@mavogel/awscdk-rootmail 0.1.2 → 0.1.4

package/node_modules/nodemailer/dist/esm/dkim/index.d.ts

@@ -0,0 +1,40 @@
+import { type DKIMKey, type DKIMPrivateKey, type DKIMSignOptions } from './sign.js';
+import { PassThrough, type Readable } from 'node:stream';
+/**
+ * A single DKIM signing key
+ */
+export type { DKIMKey, DKIMPrivateKey, DKIMSignOptions };
+/**
+ * Options for the DKIM signer
+ */
+export interface DKIMOptions extends DKIMSignOptions {
+    /** One or more signing keys, used instead of the domainName, keySelector and privateKey options */
+    keys?: DKIMKey | DKIMKey[];
+    /** Directory for buffering large message bodies to disk, no buffering when not set */
+    cacheDir?: string | false;
+    /** Body size in bytes from which the body is buffered to cacheDir, defaults to 10 MB */
+    cacheTreshold?: number;
+    /** Hash algorithm for the body hash and the signature, defaults to sha256 */
+    hashAlgo?: string;
+}
+/**
+ * The signed message as returned by DKIM#sign
+ */
+export interface DKIMSignedStream extends PassThrough {
+    /** true if the message body was buffered to cacheDir while signing */
+    usingCache: boolean;
+}
+declare class DKIM {
+    options: DKIMOptions;
+    keys: DKIMKey[];
+    constructor(options: DKIMOptions);
+    sign(input: Readable | Buffer | string, extraOptions?: DKIMOptions): DKIMSignedStream;
+}
+/**
+ * Type aliases in the layout of @types/nodemailer, so `DKIM.Options` style references keep working
+ */
+declare namespace DKIM {
+    type Options = DKIMOptions;
+    type SingleKeyOptions = Omit<DKIMOptions, 'keys'>;
+}
+export default DKIM;

