@rackbops/plugin-tracker 0.26.0 → 0.27.0

package/README.md

@@ -495,9 +495,11 @@ eBay's saved-search alerts reach eBay watches by mail (0.25.0), while `TRACKER_M
   is deployed by pasting `mail-worker/worker.js` into the Cloudflare dashboard's Worker editor; it is
   not in the plugin's npm bundle.
 - **What a message does.** Gmail's forwarding confirmation: its code is DMed, to enter in Gmail's
-  Forwarding and POP/IMAP settings. Since 0.26.0 it is any sender at Google naming forwarding, with
-  the code as `#<digits>` in the subject or after "confirmation code" in the body, or a subject in
-  any language that starts `(#<digits>)`. An eBay alert: the
+  Forwarding and POP/IMAP settings. Since 0.26.0 it is any sender at Google naming forwarding. Since
+  0.27.0 the code is a run of digits standing alone in the subject or shortly after the word
+  "code" in the body, and Gmail's verify link (a `/mail/vf-` address on `mail.google.com`,
+  `mail-settings.google.com` or a subdomain of either, never its cancel link) is DMed too; digits inside
+  an address are never the code. An eBay alert: the
   matches above "You might also like" (never eBay's suggestions) -- title, the item's bare
   `/itm/<number>` address, the price's lower end -- go into the inbox of each of the person's live
   eBay watches whose words are the saved search's (case and spacing aside), exactly as listings sent
@@ -507,7 +509,9 @@ eBay's saved-search alerts reach eBay watches by mail (0.25.0), while `TRACKER_M
   dropped. A message is never stored, only the listings read from it, and its words are never
   logged: one that does nothing is logged only with why (the owner is not registered, or its
   sender's domain -- a Google no-reply sender whole -- which bodies it had, and whether its
-  subject names forwarding).
+  subject names forwarding; for Google's no-reply senders also its subject's shape, letters `a`,
+  digits `9` and each address `<addr>`, and counts from its body as read, plain text else the
+  HTML's text).
 - **Only eBay's own domains** (ebay.com, .co.uk, .de, .ca, .com.au and the rest of eBay's sites;
   never a lookalike such as `ebay.com.de`) count as eBay, for the sender and for every item link.
   The sender is its `From` address, not a checked signature: the private address is the guard, and

