@remit/mailbox-service 0.0.99 → 0.0.101

package/src/heuristics/authenticationResults.test.ts

@@ -0,0 +1,189 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import {
+	type AuthenticationResults,
+	parseAuthenticationResults,
+} from "./authenticationResults.js";
+
+const parse = (value: string): AuthenticationResults => {
+	const parsed = parseAuthenticationResults(value);
+	assert.ok(parsed, `expected ${JSON.stringify(value)} to parse`);
+	return parsed;
+};
+
+const summary = (value: string): string[] =>
+	parse(value).results.map((r) =>
+		[`${r.method}=${r.result}`, ...r.properties].flat().join(" "),
+	);
+
+describe("parseAuthenticationResults", () => {
+	it("reads the authserv-id and every resinfo", () => {
+		const parsed = parse(
+			"mx.example.com; dkim=pass header.d=acme.example; spf=pass smtp.mailfrom=acme.example; dmarc=pass header.from=acme.example",
+		);
+		assert.equal(parsed.authservId, "mx.example.com");
+		assert.deepEqual(summary("mx.example.com; dkim=pass header.d=a.example"), [
+			"dkim=pass header.d a.example",
+		]);
+		assert.deepEqual(
+			parsed.results.map((r) => r.method),
+			["dkim", "spf", "dmarc"],
+		);
+	});
+
+	it("keeps a semicolon inside a comment within its own resinfo", () => {
+		assert.deepEqual(
+			summary(
+				"gw.example; dkim=fail (1024-bit key; unprotected) header.d=acme.example; dkim=fail header.d=relay.example; dmarc=fail (p=REJECT) header.from=acme.example",
+			),
+			[
+				"dkim=fail header.d acme.example",
+				"dkim=fail header.d relay.example",
+				"dmarc=fail header.from acme.example",
+			],
+		);
+	});
+
+	it("never reads a result out of another method's comment", () => {
+		assert.deepEqual(
+			summary(
+				"mx.example.net; arc=fail (i=1 spf=pass; dkim=fail\r\n  header.d=arcsigner.example; dmarc=fail); spf=pass smtp.mailfrom=acme.example;\r\n  dmarc=fail header.from=acme.example",
+			),
+			[
+				"arc=fail",
+				"spf=pass smtp.mailfrom acme.example",
+				"dmarc=fail header.from acme.example",
+			],
+		);
+	});
+
+	it("strips nested comments and escaped parentheses", () => {
+		assert.deepEqual(
+			summary(
+				"mx.example (outer (inner; dkim=pass) \\) still; comment); dkim=fail (a (b; c) d) header.d=acme.example",
+			),
+			["dkim=fail header.d acme.example"],
+		);
+	});
+
+	it("keeps a semicolon inside a quoted reason", () => {
+		assert.deepEqual(
+			summary(
+				'gw.example; dkim=fail reason="verification failed; body hash mismatch" header.d=acme.example; dmarc=fail header.from=acme.example',
+			),
+			[
+				"dkim=fail reason verification failed; body hash mismatch header.d acme.example",
+				"dmarc=fail header.from acme.example",
+			],
+		);
+	});
+
+	it("lower-cases methods, results and property names", () => {
+		const parsed = parse(
+			"GW.EXAMPLE; DKIM=FAIL HEADER.D=EVIL.EXAMPLE; DMARC=FAIL",
+		);
+		assert.equal(parsed.authservId, "gw.example");
+		assert.deepEqual(
+			summary("GW.EXAMPLE; DKIM=FAIL HEADER.D=EVIL.EXAMPLE; DMARC=FAIL"),
+			["dkim=fail header.d EVIL.EXAMPLE", "dmarc=fail"],
+		);
+	});
+
+	it("accepts a comment before the method name", () => {
+		assert.deepEqual(
+			summary(
+				"mx.example.com; (a comment) dkim=pass header.d=acme.example; dmarc=fail",
+			),
+			["dkim=pass header.d acme.example", "dmarc=fail"],
+		);
+	});
+
+	it("accepts whitespace around = and .", () => {
+		assert.deepEqual(
+			summary(
+				"mx.example.com; dkim = fail header . d = evil.example; dmarc=fail",
+			),
+			["dkim=fail header.d evil.example", "dmarc=fail"],
+		);
+	});
+
+	it("reads folded continuation lines", () => {
+		assert.deepEqual(
+			summary(
+				"mx.example.com;\r\n\tdkim=pass header.d=acme.example;\r\n\tdmarc=fail header.from=acme.example",
+			),
+			[
+				"dkim=pass header.d acme.example",
+				"dmarc=fail header.from acme.example",
+			],
+		);
+	});
+
+	it("finds a result after hundreds of filler properties", () => {
+		const filler = Array.from(
+			{ length: 400 },
+			(_, n) => `x-filler.p${n}=v${n}`,
+		).join(" ");
+		const parsed = parse(
+			`mx.example.com; spf=none ${filler}; dkim=fail header.d=acme.example`,
+		);
