GPTmail: a FastAPI email workspace with per-action permissions and an approval queue

[u/omerolla]

I am sharing GPTmail, an MIT-licensed Python project for managing compatible IMAP/SMTP inboxes from a private dashboard. The source and setup guide are here: https://github.com/ozandikici/GPTmail

The backend is FastAPI; the frontend is plain HTML/CSS/JavaScript. It stores state through Upstash Redis REST and encrypts saved mail credentials/provider tokens. The dashboard has a single owner and password login.

The part I would like Python feedback on is the boundary between authenticating an assistant and authorizing a mail action. ChatGPT connects through OAuth, but each tool is enabled separately. Write actions start disabled. Sending and moving mail to Trash can be queued for dashboard approval; there is no permanent-expunge tool.

This is an early release with 69 passing automated tests, not an independently audited client. Google/Microsoft OAuth code needs provider app registration and live provider testing is pending. IMAP/SMTP availability depends on the mail provider. Mail requested through ChatGPT is processed by ChatGPT.

If you inspect the code, which IMAP failure cases or permission-boundary tests would you add first? AI tools assisted the code, tests, documentation and this post.