feat: add Docker deployment and Microsoft OAuth support

2026-04-18 14:02:24 +08:00
parent 6704cfb418
commit e69c0dd226
53 changed files with 5139 additions and 4029 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -1,18 +1,25 @@
-# node
-node_modules/
-dist/
-.vite/
-
-# go
-*.exe
-*.test
-/mengpost-backend/mengpost-backend*
-/mengpost-backend/*.db
-/mengpost-backend/*.db-*
-mengpost.db
-mengpost.db-*
-
+# node
+node_modules/
+dist/
+.vite/
+
+# go
+mengpost-backend/.env
+mengpost-backend/.env.docker
+
+# 生产 SQLite 数据文件（保留 data/.gitkeep）
+/data/*.db
+/data/*.db-*
+*.exe
+*.test
+/mengpost-backend/mengpost-backend*
+/mengpost-backend/*.db
+/mengpost-backend/*.db-*
+mengpost.db
+mengpost.db-*
+
 # editors
 .vscode/
 .idea/
 .DS_Store
+.codex
--- a/README.md
+++ b/README.md
@@ -1,154 +1,161 @@
-# 萌邮 MengPost · 多邮箱管理面板
-
-基于 **SMTP / IMAP** 协议的轻量多邮箱管理后台。
-
- 前端: React 18 + Vite + React Router
- 后端: Go 1.22 + Gin + SQLite (`modernc.org/sqlite`, 纯 Go, 无需 CGO)
- 邮件: `gopkg.in/gomail.v2` (SMTP)、`github.com/emersion/go-imap` (IMAP)
- UI: 文档风、简洁, 自适应手机 / 电脑
- 鉴权: 打开站点时若本地未保存密钥，先显示 **访问密钥** 输入框（与后端 `MP_TOKEN` 一致，默认 `shumengya520`）；通过后写入浏览器本地存储，后续请求带 `X-Auth-Token`
-
-## 目录结构
-
-```
-mengpost/
-  dev.bat / dev.sh          # 一键本地开发 (双窗口启动前后端)
-  build.bat / build.sh      # 构建前端
-  mengpost-backend/         # Go + Gin 后端
-    config/                 # 配置(端口/DB/token)
-    database/               # SQLite 初始化 & 迁移
-    models/                 # 数据模型 (accounts / sent_logs)
-    services/               # smtp.go / imap.go
-    middleware/             # token 鉴权中间件
-    handlers/               # HTTP 处理器
-    router/                 # 路由聚合
-    main.go                 # 入口
-  mengpost-frontend/        # React + Vite 前端
-    public/                 # favicon.ico、logo.png 等静态资源
-    src/
-      api/                  # 统一 fetch 封装, token 存 localStorage
-      components/           # AccessGate / MainLayout(侧栏) / Topbar
-      pages/                # Home / Admin / Accounts / Mailbox / Compose
-      styles/global.css
-  scripts/                  # publish-gitea：用 tea 创建远端仓库的辅助脚本
-```
-
-## 本地开发
-
-依赖:
- Go ≥ 1.22、Node.js ≥ 18 (SQLite 使用纯 Go 实现, **无需 CGO / gcc**)
-
-```bash
-# Windows
-dev.bat
-
-# macOS / Linux
-chmod +x dev.sh && ./dev.sh
-```
-
- 前端: http://127.0.0.1:5173
- 后端: http://127.0.0.1:8787 (Vite 已代理 `/api`)
-
-## 构建
-
-```bash
-# Windows
-build.bat
-
-# macOS / Linux
-./build.sh
-```
-
-产物在 `mengpost-frontend/dist`。`npm run preview` 已配置与开发环境相同的 `/api` 代理。
-
-若静态文件与后端**不同源**部署，构建前设置 `VITE_API_URL` 指向后端根地址（如 `http://127.0.0.1:8787`），再执行 `build`。
-
-## 环境变量
-
-| 变量名 | 默认值 | 说明 |
-| ---- | ---- | ---- |
-| `MP_PORT`  | `8787`         | 后端 HTTP 端口 |
-| `MP_DB`    | `mengpost.db`  | SQLite 文件路径 |
-| `MP_TOKEN` | `shumengya520` | 访问密钥（与前端输入一致） |
-| `MP_LOG`   | `info`         | 日志级别 |
-
-### 前端 (Vite)
-
-| 变量名 | 说明 |
-| ---- | ---- |
-| `VITE_API_URL` | 可选。留空时请求相对路径 `/api`（开发 / preview 走 Vite 代理）。独立部署静态站时设为后端地址。 |
-
-## 使用
-
-1. 用 `dev.bat` / `dev.sh` 启动后，浏览器打开 **http://127.0.0.1:5173**（勿用 `file://` 打开构建产物）。
-2. 首次访问输入 **访问密钥**（与 `MP_TOKEN` 相同）；顶部可 **登出** 清除本地密钥。
-3. 在「账户」页新增邮箱 (SMTP / IMAP 与授权码)。
-4. 「收件箱」拉取邮件；「写信」发信。
-
-### 常见问题
-
- **未启动后端** 或端口不是 8787：密钥验证会失败或提示无法连接。
- **未通过 Vite 访问**：直接双击 `dist/index.html` 没有 `/api` 代理，需 `npm run preview` 或配置 `VITE_API_URL` 后重新构建。
- **使用了 `@vitejs/plugin-pwa` / Workbox**：勿让 Service Worker 缓存 `/api/*`。开发时可在 DevTools → Application → Service Workers 勾选 **Bypass for network** 或先 **Unregister** 再刷新。
-
-## 常见邮箱参考
-
-| 服务商 | SMTP | IMAP |
-| ---- | ---- | ---- |
-| QQ   | `smtp.qq.com:465` | `imap.qq.com:993` |
-| 163  | `smtp.163.com:465` | `imap.163.com:993` |
-| Gmail | `smtp.gmail.com:465` | `imap.gmail.com:993` |
-| Outlook | `smtp.office365.com:587` | `outlook.office365.com:993` |
-
-> 使用 **应用专用密码 / 授权码**, 不要直接使用邮箱登录密码。
-
-## API 一览
-
-所有受保护接口均需要请求头 `X-Auth-Token: <token>`。
-
-```
-POST   /api/auth/verify                  # 校验 token
-GET    /api/accounts                     # 列出账户
-POST   /api/accounts                     # 新增
-PUT    /api/accounts/:id                 # 更新 (password 为空则保留)
-DELETE /api/accounts/:id                 # 删除
-GET    /api/accounts/:id/mailboxes       # IMAP 邮件夹
-GET    /api/accounts/:id/messages        # 列出邮件摘要 ?mailbox=&limit=
-GET    /api/accounts/:id/messages/:uid   # 邮件详情
-POST   /api/accounts/:id/send            # 发送邮件
-GET    /api/accounts/:id/sent            # 发送日志
-```
-
-## 推送到自建 Gitea（tea CLI）
-
-前置：安装 [tea](https://gitea.com/gitea/tea/releases)，在 Gitea **设置 → 应用 → 生成令牌** 创建访问令牌。
-
-```bash
-# 1. 添加登录（只需一次；将 URL、令牌换成你的实例）
-tea login add --url https://你的Gitea地址 --token <访问令牌> --name mygitea
-tea login default mygitea
-tea whoami
-```
-
-在本项目**根目录**执行：
-
-```bash
-# 2. 在 Gitea 上创建空仓库（名称可改；若已存在同名库请先删除或换名）
-tea repos create --name mengpost --description "萌邮 MengPost：基于 SMTP/IMAP 的多邮箱管理面板（React + Vite + Go + Gin + SQLite）"
-
-# 3. 添加远程并推送（将下面 URL 换成 Gitea 仓库页的 HTTPS 克隆地址）
-git remote add origin https://你的Gitea/用户名/mengpost.git
-git branch -M main
-git push -u origin main
-```
-
-若本地已有 `origin`，可改为：`git remote set-url origin <HTTPS 地址>` 再 `git push -u origin main`。
-
-**辅助脚本**（仅执行第 2 步 `tea repos create`，推送仍需手动 `git remote` + `git push`）：
-
- Windows: `powershell -ExecutionPolicy Bypass -File scripts/publish-gitea.ps1`
- Linux / macOS: `chmod +x scripts/publish-gitea.sh && ./scripts/publish-gitea.sh`
-
-## 许可
-
-内部自用项目, 请按需修改。
+# 萌邮 MengPost · 多邮箱管理面板
+
+基于 **SMTP / IMAP** 协议的轻量多邮箱管理后台。
+
+- 前端: React 18 + Vite + React Router
+- 后端: Go 1.22 + Gin + SQLite (`modernc.org/sqlite`, 纯 Go, 无需 CGO)
+- 邮件: `gopkg.in/gomail.v2` (SMTP)、`github.com/emersion/go-imap` (IMAP)
+- UI: 文档风、简洁, 自适应手机 / 电脑
+- 鉴权: 打开站点时若本地未保存密钥，先显示 **访问密钥** 输入框（与后端 `MP_TOKEN` 一致，默认 `shumengya520`）；通过后写入浏览器本地存储，后续请求带 `X-Auth-Token`
+
+## 目录结构
+
+```
+mengpost/
+  dev.bat / dev.sh          # 一键本地开发 (双窗口启动前后端)
+  build.bat / build.sh      # 构建前端
+  mengpost-backend/         # Go + Gin 后端
+    config/                 # 配置(端口/DB/token)
+    database/               # SQLite 初始化 & 迁移
+    models/                 # 数据模型 (accounts / sent_logs)
+    services/               # smtp.go / imap.go
+    middleware/             # token 鉴权中间件
+    handlers/               # HTTP 处理器
+    router/                 # 路由聚合
+    main.go                 # 入口
+  mengpost-frontend/        # React + Vite 前端
+    public/                 # favicon.ico、logo.png 等静态资源
+    src/
+      api/                  # 统一 fetch 封装, token 存 localStorage
+      components/           # AccessGate / MainLayout(侧栏) / Topbar
+      pages/                # Home / Admin / Accounts / Mailbox / Compose
+      styles/global.css
+  scripts/                  # publish-gitea：用 tea 创建远端仓库的辅助脚本
+```
+
+## 本地开发
+
+依赖:
+- Go ≥ 1.22、Node.js ≥ 18 (SQLite 使用纯 Go 实现, **无需 CGO / gcc**)
+
+```bash
+# Windows
+dev.bat
+
+# macOS / Linux
+chmod +x dev.sh && ./dev.sh
+```
+
+- 前端: http://127.0.0.1:5173
+- 后端: http://127.0.0.1:8787 (Vite 已代理 `/api`)
+
+## 构建
+
+```bash
+# Windows
+build.bat
+
+# macOS / Linux
+./build.sh
+```
+
+产物在 `mengpost-frontend/dist`。`npm run preview` 已配置与开发环境相同的 `/api` 代理。
+
+若静态文件与后端**不同源**部署，构建前设置 `VITE_API_URL` 指向后端根地址（如 `http://127.0.0.1:8787`），再执行 `build`。
+
+## 环境变量
+
+| 变量名 | 默认值 | 说明 |
+| ---- | ---- | ---- |
+| `MP_PORT`  | `8787`         | 后端 HTTP 端口 |
+| `MP_DB`    | `mengpost.db`  | SQLite 文件路径 |
+| `MP_TOKEN` | `shumengya520` | 访问密钥（与前端输入一致） |
+| `MP_LOG`   | `info`         | 日志级别 |
+
+### 前端 (Vite)
+
+| 变量名 | 说明 |
+| ---- | ---- |
+| `VITE_API_URL` | 可选。留空时请求相对路径 `/api`（开发 / preview 走 Vite 代理）。独立部署静态站时设为后端地址。 |
+
+## 使用
+
+1. 用 `dev.bat` / `dev.sh` 启动后，浏览器打开 **http://127.0.0.1:5173**（勿用 `file://` 打开构建产物）。
+2. 首次访问输入 **访问密钥**（与 `MP_TOKEN` 相同）；顶部可 **登出** 清除本地密钥。
+3. 在「账户」页新增邮箱 (SMTP / IMAP 与授权码)。
+4. 「收件箱」拉取邮件；「写信」发信。
+
+### 常见问题
+
+- **未启动后端** 或端口不是 8787：密钥验证会失败或提示无法连接。
+- **未通过 Vite 访问**：直接双击 `dist/index.html` 没有 `/api` 代理，需 `npm run preview` 或配置 `VITE_API_URL` 后重新构建。
+- **使用了 `@vitejs/plugin-pwa` / Workbox**：勿让 Service Worker 缓存 `/api/*`。开发时可在 DevTools → Application → Service Workers 勾选 **Bypass for network** 或先 **Unregister** 再刷新。
+
+## 常见邮箱参考
+
+| 服务商 | SMTP | IMAP |
+| ---- | ---- | ---- |
+| QQ   | `smtp.qq.com:465` | `imap.qq.com:993` |
+| 163  | `smtp.163.com:465` | `imap.163.com:993` |
+| Gmail | `smtp.gmail.com:465` | `imap.gmail.com:993` |
+| Outlook / Hotmail（微软个人邮箱） | `smtp.office365.com:587`（STARTTLS） | `outlook.office365.com:993`（SSL） |
+
+> 使用 **应用专用密码 / 授权码**, 不要直接使用邮箱登录密码。
+
+### 微软 Outlook / Hotmail / Live（2026说明）
+
+- **IMAP 默认关闭**：登录 [outlook.live.com](https://outlook.live.com) → 设置 → 邮件 → 同步电子邮件，开启 **IMAP**（不同界面可能为「POP和 IMAP」）。
+- **服务器**：收信 `outlook.office365.com:993`（SSL/TLS），发信 `smtp.office365.com:587`（**STARTTLS**，勿填 465 除非你知道在做什么）。萌邮账户弹窗内可点 **「微软 Outlook / Hotmail」** 一键填入。
+- **身份验证**：微软正推动 **新式验证（OAuth 2.0）**，传统 **用户名+密码（基础认证）** 在 **SMTP AUTH** 等场景将逐步停用（约 2026 年）。当前萌邮仍使用「应用密码 / 仍有效的账户密码」走基础认证；若发信被拒，需改用支持微软 OAuth 的客户端，或等待后续版本接入 OAuth。
+- **后端**：对 `@outlook.com`、`@hotmail.com`、`@live.com`、`@msn.com` 会自动使用合适的 TLS `ServerName`，并在 IMAP/SMTP 报错时附加简要排查说明。
+
+## API 一览
+
+所有受保护接口均需要请求头 `X-Auth-Token: <token>`。
+
+```
+POST   /api/auth/verify                  # 校验 token
+GET    /api/accounts                     # 列出账户
+POST   /api/accounts                     # 新增
+PUT    /api/accounts/:id                 # 更新 (password 为空则保留)
+DELETE /api/accounts/:id                 # 删除
+GET    /api/accounts/:id/mailboxes       # IMAP 邮件夹
+GET    /api/accounts/:id/messages        # 列出邮件摘要 ?mailbox=&limit=
+GET    /api/accounts/:id/messages/:uid   # 邮件详情
+POST   /api/accounts/:id/send            # 发送邮件
+GET    /api/accounts/:id/sent            # 发送日志
+```
+
+## 推送到自建 Gitea（tea CLI）
+
+前置：安装 [tea](https://gitea.com/gitea/tea/releases)，在 Gitea **设置 → 应用 → 生成令牌** 创建访问令牌。
+
+```bash
+# 1. 添加登录（只需一次；将 URL、令牌换成你的实例）
+tea login add --url https://你的Gitea地址 --token <访问令牌> --name mygitea
+tea login default mygitea
+tea whoami
+```
+
+在本项目**根目录**执行：
+
+```bash
+# 2. 在 Gitea 上创建空仓库（名称可改；若已存在同名库请先删除或换名）
+tea repos create --name mengpost --description "萌邮 MengPost：基于 SMTP/IMAP 的多邮箱管理面板（React + Vite + Go + Gin + SQLite）"
+
+# 3. 添加远程并推送（将下面 URL 换成 Gitea 仓库页的 HTTPS 克隆地址）
+git remote add origin https://你的Gitea/用户名/mengpost.git
+git branch -M main
+git push -u origin main
+```
+
+若本地已有 `origin`，可改为：`git remote set-url origin <HTTPS 地址>` 再 `git push -u origin main`。
+
+**辅助脚本**（仅执行第 2 步 `tea repos create`，推送仍需手动 `git remote` + `git push`）：
+
+- Windows: `powershell -ExecutionPolicy Bypass -File scripts/publish-gitea.ps1`
+- Linux / macOS: `chmod +x scripts/publish-gitea.sh && ./scripts/publish-gitea.sh`
+
+## 许可
+
+内部自用项目, 请按需修改。
--- a/build.bat
+++ b/build.bat
@@ -1,16 +1,16 @@
-@echo off
-rem 构建前端静态产物到 mengpost-frontend\dist
-setlocal
-set ROOT=%~dp0
-cd /d %ROOT%mengpost-frontend
-if not exist node_modules (
-    call npm install || goto :err
-)
-call npm run build || goto :err
-echo.
-echo  前端已构建: %ROOT%mengpost-frontend\dist
-endlocal & exit /b 0
-
-:err
-echo 构建失败
-endlocal & exit /b 1
+@echo off
+rem 构建前端静态产物到 mengpost-frontend\dist
+setlocal
+set ROOT=%~dp0
+cd /d %ROOT%mengpost-frontend
+if not exist node_modules (
+    call npm install || goto :err
+)
+call npm run build || goto :err
+echo.
+echo  前端已构建: %ROOT%mengpost-frontend\dist
+endlocal & exit /b 0
+
+:err
+echo 构建失败
+endlocal & exit /b 1
--- a/build.sh
+++ b/build.sh
@@ -1,9 +1,9 @@
-#!/usr/bin/env bash
-# 构建前端静态产物到 mengpost-frontend/dist
-set -e
-ROOT="$(cd "$(dirname "$0")" && pwd)"
-cd "$ROOT/mengpost-frontend"
-[ -d node_modules ] || npm install
-npm run build
-echo ""
-echo "  前端已构建: $ROOT/mengpost-frontend/dist"
+#!/usr/bin/env bash
+# 构建前端静态产物到 mengpost-frontend/dist
+set -e
+ROOT="$(cd "$(dirname "$0")" && pwd)"
+cd "$ROOT/mengpost-frontend"
+[ -d node_modules ] || npm install
+npm run build
+echo ""
+echo "  前端已构建: $ROOT/mengpost-frontend/dist"
--- a/data/.gitkeep
+++ b/data/.gitkeep
--- a/dev.bat
+++ b/dev.bat
@@ -1,13 +1,13 @@
-@echo off
-rem 一键启动本地开发: 后端 Go 和 前端 Vite, 各自独立窗口.
-setlocal
-set ROOT=%~dp0
-
-start "mengpost-backend"  cmd /k "cd /d %ROOT%mengpost-backend && go mod tidy && go run ."
-start "mengpost-frontend" cmd /k "cd /d %ROOT%mengpost-frontend && (if not exist node_modules npm install) && npm run dev"
-
-echo.
-echo  backend : http://127.0.0.1:8787
-echo  frontend: http://127.0.0.1:5173
-echo.
-endlocal
+@echo off
+rem 一键启动本地开发: 后端 Go 和 前端 Vite, 各自独立窗口.
+setlocal
+set ROOT=%~dp0
+
+start "mengpost-backend"  cmd /k "cd /d %ROOT%mengpost-backend && go mod tidy && go run ."
+start "mengpost-frontend" cmd /k "cd /d %ROOT%mengpost-frontend && (if not exist node_modules npm install) && npm run dev"
+
+echo.
+echo  backend : http://127.0.0.1:8787
+echo  frontend: http://127.0.0.1:5173
+echo.
+endlocal
--- a/dev.sh
+++ b/dev.sh
@@ -1,16 +1,16 @@
-#!/usr/bin/env bash
-# 一键启动本地开发: 后端 Go 和 前端 Vite. Ctrl-C 同时退出.
-set -e
-ROOT="$(cd "$(dirname "$0")" && pwd)"
-
-cleanup() { kill 0 2>/dev/null || true; }
-trap cleanup EXIT INT TERM
-
-( cd "$ROOT/mengpost-backend"  && go mod tidy && go run . ) &
-( cd "$ROOT/mengpost-frontend" && { [ -d node_modules ] || npm install; } && npm run dev ) &
-
-echo ""
-echo "  backend : http://127.0.0.1:8787"
-echo "  frontend: http://127.0.0.1:5173"
-echo ""
-wait
+#!/usr/bin/env bash
+# 一键启动本地开发: 后端 Go 和 前端 Vite. Ctrl-C 同时退出.
+set -e
+ROOT="$(cd "$(dirname "$0")" && pwd)"
+
+cleanup() { kill 0 2>/dev/null || true; }
+trap cleanup EXIT INT TERM
+
+( cd "$ROOT/mengpost-backend"  && go mod tidy && go run . ) &
+( cd "$ROOT/mengpost-frontend" && { [ -d node_modules ] || npm install; } && npm run dev ) &
+
+echo ""
+echo "  backend : http://127.0.0.1:8787"
+echo "  frontend: http://127.0.0.1:5173"
+echo ""
+wait
--- a/mengpost-backend/.dockerignore
+++ b/mengpost-backend/.dockerignore
@@ -0,0 +1,11 @@
+.git
+.env
+.env.*
+*.md
+*.db
+*.db-*
+data/
+dist/
+__debug_bin
+*.exe
+*.test
--- a/mengpost-backend/Dockerfile
+++ b/mengpost-backend/Dockerfile
@@ -0,0 +1,24 @@
+# 多阶段构建，纯 Go（CGO_ENABLED=0）+ modernc.org/sqlite，适合 Alpine运行。
+# 对外映射建议：主机 28088 ->容器 8088（见 docker-compose.yml）。
+FROM golang:alpine AS build
+WORKDIR /src
+RUN apk add --no-cache git
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+ENV CGO_ENABLED=0
+RUN go build -trimpath -ldflags="-s -w" -o /out/mengpost-api .
+
+FROM alpine:3.21
+RUN apk add --no-cache ca-certificates tzdata
+ENV TZ=Asia/Shanghai
+WORKDIR /app
+RUN mkdir -p /app/data
+COPY --from=build /out/mengpost-api /app/mengpost-api
+
+ENV GIN_MODE=release
+ENV MP_PORT=8088
+ENV MP_DB=/app/data/mengpost.db
+
+EXPOSE 8088
+ENTRYPOINT ["/app/mengpost-api"]
--- a/mengpost-backend/config/config.go
+++ b/mengpost-backend/config/config.go
@@ -1,30 +1,47 @@
-package config
-
-import (
-	"os"
-)
-
-// Config 存放运行期配置, 所有值均可通过环境变量覆盖.
-type Config struct {
-	Port     string // HTTP 监听端口
-	DBPath   string // SQLite 数据库路径
-	Token    string // 管理员访问 token
-	LogLevel string
-}
-
-// Load 读取环境变量生成配置, 未设置时使用默认值.
-func Load() *Config {
-	return &Config{
-		Port:     env("MP_PORT", "8787"),
-		DBPath:   env("MP_DB", "mengpost.db"),
-		Token:    env("MP_TOKEN", "shumengya520"),
-		LogLevel: env("MP_LOG", "info"),
-	}
-}
-
-func env(k, def string) string {
-	if v := os.Getenv(k); v != "" {
-		return v
-	}
-	return def
-}
+package config
+
+import (
+	"os"
+)
+
+// Config 存放运行期配置, 所有值均可通过环境变量覆盖.
+type Config struct {
+	Port     string // HTTP 监听端口
+	DBPath   string // SQLite 数据库路径
+	Token    string // 管理员访问 token
+	LogLevel string
+	// 微软 OAuth（个人 Outlook/Hotmail）；MP_MS_CLIENT_ID 非空则启用
+	MSClientID     string
+	MSClientSecret string
+	MSRedirectURL  string // 须与 Azure 应用重定向 URI 完全一致，默认本机回调
+	FrontendURL    string // OAuth 完成后浏览器跳回的前端根地址
+	// CORS：MP_CORS_ORIGINS 为空或 * 时允许任意 Origin；否则为英文逗号分隔的来源列表
+	CORSAllowOrigins string
+}
+
+// Load 读取环境变量生成配置, 未设置时使用默认值.
