==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release):  1.6.0
- Deployed with iRedMail Easy or the downloadable installer? downloadable installer
- Linux/BSD distribution name and version:  Almalinux 8
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Web server (Apache or Nginx): nginx
- Manage mail accounts with iRedAdmin-Pro? yes
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

Hi,
I'm trying to set a fractional spam score via the RESTful API (PUT /api/spampolicy/user/<mail>, same for domain and global), e.g.:
spam_score=4.5
According to the docs docs.iredmail.org/iredadmin-pro.restful.api.html#spam-policy , the spam_score parameter is described just as "spam score", with the sample using an integer (spam_score=4), but it's not explicitly stated that decimals are disallowed.

I checked the source and found the relevant code in libs/amavisd/spampolicy.py.

str.isdigit() returns False for any string containing a decimal point, so spam_score=4.5 silently fails the if check — the block is skipped entirely, no error is returned, and spam_tag2_level/spam_kill_level are simply left unset. The API still responds with {"_success": true}, which is misleading since the value wasn't actually applied.

Interestingly, the code itself calls float(v) right after the isdigit() check, which suggests decimal support was intended but blocked by the wrong guard condition (should probably be a try/except around float(v) directly, rather than isdigit()).

Questions:

1. Is integer-only spam_score an intentional limitation, or is this a bug in the input validation?
2. Through the iRedAdmin-Pro web GUI, decimal spam score values are accepted and correctly applied/stored — so this inconsistency seems specific to the RESTful API input handling. Can you confirm the API is meant to behave the same way as the GUI here?
3. If it's a bug, could it be fixed in an upcoming release? Happy to test a patch if provided.