package/node_modules/nodemailer/{lib → dist/esm}/dkim/index.js

@@ -1,44 +1,22 @@
-'use strict';
-
 // FIXME:
 // replace this Transform mess with a method that pipes input argument to output argument
-
-const MessageParser = require('./message-parser');
-const RelaxedBody = require('./relaxed-body');
-const sign = require('./sign');
-const { PassThrough } = require('stream');
-const fs = require('fs');
-const path = require('path');
-const crypto = require('crypto');
-
+import MessageParser from './message-parser.js';
+import RelaxedBody from './relaxed-body.js';
+import sign from './sign.js';
+import { PassThrough } from 'node:stream';
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { copyOwnKeys } from '../shared/objects.js';
 const DKIM_ALGO = 'sha256';
-const MAX_MESSAGE_SIZE = 2 * 1024 * 1024; // buffer messages larger than this to disk
-
-/*
-// Usage:
-
-let dkim = new DKIM({
-    domainName: 'example.com',
-    keySelector: 'key-selector',
-    privateKey,
-    cacheDir: '/tmp'
-});
-dkim.sign(input).pipe(process.stdout);
-
-// Where inputStream is a rfc822 message (either a stream, string or Buffer)
-// and outputStream is a DKIM signed rfc822 message
-*/
-
+const MAX_MESSAGE_SIZE = 10 * 1024 * 1024; // buffer messages larger than this to disk
 class DKIMSigner {
     constructor(options, keys, input, output) {
         this.options = options || {};
         this.keys = keys;
-
         this.cacheTreshold = Number(this.options.cacheTreshold) || MAX_MESSAGE_SIZE;
         this.hashAlgo = this.options.hashAlgo || DKIM_ALGO;
-
         this.cacheDir = this.options.cacheDir || false;
-
         this.chunks = [];
         this.chunklen = 0;
         this.readPos = 0;
@@ -46,32 +24,26 @@ class DKIMSigner {
             ? path.join(this.cacheDir, 'message.' + Date.now() + '-' + crypto.randomBytes(14).toString('hex'))
             : false;
         this.cache = false;
-
         this.headers = false;
         this.bodyHash = false;
         this.parser = false;
         this.relaxedBody = false;
-
         this.input = input;
         this.output = output;
         this.output.usingCache = false;
-
         this.hasErrored = false;
-
         this.input.on('error', err => {
             this.hasErrored = true;
             this.cleanup();
             output.emit('error', err);
         });
     }
-
     cleanup() {
         if (!this.cache || !this.cachePath) {
             return;
         }
         fs.unlink(this.cachePath, () => false);
     }
-
     createReadCache() {
         // pipe remainings to cache file
         this.cache = fs.createReadStream(this.cachePath);
@@ -84,33 +56,33 @@ class DKIMSigner {
         });
         this.cache.pipe(this.output);
     }
-
     sendNextChunk() {
         if (this.hasErrored) {
             return;
         }
-
         if (this.readPos >= this.chunks.length) {
             if (!this.cache) {
-                return this.output.end();
+                this.output.end();
+                return;
             }
             return this.createReadCache();
         }
         const chunk = this.chunks[this.readPos++];
         if (this.output.write(chunk) === false) {
-            return this.output.once('drain', () => {
+            this.output.once('drain', () => {
                 this.sendNextChunk();
             });
+            return;
         }
         setImmediate(() => this.sendNextChunk());
     }
-
     sendSignedOutput() {
         let keyPos = 0;
         const signNextKey = () => {
             if (keyPos >= this.keys.length) {
                 this.output.write(this.parser.rawHeaders);
-                return setImmediate(() => this.sendNextChunk());
+                setImmediate(() => this.sendNextChunk());
+                return;
             }
             const key = this.keys[keyPos++];
             const dkimField = sign(this.headers, this.hashAlgo, this.bodyHash, {
@@ -123,17 +95,14 @@ class DKIMSigner {
             if (dkimField) {
                 this.output.write(Buffer.from(dkimField + '\r\n'));
             }
-            return setImmediate(signNextKey);
+            setImmediate(signNextKey);
         };
-
         if (this.bodyHash && this.headers) {
             return signNextKey();
         }
-
         this.output.write(this.parser.rawHeaders);
         this.sendNextChunk();
     }
-
     createWriteCache() {
         this.output.usingCache = true;
         // pipe remainings to cache file
@@ -157,21 +126,17 @@ class DKIMSigner {
         this.relaxedBody.removeAllListeners('readable');
         this.relaxedBody.pipe(this.cache);
     }
-
     signStream() {
         this.parser = new MessageParser();
         this.relaxedBody = new RelaxedBody({
             hashAlgo: this.hashAlgo
         });
-
         this.parser.on('headers', value => {
             this.headers = value;
         });
-
         this.relaxedBody.on('hash', value => {
             this.bodyHash = value;
         });
-
         this.relaxedBody.on('readable', () => {
             let chunk;
             if (this.cache) {
@@ -185,49 +150,45 @@ class DKIMSigner {
                 }
             }
         });
-
         this.relaxedBody.on('end', () => {
             if (this.cache) {
                 return;
             }
             this.sendSignedOutput();
         });
-
         this.parser.pipe(this.relaxedBody);
         setImmediate(() => this.input.pipe(this.parser));
     }
 }
-
 class DKIM {
     constructor(options) {
         this.options = options || {};
-        this.keys = [].concat(
-            this.options.keys || {
-                domainName: options.domainName,
-                keySelector: options.keySelector,
-                privateKey: options.privateKey
-            }
-        );
+        this.keys = [].concat(this.options.keys || {
+            domainName: options.domainName,
+            keySelector: options.keySelector,
+            privateKey: options.privateKey
+        });
     }
-
     sign(input, extraOptions) {
         const output = new PassThrough();
         let inputStream = input;
         let writeValue = false;
-
         if (Buffer.isBuffer(input)) {
             writeValue = input;
             inputStream = new PassThrough();
-        } else if (typeof input === 'string') {
+        }
+        else if (typeof input === 'string') {
             writeValue = Buffer.from(input);
             inputStream = new PassThrough();
         }
-
         let options = this.options;
         if (extraOptions && Object.keys(extraOptions).length) {
-            options = Object.assign({}, extraOptions, this.options);
+            // extraOptions is mail.data._dkim, caller supplied message data. An own
+            // "__proto__" key there would let every option this signer reads and the
+            // transport did not set, such as skipFields, answer from the caller
+            options = copyOwnKeys({}, extraOptions);
+            copyOwnKeys(options, this.options);
         }
-
         const signer = new DKIMSigner(options, this.keys, inputStream, output);
         setImmediate(() => {
             signer.signStream();
@@ -237,9 +198,7 @@ class DKIM {
                 });
             }
         });
-
         return output;
     }
 }
-
-module.exports = DKIM;
+export default DKIM;

