domma-cms 1.8.15 → 1.8.17

package/plugins/security/server/facts.js

@@ -5,7 +5,12 @@
  *
  * Slow answers (the latest engine version, the certificate) are cached.
  */
+import dns from 'node:dns';
 import fs from 'node:fs';
+import http from 'node:http';
+import https from 'node:https';
+import net from 'node:net';
+import os from 'node:os';
 import path from 'node:path';
 import tls from 'node:tls';
 import {getConfig} from '../../../server/config.js';
@@ -21,6 +26,7 @@ async function cached(key, ms, fn) {
     const hit = cache.get(key);
     if (hit && hit.until > Date.now()) return hit.value;
     const value = await fn();
+    if (cache.size > 200) for (const [k, v] of cache) if (v.until <= Date.now()) cache.delete(k);
     cache.set(key, {value, until: Date.now() + ms});
     return value;
 }
@@ -41,11 +47,11 @@ async function engine() {
     return {installed, latest};
 }
 
-/** Days left on the certificate the site serves (cached 6 h). */
-function certificate(host) {
-    return cached(`cert:${host}`, 6 * 3_600_000, () => new Promise((resolve) => {
+/** Days left on the certificate the site serves (cached 6 h). Connects only to the checked address. */
+export function certificate({host, address, port = 443}) {
+    return cached(`cert:${host}:${address}`, 6 * 3_600_000, () => new Promise((resolve) => {
         const done = (v) => { try { socket.destroy(); } catch { /* gone */ } resolve(v); };
-        const socket = tls.connect({host, port: 443, servername: host, rejectUnauthorized: false, timeout: TIMEOUT}, () => {
+        const socket = tls.connect({host: address, port, servername: host, rejectUnauthorized: false, timeout: TIMEOUT}, () => {
             const c = socket.getPeerCertificate();
             if (!c?.valid_to) return done({daysLeft: null, error: 'no certificate'});
             done({daysLeft: Math.floor((Date.parse(c.valid_to) - Date.now()) / 86_400_000), issuer: c.issuer?.O || c.issuer?.CN || ''});
@@ -55,23 +61,34 @@ function certificate(host) {
     }));
 }
 
-/** The security headers the public home page is served with. */
-async function headers(origin) {
-    try {
-        const res = await fetch(`${origin}/`, {redirect: 'manual', signal: AbortSignal.timeout(TIMEOUT), headers: {'user-agent': 'Domma Security health check'}});
-        const h = (n) => res.headers.get(n) || '';
-        const csp = h('content-security-policy');
-        return {
-            https: origin.startsWith('https:'),
-            csp: Boolean(csp),
-            nosniff: /nosniff/i.test(h('x-content-type-options')),
-            frame: Boolean(h('x-frame-options')) || /frame-ancestors/i.test(csp),
-            referrer: Boolean(h('referrer-policy')),
-            hsts: Boolean(h('strict-transport-security'))
-        };
-    } catch (e) {
-        return {error: e.name === 'TimeoutError' ? 'timed out' : (e.cause?.code || e.message)};
-    }
+/** The security headers the public home page is served with. Connects only to the checked address. */
+export function headers({host, proto, address, port}) {
+    return new Promise((resolve) => {
+        let settled = false;
+        const finish = (v) => { if (!settled) { settled = true; resolve(v); } };
+        const secure = proto === 'https';
+        const req = (secure ? https : http).request({
+            host: address, port: port || (secure ? 443 : 80), path: '/', method: 'GET', agent: false,
+            ...(secure ? {servername: host} : {}),
+            headers: {host, 'user-agent': 'Domma Security health check'}
+        }, (res) => {
+            const h = (n) => String(res.headers[n] || '');
+            const csp = h('content-security-policy');
+            res.resume();
+            finish({
+                https: secure,
+                csp: Boolean(csp),
+                nosniff: /nosniff/i.test(h('x-content-type-options')),
+                frame: Boolean(h('x-frame-options')) || /frame-ancestors/i.test(csp),
+                referrer: Boolean(h('referrer-policy')),
+                hsts: Boolean(h('strict-transport-security'))
+            });
+        });
+        const timer = setTimeout(() => { finish({error: 'timed out'}); req.destroy(); }, TIMEOUT);
+        req.on('error', (e) => finish({error: e.code || e.message}));
+        req.on('close', () => clearTimeout(timer));
+        req.end();
+    });
 }
 
