nmemmert
17c9cbbc8b
- server/data.js: preserve source/htmlBody/inboundTo/messageId across server restarts (sanitizeLoadedContactSubmissions was silently dropping them on reload from disk) - cloudflare/email-worker.js: rewrite MIME parsing to split on the actual boundary marker instead of any literal "--", unfold multi-line headers, and correctly recombine multi-byte UTF-8 in quoted-printable decoding - server/routes/inbound-email.js: validate Message-ID against RFC 5322 grammar before storing/using it, and compare the webhook secret with timingSafeEqual to match the rest of the codebase's auth checks - server/routes/contact.js: re-validate messageId at the point it's injected into outgoing In-Reply-To/References headers; move the allowed reply-from addresses into a shared config constant - src/AdminPage.tsx: 30s inbox poll now syncs field updates (e.g. archived) on already-loaded submissions instead of only appending new ones; consolidate the duplicated from-address list - .claude/launch.json: add a vite dev server preview config used to verify these changes Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
72 lines
2.9 KiB
JavaScript
72 lines
2.9 KiB
JavaScript
import { randomUUID, timingSafeEqual } from 'node:crypto'
|
|
import { state } from '../state.js'
|
|
import { queueContactSubmissionsWrite } from '../data.js'
|
|
import { MAX_CONTACT_SUBMISSIONS } from '../config.js'
|
|
|
|
// RFC 5322 msg-id: "<" printable-ASCII-no-whitespace ">"
|
|
const MESSAGE_ID_RE = /^<[\x21-\x7E]+>$/
|
|
|
|
export function register(app) {
|
|
app.post('/api/inbound-email', (req, res) => {
|
|
const secret = process.env.INBOUND_EMAIL_SECRET
|
|
if (!secret) {
|
|
res.status(503).json({ message: 'Inbound email not configured.' }); return
|
|
}
|
|
|
|
const provided = req.get('x-webhook-secret') ?? ''
|
|
const a = Buffer.from(provided, 'utf8')
|
|
const b = Buffer.from(secret, 'utf8')
|
|
if (!provided || a.length !== b.length || !timingSafeEqual(a, b)) {
|
|
res.status(401).json({ message: 'Unauthorized.' }); return
|
|
}
|
|
|
|
const { from, to, subject, body, htmlBody, date, messageId, source } = req.body ?? {}
|
|
|
|
if (!from || typeof from !== 'string') {
|
|
res.status(400).json({ message: 'Missing from address.' }); return
|
|
}
|
|
|
|
// Extract display name and email address from "Name <email>" format
|
|
const fromMatch = /^(.*?)\s*<([^>]+)>$/.exec(from.trim())
|
|
const fromEmail = fromMatch ? fromMatch[2].trim() : from.trim()
|
|
const fromName = fromMatch ? fromMatch[1].trim() : from.trim()
|
|
|
|
const normalizedMessageId = typeof messageId === 'string' && MESSAGE_ID_RE.test(messageId.trim()) ? messageId.trim() : ''
|
|
|
|
// Deduplicate by messageId if provided
|
|
if (normalizedMessageId) {
|
|
const exists = state.contactSubmissions.some(s => s.messageId === normalizedMessageId)
|
|
if (exists) {
|
|
res.json({ ok: true, duplicate: true }); return
|
|
}
|
|
}
|
|
|
|
const submission = {
|
|
id: randomUUID(),
|
|
submittedAt: date ? new Date(date).toISOString() : new Date().toISOString(),
|
|
name: fromName || fromEmail,
|
|
email: fromEmail,
|
|
message: [subject ? `Subject: ${subject}` : '', body ?? ''].filter(Boolean).join('\n\n'),
|
|
htmlBody: typeof htmlBody === 'string' && htmlBody.trim() ? htmlBody.trim() : null,
|
|
messageType: 'general',
|
|
subscribe: false,
|
|
archived: false,
|
|
source: 'inbound-email',
|
|
inboundTo: typeof to === 'string' ? to : '',
|
|
messageId: normalizedMessageId,
|
|
emailStatus: {
|
|
welcome: { status: 'not-applicable', lastEventAt: null, lastEventType: null, resendEmailId: null, error: null },
|
|
adminNotification: { status: 'not-applicable', lastEventAt: null, lastEventType: null, resendEmailId: null, error: null },
|
|
adminReply: { status: 'pending', lastEventAt: null, lastEventType: null, resendEmailId: null, error: null },
|
|
},
|
|
}
|
|
|
|
state.contactSubmissions.unshift(submission)
|
|
state.contactSubmissions = state.contactSubmissions.slice(0, MAX_CONTACT_SUBMISSIONS)
|
|
queueContactSubmissionsWrite()
|
|
|
|
console.log(`[inbound-email] received from ${fromEmail} — subject: ${subject ?? '(none)'}`)
|
|
res.json({ ok: true })
|
|
})
|
|
}
|