@remit/mailbox-service 0.0.111 → 0.0.113

package/src/heuristics/classifyRealMail.test.ts

@@ -1,242 +0,0 @@
-/**
- * Classification against realistic mail, drawn from the senders reported in
- * issue #45 ("only personal and marketing seem to work").
- *
- * The rule table is easy to satisfy with synthetic one-header fixtures and
- * still wrong on real mail, because real bulk senders set several signals at
- * once. Every case here carries the full header set the sender actually emits,
- * so the test fails when rule ORDER regresses even though each individual rule
- * still works.
- */
-
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import { MessageCategory } from "@remit/domain-enums";
-import { simpleParser } from "mailparser";
-import { classifyByHeaders } from "./classifyByHeaders.js";
-
-const classify = async (lines: string[]) =>
-	classifyByHeaders(await simpleParser(Buffer.from(lines.join("\r\n"))));
-
-describe("classifyByHeaders on realistic mail", () => {
-	describe("platform notifications", () => {
-		it("classifies an npm publish notification as automated", async () => {
-			const category = await classify([
-				"From: npm <notifications@npmjs.com>",
-				"To: me@example.com",
-				"Subject: A new version of left-pad was published",
-				"DKIM-Signature: v=1; a=rsa-sha256; d=npmjs.com; s=s1; h=from:to",
-				"Content-Type: text/plain",
-				"",
-				"published",
-			]);
-			assert.equal(category, MessageCategory.automated);
-		});
-
-		it("classifies an npm mail relayed through SES as automated", async () => {
-			const category = await classify([
-				"Return-Path: <bounces@amazonses.com>",
-				"From: npm <support@npmjs.com>",
-				"To: me@example.com",
-				"Subject: A new device signed in to your npm account",
-				"Feedback-ID: 1.eu-west-1.abc:AmazonSES",
-				"DKIM-Signature: v=1; a=rsa-sha256; d=amazonses.com; s=x; h=from:to",
-				"Content-Type: text/html",
-				"",
-				"<p>signed in</p>",
-			]);
-			assert.equal(category, MessageCategory.automated);
-		});
-
-		it("classifies a no-reply notification with no bulk headers as automated", async () => {
-			// The reported npm case: one-to-one machine mail, aligned DKIM, and no
-			// List-* or Precedence header at all. It used to reach the `personal`
-			// fallback and sit among real correspondence.
-			const category = await classify([
-				"From: CircleCI <no-reply@circleci.com>",
-				"To: me@example.com",
-				"Subject: Your build failed",
-				"DKIM-Signature: v=1; a=rsa-sha256; d=circleci.com; s=s1; h=from:to",
-				"Content-Type: text/plain",
-				"",
-				"build failed",
-			]);
-			assert.equal(category, MessageCategory.automated);
-		});
-
-		it("classifies X-Auto-Response-Suppress mail as automated", async () => {
-			const category = await classify([
-				"From: Helpdesk <ticketing@corp.example>",
-				"To: me@example.com",
-				"Subject: Ticket 4711 updated",
-				"X-Auto-Response-Suppress: All",
-				"Content-Type: text/plain",
-				"",
-				"updated",
-			]);
-			assert.equal(category, MessageCategory.automated);
-		});
-	});
-
-	describe("allow-listed sender domains outrank bulk headers", () => {
-		it("classifies a GitHub pull-request notification as transactional", async () => {
-			// GitHub sets List-ID, List-Unsubscribe AND Precedence: list. Before the
-			// reorder, Precedence matched first and every GitHub mail — security
-			// alerts and receipts included — landed in `automated`, contradicting
-			// the reason GitHub is on the transactional allow-list at all.
