@push.rocks/smartmta 11.1.0 → 13.0.0

package/ts/mail/routing/classes.unified.email.server.ts

@@ -1187,6 +1187,9 @@ export class UnifiedEmailServer extends EventEmitter {
         envelopeFrom: envelope.from,
         envelopeTo: [...envelope.to],
         rawMessageBase64: rawMessage.toString('base64'),
+        // Server and queue raw sends are always DKIM-signed; only a direct
+        // bridge caller can request an unsigned relay.
+        signing: 'dkim',
         dkim,
       }),
     });
@@ -2475,22 +2478,37 @@ export class UnifiedEmailServer extends EventEmitter {
   }
 
   /**
-   * Extract every mailbox address from the parsed From header. The Email
-   * abstraction keeps only the first From mailbox, which is not sufficient
-   * for scope enforcement: `From: allowed@a.com, victim@b.com` must not
-   * pass. Parsing stops at the first CRLFCRLF header boundary when present
-   * (the Rust receiver normalizes line endings to CRLF); a bodyless message
-   * without one is parsed whole.
+   * The mailbox addresses of every From header field, one list per field in
+   * message order. Groups are flattened into their member mailboxes, and a
+   * repeated From field is kept rather than collapsed to one occurrence,
+   * because scope enforcement and Email.from must see every mailbox a
+   * recipient's client might display. A field that yields no mailbox, such
+   * as an empty group or an encoded word in place of an address, gives an
+   * empty list.
    */
-  private async parseHeaderFromMailboxes(rawMessage: Buffer): Promise<string[]> {
+  private parseFromHeaderFields(
+    headers: ReadonlyArray<{ key: string; value: string }>,
+  ): string[][] {
+    return headers
+      .filter((header) => header.key === 'from')
+      .map((header) =>
+        plugins.smartmail.parseAddressList(header.value).map((mailbox) => mailbox.email),
+      );
+  }
+
+  /**
+   * The From header fields of the header section of a raw message, see
+   * parseFromHeaderFields. Parsing stops at the first CRLFCRLF header
+   * boundary when present (the Rust receiver normalizes line endings to
+   * CRLF); a bodyless message without one is parsed whole.
+   */
+  private async parseHeaderFromFields(rawMessage: Buffer): Promise<string[][]> {
     const headerBoundary = rawMessage.indexOf('\r\n\r\n');
     const headerSection = headerBoundary === -1
       ? rawMessage
       : rawMessage.subarray(0, headerBoundary + 4);
-    const parsed = await plugins.mailparser.simpleParser(headerSection);
-    return ((parsed.from as any)?.value || [])
-      .map((mailbox: any) => mailbox?.address)
-      .filter(Boolean) as string[];
+    const parsed = await plugins.smartmail.parseMailMessage(headerSection);
+    return this.parseFromHeaderFields(parsed.headers);
   }
 
   /**
@@ -2516,28 +2534,36 @@ export class UnifiedEmailServer extends EventEmitter {
     if (resolved.kind === 'unrestricted') return null;
     if (resolved.kind === 'refused') return UnifiedEmailServer.authScopeUnavailableDecision();
     const scope = resolved.scope;
-    let fromMailboxes: string[];
+    const notPermitted: ISmtpDecision = {
+      accepted: false,
+      smtpCode: 553,
+      smtpMessage: `5.7.1 Header From address not permitted for authenticated user ${username}`,
+    };
+    let fromFields: string[][];
     try {
-      fromMailboxes = await this.parseHeaderFromMailboxes(rawMessage);
+      fromFields = await this.parseHeaderFromFields(rawMessage);
     } catch {
-      fromMailboxes = [];
+      // A header section that cannot be read cannot be shown to be in scope
+      return notPermitted;
     }
-    if (fromMailboxes.length === 0) {
-      // No parsable From header: Email.from falls back to the envelope
-      // MAIL FROM, which resolveRecipientPolicy has already scope-checked.
+    let fromMailboxes: string[];
+    if (fromFields.length === 0) {
+      // A message without a From field is accepted deliberately: Email.from
+      // falls back to the envelope MAIL FROM, which resolveRecipientPolicy has
+      // already scope-checked, and no other sender identity is displayed.
       fromMailboxes = [email.getFromAddress()];
+    } else if (fromFields.some((field) => field.length === 0)) {
+      // A From field without a mailbox, such as an empty group or an encoded
+      // word in place of the address, still displays an identity this check
+      // cannot verify.
+      return notPermitted;
+    } else {
+      fromMailboxes = fromFields.flat();
     }
     const outOfScope = fromMailboxes.find(
       (mailbox) => !this.matchesScopePatterns(mailbox, scope.senders),
     );
-    if (outOfScope === undefined) {
-      return null;
-    }
-    return {
-      accepted: false,
-      smtpCode: 553,
-      smtpMessage: `5.7.1 Header From address not permitted for authenticated user ${username}`,
-    };
+    return outOfScope === undefined ? null : notPermitted;
   }
 
