ysk-server-core 1.0.0

package/dist/email/mail-tls-apply.js

@@ -0,0 +1,134 @@
+/**
+ * Bind Let's Encrypt (or existing) cert paths into Postfix/Dovecot for mail hostnames.
+ * Does not run certbot — only applies paths when files already exist (D7 polish).
+ */
+import { tl } from 'ysk-server-shared';
+import { panelBlockMessage } from '../hosting/system-apply.js';
+function certLiveBase(mailHost) {
+    return `/etc/letsencrypt/live/${mailHost}`;
+}
+function certFilesPresent(host, base) {
+    try {
+        return host.pathExists(`${base}/fullchain.pem`) && host.pathExists(`${base}/privkey.pem`);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Apply TLS paths for mail.<domain> (default) or explicit hostname.
+ */
+export async function applyMailTlsPaths(input) {
+    const domain = input.domain.trim().toLowerCase();
+    const mailHost = (input.mailHost ?? `mail.${domain}`).trim().toLowerCase();
+    const notes = [];
+    const steps = [];
+    if (!domain) {
+        return {
+            ok: false,
+            mailHost,
+            applied: false,
+            notes: [tl('notes.needDomain')],
+            steps: [],
+        };
+    }
+    if (!input.host.executeEnabled() || !input.host.isRoot()) {
+        const reason = !input.host.executeEnabled() ? 'no_execute' : 'no_root';
+        const blockMessage = panelBlockMessage(reason);
+        return {
+            ok: false,
+            blocked: true,
+            blockMessage,
+            mailHost,
+            applied: false,
+            notes: [blockMessage, tl('email.mailTls.needRootExecute')],
+            steps: [],
+        };
+    }
+    const certBase = certLiveBase(mailHost);
+    if (!certFilesPresent(input.host, certBase)) {
+        notes.push(tl('email.mailTls.certMissing', { host: mailHost, path: certBase }));
+        notes.push(tl('email.mailTls.getCertFirst', { host: mailHost }));
+        steps.push({
+            name: 'cert-files',
+            status: 'failed',
+            detail: certBase,
+        });
+        return {
+            ok: false,
+            mailHost,
+            certBase,
+            applied: false,
+            notes,
+            steps,
+        };
+    }
+    steps.push({ name: 'cert-files', status: 'ok', detail: certBase });
+    notes.push(tl('email.mailTls.certFound', { host: mailHost }));
+    const fullchain = `${certBase}/fullchain.pem`;
+    const privkey = `${certBase}/privkey.pem`;
+    const conf = await input.host.runCommand([
+        'bash',
+        '-c',
+        [
+            `postconf -e "smtpd_tls_cert_file = ${fullchain}"`,
+            `postconf -e "smtpd_tls_key_file = ${privkey}"`,
+            'postconf -e "smtpd_tls_security_level = may"',
+            'postconf -e "smtp_tls_security_level = may"',
+        ].join(' && '),
+    ], { timeoutMs: 20_000 });
+    if (conf.exitCode !== 0) {
+        notes.push(tl('email.mailTls.postconfFailed', { detail: conf.stderr || conf.stdout }));
+        steps.push({ name: 'postfix-postconf', status: 'failed', detail: conf.stderr });
+        return { ok: false, mailHost, certBase, applied: false, notes, steps };
+    }
+    steps.push({ name: 'postfix-postconf', status: 'ok' });
+    notes.push(tl('email.mailTls.postfixPathsSet'));
+    const rel = await input.host.runCommand(['bash', '-c', 'systemctl reload postfix 2>&1 || service postfix reload 2>&1'], { timeoutMs: 30_000 });
+    if (rel.exitCode === 0) {
+        steps.push({ name: 'postfix-reload', status: 'ok' });
+        notes.push(tl('email.mailTls.postfixReloaded'));
+    }
+    else {
+        steps.push({
+            name: 'postfix-reload',
+            status: 'failed',
+            detail: rel.stderr || rel.stdout,
+        });
+        notes.push(tl('email.mailTls.postfixReloadFailed', { detail: (rel.stderr || rel.stdout).slice(0, 200) }));
+    }
+    if (input.applyDovecot !== false) {
+        // Best-effort: write snippet for operator / conf.d if doveconf available
+        const dove = await input.host.runCommand([
+            'bash',
+            '-c',
+            [
+                'if command -v doveconf >/dev/null 2>&1; then',
+                `  printf 'ssl = required\\nssl_cert = <%s\\nssl_key = <%s\\n' ${JSON.stringify(fullchain)} ${JSON.stringify(privkey)} > /etc/dovecot/conf.d/99-ysk-mail-tls.conf`,
+                '  systemctl reload dovecot 2>/dev/null || service dovecot reload 2>/dev/null || true',
+                '  echo dove_ok',
+                'else',
+                '  echo dove_skip',
+                'fi',
+            ].join('\n'),
+        ], { timeoutMs: 20_000 });
+        if ((dove.stdout || '').includes('dove_ok')) {
+            steps.push({ name: 'dovecot-tls', status: 'ok' });
+            notes.push(tl('email.mailTls.dovecotApplied'));
+        }
+        else {
+            steps.push({ name: 'dovecot-tls', status: 'skipped' });
+            notes.push(tl('email.mailTls.dovecotSkipped'));
+        }
+    }
+    const applied = steps.some((s) => s.name === 'postfix-postconf' && s.status === 'ok');
+    return {
+        ok: applied && steps.find((s) => s.name === 'postfix-reload')?.status === 'ok',
+        mailHost,
+        certBase,
+        applied,
+        notes,
+        steps,
+    };
+}
+//# sourceMappingURL=mail-tls-apply.js.map