-			const category = await classify([
-				"From: contributor <notifications@github.com>",
-				"To: me@example.com",
-				"Subject: Re: [org/repo] Fix the thing (PR #45)",
-				"List-ID: org/repo <repo.org.github.com>",
-				"List-Unsubscribe: <https://github.com/unsub>",
-				"Precedence: list",
-				"DKIM-Signature: v=1; a=rsa-sha256; d=github.com; s=pf2014; h=from:to",
-				"Content-Type: text/plain",
-				"",
-				"comment",
-			]);
-			assert.equal(category, MessageCategory.transactional);
-		});
-
-		it("classifies a GitHub security alert as transactional", async () => {
-			const category = await classify([
-				"From: GitHub <noreply@github.com>",
-				"To: me@example.com",
-				"Subject: [org/repo] Dependabot alert",
-				"Precedence: bulk",
-				"Content-Type: text/plain",
-				"",
-				"alert",
-			]);
-			assert.equal(category, MessageCategory.transactional);
-		});
-
-		it("classifies a LinkedIn notification as social", async () => {
-			// The reported LinkedIn case. List-Unsubscribe matched before the social
-			// allow-list, so LinkedIn mail was filed as generic `marketing` and the
-			// Social bucket stayed empty.
-			const category = await classify([
-				"Return-Path: <s-hbhcfzp@bounce.linkedin.com>",
-				"From: LinkedIn <messages-noreply@linkedin.com>",
-				"To: me@example.com",
-				"Subject: You have a new invitation",
-				"List-Unsubscribe: <https://www.linkedin.com/e/unsub>",
-				"DKIM-Signature: v=1; a=rsa-sha256; d=linkedin.com; s=proddkim; h=from:to",
-				"Content-Type: text/html",
-				"",
-				"<p>invitation</p>",
-			]);
-			assert.equal(category, MessageCategory.social);
-		});
-
-		it("classifies a LinkedIn job alert from a subdomain as social", async () => {
-			const category = await classify([
-				"From: LinkedIn Job Alerts <jobalerts-noreply@e.linkedin.com>",
-				"To: me@example.com",
-				"Subject: 20 new jobs for you",
-				"Precedence: bulk",
-				"List-Unsubscribe: <https://www.linkedin.com/e/unsub>",
-				"Content-Type: text/html",
-				"",
-				"<p>jobs</p>",
-			]);
-			assert.equal(category, MessageCategory.social);
-		});
-	});
-
-	describe("bulk mail keeps its intent bucket", () => {
-		it("classifies a marketing blast that also sets Precedence: bulk as marketing", async () => {
-			// Nearly every marketing platform sets Precedence: bulk. Matching it
-			// first swallowed the whole Marketing bucket into `automated`.
-			const category = await classify([
-				"From: Shop <deals@shop.example>",
-				"To: me@example.com",
-				"Subject: 50% off everything",
-				"Precedence: bulk",
-				"List-Unsubscribe: <https://shop.example/unsub>",
-				"List-Unsubscribe-Post: List-Unsubscribe=One-Click",
-				"Content-Type: text/html",
-				"",
-				"<p>sale</p>",
-			]);
-			assert.equal(category, MessageCategory.marketing);
-		});
-
-		it("classifies a newsletter that also sets Precedence: list as newsletter", async () => {
-			const category = await classify([
-				"From: Some Writer <writer@substack.example>",
-				"To: me@example.com",
-				"Subject: This week's issue",
-				"Precedence: list",
-				"List-ID: <someletter.substack.example>",
-				"List-Unsubscribe: <https://substack.example/unsub>",
-				"Content-Type: text/html",
-				"",
-				"<p>news</p>",
-			]);
-			assert.equal(category, MessageCategory.newsletter);
-		});
-
-		it("classifies a mailing-list post as newsletter, not automated", async () => {
-			const category = await classify([
-				"From: Contributor <dev@lists.example>",
-				"To: dev@lists.example",
-				"Subject: [PATCH v2] fix the parser",
-				"Precedence: list",
-				"List-ID: <dev.lists.example>",
-				"List-Unsubscribe: <mailto:dev-unsubscribe@lists.example>",
-				"Content-Type: text/plain",
-				"",
-				"patch",
-			]);
-			assert.equal(category, MessageCategory.newsletter);
-		});
-	});
-
-	describe("personal mail stays personal", () => {
-		it("classifies a person writing from Gmail as personal", async () => {
-			const category = await classify([
-				"From: Alice <alice@gmail.com>",
-				"To: me@example.com",
-				"Subject: lunch?",
-				"DKIM-Signature: v=1; a=rsa-sha256; d=gmail.com; s=20230601; h=from:to",
-				"Content-Type: text/plain",
-				"",
-				"lunch tomorrow?",
-			]);
-			assert.equal(category, MessageCategory.personal);
-		});
-
-		it("does not treat a human support mailbox as a machine sender", async () => {
-			// `support@` is answered by people. Adding it to the machine local-parts
-			// would quietly bury real correspondence in `automated`.
