@xuda.io/account_module 1.2.1840 → 1.2.1841

package/index.mjs

@@ -2153,9 +2153,7 @@ export const add_contact = async function (req, job_id, headers) {
 
       set_account_profile_picture(uid, contact_uid, metadata, job_id, headers, account_profile_info);
     } else {
-      if (email.contains('unsubscribe', '+') || email.length > 20) {
-        is_spam = true;
-      }
+      is_spam = isLikelySpamEmail(email);
 
       // contact without use account
       cached_contact = await get_xuda_cache(uid, 'contact', email, 'metadata');
@@ -2165,7 +2163,7 @@ export const add_contact = async function (req, job_id, headers) {
       // }
 
       if (_.isEmpty(cached_contact)) {
-        if (metadata.subject && !metadata.is_sent && !metadata.is_answered && !metadata.not_junk) {
+        if (!is_spam && metadata.subject && !metadata.is_sent && !metadata.is_answered && !metadata.not_junk) {
           // email_type_info = await ai_module.detect_email_type(uid, name, email, account_profile_info, '', metadata?.subject);
           // is_spam = email_type_info.email_type === 'spam' || email_type_info.email_type === 'promotional';
           is_spam = await ai_module.is_spam_email(uid, email, metadata.subject, account_profile_info);
@@ -3500,3 +3498,117 @@ export const process_accounts_emails = async function () {
     email_module.process_emails({ uid: account_doc._id });
   }
 };
+
+function isLikelySpamEmail(email) {
+  if (!email || typeof email !== 'string') return true; // Invalid input → treat as spam
+
+  const lower = email.toLowerCase().trim();
+
+  // Basic format validation (must have @ and domain)
+  if (!lower.includes('@') || lower.split('@').length !== 2) return true;
+
+  const [localPart, domain] = lower.split('@');
+
+  if (!localPart || !domain) return true;
+
+  // ────────────────────────────────────────────────
+  // 1. Obvious syntax / format red flags
+  // ────────────────────────────────────────────────
+  if (
+    localPart.length > 64 || // RFC 5321 local-part max
+    domain.length > 255 || // RFC 5321 domain max
+    localPart.startsWith('.') ||
+    localPart.endsWith('.') ||
+    localPart.includes('..') ||
+    domain.includes('..') ||
+    domain.startsWith('-') ||
+    domain.endsWith('-') ||
+    localPart.match(/[^\w.!#$%&'*+/=?^`{|}~-]/) !== null // illegal chars in local part
+  ) {
+    return true;
+  }
+
+  // ────────────────────────────────────────────────
+  // 2. Very common spam patterns in local part
+  // ────────────────────────────────────────────────
+  const spamPatterns = [
+    /\d{8,}/, // long number strings (e.g. 1234567890user)
+    /[a-z]{10,}/, // very long random letters
+    /unsubscribe/i, // rare but classic spam sign
+    /free|win|bonus|deal|promo/i, // promotional keywords in address
+    /\+\d+$/, // + followed only by numbers (often disposable)
+    /^[\d\W_]+$/, // only digits & symbols (very suspicious)
+  ];
+
+  if (spamPatterns.some((p) => p.test(localPart))) {
+    return true;
+  }
+
+  // ────────────────────────────────────────────────
+  // 3. Common free / disposable / temporary providers
+  // (update this list periodically – 2026 common ones)
+  // ────────────────────────────────────────────────
+  const freeOrDisposableDomains = new Set([
+    'gmail.com',
+    'yahoo.com',
+    'hotmail.com',
+    'outlook.com',
+    'aol.com',
+    'icloud.com',
+    'proton.me',
+    'protonmail.com',
+    'mail.com',
+    'yandex.com',
+    'ymail.com',
+    'rocketmail.com',
+    'gmx.com',
+    'gmx.net',
+    'web.de',
+    'live.com',
+    'msn.com',
+    'inbox.com',
+    'zoho.com',
+    'tutanota.com',
+    'tempmail.com',
+    '10minutemail.com',
+    'guerrillamail.com',
+    'trashmail.com',
+    'mailinator.com',
+    'yopmail.com',
+    'sharklasers.com',
+    // Add more from disposable lists if needed
+  ]);
+
+  if (freeOrDisposableDomains.has(domain)) {
+    // Still allow if it looks like a serious role or branded use
+    const seriousPrefixes = ['info', 'support', 'sales', 'contact', 'hello', 'team', 'admin', 'office', 'billing'];
+    const prefix = localPart.split('+')[0].split('.')[0]; // rough prefix
+
+    if (!seriousPrefixes.some((p) => prefix.includes(p))) {
+      // Extra lenient length check for free providers
+      if (localPart.length > 24 || localPart.match(/\d{6,}/)) {
+        return true;
+      }
+    }
+    // Otherwise: free provider but looks somewhat legitimate → not spam
+    return false;
+  }
+
+  // ────────────────────────────────────────────────
+  // 4. Very short / meaningless / bot-like local parts
+  // ────────────────────────────────────────────────
+  if (localPart.length < 3 || localPart.match(/^[a-z\d]{1,4}$/)) {
+    return true; // e.g. a1@b.com, xyz@temp.com
+  }
+
+  // ────────────────────────────────────────────────
+  // 5. Suspicious TLDs sometimes used in spam (2026 context)
+  // ────────────────────────────────────────────────
+  const suspiciousTlds = ['.top', '.xyz', '.club', '.online', '.site', '.fun', '.buzz'];
+  if (suspiciousTlds.some((tld) => domain.endsWith(tld))) {
+    return true;
+  }
+
+  // Passed most checks → probably not spam
+  return false;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xuda.io/account_module",
-  "version": "1.2.1840",
+  "version": "1.2.1841",
   "description": "Xuda Account Server Module",
   "main": "index.mjs",
   "dependencies": {