Case study
Company Mail: PWA + Single Sign-On
Modernized a company's self-hosted email — installable mobile web app, push notifications, and one-account SSO login across desktop and mobile clients.
Outcomes
- Webmail turned into an installable PWA with offline support and push notifications
- OAuth2 single sign-on rolled out across desktop and mobile mail clients
- 27 end-to-end tests covering the mail push pipeline — verified on macOS and Linux
The problem
A company ran its own email stack, but the experience was stuck in the past: no mobile app, passwords managed separately from the company’s identity system, and no way to know mail had arrived without polling. Staff wanted “works like Gmail” without giving up their self-hosted setup.
The approach
Three coordinated pieces, each on open standards:
- PWA — built a plugin for the company’s webmail (Roundcube) adding a service worker, web app manifest, and localization, making it installable on phones with real push notifications driven from the mail server itself.
- Single sign-on — connected desktop and mobile mail clients to the company’s Keycloak identity server over OAuth2, centralizing configuration so every machine gets working settings without hand-editing.
- Push pipeline — wired the IMAP server to emit push events on new mail, with an end-to-end test suite (27 tests) that proves the chain from “mail delivered” to “notification on the phone”.
The fiddly parts were real: OAuth token races in the desktop client, a session cookie that silently logged the mobile app out, and a client update that removed the password store the old setup relied on. Each was diagnosed with its own minimal reproduction before being fixed.
The outcome
Staff install company mail from the browser like an app, get notified on new mail, and sign in with the same account they use everywhere else. The company kept full ownership of its mail — no migration to a hosted provider — and the test suite keeps the pipeline honest as components upgrade.