(Clone, Debug, Default, Eq, PartialEq, Serialize, Deserialize, Object)]
+pub struct MinimalUser {
+    pub id: u64,
+    pub username: String,
+    pub email: String,
+}
+
+impl MinimalUser {
+    pub async fn list_all() -> BichonResult<Vec<MinimalUser>> {
+        let all_users = list_all_impl::<UserModel>(DB_MANAGER.meta_db()).await?;
+        let minimal_list = all_users
+            .into_iter()
+            .map(|user| MinimalUser {
+                id: user.id,
+                username: user.username,
+                email: user.email,
+            })
+            .collect();
+
+        Ok(minimal_list)
+    }
+}
--- a/src/modules/users/mod.rs
+++ b/src/modules/users/mod.rs
@@ -0,0 +1,706 @@
+//
+// Copyright (c) 2025 rustmailer.com (https://rustmailer.com)
+//
+// This file is part of the Bichon Email Archiving Project
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+use crate::{
+    decrypt, encrypt, generate_token, id,
+    modules::{
+        database::{
+            async_find_impl, batch_delete_impl, delete_impl, list_all_impl, manager::DB_MANAGER,
+            secondary_find_impl, update_impl, with_transaction,
+        },
+        error::{code::ErrorCode, BichonResult},
+        token::{AccessTokenModel, AccessTokenModelKey, TokenType},
+        users::{
+            acl::AccessControl,
+            payload::{UserCreateRequest, UserUpdateRequest},
+            permissions::Permission,
+            role::{UserRole, DEFAULT_ADMIN_ROLE_ID},
+            view::UserView,
+        },
+    },
+    raise_error, utc_now,
+};
+use itertools::Itertools;
+use native_db::*;
+use native_model::{native_model, Model};
+use poem_openapi::Object;
+use serde::{Deserialize, Serialize};
+use std::collections::{BTreeMap, BTreeSet, HashSet};
+use tracing::warn;
+
+pub mod acl;
+pub mod manager;
+pub mod minimal;
+pub mod payload;
+pub mod permissions;
+pub mod role;
+pub mod view;
+
+pub type UserModel = BichonUserV2;
+
+#[derive(Clone, Debug, Default, Eq, PartialEq, Serialize, Deserialize, Object)]
+pub struct LoginResult {
+    pub success: bool,
+    pub error_message: Option<String>,
+    pub access_token: Option<String>,
+    pub theme: Option<String>,
+    pub language: Option<String>,
+}
+
+pub const DEFAULT_ADMIN_USER_ID: u64 = 100000000000000;
+
+#[derive(Clone, Debug, Default, Eq, PartialEq, Serialize, Deserialize, Object)]
+#[native_model(id = 10, version = 1)]
+#[native_db]
+pub struct BichonUser {
+    #[primary_key]
+    pub id: u64,
+    #[secondary_key(unique)]
+    pub username: String,
+    #[secondary_key(unique)]
+    pub email: String,
+
+    pub password: Option<String>,
+
+    /// Scoped Access: Defines per-account permissions.
+    /// Example:
+    /// { account_id: 1, role_id: role_manager_id } -> Manager on Account 1
+    /// { account_id: 2, role_id: role_viewer_id }  -> Viewer on Account 2
+    pub account_access_map: BTreeMap<u64, u64>,
+
+    pub description: Option<String>,
+
+    /// System Roles: Permissions that apply to the whole system
+    /// (e.g., system settings, creating new users).
+    pub global_roles: Vec<u64>,
+
+    pub avatar: Option<String>,
+    pub created_at: i64,
+    pub updated_at: i64,
+    /// Optional access control settings
+    pub acl: Option<AccessControl>,
+}
+
+#[derive(Clone, Debug, Default, Eq, PartialEq, Serialize, Deserialize, Object)]
+#[native_model(id = 10, version = 2, from = BichonUser)]
+#[native_db]
+pub struct BichonUserV2 {
+    #[primary_key]
+    pub id: u64,
+    #[secondary_key(unique)]
+    pub username: String,
+    #[secondary_key(unique)]
+    pub email: String,
+
+    pub password: Option<String>,
+
+    /// Scoped Access: Defines per-account permissions.
+    /// Example:
+    /// { account_id: 1, role_id: role_manager_id } -> Manager on Account 1
+    /// { account_id: 2, role_id: role_viewer_id }  -> Viewer on Account 2
+    pub account_access_map: BTreeMap<u64, u64>,
+
+    pub description: Option<String>,
+
+    /// System Roles: Permissions that apply to the whole system
+    /// (e.g., system settings, creating new users).
+    pub global_roles: Vec<u64>,
+
+    pub avatar: Option<String>,
+    pub created_at: i64,
+    pub updated_at: i64,
+    /// Optional access control settings
+    pub acl: Option<AccessControl>,
+
+    pub theme: Option<String>,
+    pub language: Option<String>,
+}
+
+impl BichonUserV2 {
+    pub async fn list_all() -> BichonResult<Vec<UserModel>> {
+        Ok(list_all_impl::<UserModel>(DB_MANAGER.meta_db()).await?)
+    }
+
+    async fn get_all_permissions(&self) -> HashSet<String> {
+        let mut all_perms = HashSet::new();
+
+        for &role_id in &self.global_roles {
+            if let Ok(Some(role)) = UserRole::find(role_id).await {
+                for perm in role.permissions {
+                    all_perms.insert(perm);
+                }
+            }
+        }
+
+        all_perms
+    }
+
+    pub fn to_view(self, role_lookup: &BTreeMap<u64, UserRole>) -> UserView {
+        let global_roles_names = self
+            .global_roles
+            .iter()
+            .filter_map(|role_id| role_lookup.get(role_id))
+            .map(|role| role.name.clone())
+            .collect();
+
+        let account_roles_summary = self
+            .account_access_map
+            .iter()
+            .map(|(acc_id, role_id)| {
+                let role_name = role_lookup
+                    .get(role_id)
+                    .map(|r| r.name.clone())
+                    .unwrap_or_else(|| "Unknown Role".to_string());
+                (*acc_id, role_name)
+            })
+            .collect();
+
+        let global_permissions = {
+            let mut perms = BTreeSet::new();
+
+            for role_id in &self.global_roles {
+                if let Some(role) = role_lookup.get(role_id) {
+                    perms.extend(role.permissions.iter().cloned());
+                }
+            }
+
+            perms.into_iter().collect()
+        };
+
+        let account_permissions = {
+            let mut map: BTreeMap<u64, BTreeSet<String>> = BTreeMap::new();
+
+            for (account_id, role_id) in &self.account_access_map {
+                if let Some(role) = role_lookup.get(role_id) {
+                    let entry = map.entry(*account_id).or_default();
+                    entry.extend(role.permissions.iter().cloned());
+                }
+            }
+
+            map.into_iter()
+                .map(|(acc_id, perms)| (acc_id, perms.into_iter().collect()))
+                .collect()
+        };
+        UserView {
+            id: self.id,
+            username: self.username,
+            email: self.email,
+            password: self.password.map(|_| "************".to_string()),
+            account_access_map: self.account_access_map,
+            account_roles_summary,
+            description: self.description,
+            global_roles: self.global_roles,
+            global_roles_names,
+            avatar: self.avatar,
+            created_at: self.created_at,
+            updated_at: self.updated_at,
+            acl: self.acl,
+            account_permissions,
+            global_permissions,
+            theme: self.theme,
+            language: self.language,
+        }
+    }
+
+    pub async fn is_admin(&self) -> bool {
+        self.get_all_permissions().await.contains(Permission::ROOT)
+    }
+
+    pub async fn ensure_default_admin_exists() -> BichonResult<()> {
+        with_transaction(DB_MANAGER.meta_db(), move |rw| {
+            let now = utc_now!();
+
+            // 1. Try to get the existing admin user
+            let admin = rw
+                .get()
+                .primary::<UserModel>(DEFAULT_ADMIN_USER_ID)
+                .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+
+            if admin.is_none() {
+                // 2. Insert the BichonUser with the updated schema
+                rw.insert(UserModel {
+                    id: DEFAULT_ADMIN_USER_ID,
+                    username: "admin".into(),
+                    email: "placeholder@example.com".into(),
+                    password: Some(encrypt!("admin@bichon")?),
+
+                    // Use global_roles as defined in our new schema
+                    global_roles: vec![DEFAULT_ADMIN_ROLE_ID],
+
+                    // Admin usually doesn't need specific scoped access
+                    account_access_map: BTreeMap::new(),
+
+                    avatar: None,
+                    created_at: now,
+                    updated_at: now,
+                    description: Some("System default administrator".into()),
+                    acl: None,
+                    theme: None,
+                    language: None,
+                })
+                .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+
+                // 3. Generate and insert an initial access token for the first-time setup
+                let access_token = AccessTokenModel {
+                    token: generate_token!(128),
+                    created_at: now,
+                    updated_at: now,
+                    last_access_at: Default::default(),
+                    name: Some("Initial Setup Token".into()),
+                    user_id: DEFAULT_ADMIN_USER_ID,
+                    token_type: TokenType::WebUI,
+                    expire_at: None, // Admin setup token usually persistent until changed
+                };
+
+                rw.upsert(access_token)
+                    .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+            }
+
+            Ok(())
+        })
+        .await?;
+
+        Ok(())
+    }
+
+    pub async fn authenticate_user(
+        username: String,
+        password: String,
+    ) -> BichonResult<LoginResult> {
+        let user_option = secondary_find_impl::<UserModel>(
+            DB_MANAGER.meta_db(),
+            BichonUserV2Key::username,
+            username.clone(),
+        )
+        .await?;
+
+        let user = match user_option {
+            Some(u) => u,
+            None => {
+                match secondary_find_impl::<UserModel>(
+                    DB_MANAGER.meta_db(),
+                    BichonUserV2Key::email,
+                    username,
+                )
+                .await?
+                {
+                    Some(u) => u,
+                    None => {
+                        return Ok(LoginResult {
+                            success: false,
+                            error_message: Some("User or email not found.".to_string()),
+                            access_token: None,
+                            theme: None,
+                            language: None,
+                        });
+                    }
+                }
+            }
+        };
+
+        match user.password.as_ref() {
+            Some(encrypted_password) => {
+                let decrypted = decrypt!(encrypted_password)?;
+                if password == decrypted {
+                    let new_token = AccessTokenModel::reset_webui_token(user.id).await?;
+                    Ok(LoginResult {
+                        success: true,
+                        error_message: None,
+                        access_token: Some(new_token),
+                        theme: user.theme,
+                        language: user.language,
+                    })
+                } else {
+                    warn!(
+                        "Login failed: Incorrect password for user '{}'.",
+                        user.username
+                    );
+                    Ok(LoginResult {
+                        success: false,
+                        error_message: Some("Incorrect password.".to_string()),
+                        access_token: None,
+                        theme: None,
+                        language: None,
+                    })
+                }
+            }
+            None => {
+                warn!(
+                    "Login failed: User '{}' has no password set.",
+                    user.username
+                );
+                Ok(LoginResult {
+                    success: false,
+                    error_message: Some(
+                        format!(
+                            "User '{}' has no password set. Please try logging in with an alternative method (e.g., OAuth/SSO).", 
+                            user.username
+                        )
+                    ),
+                    access_token: None,
+                    theme: None,
+                    language: None,
+                })
+            }
+        }
+    }
+
+    pub async fn find(user_id: u64) -> BichonResult<Option<UserModel>> {
+        async_find_impl(DB_MANAGER.meta_db(), user_id).await
+    }
+
+    pub async fn check_username_conflict(username: &str) -> BichonResult<()> {
+        // Check username duplicate
+        if secondary_find_impl::<UserModel>(
+            DB_MANAGER.meta_db(),
+            BichonUserV2Key::username,
+            username.to_string(),
+        )
+        .await?
+        .is_some()
+        {
+            return Err(raise_error!(
+                format!("Username '{}' is already taken.", username).into(),
+                ErrorCode::AlreadyExists
+            ));
+        }
+
+        Ok(())
+    }
+
+    pub async fn check_email_conflict(email: &str) -> BichonResult<()> {
+        // Check email duplicate
+        if secondary_find_impl::<UserModel>(
+            DB_MANAGER.meta_db(),
+            BichonUserV2Key::email,
+            email.to_string(),
+        )
+        .await?
+        .is_some()
+        {
+            return Err(raise_error!(
+                format!("Email '{}' is already registered.", email).into(),
+                ErrorCode::AlreadyExists
+            ));
+        }
+
+        Ok(())
+    }
+
+    pub async fn create(request: UserCreateRequest) -> BichonResult<UserModel> {
+        request.validate().await?;
+        Self::check_username_conflict(&request.username).await?;
+        Self::check_email_conflict(&request.email).await?;
+
+        let password_hash = Some(encrypt!(&request.password)?);
+        let now = utc_now!();
+
+        let user = UserModel {
+            id: id!(96),
+            username: request.username,
+            email: request.email,
+            password: password_hash,
+            global_roles: request.global_roles,
+            avatar: request.avatar_base64,
+            description: request.description,
+            acl: request.acl,
+            created_at: now,
+            updated_at: now,
+            account_access_map: request.account_access_map,
+            theme: request.theme,
+            language: request.language,
+        };
+
+        let user_clone = user.clone();
+
+        // 4. Atomic transaction for User and Initial Token
+        with_transaction(DB_MANAGER.meta_db(), move |rw| {
+            let user_id = user.id;
+
+            // Insert User
+            rw.insert(user)
+                .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+
+            // Create initial WebUI access token
+            let access_token = AccessTokenModel {
+                token: generate_token!(128),
+                created_at: now,
+                updated_at: now,
+                last_access_at: Default::default(),
+                name: Some("Default WebUI Token".into()),
+                user_id,
+                token_type: TokenType::WebUI,