 /** Private paths asked of the CMS itself (locally, so Security's own probe filter does not hide them). */
@@ -91,18 +108,76 @@ async function probeFiles(port) {
 
 const isLocalHost = (h) => !h || h === 'localhost' || /^[\d.]+$/.test(h) || h.includes(':') || h.endsWith('.local') || h.endsWith('.test');
 
+/** Not a public address: loopback, private, link-local, CGNAT, unique-local, unspecified, multicast. */
+export function isPrivateAddress(ip) {
+    const a = String(ip || '').toLowerCase().replace(/^::ffff:(?=\d+\.)/, '');
+    if (net.isIPv4(a)) {
+        const [o1, o2] = a.split('.').map(Number);
+        return o1 === 0 || o1 === 10 || o1 === 127 || o1 >= 224 || (o1 === 169 && o2 === 254) || (o1 === 172 && o2 >= 16 && o2 <= 31)
+            || (o1 === 192 && o2 === 168) || (o1 === 100 && o2 >= 64 && o2 <= 127) || (o1 === 192 && o2 === 0) || (o1 === 198 && (o2 === 18 || o2 === 19));
+    }
+    // IPv6: loopback, unspecified, IPv4-compatible/mapped (anything under ::/16), NAT64 (64:ff9b::), 6to4 (2002::),
+    // unique-local, link-local, site-local, multicast - an embedded IPv4 is never trusted to be public.
+    if (net.isIPv6(a)) return a.startsWith('::') || /^64:ff9b:/.test(a) || /^2002:/.test(a) || /^(fc|fd|fe[89a-f]|ff)/.test(a);
+    return true;
+}
+
+/** This machine's own public addresses (its network interfaces, not loopback or private ones). */
+export function ownPublicAddresses() {
+    return new Set(Object.values(os.networkInterfaces()).flat().filter(i => i && !i.internal)
+        .map(i => String(i.address).toLowerCase().replace(/^::ffff:(?=\d+\.)/, '').split('%')[0]).filter(a => !isPrivateAddress(a)));
+}
+
+const urlHost = (raw) => {
+    try {
+        const u = new URL(String(raw || ''));
+        return /^https?:$/.test(u.protocol) ? {host: u.hostname.toLowerCase(), proto: u.protocol.slice(0, -1)} : null;
+    } catch { return null; }
+};
+
+/**
+ * Where the public checks (headers, HTTPS, certificate) may connect - never a host named by a
+ * visitor. The site's configured address (site.json `baseUrl`, else `url`) when it has a public
+ * name (a configured name that fails the checks gives null, never a fallback); otherwise the name the admin used, but ONLY when it resolves to one of this server's own
+ * public addresses (a hosted site has no configured address, and its name points here). Either
+ * way the connection is pinned to the checked address, so a second DNS answer cannot move it.
+ * Null = leave those checks unanswered (as on localhost).
+ *
+ * @returns {Promise<{host: string, proto: 'http'|'https', address: string, source: 'config'|'request'}|null>}
+ */
+export async function publicTarget(request, {site = getConfig('site') || {}, lookup = dns.promises.lookup, own = ownPublicAddresses()} = {}) {
+    const resolve = async (host) => {
+        try { return (await lookup(host, {all: true})).map(r => String(r.address).toLowerCase().replace(/^::ffff:(?=\d+\.)/, '')); }
+        catch { return []; }
+    };
+    const configured = urlHost(site.baseUrl) || urlHost(site.url);
+    if (configured && !isLocalHost(configured.host)) {
+        const addrs = await resolve(configured.host);
+        // Every answer must be public (or this server's own): an address the admin typed is still not a way inside.
+        if (!addrs.length || !addrs.every(a => own.has(a) || !isPrivateAddress(a))) return null;
+        return {...configured, address: addrs[0], source: 'config'};
+    }
+    // A local configured address (the shipped default is http://localhost:4096) says nothing about the public name.
+
+    const host = String(request.hostname || '').split(':')[0].toLowerCase();
+    if (isLocalHost(host) || !/^[a-z0-9.-]+$/.test(host)) return null;
+    const mine = (await resolve(host)).find(a => own.has(a));
+    if (!mine) return null;
+    const proto = request.protocol === 'https' || request.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http';
+    return {host, proto, address: mine, source: 'request'};
+}
+
 /**
  * Everything the health check needs.
  *
- * @param {import('fastify').FastifyRequest} request - the admin asking (its host is the site's)
+ * @param {import('fastify').FastifyRequest} request - the admin asking
  * @param {{settings: object, checks: boolean, twoFactor?: boolean}} ctx
+ * @param {{target?: object}} [deps] - tests: options for publicTarget()
  */
-export async function gatherFacts(request, {settings, checks, twoFactor = false}) {
+export async function gatherFacts(request, {settings, checks, twoFactor = false}, deps = {}) {
     const server = readJson(path.join(CMS_ROOT, 'config', 'server.json')) || {};
     const port = Number(process.env.PORT) || server.port || 4096;
-    const host = String(request.hostname || '').split(':')[0];
-    const proto = request.protocol === 'https' || request.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http';
-    const origin = isLocalHost(host) ? `http://127.0.0.1:${port}` : `${proto}://${host}`;
+    const target = await publicTarget(request, deps.target);
 
