chore: rename silver references to OpenGovMail

.github/workflows/update-security-policy.yaml

@@ -14,11 +14,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - name: Checkout default branch using Silver Bot token
+      - name: Checkout default branch using OpenGovMail Bot token
         uses: actions/checkout@v4
         with:
           ref: ${{ github.event.repository.default_branch }}
-          token: ${{ secrets.SILVER_BOT_TOKEN }}
+          token: ${{ secrets.OPENGOVMAIL_BOT_TOKEN }}
 
       - name: Update docs/SECURITY.md supported versions
         env:
@@ -77,21 +77,21 @@ jobs:
           security_md_path.write_text("\n".join(content) + "\n", encoding="utf-8")
           PY
 
-      - name: Create Pull Request as Silver Bot
+      - name: Create Pull Request as OpenGovMail Bot
         uses: peter-evans/create-pull-request@v6
         with:
-          token: ${{ secrets.SILVER_BOT_TOKEN }}
+          token: ${{ secrets.OPENGOVMAIL_BOT_TOKEN }}
           commit-message: "chore(security): update supported versions for ${{ github.event.release.tag_name }}"
-          committer: "${{ vars.SILVER_BOT_NAME }} <${{ vars.SILVER_BOT_EMAIL }}>"
-          author: "${{ vars.SILVER_BOT_NAME }} <${{ vars.SILVER_BOT_EMAIL }}>"
-          branch: silver-bot/update-security-${{ github.event.release.tag_name }}
+          committer: "${{ vars.OPENGOVMAIL_BOT_NAME }} <${{ vars.OPENGOVMAIL_BOT_EMAIL }}>"
+          author: "${{ vars.OPENGOVMAIL_BOT_NAME }} <${{ vars.OPENGOVMAIL_BOT_EMAIL }}>"
+          branch: opengovmail-bot/update-security-${{ github.event.release.tag_name }}
           base: ${{ github.event.repository.default_branch }}
           title: "chore(security): update supported versions for ${{ github.event.release.tag_name }}"
           body: |
             This PR automatically updates **docs/SECURITY.md** to reflect the supported versions for the new release.
 
             Release: `${{ github.event.release.tag_name }}`
 
-            Generated automatically by Silver Bot.
+            Generated automatically by OpenGovMail Bot.
           add-paths: |
             docs/SECURITY.md

.github/workflows/welcome-outside-contributors.yaml

@@ -25,7 +25,7 @@ jobs:
                   - name: Welcome first-time outside commenters on issues
                     uses: actions/github-script@v7
                     with:
-                          github-token: ${{ secrets.SILVER_BOT_TOKEN || github.token }}
+                          github-token: ${{ secrets.OPENGOVMAIL_BOT_TOKEN || github.token }}
                           script: |
                                 const issueNumber = context.payload.issue.number;
                                 const login = context.payload.comment.user.login;

docs/CONTRIBUTING.md

@@ -1,6 +1,6 @@
-# Contributing to Raven (Silver Go IMAP)
+# Contributing to Raven (OpenGovMail Go IMAP)
 
-Thank you for your interest in contributing to the Raven (Silver Go IMAP) project! This document provides guidelines and instructions for contributing.
+Thank you for your interest in contributing to the Raven (OpenGovMail Go IMAP) project! This document provides guidelines and instructions for contributing.
 
 ## Table of Contents
 

internal/server/auth/authenticate_oauth_test.go

@@ -222,7 +222,7 @@ func TestAuthenticateOAuth_RejectsSASLUserEmailMismatch(t *testing.T) {
 		"aud":      []string{aud},
 		"exp":      time.Now().Add(2 * time.Minute).Unix(),
 		"username": "user2",
-		"email":    "user2@silver.example.com",
+		"email":    "user2@opengovmail.example.com",
 		"sub":      "subject-2",
 	})
 	if err != nil {

internal/server/auth/authenticateuser_test.go

@@ -243,7 +243,7 @@ func TestAuthenticateUser_SubdomainEmailFromIDP(t *testing.T) {
 	authServer := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(http.StatusOK)
-		_, _ = w.Write([]byte(`{"id":"user2@silver.example.com","type":"test-user","ouId":"silver"}`))
+		_, _ = w.Write([]byte(`{"id":"user2@opengovmail.example.com","type":"test-user","ouId":"opengovmail"}`))
 	}))
 	defer authServer.Close()
 
@@ -261,14 +261,14 @@ func TestAuthenticateUser_SubdomainEmailFromIDP(t *testing.T) {
 	conn := server.NewMockTLSConn()
 	state := &models.ClientState{}
 
-	s.HandleLogin(conn, "A001", []string{"A001", "LOGIN", "user2@silver.example.com", "password"}, state)
+	s.HandleLogin(conn, "A001", []string{"A001", "LOGIN", "user2@opengovmail.example.com", "password"}, state)
 
 	response := conn.GetWrittenData()
 	if !strings.Contains(response, "A001 OK") {
 		t.Fatalf("Expected successful login, got: %s", response)
 	}
 