+func Load() *Config {
+	return &Config{
+		Port:           env("MP_PORT", "8787"),
+		DBPath:         env("MP_DB", "mengpost.db"),
+		Token:          env("MP_TOKEN", "shumengya520"),
+		LogLevel:       env("MP_LOG", "info"),
+		MSClientID:     env("MP_MS_CLIENT_ID", ""),
+		MSClientSecret: env("MP_MS_CLIENT_SECRET", ""),
+		MSRedirectURL: env("MP_MS_OAUTH_REDIRECT", "http://127.0.0.1:8787/api/oauth/microsoft/callback"),
+		FrontendURL:      env("MP_FRONTEND_URL", "http://127.0.0.1:5173"),
+		CORSAllowOrigins: env("MP_CORS_ORIGINS", "*"),
+	}
+}
+
+// MicrosoftOAuthEnabled 是否配置了微软 OAuth（需同时配置 Client ID）.
+func (c *Config) MicrosoftOAuthEnabled() bool {
+	return c.MSClientID != ""
+}
+
+func env(k, def string) string {
+	if v := os.Getenv(k); v != "" {
+		return v
+	}
+	return def
+}
--- a/mengpost-backend/database/db.go
+++ b/mengpost-backend/database/db.go
@@ -1,59 +1,78 @@
-package database
-
-import (
-	"database/sql"
-	"log"
-
-	_ "modernc.org/sqlite"
-)
-
-var DB *sql.DB
-
-// Init 打开 SQLite 并执行必要的表结构初始化.
-// 使用纯 Go 的 modernc.org/sqlite, 无需 CGO.
-func Init(path string) {
-	dsn := "file:" + path + "?_pragma=busy_timeout(5000)&_pragma=journal_mode(WAL)&_pragma=foreign_keys(1)"
-	db, err := sql.Open("sqlite", dsn)
-	if err != nil {
-		log.Fatalf("open sqlite: %v", err)
-	}
-	DB = db
-	if err := migrate(); err != nil {
-		log.Fatalf("migrate: %v", err)
-	}
-}
-
-// migrate 创建所需表. 统一放在一处便于维护.
-func migrate() error {
-	stmts := []string{
-		`CREATE TABLE IF NOT EXISTS accounts (
-            id         INTEGER PRIMARY KEY AUTOINCREMENT,
-            name       TEXT NOT NULL,
-            email      TEXT NOT NULL UNIQUE,
-            password   TEXT NOT NULL,
-            smtp_host  TEXT NOT NULL,
-            smtp_port  INTEGER NOT NULL,
-            imap_host  TEXT NOT NULL,
-            imap_port  INTEGER NOT NULL,
-            use_tls    INTEGER DEFAULT 1,
-            created_at DATETIME DEFAULT CURRENT_TIMESTAMP
-        );`,
-		`CREATE TABLE IF NOT EXISTS sent_logs (
-            id         INTEGER PRIMARY KEY AUTOINCREMENT,
-            account_id INTEGER NOT NULL,
-            to_addr    TEXT NOT NULL,
-            subject    TEXT,
-            body       TEXT,
-            status     TEXT,
-            error      TEXT,
-            created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
-            FOREIGN KEY(account_id) REFERENCES accounts(id) ON DELETE CASCADE
-        );`,
-	}
-	for _, s := range stmts {
-		if _, err := DB.Exec(s); err != nil {
-			return err
-		}
-	}
-	return nil
-}
+package database
+
+import (
+	"database/sql"
+	"log"
+	"strings"
+
+	_ "modernc.org/sqlite"
+)
+
+var DB *sql.DB
+
+// Init 打开 SQLite 并执行必要的表结构初始化.
+func Init(path string) {
+	dsn := "file:" + path + "?_pragma=busy_timeout(5000)&_pragma=journal_mode(WAL)&_pragma=foreign_keys(1)"
+	db, err := sql.Open("sqlite", dsn)
+	if err != nil {
+		log.Fatalf("open sqlite: %v", err)
+	}
+	DB = db
+	if err := migrate(); err != nil {
+		log.Fatalf("migrate: %v", err)
+	}
+}
+
+func migrate() error {
+	stmts := []string{
+		`CREATE TABLE IF NOT EXISTS accounts (
+            id         INTEGER PRIMARY KEY AUTOINCREMENT,
+            name       TEXT NOT NULL,
+            email      TEXT NOT NULL UNIQUE,
+            password   TEXT NOT NULL DEFAULT '',
+            smtp_host  TEXT NOT NULL,
+            smtp_port  INTEGER NOT NULL,
+            imap_host  TEXT NOT NULL,
+            imap_port  INTEGER NOT NULL,
+            use_tls    INTEGER DEFAULT 1,
+            auth_type  TEXT DEFAULT 'basic',
+            oauth_refresh_token TEXT,
+            created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+        );`,
+		`CREATE TABLE IF NOT EXISTS sent_logs (
+            id         INTEGER PRIMARY KEY AUTOINCREMENT,
+            account_id INTEGER NOT NULL,
+            to_addr    TEXT NOT NULL,
+            subject    TEXT,
+            body       TEXT,
+            status     TEXT,
+            error      TEXT,
+            created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+            FOREIGN KEY(account_id) REFERENCES accounts(id) ON DELETE CASCADE
+        );`,
+		`CREATE TABLE IF NOT EXISTS oauth_microsoft_pending (
+            state          TEXT PRIMARY KEY,
+            refresh_token  TEXT,
+            email          TEXT,
+            created_at     DATETIME DEFAULT CURRENT_TIMESTAMP
+        );`,
+	}
+	for _, s := range stmts {
+		if _, err := DB.Exec(s); err != nil {
+			return err
+		}
+	}
+	// 旧库升级：逐列添加（已存在则忽略错误）
+	alters := []string{
+		`ALTER TABLE accounts ADD COLUMN auth_type TEXT DEFAULT 'basic'`,
+		`ALTER TABLE accounts ADD COLUMN oauth_refresh_token TEXT`,
+	}
+	for _, s := range alters {
+		if _, err := DB.Exec(s); err != nil {
+			if !strings.Contains(strings.ToLower(err.Error()), "duplicate column") {
+				log.Printf("migrate alter note: %v", err)
+			}
+		}
+	}
+	return nil
+}
--- a/mengpost-backend/docker-compose.yml
+++ b/mengpost-backend/docker-compose.yml
@@ -0,0 +1,24 @@
+# 在 mengpost-backend 目录执行: docker compose up -d
+# 数据目录：仓库根目录下的 data/（与 backend 并列），挂载到容器 /app/data
+services:
+  mengpost-api:
+    build: .
+    image: mengpost-api:local
+    restart: unless-stopped
+    ports:
+      # 主机 28088 -> 容器 8088（内网穿透可把 post.api.smyhub.com 指到主机 28088）
+      - "28088:8088"
+    environment:
+      GIN_MODE: release
+      MP_PORT: "8088"
+      MP_DB: /app/data/mengpost.db
+      # 生产务必改为强随机字符串，或通过 .env 覆盖
+      MP_TOKEN: ${MP_TOKEN:-change-me-in-production}
+      MP_FRONTEND_URL: ${MP_FRONTEND_URL:-https://post.smyhub.com}
+      MP_MS_OAUTH_REDIRECT: ${MP_MS_OAUTH_REDIRECT:-https://post.api.smyhub.com/api/oauth/microsoft/callback}
+      MP_MS_CLIENT_ID: ${MP_MS_CLIENT_ID:-}
+      MP_MS_CLIENT_SECRET: ${MP_MS_CLIENT_SECRET:-}
+      # 留空或 * 表示允许任意 Origin；可改为 https://post.smyhub.com
+      MP_CORS_ORIGINS: ${MP_CORS_ORIGINS:-}
+    volumes:
+      - ../data:/app/data
--- a/mengpost-backend/env.docker.example
+++ b/mengpost-backend/env.docker.example
@@ -0,0 +1,6 @@
+# 复制为 .env 后由 docker compose 读取（与 docker-compose.yml 同目录）
+MP_TOKEN=请改为强随机字符串
+MP_FRONTEND_URL=https://post.smyhub.com
+MP_MS_OAUTH_REDIRECT=https://post.api.smyhub.com/api/oauth/microsoft/callback
+MP_MS_CLIENT_ID=
+MP_MS_CLIENT_SECRET=
--- a/mengpost-backend/go.mod
+++ b/mengpost-backend/go.mod
@@ -1,13 +1,16 @@
 module mengpost-backend

-go 1.22
+go 1.25.0

 require (
 	github.com/emersion/go-imap v1.2.1
 	github.com/emersion/go-imap-id v0.0.0-20190926060100-f94a56b9ecde
 	github.com/emersion/go-message v0.18.1
+	github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6
+	github.com/emersion/go-smtp v0.24.0
 	github.com/gin-contrib/cors v1.7.2
 	github.com/gin-gonic/gin v1.10.0
+	github.com/joho/godotenv v1.5.1
 	gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df
 	modernc.org/sqlite v1.33.1
 )
@@ -18,7 +21,6 @@ require (
 	github.com/cloudwego/base64x v0.1.4 // indirect
 	github.com/cloudwego/iasm v0.2.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/emersion/go-sasl v0.0.0-20200509203442-7bfe0ed36a21 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.3 // indirect
 	github.com/gin-contrib/sse v0.1.0 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
--- a/mengpost-backend/go.sum
+++ b/mengpost-backend/go.sum
@@ -19,8 +19,11 @@ github.com/emersion/go-imap-id v0.0.0-20190926060100-f94a56b9ecde/go.mod h1:sPwp
 github.com/emersion/go-message v0.15.0/go.mod h1:wQUEfE+38+7EW8p8aZ96ptg6bAb1iwdgej19uXASlE4=
 github.com/emersion/go-message v0.18.1 h1:tfTxIoXFSFRwWaZsgnqS1DSZuGpYGzSmCZD8SK3QA2E=
 github.com/emersion/go-message v0.18.1/go.mod h1:XpJyL70LwRvq2a8rVbHXikPgKj8+aI0kGdHlg16ibYA=
-github.com/emersion/go-sasl v0.0.0-20200509203442-7bfe0ed36a21 h1:OJyUGMJTzHTd1XQp98QTaHernxMYzRaOasRir9hUlFQ=
 github.com/emersion/go-sasl v0.0.0-20200509203442-7bfe0ed36a21/go.mod h1:iL2twTeMvZnrg54ZoPDNfJaJaqy0xIQFuBdrLsmspwQ=
+github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6 h1:oP4q0fw+fOSWn3DfFi4EXdT+B+gTtzx8GC9xsc26Znk=
+github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6/go.mod h1:iL2twTeMvZnrg54ZoPDNfJaJaqy0xIQFuBdrLsmspwQ=
+github.com/emersion/go-smtp v0.24.0 h1:g6AfoF140mvW0vLNPD/LuCBLEAdlxOjIXqbIkJIS6Wk=
+github.com/emersion/go-smtp v0.24.0/go.mod h1:ZtRRkbTyp2XTHCA+BmyTFTrj8xY4I+b4McvHxCU2gsQ=
 github.com/emersion/go-textwrapper v0.0.0-20200911093747-65d896831594/go.mod h1:aqO8z8wPrjkscevZJFVE1wXJrLpC5LtJG7fqLOsPb2U=
 github.com/gabriel-vasile/mimetype v1.4.3 h1:in2uUcidCuFcDKtdcBxlR0rJ1+fsokWf+uqxgUFjbI0=
 github.com/gabriel-vasile/mimetype v1.4.3/go.mod h1:d8uq/6HKRL6CGdk+aubisF/M5GcPfT7nKyLpA0lbSSk=
@@ -49,6 +52,8 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
+github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
--- a/mengpost-backend/handlers/account.go
+++ b/mengpost-backend/handlers/account.go
@@ -1,61 +1,65 @@
-package handlers
-
-import (
-	"net/http"
-	"strconv"
-
-	"github.com/gin-gonic/gin"
-
-	"mengpost-backend/models"
-)
-
-func ListAccounts(c *gin.Context) {
-	list, err := models.ListAccounts()
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
-		return
-	}
-	c.JSON(http.StatusOK, list)
-}
-
-func CreateAccount(c *gin.Context) {
-	var a models.Account
-	if err := c.ShouldBindJSON(&a); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-	if a.Email == "" || a.Password == "" {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "email 和 password 必填"})
-		return
-	}
-	if err := models.CreateAccount(&a); err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
-		return
-	}
-	a.Password = ""
-	c.JSON(http.StatusOK, a)
-}
-
-func UpdateAccount(c *gin.Context) {
-	id, _ := strconv.ParseInt(c.Param("id"), 10, 64)
-	var a models.Account
-	if err := c.ShouldBindJSON(&a); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-	a.ID = id
-	if err := models.UpdateAccount(&a); err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
-		return
-	}
-	c.JSON(http.StatusOK, gin.H{"ok": true})
-}
-
-func DeleteAccount(c *gin.Context) {
-	id, _ := strconv.ParseInt(c.Param("id"), 10, 64)
-	if err := models.DeleteAccount(id); err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
-		return
-	}
-	c.JSON(http.StatusOK, gin.H{"ok": true})
-}
+package handlers
+
+import (
+	"net/http"
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+
+	"mengpost-backend/models"
+)
+
+func ListAccounts(c *gin.Context) {
+	list, err := models.ListAccounts()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, list)
+}
+
+func CreateAccount(c *gin.Context) {
+	var a models.Account
+	if err := c.ShouldBindJSON(&a); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if a.Email == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "email 必填"})
+		return
+	}
+	if a.AuthType != models.AuthTypeOAuthMicrosoft && a.Password == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "普通账户需要填写 password"})
+		return
+	}
+	if err := models.CreateAccount(&a); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	a.Password = ""
+	c.JSON(http.StatusOK, a)
+}
+
+func UpdateAccount(c *gin.Context) {
+	id, _ := strconv.ParseInt(c.Param("id"), 10, 64)
+	var a models.Account
+	if err := c.ShouldBindJSON(&a); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	a.ID = id
+	if err := models.UpdateAccount(&a); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"ok": true})
+}
+
+func DeleteAccount(c *gin.Context) {
+	id, _ := strconv.ParseInt(c.Param("id"), 10, 64)
+	if err := models.DeleteAccount(id); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"ok": true})
+}
--- a/mengpost-backend/handlers/auth.go
+++ b/mengpost-backend/handlers/auth.go
@@ -1,27 +1,27 @@
-package handlers
-
-import (
-	"net/http"
-
-	"github.com/gin-gonic/gin"
-
-	"mengpost-backend/config"
-)
-
-// VerifyToken 供前端 token 弹窗使用: 仅返回 token 是否正确.
-func VerifyToken(cfg *config.Config) gin.HandlerFunc {
-	return func(c *gin.Context) {
-		var body struct {
-			Token string `json:"token"`
-		}
-		if err := c.ShouldBindJSON(&body); err != nil {
-			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid body"})
-			return
-		}
-		if body.Token != cfg.Token {
-			c.JSON(http.StatusUnauthorized, gin.H{"ok": false})
-			return
-		}
-		c.JSON(http.StatusOK, gin.H{"ok": true})
-	}
-}
+package handlers
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"mengpost-backend/config"
+)
+
+// VerifyToken 供前端 token 弹窗使用: 仅返回 token 是否正确.
+func VerifyToken(cfg *config.Config) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var body struct {
+			Token string `json:"token"`
+		}
+		if err := c.ShouldBindJSON(&body); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid body"})
+			return
+		}
+		if body.Token != cfg.Token {
+			c.JSON(http.StatusUnauthorized, gin.H{"ok": false})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"ok": true})
+	}
+}
--- a/mengpost-backend/handlers/email.go
+++ b/mengpost-backend/handlers/email.go
@@ -1,111 +1,112 @@
-package handlers
-
-import (
-	"net/http"
-	"strconv"
-
-	"github.com/gin-gonic/gin"
-
-	"mengpost-backend/models"
-	"mengpost-backend/services"
-)
-
-func getAccount(c *gin.Context) *models.Account {
-	id, _ := strconv.ParseInt(c.Param("id"), 10, 64)
-	acc, err := models.GetAccount(id)
-	if err != nil {
-		c.JSON(http.StatusNotFound, gin.H{"error": "account not found"})
-		return nil
-	}
-	return acc
-}
-
-// GET /api/accounts/:id/mailboxes
-func ListMailboxes(c *gin.Context) {
-	acc := getAccount(c)
-	if acc == nil {
-		return
-	}
-	boxes, err := services.ListMailboxes(acc)
-	if err != nil {
-		c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
-		return
-	}
-	c.JSON(http.StatusOK, boxes)
-}
-
-// GET /api/accounts/:id/messages?mailbox=INBOX&limit=30
-func ListMessages(c *gin.Context) {
-	acc := getAccount(c)
-	if acc == nil {
-		return
-	}
-	mailbox := c.DefaultQuery("mailbox", "INBOX")
-	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "30"))
-	list, err := services.FetchMessages(acc, mailbox, limit)
-	if err != nil {
-		c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
-		return
-	}
-	c.JSON(http.StatusOK, list)
-}
-
-// GET /api/accounts/:id/messages/:uid?mailbox=INBOX
-func GetMessage(c *gin.Context) {
-	acc := getAccount(c)
-	if acc == nil {
-		return
-	}
-	uid64, _ := strconv.ParseUint(c.Param("uid"), 10, 32)
-	mailbox := c.DefaultQuery("mailbox", "INBOX")
-	detail, err := services.FetchMessage(acc, mailbox, uint32(uid64))
-	if err != nil {
-		c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
-		return
-	}
-	c.JSON(http.StatusOK, detail)
-}
-
-// POST /api/accounts/:id/send
-func SendMessage(c *gin.Context) {
-	acc := getAccount(c)
-	if acc == nil {
-		return
-	}
-	var body struct {
-		To      string `json:"to"`
-		Subject string `json:"subject"`
-		Body    string `json:"body"`
-		HTML    bool   `json:"html"`
-	}
-	if err := c.ShouldBindJSON(&body); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-	log := &models.SentLog{AccountID: acc.ID, To: body.To, Subject: body.Subject, Body: body.Body}
-	if err := services.SendMail(acc, body.To, body.Subject, body.Body, body.HTML); err != nil {
-		log.Status = "failed"
-		log.Error = err.Error()
-		_ = models.AddSentLog(log)
-		c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
-		return
-	}
-	log.Status = "ok"
-	_ = models.AddSentLog(log)
-	c.JSON(http.StatusOK, gin.H{"ok": true})
-}
-
-// GET /api/accounts/:id/sent?limit=50
-func ListSentLogs(c *gin.Context) {
-	acc := getAccount(c)
-	if acc == nil {
-		return
-	}
-	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "50"))
-	list, err := models.ListSentLogs(acc.ID, limit)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
-		return
-	}
-	c.JSON(http.StatusOK, list)
-}
+package handlers
+
+import (
+	"net/http"
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+
+	"mengpost-backend/models"
+	"mengpost-backend/services"
+)
+
+func getAccount(c *gin.Context) *models.Account {
+	id, _ := strconv.ParseInt(c.Param("id"), 10, 64)
+	acc, err := models.GetAccount(id)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "account not found"})
+		return nil
+	}
+	return acc
+}
+
+// GET /api/accounts/:id/mailboxes
+func ListMailboxes(c *gin.Context) {
+	acc := getAccount(c)
+	if acc == nil {
+		return
+	}
+	boxes, err := services.ListMailboxes(acc)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": services.WrapMicrosoftMailErr(acc.Email, err).Error()})
+		return
+	}
+	c.JSON(http.StatusOK, boxes)
+}
+
+// GET /api/accounts/:id/messages?mailbox=INBOX&limit=30
+func ListMessages(c *gin.Context) {
+	acc := getAccount(c)
+	if acc == nil {
+		return
+	}
+	mailbox := c.DefaultQuery("mailbox", "INBOX")
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "30"))
+	list, err := services.FetchMessages(acc, mailbox, limit)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": services.WrapMicrosoftMailErr(acc.Email, err).Error()})
+		return
+	}
+	c.JSON(http.StatusOK, list)
+}
+
+// GET /api/accounts/:id/messages/:uid?mailbox=INBOX
+func GetMessage(c *gin.Context) {
+	acc := getAccount(c)
+	if acc == nil {
+		return
+	}
+	uid64, _ := strconv.ParseUint(c.Param("uid"), 10, 32)
+	mailbox := c.DefaultQuery("mailbox", "INBOX")
+	detail, err := services.FetchMessage(acc, mailbox, uint32(uid64))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": services.WrapMicrosoftMailErr(acc.Email, err).Error()})
+		return
+	}
+	c.JSON(http.StatusOK, detail)
+}
+
+// POST /api/accounts/:id/send
+func SendMessage(c *gin.Context) {
+	acc := getAccount(c)
+	if acc == nil {
+		return
+	}
+	var body struct {
+		To      string `json:"to"`
+		Subject string `json:"subject"`
+		Body    string `json:"body"`
+		HTML    bool   `json:"html"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	log := &models.SentLog{AccountID: acc.ID, To: body.To, Subject: body.Subject, Body: body.Body}
+	if err := services.SendMail(acc, body.To, body.Subject, body.Body, body.HTML); err != nil {
+		wrapped := services.WrapMicrosoftMailErr(acc.Email, err)
+		log.Status = "failed"
+		log.Error = wrapped.Error()
+		_ = models.AddSentLog(log)
+		c.JSON(http.StatusInternalServerError, gin.H{"error": wrapped.Error()})
+		return
+	}
+	log.Status = "ok"
+	_ = models.AddSentLog(log)
+	c.JSON(http.StatusOK, gin.H{"ok": true})
+}
+
+// GET /api/accounts/:id/sent?limit=50
+func ListSentLogs(c *gin.Context) {
+	acc := getAccount(c)
+	if acc == nil {
+		return
+	}
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "50"))
+	list, err := models.ListSentLogs(acc.ID, limit)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, list)
+}
--- a/mengpost-backend/handlers/oauth_microsoft.go
+++ b/mengpost-backend/handlers/oauth_microsoft.go
@@ -0,0 +1,171 @@
+package handlers
+
+import (
+	"context"
+	"crypto/rand"
+	"database/sql"
+	"encoding/hex"
+	"errors"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+
+	"mengpost-backend/config"
+	"mengpost-backend/models"
+	"mengpost-backend/services"
+)
+
+const (
+	msSMTPHost   = "smtp.office365.com"
+	msSMTPPort   = 587
+	msIMAPHost   = "outlook.office365.com"
+	msIMAPPort   = 993
+	oauthPath    = "/admin/accounts"
+	tokenTimeout = 90 * time.Second
+)
+
+func randomOAuthState() (string, error) {
+	b := make([]byte, 16)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b), nil
+}
+
+// MicrosoftOAuthEnabled GET /api/oauth/microsoft/enabled
+func MicrosoftOAuthEnabled(cfg *config.Config) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{"enabled": cfg.MicrosoftOAuthEnabled()})
+	}
+}
+
+// MicrosoftOAuthStart GET /api/oauth/microsoft/start
+func MicrosoftOAuthStart(cfg *config.Config) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if !cfg.MicrosoftOAuthEnabled() {
+			c.JSON(http.StatusServiceUnavailable, gin.H{"error": "未配置微软 OAuth（MP_MS_CLIENT_ID）"})
+			return
+		}
+		state, err := randomOAuthState()
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		if err := models.InsertOAuthPendingState(state); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		authURL := services.MicrosoftAuthCodeURL(cfg, state)
+		c.JSON(http.StatusOK, gin.H{"url": authURL, "state": state})
+	}
+}
+
+// MicrosoftOAuthCallback GET /api/oauth/microsoft/callback（微软公网回调，无 token）
+func MicrosoftOAuthCallback(cfg *config.Config) gin.HandlerFunc {
+	frontendAccounts := strings.TrimSuffix(cfg.FrontendURL, "/") + oauthPath
+	return func(c *gin.Context) {
+		q := c.Request.URL.Query()
+		if errMsg := q.Get("error"); errMsg != "" {
+			desc := q.Get("error_description")
+			msg := errMsg
+			if desc != "" {
+				msg = errMsg + ": " + desc
+			}
+			c.Redirect(http.StatusFound, frontendAccounts+"?oauth_err="+url.QueryEscape(msg))
+			return
+		}
+		state := q.Get("state")
+		code := q.Get("code")
+		if state == "" || code == "" {
+			c.Redirect(http.StatusFound, frontendAccounts+"?oauth_err="+url.QueryEscape("缺少 code 或 state"))
+			return
+		}
+		ctx, cancel := context.WithTimeout(c.Request.Context(), tokenTimeout)
+		defer cancel()
+		email, refresh, _, _, err := services.ExchangeMicrosoftCode(ctx, cfg, code)
+		if err != nil {
+			c.Redirect(http.StatusFound, frontendAccounts+"?oauth_err="+url.QueryEscape(err.Error()))
+			return
+		}
+		if err := models.UpdateOAuthPendingTokens(state, refresh, email); err != nil {
+			c.Redirect(http.StatusFound, frontendAccounts+"?oauth_err="+url.QueryEscape(err.Error()))
+			return
+		}
+		c.Redirect(http.StatusFound, frontendAccounts+"?oauth_ms="+url.QueryEscape(state))
+	}
+}
+
+type microsoftFinishBody struct {
+	State string `json:"state"`
+}
+
+// MicrosoftOAuthFinish POST /api/oauth/microsoft/finish
+func MicrosoftOAuthFinish() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var body microsoftFinishBody
+		if err := c.ShouldBindJSON(&body); err != nil || body.State == "" {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "需要 JSON: {\"state\":\"...\"}"})
+			return
+		}
+		refresh, email, err := models.TakeOAuthPending(body.State)
+		if err != nil {
+			if errors.Is(err, models.ErrOAuthPendingNotFound) {
+				c.JSON(http.StatusBadRequest, gin.H{"error": "登录会话无效或已使用，请重新发起 OAuth"})
+				return
+			}
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		email = strings.ToLower(strings.TrimSpace(email))
+
+		acc, err := models.GetAccountByEmail(email)
+		if err != nil && !errors.Is(err, sql.ErrNoRows) {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		if err == nil {
+			acc.AuthType = models.AuthTypeOAuthMicrosoft
+			acc.OAuthRefreshToken = refresh
+			acc.SMTPHost = msSMTPHost
+			acc.SMTPPort = msSMTPPort
+			acc.IMAPHost = msIMAPHost
+			acc.IMAPPort = msIMAPPort
+			acc.UseTLS = true
+			if err := models.UpdateAccount(acc); err != nil {
+				c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+				return
+			}
+			acc.Password = ""
+			acc.OAuthRefreshToken = ""
+			c.JSON(http.StatusOK, acc)
+			return
+		}
+
+		local := email
+		if at := strings.IndexByte(email, '@'); at > 0 {
+			local = email[:at]
+		}
+		na := &models.Account{
+			Name:              local,
+			Email:             email,
+			Password:          "",
+			SMTPHost:          msSMTPHost,
+			SMTPPort:          msSMTPPort,
+			IMAPHost:          msIMAPHost,
+			IMAPPort:          msIMAPPort,
+			UseTLS:            true,
+			AuthType:          models.AuthTypeOAuthMicrosoft,
+			OAuthRefreshToken: refresh,
+		}
+		if err := models.CreateAccount(na); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		na.Password = ""
+		na.OAuthRefreshToken = ""
+		c.JSON(http.StatusOK, na)
+	}
+}
--- a/mengpost-backend/main.go
+++ b/mengpost-backend/main.go
@@ -1,19 +1,26 @@
-package main
-
-import (
-	"log"
-
-	"mengpost-backend/config"
-	"mengpost-backend/database"
-	"mengpost-backend/router"
-)
-
-func main() {
-	cfg := config.Load()
-	database.Init(cfg.DBPath)
-	r := router.New(cfg)
-	log.Printf("萌邮 MengPost backend listening on :%s (token=%s)", cfg.Port, cfg.Token)
-	if err := r.Run(":" + cfg.Port); err != nil {
-		log.Fatal(err)
-	}
-}
+package main
+
+import (
+	"log"
+
+	"github.com/joho/godotenv"
+
+	"mengpost-backend/config"
+	"mengpost-backend/database"
+	"mengpost-backend/router"
+	"mengpost-backend/services"
+)
+
+func main() {
+	// 从工作目录加载 .env（KEY=value）；缺失则忽略，仍可用系统环境变量。
+	_ = godotenv.Load()
+
+	cfg := config.Load()
+	services.SetAppConfig(cfg)
+	database.Init(cfg.DBPath)
+	r := router.New(cfg)
+	log.Printf("萌邮 MengPost backend listening on :%s (token=%s)", cfg.Port, cfg.Token)
+	if err := r.Run(":" + cfg.Port); err != nil {
+		log.Fatal(err)
+	}
+}
--- a/mengpost-backend/middleware/auth.go
+++ b/mengpost-backend/middleware/auth.go
@@ -1,24 +1,24 @@
-package middleware
-
-import (
-	"net/http"
-	"strings"
-
-	"github.com/gin-gonic/gin"
-)
-
-// TokenAuth 校验请求头中的 X-Auth-Token 或 Authorization: Bearer <token>.