     const users = (await listUsers()).map(u => ({name: u.name, email: u.email, role: u.role, lastLogin: u.lastLogin || null,
         createdAt: u.createdAt || null, isActive: u.isActive !== false, level: getEffectiveLevel(u)}));
@@ -111,10 +186,11 @@ export async function gatherFacts(request, {settings, checks, twoFactor = false}
 
     const [eng, cert, head, probes] = await Promise.all([
         engine(),
-        isLocalHost(host) ? Promise.resolve(null) : certificate(host),
+        target ? certificate(target) : Promise.resolve(null),
         // Headers and HTTPS are about the PUBLIC site: without a public name to ask (a check run by the site
-        // itself, or on localhost) they are left unanswered rather than judged on the local port.
-        isLocalHost(host) ? Promise.resolve(null) : headers(origin),
+        // itself, on localhost, or a name that is not this server's) they are left unanswered rather than
+        // judged on the local port.
+        target ? headers(target) : Promise.resolve(null),
         probeFiles(port)
     ]);
     const smtp = getConfig('site')?.smtp || {};

package/plugins/security/tests/facts.test.js

@@ -0,0 +1,109 @@
+/** Security - the health check never connects to a host a visitor names (Host / X-Forwarded-Host). */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import net from 'node:net';
+import Fastify from 'fastify';
+import {certificate, gatherFacts, headers, isPrivateAddress, publicTarget} from '../server/facts.js';
+
+const OWN = '82.165.196.228';
+const DNS = {'evil.example': ['203.0.113.9'], 'inside.example': ['127.0.0.1'], 'lan.example': ['10.0.0.5'],
+    'site.example': [OWN], 'mixed.example': ['10.0.0.5', OWN], 'configured.example': ['198.51.100.7']};
+
+/** A fake resolver that records every name it was asked about. */
+function resolver() {
+    const asked = [];
+    const lookup = async (host) => {
+        asked.push(host);
+        if (!DNS[host]) throw Object.assign(new Error('ENOTFOUND'), {code: 'ENOTFOUND'});
+        return DNS[host].map(address => ({address, family: address.includes(':') ? 6 : 4}));
+    };
+    return {asked, lookup};
+}
+
+/** Run publicTarget() on a real Fastify request (trustProxy on, so X-Forwarded-Host is believed - the worst case). */
+async function targetFor(headers, deps) {
+    const app = Fastify({trustProxy: true});
+    app.get('/t', async (request) => ({target: await publicTarget(request, deps)}));
+    const res = await app.inject({method: 'GET', url: '/t', headers});
+    await app.close();
+    return res.json().target;
+}
+
+test('a forged Host or X-Forwarded-Host is never a target', async () => {
+    for (const headers of [
+        {host: 'evil.example'},
+        {host: 'site.example', 'x-forwarded-host': 'evil.example'},
+        {host: 'inside.example'},
+        {host: 'site.example', 'x-forwarded-host': 'lan.example'},
+        {host: 'site.example', 'x-forwarded-host': 'nowhere.example'},
+        {host: '169.254.169.254'},
+        {host: 'site.example', 'x-forwarded-host': '10.0.0.5:8080'}
+    ]) {
+        const {lookup} = resolver();
+        assert.equal(await targetFor(headers, {site: {}, lookup, own: new Set([OWN])}), null, JSON.stringify(headers));
+    }
+});
+
+test('the name the admin used is checked only when it resolves to this server, and pinned there', async () => {
+    const {lookup} = resolver();
