Merge branch 'staging' of https://github.com/simple-login/app into staging

2020-01-10 11:28:08 +01:00 · 2020-01-10 11:28:08 +01:00 · ef2e390df3
parent be6db8fab1 f0c66d279b
commit ef2e390df3
55 changed files with 1072 additions and 234 deletions
--- a/.env.example
+++ b/.env.example
@ -86,3 +86,7 @@ GOOGLE_CLIENT_SECRET=to_fill
 # Facebook
 FACEBOOK_CLIENT_ID=to_fill
 FACEBOOK_CLIENT_SECRET=to_fill
+
+# Flask profiler
+# FLASK_PROFILER_PATH=/tmp/flask-profiler.sql
+# FLASK_PROFILER_PASSWORD=password
--- a/.github/workflows/pythonpackage.yml
+++ b/.github/workflows/pythonpackage.yml
@ -9,7 +9,7 @@ jobs:
    strategy:
      max-parallel: 4
      matrix:
-        python-version: [3.7]
+        python-version: [3.6, 3.7]

    steps:
    - uses: actions/checkout@v1
--- a/2
+++ b/2
@ -13,5 +13,5 @@ RUN pip3 install -r requirements.txt
 COPY . .

 #gunicorn wsgi:app -b 0.0.0.0:7777 -w 2 --timeout 15 --log-level DEBUG
-CMD ["gunicorn","wsgi:app","-b","0.0.0.0:7777","-w","2","--timeout","15","--log-level","DEBUG"]
+CMD ["gunicorn","wsgi:app","-b","0.0.0.0:7777","-w","2","--timeout","15"]

--- a/README.md
+++ b/README.md
@ -1,17 +1,70 @@
-SimpleLogin - privacy-first email alias and Single Sign-On (SSO) Identity Provider
---
+<p align="center">
+    <a href="https://simplelogin.io">
+        <img src="./docs/diagram.png" height="300px">
+    </a>
+</p>

-https://simplelogin.io
+[SimpleLogin](https://simplelogin.io) | Privacy-First Email Forwarding and Identity Provider Service
+---
+<p>    
+<a href="https://chrome.google.com/webstore/detail/simplelogin-protect-your/dphilobhebphkdjbpfohgikllaljmgbn">
+    <img src="https://img.shields.io/chrome-web-store/rating/dphilobhebphkdjbpfohgikllaljmgbn?label=Chrome%20Extension">
+</a>
+
+<a href="https://addons.mozilla.org/en-GB/firefox/addon/simplelogin/">    
+<img src="https://img.shields.io/amo/rating/simplelogin?label=Firefox%20Add-On&logo=SimpleLogin">
+</a>
+
+<a href="https://stats.uptimerobot.com/APkzziNWoM">    
+<img src="https://img.shields.io/uptimerobot/ratio/7/m782965045-15d8e413b20b5376f58db050">
+</a>
+
+<a href="./LICENSE">
+<img src="https://img.shields.io/github/license/simple-login/app">
+</a>
+
+<a href="https://twitter.com/simple_login">
+<img src="https://img.shields.io/twitter/follow/simple_login?style=social">
+</a>
+
+</p>

 > Yet another email forwarding service?

 In some way yes... However, SimpleLogin is a bit different because:

- it's fully open-source: both the server and client code (browser extension, JS library) are open-source so anyone can freely inspect and (hopefully) improve the code.
- not just email alias: SimpleLogin is a privacy-first and developer-friendly identity provider that: a. offers privacy for users b. is simple to use for developers. Our goal is to offer a privacy-focused alternative to the "Login with Facebook/Google/Twitter" buttons.
- the only email alias solution that is `self-hostable`: with our detailed self-hosting instructions and most of components running as Docker container, anyone who knows how to `ssh` is able to deploy SimpleLogin on their server.  
- plenty of features: custom domain, browser extension, alias activity, OAuth libraries, etc.
- written in Python 🐍 😅 this is not a difference per se but hey I never found a Python email server so feel free to tweak this one if you want to use Python for handling emails.
+- Fully open source: both the server and client code (browser extension, JS library) are open source so anyone can freely inspect and (hopefully) improve the code.
+- Not just email alias: SimpleLogin is a privacy-first and developer-friendly identity provider that:
+    - offers privacy for users
+    - is simple to use for developers. SimpleLogin is a privacy-focused alternative to the "Login with Facebook/Google/Twitter" buttons.
+    
+- The only email forwarding solution that is **self-hostable**: with our detailed self-hosting instructions and most of components running as Docker container, anyone who knows `ssh` is able to deploy SimpleLogin on their server.
+- Plenty of features: browser extension, custom domain, catch-all alias, OAuth libraries, etc.
+- Open roadmap at https://trello.com/b/4d6A69I4/open-roadmap: you know the exciting features we are working on.
+
+At the heart of SimpleLogin is `email alias`: an alias is a normal email address but all emails sent to an alias are **forwarded** to your email inbox. SimpleLogin alias can also **send** emails: for your contact, the alias is therefore your email address. Use alias whenever you need to give out your email address to protect your online identity. More info on our website at https://simplelogin.io
+
+<p align="center">
+    <img src="./docs/custom-alias.png" height="150px">
+</p>
+
+# Quick start
+
+If you have Docker installed, run the following command to start SimpleLogin local server:
+
+
+```bash
+docker run -it --rm \
+    -e RESET_DB=true \
+    -e CONFIG=/code/.env.example \
+    -p 7777:7777 \
+    simplelogin/app python server.py
+```
+
+Then open http://localhost:7777, you should be able to login with `john@wick.com/password` account!
+
+To use SimpleLogin aliases, you need to deploy it on your server with some DNS setup though,
+the following section will show a step-by-step guide on how to get your own email forwarder service!

 # Table of Contents

@ -24,13 +77,15 @@ In some way yes... However, SimpleLogin is a bit different because:

 ## General Architecture

-![](docs/archi.png)
+<p align="center">
+    <img src="./docs/archi.png" height="450px">
+</p>

-SimpleLogin backend consists of 2 main components: 
+SimpleLogin backend consists of 2 main components:

 - the `webapp` used by several clients: web UI (the dashboard), browser extension (Chrome & Firefox for now), OAuth clients (apps that integrate "Login with SimpleLogin" button) and mobile app (work in progress).

- the `email handler`: implements the email forwarding (i.e. alias receiving email) and email sending (i.e. alias sending email). 
+- the `email handler`: implements the email forwarding (i.e. alias receiving email) and email sending (i.e. alias sending email).

 ## Self hosting

@ -40,11 +95,10 @@ SimpleLogin backend consists of 2 main components:

 - a domain that you can config the DNS. It could be a sub-domain. In the rest of the doc, let's say it's `mydomain.com` for the email and `app.mydomain.com` for SimpleLogin webapp. Please make sure to replace these values by your domain name whenever they appear in the doc.

- [Optional]: a dedicated Postgres database. If you don't want to manage and maintain a Postgres database, you can use managed services proposed by some cloud providers. Otherwise this guide will show how to run a Postgres database using Docker. Database is not well-known to be run inside Docker but this is probably fine if you don't have thousands of email addresses.
-
 - [Optional] AWS S3, Sentry, Google/Facebook/Github developer accounts. These are necessary only if you want to activate these options.

-All the below steps, except for the DNS ones that are usually done inside your domain registrar interface, are done on your server. The commands are to run with `bash` (or any bash-compatible shell like `zsh`) being the shell. If you use other shells like `fish`, please make sure to adapt the commands.
+
+Except for the DNS setup that is usually done on your domain registrar interface, all the below steps are to be done on your server. The commands are to run with `bash` (or any bash-compatible shell like `zsh`) being the shell. If you use other shells like `fish`, please make sure to adapt the commands.

 ### DKIM

@ -72,7 +126,7 @@ Please note that DNS changes could take up to 24 hours to propagate. In practice
 #### MX record
 Create a **MX record** that points `mydomain.com` to `app.mydomain.com` with priority 10.

-To verify if the DNS works, `dig mydomain.com mx` should contain the following in the result. 
+To verify if the DNS works, `dig mydomain.com mx` should contain the following in the result.

 ```
 mydomain.com.	3600	IN	MX	10 app.mydomain.com.
@ -92,7 +146,7 @@ with `PUBLIC_KEY` being your `dkim.pub.key` but
 - remove the `-----BEGIN PUBLIC KEY-----` and `-----END PUBLIC KEY-----`
 - join all the lines on a single line.

-For example, if your `dkim.pub.key` is 
+For example, if your `dkim.pub.key` is

 ```
 -----BEGIN PUBLIC KEY-----
@ -113,16 +167,14 @@ From Wikipedia https://en.wikipedia.org/wiki/Sender_Policy_Framework

 > Sender Policy Framework (SPF) is an email authentication method designed to detect forging sender addresses during the delivery of the email

-Similar to DKIM, setting up SPF is highly recommended. 
+Similar to DKIM, setting up SPF is highly recommended.
 Add a TXT record for `mydomain.com` with the value `v=spf1 mx -all`. What it means is only your server can send email with `@mydomain.com` domain. To verify, you can use `dig mydomain.com txt`

-#### DMARC (optional) TODO
-
 ### Docker

 Now the boring DNS stuffs are done, let's do something more fun!

-Please follow the steps on [Docker CE for Ubuntu](https://docs.docker.com/v17.12/install/linux/docker-ce/ubuntu/) to install Docker on the server. 
+If you don't already have Docker installed on your server, please follow the steps on [Docker CE for Ubuntu](https://docs.docker.com/v17.12/install/linux/docker-ce/ubuntu/) to install Docker.

 Tips: if you want to run Docker without the `sudo` prefix, add your account to `docker` group:

@ -144,7 +196,7 @@ docker network create -d bridge \

 ### Postgres

-This section shows how to run a Postgres database using Docker. At the end of this section, you will have a database username and password which are being referred to the next steps.
+This section shows how to run a Postgres database using Docker. At the end of this section, you will have a database username and password which will be used in the next steps.

 If you have already had a Postgres database in use, you can skip this section and just copy the database configuration (i.e. host, port, username, password, database name).