package/dist/email/mail-tls-apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail-tls-apply.js","sourceRoot":"","sources":["../../src/email/mail-tls-apply.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAEvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAa/D,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,yBAAyB,QAAQ,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAkB,EAAE,IAAY;IACxD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,gBAAgB,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAOvC;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,QAAQ,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAgC,EAAE,CAAC;IAE9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ;YACR,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;YAC/B,KAAK,EAAE,EAAE;SACV,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,IAAI;YACb,YAAY;YACZ,QAAQ;YACR,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,+BAA+B,CAAC,CAAC;YAC1D,KAAK,EAAE,EAAE;SACV,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAChF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ;YACR,QAAQ;YACR,OAAO,EAAE,KAAK;YACd,KAAK;YACL,KAAK;SACN,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAE9D,MAAM,SAAS,GAAG,GAAG,QAAQ,gBAAgB,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,QAAQ,cAAc,CAAC;IAE1C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CACtC;QACE,MAAM;QACN,IAAI;QACJ;YACE,sCAAsC,SAAS,GAAG;YAClD,qCAAqC,OAAO,GAAG;YAC/C,8CAA8C;YAC9C,6CAA6C;SAC9C,CAAC,IAAI,CAAC,MAAM,CAAC;KACf,EACD,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;IACF,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,8BAA8B,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACvF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACzE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC,CAAC;IAEhD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CACrC,CAAC,MAAM,EAAE,IAAI,EAAE,8DAA8D,CAAC,EAC9E,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;IACF,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC,CAAC;IAClD,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM;SACjC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,mCAAmC,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5G,CAAC;IAED,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QACjC,yEAAyE;QACzE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CACtC;YACE,MAAM;YACN,IAAI;YACJ;gBACE,8CAA8C;gBAC9C,iEAAiE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,6CAA6C;gBAClK,sFAAsF;gBACtF,gBAAgB;gBAChB,MAAM;gBACN,kBAAkB;gBAClB,IAAI;aACL,CAAC,IAAI,CAAC,IAAI,CAAC;SACb,EACD,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,8BAA8B,CAAC,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,8BAA8B,CAAC,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IACtF,OAAO;QACL,EAAE,EAAE,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAAE,MAAM,KAAK,IAAI;QAC9E,QAAQ;QACR,QAAQ;QACR,OAAO;QACP,KAAK;QACL,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/email/password-hash.d.ts

