@push.rocks/smartmta 5.1.2 → 5.2.0

package/ts/mail/delivery/index.ts

@@ -0,0 +1,5 @@
+// Email delivery components
+export * from './classes.delivery.queue.js';
+export * from './classes.delivery.system.js';
+export { DeliveryStatus } from './classes.delivery.system.js';
+export * from './classes.unified.rate.limiter.js';

package/ts/mail/delivery/interfaces.ts

@@ -0,0 +1,167 @@
+/**
+ * SMTP and email delivery interface definitions
+ */
+
+/**
+ * SMTP session state enumeration
+ */
+export enum SmtpState {
+  GREETING = 'GREETING',
+  AFTER_EHLO = 'AFTER_EHLO',
+  MAIL_FROM = 'MAIL_FROM',
+  RCPT_TO = 'RCPT_TO',
+  DATA = 'DATA',
+  DATA_RECEIVING = 'DATA_RECEIVING',
+  FINISHED = 'FINISHED'
+}
+
+/**
+ * Email processing mode type
+ */
+export type EmailProcessingMode = 'forward' | 'mta' | 'process';
+
+/**
+ * Envelope recipient information
+ */
+export interface IEnvelopeRecipient {
+  /**
+   * Email address of the recipient
+   */
+  address: string;
+  
+  /**
+   * Additional SMTP command arguments
+   */
+  args: Record<string, string>;
+}
+
+/**
+ * SMTP session envelope information
+ */
+export interface ISmtpEnvelope {
+  /**
+   * Envelope sender (MAIL FROM) information
+   */
+  mailFrom: {
+    /**
+     * Email address of the sender
+     */
+    address: string;
+    
+    /**
+     * Additional SMTP command arguments
+     */
+    args: Record<string, string>;
+  };
+  
+  /**
+   * Envelope recipients (RCPT TO) information
+   */
+  rcptTo: IEnvelopeRecipient[];
+}
+
+/**
+ * SMTP Session interface - represents an active SMTP connection
+ */
+export interface ISmtpSession {
+  /**
+   * Unique session identifier
+   */
+  id: string;
+  
+  /**
+   * Current session state in the SMTP conversation
+   */
+  state: SmtpState;
+  
+  /**
+   * Hostname provided by the client in EHLO/HELO command
+   */
+  clientHostname: string;
+  
+  /**
+   * MAIL FROM email address (legacy format)
+   */
+  mailFrom: string;
+  
+  /**
+   * RCPT TO email addresses (legacy format)
+   */
+  rcptTo: string[];
+  
+  /**
+   * Raw email data being received
+   */
+  emailData: string;
+  
+  /**
+   * Chunks of email data for more efficient buffer management
+   */
+  emailDataChunks?: string[];
+  
+  /**
+   * Whether the connection is using TLS
+   */
+  useTLS: boolean;
+  
+  /**
+   * Whether the connection has ended
+   */
+  connectionEnded: boolean;
+  
+  /**
+   * Remote IP address of the client
+   */
+  remoteAddress: string;
+  
+  /**
+   * Whether the connection is secure (TLS)
+   */
+  secure: boolean;
+  
+  /**
+   * Whether the client has been authenticated
+   */
+  authenticated: boolean;
+  
+  /**
+   * SMTP envelope information (structured format)
+   */
+  envelope: ISmtpEnvelope;
+  
+  /**
+   * Email processing mode to use for this session
+   */
+  processingMode?: EmailProcessingMode;
+  
+  /**
+   * Timestamp of last activity for session timeout tracking
+   */
+  lastActivity?: number;
+  
+  /**
+   * Timeout ID for DATA command timeout
+   */
+  dataTimeoutId?: NodeJS.Timeout;
+}
+
+/**
+ * SMTP authentication data
+ */
+export interface ISmtpAuth {
+  /**
+   * Authentication method used
+   */
+  method: 'PLAIN' | 'LOGIN' | 'OAUTH2' | string;
+  
+  /**
+   * Username for authentication
+   */
+  username: string;
+  
+  /**
+   * Password or token for authentication
+   */
+  password: string;
+}
+

package/ts/mail/index.ts

@@ -0,0 +1,17 @@
+// Export all mail modules for simplified imports
+export * from './routing/index.js';
+export * from './security/index.js';
+
+// Make the core and delivery modules accessible
+import * as Core from './core/index.js';
+import * as Delivery from './delivery/index.js';
+
+export { Core, Delivery };
+
+// For direct imports
+import { Email } from './core/classes.email.js';
+
+// Re-export commonly used classes
+export {
+  Email,
+};