@ -176,7 +228,7 @@ Install `postfix` and `postfix-pgsql`. The latter is used to connect Postfix and
 sudo apt-get install -y postfix postfix-pgsql
 ```

-Choose "Internet Site" in Postfix installation window then keep using the proposed value as *System mail name* in the next window. 
+Choose "Internet Site" in Postfix installation window then keep using the proposed value as *System mail name* in the next window.

 Run the following commands to setup Postfix. Make sure to replace `mydomain.com` with the appropriate value of your domain.

@ -224,7 +276,7 @@ Finally, restart Postfix

 ### Run SimpleLogin Docker containers

-To run the server, you need a config file. Please have a look at [config example](./.env.example) for an example to create one. Some parameters are optional and are commented out by default. Some have "dummy" values, fill them up if you want to enable these features (Paddle, AWS). 
+To run the server, you need a config file. Please have a look at [config example](./.env.example) for an example to create one. Some parameters are optional and are commented out by default. Some have "dummy" values, fill them up if you want to enable these features (Paddle, AWS, etc).

 Let's put your config file at `~/simplelogin.env`.

@ -239,9 +291,6 @@ EMAIL_SERVERS_WITH_PRIORITY=[(10, "app.mydomain.com.")]
 DKIM_PRIVATE_KEY_PATH=/dkim.key
 DKIM_PUBLIC_KEY_PATH=/dkim.pub.key
 DB_URI=postgresql://myuser:mypassword@sl-db:5432/simplelogin
-
-# optional, to have more choices for random alias.
-WORDS_FILE_PATH=local_data/words_alpha.txt
 ```


@ -327,11 +376,11 @@ At this step, you should also setup the SSL for Nginx. [Certbot](https://certbot

 ### Enjoy!

-If all of the above steps are successful, open http://app.mydomain.com/ and create your first account! 
+If all of the above steps are successful, open http://app.mydomain.com/ and create your first account!

 ## Contributing

-All work on SimpleLogin happens directly on GitHub. 
+All work on SimpleLogin happens directly on GitHub.

 ### Run code locally

@ -372,56 +421,120 @@ john@wick.com / password

 ### API

-For now the only API client is the Chrome/Firefox extension. This extension relies on `API Code` for authentication. 
+For now the only API client is the Chrome/Firefox extension. This extension relies on `API Code` for authentication.

 In every request, the extension sends

 - the `API Code` is set in `Authentication` header. The check is done via the `verify_api_key` wrapper, implemented in `app/api/base.py`

- the current website `hostname` which is the website subdomain name + domain name. For ex, if user is on `http://dashboard.example.com/path1/path2?query`, the subdomain is `dashboard.example.com`. This information is important to know where an alias is used in order to proposer to user the same alias if they want to create on alias on the same website in the future. The `hostname` is passed in the request query `?hostname=`, see `app/api/views/alias_options.py` for an example.
+- (Optional but recommended) `hostname` passed in query string. hostname is the the URL hostname (cf https://en.wikipedia.org/wiki/URL), for ex if URL is http://www.example.com/index.html then the hostname is `www.example.com`. This information is important to know where an alias is used in order to suggest user the same alias if they want to create on alias on the same website in the future. 

-Currently, the latest extension uses the two following endpoints :
+If error, the API returns 4** with body containing the error message, for example:

- `/alias/options`: returns what to suggest to user when they open the extension. 
-
-```
-GET /alias/options hostname?="www.groupon.com"
-
-Response: a json with following structure. ? means optional field.
-	recommendation?:
-		alias: www_groupon_com@simplelogin.co
-		hostname: www.groupon.com
-
-	custom: 
-		suggestion: groupon
-		suffix: [@my_domain.com, .abcde@simplelogin.co]
-
-	can_create_custom: true
-
-	existing:
-		[email1, email2, ...]
+```json
+{
+  "error":  "request body cannot be empty"
+}
 ```

- `/alias/custom/new`: allows user to create a new custom alias.
+The error message could be displayed to user as-is, for example for when user exceeds their alias quota. 
+Some errors should be fixed during development however: for example error like `request body cannot be empty` is there to catch development error and should never be shown to user. 
+ 
+All following endpoint return `401` status code if the API Key is incorrect.

-To try out the endpoint, you can use the following command. The command uses [httpie](https://httpie.org). 
-Make sure to replace `{api_key}` by your API Key obtained on https://app.simplelogin.io/dashboard/api_key
+#### GET /api/user_info

-```
-http https://app.simplelogin.io/api/alias/options \
-    Authentication:{api_key} \
-    hostname==www.google.com
+Given the API Key, return user name and whether user is premium. 
+This endpoint could be used to validate the api key.
+
+Input:
+- `Authentication` header that contains the api key
+
+Output: if api key is correct, return a json with user name and whether user is premium, for example:
+
+```json
+{
+	"name": "John Wick",
+	"is_premium": false
+}
 ```

+If api key is incorrect, return 401.
+
+
+#### GET /api/v2/alias/options
+
+User alias info and suggestion. Used by the first extension screen when user opens the extension.
+
+Input:
+- `Authentication` header that contains the api key
+- (Optional but recommended) `hostname` passed in query string. 
+
+Output: a json with the following field:
+- can_create: boolean. Whether user can create new alias
+- suffixes: list of string. List of alias `suffix` that user can use. If user doesn't have custom domain, this list has a single element which is the alias default domain (simplelogin.co).
+- prefix_suggestion: string. Suggestion for the `alias prefix`. Usually this is the website name extracted from `hostname`. If no `hostname`, then the `prefix_suggestion` is empty.
+- existing: list of string. List of existing alias.
+- recommendation: optional field, dictionary. If an alias is already used for this website, the recommendation will be returned. There are 2 subfields in `recommendation`: `alias` which is the recommended alias and `hostname` is the website on which this alias is used before.
+
+For ex:
+```json
+{
+    "can_create": true,
+    "existing": [
+        "my-first-alias.meo@sl.local",
+        "e1.cat@sl.local",
+        "e2.chat@sl.local",
+        "e3.cat@sl.local"
+    ],
+    "prefix_suggestion": "test",
+    "recommendation": {
+        "alias": "e1.cat@sl.local",
+        "hostname": "www.test.com"
+    },
+    "suffixes": [
+        "@very-long-domain.com.net.org",
+        "@ab.cd",
+        ".cat@sl.local"
+    ]
+}
 ```
-POST /alias/custom/new
-	prefix: www_groupon_com
-	suffix: @my_domain.com

-Response:
-	201 -> OK {alias: "www_groupon_com@my_domain.com"}
-	409 -> duplicated
+#### POST /api/alias/custom/new

+Create a new custom alias.
+
+Input: 
+- `Authentication` header that contains the api key
+- (Optional but recommended) `hostname` passed in query string
+- Request Message Body in json (`Content-Type` is `application/json`)
+    - alias_prefix: string. The first part of the alias that user can choose.
+    - alias_suffix: should be one of the suffixes returned in the `GET /api/v2/alias/options` endpoint.
+
+Output:
+If success, 201 with the new alias, for example 
+
+```json
+{
+  "alias": "www_groupon_com@my_domain.com"
+}
+```
+
+#### POST /api/alias/random/new
+
+Create a new random alias.
+
+Input: 
+- `Authentication` header that contains the api key
+- (Optional but recommended) `hostname` passed in query string
+
+Output:
+If success, 201 with the new alias, for example 
+
+```json
+{
+  "alias": "www_groupon_com@my_domain.com"
+}
 ```

 ### Database migration
@ -430,7 +543,7 @@ The database migration is handled by `alembic`

 Whenever the model changes, a new migration has to be created

-Set the database connection to use a current database (i.e. the one without the model changes you just made), for example, if you have a staging config at `~/config/simplelogin/staging.env`, you can do: 
+Set the database connection to use a current database (i.e. the one without the model changes you just made), for example, if you have a staging config at `~/config/simplelogin/staging.env`, you can do:

 ```bash
 ln -sf ~/config/simplelogin/staging.env .env
@ -448,16 +561,16 @@ In local the database creation in Sqlite doesn't use migration and uses directly

 The repo consists of the three following entry points:

- wsgi.py and server.py: the webapp. 
- email_handler.py: the email handler. 
- cron.py: the cronjob. 
+- wsgi.py and server.py: the webapp.
+- email_handler.py: the email handler.
+- cron.py: the cronjob.

 Here are the small sum-ups of the directory structures and their roles:

 - app/: main Flask app. It is structured into different packages representing different features like oauth,  api, dashboard, etc.
 - local_data/: contains files to facilitate the local development. They are replaced during the deployment.
 - migrations/: generated by flask-migrate. Edit these files will be only edited when you spot (very rare) errors on the database migration files.
- static/: files available at `/static` url. 
+- static/: files available at `/static` url.
 - templates/: contains both html and email templates.
 - tests/: tests. We don't really distinguish unit, functional or integration test. A test is simply here to make sure a feature works correctly.

@ -473,7 +586,7 @@ SL currently supports code and implicit flow.

 #### Code flow

-To trigger the code flow locally, you can go to the following url after running `python server.py`:  
+To trigger the code flow locally, you can go to the following url after running `python server.py`:

 ```
 http://localhost:7777/oauth/authorize?client_id=client-id&state=123456&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A7000%2Fcallback&state=random_string
@ -495,8 +608,8 @@ http http://localhost:7777/oauth/user_info 'Authorization:Bearer {token}'

 #### Implicit flow

-Similar to code flow, except for the the `access token` which we we get back with the redirection. 
-For implicit flow, the url is 
+Similar to code flow, except for the the `access token` which we we get back with the redirection.
+For implicit flow, the url is

 ```
 http://localhost:7777/oauth/authorize?client_id=client-id&state=123456&response_type=token&redirect_uri=http%3A%2F%2Flocalhost%3A7000%2Fcallback&state=random_string
@ -533,6 +646,16 @@ response_type=id_token code
 ```


+## ❤️ Contributors

+Thanks go to these wonderful people:

