domma-cms 1.6.36 → 1.6.38

package/plugins/support/tests/shape.test.js

@@ -18,7 +18,7 @@ test('a request needs a subject and a message; unknown choices fall back', () =>
     assert.equal(cleanRequest({body: 'x'}).error, 'Give it a short subject.');
     assert.equal(cleanRequest({subject: 'x'}).error, 'Tell us what you need.');
     const {request} = cleanRequest({subject: '  Site\n down ', body: ' help\r\nplease ', category: 'nope', priority: 'panic', where: '/shop'});
-    assert.deepEqual(request, {category: 'help', priority: 'normal', subject: 'Site down', body: 'help\nplease', where: '/shop'});
+    assert.deepEqual(request, {category: 'help', priority: 'normal', subject: 'Site down', body: 'help\nplease', where: '/shop', attachments: []});
     assert.equal(cleanRequest({subject: 's', body: 'b', priority: 'urgent'}).request.priority, 'urgent');
 });
 
@@ -187,3 +187,53 @@ test('review: a request removed while a send is in flight is not half-deleted, a
         assert.ok(!posted.includes('T3') && !posted.includes('M3'));
     } finally { fs.rmSync(dir, {recursive: true, force: true}); }
 });
+
+// ---- Attachments (1.1.4) ----
+
+import {ATTACHMENTS, attachmentsOf, cleanAttachment, cleanAttachments, cleanMessage} from '../lib/shape.js';
+
+const FID = '0f8fad5b-d9cb-469f-a165-70867728950e';
+const file = (n = 1, extra = {}) => ({id: `${FID.slice(0, -1)}${n}`, name: `shot${n}.png`, type: 'image/png', size: 10, ...extra});
+
+test('an attachment: a known type, a server-made id, a size within the cap', () => {
+    assert.deepEqual(cleanAttachment(file(1, {junk: 1})), {id: file(1).id, name: 'shot1.png', type: 'image/png', size: 10});
+    assert.equal(cleanAttachment(file(1, {type: 'image/svg+xml'})), null, 'SVG can carry script');
+    assert.equal(cleanAttachment(file(1, {type: 'text/html'})), null);
+    assert.equal(cleanAttachment(file(1, {id: '../../x'})), null);
+    assert.equal(cleanAttachment(file(1, {size: ATTACHMENTS.maxBytes + 1})), null);
+    assert.equal(cleanAttachment(file(1, {name: '/etc/"passwd'})).name, '_passwd');
+    assert.equal(cleanAttachments([file(1), file(2), file(3), file(4), file(1)]).length, 3, 'three at most, each once');
+});
+
+test('files ride on a message: announced not stored, carried by a follow-up, shown to the site', () => {
+    const {request} = cleanRequest({subject: 's', body: 'b', attachments: [file(1), {id: 'nope'}]});
+    assert.equal(request.attachments.length, 1);
+    const {data} = receivedTicket(buildTicketPayload({request, user: {name: 'Ann'}, ref: 'r1'}), 'acme', T0);
+    assert.equal(data.messages[0].attachments[0].stored, false);
+    assert.equal(cleanMessage({body: '', attachments: [file(2)]}).error, 'Write a message first.', 'files go with words');
+    const msg = buildMessagePayload({ticketRef: 'r1', ref: 'm1', body: 'and this', attachments: [file(2)]});
+    assert.equal(msg.attachments.length, 1);
+    assert.equal(buildMessagePayload({ticketRef: 'r1', ref: 'm2', close: true, attachments: [file(3)]}).attachments, undefined, 'a close carries none');
+    const next = addTurn(data, {from: 'customer', name: 'Ann', body: 'and this', id: 'm1', at: T1, attachments: msg.attachments}).data;
+    assert.deepEqual(attachmentsOf(next).map(a => [a.name, a.messageId, a.stored]), [['shot1.png', 'r1', false], ['shot2.png', 'm1', false]]);
+    const view = senderView({id: 'e1', data: next});
+    assert.deepEqual(view.messages[1].attachments, [{id: file(2).id, name: 'shot2.png', type: 'image/png', size: 10, stored: false}]);
+    assert.equal(view.messages[0].attachments[0].messageId, undefined);
+});
+
+test('a sent message stays in the outbox until its files have gone', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sp-files-'));
+    try {
+        const ob = createOutbox(dir);
+        ob.add('ticket', {ref: 'r1', subject: 's', body: 'b', attachments: [file(1)]});
+        ob.mark('r1', {state: 'sent'});
+        const remote = [{ref: 'r1', subject: 's', status: 'open', messages: [{id: 'r1', from: 'customer', body: 'b', at: T0}]}];
+        ob.remember(remote);
+        assert.equal(ob.all().length, 1, 'kept: its file has not gone');
+        assert.ok(ob.fileIds().has(file(1).id));
+        ob.fileSent('r1', file(1).id);
+        ob.remember(remote);
+        assert.equal(ob.all().length, 0, 'now done with');
+        assert.ok(ob.fileIds().has(file(1).id), 'the file itself is still wanted: the thread shows it');
+    } finally { fs.rmSync(dir, {recursive: true, force: true}); }
+});

