domma-cms 1.10.37 → 1.10.38

package/plugins/_lib/mail/readRoutes.js

@@ -25,7 +25,6 @@
  *
  * @module _lib/mail/readRoutes
  */
-import {simpleParser} from 'mailparser';
 
 import {listUsers} from '../../../server/services/users.js';
 import {getConfig} from '../../../server/config.js';
@@ -41,6 +40,34 @@ import {listAttachments, MENU_BRIDGE_CSP, renderBody} from './render.js';
 import {readUnsubscribe} from './unsubscribe.js';
 import {MailKeyError} from './secretbox.js';
 import {unreadBadge} from './unreadBadge.js';
+import {parseReadable} from './messageSecurity.js';
+
+/**
+ * The security facts the reader shows - nothing else of the provider's
+ * answer (certificates, chains) goes to the browser.
+ *
+ * @param   {object|null} security
+ * @returns {object|null}
+ */
+export function publicSecurity(security) {
+    if (!security) return null;
+    const signer = security.signer ?? null;
+    return {
+        encrypted: security.encrypted === true,
+        decrypted: security.decrypted === true,
+        signed: security.signed === true,
+        verified: security.verified === true,
+        trusted: security.trusted === true,
+        fromMatches: security.fromMatches === true,
+        signer: signer ? {
+            emails: Array.isArray(signer.emails) ? signer.emails.map(String).slice(0, 10) : [],
+            subject: String(signer.subject ?? ''),
+            fingerprint: String(signer.fingerprint ?? ''),
+            notAfter: signer.notAfter ?? null
+        } : null,
+        problem: security.problem ? String(security.problem) : null
+    };
+}
 
 /**
  * Flatten an envelope address list into something the browser can render.
@@ -223,9 +250,9 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
                 if (failed && Date.now() < failed.until) { boxes.push({label: account.label, unseen: null}); continue; }
                 try {
                     const status = await pool.withClient(`${uid}:${account.id}`, accounts.toConnection(account),
-                        client => client.status('INBOX', {unseen: true}));
+                        client => client.status('INBOX', {unseen: true, uidNext: true}));
                     failures.delete(key);
-                    boxes.push({label: account.label, unseen: status?.unseen ?? 0});
+                    boxes.push({id: account.id, label: account.label, unseen: status?.unseen ?? 0, uidNext: status?.uidNext ?? null});
                 } catch {
                     const wait = Math.min((failed?.wait || 150_000) * 2, 3_600_000);
                     failures.set(key, {wait, until: Date.now() + wait});
@@ -550,7 +577,7 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
                 return null;
             }
 
-            const parsed = await simpleParser(fetched.source);
+            const {parsed, security} = await parseReadable(fetched.source, {account: ctx.account, userId: ctx.uid});
             const from = addresses(parsed.from?.value);
             const senderTrusted = accounts.sendersImagesTrusted(ctx.account, from);
             const allowRemoteImages = requestedNow || config.allowRemoteImages || senderTrusted;
@@ -606,6 +633,9 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
                 // an unsubscribe link is reading; acting on it is a write and
                 // lives in the Pro edition.
                 unsubscribe: readUnsubscribe(parsed.headers),
+                // Signed and/or encrypted (S/MIME), and what came of checking -
+                // null for an ordinary message, or where no edition can tell.
+                security: publicSecurity(security),
                 attachments: listAttachments(parsed.attachments)
             };
         }));
@@ -660,7 +690,7 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
                 if (!fetched || !fetched.source) return null;
                 if (fetched.source.length > config.maxMessageBytes) return null;
 
-                const parsed = await simpleParser(fetched.source);
+                const {parsed} = await parseReadable(fetched.source, {account, userId: grant.userId});
                 return renderBody(parsed, {
                     allowRemoteImages: grant.images,
                     inlineImageMaxBytes: config.inlineImageMaxBytes
@@ -790,7 +820,7 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
                 return null;
             }
 
