@open-workspace/email 0.0.0-stage → 0.1.0

package/worker/mail/remote-proxy.ts

@@ -0,0 +1,140 @@
+const BLOCKED_HOST_SUFFIXES = [".localhost", ".local", ".internal"];
+const BLOCKED_HOSTS = new Set([
+  "localhost",
+  "metadata.google.internal",
+  "metadata",
+]);
+
+const PRIVATE_IPV4 =
+  /^(?:0\.|10\.|127\.|169\.254\.|172\.(?:1[6-9]|2\d|3[01])\.|192\.168\.|100\.(?:6[4-9]|[7-9]\d|1[01]\d|12[0-7])\.)/u;
+
+export const PROXYABLE_REMOTE_MEDIA_TYPES = new Set([
+  "image/apng",
+  "image/avif",
+  "image/gif",
+  "image/jpeg",
+  "image/jpg",
+  "image/png",
+  "image/webp",
+]);
+
+export const MAX_REMOTE_PROXY_BYTES = 5 * 1024 * 1024;
+export const REMOTE_PROXY_TIMEOUT_MS = 12_000;
+export const REMOTE_PROXY_MAX_REDIRECTS = 3;
+
+function isIpv4(hostname: string) {
+  return /^(?:\d{1,3}\.){3}\d{1,3}$/u.test(hostname);
+}
+
+function isIpv6(hostname: string) {
+  return hostname.includes(":");
+}
+
+function isBlockedIp(hostname: string) {
+  if (isIpv4(hostname)) {
+    return PRIVATE_IPV4.test(hostname) || hostname === "255.255.255.255";
+  }
+  if (isIpv6(hostname)) {
+    const normalized = hostname.toLowerCase().replace(/^\[|\]$/gu, "");
+    return (
+      normalized === "::1"
+      || normalized === "::"
+      || normalized.startsWith("fc")
+      || normalized.startsWith("fd")
+      || normalized.startsWith("fe8")
+      || normalized.startsWith("fe9")
+      || normalized.startsWith("fea")
+      || normalized.startsWith("feb")
+      || normalized.startsWith("::ffff:127.")
+      || normalized.startsWith("::ffff:10.")
+      || normalized.startsWith("::ffff:192.168.")
+    );
+  }
+  return false;
+}
+
+export function assertProxyableRemoteUrl(value: string): URL {
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("Remote URL is invalid");
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error("Only http(s) remote URLs are allowed");
+  }
+  if (url.username || url.password) {
+    throw new Error("Remote URLs must not include credentials");
+  }
+  const host = url.hostname.toLowerCase();
+  if (!host || BLOCKED_HOSTS.has(host)) {
+    throw new Error("Remote host is not allowed");
+  }
+  if (BLOCKED_HOST_SUFFIXES.some((suffix) => host.endsWith(suffix))) {
+    throw new Error("Remote host is not allowed");
+  }
+  if (isBlockedIp(host)) {
+    throw new Error("Remote host is not allowed");
+  }
+  return url;
+}
+
+export function mediaType(contentType: string | null) {
+  return contentType?.split(";", 1)[0]?.trim().toLowerCase() ?? "";
+}
+
+export function isProxyableRemoteMediaType(contentType: string | null) {
+  const type = mediaType(contentType);
+  if (PROXYABLE_REMOTE_MEDIA_TYPES.has(type)) return true;
+  // Some CDNs send image/jpg; normalize already in set. image/x-png etc. rejected.
+  return false;
+}
+
+export async function fetchProxiedRemoteMedia(remoteUrl: string) {
+  let current = assertProxyableRemoteUrl(remoteUrl);
+  for (let hop = 0; hop <= REMOTE_PROXY_MAX_REDIRECTS; hop += 1) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), REMOTE_PROXY_TIMEOUT_MS);
+    let response: Response;
+    try {
+      response = await fetch(current.toString(), {
+        method: "GET",
+        redirect: "manual",
+        signal: controller.signal,
+        headers: {
+          accept: "image/avif,image/webp,image/apng,image/*,*/*;q=0.8",
+          "user-agent": "OpenWorkspaceMailProxy/1.0",
+        },
+      });
+    } finally {
+      clearTimeout(timer);
+    }
+
+    if ([301, 302, 303, 307, 308].includes(response.status)) {
+      const location = response.headers.get("location");
+      if (!location) throw new Error("Remote redirect is missing a location");
+      current = assertProxyableRemoteUrl(new URL(location, current).toString());
+      continue;
+    }
+
+    if (!response.ok) {
+      throw new Error(`Remote fetch failed (${response.status})`);
+    }
+    if (!isProxyableRemoteMediaType(response.headers.get("content-type"))) {
+      throw new Error("Remote content type is not an allowed image");
+    }
+    const lengthHeader = response.headers.get("content-length");
+    if (lengthHeader && Number(lengthHeader) > MAX_REMOTE_PROXY_BYTES) {
+      throw new Error("Remote content is too large");
+    }
+    const buffer = await response.arrayBuffer();
+    if (buffer.byteLength > MAX_REMOTE_PROXY_BYTES) {
+      throw new Error("Remote content is too large");
+    }
+    return {
+      body: buffer,
+      contentType: mediaType(response.headers.get("content-type")),
+    };
+  }
+  throw new Error("Too many remote redirects");
+}

