@rackbops/plugin-tracker 0.25.0 → 0.27.0

package/README.md

@@ -494,16 +494,24 @@ eBay's saved-search alerts reach eBay watches by mail (0.25.0), while `TRACKER_M
   an outage, bounces to the mailbox that forwarded it; that day's alert is not retried. The Worker
   is deployed by pasting `mail-worker/worker.js` into the Cloudflare dashboard's Worker editor; it is
   not in the plugin's npm bundle.
-- **What a message does.** Gmail's forwarding confirmation (from `forwarding-noreply@google.com`):
-  its code is DMed, to enter in Gmail's Forwarding and POP/IMAP settings. An eBay alert: the
+- **What a message does.** Gmail's forwarding confirmation: its code is DMed, to enter in Gmail's
+  Forwarding and POP/IMAP settings. Since 0.26.0 it is any sender at Google naming forwarding. Since
+  0.27.0 the code is a run of digits standing alone in the subject or shortly after the word
+  "code" in the body, and Gmail's verify link (a `/mail/vf-` address on `mail.google.com`,
+  `mail-settings.google.com` or a subdomain of either, never its cancel link) is DMed too; digits inside
+  an address are never the code. An eBay alert: the
   matches above "You might also like" (never eBay's suggestions) -- title, the item's bare
   `/itm/<number>` address, the price's lower end -- go into the inbox of each of the person's live
   eBay watches whose words are the saved search's (case and spacing aside), exactly as listings sent
   through the task API; the watch's next look DMs the new ones. Words match with case, spacing and
   the marks `` ` * _ ~ | < > @ # [ ] ( ) \ : / `` ignored. An alert no watch searches for gets a
   DM saying so, with the `/want` that would watch it, each time eBay sends it. Anything else is
-  dropped. A message is never stored, only the listings read from it, and nothing from it is
-  logged.
+  dropped. A message is never stored, only the listings read from it, and its words are never
+  logged: one that does nothing is logged only with why (the owner is not registered, or its
+  sender's domain -- a Google no-reply sender whole -- which bodies it had, and whether its
+  subject names forwarding; for Google's no-reply senders also its subject's shape, letters `a`,
+  digits `9` and each address `<addr>`, and counts from its body as read, plain text else the
+  HTML's text).
 - **Only eBay's own domains** (ebay.com, .co.uk, .de, .ca, .com.au and the rest of eBay's sites;
   never a lookalike such as `ebay.com.de`) count as eBay, for the sender and for every item link.
   The sender is its `From` address, not a checked signature: the private address is the guard, and

package/dist/plugin.js

@@ -13598,7 +13598,6 @@ var MAIL_DOMAIN_KEY = "TRACKER_MAIL_DOMAIN";
 var MAIL_KEY_KEY = "TRACKER_MAIL_KEY";
 var MAIL_DOMAIN_FORMAT = "^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$";
 var MIN_MAIL_KEY = 32;
-var GMAIL_FORWARDING = "forwarding-noreply@google.com";
 var LOCAL = /^m-[0-9a-f]{24}$/;
 function parseMailConfig(env) {
   const domain = (env[MAIL_DOMAIN_KEY] ?? "").trim();
@@ -13644,13 +13643,63 @@ class MailAddresses {
     return row?.user_id ?? null;
   }
 }
-function forwardingCode(mail) {
-  if (mail.from !== GMAIL_FORWARDING || !/forwarding confirmation/i.test(mail.subject))
+function fromGoogle(address) {
+  const host = address?.slice(address.lastIndexOf("@") + 1) ?? "";
+  return host === "google.com" || host.endsWith(".google.com");
+}
