@zaclinley/dsh-mailharbor 0.16.0 → 0.16.1

package/lib/index.js

@@ -2768,7 +2768,7 @@ ${conversation.trim()}
 }
 
 // src/host/version.ts
-var VERSION = "0.16.0";
+var VERSION = "0.16.1";
 
 // src/host/api.ts
 init_smtp();
@@ -3107,14 +3107,26 @@ function buildRouter(runtime) {
       const part = Number(url.searchParams.get("part") ?? 0);
       const provider = runtime.provider(account);
       const file2 = await provider.attachment(mailbox, uid, part);
-      writeAttachment(res, file2.filename, file2.contentType, Buffer.from(file2.dataBase64, "base64"));
+      writeAttachment(
+        res,
+        file2.filename,
+        file2.contentType,
+        Buffer.from(file2.dataBase64, "base64"),
+        canPreviewInline(file2.contentType) && url.searchParams.get("inline") === "1"
+      );
       return void 0;
     }
     const emailId = Number(url.searchParams.get("emailId") ?? 0);
     const attachmentId = Number(url.searchParams.get("attachmentId") ?? 0);
     const file = runtime.database(account).attachment(emailId, attachmentId);
     if (file === void 0) throw new HttpError(404, "\u9644\u4EF6\u4E0D\u5B58\u5728");
-    writeAttachment(res, file.filename, file.contentType, Buffer.from(file.data));
+    writeAttachment(
+      res,
+      file.filename,
+      file.contentType,
+      Buffer.from(file.data),
+      canPreviewInline(file.contentType) && url.searchParams.get("inline") === "1"
+    );
     return void 0;
   });
   router.get("/drafts", ({ url }) => {
@@ -3998,13 +4010,24 @@ async function listServer(runtime, account, mailbox, query, limit, offset = 0) {
   );
   return { items, total: result.total };
 }
-function writeAttachment(res, filename, contentType, data) {
+function canPreviewInline(contentType) {
+  const type = contentType.toLowerCase();
+  return type.startsWith("image/") && type !== "image/svg+xml" || type === "application/pdf" || type === "text/plain" || type === "text/csv" || type === "text/markdown" || type === "application/json";
+}
+function writeAttachment(res, filename, contentType, data, inline = false) {
   res.statusCode = 200;
   res.setHeader("content-type", contentType);
   res.setHeader("content-length", String(data.length));
-  res.setHeader("content-disposition", `attachment; filename*=UTF-8''${encodeURIComponent(filename)}`);
+  res.setHeader(
+    "content-disposition",
+    `${inline ? "inline" : "attachment"}; filename*=UTF-8''${encodeURIComponent(filename)}`
+  );
   res.setHeader("cache-control", "no-store");
   res.setHeader("x-content-type-options", "nosniff");
+  res.setHeader(
+    "content-security-policy",
+    "sandbox; default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'"
+  );
   res.end(data);
 }
 function asObject(value) {