@axium/email 0.0.1

package/dist/server/api.js

@@ -0,0 +1,138 @@
+import { checkAuthForUser } from '@axium/server/auth';
+import { database } from '@axium/server/database';
+import { error, parseBody, parseSearch, withError } from '@axium/server/requests';
+import { addRoute } from '@axium/server/routes';
+import { jsonArrayFrom } from 'kysely/helpers/postgres';
+import * as z from 'zod';
+import { EmailChangeable, EmailInit, EmailListQuery } from '../common.js';
+import './db.js';
+import { makeSnippet, send } from './send.js';
+function withAttachments(eb) {
+    return jsonArrayFrom(eb
+        .selectFrom('email_attachments')
+        .select(['id', 'emailId', 'filename', 'contentType', 'size'])
+        .whereRef('email_attachments.emailId', '=', 'emails.id'))
+        .$castTo()
+        .as('attachments');
+}
+/** Fetch a message and check that the requesting user owns its mailbox */
+async function authEmail(request, id) {
+    const email = await database
+        .selectFrom('emails')
+        .selectAll()
+        .select(withAttachments)
+        .where('id', '=', id)
+        .executeTakeFirstOrThrow()
+        .catch(withError('Email does not exist', 404));
+    await checkAuthForUser(request, email.userId);
+    return email;
+}
+const draftOnlyFields = ['to', 'cc', 'bcc', 'subject', 'text'];
+addRoute({
+    path: '/api/users/:id/email',
+    params: { id: z.uuid() },
+    async GET(request, { id: userId }) {
+        await checkAuthForUser(request, userId);
+        const query = parseSearch(request, EmailListQuery);
+        return await database
+            .selectFrom('emails')
+            .selectAll()
+            .select(withAttachments)
+            .where('userId', '=', userId)
+            .$if(!!query.starred, qb => qb.where('starred', '=', true).where('folder', 'not in', ['trash', 'spam']))
+            .$if(!query.starred, qb => qb.where('folder', '=', query.folder ?? 'inbox'))
+            .orderBy('date', 'desc')
+            .limit(query.limit)
+            .offset(query.offset)
+            .execute()
+            .catch(withError('Could not get emails'));
+    },
+    async PUT(request, { id: userId }) {
+        const init = await parseBody(request, EmailInit);
+        const { user } = await checkAuthForUser(request, userId);
+        return await send(user, init);
+    },
+});
+addRoute({
+    path: '/api/email/:id',
+    params: { id: z.uuid() },
+    async GET(request, { id }) {
+        return await authEmail(request, id);
+    },
+    async PATCH(request, { id }) {
+        const changes = await parseBody(request, EmailChangeable);
+        const email = await authEmail(request, id);
+        if (email.folder != 'drafts' && draftOnlyFields.some(field => field in changes))
+            error(400, 'Only drafts can have their content changed');
+        const { to, cc, bcc, ...rest } = changes;
+        return Object.assign(await database
+            .updateTable('emails')
+            .set(rest)
+            .$if('to' in changes, qb => qb.set('to', JSON.stringify(to)))
+            .$if('cc' in changes, qb => qb.set('cc', JSON.stringify(cc)))
+            .$if('bcc' in changes, qb => qb.set('bcc', JSON.stringify(bcc)))
+            .$if('text' in changes, qb => qb.set('snippet', makeSnippet(changes.text)))
+            .where('id', '=', id)
+            .returningAll()
+            .executeTakeFirstOrThrow()
+            .catch(withError('Could not update email')), { attachments: email.attachments });
+    },
+    async DELETE(request, { id }) {
+        const email = await authEmail(request, id);
+        // deleting moves to trash; deleting from trash (or drafts) is permanent
+        if (email.folder != 'trash' && email.folder != 'drafts') {
+            const row = await database
+                .updateTable('emails')
+                .set('folder', 'trash')
+                .where('id', '=', id)
+                .returningAll()
+                .executeTakeFirstOrThrow()
+                .catch(withError('Could not delete email'));
+            return Object.assign(row, { attachments: email.attachments });
+        }
+        const row = await database
+            .deleteFrom('emails')
+            .where('id', '=', id)
+            .returningAll()
+            .executeTakeFirstOrThrow()
+            .catch(withError('Could not delete email'));
+        return Object.assign(row, { attachments: email.attachments });
+    },
+});
+addRoute({
+    path: '/api/email/:id/thread',
+    params: { id: z.uuid() },
+    async GET(request, { id }) {
+        const email = await authEmail(request, id);
+        return await database
+            .selectFrom('emails')
+            .selectAll()
+            .select(withAttachments)
+            .where('userId', '=', email.userId)
+            .where('threadId', '=', email.threadId)
+            .orderBy('date', 'asc')
+            .execute()
+            .catch(withError('Could not get thread'));
+    },
+});
+addRoute({
+    path: '/api/email/:id/attachments/:attachmentId',
+    params: { id: z.uuid(), attachmentId: z.uuid() },
+    async GET(request, { id, attachmentId }) {
+        await authEmail(request, id);
+        const attachment = await database
+            .selectFrom('email_attachments')
+            .selectAll()
+            .where('id', '=', attachmentId)
+            .where('emailId', '=', id)
+            .executeTakeFirstOrThrow()
+            .catch(withError('Attachment does not exist', 404));
+        return new Response(new Uint8Array(attachment.content), {
+            headers: {
+                'Content-Type': attachment.contentType,
+                'Content-Length': attachment.size.toString(),
+                'Content-Disposition': `attachment; filename="${attachment.filename.replaceAll('"', '')}"`,
+            },
+        });
+    },
+});