-
+<table>
+  <tr>
+    <td align="center"><a href="https://www.linkedin.com/in/vandungnguyen/"><img src="https://simplelogin.io/about/dung.jpg" width="100px;" alt="Dung Nguyen Van"/><br /><sub><b>Dung Nguyen Van</b></sub></a><br /></td>
+    <td align="center"><a href="https://www.linkedin.com/in/giuseppe-f-83449ba4/"><img src="https://simplelogin.io/about/giuseppe.jpeg" width="100px;" alt="Giuseppe Federico"/><br /><sub><b>Giuseppe Federico</b></sub></a><br /></td>
+    <td align="center"><a href="https://github.com/NinhDinh"><img src="https://avatars2.githubusercontent.com/u/1419742?s=460&v=4" width="100px;" alt="Ninh Dinh"/><br /><sub><b>Ninh Dinh</b></sub></a><br /></td>
+    <td align="center"><a href="https://github.com/ntung"><img src="https://avatars1.githubusercontent.com/u/663341?s=460&v=4" width="100px;" alt="Tung Nguyen V. N."/><br /><sub><b>Tung Nguyen V. N.</b></sub></a><br /></td>    
+    <td align="center"><a href="https://www.linkedin.com/in/nguyenkims/"><img src="https://simplelogin.io/about/me.jpeg" width="100px;" alt="Son Nguyen Kim"/><br /><sub><b>Son Nguyen Kim</b></sub></a><br /></td>    
+</tr>
+</table>
--- a/app/api/init.py
+++ b/app/api/init.py
@ -1 +1 @@
-from .views import alias_options, new_custom_alias
+from .views import alias_options, new_custom_alias, new_random_alias, user_info
--- a/app/api/views/alias_options.py
+++ b/app/api/views/alias_options.py
@ -78,3 +78,78 @@ def options():
    ret["custom"]["suffixes"] = list(reversed(ret["custom"]["suffixes"]))

    return jsonify(ret)
+
+
+@api_bp.route("/v2/alias/options")
+@cross_origin()
+@verify_api_key
+def options_v2():
+    """
+    Return what options user has when creating new alias.
+    Input:
+        a valid api-key in "Authentication" header and
+        optional "hostname" in args
+    Output: cf README
+        can_create: bool
+        suffixes: [str]
+        prefix_suggestion: str
+        existing: [str]
+        recommendation: Optional dict
+            alias: str
+            hostname: str
+
+
+    """
+    user = g.user
+    hostname = request.args.get("hostname")
+
+    ret = {
+        "existing": [
+            ge.email for ge in GenEmail.query.filter_by(user_id=user.id, enabled=True)
+        ],
+        "can_create": user.can_create_new_alias(),
+        "suffixes": [],
+        "prefix_suggestion": "",
+    }
+
+    # recommendation alias if exist
+    if hostname:
+        # put the latest used alias first
+        q = (
+            db.session.query(AliasUsedOn, GenEmail, User)
+            .filter(
+                AliasUsedOn.gen_email_id == GenEmail.id,
+                GenEmail.user_id == user.id,
+                AliasUsedOn.hostname == hostname,
+            )
+            .order_by(desc(AliasUsedOn.created_at))
+        )
+
+        r = q.first()
+        if r:
+            _, alias, _ = r
+            LOG.d("found alias %s %s %s", alias, hostname, user)
+            ret["recommendation"] = {"alias": alias.email, "hostname": hostname}
+
+    # custom alias suggestion and suffix
+    if hostname:
+        # keep only the domain name of hostname, ignore TLD and subdomain
+        # for ex www.groupon.com -> groupon
+        domain_name = hostname
+        if "." in hostname:
+            parts = hostname.split(".")
+            domain_name = parts[-2]
+            domain_name = convert_to_id(domain_name)
+        ret["prefix_suggestion"] = domain_name
+
+    # maybe better to make sure the suffix is never used before
+    # but this is ok as there's a check when creating a new custom alias
+    ret["suffixes"] = [f".{random_word()}@{EMAIL_DOMAIN}"]
+
+    for custom_domain in user.verified_custom_domains():
+        ret["suffixes"].append("@" + custom_domain.domain)
+
+    # custom domain should be put first
+    ret["suffixes"] = list(reversed(ret["suffixes"]))
+
+    return jsonify(ret)
--- a/app/api/views/new_custom_alias.py
+++ b/app/api/views/new_custom_alias.py
@ -3,7 +3,7 @@ from flask import jsonify, request
 from flask_cors import cross_origin

 from app.api.base import api_bp, verify_api_key
-from app.config import EMAIL_DOMAIN
+from app.config import EMAIL_DOMAIN, MAX_NB_EMAIL_FREE_PLAN
 from app.extensions import db
 from app.log import LOG
 from app.models import GenEmail, AliasUsedOn
@ -31,7 +31,7 @@ def new_custom_alias():
        return (
            jsonify(
                error="You have reached the limitation of a free account with the maximum of "
-                "3 custom aliases, please upgrade your plan to create more custom aliases"
+                f"{MAX_NB_EMAIL_FREE_PLAN} aliases, please upgrade your plan to create more aliases"
            ),
            400,
        )
@ -40,8 +40,11 @@ def new_custom_alias():
    hostname = request.args.get("hostname")

    data = request.get_json()
-    alias_prefix = data["alias_prefix"]
-    alias_suffix = data["alias_suffix"]
+    if not data:
+        return jsonify(error="request body cannot be empty"), 400
+
+    alias_prefix = data.get("alias_prefix", "")
+    alias_suffix = data.get("alias_suffix", "")

    # make sure alias_prefix is not empty
    alias_prefix = alias_prefix.strip()
--- a/app/api/views/new_random_alias.py
+++ b/app/api/views/new_random_alias.py
@ -0,0 +1,43 @@
+from flask import g
+from flask import jsonify, request
+from flask_cors import cross_origin
+
+from app.api.base import api_bp, verify_api_key
+from app.config import EMAIL_DOMAIN, MAX_NB_EMAIL_FREE_PLAN
+from app.extensions import db
+from app.log import LOG
+from app.models import GenEmail, AliasUsedOn
+from app.utils import convert_to_id
+
+
+@api_bp.route("/alias/random/new", methods=["POST"])
+@cross_origin()
+@verify_api_key
+def new_random_alias():
+    """
+    Create a new random alias
+    Output:
+        201 if success
+
+    """
+    user = g.user
+    if not user.can_create_new_alias():
+        LOG.d("user %s cannot create new random alias", user)
+        return (
+            jsonify(
+                error=f"You have reached the limitation of a free account with the maximum of "
+                f"{MAX_NB_EMAIL_FREE_PLAN} aliases, please upgrade your plan to create more aliases"
+            ),
+            400,
+        )
+
+    scheme = user.alias_generator
+    gen_email = GenEmail.create_new_random(user_id=user.id, scheme=scheme)
+    db.session.commit()
+
+    hostname = request.args.get("hostname")
+    if hostname:
+        AliasUsedOn.create(gen_email_id=gen_email.id, hostname=hostname)
+        db.session.commit()
+
+    return jsonify(alias=gen_email.email), 201
--- a/app/api/views/user_info.py
+++ b/app/api/views/user_info.py
@ -0,0 +1,22 @@
+from flask import jsonify, request, g
+from flask_cors import cross_origin
+from sqlalchemy import desc
+
+from app.api.base import api_bp, verify_api_key
+from app.config import EMAIL_DOMAIN
+from app.extensions import db
+from app.log import LOG
+from app.models import AliasUsedOn, GenEmail, User
+from app.utils import convert_to_id, random_word
+
+
+@api_bp.route("/user_info")
+@cross_origin()
+@verify_api_key
+def user_info():
+    """
+    Return user info given the api-key
+    """
+    user = g.user
+
+    return jsonify({"name": user.name, "is_premium": user.is_premium()})
--- a/app/auth/templates/auth/login.html
+++ b/app/auth/templates/auth/login.html
@ -39,32 +39,26 @@
            <div class="form-group">
              <label class="form-label">
                Password
-                <a href="{{ url_for('auth.forgot_password') }}" class="float-right small">
-                  I forgot my password
-                </a>
              </label>
              {{ form.password(class="form-control", type="password") }}
              {{ render_field_errors(form.password) }}
+              <div class="text-muted">
+                <a href="{{ url_for('auth.forgot_password') }}" class="small">
+                  I forgot my password
+                </a>
+              </div>
            </div>

-            <!-- TODO: add remember me
-            <div class="form-group">
-              <label class="custom-control custom-checkbox">
-                <input type="checkbox" class="custom-control-input"/>
-                <span class="custom-control-label">Remember me</span>
-              </label>
-            </div>
-            -->
-
            <div class="form-footer">
              <button type="submit" class="btn btn-primary btn-block">Log in</button>
            </div>
+
+            <div class="text-center text-muted mt-2">
+              Don't have an account yet? <a href="{{ url_for('auth.register') }}">Sign up</a>
+            </div>
+
          </div>
        </form>
-
-        <div class="text-center text-muted mb-6">
-          Don't have an account yet? <a href="{{ url_for('auth.register') }}">Sign up</a>
-        </div>
      </div>
    </div>

--- a/app/auth/templates/auth/mfa.html
+++ b/app/auth/templates/auth/mfa.html
@ -23,7 +23,7 @@
        Authy) here
      </div>

-      {{ otp_token_form.token(class="form-control", placeholder="") }}
+      {{ otp_token_form.token(class="form-control", autofocus="true") }}
      {{ render_field_errors(otp_token_form.token) }}
      <button class="btn btn-success mt-2">Validate</button>
    </form>
--- a/app/auth/views/facebook.py
+++ b/app/auth/views/facebook.py
@ -103,7 +103,9 @@ def facebook_callback():
    # create user
    else:
        LOG.d("create facebook user with %s", facebook_user_data)
-        user = User.create(email=email, name=facebook_user_data["name"], activated=True)
+        user = User.create(
+            email=email.lower(), name=facebook_user_data["name"], activated=True
+        )

        if picture_url:
            LOG.d("set user profile picture to %s", picture_url)
--- a/app/auth/views/github.py
+++ b/app/auth/views/github.py
@ -86,7 +86,7 @@ def github_callback():
    if not user:
        LOG.d("create github user")
        user = User.create(
-            email=email, name=github_user_data.get("name") or "", activated=True
+            email=email.lower(), name=github_user_data.get("name") or "", activated=True
        )
        db.session.commit()
        login_user(user)
--- a/app/auth/views/google.py
+++ b/app/auth/views/google.py
@ -93,7 +93,9 @@ def google_callback():
    # create user
    else:
        LOG.d("create google user with %s", google_user_data)
-        user = User.create(email=email, name=google_user_data["name"], activated=True)
+        user = User.create(
+            email=email.lower(), name=google_user_data["name"], activated=True
+        )

        if picture_url:
            LOG.d("set user profile picture to %s", picture_url)
--- a/app/auth/views/mfa.py
+++ b/app/auth/views/mfa.py
@ -17,11 +17,18 @@ class OtpTokenForm(FlaskForm):
@auth_bp.route("/mfa", methods=["GET", "POST"])
 def mfa():
    # passed from login page
-    user_id = session[MFA_USER_ID]
+    user_id = session.get(MFA_USER_ID)
+
+    # user access this page directly without passing by login page
+    if not user_id:
+        flash("Unknown error, redirect back to main page", "warning")
+        return redirect(url_for("auth.login"))
+
    user = User.get(user_id)

-    if not user.enable_otp:
-        raise Exception("Only user with MFA enabled should go to this page. %s", user)
+    if not (user and user.enable_otp):
+        flash("Only user with MFA enabled should go to this page", "warning")
+        return redirect(url_for("auth.login"))

    otp_token_form = OtpTokenForm()
    next_url = request.args.get("next")
--- a/app/auth/views/register.py
+++ b/app/auth/views/register.py
@ -46,7 +46,9 @@ def register():
        else:
            LOG.debug("create user %s", form.email.data)
            user = User.create(
-                email=form.email.data, name=form.name.data, password=form.password.data
+                email=form.email.data.lower(),
+                name=form.name.data,
+                password=form.password.data,
            )
            db.session.commit()