+                expire_at: None,
+            };
+
+            rw.insert(access_token)
+                .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+
+            Ok(())
+        })
+        .await?;
+
+        Ok(user_clone)
+    }
+
+    //delete user，
+    pub async fn remove(id: u64) -> BichonResult<()> {
+        if DEFAULT_ADMIN_USER_ID == id {
+            return Err(raise_error!(
+                format!("The default admin user (id={}) cannot be removed", id),
+                ErrorCode::PermissionDenied
+            ));
+        }
+
+        delete_impl(DB_MANAGER.meta_db(), move |rw| {
+            rw.get()
+                .primary::<UserModel>(id)
+                .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
+                .ok_or_else(|| {
+                    raise_error!(
+                        format!("The User with id={id} that you want to delete was not found."),
+                        ErrorCode::ResourceNotFound
+                    )
+                })
+        })
+        .await?;
+
+        batch_delete_impl(DB_MANAGER.meta_db(), move |rw| {
+            let tokens: Vec<AccessTokenModel> = rw
+                .scan()
+                .secondary::<AccessTokenModel>(AccessTokenModelKey::user_id)
+                .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
+                .start_with(id)
+                .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
+                .try_collect()
+                .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+            Ok(tokens)
+        })
+        .await?;
+        Ok(())
+    }
+
+    pub async fn update(id: u64, request: UserUpdateRequest) -> BichonResult<()> {
+        let _ = &request.validate().await?;
+        let password_changed = request.password.is_some();
+        //
+        let is_default_admin = id == DEFAULT_ADMIN_USER_ID;
+
+        if is_default_admin {
+            if let Some(roles) = request.global_roles.as_deref() {
+                let is_valid = matches!(
+                    roles,
+                    [role] if *role == DEFAULT_ADMIN_ROLE_ID
+                );
+
+                if !is_valid {
+                    return Err(raise_error!(
+                        format!(
+                            "The role assignments for default admin (id={}) are immutable to ensure system accessibility.",
+                            id
+                        ),
+                        ErrorCode::Forbidden
+                    ));
+                }
+            }
+        }
+
+        if let Some(username) = &request.username {
+            let user_option = secondary_find_impl::<UserModel>(
+                DB_MANAGER.meta_db(),
+                BichonUserV2Key::username,
+                username.to_string(),
+            )
+            .await?;
+
+            if let Some(u) = user_option {
+                if u.id != id {
+                    return Err(raise_error!(
+                        format!("Username '{}' is already taken.", username).into(),
+                        ErrorCode::AlreadyExists
+                    ));
+                }
+            }
+        }
+
+        if let Some(email) = &request.email {
+            let user_option = secondary_find_impl::<UserModel>(
+                DB_MANAGER.meta_db(),
+                BichonUserV2Key::email,
+                email.to_string(),
+            )
+            .await?;
+
+            if let Some(u) = user_option {
+                if u.id != id {
+                    return Err(raise_error!(
+                        format!("Email '{}' is already registered.", email).into(),
+                        ErrorCode::AlreadyExists
+                    ));
+                }
+            }
+        }
+
+        update_impl(
+            DB_MANAGER.meta_db(),
+            move |rw| {
+                rw.get()
+                    .primary::<UserModel>(id)
+                    .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
+                    .ok_or_else(|| {
+                        raise_error!(
+                            format!("User with id={} not found", id),
+                            ErrorCode::ResourceNotFound
+                        )
+                    })
+            },
+            move |current| {
+                let mut updated = current.clone();
+                if let Some(username) = request.username {
+                    updated.username = username;
+                }
+                if let Some(email) = request.email {
+                    updated.email = email;
+                }
+                if let Some(desc) = request.description {
+                    updated.description = Some(desc);
+                }
+                if let Some(password) = request.password {
+                    updated.password = Some(encrypt!(&password)?);
+                }
+
+                if let Some(global_roles) = request.global_roles {
+                    updated.global_roles = global_roles;
+                }
+
+                if let Some(acl) = request.acl {
+                    updated.acl = Some(acl);
+                }
+
+                if let Some(account_access_map) = request.account_access_map {
+                    updated.account_access_map = account_access_map;
+                }
+
+                if let Some(avatar_base64) = request.avatar_base64 {
+                    updated.avatar = Some(avatar_base64);
+                }
+
+                if let Some(theme) = request.theme {
+                    updated.theme = Some(theme);
+                }
+
+                if let Some(language) = request.language {
+                    updated.language = Some(language);
+                }
+
+                updated.updated_at = utc_now!();
+
+                Ok(updated)
+            },
+        )
+        .await?;
+
+        if password_changed {
+            AccessTokenModel::reset_webui_token(id).await?;
+        }
+
+        Ok(())
+    }
+
+    async fn list_authorized_users(account_id: u64) -> BichonResult<Vec<UserModel>> {
+        let all = Self::list_all().await?;
+        let result: Vec<UserModel> = all
+            .into_iter()
+            .filter(|e| e.account_access_map.contains_key(&account_id))
+            .collect();
+        Ok(result)
+    }
+
+    pub async fn cleanup_account(account_id: u64) -> BichonResult<()> {
+        let users = Self::list_authorized_users(account_id).await?;
+        if users.is_empty() {
+            return Ok(());
+        }
+
+        with_transaction(DB_MANAGER.meta_db(), move |rw| {
+            let now = utc_now!();
+            for user in users {
+                let current = rw
+                    .get()
+                    .primary::<UserModel>(user.id)
+                    .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
+                    .ok_or_else(|| {
+                        raise_error!(
+                            format!("User {} not found", user.id),
+                            ErrorCode::ResourceNotFound
+                        )
+                    })?;
+
+                let mut updated = current.clone();
+
+                if updated.account_access_map.remove(&account_id).is_some() {
+                    updated.updated_at = now;
+                    rw.update(current, updated)
+                        .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+                }
+            }
+            Ok(())
+        })
+        .await?;
+
+        Ok(())
+    }
+}
+
+impl From<BichonUserV2> for BichonUser {
+    fn from(value: BichonUserV2) -> Self {
+        BichonUser {
+            id: value.id,
+            username: value.username,
+            email: value.email,
+            password: value.password,
+            account_access_map: value.account_access_map,
+            description: value.description,
+            global_roles: value.global_roles,
+            avatar: value.avatar,
+            created_at: value.created_at,
+            updated_at: value.updated_at,
+            acl: value.acl,
+        }
+    }
+}
+
+impl From<BichonUser> for BichonUserV2 {
+    fn from(value: BichonUser) -> Self {
+        BichonUserV2 {
+            id: value.id,
+            username: value.username,
+            email: value.email,
+            password: value.password,
+            account_access_map: value.account_access_map,
+            description: value.description,
+            global_roles: value.global_roles,
+            avatar: value.avatar,
+            created_at: value.created_at,
+            updated_at: value.updated_at,
+            acl: value.acl,
+            theme: None,
+            language: None,
+        }
+    }
+}
--- a/src/modules/users/payload.rs
+++ b/src/modules/users/payload.rs
@@ -0,0 +1,453 @@
+//
+// Copyright (c) 2025 rustmailer.com (https://rustmailer.com)
+//
+// This file is part of the Bichon Email Archiving Project
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+use crate::{
+    modules::{
+        account::migration::AccountModel,
+        error::{code::ErrorCode, BichonResult},
+        users::{
+            acl::AccessControl,
+            permissions::{Permission, VALID_PERMISSION_SET},
+            role::{RoleType, UserRole},
+        },
+        utils::decode_avatar_bytes,
+    },
+    raise_error,
+};
+use poem_openapi::Object;
+use serde::{Deserialize, Serialize};
+use std::collections::{BTreeMap, BTreeSet, HashMap, HashSet};
+
+fn allowed_themes() -> HashSet<&'static str> {
+    ["light", "dark"].into_iter().collect()
+}
+
+fn allowed_languages() -> HashSet<&'static str> {
+    [
+        "ar", "da", "de", "en", "es", "fi", "fr", "it", "jp", "ko", "nl", "no", "pl", "pt", "ru",
+        "sv", "zh", "zh-tw",
+    ]
+    .into_iter()
+    .collect()
+}
+
+fn validate_option_in_set(
+    value: &Option<String>,
+    allowed: &std::collections::HashSet<&'static str>,
+    field_name: &str,
+) -> BichonResult<()> {
+    if let Some(v) = value {
+        if !allowed.contains(v.as_str()) {
+            return Err(raise_error!(
+                format!("invalid {} value: '{}'", field_name, v),
+                ErrorCode::InvalidParameter
+            ));
+        }
+    }
+    Ok(())
+}
+
+fn validate_theme(theme: &Option<String>) -> BichonResult<()> {
+    validate_option_in_set(theme, &allowed_themes(), "theme")
+}
+
+fn validate_language(language: &Option<String>) -> BichonResult<()> {
+    validate_option_in_set(language, &allowed_languages(), "language")
+}
+
+#[derive(Clone, Debug, Default, Eq, PartialEq, Deserialize, Serialize, Object)]
+pub struct RoleCreateRequest {
+    pub name: String,
+    pub role_type: RoleType,
+    pub description: Option<String>,
+    pub permissions: BTreeSet<String>,
+}
+
+impl RoleCreateRequest {
+    pub async fn validate(&self) -> BichonResult<()> {
+        let trimmed_name = self.name.trim();
+        if trimmed_name.is_empty() {
+            return Err(raise_error!(
+                "Role name cannot be empty or consist only of whitespace.".into(),
+                ErrorCode::InvalidParameter
+            ));
+        }
+
+        let name_lower = trimmed_name.to_lowercase();
+        if name_lower == "admin" || name_lower == "manager" || name_lower == "viewer" {
+            return Err(raise_error!(
+                format!(
+                    "The name '{}' is reserved for system builtin roles.",
+                    trimmed_name
+                ),
+                ErrorCode::InvalidParameter
+            ));
+        }
+
+        if self.permissions.is_empty() {
+            return Err(raise_error!(
+                "Role must be assigned at least one permission.".into(),
+                ErrorCode::InvalidParameter
+            ));
+        }
+
+        for permission in &self.permissions {
+            if !VALID_PERMISSION_SET.contains(permission.as_str()) {
+                return Err(raise_error!(
+                    format!(
+                        "Invalid permission '{}' specified in the request.",
+                        permission
+                    ),
+                    ErrorCode::InvalidParameter
+                ));
+            }
+        }
+
+        Permission::validate_role_permissions(&self.role_type, &self.permissions)?;
+        Ok(())
+    }
+}
+
+#[derive(Clone, Debug, Default, Eq, PartialEq, Deserialize, Serialize, Object)]
+pub struct RoleUpdateRequest {
+    pub name: Option<String>,
+    pub description: Option<String>,
+    pub permissions: Option<BTreeSet<String>>,
+}
+
+impl RoleUpdateRequest {
+    pub async fn validate(&self) -> BichonResult<()> {
+        // 1. Ensure at least one field is provided for the update
+        if self.name.is_none() && self.description.is_none() && self.permissions.is_none() {
+            return Err(raise_error!(
+                "Update request must contain at least one field to modify (name, description, or permissions).".into(),
+                ErrorCode::InvalidParameter
+            ));
+        }
+
+        // 2. Validate Name if present
+        if let Some(name) = &self.name {
+            let trimmed_name = name.trim();
+            if trimmed_name.is_empty() {
+                return Err(raise_error!(
+                    "Role name cannot be set to an empty string or consist only of whitespace."
+                        .into(),
+                    ErrorCode::InvalidParameter
+                ));
+            }
+
+            // Prevent renaming to reserved system names
+            let name_lower = trimmed_name.to_lowercase();
+            if name_lower == "admin" || name_lower == "manager" || name_lower == "viewer" {
+                return Err(raise_error!(
+                    format!(
+                        "The name '{}' is reserved for system builtin roles.",
+                        trimmed_name
+                    ),
+                    ErrorCode::InvalidParameter
+                ));
+            }
+        }
+
+        // 3. Validate Permissions if present
+        if let Some(permissions) = &self.permissions {
+            // Ensure the role doesn't end up with zero permissions
+            if permissions.is_empty() {
+                return Err(raise_error!(
+                    "Permissions list cannot be empty. A role must have at least one permission."
+                        .into(),
+                    ErrorCode::InvalidParameter
+                ));
+            }
+
+            // Check for invalid permission strings using a functional approach
+            if let Some(invalid_permission) = permissions
+                .iter()
+                .find(|p| !VALID_PERMISSION_SET.contains(p.as_str()))
+            {
+                return Err(raise_error!(
+                    format!(
+                        "Invalid permission '{}' specified in the update request.",
+                        invalid_permission
+                    ),
+                    ErrorCode::InvalidParameter
+                ));
+            }
+        }
+
+        Ok(())
+    }
+}
+
+#[derive(Clone, Debug, Default, Eq, PartialEq, Deserialize, Serialize, Object)]
+pub struct UserCreateRequest {
+    pub username: String,
+
+    #[oai(validator(custom = "crate::modules::common::validator::EmailValidator"))]
+    pub email: String,
+
+    pub password: String,
+
+    /// Global Roles: System-wide permissions (e.g., Admin, User Manager).
+    pub global_roles: Vec<u64>,
+
