@structured-id/ui-core 4.2.0 → 4.3.0

package/README.md

@@ -6,7 +6,7 @@ Shared UI package for StructuredID applications: Vue 3 composables, Pinia stores
 
 - **Composables** -- `createAuth` (password ceremonies over an injected ZKPP client), `useAuthApi`, `useAccountApi`, `useIdentityApi`, `useSecurityLevel`, transport setup (`initGrpc`, `initAccountApi`)
 - **Components** -- `SidLoginForm`, `SidRegistrationForm`, `SidMfaChallenge`, `SidPrincipalInput`, profile management pages
-- **Utilities** -- `normalizePrincipal`, `detectLoginInputType`, `rpcRefusal`, validators, formatters
+- **Utilities** -- `normalizePrincipal`, `detectLoginInputType`, `rpcRefusal`, email checks (`initEmail`, `checkEmail`, `isValidEmail`), validators, formatters
 
 The generated messages and clients, the `google.rpc` error model and the gRPC-web / WebTransport transport live in `@structured-id/proto`; import them from there (`@structured-id/proto/sid/v1/identity/identity.client`, `@structured-id/proto/transport`).
 
@@ -34,6 +34,34 @@ const identity = new IdentityServiceClient(getTransport());
 const { login } = createAuth(() => loadZkppClient());
 ```
 
+### Email addresses
+
+Email fields are checked with [`@structured-world/structured-email-address-ts`](https://www.npmjs.com/package/@structured-world/structured-email-address-ts),
+the TypeScript port of the parser the server uses, checked byte-identical
+against it. Its Public Suffix List trie is the application's own asset (the
+bundler emits `psl.bin` from `@structured-world/structured-public-domains`),
+served by the application's host and cached in IndexedDB; where it is served
+from is a setting (`psl.url`), never a third-party CDN. Each namespace's admission mirrors the
+server's email policy: `LOCAL` (an installation's own accounts: internal and
+internationalized domains), `CORPORATE_BASELINE`, `GLOBAL_PERSONAL` (ASCII, no
+IDN, a public mail domain). The server still decides; the field refuses only
+what that namespace never admits.
+
+Load the parser once at start and name the application's namespace (`LOCAL`
+when omitted). The parser is loaded lazily as its own chunk; until it is,
+`checkEmail` answers `pending` and `SidPrincipalInput` keeps the form's submit
+disabled. A field accepting email starts the load itself if the application
+did not.
+
+```ts
+import { GLOBAL_PERSONAL, initEmail } from "@structured-id/ui-core";
+
+// The trie from the application's own copy...
+await initEmail({ policy: GLOBAL_PERSONAL });
+// ...or from where the deployment's configuration says it is served.
+await initEmail({ policy: GLOBAL_PERSONAL, psl: { url: config.pslUrl } });
+```
+
 ## Development
 
 The package ships its TypeScript and Vue sources; the consuming application's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@structured-id/ui-core",
-  "version": "4.2.0",
+  "version": "4.3.0",
   "type": "module",
   "publishConfig": {
     "access": "public",
@@ -43,9 +43,12 @@
     "@protobuf-ts/runtime": "^2.11.1",
     "@protobuf-ts/runtime-rpc": "^2.11.1",
     "@structured-id/proto": "^0.3.0",
+    "@structured-world/structured-email-address-ts": "^0.0.22",
+    "@structured-world/structured-public-domains": "0.0.x",
     "libphonenumber-js": "^1.13.15"
   },
   "devDependencies": {
+    "@types/node": "^26",
     "@vitejs/plugin-vue": "^6.0.9",
     "@vue/compiler-dom": "^3.5.43",
     "@vue/devtools-api": "^8.2.1",

package/src/assets.d.ts

@@ -0,0 +1,5 @@
+// A Vite asset imported for its served URL (`import url from "./x?url"`).
