@push.rocks/smartmta 14.1.0 → 14.2.0

package/ts/mail/routing/classes.unified.email.server.ts

@@ -1057,12 +1057,14 @@ export class UnifiedEmailServer extends EventEmitter {
       ? await this.resolveOutboundDkim(options.dkimDomain, options.dkimSelector || 'default')
       : undefined;
 
-    // Serialize the Email to the outbound format
+    // Serialize the Email to the outbound format. RCPT TO is the one accessor's
+    // list, which mailer-bin sends verbatim; to and cc are only written.
     const outboundEmail: IOutboundEmail = {
       from: email.from,
       to: email.to,
       cc: email.cc || [],
       bcc: email.bcc || [],
+      envelopeTo: email.getAllRecipients(),
       subject: email.subject || '',
       text: email.text || '',
       html: email.html || undefined,
@@ -2595,7 +2597,7 @@ export class UnifiedEmailServer extends EventEmitter {
     }
   }
 
-  /** Build a route-evaluation view containing only the current SMTP envelope recipient. */
+  /** A copy of the email whose envelope is only the given SMTP envelope recipient. */
   private cloneEmailForRoutingRecipient(email: Email, recipient: string): Email {
     return new Email({
       from: email.from,
@@ -2615,7 +2617,8 @@ export class UnifiedEmailServer extends EventEmitter {
       variables: structuredClone(email.variables),
     })
       .setMessageId(email.getMessageId())
-      .setEnvelopeFrom(email.getEnvelopeFrom());
+      .setEnvelopeFrom(email.getEnvelopeFrom())
+      .setEnvelopeTo([recipient]);
   }
 
   private scopeSessionForRoutingRecipient(
@@ -3514,6 +3517,19 @@ export class UnifiedEmailServer extends EventEmitter {
     }
   }
 
+  /**
+   * The envelope recipients of a received message's session. A received
+   * message is delivered to its envelope alone, so an empty one is refused;
+   * its To and Cc fields never stand in for it.
+   */
+  private envelopeRecipientsOf(session: IExtendedSmtpSession): string[] {
+    const recipients = (session.envelope?.rcptTo || []).map((recipient) => recipient.address);
+    if (recipients.length === 0) {
+      throw new Error('A received message needs at least one envelope recipient');
+    }
+    return recipients;
+  }
+
   /**
    * Builds the Email of stored message bytes (the replay paths
    * dispatchAcceptedEnvelope and processEmailByMode(Buffer)) with the parser
@@ -3534,7 +3550,7 @@ export class UnifiedEmailServer extends EventEmitter {
   /** The Email of a message the Rust parser read (docs/cleanroom/mailer-mime.md section 2.2). */
   private createEmailFromParsed(parsed: IBridgeParsedMessage, session: IExtendedSmtpSession): Email {
     const headerFromMailboxes = this.fromFieldAddresses(parsed).flat();
-    const envelopeRecipients = session.envelope.rcptTo.map(recipient => recipient.address);
+    const envelopeRecipients = this.envelopeRecipientsOf(session);
     const parsedHeaders = new Map<string, string>();
     for (const header of parsed.headers) {
       if (this.isStandardParsedHeader(header.key)) {
@@ -3550,9 +3566,7 @@ export class UnifiedEmailServer extends EventEmitter {
     return new Email({
       // The first mailbox of the From fields in message order, groups flattened
       from: headerFromMailboxes[0] || session.envelope.mailFrom.address,
-      to: envelopeRecipients.length > 0
-        ? envelopeRecipients
-        : parsed.to.map(recipient => recipient.email),
+      to: envelopeRecipients,
       cc: parsed.cc.map(recipient => recipient.email),
       bcc: [],
       subject: parsed.subject || '',
@@ -3565,7 +3579,7 @@ export class UnifiedEmailServer extends EventEmitter {
         contentType: attachment.contentType,
         ...(attachment.contentId ? { contentId: attachment.contentId } : {}),
       })),
-    });
+    }).setEnvelopeTo(envelopeRecipients);
   }
 
   private isStandardParsedHeader(headerName: string): boolean {
@@ -3971,6 +3985,8 @@ export class UnifiedEmailServer extends EventEmitter {
     } else {
       email = emailData;
     }
+    // The session's envelope alone decides who receives the message.
+    email.setEnvelopeTo(this.envelopeRecipientsOf(session));
 