+    const t = await targetFor({host: 'site.example', 'x-forwarded-proto': 'https'}, {site: {url: 'http://localhost:4096'}, lookup, own: new Set([OWN])});
+    assert.deepEqual(t, {host: 'site.example', proto: 'https', address: OWN, source: 'request'});
+    // Several answers: the connection goes to this server's own one, never the other.
+    const m = await targetFor({host: 'mixed.example'}, {site: {}, lookup, own: new Set([OWN])});
+    assert.equal(m.address, OWN);
+});
+
+test('a configured public address wins, and the request headers are not even looked up', async () => {
+    const {asked, lookup} = resolver();
+    const t = await targetFor({host: 'evil.example', 'x-forwarded-host': 'evil.example'},
+        {site: {baseUrl: 'https://configured.example'}, lookup, own: new Set([OWN])});
+    assert.deepEqual(t, {host: 'configured.example', proto: 'https', address: '198.51.100.7', source: 'config'});
+    assert.deepEqual(asked, ['configured.example']);
+});
+
+test('a configured address that resolves inside is refused, with no fallback to the request', async () => {
+    const {asked, lookup} = resolver();
+    assert.equal(await targetFor({host: 'site.example'}, {site: {url: 'https://lan.example'}, lookup, own: new Set([OWN])}), null);
+    assert.deepEqual(asked, ['lan.example']);
+});
+
+test('gatherFacts with forged headers leaves the public checks unanswered and connects nowhere', async () => {
+    const {asked, lookup} = resolver();
+    const request = {hostname: 'evil.example', protocol: 'https',
+        headers: {host: 'evil.example', 'x-forwarded-host': 'evil.example', 'x-forwarded-proto': 'https'}};
+    const settings = {lockout: {enabled: true}, policy: {enabled: true, minLength: 10}};
+    const started = Date.now();
+    const facts = await gatherFacts(request, {settings, checks: true}, {target: {site: {}, lookup, own: new Set([OWN])}});
+    assert.equal(facts.headers, null);
+    assert.equal(facts.cert, null);
+    assert.deepEqual(asked, ['evil.example']);
+    assert.ok(Date.now() - started < 20_000);
+});
+
+test('isPrivateAddress', () => {
+    for (const a of ['127.0.0.1', '10.1.2.3', '172.16.0.1', '192.168.1.1', '169.254.169.254', '100.64.0.1', '0.0.0.0', '192.0.0.8', '198.18.0.1',
+        '::', '::1', '::7f00:1', '::ffff:127.0.0.1', '64:ff9b::a00:1', '2002:7f00:1::1', 'fd00::1', 'fe80::1', 'fec0::1', 'ff02::1', 'nonsense'])
+        assert.equal(isPrivateAddress(a), true, a);
+    for (const a of [OWN, '8.8.8.8', '2a00:1450:4009::1'])
+        assert.equal(isPrivateAddress(a), false, a);
+});
+
+test('the checks connect to the pinned address, sending the name only as Host / SNI', async () => {
+    const seen = [];
+    const web = http.createServer((req, res) => { seen.push(req.headers.host); res.setHeader('x-content-type-options', 'nosniff'); res.end('ok'); });
+    await new Promise(r => web.listen(0, '127.0.0.1', r));
+    const h = await headers({host: 'site.example', proto: 'http', address: '127.0.0.1', port: web.address().port});
+    web.close();
+    assert.deepEqual(seen, ['site.example']);
+    assert.equal(h.nosniff, true);
+    assert.equal(h.https, false);
+
+    let connected = 0;
+    const raw = net.createServer((sock) => { connected++; sock.destroy(); });
+    await new Promise(r => raw.listen(0, '127.0.0.1', r));
+    const c = await certificate({host: 'pinned.example', address: '127.0.0.1', port: raw.address().port});
+    raw.close();
+    assert.equal(connected, 1);
+    assert.equal(c.daysLeft, null);
+});

