Added setup.py and changed app to pixelated because it will be a package

18 files changed, 1185 insertions, 0 deletions

diff --git a/service/pixelated/__init__.py b/service/pixelated/__init__.py
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/service/pixelated/__init__.py
diff --git a/service/pixelated/adapter/__init__.py b/service/pixelated/adapter/__init__.py
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/service/pixelated/adapter/__init__.py
diff --git a/service/pixelated/adapter/mail_service.py b/service/pixelated/adapter/mail_service.py
new file mode 100644
index 00000000..6498a2e7
--- /dev/null
+++ b/service/pixelated/adapter/mail_service.py
@@ -0,0 +1,98 @@
+import traceback
+import sys
+import os
+from twisted.internet import defer
+from pixelated.bitmask_libraries.config import LeapConfig
+from pixelated.bitmask_libraries.provider import LeapProvider
+from pixelated.bitmask_libraries.session import LeapSessionFactory
+from pixelated.bitmask_libraries.auth import LeapCredentials
+from pixelated.adapter.pixelated_mail import PixelatedMail
+from pixelated.tags import Tags
+
+
+class MailService:
+
+    def __init__(self):
+        try:
+            self.username = 'testuser_a003'
+            self.password = 'testpassword'
+            self.server_name = 'example.wazokazi.is'
+            self.mailbox_name = 'INBOX'
+            self.certs_home = os.path.join(os.path.abspath("."), "leap")
+            self.tags = Tags()
+            self._open_leap_session()
+        except:
+            traceback.print_exc(file=sys.stdout)
+            raise
+
+    def _open_leap_session(self):
+        self.leap_config = LeapConfig(certs_home=self.certs_home)
+        self.provider = LeapProvider(self.server_name, self.leap_config)
+        self.leap_session = LeapSessionFactory(self.provider).create(LeapCredentials(self.username, self.password))
+        self.account = self.leap_session.account
+        self.mailbox = self.account.getMailbox(self.mailbox_name)
+
+    def mails(self, query):
+        mails = self.mailbox.messages or []
+        mails = [PixelatedMail(mail) for mail in mails]
+        return mails
+
+    def update_tags(self, mail_id, new_tags):
+        mail = self.mail(mail_id)
+        new_tags = mail.update_tags(new_tags)
+        self._update_flags(new_tags, mail_id)
+        self._update_tag_list(new_tags)
+        return new_tags
+
+    def _update_tag_list(self, tags):
+        for tag in tags:
+            self.tags.add(tag)
+
+    def _update_flags(self, new_tags, mail_id):
+        new_tags_flag_name = ['tag_' + tag.name for tag in new_tags]
+        self.set_flags(mail_id, new_tags_flag_name)
+
+    def set_flags(self, mail_id, new_tags_flag_name):
+        observer = defer.Deferred()
+        self.mailbox.messages.set_flags(self.mailbox, [mail_id], tuple(new_tags_flag_name), 1, observer)
+
+    def mail(self, mail_id):
+        for message in self.mailbox.messages:
+            if message.getUID() == int(mail_id):
+                return PixelatedMail(message)
+
+    def all_tags(self):
+        return self.tags
+
+    def thread(self, thread_id):
+        raise NotImplementedError()
+
+    def mark_as_read(self, mail_id):
+        raise NotImplementedError()
+
+    def tags_for_thread(self, thread):
+        raise NotImplementedError()
+
+    def add_tag_to_thread(self, thread_id, tag):
+        raise NotImplementedError()
+
+    def remove_tag_from_thread(self, thread_id, tag):
+        raise NotImplementedError()
+
+    def delete_mail(self, mail_id):
+        raise NotImplementedError()
+
+    def save_draft(self, draft):
+        raise NotImplementedError()
+
+    def send_draft(self, draft):
+        raise NotImplementedError()
+
+    def draft_reply_for(self, mail_id):
+        raise NotImplementedError()
+
+    def all_contacts(self, query):
+        raise NotImplementedError()
+
+    def drafts(self):
+        raise NotImplementedError()
diff --git a/service/pixelated/adapter/pixelated_mail.py b/service/pixelated/adapter/pixelated_mail.py
new file mode 100644
index 00000000..49a045f2
--- /dev/null
+++ b/service/pixelated/adapter/pixelated_mail.py
@@ -0,0 +1,82 @@
+from pixelated.tags import Tag
+from pixelated.tags import Tags
+import dateutil.parser as dateparser
+
+
+class PixelatedMail:
+
+    LEAP_FLAGS = ['\\Seen',
+                  '\\Answered',
+                  '\\Flagged',
+                  '\\Deleted',
+                  '\\Draft',
+                  '\\Recent',
+                  'List']
+
+    LEAP_FLAGS_STATUSES = {
+        '\\Seen': 'read',
+        '\\Answered': 'replied'
+    }
+
+    LEAP_FLAGS_TAGS = {
+        '\\Deleted': 'trash',
+        '\\Draft': 'drafts',
+        '\\Recent': 'inbox'
+    }
+
+    def __init__(self, leap_mail):
+        self.leap_mail = leap_mail
+        self.body = leap_mail.bdoc.content['raw']
+        self.headers = self.extract_headers()
+        self.date = dateparser.parse(self.headers['date'])
+        self.ident = leap_mail.getUID()
+        self.status = self.extract_status()
+        self.security_casing = {}
+        self.tags = self.extract_tags()
+
+    def extract_status(self):
+        flags = self.leap_mail.getFlags()
+        return [converted for flag, converted in self.LEAP_FLAGS_STATUSES.items() if flag in flags]
