@push.rocks/smartmta 8.2.1 → 9.1.0

package/ts/mail/routing/classes.email.router.ts

@@ -6,6 +6,21 @@ import type { Email } from '../core/classes.email.js';
 import { getErrorMessage } from '../../functions.errors.js';
 import { assertValidRetentionDays } from './functions.routing.validation.js';
 
+/**
+ * Convert an address glob pattern ('a@b.com' | '*@b.com' | 'admin@*') into a
+ * case-insensitive full-match RegExp. Shared by route matching and auth
+ * account scope enforcement so both use identical pattern semantics.
+ */
+export function addressGlobToRegExp(pattern: string): RegExp {
+  // Escape special regex characters except * and ?
+  const regexString = pattern
+    .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+    .replace(/\*/g, '.*')
+    .replace(/\?/g, '.');
+
+  return new RegExp(`^${regexString}$`, 'i');
+}
+
 /**
  * Email router that evaluates routes and determines actions
  */
@@ -14,8 +29,9 @@ export class EmailRouter extends EventEmitter {
   private patternCache: Map<string, boolean> = new Map();
   private storageManager?: IStorageManager;
   private persistChanges: boolean;
+  private validateAction?: (route: IEmailRoute) => void;
   private initializationPromise: Promise<void>;
-  
+
   /**
    * Create a new email router
    * @param routes Array of email routes
@@ -24,8 +40,15 @@ export class EmailRouter extends EventEmitter {
   constructor(routes: IEmailRoute[], options?: {
     storageManager?: IStorageManager;
     persistChanges?: boolean;
+    /**
+     * Additional owner-level action policy applied to every configured,
+     * updated, and hydrated route (e.g. an embedding server requiring a
+     * durable local-delivery owner for `deliver` actions).
+     */
+    validateAction?: (route: IEmailRoute) => void;
   }) {
     super();
+    this.validateAction = options?.validateAction;
     this.validateRoutes(routes);
     this.routes = this.sortRoutesByPriority(routes);
     this.storageManager = options?.storageManager;
@@ -49,6 +72,8 @@ export class EmailRouter extends EventEmitter {
       throw new Error('Invalid route: missing required fields');
     }
 
+    this.validateAction?.(route);
+
     if (route.action.type !== 'store') {
       return;
     }
@@ -69,6 +94,16 @@ export class EmailRouter extends EventEmitter {
       this.validateRoute(route);
     }
   }
+
+  /**
+   * Synchronously validate routes against structural rules and the owner's
+   * action policy without mutating router state. Callers that stage route
+   * updates in their own configuration should validate first so an invalid
+   * route set fails loudly before any state changes.
+   */
+  public assertRoutesValid(routes: IEmailRoute[]): void {
+    this.validateRoutes(routes);
+  }
   
   /**
    * Sort routes by priority (higher priority first)
@@ -165,11 +200,17 @@ export class EmailRouter extends EventEmitter {
     }
     
     // Check authentication
-    if (match.authenticated !== undefined && 
+    if (match.authenticated !== undefined &&
         context.session.authenticated !== match.authenticated) {
       return false;
     }
-    
+
+    // Check authenticated username binding
+    if (match.authenticatedUser !== undefined &&
+        !this.matchesAuthenticatedUser(context.session, match.authenticatedUser)) {
+      return false;
+    }
+
     // Check headers
     if (match.headers && !this.matchesHeaders(context.email, match.headers)) {
       return false;
@@ -233,6 +274,25 @@ export class EmailRouter extends EventEmitter {
     return false;
   }
   
+  /**
+   * Check if the session is authenticated as one of the required usernames.
+   * Unauthenticated sessions never match.
+   * @param session SMTP session
+   * @param usernames Required username or usernames
+   * @returns True if the session's authenticated username is in the set
+   */
+  private matchesAuthenticatedUser(
+    session: IEmailContext['session'],
+    usernames: string | string[],
+  ): boolean {
+    const username = session.user?.username;
+    if (!username) {
+      return false;
+    }
+    const allowed = Array.isArray(usernames) ? usernames : [usernames];
+    return allowed.includes(username);
+  }
+
   /**
    * Check if client IP matches patterns
    * @param context Email context
@@ -354,13 +414,7 @@ export class EmailRouter extends EventEmitter {
    * @returns Regular expression
    */
   private globToRegExp(pattern: string): RegExp {
-    // Escape special regex characters except * and ?
-    let regexString = pattern
-      .replace(/[.+^${}()|[\]\\]/g, '\\$&')
-      .replace(/\*/g, '.*')
-      .replace(/\?/g, '.');
-    
-    return new RegExp(`^${regexString}$`, 'i');
+    return addressGlobToRegExp(pattern);
   }
   
   /**