@@ -0,0 +1,16 @@
+export type PasswordHashScheme = 'SHA512-CRYPT' | 'YSK-SCRYPT';
+export interface PasswordHashResult {
+    scheme: PasswordHashScheme;
+    /** Value to store in passwd-file (includes scheme prefix when Dovecot-compatible) */
+    hash: string;
+    notes: string[];
+}
+/**
+ * Hash a mailbox password for Dovecot passwd-file.
+ */
+export declare function hashMailboxPassword(password: string): Promise<PasswordHashResult>;
+/**
+ * Synchronous scrypt-only hash (tests / no child process).
+ */
+export declare function hashMailboxPasswordSync(password: string): PasswordHashResult;
+//# sourceMappingURL=password-hash.d.ts.map

package/dist/email/password-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-hash.d.ts","sourceRoot":"","sources":["../../src/email/password-hash.ts"],"names":[],"mappings":"AAaA,MAAM,MAAM,kBAAkB,GAAG,cAAc,GAAG,YAAY,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,qFAAqF;IACrF,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAkCvF;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,kBAAkB,CAQ5E"}

package/dist/email/password-hash.js

@@ -0,0 +1,56 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * Password hashes for mailboxes / Dovecot passdb.
+ * Prefer SHA512-CRYPT ({SHA512-CRYPT}) via openssl when available;
+ * fall back to YSK scrypt for managed store without openssl.
+ */
+import { randomBytes, scryptSync } from 'node:crypto';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+/**
+ * Hash a mailbox password for Dovecot passwd-file.
+ */
+export async function hashMailboxPassword(password) {
+    const notes = [];
+    if (!password || password.length < 8) {
+        throw new Error(tl('notes.auto.n0667'));
+    }
+    // openssl passwd -6 → $6$... SHA512-CRYPT
+    try {
+        const { stdout } = await execFileAsync('openssl', ['passwd', '-6', password], { timeout: 5_000, maxBuffer: 1024 });
+        const h = stdout.trim();
+        if (h.startsWith('$6$')) {
+            notes.push(tl('notes.auto.n0790'));
+            return {
+                scheme: 'SHA512-CRYPT',
+                hash: `{SHA512-CRYPT}${h}`,
+                notes,
+            };
+        }
+    }
+    catch {
+        notes.push(tl('notes.auto.n0352'));
+    }
+    const salt = randomBytes(16).toString('hex');
+    const hash = scryptSync(password, salt, 32).toString('hex');
+    notes.push(tl('notes.auto.n0537'));
+    return {
+        scheme: 'YSK-SCRYPT',
+        hash: `scrypt$${salt}$${hash}`,
+        notes,
+    };
+}
+/**
+ * Synchronous scrypt-only hash (tests / no child process).
+ */
+export function hashMailboxPasswordSync(password) {
+    const salt = randomBytes(16).toString('hex');
+    const hash = scryptSync(password, salt, 32).toString('hex');
+    return {
+        scheme: 'YSK-SCRYPT',
+        hash: `scrypt$${salt}$${hash}`,
+        notes: ['YSK-SCRYPT (sync)'],
+    };
+}
+//# sourceMappingURL=password-hash.js.map

package/dist/email/password-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-hash.js","sourceRoot":"","sources":["../../src/email/password-hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAW1C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,0CAA0C;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpC,SAAS,EACT,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,EAC1B,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CACpC,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;YACnC,OAAO;gBACL,MAAM,EAAE,cAAc;gBACtB,IAAI,EAAE,iBAAiB,CAAC,EAAE;gBAC1B,KAAK;aACN,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACnC,OAAO;QACL,MAAM,EAAE,YAAY;QACpB,IAAI,EAAE,UAAU,IAAI,IAAI,IAAI,EAAE;QAC9B,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO;QACL,MAAM,EAAE,YAAY;QACpB,IAAI,EAAE,UAAU,IAAI,IAAI,IAAI,EAAE;QAC9B,KAAK,EAAE,CAAC,mBAAmB,CAAC;KAC7B,CAAC;AACJ,CAAC"}