+    /// Scoped Access: List of accounts paired with specific roles.
+    /// This allows different permissions per account.
+    pub account_access_map: BTreeMap<u64, u64>,
+
+    pub acl: Option<AccessControl>,
+    pub avatar_base64: Option<String>,
+    pub description: Option<String>,
+    pub theme: Option<String>,
+    pub language: Option<String>,
+}
+
+impl UserCreateRequest {
+    pub async fn validate(&self) -> BichonResult<()> {
+        let username_len = self.username.len();
+
+        // 1. Username constraints
+        if username_len < 5 {
+            return Err(raise_error!(
+                "Username must be at least 5 characters long.".into(),
+                ErrorCode::InvalidParameter
+            ));
+        }
+        if username_len > 32 {
+            return Err(raise_error!(
+                "Username cannot exceed 32 characters.".into(),
+                ErrorCode::InvalidParameter
+            ));
+        }
+
+        // 2. Password constraints
+        let password_len = self.password.len();
+        if password_len < 8 {
+            return Err(raise_error!(
+                "Password must be at least 8 characters long.".into(),
+                ErrorCode::InvalidParameter
+            ));
+        }
+        if password_len > 256 {
+            return Err(raise_error!(
+                "Password cannot exceed 256 characters.".into(),
+                ErrorCode::InvalidParameter
+            ));
+        }
+
+        // 3. Global Roles validation
+        if self.global_roles.is_empty() {
+            return Err(raise_error!(
+                "Global roles list cannot be empty. At least one role must be selected.".into(),
+                ErrorCode::InvalidParameter
+            ));
+        }
+
+        validate_theme(&self.theme)?;
+        validate_language(&self.language)?;
+
+        let all_roles = UserRole::list_all().await?;
+        let role_type_map: HashMap<u64, RoleType> =
+            all_roles.into_iter().map(|r| (r.id, r.role_type)).collect();
+
+        for rid in &self.global_roles {
+            match role_type_map.get(rid) {
+                Some(RoleType::Global) => {}
+                Some(_) => {
+                    return Err(raise_error!(
+                        format!("Role {} is not a System role", rid),
+                        ErrorCode::InvalidParameter
+                    ))
+                }
+                None => {
+                    return Err(raise_error!(
+                        format!("System Role {} not found", rid),
+                        ErrorCode::InvalidParameter
+                    ))
+                }
+            }
+        }
+
+        for (aid, rid) in &self.account_access_map {
+            if AccountModel::find(*aid).await?.is_none() {
+                return Err(raise_error!(
+                    format!("Account {} not found", aid),
+                    ErrorCode::InvalidParameter
+                ));
+            }
+            match role_type_map.get(rid) {
+                Some(RoleType::Account) => {}
+                Some(_) => {
+                    return Err(raise_error!(
+                        format!(
+                            "Role {} assigned to account {} must be an Account role",
+                            rid, aid
+                        ),
+                        ErrorCode::InvalidParameter
+                    ))
+                }
+                None => {
+                    return Err(raise_error!(
+                        format!("Role {} for account {} not found", rid, aid),
+                        ErrorCode::InvalidParameter
+                    ))
+                }
+            }
+        }
+
+        if let Some(acl) = &self.acl {
+            acl.validate()?;
+        }
+
+        if let Some(desc) = &self.description {
+            if desc.len() > 256 {
+                return Err(raise_error!(
+                    "Description cannot exceed 256 characters.".into(),
+                    ErrorCode::InvalidParameter
+                ));
+            }
+        }
+
+        if let Some(avatar_base64) = &self.avatar_base64 {
+            decode_avatar_bytes(&avatar_base64)?;
+        }
+
+        Ok(())
+    }
+}
+
+#[derive(Clone, Debug, Default, Eq, PartialEq, Deserialize, Serialize, Object)]
+pub struct UserUpdateRequest {
+    pub username: Option<String>,
+    #[oai(validator(custom = "crate::modules::common::validator::EmailValidator"))]
+    pub email: Option<String>,
+    pub password: Option<String>,
+    pub avatar_base64: Option<String>,
+    pub global_roles: Option<Vec<u64>>,
+    /// Scoped Access
+    pub account_access_map: Option<BTreeMap<u64, u64>>,
+    pub acl: Option<AccessControl>,
+    pub description: Option<String>,
+    pub theme: Option<String>,
+    pub language: Option<String>,
+}
+
+impl UserUpdateRequest {
+    pub async fn validate(&self) -> BichonResult<()> {
+        if let Some(username) = &self.username {
+            let len = username.len();
+            if len < 5 || len > 32 {
+                return Err(raise_error!(
+                    "Username must be 5-32 characters.".into(),
+                    ErrorCode::InvalidParameter
+                ));
+            }
+        }
+
+        if let Some(password) = &self.password {
+            let len = password.len();
+            if len < 8 || len > 256 {
+                return Err(raise_error!(
+                    "Password must be 8-256 characters.".into(),
+                    ErrorCode::InvalidParameter
+                ));
+            }
+        }
+
+        validate_theme(&self.theme)?;
+        validate_language(&self.language)?;
+
+        let all_roles = UserRole::list_all().await?;
+        let role_type_map: HashMap<u64, RoleType> =
+            all_roles.into_iter().map(|r| (r.id, r.role_type)).collect();
+
+        if let Some(roles) = &self.global_roles {
+            if roles.is_empty() {
+                return Err(raise_error!(
+                    "Roles list cannot be empty.".into(),
+                    ErrorCode::InvalidParameter
+                ));
+            }
+            for role_id in roles {
+                match role_type_map.get(role_id) {
+                    Some(RoleType::Global) => {}
+                    Some(_) => {
+                        return Err(raise_error!(
+                            format!("Role {} is not a System role", role_id),
+                            ErrorCode::InvalidParameter
+                        ))
+                    }
+                    None => {
+                        return Err(raise_error!(
+                            format!("System Role {} not found", role_id),
+                            ErrorCode::InvalidParameter
+                        ))
+                    }
+                }
+            }
+        }
+
+        if let Some(account_access_map) = &self.account_access_map {
+            for (aid, rid) in account_access_map {
+                if AccountModel::find(*aid).await?.is_none() {
+                    return Err(raise_error!(
+                        format!("Account {} not found", aid),
+                        ErrorCode::InvalidParameter
+                    ));
+                }
+                match role_type_map.get(rid) {
+                    Some(RoleType::Account) => {}
+                    Some(_) => {
+                        return Err(raise_error!(
+                            format!(
+                                "Role {} assigned to account {} must be an Account role",
+                                rid, aid
+                            ),
+                            ErrorCode::InvalidParameter
+                        ))
+                    }
+                    None => {
+                        return Err(raise_error!(
+                            format!("Role {} for account {} not found", rid, aid),
+                            ErrorCode::InvalidParameter
+                        ))
+                    }
+                }
+            }
+        }
+
+        if let Some(desc) = &self.description {
+            if desc.len() > 256 {
+                return Err(raise_error!(
+                    "Description too long.".into(),
+                    ErrorCode::InvalidParameter
+                ));
+            }
+        }
+
+        if let Some(acl) = &self.acl {
+            acl.validate()?;
+        }
+
+        if let Some(avatar) = &self.avatar_base64 {
+            decode_avatar_bytes(avatar)?;
+        }
+
+        Ok(())
+    }
+}
--- a/src/modules/users/permissions.rs
+++ b/src/modules/users/permissions.rs
@@ -0,0 +1,239 @@
+//
+// Copyright (c) 2025 rustmailer.com (https://rustmailer.com)
+//
+// This file is part of the Bichon Email Archiving Project
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+use std::{
+    collections::{BTreeSet, HashSet},
+    sync::LazyLock,
+};
+
+use crate::{
+    modules::{
+        error::{code::ErrorCode, BichonResult},
+        users::role::RoleType,
+    },
+    raise_error,
+};
+
+pub static VALID_PERMISSION_SET: LazyLock<HashSet<&'static str>> = LazyLock::new(|| {
+    Permission::all_permissions()
+        .into_iter()
+        .map(|(key, _)| key)
+        .collect()
+});
+
+pub struct Permission;
+
+impl Permission {
+    // ----------------------------------------------------------------------
+    // 1. Global Management Permissions (System, Users, Tokens)
+    // ----------------------------------------------------------------------
+
+    /// Basic platform access. Required for any user to log in and access the dashboard.
+    /// This provides no administrative powers.
+    pub const SYSTEM_ACCESS: &str = "system:access";
+
+    /// Manage core system configurations (OAuth Client ID/Secret, Proxy settings).
+    pub const ROOT: &str = "system:root";
+
+    /// Create, modify, and delete all users and their roles (Admin only).
+    pub const USER_MANAGE: &str = "user:manage";
+
+    /// View the minimal user list and basic profiles (Managers and Admins).
+    pub const USER_VIEW: &str = "user:view";
+
+    /// View and revoke all access tokens in the system.
+    pub const TOKEN_MANAGE: &str = "token:manage";
+
+    /// Create new email account connections.
+    pub const ACCOUNT_CREATE: &str = "account:create";
+
+    // ----------------------------------------------------------------------
+    // 2. Global "ALL" Scoped Permissions (Reserved for Admin)
+    // ----------------------------------------------------------------------
+
+    /// Manage configuration for all accounts (Global control).
+    pub const ACCOUNT_MANAGE_ALL: &str = "account:manage:all";
+
+    /// Read mail data from all accounts (Search, view messages).
+    pub const DATA_READ_ALL: &str = "data:read:all";
+
+    /// Download raw EML/MIME files from all accounts.
+    pub const DATA_RAW_DOWNLOAD_ALL: &str = "data:raw:download:all";
+
+    /// Delete messages from all accounts.
+    pub const DATA_DELETE_ALL: &str = "data:delete:all";
+
+    /// Manage metadata (e.g., tags, categories, notes) for messages in ALL email accounts.
+    pub const DATA_MANAGE_ALL: &str = "data:manage:all";
+
+    /// Export messages in batches from all accounts.
+    pub const DATA_EXPORT_BATCH_ALL: &str = "data:export:batch:all";
+
+    // ----------------------------------------------------------------------
+    // 3. Scoped/Limited Permissions (Manager & Viewer)
+    //    Authorization requires checking the user's Account Access List (ACL)
+    // ----------------------------------------------------------------------
+
+    /// Manage (modify/delete/sync) configuration for a specific set of accounts.
+    pub const ACCOUNT_MANAGE: &str = "account:manage";
+
+    /// Read details and sync status for a specific set of accounts.
+    pub const ACCOUNT_READ_DETAILS: &str = "account:read_details";
+
+    /// Manage mail data metadata (e.g., updating tags, adding notes)
+    /// for specific accounts.
+    pub const DATA_MANAGE: &str = "data:manage";
+
+    /// Read mail data (Search, view) from a specific set of accounts.
+    pub const DATA_READ: &str = "data:read";
+
+    /// Download raw EML/MIME files from a specific set of accounts.
+    pub const DATA_RAW_DOWNLOAD: &str = "data:raw:download";
+
+    /// Delete messages from a specific set of accounts.
+    pub const DATA_DELETE: &str = "data:delete";
+
+    /// Export messages in batches from a specific set of accounts.
+    pub const DATA_EXPORT_BATCH: &str = "data:export:batch";
+
+    /// Import EML/PST data into a SPECIFIC account.
+    /// Authorization requires checking access to the target account_id.
+    pub const DATA_IMPORT_BATCH: &str = "data:import:batch";
+
+    pub fn global_permissions() -> Vec<(&'static str, &'static str)> {
+        vec![
+            (
+                Self::SYSTEM_ACCESS,
+                "Basic platform access for dashboard and personal settings.",
+            ),
+            (Self::ROOT, "Full system access and configuration."),
+            (Self::USER_MANAGE, "Create, update, and delete users."),
+            (
+                Self::USER_VIEW,
+                "Read-only access to user list and profiles.",
+            ),
+            (Self::TOKEN_MANAGE, "View and revoke all active API tokens."),
+            (
+                Self::ACCOUNT_CREATE,
+                "Connect new email accounts to the system.",
+            ),
+            (
+                Self::ACCOUNT_MANAGE_ALL,
+                "Manage configurations for all email accounts.",
+            ),
+            (
+                Self::DATA_READ_ALL,
+                "Search and read messages across all accounts.",
+            ),
+            (
+                Self::DATA_MANAGE_ALL,
+                "Manage metadata and tags for all accounts.",
+            ),
+            (
+                Self::DATA_RAW_DOWNLOAD_ALL,
+                "Download raw EML data from any account.",
+            ),
+            (
+                Self::DATA_DELETE_ALL,
+                "Permanently delete messages from any account.",
+            ),
+            (
+                Self::DATA_EXPORT_BATCH_ALL,
+                "Export bulk message data from all accounts.",
+            ),
+        ]
+    }
+
+    pub fn account_permissions() -> Vec<(&'static str, &'static str)> {
+        vec![
+            (
+                Self::ACCOUNT_MANAGE,
+                "Update or sync settings for authorized accounts.",
+            ),
+            (
+                Self::ACCOUNT_READ_DETAILS,
+                "View status and details of authorized accounts.",
+            ),
+            (
+                Self::DATA_READ,
+                "Read messages from authorized email accounts.",
+            ),
+            (
+                Self::DATA_MANAGE,
+                "Manage tags and metadata for authorized accounts.",
+            ),
+            (
+                Self::DATA_RAW_DOWNLOAD,
+                "Download raw EML files from authorized accounts.",
+            ),
+            (
+                Self::DATA_DELETE,
+                "Delete messages from authorized email accounts.",
+            ),
+            (
+                Self::DATA_EXPORT_BATCH,
+                "Export messages from authorized accounts.",
+            ),
+            (
+                Self::DATA_IMPORT_BATCH,
+                "Import external EML/PST data into authorized accounts.",