package/server/routes/api/blocks.js

@@ -1,7 +1,8 @@
 /**
  * Blocks API
  * CRUD for reusable HTML block templates stored in content/blocks/*.html.
- * GET    /api/blocks              - list all blocks (each with hasCss, description, example;
+ * GET    /api/blocks              - list all blocks (each with hasCss, description, example,
+ *                                    fields (its parameters) and shortTag;
  *                                    ?usage=1 adds where each is used: pages and views)
  * GET    /api/blocks/_count       - the sidebar badge (`_` is outside the block-name alphabet)
  * GET    /api/blocks/:name        - get block content
@@ -16,6 +17,7 @@ import {authenticate, requirePermission} from '../../middleware/auth.js';
 import {deleteBlock, getBlock, listBlocks, saveBlock} from '../../services/blocks.js';
 import {config, getConfig} from '../../config.js';
 import {fmtDate} from '../../services/dates.js';
+import {BUILTIN_SHORTCODES} from '../../services/markdown.js';
 
 /**
  * A block's own doc comment - the one every block opens with - read for the
@@ -59,6 +61,58 @@ export function blockDoc(html, name = '') {
     return {description: description.slice(0, 200), example: example.slice(0, 300)};
 }
 
+/**
+ * The parameters a block takes, for the page editor's short-tag menu: every
+ * `{{field}}` / `{{field:FORMAT}}` / `{{{field}}}` the template uses (outside
+ * HTML comments, which the renderer strips), in order, with what the doc
+ * comment's "Parameters" list says about each - `name - hint (default: x)`,
+ * where a hint written `a | b | c` is a choice. Fields starting `_` are
+ * collection meta (`_createdAt`), never set from a tag, so they are left out.
+ * Plain text; a field the doc does not mention gets no hint.
+ *
+ * @param {string} html
+ * @returns {{name: string, raw: boolean, hint: string, default: string, options: string[]}[]}
+ */
+export function blockFields(html) {
+    const src = String(html || '');
+    const docs = new Map();
+    const m = /^\s*<!--([\s\S]*?)-->/.exec(src);
+    if (m) {
+        const lines = m[1].split('\n').map(l => l.trim());
+        const at = lines.findIndex(l => /^parameters\b.*:$/i.test(l));
+        for (let i = at + 1; at >= 0 && i < lines.length && lines[i]; i++) {
+            const p = /^([\w]+)\s+[-–]\s+(.*)$/.exec(lines[i]);
+            if (!p) continue;
+            let hint = p[2].trim();
+            let def = '';
+            const d = /\s*\(default:\s*([^)]*)\)\s*$/i.exec(hint);
+            if (d) {
+                hint = hint.slice(0, d.index).trim();
+                def = d[1].trim().replace(/^"(.*)"$/, '$1');
+                if (/^empty$/i.test(def)) def = '';
+            }
+            const options = /^[\w-]+(?:\s*\|\s*[\w-]+)+$/.test(hint) ? hint.split('|').map(s => s.trim()) : [];
+            docs.set(p[1], {hint: hint.slice(0, 160), default: def.slice(0, 120), options});
+        }
+    }
+    const body = src.replace(/<!--[\s\S]*?-->/g, '');
+    const out = new Map();
+    for (const [, rawKey, key] of body.matchAll(/\{\{\{(\w+)\}\}\}|\{\{([\w_]+)(?::[^{}]+)?\}\}/g)) {
+        const name = rawKey ?? key;
+        if (name.startsWith('_')) continue;
+        const had = out.get(name);
+        if (had) { had.raw = had.raw || rawKey !== undefined; continue; }
+        out.set(name, {name, raw: rawKey !== undefined, hint: '', default: '', options: [], ...docs.get(name)});
+    }
+    // The doc's order where it has one (it is written in order of importance), then the rest as used.
+    const rank = [...docs.keys()];
+    const at = (n) => (rank.includes(n) ? rank.indexOf(n) : rank.length);
+    return [...out.values()].sort((a, b) => at(a.name) - at(b.name)).slice(0, 60);
+}
+
+/** A block name the page can use as its own tag (`[name … /]`) - not one a built-in shortcode owns. */
+export const isShortTag = (name) => /^[a-z0-9][a-z0-9-]*$/.test(name) && !BUILTIN_SHORTCODES.has(name);
+
 /** Escape a block name for a RegExp. Names are [a-z0-9-] so only `-` needs care. */
 const reName = (n) => n.replace(/-/g, '\\-');
 