-func TokenAuth(expected string) gin.HandlerFunc {
-	return func(c *gin.Context) {
-		got := c.GetHeader("X-Auth-Token")
-		if got == "" {
-			auth := c.GetHeader("Authorization")
-			got = strings.TrimPrefix(auth, "Bearer ")
-		}
-		if got == "" || got != expected {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
-			return
-		}
-		c.Next()
-	}
-}
+package middleware
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+)
+
+// TokenAuth 校验请求头中的 X-Auth-Token 或 Authorization: Bearer <token>.
+func TokenAuth(expected string) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		got := c.GetHeader("X-Auth-Token")
+		if got == "" {
+			auth := c.GetHeader("Authorization")
+			got = strings.TrimPrefix(auth, "Bearer ")
+		}
+		if got == "" || got != expected {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
+			return
+		}
+		c.Next()
+	}
+}
--- a/mengpost-backend/models/account.go
+++ b/mengpost-backend/models/account.go
@@ -1,85 +1,139 @@
-package models
-
-import (
-	"time"
-
-	"mengpost-backend/database"
-)
-
-// Account 代表一个邮箱账户的完整连接信息.
-type Account struct {
-	ID        int64     `json:"id"`
-	Name      string    `json:"name"`
-	Email     string    `json:"email"`
-	Password  string    `json:"password,omitempty"`
-	SMTPHost  string    `json:"smtp_host"`
-	SMTPPort  int       `json:"smtp_port"`
-	IMAPHost  string    `json:"imap_host"`
-	IMAPPort  int       `json:"imap_port"`
-	UseTLS    bool      `json:"use_tls"`
-	CreatedAt time.Time `json:"created_at"`
-}
-
-func ListAccounts() ([]Account, error) {
-	rows, err := database.DB.Query(`SELECT id,name,email,smtp_host,smtp_port,imap_host,imap_port,use_tls,created_at FROM accounts ORDER BY id DESC`)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-	var out []Account
-	for rows.Next() {
-		var a Account
-		var tls int
-		if err := rows.Scan(&a.ID, &a.Name, &a.Email, &a.SMTPHost, &a.SMTPPort, &a.IMAPHost, &a.IMAPPort, &tls, &a.CreatedAt); err != nil {
-			return nil, err
-		}
-		a.UseTLS = tls == 1
-		out = append(out, a)
-	}
-	return out, nil
-}
-
-func GetAccount(id int64) (*Account, error) {
-	row := database.DB.QueryRow(`SELECT id,name,email,password,smtp_host,smtp_port,imap_host,imap_port,use_tls,created_at FROM accounts WHERE id=?`, id)
-	var a Account
-	var tls int
-	if err := row.Scan(&a.ID, &a.Name, &a.Email, &a.Password, &a.SMTPHost, &a.SMTPPort, &a.IMAPHost, &a.IMAPPort, &tls, &a.CreatedAt); err != nil {
-		return nil, err
-	}
-	a.UseTLS = tls == 1
-	return &a, nil
-}
-
-func CreateAccount(a *Account) error {
-	tls := 0
-	if a.UseTLS {
-		tls = 1
-	}
-	res, err := database.DB.Exec(
-		`INSERT INTO accounts(name,email,password,smtp_host,smtp_port,imap_host,imap_port,use_tls) VALUES(?,?,?,?,?,?,?,?)`,
-		a.Name, a.Email, a.Password, a.SMTPHost, a.SMTPPort, a.IMAPHost, a.IMAPPort, tls,
-	)
-	if err != nil {
-		return err
-	}
-	id, _ := res.LastInsertId()
-	a.ID = id
-	return nil
-}
-
-func UpdateAccount(a *Account) error {
-	tls := 0
-	if a.UseTLS {
-		tls = 1
-	}
-	_, err := database.DB.Exec(
-		`UPDATE accounts SET name=?,email=?,password=COALESCE(NULLIF(?, ''), password),smtp_host=?,smtp_port=?,imap_host=?,imap_port=?,use_tls=? WHERE id=?`,
-		a.Name, a.Email, a.Password, a.SMTPHost, a.SMTPPort, a.IMAPHost, a.IMAPPort, tls, a.ID,
-	)
-	return err
-}
-
-func DeleteAccount(id int64) error {
-	_, err := database.DB.Exec(`DELETE FROM accounts WHERE id=?`, id)
-	return err
-}
+package models
+
+import (
+	"database/sql"
+	"time"
+
+	"mengpost-backend/database"
+)
+
+// Account 邮箱账户（basic 为密码；oauth_microsoft 使用刷新令牌）.
+type Account struct {
+	ID                int64     `json:"id"`
+	Name              string    `json:"name"`
+	Email             string    `json:"email"`
+	Password          string    `json:"password,omitempty"`
+	SMTPHost          string    `json:"smtp_host"`
+	SMTPPort          int       `json:"smtp_port"`
+	IMAPHost          string    `json:"imap_host"`
+	IMAPPort          int       `json:"imap_port"`
+	UseTLS            bool      `json:"use_tls"`
+	AuthType          string    `json:"auth_type"`
+	OAuthRefreshToken string    `json:"-"`
+	CreatedAt         time.Time `json:"created_at"`
+}
+
+func readAuthType(ns sql.NullString) string {
+	if ns.Valid && ns.String != "" {
+		return ns.String
+	}
+	return AuthTypeBasic
+}
+
+func ListAccounts() ([]Account, error) {
+	rows, err := database.DB.Query(`
+		SELECT id,name,email,smtp_host,smtp_port,imap_host,imap_port,use_tls,
+		       IFNULL(auth_type,'basic'), created_at
+		FROM accounts ORDER BY id DESC`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []Account
+	for rows.Next() {
+		var a Account
+		var tls int
+		var authType sql.NullString
+		if err := rows.Scan(&a.ID, &a.Name, &a.Email, &a.SMTPHost, &a.SMTPPort, &a.IMAPHost, &a.IMAPPort, &tls, &authType, &a.CreatedAt); err != nil {
+			return nil, err
+		}
+		a.UseTLS = tls == 1
+		a.AuthType = readAuthType(authType)
+		out = append(out, a)
+	}
+	return out, nil
+}
+
+func scanFullAccount(row *sql.Row) (*Account, error) {
+	var a Account
+	var tls int
+	var authType, oauthRefresh sql.NullString
+	err := row.Scan(&a.ID, &a.Name, &a.Email, &a.Password, &a.SMTPHost, &a.SMTPPort, &a.IMAPHost, &a.IMAPPort, &tls, &authType, &oauthRefresh, &a.CreatedAt)
+	if err != nil {
+		return nil, err
+	}
+	a.UseTLS = tls == 1
+	a.AuthType = readAuthType(authType)
+	if oauthRefresh.Valid {
+		a.OAuthRefreshToken = oauthRefresh.String
+	}
+	return &a, nil
+}
+
+func GetAccount(id int64) (*Account, error) {
+	row := database.DB.QueryRow(`
+		SELECT id,name,email,password,smtp_host,smtp_port,imap_host,imap_port,use_tls,
+		       IFNULL(auth_type,'basic'), oauth_refresh_token, created_at
+		FROM accounts WHERE id=?`, id)
+	return scanFullAccount(row)
+}
+
+func GetAccountByEmail(email string) (*Account, error) {
+	row := database.DB.QueryRow(`
+		SELECT id,name,email,password,smtp_host,smtp_port,imap_host,imap_port,use_tls,
+		       IFNULL(auth_type,'basic'), oauth_refresh_token, created_at
+		FROM accounts WHERE email=?`, email)
+	return scanFullAccount(row)
+}
+
+func CreateAccount(a *Account) error {
+	if a.AuthType == "" {
+		a.AuthType = AuthTypeBasic
+	}
+	tls := 0
+	if a.UseTLS {
+		tls = 1
+	}
+	var oauth any
+	if a.OAuthRefreshToken != "" {
+		oauth = a.OAuthRefreshToken
+	}
+	res, err := database.DB.Exec(
+		`INSERT INTO accounts(name,email,password,smtp_host,smtp_port,imap_host,imap_port,use_tls,auth_type,oauth_refresh_token)
+		 VALUES(?,?,?,?,?,?,?,?,?,?)`,
+		a.Name, a.Email, a.Password, a.SMTPHost, a.SMTPPort, a.IMAPHost, a.IMAPPort, tls, a.AuthType, oauth,
+	)
+	if err != nil {
+		return err
+	}
+	id, _ := res.LastInsertId()
+	a.ID = id
+	return nil
+}
+
+func UpdateAccount(a *Account) error {
+	tls := 0
+	if a.UseTLS {
+		tls = 1
+	}
+	if a.AuthType == "" {
+		a.AuthType = AuthTypeBasic
+	}
+	_, err := database.DB.Exec(
+		`UPDATE accounts SET name=?,email=?,password=COALESCE(NULLIF(?, ''), password),smtp_host=?,smtp_port=?,imap_host=?,imap_port=?,use_tls=?,auth_type=?,
+		 oauth_refresh_token=COALESCE(NULLIF(?, ''), oauth_refresh_token) WHERE id=?`,
+		a.Name, a.Email, a.Password, a.SMTPHost, a.SMTPPort, a.IMAPHost, a.IMAPPort, tls, a.AuthType,
+		a.OAuthRefreshToken, a.ID,
+	)
+	return err
+}
+
+func UpdateAccountOAuthRefresh(id int64, refresh string) error {
+	_, err := database.DB.Exec(`UPDATE accounts SET oauth_refresh_token=? WHERE id=?`, refresh, id)
+	return err
+}
+
+func DeleteAccount(id int64) error {
+	_, err := database.DB.Exec(`DELETE FROM accounts WHERE id=?`, id)
+	return err
+}
--- a/mengpost-backend/models/auth.go
+++ b/mengpost-backend/models/auth.go
@@ -0,0 +1,6 @@
+package models
+
+const (
+	AuthTypeBasic           = "basic"
+	AuthTypeOAuthMicrosoft  = "oauth_microsoft"
+)
--- a/mengpost-backend/models/oauth_pending.go
+++ b/mengpost-backend/models/oauth_pending.go
@@ -0,0 +1,47 @@
+package models
+
+import (
+	"database/sql"
+	"errors"
+
+	"mengpost-backend/database"
+)
+
+// ErrOAuthPendingNotFound state 不存在或尚未完成微软回调.
+var ErrOAuthPendingNotFound = errors.New("oauth state 无效或已过期")
+
+func InsertOAuthPendingState(state string) error {
+	_, err := database.DB.Exec(`INSERT INTO oauth_microsoft_pending(state) VALUES(?)`, state)
+	return err
+}
+
+func UpdateOAuthPendingTokens(state, refresh, email string) error {
+	res, err := database.DB.Exec(
+		`UPDATE oauth_microsoft_pending SET refresh_token=?, email=? WHERE state=?`,
+		refresh, email, state,
+	)
+	if err != nil {
+		return err
+	}
+	n, _ := res.RowsAffected()
+	if n == 0 {
+		return ErrOAuthPendingNotFound
+	}
+	return nil
+}
+
+// TakeOAuthPending 取出并删除 pending，用于完成账户创建.
+func TakeOAuthPending(state string) (refresh, email string, err error) {
+	row := database.DB.QueryRow(
+		`SELECT refresh_token, email FROM oauth_microsoft_pending WHERE state=? AND refresh_token IS NOT NULL AND email IS NOT NULL`,
+		state,
+	)
+	if err := row.Scan(&refresh, &email); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return "", "", ErrOAuthPendingNotFound
+		}
+		return "", "", err
+	}
+	_, _ = database.DB.Exec(`DELETE FROM oauth_microsoft_pending WHERE state=?`, state)
+	return refresh, email, nil
+}
--- a/mengpost-backend/models/sent_log.go
+++ b/mengpost-backend/models/sent_log.go
@@ -1,50 +1,50 @@
-package models
-
-import (
-	"time"
-
-	"mengpost-backend/database"
-)
-
-// SentLog 记录一次外发邮件的结果.
-type SentLog struct {
-	ID        int64     `json:"id"`
-	AccountID int64     `json:"account_id"`
-	To        string    `json:"to"`
-	Subject   string    `json:"subject"`
-	Body      string    `json:"body"`
-	Status    string    `json:"status"`
-	Error     string    `json:"error"`
-	CreatedAt time.Time `json:"created_at"`
-}
-
-func AddSentLog(l *SentLog) error {
-	_, err := database.DB.Exec(
-		`INSERT INTO sent_logs(account_id,to_addr,subject,body,status,error) VALUES(?,?,?,?,?,?)`,
-		l.AccountID, l.To, l.Subject, l.Body, l.Status, l.Error,
-	)
-	return err
-}
-
-func ListSentLogs(accountID int64, limit int) ([]SentLog, error) {
-	if limit <= 0 {
-		limit = 50
-	}
-	rows, err := database.DB.Query(
-		`SELECT id,account_id,to_addr,subject,body,status,error,created_at FROM sent_logs WHERE account_id=? ORDER BY id DESC LIMIT ?`,
-		accountID, limit,
-	)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-	var out []SentLog
-	for rows.Next() {
-		var l SentLog
-		if err := rows.Scan(&l.ID, &l.AccountID, &l.To, &l.Subject, &l.Body, &l.Status, &l.Error, &l.CreatedAt); err != nil {
-			return nil, err
-		}
-		out = append(out, l)
-	}
-	return out, nil
-}
+package models
+
+import (
+	"time"
+
+	"mengpost-backend/database"
+)
+
+// SentLog 记录一次外发邮件的结果.
+type SentLog struct {
+	ID        int64     `json:"id"`
+	AccountID int64     `json:"account_id"`
+	To        string    `json:"to"`
+	Subject   string    `json:"subject"`
+	Body      string    `json:"body"`
+	Status    string    `json:"status"`
+	Error     string    `json:"error"`
+	CreatedAt time.Time `json:"created_at"`
+}
+
+func AddSentLog(l *SentLog) error {
+	_, err := database.DB.Exec(
+		`INSERT INTO sent_logs(account_id,to_addr,subject,body,status,error) VALUES(?,?,?,?,?,?)`,
+		l.AccountID, l.To, l.Subject, l.Body, l.Status, l.Error,
+	)
+	return err
+}
+
+func ListSentLogs(accountID int64, limit int) ([]SentLog, error) {
+	if limit <= 0 {
+		limit = 50
+	}
+	rows, err := database.DB.Query(
+		`SELECT id,account_id,to_addr,subject,body,status,error,created_at FROM sent_logs WHERE account_id=? ORDER BY id DESC LIMIT ?`,
+		accountID, limit,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []SentLog
+	for rows.Next() {
+		var l SentLog
+		if err := rows.Scan(&l.ID, &l.AccountID, &l.To, &l.Subject, &l.Body, &l.Status, &l.Error, &l.CreatedAt); err != nil {
+			return nil, err
+		}
+		out = append(out, l)
+	}
+	return out, nil
+}
--- a/mengpost-backend/router/router.go
+++ b/mengpost-backend/router/router.go
@@ -1,45 +1,76 @@
-package router
-
-import (
-	"time"
-
-	"github.com/gin-contrib/cors"
-	"github.com/gin-gonic/gin"
-
-	"mengpost-backend/config"
-	"mengpost-backend/handlers"
-	"mengpost-backend/middleware"
-)
-
-// New 构建所有路由.
-func New(cfg *config.Config) *gin.Engine {
-	r := gin.Default()
-
-	r.Use(cors.New(cors.Config{
-		AllowOrigins:     []string{"*"},
-		AllowMethods:     []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
-		AllowHeaders:     []string{"Origin", "Content-Type", "Authorization", "X-Auth-Token"},
-		ExposeHeaders:    []string{"Content-Length"},
-		AllowCredentials: false,
-		MaxAge:           12 * time.Hour,
-	}))
-
-	r.GET("/api/health", func(c *gin.Context) { c.JSON(200, gin.H{"ok": true}) })
-	r.POST("/api/auth/verify", handlers.VerifyToken(cfg))
-
-	auth := r.Group("/api")
-	auth.Use(middleware.TokenAuth(cfg.Token))
-	{
-		auth.GET("/accounts", handlers.ListAccounts)
-		auth.POST("/accounts", handlers.CreateAccount)
-		auth.PUT("/accounts/:id", handlers.UpdateAccount)
-		auth.DELETE("/accounts/:id", handlers.DeleteAccount)
-
-		auth.GET("/accounts/:id/mailboxes", handlers.ListMailboxes)
-		auth.GET("/accounts/:id/messages", handlers.ListMessages)
-		auth.GET("/accounts/:id/messages/:uid", handlers.GetMessage)
-		auth.POST("/accounts/:id/send", handlers.SendMessage)
-		auth.GET("/accounts/:id/sent", handlers.ListSentLogs)
-	}
-	return r
-}
+package router
+
+import (
+	"strings"
+	"time"
+
+	"github.com/gin-contrib/cors"
+	"github.com/gin-gonic/gin"
+
+	"mengpost-backend/config"
+	"mengpost-backend/handlers"
+	"mengpost-backend/middleware"
+)
+
+func corsConfig(cfg *config.Config) cors.Config {
+	c := cors.Config{
+		AllowMethods: []string{
+			"GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS",
+		},
+		AllowHeaders: []string{
+			"Origin", "Content-Length", "Content-Type", "Accept",
+			"Authorization", "X-Auth-Token", "X-Requested-With",
+		},
+		ExposeHeaders:    []string{"Content-Length"},
+		AllowCredentials: false,
+		MaxAge:           12 * time.Hour,
+	}
+	raw := strings.TrimSpace(cfg.CORSAllowOrigins)
+	if raw == "" || raw == "*" {
+		// 生产/跨域穿透：允许任意 Origin（与 AllowCredentials=false 搭配，适合前后端分域名）
+		c.AllowOriginFunc = func(origin string) bool { return true }
+		return c
+	}
+	parts := strings.Split(raw, ",")
+	for _, p := range parts {
+		p = strings.TrimSpace(p)
+		if p != "" {
+			c.AllowOrigins = append(c.AllowOrigins, p)
+		}
+	}
+	if len(c.AllowOrigins) == 0 {
+		c.AllowOriginFunc = func(origin string) bool { return true }
+	}
+	return c
+}
+
+// New 构建所有路由.
+func New(cfg *config.Config) *gin.Engine {
+	r := gin.Default()
+
+	r.Use(cors.New(corsConfig(cfg)))
+
+	r.GET("/api/health", func(c *gin.Context) { c.JSON(200, gin.H{"ok": true}) })
+	r.POST("/api/auth/verify", handlers.VerifyToken(cfg))
+	r.GET("/api/oauth/microsoft/enabled", handlers.MicrosoftOAuthEnabled(cfg))
+	r.GET("/api/oauth/microsoft/callback", handlers.MicrosoftOAuthCallback(cfg))
+
+	auth := r.Group("/api")
+	auth.Use(middleware.TokenAuth(cfg.Token))
+	{
+		auth.GET("/oauth/microsoft/start", handlers.MicrosoftOAuthStart(cfg))
+		auth.POST("/oauth/microsoft/finish", handlers.MicrosoftOAuthFinish())
+
+		auth.GET("/accounts", handlers.ListAccounts)
+		auth.POST("/accounts", handlers.CreateAccount)
+		auth.PUT("/accounts/:id", handlers.UpdateAccount)
+		auth.DELETE("/accounts/:id", handlers.DeleteAccount)
+
+		auth.GET("/accounts/:id/mailboxes", handlers.ListMailboxes)
+		auth.GET("/accounts/:id/messages", handlers.ListMessages)
+		auth.GET("/accounts/:id/messages/:uid", handlers.GetMessage)
+		auth.POST("/accounts/:id/send", handlers.SendMessage)
+		auth.GET("/accounts/:id/sent", handlers.ListSentLogs)
+	}
+	return r
+}
--- a/mengpost-backend/services/appcfg.go
+++ b/mengpost-backend/services/appcfg.go
@@ -0,0 +1,10 @@
+package services
+
+import "mengpost-backend/config"
+
+// AppCfg 供 IMAP/SMTP 刷新微软令牌等使用（main 启动时注入）.
