@lowdefy/connection-smtp 6.0.0 → 7.0.0

package/dist/connections/SMTP/SMTP.js

@@ -16,6 +16,10 @@
 import schema from './schema.js';
 export default {
     schema,
+    // An outside service, not app data: a journey on a data set keeps its real target.
+    meta: {
+        dataSet: 'external'
+    },
     requests: {
         SMTPMailSend
     }

package/dist/connections/SMTP/SMTPMailSend/SMTPMailSend.js

@@ -13,17 +13,37 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */ import { type } from '@lowdefy/helpers';
+import resolveMailFilter from '../resolveMailFilter.js';
 import send from '../send.js';
 import schema from './schema.js';
-async function SMTPMailSend({ request, connection }) {
+async function SMTPMailSend({ request, connection, environment }) {
     const messages = type.isArray(request) ? request : [
         request
     ];
+    // The current environment can switch email off (config.environments.<env>.email.enabled: false):
+    // nothing is sent, and each message reports it was not.
+    if (environment?.email?.enabled === false) {
+        return {
+            response: 'Mail is disabled in this environment.',
+            results: messages.map(()=>({
+                    messageId: null,
+                    to: null,
+                    disabled: true
+                }))
+        };
+    }
+    const filter = resolveMailFilter({
+        connection,
+        environment
+    });
     const results = [];
     // Send sequentially so a single SMTP connection or pool is not overwhelmed.
     for (const mail of messages){
         results.push(await send({
-            connection,
+            connection: {
+                ...connection,
+                filter
+            },
             mail
         }));
     }

package/dist/connections/SMTP/applyMailFilter.js

@@ -12,27 +12,90 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import { type } from '@lowdefy/helpers';
+*/ // eslint-plugin-import's node resolver does not read package exports maps.
+// eslint-disable-next-line import/no-unresolved
+import addressparser from 'nodemailer/lib/addressparser';
+import { type } from '@lowdefy/helpers';
+// nodemailer reads a string recipient as a comma-separated list, so a string holding several
+// addresses is split into one entry per address, with nodemailer's own parser. A string holding
+// one address is kept as written.
+function splitEntries(entries) {
+    if (type.isNone(entries)) {
+        return [];
+    }
+    return (type.isArray(entries) ? entries : [
+        entries
+    ]).flatMap((entry)=>{
+        if (!type.isString(entry)) {
+            return [
+                entry
+            ];
+        }
+        const parsed = addressparser(entry, {
+            flatten: true
+        });
+        return parsed.length > 1 ? parsed : [
+            entry
+        ];
+    });
+}
+// An entry from splitEntries: a string with one address, a request object ({ name, email }) or
+// a parsed nodemailer object ({ name, address }).
 function getBareEmail(entry) {
     if (type.isObject(entry)) {
-        return String(entry.email ?? '').toLowerCase();
+        return String(entry.address ?? entry.email ?? '').trim().toLowerCase();
+    }
+    if (!type.isString(entry)) {
+        return '';
+    }
+    const [parsed] = addressparser(entry, {
+        flatten: true
+    });
+    return (parsed?.address ?? '').trim().toLowerCase();
+}
+function getDomain(email) {
+    return email.slice(email.lastIndexOf('@') + 1);
+}
+// .invalid is reserved and never resolves (RFC 6761). A trailing dot is the fully qualified
+// form of the same domain.
+function isInvalid(entry) {
+    const domain = getDomain(getBareEmail(entry)).replace(/\.+$/, '');
+    return domain === 'invalid' || domain.endsWith('.invalid');
+}
+// Returns the field as written when nothing is dropped, so mail without .invalid recipients
+// reaches nodemailer unchanged.
+function dropInvalid(entries) {
+    const split = splitEntries(entries);
+    const kept = split.filter((entry)=>!isInvalid(entry));
+    if (kept.length === split.length) {
+        return entries;
     }
-    const angleMatch = /<([^<>]+)>/.exec(String(entry));
-    if (angleMatch) {
-        return angleMatch[1].toLowerCase();
+    return kept.length === 0 ? undefined : kept;
+}
+// Mail to .invalid is dropped on every send, filter or not, and only those recipients are
+// dropped: a real cc or bcc recipient still gets the mail when every to recipient is .invalid.
+// Returns null when no recipient is left.
+function dropInvalidRecipients(mail) {
+    const to = dropInvalid(mail.to);
+    const cc = dropInvalid(mail.cc);
+    const bcc = dropInvalid(mail.bcc);
+    if (type.isNone(to) && type.isNone(cc) && type.isNone(bcc)) {
+        return null;
     }
-    return String(entry).toLowerCase();
+    return {
+        ...mail,
+        to,
+        cc,
+        bcc
+    };
 }
 function createMatcher({ allowlist, regex }) {
     const allowedDomains = type.isNone(allowlist) ? null : allowlist.map((domain)=>domain.toLowerCase());
     const pattern = type.isNone(regex) ? null : new RegExp(regex);
     return function matches(entry) {
         const email = getBareEmail(entry);
-        if (allowedDomains !== null) {
-            const domain = email.slice(email.lastIndexOf('@') + 1);
-            if (!allowedDomains.includes(domain)) {
-                return false;
-            }
+        if (allowedDomains !== null && !allowedDomains.includes(getDomain(email))) {
+            return false;
         }
         if (pattern !== null && !pattern.test(email)) {
             return false;
@@ -41,14 +104,13 @@ function createMatcher({ allowlist, regex }) {
     };
 }
 function filterEntries({ entries, matches }) {
-    if (type.isNone(entries)) {
-        return [];
-    }
-    return (type.isArray(entries) ? entries : [
-        entries
-    ]).filter(matches);
+    return splitEntries(entries).filter(matches);
 }
-function applyMailFilter({ filter, mail }) {
+function applyMailFilter({ filter, mail: received }) {
+    const mail = dropInvalidRecipients(received);
+    if (mail === null) {
+        return null;
+    }
     if (type.isNone(filter)) {
         return mail;
     }