--- a/app/config.py
+++ b/app/config.py
@ -30,6 +30,8 @@ COLOR_LOG = "COLOR_LOG" in os.environ
 # Allow user to have 1 year of premium: set the expiration_date to 1 year more
 PROMO_CODE = "SIMPLEISBETTER"

+# Debug mode
+DEBUG = os.environ["DEBUG"] if "DEBUG" in os.environ else False
 # Server url
 URL = os.environ["URL"]
 print(">>> URL:", URL)
@ -125,3 +127,6 @@ AVATAR_URL_EXPIRATION = 3600 * 24 * 7  # 1h*24h/d*7d=1week
 # session key
 HIGHLIGHT_GEN_EMAIL_ID = "highlight_gen_email_id"
 MFA_USER_ID = "mfa_user_id"
+
+FLASK_PROFILER_PATH = os.environ.get("FLASK_PROFILER_PATH")
+FLASK_PROFILER_PASSWORD = os.environ.get("FLASK_PROFILER_PASSWORD")
--- a/app/dashboard/init.py
+++ b/app/dashboard/init.py
@ -12,4 +12,5 @@ from .views import (
    mfa_setup,
    mfa_cancel,
    domain_detail,
+    lifetime_licence,
 )
--- a/app/dashboard/templates/dashboard/alias_contact_manager.html
+++ b/app/dashboard/templates/dashboard/alias_contact_manager.html
@ -15,8 +15,9 @@

  <div class="alert alert-primary" role="alert">
    <p>
-      To send an email from your alias, just send the email to a special email address that we call <em>reverse-alias</em>
-      and SimpleLogin will send it from the alias.
+      To send an email from your alias, just send the email to a special email address that we call
+      <em>reverse-alias</em>
+      and SimpleLogin will send it from the alias to the destination.
    </p>
    <p>
      Make sure you send the email from your personal email address ({{ current_user.email }}).
@ -37,23 +38,25 @@

  <div class="row">
    {% for forward_email in forward_emails %}
-      <div class="col-6">
+      <div class="col-md-6">
        <div class="my-2 p-2 card {% if forward_email.id == forward_email_id %} highlight-row {% endif %}">
          <div>
            <span>
              <a href="{{ 'mailto:' + forward_email.website_send_to() }}"
-                 class="font-weight-bold">*****</a>
+                 data-toggle="tooltip"
+                 title="You can click on this to open your email client. Or use the copy button 👉"
+                 class="font-weight-bold">*************************</a>

              <span class="clipboard btn btn-sm btn-success copy-btn" data-toggle="tooltip"
-                  title="Copy to clipboard"
-                  data-clipboard-text="{{ forward_email.website_send_to() }}">
+                    title="Copy to clipboard"
+                    data-clipboard-text="{{ forward_email.website_send_to() }}">
                Copy reverse-alias
              </span>
            </span>
          </div>

          <div>
-            → {{ forward_email.website_from or forward_email.website_email }}
+            <i class="fe fe-mail"></i> ➡ {{ forward_email.website_from or forward_email.website_email }}
          </div>

          <div class="mb-2 text-muted small-text">
--- a/app/dashboard/templates/dashboard/alias_log.html
+++ b/app/dashboard/templates/dashboard/alias_log.html
@ -1,22 +1,113 @@
 {% extends 'default.html' %}

 {% set active_page = "dashboard" %}
+{% block head %}
+  <style>
+{#  https://bootsnipp.com/snippets/rljEW#}
+.card-counter{
+    box-shadow: 2px 2px 10px #DADADA;
+    margin: 5px;
+    padding: 20px 10px;
+    background-color: #fff;
+    height: 100px;
+    border-radius: 5px;
+    transition: .3s linear all;
+  }

+  .card-counter:hover{
+    box-shadow: 4px 4px 20px #DADADA;
+    transition: .3s linear all;
+  }
+
+  .card-counter.primary{
+    background-color: #007bff;
+    color: #FFF;
+  }
+
+  .card-counter.danger{
+    background-color: #ef5350;
+    color: #FFF;
+  }
+
+  .card-counter.success{
+    background-color: #66bb6a;
+    color: #FFF;
+  }
+
+  .card-counter.info{
+    background-color: #26c6da;
+    color: #FFF;
+  }
+
+  .card-counter i{
+    font-size: 5em;
+    opacity: 0.2;
+  }
+
+  .card-counter .count-numbers{
+    position: absolute;
+    right: 35px;
+    top: 20px;
+    font-size: 32px;
+    display: block;
+  }
+
+  .card-counter .count-name{
+    position: absolute;
+    right: 35px;
+    top: 65px;
+    text-transform: capitalize;
+    opacity: 0.5;
+    display: block;
+    font-size: 18px;
+  }
+  </style>
+{% endblock %}
 {% block title %}
  Alias Activity
 {% endblock %}

 {% block default_content %}
-  <div class="page-header row">
+  <div class="page-header row ml-0">
    <h3 class="page-title col">
      {{ alias }}
    </h3>
  </div>
-
+    <div class="row">
+        <div class="col-3">
+            <div class="card-counter primary">
+                <i class="fa fa-at"></i>
+                <span class="count-numbers">{{ total }}</span>
+                <span class="count-name">Email Handled</span>
+            </div>
+        </div>
+        <div class="col-3">
+            <div class="card-counter primary">
+                <i class="fa fa-paper-plane"></i>
+                <span class="count-numbers">{{ email_forwarded }}</span>
+                <span class="count-name">Email Forwarded</span>
+            </div>
+        </div>
+        <div class="col-3">
+            <div class="card-counter primary">
+                <i class="fa fa-reply"></i>
+                <span class="count-numbers">{{ email_replied }}</span>
+                <span class="count-name">Email Replied</span>
+            </div>
+        </div>
+        <div class="col-3">
+             <div class="card-counter danger">
+                <i class="fa fa-ban"></i>
+                <span class="count-numbers">{{ email_blocked }}</span>
+            <span class="count-name">Email Blocked</span>
+            </div>
+        </div>
+    </div>
+    <h2 class="pt-4">Activities</h2>
  <div class="row">
    {% for log in logs %}
      <div class="col-12">
-        <div class="my-2 p-2 card">
+        <div class="my-2 p-2 card border-light">
          <div class="font-weight-bold">{{ log.when | dt }}</div>
          <div>
            <span class="mr-2">{{ log.website_from or log.website_email }}</span>
@ -40,6 +131,12 @@
    {% endfor %}
  </div>

+  <nav aria-label="Alias log navigation">
+    <ul class="pagination">
+      <li class="page-item {% if page_id == 0 %}disabled{% endif %}"><a class="page-link" href="{{ url_for('dashboard.alias_log', alias=alias, page_id=page_id-1) }}">Previous</a></li>
+      <li class="page-item {% if last_page %}disabled{% endif %}"><a class="page-link" href="{{ url_for('dashboard.alias_log', alias=alias, page_id=page_id+1) }}">Next</a></li>
+    </ul>
+  </nav>
 {% endblock %}

 {% block script %}
--- a/app/dashboard/templates/dashboard/custom_domain.html
+++ b/app/dashboard/templates/dashboard/custom_domain.html
@ -21,7 +21,11 @@
              {% if custom_domain.verified %}
                <span class="cursor" data-toggle="tooltip" data-original-title="Domain Verified">✅</span>
              {% else %}
-                <span class="cursor" data-toggle="tooltip" data-original-title="Domain Not Verified">🚫 </span>
+                <span class="cursor" data-toggle="tooltip" data-original-title="DNS Setup Needed">
+                  <a href="{{ url_for('dashboard.domain_detail_dns', custom_domain_id=custom_domain.id) }}"
+                     class="text-decoration-none">🚫
+                  </a>
+                </span>
              {% endif %}
            </h5>
            <h6 class="card-subtitle mb-2 text-muted">
--- a/app/dashboard/templates/dashboard/domain_detail/dns.html
+++ b/app/dashboard/templates/dashboard/domain_detail/dns.html
@ -17,7 +17,7 @@
      minute or in our experience).
    </div>

-    <div>
+    <div id="mx-form">
      <div class="font-weight-bold">1. MX record

        {% if custom_domain.verified %}
@ -27,19 +27,20 @@
        {% endif %}
      </div>

-      <div class="mb-2">Add the following MX DNS record to your domain.
-        Please note that there's a point (<em>.</em>) at the end of target addresses.
+      <div class="mb-2">Add the following MX DNS record to your domain. <br>
+        Please note that there's a point (<em>.</em>) at the end target addresses. <br>
+        Also some domain registrars (Namecheap, CloudFlare, etc) might use <em>@</em> for the root domain.
      </div>

      {% for priority, email_server in EMAIL_SERVERS_WITH_PRIORITY %}
        <div class="mb-3 p-3" style="background-color: #eee">
-          Domain: <em>{{ custom_domain.domain }}</em> <br>
-          Priority: {{priority}} <br>
+          Domain: <em>{{ custom_domain.domain }}</em> or <em>@</em> <br>
+          Priority: {{ priority }} <br>
          Target: <em>{{ email_server }}</em> <br>
        </div>
      {% endfor %}

-      <form method="post">
+      <form method="post" action="#mx-form">
        <input type="hidden" name="form-name" value="check-mx">
        {% if custom_domain.verified %}
          <button type="submit" class="btn btn-outline-primary">
@ -56,6 +57,9 @@
        <div class="text-danger mt-4">
          Your DNS is not correctly set. The MX record we obtain is:
          <div class="mb-3 p-3" style="background-color: #eee">
+            {% if not mx_errors %}
+              (Empty)
+            {% endif %}
            {% for r in mx_errors %}
              {{ r }} <br>
            {% endfor %}
@ -69,7 +73,7 @@

    <hr>

-    <div>
+    <div id="spf-form">
      <div class="font-weight-bold">2. SPF (Optional)
        {% if custom_domain.spf_verified %}
          <span class="cursor" data-toggle="tooltip" data-original-title="SPF Verified">✅</span>
@ -88,14 +92,14 @@
      <div class="mb-2">Add the following TXT DNS record to your domain</div>

      <div class="mb-2 p-3" style="background-color: #eee">
-        Domain: <em>{{ custom_domain.domain }}</em> <br>
+        Domain: <em>{{ custom_domain.domain }}</em> or <em>@</em> <br>
        Value:
        <em>
          {{ spf_record }}
        </em>
      </div>