@@ -173,7 +227,8 @@ export async function blocksRoutes(fastify) {
             let full = null;
             try { full = await getBlock(b.name); } catch { /* skip */ }
             if (!canSeeArtefact(user, full)) continue;
-            out.push({...b, hasCss: Boolean(full?.css), cssSize: full?.css?.length || 0, ...blockDoc(full?.content, b.name)});
+            out.push({...b, hasCss: Boolean(full?.css), cssSize: full?.css?.length || 0, ...blockDoc(full?.content, b.name),
+                fields: blockFields(full?.content), shortTag: isShortTag(b.name)});
         }
         return out;
     }

package/server/routes/api/forms.js

@@ -27,7 +27,7 @@ import {deleteForm, ensureCollectionForForm, ensureFormsDir, listForms, readForm
 import {executeAction} from '../../services/actions.js';
 // The same rules the browser draws the buttons by (a Cancel link must be safe).
 import {buttonSettingsProblems, formClassProblems, publicButtonSettings} from '../../../public/js/form-submit.mjs';
-import {createTransport, sendFormEmail} from '../../services/email.js';
+import {createTransport, mailFailure, sendFormEmail, TEST_EMAIL_FAILED} from '../../services/email.js';
 import {formActionFailed, formTriggerNotice} from '../../services/notification-sources.js';
 import {
     clearEntries,
@@ -1063,7 +1063,9 @@ export async function formsRoutes(fastify) {
             });
             return { ok: true, message: `Test email sent to ${to}` };
         } catch (err) {
-            return reply.status(500).send({ error: `Failed to send test email: ${err.message}` });
+            // Plain words only - the server's own are in the log (email.js mailFailure).
+            const plain = mailFailure(err);
+            return reply.status(500).send({ error: plain.refused ? `${TEST_EMAIL_FAILED} ${plain.message}` : TEST_EMAIL_FAILED });
         }
     });
 }

