🔒 security: move IMAP credentials to request body

Moved IMAP credentials from query parameters to the request body
for the test-connection endpoint to prevent cleartext logging.
Implemented a Pydantic model (IMAPTestRequest) for request body validation.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

backend/app/api/api_v1/endpoints/imap.py

@@ -1,39 +1,43 @@
 import logging
 from datetime import datetime
-from typing import Any, Dict
+from typing import Any, Dict, Optional
 
 from app.core.security import require_admin_auth
 from app.services.imap_client import IMAPClient
 from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException
+from pydantic import BaseModel
 
 router = APIRouter()
 logger = logging.getLogger(__name__)
 
 
+class IMAPTestRequest(BaseModel):
+    """IMAP connection test request body"""
+
+    server: Optional[str] = None
+    port: int = 993
+    username: Optional[str] = None
+    password: Optional[str] = None
+    ssl: bool = True
+
+
 @router.post("/test-connection")
 async def test_imap_connection(
+    request: IMAPTestRequest,
     auth: dict = Depends(require_admin_auth),
-    server: str = None,
-    port: int = 993,
-    username: str = None,
-    password: str = None,
-    ssl: bool = True,
 ) -> Dict[str, Any]:
     """
     Test connection to an IMAP server and gather mailbox statistics
 
     Security: Requires authentication (X-API-Key or Bearer token)
-    Note: Credentials should be passed in request body, not query params
+    Credentials should be passed in request body
     """
-    # Security: Don't accept credentials in query parameters (they get logged)
+    imap_client = IMAPClient(
-    if any([server, username, password]):
+        server=request.server,
-        logger.warning("IMAP credentials passed as query parameters - this is insecure")
+        port=request.port,
-        raise HTTPException(
+        username=request.username,
-            status_code=400,
+        password=request.password,
-            detail="Credentials should be passed in request body, not query parameters",
+    )
-        )
-
-    imap_client = IMAPClient(server=server, port=port, username=username, password=password)
 
     success, message, stats = imap_client.test_connection()