* feat(luahost): capture config settings set by Lua scripts
Add inbucket.config, a Lua-settable settings namespace, with its first
field decode_headers registering additional message headers for Inbucket
to decode. Values are captured once at startup from the first pooled
LState and exposed to the assembly via Host.ScriptConfig().
Settings that only have value to the Lua script belong here rather than
in env config. No consumers of decode_headers yet; that follows.
* feat(message): expose decoded headers to extensions
StoreManager gains ExtraDecodeHeaders, passed through to
enmime.DecodeHeaders, and the decoded header set (defaults plus any
registered extras) is attached to the InboundMessage event as
Headers (net/textproto.MIMEHeader).
Lua scripts access it via the read-only inbound_message.header field,
added with the new inbound_header binding. Lookups are exact-then-
case-insensitive, since enmime canonicalizes keys with email-specific
rules that differ from net/textproto.
FullAssembly wires ScriptConfig().DecodeHeaders into StoreManager.
Part of #627.
* docs(extension): document shared and untrusted header semantics
Reviewer note: BeforeMessageStored listeners receive the same decoded
header map, so a Go listener's mutations are visible to later listeners.
Also record that sender-supplied header values (Authentication-Results,
X-Spam-Status) are untrusted unless the deployment controls provenance.
Part of #627.
---------
Co-authored-by: hillyerd-bot <hillyerd-bot@users.noreply.github.com>
The TLS connection state lived on the shared POP3 Server, and Session
reached it through its embedded *Server. Once any client completed
STLS, every later session saw a non-nil state: CAPA stopped advertising
STLS and the STLS command returned "-ERR A TLS session already agreed
upon." until the server restarted. Sessions also wrote the shared field
concurrently without synchronization.
Move tlsState to Session. ForceTLS sessions set it when the session
starts, and STLS sets it on the negotiating session only.
TestSTLSPerSession runs CAPA, STLS and a TLS handshake on two sessions of
one server; it fails against the previous code on the second session.
Signed-off-by: Antoine Deschênes <antoine@antoinedeschenes.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
- RETR and TOP now respond "-ERR You deleted message N" for messages
marked deleted, as RFC 1939 sections 5 (RETR) and 7 (TOP) require;
previously the message content was still sent.
- STLS: a failed TLS handshake previously continued the session with
the dead TLS connection installed as s.conn and a bogus tlsState,
producing confusing follow-on errors. RFC 2595 section 4 requires
the negotiation to complete before further commands, so a failure
is now fatal: log it and terminate the session.
Updates the scripted tests that previously pinned the old behavior,
and adds a STLS handshake failure regression test.
Signed-off-by: James Hillyerd <james@hillyerd.com>
- validateMsgNum parses and range-checks message-number arguments,
replacing five copies of the parse/check/respond sequence in the
LIST, UIDL, DELE, RETR and TOP arms (wire responses unchanged).
- listMessages implements LIST and UIDL, which differ only in the
per-message value reported.
- sendMessageLines unifies sendMessage/sendMessageTop via a body line
limit, negative meaning unlimited.
Adds a direct unit test for validateMsgNum and an equivalence test
asserting TOP with a large line limit matches RETR output. All
scripted session tests from the previous commit pass unchanged.
Signed-off-by: James Hillyerd <james@hillyerd.com>
Covers the POP3 TRANSACTION state machine via scripted sessions over
net.Pipe, mirroring the SMTP handler test harness: STAT/LIST/UIDL/DELE/
RETR/TOP/NOOP/RSET/QUIT including argument error paths, deleted-message
behavior, dot-stuffing, RETR/TOP source error paths, mailbox load
errors, session read error handling (idle timeout vs other), and the
TCP listener lifecycle (Start/serve/Notify/Drain).
No production code changes; current behavior is pinned as-is. Two
known RFC deviations are documented in tests (RETR/TOP of messages
marked deleted) for follow-up fixes. Package coverage: 24.4% -> 93.2%.
Signed-off-by: James Hillyerd <james@hillyerd.com>
* fix: POP3 server now uses TLS HandshakeContext
Signed-off-by: James Hillyerd <james@hillyerd.com>
* fix: Web server now uses Listen with context
Signed-off-by: James Hillyerd <james@hillyerd.com>
* fix: replace interface{} with any
Signed-off-by: James Hillyerd <james@hillyerd.com>
---------
Signed-off-by: James Hillyerd <james@hillyerd.com>
* Update to golangci lint 2.0.x
Signed-off-by: James Hillyerd <james@hillyerd.com>
* Fix new lint warnings
Signed-off-by: James Hillyerd <james@hillyerd.com>
---------
Signed-off-by: James Hillyerd <james@hillyerd.com>
* chore: Update Go deps
Signed-off-by: James Hillyerd <james@hillyerd.com>
* Fix lint warnings for loopvars
Signed-off-by: James Hillyerd <james@hillyerd.com>
---------
Signed-off-by: James Hillyerd <james@hillyerd.com>
* chore: rename BeforeMailAccepted to BeforeMailFromAccepted
Signed-off-by: James Hillyerd <james@hillyerd.com>
* chore: update BeforeMailAccepted to use SMTPSession
Signed-off-by: James Hillyerd <james@hillyerd.com>
---------
Signed-off-by: James Hillyerd <james@hillyerd.com>
* chore: convert smtp/handler if-else chain to switch-case
Signed-off-by: James Hillyerd <james@hillyerd.com>
* chore: extract long case into parseMailCmd func
Signed-off-by: James Hillyerd <james@hillyerd.com>
* chore: remove extraneous braces in cases
Signed-off-by: James Hillyerd <james@hillyerd.com>
---------
Signed-off-by: James Hillyerd <james@hillyerd.com>
* chore: colocate SMTP session WaitGroup incr/decr
Signed-off-by: James Hillyerd <james@hillyerd.com>
* fix: smtp tests that hang on panic/t.Fatal
Signed-off-by: James Hillyerd <james@hillyerd.com>
* chore: reorder smtp/handler test helpers
Signed-off-by: James Hillyerd <james@hillyerd.com>
---------
Signed-off-by: James Hillyerd <james@hillyerd.com>
* fix whitespace warnings
Signed-off-by: James Hillyerd <james@hillyerd.com>
* fix a number of typos
Signed-off-by: James Hillyerd <james@hillyerd.com>
* fix many cosmetic linter warnings
Signed-off-by: James Hillyerd <james@hillyerd.com>
---------
Signed-off-by: James Hillyerd <james@hillyerd.com>
* message: migrate more delivery logic into manager.go
Signed-off-by: James Hillyerd <james@hillyerd.com>
* manager: tidy up a few things
Signed-off-by: James Hillyerd <james@hillyerd.com>
---------
Signed-off-by: James Hillyerd <james@hillyerd.com>
This change makes all header timestamps (e.g. "Received") to use
UTC time zone.
This way the length of such headers do not depend on local time zone
which if effect fixes#404.
Signed-off-by: Saulius Gurklys <s4uliu5@gmail.com>
Refactor server life-cycle into it's own file, make service startup and monitoring more consistent and testable.
* Extract services creation in preparation for DI
* pop3: rename New to NewServer
* lifecycle: Add fatal error Notify()
* web: Introduce Server struct w/ Notify()
* Extract Start in lifecycle
* Add Start() to Hub
* RetentionScanner startup consistent with other svcs
* Remove global shutdown channel
* Implement a readiness notification system
James Hillyerd