Haraka 3.1.3 → 3.1.5

package/test/server.js

@@ -1,124 +1,202 @@
-const assert = require('node:assert')
+'use strict'
+
+const { describe, it, beforeEach, afterEach } = require('node:test')
+const assert = require('node:assert/strict')
+const { createHmac } = require('node:crypto')
+const net = require('node:net')
 const path = require('node:path')
+const tls = require('node:tls')
 
 const endpoint = require('../endpoint')
 const message = require('haraka-email-message')
+const { get_client } = require('../smtp_client')
 
-const _set_up = (done) => {
-    this.config = require('haraka-config')
-    this.server = require('../server')
-    done()
-}
-
-const _setupServer = (ip_port, done) => {
-    process.env.YES_REALLY_DO_DISCARD = 1 // for queue/discard plugin
-    process.env.HARAKA_TEST_DIR = path.resolve('test')
-
-    // test sets the default path for plugin instances to the test dir
-    const test_cfg_path = path.resolve('test')
-
-    this.server = require('../server')
-    this.config = require('haraka-config').module_config(test_cfg_path)
-    this.server.logger.loglevel = 6 // INFO
-
-    // set the default path for the plugin loader
-    this.server.config = this.config.module_config(test_cfg_path)
-    this.server.plugins.config = this.config.module_config(test_cfg_path)
-    // this.server.outbound.config = this.config.module_config(this_cfg_path);
-
-    this.server.load_smtp_ini()
-    this.server.cfg.main.listen = ip_port
-    this.server.cfg.main.smtps_port = 2465
+// ─── CRAM-MD5 helper ──────────────────────────────────────────────────────────
 
-    this.server.load_default_tls_config(() => {
-        this.server.createServer({})
-        setTimeout(() => {
-            done()
-        }, 200)
-    })
+/** Compute a CRAM-MD5 response to a server challenge. */
+const cramMd5Response = (user, pass, challenge) => {
+    const decoded = Buffer.from(challenge, 'base64').toString()
+    const hmac = createHmac('md5', pass).update(decoded).digest('hex')
+    return Buffer.from(`${user} ${hmac}`).toString('base64')
 }
 
-const _tearDownServer = (done) => {
-    delete process.env.YES_REALLY_DO_DISCARD
-    delete process.env.HARAKA_TEST_DIR
-    this.server.stopListeners()
-    this.server.plugins.registered_hooks = {}
-    setTimeout(() => {
-        done()
-    }, 200)
-}
+// ─── Server lifecycle helpers ─────────────────────────────────────────────────
 
-describe('server', () => {
-    describe('get_listen_addrs', () => {
-        beforeEach(_set_up)
+const setupServer = (ip_port) =>
+    new Promise((resolve) => {
+        process.env.YES_REALLY_DO_DISCARD = '1'
+        process.env.HARAKA_TEST_DIR = path.resolve('test')
+        const test_cfg_path = path.resolve('test')
 
-        it('IPv4 fully qualified', () => {
-            const listeners = this.server.get_listen_addrs({
-                listen: '127.0.0.1:25',
-            })
-            assert.deepEqual(['127.0.0.1:25'], listeners)
-        })
+        this.server = require('../server')
+        this.config = require('haraka-config').module_config(test_cfg_path)
+        this.server.logger.loglevel = 6
+        this.server.config = this.config.module_config(test_cfg_path)
+        this.server.plugins.config = this.config.module_config(test_cfg_path)
 
-        it('IPv4, default port', () => {
-            const listeners = this.server.get_listen_addrs({
-                listen: '127.0.0.1',
-            })
-            assert.deepEqual(['127.0.0.1:25'], listeners)
-        })
+        this.server.load_smtp_ini()
+        this.server.cfg.main.listen = ip_port
+        this.server.cfg.main.smtps_port = 2465
 
-        it('IPv4, custom port', () => {
-            const listeners = this.server.get_listen_addrs({ listen: '127.0.0.1' }, 250)
-            assert.deepEqual(['127.0.0.1:250'], listeners)
+        this.server.load_default_tls_config(() => {
+            this.server.createServer({})
+            setTimeout(resolve, 200)
         })
+    })
 
