@push.rocks/smartmta 9.0.0 → 9.1.0

package/dist_ts/mail/routing/classes.unified.email.server.d.ts

@@ -2,7 +2,7 @@ import { EventEmitter } from 'events';
 import { DKIMCreator } from '../security/classes.dkimcreator.js';
 import type { IStorageManager } from '../interfaces.storage.js';
 import type { IInboundEmailSecurityResult } from '../../security/classes.rustsecuritybridge.js';
-import type { IEmailRoute, IEmailAction, IEmailDomainConfig } from './interfaces.js';
+import type { IEmailRoute, IEmailAction, IEmailDomainConfig, ISmtpAuthAccount } from './interfaces.js';
 import { Email } from '../core/classes.email.js';
 import { DomainRegistry } from './classes.domain.registry.js';
 import { BounceType, BounceCategory } from '../core/classes.bouncemanager.js';
@@ -18,7 +18,7 @@ interface DcRouter {
     options?: any;
 }
 export type TRecipientRouteSource = 'explicit-route' | 'domain-policy' | 'no-route';
-export type TRecipientRejectionReason = 'explicit-route' | 'domain-policy' | 'no-route' | 'domain-not-hosted' | 'relay-denied' | 'recipient-hook' | 'policy-error';
+export type TRecipientRejectionReason = 'explicit-route' | 'domain-policy' | 'no-route' | 'domain-not-hosted' | 'relay-denied' | 'recipient-hook' | 'policy-error' | 'sender-scope' | 'recipient-scope' | 'account-disabled';
 export interface IResolvedRecipientRoute {
     recipient: string;
     localDomain: string | null;
@@ -207,6 +207,11 @@ export interface IUnifiedEmailServerOptions {
             username: string;
             password: string;
         }>;
+        /**
+         * Authenticated SMTP accounts with hashed credentials and send scopes.
+         * Coexists with legacy `users`; accounts win on username collision.
+         */
+        accounts?: ISmtpAuthAccount[];
     };
     tls?: {
         certPem?: string;
@@ -346,6 +351,15 @@ export declare class UnifiedEmailServer extends EventEmitter {
     private acceptedEnvelopeDispatchCleanupTimer?;
     private acceptedEnvelopeDispatchCleanupPromise?;
     private acceptedEnvelopeDispatchCleanupCursor?;
+    private smtpListenerActive;
+    private smtpListenerShutdown;
+    private smtpListenerRestartPromise?;
+    private static readonly VERIFIER_DERIVATION_CONCURRENCY;
+    private static readonly VERIFIER_DERIVATION_MAX_QUEUE;
+    private verifierDerivationActive;
+    private verifierDerivationWaiters;
+    /** Compiled scope patterns; keys are config-supplied, bounded by config size. */
+    private scopePatternCache;
     constructor(dcRouter: DcRouter, options: IUnifiedEmailServerOptions);
     onRecipientRejected(listener: (event: IRecipientRejectedEvent) => Promise<void> | void): this;
     offRecipientRejected(listener: (event: IRecipientRejectedEvent) => Promise<void> | void): this;
@@ -391,6 +405,23 @@ export declare class UnifiedEmailServer extends EventEmitter {
     private unregisterBridgeStateHandler;
     private unregisterBridgeEventHandlers;
     private startSmtpServer;
+    /** Whether the current options require SMTP AUTH support on the listener. */
+    private isAuthConfigured;
+    /**
+     * Whether the Rust SMTP listener is currently accepting connections.
+     * Embedders should surface this next to getBridgeState() in health
+     * endpoints: a failed listener reconfiguration leaves it false.
+     */
+    isSmtpListenerActive(): boolean;
+    /**
+     * Restart only the Rust SMTP listener so listener-level configuration such
+     * as AUTH availability takes effect without a full process restart.
+     * Restarts are serialized and become no-ops once shutdown has begun; a
+     * failed restart leaves the listener inactive, logs loudly, and emits
+     * 'smtpListenerRestartFailed' so embedders can react (e.g. by calling
+     * stop()/start()).
