imapkit 0.0.0-stage → 4.0.1

package/lib/plugins/xoauth2.js

@@ -0,0 +1,188 @@
+'use strict';
+
+// https://developers.google.com/gmail/xoauth2_protocol
+
+/**
+ * @help Enables XOAUTH2 capability
+ * @help Implementation difference - ImapKit requires
+ * @help SASL-IR enabled and used while Gmail does not
+ * @help Valid login info:
+ * @help   Username: testuser
+ * @help   Access Token: testtoken
+ */
+
+const utf8 = new TextDecoder('utf-8', { fatal: true });
+
+module.exports = function (server) {
+    // Register capability, usable for non authenticated users
+    server.registerCapability('AUTH=XOAUTH2', connection => {
+        return connection.state === 'Not Authenticated';
+    });
+
+    server.setCommandHandler('AUTHENTICATE XOAUTH2', (connection, parsed, data, callback) => {
+        if (!server.capabilities['SASL-IR'] || !server.capabilities['SASL-IR'](connection)) {
+            connection.send(
+                {
+                    tag: parsed.tag,
+                    command: 'BAD',
+                    attributes: [
+                        {
+                            type: 'TEXT',
+                            value: 'SASL-IR must be enabled to support XOAUTH2'
+                        }
+                    ]
+                },
+                'AUTHENTICATE XOAUTH2 FAILED',
+                parsed,
+                data
+            );
+            return callback();
+        }
+
+        if (!parsed.attributes || parsed.attributes.length !== 1 || !parsed.attributes[0] || ['STRING', 'ATOM'].indexOf(parsed.attributes[0].type) < 0) {
+            connection.send(
+                {
+                    tag: parsed.tag,
+                    command: 'NO',
+                    attributes: [
+                        {
+                            type: 'TEXT',
+                            value: 'Invalid SASL argument'
+                        }
+                    ]
+                },
+                'AUTHENTICATE XOAUTH2 FAILED',
+                parsed,
+                data
+            );
+            return callback();
+        }
+
+        const decoded = connection.decodeSaslResponse(parsed.attributes[0].value);
+        if (!decoded) {
+            connection.sendStatus(parsed, data, 'BAD', 'Invalid base64 in SASL response', false, 'AUTHENTICATE XOAUTH2 FAILED');
+            return callback();
+        }
+        let parts = [];
+        try {
+            // user names are unicode strings, like the keys of `users`
+            parts = utf8.decode(decoded).split('\x01');
+        } catch {
+            // invalid UTF-8 is a malformed payload like any other
+        }
+        const user = (parts[0] || '').substr(5);
+        const accessToken = (parts[1] || '').substr(12);
+
+        if (
+            parts.length !== 4 ||
+            !parts[0].match(/^user=/) ||
+            !parts[1].match(/^auth=Bearer /) ||
+            !user || // Must be present
+            !accessToken || // Must be present
+            parts[2] || // Must be empty
+            parts[3] // Must be empty
+        ) {
+            connection.send(
+                {
+                    tag: parsed.tag,
+                    command: 'NO',
+                    attributes: [
+                        {
+                            type: 'TEXT',
+                            value: 'Invalid SASL argument.'