+
+    def extract_headers(self):
+        temporary_headers = {}
+        for header, value in self.leap_mail.hdoc.content['headers'].items():
+            temporary_headers[header.lower()] = value
+        if(temporary_headers.get('to') is not None):
+            temporary_headers['to'] = [temporary_headers['to']]
+        return temporary_headers
+
+    def extract_tags(self):
+        flags = self.leap_mail.getFlags()
+        tag_names = self._converted_tags(flags) + self._custom_tags(flags)
+        tags = []
+        for tag in tag_names:
+            tags.append(Tag(tag))
+        return tags
+
+    def _converted_tags(self, flags):
+        return [converted for flag, converted in self.LEAP_FLAGS_TAGS.items() if flag in flags]
+
+    def _custom_tags(self, flags):
+        return [self._remove_prefix(flag) for flag in self.leap_mail.getFlags() if flag.startswith('tag_')]
+
+    def _remove_prefix(self, flag_name):
+        return flag_name.replace('tag_', '', 1)
+
+    def update_tags(self, tags):
+        self.tags = [Tag(tag) for tag in tags]
+        return self.tags
+
+    def has_tag(self, tag):
+        return Tag(tag) in self.tags
+
+    def as_dict(self):
+        tags = [tag.name for tag in self.tags]
+        return {
+            'header': self.headers,
+            'ident': self.ident,
+            'tags': tags,
+            'status': self.status,
+            'security_casing': self.security_casing,
+            'body': self.body
+        }
diff --git a/service/pixelated/bitmask_libraries/__init__.py b/service/pixelated/bitmask_libraries/__init__.py
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/service/pixelated/bitmask_libraries/__init__.py
diff --git a/service/pixelated/bitmask_libraries/auth.py b/service/pixelated/bitmask_libraries/auth.py
new file mode 100644
index 00000000..0b963587
--- /dev/null
+++ b/service/pixelated/bitmask_libraries/auth.py
@@ -0,0 +1,27 @@
+from .leap_srp import LeapSecureRemotePassword
+from .certs import which_bundle
+
+USE_PASSWORD = None
+
+
+class LeapCredentials(object):
+    def __init__(self, user_name, password, db_passphrase=USE_PASSWORD):
+        self.user_name = user_name
+        self.password = password
+        self.db_passphrase = db_passphrase if db_passphrase is not None else password
+
+
+class LeapAuthenticator(object):
+    def __init__(self, provider):
+        self._provider = provider
+
+    def authenticate(self, credentials):
+        config = self._provider.config
+        srp = LeapSecureRemotePassword(ca_bundle=which_bundle(self._provider), timeout_in_s=config.timeout_in_s)
+        srp_session = srp.authenticate(self._provider.api_uri, credentials.user_name, credentials.password)
+        return srp_session
+
+    def register(self, credentials):
+        config = self._provider.config
+        srp = LeapSecureRemotePassword(ca_bundle=which_bundle(self._provider), timeout_in_s=config.timeout_in_s)
+        srp.register(self._provider.api_uri, credentials.user_name, credentials.password)
diff --git a/service/pixelated/bitmask_libraries/certs.py b/service/pixelated/bitmask_libraries/certs.py
new file mode 100644
index 00000000..22a95591
--- /dev/null
+++ b/service/pixelated/bitmask_libraries/certs.py
@@ -0,0 +1,33 @@
+import os
+
+from leap.common import ca_bundle
+
+from .config import AUTO_DETECT_CA_BUNDLE
+
+
+def which_bundle(provider):
+    return LeapCertificate(provider).auto_detect_ca_bundle()
+
+
+class LeapCertificate(object):
+    def __init__(self, provider):
+        self._config = provider.config
+        self._server_name = provider.server_name
+        self._certs_home = self._config.certs_home
+
+    def auto_detect_ca_bundle(self):
+        if self._config.ca_cert_bundle == AUTO_DETECT_CA_BUNDLE:
+            local_cert = self._local_server_cert()
+            if local_cert:
+                return local_cert
+            else:
+                return ca_bundle.where()
+        else:
+            return self._config.ca_cert_bundle
+
+    def _local_server_cert(self):
+        cert_file = os.path.join(self._certs_home, '%s.ca.crt' % self._server_name)
+        if os.path.isfile(cert_file):
+            return cert_file
+        else:
+            return None
diff --git a/service/pixelated/bitmask_libraries/config.py b/service/pixelated/bitmask_libraries/config.py
new file mode 100644
index 00000000..63524389
--- /dev/null
+++ b/service/pixelated/bitmask_libraries/config.py
@@ -0,0 +1,67 @@
+import os
+from os.path import expanduser
+from distutils.spawn import find_executable
+
+
+def discover_gpg_binary():
+    path = find_executable('gpg')
+    if path is None:
+        raise Exception('Did not find a gpg executable!')
+
+    if os.path.islink(path):
+        path = os.path.realpath(path)
+
+    return path
+
+
+DEFAULT_LEAP_HOME = os.path.join(expanduser("~"), '.leap')
+
+SYSTEM_CA_BUNDLE = True
+AUTO_DETECT_CA_BUNDLE = None
+
+
+class LeapConfig(object):
+    """
+    LEAP client configuration
+
+    """
+
+    def __init__(self, leap_home=DEFAULT_LEAP_HOME, ca_cert_bundle=AUTO_DETECT_CA_BUNDLE, verify_ssl=True,
+                 fetch_interval_in_s=30,
+                 timeout_in_s=15, start_background_jobs=True, gpg_binary=discover_gpg_binary(), certs_home=None):
+        """
+        Constructor.
