Lucas RayanandClaude Sonnet 5.5
60c6f5731c
Two bugs found by the setup check right after the last deploy: - every domain's BIMI record named the deployment's own mail host, and the server picked the domain from the host name, so only the primary domain's logo could be fetched: ciberlab.seg.br's record pointed at a 404. The logo and the certificate are now served at /.well-known/bimi/<domain>/..., the record names that, and the webmail routes it. The old path still answers - SetBimiPublisher ran before SetBimiAPI, found no BIMI API to attach to and was dropped, so saving a logo never published the DNS record by itself. It is kept on the router now, so the order does not matter Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
78 lines
3.5 KiB
TypeScript
78 lines
3.5 KiB
TypeScript
import { describe, it, expect } from "vitest";
|
|
import { readFileSync } from "node:fs";
|
|
import { resolve } from "node:path";
|
|
|
|
/**
|
|
* The well-known documents senders fetch over HTTPS.
|
|
*
|
|
* The protocols service serves /.well-known/mta-sts.txt, but the hostname a
|
|
* sender asks - mta-sts.<domain> - lands on this Next app, which had no route
|
|
* for it and answered its own 404 page. The DNS half of MTA-STS was published
|
|
* and the HTTPS half was not, so every sender saw "no-policy-found" and no
|
|
* TLS policy was ever enforced. Google's daily TLS-RPT report says exactly
|
|
* that.
|
|
*/
|
|
|
|
const config = readFileSync(resolve(process.cwd(), "next.config.ts"), "utf8");
|
|
|
|
describe("the MTA-STS policy senders fetch", () => {
|
|
it("is routed to the service that serves it", () => {
|
|
expect(config).toContain("/.well-known/mta-sts.txt");
|
|
expect(config).toMatch(/mta-sts\.txt[\s\S]{0,200}PROTOCOLS_SERVICE_URL/);
|
|
});
|
|
|
|
it("routes the other well-known documents the same way", () => {
|
|
expect(config).toContain("/.well-known/security.txt");
|
|
});
|
|
|
|
// A rewrite, not a redirect: RFC 8461 section 3.3 requires the policy to be
|
|
// fetched over HTTPS from that exact path, and a sender is not obliged to
|
|
// follow a redirect to get it.
|
|
it("rewrites rather than redirects", () => {
|
|
expect(config).not.toMatch(/redirects\(\)/);
|
|
});
|
|
});
|
|
|
|
/**
|
|
* Everything the protocols service owns has to be named twice: once where the
|
|
* route is registered, and once here where the proxy decides which upstream a
|
|
* request goes to. Adding it in only one place is silent - an admin route
|
|
* lands on the auth service and comes back "API endpoint not found", and a
|
|
* well-known document comes back as this app's own 404 page.
|
|
*/
|
|
describe("the routes the protocols service owns", () => {
|
|
const proxy = readFileSync(
|
|
resolve(process.cwd(), "src/app/api/v1/[...path]/route.ts"),
|
|
"utf8",
|
|
);
|
|
|
|
// Each of these is served by protocols because that process holds something
|
|
// the auth service does not.
|
|
it.each(["dkim", "tls", "dns", "bimi"])("routes /admin/%s to protocols", (area) => {
|
|
expect(proxy).toMatch(new RegExp(`PROTOCOLS_ADMIN_AREAS[\\s\\S]{0,120}"${area}"`));
|
|
});
|
|
|
|
// Fetched by receiving mail providers evaluating a message. They hold no
|
|
// session, so this one has to be reachable without any.
|
|
it("routes the BIMI logo to the service that stores it", () => {
|
|
expect(config).toContain("/.well-known/bimi/default.svg");
|
|
expect(config).toMatch(/bimi\/default\.svg[\s\S]{0,200}PROTOCOLS_SERVICE_URL/);
|
|
});
|
|
|
|
// The a= tag of the BIMI record points here when the certificate is held by
|
|
// the service; without the rewrite the Next 404 page is served instead, and
|
|
// the receiver sees a record whose certificate cannot be fetched.
|
|
it("routes the BIMI certificate to the service that stores it", () => {
|
|
expect(config).toContain("/.well-known/bimi/vmc.pem");
|
|
expect(config).toMatch(/bimi\/vmc\.pem[\s\S]{0,200}PROTOCOLS_SERVICE_URL/);
|
|
});
|
|
|
|
// Each domain's record names its own logo and certificate under its own name.
|
|
// Without these rewrites only the host's primary domain had a logo that could
|
|
// be fetched; every other domain's record pointed at a 404.
|
|
it("routes the per-domain BIMI logo and certificate to the service", () => {
|
|
expect(config).toMatch(/bimi\/:domain\/default\.svg[\s\S]{0,200}PROTOCOLS_SERVICE_URL[^\n]*:domain\/default\.svg/);
|
|
expect(config).toMatch(/bimi\/:domain\/vmc\.pem[\s\S]{0,200}PROTOCOLS_SERVICE_URL[^\n]*:domain\/vmc\.pem/);
|
|
});
|
|
});
|