-			const category = await classify([
-				"From: Acme Support <support@acme.example>",
-				"To: me@example.com",
-				"Subject: Re: your question",
-				"Content-Type: text/plain",
-				"",
-				"answering your question",
-			]);
-			assert.equal(category, MessageCategory.personal);
-		});
-
-		it("classifies a calendar invite from a colleague as transactional", async () => {
-			const category = await classify([
-				"From: Bob <bob@corp.example>",
-				"To: me@example.com",
-				"Subject: Invitation: standup",
-				'Content-Type: multipart/mixed; boundary="b1"',
-				"",
-				"--b1",
-				"Content-Type: text/calendar; method=REQUEST",
-				"",
-				"BEGIN:VCALENDAR",
-				"END:VCALENDAR",
-				"--b1--",
-			]);
-			assert.equal(category, MessageCategory.transactional);
-		});
-	});
-});

package/src/heuristics/machineSenders.test.ts

@@ -1,101 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import { hasMachineHeader, isMachineLocalPart } from "./machineSenders.js";
-
-describe("isMachineLocalPart", () => {
-	it("matches the no-reply spellings", () => {
-		for (const localPart of [
-			"noreply",
-			"no-reply",
-			"no_reply",
-			"NoReply",
-			"donotreply",
-			"do-not-reply",
-		]) {
-			assert.equal(isMachineLocalPart(localPart), true, localPart);
-		}
-	});
-
-	it("matches no-reply prefixes used by platforms", () => {
-		for (const localPart of [
-			"noreply-github",
-			"no-reply+abc123",
-			"messages-noreply",
-		]) {
-			assert.equal(isMachineLocalPart(localPart), true, localPart);
-		}
-	});
-
-	it("matches notification and bounce mailboxes", () => {
-		for (const localPart of [
-			"notifications",
-			"notify",
-			"alerts",
-			"bounces",
-			"mailer-daemon",
-			"postmaster",
-		]) {
-			assert.equal(isMachineLocalPart(localPart), true, localPart);
-		}
-	});
-
-	it("does not match mailboxes a person answers", () => {
-		// A wrong entry here silently buries real correspondence in `automated`,
-		// which is the failure mode this whole change exists to remove.
-		for (const localPart of [
-			"support",
-			"info",
-			"contact",
-			"hello",
-			"sales",
-			"alice",
-			"team",
-		]) {
-			assert.equal(isMachineLocalPart(localPart), false, localPart);
-		}
-	});
-
-	it("does not read a machine name across two words of a person's name", () => {
-		// `bruno.reply` strips to "brunoreply", which contains "noreply" spanning
-		// the boundary between the two words. Matching on whole words is what
-		// keeps Bruno out of `automated`.
