@push.rocks/smartmta 14.1.0 → 14.3.0

package/ts/mail/delivery/classes.delivery.system.ts

@@ -284,14 +284,13 @@ export class MultiModeDeliverySystem extends EventEmitter {
     }
   }
 
+  /**
+   * The copy of an email for one SMTP transaction: its envelope is exactly
+   * `recipients`, and its To, Cc and Bcc fields stay as they are, so every
+   * copy shows the same To and Cc.
+   */
   private createEmailForRecipients(email: Email, recipients: string[]): Email {
-    const recipientSet = new Set(recipients.map((recipient) => recipient.toLowerCase()));
-    return new Email({
-      ...email.toEmailOptions(),
-      to: email.to.filter((recipient) => recipientSet.has(recipient.toLowerCase())),
-      cc: (email.cc || []).filter((recipient) => recipientSet.has(recipient.toLowerCase())),
-      bcc: (email.bcc || []).filter((recipient) => recipientSet.has(recipient.toLowerCase())),
-    })
+    return new Email({ ...email.toEmailOptions(), envelopeTo: recipients })
       .setMessageId(email.getMessageId())
       .setEnvelopeFrom(email.getEnvelopeFrom());
   }

package/ts/mail/delivery/functions.raw-email.ts

@@ -1,7 +1,7 @@
 import { createHash, type Hash } from 'node:crypto';
-import { domainToASCII } from 'node:url';
 
 import { Email } from '../core/classes.email.js';
+import { canonicalMailboxAddress } from '../core/functions.mailbox.js';
 
 export interface IRawSmtpEnvelope {
   from: string;
@@ -50,11 +50,10 @@ const normalizeRawMailbox = (valueArg: string, fieldArg: string): string => {
   if (atIndex < 1 || atIndex !== value.lastIndexOf('@') || atIndex === value.length - 1) {
     throw new Error(`Raw SMTP envelope ${fieldArg} must be a plain mailbox address`);
   }
-  const asciiDomain = domainToASCII(value.slice(atIndex + 1));
-  if (!asciiDomain) {
+  const normalized = canonicalMailboxAddress(value);
+  if (!normalized) {
     throw new Error(`Raw SMTP envelope ${fieldArg} has an invalid domain`);
   }
-  const normalized = `${value.slice(0, atIndex).toLowerCase()}@${asciiDomain.toLowerCase()}`;
   try {
     new Email({ from: normalized, to: normalized, subject: '', text: '' });
   } catch {

package/ts/mail/routing/classes.email.action.executor.ts

@@ -136,9 +136,14 @@ export class EmailActionExecutor {
       }
     }
 
-    // Add standard forwarding headers
+    // Add standard forwarding headers. X-Forwarded-To names the one envelope
+    // recipient of a single-recipient copy and is never a list: the next hop
+    // has RCPT TO, and a list would show each recipient to every other.
     email.headers['X-Forwarded-For'] = context.session.remoteAddress || 'unknown';
-    email.headers['X-Forwarded-To'] = email.to.join(', ');
+    const forwardedRecipients = email.getAllRecipients();
+    if (forwardedRecipients.length === 1) {
+      email.headers['X-Forwarded-To'] = forwardedRecipients[0];
+    }
     email.headers['X-Forwarded-Date'] = new Date().toISOString();
 
     if (options.durableQueue) {
@@ -174,7 +179,7 @@ export class EmailActionExecutor {
           routeName: context.session.matchedRoute?.name,
           targetHost: host,
           targetPort: port,
-          recipients: email.to
+          recipients: email.getAllRecipients()
         },
         success: true
       }));
@@ -272,7 +277,7 @@ export class EmailActionExecutor {
         rejectCode: code,
         rejectMessage: message,
         from: _email.from,
-        to: _email.to
+        to: _email.getAllRecipients()
       },
       success: false
     }));

package/ts/mail/routing/classes.unified.email.server.ts

@@ -1057,12 +1057,14 @@ export class UnifiedEmailServer extends EventEmitter {
       ? await this.resolveOutboundDkim(options.dkimDomain, options.dkimSelector || 'default')
       : undefined;
 
