@meith/drivers 0.29.0 → 0.30.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meith/drivers",
-  "version": "0.29.0",
+  "version": "0.30.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -37,11 +37,11 @@
     "nodemailer": "^9.0.5",
     "redis": "^6.2.1",
     "shiki": "^4.4.3",
-    "@meith/attachments": "0.29.0",
-    "@meith/core": "0.29.0",
-    "@meith/db": "0.29.0",
-    "@meith/i18n": "0.29.0",
-    "@meith/settings": "0.29.0"
+    "@meith/attachments": "0.30.0",
+    "@meith/core": "0.30.0",
+    "@meith/db": "0.30.0",
+    "@meith/i18n": "0.30.0",
+    "@meith/settings": "0.30.0"
   },
   "peerDependencies": {
     "next": "16.3.1"

package/src/mail/index.ts

@@ -7,6 +7,13 @@ import {
   mailConfigProblems,
 } from '@meith/settings'
 
+import {
+  assertSafeMailEndpoint,
+  BlockedOutboundError,
+  guardedMailTransport,
+  type HttpMailTransport,
+  mailAllowsPrivateHosts,
+} from '../net/outbound'
 import { formatSender } from './sender'
 import { SmtpMailDriver } from './smtp'
 
@@ -37,15 +44,19 @@ export class MemoryMailDriver implements MailDriver {
 }
 
 export class HttpMailDriver implements MailDriver {
-  constructor(private readonly config: HttpMailConfig) {}
+  constructor(
+    private readonly config: HttpMailConfig,
+    private readonly transport: HttpMailTransport = guardedMailTransport,
+  ) {}
 
   async send(mail: OutgoingMail): Promise<void> {
-    const controller = new AbortController()
-    const timeout = setTimeout(() => controller.abort(), 10_000)
+    const allowPrivateHosts = mailAllowsPrivateHosts()
 
     try {
-      const response = await fetch(this.config.endpoint, {
-        method: 'POST',
+      const url = assertSafeMailEndpoint(this.config.endpoint, allowPrivateHosts)
+
+      const result = await this.transport({
+        url,
         headers: {
           'content-type': 'application/json',
           authorization: `Bearer ${this.config.token}`,
@@ -58,20 +69,26 @@ export class HttpMailDriver implements MailDriver {
           ...(mail.html ? { html: mail.html } : {}),
           ...(mail.replyTo ? { reply_to: mail.replyTo } : {}),
         }),
-        signal: controller.signal,
+        timeoutMs: 10_000,
+        allowPrivateHosts,
       })
 
-      if (!response.ok) {
-        const body = await response.text().catch(() => '')
-        const detail = `${response.status} ${body.slice(0, 200)}`
+      if (result.status >= 200 && result.status < 300) return
 
-        if (response.status >= 400 && response.status < 500 && response.status !== 429) {
-          throw new ConfigurationError(`Mail provider rejected the message: ${detail}`)
-        }
-        throw new Error(`Mail provider error: ${detail}`)
+      logger({ driver: 'http', host: url.host }).warn(
+        { status: result.status, sample: result.diagnostic },
+        'mail provider returned a non-success status',
+      )
+
+      if (result.status >= 400 && result.status < 500 && result.status !== 429) {
+        throw new ConfigurationError(`Mail provider rejected the message (HTTP ${result.status}).`)
+      }
+      throw new Error(`Mail provider error (HTTP ${result.status}).`)
+    } catch (error) {
+      if (error instanceof BlockedOutboundError) {
+        throw new ConfigurationError(error.message, { cause: error })
       }
-    } finally {
-      clearTimeout(timeout)
+      throw error
     }
   }
 }

package/src/mail/smtp.ts

@@ -3,6 +3,7 @@ import nodemailer, { type Transporter } from 'nodemailer'
 import { ConfigurationError, logger, type MailDriver, type OutgoingMail } from '@meith/core'
 import type { SmtpMailConfig } from '@meith/settings'
 
+import { assertSafeSmtpHost, BlockedOutboundError, mailAllowsPrivateHosts } from '../net/outbound'
 import { formatSender } from './sender'
 
 const CONNECTION_TIMEOUT_MS = 10_000
@@ -52,6 +53,15 @@ export class SmtpMailDriver implements MailDriver {
   }
 
   async send(mail: OutgoingMail): Promise<void> {
+    try {
+      await assertSafeSmtpHost(this.config.host, mailAllowsPrivateHosts())
+    } catch (error) {
+      if (error instanceof BlockedOutboundError) {
+        throw new ConfigurationError(error.message, { cause: error })
+      }
+      throw error
+    }
+
     try {
       await this.transport.sendMail({
         from: formatSender(this.config.from, mail.fromName),

package/src/net/outbound.ts

@@ -0,0 +1,61 @@
+import { lookup as dnsLookupAsync } from 'node:dns/promises'
+import { isIP } from 'node:net'
+
+import { env, isProduction } from '@meith/core'
+import {
+  assertAllowedUrl,
+  BlockedOutboundError,
+  guardedRequest,
+  isBlockedAddress,
+} from '@meith/core/outbound'
+
+export { BlockedOutboundError } from '@meith/core/outbound'
+
+export function mailAllowsPrivateHosts(): boolean {
+  return env.MAIL_ALLOW_PRIVATE_HOSTS || !isProduction()
+}
+
+export function assertSafeMailEndpoint(rawUrl: string, allowPrivateHosts: boolean): URL {
+  return assertAllowedUrl(rawUrl, { allowPrivateHosts })
+}
+
+export async function assertSafeSmtpHost(host: string, allowPrivateHosts: boolean): Promise<void> {
+  if (allowPrivateHosts) return
+
+  if (isIP(host) !== 0) {
+    if (isBlockedAddress(host)) {
+      throw new BlockedOutboundError('The SMTP host is a private or internal address.')
+    }
+    return
+  }
+
+  const addresses = await dnsLookupAsync(host, { all: true })
+  if (addresses.some((candidate) => isBlockedAddress(candidate.address))) {
+    throw new BlockedOutboundError('The SMTP host resolves to a private or internal address.')
+  }
+}
+
+export interface MailRequest {
+  readonly url: URL
+  readonly headers: Readonly<Record<string, string>>
+  readonly body: string
+  readonly timeoutMs: number
+  readonly allowPrivateHosts: boolean
+}
+
+export interface MailTransportResult {
+  readonly status: number
+  readonly diagnostic: string
+}
+
+export type HttpMailTransport = (request: MailRequest) => Promise<MailTransportResult>
+
+export const guardedMailTransport: HttpMailTransport = (request) =>
+  guardedRequest({
+    url: request.url,
+    method: 'POST',
+    headers: request.headers,
+    body: request.body,
+    timeoutMs: request.timeoutMs,
+    allowPrivateHosts: request.allowPrivateHosts,
+  })