+var AppCfg *config.Config
+
+func SetAppConfig(c *config.Config) {
+	AppCfg = c
+}
--- a/mengpost-backend/services/imap.go
+++ b/mengpost-backend/services/imap.go
@@ -1,225 +1,258 @@
-package services
-
-import (
-	"crypto/tls"
-	"fmt"
-	"io"
-	"strings"
-	"time"
-
-	"github.com/emersion/go-imap"
-	"github.com/emersion/go-imap/client"
-	"github.com/emersion/go-message/mail"
-	imapid "github.com/emersion/go-imap-id"
-
-	"mengpost-backend/models"
-)
-
-// MailSummary 是列表页展示的邮件摘要.
-type MailSummary struct {
-	UID     uint32    `json:"uid"`
-	Subject string    `json:"subject"`
-	From    string    `json:"from"`
-	Date    time.Time `json:"date"`
-	Seen    bool      `json:"seen"`
-	Mailbox string    `json:"mailbox"`
-}
-
-// MailDetail 邮件详情, 包含正文.
-type MailDetail struct {
-	MailSummary
-	To   []string `json:"to"`
-	Text string   `json:"text"`
-	HTML string   `json:"html"`
-}
-
-func dial(acc *models.Account) (*client.Client, error) {
-	addr := fmt.Sprintf("%s:%d", acc.IMAPHost, acc.IMAPPort)
-	if acc.UseTLS {
-		return client.DialTLS(addr, &tls.Config{ServerName: acc.IMAPHost})
-	}
-	return client.Dial(addr)
-}
-
-// imapSendClientID 在 LOGIN 之后、SELECT/LIST 等之前发送 RFC2971 ID（网易 163/126/yeah 等要求，否则报 Unsafe Login）。
-func imapSendClientID(c *client.Client) error {
-	ic := imapid.NewClient(c)
-	_, err := ic.ID(imapid.ID{
-		imapid.FieldName:    "MengPost",
-		imapid.FieldVersion: "1.0",
-		imapid.FieldVendor:  "MengPost",
-		imapid.FieldOS:      "Go",
-	})
-	return err
-}
-
-// ListMailboxes 列出账户下可用的邮件夹名称.
-func ListMailboxes(acc *models.Account) ([]string, error) {
-	c, err := dial(acc)
-	if err != nil {
-		return nil, err
-	}
-	defer c.Logout()
-	if err := c.Login(acc.Email, acc.Password); err != nil {
-		return nil, err
-	}
-	if err := imapSendClientID(c); err != nil {
-		return nil, err
-	}
-	ch := make(chan *imap.MailboxInfo, 20)
-	done := make(chan error, 1)
-	go func() { done <- c.List("", "*", ch) }()
-	var out []string
-	for m := range ch {
-		out = append(out, m.Name)
-	}
-	if err := <-done; err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-// FetchMessages 获取指定邮件夹中最近 n 封邮件摘要.
-func FetchMessages(acc *models.Account, mailbox string, limit int) ([]MailSummary, error) {
-	if mailbox == "" {
-		mailbox = "INBOX"
-	}
-	if limit <= 0 {
-		limit = 30
-	}
-	c, err := dial(acc)
-	if err != nil {
-		return nil, err
-	}
-	defer c.Logout()
-	if err := c.Login(acc.Email, acc.Password); err != nil {
-		return nil, err
-	}
-	if err := imapSendClientID(c); err != nil {
-		return nil, err
-	}
-	mbox, err := c.Select(mailbox, true)
-	if err != nil {
-		return nil, err
-	}
-	if mbox.Messages == 0 {
-		return []MailSummary{}, nil
-	}
-	from := uint32(1)
-	if mbox.Messages > uint32(limit) {
-		from = mbox.Messages - uint32(limit) + 1
-	}
-	seq := new(imap.SeqSet)
-	seq.AddRange(from, mbox.Messages)
-	items := []imap.FetchItem{imap.FetchEnvelope, imap.FetchFlags, imap.FetchUid}
-	ch := make(chan *imap.Message, limit)
-	done := make(chan error, 1)
-	go func() { done <- c.Fetch(seq, items, ch) }()
-	var out []MailSummary
-	for msg := range ch {
-		sum := MailSummary{UID: msg.Uid, Mailbox: mailbox}
-		if msg.Envelope != nil {
-			sum.Subject = msg.Envelope.Subject
-			sum.Date = msg.Envelope.Date
-			if len(msg.Envelope.From) > 0 {
-				a := msg.Envelope.From[0]
-				sum.From = fmt.Sprintf("%s <%s@%s>", a.PersonalName, a.MailboxName, a.HostName)
-			}
-		}
-		for _, f := range msg.Flags {
-			if f == imap.SeenFlag {
-				sum.Seen = true
-			}
-		}
-		out = append(out, sum)
-	}
-	if err := <-done; err != nil {
-		return nil, err
-	}
-	// 最新的在前
-	for i, j := 0, len(out)-1; i < j; i, j = i+1, j-1 {
-		out[i], out[j] = out[j], out[i]
-	}
-	return out, nil
-}
-
-// FetchMessage 根据 UID 获取单封邮件完整内容.
-func FetchMessage(acc *models.Account, mailbox string, uid uint32) (*MailDetail, error) {
-	if mailbox == "" {
-		mailbox = "INBOX"
-	}
-	c, err := dial(acc)
-	if err != nil {
-		return nil, err
-	}
-	defer c.Logout()
-	if err := c.Login(acc.Email, acc.Password); err != nil {
-		return nil, err
-	}
-	if err := imapSendClientID(c); err != nil {
-		return nil, err
-	}
-	if _, err := c.Select(mailbox, false); err != nil {
-		return nil, err
-	}
-	seq := new(imap.SeqSet)
-	seq.AddNum(uid)
-	section := &imap.BodySectionName{}
-	items := []imap.FetchItem{imap.FetchEnvelope, imap.FetchFlags, imap.FetchUid, section.FetchItem()}
-	ch := make(chan *imap.Message, 1)
-	done := make(chan error, 1)
-	go func() { done <- c.UidFetch(seq, items, ch) }()
-	msg := <-ch
-	if err := <-done; err != nil {
-		return nil, err
-	}
-	if msg == nil {
-		return nil, fmt.Errorf("message not found")
-	}
-	d := &MailDetail{MailSummary: MailSummary{UID: msg.Uid, Mailbox: mailbox}}
-	if msg.Envelope != nil {
-		d.Subject = msg.Envelope.Subject
-		d.Date = msg.Envelope.Date
-		if len(msg.Envelope.From) > 0 {
-			a := msg.Envelope.From[0]
-			d.From = fmt.Sprintf("%s <%s@%s>", a.PersonalName, a.MailboxName, a.HostName)
-		}
-		for _, a := range msg.Envelope.To {
-			d.To = append(d.To, fmt.Sprintf("%s@%s", a.MailboxName, a.HostName))
-		}
-	}
-	for _, f := range msg.Flags {
-		if f == imap.SeenFlag {
-			d.Seen = true
-		}
-	}
-	r := msg.GetBody(section)
-	if r == nil {
-		return d, nil
-	}
-	mr, err := mail.CreateReader(r)
-	if err != nil {
-		b, _ := io.ReadAll(r)
-		d.Text = string(b)
-		return d, nil
-	}
-	for {
-		p, err := mr.NextPart()
-		if err == io.EOF {
-			break
-		} else if err != nil {
-			break
-		}
-		switch h := p.Header.(type) {
-		case *mail.InlineHeader:
-			ct, _, _ := h.ContentType()
-			b, _ := io.ReadAll(p.Body)
-			if strings.Contains(ct, "html") {
-				d.HTML = string(b)
-			} else {
-				d.Text = string(b)
-			}
-		}
-	}
-	return d, nil
-}
+package services
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"io"
+	"strings"
+	"time"
+
+	"github.com/emersion/go-imap"
+	"github.com/emersion/go-imap/client"
+	"github.com/emersion/go-message/mail"
+	imapid "github.com/emersion/go-imap-id"
+
+	"mengpost-backend/models"
+)
+
+// MailSummary 是列表页展示的邮件摘要.
+type MailSummary struct {
+	UID     uint32    `json:"uid"`
+	Subject string    `json:"subject"`
+	From    string    `json:"from"`
+	Date    time.Time `json:"date"`
+	Seen    bool      `json:"seen"`
+	Mailbox string    `json:"mailbox"`
+}
+
+// MailDetail 邮件详情, 包含正文.
+type MailDetail struct {
+	MailSummary
+	To   []string `json:"to"`
+	Text string   `json:"text"`
+	HTML string   `json:"html"`
+}
+
+func dial(acc *models.Account) (*client.Client, error) {
+	addr := fmt.Sprintf("%s:%d", acc.IMAPHost, acc.IMAPPort)
+	if acc.UseTLS {
+		cfg := IMAPTLSConfig(acc)
+		if cfg == nil {
+			cfg = &tls.Config{MinVersion: tls.VersionTLS12, ServerName: acc.IMAPHost}
+		}
+		return client.DialTLS(addr, cfg)
+	}
+	return client.Dial(addr)
+}
+
+func imapAuthenticate(c *client.Client, acc *models.Account) error {
+	if acc.AuthType == models.AuthTypeOAuthMicrosoft {
+		if AppCfg == nil {
+			return fmt.Errorf("服务未配置微软 OAuth")
+		}
+		mt, err := RefreshMicrosoftAccess(context.Background(), AppCfg, acc.OAuthRefreshToken)
+		if err != nil {
+			return err
+		}
+		if mt.RefreshToken != "" {
+			_ = models.UpdateAccountOAuthRefresh(acc.ID, mt.RefreshToken)
+		}
+		if err := c.Authenticate(NewXOAUTH2Client(acc.Email, mt.AccessToken)); err != nil {
+			return err
+		}
+	} else {
+		if err := c.Login(acc.Email, acc.Password); err != nil {
+			return err
+		}
+	}
+	// Outlook/Exchange IMAP 在 AUTH 后对 RFC2971 ID 常返回 “Command Argument Error.12”；网易等仍需 ID。
+	if !imapShouldSendClientID(acc) {
+		return nil
+	}
+	return imapSendClientID(c)
+}
+
+func imapShouldSendClientID(acc *models.Account) bool {
+	if acc.AuthType == models.AuthTypeOAuthMicrosoft {
+		return false
+	}
+	if IsMicrosoftConsumerEmail(acc.Email) && strings.EqualFold(acc.IMAPHost, "outlook.office365.com") {
+		return false
+	}
+	return true
+}
+
+// imapSendClientID 在 LOGIN 之后、SELECT/LIST 等之前发送 RFC2971 ID（网易 163/126/yeah 等要求，否则报 Unsafe Login）。
+func imapSendClientID(c *client.Client) error {
+	ic := imapid.NewClient(c)
+	_, err := ic.ID(imapid.ID{
+		imapid.FieldName:    "MengPost",
+		imapid.FieldVersion: "1.0",
+		imapid.FieldVendor:  "MengPost",
+		imapid.FieldOS:      "Go",
+	})
+	return err
+}
+
+// ListMailboxes 列出账户下可用的邮件夹名称.
+func ListMailboxes(acc *models.Account) ([]string, error) {
+	c, err := dial(acc)
+	if err != nil {
+		return nil, err
+	}
+	defer c.Logout()
+	if err := imapAuthenticate(c, acc); err != nil {
+		return nil, err
+	}
+	ch := make(chan *imap.MailboxInfo, 20)
+	done := make(chan error, 1)
+	go func() { done <- c.List("", "*", ch) }()
+	var out []string
+	for m := range ch {
+		out = append(out, m.Name)
+	}
+	if err := <-done; err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// FetchMessages 获取指定邮件夹中最近 n 封邮件摘要.
+func FetchMessages(acc *models.Account, mailbox string, limit int) ([]MailSummary, error) {
+	if mailbox == "" {
+		mailbox = "INBOX"
+	}
+	if limit <= 0 {
+		limit = 30
+	}
+	c, err := dial(acc)
+	if err != nil {
+		return nil, err
+	}
+	defer c.Logout()
+	if err := imapAuthenticate(c, acc); err != nil {
+		return nil, err
+	}
+	mbox, err := c.Select(mailbox, true)
+	if err != nil {
+		return nil, err
+	}
+	if mbox.Messages == 0 {
+		return []MailSummary{}, nil
+	}
+	from := uint32(1)
+	if mbox.Messages > uint32(limit) {
+		from = mbox.Messages - uint32(limit) + 1
+	}
+	seq := new(imap.SeqSet)
+	seq.AddRange(from, mbox.Messages)
+	items := []imap.FetchItem{imap.FetchEnvelope, imap.FetchFlags, imap.FetchUid}
+	ch := make(chan *imap.Message, limit)
+	done := make(chan error, 1)
+	go func() { done <- c.Fetch(seq, items, ch) }()
+	var out []MailSummary
+	for msg := range ch {
+		sum := MailSummary{UID: msg.Uid, Mailbox: mailbox}
+		if msg.Envelope != nil {
+			sum.Subject = msg.Envelope.Subject
+			sum.Date = msg.Envelope.Date
+			if len(msg.Envelope.From) > 0 {
+				a := msg.Envelope.From[0]
+				sum.From = fmt.Sprintf("%s <%s@%s>", a.PersonalName, a.MailboxName, a.HostName)
+			}
+		}
+		for _, f := range msg.Flags {
+			if f == imap.SeenFlag {
+				sum.Seen = true
+			}
+		}
+		out = append(out, sum)
+	}
+	if err := <-done; err != nil {
+		return nil, err
+	}
+	// 最新的在前
+	for i, j := 0, len(out)-1; i < j; i, j = i+1, j-1 {
+		out[i], out[j] = out[j], out[i]
+	}
+	return out, nil
+}
+
+// FetchMessage 根据 UID 获取单封邮件完整内容.
+func FetchMessage(acc *models.Account, mailbox string, uid uint32) (*MailDetail, error) {
+	if mailbox == "" {
+		mailbox = "INBOX"
+	}
+	c, err := dial(acc)
+	if err != nil {
+		return nil, err
+	}
+	defer c.Logout()
+	if err := imapAuthenticate(c, acc); err != nil {
+		return nil, err
+	}
+	if _, err := c.Select(mailbox, false); err != nil {
+		return nil, err
+	}
+	seq := new(imap.SeqSet)
+	seq.AddNum(uid)
+	section := &imap.BodySectionName{}
+	items := []imap.FetchItem{imap.FetchEnvelope, imap.FetchFlags, imap.FetchUid, section.FetchItem()}
+	ch := make(chan *imap.Message, 1)
+	done := make(chan error, 1)
+	go func() { done <- c.UidFetch(seq, items, ch) }()
+	msg := <-ch
+	if err := <-done; err != nil {
+		return nil, err
+	}
+	if msg == nil {
+		return nil, fmt.Errorf("message not found")
+	}
+	d := &MailDetail{MailSummary: MailSummary{UID: msg.Uid, Mailbox: mailbox}}
+	if msg.Envelope != nil {
+		d.Subject = msg.Envelope.Subject
+		d.Date = msg.Envelope.Date
+		if len(msg.Envelope.From) > 0 {
+			a := msg.Envelope.From[0]
+			d.From = fmt.Sprintf("%s <%s@%s>", a.PersonalName, a.MailboxName, a.HostName)
+		}
+		for _, a := range msg.Envelope.To {
+			d.To = append(d.To, fmt.Sprintf("%s@%s", a.MailboxName, a.HostName))
+		}
+	}
+	for _, f := range msg.Flags {
+		if f == imap.SeenFlag {
+			d.Seen = true
+		}
+	}
+	r := msg.GetBody(section)
+	if r == nil {
+		return d, nil
+	}
+	mr, err := mail.CreateReader(r)
+	if err != nil {
+		b, _ := io.ReadAll(r)
+		d.Text = string(b)
+		return d, nil
+	}
+	for {
+		p, err := mr.NextPart()
+		if err == io.EOF {
+			break
+		} else if err != nil {
+			break
+		}
+		switch h := p.Header.(type) {
+		case *mail.InlineHeader:
+			ct, _, _ := h.ContentType()
+			b, _ := io.ReadAll(p.Body)
+			if strings.Contains(ct, "html") {
+				d.HTML = string(b)
+			} else {
+				d.Text = string(b)
+			}
+		}
+	}
+	return d, nil
+}
--- a/mengpost-backend/services/microsoft.go
+++ b/mengpost-backend/services/microsoft.go
@@ -0,0 +1,66 @@
+package services
+
+import (
+	"crypto/tls"
+	"fmt"
+	"strings"
+
+	"mengpost-backend/models"
+)
+
+// 微软个人邮箱常见后缀（Outlook / Hotmail / Live 等）.
+var microsoftConsumerSuffixes = []string{
+	"@outlook.com",
+	"@hotmail.com",
+	"@live.com",
+	"@msn.com",
+}
+
+// IsMicrosoftConsumerEmail 判断是否为消费者微软邮箱（非 Exchange 自建域）.
+func IsMicrosoftConsumerEmail(email string) bool {
+	e := strings.ToLower(strings.TrimSpace(email))
+	for _, suf := range microsoftConsumerSuffixes {
+		if strings.HasSuffix(e, suf) {
+			return true
+		}
+	}
+	return false
+}
+
+// IMAPTLSConfig 为 IMAP TLS 握手提供 ServerName（微软等场景与证书一致）.
+func IMAPTLSConfig(acc *models.Account) *tls.Config {
+	if acc == nil || !acc.UseTLS {
+		return nil
+	}
+	sn := acc.IMAPHost
+	if IsMicrosoftConsumerEmail(acc.Email) && strings.EqualFold(acc.IMAPHost, "outlook.office365.com") {
+		sn = "outlook.office365.com"
+	}
+	return &tls.Config{
+		MinVersion: tls.VersionTLS12,
+		ServerName: sn,
+	}
+}
+
+// SMTPTLSConfig 发信使用 587 STARTTLS 时校验证书（微软 smtp.office365.com）.
+func SMTPTLSConfig(acc *models.Account) *tls.Config {
+	if acc == nil || !IsMicrosoftConsumerEmail(acc.Email) {
+		return nil
+	}
+	if strings.EqualFold(acc.SMTPHost, "smtp.office365.com") {
+		return &tls.Config{
+			MinVersion: tls.VersionTLS12,
+			ServerName: "smtp.office365.com",
+		}
+	}
+	return nil
+}
+
+// WrapMicrosoftMailErr 为微软邮箱附加常见配置说明（IMAP 开关、基础认证与 OAuth）.
+func WrapMicrosoftMailErr(email string, err error) error {
+	if err == nil || !IsMicrosoftConsumerEmail(email) {
+		return err
+	}
+	hint := "（微软邮箱：网页端需开启 IMAP；OAuth 账户无需应用密码。若仍失败请检查令牌是否过期、Azure 权限是否含 IMAP。）"
+	return fmt.Errorf("%w %s", err, hint)
+}
--- a/mengpost-backend/services/microsoft_oauth.go
+++ b/mengpost-backend/services/microsoft_oauth.go
@@ -0,0 +1,165 @@
+package services
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"mengpost-backend/config"
+)
+
+var msTokenURL = "https://login.microsoftonline.com/consumers/oauth2/v2.0/token"
+var msAuthURL = "https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize"
+
+// MicrosoftOAuthScopes IMAP + SMTP + 刷新令牌.
+var MicrosoftOAuthScopes = []string{
+	"openid",
+	"email",
+	"offline_access",
+	"https://outlook.office.com/IMAP.AccessAsUser.All",
+	"https://outlook.office.com/SMTP.Send",
+}
+
+// MicrosoftAuthCodeURL 生成跳转微软登录的 URL.
+func MicrosoftAuthCodeURL(cfg *config.Config, state string) string {
+	q := url.Values{}
+	q.Set("client_id", cfg.MSClientID)
+	q.Set("response_type", "code")
+	q.Set("redirect_uri", cfg.MSRedirectURL)
+	q.Set("response_mode", "query")
+	q.Set("scope", strings.Join(MicrosoftOAuthScopes, " "))
+	q.Set("state", state)
+	return msAuthURL + "?" + q.Encode()
+}
+
+type msTokenResp struct {
+	AccessToken  string `json:"access_token"`
+	RefreshToken string `json:"refresh_token"`
+	IDToken      string `json:"id_token"`
+	ExpiresIn    int    `json:"expires_in"`
+	Error        string `json:"error"`
+	Description  string `json:"error_description"`
+}
+
+// ExchangeMicrosoftCode 用授权码换令牌并解析邮箱（id_token）.
+func ExchangeMicrosoftCode(ctx context.Context, cfg *config.Config, code string) (email, refresh, access string, accessExpiry time.Time, err error) {
+	form := url.Values{}
+	form.Set("client_id", cfg.MSClientID)
+	if cfg.MSClientSecret != "" {
+		form.Set("client_secret", cfg.MSClientSecret)
+	}
+	form.Set("code", code)
+	form.Set("redirect_uri", cfg.MSRedirectURL)
+	form.Set("grant_type", "authorization_code")
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, msTokenURL, strings.NewReader(form.Encode()))
+	if err != nil {
+		return "", "", "", time.Time{}, err
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return "", "", "", time.Time{}, err
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	var tr msTokenResp
+	if err := json.Unmarshal(body, &tr); err != nil {
+		return "", "", "", time.Time{}, fmt.Errorf("token 响应解析失败: %w", err)
+	}
+	if tr.Error != "" {
+		return "", "", "", time.Time{}, fmt.Errorf("微软 token错误: %s %s", tr.Error, tr.Description)
+	}
+	if tr.RefreshToken == "" {
+		return "", "", "", time.Time{}, fmt.Errorf("未返回 refresh_token，请确认 scope 含 offline_access")
+	}
+	email, err = emailFromIDToken(tr.IDToken)
+	if err != nil || email == "" {
+		return "", "", "", time.Time{}, fmt.Errorf("无法从 id_token 解析邮箱: %w", err)
+	}
+	exp := time.Now().Add(time.Duration(tr.ExpiresIn) * time.Second)
+	return strings.ToLower(strings.TrimSpace(email)), tr.RefreshToken, tr.AccessToken, exp, nil
+}
+
+func emailFromIDToken(idt string) (string, error) {
+	if idt == "" {
+		return "", fmt.Errorf("无 id_token")
+	}
+	parts := strings.Split(idt, ".")
+	if len(parts) < 2 {
+		return "", fmt.Errorf("id_token 格式异常")
+	}
+	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return "", err
+	}
+	var claims struct {
+		Email             string `json:"email"`
+		PreferredUsername string `json:"preferred_username"`
+		UPN               string `json:"upn"`
+	}
+	if err := json.Unmarshal(payload, &claims); err != nil {
+		return "", err
+	}
+	if claims.Email != "" {
+		return claims.Email, nil
+	}
+	if claims.PreferredUsername != "" {
+		return claims.PreferredUsername, nil
+	}
+	if claims.UPN != "" {
+		return claims.UPN, nil
+	}
+	return "", fmt.Errorf("claims 中无邮箱字段")
+}
+
+// MicrosoftAccessToken 用 refresh_token 换新 access_token（及可能的新 refresh）.
+type MicrosoftAccessToken struct {
+	AccessToken  string
+	RefreshToken string // 若微软返回新的则替换存库
+	Expiry       time.Time
+}
+
+func RefreshMicrosoftAccess(ctx context.Context, cfg *config.Config, refresh string) (*MicrosoftAccessToken, error) {
+	form := url.Values{}
+	form.Set("client_id", cfg.MSClientID)
+	if cfg.MSClientSecret != "" {
+		form.Set("client_secret", cfg.MSClientSecret)
+	}
+	form.Set("refresh_token", refresh)
+	form.Set("grant_type", "refresh_token")
+	form.Set("scope", strings.Join(MicrosoftOAuthScopes, " "))
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, msTokenURL, strings.NewReader(form.Encode()))
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	var tr msTokenResp
+	if err := json.Unmarshal(body, &tr); err != nil {
+		return nil, err
+	}
+	if tr.Error != "" {
+		return nil, fmt.Errorf("%s: %s", tr.Error, tr.Description)
+	}
+	out := &MicrosoftAccessToken{
+		AccessToken: tr.AccessToken,
+		Expiry:      time.Now().Add(time.Duration(tr.ExpiresIn) * time.Second),
+	}
+	if tr.RefreshToken != "" {
+		out.RefreshToken = tr.RefreshToken
+	}
+	return out, nil
+}
--- a/mengpost-backend/services/smtp.go
+++ b/mengpost-backend/services/smtp.go
@@ -1,23 +1,29 @@
-package services
-
-import (
-	"gopkg.in/gomail.v2"
-
-	"mengpost-backend/models"
-)
-
-// SendMail 通过指定账户发送邮件. body 支持纯文本或 HTML.