-        it('IPv6 fully qualified', () => {
-            const listeners = this.server.get_listen_addrs({
-                listen: '[::1]:25',
-            })
-            assert.deepEqual(['[::1]:25'], listeners)
-        })
+const tearDownServer = () =>
+    new Promise((resolve) => {
+        delete process.env.YES_REALLY_DO_DISCARD
+        delete process.env.HARAKA_TEST_DIR
+        this.server.stopListeners()
+        this.server.plugins.registered_hooks = {}
+        setTimeout(resolve, 200)
+    })
 
-        it('IPv6, default port', () => {
-            const listeners = this.server.get_listen_addrs({ listen: '[::1]' })
-            assert.deepEqual(['[::1]:25'], listeners)
-        })
+// ─── SMTP session helper ──────────────────────────────────────────────────────
+
+/**
+ * Deliver a message via smtp_client and return a Promise that resolves on
+ * acceptance (dot event) or rejects on any SMTP error (bad_code event).
+ *
+ * When `user`/`pass` are provided, CRAM-MD5 authentication is performed
+ * before sending the message.
+ */
+const sendMessage = ({
+    host = '127.0.0.1',
+    port,
+    from = '<test@haraka.local>',
+    to = '<discard@haraka.local>',
+    user,
+    pass,
+    body = 'Hello from smtp_client test',
+} = {}) =>
+    new Promise((resolve, reject) => {
+        get_client(
+            { notes: {} },
+            (client) => {
+                let credsSent = false
+
+                client
+                    .on('greeting', (cmd) => client.send_command(cmd, host))
+                    .on('helo', () => {
+                        if (user && !credsSent) {
+                            client.authenticating = true
+                            client.send_command('AUTH', 'CRAM-MD5')
+                        } else {
+                            client.send_command('MAIL', `FROM:${from}`)
+                        }
+                    })
+                    .on('auth', () => {
+                        if (client.authenticated) {
+                            client.send_command('MAIL', `FROM:${from}`)
+                        } else if (!credsSent) {
+                            credsSent = true
+                            const resp = cramMd5Response(user, pass, client.response[0])
+                            // Write CRAM-MD5 response directly (no command prefix)
+                            client.command = 'auth'
+                            client.response = []
+                            client.socket.write(`${resp}\r\n`)
+                        }
+                    })
+                    .on('mail', () => client.send_command('RCPT', `TO:${to}`))
+                    .on('rcpt', () => client.send_command('DATA'))
+                    .on('data', () => {
+                        const stream = new message.stream({ main: { spool_after: 1024 } }, 'testId')
+                        stream.on('end', () => client.socket.write('.\r\n'))
+                        stream.add_line('Subject: test\r\n')
+                        stream.add_line('\r\n')
+                        stream.add_line(`${body}\r\n`)
+                        stream.add_line_end()
+                        client.start_data(stream)
+                    })
+                    .on('dot', () => {
+                        client.release()
+                        resolve()
+                    })
+                    .on('bad_code', (code, msg) => {
+                        client.release()
+                        reject(new Error(`${code} ${msg}`))
+                    })
+            },
+            { host, port, connect_timeout: 5 },
+        )
+    })
 
-        it('IPv6, custom port', () => {
-            const listeners = this.server.get_listen_addrs({ listen: '[::1]' }, 250)
-            assert.deepEqual(['[::1]:250'], listeners)
-        })
+// ─── Tests ────────────────────────────────────────────────────────────────────
 
-        it('IPv4 & IPv6 fully qualified', () => {
-            const listeners = this.server.get_listen_addrs({
-                listen: '127.0.0.1:25,[::1]:25',
-            })
-            assert.deepEqual(['127.0.0.1:25', '[::1]:25'], listeners)
+describe('server', () => {
+    // ── get_listen_addrs ──────────────────────────────────────────────────────
+    describe('get_listen_addrs', () => {
+        beforeEach(() => {
+            this.config = require('haraka-config')
+            this.server = require('../server')
         })
 