+		assert.equal(parsed.results[0].properties.size, 400);
+		assert.equal(parsed.results[1].properties.get("header.d"), "acme.example");
+	});
+
+	it("reads a result that carries no properties", () => {
+		assert.deepEqual(summary("gw.example; dkim=fail; dmarc=fail"), [
+			"dkim=fail",
+			"dmarc=fail",
+		]);
+	});
+
+	it("reads method versions, an authres-version and a trailing semicolon", () => {
+		const parsed = parse("mx.example 1; dkim/1=pass header.d=acme.example;");
+		assert.equal(parsed.authservId, "mx.example");
+		assert.deepEqual(
+			summary("mx.example 1; dkim/1=pass header.d=acme.example;"),
+			["dkim=pass header.d acme.example"],
+		);
+	});
+
+	it("reads the explicit no-result form", () => {
+		assert.deepEqual(parse("mx.example.com; none"), {
+			authservId: "mx.example.com",
+			results: [],
+		});
+	});
+
+	it("reads a header that omits the authserv-id", () => {
+		const parsed = parse(
+			"spf=pass (sender IP is 192.0.2.1) smtp.mailfrom=acme.example; dkim=pass (signature was verified) header.d=acme.example;dmarc=pass action=none header.from=acme.example;compauth=pass reason=100",
+		);
+		assert.equal(parsed.authservId, "");
+		assert.deepEqual(
+			parsed.results.map((r) => `${r.method}=${r.result}`),
+			["spf=pass", "dkim=pass", "dmarc=pass", "compauth=pass"],
+		);
+	});
+
+	for (const [label, value] of [
+		["an empty header", "   "],
+		["an authserv-id alone", "mx.example.com"],
+		["an authserv-id with an empty resinfo", "mx.example.com;"],
+		["an unterminated comment", "mx.example; dmarc=pass (oops"],
+		["an unbalanced closing parenthesis", "mx.example; dmarc=pass oops)"],
+		["an unterminated quoted string", 'mx.example; dkim=fail reason="oops'],
+		["a word with no value", "mx.example; dmarc=pass stray"],
+		["a key with no value", "mx.example; dmarc=pass header.from="],
+		["a resinfo with no method", "mx.example; header.d=acme.example"],
+		["a quoted result", 'mx.example; dmarc="pass"'],
+		[
+			"two words where a key belongs",
+			"mx.example; dmarc=pass extra header.from=a.example",
+		],
+		["no-result mixed with a result", "mx.example; none; dmarc=pass"],
+	] as const) {
+		it(`yields no result for ${label}`, () => {
+			assert.equal(parseAuthenticationResults(value), null);
+		});
+	}
+});

package/src/heuristics/authenticationResults.ts

@@ -0,0 +1,212 @@
+export interface AuthenticationResult {
+	method: string;
+	result: string;
+	properties: ReadonlyMap<string, string>;
+}
+
+export interface AuthenticationResults {
+	authservId: string;
+	results: AuthenticationResult[];
+}
+
+type Token =
+	| { kind: "word"; text: string }
+	| { kind: "quoted"; text: string }
+	| { kind: "semicolon" }
+	| { kind: "equals" };
+
+type ValueToken = Extract<Token, { kind: "word" | "quoted" }>;
+
+const DELIMITERS = new Set([";", "=", "(", ")", '"']);
+const KEYWORD = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+const METHOD = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\/[0-9]+)?$/;
+const PROPERTY_KEY =
+	/^[a-z0-9](?:[a-z0-9_-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9_-]*[a-z0-9])?)?$/;
+const VERSION = /^[0-9]+$/;
+
+const isWhitespace = (c: string): boolean =>
+	c === " " || c === "\t" || c === "\r" || c === "\n";
+
+const skipComment = (input: string, start: number): number | null => {
+	let depth = 0;
+	for (let i = start; i < input.length; i++) {
+		const c = input[i];
+		if (c === "\\") {
+			i++;
+			continue;
+		}
+		if (c === "(") depth++;
+		if (c === ")") depth--;
+		if (depth === 0) return i + 1;
+	}
+	return null;
+};
+
+const readQuoted = (
+	input: string,
+	start: number,
+): { text: string; end: number } | null => {
+	let text = "";
+	for (let i = start + 1; i < input.length; i++) {
+		const c = input[i];
+		if (c === "\\") {
+			if (i + 1 >= input.length) return null;
+			text += input[i + 1];
+			i++;
+			continue;
+		}
+		if (c === '"') return { text, end: i + 1 };
+		text += c;
+	}
+	return null;
+};
+
+const tokenize = (input: string): Token[] | null => {
+	const tokens: Token[] = [];
+	let i = 0;
+	while (i < input.length) {
+		const c = input[i];
+		if (isWhitespace(c)) {
+			i++;
+			continue;
+		}