+                        }
+                    ]
+                },
+                'AUTHENTICATE XOAUTH2 FAILED',
+                parsed,
+                data
+            );
+            return callback();
+        }
+
+        const userData = connection.server.getUser(user);
+        if (!userData) {
+            connection.send(
+                {
+                    tag: parsed.tag,
+                    command: 'NO',
+                    attributes: [
+                        // RFC 5530 section 3: unknown user or bad token
+                        { type: 'SECTION', section: [{ type: 'ATOM', value: 'AUTHENTICATIONFAILED' }] },
+                        {
+                            type: 'TEXT',
+                            value: 'Invalid credentials'
+                        }
+                    ]
+                },
+                'AUTHENTICATE XOAUTH2 FAILED',
+                parsed,
+                data
+            );
+            return callback();
+        }
+
+        if (!userData.xoauth2 || userData.xoauth2.accessToken !== accessToken) {
+            connection.send(
+                {
+                    tag: '+',
+                    attributes: [
+                        {
+                            type: 'ATOM',
+                            value: Buffer.from(
+                                JSON.stringify({
+                                    status: '400',
+                                    schemes: 'Bearer',
+                                    scope: 'https://mail.google.com/'
+                                })
+                            ).toString('base64')
+                        }
+                    ]
+                },
+                'AUTHENTICATE XOAUTH2 FAILED',
+                parsed,
+                data
+            );
+
+            // wait for response
+            connection.inputHandler = function () {
+                connection.inputHandler = false;
+                connection.send(
+                    {
+                        tag: parsed.tag,
+                        command: 'NO',
+                        attributes: [
+                            { type: 'SECTION', section: [{ type: 'ATOM', value: 'AUTHENTICATIONFAILED' }] },
+                            {
+                                type: 'TEXT',
+                                value: 'SASL authentication failed'
+                            }
+                        ]
+                    },
+                    'AUTHENTICATE XOAUTH2 FAILED',
+                    parsed,
+                    data
+                );
+            };
+        } else {
+            connection.state = 'Authenticated';
+            connection.username = user;
+            connection.send(
+                {
+                    tag: parsed.tag,
+                    command: 'OK',
+                    attributes: [
+                        {
+                            type: 'TEXT',
+                            value: 'User logged in'
+                        }
+                    ]
+                },
+                'AUTHENTICATE XOAUTH2 SUCCESS',
+                parsed,
+                data
+            );
+        }
+        return callback();
+    });
+};

package/lib/plugins/xtoybird.js

@@ -0,0 +1,282 @@
+'use strict';
+
+const { states } = require('../command-states');
+
+/**
+ * @help Custom plugin to allow programmatic control of the server
+ * @help Available commands:
+ * @help  XTOYBIRD SERVER dumps server internals
+ * @help  XTOYBIRD CONNECTION dumps connection internals
+ * @help  XTOYBIRD STORAGE dumps storage as JSON
+ * @help  XTOYBIRD USERADD "username" "password" adds or updates user
+ * @help  XTOYBIRD USERDEL "username" removes a user
+ * @help  XTOYBIRD SHUTDOWN Closes the server after the last client
+ * @help                  disconnects. New connections are rejected.
+ * @help Commands are only allowed after login, and only for the owner
+ * @help (aclOwner option) when ACL is loaded. A test control plugin,
+ * @help any user it allows can read and change everything
+ */
+
+const util = require('util');
+const { isAstring } = require('../arguments');
+
+module.exports = function (server) {
+    let username;
+    let password;
+    let message;
+
+    const sendError = (connection, parsed, data, callback, command, message) => {
+        connection.sendStatus(parsed, data, command, message, false, 'INVALID COMMAND');
+        return callback();
+    };
+
+    server.setCommandHandler(
+        'XTOYBIRD',
+        (connection, parsed, data, callback) => {
+            // XTOYBIRD bypasses every access check (STORAGE dumps all mailboxes), so with ACL only the owner may use it
+            if (server.acl && !server.acl.isOwner(connection)) {
+                connection.sendStatus(parsed, data, 'NO', 'XTOYBIRD is only allowed for the owner', 'NOPERM', 'INVALID COMMAND');
+                return callback();
+            }
+
+            if (parsed.attributes) {
+                const subcommand = ((parsed.attributes[0] && parsed.attributes[0].value) || '').toString().toUpperCase();
+                if (subcommand === 'USERADD' && (parsed.attributes.length !== 3 || !isAstring(parsed.attributes[1]) || !isAstring(parsed.attributes[2]))) {
+                    return sendError(connection, parsed, data, callback, 'BAD', 'USERADD expects username and password');
+                }
+                if (subcommand === 'USERDEL' && (parsed.attributes.length !== 2 || !isAstring(parsed.attributes[1]))) {
+                    return sendError(connection, parsed, data, callback, 'BAD', 'USERDEL expects username');
+                }
+
+                switch (subcommand) {
+                    case 'SERVER':
+                        connection.send(
+                            {
+                                tag: '*',
+                                command: 'XTOYBIRD',
+                                attributes: [
+                                    {
+                                        type: 'SECTION',
+                                        section: [
+                                            {
+                                                type: 'ATOM',
+                                                value: 'XDUMPVAL'
+                                            }
+                                        ]
+                                    },
+                                    {
+                                        type: 'LITERAL',
+                                        value: util.inspect(server, false, 22)
+                                    }
+                                ]
+                            },
+                            'CONNECTION STATUS',
+                            parsed,
+                            data
+                        );
+                        break;
+
+                    case 'CONNECTION':
+                        connection.send(
+                            {
+                                tag: '*',
+                                command: 'XTOYBIRD',
+                                attributes: [
+                                    {
+                                        type: 'SECTION',
+                                        section: [
+                                            {
+                                                type: 'ATOM',
+                                                value: 'XDUMPVAL'
+                                            }
+                                        ]
+                                    },
+                                    {
+                                        type: 'LITERAL',