+var GMAIL_LINK = /https:\/\/(?:[a-z0-9-]{1,63}\.){0,4}(?:mail|mail-settings)\.google\.com\/[A-Za-z0-9\-._~%/?#&=+:@!$,;]{1,1000}/gi;
+function decodedHtmlLinks(html) {
+  return html.slice(0, MAX_HTML_CHARS).replace(/&(?:amp|#0*38|#x0*26);/gi, "&");
+}
+function trimClosingMarks(s) {
+  let end = s.length;
+  while (end > 0 && ".,;:!?".includes(s.charAt(end - 1)))
+    end--;
+  return s.slice(0, end);
+}
+function gmailLink(s) {
+  for (const l of s.match(GMAIL_LINK) ?? []) {
+    const link = trimClosingMarks(l);
+    if (/^https:\/\/[^/]+\/mail\/vf-/i.test(link))
+      return link;
+  }
+  return null;
+}
+function withoutAddresses(s) {
+  return s.split(/\s+/).filter((w) => !w.includes("@")).join(" ");
+}
+function bodyText(mail) {
+  return mail.text || (mail.html !== null ? htmlText(mail.html.slice(0, MAX_HTML_CHARS)) : "");
+}
+function forwardingConfirmation(mail) {
+  if (!fromGoogle(mail.from))
     return null;
-  const inSubject = /\(#(\d{6,12})\)/.exec(mail.subject)?.[1];
-  if (inSubject)
-    return inSubject;
-  return /confirmation code:\s*(\d{6,12})/i.exec(mail.text ?? mail.html ?? "")?.[1] ?? null;
+  const leading = /^\(#(\d{6,12})\)/.exec(mail.subject)?.[1] ?? null;
+  const body = bodyText(mail);
+  if (!leading && !/forwarding/i.test(mail.subject) && !/forward/i.test(body))
+    return null;
+  const subject = withoutAddresses(mail.subject.slice(0, 500));
+  const code = leading ?? /(?:^|[\s#(])(\d{6,12})(?=$|[\s).,:;])/.exec(subject)?.[1] ?? /\bcode\b\D{0,40}?(?<![\w.@/=%?&#:-])(\d{6,12})(?!\d)/i.exec(withoutAddresses(body))?.[1] ?? null;
+  const link = gmailLink(mail.text ?? "") ?? (mail.html !== null ? gmailLink(decodedHtmlLinks(mail.html)) : null);
+  return code || link ? { code, link } : null;
+}
+function shape(s) {
+  return s.replace(/\p{L}/gu, "a").replace(/\p{N}/gu, "9").replace(/[^\x20-\x7e]/g, "?").slice(0, 160);
+}
+function subjectShape(subject) {
+  return subject.slice(0, 500).split(/\s+/).map((w) => w.includes("@") ? "<addr>" : shape(w)).join(" ").slice(0, 160);
+}
+function ignoredWhy(mail) {
+  const system = mail.from !== null && fromGoogle(mail.from) && /^[a-z-]*no-?reply$/.test(mail.from.slice(0, mail.from.lastIndexOf("@")));
+  const domain = mail.from ? system ? mail.from : mail.from.slice(mail.from.lastIndexOf("@") + 1) : "none";
+  const parts = [mail.html !== null ? "html" : "", mail.text !== null ? "text" : ""].filter(Boolean).join("+") || "no body";
+  const base = `from ${domain.replace(/[^a-z0-9.@-]/g, "?").slice(0, 100)}, ${parts}, subject ${/forwarding/i.test(mail.subject) ? "names" : "does not name"} forwarding`;
+  if (!system)
+    return base;
+  const body = bodyText(mail);
+  const runs = (body.match(/\d{6,12}/g) ?? []).length;
+  const links = (body.match(/https:\/\/[a-z0-9.-]{1,253}/gi) ?? []).length;
+  return `${base}, subject shape "${subjectShape(mail.subject)}", body ${body.length} chars, ${runs} digit run(s), ${links} https link(s), says code: ${/code/i.test(body) ? "yes" : "no"}`;
 }
 function quoted(words) {
   return words.replace(SEARCH_MARKS, " ").replace(/\s+/g, " ").trim().slice(0, 100);
@@ -13678,15 +13727,19 @@ async function tell(d, userId, text) {
 async function deliverMail(d, userId, mail) {
   const user = await d.store.getUser(userId);
   if (!user || !d.admissions.isRegistered(user.id) || !d.inbox)
-    return { kind: "ignored" };
-  const code = forwardingCode(mail);
-  if (code) {