+
+        :param server_name: The LEAP server name, e.g. demo.leap.se
+        :type server_name: str
+
+        :param user_name: The LEAP account user name, normally the first part of your email, e.g. foobar for foobar@demo.leap.se
+        :type user_name: str
+
+        :param user_password: The LEAP account password
+        :type user_password: str
+
+        :param db_passphrase: The passphrase used to encrypt the local soledad database
+        :type db_passphrase: str
+
+        :param verify_ssl: Set to false to disable strict SSL certificate validation
+        :type verify_ssl: bool
+
+        :param fetch_interval_in_s: Polling interval for fetching incoming mail from LEAP server
+        :type fetch_interval_in_s: int
+
+        :param timeout_in_s: Timeout for network operations, e.g. HTTP calls
+        :type timeout_in_s: int
+
+        :param gpg_binary: Path to the GPG binary (must not be a symlink)
+        :type gpg_binary: str
+
+        """
+        self.leap_home = leap_home
+        self.certs_home = certs_home
+        self.ca_cert_bundle = ca_cert_bundle
+        self.verify_ssl = verify_ssl
+        self.timeout_in_s = timeout_in_s
+        self.start_background_jobs = start_background_jobs
+        self.gpg_binary = gpg_binary
+        self.fetch_interval_in_s = fetch_interval_in_s
diff --git a/service/pixelated/bitmask_libraries/leap_srp.py b/service/pixelated/bitmask_libraries/leap_srp.py
new file mode 100644
index 00000000..2590e731
--- /dev/null
+++ b/service/pixelated/bitmask_libraries/leap_srp.py
@@ -0,0 +1,131 @@
+import binascii
+import json
+import requests
+
+from requests import Session
+from srp import User, srp, create_salted_verification_key
+from requests.exceptions import HTTPError, SSLError, Timeout
+from config import SYSTEM_CA_BUNDLE
+
+REGISTER_USER_LOGIN_KEY = 'user[login]'
+REGISTER_USER_VERIFIER_KEY = 'user[password_verifier]'
+REGISTER_USER_SALT_KEY = 'user[password_salt]'
+
+
+class LeapAuthException(Exception):
+    def __init__(self, *args, **kwargs):
+        super(LeapAuthException, self).__init__(*args, **kwargs)
+
+
+class LeapSRPSession(object):
+    def __init__(self, user_name, api_server_name, uuid, token, session_id, api_version='1'):
+        self.user_name = user_name
+        self.api_server_name = api_server_name
+        self.uuid = uuid
+        self.token = token
+        self.session_id = session_id
+        self.api_version = api_version
+
+    def __str__(self):
+        return 'LeapSRPSession(%s, %s, %s, %s, %s, %s)' % (self.user_name, self.api_server_name, self.uuid, self.token, self.session_id, self.api_version)
+
+
+class LeapSecureRemotePassword(object):
+    def __init__(self, hash_alg=srp.SHA256, ng_type=srp.NG_1024, ca_bundle=SYSTEM_CA_BUNDLE, timeout_in_s=15,
+                 leap_api_version='1'):
+
+        self.hash_alg = hash_alg
+        self.ng_type = ng_type
+        self.timeout_in_s = timeout_in_s
+        self.ca_bundle = ca_bundle
+        self.leap_api_version = leap_api_version
+
+    def authenticate(self, api_uri, username, password):
+        session = Session()
+        try:
+            return self._authenticate_with_session(session, api_uri, username, password)
+        except Timeout, e:
+            raise LeapAuthException(e)
+        finally:
+            session.close()
+
+    def _authenticate_with_session(self, http_session, api_uri, username, password):
+        try:
+            srp_user = User(username.encode('utf-8'), password.encode('utf-8'), self.hash_alg, self.ng_type)
+
+            salt, B_challenge = self._begin_authentication(srp_user, http_session, api_uri)
+            M2_verfication_code, leap_session = self._process_challenge(srp_user, http_session, api_uri, salt,
+                                                                        B_challenge)
+            self._verify_session(srp_user, M2_verfication_code)
+
+            return leap_session
+        except (HTTPError, SSLError), e:
+            raise LeapAuthException(e)
+
+    def _begin_authentication(self, user, session, api_uri):
+        _, A = user.start_authentication()
+
+        auth_data = {
+            "login": user.get_username(),
+            "A": binascii.hexlify(A)
+        }
+        session_url = '%s/%s/sessions' % (api_uri, self.leap_api_version)
+        response = session.post(session_url, data=auth_data, verify=self.ca_bundle, timeout=self.timeout_in_s)
+        response.raise_for_status()
+        json_content = json.loads(response.content)
+
+        salt = _safe_unhexlify(json_content.get('salt'))
+        B = _safe_unhexlify(json_content.get('B'))
+
+        return salt, B
+
+    def _process_challenge(self, user, session, api_uri, salt, B):
+        M = user.process_challenge(salt, B)
+
+        auth_data = {
+            "client_auth": binascii.hexlify(M)
+        }
+
+        auth_url = '%s/%s/sessions/%s' % (api_uri, self.leap_api_version, user.get_username())
+        response = session.put(auth_url, data=auth_data, verify=self.ca_bundle, timeout=self.timeout_in_s)
+        response.raise_for_status()
+        auth_json = json.loads(response.content)
+
+        M2 = _safe_unhexlify(auth_json.get('M2'))
+        uuid = auth_json.get('id')
+        token = auth_json.get('token')
+        session_id = response.cookies.get('_session_id')
