@push.rocks/smartmta 9.5.0 → 9.6.1

package/ts/mail/routing/interfaces.ts

@@ -203,6 +203,49 @@ export interface ISmtpAuthAccount {
   scope?: ISmtpAuthAccountScope;
 }
 
+/**
+ * Context handed to `hooks.onAuthenticate` for a PLAIN/LOGIN attempt whose
+ * username is not declared in `auth.accounts` or `auth.users`.
+ */
+export interface ISmtpAuthenticateContext {
+  /** Username exactly as supplied by the client. */
+  username: string;
+  /** Password exactly as supplied by the client. */
+  password: string;
+  /** SMTP session the attempt belongs to. */
+  sessionId: string;
+  /** Remote peer address of the SMTP connection. */
+  remoteAddress: string;
+  /** Aborted when the hook exceeds `smtp.authenticationTimeoutMs`. */
+  abortSignal?: AbortSignal;
+}
+
+/**
+ * Result of an `hooks.onAuthenticate` credential verification.
+ */
+export interface ISmtpAuthenticateDecision {
+  /** Whether the supplied credential is valid. */
+  accepted: boolean;
+  /**
+   * Reason for a rejection, recorded in the server log.
+   *
+   * It is deliberately NOT sent to the client: the SMTP listener answers every
+   * failed authentication with the same `535 5.7.8 Authentication credentials
+   * invalid`, so a caller cannot probe which usernames exist. Use this to make
+   * an operator's log say why a binding was refused.
+   */
+  message?: string;
+  /**
+   * Send-authorization scope for the resulting session, enforced identically
+   * to a configured account's scope for the lifetime of that session.
+   *
+   * Absent scope = unrestricted, matching `ISmtpAuthAccount.scope`. A hook
+   * that authenticates tenants MUST return a scope; without one the session
+   * may send as any sender to any recipient.
+   */
+  scope?: ISmtpAuthAccountScope;
+}
+
 /**
  * Context for route evaluation
  */

package/readme.hints.md

@@ -1,45 +0,0 @@
-# Project Hints
-
-## Rust Workspace
-- Rust code lives in `rust/` with a Cargo workspace
-- Crates: `mailer-core`, `mailer-smtp`, `mailer-security`, `mailer-napi`, `mailer-bin`
-- `mailer-bin` is the binary target that `tsrust` builds for cross-compilation
-- `mailer-napi` is a cdylib for N-API bindings (not built by tsrust, needs separate napi-rs build pipeline)
-- tsrust only supports binary targets (looks for `src/main.rs` or `[[bin]]` entries)
-- Cross-compilation targets: `linux_amd64`, `linux_arm64` (configured in `.smartconfig.json`)
-- Build output goes to `dist_rust/`
-
-## Build
-- `pnpm build` runs `tsbuild tsfolders && tsrust`
-- `pnpm run check` uses `@git.zone/tsbuild` 4.4.2 for production and test type checks
-- `tsrust` independently works and produces binaries in `dist_rust/`
-
-## Key Dependencies (Rust)
-- `tokio` - async runtime
-- `tokio-rustls` - TLS
-- `hickory-dns` (hickory-resolver) - DNS resolution
-- `mail-auth` - DKIM/SPF/DMARC (by Stalwart Labs)
-- `mailparse` - MIME parsing
-- `napi` + `napi-derive` - Node.js bindings
-- `ring` - crypto primitives
-- `dashmap` - concurrent hash maps
-
-## Static Rust Binaries
-
-- The Rust binaries in `dist_rust/` are statically linked (static-pie) via `"static": true` in the `@git.zone/tsrust` block of `.smartconfig.json` (tsrust >= 1.4.1). They run on both glibc (Debian/Ubuntu) and musl (Alpine) systems.
-- tsrust injects `RUSTFLAGS="-C target-feature=+crt-static"` only into its own per-target cargo invocations and verifies the result (no `PT_INTERP` ELF header). Keep `rust/.cargo/config.toml` free of `rustflags` entries: the injected env variable would replace them, and a repo-wide `rustflags` would also break plain `cargo test`/`cargo check` (proc-macros cannot build with `+crt-static` on linux-gnu without an explicit `--target`).
-- `pnpm run test:rust` runs the Rust unit tests; plain `cargo test` in `rust/` works as well.
-- Verify linkage manually with `ldd dist_rust/<binary>_linux_amd64` → "statically linked".
-
-## Type Checking
-
-- `@git.zone/tsbuild` is pinned at 4.4.2 and the stricter production/test checks are clean.
-- Do not downgrade tsbuild or add `skipLibCheck` to production configuration; fix source types at their origin.
-
-## Raw Queue Schema
-
-- Structured queue records continue to write schema V2 and read V1/V2. Only durable raw outbound records use schema V3.
-- A V3 record stores metadata and canonical CRLF-terminated exact unsigned RFC822 bytes in the same managed blob. Queue memory and public snapshots retain metadata only.
-- Raw-operation reservations charge enqueue at 3x and payload access, persistence, and direct send at 6x message length; the default 32 MiB message limit therefore requires the default 192 MiB budget. A separate 1,024-reservation cap bounds fixed per-operation overhead, and shutdown drains accepted reservations.
-- Managed queue startup uses `listPage()` when available so hydration never materializes the complete key listing in memory.
-- SmartMTA 9.4 is safe only after a current queue inventory contains zero `messageFormat: 'raw-rfc822'` items. Queue prefixes require one deployment-wide writer; the in-process ownership guard is not a distributed lease.

package/readme.plan.md

@@ -1,30 +0,0 @@
-# Rust Migration Plan
-
-## Completed Phases
-
-### Phase 6: Durable Per-Recipient Delivery And Bounce Outbox
-- Queue schema V2 stores explicit recipient dispositions and deterministic bounce operations in managed blob storage
-- Final 250 acceptance, permanent 5xx terminal state, and unresolved 4xx retry semantics are checkpointed per recipient
-- Built-in bounce processing is idempotent by operation ID; custom handlers receive the ID for at-least-once deduplication
-- Queue and delivery observers are isolated from committed state, statistics, and downstream listeners
-
-### Phase 3: Rust Primary Backend (DKIM/SPF/DMARC/IP Reputation)
-- Rust is the mandatory security backend — no TS fallbacks
-- All DKIM signing/verification, SPF, DMARC, IP reputation through Rust bridge
-
-### Phase 5: BounceManager + ContentScanner
-- BounceManager bounce detection delegated to Rust `detectBounce` IPC command
-- ContentScanner pattern matching delegated to new Rust `scanContent` IPC command
-- New module: `rust/crates/mailer-security/src/content_scanner.rs` (10 Rust tests)
-- ~215 lines removed from BounceManager, ~350 lines removed from ContentScanner
-- Binary attachment scanning (PE headers, VBA macros) stays in TS
-- Custom rules (runtime-configured) stay in TS
-- Net change: ~-560 TS lines, +265 Rust lines
-
-## Deferred
-
-| Component | Rationale |
-|-----------|-----------|
-| EmailValidator | Already thin; uses smartmail; minimal gain |
-| DNS record generation | Pure string building; zero benefit from Rust |
-| MIME building (`toRFC822String`) | Sync in TS, async via IPC; too much blast radius |