package/dist/plugin.js

@@ -13647,25 +13647,59 @@ function fromGoogle(address) {
   const host = address?.slice(address.lastIndexOf("@") + 1) ?? "";
   return host === "google.com" || host.endsWith(".google.com");
 }
-function forwardingCode(mail) {
+var GMAIL_LINK = /https:\/\/(?:[a-z0-9-]{1,63}\.){0,4}(?:mail|mail-settings)\.google\.com\/[A-Za-z0-9\-._~%/?#&=+:@!$,;]{1,1000}/gi;
+function decodedHtmlLinks(html) {
+  return html.slice(0, MAX_HTML_CHARS).replace(/&(?:amp|#0*38|#x0*26);/gi, "&");
+}
+function trimClosingMarks(s) {
+  let end = s.length;
+  while (end > 0 && ".,;:!?".includes(s.charAt(end - 1)))
+    end--;
+  return s.slice(0, end);
+}
+function gmailLink(s) {
+  for (const l of s.match(GMAIL_LINK) ?? []) {
+    const link = trimClosingMarks(l);
+    if (/^https:\/\/[^/]+\/mail\/vf-/i.test(link))
+      return link;
+  }
+  return null;
+}
+function withoutAddresses(s) {
+  return s.split(/\s+/).filter((w) => !w.includes("@")).join(" ");
+}
+function bodyText(mail) {
+  return mail.text || (mail.html !== null ? htmlText(mail.html.slice(0, MAX_HTML_CHARS)) : "");
+}
+function forwardingConfirmation(mail) {
   if (!fromGoogle(mail.from))
     return null;
-  const leading = /^\(#(\d{6,12})\)/.exec(mail.subject)?.[1];
-  if (leading)
-    return leading;
-  const body = mail.text || (mail.html !== null ? htmlText(mail.html.slice(0, MAX_HTML_CHARS)) : "");
-  if (!/forwarding/i.test(mail.subject) && !/forward/i.test(body))
+  const leading = /^\(#(\d{6,12})\)/.exec(mail.subject)?.[1] ?? null;
+  const body = bodyText(mail);
+  if (!leading && !/forwarding/i.test(mail.subject) && !/forward/i.test(body))
     return null;
-  const inSubject = /#\s?(\d{6,12})\b/.exec(mail.subject)?.[1];
-  if (inSubject)
-    return inSubject;
-  return /confirmation code\W{0,20}(\d{6,12})\b/i.exec(body)?.[1] ?? null;
+  const subject = withoutAddresses(mail.subject.slice(0, 500));
+  const code = leading ?? /(?:^|[\s#(])(\d{6,12})(?=$|[\s).,:;])/.exec(subject)?.[1] ?? /\bcode\b\D{0,40}?(?<![\w.@/=%?&#:-])(\d{6,12})(?!\d)/i.exec(withoutAddresses(body))?.[1] ?? null;
+  const link = gmailLink(mail.text ?? "") ?? (mail.html !== null ? gmailLink(decodedHtmlLinks(mail.html)) : null);
+  return code || link ? { code, link } : null;
+}
+function shape(s) {
+  return s.replace(/\p{L}/gu, "a").replace(/\p{N}/gu, "9").replace(/[^\x20-\x7e]/g, "?").slice(0, 160);
+}
+function subjectShape(subject) {
+  return subject.slice(0, 500).split(/\s+/).map((w) => w.includes("@") ? "<addr>" : shape(w)).join(" ").slice(0, 160);
 }
 function ignoredWhy(mail) {
   const system = mail.from !== null && fromGoogle(mail.from) && /^[a-z-]*no-?reply$/.test(mail.from.slice(0, mail.from.lastIndexOf("@")));
   const domain = mail.from ? system ? mail.from : mail.from.slice(mail.from.lastIndexOf("@") + 1) : "none";
   const parts = [mail.html !== null ? "html" : "", mail.text !== null ? "text" : ""].filter(Boolean).join("+") || "no body";
-  return `from ${domain.replace(/[^a-z0-9.@-]/g, "?").slice(0, 100)}, ${parts}, subject ${/forwarding/i.test(mail.subject) ? "names" : "does not name"} forwarding`;
+  const base = `from ${domain.replace(/[^a-z0-9.@-]/g, "?").slice(0, 100)}, ${parts}, subject ${/forwarding/i.test(mail.subject) ? "names" : "does not name"} forwarding`;
+  if (!system)
+    return base;
+  const body = bodyText(mail);
+  const runs = (body.match(/\d{6,12}/g) ?? []).length;
+  const links = (body.match(/https:\/\/[a-z0-9.-]{1,253}/gi) ?? []).length;
+  return `${base}, subject shape "${subjectShape(mail.subject)}", body ${body.length} chars, ${runs} digit run(s), ${links} https link(s), says code: ${/code/i.test(body) ? "yes" : "no"}`;
 }
 function quoted(words) {
   return words.replace(SEARCH_MARKS, " ").replace(/\s+/g, " ").trim().slice(0, 100);
@@ -13694,9 +13728,13 @@ async function deliverMail(d, userId, mail) {
   const user = await d.store.getUser(userId);
   if (!user || !d.admissions.isRegistered(user.id) || !d.inbox)
     return { kind: "ignored", why: "the owner is not registered" };
-  const code = forwardingCode(mail);
-  if (code) {
-    await tell(d, user.id, `Gmail asks to confirm forwarding to your alert address. The confirmation code is ${code}: enter it in Gmail's Settings, under Forwarding and POP/IMAP. If you did not ask for this, ignore it.`);
+  const confirm = forwardingConfirmation(mail);
+  if (confirm) {
+    const how = [
+      confirm.code ? `The confirmation code is ${confirm.code}: enter it in Gmail's Settings, under Forwarding and POP/IMAP.` : "",
+      confirm.link ? `${confirm.code ? "Or open" : "Open"} Gmail's confirmation link: <${confirm.link}>` : ""
+    ].filter(Boolean).join(" ");
+    await tell(d, user.id, `Gmail asks to confirm forwarding to your alert address. ${how} If you did not ask for this, ignore it.`);
     return { kind: "confirmation" };
   }
   const alert = readEbayAlert(mail);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rackbops/plugin-tracker",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "description": "The task tracker for Rackbops Clerk: reminders, renewals, price drops, one-off research and an interest scout (through city-hall, with their findings), a want-list watcher (listing pages you paste, BoardGameGeek through its API once its token is set, and eBay and BoardGameGeek listings you send in through the task API or that eBay's saved-search alert emails forwarded to your alert address carry, which the watcher never opens; with the model checking each new listing and its seller first, through city-hall) by slash command, delivered by DM with buttons, and a daily DM at each person's hour of what is due today and overdue, on docket's SQLite store (/allow, /register, /remind, /renewal, /price, /research, /scout, /want, /tasks, /task, /settings, /web), with a web area for your tasks, history and settings, a web editor to make, change, pause and delete your own tasks (research requests too, made but not changed, and scouts, made and changed), an admin view (with the DMs that did not arrive, raising a person's daily model ceiling, and daily model usage per person), an operator switch that turns the daily budgets off for the alpha, forget-me, and a JSON task API with personal API tokens",
   "type": "module",
   "main": "dist/plugin.js",