-    // Serialize the Email to the outbound format
+    // Serialize the Email to the outbound format. RCPT TO is the one accessor's
+    // list, which mailer-bin sends verbatim; to and cc are only written.
     const outboundEmail: IOutboundEmail = {
       from: email.from,
       to: email.to,
       cc: email.cc || [],
       bcc: email.bcc || [],
+      envelopeTo: email.getAllRecipients(),
       subject: email.subject || '',
       text: email.text || '',
       html: email.html || undefined,
@@ -2595,13 +2597,17 @@ export class UnifiedEmailServer extends EventEmitter {
     }
   }
 
-  /** Build a route-evaluation view containing only the current SMTP envelope recipient. */
+  /**
+   * A copy of the email whose envelope is only the given SMTP envelope
+   * recipient; its To, Cc and Bcc fields stay as they are.
+   */
   private cloneEmailForRoutingRecipient(email: Email, recipient: string): Email {
     return new Email({
       from: email.from,
-      to: [recipient],
-      cc: [],
-      bcc: [],
+      to: [...email.to],
+      cc: [...email.cc],
+      bcc: [...email.bcc],
+      envelopeTo: [recipient],
       subject: email.subject,
       text: email.text,
       html: email.html,
@@ -3514,6 +3520,19 @@ export class UnifiedEmailServer extends EventEmitter {
     }
   }
 
+  /**
+   * The envelope recipients of a received message's session. A received
+   * message is delivered to its envelope alone, so an empty one is refused;
+   * its To and Cc fields never stand in for it.
+   */
+  private envelopeRecipientsOf(session: IExtendedSmtpSession): string[] {
+    const recipients = (session.envelope?.rcptTo || []).map((recipient) => recipient.address);
+    if (recipients.length === 0) {
+      throw new Error('A received message needs at least one envelope recipient');
+    }
+    return recipients;
+  }
+
   /**
    * Builds the Email of stored message bytes (the replay paths
    * dispatchAcceptedEnvelope and processEmailByMode(Buffer)) with the parser
@@ -3534,7 +3553,7 @@ export class UnifiedEmailServer extends EventEmitter {
   /** The Email of a message the Rust parser read (docs/cleanroom/mailer-mime.md section 2.2). */
   private createEmailFromParsed(parsed: IBridgeParsedMessage, session: IExtendedSmtpSession): Email {
     const headerFromMailboxes = this.fromFieldAddresses(parsed).flat();
-    const envelopeRecipients = session.envelope.rcptTo.map(recipient => recipient.address);
+    const envelopeRecipients = this.envelopeRecipientsOf(session);
     const parsedHeaders = new Map<string, string>();
     for (const header of parsed.headers) {
       if (this.isStandardParsedHeader(header.key)) {
@@ -3550,11 +3569,12 @@ export class UnifiedEmailServer extends EventEmitter {
     return new Email({
       // The first mailbox of the From fields in message order, groups flattened
       from: headerFromMailboxes[0] || session.envelope.mailFrom.address,
-      to: envelopeRecipients.length > 0
-        ? envelopeRecipients
-        : parsed.to.map(recipient => recipient.email),
+      // The message's To and Cc fields; the envelope alone receives it, and a
+      // Bcc field never travels on.
+      to: parsed.to.map(recipient => recipient.email),
       cc: parsed.cc.map(recipient => recipient.email),
       bcc: [],
+      envelopeTo: envelopeRecipients,
       subject: parsed.subject || '',
       text: bodies.text,
       html: bodies.html,
@@ -3971,6 +3991,8 @@ export class UnifiedEmailServer extends EventEmitter {
     } else {
       email = emailData;
     }
+    // The session's envelope alone decides who receives the message.
+    email.setEnvelopeTo(this.envelopeRecipientsOf(session));
 