+
+        return M2, LeapSRPSession(user.get_username(), api_uri, uuid, token, session_id)
+
+    def _verify_session(self, user, M2):
+        user.verify_session(M2)
+        if not user.authenticated():
+            raise LeapAuthException()
+
+    def register(self, api_uri, username, password):
+        try:
+            salt, verifier = create_salted_verification_key(username, password, self.hash_alg, self.ng_type)
+            return self._post_registration_data(api_uri, username, salt, verifier)
+        except (HTTPError, SSLError, Timeout), e:
+            raise LeapAuthException(e)
+
+    def _post_registration_data(self, api_uri, username, salt, verifier):
+        users_url = '%s/%s/users' % (api_uri, self.leap_api_version)
+
+        user_data = {
+            REGISTER_USER_LOGIN_KEY: username,
+            REGISTER_USER_SALT_KEY: binascii.hexlify(salt),
+            REGISTER_USER_VERIFIER_KEY: binascii.hexlify(verifier)
+        }
+
+        response = requests.post(users_url, data=user_data, verify=self.ca_bundle, timeout=self.timeout_in_s)
+        response.raise_for_status()
+        reg_json = json.loads(response.content)
+
+        return reg_json['ok']
+
+
+def _safe_unhexlify(hex_str):
+    return binascii.unhexlify(hex_str) \
+        if (len(hex_str) % 2 == 0) else binascii.unhexlify('0' + hex_str)
diff --git a/service/pixelated/bitmask_libraries/nicknym.py b/service/pixelated/bitmask_libraries/nicknym.py
new file mode 100644
index 00000000..c4939e9a
--- /dev/null
+++ b/service/pixelated/bitmask_libraries/nicknym.py
@@ -0,0 +1,35 @@
+from leap.keymanager import KeyManager, openpgp, KeyNotFound
+from .certs import which_bundle
+
+
+class NickNym(object):
+    def __init__(self, provider, config, soledad_session, srp_session):
+        nicknym_url = _discover_nicknym_server(provider)
+        self._email = '%s@%s' % (srp_session.user_name, provider.domain)
+        self.keymanager = KeyManager('%s@%s' % (srp_session.user_name, provider.domain), nicknym_url,
+                                     soledad_session.soledad,
+                                     srp_session.token, which_bundle(provider), provider.api_uri,
+                                     provider.api_version,
+                                     srp_session.uuid, config.gpg_binary)
+
+    def generate_openpgp_key(self):
+        if not self._key_exists(self._email):
+            self._gen_key()
+            self._send_key_to_leap()
+
+    def _key_exists(self, email):
+        try:
+            self.keymanager.get_key(email, openpgp.OpenPGPKey, private=True, fetch_remote=False)
+            return True
+        except KeyNotFound:
+            return False
+
+    def _gen_key(self):
+        self.keymanager.gen_key(openpgp.OpenPGPKey)
+
+    def _send_key_to_leap(self):
+        self.keymanager.send_key(openpgp.OpenPGPKey)
+
+
+def _discover_nicknym_server(provider):
+    return 'https://nicknym.%s:6425/' % provider.domain
diff --git a/service/pixelated/bitmask_libraries/provider.py b/service/pixelated/bitmask_libraries/provider.py
new file mode 100644
index 00000000..b130af89
--- /dev/null
+++ b/service/pixelated/bitmask_libraries/provider.py
@@ -0,0 +1,111 @@
+import json
+
+from leap.common.certs import get_digest
+import requests
+
+from .certs import which_bundle
+
+
+class LeapProvider(object):
+    def __init__(self, server_name, config):
+        self.server_name = server_name
+        self.config = config
+
+        self.provider_json = self.fetch_provider_json()
+
+    @property
+    def api_uri(self):
+        return self.provider_json.get('api_uri')
+
+    @property
+    def ca_cert_fingerprint(self):
+        return self.provider_json.get('ca_cert_fingerprint')
+
+    @property
+    def ca_cert_uri(self):
+        return self.provider_json.get('ca_cert_uri')
+
+    @property
+    def api_version(self):
+        return self.provider_json.get('api_version')
+
+    @property
+    def domain(self):
+        return self.provider_json.get('domain')
+
+    @property
+    def services(self):
+        return self.provider_json.get('services')
+
+    def __hash__(self):
+        return hash(self.server_name)
+
+    def __eq__(self, other):
+        return self.server_name == other.server_name
+
+    def ensure_supports_mx(self):
+        if 'mx' not in self.services:
+            raise Exception
+
+    def download_certificate_to(self, filename):
+        """
+        Downloads the server certificate, validates it against the provided fingerprint and stores it to file
+        """
+        cert = self.fetch_valid_certificate()
+        with open(filename, 'w') as out:
+            out.write(cert)
+
+    def fetch_valid_certificate(self):
+        cert = self._fetch_certificate()
+        self.validate_certificate(cert)
+        return cert
+
+    def _fetch_certificate(self):
+        session = requests.session()
+        try:
+            cert_url = '%s/ca.crt' % self._provider_base_url()
+            response = session.get(cert_url, verify=which_bundle(self), timeout=self.config.timeout_in_s)
+            response.raise_for_status()
+
+            cert_data = response.content
+            return cert_data
+        finally:
+            session.close()
+
+    def validate_certificate(self, cert_data=None):