package/worker/mail/reply-plan.ts

@@ -0,0 +1,136 @@
+import { normalizeEmail, normalizeMailboxAddress } from "@open-workspace/core/worker/lib/ids.ts";
+import type { MailAddress } from "../mailbox/model";
+import type { Email } from "../mailbox/schema";
+import type { ReplyAction, ReplyPlan } from "../../shared/mail";
+import { uniqueParticipantAddresses } from "./participants";
+
+export type {
+  ReplyAction,
+  ReplyActionMode,
+  ReplyPlan,
+} from "../../shared/mail";
+
+function uniqueAddresses(values: MailAddress[], ownAddress: string) {
+  return uniqueParticipantAddresses(values, ownAddress);
+}
+
+function without(values: string[], excluded: string[]) {
+  const blocked = new Set(excluded.map(normalizeEmail));
+  return values.filter((value) => !blocked.has(normalizeEmail(value)));
+}
+
+type ReplySource = Pick<
+  Email,
+  | "direction"
+  | "messageIdHeader"
+  | "transportState"
+  | "fromJson"
+  | "replyToJson"
+  | "toJson"
+  | "ccJson"
+  | "listId"
+  | "listPostAddress"
+>;
+
+export function canReplyFrom(email: Pick<ReplySource, "direction" | "messageIdHeader" | "transportState">) {
+  if (email.direction === "incoming") return true;
+  return Boolean(email.messageIdHeader)
+    && email.transportState === "submitted";
+}
+
+export function buildReplyPlan(ownAddress: string, email: ReplySource): ReplyPlan {
+  if (email.direction === "outgoing") {
+    const to = uniqueAddresses(email.toJson, ownAddress);
+    const cc = without(uniqueAddresses(email.ccJson, ownAddress), to);
+    const participants = [...to, ...cc];
+    return {
+      defaultMode: "continue",
+      isGroup: participants.length > 1,
+      participants,
+      actions: canReplyFrom(email)
+        ? [{
+            mode: "continue",
+            label: "Continue",
+            to,
+            cc,
+          }]
+        : [],
+    };
+  }
+
+  // List managers commonly rewrite Reply-To to the list itself. A private
+  // reply must still target the actual author; List-Post is handled separately.
+  const replyTargets = uniqueAddresses(
+    email.listId
+      ? email.fromJson
+      : email.replyToJson.length ? email.replyToJson : email.fromJson,
+    ownAddress,
+  );
+  const visibleParticipants = uniqueAddresses(
+    [
+      ...email.fromJson,
+      ...email.toJson,
+      ...email.ccJson,
+    ],
+    ownAddress,
+  );
+  const replyAllParticipants = uniqueAddresses(
+    [
+      ...(email.listId
+        ? email.fromJson
+        : email.replyToJson.length ? email.replyToJson : email.fromJson),
+      ...email.toJson,
+      ...email.ccJson,
+    ],
+    ownAddress,
+  );
+  const visibleIsGroup = Boolean(email.listId) || replyAllParticipants.length > 1;
+  const own = normalizeMailboxAddress(ownAddress);
+  const visibleRecipients = [...email.toJson, ...email.ccJson].some(
+    (recipient) => normalizeMailboxAddress(recipient.address) === own,
+  );
+  const undisclosedLocalRecipient = !email.listId && !visibleRecipients;
+  const isGroup = visibleIsGroup && !undisclosedLocalRecipient;
+  const actions: ReplyAction[] = [{
+    mode: "reply",
+    label: "Reply",
+    to: replyTargets,
+    cc: [],
+  }];
+  const listTargets = uniqueAddresses(
+    email.listPostAddress
+      ? [{ address: email.listPostAddress, name: null }]
+      : [],
+    ownAddress,
+  ).slice(0, 1);
+  if (!email.listId && visibleIsGroup) {
+    actions.push({
+      mode: "reply_all",
+      label: "Reply all",
+      to: replyTargets,
+      cc: without(replyAllParticipants, replyTargets),
+    });
+  }
+
+  if (email.listId && listTargets.length) {
+    actions.push({
+      mode: "reply_list",
+      label: "Reply to list",
+      to: listTargets,
+      cc: [],
+    });
+  }
+
+  return {
+    defaultMode: listTargets.length
+      ? "reply_list"
+      : email.listId
+        ? "reply"
+        : undisclosedLocalRecipient
+          ? "reply"
+          : isGroup ? "reply_all" : "reply",
+    isGroup,
+    participants: undisclosedLocalRecipient ? replyTargets : visibleParticipants,
+    actions,
+  };
+}