package/dist/email/relay.d.ts

@@ -0,0 +1,45 @@
+/**
+ * SMTP relay configuration for when Port 25 is blocked (Spec §5.4 C).
+ */
+import type { HostExecutor } from '../host/executor.js';
+import type { YskDatabase } from '../db/database.js';
+export interface SmtpRelayConfig {
+    host: string;
+    port: number;
+    username?: string;
+    /** Never store raw password in plain logs; optional sasl password file path */
+    password?: string;
+    security: 'none' | 'starttls' | 'tls';
+    domain?: string;
+}
+export interface SmtpRelayApplyResult {
+    ok: boolean;
+    written: string[];
+    notes: string[];
+    requiresExecute: boolean;
+    requiresRoot: boolean;
+    appliedToSystem: boolean;
+    config: Omit<SmtpRelayConfig, 'password'> & {
+        passwordSet: boolean;
+    };
+    commandResults: Array<{
+        argv: string[];
+        exitCode: number;
+        stderr: string;
+    }>;
+}
+/**
+ * Write Postfix relay maps under dataDir/email/relay/.
+ * Optionally copy to /etc/postfix when EXECUTE+root.
+ */
+export declare function applySmtpRelay(input: {
+    dataDir: string;
+    host: HostExecutor;
+    relay: SmtpRelayConfig;
+    /** Attempt system install of relay snippets */
+    applySystem?: boolean;
+    db?: YskDatabase;
+    actor?: string;
+}): Promise<SmtpRelayApplyResult>;
+export declare function loadSmtpRelaySettings(dataDir: string): Record<string, unknown> | null;
+//# sourceMappingURL=relay.d.ts.map

package/dist/email/relay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay.d.ts","sourceRoot":"","sources":["../../src/email/relay.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,KAAK,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,GAAG;QAAE,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC;IACrE,cAAc,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7E;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,+CAA+C;IAC/C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,EAAE,CAAC,EAAE,WAAW,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiHhC;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAOrF"}

