@remit/data-ports 0.0.30 → 0.0.31

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/data-ports",
-  "version": "0.0.30",
+  "version": "0.0.31",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",
@@ -25,6 +25,10 @@
       "types": "./src/account-settings.ts",
       "default": "./src/account-settings.ts"
     },
+    "./display-name": {
+      "types": "./src/display-name.ts",
+      "default": "./src/display-name.ts"
+    },
     "./wellknown": {
       "types": "./src/wellknown.ts",
       "default": "./src/wellknown.ts"

package/src/display-name.test.ts

@@ -0,0 +1,114 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { storedDisplayName } from "./display-name.js";
+
+const OWN = "matthijs@ischen.nl";
+const SPOOFED = "aramirez@secresaludguaviare.gov.co";
+
+/**
+ * The name is a stranger's address and nothing else, so nothing survives it.
+ */
+const emptied: ReadonlyArray<readonly [string, string]> = [
+	["the incident", "matthijs@ischen.nl"],
+	["quoted", '"matthijs@ischen.nl"'],
+	["angle-bracketed", "<matthijs@ischen.nl>"],
+	["BATV-wrapped", "prvs=0068b51f37=matthijs@ischen.nl"],
+	["upper case", "MATTHIJS@ISCHEN.NL"],
+	["a subdomain apart", "matthijs@mail.ischen.nl"],
+	["separated by a tab", "\tmatthijs@ischen.nl"],
+	["separated by a no-break space", " matthijs@ischen.nl"],
+	["separated by a zero-width space", "​matthijs@ischen.nl"],
+	["a non-ASCII local part", "Özcan@example.com"],
+];
+
+/**
+ * The name says something besides the address, and that something is what its
+ * recipient knows the sender by. Removing it to remove the address destroys
+ * real text on a live instance.
+ */
+const stripped: ReadonlyArray<readonly [string, string, string]> = [
+	["parenthesised", "Support (support@acme.com)", "Support"],
+	["angle-bracketed", "Matthijs <matthijs@ischen.nl>", "Matthijs"],
+	["comma-separated", "matthijs@ischen.nl, team", "team"],
+	["semicolon-separated", "Team; matthijs@ischen.nl", "Team"],
+	["colon-separated", "Reply to: matthijs@ischen.nl", "Reply to"],
+	["leading and parenthesised", "(matthijs@ischen.nl) Support", "Support"],
+	["mid-name", "Support <matthijs@ischen.nl> Team", "Support Team"],
+	["with a trailing verb", "matthijs@ischen.nl wrote", "wrote"],
+	[
+		"quoted around a name",
+		'Bob "The Builder" <bob@acme.com>',
+		'Bob "The Builder"',
+	],
+	["a tab away from the name", "Support\tmatthijs@ischen.nl", "Support"],
+];
+
+const kept: ReadonlyArray<readonly [string, string]> = [
+	["an ordinary human name", "Matthijs van Henten"],
+	["a name with a full stop", "Dr. M. van Henten"],
+	["a company name", "ING Bank N.V."],
+	["a bare word", "Newsletter"],
+	["an empty name", ""],
+	["a name with an at-sign but no domain", "me @ home"],
+	["a social handle", "@matthijs"],
+	["a version string", "release 2.11"],
+	["a domain with no local part", "ischen.nl"],
+	["a single-letter tld", "a@b.c"],
+];
+
+describe("a display name that claims to be an address", () => {
+	for (const [what, name] of emptied) {
+		it(`empties ${what}`, () => {
+			assert.equal(storedDisplayName(name, SPOOFED), "");
+		});
+	}
+
+	for (const [what, name, remainder] of stripped) {
+		it(`keeps what is left after ${what}`, () => {
+			assert.equal(storedDisplayName(name, SPOOFED), remainder);
+		});
+	}
+
+	for (const [what, name] of kept) {
+		it(`leaves ${what} alone`, () => {
+			assert.equal(storedDisplayName(name, OWN), name);
+		});
+	}
+
+	it("keeps the address it labels", () => {
+		assert.equal(storedDisplayName(OWN, OWN), OWN);
+	});
+
+	it("keeps its own address inside a longer name", () => {
+		const name = "Matthijs <matthijs@ischen.nl>";
+		assert.equal(storedDisplayName(name, OWN), name);
+	});
+
+	/**
+	 * SQLite folds `A-Z` and stops; JS folds the whole of Unicode. A rule spelled
+	 * once in SQL and once in TypeScript disagrees exactly here, and the
+	 * disagreement rewrites a name on a live database.
+	 */
+	it("folds case beyond ASCII on both sides", () => {
+		assert.equal(
+			storedDisplayName("Özcan@example.com", "özcan@example.com"),
+			"Özcan@example.com",
+		);
+		assert.equal(
+			storedDisplayName("ÖZCAN@EXAMPLE.COM", "özcan@example.com"),
+			"ÖZCAN@EXAMPLE.COM",
+		);
+	});
+
+	it("removes any address when the envelope carried none", () => {
+		assert.equal(storedDisplayName(`Support ${OWN}`, undefined), "Support");
+		assert.equal(storedDisplayName("Matthijs", undefined), "Matthijs");
+	});
+
+	it("removes a second address and keeps its own", () => {
+		assert.equal(
+			storedDisplayName(`${OWN} on behalf of ${SPOOFED}`, OWN),
+			`${OWN} on behalf of`,
+		);
+	});
+});

