@serve.zone/dcrouter 17.4.2 → 17.6.0

package/ts/email/classes.accepted-email-spool.ts

@@ -5,6 +5,7 @@ import type {
   ICachedEmailSmtpTransaction,
   TCachedEmailDirection,
 } from '../db/documents/classes.cached.email.js';
+import { AcceptEnvelopeRejectionError } from '@push.rocks/smartmta';
 import type {
   Email,
   IAcceptEnvelopeContext,
@@ -15,6 +16,58 @@ import type {
 } from '@push.rocks/smartmta';
 import type { DcRouter } from '../classes.dcrouter.js';
 
+
+/** Inbound authentication verdict evaluation for acceptance semantics. */
+export interface IInboundAcceptanceEvaluation {
+  status: 'accepted' | 'flagged';
+  doubts: string[];
+  dmarcReject: boolean;
+  dmarcDomain?: string;
+}
+
+export function evaluateInboundAcceptance(securityResults: any): IInboundAcceptanceEvaluation {
+  const doubts: string[] = [];
+  let dmarcReject = false;
+  let dmarcDomain: string | undefined;
+
+  // Infrastructure failures (temperror, resolver problems) are OUR problem,
+  // not evidence against the sender — they never produce doubts.
+  const spfResult = String(securityResults?.spf?.result || '').toLowerCase();
+  if (spfResult === 'fail' || spfResult === 'softfail') {
+    doubts.push(`SPF ${spfResult} for ${securityResults?.spf?.domain || 'sender domain'}`);
+  }
+
+  // The verdict bridge emits a placeholder entry (status 'none') when a
+  // message carries no DKIM signature at all; only real failed signatures
+  // count as doubts.
+  const dkimSignatures = (Array.isArray(securityResults?.dkim) ? securityResults.dkim : [])
+    .filter((signature: any) => String(signature?.status || '').toLowerCase() !== 'none');
+  if (dkimSignatures.length > 0 && !dkimSignatures.some((signature: any) => signature?.is_valid)) {
+    doubts.push('DKIM signature(s) present but none verified');
+  }
+
+  // DMARC only matters when the sender domain publishes an enforcing policy;
+  // absent records surface as policy 'none' and are not doubts.
+  const dmarc = securityResults?.dmarc;
+  if (dmarc && dmarc.passed === false) {
+    const policy = String(dmarc.policy || '').toLowerCase();
+    const action = String(dmarc.action || '').toLowerCase();
+    if (policy === 'reject' || policy === 'quarantine' || action === 'reject' || action === 'quarantine') {
+      dmarcDomain = dmarc.domain || undefined;
+      if (action === 'reject' || policy === 'reject') {
+        dmarcReject = true;
+      }
+      doubts.push(`DMARC failed for ${dmarc.domain || 'sender domain'} (policy ${dmarc.policy || 'unknown'})`);
+    }
+  }
+  return {
+    status: doubts.length > 0 ? 'flagged' : 'accepted',
+    doubts,
+    dmarcReject,
+    dmarcDomain,
+  };
+}
+
 export const DCROUTER_CACHE_ID_HEADER = 'X-Dcrouter-Cached-Email-Id';
 const ACCEPTED_EMAIL_SPOOL_INTERVAL_MS = 60_000;
 const ACCEPTED_EMAIL_RETRY_DELAY_MS = 5 * 60_000;
@@ -296,17 +349,63 @@ export class AcceptedEmailSpool {
     const plan = emailServer.createAcceptedEnvelopeDispatchPlan(context, idempotencyKeys);
     const nonStoreEntries = plan.filter((entry) => entry.action.type !== 'store');
 
