openmail

OSS/openmail

Fork 0

Commit Graph

Author	SHA1	Message	Date
karti-ai	428040d964	Fix 13 findings from adversarial milestone-1 review Blockers in the ingest path (all funnel real mail in milestone 2): - H1: coerce body bytes to valid UTF-8 (ToValidUTF8) — non-UTF-8/mid-rune cuts no longer abort the ingest tx and drop the message. - H2: EnsurePart's recoverable parse error is non-fatal — proceed with the guaranteed-usable Part so messy real-world mail is stored, not rejected. - H3: extractBodies descends into message/rfc822 (Part.Message via SetMessageReaderAt) — forwarded/bounce bodies no longer lost. - H4: GetMessage/GetThread/GetThreadMessages scoped to inbox_id — no cross-inbox access; reply no longer a confused deputy. Hardening: - M1: /healthz no longer leaks DB error to unauthenticated callers. - M2: all DB errors funnel through handleErr; malformed UUID -> 404, dup -> 409, internal errors no longer echo the driver string. - M3: index messages(inbox_id, message_id_hdr) for thread resolution. - M4: pods UNIQUE(name) + ON CONFLICT (name) — no duplicate default pods. - L1: skip empty-User/Host addresses (no literal "@"). - L2: skip attachment-disposition parts when picking the body. - L3: case-insensitive, trimmed 'Re:' detection. Verified e2e vs Postgres 16: latin1 body stored valid UTF-8; rfc822-only body extracted; cross-inbox 404; malformed UUID 404; dup 409; threading regression OK. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-21 13:22:35 -07:00
karti-ai	551739baa3	Milestone 1 scaffold: binary skeleton, schema, deploy, Mox spike - Confirmed core bet via spike/mimecheck: mox/message parses a messy multipart message standalone (envelope, MIME tree, attachment, body) with only an io.ReaderAt — no mox store/config. Option B is viable. - cmd/openmail single binary: serve\|migrate\|smtpd\|sender\|version subcommands. - internal/api: chi router, constant-time bearer auth, /healthz, stubbed v0 AgentMail-shaped routes (501 until core services land). - internal/store: pgxpool + embedded, idempotent, tracked SQL migrations. - internal/store/migrations/0001_init.sql: full native schema (pods, inboxes, threads, messages, attachments, drafts, api_keys, webhooks, outbox, events, domains) with FTS + GIN indexes. Validated end-to-end against Postgres 16. - deploy/: docker-compose (postgres+minio+openmail+caddy), Caddyfile, DNS.md (MX/SPF/DKIM/DMARC/DANE/MTA-STS). Makefile, .gitignore. - Verified: go vet clean; build OK; health/auth smoke tests; migrate idempotent. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-21 12:16:51 -07:00

Author

SHA1

Message

Date

karti-ai

428040d964

Fix 13 findings from adversarial milestone-1 review

Blockers in the ingest path (all funnel real mail in milestone 2):
- H1: coerce body bytes to valid UTF-8 (ToValidUTF8) — non-UTF-8/mid-rune cuts
  no longer abort the ingest tx and drop the message.
- H2: EnsurePart's recoverable parse error is non-fatal — proceed with the
  guaranteed-usable Part so messy real-world mail is stored, not rejected.
- H3: extractBodies descends into message/rfc822 (Part.Message via
  SetMessageReaderAt) — forwarded/bounce bodies no longer lost.
- H4: GetMessage/GetThread/GetThreadMessages scoped to inbox_id — no cross-inbox
  access; reply no longer a confused deputy.

Hardening:
- M1: /healthz no longer leaks DB error to unauthenticated callers.
- M2: all DB errors funnel through handleErr; malformed UUID -> 404, dup -> 409,
  internal errors no longer echo the driver string.
- M3: index messages(inbox_id, message_id_hdr) for thread resolution.
- M4: pods UNIQUE(name) + ON CONFLICT (name) — no duplicate default pods.
- L1: skip empty-User/Host addresses (no literal "@").
- L2: skip attachment-disposition parts when picking the body.
- L3: case-insensitive, trimmed 'Re:' detection.

Verified e2e vs Postgres 16: latin1 body stored valid UTF-8; rfc822-only body
extracted; cross-inbox 404; malformed UUID 404; dup 409; threading regression OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-21 13:22:35 -07:00

karti-ai

551739baa3

Milestone 1 scaffold: binary skeleton, schema, deploy, Mox spike

- Confirmed core bet via spike/mimecheck: mox/message parses a messy multipart
  message standalone (envelope, MIME tree, attachment, body) with only an
  io.ReaderAt — no mox store/config. Option B is viable.
- cmd/openmail single binary: serve|migrate|smtpd|sender|version subcommands.
- internal/api: chi router, constant-time bearer auth, /healthz, stubbed v0
  AgentMail-shaped routes (501 until core services land).
- internal/store: pgxpool + embedded, idempotent, tracked SQL migrations.
- internal/store/migrations/0001_init.sql: full native schema (pods, inboxes,
  threads, messages, attachments, drafts, api_keys, webhooks, outbox, events,
  domains) with FTS + GIN indexes. Validated end-to-end against Postgres 16.
- deploy/: docker-compose (postgres+minio+openmail+caddy), Caddyfile, DNS.md
  (MX/SPF/DKIM/DMARC/DANE/MTA-STS). Makefile, .gitignore.
- Verified: go vet clean; build OK; health/auth smoke tests; migrate idempotent.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-21 12:16:51 -07:00

2 Commits