-      <form method="post">
+      <form method="post" action="#spf-form">
        <input type="hidden" name="form-name" value="check-spf">
        {% if custom_domain.spf_verified %}
          <button type="submit" class="btn btn-outline-primary">
@ -112,6 +116,10 @@
        <div class="text-danger mt-4">
          Your DNS is not correctly set. The TXT record we obtain is:
          <div class="mb-3 p-3" style="background-color: #eee">
+            {% if not spf_errors %}
+              (Empty)
+            {% endif %}
+
            {% for r in spf_errors %}
              {{ r }} <br>
            {% endfor %}
@ -125,7 +133,7 @@

    <hr>

-    <div>
+    <div id="dkim-form">
      <div class="font-weight-bold">3. DKIM (Optional)
        {% if custom_domain.dkim_verified %}
          <span class="cursor" data-toggle="tooltip" data-original-title="SPF Verified">✅</span>
@ -152,7 +160,7 @@
        </em>
      </div>

-      <form method="post">
+      <form method="post" action="#dkim-form">
        <input type="hidden" name="form-name" value="check-dkim">
        {% if custom_domain.dkim_verified %}
          <button type="submit" class="btn btn-outline-primary">
--- a/app/dashboard/templates/dashboard/domain_detail/info.html
+++ b/app/dashboard/templates/dashboard/domain_detail/info.html
@ -11,7 +11,11 @@
    {% if custom_domain.verified %}
      <span class="cursor" data-toggle="tooltip" data-original-title="DNS Setup OK">✅</span>
    {% else %}
-      <span class="cursor" data-toggle="tooltip" data-original-title="DNS Setup Needed">🚫 </span>
+      <span class="cursor" data-toggle="tooltip" data-original-title="DNS Setup Needed">
+        <a href="{{ url_for('dashboard.domain_detail_dns', custom_domain_id=custom_domain.id) }}"
+           class="text-decoration-none">🚫
+        </a>
+      </span>
    {% endif %}
  </h1>

--- a/app/dashboard/templates/dashboard/lifetime_licence.html
+++ b/app/dashboard/templates/dashboard/lifetime_licence.html
@ -0,0 +1,29 @@
+{% extends 'default.html' %}
+
+{% set active_page = "dashboard" %}
+
+{% block title %}
+  Lifetime Licence
+{% endblock %}
+
+{% block default_content %}
+  <div class="bg-white p-6" style="max-width: 60em; margin: auto">
+    <h1 class="h2">Lifetime Licence</h1>
+
+    <div class="mb-4">
+      If you have a lifetime licence, please paste it here. <br>
+      For information, we offer free premium account for education (student, professor or technical staff working at
+      an educational institute). <br>
+      Drop us an email at <a href="mailto:hi@simplelogin.io">hi@simplelogin.io</a> with your student ID or certificate to get the lifetime licence.
+    </div>
+
+    <form method="post">
+      {{ coupon_form.csrf_token }}
+
+      {{ coupon_form.code(class="form-control", placeholder="Licence Code") }}
+      {{ render_field_errors(coupon_form.code) }}
+      <button class="btn btn-success mt-2">Apply</button>
+    </form>
+  </div>
+
+{% endblock %}
--- a/app/dashboard/templates/dashboard/mfa_cancel.html
+++ b/app/dashboard/templates/dashboard/mfa_cancel.html
@ -18,7 +18,7 @@
      <div class="font-weight-bold mt-5">Token</div>
      <div class="small-text">The 6-digit number displayed on your phone.</div>

-      {{ otp_token_form.token(class="form-control", placeholder="") }}
+      {{ otp_token_form.token(class="form-control", autofocus="true") }}
      {{ render_field_errors(otp_token_form.token) }}
      <button class="btn btn-lg btn-danger mt-2">Cancel MFA</button>
    </form>
--- a/app/dashboard/templates/dashboard/pricing.html
+++ b/app/dashboard/templates/dashboard/pricing.html
@ -21,6 +21,9 @@
            <li><i class="fe fe-check text-success mr-2" aria-hidden="true"></i>
              Custom Domain
            </li>
+            <li><i class="fe fe-check text-success mr-2" aria-hidden="true"></i>
+              Catch-all (or wildcard) alias
+            </li>
            <li><i class="fe fe-check text-success mr-2" aria-hidden="true"></i>
              Directory (or Username)
              <span class="badge badge-info">Coming Soon</span>
@ -35,23 +38,31 @@
    </div>

    <div class="col-sm-6 col-lg-6">
-      <div class="display-6 mt-3">
+      <div class="display-6 my-3">
        🔐 Secure payments by
-        <a href="https://paddle.com">Paddle<i class="fe fe-external-link"></i></a></li>
+        <a href="https://paddle.com" target="_blank">Paddle<i class="fe fe-external-link"></i></a></li>
        </a>
      </div>

-      <hr>
+      <div class="mb-3">
+        Please note that Paddle only supports bank card or PayPal. <br>
+        Send us an email at <a href="mailto:hi@simplelogin.io">hi@simplelogin.io</a> if you need other payment options
+        (e.g. IBAN transfer).
+      </div>

-      <button class="btn btn-success btn-lg" onclick="upgrade({{ PADDLE_MONTHLY_PRODUCT_ID }})">
+      <button class="btn btn-success" onclick="upgrade({{ PADDLE_MONTHLY_PRODUCT_ID }})">
        Monthly <br>
        $2.99/month
      </button>

-      <button class="btn btn-primary btn-lg" onclick="upgrade({{ PADDLE_YEARLY_PRODUCT_ID }})">
+      <button class="btn btn-primary" onclick="upgrade({{ PADDLE_YEARLY_PRODUCT_ID }})">
        Yearly <br>
        $29.99/year
      </button>
+
+      <hr class="my-6">
+      If you have a lifetime licence, please go to this page to apply your licence code.
+      <a href="{{ url_for('dashboard.lifetime_licence') }}">Lifetime Licence</a>
    </div>
  </div>

--- a/app/dashboard/templates/dashboard/setting.html
+++ b/app/dashboard/templates/dashboard/setting.html
@ -90,7 +90,7 @@

    <hr>

-    <h3 class="mb-0">Notifications</h3>
+    <h3 class="mb-0" id="notification">Notifications</h3>
    <div class="small-text mb-3">Do you want to receive our newsletter?</div>
      <form method="post">
        <input type="hidden" name="form-name" value="notification-preference">
--- a/app/dashboard/views/alias_log.py
+++ b/app/dashboard/views/alias_log.py
@ -1,5 +1,3 @@
-from dataclasses import dataclass
-
 import arrow
 from flask import render_template, flash, redirect, url_for
 from flask_login import login_required, current_user
@ -8,8 +6,9 @@ from app.dashboard.base import dashboard_bp
 from app.extensions import db
 from app.models import GenEmail, ForwardEmailLog, ForwardEmail

+_LIMIT = 15
+

-@dataclass
 class AliasLog:
    website_email: str
    website_from: str
@ -18,10 +17,15 @@ class AliasLog:
    is_reply: bool
    blocked: bool

+    def __init__(self, **kwargs):
+        for k, v in kwargs.items():
+            setattr(self, k, v)

-@dashboard_bp.route("/alias_log/<alias>", methods=["GET"])
+
+@dashboard_bp.route("/alias_log/<alias>", methods=["GET"], defaults={"page_id": 0})
+@dashboard_bp.route("/alias_log/<alias>/<int:page_id>")
@login_required
-def alias_log(alias):
+def alias_log(alias, page_id):
    gen_email = GenEmail.get_by(email=alias)

    # sanity check
@ -33,19 +37,36 @@ def alias_log(alias):
        flash("You do not have access to this page", "warning")
        return redirect(url_for("dashboard.index"))

-    return render_template(
-        "dashboard/alias_log.html", logs=get_alias_log(gen_email), alias=alias
+    logs = get_alias_log(gen_email, page_id)
+    base = (
+        db.session.query(ForwardEmail, ForwardEmailLog)
+        .filter(ForwardEmail.id == ForwardEmailLog.forward_id)
+        .filter(ForwardEmail.gen_email_id == gen_email.id)
    )
+    total = base.count()
+    email_forwarded = (
+        base.filter(ForwardEmailLog.is_reply == False)
+        .filter(ForwardEmailLog.blocked == False)
+        .count()
+    )
+    email_replied = base.filter(ForwardEmailLog.is_reply == True).count()
+    email_blocked = base.filter(ForwardEmailLog.blocked == True).count()
+    last_page = (
+        len(logs) < _LIMIT
+    )  # lightweight pagination without counting all objects
+
+    return render_template("dashboard/alias_log.html", **locals())


-def get_alias_log(gen_email: GenEmail):
+def get_alias_log(gen_email: GenEmail, page_id=0):
    logs: [AliasLog] = []

    q = (
        db.session.query(ForwardEmail, ForwardEmailLog)
        .filter(ForwardEmail.id == ForwardEmailLog.forward_id)
        .filter(ForwardEmail.gen_email_id == gen_email.id)
-        .all()
+        .limit(_LIMIT)
+        .offset(page_id * _LIMIT)
    )

    for fe, fel in q:
@ -58,7 +79,6 @@ def get_alias_log(gen_email: GenEmail):
            blocked=fel.blocked,
        )
        logs.append(al)
-
    logs = sorted(logs, key=lambda l: l.when, reverse=True)

    return logs
--- a/app/dashboard/views/billing.py
+++ b/app/dashboard/views/billing.py
@ -8,10 +8,10 @@ from app.dashboard.base import dashboard_bp
@login_required
 def billing():
    # sanity check: make sure this page is only for user who has paddle subscription
-    if not current_user.is_premium():
-        flash("This page is for paid customer only", "warning")
-        return redirect(url_for("dashboard.index"))
-
    sub = current_user.get_subscription()

+    if not sub:
+        flash("You don't have any active subscription", "warning")
+        return redirect(url_for("dashboard.index"))
+
    return render_template("dashboard/billing.html", sub=sub)
--- a/app/dashboard/views/custom_alias.py
+++ b/app/dashboard/views/custom_alias.py
@ -6,7 +6,7 @@ from app.dashboard.base import dashboard_bp
 from app.extensions import db
 from app.log import LOG
 from app.models import GenEmail, DeletedAlias, CustomDomain
-from app.utils import convert_to_id, random_word
+from app.utils import convert_to_id, random_word, word_exist


@dashboard_bp.route("/custom_alias", methods=["GET", "POST"])
@ -27,6 +27,14 @@ def custom_alias():
            email_prefix = convert_to_id(email_prefix)
            email_suffix = request.form.get("email-suffix")