+    const acceptance = evaluateInboundAcceptance(context.securityResults);
+    const startedAtMs = Date.now();
+
     const persistedRawMessage = this.setDcRouterCacheIdHeader(
       context.rawMessage.toString('utf8'),
       cachedEmail.id,
     );
     await this.persistRawMessage(cachedEmail, persistedRawMessage);
     cachedEmail.direction = session.authenticated ? 'outbound' : 'inbound';
-    cachedEmail.acceptedAt = Date.now();
-    cachedEmail.markStored(INBOUND_STORE_RETENTION_MS);
+    cachedEmail.acceptedAt = startedAtMs;
+
+    if (acceptance.dmarcReject) {
+      // Enforce the sender domain's published DMARC reject policy: persist the
+      // rejected attempt for the email log, then refuse the envelope with a
+      // permanent SMTP failure.
+      const rejectionMessage = `5.7.1 Rejected by DMARC policy of ${acceptance.dmarcDomain || 'the sender domain'}`;
+      cachedEmail.status = 'rejected';
+      cachedEmail.lastError = rejectionMessage;
+      cachedEmail.setTTL(INBOUND_STORE_RETENTION_MS);
+      cachedEmail.appendSmtpTransaction(this.buildInboundTransaction(context, cachedEmail.id, {
+        outcome: 'failed',
+        smtpCode: 550,
+        finalLine: rejectionMessage,
+        doubts: acceptance.doubts,
+        startedAtMs,
+      }));
+      cachedEmail.routeData = JSON.stringify({
+        acceptedAt: new Date(startedAtMs).toISOString(),
+        acceptance: 'dmarc-policy-reject',
+        doubts: acceptance.doubts,
+      });
+      cachedEmail.updateSenderDomain();
+      cachedEmail.updateRecipientDomains();
+      await cachedEmail.save().catch(() => undefined);
+      await this.notifyEmailQueuePersisted(cachedEmail, 'envelope-rejected-dmarc').catch(() => undefined);
+      throw new AcceptEnvelopeRejectionError(550, rejectionMessage);
+    }
+
+    if (acceptance.status === 'flagged') {
+      cachedEmail.status = 'flagged';
+      cachedEmail.lastError = acceptance.doubts.join('; ');
+    } else {
+      cachedEmail.status = 'accepted';
+    }
+    cachedEmail.deliveredAt = new Date();
+    cachedEmail.setTTL(INBOUND_STORE_RETENTION_MS);
+    cachedEmail.appendSmtpTransaction(this.buildInboundTransaction(context, cachedEmail.id, {
+      outcome: 'succeeded',
+      smtpCode: 250,
+      finalLine: '250 2.0.0 Message accepted for delivery',
+      doubts: acceptance.doubts,
+      startedAtMs,
+    }));
     cachedEmail.routeData = JSON.stringify({
-      acceptedAt: new Date().toISOString(),
+      acceptedAt: new Date(startedAtMs).toISOString(),
       acceptance: 'durable-envelope',
+      verdictDoubts: acceptance.doubts,
       recipientPlans: plan.map((entry) => ({
         recipient: entry.recipient,
         routeName: entry.routeName,
@@ -363,6 +462,80 @@ export class AcceptedEmailSpool {
     }
   }
 