-    await tell(d, user.id, `Gmail asks to confirm forwarding to your alert address. The confirmation code is ${code}: enter it in Gmail's Settings, under Forwarding and POP/IMAP. If you did not ask for this, ignore it.`);
+    return { kind: "ignored", why: "the owner is not registered" };
+  const confirm = forwardingConfirmation(mail);
+  if (confirm) {
+    const how = [
+      confirm.code ? `The confirmation code is ${confirm.code}: enter it in Gmail's Settings, under Forwarding and POP/IMAP.` : "",
+      confirm.link ? `${confirm.code ? "Or open" : "Open"} Gmail's confirmation link: <${confirm.link}>` : ""
+    ].filter(Boolean).join(" ");
+    await tell(d, user.id, `Gmail asks to confirm forwarding to your alert address. ${how} If you did not ask for this, ignore it.`);
     return { kind: "confirmation" };
   }
   const alert = readEbayAlert(mail);
   if (!alert)
-    return { kind: "ignored" };
+    return { kind: "ignored", why: ignoredWhy(mail) };
   const listings = [];
   for (const raw of alert.listings) {
     const l = acceptListing(raw);
@@ -13758,7 +13811,7 @@ function params(value) {
   return { value: first.trim().toLowerCase(), params: out };
 }
 function quotedPrintable(body) {
-  const s = body.replace(/=\r?\n/g, "").replace(/=([0-9A-Fa-f]{2})/g, (_, h) => String.fromCharCode(Number.parseInt(h, 16)));
+  const s = body.replace(/=[ \t]*\r?\n/g, "").replace(/=([0-9A-Fa-f]{2})/g, (_, h) => String.fromCharCode(Number.parseInt(h, 16)));
   return bytesOf(s);
 }
 function base64(body) {
@@ -13884,8 +13937,12 @@ async function handleMailInbound(m, request) {
     const outcome = await deliverMail(d, userId, parseMail(raw));
     if (outcome.kind === "stored")
       d.log.info(`mail: an eBay alert gave ${outcome.listings} listing(s) to ${outcome.watches} watch(es)`);
+    else if (outcome.kind === "ignored")
+      d.log.info(`mail: one message ignored (${outcome.why})`);
     else
       d.log.info(`mail: one message ${outcome.kind}`);
+    if (outcome.kind === "ignored")
+      return answer(200, { result: "ignored" });
     const { kind, ...rest } = outcome;
     return answer(200, { result: kind, ...rest });
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rackbops/plugin-tracker",
-  "version": "0.25.0",
+  "version": "0.27.0",
   "description": "The task tracker for Rackbops Clerk: reminders, renewals, price drops, one-off research and an interest scout (through city-hall, with their findings), a want-list watcher (listing pages you paste, BoardGameGeek through its API once its token is set, and eBay and BoardGameGeek listings you send in through the task API or that eBay's saved-search alert emails forwarded to your alert address carry, which the watcher never opens; with the model checking each new listing and its seller first, through city-hall) by slash command, delivered by DM with buttons, and a daily DM at each person's hour of what is due today and overdue, on docket's SQLite store (/allow, /register, /remind, /renewal, /price, /research, /scout, /want, /tasks, /task, /settings, /web), with a web area for your tasks, history and settings, a web editor to make, change, pause and delete your own tasks (research requests too, made but not changed, and scouts, made and changed), an admin view (with the DMs that did not arrive, raising a person's daily model ceiling, and daily model usage per person), an operator switch that turns the daily budgets off for the alpha, forget-me, and a JSON task API with personal API tokens",
   "type": "module",
   "main": "dist/plugin.js",