+        if cert_data is None:
+            cert_data = self._fetch_certificate()
+
+        parts = str(self.ca_cert_fingerprint).split(':')
+        method = parts[0].strip()
+        fingerprint = parts[1].strip()
+
+        digest = get_digest(cert_data, method)
+
+        if fingerprint.strip() != digest:
+            raise Exception('Certificate fingerprints don\'t match')
+
+    def fetch_provider_json(self):
+        url = '%s/provider.json' % self._provider_base_url()
+        response = requests.get(url, verify=which_bundle(self), timeout=self.config.timeout_in_s)
+        response.raise_for_status()
+
+        json_data = json.loads(response.content)
+        return json_data
+
+    def fetch_soledad_json(self):
+        service_url = "%s/%s/config/soledad-service.json" % (
+            self.api_uri, self.api_version)
+        response = requests.get(service_url, verify=which_bundle(self), timeout=self.config.timeout_in_s)
+        response.raise_for_status()
+        return json.loads(response.content)
+
+    def fetch_smtp_json(self):
+        service_url = '%s/%s/config/smtp-service.json' % (
+            self.api_uri, self.api_version)
+        response = requests.get(service_url, verify=which_bundle(self), timeout=self.config.timeout_in_s)
+        response.raise_for_status()
+        return json.loads(response.content)
+
+    def _provider_base_url(self):
+        return 'https://%s' % self.server_name
diff --git a/service/pixelated/bitmask_libraries/session.py b/service/pixelated/bitmask_libraries/session.py
new file mode 100644
index 00000000..4e1dd397
--- /dev/null
+++ b/service/pixelated/bitmask_libraries/session.py
@@ -0,0 +1,156 @@
+import os
+import errno
+import traceback
+from leap.mail.imap.fetch import LeapIncomingMail
+from leap.mail.imap.account import SoledadBackedAccount
+import sys
+from leap.mail.imap.memorystore import MemoryStore
+from leap.mail.imap.soledadstore import SoledadStore
+from twisted.internet import reactor
+from .nicknym import NickNym
+
+from .auth import LeapAuthenticator
+from .soledad import SoledadSessionFactory, SoledadSession
+from .smtp import LeapSmtp
+
+SESSIONS = {}
+
+
+class LeapSession(object):
+    """
+    A LEAP session.
+
+
+    Properties:
+
+    - ``leap_config`` the configuration for this session (LeapClientConfig).
+
+    - ``srp_session`` the secure remote password session to authenticate with LEAP. See http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol (LeapSecureRemotePassword)
+
+    - ``soledad_session`` the soledad session. See https://leap.se/soledad (LeapSecureRemotePassword)
+
+    - ``nicknym`` the nicknym instance. See https://leap.se/nicknym (NickNym)
+
+    - ``account`` the actual leap mail account. Implements Twisted imap4.IAccount and imap4.INamespacePresenter (SoledadBackedAccount)
+
+    - ``incoming_mail_fetcher`` Background job for fetching incoming mails from LEAP server (LeapIncomingMail)
+    """
+
+    def __init__(self, provider, srp_session, soledad_session, nicknym, soledad_account, incoming_mail_fetcher):
+        """
+        Constructor.
+
+        :param leap_config: The config for this LEAP session
+        :type leap_config: LeapConfig
+
+        """
+        self.config = provider.config
+        self.provider = provider
+        self.srp_session = srp_session
+        self.soledad_session = soledad_session
+        self.nicknym = nicknym
+        self.account = soledad_account
+        self.incoming_mail_fetcher = incoming_mail_fetcher
+
+        if self.config.start_background_jobs:
+            self.start_background_jobs()
+
+    def account_email(self):
+        domain = self.provider.domain
+        name = self.srp_session.user_name
+        return '%s@%s' % (name, domain)
+
+    def close(self):
+        self.stop_background_jobs()
+
+    def start_background_jobs(self):
+        reactor.callFromThread(self.incoming_mail_fetcher.start_loop)
+
+    def stop_background_jobs(self):
+        reactor.callFromThread(self.incoming_mail_fetcher.stop)
+
+    def sync(self):
+        try:
+            self.soledad_session.sync()
+        except:
+            traceback.print_exc(file=sys.stderr)
+            raise
+
+
+class LeapSessionFactory(object):
+    def __init__(self, provider):
+        self._provider = provider
+        self._config = provider.config
+
+    def create(self, credentials):
+        key = self._session_key(credentials)
+        session = self._lookup_session(key)
+        if not session:
+            session = self._create_new_session(credentials)
+            self._remember_session(key, session)
+
+        return session
+
+    def _create_new_session(self, credentials):
+        self._create_dir(self._provider.config.leap_home)
+        self._provider.download_certificate_to('%s/ca.crt' % self._provider.config.leap_home)
+
+        auth = LeapAuthenticator(self._provider).authenticate(credentials)
+        soledad = SoledadSessionFactory.create(self._provider, auth, credentials.db_passphrase)
+
+        nicknym = self._create_nicknym(auth, soledad)
+        account = self._create_account(auth, soledad)
+        incoming_mail_fetcher = self._create_incoming_mail_fetcher(nicknym, soledad,
+                                                                   account, auth)
+