-		for (const localPart of [
-			"bruno.reply",
-			"bruno-reply",
-			"bruno_reply",
-			"juno.replies",
-			"toni.fyi",
-			"bruno.reply+newsletter",
-		]) {
-			assert.equal(isMachineLocalPart(localPart), false, localPart);
-		}
-	});
-
-	it("still matches the qualified machine forms", () => {
-		for (const localPart of [
-			"noreply-github",
-			"messages-noreply",
-			"jobalerts-noreply",
-			"mailer.daemon",
-			"do-not-reply",
-			"team.notifications",
-		]) {
-			assert.equal(isMachineLocalPart(localPart), true, localPart);
-		}
-	});
-});
-
-describe("hasMachineHeader", () => {
-	it("matches Feedback-ID regardless of case", () => {
-		assert.equal(hasMachineHeader(["from", "Feedback-ID"]), true);
-		assert.equal(hasMachineHeader(["feedback-id"]), true);
-	});
-
-	it("matches X-Auto-Response-Suppress", () => {
-		assert.equal(hasMachineHeader(["x-auto-response-suppress"]), true);
-	});
-
-	it("does not match ordinary headers", () => {
-		assert.equal(hasMachineHeader(["from", "to", "subject", "date"]), false);
-	});
-});

package/src/heuristics/senderMismatch.test.ts

@@ -1,346 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import { DisplayNameCorrespondence } from "@remit/domain-enums";
-import { simpleParser } from "mailparser";
-import {
-	classifyDisplayNameCorrespondence,
-	extractOffDomainLinkDomains,
-	extractSenderMismatch,
-} from "./senderMismatch.js";
-
-const parse = async (lines: string[]) =>
-	simpleParser(Buffer.from(lines.join("\r\n")));
-
-describe("classifyDisplayNameCorrespondence", () => {
-	it("corresponds when the name is a label of the From domain", () => {
-		assert.equal(
-			classifyDisplayNameCorrespondence("GitHub", "notifications.github.com"),
-			DisplayNameCorrespondence.Corresponds,
-		);
-	});
-
-	it("corresponds when a word of a decorated name is a label of the From domain", () => {
-		assert.equal(
-			classifyDisplayNameCorrespondence(
-				"GitHub Actions",
-				"notifications.github.com",
-			),
-			DisplayNameCorrespondence.Corresponds,
-		);
-	});
-
-	it("corresponds across a multi-part public suffix", () => {
-		assert.equal(
-			classifyDisplayNameCorrespondence("Sainsbury's", "mail.sainsburys.co.uk"),
-			DisplayNameCorrespondence.Corresponds,
-		);
-	});
-
-	it("is unrelated when the name appears nowhere in the From domain", () => {
-		assert.equal(
-			classifyDisplayNameCorrespondence(
-				"InfoMedics",
-				"serviceupdatebank.atlassian.net",
-			),
-			DisplayNameCorrespondence.Unrelated,
-		);
-	});
-
-	it("is a lookalike when a digit stands in for a letter of the domain", () => {
-		assert.equal(
-			classifyDisplayNameCorrespondence("InfoMedics", "1nfomedics.nl"),
-			DisplayNameCorrespondence.Lookalike,
-		);
-	});
-
-	it("is a lookalike for a short brand one character off", () => {
-		assert.equal(
-			classifyDisplayNameCorrespondence("PayPal", "paypa1.com"),
-			DisplayNameCorrespondence.Lookalike,
-		);
-	});
-
-	it("claims nothing when the display name is empty", () => {
-		assert.equal(
-			classifyDisplayNameCorrespondence("", "example.com"),
-			DisplayNameCorrespondence.NoClaim,
-		);
-		assert.equal(
-			classifyDisplayNameCorrespondence(undefined, "example.com"),
-			DisplayNameCorrespondence.NoClaim,
-		);
-	});
-
-	it("claims nothing when the display name is an address at the sending domain", () => {
-		assert.equal(
-			classifyDisplayNameCorrespondence(
-				"billing@serviceupdatebank.atlassian.net",
-				"serviceupdatebank.atlassian.net",
-			),
-			DisplayNameCorrespondence.NoClaim,
-		);
-	});
-
-	it("claims nothing when the display name spells the envelope address itself", () => {
-		assert.equal(
-			classifyDisplayNameCorrespondence("matthijs@ischen.nl", "ischen.nl"),
-			DisplayNameCorrespondence.NoClaim,
-		);
-	});
-
-	it("claims nothing when the display name is an address on a sibling subdomain", () => {
-		assert.equal(
-			classifyDisplayNameCorrespondence(
-				"noreply@example.co.uk",
-				"mail.example.co.uk",
-			),
-			DisplayNameCorrespondence.NoClaim,
-		);
-	});
-
-	it("is a foreign address when the display name spells an address over another domain", () => {
-		assert.equal(
-			classifyDisplayNameCorrespondence(
-				"matthijs@ischen.nl",
-				"secresaludguaviare.gov.co",
-			),
-			DisplayNameCorrespondence.ForeignAddress,
-		);
-	});
-
-	it("is a foreign address when the spelled-out address is decorated with a name", () => {
-		assert.equal(
-			classifyDisplayNameCorrespondence(
-				"Matthijs (matthijs@ischen.nl)",
-				"secresaludguaviare.gov.co",
-			),
-			DisplayNameCorrespondence.ForeignAddress,
-		);
-	});
-
-	it("compares an at sign that spells no address as an ordinary name", () => {
-		assert.equal(
-			classifyDisplayNameCorrespondence(
-				"Support @ InfoMedics",
-				"infomedics.nl",
-			),
-			DisplayNameCorrespondence.Corresponds,
-		);
-		assert.equal(
-			classifyDisplayNameCorrespondence(
-				"Support @ InfoMedics",
-				"serviceupdatebank.atlassian.net",
-			),
-			DisplayNameCorrespondence.Unrelated,
-		);
-	});
-
-	it("does not read the public suffix as a match for a brand containing it", () => {
-		assert.equal(
-			classifyDisplayNameCorrespondence("Netflix", "mailer.example.net"),
-			DisplayNameCorrespondence.Unrelated,
-		);
-	});
-
-	// Live phishing shape: a short, valuable brand name embedded as a
-	// coincidental substring of a longer, attacker-chosen domain. "ing" sits
-	// inside "secureingverify" the same way "irs"/"dhl"/"ups"/"kpn" sit inside
-	// countless lookalike domains — none of that is the domain naming the
-	// brand.