package/dist/server/cli.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/cli.js

@@ -0,0 +1,69 @@
+import { config, hostname } from '@axium/server/config';
+import { database } from '@axium/server/database';
+import { program } from 'commander';
+import * as io from 'ioium/node';
+import { createPrivateKey, createPublicKey } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { styleText } from 'node:util';
+const cli = program.command('email').helpGroup('Plugins:').description('CLI integration for @axium/email');
+/** The DKIM TXT record for a private key */
+function dkimRecord(privatePEM) {
+    const publicKey = createPublicKey(createPrivateKey(privatePEM)).export({ type: 'spki', format: 'der' }).toString('base64');
+    return `${config.email.dkim.selector}._domainkey.${hostname()}.\tIN\tTXT\t"v=DKIM1; k=rsa; p=${publicKey}"`;
+}
+cli.command('dns')
+    .description('Print the DNS records needed to send and receive email')
+    .action(() => {
+    const domain = hostname();
+    const host = new URL(config.origin).hostname;
+    const { key_file } = config.email.dkim;
+    console.log(styleText('whiteBright', '; Receiving (MX)'));
+    console.log(`${domain}.\tIN\tMX\t10 ${host}.`);
+    console.log(styleText('whiteBright', '\n; Sending (SPF)'));
+    console.log(`${domain}.\tIN\tTXT\t"v=spf1 mx -all"`);
+    console.log(styleText('whiteBright', '\n; DKIM'));
+    if (key_file && existsSync(key_file)) {
+        try {
+            console.log(dkimRecord(readFileSync(key_file, 'utf8')));
+        }
+        catch (e) {
+            io.warn('Could not read the DKIM key: ' + io.errorText(e));
+        }
+    }
+    else {
+        console.log(styleText('dim', '; Generate a DKIM key with `axium email dkim-keygen` first'));
+    }
+    console.log(styleText('whiteBright', '\n; DMARC'));
+    console.log(`_dmarc.${domain}.\tIN\tTXT\t"v=DMARC1; p=quarantine; rua=mailto:postmaster@${domain}"`);
+});
+cli.command('queue')
+    .description('Show the outbound email queue')
+    .option('-a, --all', 'Include delivered and failed messages', false)
+    .option('--retry', 'Retry failed messages now', false)
+    .action(async (opt) => {
+    if (opt.retry) {
+        const retried = await database
+            .updateTable('email_outbound')
+            .set({ status: 'pending', attempts: 0, nextAttempt: new Date() })
+            .where('status', '=', 'failed')
+            .returningAll()
+            .execute();
+        io.info(`Marked ${retried.length} messages for retry. They will be sent when the server processes the queue.`);
+        return;
+    }
+    const jobs = await database
+        .selectFrom('email_outbound')
+        .innerJoin('emails', 'emails.id', 'email_outbound.emailId')
+        .select(['email_outbound.id', 'recipient', 'status', 'attempts', 'nextAttempt', 'lastError', 'emails.subject'])
+        .$if(!opt.all, qb => qb.where('status', '=', 'pending'))
+        .orderBy('nextAttempt', 'asc')
+        .execute();
+    if (!jobs.length) {
+        console.log(styleText(['italic', 'dim'], 'The queue is empty.'));
+        return;
+    }
+    for (const job of jobs) {
+        const color = job.status == 'sent' ? 'green' : job.status == 'failed' ? 'red' : 'yellow';
+        console.log(styleText(color, job.status.padEnd(7)), job.recipient, styleText('dim', `(${job.attempts} attempts, next ${job.nextAttempt.toISOString()})`), styleText('yellow', JSON.stringify(job.subject)), job.lastError ? styleText('red', job.lastError) : '');
+    }
+});