+     */
+    private scheduleSmtpListenerRestart;
     /**
      * Stop the unified email server
      */
@@ -402,6 +433,39 @@ export declare class UnifiedEmailServer extends EventEmitter {
     private notifyRecipientRejected;
     private buildPolicySession;
     private getAddressDomain;
+    /** Resolve the configured account for a username. Accounts win over legacy users. */
+    private findAuthAccount;
+    private normalizeScopeAddress;
+    /**
+     * Glob match ('a@b.com' | '*@b.com') against a normalized address, using
+     * the same pattern semantics as route matching. Compiled patterns are
+     * cached; keys are configuration-supplied (never remote-controlled), so
+     * the cache is bounded by account configuration size.
+     */
+    private matchesScopePatterns;
+    /**
+     * Envelope-level scope decision for an authenticated session. Returns null
+     * when the envelope is permitted (unauthenticated sessions, usernames with
+     * no configured account, and accounts without a scope are unrestricted).
+     */
+    private resolveAuthAccountScopeDecision;
+    /**
+     * Extract every mailbox address from the parsed From header. The Email
+     * abstraction keeps only the first From mailbox, which is not sufficient
+     * for scope enforcement: `From: allowed@a.com, victim@b.com` must not
+     * pass. Parsing stops at the first CRLFCRLF header boundary when present
+     * (the Rust receiver normalizes line endings to CRLF); a bodyless message
+     * without one is parsed whole.
+     */
+    private parseHeaderFromMailboxes;
+    /**
+     * Header-From alignment for scoped authenticated accounts at DATA. The
+     * envelope MAIL FROM is enforced per recipient via resolveRecipientPolicy
+     * from session.envelope truth; every parsed header From mailbox must
+     * independently stay in scope because route matching and downstream
+     * consumers see the header identity.
+     */
+    private checkAuthenticatedHeaderFromScope;
     private getRecipientValidationTimeoutMs;
     private isRecipientValidationEnabled;
     private getMessageAcceptanceTimeoutMs;
@@ -440,12 +504,39 @@ export declare class UnifiedEmailServer extends EventEmitter {
     private isStandardParsedHeader;
     private stringifyParsedHeaderValue;
     /**
-     * Handle an authRequest event from the Rust SMTP server.
+     * Compute SCRAM-SHA-256 credential fields from a plaintext password with a
+     * fresh random salt (used for legacy plaintext credentials only; verifier
+     * accounts return their stored fields directly).
+     */
+    private computeScramCredentials;
+    /**
+     * Bound concurrent PBKDF2 derivations so credential-stuffing pressure at
+     * high configured iteration counts cannot exhaust the shared libuv
+     * threadpool. Returns false when the wait queue is saturated (fail fast).
+     */
+    private acquireVerifierDerivationSlot;
+    private releaseVerifierDerivationSlot;
+    /**
+     * Verify a presented plaintext password against a stored SCRAM verifier by
+     * deriving StoredKey from the presented password and comparing in constant
+     * time. PBKDF2 runs on the async crypto threadpool so caller-configured
+     * iteration counts never block the event loop inside the Rust auth
+     * callback window; iteration bounds are enforced at configuration time and
+     * in-flight derivations are bounded by a small semaphore.
+     */
+    private verifyPasswordAgainstScramVerifier;
+    /** Constant-time string comparison for legacy plaintext credentials. */
+    private timingSafeStringEqual;
+    /**
+     * Handle an authRequest event from the Rust SMTP server (PLAIN/LOGIN).
+     * Accounts win over legacy users on username collision; disabled accounts
+     * always fail.
      */
     private handleRustAuthRequest;
     /**
      * Handle a SCRAM credential request from the Rust SMTP server.
-     * Computes SCRAM-SHA-256 credentials from the stored password for the given user.
+     * Verifier accounts return their stored fields directly; plaintext
+     * credentials (accounts or legacy users) derive fields on the fly.
      */
     private handleScramCredentialRequest;
     /**