+            ),
+        ]
+    }
+
+    pub fn all_permissions() -> Vec<(&'static str, &'static str)> {
+        let mut all = Self::global_permissions();
+        all.extend(Self::account_permissions());
+        all
+    }
+
+    fn is_account_permission(perm: &str) -> bool {
+        Self::account_permissions().iter().any(|(p, _)| *p == perm)
+    }
+
+    fn is_global_permission(perm: &str) -> bool {
+        Self::global_permissions().iter().any(|(p, _)| *p == perm)
+    }
+
+    pub fn validate_role_permissions(
+        role_type: &RoleType,
+        permissions: &BTreeSet<String>,
+    ) -> BichonResult<()> {
+        for p in permissions {
+            match role_type {
+                RoleType::Global => {
+                    if !Self::is_global_permission(p) {
+                        return Err(raise_error!(
+                            format!("Permission '{}' is not a valid Global permission", p),
+                            ErrorCode::InvalidParameter
+                        ));
+                    }
+                }
+                RoleType::Account => {
+                    if !Self::is_account_permission(p) {
+                        return Err(raise_error!(
+                            format!("Permission '{}' is not a valid Account permission", p),
+                            ErrorCode::InvalidParameter
+                        ));
+                    }
+                }
+            }
+        }
+        Ok(())
+    }
+}
--- a/src/modules/users/role.rs
+++ b/src/modules/users/role.rs
@@ -0,0 +1,359 @@
+//
+// Copyright (c) 2025 rustmailer.com (https://rustmailer.com)
+//
+// This file is part of the Bichon Email Archiving Project
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+use std::{
+    collections::{BTreeSet, HashSet},
+    fmt::{self, Display},
+};
+
+use native_db::*;
+use native_model::{native_model, Model};
+use poem_openapi::{Enum, Object};
+use serde::{Deserialize, Serialize};
+
+use crate::{
+    id,
+    modules::{
+        database::{
+            async_find_impl, delete_impl, insert_impl, list_all_impl, manager::DB_MANAGER,
+            update_impl, with_transaction,
+        },
+        error::{code::ErrorCode, BichonResult},
+        users::{
+            payload::{RoleCreateRequest, RoleUpdateRequest},
+            permissions::*,
+        },
+    },
+    raise_error, utc_now,
+};
+
+/// Enumerates the built-in roles in the Bichon system.
+#[derive(Debug, PartialEq, Eq, Hash)]
+pub enum BuiltinRole {
+    Admin,
+    Manager,
+    Member,
+    AccountManager,
+    AccountViewer,
+}
+
+impl Display for BuiltinRole {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let s = match self {
+            BuiltinRole::Admin => "admin",
+            BuiltinRole::Manager => "manager",
+            BuiltinRole::Member => "member",
+            BuiltinRole::AccountManager => "account_manager",
+            BuiltinRole::AccountViewer => "account_viewer",
+        };
+        write!(f, "{}", s)
+    }
+}
+
+impl BuiltinRole {
+    pub fn description(&self) -> &'static str {
+        match self {
+            BuiltinRole::Admin => {
+                "Full system administrator with unrestricted access to all accounts, user management, and system configurations."
+            }
+            BuiltinRole::Manager => {
+                "Standard operational manager. Can manage users, create accounts, and perform data operations on authorized email accounts."
+            }
+            BuiltinRole::Member => {
+                "Regular platform member. Provides basic login access to the system without any administrative or global management privileges."
+            }
+            BuiltinRole::AccountManager => {
+                "Specific account manager. Has full administrative control over a particular email account, including configuration and data deletion."
+            }
+            BuiltinRole::AccountViewer => {
+                "Specific account observer. Has read-only access to messages and metadata for a particular email account."
+            }
+        }
+    }
+
+    /// Retrieves the set of static permissions associated with the role.
+    pub fn get_permissions(&self) -> HashSet<&'static str> {
+        match self {
+            BuiltinRole::Admin => Self::admin_permissions(),
+            BuiltinRole::Manager => Self::manager_permissions(),
+            BuiltinRole::Member => Self::member_permissions(),
+            BuiltinRole::AccountManager => Self::account_owner_permissions(),
+            BuiltinRole::AccountViewer => Self::account_viewer_permissions(),
+        }
+    }
+
+    /// Admin Role: Full control over the system and all data.
+    fn admin_permissions() -> HashSet<&'static str> {
+        [
+            // System-Wide
+            Permission::ROOT,
+            Permission::USER_MANAGE,
+            Permission::USER_VIEW,
+            Permission::TOKEN_MANAGE,
+            // Account Configuration
+            Permission::ACCOUNT_CREATE,
+            Permission::ACCOUNT_MANAGE_ALL, // Global account management
+            // Data Access (Global ALL)
+            Permission::DATA_READ_ALL,
+            Permission::DATA_MANAGE_ALL,
+            Permission::DATA_RAW_DOWNLOAD_ALL,
+            Permission::DATA_DELETE_ALL,
+            Permission::DATA_EXPORT_BATCH_ALL,
+        ]
+        .into_iter()
+        .collect()
+    }
+
+    /// Manager Role: Data and account configuration management, limited user management.
+    /// ALL data/account access must be scoped by the user's ACL.
+    fn manager_permissions() -> HashSet<&'static str> {
+        [Permission::USER_VIEW, Permission::ACCOUNT_CREATE]
+            .into_iter()
+            .collect()
+    }
+
+    fn member_permissions() -> HashSet<&'static str> {
+        [Permission::SYSTEM_ACCESS].into_iter().collect()
+    }
+
+    fn account_owner_permissions() -> HashSet<&'static str> {
+        [
+            Permission::ACCOUNT_MANAGE,
+            Permission::ACCOUNT_READ_DETAILS,
+            Permission::DATA_READ,
+            Permission::DATA_MANAGE,
+            Permission::DATA_RAW_DOWNLOAD,
+            Permission::DATA_DELETE,
+            Permission::DATA_EXPORT_BATCH,
+            Permission::DATA_IMPORT_BATCH,
+        ]
+        .into_iter()
+        .collect()
+    }
+
+    fn account_viewer_permissions() -> HashSet<&'static str> {
+        [Permission::ACCOUNT_READ_DETAILS, Permission::DATA_READ]
+            .into_iter()
+            .collect()
+    }
+}
+
+// Global Roles (Starting with 1)
+pub const DEFAULT_ADMIN_ROLE_ID: u64 = 100_000_000_000_000; // System Admin
+pub const DEFAULT_MANAGER_ROLE_ID: u64 = 100_100_000_000_000; // System Manager
+pub const DEFAULT_MEMBER_ROLE_ID: u64 = 100_200_000_000_000; // Regular Member (system:access)
+
+// Account-specific Roles (Starting with 2)
+pub const DEFAULT_ACCOUNT_MANAGER_ROLE_ID: u64 = 200_100_000_000_000;
+pub const DEFAULT_ACCOUNT_VIEWER_ROLE_ID: u64 = 200_200_000_000_000;
+
+fn is_builtin(id: u64) -> bool {
+    matches!(
+        id,
+        DEFAULT_ADMIN_ROLE_ID
+            | DEFAULT_MANAGER_ROLE_ID
+            | DEFAULT_MEMBER_ROLE_ID
+            | DEFAULT_ACCOUNT_MANAGER_ROLE_ID
+            | DEFAULT_ACCOUNT_VIEWER_ROLE_ID
+    )
+}
+
+#[derive(Clone, Debug, Default, Eq, PartialEq, Serialize, Deserialize, Enum)]
+pub enum RoleType {
+    #[default]
+    Global,
+    Account,
+}
+
+#[derive(Clone, Debug, Default, Eq, PartialEq, Serialize, Deserialize, Object)]
+#[native_model(id = 9, version = 1)]
+#[native_db]
+pub struct UserRole {
+    #[primary_key]
+    pub id: u64,
+    pub name: String,
+    pub description: Option<String>,
+    pub permissions: BTreeSet<String>,
+    pub is_builtin: bool,
+    pub created_at: i64,
+    pub role_type: RoleType,
+    pub updated_at: i64,
+}
+
+impl UserRole {
+    pub async fn ensure_default_roles_exists() -> BichonResult<()> {
+        let builtin_roles = vec![
+            (BuiltinRole::Admin, DEFAULT_ADMIN_ROLE_ID, RoleType::Global),
+            (
+                BuiltinRole::Manager,
+                DEFAULT_MANAGER_ROLE_ID,
+                RoleType::Global,
+            ),
+            (
+                BuiltinRole::Member,
+                DEFAULT_MEMBER_ROLE_ID,
+                RoleType::Global,
+            ),
+            (
+                BuiltinRole::AccountManager,
+                DEFAULT_ACCOUNT_MANAGER_ROLE_ID,
+                RoleType::Account,
+            ),
+            (
+                BuiltinRole::AccountViewer,
+                DEFAULT_ACCOUNT_VIEWER_ROLE_ID,
+                RoleType::Account,
+            ),
+        ];
+
+        with_transaction(DB_MANAGER.meta_db(), move |rw| {
+            let now = utc_now!();
+
+            for (role, role_id, role_type) in builtin_roles {
+                let exists = rw
+                    .get()
+                    .primary::<UserRole>(role_id)
+                    .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
+                    .is_some();
+
+                if !exists {
+                    let permissions: BTreeSet<String> = role
+                        .get_permissions()
+                        .into_iter()
+                        .map(|s| s.to_string())
+                        .collect();
+
+                    rw.insert(UserRole {
+                        id: role_id,
+                        name: role.to_string(),
+                        description: Some(role.description().to_string()),
+                        permissions,
+                        created_at: now,
+                        updated_at: now,
+                        is_builtin: true,
+                        role_type,
+                    })
+                    .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+                }
+            }
+            Ok(())
+        })
+        .await?;
+
+        Ok(())
+    }
+
+    pub async fn list_all() -> BichonResult<Vec<UserRole>> {
+        list_all_impl(DB_MANAGER.meta_db()).await
+    }
+
+    pub async fn find(role_id: u64) -> BichonResult<Option<UserRole>> {
+        async_find_impl(DB_MANAGER.meta_db(), role_id).await
+    }
+
+    pub async fn create(request: RoleCreateRequest) -> BichonResult<UserRole> {
+        let _ = &request.validate().await?;
+        let now = utc_now!();
+        let new_role = UserRole {
+            id: id!(64),
+            name: request.name,
+            description: request.description,
+            permissions: request.permissions,
+            created_at: now,
+            updated_at: now,
+            is_builtin: false,
+            role_type: request.role_type,
+        };
+        insert_impl(DB_MANAGER.meta_db(), new_role.clone()).await?;
+        Ok(new_role)
+    }
+
+    pub async fn update(id: u64, request: RoleUpdateRequest) -> BichonResult<()> {
+        if is_builtin(id) && request.permissions.is_some() {
+            return Err(raise_error!(
+                "The permissions of a builtin role are immutable. Please create a custom role instead.".into(),
+                ErrorCode::Forbidden
+            ));
+        }
+        let _ = &request.validate().await?;
+
+        if let Some(permissions) = &request.permissions {
+            let role = Self::find(id).await?.ok_or_else(|| {
+                raise_error!(
+                    format!("UserRole with id={} not found", id),
+                    ErrorCode::ResourceNotFound
+                )
+            })?;
+            Permission::validate_role_permissions(&role.role_type, permissions)?;
+        }
+
+        update_impl(
+            DB_MANAGER.meta_db(),
+            move |rw| {
+                rw.get()
+                    .primary::<UserRole>(id)
+                    .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
+                    .ok_or_else(|| {
+                        raise_error!(
+                            format!("UserRole with id={} not found", id),
+                            ErrorCode::ResourceNotFound
+                        )
+                    })
+            },
+            move |current| {
+                let mut updated = current.clone();
+                if let Some(name) = request.name {
+                    updated.name = name;
+                }
+
+                if let Some(desc) = request.description {
+                    updated.description = Some(desc);
+                }
+
+                if let Some(permissions) = request.permissions {
+                    updated.permissions = permissions;
+                }
+                updated.updated_at = utc_now!();
+                Ok(updated)
+            },
+        )
+        .await?;
+        Ok(())
+    }
+
+    pub async fn delete(id: u64) -> BichonResult<()> {
+        if is_builtin(id) {
+            return Err(raise_error!(
+                format!("Cannot delete a default system role (ID: {}).", id),
+                ErrorCode::InvalidParameter
+            ));
+        }
+        delete_impl(DB_MANAGER.meta_db(), move |rw| {
+            rw.get()
+                .primary::<UserRole>(id)
+                .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?
+                .ok_or_else(|| {
+                    raise_error!(
+                        format!("UserRole '{}' not found during deletion process.", id),
+                        ErrorCode::ResourceNotFound
+                    )
+                })
+        })
+        .await
+    }
+}
--- a/src/modules/users/view.rs
+++ b/src/modules/users/view.rs
@@ -0,0 +1,54 @@
+//
+// Copyright (c) 2025 rustmailer.com (https://rustmailer.com)
+//
+// This file is part of the Bichon Email Archiving Project
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+use std::collections::BTreeMap;
+
+use poem_openapi::Object;
+use serde::{Deserialize, Serialize};
+
+use crate::modules::users::acl::AccessControl;
+
+#[derive(Clone, Debug, Default, Eq, PartialEq, Serialize, Deserialize, Object)]
+pub struct UserView {
+    pub id: u64,
+    pub username: String,
+    pub email: String,
+
+    pub password: Option<String>,
+
+    /// Scoped Access: Defines per-account permissions.
+    /// Example:
+    /// { account_id: 1, role_id: role_manager_id } -> Manager on Account 1
+    /// { account_id: 2, role_id: role_viewer_id }  -> Viewer on Account 2
+    pub account_access_map: BTreeMap<u64, u64>,
+    pub account_roles_summary: BTreeMap<u64, String>,
+    pub account_permissions: BTreeMap<u64, Vec<String>>,
+    pub description: Option<String>,
+    /// Global Roles: Permissions that apply to the whole system
+    /// (e.g., system settings, creating new users).
+    pub global_roles: Vec<u64>,
+    pub global_roles_names: Vec<String>,
+    pub global_permissions: Vec<String>,
+    pub avatar: Option<String>,
+    pub created_at: i64,
+    pub updated_at: i64,
+    /// Optional access control settings
+    pub acl: Option<AccessControl>,
+    pub theme: Option<String>,
+    pub language: Option<String>,
+}
--- a/src/modules/utils/encrypt.rs
+++ b/src/modules/utils/encrypt.rs
@@ -16,18 +16,34 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use base64::{engine::general_purpose, Engine as _};
 use ring::aead::{Aad, BoundKey, Nonce, NonceSequence, OpeningKey, SealingKey, AES_256_GCM};
 use ring::pbkdf2::{self, derive};
 use ring::rand::{SecureRandom, SystemRandom};
+use std::fs;
 use std::num::NonZeroU32;
+use std::sync::LazyLock;