package/dist/server/db.d.ts

@@ -0,0 +1,17 @@
+import type { FromFile as FromSchemaFile } from '@axium/server/db/schema';
+import type { ColumnType, Generated } from 'kysely';
+import type schema from '../../db.json';
+import type { EmailFolder, Mailbox } from '../common.js';
+type _DB = FromSchemaFile<typeof schema>;
+declare module '@axium/server/database' {
+    interface Schema extends Omit<_DB, 'emails'> {
+        emails: Omit<_DB['emails'], 'from' | 'to' | 'cc' | 'bcc' | 'folder'> & {
+            from: ColumnType<Mailbox, string | Mailbox, string | Mailbox>;
+            to: ColumnType<Mailbox[], string | Mailbox[], string | Mailbox[]>;
+            cc: ColumnType<Mailbox[], string | Mailbox[], string | Mailbox[]>;
+            bcc: ColumnType<Mailbox[], string | Mailbox[], string | Mailbox[]>;
+            folder: Generated<EmailFolder>;
+        };
+    }
+}
+export {};

package/dist/server/db.js

@@ -0,0 +1,2 @@
+import { addObjectType as addSyncObjectType } from '@axium/server/sync';
+addSyncObjectType('emails');

package/dist/server/hooks.d.ts

@@ -0,0 +1,4 @@
+import '../common.js';
+import './api.js';
+export declare function statusText(): Promise<string>;
+export declare function load(): void;

package/dist/server/hooks.js

@@ -0,0 +1,13 @@
+import { count } from '@axium/server/database';
+import '../common.js';
+import './api.js';
+import { startOutbound } from './send.js';
+import { startInbound } from './smtp.js';
+export async function statusText() {
+    const { emails } = await count('emails');
+    return `${emails} emails`;
+}
+export function load() {
+    startInbound();
+    startOutbound();
+}

package/dist/server/index.d.ts

@@ -0,0 +1,4 @@
+export * from '../common.js';
+export * from './send.js';
+import './api.js';
+import './db.js';

package/dist/server/index.js

@@ -0,0 +1,4 @@
+export * from '../common.js';
+export * from './send.js';
+import './api.js';
+import './db.js';