-            const parsed = await simpleParser(fetched.source);
+            const {parsed} = await parseReadable(fetched.source, {account: ctx.account, userId: ctx.uid});
             const attachment = parsed.attachments?.[index];
             if (!attachment) {
                 reply.code(404).send({error: 'That attachment is not on this message.'});

package/plugins/_lib/mail/send.js

@@ -16,7 +16,9 @@ import {bareAddress, formatFrom} from '../admin/mail/identity.js';
 import {describeError} from './imapPool.js';
 import {pinMailHost} from './hostGuard.js';
 import {normalisePriority, priorityHeaders} from './priority.js';
-import {normaliseMessageSource, recordMessageAction, SOURCE_HEADER} from './message-action.js';
+import {composeFlagsHeader, COMPOSE_HEADER, normaliseMessageSource, recordMessageAction, SOURCE_HEADER} from './message-action.js';
+import {composeOptions} from './accounts.js';
+import {protectDraftRaw, protectRaw} from './messageSecurity.js';
 
 // MailComposer is not on nodemailer's public export, but it is the piece that
 // turns a message object into the bytes that go on the wire - which is what a
@@ -195,10 +197,12 @@ export async function sendMessage({
     smtp, draft, pool, poolKey, connection, sentFolder = null, allowInsecureTLS = false,
     replaces = null, draftsFolder = null, headers = {}, fileCopy = true, account = null, store = null
 }) {
+    const options = composeOptions(account);
+
     // The header carries the display name; the envelope never can. They are
     // built from the same stored address so they cannot name two different
     // mailboxes, but they are not the same string.
-    const raw = await buildRaw(draft, formatFrom(smtp.from, smtp.fromName), {
+    const built = await buildRaw(draft, formatFrom(smtp.from, smtp.fromName), {
         replyTo: smtp.replyTo,
         // Asked for per message, addressed to wherever replies would go -
         // which is the Reply-To when there is one and the From otherwise.
@@ -210,6 +214,13 @@ export async function sendMessage({
         headers
     });
 
+    // Signed and/or encrypted when the message asks - after it is built and
+    // before it is sent, so what is sent and what is filed are one buffer, as
+    // ever. Encrypted, the copy in Sent is encrypted too (to the sender as
+    // well as the recipients), which is the point: a copy readable by anyone
+    // with the mailbox password would undo it.
+    const raw = await protectRaw({raw: built, draft, account, userId: account?.userId ?? null});
+
     // The same setting that governs incoming TLS governs outgoing: a site
     // running its own mail server with a self-signed certificate has the same
     // problem in both directions, and two switches for one decision is how
@@ -221,6 +232,8 @@ export async function sendMessage({
     try {
         transport = nodemailer.createTransport({
             ...await pinnedTransport(smtp.transport, pool?.mailHostOptions),
+            // Secure delivery starts with this hop: STARTTLS or nothing.
+            ...(options.requireSecureDelivery ? {requireTLS: true} : {}),
             tls: {rejectUnauthorized: !allowInsecureTLS}
         });
         info = await transport.sendMail({
@@ -232,10 +245,11 @@ export async function sendMessage({
                 to: [...addresses(draft.to), ...addresses(draft.cc), ...addresses(draft.bcc)]
                     .map(a => a.address)
             },
+            ...deliveryOptions(draft, options),
             raw
         });
     } catch (err) {
-        throw plainSendError(err, smtp.transport);
+        throw plainSendError(err, {...smtp.transport, requireTLS: options.requireSecureDelivery});
     } finally {
         transport?.close();
     }
@@ -252,7 +266,11 @@ export async function sendMessage({
         // is a Sent folder nobody can find anything in - the responder keeps
         // its own log instead.
         if (!fileCopy) throw new SkipFiling();
-        const destination = sentFolder ?? await findSentFolder(pool, poolKey, connection);
+        const destination = await filingFolder({
+            pool, poolKey, connection, sentFolder,
+            source: options.repliesInSourceFolder && account ? draft.sourceMessage : null,
+            accountId: account?.id ?? null
+        });
         if (destination) {
             await pool.withClient(poolKey, connection,
                 client => client.append(destination, raw, ['\\Seen']));
@@ -280,6 +298,66 @@ export async function sendMessage({
     };
 }
 
