Lucas Rayan
110a240cd9
The webmail creates app passwords (shown once, stored hashed, with scopes) but the protocol servers only compared a login against mailboxes.password_hash, so an app password was always refused with 535 / authentication failed. They exist because mail clients cannot do a second factor. - port.MailboxAuth carries the mailbox's app passwords (newest 20) with their scopes; the Postgres repository loads them and stamps last_used_at on use - verifyCredential accepts the mailbox password or an app password that holds the scope of the protocol; SMTP, IMAP and POP3 use it. ManageSieve keeps the mailbox password only, as no default scope covers it - a malformed app password hash is skipped instead of failing the login; a malformed mailbox hash still surfaces as the server-side error it was Tests: unit cases for scopes and malformed hashes, the three entry points, repository tests against Postgres, and an end-to-end test on the real submission server that fails with 535 without the fix and passes with it. Full `go test ./...` with TEST_DATABASE_URL, go vet and lang-lint are clean.
75 lines
1.9 KiB
Go
75 lines
1.9 KiB
Go
package postgres
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/google/uuid"
|
|
"github.com/jackc/pgx/v5"
|
|
"github.com/jackc/pgx/v5/pgxpool"
|
|
|
|
"lambdamail/protocols/internal/application/port"
|
|
)
|
|
|
|
// AuthRepository implements port.AuthRepository against Postgres.
|
|
type AuthRepository struct {
|
|
pool *pgxpool.Pool
|
|
}
|
|
|
|
func NewAuthRepository(pool *pgxpool.Pool) *AuthRepository {
|
|
return &AuthRepository{pool: pool}
|
|
}
|
|
|
|
func (r *AuthRepository) FindByAddress(ctx context.Context, address string) (*port.MailboxAuth, error) {
|
|
row := r.pool.QueryRow(ctx, `
|
|
SELECT m.id, m.password_hash, m.email_address, d.name, m.max_recipients_per_hour
|
|
FROM mailboxes m
|
|
JOIN domains d ON d.id = m.domain_id
|
|
WHERE m.email_address = $1
|
|
AND m.is_active = true
|
|
AND d.is_active = true
|
|
`, address)
|
|
|
|
var rec port.MailboxAuth
|
|
var id uuid.UUID
|
|
if err := row.Scan(&id, &rec.PasswordHash, &rec.EmailAddress, &rec.DomainName, &rec.MaxRecipientsPerHour); err != nil {
|
|
if err == pgx.ErrNoRows {
|
|
return nil, nil
|
|
}
|
|
return nil, err
|
|
}
|
|
rec.ID = id
|
|
|
|
// The newest few only: each one costs an Argon2 comparison on a failed login,
|
|
// so the number considered is bounded.
|
|
rows, err := r.pool.Query(ctx, `
|
|
SELECT id, password_hash, scopes
|
|
FROM app_passwords
|
|
WHERE mailbox_id = $1
|
|
ORDER BY created_at DESC
|
|
LIMIT $2
|
|
`, id, port.MaxAppPasswordsChecked)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
|
|
for rows.Next() {
|
|
var app port.AppPasswordAuth
|
|
if err := rows.Scan(&app.ID, &app.Hash, &app.Scopes); err != nil {
|
|
return nil, err
|
|
}
|
|
rec.AppPasswords = append(rec.AppPasswords, app)
|
|
}
|
|
if err := rows.Err(); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return &rec, nil
|
|
}
|
|
|
|
// RecordAppPasswordUse stamps the moment an app password last signed a client in.
|
|
func (r *AuthRepository) RecordAppPasswordUse(ctx context.Context, id uuid.UUID) error {
|
|
_, err := r.pool.Exec(ctx, `UPDATE app_passwords SET last_used_at = NOW() WHERE id = $1`, id)
|
|
return err
|
|
}
|