     // Run inbound security verification (DKIM/SPF/DMARC) via Rust bridge
     if (session.remoteAddress && session.remoteAddress !== '127.0.0.1') {
@@ -4281,23 +4297,24 @@ export class UnifiedEmailServer extends EventEmitter {
     }
   ): Promise<string> {
     this.assertAcceptingOutboundWork();
-    logger.log('info', `Sending email: ${email.subject} to ${email.to.join(', ')}`);
+    const recipients = email.getAllRecipients();
+    logger.log('info', `Sending email: ${email.subject} to ${recipients.join(', ')}`);
 
     try {
       if (!email.from) {
         throw new Error('Email must have a sender address');
       }
 
-      if (!email.to || email.to.length === 0) {
+      if (recipients.length === 0) {
         throw new Error('Email must have at least one recipient');
       }
 
       // Check if any recipients are on the suppression list
       if (!options?.skipSuppressionCheck) {
-        const suppressedRecipients = email.to.filter(recipient => this.isEmailSuppressed(recipient));
+        const suppressedRecipients = recipients.filter(recipient => this.isEmailSuppressed(recipient));
 
         if (suppressedRecipients.length > 0) {
-          const originalCount = email.to.length;
+          const originalCount = recipients.length;
           const suppressed = suppressedRecipients.map(recipient => {
             const info = this.getSuppressionInfo(recipient);
             return {
@@ -4313,7 +4330,9 @@ export class UnifiedEmailServer extends EventEmitter {
             throw new Error('All recipients are on the suppression list');
           }
 
-          email.to = email.to.filter(recipient => !this.isEmailSuppressed(recipient));
+          // The message's fields stay as written; the suppressed recipients
+          // only leave the envelope.
+          email.setEnvelopeTo(recipients.filter(recipient => !this.isEmailSuppressed(recipient)));
         }
       }
 

package/ts/security/classes.contentscanner.ts

@@ -346,7 +346,7 @@ export class ContentScanner {
     void callObserverSafely('content scan security log', () => SecurityLogger.getInstance().logEvent({
       level: SecurityLogLevel.ERROR,
       type: SecurityEventType.MALWARE,
-      message: `High threat content detected in email from ${email.from} to ${email.to.join(', ')}`,
+      message: `High threat content detected in email from ${email.from} to ${email.getAllRecipients().join(', ')}`,
       details: {
         messageId: email.getMessageId(),
         threatType: result.threatType,
@@ -369,7 +369,7 @@ export class ContentScanner {
     void callObserverSafely('content scan security log', () => SecurityLogger.getInstance().logEvent({
       level: SecurityLogLevel.WARN,
       type: SecurityEventType.SPAM,
-      message: `Suspicious content detected in email from ${email.from} to ${email.to.join(', ')}`,
+      message: `Suspicious content detected in email from ${email.from} to ${email.getAllRecipients().join(', ')}`,
       details: {
         messageId: email.getMessageId(),
         threatType: result.threatType,

package/ts/security/classes.rustsecuritybridge.ts

@@ -358,9 +358,12 @@ const isSmtpDeliveryPhase = (valueArg: unknown): valueArg is TSmtpDeliveryPhase
 
 interface IOutboundEmail {
   from: string;
+  /** The message's To field; written as To, never used for RCPT TO when `envelopeTo` is set. */
   to: string[];
   cc?: string[];
   bcc?: string[];
+  /** The SMTP envelope recipients; when present, RCPT TO goes to them alone. */
+  envelopeTo?: string[];
   subject?: string;
   text?: string;
   html?: string;