package/worker/mail/reported-messages.ts

@@ -0,0 +1,68 @@
+import { and, eq } from "drizzle-orm";
+import type { MessageSecurity } from "../../shared/mail-authentication";
+import type { ReportSnapshot } from "../../shared/mail-feedback";
+import type { SenderIntel } from "../../shared/mail-sender-intel";
+import { createDb } from "@open-workspace/core/worker/db/client.ts";
+import { reportedMessages } from "../db/schema";
+import { createId } from "@open-workspace/core/worker/lib/ids.ts";
+import type { Email } from "../mailbox/schema";
+import { linkDomains } from "./link-domains";
+
+export function reportSnapshot(input: {
+  email: Email;
+  security: MessageSecurity | null;
+  intel: SenderIntel | null;
+  bodyHtml: string | null;
+}): ReportSnapshot {
+  const { email, security, intel } = input;
+  const ai = email.aiClassificationJson;
+  return {
+    fromName: email.fromJson[0]?.name ?? null,
+    replyTo: email.replyToJson.map((item) => item.address),
+    to: [...email.toJson, ...email.ccJson].map((item) => item.address).slice(0, 20),
+    verdict: security?.verdict ?? "unavailable",
+    verdictReason: security?.verdictReason ?? "missing_results",
+    warnings: security?.warnings.map((warning) => warning.kind) ?? [],
+    spamScore: email.authenticationResultsJson?.source === "headers"
+      ? email.authenticationResultsJson.spamScore
+      : null,
+    ip: intel?.ip ?? null,
+    network: intel?.network.asn ? `AS${intel.network.asn} ${intel.network.asName ?? ""}`.trim() : null,
+    country: intel?.network.country ?? null,
+    ai: ai ? { spam: ai.spam, spamConfidence: ai.spamConfidence, reason: ai.reason } : null,
+    linkDomains: linkDomains({ html: input.bodyHtml, text: [email.bodyText] }),
+    preview: email.preview.slice(0, 280),
+  };
+}
+
+/** One admin report per message and mailbox; reporting again keeps the first one. */
+export async function recordReportedMessage(binding: D1Database, input: {
+  mailboxId: string;
+  email: Email;
+  reporterUserId: string;
+  snapshot: ReportSnapshot;
+}) {
+  const from = input.email.fromJson[0]?.address.toLocaleLowerCase() ?? "unknown@invalid";
+  const db = createDb(binding);
+  const id = createId("rpt");
+  await db.insert(reportedMessages).values({
+    id,
+    mailboxId: input.mailboxId,
+    emailId: input.email.id,
+    reporterUserId: input.reporterUserId,
+    senderAddress: from,
+    senderDomain: from.slice(from.lastIndexOf("@") + 1),
+    subject: input.email.subject,
+    receivedAt: input.email.timelineAt,
+    snapshotJson: input.snapshot,
+    status: "open",
+    createdAt: new Date(),
+  }).onConflictDoNothing();
+  const [row] = await db
+    .select({ id: reportedMessages.id })
+    .from(reportedMessages)
+    .where(and(eq(reportedMessages.mailboxId, input.mailboxId), eq(reportedMessages.emailId, input.email.id)))
+    .limit(1);
+  return row?.id ?? id;
+}
+