package/server/routes/api/settings.js

@@ -11,7 +11,9 @@ import {faviconSource, generateFavicon} from '../../services/favicon.js';
 import {saveMedia} from '../../services/content.js';
 import {randomUUID} from 'node:crypto';
 import {authenticate, requirePermission} from '../../middleware/auth.js';
-import {createTransport} from '../../services/email.js';
+import {createTransport, mailFailure, TEST_EMAIL_FAILED} from '../../services/email.js';
+import {signedOnly} from '../../services/codePolicy.js';
+import {resolveMailHost} from '../../services/mailHost.js';
 import fs from 'fs/promises';
 import path from 'path';
 import {fileURLToPath} from 'url';
@@ -171,6 +173,17 @@ export async function settingsRoutes(fastify) {
         if (merged.smtp && merged.smtp.pass === '' && existing.smtp?.pass) {
             merged.smtp = {...merged.smtp, pass: existing.smtp.pass};
         }
+        // Hosted sites: refuse a mail server this site would not connect to, at
+        // save, so it is not found out at the first password reset.
+        if (signedOnly() && merged.smtp?.host
+            && (merged.smtp.host !== existing.smtp?.host || merged.smtp.port !== existing.smtp?.port)) {
+            try {
+                await resolveMailHost(merged.smtp.host, Number(merged.smtp.port) || 587, {kind: 'smtp', signed: true});
+            } catch (err) {
+                if (err.mailHostRefused) return reply.code(400).send({error: err.message});
+                // A name that does not resolve yet is the send's problem, not the save's.
+            }
+        }
         saveConfig('site', merged);
         await cache.invalidateTags(['site']);
         return { success: true };
@@ -182,16 +195,16 @@ export async function settingsRoutes(fastify) {
             return reply.status(400).send({ error: 'SMTP is not configured. Save your SMTP settings first.' });
         }
 
-        // Shared transport factory - carries the self-signed-cert TLS relaxation.
-        // Do NOT build a raw nodemailer transport here; that regresses on engine sync.
-        const transporter = await createTransport(smtp);
-
         const to = request.body?.to || smtp.fromAddress;
         if (!to) {
             return reply.status(400).send({ error: 'No recipient address. Provide "to" in the request body or set a From Address.' });
         }
 
         try {
+            // Shared transport factory - carries the self-signed-cert TLS relaxation
+            // and, on hosted sites, the mail-host rules (services/mailHost.js).
+            // Do NOT build a raw nodemailer transport here; that regresses on engine sync.
+            const transporter = await createTransport(smtp);
             await transporter.sendMail({
                 from:    smtp.fromName ? `"${smtp.fromName}" <${smtp.fromAddress}>` : smtp.fromAddress,
                 to,
@@ -201,7 +214,10 @@ export async function settingsRoutes(fastify) {
             });
             return { success: true, message: `Test email sent to ${to}` };
         } catch (err) {
-            return reply.status(500).send({ error: `Failed to send email: ${err.message}` });
+            // Never the mail server's words: they say what listens on a host and
+            // port. The detail is in the server log (mailFailure).
+            const plain = mailFailure(err);
+            return reply.status(500).send({ error: plain.refused ? `${TEST_EMAIL_FAILED} ${plain.message}` : TEST_EMAIL_FAILED });
         }
     });
 