+/**
+ * The SMTP extras a message asks for: a delivery status notification (DSN,
+ * RFC 3461) when it wants a delivery receipt, and REQUIRETLS (RFC 8689) when
+ * the mailbox requires secure delivery.
+ *
+ * A delivery receipt is the outgoing server's to give: one that does not offer
+ * DSN sends the message without asking, which is the most a client can do.
+ * REQUIRETLS is the opposite - asked for, it must be honoured, and a server
+ * that cannot is refused before the message leaves (EREQUIRETLS).
+ *
+ * @param   {object} draft
+ * @param   {{requireSecureDelivery?: boolean}} options
+ * @returns {object}
+ */
+export function deliveryOptions(draft, options = {}) {
+    return {
+        // Headers, not the whole message, come back with the report: the
+        // sender has the message already, and a full copy doubles the mail.
+        ...(draft?.deliveryReceipt === true
+            ? {dsn: {ret: 'HDRS', notify: ['SUCCESS', 'FAILURE', 'DELAY']}}
+            : {}),
+        ...(options.requireSecureDelivery === true ? {requireTLSExtensionEnabled: true} : {})
+    };
+}
+
+/**
+ * Where the copy of a sent message is filed.
+ *
+ * Sent, normally. A reply goes beside the message it answers when the mailbox
+ * says so - the folder it was replied from, so a conversation filed under a
+ * project keeps both halves there. Never into Trash, Junk or Drafts (a reply
+ * written from the bin is not meant to live in it), nor into a folder that
+ * has gone, nor for another mailbox's message: those fall back to Sent.
+ *
+ * @param   {{folders: Array<{path: string, specialUse?: string}>, sentFolder?: string|null,
+ *            source?: object|null, accountId?: string|null}} input
+ * @returns {string|null}
+ */
+export function chooseFilingFolder({folders = [], sentFolder = null, source = null, accountId = null}) {
+    const sent = sentFolder ?? folders.find(box => box.specialUse === '\\Sent')?.path ?? null;
+    const from = normaliseMessageSource(source);
+    if (!from || from.action !== 'reply' || !accountId || from.accountId !== accountId) return sent;
+    const box = folders.find(entry => entry.path === from.folder);
+    if (!box || ['\\Trash', '\\Junk', '\\Drafts'].includes(box.specialUse)) return sent;
+    return box.path;
+}
+
+/**
+ * The folder list, then `chooseFilingFolder`. Skips the listing when there is
+ * nothing to choose: Sent is already known and this is not a reply to file
+ * elsewhere.
+ *
+ * @returns {Promise<string|null>}
+ */
+async function filingFolder({pool, poolKey, connection, sentFolder, source, accountId}) {
+    if (sentFolder && !source) return sentFolder;
+    const folders = await pool.withClient(poolKey, connection, client => client.list());
+    return chooseFilingFolder({folders, sentFolder, source, accountId});
+}
+
 /**
  * Take a superseded draft out of the Drafts folder.
  *
@@ -295,7 +373,7 @@ export async function sendMessage({
  *            draftsFolder?: string|null}} options
  * @returns {Promise<boolean>}
  */
-async function discardDraft({pool, poolKey, connection, uid, draftsFolder = null}) {
+export async function discardDraft({pool, poolKey, connection, uid, draftsFolder = null}) {
     try {
         const destination = draftsFolder
             ?? await findSpecialFolder(pool, poolKey, connection, '\\Drafts');
@@ -327,16 +405,20 @@ async function discardDraft({pool, poolKey, connection, uid, draftsFolder = null
  * @returns {Promise<{savedTo: string, uid: number|null, replaced: number|null}>}
  */
 export async function saveDraft({
-    draft, from, replyTo = '', pool, poolKey, connection, draftsFolder = null, replaces = null
+    draft, from, replyTo = '', pool, poolKey, connection, draftsFolder = null, replaces = null, account = null
 }) {
     // Written into the draft, not applied when it is eventually sent: a draft
     // opened on the phone should show the same headers it will go out with.
     const source = normaliseMessageSource(draft.sourceMessage);
+    const flags = composeFlagsHeader(draft);
     const raw = await buildRaw(draft, from, {
         replyTo,
         readReceiptTo: draft.readReceipt ? (replyTo || bareAddress(from)) : '',
         // Private draft metadata: it is omitted from SMTP and the Sent copy.
-        headers: source ? {[SOURCE_HEADER]: Buffer.from(JSON.stringify(source)).toString('base64url')} : {}
+        headers: {
+            ...(source ? {[SOURCE_HEADER]: Buffer.from(JSON.stringify(source)).toString('base64url')} : {}),
+            ...(flags ? {[COMPOSE_HEADER]: flags} : {})
+        }
     });
 
