Lucas Rayan
110a240cd9
The webmail creates app passwords (shown once, stored hashed, with scopes) but the protocol servers only compared a login against mailboxes.password_hash, so an app password was always refused with 535 / authentication failed. They exist because mail clients cannot do a second factor. - port.MailboxAuth carries the mailbox's app passwords (newest 20) with their scopes; the Postgres repository loads them and stamps last_used_at on use - verifyCredential accepts the mailbox password or an app password that holds the scope of the protocol; SMTP, IMAP and POP3 use it. ManageSieve keeps the mailbox password only, as no default scope covers it - a malformed app password hash is skipped instead of failing the login; a malformed mailbox hash still surfaces as the server-side error it was Tests: unit cases for scopes and malformed hashes, the three entry points, repository tests against Postgres, and an end-to-end test on the real submission server that fails with 535 without the fix and passes with it. Full `go test ./...` with TEST_DATABASE_URL, go vet and lang-lint are clean.
47 lines
1.5 KiB
Go
47 lines
1.5 KiB
Go
package port
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/google/uuid"
|
|
)
|
|
|
|
// MailboxAuth is the subset of mailbox data needed to verify a login and,
|
|
// once authenticated, to apply the sender policy of PLAN.md section 5.2.
|
|
type MailboxAuth struct {
|
|
ID uuid.UUID
|
|
PasswordHash string
|
|
EmailAddress string
|
|
DomainName string
|
|
// MaxRecipientsPerHour caps a compromised account's blast radius.
|
|
MaxRecipientsPerHour int
|
|
// AppPasswords are the per-client credentials the user generated in the
|
|
// webmail. Protocol clients cannot answer a second factor, so these are how
|
|
// a mail client signs in on an account that has one.
|
|
AppPasswords []AppPasswordAuth
|
|
}
|
|
|
|
// AppPasswordAuth is one app password as stored: a hash, never the secret.
|
|
type AppPasswordAuth struct {
|
|
ID uuid.UUID
|
|
Hash string
|
|
Scopes []string
|
|
}
|
|
|
|
// AppPasswordUseRecorder is implemented by repositories that can note when an
|
|
// app password was last used. It is optional: a fake in a test need not have it.
|
|
type AppPasswordUseRecorder interface {
|
|
RecordAppPasswordUse(ctx context.Context, id uuid.UUID) error
|
|
}
|
|
|
|
// MaxAppPasswordsChecked bounds how many app passwords one login attempt is
|
|
// compared against.
|
|
const MaxAppPasswordsChecked = 20
|
|
|
|
// AuthRepository resolves a login address to its stored credential.
|
|
type AuthRepository interface {
|
|
// FindByAddress returns nil, nil (not an error) when no active mailbox
|
|
// with an active domain matches address.
|
|
FindByAddress(ctx context.Context, address string) (*MailboxAuth, error)
|
|
}
|