package/server/services/email.js

@@ -3,6 +3,82 @@
  * Nodemailer transport factory and generic form email sending utility.
  */
 import nodemailer from 'nodemailer';
+import {signedOnly} from './codePolicy.js';
+import {resolveMailHost} from './mailHost.js';
+
+/**
+ * What a person is told when mail could not be sent. The mail server's own
+ * words (and the library's) go to the server log only: they say what is
+ * listening on a host and port, which is how a mail setting becomes a scanner
+ * of the server's network.
+ */
+export const MAIL_SEND_FAILED = 'Could not send the email. Check the mail server settings.';
+export const TEST_EMAIL_FAILED = 'Could not send the test email. Check the mail server settings.';
+
+/** The error every send fails with: plain words, nothing from the server. */
+export class MailSendError extends Error {
+    constructor(message = MAIL_SEND_FAILED, {refused = false} = {}) {
+        super(message);
+        this.code = 'EMAILSEND';
+        this.mailSendFailed = true;
+        // The host or port was refused by services/mailHost.js - the message is ours, not the server's.
+        this.refused = refused;
+    }
+}
+
+/**
+ * Log a send failure in full, and hand back the plain error to throw.
+ *
+ * @param {unknown} err
+ * @returns {MailSendError}
+ */
+export function mailFailure(err) {
+    if (err instanceof MailSendError) return err;
+    const detail = err?.message || String(err);
+    console.warn(`[email] send failed${err?.code ? ` (${err.code})` : ''}: ${detail}`);
+    return err?.mailHostRefused ? new MailSendError(err.message, {refused: true}) : new MailSendError();
+}
+
+/** Wrap sendMail/verify (promise or callback style) so only plain errors leave. */
+function guardTransportErrors(transport) {
+    for (const method of ['sendMail', 'verify']) {
+        const real = transport[method]?.bind(transport);
+        if (!real) continue;
+        transport[method] = (...args) => {
+            const cb = typeof args.at(-1) === 'function' ? args.pop() : null;
+            const p = Promise.resolve().then(() => real(...args)).catch(err => { throw mailFailure(err); });
+            if (!cb) return p;
+            p.then(info => cb(null, info), err => cb(err));
+            return undefined;
+        };
+    }
+    return transport;
+}
+
+/**
+ * A transport for a signed-only site: each send checks the host again and
+ * connects to the address it checked (the name kept for TLS), so neither a
+ * changed setting nor a second DNS answer can point it inward. nodemailer's SMTP
+ * transport opens a connection per message anyway, so a transport per send
+ * costs nothing extra.
+ */
+function pinnedTransport(base, {lookup} = {}) {
+    const open = async () => {
+        const {address, servername} = await resolveMailHost(base.host, base.port, {kind: 'smtp', signed: true, lookup});
+        return nodemailer.createTransport({...base, host: address, ...(servername && {servername})});
+    };
+    const run = async (method, args) => {
+        const t = await open();
+        try { return await t[method](...args); } finally { t.close(); }
+    };
+    return guardTransportErrors({
+        options: {...base},
+        sendMail: (message) => run('sendMail', [message]),
+        verify: () => run('verify', []),
+        close: () => {},
+        isIdle: () => true
+    });
+}
 
 let lastSendResult = null;
 
@@ -70,15 +146,27 @@ export function isSmtpConfigured(smtp) {
  * @returns {Promise<import('nodemailer').Transporter>}
  * @throws {Error} If Ethereal test account creation fails.
  */
-export async function createTransport(smtp) {
+export async function createTransport(smtp, {signed, lookup} = {}) {
     if (isSmtpConfigured(smtp)) {
-        return nodemailer.createTransport({
+        const base = {
             host: smtp.host,
-            port: smtp.port || 587,
+            port: Number(smtp.port) || 587,
             secure: smtp.secure || false,
             auth: smtp.user ? { user: smtp.user, pass: smtp.pass } : undefined,
             tls: { rejectUnauthorized: false }
-        });
+        };
+        // Hosted (signed-only) sites: loopback or a public mail server on a mail
+        // port, connected by the checked address - services/mailHost.js.
+        // Self-hosted sites may use any relay, internal ones included, as before.
+        if (signed ?? signedOnly()) {
+            try {
+                await resolveMailHost(base.host, base.port, {kind: 'smtp', signed: true, lookup});
+            } catch (err) {
+                throw mailFailure(err);
+            }
+            return pinnedTransport(base, {lookup});
+        }
+        return guardTransportErrors(nodemailer.createTransport(base));
     }
 
     // No SMTP configured - use Ethereal for dev/demo.
@@ -152,8 +240,9 @@ export async function sendEmail(transport, {from, fromName, to, subject, html, t
         }
         return info;
     } catch (err) {
-        recordSendResult(false, err.message);
-        throw err;
+        const plain = mailFailure(err);
+        recordSendResult(false, plain.message);
+        throw plain;
     }
 }
 
@@ -213,7 +302,8 @@ export async function sendFormEmail(transport, { from, fromName, to, subject, fo
         }
         return info;
     } catch (err) {
-        recordSendResult(false, err.message);
-        throw err;
+        const plain = mailFailure(err);
+        recordSendResult(false, plain.message);
+        throw plain;
     }
 }