package/dist/server/send.d.ts

@@ -0,0 +1,45 @@
+import type { User } from '@axium/core';
+import type { Email, EmailFolder, EmailInit, Mailbox } from '../common.js';
+import './db.js';
+/** The address of a user on this server */
+export declare function addressFor(user: Pick<User, 'username'>): string | null;
+/** Make a list snippet from a body, excluding quoted replies */
+export declare function makeSnippet(text?: string | null): string | null;
+/** Resolve the user an address belongs to, if it is local to this server */
+export declare function localUser(address: string): Promise<{
+    id: string;
+} | null>;
+/** Find the thread a reply belongs to in a user's mailbox */
+export declare function threadFor(userId: string, inReplyTo?: string | null): Promise<string>;
+export interface MessageData {
+    messageId: string;
+    inReplyTo?: string | null;
+    references?: string[];
+    from: Mailbox;
+    to: Mailbox[];
+    cc: Mailbox[];
+    bcc: Mailbox[];
+    subject: string;
+    text?: string | null;
+    html?: string | null;
+    date: Date;
+    size: number;
+}
+export interface IncomingAttachment {
+    filename: string;
+    contentType: string;
+    content: Uint8Array<ArrayBuffer>;
+}
+/** Store a message in a user's mailbox */
+export declare function deliver(userId: string, folder: EmailFolder, data: MessageData, attachments?: IncomingAttachment[]): Promise<Email>;
+/**
+ * Send a message composed by a local user: store the sender's copy,
+ * deliver to local recipients, and queue delivery to external recipients.
+ */
+export declare function send(sender: User, init: EmailInit): Promise<Email>;
+/** Push a message to its mailbox owner over the socket */
+export declare function notifyReceived(email: Email): void;
+/** Periodically deliver queued outbound messages */
+export declare function startOutbound(): void;
+export declare function stopOutbound(): void;
+export declare function processOutbound(): Promise<void>;