-func SendMail(acc *models.Account, to, subject, body string, html bool) error {
-	m := gomail.NewMessage()
-	m.SetHeader("From", acc.Email)
-	m.SetHeader("To", to)
-	m.SetHeader("Subject", subject)
-	if html {
-		m.SetBody("text/html", body)
-	} else {
-		m.SetBody("text/plain", body)
-	}
-	d := gomail.NewDialer(acc.SMTPHost, acc.SMTPPort, acc.Email, acc.Password)
-	d.SSL = acc.UseTLS && acc.SMTPPort == 465
-	return d.DialAndSend(m)
-}
+package services
+
+import (
+	"gopkg.in/gomail.v2"
+
+	"mengpost-backend/models"
+)
+
+// SendMail 通过指定账户发送邮件. body 支持纯文本或 HTML.
+func SendMail(acc *models.Account, to, subject, body string, html bool) error {
+	if acc.AuthType == models.AuthTypeOAuthMicrosoft {
+		return sendMailMicrosoftOAuth(acc, to, subject, body, html)
+	}
+	m := gomail.NewMessage()
+	m.SetHeader("From", acc.Email)
+	m.SetHeader("To", to)
+	m.SetHeader("Subject", subject)
+	if html {
+		m.SetBody("text/html", body)
+	} else {
+		m.SetBody("text/plain", body)
+	}
+	d := gomail.NewDialer(acc.SMTPHost, acc.SMTPPort, acc.Email, acc.Password)
+	d.SSL = acc.UseTLS && acc.SMTPPort == 465
+	if tc := SMTPTLSConfig(acc); tc != nil {
+		d.TLSConfig = tc
+	}
+	return d.DialAndSend(m)
+}
--- a/mengpost-backend/services/smtp_oauth.go
+++ b/mengpost-backend/services/smtp_oauth.go
@@ -0,0 +1,73 @@
+package services
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"fmt"
+
+	smtpp "github.com/emersion/go-smtp"
+	"gopkg.in/gomail.v2"
+
+	"mengpost-backend/models"
+)
+
+// sendMailMicrosoftOAuth 使用 XOAUTH2 + STARTTLS 连接 smtp.office365.com:587.
+func sendMailMicrosoftOAuth(acc *models.Account, to, subject, body string, html bool) error {
+	if AppCfg == nil {
+		return fmt.Errorf("服务未配置 OAuth")
+	}
+	mt, err := RefreshMicrosoftAccess(context.Background(), AppCfg, acc.OAuthRefreshToken)
+	if err != nil {
+		return err
+	}
+	if mt.RefreshToken != "" {
+		_ = models.UpdateAccountOAuthRefresh(acc.ID, mt.RefreshToken)
+	}
+
+	m := gomail.NewMessage()
+	m.SetHeader("From", acc.Email)
+	m.SetHeader("To", to)
+	m.SetHeader("Subject", subject)
+	if html {
+		m.SetBody("text/html", body)
+	} else {
+		m.SetBody("text/plain", body)
+	}
+	var buf bytes.Buffer
+	if _, err := m.WriteTo(&buf); err != nil {
+		return err
+	}
+
+	addr := fmt.Sprintf("%s:%d", acc.SMTPHost, acc.SMTPPort)
+	tlsCfg := &tls.Config{
+		MinVersion: tls.VersionTLS12,
+		ServerName: acc.SMTPHost,
+	}
+	c, err := smtpp.DialStartTLS(addr, tlsCfg)
+	if err != nil {
+		return err
+	}
+	defer c.Close()
+
+	if err := c.Auth(NewXOAUTH2Client(acc.Email, mt.AccessToken)); err != nil {
+		return err
+	}
+	if err := c.Mail(acc.Email, nil); err != nil {
+		return err
+	}
+	if err := c.Rcpt(to, nil); err != nil {
+		return err
+	}
+	w, err := c.Data()
+	if err != nil {
+		return err
+	}
+	if _, err := w.Write(buf.Bytes()); err != nil {
+		return err
+	}
+	if err := w.Close(); err != nil {
+		return err
+	}
+	return c.Quit()
+}
--- a/mengpost-backend/services/xoauth2.go
+++ b/mengpost-backend/services/xoauth2.go
@@ -0,0 +1,35 @@
+package services
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/emersion/go-sasl"
+)
+
+// xoauth2SASL 实现 Microsoft / Google 邮件使用的 XOAUTH2（与 RFC7628 OAUTHBEARER 不同）。
+type xoauth2SASL struct {
+	username string
+	token    string
+}
+
+// NewXOAUTH2Client 供 IMAP AUTHENTICATE / SMTP AUTH 使用，username 一般为完整邮箱。
+func NewXOAUTH2Client(username, accessToken string) sasl.Client {
+	return &xoauth2SASL{
+		username: strings.TrimSpace(username),
+		token:    strings.TrimSpace(accessToken),
+	}
+}
+
+func (x *xoauth2SASL) Start() (mech string, ir []byte, err error) {
+	// https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth
+	s := fmt.Sprintf("user=%s\x01auth=Bearer %s\x01\x01", x.username, x.token)
+	return "XOAUTH2", []byte(s), nil
+}
+
+func (x *xoauth2SASL) Next(challenge []byte) ([]byte, error) {
+	if len(challenge) == 0 {
+		return nil, nil
+	}
+	return nil, fmt.Errorf("xoauth2: %s", string(challenge))
+}
--- a/mengpost-frontend/.env.production
+++ b/mengpost-frontend/.env.production
@@ -0,0 +1,2 @@
+# 生产构建：npm run build 时注入。静态站点域名 post.smyhub.com，API 走 post.api.smyhub.com
+VITE_API_URL=https://post.api.smyhub.com
--- a/mengpost-frontend/index.html
+++ b/mengpost-frontend/index.html
@@ -1,13 +1,13 @@
-<!doctype html>
-<html lang="zh-CN">
-  <head>
-    <meta charset="UTF-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <link rel="icon" href="/favicon.ico" sizes="any" />
-    <title>萌邮 MengPost · 多邮箱管理</title>
-  </head>
-  <body>
-    <div id="root"></div>
-    <script type="module" src="/src/main.jsx"></script>
-  </body>
-</html>
+<!doctype html>
+<html lang="zh-CN">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <link rel="icon" href="/favicon.ico" sizes="any" />
+    <title>萌邮 MengPost · 多邮箱管理</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.jsx"></script>
+  </body>
+</html>
--- a/mengpost-frontend/package-lock.json
+++ b/mengpost-frontend/package-lock.json
--- a/mengpost-frontend/package.json
+++ b/mengpost-frontend/package.json
@@ -1,20 +1,20 @@
-{
-  "name": "mengpost-frontend",
-  "private": true,
-  "version": "0.1.0",
-  "type": "module",
-  "scripts": {
-    "dev": "vite",
-    "build": "vite build",
-    "preview": "vite preview --port 5173"
-  },
-  "dependencies": {
-    "react": "^18.3.1",
-    "react-dom": "^18.3.1",
-    "react-router-dom": "^6.26.2"
-  },
-  "devDependencies": {
-    "@vitejs/plugin-react": "^4.3.1",
-    "vite": "^5.4.6"
-  }
-}
+{
+  "name": "mengpost-frontend",
+  "private": true,
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "vite build",
+    "preview": "vite preview --port 5173"
+  },
+  "dependencies": {
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1",
+    "react-router-dom": "^6.26.2"
+  },
+  "devDependencies": {
+    "@vitejs/plugin-react": "^4.3.1",
+    "vite": "^5.4.6"
+  }
+}
--- a/mengpost-frontend/src/App.jsx
+++ b/mengpost-frontend/src/App.jsx
@@ -1,35 +1,35 @@
-import { useSyncExternalStore } from 'react'
-import { Route, Routes } from 'react-router-dom'
-import { tokenStore } from './api/client.js'
-import AccessGate from './components/AccessGate.jsx'
-import MainLayout from './components/MainLayout.jsx'
-import Topbar from './components/Topbar.jsx'
-import Home from './pages/Home.jsx'
-import Admin from './pages/Admin.jsx'
-import Accounts from './pages/Accounts.jsx'
-import Mailbox from './pages/Mailbox.jsx'
-import Compose from './pages/Compose.jsx'
-
-function useToken() {
-  return useSyncExternalStore(tokenStore.subscribe, () => tokenStore.get(), () => '')
-}
-
-export default function App() {
-  const token = useToken()
-  if (!token) return <AccessGate />
-
-  return (
-    <>
-      <Topbar />
-      <Routes>
-        <Route element={<MainLayout />}>
-          <Route path="/" element={<Home />} />
-          <Route path="/admin" element={<Admin />} />
-          <Route path="/admin/accounts" element={<Accounts />} />
-          <Route path="/admin/mailbox/:id" element={<Mailbox />} />
-          <Route path="/admin/compose/:id" element={<Compose />} />
-        </Route>
-      </Routes>
-    </>
-  )
-}
+import { useSyncExternalStore } from 'react'
+import { Route, Routes } from 'react-router-dom'
+import { tokenStore } from './api/client.js'
+import AccessGate from './components/AccessGate.jsx'
+import MainLayout from './components/MainLayout.jsx'
+import Topbar from './components/Topbar.jsx'
+import Home from './pages/Home.jsx'
+import Admin from './pages/Admin.jsx'
+import Accounts from './pages/Accounts.jsx'
+import Mailbox from './pages/Mailbox.jsx'
+import Compose from './pages/Compose.jsx'
+
+function useToken() {
+  return useSyncExternalStore(tokenStore.subscribe, () => tokenStore.get(), () => '')
+}
+
+export default function App() {
+  const token = useToken()
+  if (!token) return <AccessGate />
+
+  return (
+    <>
+      <Topbar />
+      <Routes>
+        <Route element={<MainLayout />}>
+          <Route path="/" element={<Home />} />
+          <Route path="/admin" element={<Admin />} />
+          <Route path="/admin/accounts" element={<Accounts />} />
+          <Route path="/admin/mailbox/:id" element={<Mailbox />} />
+          <Route path="/admin/compose/:id" element={<Compose />} />
+        </Route>
+      </Routes>
+    </>
+  )
+}
--- a/mengpost-frontend/src/api/client.js
+++ b/mengpost-frontend/src/api/client.js
@@ -1,109 +1,111 @@
-const TOKEN_KEY = 'mengpost_token'
-const EVT = 'mengpost-token'
-
-/** 生产环境前后端分离时设 VITE_API_URL, 如 http://127.0.0.1:8787 */
-const base = (import.meta.env.VITE_API_URL || '').replace(/\/$/, '')
-
-export function apiUrl(path) {
-  if (!path.startsWith('/')) path = '/' + path
-  return base ? base + path : path
-}
-
-export const tokenStore = {
-  get: () => localStorage.getItem(TOKEN_KEY) || '',
-  set: (t) => {
-    localStorage.setItem(TOKEN_KEY, t)
-    window.dispatchEvent(new Event(EVT))
-  },
-  clear: () => {
-    localStorage.removeItem(TOKEN_KEY)
-    window.dispatchEvent(new Event(EVT))
-  },
-  subscribe: (fn) => {
-    window.addEventListener(EVT, fn)
-    return () => window.removeEventListener(EVT, fn)
-  },
-}
-
-function parseJsonSafe(txt) {
-  if (!txt || !txt.trim()) return null
-  try {
-    return JSON.parse(txt)
-  } catch {
-    return { error: txt.length > 120 ? txt.slice(0, 120) + '…' : txt }
-  }
-}
-
-async function request(method, path, body) {
-  const headers = { 'Content-Type': 'application/json' }
-  const t = tokenStore.get()
-  if (t) headers['X-Auth-Token'] = t
-  let res
-  try {
-    res = await fetch(apiUrl(path), {
-      method,
-      headers,
-      body: body ? JSON.stringify(body) : undefined,
-    })
-  } catch (e) {
-    throw new Error(
-      e.message?.includes('Failed to fetch')
-        ? '无法连接后端：请确认已启动 mengpost-backend (默认 8787)，且本页通过 Vite 开发服务器打开或已配置 VITE_API_URL'
-        : e.message,
-    )
-  }
-  const txt = await res.text()
-  const data = parseJsonSafe(txt)
-  if (!res.ok) {
-    const msg = (data && data.error) || res.statusText || '请求失败'
-    throw new Error(msg)
-  }
-  return data
-}
-
-/** 列表接口在空 body / SW 缓存异常时可能得到 null，统一成数组 */
-function asArray(v) {
-  return Array.isArray(v) ? v : []
-}
-
-/** 校验 token 时不带 X-Auth-Token，避免旧 token 干扰 */
-export async function verifyToken(token) {
-  let res
-  try {
-    res = await fetch(apiUrl('/api/auth/verify'), {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ token }),
-    })
-  } catch (e) {
-    throw new Error(
-      e.message?.includes('Failed to fetch')
-        ? '无法连接后端：请先运行 dev.bat / dev.sh 启动后端，或设置 VITE_API_URL'
-        : e.message,
-    )
-  }
-  const txt = await res.text()
-  const data = parseJsonSafe(txt)
-  if (!res.ok) {
-    if (data && data.ok === false) return { ok: false }
-    throw new Error((data && data.error) || res.statusText || '验证失败')
-  }
-  return data
-}
-
-export const api = {
-  listAccounts: () => request('GET', '/api/accounts').then(asArray),
-  createAccount: (a) => request('POST', '/api/accounts', a),
-  updateAccount: (id, a) => request('PUT', `/api/accounts/${id}`, a),
-  deleteAccount: (id) => request('DELETE', `/api/accounts/${id}`),
-  listMailboxes: (id) => request('GET', `/api/accounts/${id}/mailboxes`).then(asArray),
-  listMessages: (id, mailbox = 'INBOX', limit = 30) =>
-    request('GET', `/api/accounts/${id}/messages?mailbox=${encodeURIComponent(mailbox)}&limit=${limit}`).then(
-      asArray,
-    ),
-  getMessage: (id, uid, mailbox = 'INBOX') =>
-    request('GET', `/api/accounts/${id}/messages/${uid}?mailbox=${encodeURIComponent(mailbox)}`),
-  send: (id, body) => request('POST', `/api/accounts/${id}/send`, body),
-  listSent: (id, limit = 50) =>
-    request('GET', `/api/accounts/${id}/sent?limit=${limit}`).then(asArray),
-}
+const TOKEN_KEY = 'mengpost_token'
+const EVT = 'mengpost-token'
+
+/** 生产环境前后端分离时设 VITE_API_URL, 如 http://127.0.0.1:8787 */
+const base = (import.meta.env.VITE_API_URL || '').replace(/\/$/, '')
+
+export function apiUrl(path) {
+  if (!path.startsWith('/')) path = '/' + path
+  return base ? base + path : path
+}
+
+export const tokenStore = {
+  get: () => localStorage.getItem(TOKEN_KEY) || '',
+  set: (t) => {
+    localStorage.setItem(TOKEN_KEY, t)
+    window.dispatchEvent(new Event(EVT))
+  },
+  clear: () => {
+    localStorage.removeItem(TOKEN_KEY)
+    window.dispatchEvent(new Event(EVT))
+  },
+  subscribe: (fn) => {
+    window.addEventListener(EVT, fn)
+    return () => window.removeEventListener(EVT, fn)
+  },
+}
+
+function parseJsonSafe(txt) {
+  if (!txt || !txt.trim()) return null
+  try {
+    return JSON.parse(txt)
+  } catch {
+    return { error: txt.length > 120 ? txt.slice(0, 120) + '…' : txt }
+  }
+}
+
+async function request(method, path, body) {
+  const headers = { 'Content-Type': 'application/json' }
+  const t = tokenStore.get()
+  if (t) headers['X-Auth-Token'] = t
+  let res
+  try {
+    res = await fetch(apiUrl(path), {
+      method,
+      headers,
+      body: body ? JSON.stringify(body) : undefined,
+    })
+  } catch (e) {
+    throw new Error(
+      e.message?.includes('Failed to fetch')
+        ? '无法连接后端：请确认已启动 mengpost-backend (默认 8787)，且本页通过 Vite 开发服务器打开或已配置 VITE_API_URL'
+        : e.message,
+    )
+  }
+  const txt = await res.text()
+  const data = parseJsonSafe(txt)
+  if (!res.ok) {
+    const msg = (data && data.error) || res.statusText || '请求失败'
+    throw new Error(msg)
+  }
+  return data
+}
+
+/** 列表接口在空 body / SW 缓存异常时可能得到 null，统一成数组 */
+function asArray(v) {
+  return Array.isArray(v) ? v : []
+}
+
+/** 校验 token 时不带 X-Auth-Token，避免旧 token 干扰 */
+export async function verifyToken(token) {
+  let res
+  try {
+    res = await fetch(apiUrl('/api/auth/verify'), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ token }),
+    })
+  } catch (e) {
+    throw new Error(
+      e.message?.includes('Failed to fetch')
+        ? '无法连接后端：请先运行 dev.bat / dev.sh 启动后端，或设置 VITE_API_URL'
+        : e.message,
+    )
+  }
+  const txt = await res.text()
+  const data = parseJsonSafe(txt)
+  if (!res.ok) {
+    if (data && data.ok === false) return { ok: false }
+    throw new Error((data && data.error) || res.statusText || '验证失败')
+  }
+  return data
+}
+
+export const api = {
+  listAccounts: () => request('GET', '/api/accounts').then(asArray),
+  createAccount: (a) => request('POST', '/api/accounts', a),
+  updateAccount: (id, a) => request('PUT', `/api/accounts/${id}`, a),
+  deleteAccount: (id) => request('DELETE', `/api/accounts/${id}`),
+  listMailboxes: (id) => request('GET', `/api/accounts/${id}/mailboxes`).then(asArray),
+  listMessages: (id, mailbox = 'INBOX', limit = 30) =>
+    request('GET', `/api/accounts/${id}/messages?mailbox=${encodeURIComponent(mailbox)}&limit=${limit}`).then(
+      asArray,
+    ),
+  getMessage: (id, uid, mailbox = 'INBOX') =>
+    request('GET', `/api/accounts/${id}/messages/${uid}?mailbox=${encodeURIComponent(mailbox)}`),
+  send: (id, body) => request('POST', `/api/accounts/${id}/send`, body),
+  listSent: (id, limit = 50) =>
+    request('GET', `/api/accounts/${id}/sent?limit=${limit}`).then(asArray),
+  microsoftOAuthStart: () => request('GET', '/api/oauth/microsoft/start'),
+  microsoftOAuthFinish: (state) => request('POST', '/api/oauth/microsoft/finish', { state }),
+}
--- a/mengpost-frontend/src/components/AccessGate.jsx
+++ b/mengpost-frontend/src/components/AccessGate.jsx
@@ -1,64 +1,64 @@
-import { useEffect, useRef, useState } from 'react'
-import { verifyToken, tokenStore } from '../api/client.js'
-
-/** 未携带有效密钥时全屏展示, 校验通过后写入 localStorage 并刷新应用状态 */
-export default function AccessGate() {
-  const [key, setKey] = useState('')
-  const [err, setErr] = useState('')
-  const [loading, setLoading] = useState(false)
-  const inputRef = useRef(null)
-
-  useEffect(() => {
-    inputRef.current?.focus()
-  }, [])
-
-  const submit = async () => {
-    const v = key.trim()
-    if (!v) return
-    setLoading(true)
-    setErr('')
-    try {
-      const r = await verifyToken(v)
-      if (r && r.ok) {
-        tokenStore.set(v)
-      } else {
-        setErr('密钥不正确')
-      }
-    } catch (e) {
-      setErr(e.message || '验证失败')
-    } finally {
-      setLoading(false)
-    }
-  }
-
-  return (
-    <div className="access-gate">
-      <div className="card" style={{ width: '100%', maxWidth: 360 }}>
-        <div style={{ display: 'flex', alignItems: 'center', gap: 10, marginBottom: 12 }}>
-          <img src="/logo.png" alt="" width={36} height={36} style={{ borderRadius: 8 }} />
-          <h1 style={{ fontSize: 18, margin: 0 }}>萌邮 MengPost</h1>
-        </div>
-        <p className="muted" style={{ marginBottom: 16, fontSize: 14 }}>
-          请输入访问密钥（与后端 <code>MP_TOKEN</code> 一致）
-        </p>
-        <input
-          ref={inputRef}
-          type="password"
-          autoComplete="off"
-          placeholder="访问密钥"
-          value={key}
-          onChange={(e) => setKey(e.target.value)}
-          onKeyDown={(e) => e.key === 'Enter' && submit()}
-        />
-        {err && (
-          <div style={{ color: 'var(--danger)', fontSize: 13, marginTop: 10 }}>{err}</div>
-        )}
-        <div style={{ marginTop: 14 }}>
-          <button type="button" className="btn-primary" disabled={loading} onClick={submit}>
-            {loading ? '验证中…' : '进入'}
-          </button>
-        </div>
-      </div>
-    </div>
-  )
-}
+import { useEffect, useRef, useState } from 'react'
+import { verifyToken, tokenStore } from '../api/client.js'
+
+/** 未携带有效密钥时全屏展示, 校验通过后写入 localStorage 并刷新应用状态 */
+export default function AccessGate() {
+  const [key, setKey] = useState('')
+  const [err, setErr] = useState('')
+  const [loading, setLoading] = useState(false)
+  const inputRef = useRef(null)
+
+  useEffect(() => {
+    inputRef.current?.focus()
+  }, [])
+
+  const submit = async () => {
+    const v = key.trim()
+    if (!v) return
+    setLoading(true)
+    setErr('')
+    try {
+      const r = await verifyToken(v)
+      if (r && r.ok) {
+        tokenStore.set(v)
+      } else {
+        setErr('密钥不正确')
+      }
+    } catch (e) {
+      setErr(e.message || '验证失败')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  return (
+    <div className="access-gate">
+      <div className="card" style={{ width: '100%', maxWidth: 360 }}>
+        <div style={{ display: 'flex', alignItems: 'center', gap: 10, marginBottom: 12 }}>
+          <img src="/logo.png" alt="" width={36} height={36} style={{ borderRadius: 8 }} />
+          <h1 style={{ fontSize: 18, margin: 0 }}>萌邮 MengPost</h1>
+        </div>
+        <p className="muted" style={{ marginBottom: 16, fontSize: 14 }}>
+          请输入访问密钥（与后端 <code>MP_TOKEN</code> 一致）
+        </p>
+        <input
+          ref={inputRef}
+          type="password"
+          autoComplete="off"
+          placeholder="访问密钥"
+          value={key}
+          onChange={(e) => setKey(e.target.value)}
+          onKeyDown={(e) => e.key === 'Enter' && submit()}
+        />
+        {err && (
+          <div style={{ color: 'var(--danger)', fontSize: 13, marginTop: 10 }}>{err}</div>
+        )}
+        <div style={{ marginTop: 14 }}>
+          <button type="button" className="btn-primary" disabled={loading} onClick={submit}>
+            {loading ? '验证中…' : '进入'}
+          </button>
+        </div>
+      </div>
+    </div>
+  )
+}
--- a/mengpost-frontend/src/components/MainLayout.jsx
+++ b/mengpost-frontend/src/components/MainLayout.jsx
@@ -1,99 +1,184 @@
-import { useEffect, useMemo, useState } from 'react'
-import { Link, NavLink, Outlet, useLocation } from 'react-router-dom'
-import { api } from '../api/client.js'
-
-function useMailboxAccountId() {
-  const loc = useLocation()
-  return useMemo(() => {
-    const m = loc.pathname.match(/\/admin\/mailbox\/(\d+)/)
-    return m ? Number(m[1]) : null
-  }, [loc.pathname])
-}
-
-function accountActive(location, id) {
-  return (
-    location.pathname === `/admin/mailbox/${id}` || location.pathname === `/admin/compose/${id}`
-  )
-}
-
-function SidebarMailboxLink({ accountId, name }) {
-  const location = useLocation()
-  const current = new URLSearchParams(location.search).get('mailbox') || 'INBOX'
-  const active =
-    location.pathname === `/admin/mailbox/${accountId}` && current === name
-  return (
-    <Link
-      to={`/admin/mailbox/${accountId}?mailbox=${encodeURIComponent(name)}`}
-      className={'sidebar-item' + (active ? ' active' : '')}
-    >
-      {name}
-    </Link>
-  )
-}
-
-export default function MainLayout() {
-  const location = useLocation()
-  const [accounts, setAccounts] = useState([])
-  const [boxes, setBoxes] = useState([])
-  const accountId = useMailboxAccountId()
-
-  useEffect(() => {
-    api
-      .listAccounts()
-      .then((rows) => setAccounts(Array.isArray(rows) ? rows : []))
-      .catch(() => setAccounts([]))
-  }, [location.pathname])
-
-  useEffect(() => {
-    if (!accountId) {
-      setBoxes([])
-      return
-    }
-    api
-      .listMailboxes(accountId)
-      .then((b) => setBoxes(Array.isArray(b) ? b : []))
-      .catch(() => setBoxes([]))
-  }, [accountId])
-
-  return (
-    <div className="app-shell">
-      <aside className="sidebar">
-        <div className="sidebar-section">
-          <div className="sidebar-label">邮箱</div>
-          {accounts.map((a) => (
-            <NavLink
-              key={a.id}
-              to={`/admin/mailbox/${a.id}`}
-              className={() =>
-                'sidebar-item' + (accountActive(location, a.id) ? ' active' : '')
-              }
-            >
-              <span className="sidebar-item-title">{a.name || '未命名'}</span>
-              <span className="sidebar-item-sub muted">{a.email}</span>
-            </NavLink>
-          ))}
-          {accounts.length === 0 && <p className="sidebar-muted">暂无账户</p>}
-          <Link to="/admin/accounts" className="sidebar-foot">
-            管理账户
-          </Link>
-        </div>
-
-        {accountId != null && (
-          <div className="sidebar-section">
-            <div className="sidebar-label">邮件夹</div>
-            {boxes.map((b) => (