+declare module "*?url" {
+  const url: string;
+  export default url;
+}

package/src/index.ts

@@ -36,7 +36,16 @@ export { useAuthStore } from "./stores/auth";
 
 // Utils
 export {
+  CORPORATE_BASELINE,
+  GLOBAL_PERSONAL,
+  LOCAL,
+  checkEmail,
+  emailPolicy,
+  emailReady,
+  initEmail,
   isValidEmail,
+  type EmailCheck,
+  type EmailPolicy,
   isValidPhone,
   isValidUuid,
   isValidUsername,

package/src/profile/components/SidLoginForm.test.ts

@@ -1,8 +1,13 @@
-import { describe, it, expect, vi } from "vitest";
+import { beforeAll, describe, it, expect, vi } from "vitest";
 import { mount } from "@vue/test-utils";
 import { defineComponent } from "vue";
 import SidLoginForm from "./SidLoginForm.vue";
 import { REQUIRED_FIELD_TEXT } from "../../utils/validators";
+import { initEmail } from "../../utils/email";
+import { TEST_PSL } from "../../utils/email.testing";
+
+// As an application does at start: the email parser loaded, LOCAL namespace.
+beforeAll(() => initEmail({ psl: TEST_PSL }));
 
 // Stub all Quasar components as divs
 const quasarStubs = {

package/src/profile/components/SidRegistrationForm.test.ts

@@ -1,5 +1,7 @@
-import { describe, it, expect, vi } from "vitest";
+import { beforeAll, describe, it, expect, vi } from "vitest";
 import { flushPromises, mount } from "@vue/test-utils";
+import { initEmail } from "../../utils/email";
+import { TEST_PSL } from "../../utils/email.testing";
 import { RpcError } from "@protobuf-ts/runtime-rpc";
 import { base64encode } from "@protobuf-ts/runtime";
 import { Any } from "@structured-id/proto/google/protobuf/any";
@@ -10,6 +12,9 @@ import {
 } from "@structured-id/proto/google/rpc/error_details";
 import SidRegistrationForm from "./SidRegistrationForm.vue";
 
+// As an application does at start: the email parser loaded, LOCAL namespace.
+beforeAll(() => initEmail({ psl: TEST_PSL }));
+
 const quasarStubs = {
   "q-card": { template: "<div><slot /></div>" },
   "q-card-section": { template: "<div><slot /></div>" },

package/src/quasar/SidPrincipalInput.autoload.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, it, vi } from "vitest";
+import { flushPromises, mount } from "@vue/test-utils";
+
+// A module graph of its own: here no application started the email parser,
+// so the field is what starts it.
+vi.mock("../utils/email", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../utils/email")>();
+  const { TEST_PSL } = await import("../utils/email.testing");
+  return {
+    ...actual,
+    // The field calls it without options; the test serves the trie itself.
+    initEmail: vi.fn(() => actual.initEmail({ psl: TEST_PSL })),
+  };
+});
+
+const stubs = {
+  "q-input": { template: "<div />" },
+  "q-icon": { template: "<span />" },
+  "q-chip": { template: "<span />" },
+};
+
+describe("SidPrincipalInput starting the parser", () => {
+  // Regression: the parser was started only on mount, so a field whose
+  // accepted types came to include email later kept every email pending
+  // and its form's submit disabled for good.
+  it("starts it when the accepted types come to include email", async () => {
+    const email = await import("../utils/email");
+    const { default: SidPrincipalInput } =
+      await import("./SidPrincipalInput.vue");
+    const w = mount(SidPrincipalInput, {
+      props: { modelValue: "alice@example.com", types: ["username"] },
+      global: { stubs },
+    });
+    expect(email.initEmail).not.toHaveBeenCalled();
+    await w.setProps({ types: ["email", "username"] });
+    await vi.waitFor(() => expect(email.emailReady.value).toBe(true));
+    await flushPromises();
+    expect(email.initEmail).toHaveBeenCalled();
+    expect(w.emitted("update:valid")?.at(-1)?.[0]).toBe(true);
+  });
+});

package/src/quasar/SidPrincipalInput.test.ts

@@ -1,8 +1,13 @@
-import { describe, it, expect } from "vitest";
+import { beforeAll, describe, it, expect } from "vitest";
 import { mount } from "@vue/test-utils";
-import { defineComponent } from "vue";
+import { defineComponent, nextTick } from "vue";
 import SidPrincipalInput from "./SidPrincipalInput.vue";
 import { principalRecognizable } from "./principalInputTexts";
+import { GLOBAL_PERSONAL, LOCAL, initEmail } from "../utils/email";
+import { TEST_PSL } from "../utils/email.testing";
+
+// As an application does at start: the email parser loaded, LOCAL namespace.