 use crate::modules::error::code::ErrorCode;
 use crate::modules::error::BichonResult;
 use crate::modules::settings::cli::SETTINGS;
 use crate::raise_error;

+static ENCRYPT_PASSWORD: LazyLock<String> = LazyLock::new(|| {
+    if let Some(file_path) = &SETTINGS.bichon_encrypt_password_file {
+        return fs::read_to_string(file_path)
+            .expect("failed to read the file with the encrypt password")
+            .trim()
+            .to_string();
+    }
+
+    if let Some(p) = &SETTINGS.bichon_encrypt_password {
+        return p.clone();
+    }
+
+    panic!("Neither encrypt_password nor encrypt_password_file is set. This should have been validated by SETTINGS.");
+});
+
 struct SingleNonceSequence([u8; 12]);

 impl SingleNonceSequence {
@@ -43,12 +59,12 @@ impl NonceSequence for SingleNonceSequence {
 }

 pub fn encrypt_string(plaintext: &str) -> BichonResult<String> {
-    internal_encrypt_string(&SETTINGS.bichon_encrypt_password, plaintext)
+    internal_encrypt_string(&ENCRYPT_PASSWORD, plaintext)
        .map_err(|_| raise_error!("Failed to encrypt string.".into(), ErrorCode::InternalError))
 }

 pub fn decrypt_string(data: &str) -> BichonResult<String> {
-    internal_decrypt_string(&SETTINGS.bichon_encrypt_password, data).map_err(|_| {
+    internal_decrypt_string(&ENCRYPT_PASSWORD, data).map_err(|_| {
        raise_error!(
            "Decryption failed, likely due to incorrect encryption key or corrupted data".into(),
            ErrorCode::InternalError
--- a/src/modules/utils/mod.rs
+++ b/src/modules/utils/mod.rs
@@ -16,9 +16,10 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use std::{fs, io, path::PathBuf};