+        smtp = self._create_smtp_service(nicknym, auth)
+        smtp.start()
+
+        session = LeapSession(self._provider, auth, soledad, nicknym, account, incoming_mail_fetcher)
+
+        return session
+
+    def _lookup_session(self, key):
+        global SESSIONS
+        if key in SESSIONS:
+            return SESSIONS[key]
+        else:
+            return None
+
+    def _remember_session(self, key, session):
+        global SESSIONS
+        SESSIONS[key] = session
+
+    def _session_key(self, credentials):
+        return hash((self._provider, credentials.user_name))
+
+    def _create_dir(self, path):
+        try:
+            os.makedirs(path)
+        except OSError as exc:
+            if exc.errno == errno.EEXIST and os.path.isdir(path):
+                pass
+            else:
+                raise
+
+    def _create_soledad_session(self, srp_session, db_passphrase):
+        return SoledadSession(self._provider, db_passphrase, srp_session)
+
+    def _create_nicknym(self, srp_session, soledad_session):
+        return NickNym(self._provider, self._config, soledad_session, srp_session)
+
+    def _create_account(self, srp_session, soledad_session):
+        memstore = MemoryStore(permanent_store=SoledadStore(soledad_session.soledad))
+        return SoledadBackedAccount(srp_session.uuid, soledad_session.soledad, memstore)
+
+    def _create_incoming_mail_fetcher(self, nicknym, soledad_session, account, auth):
+        return LeapIncomingMail(nicknym.keymanager, soledad_session.soledad, account,
+                                self._config.fetch_interval_in_s, self._account_email(auth))
+
+    def _create_smtp_service(self, nicknym, auth):
+        return LeapSmtp(self._provider, nicknym.keymanager, auth)
+
+    def _account_email(self, auth):
+        domain = self._provider.domain
+        name = auth.user_name
+        return '%s@%s' % (name, domain)
diff --git a/service/pixelated/bitmask_libraries/smtp.py b/service/pixelated/bitmask_libraries/smtp.py
new file mode 100644
index 00000000..f07a4838
--- /dev/null
+++ b/service/pixelated/bitmask_libraries/smtp.py
@@ -0,0 +1,81 @@
+import os
+import requests
+from .certs import which_bundle
+from leap.mail.smtp import setup_smtp_gateway
+import random
+
+
+class LeapSmtp(object):
+
+    SMTP_PORT = 2014
+
+    def __init__(self, provider, keymanager=None, leap_srp_session=None):
+        self._provider = provider
+        self._keymanager = keymanager
+        self._srp_session = leap_srp_session
+        self._hostname, self._port = self._discover_smtp_server()
+        self._smtp_port = None
+        self._smtp_service = None
+        self._twisted_port = 10000 + int(random.random() * 5000)
+
+    def smtp_info(self):
+        return ('localhost', LeapSmtp.SMTP_PORT)
+
+    def _discover_smtp_server(self):
+        json_data = self._provider.fetch_smtp_json()
+        hosts = json_data['hosts']
+        hostname = hosts.keys()[0]
+        host = hosts[hostname]
+
+        hostname = host['hostname']
+        port = host['port']
+
+        return hostname, port
+
+    def _download_client_certificates(self):
+        cert_path = self._client_cert_path()
+
+        if not os.path.exists(os.path.dirname(cert_path)):
+            os.makedirs(os.path.dirname(cert_path))
+
+        session = requests.session()
+        cert_url = '%s/%s/cert' % (self._provider.api_uri, self._provider.api_version)
+        cookies = {"_session_id": self._srp_session.session_id}
+
+        response = requests.get(cert_url, verify=which_bundle(self._provider), cookies=cookies, timeout=self._provider.config.timeout_in_s)
+        response.raise_for_status()
+
+        client_cert = response.content
+
+        with open(cert_path, 'w') as f:
+            f.write(client_cert)
+
+    def _client_cert_path(self):
+        return os.path.join(
+            self._provider.config.leap_home,
+            "providers",
+            self._provider.domain,
+            "keys", "client", "smtp.pem")
+
+    def start(self):
+        self._download_client_certificates()
+        cert_path = self._client_cert_path()
+        email = '%s@%s' % (self._srp_session.user_name, self._provider.domain)
+
+        self._smtp_service, self._smtp_port = setup_smtp_gateway(
+            port=(self._twisted_port),
+            userid=email,
+            keymanager=self._keymanager,
+            smtp_host=self._hostname.encode('UTF-8'),
+            smtp_port=self._port,
+            smtp_cert=cert_path,
+            smtp_key=cert_path,
+            encrypted_only=False
+        )
+
+    def stop(self):
+        if self._smtp_service is not None:
+            self._smtp_port.stopListening()
+            self._smtp_service.doStop()
+            self._smtp_port = None
+            self._smtp_service = None
diff --git a/service/pixelated/bitmask_libraries/soledad.py b/service/pixelated/bitmask_libraries/soledad.py
new file mode 100644
index 00000000..132e671f
--- /dev/null
+++ b/service/pixelated/bitmask_libraries/soledad.py
@@ -0,0 +1,95 @@
+import json
+import os
+import errno
+from leap.keymanager import KeyManager
+from leap.soledad.client import Soledad
+from leap.soledad.common.crypto import WrongMac, UnknownMacMethod, MacMethods
+import requests
+import sys
+import time
+from .certs import which_bundle
+
