@push.rocks/smartmta 14.0.1 → 14.2.0

package/ts/mail/routing/classes.email.action.executor.ts

@@ -174,7 +174,7 @@ export class EmailActionExecutor {
           routeName: context.session.matchedRoute?.name,
           targetHost: host,
           targetPort: port,
-          recipients: email.to
+          recipients: email.getAllRecipients()
         },
         success: true
       }));
@@ -272,7 +272,7 @@ export class EmailActionExecutor {
         rejectCode: code,
         rejectMessage: message,
         from: _email.from,
-        to: _email.to
+        to: _email.getAllRecipients()
       },
       success: false
     }));

package/ts/mail/routing/classes.unified.email.server.ts

@@ -1057,12 +1057,14 @@ export class UnifiedEmailServer extends EventEmitter {
       ? await this.resolveOutboundDkim(options.dkimDomain, options.dkimSelector || 'default')
       : undefined;
 
-    // Serialize the Email to the outbound format
+    // Serialize the Email to the outbound format. RCPT TO is the one accessor's
+    // list, which mailer-bin sends verbatim; to and cc are only written.
     const outboundEmail: IOutboundEmail = {
       from: email.from,
       to: email.to,
       cc: email.cc || [],
       bcc: email.bcc || [],
+      envelopeTo: email.getAllRecipients(),
       subject: email.subject || '',
       text: email.text || '',
       html: email.html || undefined,
@@ -2506,10 +2508,10 @@ export class UnifiedEmailServer extends EventEmitter {
    * envelope MAIL FROM is enforced per recipient via resolveRecipientPolicy
    * from session.envelope truth; every parsed header From mailbox must
    * independently stay in scope because route matching and downstream
-   * consumers see the header identity.
+   * consumers see the header identity. A scoped submission without a From
+   * field is refused with 550 5.6.0.
    */
   private async checkAuthenticatedHeaderFromScope(
-    email: Email,
     fromFields: string[][],
     session: IExtendedSmtpSession,
   ): Promise<ISmtpDecision | null> {
@@ -2531,21 +2533,24 @@ export class UnifiedEmailServer extends EventEmitter {
     };
     // A message the parser rejects never reaches this check: Rust refuses it at
     // DATA, as it refuses a header section that ends before its empty line.
-    let fromMailboxes: string[];
     if (fromFields.length === 0) {
-      // A message without a From field is accepted deliberately: Email.from
-      // falls back to the envelope MAIL FROM, which resolveRecipientPolicy has
-      // already scope-checked, and no other sender identity is displayed.
-      fromMailboxes = [email.getFromAddress()];
-    } else if (fromFields.some((field) => field.length === 0)) {
+      // A scoped submission must carry the From field this check verifies
+      // (RFC 5322 3.6). Passing it on the envelope sender would rest on the
+      // assumption that no recipient's reader finds a From where this parser
+      // found none; unscoped and unauthenticated mail are not checked here.
+      return {
+        accepted: false,
+        smtpCode: 550,
+        smtpMessage: '5.6.0 Message has no From header field (RFC 5322 3.6)',
+      };
+    }
+    if (fromFields.some((field) => field.length === 0)) {
       // A From field without a mailbox, such as an empty group or an encoded
       // word in place of the address, still displays an identity this check
       // cannot verify.
       return notPermitted;
-    } else {
-      fromMailboxes = fromFields.flat();
     }
-    const outOfScope = fromMailboxes.find(
+    const outOfScope = fromFields.flat().find(
       (mailbox) => !this.matchesScopePatterns(mailbox, scope.senders),
     );
     return outOfScope === undefined ? null : notPermitted;
@@ -2592,7 +2597,7 @@ export class UnifiedEmailServer extends EventEmitter {
     }
   }
 
-  /** Build a route-evaluation view containing only the current SMTP envelope recipient. */
+  /** A copy of the email whose envelope is only the given SMTP envelope recipient. */
   private cloneEmailForRoutingRecipient(email: Email, recipient: string): Email {
     return new Email({
       from: email.from,
@@ -2612,7 +2617,8 @@ export class UnifiedEmailServer extends EventEmitter {
       variables: structuredClone(email.variables),
     })
       .setMessageId(email.getMessageId())
-      .setEnvelopeFrom(email.getEnvelopeFrom());
+      .setEnvelopeFrom(email.getEnvelopeFrom())
+      .setEnvelopeTo([recipient]);
   }
 
   private scopeSessionForRoutingRecipient(
@@ -3343,7 +3349,6 @@ export class UnifiedEmailServer extends EventEmitter {
       // enforced before any durable acceptance or routing: the RCPT phase
       // only ever saw the envelope MAIL FROM.
       const headerFromViolation = await this.checkAuthenticatedHeaderFromScope(
-        email,
         this.fromFieldAddresses(data.parsed),
         session,
       );
@@ -3512,6 +3517,19 @@ export class UnifiedEmailServer extends EventEmitter {
     }
   }
 