+use crate::modules::error::BichonResult;
+use base64::engine::general_purpose::STANDARD;
 use base64::{engine::general_purpose, Engine};
 use rand::{rng, Rng};

@@ -310,3 +311,26 @@ pub fn get_total_size(path: &PathBuf) -> io::Result<u64> {

    Ok(total_size)
 }
+
+const MAX_AVATAR_BYTES: usize = 128 * 1024;
+
+pub fn decode_avatar_bytes(base64_str: &str) -> BichonResult<Vec<u8>> {
+    let bytes = STANDARD.decode(base64_str).map_err(|e| {
+        raise_error!(
+            format!("Invalid avatar base64 encoding: {}", e),
+            ErrorCode::InvalidParameter
+        )
+    })?;
+
+    if bytes.len() > MAX_AVATAR_BYTES {
+        return Err(raise_error!(
+            format!(
+                "Avatar image exceeds maximum size ({} KB).",
+                MAX_AVATAR_BYTES / 1024
+            ),
+            ErrorCode::InvalidParameter
+        ));
+    }
+
+    Ok(bytes)
+}
--- a/src/modules/utils/rate_limit/mod.rs
+++ b/src/modules/utils/rate_limit/mod.rs
@@ -16,7 +16,6 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.

-
 use dashmap::DashMap;
 use governor::{
    clock::{QuantaClock, QuantaInstant},
@@ -30,14 +29,14 @@ use std::{
    time::Duration,
 };

-use crate::modules::token::RateLimit;
+use crate::modules::users::acl::RateLimit;

-pub static RATE_LIMITER_MANAGER: LazyLock<TokenRateLimiter> = LazyLock::new(TokenRateLimiter::new);
+pub static RATE_LIMITER_MANAGER: LazyLock<UserRateLimiter> = LazyLock::new(UserRateLimiter::new);

-pub struct TokenRateLimiter {
+pub struct UserRateLimiter {
    limiters: Arc<
        DashMap<
-            String,
+            u64,
            (
                Arc<RateLimiter<NotKeyed, InMemoryState, QuantaClock, NoOpMiddleware>>,
                RateLimit,
@@ -46,29 +45,29 @@ pub struct TokenRateLimiter {
    >,
 }

-impl TokenRateLimiter {
+impl UserRateLimiter {
    pub fn new() -> Self {
-        TokenRateLimiter {
+        UserRateLimiter {
            limiters: Arc::new(DashMap::new()),
        }
    }

    pub async fn check(
        &self,
-        token: &str,
+        user_id: u64,
        limit: RateLimit,
    ) -> Result<(), NotUntil<QuantaInstant>> {
-        let limiter = self.get_or_update_limiter(token, limit).await;
+        let limiter = self.get_or_update_limiter(user_id, limit).await;
        limiter.check()
    }

    async fn get_or_update_limiter(
        &self,
-        token: &str,
+        user_id: u64,
        limit: RateLimit,
    ) -> Arc<RateLimiter<NotKeyed, InMemoryState, QuantaClock, NoOpMiddleware>> {
        self.limiters
-            .entry(token.to_string())
+            .entry(user_id)
            .and_modify(|(existing_limiter, current_limit)| {
                if current_limit.interval != limit.interval || current_limit.quota != limit.quota {
                    let quota = Quota::with_period(Duration::from_secs(limit.interval))
@@ -100,4 +99,4 @@ impl TokenRateLimiter {
            .0
            .clone()
    }
-}
+}
--- a/web/components.json
+++ b/web/components.json
@@ -10,6 +10,7 @@
    "cssVariables": true,
    "prefix": ""
  },
+  "iconLibrary": "lucide",
  "aliases": {
    "components": "@/components",
    "utils": "@/lib/utils",
@@ -17,5 +18,7 @@
    "lib": "@/lib",
    "hooks": "@/hooks"
  },
-  "iconLibrary": "lucide"
-}
+  "registries": {
+    "@reui": "https://reui.io/r/{name}.json"
+  }
+}
--- a/web/package.json
+++ b/web/package.json
@@ -58,9 +58,10 @@
    "i18next": "^25.6.3",
    "js-cookie": "^3.0.5",
    "lucide-react": "^0.468.0",
+    "radix-ui": "^1.4.3",
    "react": "^18.3.1",
    "react-ace": "^13.0.0",
-    "react-day-picker": "8.10.1",
+    "react-day-picker": "9.13.0",
    "react-dom": "^18.3.1",
    "react-hook-form": "^7.54.0",
    "react-i18next": "^16.3.5",
--- a/web/pnpm-lock.yaml
+++ b/web/pnpm-lock.yaml
--- a/web/src/api/access-tokens/api.ts
+++ b/web/src/api/access-tokens/api.ts
@@ -1,64 +0,0 @@
-//
-// Copyright (c) 2025 rustmailer.com (https://rustmailer.com)
-//
-// This file is part of the Bichon Email Archiving Project
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-
-import axiosInstance from "@/api/axiosInstance";
-import { AccessToken } from "@/features/access-tokens/data/schema";
-
-export const login = async (password: string) => {
-    const response = await axiosInstance.post(`/api/login`, password, {
-        headers: {
-            "Content-Type": "text/plain",
-        },
-    });
-    return response.data;
-};
-
-export const reset_root_token = async () => {
-    const response = await axiosInstance.post("/api/v1/reset-root-token");
-    return response.data;
-};
-
-export const reset_root_password = async (password: string) => {
-    const response = await axiosInstance.post("/api/v1/reset-root-password", password, {
-        headers: {
-            "Content-Type": "text/plain",
-        },
-    });
-    return response.data;
-};
-
-export const list_access_tokens = async () => {
-    const response = await axiosInstance.get<AccessToken[]>("/api/v1/access-token-list");
-    return response.data;
-};
-
-export const create_access_token = async (data: Record<string, any>) => {
-    const response = await axiosInstance.post("/api/v1/access-token", data);
-    return response.data;
-}
-
-export const update_access_token = async (token: string, data: Record<string, any>) => {
-    const response = await axiosInstance.post(`/api/v1/access-token/${token}`, data);
-    return response.data;
-}
-
-export const delete_access_token = async (token: string) => {
-    const response = await axiosInstance.delete(`/api/v1/access-token/${token}`);
-    return response.data;
-}
--- a/web/src/api/account/api.ts
+++ b/web/src/api/account/api.ts
@@ -18,7 +18,6 @@


 import axiosInstance from "@/api/axiosInstance";
-import { AccountModel } from "@/features/accounts/data/schema";
 import { PaginatedResponse } from "..";

 export interface MinimalAccount {
@@ -56,6 +55,59 @@ export interface MailboxBatchProgress {
    current_batch: number;
 }

+
+
+type Encryption = 'Ssl' | 'StartTls' | 'None';
+type AuthType = 'Password' | 'OAuth2';
+type Unit = 'Days' | 'Months' | 'Years';
+type AccountType = 'IMAP' | 'NoSync';
+// Interface definitions
+interface AuthConfig {
+    auth_type: AuthType;
+    password?: string;
+}
+
+export interface ImapConfig {
+    host: string;
+    port: number; // integer, 0-65535
+    encryption: Encryption;
+    auth: AuthConfig;
+    use_proxy?: number;
+}
+
+interface RelativeDate {
+    unit: Unit;
+    value: number; // integer, minimum 1
+}
+
+interface DateSelection {
+    fixed?: string; // format: "YYYY-MM-DD"
+    relative?: RelativeDate;
+}
+
+export interface AccountModel {
+    id: number;
+    account_type: AccountType;
+    imap?: ImapConfig;
+    enabled: boolean;
+    name?: string,
+    email: string;
+    capabilities?: string[];
+    date_since?: DateSelection;
+    date_before?: RelativeDate;
+    folder_limit?: number,
+    sync_folders: string[];
+    sync_interval_min?: number;
+    sync_batch_size?: number;
+    created_by: number;
+    created_user_name: string;
+    created_user_email: string;
+    created_at: number;
+    updated_at: number;
+    use_proxy?: number
+    use_dangerous: boolean
+}
+
 export const account_state = async (account_id: number) => {
    const response = await axiosInstance.get<AccountRunningState>(`/api/v1/account-state/${account_id}`);
    return response.data;
@@ -103,3 +155,8 @@ export const autoconfig = async (email: string) => {
    const response = await axiosInstance.get<AutoConfigResult>(`/api/v1/autoconfig/${email}`);
    return response.data;
 };
+
+export const access_assign = async (data: Record<string, any>) => {
+    const response = await axiosInstance.post("/api/v1/accounts/access/assignments", data);
+    return response.data;
+};
--- a/web/src/api/axiosInstance.ts
+++ b/web/src/api/axiosInstance.ts
@@ -17,7 +17,7 @@
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.


-import { getAccessToken } from "@/stores/authStore";
+import { getToken } from "@/stores/authStore";
 import axios from "axios";

 // Create an Axios instance
@@ -36,9 +36,9 @@ const axiosInstance = axios.create({
 // Add a request interceptor to include the access token in headers
 axiosInstance.interceptors.request.use(
  (config) => {
-    const accessToken = getAccessToken(); // Retrieve access token from localStorage
-    if (accessToken) {
-      config.headers.Authorization = `Bearer ${accessToken}`;
+    const stored = getToken(); // Retrieve access token from localStorage
+    if (stored) {
+      config.headers.Authorization = `Bearer ${stored.accessToken}`;
    }
    return config;
  },
--- a/web/src/api/index.ts
+++ b/web/src/api/index.ts
@@ -30,6 +30,8 @@ export interface EmailEnvelope {
  id: number;
  message_id: string;
  account_id: number;
+  account_email?: string;
+  mailbox_name?: string;
  uid: number;
  subject: string;
  text: string;
--- a/web/src/api/mailbox/api.ts
+++ b/web/src/api/mailbox/api.ts
@@ -34,4 +34,10 @@ export interface MailboxData {
 export const list_mailboxes = async (accountId: number, remote: boolean) => {
    const response = await axiosInstance.get<MailboxData[]>(`/api/v1/list-mailboxes/${accountId}?remote=${remote}`);
    return response.data;
+};
+
+
+export const delete_mailbox = async (accountId: number, mailboxId: string) => {
+    const response = await axiosInstance.delete(`/api/v1/delete-mailbox/${accountId}/${mailboxId}`);
+    return response.data;
 };
--- a/web/src/api/mailbox/envelope/api.ts
+++ b/web/src/api/mailbox/envelope/api.ts
@@ -48,7 +48,7 @@ export const get_thread_messages = async (accountId: number, thread_id: number,
 }

 export const download_attachment = async (accountId: number, id: number, attachmentFileName: string) => {
-    const response = await axiosInstance.get(`/api/v1/download-attachment/${accountId}?id=${id}&name=${attachmentFileName}`, { responseType: 'blob' });
+    const response = await axiosInstance.get(`/api/v1/download-attachment/${accountId}/${id}?name=${attachmentFileName}`, { responseType: 'blob' });
    const blob = new Blob([response.data]);
    saveAs(blob, attachmentFileName);
 };
@@ -83,7 +83,7 @@ export const getContent = (messageContent: MessageContentResponse): string | nul
 };

 export const load_message = async (accountId: number, id: number) => {
-    const response = await axiosInstance.get<MessageContentResponse>(`/api/v1/message-content/${accountId}?id=${id}`);
+    const response = await axiosInstance.get<MessageContentResponse>(`/api/v1/message-content/${accountId}/${id}`);
    return response.data;
 };