+beforeAll(() => initEmail({ psl: TEST_PSL }));
 
 const stubs = {
   "q-input": defineComponent({
@@ -236,6 +241,20 @@ describe("SidPrincipalInput", () => {
   // The form disables its submit on this, before any error is shown: only a
   // recognized, accepted, well-formed value, not refused by the server, is
   // valid.
+  // Regression: the application's namespace was not reactive, so a field
+  // mounted under one kept the verdict of it after initEmail named another.
+  it("re-judges an email when the application's namespace changes", async () => {
+    await initEmail({ policy: GLOBAL_PERSONAL, psl: TEST_PSL });
+    const w = mount(SidPrincipalInput, {
+      props: { modelValue: "admin@printer", types: ["email"] },
+      global: { stubs },
+    });
+    expect(w.emitted("update:valid")?.at(-1)?.[0]).toBe(false);
+    await initEmail({ policy: LOCAL });
+    await nextTick();
+    expect(w.emitted("update:valid")?.at(-1)?.[0]).toBe(true);
+  });
+
   it("tells the form whether the value can be submitted", () => {
     const valid = (props: { modelValue: string; fieldError?: string }) => {
       const w = mount(SidPrincipalInput, {

package/src/quasar/SidPrincipalInput.vue

@@ -35,7 +35,7 @@
 <script setup lang="ts">
 import { ref, computed, watch } from "vue";
 import { isValidPhoneNumber } from "libphonenumber-js";
-import { isValidEmail } from "../utils/validators";
+import { checkEmail, emailReady, initEmail } from "../utils/email";
 
 import {
   ALL_PRINCIPAL_TYPES,
@@ -167,8 +167,13 @@ const typeRule = (val: string): string | true => {
   }
 
   switch (type) {
-    case "email":
-      return isValidEmail(val.trim()) || text.value.invalidEmail;
+    case "email": {
+      // Read so the rule re-runs once the parser has loaded.
+      void emailReady.value;
+      const check = checkEmail(val.trim());
+      // Nothing is wrong yet while the parser loads; `valid` stays false.
+      return check !== "invalid" || text.value.invalidEmail;
+    }
     case "phone":
       return isValidPhoneNumber(val) || text.value.invalidPhone;
     case "username": {
@@ -199,9 +204,26 @@ const valid = computed(
   () =>
     detectedType.value !== "unknown" &&
     typeRule(model.value) === true &&
+    // An email is not submittable before the parser has judged it.
+    (detectedType.value !== "email" || emailReady.value) &&
     !props.fieldError,
 );
 
+// The application starts the parser at boot (initEmail with its namespace);
+// a field that accepts email starts it when nobody did, also once its
+// accepted types come to include email.
+watch(
+  () => accepted.value.includes("email"),
+  (takesEmail) => {
+    if (takesEmail && !emailReady.value) {
+      initEmail().catch((error: unknown) => {
+        console.error("email address parser failed to load", error);
+      });
+    }
+  },
+  { immediate: true },
+);
+
 watch(valid, (v) => emit("update:valid", v), { immediate: true });
 
 // --- Dynamic icon & type ---

package/src/utils/email.test.ts

@@ -0,0 +1,107 @@
+import { beforeAll, describe, expect, it } from "vitest";
+import {
+  CORPORATE_BASELINE,
+  GLOBAL_PERSONAL,
+  LOCAL,
+  checkEmail,
+  emailPolicy,
+  initEmail,
+  isValidEmail,
+} from "./email";
+import { TEST_PSL } from "./email.testing";
+
+// The admission the server applies (sid_authn::email): the same parser, the
+// same configuration per namespace, so the field refuses what the server
+// would refuse and accepts what it would accept.