+            # verify email_suffix
+            if not word_exist(email_suffix):
+                flash(
+                    "nice try :). The suffix is there so no one can take all the *nice* aliases though",
+                    "warning",
+                )
+                return redirect(url_for("dashboard.custom_alias"))
+
            if not email_prefix:
                error = "alias prefix cannot be empty"
            else:
--- a/app/dashboard/views/custom_domain.py
+++ b/app/dashboard/views/custom_domain.py
@ -31,19 +31,25 @@ def custom_domain():
    if request.method == "POST":
        if request.form.get("form-name") == "create":
            if new_custom_domain_form.validate():
-                new_custom_domain = CustomDomain.create(
-                    domain=new_custom_domain_form.domain.data, user_id=current_user.id
-                )
-                db.session.commit()
-
-                flash(f"New domain {new_custom_domain.domain} is created", "success")
-
-                return redirect(
-                    url_for(
-                        "dashboard.domain_detail_dns",
-                        custom_domain_id=new_custom_domain.id,
+                new_domain = new_custom_domain_form.domain.data
+                if CustomDomain.get_by(domain=new_domain):
+                    flash(f"{new_domain} already added", "warning")
+                else:
+                    new_custom_domain = CustomDomain.create(
+                        domain=new_domain, user_id=current_user.id
+                    )
+                    db.session.commit()
+
+                    flash(
+                        f"New domain {new_custom_domain.domain} is created", "success"
+                    )
+
+                    return redirect(
+                        url_for(
+                            "dashboard.domain_detail_dns",
+                            custom_domain_id=new_custom_domain.id,
+                        )
                    )
-                )

    return render_template(
        "dashboard/custom_domain.html",
--- a/app/dashboard/views/domain_detail.py
+++ b/app/dashboard/views/domain_detail.py
@ -34,6 +34,7 @@ def domain_detail_dns(custom_domain_id):
            mx_domains = get_mx_domains(custom_domain.domain)

            if sorted(mx_domains) != sorted(EMAIL_SERVERS_WITH_PRIORITY):
+                flash("The MX record is not correctly set", "warning")
                mx_ok = False
                # build mx_errors to show to user
                mx_errors = [
@ -63,7 +64,10 @@ def domain_detail_dns(custom_domain_id):
                    )
                )
            else:
-                flash(f"{EMAIL_DOMAIN} is not included in your SPF record.", "warning")
+                flash(
+                    f"SPF: {EMAIL_DOMAIN} is not included in your SPF record.",
+                    "warning",
+                )
                spf_ok = False
                spf_errors = get_txt_record(custom_domain.domain)

@ -81,6 +85,7 @@ def domain_detail_dns(custom_domain_id):
                    )
                )
            else:
+                flash("DKIM: the TXT record is not correctly set", "warning")
                dkim_ok = False
                dkim_errors = get_txt_record(f"dkim._domainkey.{custom_domain.domain}")

--- a/app/dashboard/views/index.py
+++ b/app/dashboard/views/index.py
@ -1,5 +1,3 @@
-from dataclasses import dataclass
-
 from flask import render_template, request, redirect, url_for, flash, session
 from flask_login import login_required, current_user
 from sqlalchemy.orm import joinedload
@ -19,7 +17,6 @@ from app.models import (
 )


-@dataclass
 class AliasInfo:
    gen_email: GenEmail
    nb_forward: int
@ -29,6 +26,10 @@ class AliasInfo:
    show_intro_test_send_email: bool = False
    highlight: bool = False

+    def __init__(self, **kwargs):
+        for k, v in kwargs.items():
+            setattr(self, k, v)
+

@dashboard_bp.route("/", methods=["GET", "POST"])
@login_required
--- a/app/dashboard/views/lifetime_licence.py
+++ b/app/dashboard/views/lifetime_licence.py
@ -0,0 +1,57 @@
+from flask import render_template, flash, redirect, url_for
+from flask_login import login_required, current_user
+from flask_wtf import FlaskForm
+from wtforms import StringField, validators
+
+from app.config import (
+    PADDLE_VENDOR_ID,
+    PADDLE_MONTHLY_PRODUCT_ID,
+    PADDLE_YEARLY_PRODUCT_ID,
+    URL,
+    ADMIN_EMAIL,
+)
+from app.dashboard.base import dashboard_bp
+from app.email_utils import send_email
+from app.extensions import db
+from app.models import LifetimeCoupon
+
+
+class CouponForm(FlaskForm):
+    code = StringField("Coupon Code", validators=[validators.DataRequired()])
+
+
+@dashboard_bp.route("/lifetime_licence", methods=["GET", "POST"])
+@login_required
+def lifetime_licence():
+    # sanity check: make sure this page is only for free user
+    if current_user.is_premium():
+        flash("You are already a premium user", "warning")
+        return redirect(url_for("dashboard.index"))
+
+    coupon_form = CouponForm()
+
+    if coupon_form.validate_on_submit():
+        code = coupon_form.code.data
+
+        coupon = LifetimeCoupon.get_by(code=code)
+
+        if coupon and coupon.nb_used > 0:
+            coupon.nb_used -= 1
+            current_user.lifetime = True
+            db.session.commit()
+
+            # notify admin
+            send_email(
+                ADMIN_EMAIL,
+                subject=f"User {current_user.id} used lifetime coupon. Coupon nb_used: {coupon.nb_used}",
+                plaintext="",
+                html="",
+            )
+
+            flash("You are upgraded to lifetime premium!", "success")
+            return redirect(url_for("dashboard.index"))
+
+        else:
+            flash(f"Code *{code}* expired or invalid", "warning")
+
+    return render_template("dashboard/lifetime_licence.html", coupon_form=coupon_form)
--- a/app/dns_utils.py
+++ b/app/dns_utils.py
@ -1,13 +1,22 @@
 import dns.resolver


+def _get_dns_resolver():
+    my_resolver = dns.resolver.Resolver()
+
+    # 8.8.8.8 is Google's public DNS server
+    my_resolver.nameservers = ["8.8.8.8"]
+
+    return my_resolver
+
+
 def get_mx_domains(hostname) -> [(int, str)]:
    """return list of (priority, domain name).
    domain name ends with a "." at the end.
    """
    try:
-        answers = dns.resolver.query(hostname, "MX")
-    except dns.resolver.NoAnswer:
+        answers = _get_dns_resolver().query(hostname, "MX")
+    except Exception:
        return []

    ret = []
@ -27,8 +36,8 @@ _include_spf = "include:"
 def get_spf_domain(hostname) -> [str]:
    """return all domains listed in *include:*"""
    try:
-        answers = dns.resolver.query(hostname, "TXT")
-    except dns.resolver.NoAnswer:
+        answers = _get_dns_resolver().query(hostname, "TXT")
+    except Exception:
        return []

    ret = []
@ -48,17 +57,14 @@ def get_spf_domain(hostname) -> [str]:

 def get_txt_record(hostname) -> [str]:
    try:
-        answers = dns.resolver.query(hostname, "TXT")
-    except dns.resolver.NoAnswer:
+        answers = _get_dns_resolver().query(hostname, "TXT")
+    except Exception:
        return []

    ret = []

    for a in answers:  # type: dns.rdtypes.ANY.TXT.TXT
-        for record in a.strings:
-            record = record.decode()  # record is bytes
-
-            ret.append(a)
+        ret.append(a)

    return ret

@ -66,8 +72,8 @@ def get_txt_record(hostname) -> [str]:
 def get_dkim_record(hostname) -> str:
    """query the dkim._domainkey.{hostname} record and returns its value"""
    try:
-        answers = dns.resolver.query(f"dkim._domainkey.{hostname}", "TXT")
-    except dns.resolver.NoAnswer:
+        answers = _get_dns_resolver().query(f"dkim._domainkey.{hostname}", "TXT")
+    except Exception:
        return ""

    ret = []
--- a/app/email_utils.py
+++ b/app/email_utils.py
@ -1,5 +1,5 @@
 import os
-from email.message import EmailMessage
+from email.message import EmailMessage, Message
 from email.utils import make_msgid, formatdate
 from smtplib import SMTP

@ -177,7 +177,7 @@ def get_email_domain_part(email):
    return email[email.find("@") + 1 :]


-def add_dkim_signature(msg: EmailMessage, email_domain: str):
+def add_dkim_signature(msg: Message, email_domain: str):
    if msg["DKIM-Signature"]:
        LOG.d("Remove DKIM-Signature %s", msg["DKIM-Signature"])
        del msg["DKIM-Signature"]
@ -197,3 +197,16 @@ def add_dkim_signature(msg: EmailMessage, email_domain: str):
    sig = sig.replace("\n", " ").replace("\r", "")

    msg.add_header("DKIM-Signature", sig[len("DKIM-Signature: ") :])
+
+
+def add_or_replace_header(msg: Message, header: str, value: str):
+    try:
+        msg.add_header(header, value)
+    except ValueError:
+        # the header exists already
+        msg.replace_header(header, value)
+
+
+def delete_header(msg: Message, header: str):
+    if msg[header]:
+        del msg[header]
--- a/app/models.py
+++ b/app/models.py
@ -119,6 +119,9 @@ class User(db.Model, ModelMixin, UserMixin):
        db.Boolean, nullable=False, default=False, server_default="0"
    )

+    # some users could have lifetime premium
+    lifetime = db.Column(db.Boolean, default=False, nullable=False, server_default="0")
+
    profile_picture = db.relationship(File)

    @classmethod
@ -143,13 +146,11 @@ class User(db.Model, ModelMixin, UserMixin):

    def is_premium(self):
        """user is premium if they have a active subscription"""
+        if self.lifetime:
+            return True
+
        sub: Subscription = self.get_subscription()
        if sub:
-            if sub.cancelled:
-                # user is premium until the next billing_date + 1
-                return sub.next_bill_date >= arrow.now().shift(days=-1).date()
-
-            # subscription active, ie not cancelled
            return True

        return False
@ -217,8 +218,18 @@ class User(db.Model, ModelMixin, UserMixin):
            return "Free Plan"

    def get_subscription(self):
+        """return *active* subscription
+        TODO: support user unsubscribe and re-subscribe
+        """
        sub = Subscription.get_by(user_id=self.id)
-        return sub
+        if sub and sub.cancelled:
+            # sub is active until the next billing_date + 1
+            if sub.next_bill_date >= arrow.now().shift(days=-1).date():
+                return sub
+            else:  # past subscription, user is considered not having a subscription
+                return None
+        else:
+            return sub

    def verified_custom_domains(self):
        return CustomDomain.query.filter_by(user_id=self.id, verified=True).all()
@ -709,3 +720,8 @@ class CustomDomain(db.Model, ModelMixin):

    def __repr__(self):
        return f"<Custom Domain {self.domain}>"
+
+
+class LifetimeCoupon(db.Model, ModelMixin):
+    code = db.Column(db.String(128), nullable=False, unique=True)
+    nb_used = db.Column(db.Integer, nullable=False)
--- a/app/utils.py
+++ b/app/utils.py
@ -16,6 +16,10 @@ def random_word():
    return random.choice(_words)