-              <SidebarMailboxLink key={b} accountId={accountId} name={b} />
-            ))}
-            {boxes.length === 0 && <p className="sidebar-muted">暂无或加载中</p>}
-            <Link to={`/admin/compose/${accountId}`} className="sidebar-foot">
-              写邮件
-            </Link>
-          </div>
-        )}
-      </aside>
-      <main className="main-area">
-        <Outlet />
-      </main>
-    </div>
-  )
-}
+import { useCallback, useEffect, useMemo, useState } from 'react'
+import { Link, NavLink, Outlet, useLocation } from 'react-router-dom'
+import { api } from '../api/client.js'
+
+function emailDomain(email) {
+  const s = (email || '').trim().toLowerCase()
+  const at = s.lastIndexOf('@')
+  if (at < 0 || at === s.length - 1) return '其他'
+  return s.slice(at + 1)
+}
+
+function groupAccountsByDomain(accounts) {
+  const map = new Map()
+  for (const a of accounts) {
+    const d = emailDomain(a.email)
+    if (!map.has(d)) map.set(d, [])
+    map.get(d).push(a)
+  }
+  const groups = Array.from(map.entries()).map(([domain, items]) => ({
+    domain,
+    items: items.slice().sort((x, y) => (x.email || '').localeCompare(y.email || '', 'zh-CN')),
+  }))
+  groups.sort((a, b) => a.domain.localeCompare(b.domain, 'zh-CN'))
+  return groups
+}
+
+function useMailboxAccountId() {
+  const loc = useLocation()
+  return useMemo(() => {
+    const m = loc.pathname.match(/\/admin\/(?:mailbox|compose)\/(\d+)/)
+    return m ? Number(m[1]) : null
+  }, [loc.pathname])
+}
+
+function accountActive(location, id) {
+  return (
+    location.pathname === `/admin/mailbox/${id}` || location.pathname === `/admin/compose/${id}`
+  )
+}
+
+function SidebarMailboxLink({ accountId, name }) {
+  const location = useLocation()
+  const current = new URLSearchParams(location.search).get('mailbox') || 'INBOX'
+  const active =
+    location.pathname === `/admin/mailbox/${accountId}` && current === name
+  return (
+    <Link
+      to={`/admin/mailbox/${accountId}?mailbox=${encodeURIComponent(name)}`}
+      className={'sidebar-item' + (active ? ' active' : '')}
+    >
+      {name}
+    </Link>
+  )
+}
+
+export default function MainLayout() {
+  const location = useLocation()
+  const [accounts, setAccounts] = useState([])
+  const [boxes, setBoxes] = useState([])
+  const [domainCollapsed, setDomainCollapsed] = useState({})
+  const accountId = useMailboxAccountId()
+
+  const groupedAccounts = useMemo(() => groupAccountsByDomain(accounts), [accounts])
+
+  const expandAllDomains = useCallback(() => setDomainCollapsed({}), [])
+  const collapseAllDomains = useCallback(() => {
+    const next = {}
+    for (const g of groupedAccounts) next[g.domain] = true
+    setDomainCollapsed(next)
+  }, [groupedAccounts])
+
+  const toggleDomain = useCallback((domain) => {
+    setDomainCollapsed((c) => ({ ...c, [domain]: !c[domain] }))
+  }, [])
+
+  useEffect(() => {
+    api
+      .listAccounts()
+      .then((rows) => setAccounts(Array.isArray(rows) ? rows : []))
+      .catch(() => setAccounts([]))
+  }, [location.pathname])
+
+  // 当前选中的账户所在分组自动展开
+  useEffect(() => {
+    const active = accounts.find((a) => accountActive(location, a.id))
+    if (!active) return
+    const d = emailDomain(active.email)
+    setDomainCollapsed((c) => {
+      if (!c[d]) return c
+      const next = { ...c }
+      delete next[d]
+      return next
+    })
+  }, [location.pathname, accounts])
+
+  useEffect(() => {
+    if (!accountId) {
+      setBoxes([])
+      return
+    }
+    api
+      .listMailboxes(accountId)
+      .then((b) => setBoxes(Array.isArray(b) ? b : []))
+      .catch(() => setBoxes([]))
+  }, [accountId])
+
+  return (
+    <div className="app-shell">
+      <aside className="sidebar">
+        <div className="sidebar-section">
+          <div className="sidebar-label-row">
+            <div className="sidebar-label">邮箱</div>
+            {accounts.length > 0 && (
+              <div className="sidebar-label-actions">
+                <button type="button" className="sidebar-mini-btn" onClick={expandAllDomains}>
+                  全部展开
+                </button>
+                <button type="button" className="sidebar-mini-btn" onClick={collapseAllDomains}>
+                  全部收起
+                </button>
+              </div>
+            )}
+          </div>
+          {groupedAccounts.map(({ domain, items }) => {
+            const collapsed = !!domainCollapsed[domain]
+            return (
+              <div key={domain} className="sidebar-group">
+                <button
+                  type="button"
+                  className="sidebar-group-header"
+                  onClick={() => toggleDomain(domain)}
+                  aria-expanded={!collapsed}
+                >
+                  <span className="sidebar-group-chevron" aria-hidden>
+                    {collapsed ? '\u25B8' : '\u25BE'}
+                  </span>
+                  <span className="sidebar-group-title">@{domain}</span>
+                  <span className="sidebar-group-count">{items.length}</span>
+                </button>
+                {!collapsed && (
+                  <div className="sidebar-group-body">
+                    {items.map((a) => (
+                      <NavLink
+                        key={a.id}
+                        to={`/admin/mailbox/${a.id}`}
+                        className={() =>
+                          'sidebar-item' + (accountActive(location, a.id) ? ' active' : '')
+                        }
+                      >
+                        <span className="sidebar-item-title">{a.name || '未命名'}</span>
+                        <span className="sidebar-item-sub muted">{a.email}</span>
+                      </NavLink>
+                    ))}
+                  </div>
+                )}
+              </div>
+            )
+          })}
+          {accounts.length === 0 && <p className="sidebar-muted">暂无账户</p>}
+          <Link to="/admin/accounts" className="sidebar-foot">
+            管理账户
+          </Link>
+        </div>
+      </aside>
+      <main className="main-area">
+        <Outlet />
+      </main>
+      {accountId != null && (
+        <aside className="sidebar sidebar-right" aria-label="邮件夹">
+          <div className="sidebar-section">
+            <div className="sidebar-label">邮件夹</div>
+            {boxes.map((b) => (
+              <SidebarMailboxLink key={b} accountId={accountId} name={b} />
+            ))}
+            {boxes.length === 0 && <p className="sidebar-muted">暂无或加载中</p>}
+            <Link to={`/admin/compose/${accountId}`} className="sidebar-foot">
+              写邮件
+            </Link>
+          </div>
+        </aside>
+      )}
+    </div>
+  )
+}
--- a/mengpost-frontend/src/components/Topbar.jsx
+++ b/mengpost-frontend/src/components/Topbar.jsx
@@ -1,29 +1,29 @@
-import { NavLink, useNavigate } from 'react-router-dom'
-import { tokenStore } from '../api/client.js'
-
-export default function Topbar() {
-  const nav = useNavigate()
-
-  const logout = () => {
-    tokenStore.clear()
-    nav('/', { replace: true })
-  }
-
-  return (
-    <header className="topbar">
-      <NavLink to="/admin" className="brand" style={{ textDecoration: 'none', color: 'inherit' }}>
-        <img className="logo" src="/logo.png" alt="" width={28} height={28} />
-        <span>萌邮 MengPost</span>
-      </NavLink>
-      <nav>
-        <NavLink to="/admin" end>
-          概览
-        </NavLink>
-        <NavLink to="/admin/accounts">账户</NavLink>
-        <a onClick={logout} style={{ cursor: 'pointer' }}>
-          登出
-        </a>
-      </nav>
-    </header>
-  )
-}
+import { NavLink, useNavigate } from 'react-router-dom'
+import { tokenStore } from '../api/client.js'
+
+export default function Topbar() {
+  const nav = useNavigate()
+
+  const logout = () => {
+    tokenStore.clear()
+    nav('/', { replace: true })
+  }
+
+  return (
+    <header className="topbar">
+      <NavLink to="/admin" className="brand" style={{ textDecoration: 'none', color: 'inherit' }}>
+        <img className="logo" src="/logo.png" alt="" width={28} height={28} />
+        <span>萌邮 MengPost</span>
+      </NavLink>
+      <nav>
+        <NavLink to="/admin" end>
+          概览
+        </NavLink>
+        <NavLink to="/admin/accounts">账户</NavLink>
+        <a onClick={logout} style={{ cursor: 'pointer' }}>
+          登出
+        </a>
+      </nav>
+    </header>
+  )
+}
--- a/mengpost-frontend/src/main.jsx
+++ b/mengpost-frontend/src/main.jsx
@@ -1,13 +1,13 @@
-import React from 'react'
-import ReactDOM from 'react-dom/client'
-import { BrowserRouter } from 'react-router-dom'
-import App from './App.jsx'
-import './styles/global.css'
-
-ReactDOM.createRoot(document.getElementById('root')).render(
-  <React.StrictMode>
-    <BrowserRouter>
-      <App />
-    </BrowserRouter>
-  </React.StrictMode>,
-)
+import React from 'react'
+import ReactDOM from 'react-dom/client'
+import { BrowserRouter } from 'react-router-dom'
+import App from './App.jsx'
+import './styles/global.css'
+
+ReactDOM.createRoot(document.getElementById('root')).render(
+  <React.StrictMode>
+    <BrowserRouter>
+      <App />
+    </BrowserRouter>
+  </React.StrictMode>,
+)
--- a/mengpost-frontend/src/pages/Accounts.jsx
+++ b/mengpost-frontend/src/pages/Accounts.jsx
@@ -1,225 +1,311 @@
-import { useEffect, useState, useCallback } from 'react'
-import { api } from '../api/client.js'
-
-const empty = {
-  name: '',
-  email: '',
-  password: '',
-  smtp_host: '',
-  smtp_port: 465,
-  imap_host: '',
-  imap_port: 993,
-  use_tls: true,
-}
-
-export default function Accounts() {
-  const [list, setList] = useState([])
-  const [form, setForm] = useState(empty)
-  const [editing, setEditing] = useState(null)
-  const [modalOpen, setModalOpen] = useState(false)
-  const [err, setErr] = useState('')
-  const [msg, setMsg] = useState('')
-
-  const reload = () =>
-    api
-      .listAccounts()
-      .then((rows) => setList(Array.isArray(rows) ? rows : []))
-      .catch((e) => setErr(e.message))
-
-  useEffect(() => {
-    reload()
-  }, [])
-
-  const openNew = () => {
-    setEditing(null)
-    setForm(empty)
-    setErr('')
-    setMsg('')
-    setModalOpen(true)
-  }
-
-  const openEdit = (a) => {
-    setEditing(a.id)
-    setForm({ ...a, password: '' })
-    setErr('')
-    setMsg('')
-    setModalOpen(true)
-  }
-
-  const closeModal = useCallback(() => {
-    setModalOpen(false)
-    setEditing(null)
-    setForm(empty)
-    setErr('')
-  }, [])
-
-  useEffect(() => {
-    if (!modalOpen) return
-    const onKey = (e) => {
-      if (e.key === 'Escape') closeModal()
-    }
-    window.addEventListener('keydown', onKey)
-    return () => window.removeEventListener('keydown', onKey)
-  }, [modalOpen, closeModal])
-
-  const save = async (e) => {
-    e.preventDefault()
-    setErr('')
-    try {
-      if (editing) {
-        await api.updateAccount(editing, form)
-        setMsg('已更新')
-      } else {
-        await api.createAccount(form)
-        setMsg('已创建')
-      }
-      closeModal()
-      reload()
-    } catch (e) {
-      setErr(e.message)
-    }
-  }
-
-  const del = async (id) => {
-    if (!confirm('确定删除该账户?')) return
-    try {
-      await api.deleteAccount(id)
-      setMsg('已删除')
-      reload()
-    } catch (e) {
-      setErr(e.message)
-    }
-  }
-
-  const set = (k) => (e) => {
-    const v =
-      e.target.type === 'checkbox'
-        ? e.target.checked
-        : e.target.type === 'number'
-          ? Number(e.target.value)
-          : e.target.value
-    setForm({ ...form, [k]: v })
-  }
-
-  return (
-    <div className="main-inner">
-      <div className="page-toolbar">
-        <h1 className="page-title">邮箱账户</h1>
-        <button type="button" className="btn-primary" onClick={openNew}>
-          新增账户
-        </button>
-      </div>
-
-      {msg && <p style={{ color: '#16a34a', margin: '0 0 12px' }}>{msg}</p>}
-      {err && !modalOpen && (
-        <p style={{ color: 'var(--danger)', margin: '0 0 12px' }}>{err}</p>
-      )}
-
-      <div className="card">
-        <h2 style={{ marginTop: 0 }}>已有账户</h2>
-        {list.length === 0 ? (
-          <p className="muted">暂无账户。</p>
-        ) : (
-          <table>
-            <thead>
-              <tr>
-                <th>名称</th>
-                <th>邮箱</th>
-                <th>SMTP</th>
-                <th>IMAP</th>
-                <th></th>
-              </tr>
-            </thead>
-            <tbody>
-              {list.map((a) => (
-                <tr key={a.id}>
-                  <td>{a.name}</td>
-                  <td>{a.email}</td>
-                  <td>
-                    {a.smtp_host}:{a.smtp_port}
-                  </td>
-                  <td>
-                    {a.imap_host}:{a.imap_port}
-                  </td>
-                  <td>
-                    <button type="button" onClick={() => openEdit(a)}>
-                      编辑
-                    </button>{' '}
-                    <button type="button" className="btn-danger" onClick={() => del(a.id)}>
-                      删除
-                    </button>
-                  </td>
-                </tr>
-              ))}
-            </tbody>
-          </table>
-        )}
-      </div>
-
-      {modalOpen && (
-        <div
-          className="modal-mask"
-          role="presentation"
-          onClick={(e) => e.target === e.currentTarget && closeModal()}
-        >
-          <div className="modal modal-wide" onClick={(e) => e.stopPropagation()}>
-            <h2>{editing ? `编辑账户 #${editing}` : '新增账户'}</h2>
-            <form onSubmit={save}>
-              <div className="form-row">
-                <label>名称</label>
-                <input value={form.name} onChange={set('name')} placeholder="工作 / 私人" required />
-              </div>
-              <div className="form-row">
-                <label>邮箱</label>
-                <input value={form.email} onChange={set('email')} type="email" required />
-              </div>
-              <div className="form-row">
-                <label>密码 / 授权码</label>
-                <input
-                  value={form.password}
-                  onChange={set('password')}
-                  type="password"
-                  placeholder={editing ? '留空不修改' : ''}
-                />
-              </div>
-              <div className="form-row">
-                <label>SMTP 主机</label>
-                <input value={form.smtp_host} onChange={set('smtp_host')} placeholder="smtp.example.com" required />
-              </div>
-              <div className="form-row">
-                <label>SMTP 端口</label>
-                <input value={form.smtp_port} onChange={set('smtp_port')} type="number" required />
-              </div>
-              <div className="form-row">
-                <label>IMAP 主机</label>
-                <input value={form.imap_host} onChange={set('imap_host')} placeholder="imap.example.com" required />
-              </div>
-              <div className="form-row">
-                <label>IMAP 端口</label>
-                <input value={form.imap_port} onChange={set('imap_port')} type="number" required />
-              </div>
-              <div className="form-row">
-                <label>使用 TLS/SSL</label>
-                <label style={{ display: 'flex', alignItems: 'center', gap: 6 }}>
-                  <input type="checkbox" checked={form.use_tls} onChange={set('use_tls')} style={{ width: 'auto' }} />
-                  <span className="muted">建议开启</span>
-                </label>
-              </div>
-              {err && (
-                <div style={{ color: 'var(--danger)', marginTop: 8, fontSize: 14 }}>{err}</div>
-              )}
-              <div className="actions" style={{ marginTop: 16 }}>
-                <button type="button" onClick={closeModal}>
-                  取消
-                </button>
-                <button type="submit" className="btn-primary">
-                  {editing ? '保存' : '创建'}
-                </button>
-              </div>
-            </form>
-          </div>
-        </div>
-      )}
-    </div>
-  )
-}
+import { useEffect, useState, useCallback } from 'react'
+import { useSearchParams } from 'react-router-dom'
+import { api } from '../api/client.js'
+
+const empty = {
+  name: '',
+  email: '',
+  password: '',
+  smtp_host: '',
+  smtp_port: 465,
+  imap_host: '',
+  imap_port: 993,
+  use_tls: true,
+}
+
+function authLabel(t) {
+  return t === 'oauth_microsoft' ? 'OAuth（微软）' : '密码'
+}
+
+export default function Accounts() {
+  const [searchParams, setSearchParams] = useSearchParams()
+  const [list, setList] = useState([])
+  const [form, setForm] = useState(empty)
+  const [editing, setEditing] = useState(null)
+  const [modalOpen, setModalOpen] = useState(false)
+  const [err, setErr] = useState('')
+  const [msg, setMsg] = useState('')
+
+  const reload = () =>
+    api
+      .listAccounts()
+      .then((rows) => setList(Array.isArray(rows) ? rows : []))
+      .catch((e) => setErr(e.message))
+
+  useEffect(() => {
+    reload()
+  }, [])
+
+  useEffect(() => {
+    const ms = searchParams.get('oauth_ms')
+    const oe = searchParams.get('oauth_err')
+    if (!ms && !oe) return
+
+    const next = new URLSearchParams(searchParams)
+    if (oe) {
+      setErr(decodeURIComponent(oe.replace(/\+/g, ' ')))
+      next.delete('oauth_err')
+    }
+    if (ms) {
+      next.delete('oauth_ms')
+    }
+    setSearchParams(next, { replace: true })
+
+    if (ms) {
+      const gate = `mp_ms_oauth_${ms}`
+      let skip = false
+      try {
+        if (sessionStorage.getItem(gate)) skip = true
+        else sessionStorage.setItem(gate, '1')
+      } catch {
+        /* ignore */
+      }
+      if (skip) return
+      api
+        .microsoftOAuthFinish(ms)
+        .then(() => {
+          setMsg('微软账户已通过 OAuth 连接')
+          reload()
+        })
+        .catch((e) => {
+          try {
+            sessionStorage.removeItem(gate)
+          } catch {
+            /* ignore */
+          }
+          setErr(e.message)
+        })
+    }
+  }, [searchParams, setSearchParams])
+
+  const startMicrosoftOAuth = async () => {
+    setErr('')
+    setMsg('')
+    try {
+      const { url } = await api.microsoftOAuthStart()
+      if (url) window.location.href = url
+    } catch (e) {
+      setErr(e.message)
+    }
+  }
+
+  const openNew = () => {
+    setEditing(null)
+    setForm(empty)
+    setErr('')
+    setMsg('')
+    setModalOpen(true)
+  }
+
+  const openEdit = (a) => {
+    setEditing(a.id)
+    setForm({ ...a, password: '' })
+    setErr('')
+    setMsg('')
+    setModalOpen(true)
+  }
+
+  const closeModal = useCallback(() => {
+    setModalOpen(false)
+    setEditing(null)
+    setForm(empty)
+    setErr('')
+  }, [])
+
+  useEffect(() => {
+    if (!modalOpen) return
+    const onKey = (e) => {
+      if (e.key === 'Escape') closeModal()
+    }
+    window.addEventListener('keydown', onKey)
+    return () => window.removeEventListener('keydown', onKey)
+  }, [modalOpen, closeModal])
+
+  const save = async (e) => {
+    e.preventDefault()
+    setErr('')
+    try {
+      if (editing) {
+        await api.updateAccount(editing, form)
+        setMsg('已更新')
+      } else {
+        await api.createAccount(form)
+        setMsg('已创建')
+      }
+      closeModal()
+      reload()
+    } catch (e) {
+      setErr(e.message)
+    }
+  }
+
+  const del = async (id) => {
+    if (!confirm('确定删除该账户?')) return
+    try {
+      await api.deleteAccount(id)
+      setMsg('已删除')
+      reload()
+    } catch (e) {
+      setErr(e.message)
+    }
+  }
+
+  const set = (k) => (e) => {
+    const v =
+      e.target.type === 'checkbox'
+        ? e.target.checked
+        : e.target.type === 'number'
+          ? Number(e.target.value)
+          : e.target.value
+    setForm({ ...form, [k]: v })
+  }
+
+  return (
+    <div className="main-inner">
+      <div className="page-toolbar">
+        <h1 className="page-title">邮箱账户</h1>
+        <div style={{ display: 'flex', flexWrap: 'wrap', gap: 8 }}>
+          <button type="button" className="btn-primary" onClick={startMicrosoftOAuth}>
+            微软邮箱 OAuth 登录
+          </button>
+          <button type="button" className="btn-primary" onClick={openNew}>
+            新增账户
+          </button>
+        </div>
+      </div>
+
+      {msg && <p style={{ color: '#16a34a', margin: '0 0 12px' }}>{msg}</p>}
+      {err && !modalOpen && (
+        <p style={{ color: 'var(--danger)', margin: '0 0 12px' }}>{err}</p>
+      )}
+
+      <div className="card">
+        <h2 style={{ marginTop: 0 }}>已有账户</h2>
+        {list.length === 0 ? (
+          <p className="muted">暂无账户。</p>
+        ) : (
+          <table>
+            <thead>
+              <tr>
+                <th>名称</th>
+                <th>邮箱</th>
+                <th>认证</th>
+                <th>SMTP</th>
+                <th>IMAP</th>
+                <th></th>
+              </tr>
+            </thead>
+            <tbody>
+              {list.map((a) => (
+                <tr key={a.id}>
+                  <td>{a.name}</td>
+                  <td>{a.email}</td>
+                  <td>{authLabel(a.auth_type)}</td>
+                  <td>
+                    {a.smtp_host}:{a.smtp_port}
+                  </td>
+                  <td>
+                    {a.imap_host}:{a.imap_port}
+                  </td>
+                  <td>
+                    <button type="button" onClick={() => openEdit(a)}>
+                      编辑
+                    </button>{' '}
+                    <button type="button" className="btn-danger" onClick={() => del(a.id)}>
+                      删除
+                    </button>
+                  </td>
+                </tr>
+              ))}
+            </tbody>
+          </table>
+        )}
+      </div>
+
+      {modalOpen && (
+        <div
+          className="modal-mask"
+          role="presentation"
