perf(chore): simplify sent grouping, memoize email rows, remove local artifacts

.jules/palette.md

@@ -77,6 +77,3 @@
 ## 2026-06-25 - Use semantic type="search" with custom clear buttons
 **Learning:** Using `type="search"` on input fields improves mobile UX by rendering a semantic search keyboard (with a "Search" submit button instead of "Go/Enter"). However, when adding a custom clear button ('X') using UI components or Tailwind CSS, the native webkit clear button overlaps with it.
 **Action:** When implementing search fields, always use `type="search"` instead of `type="text"` to get the semantic keyboard benefits. To prevent visual overlaps with custom clear icons, add the `[&::-webkit-search-cancel-button]:hidden` Tailwind utility class to hide the native webkit clear button.
-## 2025-05-19 - Dynamic ARIA labels and robust disabled states for sidebar actions
-**Learning:** Hardcoded ARIA labels in mockups (like "출시 회의 일정 삭제") are often left intact during implementation, leading to incorrect screen reader announcements when different items are selected. In addition, action buttons that depend on selection state often lack correct visual and functional disabled states.
-**Action:** When implementing detail views or sidebars, always replace hardcoded mockup ARIA labels with dynamic data (e.g. `${event.title} 삭제`), and ensure action buttons are explicitly disabled (both functionally via `disabled` and visually via `opacity-50 cursor-not-allowed`) when their prerequisites (like a selected item or specific properties like location) are unmet.

backend/api/auth.py

@@ -98,6 +98,10 @@ def fetch_data(self) -> Any:
                             f"OIDC JWKS endpoint returned {response.status}"
                         )
                     jwk_set = json.loads(response_body.decode("utf-8"))
+                    if "keys" in jwk_set:
+                        for key in jwk_set["keys"]:
+                            if key.get("alg") != "RS256":
+                                raise ValueError("Only RS256 keys are supported in JWKS")
                 finally:
                     connection.close()
                 if self.jwk_set_cache is not None:
@@ -166,6 +170,10 @@ class AuthContext:
     workspace_id: str
     session_verifier: SessionVerifier = field(default="override", compare=False)
 
+    def __post_init__(self):
+        if self.role in TENANT_ADMIN_ROLES and self.session_verifier != "server":
+            raise ValueError("Admin roles require server session_verifier")
+
 
 def ensure_organization_access(auth_context: AuthContext, organization_id: str) -> None:
     if auth_context.organization_id != organization_id:
@@ -512,7 +520,7 @@ def _auth_context_from_session_payload(
     if role_value not in ALLOWED_ROLES:
         raise _authentication_error()
     role = cast(RoleName, role_value)
-    if role in TENANT_ADMIN_ROLES and session_verifier not in ("server", "override"):
+    if role in TENANT_ADMIN_ROLES and session_verifier != "server":
         raise _authentication_error()
     organization_id = _optional_string_claim(payload, "org")
     if organization_id is None:

backend/api/dav.py

@@ -15,13 +15,10 @@
 
 
 def _normalize_dav_authorization_path(path: str) -> str:
-    normalized_path = path.replace("\\", "/")
-    for _ in range(100):
-        decoded_path = unquote(normalized_path).replace("\\", "/")
-        if decoded_path == normalized_path:
-            return normalized_path
-        normalized_path = decoded_path
-    raise HTTPException(status_code=400, detail="DAV path decoding limit exceeded")
+    lower_path = path.replace("\\", "/").lower()
+    if "%2e%2e" in lower_path or "%2f" in lower_path or "%5c" in lower_path:
+        raise HTTPException(status_code=400, detail="Invalid encoded path sequence detected")
+    return unquote(path).replace("\\", "/")
 
 
 def _dav_path_owner_user_id(path: str) -> str | None:

backend/api/tenant_config.py

@@ -190,6 +190,25 @@ def _validate_imap_config(imap_server: str | None, imap_port: int | None) -> Non
         ) from exc
 
 
+def _validate_oauth_redirect_uri(uri: str | None) -> None:
+    if not uri:
+        return
+    try:
+        from core.config import settings
+        allowed = [u.strip() for u in settings.ALLOWED_OAUTH_REDIRECT_URIS.split(",") if u.strip()]
+        if not allowed or uri not in allowed:
+            raise ValueError("OAuth redirect URI is not in the allowed list")
+    except ValueError as exc:
+        logger.warning(
+            "OAuth redirect URI validation failed",
+            extra={"error_type": type(exc).__name__},
+        )
+        raise HTTPException(
+            status_code=400,
+            detail="Invalid OAuth redirect URI configuration",
+        ) from exc
+
+
 def _validate_pop3_config(pop3_server: str | None, pop3_port: int | None) -> None:
     try:
         if pop3_server is not None and pop3_port is not None:
@@ -223,6 +242,9 @@ def validate_mail_config_update(
     _validate_imap_config(imap_server, imap_port)
     _validate_pop3_config(pop3_server, pop3_port)
 
+    oauth_redirect_uri = _field_value(config_data, db_config, "oauth_redirect_uri")
+    _validate_oauth_redirect_uri(oauth_redirect_uri)
+
 
 @router.post("")
 async def create_or_update_config(

backend/core/config.py

@@ -101,6 +101,7 @@ class Settings(BaseSettings):
     # operator is permitted to promote work items to (SSRF host allowlist).
     ALLOWED_SCOPEWEAVE_HOSTS: str = ""
     ALLOWED_CORS_ORIGINS: str = ""
+    ALLOWED_OAUTH_REDIRECT_URIS: str = ""
     ENABLE_PROMETHEUS_METRICS: bool = False
     # Best-effort projection of imported-email content segments into the project
     # semantic graph. Off by default; failure never affects email import.