package/src/display-name.ts

@@ -0,0 +1,86 @@
+/**
+ * A display name that claims to be an email address (issue #826).
+ *
+ * The name on an envelope address is free text its sender chooses; the address
+ * is verifiable. A spam envelope of
+ * `matthijs@ischen.nl <aramirez@secresaludguaviare.gov.co>` therefore labels a
+ * stranger's address with the reader's own, and every surface that shows a name
+ * — the message list, the message header, contact autocomplete — repeats the
+ * claim. On 2026-08-18 autocomplete offered such a row back and private mail
+ * left the instance.
+ *
+ * The rule is one function because it has to hold in two places at once: the
+ * harvest that decides what to store, and the repair that rewrites what is
+ * already stored. Two spellings of it disagree at the edges — SQL `lower()`
+ * folds ASCII only where JS folds all of Unicode — and every disagreement
+ * rewrites a name on a live database that holds the only copy of it.
+ *
+ * What comes out is the name minus the claim, not the empty string. A sender
+ * signing itself `Support (support@acme.com)` from `noreply@acme.com` is
+ * ordinary mail, and `Support` is the name its recipient knows it by; deleting
+ * that to remove the address takes real text off a live instance. Only the
+ * address is removed, with the punctuation that was holding it, and a name that
+ * is nothing but the claim comes back empty.
+ *
+ * An address the name shares with the address it labels is not a claim about
+ * anyone else, so it stays — `Matthijs <matthijs@ischen.nl>` on
+ * `matthijs@ischen.nl` is the same information twice.
+ */
+
+const EMBEDDED_ADDRESS =
+	/[^\s@<>()[\],;:"'\\]+@[^\s@<>()[\],;:"'\\]+\.[^\s@<>()[\],;:"'\\.]{2,}/gu;
+
+/** `( )`, `< >`, `""` — a delimiter pair the removed address was sitting in. */
+const EMPTIED_PAIR = /[<([{"']\s*[>)\]}"']/gu;
+
+/**
+ * What is left holding the address once it is gone: the separators around it.
+ * Brackets and quotes are not trimmed here — EMPTIED_PAIR has already taken the
+ * ones that were wrapping the address, and a name can legitimately end in one.
+ */
+const EDGE_SEPARATORS = /^[\s,;:|/\\-]+|[\s,;:|/\\-]+$/gu;
+
+const tidy = (text: string): string =>
+	text
+		.replace(EMPTIED_PAIR, " ")
+		.replace(/\s+/gu, " ")
+		.replace(EDGE_SEPARATORS, "")
+		.trim();
+
+/**
+ * `normalizedEmail` absent means the envelope carried no address this name
+ * could be describing, so any address in the name is a claim about nobody.
+ */
+const claimsAnotherAddress = (
+	text: string,
+	own: string | undefined,
+): boolean => {
+	for (const [address] of text.matchAll(EMBEDDED_ADDRESS)) {
+		if (address.toLowerCase() !== own) return true;
+	}
+	return false;
+};
+
+/**
+ * The display name as it should be stored, for both the harvest and the repair.
+ * Unchanged when the name claims nothing.
+ */
+export const storedDisplayName = (
+	displayName: string | undefined,
+	normalizedEmail: string | undefined,
+): string => {
+	if (!displayName) return "";
+	const own = normalizedEmail?.toLowerCase();
+	if (!claimsAnotherAddress(displayName, own)) return displayName;
+
+	const remainder = tidy(
+		displayName.replace(EMBEDDED_ADDRESS, (address) =>
+			address.toLowerCase() === own ? address : " ",
+		),
+	);
+	// Stripping leaves at most the row's own address behind, so the re-check is a
+	// backstop rather than a case: nothing that still claims another address is
+	// ever stored, whatever the shape it was hiding in.
+	if (!remainder || claimsAnotherAddress(remainder, own)) return "";
+	return remainder;
+};