   private getRecipientValidationTimeoutMs(): number {
@@ -3499,37 +3525,38 @@ export class UnifiedEmailServer extends EventEmitter {
 
   private async createEmailFromBuffer(emailData: Buffer, session: IExtendedSmtpSession): Promise<Email> {
     try {
-      const parsed = await plugins.mailparser.simpleParser(emailData);
+      // Forwarded messages stay attachments of their bytes, so a relay hands them on unchanged
+      const parsed = await plugins.smartmail.parseMailMessage(emailData, { rfc822Attachments: true });
+      const headerFromMailboxes = this.parseFromHeaderFields(parsed.headers).flat();
       const envelopeRecipients = session.envelope.rcptTo.map(recipient => recipient.address);
-      const parsedTo = ((parsed.to as any)?.value || [])
-        .map((recipient: any) => recipient.address)
-        .filter(Boolean) as string[];
-      const parsedCc = ((parsed.cc as any)?.value || [])
-        .map((recipient: any) => recipient.address)
-        .filter(Boolean) as string[];
-      const parsedHeaders: Record<string, string> = {};
-      for (const [headerName, headerValue] of parsed.headers.entries()) {
-        if (this.isStandardParsedHeader(headerName)) {
+      const parsedHeaders = new Map<string, string>();
+      for (const header of parsed.headers) {
+        if (this.isStandardParsedHeader(header.key)) {
           continue;
         }
-        parsedHeaders[headerName] = this.stringifyParsedHeaderValue(headerValue);
+        // Raw values as written; a repeated field joins its values with ', '
+        const previous = parsedHeaders.get(header.key);
+        parsedHeaders.set(header.key, previous === undefined ? header.value : `${previous}, ${header.value}`);
       }
       return new Email({
-        from: parsed.from?.value[0]?.address || session.envelope.mailFrom.address,
+        // The first mailbox of the From fields in message order, groups flattened
+        from: headerFromMailboxes[0] || session.envelope.mailFrom.address,
         to: envelopeRecipients.length > 0
           ? envelopeRecipients
-          : parsedTo,
-        cc: parsedCc,
+          : parsed.to.map(recipient => recipient.email),
+        cc: parsed.cc.map(recipient => recipient.email),
         bcc: [],
         subject: parsed.subject || '',
-        text: parsed.text || '',
+        // A message that carries only HTML is read and scanned through its text
+        text: parsed.text ?? (parsed.html ? plugins.smartmail.htmlToText(parsed.html) : ''),
         html: parsed.html || undefined,
-        headers: parsedHeaders,
-        attachments: parsed.attachments?.map(att => ({
-          filename: att.filename || '',
-          content: att.content,
-          contentType: att.contentType
-        })) || []
+        headers: Object.fromEntries(parsedHeaders),
+        attachments: parsed.attachments.map(attachment => ({
+          filename: attachment.filename || '',
+          content: Buffer.from(attachment.content),
+          contentType: attachment.contentType,
+          ...(attachment.contentId ? { contentId: attachment.contentId } : {}),
+        })),
       });
     } catch (error) {
       logger.log('error', `Error parsing email data: ${(error as Error).message}`);
@@ -3555,22 +3582,6 @@ export class UnifiedEmailServer extends EventEmitter {
     ]).has(headerName.toLowerCase());
   }
 