-	if state.Email != "user2@silver.example.com" {
+	if state.Email != "user2@opengovmail.example.com" {
 		t.Fatalf("Expected canonical subdomain email, got: %s", state.Email)
 	}
 }
@@ -284,7 +284,7 @@ func TestAuthenticateUser_SubdomainEmailFromOrgUnitHierarchy(t *testing.T) {
 		case "/auth/credentials/authenticate":
 			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusOK)
-			_, _ = w.Write([]byte(`{"id":"019cf0a6-114a-7dad-bea1-9a36bc728ece","type":"silveruser","ouId":"019cf0a5-4109-79ac-857b-07fc7b5c19ac"}`))
+			_, _ = w.Write([]byte(`{"id":"019cf0a6-114a-7dad-bea1-9a36bc728ece","type":"opengovmailuser","ouId":"019cf0a5-4109-79ac-857b-07fc7b5c19ac"}`))
 		case "/flow/execute":
 			var payload map[string]any
 			if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
@@ -333,7 +333,7 @@ func TestAuthenticateUser_SubdomainEmailFromOrgUnitHierarchy(t *testing.T) {
 			}
 			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusOK)
-			_, _ = w.Write([]byte(`{"id":"019cf0a5-4109-79ac-857b-07fc7b5c19ac","handle":"silver","parent":"019cf0a3-c234-7190-a4c9-d5f6860a44e9"}`))
+			_, _ = w.Write([]byte(`{"id":"019cf0a5-4109-79ac-857b-07fc7b5c19ac","handle":"opengovmail","parent":"019cf0a3-c234-7190-a4c9-d5f6860a44e9"}`))
 		case "/organization-units/019cf0a3-c234-7190-a4c9-d5f6860a44e9":
 			if r.Header.Get("Authorization") != "Bearer test-assertion" {
 				w.WriteHeader(http.StatusUnauthorized)
@@ -367,14 +367,14 @@ func TestAuthenticateUser_SubdomainEmailFromOrgUnitHierarchy(t *testing.T) {
 	conn := server.NewMockTLSConn()
 	state := &models.ClientState{}
 
-	s.HandleLogin(conn, "A001", []string{"A001", "LOGIN", "user2@silver.example.com", "password"}, state)
+	s.HandleLogin(conn, "A001", []string{"A001", "LOGIN", "user2@opengovmail.example.com", "password"}, state)
 
 	response := conn.GetWrittenData()
 	if !strings.Contains(response, "A001 OK") {
 		t.Fatalf("Expected successful login, got: %s", response)
 	}
 
-	if state.Email != "user2@silver.example.com" {
+	if state.Email != "user2@opengovmail.example.com" {
 		t.Fatalf("Expected OU-derived subdomain email, got: %s", state.Email)
 	}
 
@@ -394,7 +394,7 @@ func TestAuthenticateUser_UsernameWithDomainMismatchFromOrgUnit(t *testing.T) {
 		case "/auth/credentials/authenticate":
 			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusOK)
-			_, _ = w.Write([]byte(`{"id":"019cf0a6-114a-7dad-bea1-9a36bc728ece","type":"silveruser","ouId":"019cf0a5-4109-79ac-857b-07fc7b5c19ac"}`))
+			_, _ = w.Write([]byte(`{"id":"019cf0a6-114a-7dad-bea1-9a36bc728ece","type":"opengovmailuser","ouId":"019cf0a5-4109-79ac-857b-07fc7b5c19ac"}`))
 		case "/flow/execute":
 			var payload map[string]any
 			if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
@@ -415,7 +415,7 @@ func TestAuthenticateUser_UsernameWithDomainMismatchFromOrgUnit(t *testing.T) {
 			}
 			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusOK)
-			_, _ = w.Write([]byte(`{"id":"019cf0a5-4109-79ac-857b-07fc7b5c19ac","handle":"silver","parent":"019cf0a3-c234-7190-a4c9-d5f6860a44e9"}`))
+			_, _ = w.Write([]byte(`{"id":"019cf0a5-4109-79ac-857b-07fc7b5c19ac","handle":"opengovmail","parent":"019cf0a3-c234-7190-a4c9-d5f6860a44e9"}`))
 		case "/organization-units/019cf0a3-c234-7190-a4c9-d5f6860a44e9":
 			if r.Header.Get("Authorization") != "Bearer test-assertion" {
 				w.WriteHeader(http.StatusUnauthorized)
@@ -463,7 +463,7 @@ func TestAuthenticateUser_UsernameWithDomainMatchesOrgUnit(t *testing.T) {
 		case "/auth/credentials/authenticate":
 			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusOK)
-			_, _ = w.Write([]byte(`{"id":"019cf0a6-114a-7dad-bea1-9a36bc728ece","type":"silveruser","ouId":"019cf0a5-4109-79ac-857b-07fc7b5c19ac"}`))
+			_, _ = w.Write([]byte(`{"id":"019cf0a6-114a-7dad-bea1-9a36bc728ece","type":"opengovmailuser","ouId":"019cf0a5-4109-79ac-857b-07fc7b5c19ac"}`))
 		case "/flow/execute":
 			var payload map[string]any
 			if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
@@ -484,7 +484,7 @@ func TestAuthenticateUser_UsernameWithDomainMatchesOrgUnit(t *testing.T) {
 			}
 			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusOK)
-			_, _ = w.Write([]byte(`{"id":"019cf0a5-4109-79ac-857b-07fc7b5c19ac","handle":"silver","parent":"019cf0a3-c234-7190-a4c9-d5f6860a44e9"}`))
+			_, _ = w.Write([]byte(`{"id":"019cf0a5-4109-79ac-857b-07fc7b5c19ac","handle":"opengovmail","parent":"019cf0a3-c234-7190-a4c9-d5f6860a44e9"}`))
 		case "/organization-units/019cf0a3-c234-7190-a4c9-d5f6860a44e9":
 			if r.Header.Get("Authorization") != "Bearer test-assertion" {
 				w.WriteHeader(http.StatusUnauthorized)
@@ -513,7 +513,7 @@ func TestAuthenticateUser_UsernameWithDomainMatchesOrgUnit(t *testing.T) {
 	conn := server.NewMockTLSConn()
 	state := &models.ClientState{}
 