+
+describe("before the parser is loaded", () => {
+  // Nothing is judged without the parser: a hand-written guess would accept
+  // what the server refuses.
+  it("says pending and never valid", () => {
+    expect(checkEmail("user@example.com", LOCAL)).toBe("pending");
+    expect(isValidEmail("user@example.com", LOCAL)).toBe(false);
+  });
+});
+
+describe("with the parser", () => {
+  beforeAll(async () => {
+    await initEmail({ psl: TEST_PSL });
+  });
+
+  it("accepts an ordinary mailbox in every namespace", () => {
+    for (const policy of [GLOBAL_PERSONAL, CORPORATE_BASELINE, LOCAL]) {
+      expect(checkEmail("a.b+c@example.com", policy)).toBe("valid");
+    }
+  });
+
+  it("refuses what is never an address", () => {
+    for (const input of [
+      "",
+      "noat",
+      "@no-local.com",
+      "user@",
+      "spaces in@email.com",
+      "user@exa mple.com",
+    ]) {
+      expect(checkEmail(input, LOCAL), input).toBe("invalid");
+    }
+  });
+
+  // RFC 5321 §4.1.2: a quoted local part is a mailbox; comments and display
+  // names are header syntax and are not.
+  it("accepts a quoted local part, refuses header syntax", () => {
+    expect(checkEmail('"a b"@example.com', LOCAL)).toBe("valid");
+    expect(checkEmail('"a@b"@example.com', LOCAL)).toBe("valid");
+    expect(checkEmail("a(comment)@example.com", LOCAL)).toBe("invalid");
+    expect(checkEmail("Name <a@example.com>", LOCAL)).toBe("invalid");
+  });
+
+  it("refuses a local part left empty by the equality rules", () => {
+    expect(checkEmail("+tag@example.com", LOCAL)).toBe("invalid");
+  });
+
+  describe("the global Personal namespace", () => {
+    it("refuses non-ASCII in either part", () => {
+      expect(checkEmail("алиса@example.com", GLOBAL_PERSONAL)).toBe("invalid");
+      expect(checkEmail("user@münchen.de", GLOBAL_PERSONAL)).toBe("invalid");
+    });
+
+    it("refuses an A-label domain", () => {
+      expect(checkEmail("user@xn--mnchen-3ya.de", GLOBAL_PERSONAL)).toBe(
+        "invalid",
+      );
+    });
+
+    it("requires a public suffix", () => {
+      expect(checkEmail("admin@printer", GLOBAL_PERSONAL)).toBe("invalid");
+      expect(checkEmail("user@example.notatld", GLOBAL_PERSONAL)).toBe(
+        "invalid",
+      );
+    });
+  });
+
+  describe("an installation's own accounts", () => {
+    it("admits internal and internationalized mail domains", () => {
+      expect(checkEmail("admin@printer", LOCAL)).toBe("valid");
+      expect(checkEmail("user@münchen.de", LOCAL)).toBe("valid");
+      expect(checkEmail("алиса@example.com", LOCAL)).toBe("valid");
+    });
+  });
+
+  it("corporate baseline admits an internal domain, ASCII only", () => {
+    expect(checkEmail("admin@printer", CORPORATE_BASELINE)).toBe("valid");
+    expect(checkEmail("user@münchen.de", CORPORATE_BASELINE)).toBe("invalid");
+  });
+});
+
+describe("the application's namespace", () => {
+  it("is LOCAL unless the application names its own", async () => {
+    await initEmail();
+    expect(emailPolicy()).toBe(LOCAL);
+    await initEmail({ policy: GLOBAL_PERSONAL });
+    expect(emailPolicy()).toBe(GLOBAL_PERSONAL);
+    expect(isValidEmail("admin@printer")).toBe(false);
+    await initEmail({ policy: LOCAL });
+    expect(isValidEmail("admin@printer")).toBe(true);
+  });
+});

package/src/utils/email.testing.ts

@@ -0,0 +1,19 @@
+import { readFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import type { PslSource } from "./email";
+
+/**
+ * The trie the application would serve, read from the installed package, for
+ * tests running without the application's host. Not cached, so a test never
+ * reads another run's copy.