package/dist/email/relay.js

@@ -0,0 +1,122 @@
+/**
+ * SMTP relay configuration for when Port 25 is blocked (Spec §5.4 C).
+ */
+import { mkdirSync, writeFileSync, existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+/**
+ * Write Postfix relay maps under dataDir/email/relay/.
+ * Optionally copy to /etc/postfix when EXECUTE+root.
+ */
+export async function applySmtpRelay(input) {
+    const r = input.relay;
+    if (!r.host?.trim()) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1393'), { httpStatus: 400 });
+    }
+    if (!Number.isInteger(r.port) || r.port < 1 || r.port > 65535) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n0501'), { httpStatus: 400 });
+    }
+    const dir = join(input.dataDir, 'email', 'relay');
+    mkdirSync(dir, { recursive: true });
+    const security = r.security ?? 'starttls';
+    const mainSnippet = [
+        '# YSK Server — SMTP relay snippet (include / append to main.cf)',
+        `relayhost = [${r.host}]:${r.port}`,
+        'smtp_sasl_auth_enable = yes',
+        'smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd',
+        'smtp_sasl_security_options = noanonymous',
+        security === 'tls'
+            ? 'smtp_tls_security_level = encrypt'
+            : security === 'starttls'
+                ? 'smtp_tls_security_level = may'
+                : 'smtp_tls_security_level = none',
+        'smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt',
+        '',
+    ].join('\n');
+    const user = r.username ?? '';
+    const pass = r.password ?? 'CHANGE_ME';
+    const saslLine = `[${r.host}]:${r.port} ${user}:${pass}\n`;
+    const snippetPath = join(dir, 'relay-main.cf.snippet');
+    const saslPath = join(dir, 'sasl_passwd');
+    const readme = join(dir, 'README.txt');
+    writeFileSync(snippetPath, mainSnippet, 'utf8');
+    writeFileSync(saslPath, saslLine, { mode: 0o600 });
+    writeFileSync(readme, [
+        'SMTP relay for blocked Port 25',
+        `Host: ${r.host}:${r.port}`,
+        '1. Merge relay-main.cf.snippet into /etc/postfix/main.cf',
+        '2. Install sasl_passwd → postmap hash:/etc/postfix/sasl_passwd',
+        '3. systemctl reload postfix',
+        'Credentials file mode should be 600.',
+        '',
+    ].join('\n'), 'utf8');
+    const notes = [
+        `Wrote relay snippets under ${dir}`,
+        r.password ? 'Password written to managed sasl_passwd (restrict access)' : 'Password placeholder CHANGE_ME',
+    ];
+    const written = [snippetPath, saslPath, readme];
+    const commandResults = [];
+    let appliedToSystem = false;
+    const want = Boolean(input.applySystem);
+    const can = want && input.host.executeEnabled() && input.host.isRoot();
+    if (want && !can) {
+        notes.push(tl('notes.auto.n1161'));
+    }
+    if (can) {
+        const steps = [
+            ['cp', snippetPath, '/etc/postfix/ysk-relay.cf'],
+            ['cp', saslPath, '/etc/postfix/sasl_passwd'],
+            ['chmod', '600', '/etc/postfix/sasl_passwd'],
+            ['postmap', 'hash:/etc/postfix/sasl_passwd'],
+            [
+                'bash',
+                '-c',
+                'grep -q ysk-relay.cf /etc/postfix/main.cf || echo "include /etc/postfix/ysk-relay.cf" >> /etc/postfix/main.cf',
+            ],
+            ['systemctl', 'reload', 'postfix'],
+        ];
+        for (const argv of steps) {
+            const res = await input.host.runCommand(argv, { timeoutMs: 30_000 });
+            commandResults.push({ argv, exitCode: res.exitCode, stderr: res.stderr });
+        }
+        appliedToSystem = commandResults.every((c) => c.exitCode === 0);
+        notes.push(appliedToSystem ? tl('notes.auto.n0755') : tl('notes.auto.n1496'));
+    }
+    const publicConfig = {
+        host: r.host,
+        port: r.port,
+        username: r.username,
+        security,
+        domain: r.domain,
+        passwordSet: Boolean(r.password),
+    };
+    if (input.db) {
+        input.db.snapshot.settings['email.smtp_relay'] = JSON.stringify({
+            ...publicConfig,
+            updated_at: new Date().toISOString(),
+            actor: input.actor,
+            paths: written,
+        });
+        input.db.persist();
+    }
+    return {
+        ok: want ? can && appliedToSystem : true,
+        written,
+        notes,
+        requiresExecute: !input.host.executeEnabled(),
+        requiresRoot: !input.host.isRoot(),
+        appliedToSystem,
+        config: publicConfig,
+        commandResults,
+    };
+}
+export function loadSmtpRelaySettings(dataDir) {
+    const p = join(dataDir, 'email', 'relay', 'relay-main.cf.snippet');
+    if (!existsSync(p))
+        return null;
+    return {
+        snippetPath: p,
+        snippetPreview: readFileSync(p, 'utf8').slice(0, 400),
+    };
+}
+//# sourceMappingURL=relay.js.map