package/server/routes/outreach-public.js

@@ -1,13 +1,22 @@
 /**
- * The one-click unsubscribe page every outreach email links to:
+ * The unsubscribe page every outreach email links to:
  *
- *   GET /campaign-unsubscribe?e=<base64url address>&k=<HMAC>
+ *   GET  /campaign-unsubscribe?e=<base64url address>&k=<HMAC>   a confirm page
+ *   POST /campaign-unsubscribe  (e, k as form fields or query)   the opt-out
  *
  * Core's, not the sending Tool's, so the link in an email already sent keeps
  * working when that Tool lapses or is removed (PECR). The address goes on the
  * shared suppression list (`outreach-unsubscribes`), which every outreach
  * Tool checks before it sends.
  *
+ * Only the POST changes anything. Mail security scanners (Safe Links,
+ * Mimecast, Proofpoint) and mailbox previews GET every link in a message, so a
+ * GET that opted out unsubscribed people who never clicked - and silenced
+ * Surveys and Onboard for them too, the list being shared. The GET shows one
+ * button; the POST is also what a mail client's own Unsubscribe button sends
+ * (RFC 8058 one-click: the List-Unsubscribe URL with the body
+ * `List-Unsubscribe=One-Click`), so both land on the same handler.
+ *
  * A Campaigns Pro older than this engine registers the same path itself, and
  * plugins register before core: then core stands aside rather than collide.
  *
@@ -19,6 +28,7 @@ import {UNSUBSCRIBE_PATH, verifyUnsubscribe} from '../../plugins/_lib/outreach/u
 import {getUnsubscribeSecret} from '../services/outreachUnsubscribe.js';
 
 const SLUG = 'outreach-unsubscribes';
+const FORM_TYPE = 'application/x-www-form-urlencoded';
 
 const esc = (s) => String(s ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
 
@@ -26,6 +36,15 @@ function page(title, bodyHtml) {
     return `<!DOCTYPE html><html lang="en-GB"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta name="robots" content="noindex"><title>${esc(title)}</title><link rel="stylesheet" href="/dist/domma/domma.css"><style>main{max-width:36rem;margin:4rem auto;padding:0 1.25rem;line-height:1.6}</style></head><body><main>${bodyHtml}</main></body></html>`;
 }
 
+const badLink = () => page('Unsubscribe', '<h1>That link is not right.</h1><p>Use the unsubscribe link from one of our emails.</p>');
+
+/** The confirm page: the same e and k, posted back by one button. */
+function confirmPage(email, e, k) {
+    return page('Unsubscribe', `<h1>Unsubscribe?</h1><p>${esc(email)} will get no more campaign or survey emails from this site.</p>`
+        + `<form method="post" action="${UNSUBSCRIBE_PATH}"><input type="hidden" name="e" value="${esc(e)}"><input type="hidden" name="k" value="${esc(k)}">`
+        + `<button type="submit" class="btn btn-primary">Unsubscribe</button></form>`);
+}
+
 /** The suppression list's collection - made if no outreach Tool ever made it. */
 async function ensureList() {
     try {
@@ -43,6 +62,14 @@ async function ensureList() {
     }
 }
 
+/** The e and k of a request: the posted form first, else the URL (a one-click POST keeps them there). */
+export function linkParams(req) {
+    const body = req.body && typeof req.body === 'object' ? req.body : {};
+    const query = req.query || {};
+    const pick = (v) => (typeof v === 'string' ? v : '');
+    return {e: pick(body.e) || pick(query.e), k: pick(body.k) || pick(query.k)};
+}
+
 /**
  * @param {import('fastify').FastifyInstance} fastify
  * @param {{col?: object, secret?: string}} [opts] - tests inject a collections service and a secret
@@ -52,17 +79,34 @@ export async function outreachPublicRoutes(fastify, opts = {}) {
     const col = opts.col || {createEntry, deleteEntry, listEntries};
     const suppression = createSuppression(col);
 
-    fastify.get(UNSUBSCRIBE_PATH, async (req, reply) => {
-        reply.header('Cache-Control', 'no-store').header('Referrer-Policy', 'no-referrer');
+    // The engine parses JSON only; the confirm form and one-click POSTs are
+    // form-encoded. Scoped to these routes, and tiny: two short fields.
+    if (!fastify.hasContentTypeParser(FORM_TYPE)) {
+        fastify.addContentTypeParser(FORM_TYPE, {parseAs: 'string', bodyLimit: 4096}, (req, body, done) => {
+            try { done(null, Object.fromEntries(new URLSearchParams(body))); } catch (err) { done(err); }
+        });
+    }
+
+    const verified = (req) => {
+        const {e, k} = linkParams(req);
         let email = null;
-        try { email = verifyUnsubscribe(opts.secret || getUnsubscribeSecret(), req.query?.e, req.query?.k); } catch { email = null; }
-        if (!email) {
-            return reply.code(400).type('text/html; charset=utf-8')
-                .send(page('Unsubscribe', '<h1>That link is not right.</h1><p>Use the unsubscribe link from one of our emails.</p>'));
-        }
+        try { email = verifyUnsubscribe(opts.secret || getUnsubscribeSecret(), e, k); } catch { email = null; }
+        return {email, e, k};
+    };
+    const html = (reply) => reply.header('Cache-Control', 'no-store').header('Referrer-Policy', 'no-referrer').type('text/html; charset=utf-8');
+
+    fastify.get(UNSUBSCRIBE_PATH, async (req, reply) => {
+        const {email, e, k} = verified(req);
+        if (!email) return html(reply).code(400).send(badLink());
+        return html(reply).send(confirmPage(email, e, k));
+    });
+
+    fastify.post(UNSUBSCRIBE_PATH, async (req, reply) => {
+        const {email} = verified(req);
+        if (!email) return html(reply).code(400).send(badLink());
         if (!opts.col) await ensureList();
         await suppression.add(email, 'unsubscribe-link');
-        return reply.type('text/html; charset=utf-8').send(page('Unsubscribed',
+        return html(reply).send(page('Unsubscribed',
             `<h1>You are unsubscribed.</h1><p>${esc(email)} will get no more campaign or survey emails from this site.</p>`));
     });
 }