+ */
+export const TEST_PSL: PslSource = {
+  url: "psl.bin",
+  cache: false,
+  fetch: (async () => {
+    const path = createRequire(import.meta.url).resolve(
+      "@structured-world/structured-public-domains/psl.bin",
+    );
+    return new Response(await readFile(path));
+  }) as typeof fetch,
+};

package/src/utils/email.ts

@@ -0,0 +1,165 @@
+// An ambient declaration cannot be imported, and a consumer compiling this
+// source sees it only through this reference.
+// eslint-disable-next-line @typescript-eslint/triple-slash-reference
+/// <reference path="../assets.d.ts" />
+import { readonly, ref, shallowRef, type Ref } from "vue";
+
+/**
+ * Which mailboxes an email namespace admits, as the server's policy for it
+ * (sid_authn::email) does. Equality and the resolution key stay the
+ * server's: the field only refuses what the namespace never admits.
+ */
+export interface EmailPolicy {
+  /** Accept non-ASCII characters in the local part (RFC 6531). */
+  readonly unicodeLocal: boolean;
+  /** Accept internationalized domains, in Unicode or A-label spelling. */
+  readonly idnDomain: boolean;
+  /** Accept a domain without a dot (an installation-local mail domain). */
+  readonly singleLabelDomain: boolean;
+  /** Require the domain to end in a Public Suffix List suffix. */
+  readonly publicSuffix: boolean;
+}
+
+/** The global SaaS/federated Personal namespace: ASCII, no IDN, a public mail domain. */
+export const GLOBAL_PERSONAL: EmailPolicy = Object.freeze({
+  unicodeLocal: false,
+  idnDomain: false,
+  singleLabelDomain: false,
+  publicSuffix: true,
+});
+
+/** An organization's Corporate namespace before it sets its own rules. */
+export const CORPORATE_BASELINE: EmailPolicy = Object.freeze({
+  unicodeLocal: false,
+  idnDomain: false,
+  singleLabelDomain: true,
+  publicSuffix: false,
+});
+
+/** An installation's own managed accounts (standalone). */
+export const LOCAL: EmailPolicy = Object.freeze({
+  unicodeLocal: true,
+  idnDomain: true,
+  singleLabelDomain: true,
+  publicSuffix: false,
+});
+
+/** A verdict on one input; `pending` until the parser is loaded. */
+export type EmailCheck = "valid" | "invalid" | "pending";
+
+type Parser = typeof import("@structured-world/structured-email-address-ts");
+
+/** How the Public Suffix List trie is fetched and cached. */
+export type PslSource = NonNullable<
+  NonNullable<Parameters<Parser["init"]>[0]>["psl"]
+>;
+
+let parser: Parser | undefined;
+let loading: Promise<Parser> | undefined;
+// Reactive, so a verdict computed under it is recomputed when it changes.
+const appPolicy = shallowRef<EmailPolicy>(LOCAL);
+const loaded = ref(false);
+
+/** Whether the parser is loaded; a rule depending on it re-runs when it is. */
+export const emailReady: Readonly<Ref<boolean>> = readonly(loaded);
+
+/**
+ * The trie this package ships, as the application's own asset: the bundler
+ * emits it beside the bundle, so the application's host serves it.