package/node_modules/nodemailer/dist/esm/dkim/message-parser.d.ts

@@ -0,0 +1,41 @@
+import { Transform, type TransformCallback, type TransformOptions } from 'node:stream';
+/**
+ * A header line as emitted with the 'headers' event
+ */
+export interface MessageParserHeaderLine {
+    /** Lowercase header field name */
+    key: string;
+    /** Full header line, folded continuation lines included, one character per byte ('binary' encoding) */
+    line: string;
+}
+/**
+ * MessageParser instance is a transform stream that separates message headers
+ * from the rest of the body. Headers are emitted with the 'headers' event. Message
+ * body is passed on as the resulting stream.
+ */
+export default class MessageParser extends Transform {
+    lastBytes: Buffer;
+    headersParsed: boolean;
+    headerBytes: number;
+    headerChunks: Buffer[] | null;
+    rawHeaders: Buffer | false;
+    bodySize: number;
+    constructor(options?: TransformOptions);
+    /**
+     * Keeps count of the last 4 bytes in order to detect line breaks on chunk boundaries
+     *
+     * @param data Next data chunk from the stream
+     */
+    updateLastBytes(data: Buffer): void;
+    /**
+     * Finds and removes message headers from the remaining body. We want to keep
+     * headers separated until final delivery to be able to modify these
+     *
+     * @param data Next chunk of data
+     * @return Returns true if headers are already found or false otherwise
+     */
+    checkHeaders(data: Buffer): boolean;
+    _transform(chunk: Buffer | string, encoding: BufferEncoding, callback: TransformCallback): void;
+    _flush(callback: TransformCallback): void;
+    parseHeaders(): MessageParserHeaderLine[];
+}