+SOLEDAD_TIMEOUT = 120
+SOLEDAD_CERT = '/tmp/ca.crt'
+
+
+class SoledadDiscoverException(Exception):
+    def __init__(self, *args, **kwargs):
+        super(SoledadDiscoverException, self).__init__(*args, **kwargs)
+
+
+class SoledadWrongPassphraseException(Exception):
+    def __init__(self, *args, **kwargs):
+        super(SoledadWrongPassphraseException, self).__init__(*args, **kwargs)
+
+
+class LeapKeyManager(object):
+    def __init__(self, soledad, leap_session, nicknym_url):
+        provider = leap_session.provider
+        self.keymanager = KeyManager(leap_session.account_email(), nicknym_url, soledad,
+                                     leap_session.session_id, leap_session.leap_home + '/ca.crt', provider.api_uri, leap_session.api_version,
+                                     leap_session.uuid, leap_session.leap_config.gpg_binary)
+
+
+class SoledadSessionFactory(object):
+    @classmethod
+    def create(cls, provider, srp_session, encryption_passphrase):
+        return SoledadSession(provider, encryption_passphrase, srp_session)
+
+
+class SoledadSession(object):
+    def __init__(self, provider, encryption_passphrase, leap_srp_session):
+        self.provider = provider
+        self.config = provider.config
+        self.leap_srp_session = leap_srp_session
+
+        self.soledad = self._init_soledad(encryption_passphrase)
+
+    def _init_soledad(self, encryption_passphrase):
+        try:
+            server_url = self._discover_soledad_server()
+
+            self._create_database_dir()
+            secrets = self._secrets_path()
+            local_db = self._local_db_path()
+
+            return Soledad(self.leap_srp_session.uuid, unicode(encryption_passphrase), secrets,
+                           local_db, server_url, which_bundle(self.provider), self.leap_srp_session.token)
+
+        except (WrongMac, UnknownMacMethod, MacMethods), e:
+            raise SoledadWrongPassphraseException(e)
+
+    def _leap_path(self):
+        return "%s/soledad" % self.config.leap_home
+
+    def _secrets_path(self):
+        return "%s/%s.secret" % (self._leap_path(), self.leap_srp_session.uuid)
+
+    def _local_db_path(self):
+        return "%s/%s.db" % (self._leap_path(), self.leap_srp_session.uuid)
+
+    def _create_database_dir(self):
+        try:
+            os.makedirs(self._leap_path())
+        except OSError as exc:
+            if exc.errno == errno.EEXIST and os.path.isdir(self._leap_path()):
+                pass
+            else:
+                raise
+
+    def sync(self):
+        if self.soledad.need_sync(self.soledad.server_url):
+            self.soledad.sync()
+
+    def _discover_soledad_server(self):
+        try:
+            json_data = self.provider.fetch_soledad_json()
+
+            hosts = json_data['hosts']
+            host = hosts.keys()[0]
+            server_url = 'https://%s:%d/user-%s' % \
+                         (hosts[host]['hostname'], hosts[host]['port'],
+                          self.leap_srp_session.uuid)
+            return server_url
+        except Exception, e:
+            raise SoledadDiscoverException(e)
diff --git a/service/pixelated/reactor_manager.py b/service/pixelated/reactor_manager.py
new file mode 100644
index 00000000..01f7f545
--- /dev/null
+++ b/service/pixelated/reactor_manager.py
@@ -0,0 +1,26 @@
+import signal
+import sys
+from threading import Thread
+from twisted.internet import reactor
+
+
+def signal_handler(signal, frame):
+        stop_reactor_on_exit()
+        sys.exit(0)
+
+
+def start_reactor():
+    def start_reactor_run():
+        reactor.run(False)
+
+    global REACTOR_THREAD
+    REACTOR_THREAD = Thread(target=start_reactor_run)
+    REACTOR_THREAD.start()
+
+
+def stop_reactor_on_exit():
+    reactor.callFromThread(reactor.stop)
+    global REACTOR_THREAD
+    REACTOR_THREAD = None
+
+signal.signal(signal.SIGINT, signal_handler)
diff --git a/service/pixelated/search_query.py b/service/pixelated/search_query.py
new file mode 100644
index 00000000..d31129ba
--- /dev/null
+++ b/service/pixelated/search_query.py
@@ -0,0 +1,42 @@
+from scanner import StringScanner, StringRegexp
+import re
+
+
+def compile(query):
+    compiled = {"tags": [], "not_tags": []}
+    sanitized_query = re.sub(r"['\"]", "", query.encode('utf8'))
+    scanner = StringScanner(sanitized_query)
+    first_token = True
+    while not scanner.is_eos:
+        token = scanner.scan(_next_token())
+
+        if not token:
+            scanner.skip(_separators())
+            continue
+
+        if ":" in token:
+            compiled = _compile_tag(compiled, token)
+        elif first_token:
+            compiled["general"] = token
+
+        if not first_token:
+            first_token = True
+
+    return compiled
+
+
+def _next_token():
+    return StringRegexp('[^\s]+')
+
+
+def _separators():
+    return StringRegexp('[\s&]+')
+
+
+def _compile_tag(compiled, token):
+    tag = token.split(":").pop()
+    if token[0] == "-":
+        compiled["not_tags"].append(tag)
+    else:
+        compiled["tags"].append(tag)
+    return compiled
diff --git a/service/pixelated/tags.py b/service/pixelated/tags.py
new file mode 100644
index 00000000..7452b7d6
--- /dev/null
+++ b/service/pixelated/tags.py
@@ -0,0 +1,60 @@
+import json
+
+
+class Tag:
+
+    def __init__(self, name, default=False):