package/worker/mail/rfc.ts

@@ -0,0 +1,73 @@
+import type { Header } from "postal-mime";
+import { normalizeEmail } from "@open-workspace/core/worker/lib/ids.ts";
+import type { MailAddress } from "../mailbox/model";
+
+const MAX_REFERENCE_IDS = 100;
+const MAX_REFERENCE_BYTES = 12 * 1024;
+const MAX_MESSAGE_ID_BYTES = 900;
+const textEncoder = new TextEncoder();
+
+export function boundedMessageIds(values: string[]) {
+  const unique = [...new Set(values.map((item) => item.trim()).filter(Boolean))];
+  const newestFirst: string[] = [];
+  let bytes = 0;
+  for (let index = unique.length - 1; index >= 0; index -= 1) {
+    if (newestFirst.length >= MAX_REFERENCE_IDS) break;
+    const value = unique[index]!;
+    const valueBytes = textEncoder.encode(value).byteLength;
+    if (valueBytes > MAX_MESSAGE_ID_BYTES) continue;
+    const nextBytes = valueBytes + (newestFirst.length ? 1 : 0);
+    if (bytes + nextBytes > MAX_REFERENCE_BYTES) continue;
+    newestFirst.push(value);
+    bytes += nextBytes;
+  }
+  return newestFirst.reverse();
+}
+
+export function messageIds(value: string | undefined) {
+  if (!value) return [];
+  const bracketed = value.match(/<[^<>]+>/gu);
+  const values = bracketed ?? value.split(/\s+/u);
+  return boundedMessageIds(values);
+}
+
+export function replyThreadHeaders(parent: {
+  messageIdHeader: string | null;
+  inReplyToJson: string[];
+  referencesJson: string[];
+}) {
+  const parentMessageId = messageIds(parent.messageIdHeader ?? undefined)[0];
+  if (!parentMessageId) return { inReplyTo: [], references: [] };
+  const ancestry = parent.referencesJson.length
+    ? parent.referencesJson
+    : parent.inReplyToJson.length === 1 ? parent.inReplyToJson : [];
+  return {
+    inReplyTo: [parentMessageId],
+    references: boundedMessageIds([...ancestry, parentMessageId]),
+  };
+}
+
+export function address(address: string, name: string | null = null): MailAddress {
+  return { address: normalizeEmail(address), name: name?.trim() || null };
+}
+
+export function headerValue(headers: Header[], name: string) {
+  return headers.find((header) => header.key === name)?.value.trim() || null;
+}
+
+export function listId(headers: Header[]) {
+  const value = headerValue(headers, "list-id");
+  return value?.match(/<([^<>]+)>/u)?.[1] ?? value;
+}
+
+export function listPostAddress(value: string | null | undefined) {
+  if (!value) return null;
+  const match = /<mailto:([^?>]+)(?:\?[^>]*)?>/iu.exec(value);
+  if (!match?.[1]) return null;
+  try {
+    return normalizeEmail(decodeURIComponent(match[1]));
+  } catch {
+    // Invalid list metadata must not make the containing message unreadable.
+    return null;
+  }
+}