package/dist/email/relay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay.js","sourceRoot":"","sources":["../../src/email/relay.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAC,MAAM,mBAAmB,CAAC;AAyB5D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAQpC;IACC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;IACtB,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;QAC9D,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpC,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,UAAU,CAAC;IAC1C,MAAM,WAAW,GAAG;QAClB,iEAAiE;QACjE,gBAAgB,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE;QACnC,6BAA6B;QAC7B,yDAAyD;QACzD,0CAA0C;QAC1C,QAAQ,KAAK,KAAK;YAChB,CAAC,CAAC,mCAAmC;YACrC,CAAC,CAAC,QAAQ,KAAK,UAAU;gBACvB,CAAC,CAAC,+BAA+B;gBACjC,CAAC,CAAC,gCAAgC;QACtC,sDAAsD;QACtD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,IAAI,WAAW,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC;IAE3D,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACvC,aAAa,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAChD,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,aAAa,CACX,MAAM,EACN;QACE,gCAAgC;QAChC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE;QAC3B,0DAA0D;QAC1D,gEAAgE;QAChE,6BAA6B;QAC7B,sCAAsC;QACtC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,MAAM,CACP,CAAC;IAEF,MAAM,KAAK,GAAG;QACZ,8BAA8B,GAAG,EAAE;QACnC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,2DAA2D,CAAC,CAAC,CAAC,gCAAgC;KAC5G,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,cAAc,GAA2C,EAAE,CAAC;IAClE,IAAI,eAAe,GAAG,KAAK,CAAC;IAE5B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACvE,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,KAAK,GAAe;YACxB,CAAC,IAAI,EAAE,WAAW,EAAE,2BAA2B,CAAC;YAChD,CAAC,IAAI,EAAE,QAAQ,EAAE,0BAA0B,CAAC;YAC5C,CAAC,OAAO,EAAE,KAAK,EAAE,0BAA0B,CAAC;YAC5C,CAAC,SAAS,EAAE,+BAA+B,CAAC;YAC5C;gBACE,MAAM;gBACN,IAAI;gBACJ,+GAA+G;aAChH;YACD,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC;SACnC,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YACrE,cAAc,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;QAChE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,YAAY,GAAG;QACnB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ;QACR,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;KACjC,CAAC;IAEF,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QACb,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;YAC9D,GAAG,YAAY;YACf,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IACrB,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,eAAe,CAAC,CAAC,CAAC,IAAI;QACxC,OAAO;QACP,KAAK;QACL,eAAe,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE;QAC7C,YAAY,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE;QAClC,eAAe;QACf,MAAM,EAAE,YAAY;QACpB,cAAc;KACf,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO;QACL,WAAW,EAAE,CAAC;QACd,cAAc,EAAE,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;KACtD,CAAC;AACJ,CAAC"}

package/dist/email/roundcube-sso-plugin.d.ts

@@ -0,0 +1,44 @@
+import type { HostExecutor } from '../host/executor.js';
+export declare function writeRoundcubeSsoPlugin(input: {
+    dataDir: string;
+    /** panel public base URL for token consume */
+    panelBaseUrl: string;
+}): {
+    ok: boolean;
+    written: string[];
+    notes: string[];
+    pluginDir: string;
+};
+/** Common Roundcube plugin directory candidates */
+export declare const ROUNDCUBE_PLUGIN_CANDIDATES: string[];
+/**
+ * Symlink managed plugin into a Roundcube plugins/ tree (needs EXECUTE+root for system paths).
+ */
+export declare function enableRoundcubeSsoPlugin(input: {
+    dataDir: string;
+    host: HostExecutor;
+    panelBaseUrl: string;
+    /** Explicit Roundcube plugins dir; auto-detect if omitted */
+    roundcubePluginsDir?: string;
+}): Promise<{
+    ok: boolean;
+    notes: string[];
+    written: string[];
+    symlink?: string;
+    blocked?: boolean;
+    blockMessage?: string;
+    apply_status: 'written' | 'applied' | 'blocked';
+}>;
+/**
+ * Ensure $config['plugins'][] = 'ysk_sso' in Roundcube config.inc.php
+ */
+export declare function ensureRoundcubePluginInConfig(input: {
+    host: HostExecutor;
+    pluginsDir: string;
+    pluginName: string;
+}): Promise<{
+    ok: boolean;
+    notes: string[];
+    written: string[];
+}>;
+//# sourceMappingURL=roundcube-sso-plugin.d.ts.map

package/dist/email/roundcube-sso-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roundcube-sso-plugin.d.ts","sourceRoot":"","sources":["../../src/email/roundcube-sso-plugin.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAuFzE;AAED,mDAAmD;AACnD,eAAO,MAAM,2BAA2B,UAMvC,CAAC;AAEF;;GAEG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;CACjD,CAAC,CA2HD;AAED;;GAEG;AACH,wBAAsB,6BAA6B,CAAC,KAAK,EAAE;IACzD,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAsE/D"}