     // Run inbound security verification (DKIM/SPF/DMARC) via Rust bridge
     if (session.remoteAddress && session.remoteAddress !== '127.0.0.1') {
@@ -4281,23 +4303,26 @@ export class UnifiedEmailServer extends EventEmitter {
     }
   ): Promise<string> {
     this.assertAcceptingOutboundWork();
-    logger.log('info', `Sending email: ${email.subject} to ${email.to.join(', ')}`);
+    const recipients = email.getAllRecipients();
+    // What goes to the queue; the caller's email is never changed.
+    let outgoing = email;
+    logger.log('info', `Sending email: ${email.subject} to ${recipients.join(', ')}`);
 
     try {
       if (!email.from) {
         throw new Error('Email must have a sender address');
       }
 
-      if (!email.to || email.to.length === 0) {
+      if (recipients.length === 0) {
         throw new Error('Email must have at least one recipient');
       }
 
       // Check if any recipients are on the suppression list
       if (!options?.skipSuppressionCheck) {
-        const suppressedRecipients = email.to.filter(recipient => this.isEmailSuppressed(recipient));
+        const suppressedRecipients = recipients.filter(recipient => this.isEmailSuppressed(recipient));
 
         if (suppressedRecipients.length > 0) {
-          const originalCount = email.to.length;
+          const originalCount = recipients.length;
           const suppressed = suppressedRecipients.map(recipient => {
             const info = this.getSuppressionInfo(recipient);
             return {
@@ -4313,11 +4338,18 @@ export class UnifiedEmailServer extends EventEmitter {
             throw new Error('All recipients are on the suppression list');
           }
 
-          email.to = email.to.filter(recipient => !this.isEmailSuppressed(recipient));
+          // The message's fields stay as written; the suppressed recipients
+          // only leave the envelope of the copy that is sent.
+          outgoing = new Email({
+            ...email.toEmailOptions(),
+            envelopeTo: recipients.filter(recipient => !this.isEmailSuppressed(recipient)),
+          })
+            .setMessageId(email.getMessageId())
+            .setEnvelopeFrom(email.getEnvelopeFrom());
         }
       }
 
-      const id = await this.deliveryQueue.enqueue(email, mode, route);
+      const id = await this.deliveryQueue.enqueue(outgoing, mode, route);
 
       logger.log('info', `Email queued with ID: ${id}`);
       return id;

package/ts/security/classes.contentscanner.ts

@@ -346,7 +346,7 @@ export class ContentScanner {
     void callObserverSafely('content scan security log', () => SecurityLogger.getInstance().logEvent({
       level: SecurityLogLevel.ERROR,
       type: SecurityEventType.MALWARE,
-      message: `High threat content detected in email from ${email.from} to ${email.to.join(', ')}`,
+      message: `High threat content detected in email from ${email.from} to ${email.getAllRecipients().join(', ')}`,
       details: {
         messageId: email.getMessageId(),
         threatType: result.threatType,
@@ -369,7 +369,7 @@ export class ContentScanner {
     void callObserverSafely('content scan security log', () => SecurityLogger.getInstance().logEvent({
       level: SecurityLogLevel.WARN,
       type: SecurityEventType.SPAM,
-      message: `Suspicious content detected in email from ${email.from} to ${email.to.join(', ')}`,
+      message: `Suspicious content detected in email from ${email.from} to ${email.getAllRecipients().join(', ')}`,
       details: {
         messageId: email.getMessageId(),
         threatType: result.threatType,

package/ts/security/classes.rustsecuritybridge.ts

@@ -358,9 +358,12 @@ const isSmtpDeliveryPhase = (valueArg: unknown): valueArg is TSmtpDeliveryPhase
 
 interface IOutboundEmail {
   from: string;
+  /** The message's To field; written as To, never used for RCPT TO when `envelopeTo` is set. */
   to: string[];
   cc?: string[];
   bcc?: string[];
+  /** The SMTP envelope recipients; when present, RCPT TO goes to them alone. */
+  envelopeTo?: string[];
   subject?: string;
   text?: string;
   html?: string;