+                                        value: util.inspect(connection, false, 22)
+                                    }
+                                ]
+                            },
+                            'CONNECTION STATUS',
+                            parsed,
+                            data
+                        );
+                        break;
+
+                    case 'STORAGE':
+                        connection.send(
+                            {
+                                tag: '*',
+                                command: 'XTOYBIRD',
+                                attributes: [
+                                    {
+                                        type: 'SECTION',
+                                        section: [
+                                            {
+                                                type: 'ATOM',
+                                                value: 'XJSONDUMP'
+                                            }
+                                        ]
+                                    },
+                                    {
+                                        type: 'LITERAL',
+                                        value: JSON.stringify(connection.server.storage, false, 4)
+                                    }
+                                ]
+                            },
+                            'CONNECTION STATUS',
+                            parsed,
+                            data
+                        );
+                        break;
+
+                    case 'USERADD':
+                        username = parsed.attributes[1].value || '';
+                        password = parsed.attributes[2].value || '';
+
+                        if (connection.server.getUser(username)) {
+                            connection.server.users[username].password = password;
+                            message = 'updated';
+                        } else {
+                            connection.server.users[username] = {
+                                password: password
+                            };
+                            message = 'added';
+                        }
+
+                        connection.send(
+                            {
+                                tag: '*',
+                                command: 'XTOYBIRD',
+                                attributes: [
+                                    {
+                                        type: 'SECTION',
+                                        section: [
+                                            {
+                                                type: 'ATOM',
+                                                value: 'XUSER'
+                                            }
+                                        ]
+                                    },
+                                    {
+                                        type: 'TEXT',
+                                        value: 'User ' + displayName(username) + message + ' successfully'
+                                    }
+                                ]
+                            },
+                            'CONNECTION USERADD',
+                            parsed,
+                            data
+                        );
+                        break;
+
+                    case 'USERDEL':
+                        username = parsed.attributes[1].value || '';
+
+                        if (username in connection.server.users) {
+                            delete connection.server.users[username];
+                            message = 'succeeded';
+                        } else {
+                            message = 'failed (no such user)';
+                        }
+
+                        connection.send(
+                            {
+                                tag: '*',
+                                command: 'XTOYBIRD',
+                                attributes: [
+                                    {
+                                        type: 'SECTION',
+                                        section: [
+                                            {
+                                                type: 'ATOM',
+                                                value: 'XUSER'
+                                            }
+                                        ]
+                                    },
+                                    {
+                                        type: 'TEXT',
+                                        value: 'Removing user ' + displayName(username) + message
+                                    }
+                                ]
+                            },
+                            'CONNECTION USERDEL',
+                            parsed,
+                            data
+                        );
+                        break;
+
+                    case 'SHUTDOWN':
+                        connection.send(
+                            {
+                                tag: '*',
+                                command: 'OK',
+                                attributes: [
+                                    {
+                                        type: 'SECTION',
+                                        section: [
+                                            {
+                                                type: 'ATOM',
+                                                value: 'ALERT'
+                                            }
+                                        ]
+                                    },
+                                    {
+                                        type: 'TEXT',
+                                        value: 'System scheduled for shutdown'
+                                    }
+                                ]
+                            },
+                            'CONNECTION SHUTDOWN',
+                            parsed,
+                            data
+                        );
+
+                        connection.server.close();
+                        break;
+
+                    default:
+                        connection.send(
+                            {
+                                tag: parsed.tag,
+                                command: 'BAD',
+                                attributes: [
+                                    {
+                                        type: 'TEXT',
+                                        value: 'Unknown command'
+                                    }
+                                ]
+                            },
+                            'INVALID COMMAND',
+                            parsed,
+                            data
+                        );
+                        return callback();
+                }
+            }
+
+            connection.send(
+                {
+                    tag: parsed.tag,
+                    command: 'OK',
+                    attributes: [
+                        {
+                            type: 'TEXT',
+                            value: 'XTOYBIRD Completed'
+                        }
+                    ]
+                },
+                'XTOYBIRD',
+                parsed,
+                data
+            );
+            return callback();
+        },
+        { states: states.AUTHENTICATED }
+    );
+};
+
+// Response text is free text that some clients still tokenize, so only plain user names are echoed
+function displayName(username) {
+    return /^[\w.@+-]+$/.test(username) ? "'" + username + "' " : '';
+}