     const destination = draftsFolder ?? await findSpecialFolder(pool, poolKey, connection, '\\Drafts');
@@ -344,8 +426,12 @@ export async function saveDraft({
         throw new Error('This server has no Drafts folder to save into.');
     }
 
+    // A message that is to be encrypted is not left readable in Drafts: it
+    // is encrypted to the sender alone, and opened again when reopened.
+    const stored = await protectDraftRaw({raw, draft, account, userId: account?.userId ?? null});
+
     const appended = await pool.withClient(poolKey, connection,
-        client => client.append(destination, raw, ['\\Draft', '\\Seen']));
+        client => client.append(destination, stored, ['\\Draft', '\\Seen']));
 
     // Only now is the previous version expendable.
     let replaced = null;
@@ -378,21 +464,6 @@ async function findSpecialFolder(pool, poolKey, connection, use) {
     return boxes.find(box => box.specialUse === use)?.path ?? null;
 }
 
-/**
- * Where this server keeps sent mail.
- *
- * By SPECIAL-USE, never by name: it is localised on plenty of servers, and
- * guessing wrong means the copy lands in a folder nobody looks at.
- *
- * @param   {object} pool
- * @param   {string} poolKey
- * @param   {object} connection
- * @returns {Promise<string|null>}
- */
-async function findSentFolder(pool, poolKey, connection) {
-    return findSpecialFolder(pool, poolKey, connection, '\\Sent');
-}
-
 /**
  * A send failure as plain words. Our own errors (a refused host, a mailbox that
  * needs signing in again) pass as they are; anything from the server or the
@@ -405,6 +476,17 @@ async function findSentFolder(pool, poolKey, connection) {
  */
 export function plainSendError(err, transportConfig = {}) {
     if (!err || err.needsReconnect || err.mailHostRefused || err.name === 'MailKeyError') return err;
+    // Asked for, and the outgoing server could not promise it - said in words,
+    // because "not sent" is the right answer and the reason is the useful part.
+    // A certificate problem is NOT this - it keeps describeError's own words.
+    if (err.code === 'EREQUIRETLS'
+        || (err.code === 'ETLS' && transportConfig.requireTLS && /upgrading connection with STARTTLS/i.test(err.message ?? ''))) {
+        const plain = new Error('Not sent: this mailbox requires secure delivery, and its outgoing server '
+            + 'cannot promise it (it does not offer REQUIRETLS over an encrypted connection). '
+            + 'Switch "Require secure delivery" off in Settings > Composing to send it normally.');
+        plain.code = 'EREQUIRETLS';
+        return plain;
+    }
     const plain = new Error(describeError(err, transportConfig));
     if (err.code) plain.code = err.code;
     if (err.responseCode) plain.responseCode = err.responseCode;

package/plugins/_lib/mail/store.js

@@ -826,6 +826,28 @@ export function createStore(connection) {
             .toArray();
     }
 