package/dist/server/send.js

@@ -0,0 +1,221 @@
+import { hostname } from '@axium/server/config';
+import { database } from '@axium/server/database';
+import { sendMail } from '@axium/server/email';
+import { error, withError } from '@axium/server/requests';
+import { io as socketServer } from '@axium/server/socket';
+import * as io from 'ioium/node';
+import { pick } from 'utilium';
+import { splitQuoted } from '../common.js';
+import './db.js';
+/** The address of a user on this server */
+export function addressFor(user) {
+    return user.username ? `${user.username}@${hostname()}` : null;
+}
+/** Make a list snippet from a body, excluding quoted replies */
+export function makeSnippet(text) {
+    if (!text)
+        return null;
+    return splitQuoted(text).content.replaceAll(/\s+/g, ' ').trim().slice(0, 160) || null;
+}
+/** Resolve the user an address belongs to, if it is local to this server */
+export async function localUser(address) {
+    const [local, domain] = address.toLowerCase().split('@');
+    if (domain != hostname())
+        return null;
+    const user = await database.selectFrom('users').select('id').where('username', '=', local).executeTakeFirst();
+    return user ?? null;
+}
+/** Find the thread a reply belongs to in a user's mailbox */
+export async function threadFor(userId, inReplyTo) {
+    if (inReplyTo) {
+        const ref = await database
+            .selectFrom('emails')
+            .select('threadId')
+            .where('userId', '=', userId)
+            .where('messageId', '=', inReplyTo)
+            .orderBy('received', 'desc')
+            .executeTakeFirst();
+        if (ref)
+            return ref.threadId;
+    }
+    return crypto.randomUUID();
+}
+/** Store a message in a user's mailbox */
+export async function deliver(userId, folder, data, attachments = []) {
+    const row = await database
+        .insertInto('emails')
+        .values({
+        userId,
+        folder,
+        ...data,
+        threadId: await threadFor(userId, data.inReplyTo),
+        snippet: makeSnippet(data.text),
+        read: folder == 'sent' || folder == 'drafts',
+    })
+        .returningAll()
+        .executeTakeFirstOrThrow();
+    const stored = { ...row, attachments: [] };
+    for (const attachment of attachments) {
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        const { content: _, ...meta } = await database
+            .insertInto('email_attachments')
+            .values({
+            emailId: row.id,
+            filename: attachment.filename,
+            contentType: attachment.contentType,
+            size: BigInt(attachment.content.byteLength),
+            content: attachment.content,
+        })
+            .returningAll()
+            .executeTakeFirstOrThrow();
+        stored.attachments.push(meta);
+    }
+    return stored;
+}
+/**
+ * Send a message composed by a local user: store the sender's copy,
+ * deliver to local recipients, and queue delivery to external recipients.
+ */
+export async function send(sender, init) {
+    const address = addressFor(sender);
+    if (!address)
+        error(409, 'You need a username to use email');
+    const data = {
+        messageId: `<${crypto.randomUUID()}@${hostname()}>`,
+        ...pick(init, 'inReplyTo', 'to', 'cc', 'bcc', 'subject', 'text'),
+        references: [],
+        from: { name: sender.name, address },
+        date: new Date(),
+        size: new TextEncoder().encode(init.text ?? '').byteLength,
+    };
+    if (init.inReplyTo) {
+        const ref = await database
+            .selectFrom('emails')
+            .select('references')
+            .where('userId', '=', sender.id)
+            .where('messageId', '=', init.inReplyTo)
+            .executeTakeFirst();
+        data.references = [...(ref?.references ?? []), init.inReplyTo];
+    }
+    if (init.draftId) {
+        await database
+            .deleteFrom('emails')
+            .where('id', '=', init.draftId)
+            .where('userId', '=', sender.id)
+            .where('folder', '=', 'drafts')
+            .execute()
+            .catch(withError('Could not consume draft'));
+    }
+    if (init.isDraft)
+        return await deliver(sender.id, 'drafts', data);
+    const sent = await deliver(sender.id, 'sent', data);