@@ -93,7 +93,16 @@ export const delete_messages = async (payload: Record<string, number[]>) => {
 };

 export const download_message = async (accountId: number, id: number) => {
-    const response = await axiosInstance.get(`/api/v1/download-message/${accountId}?id=${id}`, { responseType: 'blob' });
+    const response = await axiosInstance.get(`/api/v1/download-message/${accountId}/${id}`, { responseType: 'blob' });
    const blob = new Blob([response.data]);
    saveAs(blob, `${id}.eml`);
+};
+
+
+
+export const restore_message = async (accountId: number, messageIds: number[]) => {
+    const response = await axiosInstance.post(`/api/v1/restore-messages/${accountId}`, {
+        message_ids: messageIds,
+    });
+    return response.data;
 };
--- a/web/src/api/system/api.ts
+++ b/web/src/api/system/api.ts
@@ -18,7 +18,6 @@


 import axiosInstance from "@/api/axiosInstance";
-import { Proxy } from "@/features/settings/proxy/data/schema";

 export interface Release {
    tag_name: string;
@@ -73,6 +72,34 @@ export interface LargestEmail {
    size_bytes: number;     // Email size in bytes
 }

+export interface Proxy {
+    id: number;
+    url: string;
+    created_at: number;
+    updated_at: number;
+}
+
+export type ServerConfigurations = {
+    bichon_log_level: string
+    bichon_http_port: number
+    bichon_bind_ip?: string | null
+    bichon_public_url: string
+    bichon_cors_origins?: string[] | null
+    bichon_cors_max_age: number
+    bichon_ansi_logs: boolean
+    bichon_log_to_file: boolean
+    bichon_json_logs: boolean
+    bichon_max_server_log_files: number
+    bichon_encrypt_password_set: boolean
+    bichon_webui_token_expiration_hours: number
+    bichon_root_dir: string
+    bichon_metadata_cache_size?: number | null
+    bichon_envelope_cache_size?: number | null
+    bichon_enable_rest_https: boolean
+    bichon_http_compression_enabled: boolean
+    bichon_sync_concurrency?: number | null
+}
+
 export const get_dashboard_stats = async () => {
    const response = await axiosInstance.get<DashboardStats>(`/api/v1/dashboard-stats`);
    return response.data;
@@ -104,4 +131,10 @@ export const add_proxy = async (url: string) => {
        },
    });
    return response.data;
+};
+
+
+export const get_system_configurations = async () => {
+    const response = await axiosInstance.get<ServerConfigurations>(`/api/v1/system-configurations`);
+    return response.data;
 };
--- a/web/src/api/users/api.ts
+++ b/web/src/api/users/api.ts
@@ -0,0 +1,208 @@
+import axiosInstance from "@/api/axiosInstance";
+
+export type RoleType = 'Global' | 'Account';
+
+export interface UserRole {
+    id: number;
+    name: string;
+    description?: string | null;
+    permissions: string[];
+    is_builtin: boolean;
+    role_type: RoleType;
+    created_at: number;
+    updated_at: number;
+}
+
+export function getPermissions(t: (key: string) => string) {
+    return [
+        // 1. Global Management
+        { label: t('permission.system.access'), value: 'system:access' },
+        { label: t('permission.system.root'), value: 'system:root' },
+        { label: t('permission.user.manage'), value: 'user:manage' },
+        { label: t('permission.user.view'), value: 'user:view' },
+        { label: t('permission.token.manage'), value: 'token:manage' },
+        { label: t('permission.account.create'), value: 'account:create' },
+
+        // 2. Global "ALL" Scoped (Admin)
+        { label: t('permission.account.manage_all'), value: 'account:manage:all' },
+        { label: t('permission.data.read_all'), value: 'data:read:all' },
+        { label: t('permission.data.manage_all'), value: 'data:manage:all' },
+        { label: t('permission.data.raw_download_all'), value: 'data:raw:download:all' },
+        { label: t('permission.data.delete_all'), value: 'data:delete:all' },
+        { label: t('permission.data.export_batch_all'), value: 'data:export:batch:all' },
+
+        // 3. Scoped / Limited
+        { label: t('permission.account.manage'), value: 'account:manage' },
+        { label: t('permission.account.read_details'), value: 'account:read_details' },
+        { label: t('permission.data.read'), value: 'data:read' },
+        { label: t('permission.data.manage'), value: 'data:manage' },
+        { label: t('permission.data.raw_download'), value: 'data:raw:download' },
+        { label: t('permission.data.delete'), value: 'data:delete' },
+        { label: t('permission.data.export_batch'), value: 'data:export:batch' },
+        { label: t('permission.data.import_batch'), value: 'data:import:batch' },
+    ]
+}
+
+export interface RateLimit {
+    quota: number;
+    interval: number;
+}
+
+export interface AccessControl {
+    ip_whitelist?: string[];
+    rate_limit?: RateLimit;
+}
+
+export type TokenType = "WebUI" | "Api";
+
+export interface AccessToken {
+    user_id: number;
+    user_name: string,
+    user_email: string,
+    token: string;
+    created_at: number;
+    updated_at: number;
+    name?: string;
+    last_access_at: number;
+    expire_at?: number | null;
+    token_type: TokenType;
+}
+
+export interface User {
+    id: number;
+    username: string;
+    email: string;
+    password?: string | null;
+    description?: string | null;
+    global_roles: number[];
+    global_roles_names: string[];
+    avatar?: string;
+    acl?: AccessControl;
+    account_access_map: Record<number, number>;
+    account_roles_summary: Record<number, string>;
+    global_permissions: string[]
+    account_permissions: Record<number, string[]>
+    created_at: number;
+    updated_at: number;
+}
+
+type Theme = 'dark' | 'light'
+
+
+export interface LoginResult {
+    success: boolean;
+    error_message?: string | null;
+    access_token?: string | null;
+    theme?: Theme,
+    language?: string,
+}
+
+
+export interface MinimalUser {
+    id: number;
+    username: string;
+    email: string;
+}
+
+
+export const login = async (data: Record<string, any>) => {
+    const response = await axiosInstance.post<LoginResult>(`/api/login`, data);
+    return response.data;
+};
+
+export const reset_admin_token = async () => {
+    const response = await axiosInstance.post("/api/v1/reset-admin-token");
+    return response.data;
+};
+
+export const reset_admin_password = async (password: string) => {
+    const response = await axiosInstance.post("/api/v1/reset-admin-password", password, {
+        headers: {
+            "Content-Type": "text/plain",
+        },
+    });
+    return response.data;
+};
+
+export const list_access_tokens = async () => {
+    const response = await axiosInstance.get<AccessToken[]>("/api/v1/access-token-list");
+    return response.data;
+};
+
+export const create_access_token = async (data: Record<string, any>) => {
+    const response = await axiosInstance.post("/api/v1/access-token", data);
+    return response.data;
+}
+
+export const update_access_token = async (token: string, data: Record<string, any>) => {
+    const response = await axiosInstance.post(`/api/v1/access-token/${token}`, data);
+    return response.data;
+}
+
+export const remove_access_token = async (token: string) => {
+    const response = await axiosInstance.delete(`/api/v1/access-token/${token}`);
+    return response.data;
+}
+
+
+export const list_roles = async () => {
+    const response = await axiosInstance.get<UserRole[]>("/api/v1/list-roles");
+    return response.data;
+};
+
+
+export const remove_role = async (id: number) => {
+    const response = await axiosInstance.delete(`/api/v1/roles/${id}`);
+    return response.data;
+};
+
+
+export const create_role = async (data: Record<string, any>) => {
+    const response = await axiosInstance.post("/api/v1/roles", data);
+    return response.data;
+};
+
+
+export const update_role = async (id: number, data: Record<string, any>) => {
+    const response = await axiosInstance.post(`/api/v1/roles/${id}`, data);
+    return response.data;
+};
+
+
+export const list_users = async () => {
+    const response = await axiosInstance.get<User[]>("/api/v1/list-users");
+    return response.data;
+};
+
+
+export const list_minimal_users = async () => {
+    const response = await axiosInstance.get<MinimalUser[]>("/api/v1/minimal-user-list");
+    return response.data;
+};
+
+export const remove_user = async (id: number) => {
+    const response = await axiosInstance.delete(`/api/v1/users/${id}`);
+    return response.data;
+};
+
+
+export const create_user = async (data: Record<string, any>) => {
+    const response = await axiosInstance.post("/api/v1/users", data);
+    return response.data;
+};
+
+
+export const update_user = async (id: number, data: Record<string, any>) => {
+    const response = await axiosInstance.post(`/api/v1/users/${id}`, data);
+    return response.data;
+};
+
+export const get_user_tokens = async (id: number) => {
+    const response = await axiosInstance.get<AccessToken[]>(`/api/v1/user-tokens/${id}`);
+    return response.data;
+};
+
+export const get_current_user = async () => {
+    const response = await axiosInstance.get<User>("/api/v1/current-user");
+    return response.data;
+};
--- a/web/src/components/api-docs.tsx
+++ b/web/src/components/api-docs.tsx
@@ -22,10 +22,11 @@ import { FixedHeader } from "./layout/fixed-header";
 import { Main } from "./layout/main";
 import Logo from '@/assets/logo.svg'
 import { useTranslation } from 'react-i18next'
+import { Separator } from "./ui/separator";

 export default function APIDocs() {
  const { t } = useTranslation()
-  
+
  const docsOptions = [
    { name: t('apiDocs.swaggerUI'), path: "/api-docs/swagger" },
    { name: t('apiDocs.reDoc'), path: "/api-docs/redoc" },
@@ -51,6 +52,7 @@ export default function APIDocs() {
            </p>
          </div>
        </div>
+        <Separator className='mt-2 mb-4 lg:mt-3 lg:mb-6' />
        <div className='-mx-4 flex-1 overflow-auto px-4 py-1 flex-row lg:space-x-12 space-y-0'>
          <div className='m-auto flex h-full w-full flex-col items-center justify-center gap-6 p-4'>
            <div className="grid w-full gap-4 sm:grid-cols-1 md:grid-cols-2 xl:max-w-4xl">
--- a/web/src/components/confirm-dialog.tsx
+++ b/web/src/components/confirm-dialog.tsx
@@ -29,6 +29,7 @@ import {
 } from '@/components/ui/alert-dialog'
 import { Button } from '@/components/ui/button'
 import { useTranslation } from 'react-i18next'
+import { Loader2 } from 'lucide-react'