package/node_modules/nodemailer/{lib → dist/esm}/dkim/message-parser.js

@@ -1,13 +1,10 @@
-'use strict';
-
-const { Transform } = require('stream');
-
+import { Transform } from 'node:stream';
 /**
  * MessageParser instance is a transform stream that separates message headers
  * from the rest of the body. Headers are emitted with the 'headers' event. Message
  * body is passed on as the resulting stream.
  */
-class MessageParser extends Transform {
+export default class MessageParser extends Transform {
     constructor(options) {
         super(options);
         this.lastBytes = Buffer.alloc(4);
@@ -17,46 +14,42 @@ class MessageParser extends Transform {
         this.rawHeaders = false;
         this.bodySize = 0;
     }
-
     /**
      * Keeps count of the last 4 bytes in order to detect line breaks on chunk boundaries
      *
-     * @param {Buffer} data Next data chunk from the stream
+     * @param data Next data chunk from the stream
      */
     updateLastBytes(data) {
         const lblen = this.lastBytes.length;
         const nblen = Math.min(data.length, lblen);
-
         // shift existing bytes
         for (let i = 0, len = lblen - nblen; i < len; i++) {
             this.lastBytes[i] = this.lastBytes[i + nblen];
         }
-
         // add new bytes
         for (let i = 1; i <= nblen; i++) {
             this.lastBytes[lblen - i] = data[data.length - i];
         }
     }
-
     /**
      * Finds and removes message headers from the remaining body. We want to keep
      * headers separated until final delivery to be able to modify these
      *
-     * @param {Buffer} data Next chunk of data
-     * @return {Boolean} Returns true if headers are already found or false otherwise
+     * @param data Next chunk of data
+     * @return Returns true if headers are already found or false otherwise
      */
     checkHeaders(data) {
         if (this.headersParsed) {
             return true;
         }
-
         const lblen = this.lastBytes.length;
         let headerPos = 0;
         for (let i = 0, len = this.lastBytes.length + data.length; i < len; i++) {
             let chr;
             if (i < lblen) {
                 chr = this.lastBytes[i];
-            } else {
+            }
+            else {
                 chr = data[i - lblen];
             }
             if (chr === 0x0a && i) {
@@ -67,7 +60,8 @@ class MessageParser extends Transform {
                     headerPos = i - lblen + 1;
                     this.headerBytes += headerPos;
                     break;
-                } else if (pr1 === 0x0d && pr2 === 0x0a) {
+                }
+                else if (pr1 === 0x0d && pr2 === 0x0a) {
                     this.headersParsed = true;
                     headerPos = i - lblen + 1;
                     this.headerBytes += headerPos;
@@ -75,13 +69,12 @@ class MessageParser extends Transform {
                 }
             }
         }
-
         if (this.headersParsed) {
             this.headerChunks.push(data.slice(0, headerPos));
             this.rawHeaders = Buffer.concat(this.headerChunks, this.headerBytes);
             this.headerChunks = null;
             this.emit('headers', this.parseHeaders());
-            if (data.length - 1 > headerPos) {
+            if (data.length > headerPos) {
                 const chunk = data.slice(headerPos);
                 this.bodySize += chunk.length;
                 // this would be the first chunk of data sent downstream
@@ -89,66 +82,61 @@ class MessageParser extends Transform {
             }
             return false;
         }
-
         this.headerBytes += data.length;
         this.headerChunks.push(data);
-
         // store last 4 bytes to catch header break
         this.updateLastBytes(data);
-
         return false;
     }
-
     _transform(chunk, encoding, callback) {
         if (!chunk || !chunk.length) {
             return callback();
         }
-
         if (typeof chunk === 'string') {
             chunk = Buffer.from(chunk, encoding);
         }
-
         let headersFound;
-
         try {
             headersFound = this.checkHeaders(chunk);
-        } catch (E) {
+        }
+        catch (E) {
             return callback(E);
         }
-
         if (headersFound) {
             this.bodySize += chunk.length;
             this.push(chunk);
         }
-
         setImmediate(callback);
     }
-
     _flush(callback) {
         if (this.headerChunks) {
-            const chunk = Buffer.concat(this.headerChunks, this.headerBytes);
-            this.bodySize += chunk.length;
-            this.push(chunk);
+            // no empty line was seen, so the message consists of headers only
+            this.rawHeaders = Buffer.concat(this.headerChunks, this.headerBytes);
             this.headerChunks = null;
+            this.emit('headers', this.parseHeaders());
         }
         callback();
     }
-
     parseHeaders() {
-        const lines = (this.rawHeaders || '').toString().split(/\r?\n/);
+        // the header bytes are kept as they are, one character per byte, so the
+        // signature covers exactly the bytes the receiving side canonicalizes
+        // Only SP and HTAB fold a line, and only they are trimmed from the field name, the
+        // same whitespace the relaxed canonicalization in sign.ts works with
+        const lines = (this.rawHeaders || Buffer.alloc(0)).toString('binary').split(/\r?\n/);
         for (let i = lines.length - 1; i > 0; i--) {
-            if (/^\s/.test(lines[i])) {
+            if (/^[ \t]/.test(lines[i])) {
                 lines[i - 1] += '\n' + lines[i];
                 lines.splice(i, 1);
             }
         }
         return lines
-            .filter(line => line.trim())
+            .filter(line => /[^ \t\r]/.test(line))
             .map(line => ({
-                key: line.substr(0, line.indexOf(':')).trim().toLowerCase(),
-                line
-            }));
+            key: line
+                .substr(0, line.indexOf(':'))
+                .replace(/^[ \t]+|[ \t]+$/g, '')
+                .toLowerCase(),
+            line
+        }));
     }
 }
-
-module.exports = MessageParser;