-        it('IPv4 & IPv6, default port', () => {
-            const listeners = this.server.get_listen_addrs({
-                listen: '127.0.0.1:25,[::1]',
+        const cases = [
+            {
+                desc: 'IPv4 fully qualified',
+                args: [{ listen: '127.0.0.1:25' }],
+                expected: ['127.0.0.1:25'],
+            },
+            {
+                desc: 'IPv4, default port',
+                args: [{ listen: '127.0.0.1' }],
+                expected: ['127.0.0.1:25'],
+            },
+            {
+                desc: 'IPv4, custom port',
+                args: [{ listen: '127.0.0.1' }, 250],
+                expected: ['127.0.0.1:250'],
+            },
+            {
+                desc: 'IPv6 fully qualified',
+                args: [{ listen: '[::1]:25' }],
+                expected: ['[::1]:25'],
+            },
+            {
+                desc: 'IPv6, default port',
+                args: [{ listen: '[::1]' }],
+                expected: ['[::1]:25'],
+            },
+            {
+                desc: 'IPv6, custom port',
+                args: [{ listen: '[::1]' }, 250],
+                expected: ['[::1]:250'],
+            },
+            {
+                desc: 'IPv4 & IPv6 fully qualified',
+                args: [{ listen: '127.0.0.1:25,[::1]:25' }],
+                expected: ['127.0.0.1:25', '[::1]:25'],
+            },
+            {
+                desc: 'IPv4 & IPv6, default port',
+                args: [{ listen: '127.0.0.1:25,[::1]' }],
+                expected: ['127.0.0.1:25', '[::1]:25'],
+            },
+            {
+                desc: 'IPv4 & IPv6, custom port',
+                args: [{ listen: '127.0.0.1,[::1]' }, 250],
+                expected: ['127.0.0.1:250', '[::1]:250'],
+            },
+        ]
+
+        for (const { desc, args, expected } of cases) {
+            it(desc, () => {
+                assert.deepEqual(this.server.get_listen_addrs(...args), expected)
             })
-            assert.deepEqual(['127.0.0.1:25', '[::1]:25'], listeners)
-        })
-
-        it('IPv4 & IPv6, custom port', () => {
-            const listeners = this.server.get_listen_addrs(
-                {
-                    listen: '127.0.0.1,[::1]',
-                },
-                250,
-            )
-            assert.deepEqual(['127.0.0.1:250', '[::1]:250'], listeners)
-        })
+        }
     })
 
+    // ── load_smtp_ini ─────────────────────────────────────────────────────────
     describe('load_smtp_ini', () => {
-        beforeEach(_set_up)
+        beforeEach(() => {
+            this.config = require('haraka-config')
+            this.server = require('../server')
+        })
 
         it('saves settings to Server.cfg', () => {
             this.server.load_smtp_ini()
-            // console.log(this.server.cfg);
             const c = this.server.cfg.main
             assert.notEqual(c.daemonize, undefined)
             assert.notEqual(c.daemon_log_file, undefined)
@@ -126,387 +204,154 @@ describe('server', () => {
         })
     })
 
+    // ── get_smtp_server ───────────────────────────────────────────────────────
     describe('get_smtp_server', () => {
-        beforeEach((done) => {
-            this.config = require('haraka-config')
-            this.config = this.config.module_config(path.resolve('test'))
-
+        beforeEach(async () => {
+            this.config = require('haraka-config').module_config(path.resolve('test'))
             this.server = require('../server')
             this.server.config = this.config
             this.server.plugins.config = this.config
-
-            this.server.load_default_tls_config(() => {
-                setTimeout(() => {
-                    done()
-                }, 200)
+            await new Promise((resolve) => {
+                this.server.load_default_tls_config(() => setTimeout(resolve, 200))
             })
         })
 
-        it('gets a net server object', (done) => {
-            this.server.get_smtp_server(endpoint('0.0.0.0:2501'), 10).then((server) => {
-                if (!server) {
-                    console.error('unable to bind to 0.0.0.0:2501')
-                    if (process.env.CI) return // can't bind to IP/port (fails on Travis)
-                }
-                assert.ok(server)
-                assert.equal(server.has_tls, false)
-                server.getConnections((err, count) => {
-                    assert.equal(0, count)
-                    done()
-                })
-            })
+        it('gets a net server object', async () => {
+            const server = await this.server.get_smtp_server(endpoint('0.0.0.0:2501'), 10)
+            if (!server) {
+                if (process.env.CI) return
+                assert.fail('unable to bind to 0.0.0.0:2501')
+            }
+            assert.ok(server)
+            assert.equal(server.has_tls, false)
+            const count = await new Promise((res) => server.getConnections((err, n) => res(n)))
+            assert.equal(count, 0)
         })
 
-        it('gets a TLS net server object', (done) => {
+        it('gets a TLS net server object', async () => {
             this.server.cfg.main.smtps_port = 2502
-            this.server.get_smtp_server(endpoint('0.0.0.0:2502'), 10).then((server) => {
-                if (!server) {
-                    console.error('unable to bind to 0.0.0.0:2502')
-                    if (process.env.CI) return // can't bind to IP/port (fails on Travis)
-                }
-                assert.ok(server)
-                assert.equal(server.has_tls, true)
-                server.getConnections((err, count) => {
-                    assert.equal(0, count)
-                    done()
-                })
-            })
+            const server = await this.server.get_smtp_server(endpoint('0.0.0.0:2502'), 10)
+            if (!server) {
+                if (process.env.CI) return
+                assert.fail('unable to bind to 0.0.0.0:2502')
+            }
+            assert.ok(server)
+            assert.equal(server.has_tls, true)
+            const count = await new Promise((res) => server.getConnections((err, n) => res(n)))
+            assert.equal(count, 0)
         })
     })
 
+    // ── get_http_docroot ──────────────────────────────────────────────────────
     describe('get_http_docroot', () => {
-        beforeEach(_set_up)
+        beforeEach(() => {
+            this.config = require('haraka-config')
+            this.server = require('../server')
+        })
 
         it('gets a fs path', () => {
             assert.ok(this.server.get_http_docroot())
         })
     })
 
-    describe('smtp_client', () => {
-        beforeEach((done) => {
-            _setupServer('localhost:2500', done)
-        })
-
-        afterEach(_tearDownServer)
-
-        it('accepts SMTP message', () => {
-            const server = { notes: {} }
-            const cfg = {
-                connect_timeout: 2,
-            }
+    // ── SMTP sessions ─────────────────────────────────────────────────────────
+    describe('SMTP sessions', () => {
+        beforeEach(async () => setupServer('127.0.0.1:2503'))
+        afterEach(async () => tearDownServer())
 
-            const smtp_client = require('../smtp_client')
-
-            smtp_client.get_client(
-                server,
-                (client) => {
-                    client
-                        .on('greeting', (command) => {
-                            client.send_command('HELO', 'haraka.local')
-                        })
-                        .on('helo', () => {
-                            client.send_command('MAIL', 'FROM:<test@haraka.local>')
-                        })
-                        .on('mail', () => {
-                            client.send_command('RCPT', 'TO:<nobody-will-see-this@haraka.local>')
-                        })
-                        .on('rcpt', () => {
-                            client.send_command('DATA')
-                        })
-                        .on('data', () => {
-                            const message_stream = new message.stream({ main: { spool_after: 1024 } }, 'theMessageId')
-
-                            message_stream.on('end', () => {
-                                client.socket.write('.\r\n')
-                            })
-                            message_stream.add_line('Header: test\r\n')
-                            message_stream.add_line('\r\n')
-                            message_stream.add_line('I am body text\r\n')
-                            message_stream.add_line_end()
-
-                            client.start_data(message_stream)
-                        })
-                        .on('dot', () => {
-                            assert.ok(1)
-                            client.release()
-                        })
-                        .on('bad_code', (code, msg) => {
-                            client.release()
-                        })
-                },
-                { port: 2500, host: 'localhost', cfg },
-            )
+        it('accepts plain SMTP message', async () => {
+            await sendMessage({ port: 2503 })
         })
-    })
 
-    describe('nodemailer', () => {
-        beforeEach((done) => {
-            _setupServer('127.0.0.1:2503', done)
+        it('accepts CRAM-MD5 authenticated SMTP', async () => {
+            await sendMessage({ port: 2503, user: 'matt', pass: 'goodPass' })
         })
 
-        afterEach(_tearDownServer)
-
-        it('accepts SMTP message', (done) => {
-            const nodemailer = require('nodemailer')
-            const transporter = nodemailer.createTransport({
-                host: '127.0.0.1',
-                port: 2503,
-                tls: {
-                    // do not fail on invalid certs
-                    rejectUnauthorized: false,
-                },
-            })
-            transporter.sendMail(
-                {
-                    from: '"Testalicious Matt" <harakamail@gmail.com>',
-                    to: 'nobody-will-see-this@haraka.local',
-                    envelope: {
-                        from: 'Haraka Test <test@haraka.local>',
-                        to: 'Discard Queue <discard@haraka.local>',
-                    },
-                    subject: 'Hello ✔',
-                    text: 'Hello world ?',
-                    html: '<b>Hello world ?</b>',
-                },
-                (error, info) => {
-                    if (error) {
-                        console.log(error)
-                        return
-                    }
-                    assert.deepEqual(info.accepted, ['discard@haraka.local'])
-                    console.log(`Message sent: ${info.response}`)
-                    done()
-                },
-            )
+        it('rejects invalid CRAM-MD5 credentials', async () => {
+            await assert.rejects(() => sendMessage({ port: 2503, user: 'matt', pass: 'badPass' }), /5\d\d/)
         })
 
-        it('accepts authenticated SMTP', (done) => {
-            const nodemailer = require('nodemailer')
-            const transporter = nodemailer.createTransport({
-                host: '127.0.0.1',
+        it('accepts message with custom headers', async () => {
+            await sendMessage({
                 port: 2503,
-                auth: {
-                    user: 'matt',
-                    pass: 'goodPass',
-                },
-                requireTLS: true,
-                tls: {
-                    // do not fail on invalid certs
-                    rejectUnauthorized: false,
-                },
+                from: '<sender@haraka.local>',
+                to: '<discard@haraka.local>',
+                body: 'X-Custom: test-value\r\n\r\nBody text',
             })
-
-            transporter.sendMail(
-                {
-                    from: '"Testalicious Matt" <harakamail@gmail.com>',
-                    to: 'nobody-will-see-this@haraka.local',
-                    envelope: {
-                        from: 'Haraka Test <test@haraka.local>',
-                        to: 'Discard Queue <discard@haraka.local>',
-                    },
-                    subject: 'Hello ✔',
-                    text: 'Hello world ?',
-                    html: '<b>Hello world ?</b>',
-                },
-                (error, info) => {
-                    if (error) {
-                        console.log(error)
-                        return
-                    }
-                    assert.deepEqual(info.accepted, ['discard@haraka.local'])
-                    console.log(`Message sent: ${info.response}`)
-                    done()
-                },
-            )
-        })
-
-        it('rejects invalid auth', (done) => {
-            const nodemailer = require('nodemailer')
-            const transporter = nodemailer.createTransport({
-                host: '127.0.0.1',
-                port: 2503,
-                auth: {
-                    user: 'matt',
-                    pass: 'badPass',
-                },
-                tls: {
-                    // do not fail on invalid certs
-                    rejectUnauthorized: false,
-                },
-            })
-
-            transporter.sendMail(
-                {
-                    from: '"Testalicious Matt" <harakamail@gmail.com>',
-                    to: 'nobody-will-see-this@haraka.local',
-                    envelope: {
-                        from: 'Haraka Test <test@haraka.local>',
-                        to: 'Discard Queue <discard@haraka.local>',
-                    },
-                    subject: 'Hello ✔',
-                    text: 'Hello world ?',
-                    html: '<b>Hello world ?</b>',
-                },
-                (error, info) => {
-                    if (error) {
-                        assert.equal(error.code, 'EAUTH')
-                        // console.log(error);
-                        return done()
-                    }
-                    console.log(info.response)
-                    done()
-                },
-            )
-        })
-
-        it('DKIM validates signed message', (done) => {
-            const nodemailer = require('nodemailer')
-            const transporter = nodemailer.createTransport({
-                host: '127.0.0.1',
-                port: 2503,
-                tls: {
-                    // do not fail on invalid certs
-                    rejectUnauthorized: false,
-                },
-            })
-
-            transporter.sendMail(
-                {
-                    from: '"Testalicious Matt" <harakamail@gmail.com>',
-                    to: 'nobody-will-see-this@haraka.local',
-                    envelope: {
-                        from: 'Haraka Test <test@haraka.local>',
-                        to: 'Discard Queue <discard@haraka.local>',
-                    },
-                    subject: 'Hello ✔',
-                    text: 'Hello world ?',
-                    html: '<b>Hello world ?</b>',
-                    dkim: {
-                        domainName: 'test.simerson.com',
-                        keySelector: 'harakatest2017',
-                        privateKey:
-                            '-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEAxqoUAnQ9GB3iNnkS7coj0Iggd0nyryW062tpK95NC5UXmmAwIpUMfkYdiHY2o2duWYGF0Bp237M/QXKhJYTXfsgkwP/bq9OGWtRZxHPHhbhdjbiI\nqObi6zvYcxrI77gpWDDvruhMeS9Hwa1R99pLUWd4PsuYTzbV/jwu2pz+XZXXXNEU\nVxzDAAj0yF7mwxHMLzQfR+hdhWcrgN0stUP0o7hm7hoOP8IWgcSW3JiQYavIKoI4\nm4+I9I1LzDJN2rHVnQvmjUrqqpG7X6SyFVFtuTWGaMqf1Cj/t8eSvU9VdgLFllS8\ntThqUZHq5S5hm8M8VzLuQLG9U0dtFolcFmJkbQIDAQABAoIBAB4fUbNhjpXmihM6\nXm1htfZ7fXi45Kw76me7vJGjPklgTNjidsn3kZJf7UBwtC4ok6nMos6ABMA8fH3e\n9KIst0QI8tG0ucke5INHKWlJKNqUrtK7RTVe9M84HsStLgRzBwnRObZqkJXbXmT2\nc7RCDCOGrcvPsQNpzB6lX3FUVpk3x24RXpQV1qSgH8yuHSPc1C6rssXwPAgnESfS\nK3MHRx2CLZvTTkq/YCsT+wS/O9RWPCVOYuWaa5DDDAIp3Yw1wYq9Upoh0BdIFC3U\nWm+5Cr3o9wxcvS6+W2RA6I51eymzvCU5ZakWt/bnUDb6/ByxsWOn5rL4WfPpCwE4\nnuC72v0CgYEA9imEq6a0GoaEsMoR7cxT7uXKimQH+Jaq3CGkuh0iN32F4FXhuUKz\nLYKSLCZzpb1MiDJv6BBchV6uSQ6ATo1cZ8WzYQISikk175bf0SPom591OZElvKA2\nSOrTrXtbl33YbWZEgyEcpTgelVi5ys9rj4eKkMvM0lwRmW6gctEFXRcCgYEAzpqc\nR/wqPjgPhpF1CZtdEwOZg4kkOig8CBcuQ7o/hDG7N69A9ZbeJO8eD+gKDrHRfkYr\nTH/UdkZGjilBk/lxnpIZpyBLxQ6UdhNPuwtxXKAvuSN+aQ0pdJn8tg03OSj2OzTK\nJ4hMsO/wt1xM8EDRobLZEosMadaYZUHzx8VU5RsCgYEAvFZbuXEcT0cocpLIUOaK\nOTf7VRLfvmSYaUAcZoEv0sDpExDiWPodWO6To8/vn5lL2tCsKiOKhkhAlIjRxkgF\nsSfj7I7HXKJS7/LBX6RXrem8qMTS2JTDs9pnBk5hb3DLjDg4pxNIdWiQjbeKvw8f\nvnr3m30yQqhKlte7Tt15exUCgYBzq7RbyR6Nfy2SFdYE7usJPjawohOaS/RwQyov\n2RK+nGlJH+GqnjD5VLbsCOm4mG3F2NtdFSSKo4XVCdwhUMMAGKQsIbTKOwN7qAw3\nmIx7Y2PUr76SakAPfDc0ZenJItnZBBE6WOE3Ht8Siaa5zFCRy2QlMZxdlTv1VRt7\neUuyiQKBgQDdXJO5+3h1HPxbYZcmNm/2CJUNw2ehU8vCiBXCcWPn7JukayHx+TXy\nyj0j/b1SvmKgjB+4JWluiqIU+QBjRjvb397QY1YoCEaGZd0zdFjTZwQksQ5AFst9\nCiD9OFXe/kkmIUQQra6aw1CoppyAfvAblp8uevLWb57xU3VUB3xeGg==\n-----END RSA PRIVATE KEY-----\n',
-                    },
-                },
-                (error, info) => {
-                    // console.log(info);
-                    if (error) {
-                        console.log(error)
-                        return
-                    }
-                    assert.deepEqual(info.accepted, ['discard@haraka.local'])
-                    console.log(`Message sent: ${info.response}`)
-                    done()
-                },
-            )
         })
     })
 
+    // ── requireAuthorized: SMTPS (implicit TLS) ───────────────────────────────
     describe('requireAuthorized_SMTPS', () => {
-        beforeEach((done) => {
-            _setupServer('127.0.0.1:2465', done)
-        })
-
-        afterEach(_tearDownServer)
-
-        it('rejects non-validated SMTPS connection', (done) => {
-            const nodemailer = require('nodemailer')
-            const transporter = nodemailer.createTransport({
-                host: '127.0.0.1',
-                port: 2465,
-                secure: true,
-                tls: {
-                    // do not fail on invalid certs
+        beforeEach(async () => setupServer('127.0.0.1:2465'))
+        afterEach(async () => tearDownServer())
+
+        it('rejects non-validated SMTPS connection', async () => {
+            // Port 2465 is configured as SMTPS with requireAuthorized.
+            // In TLSv1.3 the handshake completes (secureConnect fires), then the server
+            // sends a post-handshake "certificate required" alert as a socket error.
+            const err = await new Promise((resolve) => {
+                const socket = tls.connect({
+                    host: '127.0.0.1',
+                    port: 2465,
                     rejectUnauthorized: false,
-                },
+                })
+                socket.on('error', resolve)
+                // secureConnect may fire before the post-handshake alert; keep waiting.
+                socket.on('secureConnect', () => {})
+                setTimeout(() => {
+                    socket.destroy()
+                    resolve(new Error('timeout'))
+                }, 3000)
             })
-
-            // give the SMTPS listener a second to start listening
-            setTimeout(() => {
-                transporter.sendMail(
-                    {
-                        from: '"Testalicious Matt" <harakamail@gmail.com>',
-                        to: 'nobody-will-see-this@haraka.local',
-                        envelope: {
-                            from: 'Haraka Test <test@haraka.local>',
-                            to: 'Discard Queue <discard@haraka.local>',
-                        },
-                        subject: 'Hello ✔',
-                        text: 'Hello world ?',
-                        html: '<b>Hello world ?</b>',
-                    },
-                    (error, info) => {
-                        if (error) {
-                            // console.log(error);
-                            if (error.message === 'socket hang up') {
-                                // node 6 & 8
-                                assert.equal(error.message, 'socket hang up')
-                            } else if (/alert certificate required/.test(error.message)) {
-                                // node 18
-                                assert.ok(/alert certificate required/.test(error.message))
-                            } else {
-                                // node 10+
-                                assert.equal(
-                                    error.message,
-                                    'Client network socket disconnected before secure TLS connection was established',
-                                )
-                            }
-                        }
-                        done()
-                    },
-                )
-            }, 500)
+            assert.ok(
+                /socket hang up|disconnected before secure TLS|alert certificate required/.test(err.message),
+                `unexpected error: ${err.message}`,
+            )
         })
     })
 
+    // ── requireAuthorized: STARTTLS ───────────────────────────────────────────
     describe('requireAuthorized_STARTTLS', () => {
-        beforeEach((done) => {
-            _setupServer('127.0.0.1:2587', done)
-        })
-
-        it('rejects non-validated STARTTLS connection', (done) => {
-            const nodemailer = require('nodemailer')
-            const transporter = nodemailer.createTransport({
-                host: '127.0.0.1',
-                port: 2587,
-                secure: false,
-                tls: {
-                    // do not fail on invalid certs
-                    rejectUnauthorized: false,
-                },
-            })
-
-            // give the SMTPS listener a half second to start listening
-            setTimeout(() => {
-                transporter.sendMail(
-                    {
-                        from: '"Testalicious Matt" <harakamail@gmail.com>',
-                        to: 'nobody-will-see-this@haraka.local',
-                        envelope: {
-                            from: 'Haraka Test <test@haraka.local>',
-                            to: 'Discard Queue <discard@haraka.local>',
-                        },
-                        subject: 'Hello ✔',
-                        text: 'Hello world ?',
-                        html: '<b>Hello world ?</b>',
-                    },
-                    (error, info) => {
-                        if (error) {
-                            // console.log(error);
-                            if (/alert certificate required/.test(error.message)) {
-                                // node 18
-                                assert.ok(/alert certificate required/.test(error.message))
-                            } else {
-                                assert.equal(
-                                    error.message,
-                                    'Client network socket disconnected before secure TLS connection was established',
-                                )
-                            }
+        beforeEach(async () => setupServer('127.0.0.1:2587'))
+        afterEach(async () => tearDownServer())
+
+        it('rejects non-validated STARTTLS connection', async () => {
+            // Port 2587 is plain SMTP; requireAuthorized enforces mutual TLS on STARTTLS upgrade.
+            // In TLSv1.3 secureConnect fires first, then the server sends a post-handshake
+            // "certificate required" alert. Use raw sockets to observe the TLS error.
+            // (smtp_client's upgrade path silently swallows the post-upgrade error.)
+            const err = await new Promise((resolve) => {
+                const sock = net.connect({ host: '127.0.0.1', port: 2587 })
+                let state = 'greeting'
+                let buf = ''
+                sock.on('data', (d) => {
+                    buf += d.toString()
+                    for (const line of buf.split('\r\n').slice(0, -1)) {
+                        buf = buf.slice(line.length + 2)
+                        if (line[3] === '-') continue // multi-line continuation
+                        if (state === 'greeting') {
+                            sock.write('EHLO test\r\n')
+                            state = 'ehlo'
+                        } else if (state === 'ehlo') {
+                            sock.write('STARTTLS\r\n')
+                            state = 'starttls'
+                        } else if (state === 'starttls') {
+                            state = 'tls'
+                            const cleartext = tls.connect({ socket: sock, rejectUnauthorized: false })
+                            cleartext.on('secureConnect', () => {})
+                            cleartext.on('error', resolve)
+                            cleartext.on('close', () => resolve(new Error('closed without error')))
                         }
-                        done()
-                    },
-                )
-            }, 500)
+                    }
+                })
+                sock.on('error', resolve)
+                setTimeout(() => resolve(new Error('timeout')), 3000)
+            })
+            assert.ok(
+                /alert certificate required|socket hang up|disconnected/.test(err.message),
+                `unexpected error: ${err.message}`,
+            )
         })
     })
 })