-  private stringifyParsedHeaderValue(headerValue: unknown): string {
-    if (Array.isArray(headerValue)) {
-      return headerValue.map(value => this.stringifyParsedHeaderValue(value)).join(', ');
-    }
-    if (headerValue instanceof Date) {
-      return headerValue.toUTCString();
-    }
-    if (typeof headerValue === 'string') {
-      return headerValue;
-    }
-    if (headerValue && typeof headerValue === 'object' && 'text' in headerValue) {
-      return String((headerValue as { text?: unknown }).text || '');
-    }
-    return headerValue === undefined || headerValue === null ? '' : String(headerValue);
-  }
-
   /**
    * Compute SCRAM-SHA-256 credential fields from a plaintext password with a
    * fresh random salt (used for legacy plaintext credentials only; verifier

package/ts/plugins.ts

@@ -39,10 +39,3 @@ import * as tsclass from '@tsclass/tsclass';
 export {
   tsclass,
 }
-
-// third party
-import mailparser from 'mailparser';
-
-export {
-  mailparser,
-}

package/ts/security/classes.rustsecuritybridge.ts

@@ -435,7 +435,10 @@ interface IVerifyCapturedOutboundEmailResult {
   result?: IEmailSecurityResult;
 }
 
-interface ISmtpSendRawOptions {
+/** How a raw outbound message is signed. */
+type TSmtpRawSigningMode = 'dkim' | 'unsignedRelay';
+
+interface ISmtpSendRawTransportOptions {
   host: string;
   port: number;
   connectHost?: string;
@@ -446,7 +449,6 @@ interface ISmtpSendRawOptions {
   envelopeFrom: string;
   envelopeTo: string[];
   rawMessageBase64: string;
-  dkim: { domain: string; selector: string; privateKey: string; keyType?: string };
   connectionTimeoutSecs?: number;
   socketTimeoutSecs?: number;
   poolKey?: string;
@@ -456,6 +458,25 @@ interface ISmtpSendRawOptions {
   outboundAuthenticationCaptureId?: string;
 }
 
+/** A raw send signed with caller-supplied DKIM material, the default. */
+interface ISmtpSendRawOptions extends ISmtpSendRawTransportOptions {
+  signing?: 'dkim';
+  dkim: { domain: string; selector: string; privateKey: string; keyType?: string };
+}
+
+/**
+ * A raw send that relays the exact received bytes without a signature, for a
+ * backup MX forwarding third parties' mail to the primary. It must be
+ * requested explicitly and carries no DKIM material; the Rust engine refuses
+ * a request that mixes the two.
+ */
+interface ISmtpSendRawUnsignedRelayOptions extends ISmtpSendRawTransportOptions {
+  signing: 'unsignedRelay';
+  dkim?: never;
+}
+
+type TSmtpSendRawOptions = ISmtpSendRawOptions | ISmtpSendRawUnsignedRelayOptions;
+
 interface ISmtpVerifyOptions {
   host: string;
   port: number;
@@ -674,7 +695,7 @@ type TMailerCommands = {
     result: ISmtpSendResult;
   };
   sendRawEmail: {
-    params: ISmtpSendRawOptions;
+    params: TSmtpSendRawOptions;
     result: ISmtpSendResult;
   };
   verifyCapturedOutboundEmail: {
@@ -764,14 +785,16 @@ export class RustSecurityBridge extends EventEmitter {
   private _smtpServerConfig: ISmtpServerConfig | null = null;
 