-	s.HandleLogin(conn, "A001", []string{"A001", "LOGIN", "user2@silver.example.com", "password"}, state)
+	s.HandleLogin(conn, "A001", []string{"A001", "LOGIN", "user2@opengovmail.example.com", "password"}, state)
 
 	response := conn.GetWrittenData()
 	if !strings.Contains(response, "A001 OK") {

internal/server/auth/helpers_internal_test.go

@@ -26,22 +26,22 @@ func TestResolveMailboxEmailPriority(t *testing.T) {
 			name:          "login email wins",
 			loginIdentity: " user@example.com ",
 			authID:        "id@example.net",
-			domain:        "silver.example.com",
+			domain:        "opengovmail.example.com",
 			want:          "user@example.com",
 		},
 		{
 			name:          "auth id email used",
 			loginIdentity: "user2",
-			authID:        "user2@silver.example.com",
+			authID:        "user2@opengovmail.example.com",
 			domain:        "example.com",
-			want:          "user2@silver.example.com",
+			want:          "user2@opengovmail.example.com",
 		},
 		{
 			name:          "derived domain fallback",
 			loginIdentity: "user2",
 			authID:        "019cf0a6-114a",
-			domain:        "silver.example.com",
-			want:          "user2@silver.example.com",
+			domain:        "opengovmail.example.com",
+			want:          "user2@opengovmail.example.com",
 		},
 		{
 			name:          "empty when nothing resolvable",
@@ -133,7 +133,7 @@ func TestResolveOrganizationUnitDomainAndCycle(t *testing.T) {
 			w.Header().Set("Content-Type", "application/json")
 			switch r.URL.Path {
 			case "/organization-units/ou-child":
-				_, _ = w.Write([]byte(`{"id":"ou-child","handle":"silver","parent":"ou-root"}`))
+				_, _ = w.Write([]byte(`{"id":"ou-child","handle":"opengovmail","parent":"ou-root"}`))
 			case "/organization-units/ou-root":
 				_, _ = w.Write([]byte(`{"id":"ou-root","handle":"example.com","parent":null}`))
 			default:
@@ -146,8 +146,8 @@ func TestResolveOrganizationUnitDomainAndCycle(t *testing.T) {
 		if err != nil {
 			t.Fatalf("resolveOrganizationUnitDomain() unexpected error: %v", err)
 		}
-		if domain != "silver.example.com" {
-			t.Fatalf("domain = %q, want %q", domain, "silver.example.com")
+		if domain != "opengovmail.example.com" {
+			t.Fatalf("domain = %q, want %q", domain, "opengovmail.example.com")
 		}
 	})
 
@@ -275,7 +275,7 @@ func TestResolveDomainFromOrganizationUnit_AdditionalBranches(t *testing.T) {
 				return
 			}
 			w.Header().Set("Content-Type", "application/json")
-			_, _ = w.Write([]byte(`{"id":"ou-child","handle":"silver","parent":"ou-root"}`))
+			_, _ = w.Write([]byte(`{"id":"ou-child","handle":"opengovmail","parent":"ou-root"}`))
 		case "/organization-units/ou-root":
 			if r.Header.Get("Authorization") != "Bearer assertion-user" {
 				w.WriteHeader(http.StatusUnauthorized)
@@ -298,8 +298,8 @@ func TestResolveDomainFromOrganizationUnit_AdditionalBranches(t *testing.T) {
 		t.Fatalf("extractBaseURL() = %q, want %q", baseURL, srv.URL)
 	}
 
-	if got := resolveDomainFromOrganizationUnit(srv.URL+"/auth/credentials/authenticate", "ou-child", "user2", "pass"); got != "silver.example.com" {
-		t.Fatalf("resolveDomainFromOrganizationUnit() = %q, want %q", got, "silver.example.com")
+	if got := resolveDomainFromOrganizationUnit(srv.URL+"/auth/credentials/authenticate", "ou-child", "user2", "pass"); got != "opengovmail.example.com" {
+		t.Fatalf("resolveDomainFromOrganizationUnit() = %q, want %q", got, "opengovmail.example.com")
 	}
 }