+def word_exist(word):
+    return word in _words
+
+
 def random_words():
    """Generate a random words. Used to generate user-facing string, for ex email addresses"""
    nb_words = random.randint(2, 3)
--- a/docs/banner.png
+++ b/docs/banner.png
--- a/docs/custom-alias.png
+++ b/docs/custom-alias.png
--- a/docs/diagram.png
+++ b/docs/diagram.png
--- a/email_handler.py
+++ b/email_handler.py
@ -31,7 +31,7 @@ It should contain the following info:

 """
 import time
-from email.message import EmailMessage
+from email.message import Message
 from email.parser import Parser
 from email.policy import SMTPUTF8
 from smtplib import SMTP
@ -45,6 +45,8 @@ from app.email_utils import (
    send_email,
    add_dkim_signature,
    get_email_domain_part,
+    add_or_replace_header,
+    delete_header,
 )
 from app.extensions import db
 from app.log import LOG
@ -85,11 +87,11 @@ class MailHandler:
        smtp = SMTP(POSTFIX_SERVER, 25)
        msg = Parser(policy=SMTPUTF8).parsestr(message_data)

+        rcpt_to = envelope.rcpt_tos[0].lower()
+
        # Reply case
        # reply+ or ra+ (reverse-alias) prefix
-        if envelope.rcpt_tos[0].startswith("reply+") or envelope.rcpt_tos[0].startswith(
-            "ra+"
-        ):
+        if rcpt_to.startswith("reply+") or rcpt_to.startswith("ra+"):
            LOG.debug("Reply phase")
            app = new_app()

@ -102,9 +104,9 @@ class MailHandler:
            with app.app_context():
                return self.handle_forward(envelope, smtp, msg)

-    def handle_forward(self, envelope, smtp: SMTP, msg: EmailMessage) -> str:
+    def handle_forward(self, envelope, smtp: SMTP, msg: Message) -> str:
        """return *status_code message*"""
-        alias = envelope.rcpt_tos[0]  # alias@SL
+        alias = envelope.rcpt_tos[0].lower()  # alias@SL

        gen_email = GenEmail.get_by(email=alias)
        if not gen_email:
@ -162,9 +164,7 @@ class MailHandler:
            add_or_replace_header(msg, "X-SimpleLogin-Type", "Forward")

            # remove reply-to header if present
-            if msg["Reply-To"]:
-                LOG.d("Delete reply-to header %s", msg["Reply-To"])
-                del msg["Reply-To"]
+            delete_header(msg, "Reply-To")

            # change the from header so the sender comes from @SL
            # so it can pass DMARC check
@ -212,8 +212,8 @@ class MailHandler:
        db.session.commit()
        return "250 Message accepted for delivery"

-    def handle_reply(self, envelope, smtp: SMTP, msg: EmailMessage) -> str:
-        reply_email = envelope.rcpt_tos[0]
+    def handle_reply(self, envelope, smtp: SMTP, msg: Message) -> str:
+        reply_email = envelope.rcpt_tos[0].lower()

        # reply_email must end with EMAIL_DOMAIN
        if not reply_email.endswith(EMAIL_DOMAIN):
@ -230,7 +230,7 @@ class MailHandler:
                return "550 alias unknown by SimpleLogin"

        user_email = forward_email.gen_email.user.email
-        if envelope.mail_from != user_email:
+        if envelope.mail_from.lower() != user_email.lower():
            LOG.error(
                f"Reply email can only be used by user email. Actual mail_from: %s. User email %s",
                envelope.mail_from,
@ -246,13 +246,15 @@ class MailHandler:

            return "550 ignored"

-        # remove DKIM-Signature
-        if msg["DKIM-Signature"]:
-            LOG.d("Remove DKIM-Signature %s", msg["DKIM-Signature"])
-            del msg["DKIM-Signature"]
+        delete_header(msg, "DKIM-Signature")

-        # email seems to come from alias
+        # the email comes from alias
        msg.replace_header("From", alias)
+
+        # some email providers like ProtonMail adds automatically the Reply-To field
+        # make sure to delete it
+        delete_header(msg, "Reply-To")
+
        msg.replace_header("To", forward_email.website_email)

        # add List-Unsubscribe header
@ -293,14 +295,6 @@ class MailHandler:
        return "250 Message accepted for delivery"


-def add_or_replace_header(msg: EmailMessage, header: str, value: str):
-    try:
-        msg.add_header(header, value)
-    except ValueError:
-        # the header exists already
-        msg.replace_header(header, value)
-
-
 if __name__ == "__main__":
    controller = Controller(MailHandler(), hostname="0.0.0.0", port=20381)

--- a/migrations/versions/2020_010120_d29cca963221_.py
+++ b/migrations/versions/2020_010120_d29cca963221_.py
@ -0,0 +1,39 @@
+"""empty message
+
+Revision ID: d29cca963221
+Revises: 01f808f15b2e
+Create Date: 2020-01-01 20:01:51.861329
+
+"""
+import sqlalchemy_utils
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = 'd29cca963221'
+down_revision = '01f808f15b2e'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.create_table('lifetime_coupon',
+    sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+    sa.Column('created_at', sqlalchemy_utils.types.arrow.ArrowType(), nullable=False),
+    sa.Column('updated_at', sqlalchemy_utils.types.arrow.ArrowType(), nullable=True),
+    sa.Column('code', sa.String(length=128), nullable=False),
+    sa.Column('nb_used', sa.Integer(), nullable=False),
+    sa.PrimaryKeyConstraint('id'),
+    sa.UniqueConstraint('code')
+    )
+    op.add_column('users', sa.Column('lifetime', sa.Boolean(), server_default='0', nullable=False))
+    # ### end Alembic commands ###
+
+
+def downgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.drop_column('users', 'lifetime')
+    op.drop_table('lifetime_coupon')
+    # ### end Alembic commands ###
--- a/requirements.in
+++ b/requirements.in
@ -32,4 +32,5 @@ coloredlogs
 pycryptodome
 phpserialize
 dkimpy
-pyotp
+pyotp
+flask_profiler
--- a/requirements.txt
+++ b/requirements.txt
@ -34,8 +34,10 @@ docutils==0.14            # via botocore
 flask-admin==1.5.3
 flask-cors==3.0.8
 flask-debugtoolbar==0.10.1
+flask-httpauth==3.3.0     # via flask-profiler
 flask-login==0.4.1
 flask-migrate==2.5.2
+flask-profiler==1.8.1
 flask-sqlalchemy==2.4.0
 flask-wtf==0.14.2
 flask==1.0.3
@ -83,8 +85,9 @@ requests==2.22.0          # via requests-oauthlib
 ruamel.yaml==0.15.97      # via strictyaml
 s3transfer==0.2.1         # via boto3
 sentry-sdk==0.13.5
+simplejson==3.17.0        # via flask-profiler
 six==1.12.0               # via bcrypt, cryptography, flask-cors, packaging, pip-tools, prompt-toolkit, pyopenssl, pytest, python-dateutil, sqlalchemy-utils, traitlets
-sqlalchemy-utils==0.33.11
+sqlalchemy-utils==0.36.1
 sqlalchemy==1.3.12        # via alembic, flask-sqlalchemy, sqlalchemy-utils
 strictyaml==1.0.2         # via yacron
 traitlets==4.3.2          # via ipython
--- a/server.py
+++ b/server.py
@ -2,19 +2,23 @@ import os
 import ssl

 import arrow
+import flask_profiler
 import sentry_sdk
 from flask import Flask, redirect, url_for, render_template, request, jsonify
 from flask_admin import Admin
 from flask_cors import cross_origin
-from flask_debugtoolbar import DebugToolbarExtension
 from flask_login import current_user
 from sentry_sdk.integrations.flask import FlaskIntegration
+from sentry_sdk.integrations.sqlalchemy import SqlalchemyIntegration
+from sentry_sdk.integrations.aiohttp import AioHttpIntegration
+

 from app import paddle_utils
 from app.admin_model import SLModelView, SLAdminIndexView
 from app.api.base import api_bp
 from app.auth.base import auth_bp
 from app.config import (
+    DEBUG,
    DB_URI,
    FLASK_SECRET,
    SENTRY_DSN,
@ -22,6 +26,8 @@ from app.config import (
    SHA1,
    PADDLE_MONTHLY_PRODUCT_ID,
    RESET_DB,
+    FLASK_PROFILER_PATH,
+    FLASK_PROFILER_PASSWORD,
 )
 from app.dashboard.base import dashboard_bp
 from app.developer.base import developer_bp
@ -39,13 +45,21 @@ from app.models import (
    PlanEnum,
    ApiKey,
    CustomDomain,
+    LifetimeCoupon,
 )
 from app.monitor.base import monitor_bp
 from app.oauth.base import oauth_bp

 if SENTRY_DSN:
    LOG.d("enable sentry")
-    sentry_sdk.init(dsn=SENTRY_DSN, integrations=[FlaskIntegration()])
+    sentry_sdk.init(
+        dsn=SENTRY_DSN,
+        integrations=[
+            FlaskIntegration(),
+            SqlalchemyIntegration(),
+            AioHttpIntegration(),
+        ],
+    )

 # the app is served behin nginx which uses http and not https
 os.environ["OAUTHLIB_INSECURE_TRANSPORT"] = "1"
@ -76,6 +90,21 @@ def create_app() -> Flask:

    init_admin(app)
    setup_paddle_callback(app)
+    setup_do_not_track(app)
+
+    if FLASK_PROFILER_PATH:
+        LOG.d("Enable flask-profiler")
+        app.config["flask_profiler"] = {
+            "enabled": True,
+            "storage": {"engine": "sqlite", "FILE": FLASK_PROFILER_PATH},
+            "basicAuth": {
+                "enabled": True,
+                "username": "admin",
+                "password": FLASK_PROFILER_PASSWORD,
+            },
+            "ignore": ["^/static/.*", "/git", "/exception"],
+        }
+        flask_profiler.init_app(app)

    return app

@ -101,6 +130,9 @@ def fake_data():
    )
    db.session.commit()