+  /**
+   * The envelope recipients of a received message's session. A received
+   * message is delivered to its envelope alone, so an empty one is refused;
+   * its To and Cc fields never stand in for it.
+   */
+  private envelopeRecipientsOf(session: IExtendedSmtpSession): string[] {
+    const recipients = (session.envelope?.rcptTo || []).map((recipient) => recipient.address);
+    if (recipients.length === 0) {
+      throw new Error('A received message needs at least one envelope recipient');
+    }
+    return recipients;
+  }
+
   /**
    * Builds the Email of stored message bytes (the replay paths
    * dispatchAcceptedEnvelope and processEmailByMode(Buffer)) with the parser
@@ -3532,7 +3550,7 @@ export class UnifiedEmailServer extends EventEmitter {
   /** The Email of a message the Rust parser read (docs/cleanroom/mailer-mime.md section 2.2). */
   private createEmailFromParsed(parsed: IBridgeParsedMessage, session: IExtendedSmtpSession): Email {
     const headerFromMailboxes = this.fromFieldAddresses(parsed).flat();
-    const envelopeRecipients = session.envelope.rcptTo.map(recipient => recipient.address);
+    const envelopeRecipients = this.envelopeRecipientsOf(session);
     const parsedHeaders = new Map<string, string>();
     for (const header of parsed.headers) {
       if (this.isStandardParsedHeader(header.key)) {
@@ -3548,9 +3566,7 @@ export class UnifiedEmailServer extends EventEmitter {
     return new Email({
       // The first mailbox of the From fields in message order, groups flattened
       from: headerFromMailboxes[0] || session.envelope.mailFrom.address,
-      to: envelopeRecipients.length > 0
-        ? envelopeRecipients
-        : parsed.to.map(recipient => recipient.email),
+      to: envelopeRecipients,
       cc: parsed.cc.map(recipient => recipient.email),
       bcc: [],
       subject: parsed.subject || '',
@@ -3563,7 +3579,7 @@ export class UnifiedEmailServer extends EventEmitter {
         contentType: attachment.contentType,
         ...(attachment.contentId ? { contentId: attachment.contentId } : {}),
       })),
-    });
+    }).setEnvelopeTo(envelopeRecipients);
   }
 
   private isStandardParsedHeader(headerName: string): boolean {
@@ -3969,6 +3985,8 @@ export class UnifiedEmailServer extends EventEmitter {
     } else {
       email = emailData;
     }
+    // The session's envelope alone decides who receives the message.
+    email.setEnvelopeTo(this.envelopeRecipientsOf(session));
 
     // Run inbound security verification (DKIM/SPF/DMARC) via Rust bridge
     if (session.remoteAddress && session.remoteAddress !== '127.0.0.1') {
@@ -4279,23 +4297,24 @@ export class UnifiedEmailServer extends EventEmitter {
     }
   ): Promise<string> {
     this.assertAcceptingOutboundWork();
-    logger.log('info', `Sending email: ${email.subject} to ${email.to.join(', ')}`);
+    const recipients = email.getAllRecipients();
+    logger.log('info', `Sending email: ${email.subject} to ${recipients.join(', ')}`);
 
     try {
       if (!email.from) {
         throw new Error('Email must have a sender address');
       }
 
-      if (!email.to || email.to.length === 0) {
+      if (recipients.length === 0) {
         throw new Error('Email must have at least one recipient');
       }
 
       // Check if any recipients are on the suppression list
       if (!options?.skipSuppressionCheck) {
-        const suppressedRecipients = email.to.filter(recipient => this.isEmailSuppressed(recipient));
+        const suppressedRecipients = recipients.filter(recipient => this.isEmailSuppressed(recipient));
 
         if (suppressedRecipients.length > 0) {
-          const originalCount = email.to.length;
+          const originalCount = recipients.length;
           const suppressed = suppressedRecipients.map(recipient => {
             const info = this.getSuppressionInfo(recipient);
             return {
@@ -4311,7 +4330,9 @@ export class UnifiedEmailServer extends EventEmitter {
             throw new Error('All recipients are on the suppression list');
           }
 
-          email.to = email.to.filter(recipient => !this.isEmailSuppressed(recipient));
+          // The message's fields stay as written; the suppressed recipients
+          // only leave the envelope.
+          email.setEnvelopeTo(recipients.filter(recipient => !this.isEmailSuppressed(recipient)));
         }
       }
 

package/ts/security/classes.contentscanner.ts

@@ -346,7 +346,7 @@ export class ContentScanner {
     void callObserverSafely('content scan security log', () => SecurityLogger.getInstance().logEvent({
       level: SecurityLogLevel.ERROR,
       type: SecurityEventType.MALWARE,
-      message: `High threat content detected in email from ${email.from} to ${email.to.join(', ')}`,
+      message: `High threat content detected in email from ${email.from} to ${email.getAllRecipients().join(', ')}`,
       details: {
         messageId: email.getMessageId(),
         threatType: result.threatType,
@@ -369,7 +369,7 @@ export class ContentScanner {
     void callObserverSafely('content scan security log', () => SecurityLogger.getInstance().logEvent({
       level: SecurityLogLevel.WARN,
       type: SecurityEventType.SPAM,
-      message: `Suspicious content detected in email from ${email.from} to ${email.to.join(', ')}`,
+      message: `Suspicious content detected in email from ${email.from} to ${email.getAllRecipients().join(', ')}`,
       details: {
         messageId: email.getMessageId(),
         threatType: result.threatType,

package/ts/security/classes.rustsecuritybridge.ts

@@ -358,9 +358,12 @@ const isSmtpDeliveryPhase = (valueArg: unknown): valueArg is TSmtpDeliveryPhase
 
 interface IOutboundEmail {
   from: string;
+  /** The message's To field; written as To, never used for RCPT TO when `envelopeTo` is set. */
   to: string[];
   cc?: string[];
   bcc?: string[];
+  /** The SMTP envelope recipients; when present, RCPT TO goes to them alone. */
+  envelopeTo?: string[];
   subject?: string;
   text?: string;
   html?: string;