Mailbox: a mail client for ProcessWire

[maximus]

Hi everyone!

I’m continuing to explore AI-assisted development—not only generating code, but using AI throughout architecture, security review, testing, documentation and UI work.

Apparently, one side effect is that small personal tasks keep turning into ProcessWire modules. 🙂

After Ryan’s recent interview and weekly update, I can confirm that the mysterious “magic elixir” is still working.

This module, however, started for a much less glamorous reason: I recently left my job and started looking for a new one.

While applying for jobs, I kept receiving messages from Greenhouse and similar recruitment systems. Some emails contain links that need to be opened to confirm an application, schedule an interview or complete another step.

So I thought:

I just need a simple ProcessWire admin page where I can read those emails and open the necessary links.

A perfectly reasonable little task.

Naturally, it became a complete mail client for ProcessWire.

This is probably not the most efficient job-search strategy, but at least there is now a new module. 😄

About Mailbox

Mailbox adds a secure mail workspace and integration layer to the ProcessWire admin.

It is designed for ProcessWire sites that need email inside an editorial, support or operational workflow without turning the CMS into an unrestricted public webmail server.

The module currently supports:

• up to three IMAP/SMTP accounts;
• switching between accounts from the admin interface;
• password and app-password authentication;
• Google and Microsoft OAuth2/XOAUTH2;
• IMAP folders and message pagination;
• search and advanced filters;
• HTML, text and raw message views;
• attachment downloads;
• read and unread status;
• bulk message actions;
• moving and deleting messages;
• replies and forwarding through SMTP;
• encrypted credentials, message cache and local index;
• presets for popular hosted and self-hosted mail services;
• PHP API, same-origin REST API and local CLI;
• optional AI summaries and reply drafts through Squad;
• controlled confirmation-link workflows;
• optional integration boundaries for Tickets, Verk and Kontor.

Provider presets

Mailbox includes editable presets for: Gmail, Microsoft 365 and Outlook, iCloud, Yahoo, Fastmail, Zoho, Proton Bridge, HestiaCP, VestaCP, Poste.io, iRedMail, CyberPanel, Mail-in-a-Box, Modoboa, cPanel, Plesk, DirectAdmin, Dovecot, Stalwart, custom IMAP/SMTP servers.

The presets are starting points rather than a guarantee that a server is reachable. IMAP and SMTP connections can be tested independently from the account screen.

Admin interface

Mailbox adds four sections under Setup → Mailbox:

• Mailbox — folders, search, messages, reader and message actions;
• Discover settings — credential-free discovery of possible server settings;
• Accounts — configuration for up to three mailboxes;
• Runtime — installation and diagnostics for optional PHP mail packages.

The interface supports:

• light and dark themes;
• a persistent collapsible folder sidebar;
• responsive message tables;
• encrypted local caching to avoid waiting for IMAP on every request;
• translated admin interfaces for German, French, Italian, Spanish and Dutch.

Security

Because this module handles real mail credentials and potentially sensitive messages, security became a major part of the project.

Usernames, passwords and OAuth tokens are stored in a dedicated encrypted database table. Passwords and tokens are never rendered back into configuration forms.

Message HTML is sanitized on the server and displayed inside a sandboxed, credentialless and CSP-restricted iframe. Scripts, forms, frames, event handlers, active links and remote images are blocked by default.

Remote images and external links can be enabled separately after acknowledging their privacy implications. External links use a strict no-referrer policy so the destination does not receive the ProcessWire admin URL.

Attachments, message mutations, sending, API access, AI processing and confirmation workflows also have separate settings and permissions.

Mailbox is intentionally conservative by default. Installing the module does not automatically enable sending, remote content, AI processing or automated link confirmation.

AI and integrations

AI support is optional. Mailbox works as a regular mail client without an AI provider.

When Squad is installed and configured, Mailbox can request a message summary or prepare a reply draft. AI cannot automatically send a message, approve an action or execute a confirmation link. A human remains in control.

The module also provides integration boundaries for Tickets, Verk and Kontor, along with PHP, REST and CLI access for custom applications and agents.

Requirements

• ProcessWire 3.x;
• AdminThemeUikit;
• PHP 8.0.2 or newer;
• PHP JSON and Sodium extensions;
• PHP cURL for OAuth, discovery, webhooks and confirmations;
• Composer for the locked Webklex and PHPMailer packages;
• PHP IMAP extension only when explicitly using the native IMAP engine.

Installation

1. Download or clone the repository.
2. Copy the Mailbox directory into /site/modules/.
3. Refresh modules and install Mailbox.
4. Add a dedicated $config->mailboxSecret before storing production credentials.
5. Open the Runtime section and install the required mail packages.
6. Configure an account and test IMAP and SMTP independently.
7. Assign only the permissions required by each ProcessWire role.

Download and documentation

GitHub repository:
https://github.com/mxmsmnv/Mailbox

Download ZIP:
https://github.com/mxmsmnv/Mailbox/archive/refs/heads/main.zip

README:
https://github.com/mxmsmnv/Mailbox/blob/main/README.md

API documentation:
https://github.com/mxmsmnv/Mailbox/blob/main/API.md

Security model:
https://github.com/mxmsmnv/Mailbox/blob/main/SECURITY.md

I would be very interested to hear how other ProcessWire developers might use email inside their projects—support tickets, CRM workflows, application processing, automated confirmations, AI agents or something completely different.

Feedback, testing and bug reports are very welcome.

And yes, I am currently looking for a new opportunity.

Apparently, I can build more than a landing page. 🙂