package/ts/mail/routing/classes.dkim.manager.ts

@@ -0,0 +1,157 @@
+import { logger } from '../../logger.js';
+import { DKIMCreator } from '../security/classes.dkimcreator.js';
+import { DomainRegistry } from './classes.domain.registry.js';
+import { RustSecurityBridge } from '../../security/classes.rustsecuritybridge.js';
+import { Email } from '../core/classes.email.js';
+
+/** External DcRouter interface shape used by DkimManager */
+interface DcRouter {
+  storageManager: any;
+  dnsServer?: any;
+}
+
+/**
+ * Manages DKIM key setup, rotation, and signing for all configured domains
+ */
+export class DkimManager {
+  private dkimKeys: Map<string, string> = new Map();
+
+  constructor(
+    private dkimCreator: DKIMCreator,
+    private domainRegistry: DomainRegistry,
+    private dcRouter: DcRouter,
+    private rustBridge: RustSecurityBridge,
+  ) {}
+
+  async setupDkimForDomains(): Promise<void> {
+    const domainConfigs = this.domainRegistry.getAllConfigs();
+
+    if (domainConfigs.length === 0) {
+      logger.log('warn', 'No domains configured for DKIM');
+      return;
+    }
+
+    for (const domainConfig of domainConfigs) {
+      const domain = domainConfig.domain;
+      const selector = domainConfig.dkim?.selector || 'default';
+
+      try {
+        let keyPair: { privateKey: string; publicKey: string };
+
+        try {
+          keyPair = await this.dkimCreator.readDKIMKeys(domain);
+          logger.log('info', `Using existing DKIM keys for domain: ${domain}`);
+        } catch (error) {
+          keyPair = await this.dkimCreator.createDKIMKeys();
+          await this.dkimCreator.createAndStoreDKIMKeys(domain);
+          logger.log('info', `Generated new DKIM keys for domain: ${domain}`);
+        }
+
+        this.dkimKeys.set(domain, keyPair.privateKey);
+        logger.log('info', `DKIM keys loaded for domain: ${domain} with selector: ${selector}`);
+      } catch (error) {
+        logger.log('error', `Failed to set up DKIM for domain ${domain}: ${error.message}`);
+      }
+    }
+  }
+
+  async checkAndRotateDkimKeys(): Promise<void> {
+    const domainConfigs = this.domainRegistry.getAllConfigs();
+
+    for (const domainConfig of domainConfigs) {
+      const domain = domainConfig.domain;
+      const selector = domainConfig.dkim?.selector || 'default';
+      const rotateKeys = domainConfig.dkim?.rotateKeys || false;
+      const rotationInterval = domainConfig.dkim?.rotationInterval || 90;
+      const keySize = domainConfig.dkim?.keySize || 2048;
+
+      if (!rotateKeys) {
+        logger.log('debug', `DKIM key rotation disabled for ${domain}`);
+        continue;
+      }
+
+      try {
+        const needsRotation = await this.dkimCreator.needsRotation(domain, selector, rotationInterval);
+
+        if (needsRotation) {
+          logger.log('info', `DKIM keys need rotation for ${domain} (selector: ${selector})`);
+
+          const newSelector = await this.dkimCreator.rotateDkimKeys(domain, selector, keySize);
+
+          domainConfig.dkim = {
+            ...domainConfig.dkim,
+            selector: newSelector
+          };
+
+          if (domainConfig.dnsMode === 'internal-dns' && this.dcRouter.dnsServer) {
+            const keyPair = await this.dkimCreator.readDKIMKeysForSelector(domain, newSelector);
+            const publicKeyBase64 = keyPair.publicKey
+              .replace(/-----BEGIN PUBLIC KEY-----/g, '')
+              .replace(/-----END PUBLIC KEY-----/g, '')
+              .replace(/\s/g, '');
+
+            const ttl = domainConfig.dns?.internal?.ttl || 3600;
+
+            this.dcRouter.dnsServer.registerHandler(
+              `${newSelector}._domainkey.${domain}`,
+              ['TXT'],
+              () => ({
+                name: `${newSelector}._domainkey.${domain}`,
+                type: 'TXT',
+                class: 'IN',
+                ttl: ttl,
+                data: `v=DKIM1; k=rsa; p=${publicKeyBase64}`
+              })
+            );
+
+            logger.log('info', `DKIM DNS handler registered for new selector: ${newSelector}._domainkey.${domain}`);
+
+            await this.dcRouter.storageManager.set(
+              `/email/dkim/${domain}/public.key`,
+              keyPair.publicKey
+            );
+          }
+
+          this.dkimCreator.cleanupOldKeys(domain, 30).catch(error => {
+            logger.log('warn', `Failed to cleanup old DKIM keys for ${domain}: ${error.message}`);
+          });
+
+        } else {
+          logger.log('debug', `DKIM keys for ${domain} are up to date`);
+        }
+      } catch (error) {
+        logger.log('error', `Failed to check/rotate DKIM keys for ${domain}: ${error.message}`);
+      }
+    }
+  }
+
+  async handleDkimSigning(email: Email, domain: string, selector: string): Promise<void> {
+    try {
+      await this.dkimCreator.handleDKIMKeysForDomain(domain);
+      const { privateKey } = await this.dkimCreator.readDKIMKeys(domain);
+      const rawEmail = email.toRFC822String();
+
+      // Detect key type from PEM header
+      const keyType = privateKey.includes('ED25519') ? 'ed25519' : 'rsa';
+
+      const signResult = await this.rustBridge.signDkim({
+        rawMessage: rawEmail,
+        domain,
+        selector,
+        privateKey,
+        keyType,
+      });
+
+      if (signResult.header) {
+        email.addHeader('DKIM-Signature', signResult.header);
+        logger.log('info', `Successfully added DKIM signature for ${domain}`);
+      }
+    } catch (error) {
+      logger.log('error', `Failed to sign email with DKIM: ${error.message}`);
+    }
+  }
+
+  getDkimKey(domain: string): string | undefined {
+    return this.dkimKeys.get(domain);
+  }
+}