package/node_modules/nodemailer/dist/esm/dkim/relaxed-body.d.ts

@@ -0,0 +1,46 @@
+import { Transform, type TransformCallback } from 'node:stream';
+import crypto from 'node:crypto';
+/**
+ * Options for the relaxed body hash stream
+ */
+export interface RelaxedBodyOptions {
+    /** Hash algorithm for the body hash, defaults to sha256 */
+    hashAlgo?: string;
+    /** Collect the canonicalized body and emit it with the 'hash' event */
+    debug?: boolean;
+}
+/**
+ * Passes the message body through unchanged and hashes its relaxed
+ * canonicalization (RFC 6376 section 3.4.4) on the side: whitespace at the end
+ * of a line is dropped, runs of whitespace within a line become a single space,
+ * every line ends with CRLF, empty lines at the end of the body are ignored and
+ * a non-empty body always ends with CRLF. Bytes are canonicalized as they arrive,
+ * so a line of any length costs constant memory.
+ */
+export default class RelaxedBody extends Transform {
+    bodyHash: crypto.Hash;
+    /** Bytes of the original body seen so far */
+    byteLength: number;
+    debug: boolean | undefined;
+    _debugBody: Buffer[] | false;
+    /** The current line has bytes that survive canonicalization */
+    _lineHasContent: boolean;
+    /** Whitespace that ends up as a single space if more content follows on the line */
+    _pendingWsp: boolean;
+    /** A CR that is part of the line ending if LF follows, otherwise content */
+    _pendingCr: boolean;
+    /** Empty lines that are hashed only once a non-empty line follows them */
+    _pendingEmptyLines: number;
+    constructor(options?: RelaxedBodyOptions);
+    _hashCanonical(data: Buffer): void;
+    _hashEmptyLines(): void;
+    /**
+     * Writes a content byte, with the space a pending run of whitespace collapses to,
+     * into the output buffer and returns the new write position. Kept a method rather
+     * than a closure so the write position stays a plain local in the byte loop
+     */
+    _emitContent(out: Buffer, outPos: number, c: number): number;
+    updateHash(chunk: Buffer, final?: boolean): void;
+    _transform(chunk: Buffer | string, encoding: BufferEncoding, callback: TransformCallback): void;
+    _flush(callback: TransformCallback): void;
+}