+    const delivered = new Set();
+    const external = new Set();
+    for (const recipient of [...init.to, ...init.cc, ...init.bcc]) {
+        const local = await localUser(recipient.address);
+        if (!local) {
+            external.add(recipient.address.toLowerCase());
+            continue;
+        }
+        if (delivered.has(local.id))
+            continue;
+        delivered.add(local.id);
+        // recipients must not see who was bcc'd
+        notifyReceived(await deliver(local.id, 'inbox', { ...data, bcc: [] }));
+    }
+    for (const recipient of external) {
+        await database.insertInto('email_outbound').values({ emailId: sent.id, recipient }).execute();
+    }
+    if (external.size)
+        void processOutbound().catch(e => io.warn('Outbound delivery failed: ' + io.errorText(e)));
+    return sent;
+}
+/** Push a message to its mailbox owner over the socket */
+export function notifyReceived(email) {
+    socketServer?.to(`user:${email.userId}`).emit('email.received', email);
+}
+const maxAttempts = 8;
+let outboundWorker;
+let processing = false;
+/** Periodically deliver queued outbound messages */
+export function startOutbound() {
+    outboundWorker ??= setInterval(() => void processOutbound().catch(e => io.warn('Outbound delivery failed: ' + io.errorText(e))), 60_000);
+    outboundWorker.unref();
+}
+export function stopOutbound() {
+    clearInterval(outboundWorker);
+    outboundWorker = undefined;
+}
+/** Attempt delivery of a single queued message */
+async function attemptDelivery(job, email) {
+    try {
+        await sendMail(job.recipient, {
+            ...pick(email, 'subject', 'date', 'read', 'messageId'),
+            envelope: { from: email.from.address, to: [job.recipient] },
+            from: { name: email.from.name ?? '', address: email.from.address },
+            to: email.to.map(m => ({ name: m.name ?? '', address: m.address })),
+            cc: email.cc.map(m => ({ name: m.name ?? '', address: m.address })),
+            text: email.text ?? undefined,
+            html: email.html ?? undefined,
+            inReplyTo: email.inReplyTo ?? undefined,
+        });
+        await database.updateTable('email_outbound').set({ status: 'sent' }).where('id', '=', job.id).execute();
+    }
+    catch (e) {
+        const attempts = job.attempts + 1;
+        const failed = attempts >= maxAttempts;
+        await database
+            .updateTable('email_outbound')
+            .set({
+            attempts,
+            status: failed ? 'failed' : 'pending',
+            lastError: String(e?.message ?? e),
+            nextAttempt: new Date(Date.now() + 5 * 2 ** attempts * 60_000),
+        })
+            .where('id', '=', job.id)
+            .execute();
+        if (failed)
+            await bounce(email, job.recipient, String(e?.message ?? e));
+    }
+}
+/** Deliver a failure notice to the sender */
+async function bounce(email, recipient, reason) {
+    notifyReceived(await deliver(email.userId, 'inbox', {
+        messageId: `<${crypto.randomUUID()}@${hostname()}>`,
+        inReplyTo: email.messageId,
+        references: [email.messageId],
+        from: { name: 'Mail Delivery', address: `mailing@${hostname()}` },
+        to: [email.from],
+        cc: [],
+        bcc: [],
+        subject: 'Delivery Failed',
+        text: `Your message to ${recipient} could not be delivered:\n\n${reason}`,
+        date: new Date(),
+        size: 0,
+    }));
+}
+export async function processOutbound() {
+    if (processing)
+        return;
+    processing = true;
+    try {
+        const jobs = await database
+            .selectFrom('email_outbound')
+            .selectAll()
+            .where('status', '=', 'pending')
+            .where('nextAttempt', '<=', new Date())
+            .limit(20)
+            .execute();
+        for (const job of jobs) {
+            const email = await database.selectFrom('emails').selectAll().where('id', '=', job.emailId).executeTakeFirst();
+            if (!email) {
+                await database.deleteFrom('email_outbound').where('id', '=', job.id).execute();
+                continue;
+            }
+            await attemptDelivery(job, { ...email, attachments: [] });
+        }
+    }
+    finally {
+        processing = false;
+    }
+}