+    LifetimeCoupon.create(code="coupon", nb_used=10)
+    db.session.commit()
+
    # Create a subscription for user
    Subscription.create(
        user_id=user.id,
@ -165,7 +197,7 @@ def register_blueprints(app: Flask):


 def set_index_page(app):
-    @app.route("/")
+    @app.route("/", methods=["GET", "POST"])
    def index():
        if current_user.is_authenticated:
            return redirect(url_for("dashboard.index"))
@ -347,9 +379,9 @@ def setup_paddle_callback(app: Flask):
            LOG.debug("Cancel subscription %s", subscription_id)

            sub: Subscription = Subscription.get_by(subscription_id=subscription_id)
-            sub.cancelled = True
-
-            db.session.commit()
+            if sub:
+                sub.cancelled = True
+                db.session.commit()

        return "OK"

@ -371,11 +403,26 @@ def init_admin(app):
    admin.add_view(SLModelView(ClientUser, db.session))


+def setup_do_not_track(app):
+    @app.route("/dnt")
+    def do_not_track():
+        return """
+        <script>
+// Disable GoatCounter if this script is called
+
+window.localStorage.setItem('goatcounter-ignore', 't');
+
+alert("GoatCounter disabled");
+
+window.location.href = "/";
+
+</script>
+        """
+
+
 if __name__ == "__main__":
    app = create_app()

-    app.debug = True
-
    # enable flask toolbar
    # app.config["DEBUG_TB_PROFILER_ENABLED"] = True
    # app.config["DEBUG_TB_INTERCEPT_REDIRECTS"] = False
--- a/templates/base.html
+++ b/templates/base.html
@ -128,5 +128,30 @@
 {% block script %}
 {% endblock %}

+<script>
+  (function () {
+    // only enable on prod
+    if (!window.location.host.endsWith('simplelogin.io')) {
+      console.log("GoatCounter should only be enabled in prod");
+      return;
+    }
+
+    if (localStorage.getItem('goatcounter-ignore') === 't') {
+      console.log("GoatCounter is disabled");
+      return;
+    }
+
+    console.log("init GoatCounter");
+
+    var script = document.createElement('script');
+    window.counter = 'https://app.goatcounter.com/count'
+    script.async = 1;
+    script.src = '//gc.zgo.at/count.js';
+
+    var ins = document.getElementsByTagName('script')[0];
+    ins.parentNode.insertBefore(script, ins)
+  })();
+</script>
+
 </body>
 </html>
--- a/templates/footer.html
+++ b/templates/footer.html
@ -22,6 +22,14 @@
              </a></li>
              <li class="list-inline-item"><a href="mailto:hi@simplelogin.io">Contact Us
                <i class="fe fe-external-link"></i></a></li>
+              <li class="list-inline-item intro-step-0">
+                <a onclick="startIntro()"
+                   data-intro="Welcome to SimpleLogin! <br><br>
+  It seems that this is the first time you are here,
+  let's walk through some SimpleLogin features together! <br><br>
+             You can always show this tutorial again any time by clicking on this <i class='fe fe-help-circle'></i> icon below 👇"
+                   data-step="1"
+                ><i class="fe fe-help-circle"></i></a></li>
            </ul>
          </div>
        </div>
--- a/templates/header.html
+++ b/templates/header.html
@ -12,16 +12,6 @@
          </div>
        {% endif %}

-        <div class="dropdown d-none d-md-flex">
-          <a class="nav-link icon"
-             data-intro="Welcome to SimpleLogin! <br><br>
-  It seems that this is the first time you are here,
-  let's walk through some SimpleLogin features together! <br><br>
-             You can always show this tutorial again any time by clicking on this <i class='fe fe-help-circle'></i> icon above 👆"
-             onclick="startIntro()">
-            <i class="fe fe-help-circle"></i>
-          </a>
-        </div>
        <div class="dropdown">
          <a href="#" class="nav-link pr-0 leading-none" data-toggle="dropdown">
            {% if current_user.profile_picture_id %}
@ -42,7 +32,7 @@
          </a>

          <div class="dropdown-menu dropdown-menu-right dropdown-menu-arrow">
-            {% if current_user.is_premium() %}
+            {% if current_user.get_subscription() %}
              <a class="dropdown-item" href="{{ url_for('dashboard.billing') }}">
                <i class="dropdown-icon fe fe-dollar-sign"></i> Billing
              </a>
--- a/templates/menu.html
+++ b/templates/menu.html
@ -40,10 +40,7 @@
  </li>
  -->

-  <li class="nav-item"
-      data-intro="If you want to add SimpleLogin to your website/application, this tab is for you 😀"
-      data-step="5"
-  >
+  <li class="nav-item">
    <a href="{{ url_for('developer.index') }}"
       class="nav-link {{ 'active' if active_page == 'developer' }}">
      <i class="fe fe-terminal"></i>
--- a/tests/api/test_alias_options.py
+++ b/tests/api/test_alias_options.py
@ -50,3 +50,48 @@ def test_different_scenarios(flask_client):
    )
    assert r.json["recommendation"]["alias"] == alias.email
    assert r.json["recommendation"]["hostname"] == "www.test.com"
+
+
+def test_different_scenarios_v2(flask_client):
+    user = User.create(
+        email="a@b.c", password="password", name="Test User", activated=True
+    )
+    db.session.commit()
+
+    # create api_key
+    api_key = ApiKey.create(user.id, "for test")
+    db.session.commit()
+
+    # <<< without hostname >>>
+    r = flask_client.get(
+        url_for("api.options_v2"), headers={"Authentication": api_key.code}
+    )
+
+    assert r.status_code == 200
+    # {'can_create': True, 'existing': ['my-first-alias.chat@sl.local'], 'prefix_suggestion': '', 'suffixes': ['.meo@sl.local']}
+
+    assert r.json["can_create"]
+    assert len(r.json["existing"]) == 1
+    assert r.json["suffixes"]
+    assert r.json["prefix_suggestion"] == ""  # no hostname => no suggestion
+
+    # <<< with hostname >>>
+    r = flask_client.get(
+        url_for("api.options_v2", hostname="www.test.com"),
+        headers={"Authentication": api_key.code},
+    )
+
+    assert r.json["prefix_suggestion"] == "test"
+
+    # <<< with recommendation >>>
+    alias = GenEmail.create_new(user.id, prefix="test")
+    db.session.commit()
+    AliasUsedOn.create(gen_email_id=alias.id, hostname="www.test.com")
+    db.session.commit()
+
+    r = flask_client.get(
+        url_for("api.options_v2", hostname="www.test.com"),
+        headers={"Authentication": api_key.code},
+    )
+    assert r.json["recommendation"]["alias"] == alias.email
+    assert r.json["recommendation"]["hostname"] == "www.test.com"
--- a/tests/api/test_new_custom_alias.py
+++ b/tests/api/test_new_custom_alias.py
@ -48,5 +48,5 @@ def test_out_of_quota(flask_client):

    assert r.status_code == 400
    assert r.json == {
-        "error": "You have reached the limitation of a free account with the maximum of 3 custom aliases, please upgrade your plan to create more custom aliases"
+        "error": "You have reached the limitation of a free account with the maximum of 3 aliases, please upgrade your plan to create more aliases"
    }
--- a/tests/api/test_new_random_alias.py
+++ b/tests/api/test_new_random_alias.py
@ -0,0 +1,52 @@
+from flask import url_for
+
+from app.config import EMAIL_DOMAIN, MAX_NB_EMAIL_FREE_PLAN
+from app.extensions import db
+from app.models import User, ApiKey, GenEmail
+
+
+def test_success(flask_client):
+    user = User.create(
+        email="a@b.c", password="password", name="Test User", activated=True
+    )
+    db.session.commit()
+
+    # create api_key
+    api_key = ApiKey.create(user.id, "for test")
+    db.session.commit()
+
+    r = flask_client.post(
+        url_for("api.new_random_alias", hostname="www.test.com"),
+        headers={"Authentication": api_key.code},
+    )
+
+    assert r.status_code == 201
+    assert r.json["alias"].endswith(EMAIL_DOMAIN)
+
+
+def test_out_of_quota(flask_client):
+    user = User.create(
+        email="a@b.c", password="password", name="Test User", activated=True
+    )
+    db.session.commit()
+
+    # create api_key
+    api_key = ApiKey.create(user.id, "for test")
+    db.session.commit()
+
+    # create 3 random alias to run out of quota
+    for _ in range(MAX_NB_EMAIL_FREE_PLAN):
+        GenEmail.create_new(user.id, prefix="test1")
+        GenEmail.create_new(user.id, prefix="test2")
+        GenEmail.create_new(user.id, prefix="test3")
+
+    r = flask_client.post(
+        url_for("api.new_random_alias", hostname="www.test.com"),
+        headers={"Authentication": api_key.code},
+    )
+
+    assert r.status_code == 400
+    assert (
+        r.json["error"]
+        == "You have reached the limitation of a free account with the maximum of 3 aliases, please upgrade your plan to create more aliases"
+    )
--- a/tests/api/test_user_info.py
+++ b/tests/api/test_user_info.py
@ -0,0 +1,32 @@
+from flask import url_for
+
+from app.extensions import db
+from app.models import User, ApiKey, AliasUsedOn, GenEmail
+
+
+def test_success(flask_client):
+    user = User.create(
+        email="a@b.c", password="password", name="Test User", activated=True
+    )
+    db.session.commit()
+
+    # create api_key
+    api_key = ApiKey.create(user.id, "for test")
+    db.session.commit()
+
+    r = flask_client.get(
+        url_for("api.user_info"), headers={"Authentication": api_key.code}
+    )
+
+    assert r.status_code == 200
+    assert r.json == {"is_premium": False, "name": "Test User"}
+
+
+def test_wrong_api_key(flask_client):
+    r = flask_client.get(
+        url_for("api.user_info"), headers={"Authentication": "Invalid code"}
+    )
+
+    assert r.status_code == 401
+
+    assert r.json == {"error": "Wrong api key"}
--- a/tests/test_dns_utils.py
+++ b/tests/test_dns_utils.py
@ -0,0 +1,30 @@
+from app.dns_utils import *
+
+# use our own domain for test
+_DOMAIN = "simplelogin.io"
+
+
+def test_get_mx_domains():
+    r = get_mx_domains(_DOMAIN)
+
+    assert len(r) > 0
+
+    for x in r:
+        assert x[0] > 0
+        assert x[1]
+
+
+def test_get_spf_domain():
+    r = get_spf_domain(_DOMAIN)
+    assert r == ["simplelogin.co"]
+
+
+def test_get_txt_record():
+
+    r = get_txt_record(_DOMAIN)
+    assert len(r) > 0
+
+
+def test_get_dkim_record():
+    r = get_dkim_record(_DOMAIN)
+    assert r.startswith("v=DKIM1; k=rsa;")