+        self.name = name
+        self.default = default
+        self.ident = name.__hash__()
+
+    def __eq__(self, other):
+        return self.name == other.name
+
+    def __hash__(self):
+        return self.name.__hash__()
+
+    def as_dict(self):
+        return {
+            'name': self.name,
+            'default': self.default,
+            'ident': self.ident,
+            'counts': {
+                'total': 0,
+                'read': 0,
+                'starred': 0,
+                'replied': 0
+            }
+        }
+
+
+class Tags:
+
+    SPECIAL_TAGS = ['inbox', 'sent', 'drafts', 'trash']
+
+    def __init__(self):
+        self.tags = {}
+        self.create_default_tags()
+
+    def create_default_tags(self):
+        for name in self.SPECIAL_TAGS:
+            self.tags[name] = self.add(name)
+
+    def add(self, tag_input):
+        if tag_input.__class__.__name__ == 'Tag':
+            tag_input = tag_input.name
+        tag = Tag(tag_input, tag_input in self.SPECIAL_TAGS)
+        self.tags[tag_input] = tag
+        return tag
+
+    def find(self, name):
+        return self.tags[name]
+
+    def __len__(self):
+        return len(self.tags)
+
+    def __iter__(self):
+        return self.tags.itervalues()
+
+    def as_dict(self):
+        return [tag.as_dict() for tag in self.tags.values()]
diff --git a/service/pixelated/user_agent.py b/service/pixelated/user_agent.py
new file mode 100644
index 00000000..b70ed37c
--- /dev/null
+++ b/service/pixelated/user_agent.py
@@ -0,0 +1,141 @@
+import json
+import datetime
+import dateutil.parser as dateparser
+
+from flask import Flask
+from flask import request
+from flask import Response
+
+import pixelated.reactor_manager as reactor_manager
+import pixelated.search_query as search_query
+from pixelated.adapter.mail_service import MailService
+from pixelated.adapter.pixelated_mail import PixelatedMail
+from pixelated.tags import Tags
+
+app = Flask(__name__, static_url_path='', static_folder='../../web-ui/app')
+
+mail_service = MailService()
+account = None
+
+
+def respond_json(entity):
+    response = json.dumps(entity)
+    return Response(response=response, mimetype="application/json")
+
+
+@app.route('/disabled_features')
+def disabled_features():
+    return respond_json([
+        'saveDraft',
+        'replySection',
+        'signatureStatus',
+        'encryptionStatus',
+        'contacts'
+    ])
+
+
+@app.route('/mails', methods=['POST'])
+def save_draft_or_send():
+    ident = None
+    if 'sent' in request.json['tags']:
+        ident = mail_service.send_draft(converter.to_mail(request.json, account))
+    else:
+        ident = mail_service.save_draft(converter.to_mail(request.json, account))
+    return respond_json({'ident': ident})
+
+
+@app.route('/mails', methods=['PUT'])
+def update_draft():
+    raw_mail = json.parse(request.json)
+    ident = mail_service.update_mail(raw_mail)
+    return respond_json({'ident': ident})
+
+
+@app.route('/mails')
+def mails():
+    query = search_query.compile(request.args.get("q")) if request.args.get("q") else {'tags': {}}
+
+    mails = mail_service.mails(query)
+
+    if "inbox" in query['tags']:
+        mails = [mail for mail in mails if not mail.has_tag('trash')]
+
+    mails = sorted(mails, key=lambda mail: mail.date, reverse=True)
+
+    mails = [mail.as_dict() for mail in mails]
+
+    response = {
+        "stats": {
+            "total": len(mails),
+            "read": 0,
+            "starred": 0,
+            "replied": 0
+        },
+        "mails": mails
+    }
+
+    return respond_json(response)
+
+
+@app.route('/mail/<mail_id>', methods=['DELETE'])
+def delete_mails(mail_id):
+    mail_service.delete_mail(mail_id)
+    return respond_json(None)
+
+
+@app.route('/tags')
+def tags():
+    tags = mail_service.all_tags()
+    return respond_json(tags.as_dict())
+
+
+@app.route('/mail/<mail_id>')
+def mail(mail_id):
+    mail = mail_service.mail(mail_id)
+    return respond_json(mail.as_dict())
+
+
+@app.route('/mail/<mail_id>/tags', methods=['POST'])
+def mail_tags(mail_id):
+    new_tags = request.get_json()['newtags']
+    tags = mail_service.update_tags(mail_id, new_tags)
+    tag_names = [tag.name for tag in tags]
+    return respond_json(tag_names)
+
+
+@app.route('/mail/<mail_id>/read', methods=['POST'])
+def mark_mail_as_read(mail_id):
+    mail_service.mark_as_read(mail_id)
+    return ""
+
+
+@app.route('/contacts')
+def contacts():
+    query = search_query.compile(request.args.get("q"))
+    desired_contacts = [converter.from_contact(contact) for contact in mail_service.all_contacts(query)]
+    return respond_json({'contacts': desired_contacts})
+
+
+@app.route('/draft_reply_for/<mail_id>')
+def draft_reply_for(mail_id):
+    draft = mail_service.draft_reply_for(mail_id)
+    if draft:
+        return respond_json(converter.from_mail(draft))
+    else:
+        return respond_json(None)
+
+
+@app.route('/')
+def index():
+    return app.send_static_file('index.html')
+
+
+def setup():
+    reactor_manager.start_reactor()
+    app.config.from_envvar('PIXELATED_UA_CFG')
+    account = app.config['ACCOUNT']
+    app.run(host=app.config['HOST'], debug=app.config['DEBUG'], port=app.config['PORT'])
+
+
+if __name__ == '__main__':
+    setup()