package/node_modules/nodemailer/dist/esm/dkim/relaxed-body.js

@@ -0,0 +1,135 @@
+// streams through a message body and calculates relaxed body hash
+import { Transform } from 'node:stream';
+import crypto from 'node:crypto';
+const CHAR_CR = 0x0d;
+const CHAR_LF = 0x0a;
+const CHAR_SPACE = 0x20;
+const CHAR_TAB = 0x09;
+const CRLF = Buffer.from('\r\n');
+// a run of empty lines is hashed from this buffer in slices
+const EMPTY_LINES = Buffer.alloc(4096, CRLF);
+/**
+ * Passes the message body through unchanged and hashes its relaxed
+ * canonicalization (RFC 6376 section 3.4.4) on the side: whitespace at the end
+ * of a line is dropped, runs of whitespace within a line become a single space,
+ * every line ends with CRLF, empty lines at the end of the body are ignored and
+ * a non-empty body always ends with CRLF. Bytes are canonicalized as they arrive,
+ * so a line of any length costs constant memory.
+ */
+export default class RelaxedBody extends Transform {
+    constructor(options) {
+        super();
+        options = options || {};
+        this.bodyHash = crypto.createHash(options.hashAlgo || 'sha256');
+        this.byteLength = 0;
+        this.debug = options.debug;
+        this._debugBody = options.debug ? [] : false;
+        this._lineHasContent = false;
+        this._pendingWsp = false;
+        this._pendingCr = false;
+        this._pendingEmptyLines = 0;
+    }
+    _hashCanonical(data) {
+        if (!data.length) {
+            return;
+        }
+        this.bodyHash.update(data);
+        if (this._debugBody) {
+            this._debugBody.push(Buffer.from(data));
+        }
+    }
+    _hashEmptyLines() {
+        while (this._pendingEmptyLines > 0) {
+            const count = Math.min(this._pendingEmptyLines, EMPTY_LINES.length / 2);
+            this._hashCanonical(EMPTY_LINES.subarray(0, count * 2));
+            this._pendingEmptyLines -= count;
+        }
+    }
+    /**
+     * Writes a content byte, with the space a pending run of whitespace collapses to,
+     * into the output buffer and returns the new write position. Kept a method rather
+     * than a closure so the write position stays a plain local in the byte loop
+     */
+    _emitContent(out, outPos, c) {
+        if (!this._lineHasContent) {
+            if (this._pendingEmptyLines) {
+                // the first content byte of a line is where the empty lines before it
+                // become part of the body, so hash what is in the buffer before them
+                this._hashCanonical(out.subarray(0, outPos));
+                outPos = 0;
+                this._hashEmptyLines();
+            }
+            this._lineHasContent = true;
+        }
+        if (this._pendingWsp) {
+            out[outPos++] = CHAR_SPACE;
+            this._pendingWsp = false;
+        }
+        out[outPos++] = c;
+        return outPos;
+    }
+    updateHash(chunk, final) {
+        // every byte contributes itself at most once, plus a CR for a bare LF
+        // and, once per chunk, a pending space and CR carried over from before
+        const out = Buffer.allocUnsafe(chunk.length * 2 + 2);
+        let outPos = 0;
+        for (let i = 0; i < chunk.length; i++) {
+            const c = chunk[i];
+            if (c === CHAR_LF) {
+                // end of line, a CR right before it and any trailing whitespace are dropped
+                if (this._lineHasContent) {
+                    out[outPos++] = CHAR_CR;
+                    out[outPos++] = CHAR_LF;
+                    this._lineHasContent = false;
+                }
+                else {
+                    this._pendingEmptyLines++;
+                }
+                this._pendingWsp = false;
+                this._pendingCr = false;
+                continue;
+            }
+            if (this._pendingCr) {
+                // not followed by LF, so the CR is content
+                outPos = this._emitContent(out, outPos, CHAR_CR);
+                this._pendingCr = false;
+            }
+            if (c === CHAR_CR) {
+                this._pendingCr = true;
+            }
+            else if (c === CHAR_SPACE || c === CHAR_TAB) {
+                this._pendingWsp = true;
+            }
+            else {
+                outPos = this._emitContent(out, outPos, c);
+            }
+        }
+        if (final && this._pendingCr) {
+            // a CR at the very end of the body is content
+            outPos = this._emitContent(out, outPos, CHAR_CR);
+            this._pendingCr = false;
+        }
+        this._hashCanonical(out.subarray(0, outPos));
+    }
+    _transform(chunk, encoding, callback) {
+        if (!chunk || !chunk.length) {
+            return callback();
+        }
+        if (typeof chunk === 'string') {
+            chunk = Buffer.from(chunk, encoding);
+        }
+        this.updateHash(chunk);
+        this.byteLength += chunk.length;
+        this.push(chunk);
+        callback();
+    }
+    _flush(callback) {
+        this.updateHash(Buffer.alloc(0), true);
+        if (this._lineHasContent) {
+            // the body does not end with a line break, add one
+            this._hashCanonical(CRLF);
+        }
+        this.emit('hash', this.bodyHash.digest('base64'), this.debug ? Buffer.concat(this._debugBody) : false);
+        callback();
+    }
+}