+          onClick={(e) => e.target === e.currentTarget && closeModal()}
+        >
+          <div className="modal modal-wide" onClick={(e) => e.stopPropagation()}>
+            <h2>{editing ? `编辑账户 #${editing}` : '新增账户'}</h2>
+            <form onSubmit={save}>
+              <div className="form-row">
+                <label>快速配置</label>
+                <div style={{ display: 'flex', flexWrap: 'wrap', gap: 8, alignItems: 'center' }}>
+                  <button
+                    type="button"
+                    onClick={() =>
+                      setForm((f) => ({
+                        ...f,
+                        smtp_host: '',
+                        smtp_port: 465,
+                        imap_host: '',
+                        imap_port: 993,
+                        use_tls: true,
+                      }))
+                    }
+                  >
+                    清空主机（手动填）
+                  </button>
+                </div>
+              </div>
+              <div className="form-row">
+                <label>名称</label>
+                <input value={form.name} onChange={set('name')} placeholder="工作 / 私人" required />
+              </div>
+              <div className="form-row">
+                <label>邮箱</label>
+                <input value={form.email} onChange={set('email')} type="email" required />
+              </div>
+              <div className="form-row">
+                <label>密码 / 授权码</label>
+                <input
+                  value={form.password}
+                  onChange={set('password')}
+                  type="password"
+                  placeholder={editing ? '留空不修改' : '各邮箱授权码或密码'}
+                />
+              </div>
+              <div className="form-row">
+                <label>SMTP 主机</label>
+                <input value={form.smtp_host} onChange={set('smtp_host')} placeholder="smtp.example.com" required />
+              </div>
+              <div className="form-row">
+                <label>SMTP 端口</label>
+                <input value={form.smtp_port} onChange={set('smtp_port')} type="number" required />
+              </div>
+              <div className="form-row">
+                <label>IMAP 主机</label>
+                <input value={form.imap_host} onChange={set('imap_host')} placeholder="imap.example.com" required />
+              </div>
+              <div className="form-row">
+                <label>IMAP 端口</label>
+                <input value={form.imap_port} onChange={set('imap_port')} type="number" required />
+              </div>
+              <div className="form-row">
+                <label>使用 TLS/SSL</label>
+                <label style={{ display: 'flex', alignItems: 'center', gap: 6 }}>
+                  <input type="checkbox" checked={form.use_tls} onChange={set('use_tls')} style={{ width: 'auto' }} />
+                  <span className="muted">建议开启</span>
+                </label>
+              </div>
+              {err && (
+                <div style={{ color: 'var(--danger)', marginTop: 8, fontSize: 14 }}>{err}</div>
+              )}
+              <div className="actions" style={{ marginTop: 16 }}>
+                <button type="button" onClick={closeModal}>
+                  取消
+                </button>
+                <button type="submit" className="btn-primary">
+                  {editing ? '保存' : '创建'}
+                </button>
+              </div>
+            </form>
+          </div>
+        </div>
+      )}
+    </div>
+  )
+}
--- a/mengpost-frontend/src/pages/Admin.jsx
+++ b/mengpost-frontend/src/pages/Admin.jsx
@@ -1,57 +1,57 @@
-import { useEffect, useState } from 'react'
-import { Link } from 'react-router-dom'
-import { api } from '../api/client.js'
-
-export default function Admin() {
-  const [accounts, setAccounts] = useState([])
-  const [err, setErr] = useState('')
-
-  useEffect(() => {
-    api
-      .listAccounts()
-      .then((rows) => setAccounts(Array.isArray(rows) ? rows : []))
-      .catch((e) => setErr(e.message))
-  }, [])
-
-  return (
-    <div className="main-inner">
-      <h1 className="page-title">概览</h1>
-      <p className="muted">共 {accounts.length} 个邮箱账户</p>
-
-      {err && (
-        <div className="card" style={{ color: 'var(--danger)' }}>
-          {err}
-        </div>
-      )}
-
-      <div className="card">
-        {accounts.length === 0 ? (
-          <p className="muted">
-            暂无账户，前往 <Link to="/admin/accounts">管理账户</Link> 添加。
-          </p>
-        ) : (
-          <table>
-            <thead>
-              <tr>
-                <th>名称</th>
-                <th>邮箱</th>
-                <th></th>
-              </tr>
-            </thead>
-            <tbody>
-              {accounts.map((a) => (
-                <tr key={a.id}>
-                  <td>{a.name}</td>
-                  <td>{a.email}</td>
-                  <td>
-                    <Link to={`/admin/mailbox/${a.id}`}>打开</Link>
-                  </td>
-                </tr>
-              ))}
-            </tbody>
-          </table>
-        )}
-      </div>
-    </div>
-  )
-}
+import { useEffect, useState } from 'react'
+import { Link } from 'react-router-dom'
+import { api } from '../api/client.js'
+
+export default function Admin() {
+  const [accounts, setAccounts] = useState([])
+  const [err, setErr] = useState('')
+
+  useEffect(() => {
+    api
+      .listAccounts()
+      .then((rows) => setAccounts(Array.isArray(rows) ? rows : []))
+      .catch((e) => setErr(e.message))
+  }, [])
+
+  return (
+    <div className="main-inner">
+      <h1 className="page-title">概览</h1>
+      <p className="muted">共 {accounts.length} 个邮箱账户</p>
+
+      {err && (
+        <div className="card" style={{ color: 'var(--danger)' }}>
+          {err}
+        </div>
+      )}
+
+      <div className="card">
+        {accounts.length === 0 ? (
+          <p className="muted">
+            暂无账户，前往 <Link to="/admin/accounts">管理账户</Link> 添加。
+          </p>
+        ) : (
+          <table>
+            <thead>
+              <tr>
+                <th>名称</th>
+                <th>邮箱</th>
+                <th></th>
+              </tr>
+            </thead>
+            <tbody>
+              {accounts.map((a) => (
+                <tr key={a.id}>
+                  <td>{a.name}</td>
+                  <td>{a.email}</td>
+                  <td>
+                    <Link to={`/admin/mailbox/${a.id}`}>打开</Link>
+                  </td>
+                </tr>
+              ))}
+            </tbody>
+          </table>
+        )}
+      </div>
+    </div>
+  )
+}
--- a/mengpost-frontend/src/pages/Compose.jsx
+++ b/mengpost-frontend/src/pages/Compose.jsx
@@ -1,78 +1,78 @@
-import { useEffect, useState } from 'react'
-import { useNavigate, useParams } from 'react-router-dom'
-import { api } from '../api/client.js'
-
-export default function Compose() {
-  const { id } = useParams()
-  const accountId = Number(id)
-  const nav = useNavigate()
-  const [accounts, setAccounts] = useState([])
-  const [form, setForm] = useState({ to: '', subject: '', body: '', html: false })
-  const [sending, setSending] = useState(false)
-  const [err, setErr] = useState('')
-  const [msg, setMsg] = useState('')
-
-  useEffect(() => {
-    api
-      .listAccounts()
-      .then((rows) => setAccounts(Array.isArray(rows) ? rows : []))
-      .catch(() => {})
-  }, [])
-
-  const set = (k) => (e) => {
-    const v = e.target.type === 'checkbox' ? e.target.checked : e.target.value
-    setForm({ ...form, [k]: v })
-  }
-
-  const send = async (e) => {
-    e.preventDefault()
-    setErr(''); setMsg(''); setSending(true)
-    try {
-      await api.send(accountId, form)
-      setMsg('发送成功')
-      setForm({ to: '', subject: '', body: '', html: false })
-    } catch (e) { setErr(e.message) }
-    finally { setSending(false) }
-  }
-
-  const acc = accounts.find((a) => a.id === accountId)
-
-  return (
-    <div className="main-inner">
-      <h1 className="page-title">撰写</h1>
-      <p className="muted">{acc ? acc.email : `#${accountId}`}</p>
-
-      <div className="card">
-        <form onSubmit={send}>
-          <div className="form-row"><label>切换账户</label>
-            <select value={accountId} onChange={(e) => nav(`/admin/compose/${e.target.value}`)}>
-              {accounts.map((a) => (
-                <option key={a.id} value={a.id}>{a.name} &lt;{a.email}&gt;</option>
-              ))}
-            </select>
-          </div>
-          <div className="form-row"><label>收件人</label><input value={form.to} onChange={set('to')} type="email" required /></div>
-          <div className="form-row"><label>主题</label><input value={form.subject} onChange={set('subject')} required /></div>
-          <div className="form-row">
-            <label>HTML</label>
-            <label style={{ display: 'flex', alignItems: 'center', gap: 6 }}>
-              <input type="checkbox" checked={form.html} onChange={set('html')} style={{ width: 'auto' }} />
-              <span className="muted">按 HTML 发送</span>
-            </label>
-          </div>
-          <div className="form-row" style={{ alignItems: 'start' }}>
-            <label>正文</label>
-            <textarea value={form.body} onChange={set('body')} rows={10} required />
-          </div>
-          <div style={{ marginTop: 8 }}>
-            <button type="submit" className="btn-primary" disabled={sending}>
-              {sending ? '发送中…' : '发送'}
-            </button>
-          </div>
-          {err && <div style={{ color: 'var(--danger)', marginTop: 8 }}>{err}</div>}
-          {msg && <div style={{ color: '#16a34a', marginTop: 8 }}>{msg}</div>}
-        </form>
-      </div>
-    </div>
-  )
-}
+import { useEffect, useState } from 'react'
+import { useNavigate, useParams } from 'react-router-dom'
+import { api } from '../api/client.js'
+
+export default function Compose() {
+  const { id } = useParams()
+  const accountId = Number(id)
+  const nav = useNavigate()
+  const [accounts, setAccounts] = useState([])
+  const [form, setForm] = useState({ to: '', subject: '', body: '', html: false })
+  const [sending, setSending] = useState(false)
+  const [err, setErr] = useState('')
+  const [msg, setMsg] = useState('')
+
+  useEffect(() => {
+    api
+      .listAccounts()
+      .then((rows) => setAccounts(Array.isArray(rows) ? rows : []))
+      .catch(() => {})
+  }, [])
+
+  const set = (k) => (e) => {
+    const v = e.target.type === 'checkbox' ? e.target.checked : e.target.value
+    setForm({ ...form, [k]: v })
+  }
+
+  const send = async (e) => {
+    e.preventDefault()
+    setErr(''); setMsg(''); setSending(true)
+    try {
+      await api.send(accountId, form)
+      setMsg('发送成功')
+      setForm({ to: '', subject: '', body: '', html: false })
+    } catch (e) { setErr(e.message) }
+    finally { setSending(false) }
+  }
+
+  const acc = accounts.find((a) => a.id === accountId)
+
+  return (
+    <div className="main-inner">
+      <h1 className="page-title">撰写</h1>
+      <p className="muted">{acc ? acc.email : `#${accountId}`}</p>
+
+      <div className="card">
+        <form onSubmit={send}>
+          <div className="form-row"><label>切换账户</label>
+            <select value={accountId} onChange={(e) => nav(`/admin/compose/${e.target.value}`)}>
+              {accounts.map((a) => (
+                <option key={a.id} value={a.id}>{a.name} &lt;{a.email}&gt;</option>
+              ))}
+            </select>
+          </div>
+          <div className="form-row"><label>收件人</label><input value={form.to} onChange={set('to')} type="email" required /></div>
+          <div className="form-row"><label>主题</label><input value={form.subject} onChange={set('subject')} required /></div>
+          <div className="form-row">
+            <label>HTML</label>
+            <label style={{ display: 'flex', alignItems: 'center', gap: 6 }}>
+              <input type="checkbox" checked={form.html} onChange={set('html')} style={{ width: 'auto' }} />
+              <span className="muted">按 HTML 发送</span>
+            </label>
+          </div>
+          <div className="form-row" style={{ alignItems: 'start' }}>
+            <label>正文</label>
+            <textarea value={form.body} onChange={set('body')} rows={10} required />
+          </div>
+          <div style={{ marginTop: 8 }}>
+            <button type="submit" className="btn-primary" disabled={sending}>
+              {sending ? '发送中…' : '发送'}
+            </button>
+          </div>
+          {err && <div style={{ color: 'var(--danger)', marginTop: 8 }}>{err}</div>}
+          {msg && <div style={{ color: '#16a34a', marginTop: 8 }}>{msg}</div>}
+        </form>
+      </div>
+    </div>
+  )
+}
--- a/mengpost-frontend/src/pages/Home.jsx
+++ b/mengpost-frontend/src/pages/Home.jsx
@@ -1,5 +1,5 @@
-import { Navigate } from 'react-router-dom'
-
-export default function Home() {
-  return <Navigate to="/admin" replace />
-}
+import { Navigate } from 'react-router-dom'
+
+export default function Home() {
+  return <Navigate to="/admin" replace />
+}
--- a/mengpost-frontend/src/pages/Mailbox.jsx
+++ b/mengpost-frontend/src/pages/Mailbox.jsx
@@ -1,108 +1,108 @@
-import { useCallback, useEffect, useState } from 'react'
-import { useParams, useSearchParams } from 'react-router-dom'
-import { api } from '../api/client.js'
-
-export default function Mailbox() {
-  const { id } = useParams()
-  const accountId = Number(id)
-  const [searchParams] = useSearchParams()
-  const mailbox = searchParams.get('mailbox') || 'INBOX'
-
-  const [list, setList] = useState([])
-  const [active, setActive] = useState(null)
-  const [loading, setLoading] = useState(false)
-  const [err, setErr] = useState('')
-
-  useEffect(() => {
-    setActive(null)
-    setLoading(true)
-    setErr('')
-    api
-      .listMessages(accountId, mailbox)
-      .then((l) => setList(l || []))
-      .catch((e) => setErr(e.message))
-      .finally(() => setLoading(false))
-  }, [accountId, mailbox])
-
-  const closeDetail = useCallback(() => setActive(null), [])
-
-  useEffect(() => {
-    if (!active) return
-    const onKey = (e) => {
-      if (e.key === 'Escape') closeDetail()
-    }
-    window.addEventListener('keydown', onKey)
-    return () => window.removeEventListener('keydown', onKey)
-  }, [active, closeDetail])
-
-  const open = async (m) => {
-    setActive({ ...m, loading: true })
-    try {
-      const d = await api.getMessage(accountId, m.uid, mailbox)
-      setActive(d)
-    } catch (e) {
-      setActive({ ...m, error: e.message, loading: false })
-    }
-  }
-
-  return (
-    <div className="main-inner">
-      <div className="page-toolbar">
-        <h1 className="page-title">{mailbox}</h1>
-      </div>
-
-      <div className="card" style={{ padding: 0 }}>
-        {loading && <p className="muted" style={{ padding: 12 }}>加载中…</p>}
-        {err && <p style={{ color: 'var(--danger)', padding: 12 }}>{err}</p>}
-        {!loading && !err && list.length === 0 && (
-          <p className="muted" style={{ padding: 12 }}>暂无邮件</p>
-        )}
-        <ul className="mail-list">
-          {list.map((m) => (
-            <li key={m.uid} className={m.seen ? '' : 'unseen'} onClick={() => open(m)}>
-              <div className="subject">{m.subject || '(无主题)'}</div>
-              <div className="from">
-                {m.from} · {m.date && new Date(m.date).toLocaleString()}
-              </div>
-            </li>
-          ))}
-        </ul>
-      </div>
-
-      {active && (
-        <div
-          className="modal-mask"
-          role="dialog"
-          aria-modal="true"
-          aria-labelledby="mail-subject"
-          onClick={(e) => e.target === e.currentTarget && closeDetail()}
-        >
-          <div className="modal modal-mail" onClick={(e) => e.stopPropagation()}>
-            <div className="modal-mail-toolbar">
-              <h2 id="mail-subject">{active.subject || '(无主题)'}</h2>
-              <button type="button" onClick={closeDetail}>
-                关闭
-              </button>
-            </div>
-            <div className="modal-mail-meta muted">
-              <p>发件人: {active.from || '—'}</p>
-              {active.to && active.to.length > 0 && (
-                <p>收件人: {active.to.join(', ')}</p>
-              )}
-            </div>
-            <div className="modal-mail-body">
-              {active.loading && <p className="muted">加载中…</p>}
-              {active.error && <p style={{ color: 'var(--danger)' }}>{active.error}</p>}
-              {!active.loading && !active.error && active.html && (
-                <iframe title="mail-html" srcDoc={active.html} />
-              )}
-              {!active.loading && !active.error && !active.html && (
-                <pre>{active.text || ''}</pre>
-              )}
-            </div>
-          </div>
-        </div>
-      )}
-    </div>
-  )
-}
+import { useCallback, useEffect, useState } from 'react'
+import { useParams, useSearchParams } from 'react-router-dom'
+import { api } from '../api/client.js'
+
+export default function Mailbox() {
+  const { id } = useParams()
+  const accountId = Number(id)
+  const [searchParams] = useSearchParams()
+  const mailbox = searchParams.get('mailbox') || 'INBOX'
+
+  const [list, setList] = useState([])
+  const [active, setActive] = useState(null)
+  const [loading, setLoading] = useState(false)
+  const [err, setErr] = useState('')
+
+  useEffect(() => {
+    setActive(null)
+    setLoading(true)
+    setErr('')
+    api
+      .listMessages(accountId, mailbox)
+      .then((l) => setList(l || []))
+      .catch((e) => setErr(e.message))
+      .finally(() => setLoading(false))
+  }, [accountId, mailbox])
+
+  const closeDetail = useCallback(() => setActive(null), [])
+
+  useEffect(() => {
+    if (!active) return
+    const onKey = (e) => {
+      if (e.key === 'Escape') closeDetail()
+    }
+    window.addEventListener('keydown', onKey)
+    return () => window.removeEventListener('keydown', onKey)
+  }, [active, closeDetail])
+
+  const open = async (m) => {
+    setActive({ ...m, loading: true })
+    try {
+      const d = await api.getMessage(accountId, m.uid, mailbox)
+      setActive(d)
+    } catch (e) {
+      setActive({ ...m, error: e.message, loading: false })
+    }
+  }
+
+  return (
+    <div className="main-inner">
+      <div className="page-toolbar">
+        <h1 className="page-title">{mailbox}</h1>
+      </div>
+
+      <div className="card" style={{ padding: 0 }}>
+        {loading && <p className="muted" style={{ padding: 12 }}>加载中…</p>}
+        {err && <p style={{ color: 'var(--danger)', padding: 12 }}>{err}</p>}
+        {!loading && !err && list.length === 0 && (
+          <p className="muted" style={{ padding: 12 }}>暂无邮件</p>
+        )}
+        <ul className="mail-list">
+          {list.map((m) => (
+            <li key={m.uid} className={m.seen ? '' : 'unseen'} onClick={() => open(m)}>
+              <div className="subject">{m.subject || '(无主题)'}</div>
+              <div className="from">
+                {m.from} · {m.date && new Date(m.date).toLocaleString()}
+              </div>
+            </li>
+          ))}
+        </ul>
+      </div>
+
+      {active && (
+        <div
+          className="modal-mask"
+          role="dialog"
+          aria-modal="true"
+          aria-labelledby="mail-subject"
+          onClick={(e) => e.target === e.currentTarget && closeDetail()}
+        >
+          <div className="modal modal-mail" onClick={(e) => e.stopPropagation()}>
+            <div className="modal-mail-toolbar">
+              <h2 id="mail-subject">{active.subject || '(无主题)'}</h2>
+              <button type="button" onClick={closeDetail}>
+                关闭
+              </button>
+            </div>
+            <div className="modal-mail-meta muted">
+              <p>发件人: {active.from || '—'}</p>
+              {active.to && active.to.length > 0 && (
+                <p>收件人: {active.to.join(', ')}</p>
+              )}
+            </div>
+            <div className="modal-mail-body">
+              {active.loading && <p className="muted">加载中…</p>}
+              {active.error && <p style={{ color: 'var(--danger)' }}>{active.error}</p>}
+              {!active.loading && !active.error && active.html && (
+                <iframe title="mail-html" srcDoc={active.html} />
+              )}
+              {!active.loading && !active.error && !active.html && (
+                <pre>{active.text || ''}</pre>
+              )}
+            </div>
+          </div>
+        </div>
+      )}
+    </div>
+  )
+}
--- a/mengpost-frontend/src/styles/global.css
+++ b/mengpost-frontend/src/styles/global.css
@@ -1,363 +1,465 @@
-:root {
-  --bg: #fafafa;
-  --surface: #ffffff;
-  --border: #e5e7eb;
-  --text: #1f2328;
-  --muted: #6b7280;
-  --accent: #2563eb;
-  --accent-hover: #1d4ed8;
-  --danger: #dc2626;
-  --radius: 6px;
-  --mono: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
-  --sans: -apple-system, BlinkMacSystemFont, "Segoe UI", "PingFang SC",
-    "Hiragino Sans GB", "Microsoft YaHei", Roboto, sans-serif;
-}
-
-* { box-sizing: border-box; }
-
-html, body, #root { height: 100%; }
-
-body {
-  margin: 0;
-  background: var(--bg);
-  color: var(--text);
-  font-family: var(--sans);
-  font-size: 15px;
-  line-height: 1.6;
-  -webkit-font-smoothing: antialiased;
-}
-
-a { color: var(--accent); text-decoration: none; }
-a:hover { text-decoration: underline; }
-
-button,
-.btn {
-  font: inherit;
-  padding: 6px 14px;
-  border: 1px solid var(--border);
-  background: var(--surface);
-  color: var(--text);
-  border-radius: var(--radius);
-  cursor: pointer;
-  transition: background .15s, border-color .15s;
-}
-button:hover,
-.btn:hover { border-color: #c5c9d0; background: #f3f4f6; }
-
-.btn-primary {
-  background: var(--accent);
-  border-color: var(--accent);
-  color: #fff;
-}
-.btn-primary:hover { background: var(--accent-hover); border-color: var(--accent-hover); }
-