+ */
+async function bundledPsl(): Promise<string> {
+  const asset =
+    await import("@structured-world/structured-public-domains/psl.bin?url");
+  return asset.default;
+}
+
+/**
+ * Load the parser (once) and set the application's email namespace, LOCAL
+ * unless named. The parser is the TypeScript port of the server's, checked
+ * byte-identical against it; its Public Suffix List trie comes from `psl`
+ * (`url`: the setting of where it is served, the application's own copy of
+ * it when unset; never a third-party CDN), cached in IndexedDB. An
+ * application calls this at start; a field starts it when nobody did.
+ */
+export async function initEmail(options?: {
+  policy?: EmailPolicy;
+  psl?: PslSource;
+}): Promise<void> {
+  if (options?.policy) appPolicy.value = options.policy;
+  loading ??= import("@structured-world/structured-email-address-ts").then(
+    async (module) => {
+      const url = options?.psl?.url ?? (await bundledPsl());
+      await module.init({ psl: { ...options?.psl, url } });
+      return module;
+    },
+  );
+  try {
+    parser = await loading;
+  } catch (error) {
+    // A failed load is retried by the next call, never cached as loaded.
+    loading = undefined;
+    throw error;
+  }
+  loaded.value = true;
+}
+
+/** The application's email namespace. */
+export function emailPolicy(): EmailPolicy {
+  return appPolicy.value;
+}
+
+/** Whether a domain label is an IDNA A-label (`xn--`). */
+function isALabel(label: string): boolean {
+  return label.slice(0, 4).toLowerCase() === "xn--";
+}
+
+/**
+ * Whether `value` is one mailbox the namespace admits: an RFC 5321 mailbox
+ * (dot-atom or quoted local part; no comments, display name or address
+ * literal) under the namespace's character, domain and suffix rules, with a
+ * local part that its equality rules (case, dots, `+tag`) do not empty.
+ */
+export function checkEmail(
+  value: string,
+  policy: EmailPolicy = appPolicy.value,
+): EmailCheck {
+  if (!parser) return "pending";
+  if (
+    !policy.unicodeLocal &&
+    !policy.idnDomain &&
+    !/^[\x00-\x7f]*$/.test(value)
+  ) {
+    return "invalid";
+  }
+  let local: string;
+  let domain: string;
+  try {
+    const mailbox = parser.parse(value, {
+      strictness: "strict",
+      allowQuotedLocalPart: true,
+      casePolicy: "preserve",
+      dotPolicy: "preserve",
+      subaddress: "preserve",
+      allowSingleLabelDomain: policy.singleLabelDomain,
+      domainCheck: policy.publicSuffix ? "psl" : "syntax",
+    });
+    local = mailbox.localPart;
+    domain = mailbox.domain;
+  } catch {
+    return "invalid";
+  }
+  if (!policy.unicodeLocal && !/^[\x00-\x7f]*$/.test(local)) return "invalid";
+  // A Unicode domain arrives IDNA-encoded, so A-labels cover both spellings.
+  if (!policy.idnDomain && domain.split(".").some(isALabel)) return "invalid";
+  const base = local.toLowerCase().split("+", 1)[0] ?? "";
+  if (base.replaceAll(".", "") === "") return "invalid";
+  return "valid";
+}
+
+/** {@link checkEmail} as a yes/no; `false` while the parser is loading. */
+export function isValidEmail(
+  value: string,
+  policy: EmailPolicy = appPolicy.value,
+): boolean {
+  return checkEmail(value, policy) === "valid";
+}

package/src/utils/index.ts

@@ -1,5 +1,4 @@
 export {
-  isValidEmail,
   isValidPhone,
   isValidUuid,
   isValidUsername,
@@ -8,6 +7,19 @@ export {
   isRequired,
 } from "./validators";
 
+export {
+  CORPORATE_BASELINE,
+  GLOBAL_PERSONAL,
+  LOCAL,
+  checkEmail,
+  emailPolicy,
+  emailReady,
+  initEmail,
+  isValidEmail,
+  type EmailCheck,
+  type EmailPolicy,
+} from "./email";
+
 export {
   formatDate,
   formatRelativeTime,

package/src/utils/normalizePrincipal.test.ts

@@ -1,5 +1,10 @@
-import { describe, it, expect } from "vitest";
+import { beforeAll, describe, it, expect } from "vitest";
 import { detectLoginInputType, normalizePrincipal } from "./normalizePrincipal";
+import { initEmail } from "./email";
+import { TEST_PSL } from "./email.testing";
+
+// As an application does at start: the email parser loaded, LOCAL namespace.