package/dist/server/smtp.d.ts

@@ -0,0 +1,2 @@
+export declare function startInbound(): void;
+export declare function stopInbound(): void;

package/dist/server/smtp.js

@@ -0,0 +1,128 @@
+import { getConfig } from '@axium/core/plugins';
+import { config, hostname } from '@axium/server/config';
+import * as io from 'ioium/node';
+import { authenticate } from 'mailauth';
+import { randomUUID } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import PostalMime, {} from 'postal-mime';
+import { SMTPServer } from 'smtp-server';
+import { Mailbox } from '../common.js';
+import { deliver, localUser, notifyReceived } from './send.js';
+let server;
+/** Convert a parsed address into a valid Mailbox, since we can't trust senders to use valid addresses */
+function toMailbox(parsed) {
+    if (!parsed)
+        return null;
+    const result = Mailbox.safeParse({ name: parsed.name || null, address: 'address' in parsed ? parsed.address : null });
+    if (result.success)
+        return result.data;
+    if (parsed.name)
+        return { name: parsed.name, address: `invalid@${hostname()}` };
+    return null;
+}
+function toMailboxes(parsed) {
+    return (parsed ?? []).flatMap(address => {
+        if ('group' in address && Array.isArray(address.group))
+            return address.group.map(toMailbox).filter(m => m != null);
+        const mailbox = toMailbox(address);
+        return mailbox ? [mailbox] : [];
+    });
+}
+async function handleMessage(stream, session) {
+    const chunks = [];
+    for await (const chunk of stream)
+        chunks.push(chunk);
+    if (stream.sizeExceeded)
+        throw Object.assign(new Error('Message exceeds maximum size'), { responseCode: 552 });
+    const raw = Buffer.concat(chunks);
+    // SPF/DKIM/DMARC; failures go to spam rather than being rejected, since
+    // rejecting after DATA gives senders a bounce with the reason anyway
+    let spam = false;
+    try {
+        const auth = await authenticate(raw, {
+            ip: session.remoteAddress,
+            helo: session.hostNameAppearsAs,
+            sender: session.envelope.mailFrom ? session.envelope.mailFrom.address : undefined,
+            mta: hostname(),
+        });
+        spam = !auth.dmarc || auth.dmarc.status.result == 'fail' || !auth.spf || auth.spf.status.result == 'fail';
+    }
+    catch (e) {
+        io.warn('Could not authenticate inbound email: ' + io.errorText(e));
+    }
+    const parsed = await PostalMime.parse(raw);
+    const envelopeFrom = session.envelope.mailFrom ? session.envelope.mailFrom.address : `unknown@${hostname()}`;
+    const data = {
+        messageId: parsed.messageId || `<${randomUUID()}@${hostname()}>`,
+        inReplyTo: parsed.inReplyTo?.trim() || null,
+        references: parsed.references?.split(/\s+/).filter(ref => ref.length) ?? [],
+        from: toMailbox(parsed.from) ?? { address: envelopeFrom },
+        to: toMailboxes(parsed.to),
+        cc: toMailboxes(parsed.cc),
+        bcc: [],
+        subject: parsed.subject ?? '',
+        text: parsed.text,
+        html: parsed.html,
+        date: parsed.date ? new Date(parsed.date) : new Date(),
+        size: raw.byteLength,
+    };
+    const attachments = (parsed.attachments ?? []).map(attachment => ({
+        filename: attachment.filename || 'attachment',
+        contentType: attachment.mimeType || 'application/octet-stream',
+        content: typeof attachment.content == 'string' ? new TextEncoder().encode(attachment.content) : new Uint8Array(attachment.content),
+    }));
+    const delivered = new Set();
+    for (const recipient of session.envelope.rcptTo) {
+        const user = await localUser(recipient.address);
+        if (!user || delivered.has(user.id))
+            continue;
+        delivered.add(user.id);
+        notifyReceived(await deliver(user.id, spam ? 'spam' : 'inbox', data, attachments));
+    }
+}
+function tlsOptions() {
+    const { inbound } = getConfig('@axium/email');
+    const key_file = inbound.ssl_key || config.web.ssl_key;
+    const cert_file = inbound.ssl_cert || config.web.ssl_cert;
+    try {
+        return { key: readFileSync(key_file), cert: readFileSync(cert_file) };
+    }
+    catch (e) {
+        io.warn(`Inbound SMTP will not support STARTTLS (${e.message})`);
+        return { disabledCommands: ['STARTTLS'] };
+    }
+}
+export function startInbound() {
+    if (server)
+        return;
+    const { inbound } = getConfig('@axium/email');
+    if (!inbound.enabled)
+        return;
+    server = new SMTPServer({
+        ...tlsOptions(),
+        name: hostname(),
+        size: inbound.max_size ? inbound.max_size * 1000 : undefined,
+        disableReverseLookup: true,
+        authOptional: true,
+        // eslint-disable-next-line @typescript-eslint/no-misused-promises
+        async onRcptTo(address, _session, callback) {
+            const user = await localUser(address.address);
+            if (!user)
+                return callback(Object.assign(new Error('Mailbox not found'), { responseCode: 550 }));
+            callback();
+        },
+        onData(stream, session, callback) {
+            handleMessage(stream, session).then(() => callback(), (e) => {
+                io.warn('Failed to handle inbound email: ' + io.errorText(e));
+                e.responseCode ??= 451;
+                callback(e);
+            });
+        },
+    });
+    server.on('error', e => io.warn('Inbound SMTP error: ' + io.errorText(e)));
+    server.listen(inbound.port);
+}
+export function stopInbound() {
+    server?.close();
+    server = undefined;
+}