-.btn-danger { color: var(--danger); border-color: var(--border); background: var(--surface); }
-.btn-danger:hover { background: #fef2f2; border-color: #fca5a5; }
-
-input, select, textarea {
-  font: inherit;
-  padding: 8px 10px;
-  border: 1px solid var(--border);
-  border-radius: var(--radius);
-  background: var(--surface);
-  color: var(--text);
-  width: 100%;
-}
-input:focus, select:focus, textarea:focus {
-  outline: none;
-  border-color: var(--accent);
-  box-shadow: 0 0 0 3px rgba(37, 99, 235, .15);
-}
-
-.container {
-  max-width: 960px;
-  margin: 0 auto;
-  padding: 24px 16px 64px;
-}
-
-.app-shell {
-  display: flex;
-  min-height: calc(100vh - 54px);
-  align-items: stretch;
-}
-
-.sidebar {
-  width: 240px;
-  flex-shrink: 0;
-  background: var(--surface);
-  border-right: 1px solid var(--border);
-  padding: 16px 0;
-  overflow-y: auto;
-}
-
-.sidebar-section {
-  padding: 0 12px 16px;
-  margin-bottom: 8px;
-  border-bottom: 1px solid var(--border);
-}
-.sidebar-section:last-of-type {
-  border-bottom: none;
-}
-
-.sidebar-label {
-  font-size: 11px;
-  font-weight: 600;
-  letter-spacing: 0.04em;
-  text-transform: uppercase;
-  color: var(--muted);
-  margin-bottom: 8px;
-  padding: 0 8px;
-}
-
-.sidebar-item {
-  display: flex;
-  flex-direction: column;
-  align-items: flex-start;
-  gap: 2px;
-  padding: 8px 10px;
-  margin-bottom: 2px;
-  border-radius: var(--radius);
-  color: var(--text);
-  text-decoration: none;
-  font-size: 14px;
-  line-height: 1.35;
-}
-.sidebar-item:hover {
-  background: #f3f4f6;
-  text-decoration: none;
-}
-.sidebar-item.active {
-  background: #eff6ff;
-  color: var(--accent);
-  font-weight: 500;
-}
-.sidebar-item-title { font-weight: 500; }
-.sidebar-item-sub { font-size: 12px; word-break: break-all; }
-
-.sidebar-muted {
-  font-size: 13px;
-  color: var(--muted);
-  padding: 4px 8px;
-  margin: 0;
-}
-
-.sidebar-foot {
-  display: block;
-  font-size: 13px;
-  color: var(--muted);
-  padding: 8px;
-  margin-top: 6px;
-}
-.sidebar-foot:hover { color: var(--accent); }
-
-.main-area {
-  flex: 1;
-  min-width: 0;
-  background: var(--bg);
-}
-
-/* 主内容区占满侧栏右侧可用宽度（不再限制 900px） */
-.main-inner {
-  width: 100%;
-  max-width: none;
-  margin: 0;
-  padding: 20px 28px 48px;
-  box-sizing: border-box;
-}
-
-.page-toolbar {
-  display: flex;
-  align-items: baseline;
-  justify-content: space-between;
-  gap: 12px;
-  margin-bottom: 16px;
-}
-.page-title {
-  margin: 0;
-  font-size: 20px;
-  font-weight: 600;
-}
-
-@media (max-width: 768px) {
-  .app-shell { flex-direction: column; }
-  .sidebar {
-    width: 100%;
-    border-right: none;
-    border-bottom: 1px solid var(--border);
-    max-height: none;
-  }
-  .sidebar-section {
-    display: flex;
-    flex-wrap: wrap;
-    align-items: flex-start;
-    gap: 8px;
-    padding-bottom: 12px;
-  }
-  .sidebar-label { width: 100%; margin-bottom: 0; }
-  .sidebar-item { flex: 1 1 auto; min-width: 44%; margin-bottom: 0; }
-  .sidebar-foot { width: 100%; }
-}
-
-.topbar {
-  height: 54px;
-  background: var(--surface);
-  border-bottom: 1px solid var(--border);
-  display: flex;
-  align-items: center;
-  padding: 0 16px;
-  position: sticky;
-  top: 0;
-  z-index: 10;
-}
-.topbar .brand {
-  display: flex; align-items: center; gap: 8px;
-  cursor: pointer; user-select: none; font-weight: 600;
-}
-.topbar .logo {
-  width: 28px;
-  height: 28px;
-  border-radius: 6px;
-  object-fit: contain;
-  display: block;
-  flex-shrink: 0;
-}
-.topbar nav { margin-left: auto; display: flex; gap: 14px; }
-.topbar nav a { color: var(--muted); }
-.topbar nav a.active { color: var(--text); font-weight: 600; }
-
-.card {
-  background: var(--surface);
-  border: 1px solid var(--border);
-  border-radius: var(--radius);
-  padding: 16px;
-  margin-bottom: 16px;
-}
-
-h1, h2, h3 { margin: 0 0 12px; font-weight: 600; }
-h1 { font-size: 22px; }
-h2 { font-size: 18px; }
-h3 { font-size: 15px; color: var(--muted); }
-
-.muted { color: var(--muted); }
-
-table { width: 100%; border-collapse: collapse; font-size: 14px; }
-th, td { text-align: left; padding: 10px 8px; border-bottom: 1px solid var(--border); }
-th { color: var(--muted); font-weight: 500; background: #fafbfc; }
-tr:hover td { background: #f9fafb; }
-
-.form-row { display: grid; grid-template-columns: 120px 1fr; gap: 10px 16px; align-items: center; margin-bottom: 10px; }
-@media (max-width: 640px) {
-  .form-row { grid-template-columns: 1fr; gap: 4px; }
-  .topbar nav { gap: 10px; }
-  .container { padding: 16px 12px 48px; }
-  th:nth-child(3), td:nth-child(3),
-  th:nth-child(4), td:nth-child(4) { display: none; }
-}
-
-.grid-2 { display: grid; grid-template-columns: 260px 1fr; gap: 16px; }
-@media (max-width: 720px) { .grid-2 { grid-template-columns: 1fr; } }
-
-.mail-list { list-style: none; margin: 0; padding: 0; }
-.mail-list li {
-  padding: 10px 12px;
-  border-bottom: 1px solid var(--border);
-  cursor: pointer;
-}
-.mail-list li.unseen { background: #f8fafc; }
-.mail-list li:hover { background: #f3f4f6; }
-.mail-list .subject { font-weight: 500; }
-.mail-list .from { color: var(--muted); font-size: 13px; }
-
-/* token 弹框 */
-.modal-mask {
-  position: fixed; inset: 0;
-  background: rgba(17, 24, 39, .45);
-  display: flex; align-items: center; justify-content: center;
-  z-index: 100;
-}
-.modal {
-  background: var(--surface);
-  border-radius: 8px;
-  width: min(360px, 92vw);
-  padding: 18px;
-  box-shadow: 0 10px 30px rgba(0,0,0,.18);
-}
-.modal h3 { margin: 0 0 10px; color: var(--text); font-size: 14px; }
-.modal .actions { margin-top: 12px; display: flex; justify-content: flex-end; gap: 8px; }
-
-.modal.modal-wide {
-  width: min(640px, 94vw);
-  max-height: min(92vh, 880px);
-  overflow-y: auto;
-  padding: 20px 22px;
-}
-.modal.modal-wide h2 {
-  margin: 0 0 16px;
-  font-size: 17px;
-  font-weight: 600;
-}
-
-/* 阅读邮件：宽弹窗，正文区域独立滚动 */
-.modal.modal-mail {
-  width: min(1320px, 98vw);
-  max-height: 96vh;
-  display: flex;
-  flex-direction: column;
-  padding: 0;
-  overflow: hidden;
-}
-.modal-mail-toolbar {
-  display: flex;
-  align-items: flex-start;
-  justify-content: space-between;
-  gap: 12px;
-  padding: 16px 20px;
-  border-bottom: 1px solid var(--border);
-  flex-shrink: 0;
-}
-.modal-mail-toolbar h2 {
-  margin: 0;
-  font-size: 17px;
-  font-weight: 600;
-  line-height: 1.4;
-}
-.modal-mail-meta {
-  padding: 0 20px 12px;
-  font-size: 14px;
-}
-.modal-mail-meta p {
-  margin: 4px 0;
-}
-.modal-mail-body {
-  flex: 1;
-  min-height: 0;
-  overflow-y: auto;
-  padding: 0 20px 20px;
-}
-.modal-mail-body iframe {
-  display: block;
-  width: 100%;
-  min-height: min(720px, 72vh);
-  border: 0;
-}
-.modal-mail-body pre {
-  margin: 0;
-  white-space: pre-wrap;
-  word-break: break-word;
-}
-
-.tag {
-  display: inline-block; font-size: 12px; color: var(--muted);
-  padding: 1px 8px; border: 1px solid var(--border); border-radius: 999px;
-}
-
-pre { background: #f6f8fa; padding: 12px; border-radius: 6px; overflow: auto; font-family: var(--mono); }
-
-.access-gate {
-  min-height: 100vh;
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  padding: 24px;
-  box-sizing: border-box;
-}
+:root {
+  --bg: #fafafa;
+  --surface: #ffffff;
+  --border: #e5e7eb;
+  --text: #1f2328;
+  --muted: #6b7280;
+  --accent: #2563eb;
+  --accent-hover: #1d4ed8;
+  --danger: #dc2626;
+  --radius: 6px;
+  --mono: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+  --sans: -apple-system, BlinkMacSystemFont, "Segoe UI", "PingFang SC",
+    "Hiragino Sans GB", "Microsoft YaHei", Roboto, sans-serif;
+}
+
+* { box-sizing: border-box; }
+
+html, body, #root { height: 100%; }
+
+body {
+  margin: 0;
+  background: var(--bg);
+  color: var(--text);
+  font-family: var(--sans);
+  font-size: 15px;
+  line-height: 1.6;
+  -webkit-font-smoothing: antialiased;
+}
+
+a { color: var(--accent); text-decoration: none; }
+a:hover { text-decoration: underline; }
+
+button,
+.btn {
+  font: inherit;
+  padding: 6px 14px;
+  border: 1px solid var(--border);
+  background: var(--surface);
+  color: var(--text);
+  border-radius: var(--radius);
+  cursor: pointer;
+  transition: background .15s, border-color .15s;
+}
+button:hover,
+.btn:hover { border-color: #c5c9d0; background: #f3f4f6; }
+
+.btn-primary {
+  background: var(--accent);
+  border-color: var(--accent);
+  color: #fff;
+}
+.btn-primary:hover { background: var(--accent-hover); border-color: var(--accent-hover); }
+
+.btn-danger { color: var(--danger); border-color: var(--border); background: var(--surface); }
+.btn-danger:hover { background: #fef2f2; border-color: #fca5a5; }
+
+input, select, textarea {
+  font: inherit;
+  padding: 8px 10px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  background: var(--surface);
+  color: var(--text);
+  width: 100%;
+}
+input:focus, select:focus, textarea:focus {
+  outline: none;
+  border-color: var(--accent);
+  box-shadow: 0 0 0 3px rgba(37, 99, 235, .15);
+}
+
+.container {
+  max-width: 960px;
+  margin: 0 auto;
+  padding: 24px 16px 64px;
+}
+
+.app-shell {
+  display: flex;
+  min-height: calc(100vh - 54px);
+  align-items: stretch;
+}
+
+.sidebar {
+  width: 240px;
+  flex-shrink: 0;
+  background: var(--surface);
+  border-right: 1px solid var(--border);
+  padding: 16px 0;
+  overflow-y: auto;
+}
+
+.sidebar-right {
+  border-right: none;
+  border-left: 1px solid var(--border);
+}
+
+.sidebar-section {
+  padding: 0 12px 16px;
+  margin-bottom: 8px;
+  border-bottom: 1px solid var(--border);
+}
+.sidebar-section:last-of-type {
+  border-bottom: none;
+}
+
+.sidebar-label-row {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 8px;
+  margin-bottom: 8px;
+  padding: 0 8px;
+}
+
+.sidebar-label {
+  font-size: 11px;
+  font-weight: 600;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+  color: var(--muted);
+  margin-bottom: 0;
+  padding: 0;
+}
+
+.sidebar-label-actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 4px 8px;
+  justify-content: flex-end;
+}
+
+.sidebar-mini-btn {
+  font-size: 11px;
+  padding: 2px 6px;
+  border: none;
+  background: transparent;
+  color: var(--accent);
+  cursor: pointer;
+  border-radius: 4px;
+  white-space: nowrap;
+}
+.sidebar-mini-btn:hover {
+  background: #eff6ff;
+  text-decoration: none;
+}
+
+.sidebar-group {
+  margin-bottom: 4px;
+}
+
+.sidebar-group-header {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  width: 100%;
+  padding: 6px 8px;
+  margin: 0 0 2px;
+  border: none;
+  border-radius: var(--radius);
+  background: transparent;
+  font: inherit;
+  font-size: 13px;
+  color: var(--text);
+  cursor: pointer;
+  text-align: left;
+}
+.sidebar-group-header:hover {
+  background: #f3f4f6;
+}
+
+.sidebar-group-chevron {
+  flex-shrink: 0;
+  width: 1em;
+  color: var(--muted);
+  font-size: 12px;
+  line-height: 1;
+}
+
+.sidebar-group-title {
+  flex: 1;
+  min-width: 0;
+  font-weight: 500;
+  word-break: break-all;
+}
+
+.sidebar-group-count {
+  flex-shrink: 0;
+  font-size: 11px;
+  color: var(--muted);
+  background: #f3f4f6;
+  padding: 1px 6px;
+  border-radius: 999px;
+}
+
+.sidebar-group-body {
+  padding: 0 0 4px 4px;
+}
+.sidebar-group-body .sidebar-item {
+  margin-left: 4px;
+}
+
+.sidebar-item {
+  display: flex;
+  flex-direction: column;
+  align-items: flex-start;
+  gap: 2px;
+  padding: 8px 10px;
+  margin-bottom: 2px;
+  border-radius: var(--radius);
+  color: var(--text);
+  text-decoration: none;
+  font-size: 14px;
+  line-height: 1.35;
+}
+.sidebar-item:hover {
+  background: #f3f4f6;
+  text-decoration: none;
+}
+.sidebar-item.active {
+  background: #eff6ff;
+  color: var(--accent);
+  font-weight: 500;
+}
+.sidebar-item-title { font-weight: 500; }
+.sidebar-item-sub { font-size: 12px; word-break: break-all; }
+
+.sidebar-muted {
+  font-size: 13px;
+  color: var(--muted);
+  padding: 4px 8px;
+  margin: 0;
+}
+
+.sidebar-foot {
+  display: block;
+  font-size: 13px;
+  color: var(--muted);
+  padding: 8px;
+  margin-top: 6px;
+}
+.sidebar-foot:hover { color: var(--accent); }
+
+.main-area {
+  flex: 1;
+  min-width: 0;
+  background: var(--bg);
+}
+
+/* 主内容区占满侧栏右侧可用宽度（不再限制 900px） */
+.main-inner {
+  width: 100%;
+  max-width: none;
+  margin: 0;
+  padding: 20px 28px 48px;
+  box-sizing: border-box;
+}
+
+.page-toolbar {
+  display: flex;
+  align-items: baseline;
+  justify-content: space-between;
+  gap: 12px;
+  margin-bottom: 16px;
+}
+.page-title {
+  margin: 0;
+  font-size: 20px;
+  font-weight: 600;
+}
+
+@media (max-width: 768px) {
+  .app-shell { flex-direction: column; }
+  .sidebar {
+    width: 100%;
+    border-right: none;
+    border-bottom: 1px solid var(--border);
+    max-height: none;
+  }
+  .sidebar-right {
+    border-left: none;
+    border-top: 1px solid var(--border);
+    border-bottom: none;
+    order: 3;
+  }
+  .main-area { order: 2; }
+  .sidebar:not(.sidebar-right) { order: 1; }
+  .sidebar-section {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: flex-start;
+    gap: 8px;
+    padding-bottom: 12px;
+  }
+  .sidebar-label-row { width: 100%; flex-wrap: wrap; }
+  .sidebar-label { width: auto; }
+  .sidebar-label-actions { width: 100%; justify-content: flex-start; }
+  .sidebar-group { width: 100%; }
+  .sidebar-item { flex: 1 1 auto; min-width: 44%; margin-bottom: 0; }
+  .sidebar-foot { width: 100%; }
+}
+
+.topbar {
+  height: 54px;
+  background: var(--surface);
+  border-bottom: 1px solid var(--border);
+  display: flex;
+  align-items: center;
+  padding: 0 16px;
+  position: sticky;
+  top: 0;
+  z-index: 10;
+}
+.topbar .brand {
+  display: flex; align-items: center; gap: 8px;
+  cursor: pointer; user-select: none; font-weight: 600;
+}
+.topbar .logo {
+  width: 28px;
+  height: 28px;
+  border-radius: 6px;
+  object-fit: contain;
+  display: block;
+  flex-shrink: 0;
+}
+.topbar nav { margin-left: auto; display: flex; gap: 14px; }
+.topbar nav a { color: var(--muted); }
+.topbar nav a.active { color: var(--text); font-weight: 600; }
+
+.card {
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  padding: 16px;
+  margin-bottom: 16px;
+}
+
+h1, h2, h3 { margin: 0 0 12px; font-weight: 600; }
+h1 { font-size: 22px; }
+h2 { font-size: 18px; }
+h3 { font-size: 15px; color: var(--muted); }
+
+.muted { color: var(--muted); }
+
+table { width: 100%; border-collapse: collapse; font-size: 14px; }
+th, td { text-align: left; padding: 10px 8px; border-bottom: 1px solid var(--border); }
+th { color: var(--muted); font-weight: 500; background: #fafbfc; }
+tr:hover td { background: #f9fafb; }
+
+.form-row { display: grid; grid-template-columns: 120px 1fr; gap: 10px 16px; align-items: center; margin-bottom: 10px; }
+@media (max-width: 640px) {
+  .form-row { grid-template-columns: 1fr; gap: 4px; }
+  .topbar nav { gap: 10px; }
+  .container { padding: 16px 12px 48px; }
+  th:nth-child(3), td:nth-child(3),
+  th:nth-child(4), td:nth-child(4) { display: none; }
+}
+
+.grid-2 { display: grid; grid-template-columns: 260px 1fr; gap: 16px; }
+@media (max-width: 720px) { .grid-2 { grid-template-columns: 1fr; } }
+
+.mail-list { list-style: none; margin: 0; padding: 0; }
+.mail-list li {
+  padding: 10px 12px;
+  border-bottom: 1px solid var(--border);
+  cursor: pointer;
+}
+.mail-list li.unseen { background: #f8fafc; }
+.mail-list li:hover { background: #f3f4f6; }
+.mail-list .subject { font-weight: 500; }
+.mail-list .from { color: var(--muted); font-size: 13px; }
+
+/* token 弹框 */
+.modal-mask {
+  position: fixed; inset: 0;
+  background: rgba(17, 24, 39, .45);
+  display: flex; align-items: center; justify-content: center;
+  z-index: 100;
+}
+.modal {
+  background: var(--surface);
+  border-radius: 8px;
+  width: min(360px, 92vw);
+  padding: 18px;
+  box-shadow: 0 10px 30px rgba(0,0,0,.18);
+}
+.modal h3 { margin: 0 0 10px; color: var(--text); font-size: 14px; }
+.modal .actions { margin-top: 12px; display: flex; justify-content: flex-end; gap: 8px; }
+
+.modal.modal-wide {
+  width: min(640px, 94vw);
+  max-height: min(92vh, 880px);
+  overflow-y: auto;
+  padding: 20px 22px;
+}
+.modal.modal-wide h2 {
+  margin: 0 0 16px;
+  font-size: 17px;
+  font-weight: 600;
+}
+
+/* 阅读邮件：宽弹窗，正文区域独立滚动 */
+.modal.modal-mail {
+  width: min(1320px, 98vw);
+  max-height: 96vh;
+  display: flex;
+  flex-direction: column;
+  padding: 0;
+  overflow: hidden;
+}
+.modal-mail-toolbar {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 12px;
+  padding: 16px 20px;
+  border-bottom: 1px solid var(--border);
+  flex-shrink: 0;
+}
+.modal-mail-toolbar h2 {
+  margin: 0;
+  font-size: 17px;
+  font-weight: 600;
+  line-height: 1.4;
+}
+.modal-mail-meta {
+  padding: 0 20px 12px;
+  font-size: 14px;
+}
+.modal-mail-meta p {
+  margin: 4px 0;
+}
+.modal-mail-body {
+  flex: 1;
+  min-height: 0;
+  overflow-y: auto;
+  padding: 0 20px 20px;
+}
+.modal-mail-body iframe {
+  display: block;
+  width: 100%;
+  min-height: min(720px, 72vh);
+  border: 0;
+}
+.modal-mail-body pre {
+  margin: 0;
+  white-space: pre-wrap;
+  word-break: break-word;
+}
+
+.tag {
+  display: inline-block; font-size: 12px; color: var(--muted);
+  padding: 1px 8px; border: 1px solid var(--border); border-radius: 999px;
+}
+
+pre { background: #f6f8fa; padding: 12px; border-radius: 6px; overflow: auto; font-family: var(--mono); }
+
+.access-gate {
+  min-height: 100vh;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 24px;
+  box-sizing: border-box;
+}
--- a/mengpost-frontend/vite.config.js
+++ b/mengpost-frontend/vite.config.js
@@ -1,18 +1,20 @@
-import { defineConfig } from 'vite'
-import react from '@vitejs/plugin-react'
-
-export default defineConfig({
-  plugins: [react()],
-  server: {
-    port: 5173,
-    proxy: {
-      '/api': 'http://127.0.0.1:8787',
-    },
-  },
-  preview: {
-    port: 5173,
-    proxy: {
-      '/api': 'http://127.0.0.1:8787',
-    },
-  },
-})
+import { defineConfig } from 'vite'
+import react from '@vitejs/plugin-react'
+
+// 生产：`.env.production` 中 VITE_API_URL=https://post.api.smyhub.com
+// 开发：未设置时走相对路径 + server.proxy
+export default defineConfig({
+  plugins: [react()],
+  server: {
+    port: 5173,
+    proxy: {
+      '/api': 'http://127.0.0.1:8787',
+    },
+  },
+  preview: {
+    port: 5173,
+    proxy: {
+      '/api': 'http://127.0.0.1:8787',
+    },
+  },
+})
--- a/scripts/publish-gitea.ps1
+++ b/scripts/publish-gitea.ps1
@@ -1,23 +1,23 @@
-# 使用 Gitea tea CLI 创建远端仓库并推送（需在已 git init 且已 commit 的项目根目录执行）
-# 前置: tea login add --url https://你的Gitea --token <令牌> --name <别名>
-#      tea login default <别名>
-
-$ErrorActionPreference = "Stop"
-$root = Split-Path -Parent $PSScriptRoot
-Set-Location $root
-
-if (-not (Get-Command tea -ErrorAction SilentlyContinue)) {
-    Write-Error "未找到 tea，请安装: https://gitea.com/gitea/tea/releases"
-}
-
-$desc = "萌邮 MengPost：基于 SMTP/IMAP 的多邮箱管理面板（React + Vite + Go + Gin + SQLite）"
-Write-Host ">>> tea repos create --name mengpost ..."
-tea repos create --name mengpost --description $desc
-
-Write-Host ""
-Write-Host "请在 Gitea 网页打开新建的 mengpost 仓库，复制 HTTPS 克隆地址，然后执行:"
-Write-Host "  git remote add origin <粘贴地址>"
-Write-Host "  git branch -M main"
-Write-Host "  git push -u origin main"
-Write-Host ""
-Write-Host "若已存在 origin，可改为: git remote set-url origin <地址>"
+# 使用 Gitea tea CLI 创建远端仓库并推送（需在已 git init 且已 commit 的项目根目录执行）
+# 前置: tea login add --url https://你的Gitea --token <令牌> --name <别名>
+#      tea login default <别名>
+
+$ErrorActionPreference = "Stop"
+$root = Split-Path -Parent $PSScriptRoot
+Set-Location $root
+
+if (-not (Get-Command tea -ErrorAction SilentlyContinue)) {
+    Write-Error "未找到 tea，请安装: https://gitea.com/gitea/tea/releases"
+}
+
+$desc = "萌邮 MengPost：基于 SMTP/IMAP 的多邮箱管理面板（React + Vite + Go + Gin + SQLite）"
+Write-Host ">>> tea repos create --name mengpost ..."
+tea repos create --name mengpost --description $desc
+
+Write-Host ""
+Write-Host "请在 Gitea 网页打开新建的 mengpost 仓库，复制 HTTPS 克隆地址，然后执行:"
+Write-Host "  git remote add origin <粘贴地址>"
+Write-Host "  git branch -M main"
+Write-Host "  git push -u origin main"
+Write-Host ""
+Write-Host "若已存在 origin，可改为: git remote set-url origin <地址>"
--- a/scripts/publish-gitea.sh
+++ b/scripts/publish-gitea.sh
@@ -1,19 +1,19 @@
-#!/usr/bin/env bash
-# 使用 Gitea tea CLI 创建远端仓库（需在已 git init 且已 commit 的项目根目录执行）
-set -e
-cd "$(dirname "$0")/.."
-
-if ! command -v tea >/dev/null 2>&1; then
-  echo "未找到 tea，请安装: https://gitea.com/gitea/tea/releases" >&2
-  exit 1
-fi
-
-DESC='萌邮 MengPost：基于 SMTP/IMAP 的多邮箱管理面板（React + Vite + Go + Gin + SQLite）'
-echo ">>> tea repos create --name mengpost ..."
-tea repos create --name mengpost --description "$DESC"
-
-echo ""
-echo "请在 Gitea 网页打开新建的 mengpost 仓库，复制 HTTPS 克隆地址，然后执行:"
-echo "  git remote add origin <粘贴地址>"
-echo "  git branch -M main"
-echo "  git push -u origin main"
+#!/usr/bin/env bash
+# 使用 Gitea tea CLI 创建远端仓库（需在已 git init 且已 commit 的项目根目录执行）
+set -e
+cd "$(dirname "$0")/.."
+
+if ! command -v tea >/dev/null 2>&1; then
+  echo "未找到 tea，请安装: https://gitea.com/gitea/tea/releases" >&2
+  exit 1
+fi
+
+DESC='萌邮 MengPost：基于 SMTP/IMAP 的多邮箱管理面板（React + Vite + Go + Gin + SQLite）'
+echo ">>> tea repos create --name mengpost ..."
+tea repos create --name mengpost --description "$DESC"
+
+echo ""
+echo "请在 Gitea 网页打开新建的 mengpost 仓库，复制 HTTPS 克隆地址，然后执行:"
+echo "  git remote add origin <粘贴地址>"
+echo "  git branch -M main"
+echo "  git push -u origin main"
--- a/scripts/push-to-gitea.ps1
+++ b/scripts/push-to-gitea.ps1
@@ -1,9 +1,9 @@
-# 在已执行 tea repos create 创建 mengpost 后，关联 https://shumengya.top/shumengya/mengpost 并推送 main
-$ErrorActionPreference = "Stop"
-$Origin = "https://shumengya.top/shumengya/mengpost.git"
-Set-Location (Split-Path -Parent $PSScriptRoot)
-
-git remote remove origin 2>$null
-git remote add origin $Origin
-git branch -M main
-git push -u origin main
+# 在已执行 tea repos create 创建 mengpost 后，关联 https://shumengya.top/shumengya/mengpost 并推送 main
+$ErrorActionPreference = "Stop"
+$Origin = "https://shumengya.top/shumengya/mengpost.git"
+Set-Location (Split-Path -Parent $PSScriptRoot)
+
+git remote remove origin 2>$null
+git remote add origin $Origin
+git branch -M main
+git push -u origin main