package/dist/connections/SMTP/resolveMailFilter.js

@@ -0,0 +1,35 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+// The connection's own filter wins over the current environment's delivery filter
+// (config.environments.<env>.email.filter) when it sets at least one field. `false` turns
+// filtering off, the environment's too — for mail that must reach the real recipient in every
+// environment. An unset connection filter, or one whose fields all resolve to null (a
+// `_secret` that is not set on this deployment, say), falls back to the environment's, so a
+// missing value can never switch the safety net off.
+function setsAField(filter) {
+    if (!type.isObject(filter)) return false;
+    return [
+        'replaceAddress',
+        'allowlist',
+        'regex'
+    ].some((field)=>!type.isNone(filter[field]));
+}
+function resolveMailFilter({ connection, environment }) {
+    if (connection.filter === false) return null;
+    if (setsAField(connection.filter)) return connection.filter;
+    return environment?.email?.filter ?? null;
+}
+export default resolveMailFilter;

package/dist/connections/SMTP/schema.js

@@ -101,12 +101,19 @@ export default {
             description: 'Default email address replies should be sent to.'
         },
         // null allowed on all filter values because they come from _secret;
-        // unset secrets resolve null - an unset filter field is disabled.
+        // unset secrets resolve null - an unset filter field is disabled. An unset
+        // (null) filter falls back to the current environment's email filter;
+        // false turns filtering off, the environment's too. Recipients on the reserved
+        // .invalid domain are always dropped (applyMailFilter.js).
         filter: {
             type: [
                 'object',
-                'null'
+                'null',
+                'boolean'
             ],
+            not: {
+                const: true
+            },
             additionalProperties: false,
             properties: {
                 replaceAddress: {

package/dist/types.js

@@ -16,6 +16,13 @@
     connections: [
         'SMTP'
     ],
+    // Non-scopable: the tenant wall does not cover this type, so its
+    // connections are never scoped and accept no tenant: declaration.
+    connectionMetas: {
+        SMTP: {
+            tenant: false
+        }
+    },
     requests: [
         'SMTPMailSend'
     ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/connection-smtp",
-  "version": "6.0.0",
+  "version": "7.0.0",
   "license": "Apache-2.0",
   "description": "",
   "homepage": "https://lowdefy.com",
@@ -27,8 +27,12 @@
     "url": "https://github.com/lowdefy/lowdefy.git"
   },
   "type": "module",
+  "sideEffects": [
+    "**/*.css"
+  ],
   "exports": {
     "./connections": "./dist/connections.js",
+    "./send": "./dist/connections/SMTP/send.js",
     "./types": "./dist/types.js",
     "./transportSchema": "./dist/connections/SMTP/transportSchema.js"
   },
@@ -36,12 +40,12 @@
     "dist/*"
   ],
   "dependencies": {
-    "@lowdefy/helpers": "6.0.0",
-    "nodemailer": "9.0.3"
+    "@lowdefy/helpers": "7.0.0",
+    "nodemailer": "10.0.13"
   },
   "devDependencies": {
     "@jest/globals": "28.1.3",
-    "@lowdefy/ajv": "6.0.0",
+    "@lowdefy/ajv": "7.0.0",
     "@swc/cli": "0.8.1",
     "@swc/core": "1.15.32",
     "@swc/jest": "0.2.39",