-	it("does not match a short brand name that is merely embedded in a longer domain label (ING)", () => {
-		assert.equal(
-			classifyDisplayNameCorrespondence(
-				"ING Fraudedesk",
-				"secure-ing-verify.tk",
-			),
-			DisplayNameCorrespondence.Unrelated,
-		);
-	});
-
-	it("still matches a short brand name against its own real domain", () => {
-		assert.equal(
-			classifyDisplayNameCorrespondence("ING", "ing.nl"),
-			DisplayNameCorrespondence.Corresponds,
-		);
-	});
-});
-
-describe("extractOffDomainLinkDomains", () => {
-	it("names only the registrable domains that leave the sender's own", async () => {
-		const parsed = await parse([
-			"From: Jira <jira@serviceupdatebank.atlassian.net>",
-			"To: bob@example.com",
-			"Subject: Vordering",
-			"Content-Type: text/html",
-			"",
-			'<a href="https://serviceupdatebank.atlassian.net/browse/X">ticket</a>',
-			'<a href="https://betaal-vordering.example.org/pay">betaal nu</a>',
-			'<a href="https://cdn.betaal-vordering.example.org/logo.png">logo</a>',
-		]);
-		assert.deepEqual(
-			extractOffDomainLinkDomains(parsed, "serviceupdatebank.atlassian.net"),
-			["example.org"],
-		);
-	});
-
-	it("compares public-suffix-aware, so a co.uk sibling is not off-domain", async () => {
-		const parsed = await parse([
-			"From: Shop <shop@mail.example.co.uk>",
-			"To: bob@example.com",
-			"Subject: order",
-			"Content-Type: text/html",
-			"",
-			'<a href="https://www.example.co.uk/orders">orders</a>',
-		]);
-		assert.deepEqual(
-			extractOffDomainLinkDomains(parsed, "mail.example.co.uk"),
-			[],
-		);
-	});
-
-	it("ignores mailto, anchors and relative hrefs", async () => {
-		const parsed = await parse([
-			"From: Shop <shop@example.com>",
-			"To: bob@example.com",
-			"Subject: order",
-			"Content-Type: text/html",
-			"",
-			'<a href="mailto:help@elsewhere.example">mail us</a>',
-			'<a href="#top">top</a>',
-			'<a href="/orders">orders</a>',
-			'<a href="tel:+31201234567">call</a>',
-		]);
-		assert.deepEqual(extractOffDomainLinkDomains(parsed, "example.com"), []);
-	});
-
-	it("reads bare URLs out of a plain-text body", async () => {
-		const parsed = await parse([
-			"From: Shop <shop@example.com>",
-			"To: bob@example.com",
-			"Subject: order",
-			"",
-			"Betaal hier: https://betaal.elsewhere.example/pay?id=1",
-		]);
-		assert.deepEqual(extractOffDomainLinkDomains(parsed, "example.com"), [
-			"elsewhere.example",
-		]);
-	});
-});
-
-describe("extractSenderMismatch", () => {
-	const infoMedicsPhish = [
-		"From: InfoMedics <jira@serviceupdatebank.atlassian.net>",
-		"To: bob@example.com",
-		"Subject: Vordering",
-		"Authentication-Results: mx.example.com; dmarc=pass; spf=pass; dkim=pass",
-		"X-HalOne-Spam-Probability: 1",
-		"DKIM-Signature: v=1; a=rsa-sha256; d=custmx.one.com; s=sel; b=xxx",
-		"Content-Type: text/html",
-		"",
-		'<a href="https://betaal-vordering.example.org/pay">Betaal uw factuur</a>',
-	];
-
-	it("flags the display name and the links on a spam-classified message", async () => {
-		const parsed = await parse(infoMedicsPhish);
