Lucas Rayan
110a240cd9
The webmail creates app passwords (shown once, stored hashed, with scopes) but the protocol servers only compared a login against mailboxes.password_hash, so an app password was always refused with 535 / authentication failed. They exist because mail clients cannot do a second factor. - port.MailboxAuth carries the mailbox's app passwords (newest 20) with their scopes; the Postgres repository loads them and stamps last_used_at on use - verifyCredential accepts the mailbox password or an app password that holds the scope of the protocol; SMTP, IMAP and POP3 use it. ManageSieve keeps the mailbox password only, as no default scope covers it - a malformed app password hash is skipped instead of failing the login; a malformed mailbox hash still surfaces as the server-side error it was Tests: unit cases for scopes and malformed hashes, the three entry points, repository tests against Postgres, and an end-to-end test on the real submission server that fails with 535 without the fix and passes with it. Full `go test ./...` with TEST_DATABASE_URL, go vet and lang-lint are clean.
110 lines
3.7 KiB
Go
110 lines
3.7 KiB
Go
package usecase
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
|
|
"github.com/google/uuid"
|
|
|
|
"lambdamail/protocols/internal/application/port"
|
|
)
|
|
|
|
// ErrAuthFailed is returned by Login for any credential problem - unknown
|
|
// address, wrong password, or (once AuthRepository filters it) an inactive
|
|
// mailbox/domain. Deliberately the same error in every case: distinguishing
|
|
// them would let a client enumerate valid addresses (PLAN.md section 14.6).
|
|
var ErrAuthFailed = errors.New("imap session: authentication failed")
|
|
|
|
// ErrNoSuchFolder is returned by SelectFolder when the named folder doesn't exist.
|
|
var ErrNoSuchFolder = errors.New("imap session: no such folder")
|
|
|
|
// ImapSessionUseCase implements the read/auth half of PLAN.md section 3's
|
|
// HandleImapCommandUseCase (this sub-project's scope: LOGIN, LIST, SELECT,
|
|
// FETCH, STORE; SEARCH/EXPUNGE/IDLE/MOVE land in later sub-projects).
|
|
type ImapSessionUseCase struct {
|
|
auth port.AuthRepository
|
|
folders port.ImapFolderRepository
|
|
messages port.MessageQueryRepository
|
|
flags port.FlagRepository
|
|
blobs port.BlobReader
|
|
expunger port.ExpungeRepository
|
|
copier port.CopyRepository
|
|
trackerManager *MailboxTrackerManager
|
|
}
|
|
|
|
func NewImapSessionUseCase(auth port.AuthRepository, folders port.ImapFolderRepository, messages port.MessageQueryRepository, flags port.FlagRepository, blobs port.BlobReader, expunger port.ExpungeRepository, copier port.CopyRepository) *ImapSessionUseCase {
|
|
return &ImapSessionUseCase{
|
|
auth: auth,
|
|
folders: folders,
|
|
messages: messages,
|
|
flags: flags,
|
|
blobs: blobs,
|
|
expunger: expunger,
|
|
copier: copier,
|
|
trackerManager: NewMailboxTrackerManager(),
|
|
}
|
|
}
|
|
|
|
func (uc *ImapSessionUseCase) SetTrackerManager(tm *MailboxTrackerManager) {
|
|
if tm != nil {
|
|
uc.trackerManager = tm
|
|
}
|
|
}
|
|
|
|
func (uc *ImapSessionUseCase) GetTrackerManager() *MailboxTrackerManager {
|
|
return uc.trackerManager
|
|
}
|
|
|
|
func (uc *ImapSessionUseCase) Login(ctx context.Context, address, password string) (string, error) {
|
|
rec, err := uc.auth.FindByAddress(ctx, address)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
if rec == nil {
|
|
return "", ErrAuthFailed
|
|
}
|
|
match, err := verifyCredential(ctx, uc.auth, rec, password, ScopeIMAP)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
if !match {
|
|
return "", ErrAuthFailed
|
|
}
|
|
return rec.ID.String(), nil
|
|
}
|
|
|
|
func (uc *ImapSessionUseCase) ListFolders(ctx context.Context, mailboxID string) ([]port.ImapFolderRecord, error) {
|
|
return uc.folders.ListFolders(ctx, mailboxID)
|
|
}
|
|
|
|
func (uc *ImapSessionUseCase) SelectFolder(ctx context.Context, mailboxID, name string) (*port.ImapFolderRecord, error) {
|
|
rec, err := uc.folders.FindByName(ctx, mailboxID, name)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if rec == nil {
|
|
return nil, ErrNoSuchFolder
|
|
}
|
|
return rec, nil
|
|
}
|
|
|
|
func (uc *ImapSessionUseCase) FetchMessages(ctx context.Context, folderID string) ([]port.MessageRecord, error) {
|
|
return uc.messages.ListMessages(ctx, folderID)
|
|
}
|
|
|
|
func (uc *ImapSessionUseCase) ReadBlob(ctx context.Context, blobID uuid.UUID) ([]byte, error) {
|
|
return uc.blobs.ReadByID(ctx, blobID)
|
|
}
|
|
|
|
func (uc *ImapSessionUseCase) SetFlags(ctx context.Context, folderID string, uid uint32, op port.FlagOp, flags []string, unchangedSince uint64) (bool, error) {
|
|
return uc.flags.SetFlags(ctx, folderID, uid, op, flags, unchangedSince)
|
|
}
|
|
|
|
func (uc *ImapSessionUseCase) Expunge(ctx context.Context, folderID string, uids []uint32) error {
|
|
return uc.expunger.Expunge(ctx, folderID, uids)
|
|
}
|
|
|
|
func (uc *ImapSessionUseCase) CopyMessages(ctx context.Context, sourceFolderID string, uids []uint32, destFolderID string) ([]port.CopiedMessage, error) {
|
|
return uc.copier.CopyMessages(ctx, sourceFolderID, uids, destFolderID)
|
|
}
|