   /**
-   * Map Node.js process.platform / process.arch to the tsrust-style suffix
-   * used for cross-compiled binaries, e.g. mailer-bin_linux_amd64.
+   * Map Node.js process.platform / process.arch to the tsrust target suffix
+   * of the shipped binaries. Linux binaries are static musl builds, e.g.
+   * mailer-bin_linux_amd64_musl.
    */
   private static getPlatformSuffix(): string | null {
     const archMap: Record<string, string> = { x64: 'amd64', arm64: 'arm64' };
     const os = process.platform;   // 'linux', 'darwin', 'win32', …
     const arch = archMap[process.arch];
     if (!arch) return null;
+    if (os === 'linux') return `linux_${arch}_musl`;
     return `${os}_${arch}`;
   }
 
@@ -1241,8 +1264,11 @@ export class RustSecurityBridge extends EventEmitter {
     }
   }
 
-  /** Send a pre-formatted raw email via the Rust SMTP client. */
-  public async sendRawEmail(opts: ISmtpSendRawOptions): Promise<ISmtpSendResult> {
+  /**
+   * Send a pre-formatted raw email via the Rust SMTP client. It is DKIM-signed
+   * with `opts.dkim` unless `opts.signing` is explicitly `'unsignedRelay'`.
+   */
+  public async sendRawEmail(opts: TSmtpSendRawOptions): Promise<ISmtpSendResult> {
     this.ensureRunning();
     try {
       const result = await this.bridge.sendCommand('sendRawEmail', opts);
@@ -1454,6 +1480,9 @@ export type {
   ISmtpRecipientResult,
   ISmtpSendOptions,
   ISmtpSendRawOptions,
+  ISmtpSendRawUnsignedRelayOptions,
+  TSmtpSendRawOptions,
+  TSmtpRawSigningMode,
   ISmtpVerifyOptions,
   ISmtpVerifyResult,
   ISmtpPoolStatus,

package/ts/security/index.ts

@@ -42,6 +42,10 @@ export {
   type ISmtpSendResult,
   type ISmtpRecipientResult,
   type ISmtpSendOptions,
+  type ISmtpSendRawOptions,
+  type ISmtpSendRawUnsignedRelayOptions,
+  type TSmtpSendRawOptions,
+  type TSmtpRawSigningMode,
   type ISmtpVerifyResult,
   type ISmtpPoolStatus,
 } from './classes.rustsecuritybridge.js';

package/dist_rust/mailer-bin_linux_amd64.tsrust-build.json

@@ -1,14 +0,0 @@
-{
-  "format": "tsrust.build-provenance.v2",
-  "binarySha256": "d698d8d0af565269b930e9af77e6046ca80d5c159e5aca55d2e2aa0c73a96f14",
-  "buildInfo": {
-    "projectName": "@push.rocks/smartmta",
-    "projectVersion": "11.1.0",
-    "gitCommit": "f9dc39d8b543051ed3afae5b3708f1583b8c6630",
-    "gitDirty": false,
-    "builtAt": "2026-10-14T22:19:16.659Z",
-    "tsrustVersion": "4.5.1",
-    "binary": "mailer-bin",
-    "target": "linux_amd64"
-  }
-}

package/dist_rust/mailer-bin_linux_arm64.tsrust-build.json

@@ -1,14 +0,0 @@
-{
-  "format": "tsrust.build-provenance.v2",
-  "binarySha256": "2e5502aaff345b35f16840f14c28e7b50c13b45f7015025021913006d6774f1c",
-  "buildInfo": {
-    "projectName": "@push.rocks/smartmta",
-    "projectVersion": "11.1.0",
-    "gitCommit": "f9dc39d8b543051ed3afae5b3708f1583b8c6630",
-    "gitDirty": false,
-    "builtAt": "2026-10-14T22:21:40.086Z",
-    "tsrustVersion": "4.5.1",
-    "binary": "mailer-bin",
-    "target": "linux_arm64"
-  }
-}