@bobfrankston/rmfmail 1.2.289 → 1.2.291

package/packages/mailx-types/trust.ts

@@ -56,6 +56,14 @@ export interface TrustInput {
     ownAddresses: string[];
     /** Sanitized HTML body, for the link-construct checks. */
     bodyHtml: string;
+    /** The reader has approved this sender or its domain in allowlist.jsonc —
+     *  "Always: *@icecer.com" in the remote-content banner, or "Trust all
+     *  senders at ‹domain›" in the address menu. It answers the only question
+     *  a spam score cannot: is this mail WANTED. It never silences forgery
+     *  evidence, and it counts only on a message whose sender was actually
+     *  proved — otherwise the list would be a switch a forger could flip by
+     *  typing a trusted address into From. */
+    senderTrusted?: boolean;
     /** Plain-text body, for the character-level checks. Separate from the HTML
      *  because markup legitimately contains things prose does not, and the
      *  zero-width test would trip over an entity or an attribute value. */
@@ -133,6 +141,15 @@ const ASSOCIATION_RULES: RegExp[] = [
     /^SEM_URIBL/,
     /^SPAMHAUS_/,
     /^RCVD_IN_(SBL|XBL|PBL|BL_SPAMCOP|SORBS|BRBL|VALIDITY|MSPIKE_[LZ])/,
+    // Blocklist rules that happen to live under other prefixes. KAM_*URIBL_*
+    // ("Body contains URI listed in PCCC WILD RBL", 9.0) and SH_HBL_EMAILS
+    // ("Email address listed in email blocklist", 8.0) are the same kind of
+    // evidence as URIBL_SBL — somebody else's list, about a host or address
+    // the message mentions — and they were the bulk of what still cautioned a
+    // proved sender: a Business Insider newsletter, an MIT cancer-center
+    // invitation, a campaign mailing. KAM_INFOUSMEBIZ judges the TLD a domain
+    // lives in, which is guilt by neighbourhood.
+    /^KAM_(BODY_|FROM_)?URIBL/, /^SH_HBL/, /^KAM_INFOUSMEBIZ$/,
 ];
 
 /** The shape of mass mailing: bulk-detection networks, marketing markup, list
@@ -151,6 +168,10 @@ const BULK_RULES: RegExp[] = [
     /^URIBL_(GREY|CSS|BLOCKED|CT_SURBL)/, /^SH_BODYURI/,
     /^HEADER_FROM_DIFFERENT_DOMAINS$/,          // every ESP on earth trips this
     /^MPART_ALT_DIFF/, /^TVD_/, /^T_REMOTE_IMAGE$/, /^UNPARSEABLE_RELAY$/,
+    // Branded ESP click-trackers. Not open redirectors (URI_PHP_REDIR and
+    // friends stay unclassified): these are the sending platform's own
+    // tracking domain, which is mass-mail machinery by definition.
+    /^GB_AWSTRACK/, /AWSTRACK/, /^GB_SENDGRID/, /^GB_MAILCHIMP/,
 ];
 
 /** Passes, whitelistings, and Bayes' own opinion — informational, and in
@@ -333,9 +354,28 @@ function analyzeServerSpam(input: TrustInput): ServerSpamAnalysis {
     // of a report is not evidence the rule was free.
     const scored = (r: SpamRule) => !(r.score <= 0);
     const present = (cls: RuleClass) => rules.some(r => r.cls === cls && scored(r));
+
+    // An unknown rule keeps a proved sender at caution only if it could have
+    // flagged the message BY ITSELF. Presence was too crude: an IEEE
+    // conference announcement (Bob 2026-08-28) scored 4.5 of 4.5 on DCC 3.0 +
+    // marketing 1.0 + 1.5 for GB_AWSTRACK_REDIR — Amazon SES's click-tracker,
+    // which every bulk mailer on earth routes through — and the 1.5 alone
+    // pushed a DMARC-proved announcement into "check this message before
+    // acting on it". Meanwhile KAM_BENEFICIARY, the case this rule exists for,
+    // is worth 10.0 on its own.
+    //
+    // The comparison is against the SERVER'S OWN threshold, so this adds no
+    // constant to tune: "enough to condemn" already has a number, and it is
+    // the one the server used. Unscored rules (no X-Spam-Report) make the sum
+    // unknown, and unknown stays cautious.
+    const unknown = rules.filter(r => r.cls === "other" && scored(r));
+    const unknownWeight = unknown.reduce((sum, r) => sum + r.score, 0);
+    const unknownCouldFlagAlone = !unknown.length ? false
+        : !Number.isFinite(unknownWeight) || !Number.isFinite(threshold) ? true
+        : unknownWeight >= threshold;
     const kind = (dmarc.authFailures.length || present("forgery")) ? "forgery"
         : present("association") ? "association"
-        : present("other") ? "unclassified"
+        : unknownCouldFlagAlone ? "unclassified"
         : rules.length ? "bulk"
         : "unclassified";
 
@@ -424,6 +464,16 @@ function serverSpamVerdict(input: TrustInput): TrustFinding {
     const a = analyzeServerSpam(input);
     if (!a || !a.flagged) return null;
 
+    // Mail from a sender the reader has approved, whose identity is proved,
+    // and which nothing accuses of forgery: say nothing at all. The server's
+    // score answers "is this bulk", the reader has already answered "is it
+    // wanted", and repeating the first after the second is how a banner turns
+    // into furniture. (Bob 2026-08-28, having just clicked "Always:
+    // *@icecer.com" on a conference announcement: "I accepted the server so
+    // shouldn't this be considered safe?")
+    const trustedAndProved = input.senderTrusted && a.proved;
+    if (trustedAndProved && a.kind !== "forgery" && !a.authFailures.length) return null;
+
     const numbers = Number.isFinite(a.score) && Number.isFinite(a.threshold)
         ? `SpamAssassin score ${a.score} of ${a.threshold}`
         : "flagged by SpamAssassin";
@@ -459,6 +509,13 @@ function serverSpamVerdict(input: TrustInput): TrustFinding {
         };
 
     const proof = a.proved ? `${provedNote(a)} ` : "";
+    if (input.senderTrusted && !a.proved)
+        return {
+            id: "server-spam-verdict",
+            severity: "caution",
+            text: "This claims to be a sender you trust, but nothing proves it is.",
+            detail: `No DMARC pass, no valid signature from the sending domain, and it passed through hosts your server does not trust. ${numbers}${why}`,
+        };
     return {
         id: "server-spam-verdict",
         severity: "caution",
@@ -742,6 +799,9 @@ export interface SpamScore {
      *  listed in the Spamhaus SBL blocklist)". A number alone is unactionable;
      *  this can be judged in a second. */
     reasons: string[];
+    /** The reader approved this sender AND the sender is proved: the score is
+     *  still true, and no longer worth showing. The viewer hides the chip. */
+    trusted: boolean;
 }
 
 export function spamScoreOf(input: TrustInput): SpamScore {
@@ -754,6 +814,7 @@ export function spamScoreOf(input: TrustInput): SpamScore {
         kind: a.kind,
         proved: a.proved,
         provedBy: a.provedBy,
+        trusted: !!input.senderTrusted && a.proved && a.kind !== "forgery" && !a.authFailures.length,
         reasons: a.reasons,
     };
 }