+    /**
+     * The highest UID among a mailbox's unread messages in these folders -
+     * the "new mail arrived" mark for the sidebar's notifications. A UID only
+     * grows as mail arrives, so reading the newest message lowers this and
+     * a new arrival raises it past anything seen before.
+     *
+     * @param   {string} accountId
+     * @param   {string[]|null} [folders]
+     * @returns {Promise<number|null>}
+     */
+    async function newestUnreadUid(accountId, folders = null) {
+        const database = await connect();
+        const filter = {accountId, seen: false};
+        if (Array.isArray(folders) && folders.length) filter.folder = {$in: folders};
+        const row = await database.collection(MESSAGES)
+            .find(filter, {projection: {_id: 0, uid: 1}})
+            .sort({uid: -1})
+            .limit(1)
+            .next();
+        return Number.isFinite(row?.uid) ? row.uid : null;
+    }
+
     /**
      * The newest mirrored messages to or from any of these addresses, across
      * the given mailboxes - a contact's emails, for the card in Contacts.
@@ -1081,7 +1103,7 @@ export function createStore(connection) {
         connect,
         getFolder, saveFolder,
         putMessages, setFlags, setMessageAction, removeMessages, clearFolder,
-        storedUids, listMessages, listThreads, searchMessages, countUnread, listUnread, listByAddresses, forgetAccount,
+        storedUids, listMessages, listThreads, searchMessages, countUnread, listUnread, newestUnreadUid, listByAddresses, forgetAccount,
         queueSend, listQueuedSends, claimDueSends, finishSend, cancelSend, getQueuedSend,
         queueSnooze, listSnoozed, claimDueSnoozes, finishSnooze, wakeSnooze,
         lastAutoReply, noteAutoReply, listAutoReplies, clearAutoReplies,

package/plugins/_lib/mail/unreadBadge.js

@@ -15,7 +15,7 @@
 const plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
 
 /**
- * @param   {{label?: string, unseen: number|null, error?: string}[]} boxes - one per mailbox
+ * @param   {{id?: string, label?: string, unseen: number|null, uidNext?: number|null, error?: string}[]} boxes - one per mailbox
  * @returns {{count: number, label: string, tone: string, details: object}}
  */
 export function unreadBadge(boxes = []) {
@@ -31,6 +31,7 @@ export function unreadBadge(boxes = []) {
         // shown even at 0 - otherwise a broken password reads as "all read".
         tone: failed ? 'danger' : 'info',
         ...(failed ? {showZero: true} : {}),
+        ...newMailNotice(known),
         details: {
             title: 'Mail',
             rows: boxes.map(b => ({
@@ -43,3 +44,25 @@ export function unreadBadge(boxes = []) {
         }
     };
 }
+
+/**
+ * The sidebar's "new mail" signal (admin/js/lib/sidebar-notify.js): one mark
+ * per mailbox with unread mail - the inbox's newest UID, which only rises when
+ * something arrives. STATUS has no sender or subject, so the notice says how
+ * many and where.
+ *
+ * @param   {object[]} boxes - the reachable ones
+ * @returns {{notify?: object}}
+ */
+function newMailNotice(boxes) {
+    const marks = {};
+    const where = [];
+    for (const box of boxes) {
+        const uidNext = Number(box.uidNext);
+        if (!box.id || !(box.unseen > 0) || !Number.isFinite(uidNext) || uidNext < 2) continue;
+        marks[box.id] = uidNext - 1;
+        where.push(`${plural(box.unseen, 'unread message')} in ${String(box.label || 'your inbox')}`);
+    }
+    if (!where.length) return {};
+    return {notify: {marks, title: 'New mail', body: where.join('; ')}};
+}

package/plugins/_lib/mail/vacationRunner.js

@@ -97,7 +97,10 @@ export async function runVacation({
                 // Not filed. One holiday produces a hundred of these, and a
                 // Sent folder that is mostly "Out of office" is one nobody can
                 // find anything in - the reply log is the audit trail instead.
-                fileCopy: false
+                fileCopy: false,
+                // So the mailbox's rules about leaving (secure delivery) apply
+                // to its away message too.
+                account
             });
 
             // Recorded AFTER it has gone. The other order would mean a send

package/server/routes/api/sidebar-counts.js

@@ -55,7 +55,7 @@ export async function sidebarCountRoutes(fastify, opts = {}) {
                     const count = Number(value);
                     if (value == null || !Number.isFinite(count) || count < 0) { answers.set(url, null); continue; }
                     if (typeof answer !== 'object') answers.set(url, count);
-                    else answers.set(url, Object.fromEntries(['count', 'label', 'tone', 'inventory', 'showZero', 'details']
+                    else answers.set(url, Object.fromEntries(['count', 'label', 'tone', 'inventory', 'showZero', 'details', 'notify']
                         .filter(key => answer[key] !== undefined).map(key => [key, answer[key]])));
                 } catch { answers.set(url, null); }
                 finally { clearTimeout(timer); }