+		if (c === "(") {
+			const end = skipComment(input, i);
+			if (end === null) return null;
+			i = end;
+			continue;
+		}
+		if (c === ")") return null;
+		if (c === ";") {
+			tokens.push({ kind: "semicolon" });
+			i++;
+			continue;
+		}
+		if (c === "=") {
+			tokens.push({ kind: "equals" });
+			i++;
+			continue;
+		}
+		if (c === '"') {
+			const quoted = readQuoted(input, i);
+			if (!quoted) return null;
+			tokens.push({ kind: "quoted", text: quoted.text });
+			i = quoted.end;
+			continue;
+		}
+		let end = i;
+		while (
+			end < input.length &&
+			!isWhitespace(input[end]) &&
+			!DELIMITERS.has(input[end])
+		) {
+			end++;
+		}
+		tokens.push({ kind: "word", text: input.slice(i, end) });
+		i = end;
+	}
+	return tokens;
+};
+
+const splitStatements = (tokens: Token[]): Token[][] => {
+	const statements: Token[][] = [[]];
+	for (const token of tokens) {
+		if (token.kind === "semicolon") {
+			statements.push([]);
+			continue;
+		}
+		statements[statements.length - 1].push(token);
+	}
+	return statements;
+};
+
+const isValue = (token: Token | undefined): token is ValueToken =>
+	token !== undefined && (token.kind === "word" || token.kind === "quoted");
+
+const joinsKey = (previous: string, next: string): boolean =>
+	previous.endsWith(".") ||
+	previous.endsWith("/") ||
+	next.startsWith(".") ||
+	next.startsWith("/");
+
+const readPairs = (statement: Token[]): [string, ValueToken][] | null => {
+	const pairs: [string, ValueToken][] = [];
+	let key: string[] = [];
+	for (let i = 0; i < statement.length; i++) {
+		const token = statement[i];
+		if (token.kind === "equals") {
+			const value = statement[i + 1];
+			if (key.length === 0 || !isValue(value)) return null;
+			pairs.push([key.join("").toLowerCase(), value]);
+			key = [];
+			i++;
+			continue;
+		}
+		if (token.kind !== "word") return null;
+		const previous = key[key.length - 1];
+		if (previous !== undefined && !joinsKey(previous, token.text)) return null;
+		key.push(token.text);
+	}
+	if (key.length > 0) return null;
+	return pairs;
+};
+
+const parseResult = (statement: Token[]): AuthenticationResult | null => {
+	const pairs = readPairs(statement);
+	if (!pairs || pairs.length === 0) return null;
+	const [[methodKey, resultToken], ...rest] = pairs;
+	if (!METHOD.test(methodKey)) return null;
+	if (resultToken.kind !== "word") return null;
+	const result = resultToken.text.toLowerCase();
+	if (!KEYWORD.test(result)) return null;
+
+	const properties = new Map<string, string>();
+	for (const [key, value] of rest) {
+		if (!PROPERTY_KEY.test(key)) return null;
+		if (!properties.has(key)) properties.set(key, value.text);
+	}
+	return { method: methodKey.split("/")[0], result, properties };
+};
+
+const parseAuthservId = (statement: Token[]): string | null => {
+	const [id, version, ...extra] = statement;
+	if (!isValue(id) || extra.length > 0) return null;
+	if (version !== undefined) {
+		if (version.kind !== "word" || !VERSION.test(version.text)) return null;
+	}
+	const authservId = id.text.toLowerCase();
+	return authservId.length > 0 ? authservId : null;
+};
+
+const isNoResult = (statement: Token[]): boolean =>
+	statement.length === 1 &&
+	statement[0].kind === "word" &&
+	statement[0].text.toLowerCase() === "none";
+
+export const parseAuthenticationResults = (
+	value: string,
+): AuthenticationResults | null => {
+	const tokens = tokenize(value);
+	if (!tokens) return null;
+
+	const [head, ...tail] = splitStatements(tokens);
+	const headIsResult = head.some((token) => token.kind === "equals");
+	const authservId = headIsResult ? "" : parseAuthservId(head);
+	if (authservId === null) return null;
+
+	const statements = (headIsResult ? [head, ...tail] : tail).filter(
+		(statement) => statement.length > 0,
+	);
+	if (statements.length === 0) return null;
+	if (statements.length === 1 && isNoResult(statements[0])) {
+		return { authservId, results: [] };
+	}
+
+	const results: AuthenticationResult[] = [];
+	for (const statement of statements) {
+		const result = parseResult(statement);
+		if (!result) return null;
+		results.push(result);
+	}
+	return { authservId, results };
+};