+  /**
+   * Synthesizes the inbound SMTP transaction for the email log from the
+   * acceptance context: the receiving session where WE are the server. The
+   * Rust frontend does not export a raw line transcript yet, so entries are
+   * reconstructed from the envelope, session, and verdict data.
+   */
+  private buildInboundTransaction(
+    context: IAcceptEnvelopeContext,
+    cachedEmailId: string,
+    resultArg: {
+      outcome: 'succeeded' | 'failed';
+      smtpCode: number;
+      finalLine: string;
+      doubts: string[];
+      startedAtMs: number;
+    },
+  ): ICachedEmailSmtpTransaction {
+    const session = context.session;
+    const nowMs = Date.now();
+    const hostname = this.dcRouterRef.options?.emailConfig?.hostname || 'mail-gateway';
+    const transcript: Array<{
+      timestampMs: number;
+      direction: 'client' | 'server' | 'system';
+      phase: string;
+      text: string;
+      responseCode?: number;
+    }> = [];
+    let timestampMs = resultArg.startedAtMs;
+    const push = (direction: 'client' | 'server' | 'system', phase: string, text: string, responseCode?: number) => {
+      transcript.push({ timestampMs, direction, phase, text, ...(responseCode !== undefined ? { responseCode } : {}) });
+      timestampMs += 1;
+    };
+
+    push('system', 'connect', `Connection from ${session.remoteAddress || 'unknown'}${session.clientHostname ? ` (${session.clientHostname})` : ''}${session.secure ? ', TLS' : ', plaintext'}${session.authenticated ? ', authenticated' : ''}`);
+    push('client', 'mail_from', `MAIL FROM:<${context.envelope.mailFrom}>`);
+    push('server', 'mail_from', '250 OK', 250);
+    for (const recipient of context.envelope.rcptTo) {
+      push('client', 'rcpt_to', `RCPT TO:<${recipient}>`);
+      push('server', 'rcpt_to', '250 OK', 250);
+    }
+    push('client', 'data_command', 'DATA');
+    push('server', 'data_command', '354 Start mail input', 354);
+    push('system', 'message_body', `Message received: ${context.rawMessage.length} bytes, ${context.attachmentCount} attachment(s)`);
+    const spf = (context.securityResults as any)?.spf;
+    const dkimSignatures = Array.isArray((context.securityResults as any)?.dkim) ? (context.securityResults as any).dkim : [];
+    const dmarc = (context.securityResults as any)?.dmarc;
+    if (spf) push('system', 'message_body', `SPF: ${spf.result || 'unknown'} (${spf.domain || 'unknown domain'})`);
+    if (dkimSignatures.length > 0) {
+      const valid = dkimSignatures.filter((signature: any) => signature?.is_valid).length;
+      push('system', 'message_body', `DKIM: ${valid}/${dkimSignatures.length} signature(s) verified${dkimSignatures[0]?.domain ? ` (${dkimSignatures[0].domain})` : ''}`);
+    }
+    if (dmarc) push('system', 'message_body', `DMARC: ${dmarc.passed ? 'pass' : 'fail'} (policy ${dmarc.policy || 'unknown'})`);
+    for (const doubt of resultArg.doubts) {
+      push('system', 'message_body', `Verdict doubt: ${doubt}`);
+    }
+    push('server', 'final_response', resultArg.finalLine, resultArg.smtpCode);
+
+    return {
+      id: `inbound-${cachedEmailId}`,
+      queueItemId: cachedEmailId,
+      queueAttempt: 1,
+      targetHost: hostname,
+      targetPort: 25,
+      recipients: [...context.envelope.rcptTo],
+      startedAt: new Date(resultArg.startedAtMs).toISOString(),
+      completedAt: new Date(nowMs).toISOString(),
+      durationMs: Math.max(0, nowMs - resultArg.startedAtMs),
+      outcome: resultArg.outcome,
+      ...(resultArg.outcome === 'failed' ? { retryable: false, error: resultArg.finalLine, errorType: 'policy' } : {}),
+      smtpCode: resultArg.smtpCode,
+      transcript,
+    } as unknown as ICachedEmailSmtpTransaction;
+  }
+
   /** Start the interval-driven spool processor and trigger an immediate run. */
   public start(): void {
     this.clearSpoolTimer();

package/ts/opsserver/handlers/email-ops.handler.ts

@@ -428,8 +428,16 @@ export class EmailOpsHandler {
       case 'queued':
         return 'pending';
       case 'delivered':
-      case 'stored':
         return 'delivered';
+      case 'stored':
+        return 'accepted';
+      case 'accepted':
+        return 'accepted';
+      case 'acceptedWithDoubts':
+      case 'flagged':
+        return 'flagged';
+      case 'rejected':
+        return 'rejected';
       case 'failed':
         return 'bounced';
       case 'deferred':

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '17.4.2',
+  version: '17.6.0',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }