domma-cms 0.55.1 → 0.66.0

package/plugins/_lib/admin/mail/identity.js

@@ -0,0 +1,480 @@
+/**
+ * Who a mailbox sends as, and what it signs off with.
+ *
+ * Pure, and kept apart from `accounts.js` and `send.js`, because the parts
+ * that go wrong here are conventions rather than transport. A display name
+ * that is not quoted breaks the From header on any name containing a comma; a
+ * name carried into the SMTP envelope makes the envelope invalid; a newline
+ * that reaches a header is header injection. All three are decided here, once,
+ * so that the send path and the draft path cannot disagree about them.
+ *
+ * ## Why this sits under `admin/`
+ *
+ * Both sides need it: the send path builds the From header with it, and the
+ * compose window adds the signature with it. The static mount serves
+ * `{plugin}/{admin|public}/**` and nothing else - `_lib/mail/` is where the
+ * credential store and the secret box live, and it is 404 to a browser by
+ * design. A module the browser must import therefore has to live here, and
+ * the server imports it across rather than the alternative, which is two
+ * copies of the placement rules drifting apart.
+ *
+ * @module _lib/admin/mail/identity
+ */
+
+/** Where a signature sits relative to quoted text. */
+export const PLACEMENTS = ['above-quote', 'below-quote'];
+
+/**
+ * Strip anything that would end a header line.
+ *
+ * Every value here is interpolated into a mail header, so a CR or LF in one
+ * is not a formatting problem - it is a second header of the sender's
+ * choosing. Folded to a space rather than removed, so "Sales\nTeam" reads as
+ * "Sales Team" instead of "SalesTeam".
+ *
+ * @param   {*} value
+ * @returns {string}
+ */
+function headerSafe(value) {
+    return String(value ?? '').replace(/[\r\n]+/g, ' ').trim();
+}
+
+/**
+ * The bare address out of anything address-shaped.
+ *
+ * `"Sales" <sales@example.com>` and `sales@example.com` both answer
+ * `sales@example.com`. Used for the SMTP envelope, which takes an address and
+ * nothing else - a display name there is not a nicety, it is a syntax error
+ * the server rejects the whole message over.
+ *
+ * @param   {*} value
+ * @returns {string}
+ */
+export function bareAddress(value) {
+    const clean = headerSafe(value);
+    const angled = clean.match(/<([^>]+)>\s*$/);
+    return (angled ? angled[1] : clean).trim();
+}
+
+/**
+ * The From header for an address and an optional display name.
+ *
+ * The name is always emitted as a quoted string. A display name may go
+ * unquoted only while it is a run of atoms, and the characters that break
+ * that rule - a comma, a full stop, a colon - are exactly the ones real names
+ * and job titles contain ("Waterhouse, Darryl", "D. Waterhouse", "Sales:
+ * UK"). Quoting unconditionally is one branch instead of a predicate that
+ * gets the interesting cases wrong.
+ *
+ * @param   {*} address
+ * @param   {*} displayName
+ * @returns {string}
+ */
+export function formatFrom(address, displayName) {
+    const clean = headerSafe(address);
+    const bare = bareAddress(clean);
+    const name = headerSafe(displayName);
+    // No display name of our own means leave the address exactly as stored,
+    // NOT reduced to its bare form. The Outgoing tab's From field is free
+    // text hinted "What recipients see", so mailboxes configured before this
+    // feature existed have `Sales Team <sales@example.com>` sitting in it -
+    // and stripping that back to the address the moment an empty identity is
+    // introduced would silently rename every sender on the site.
+    if (!name || !bare) return clean;
+    return `"${name.replace(/([\\"])/g, '\\$1')}" <${bare}>`;
+}
+
+/**
+ * Is this something that could be an email address at all?
+ *
+ * The same shape `validateDraft` holds recipients to, so a Reply-To is not
+ * accepted here on terms a recipient list would refuse.
+ *
+ * @param   {*} value
+ * @returns {boolean}
+ */
+export function looksLikeAddress(value) {
+    return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(bareAddress(value));
+}
+
+/**
+ * Turn signature HTML into the plain-text version that rides alongside it.
+ *
+ * Derived rather than asked for twice. Nobody maintains two signatures, and a
+ * mailbox whose text part says something different from its HTML part is the
+ * thing that discovers, months later, that half its recipients were reading
+ * the wrong job title.
+ *
+ * @param   {string} html
+ * @returns {string}
+ */
+export function signatureToText(html) {
+    return String(html ?? '')
+        // Block-level ends become line breaks before the tags go, or every
+        // line of the signature runs into the next.
+        .replace(/<br\s*\/?>/gi, '\n')
+        .replace(/<\/(p|div|tr|li|h[1-6]|blockquote)\s*>/gi, '\n')
+        .replace(/<\/?(td|th)\s*[^>]*>/gi, ' ')
+        .replace(/<[^>]+>/g, '')
+        .replace(/&nbsp;/gi, ' ')
+        .replace(/&amp;/gi, '&')
+        .replace(/&lt;/gi, '<')
+        .replace(/&gt;/gi, '>')
+        .replace(/&quot;/gi, '"')
+        .replace(/&#39;|&apos;/gi, "'")
+        .replace(/[ \t]+\n/g, '\n')
+        .replace(/\n{3,}/g, '\n\n')
+        .trim();
+}
+
+/**
+ * Escape text for interpolation into HTML.
+ *
+ * @param   {*} value
+ * @returns {string}
+ */
+function escapeHtml(value) {
+    return String(value ?? '')
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;');
+}
+
+/**
+ * Minimal HTML preserving the line breaks of some plain text.
+ *
+ * @param   {string} text
+ * @returns {string}
+ */
+export function textToHtml(text) {
+    const clean = String(text ?? '').trim();
+    if (!clean) return '';
+    return clean
+        .split(/\n{2,}/)
+        .map(block => `<p>${escapeHtml(block).replace(/\n/g, '<br>')}</p>`)
+        .join('');
+}
+
+/**
+ * Put a stored identity into a known shape.
+ *
+ * Whitelisted rather than merged: this object is read back by the browser and
+ * its signature HTML is embedded in outgoing mail, so an unexpected key in
+ * the store should not become an unexpected key on the wire.
+ *
+ * @param   {object|null|undefined} input
+ * @returns {object}
+ */
+export function normaliseIdentity(input) {
+    const source = input && typeof input === 'object' ? input : {};
+    const useOn = source.useOn && typeof source.useOn === 'object' ? source.useOn : {};
+
+    const signatureHtml = String(source.signatureHtml ?? '').trim();
+    // Only ever derived, never trusted from the caller: the browser sends the
+    // HTML it edited, and accepting a text part alongside it would let the two
+    // drift the moment anything but this editor did the sending.
+    const signatureText = signatureHtml
+        ? signatureToText(signatureHtml)
+        : String(source.signatureText ?? '').trim();
+
+    return {
+        displayName: headerSafe(source.displayName),
+        replyTo: looksLikeAddress(source.replyTo) ? bareAddress(source.replyTo) : '',
+        signatureHtml,
+        signatureText,
+        useOn: {
+            compose: useOn.compose !== false,
+            reply: useOn.reply !== false,
+            forward: useOn.forward !== false
+        },
+        placement: PLACEMENTS.includes(source.placement) ? source.placement : 'above-quote'
+    };
+}
+
+/**
+ * Does this identity have a signature to add at all?
+ *
+ * @param   {object} identity
+ * @returns {boolean}
+ */
+export function hasSignature(identity) {
+    return Boolean(identity?.signatureHtml || identity?.signatureText);
+}
+
+/**
+ * Should a signature go on a draft opened this way?
+ *
+ * `edit` never does. A saved draft already carries whatever signature it was
+ * written with, and adding one on reopen is how a draft edited four times
+ * goes out with four signatures.
+ *
+ * @param   {object} identity
+ * @param   {'new'|'reply'|'replyAll'|'forward'|'edit'} mode
+ * @returns {boolean}
+ */
+export function signsOn(identity, mode) {
+    if (!hasSignature(identity)) return false;
+    const on = normaliseIdentity(identity).useOn;
+    if (mode === 'forward') return on.forward;
+    if (mode === 'reply' || mode === 'replyAll') return on.reply;
+    if (mode === 'new') return on.compose;
+    return false;
+}
+
+/**
+ * Add the signature to a draft.
+ *
+ * Returns a new draft rather than mutating: the caller's copy is the one the
+ * compose window compares against to decide whether anything was typed, and
+ * that comparison is meaningless if the baseline moved.
+ *
+ * Both parts are written, not just the HTML one. The rich editor derives the
+ * text part from what it holds, so the text written here only reaches the
+ * wire on the plain-textarea fallback - but the compose window also compares
+ * the two to decide whether a message is worth asking about before discarding
+ * it, and a signature in one part and not the other reads as an edit.
+ *
+ * @param   {object} draft
+ * @param   {object|null} identity
+ * @param   {'new'|'reply'|'replyAll'|'forward'|'edit'} [mode]
+ * @returns {object}
+ */
+export function applyIdentity(draft, identity, mode = 'new') {
+    if (!signsOn(identity, mode)) return draft;
+
+    const id = normaliseIdentity(identity);
+    const sigHtml = id.signatureHtml || textToHtml(id.signatureText);
+    // No "-- " above the HTML block, and one above the text: the delimiter is
+    // a plain-text convention that clients use to fold a signature away, and
+    // a designed signature with a bare "--" floating over the logo is what
+    // every rich client stopped doing years ago.
+    const sigText = id.signatureText ? `-- \n${id.signatureText}` : '';
+
+    const block = `<div class="dm-mail-signature">${sigHtml}</div>`;
+    // An empty paragraph above everything, which is where the cursor lands
+    // and where the message gets written.
+    const lead = '<p><br></p>';
+    const quoted = String(draft.html ?? '');
+    const quotedText = String(draft.body ?? '');
+    const below = id.placement === 'below-quote' && quoted;
+
+    return {
+        ...draft,
+        html: below ? lead + quoted + block : lead + block + quoted,
+        body: below ? `${quotedText}\n\n${sigText}` : `\n\n${sigText}${quotedText}`
+    };
+}
+
+// ---------------------------------------------------------------------------
+// Several identities per mailbox
+// ---------------------------------------------------------------------------
+
+/**
+ * How many identities one mailbox may hold.
+ *
+ * A ceiling rather than a guess at what is reasonable: the picker is a
+ * dropdown, the list is stored in the credentials file, and neither wants to
+ * be unbounded because a script pushed a thousand.
+ */
+export const MAX_IDENTITIES = 25;
+
+/**
+ * A stable id for an identity.
+ *
+ * Not `randomUUID` - this module is imported by the browser as well as the
+ * server, and `node:crypto` is not there. `crypto.randomUUID` exists in both,
+ * but only over HTTPS or localhost in the browser, and the admin is served
+ * over both. So: a short random string, which is all an id in a list of at
+ * most twenty-five needs to be.
+ *
+ * @returns {string}
+ */
+function newId() {
+    return `id-${Math.random().toString(36).slice(2, 10)}${Date.now().toString(36).slice(-4)}`;
+}
+
+/**
+ * Put one entry of an identity list into shape.
+ *
+ * Everything `normaliseIdentity` decides, plus the two things that only mean
+ * something when there is more than one: which address it sends from, and
+ * what to call it in the picker.
+ *
+ * @param   {object} input
+ * @param   {number} index - used only to name an entry that has no label
+ * @returns {object}
+ */
+function normaliseEntry(input, index) {
+    const source = input && typeof input === 'object' ? input : {};
+    const base = normaliseIdentity(source);
+
+    // An alias address, or '' meaning "the mailbox's own From address". Held
+    // to the same shape a recipient is, because it IS a From address - a
+    // typo here is mail that bounces rather than mail that looks odd.
+    const address = looksLikeAddress(source.address) ? bareAddress(source.address) : '';
+
+    const label = headerSafe(source.label)
+        || base.displayName
+        || address
+        || `Identity ${index + 1}`;
+
+    return {
+        ...base,
+        id: typeof source.id === 'string' && source.id.trim() ? source.id.trim() : newId(),
+        label,
+        address
+    };
+}
+
+/**
+ * Every identity a mailbox holds, in picker order.
+ *
+ * Takes the whole account rather than a field, because the migration is part
+ * of the answer: a mailbox configured before aliases existed has a single
+ * `identity` object and no list, and it must come back as a one-entry list
+ * rather than as nothing. Doing that here means no caller has to know there
+ * were ever two shapes.
+ *
+ * The first entry is the default - the one a new message uses and the one the
+ * From header carries when nothing chose otherwise. Order is therefore
+ * meaningful, not cosmetic.
+ *
+ * @param   {object|null|undefined} account
+ * @returns {object[]}
+ */
+export function normaliseIdentityList(account) {
+    const source = account && typeof account === 'object' ? account : {};
+
+    const raw = Array.isArray(source.identities)
+        ? source.identities
+        // The pre-alias shape. An empty identity is still an identity here:
+        // a mailbox that set a display name and nothing else should not lose
+        // it to a migration.
+        : (source.identity ? [source.identity] : []);
+
+    const list = raw.slice(0, MAX_IDENTITIES).map(normaliseEntry);
+
+    // Ids have to be unique or the picker cannot tell two entries apart and
+    // `findIdentity` answers the wrong one. Duplicates are re-issued rather
+    // than dropped, because the entry itself is still wanted.
+    const seen = new Set();
+    for (const entry of list) {
+        while (seen.has(entry.id)) entry.id = newId();
+        seen.add(entry.id);
+    }
+
+    return list;
+}
+
+/**
+ * The identity a mailbox uses when nothing has chosen one.
+ *
+ * Null rather than an empty identity when the list is empty: "there is no
+ * identity" and "there is one, and it is blank" lead to different From
+ * headers, and `formatFrom` already knows what to do with the first.
+ *
+ * @param   {object[]} list
+ * @returns {object|null}
+ */
+export function defaultIdentity(list) {
+    return (Array.isArray(list) && list.length) ? list[0] : null;
+}
+
+/**
+ * Look one up by id, falling back to the default.
+ *
+ * A missing id is the normal case, not an error: most messages do not choose,
+ * and an id that no longer exists means an identity was deleted while a
+ * compose window was open. Both should send as the default rather than fail.
+ *
+ * @param   {object[]} list
+ * @param   {string|null|undefined} id
+ * @returns {object|null}
+ */
+export function findIdentity(list, id) {
+    if (!Array.isArray(list) || !list.length) return null;
+    if (!id) return list[0];
+    return list.find(entry => entry.id === id) ?? list[0];
+}
+
+/**
+ * The From header this identity produces.
+ *
+ * The identity's own address when it has one - that is what makes it an alias
+ * rather than just a second signature - and the mailbox's configured From
+ * address otherwise.
+ *
+ * @param   {object|null} identity
+ * @param   {string} mailboxAddress - the account's own From address
+ * @returns {string}
+ */
+export function identityFrom(identity, mailboxAddress) {
+    if (!identity) return headerSafe(mailboxAddress);
+    return formatFrom(identity.address || mailboxAddress, identity.displayName);
+}
+
+/**
+ * The envelope address this identity sends with.
+ *
+ * An alias sends as itself. That is not a detail: SPF and DMARC are checked
+ * against the envelope, so an alias whose envelope says the main mailbox is
+ * an alias whose mail fails alignment at a good many receivers. A provider
+ * that refuses to let the alias be the envelope sender will say so at MAIL
+ * FROM, which is a clear error at send time rather than silent filtering a
+ * week later.
+ *
+ * @param   {object|null} identity
+ * @param   {string} mailboxAddress
+ * @returns {string}
+ */
+export function identityEnvelopeFrom(identity, mailboxAddress) {
+    return bareAddress(identity?.address || mailboxAddress);
+}
+
+/** The wrapper `applyIdentity` puts a signature in, and the hook for replacing it. */
+export const SIGNATURE_CLASS = 'dm-mail-signature';
+
+/**
+ * Replace the signature already in a draft with a different identity's.
+ *
+ * Used when the From picker changes halfway through writing a message: the
+ * signature that is there belongs to the identity that is no longer sending.
+ *
+ * Best effort, and deliberately so. The block is found by the wrapper
+ * `applyIdentity` wrote, and a rich editor is entitled to reformat the markup
+ * it was handed - so if the marker is not there any more, the body is left
+ * exactly as it is rather than guessed at. Silently leaving a signature alone
+ * is a small surprise; silently rewriting the wrong part of somebody's
+ * half-written message is not.
+ *
+ * @param   {string} html
+ * @param   {object|null} identity - the identity now sending
+ * @param   {'new'|'reply'|'replyAll'|'forward'|'edit'} [mode]
+ * @returns {{html: string, swapped: boolean}}
+ */
+export function swapSignature(html, identity, mode = 'new') {
+    const source = String(html ?? '');
+    const pattern = new RegExp(
+        `<div class="${SIGNATURE_CLASS}"[^>]*>[\\s\\S]*?</div>`, 'i'
+    );
+
+    if (!pattern.test(source)) return {html: source, swapped: false};
+
+    // The new identity may not sign this kind of message at all, in which
+    // case the right answer is to take the old block out and put nothing
+    // back.
+    if (!signsOn(identity, mode)) {
+        return {html: source.replace(pattern, ''), swapped: true};
+    }
+
+    const id = normaliseIdentity(identity);
+    const sigHtml = id.signatureHtml || textToHtml(id.signatureText);
+    const block = `<div class="${SIGNATURE_CLASS}">${sigHtml}</div>`;
+    // A FUNCTION, not a string. `String.replace` expands `$&`, `` $` ``, `$'`
+    // and `$1` in a string replacement - and this replacement is somebody's
+    // signature, which may legitimately contain `$'` (a price list) or `$&`.
+    // A signature reading "Save $'s" would otherwise paste the entire rest of
+    // the draft into the body on every change of sender.
+    return {html: source.replace(pattern, () => block), swapped: true};
+}

package/plugins/_lib/admin/mail/image-senders-section.js

@@ -0,0 +1,131 @@
+/**
+ * The settings section for senders whose images always load.
+ *
+ * Shared by both editions: blocking remote images is not a Pro feature, and
+ * neither is choosing to stop blocking them for someone in particular.
+ *
+ * The list exists so the choice stays visible. A preference someone cannot
+ * find is one they cannot revoke, and this one decides whether a sender learns
+ * that their mail was opened.
+ *
+ * @module _lib/admin/mail/image-senders-section
+ */
+
+/**
+ * Say something in a status line, in the right colour.
+ *
+ * A class rather than `style.color`: an inline colour cannot read a `--dm-*`
+ * token that a theme override has redefined, so a status set that way is the
+ * same shade in every theme.
+ *
+ * @param   {HTMLElement} el
+ * @param   {string} text
+ * @param   {'ok'|'bad'|'quiet'} [tone]
+ * @param   {string} [base] - the layout classes the line always carries
+ * @returns {void}
+ */
+function say(el, text, tone = 'quiet', base = 'text-sm mail-status') {
+    el.textContent = text ?? '';
+    el.className = `${base} ` + ({ok: 'text-success', bad: 'text-danger'}[tone] ?? 'text-muted');
+}
+
+/**
+ * @param   {HTMLElement} container
+ * @param   {object} ctx
+ * @returns {Promise<void>}
+ */
+async function render(container, ctx) {
+    if (!ctx.account) {
+        container.textContent = 'Add a mailbox first.';
+        return;
+    }
+
+    const params = new URLSearchParams({account: ctx.account.id});
+    const data = await ctx.api(`${ctx.base}/image-senders?${params}`);
+
+    const intro = document.createElement('p');
+    intro.className = 'text-sm text-muted mb-3';
+    intro.textContent = 'Remote images are blocked by default, because loading one tells the sender that the message was opened and who opened it. Senders listed here are trusted, and their images load without asking.';
+    container.appendChild(intro);
+
+    const toggleRow = document.createElement('label');
+    toggleRow.className = 'mail-toggle-row text-sm';
+    const toggle = document.createElement('input');
+    toggle.type = 'checkbox';
+    toggle.checked = data.remember !== false;
+    toggleRow.appendChild(toggle);
+    toggleRow.appendChild(document.createTextNode('Offer to remember senders'));
+    container.appendChild(toggleRow);
+
+    const list = document.createElement('div');
+    list.className = 'mail-sender-list';
+    container.appendChild(list);
+
+    const status = document.createElement('div');
+    status.className = 'text-sm mail-status text-muted mt-2';
+    container.appendChild(status);
+
+    /**
+     * @param   {string[]} senders
+     * @returns {void}
+     */
+    function paint(senders) {
+        list.textContent = '';
+        if (!senders.length) {
+            const empty = document.createElement('p');
+            empty.className = 'text-sm text-muted mail-none';
+            empty.textContent = 'No senders trusted yet.';
+            list.appendChild(empty);
+            return;
+        }
+
+        for (const address of senders) {
+            const row = document.createElement('div');
+            row.className = 'mail-box-row';
+
+            const name = document.createElement('span');
+            name.className = 'flex-1 text-sm mail-ellipsis';
+            name.textContent = address;
+            row.appendChild(name);
+
+            const remove = document.createElement('button');
+            remove.className = 'btn btn-sm btn-ghost';
+            remove.classList.add('text-danger');
+            remove.textContent = 'Stop trusting';
+            remove.addEventListener('click', async () => {
+                remove.disabled = true;
+                try {
+                    const query = new URLSearchParams({account: ctx.account.id, address});
+                    const result = await ctx.api(`${ctx.base}/image-senders?${query}`, 'DELETE');
+                    paint(result.senders);
+                    say(status, `Images from ${address} will be blocked again.`,
+                        'quiet', 'text-sm mail-status mt-2');
+                } catch (err) {
+                    say(status, err.message, 'bad', 'text-sm mail-status mt-2');
+                    remove.disabled = false;
+                }
+            });
+            row.appendChild(remove);
+            list.appendChild(row);
+        }
+    }
+
+    paint(data.senders ?? []);
+
+    toggle.addEventListener('change', async () => {
+        try {
+            const result = await ctx.api(`${ctx.base}/image-senders/remember?${params}`, 'PUT',
+                {remember: toggle.checked});
+            status.className = 'text-sm mail-status mt-2 text-muted';
+            status.textContent = result.remember
+                ? 'Senders can be remembered.'
+                : 'Remembering is off. The list is kept but ignored.';
+        } catch (err) {
+            say(status, err.message, 'bad', 'text-sm mail-status mt-2');
+            toggle.checked = !toggle.checked;
+        }
+    });
+}
+
+/** The section both editions show. */
+export const imageSendersSection = {id: 'images', label: 'Images', render};