 interface ConfirmDialogProps {
  open: boolean
@@ -79,6 +80,7 @@ export function ConfirmDialog(props: ConfirmDialogProps) {
            onClick={handleConfirm}
            disabled={disabled || isLoading}
          >
+            {isLoading && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
            {confirmText ?? t('dialogs.continue')}
          </Button>
        </AlertDialogFooter>
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
rustmailer	55e97510c4	fix: Folder limit cannot be empty #97	2026-01-05 21:32:00 +08:00
rustmailer	0bf2003670	chore(release): package bichonctl together with bichon binaries	2026-01-05 18:38:34 +08:00
rustmailer	e56fe5ebea	feat(mailbox): support mailbox cleanup #96	2026-01-05 18:27:40 +08:00
rustmailer	c69ada32ef	feat(ui): add clickable logo to redirect to homepage #95	2026-01-05 14:31:47 +08:00
rustmailer	3f4b37be17	feat(cli): add interactive email import tool for EML, MBOX, and Thunderbird - Implement `bichonctl` interactive CLI using `dialoguer`. - Support recursive EML directory scanning with folder structure preservation. - Support single MBOX file streaming import. - Support Thunderbird profile import with automatic `.sbd` hierarchy detection. - Add batch processing (Base64 encoding & batch API requests) for improved performance.	2026-01-05 14:31:04 +08:00
rustmailer	09375ee11c	fix: #94	2026-01-01 20:28:23 +08:00
rustmailer	b2e43b0907	fix: skip default admin role validation when global_roles is None #93	2026-01-01 15:24:51 +08:00
rustmailer	44fc0e15de	bump versions	2025-12-31 22:57:31 +08:00
rustmailer	ef891b20c3	fix(account): update sync range and handle all-mode reset	2025-12-31 22:57:20 +08:00
rustmailer	a6216c2ce6	feat: support restoring single message to IMAP #77	2025-12-31 22:56:06 +08:00
rustmailer	1c58b516dd	update sign-out dialog	2025-12-31 02:44:43 +08:00
rustmailer	ae916574de	Fix: modifying the admin user	2025-12-31 02:43:57 +08:00
rustmailer	14fb3368a3	udpate locales files	2025-12-31 02:40:58 +08:00
rustmailer	f49929dd67	Update message.rs	2025-12-30 22:41:51 +08:00
rustmailer	97143d55b8	Merge pull request #67 from mmaudet/feat/envelope-endpoint-and-api-improvements feat(api): Add envelope endpoint and improve API documentation	2025-12-30 22:32:26 +08:00
rustmailer	e666f76d87	Merge branch 'main' into feat/envelope-endpoint-and-api-improvements	2025-12-30 22:32:11 +08:00
rustmailer	7fb6575f8d	feat: use email 'Date' header for statistics and search filtering #87	2025-12-30 22:21:53 +08:00
rustmailer	fb0be8c5d1	bump version to 0.2.1	2025-12-30 15:11:57 +08:00
rustmailer	455e6b1a75	feat: support user appearance preferences with persisted theme and language #85	2025-12-30 15:09:41 +08:00
rustmailer	75cae51be9	feat(ui): Add quick page navigation to the email list pagination #85	2025-12-30 11:40:09 +08:00
rustmailer	62d956c7d6	feat: increase password max to 256, fix i18n, and force re-login #83 - Raise password maximum length from 32 to 256 characters - fix profileSchema to accept `t` for proper internationalization - Invalidate user's WebUI token on password change, requiring re-login	2025-12-30 11:05:07 +08:00
rustmailer	c01872284e	Update release.yml	2025-12-29 12:41:15 +08:00
rustmailer	2887b5d16d	Update release.yml	2025-12-29 12:37:51 +08:00
rustmailer	558ea2f9b0	Update release.yml	2025-12-29 12:25:05 +08:00
rustmailer	b07defa2d5	Update README.md	2025-12-29 12:22:05 +08:00
rustmailer	76ab16b55b	fetch: support fetching mails before a specified date	2025-12-29 12:06:04 +08:00
rustmailer	06a126461b	feat: Replace min/max byte inputs with size preset selection #39	2025-12-28 13:54:35 +08:00
rustmailer	a02bb65ca0	feat: Search results display the account email and mailbox name. #39	2025-12-28 13:20:21 +08:00
rustmailer	1f57f372d3	feat: Add sync_batch_size to allow users to customize the synchronization batch size, and introduce date_before to support semantics such as downloading emails from more than one year ago. #24 #58	2025-12-28 13:01:34 +08:00
rustmailer	b35493e4e1	chore(search ui): Quick selection of year and month #39	2025-12-28 12:58:30 +08:00
rustmailer	16578fb8e2	fix: stitch adjacent RFC2047 words to prevent byte-split artifacts #79	2025-12-27 03:38:53 +08:00
rustmailer	6dd3f90ee0	update	2025-12-26 20:04:31 +08:00
rustmailer	6d11dcd33f	Merge pull request #65 from mmaudet/fix/rename-id-to-message-id fix(api): Rename id to message_id and fix OpenAPI path parameters	2025-12-26 20:00:48 +08:00
rustmailer	e64c2467fd	Merge branch 'main' into fix/rename-id-to-message-id	2025-12-26 19:59:25 +08:00
rustmailer	e8a15695d8	feat(ui): add i18n support for profile dropdown	2025-12-26 14:45:43 +08:00
rustmailer	0f3ad83004	feat: use password file as primary source if provided	2025-12-26 14:44:49 +08:00
rustmailer	4af5176b65	feat: add multi-user support and role-based access control #31	2025-12-26 14:27:04 +08:00
rustmailer	1e2f526a07	fix: ensure unselected checkboxes are visible in dark mode #70	2025-12-26 14:17:55 +08:00
rustmailer	97be76278e	Merge pull request #71 from metlos/encrypt-password-file feat(cli): add an option to specify the encrypt password in a file	2025-12-20 19:45:55 +08:00
rustmailer	d4232789f9	Add roadmap section to README #76 Added a roadmap section outlining future features and enhancements.	2025-12-20 18:59:52 +08:00
Lukas Krejci	9b83d5617e	feat(cli): add an option to specify the encrypt password in a file	2025-12-17 18:03:00 +01:00
Michel-Marie MAUDET	70db81dc03	feat(api): Add envelope endpoint and improve API documentation - Add GET /envelope/{account_id}/{message_id} endpoint to retrieve message envelope (metadata) - Add get_envelope_by_id method to ENVELOPE_INDEX_MANAGER for querying single envelope - Move message_id from query parameter to path parameter for clearer API paths: - /message-content/{account_id}/{message_id} - /download-message/{account_id}/{message_id} - /download-attachment/{account_id}/{message_id} - /envelope/{account_id}/{message_id} - Fix API documentation descriptions to be more accurate: - search_messages: Now correctly describes search functionality - get_thread_messages: Mentions thread_id requirement - proxy endpoints: Fixed copy-paste errors from OAuth2 docs - Update frontend API client to use new path-based URLs 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2025-12-14 11:12:16 +01:00
Michel-Marie MAUDET	6b18d7371d	fix(api): Use poem_openapi::param::Path for OpenAPI documentation - Fix Path import in message.rs, account.rs, mailbox.rs, oauth2.rs, and auto_config.rs to use poem_openapi::param::Path instead of poem::web::Path - This ensures path parameters appear in OpenAPI/Swagger documentation - Update frontend API calls to use message_id parameter - Add parameter documentation comments for better API clarity 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2025-12-14 09:33:18 +01:00
Michel-Marie MAUDET	934e81c5f9	fix(api): Rename query parameter `id` to `message_id` for clarity Rename the `id` query parameter to `message_id` in three message API endpoints for better API clarity and consistency: - GET /api/v1/message-content/:account_id - GET /api/v1/download-message/:account_id - GET /api/v1/download-attachment/:account_id This is a breaking change for API clients that use these endpoints. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2025-12-14 08:02:02 +01:00
rustmailer	c05a8944ef	Merge pull request #57 from pansuzuki/lang-pack-pl Added new language Polish	2025-12-10 23:13:04 +08:00
Marcin Wojtczak	eaff2ca70d	Added new language Polish	2025-12-10 00:21:16 +01:00
rustmailer	000d144e70	chore(ui): Adjust width of account list for better visibility	2025-12-08 03:43:00 +08:00
rustmailer	20970b4fb6	Feat: Add IMAP connection pool status logging and disable bb8 idle timeout	2025-12-08 03:41:56 +08:00
rustmailer	57df3466e7	Update extractor.rs	2025-12-08 02:18:34 +08:00
rustmailer	75d859abdf	fix(sync): error in account sync task "TooNarrow" #38	2025-12-08 01:30:46 +08:00
rustmailer	b0412b02f5	Add user case showcase and performance data overview Added a user case showcase highlighting performance and storage efficiency with data from 126 email accounts.	2025-12-07 23:22:54 +08:00
rustmailer	a1453f3cda	Document environment variable quotes in container usage Added notes on running Bichon in a container to README.	2025-12-07 00:42:10 +08:00
rustmailer	9e656b1f91	Bump version from 0.1.3 to 0.1.4	2025-12-07 00:22:41 +08:00
rustmailer	afac192280	Enhance CORS configuration section in README Added detailed CORS configuration instructions for Bichon, including new behavior in v0.1.4 and examples for setting origins.	2025-12-07 00:22:07 +08:00
rustmailer	c00ffe8d11	feat(cors): remove default value for BICHON_CORS_ORIGINS and allow all origins when unset - Changed behavior so that when BICHON_CORS_ORIGINS is not configured, CORS now allows any origin. - Added debug logging to print incoming Origin and configured origins to help users diagnose CORS misconfiguration issues.	2025-12-07 00:03:21 +08:00
rustmailer	c90a2d552d	Fix FAQ link in README.md	2025-12-06 22:04:35 +08:00
rustmailer	a4627a63cb	Update README.md	2025-12-06 22:03:36 +08:00
rustmailer	684b9765fe	Update README.md	2025-12-06 20:33:51 +08:00
rustmailer	b0ce7671a8	chore(ui): move name field to step 2 #30	2025-12-04 08:33:16 +08:00
rustmailer	4b13bf14c4	Fix(sync): missing initial sync start time after enabling a previously disabled account #32	2025-12-03 20:11:19 +08:00
rustmailer	0015192b4d	bump version to 0.1.3	2025-12-03 09:27:17 +08:00
rustmailer	2f3acdd759	fix(ui, config): Ensure use_dangerous status is visible in ui	2025-12-03 09:26:34 +08:00
rustmailer	0fc83b693e	fix(i18n, dashboard): Internationalize recent activity chart dates	2025-12-03 09:23:51 +08:00
rustmailer	9ba56ca5bb	feat(i18n): Implement internationalization for date distance	2025-12-03 09:23:16 +08:00
rustmailer	8f7244ccb9	fix(account): Resolve name clearing issue and update field labels	2025-12-03 09:21:33 +08:00
rustmailer	454950374f	feat(account): Prioritize dedicated name field for IMAP authentication username #28 Refactor account authentication logic to prioritize the `name` field over the `email` field during the IMAP connection phase. - The `name` field now serves as the primary IMAP login credential and is no longer treated purely as an optional, descriptive field. - If the `name` field is empty or unset, the system will fall back to using the full `email` address for authentication. - This change supports IMAP providers that require a username different from the full email address (e.g., employee ID, specific account name).	2025-12-03 03:48:39 +08:00
rustmailer	3a2b42f5c3	fixZ: Send IMAP ID command after successful authentication to ensure compatibility with 163 mail servers #25	2025-11-30 17:40:10 +08:00