+beforeAll(() => initEmail({ psl: TEST_PSL }));
 
 describe("detectLoginInputType", () => {
   it("detects email", () => {

package/src/utils/normalizePrincipal.ts

@@ -1,7 +1,7 @@
 import parsePhoneNumberFromString, {
   isValidPhoneNumber,
 } from "libphonenumber-js";
-import { isValidEmail } from "./validators";
+import { checkEmail } from "./email";
 
 export type LoginInputType = "email" | "phone" | "username" | "unknown";
 
@@ -100,8 +100,13 @@ export function normalizePrincipal(
   switch (type) {
     case "email": {
       // Sent as typed: the server validates it, derives the lookup key and
-      // keeps this spelling as the address to mail.
-      if (!isValidEmail(trimmed)) {
+      // keeps this spelling as the address to mail. Checked here under the
+      // application's namespace (initEmail), as the server would.
+      const check = checkEmail(trimmed);
+      if (check === "pending") {
+        throw new Error("Email check not loaded: call initEmail() first");
+      }
+      if (check === "invalid") {
         throw new Error("Invalid email address");
       }
       return { value: trimmed, display: trimmed, type: "email" };

package/src/utils/validators.test.ts

@@ -1,6 +1,5 @@
 import { describe, it, expect } from "vitest";
 import {
-  isValidEmail,
   isValidPhone,
   isValidUuid,
   isValidUsername,
@@ -9,28 +8,6 @@ import {
   isRequired,
 } from "./validators";
 
-describe("isValidEmail", () => {
-  it("accepts valid emails", () => {
-    expect(isValidEmail("user@example.com")).toBe(true);
-    expect(isValidEmail("a.b+c@d.co")).toBe(true);
-  });
-  it("rejects invalid emails", () => {
-    expect(isValidEmail("")).toBe(false);
-    expect(isValidEmail("noat")).toBe(false);
-    expect(isValidEmail("@no-local.com")).toBe(false);
-    expect(isValidEmail("spaces in@email.com")).toBe(false);
-    expect(isValidEmail("user@")).toBe(false);
-    expect(isValidEmail("user@exa mple.com")).toBe(false);
-  });
-  // Regression: a dot was required in the domain and quoted local parts were
-  // refused, so the client turned away addresses the server's policy admits.
-  it("leaves admission to the server's email policy", () => {
-    expect(isValidEmail("admin@printer")).toBe(true);
-    expect(isValidEmail('"a b"@example.com')).toBe(true);
-    expect(isValidEmail('"a@b"@example.com')).toBe(true);
-  });
-});
-
 describe("isValidPhone", () => {
   it("accepts E.164 format", () => {
     expect(isValidPhone("+380501234567")).toBe(true);

package/src/utils/validators.ts

@@ -1,20 +1,3 @@
-/**
- * Whether `value` has the shape of one mailbox: a local part and a domain
- * around the last `@`, whitespace only inside a quoted local part. Advisory:
- * the server's email policy decides admission (internal single-label domains
- * and quoted local parts may be admitted), so this refuses only what can
- * never be an address.
- */
-export function isValidEmail(value: string): boolean {
-  const at = value.lastIndexOf("@");
-  if (at <= 0 || at === value.length - 1) return false;
-  const local = value.slice(0, at);
-  const domain = value.slice(at + 1);
-  const quoted =
-    local.length > 1 && local.startsWith('"') && local.endsWith('"');
-  return !/\s/.test(domain) && (quoted || !/\s/.test(local));
-}
-
 /** Phone number validation (E.164 format). */
 export function isValidPhone(value: string): boolean {
   return /^\+[1-9]\d{6,14}$/.test(value);