-		assert.deepEqual(
-			extractSenderMismatch(parsed, {
-				fromDomain: "serviceupdatebank.atlassian.net",
-				providerSpamClassified: true,
-				placement: "other",
-				bulkSender: false,
-			}),
-			{
-				displayNameCorrespondence: DisplayNameCorrespondence.Unrelated,
-				offDomainLinkDomains: ["example.org"],
-			},
-		);
-	});
-
-	it("flags a message sitting in Junk that the provider rated clean", async () => {
-		const parsed = await parse(infoMedicsPhish);
-		assert.deepEqual(
-			extractSenderMismatch(parsed, {
-				fromDomain: "serviceupdatebank.atlassian.net",
-				providerSpamClassified: false,
-				placement: "junk",
-				bulkSender: false,
-			}),
-			{
-				displayNameCorrespondence: DisplayNameCorrespondence.Unrelated,
-				offDomainLinkDomains: ["example.org"],
-			},
-		);
-	});
-
-	it("flags a provider-classified message outside Junk", async () => {
-		const parsed = await parse(infoMedicsPhish);
-		assert.deepEqual(
-			extractSenderMismatch(parsed, {
-				fromDomain: "serviceupdatebank.atlassian.net",
-				providerSpamClassified: true,
-				placement: "inbox",
-				bulkSender: false,
-			}),
-			{
-				displayNameCorrespondence: DisplayNameCorrespondence.Unrelated,
-				offDomainLinkDomains: ["example.org"],
-			},
-		);
-	});
-
-	for (const placement of ["inbox", "other"] as const) {
-		it(`compares nothing in ${placement} when the provider did not call the message spam`, async () => {
-			const parsed = await parse(infoMedicsPhish);
-			assert.deepEqual(
-				extractSenderMismatch(parsed, {
-					fromDomain: "serviceupdatebank.atlassian.net",
-					providerSpamClassified: false,
-					placement,
-					bulkSender: false,
-				}),
-				{},
-			);
-		});
-	}
-
-	it("flags a display name spelling the recipient's own address over a foreign domain", async () => {
-		const parsed = await parse([
-			"From: matthijs@ischen.nl <aramirez@secresaludguaviare.gov.co>",
-			"To: matthijs@ischen.nl",
-			"Subject: Re: factura",
-			"X-HalOne-Spam-Probability: 1",
-			"",
-			"hola",
-		]);
-		assert.equal(
-			extractSenderMismatch(parsed, {
-				fromDomain: "secresaludguaviare.gov.co",
-				providerSpamClassified: true,
-				placement: "other",
-				bulkSender: false,
-			}).displayNameCorrespondence,
-			DisplayNameCorrespondence.ForeignAddress,
-		);
-	});
-
-	it("leaves the display name uncompared for a bulk sender", async () => {
-		const parsed = await parse([
-			"From: Dutch Cycling Weekly <bounce-9f2@mailer.esp.example>",
-			"To: bob@example.com",
-			"Subject: This week in cycling",
-			"List-Unsubscribe: <https://mailer.esp.example/u/9f2>",
-			"X-HalOne-Spam-Probability: 1",
-			"Content-Type: text/html",
-			"",
-			'<a href="https://dutchcyclingweekly.example.org/issue/12">read</a>',
-		]);
-		const signals = extractSenderMismatch(parsed, {
-			fromDomain: "mailer.esp.example",
-			providerSpamClassified: true,
-			placement: "other",
-			bulkSender: true,
-		});
-		assert.equal(signals.displayNameCorrespondence, undefined);
-		assert.deepEqual(signals.offDomainLinkDomains, ["example.org"]);
-	});
-});