ac/ac-deploy
1
0
Fork 0
mirror of git://f0xx.org/ac/ac-deploy synced 2026-07-29 05:59:05 +03:00
Code Issues Packages Projects Releases Wiki Activity

cluster0: fix secrets MAIL_FROM parsing; normalize RFC5322 From in compose

Browse Source 
load_secrets_lab quotes values safely; compose reads MAIL_FROM via read_secret.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Anton Afanasyeu
2026-06-23 20:14:27 +02:00
parent 62ba6aa615
commit 5b16848366
4 changed files with 125 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

105
sim/cluster0/lab-seeds/backend/src/AuthMailer.php
View File

@@ -16,7 +16,8 @@ final class AuthMailer {
array $attachments = [],
?string $bodyHtml = null
): bool {
$from = (string) cfg('mail.from', 'Android Cast <noreply@apps.f0xx.org>');
$smtpUser = (string) cfg('mail.smtp.username', '');
$from = self::resolveFromAddress($smtpUser);
$replyTo = (string) cfg('mail.reply_to', '');
$transport = strtolower((string) cfg('mail.transport', 'smtp'));
if ($transport === 'sendmail') {
@@ -45,22 +46,37 @@ final class AuthMailer {
}
}
$body = "Open this link to verify your email (valid 24h):\n\n"
. $shortUrl . "\n\n";
$bodyHtml = null;
. $shortUrl . "\n";
if ($qrImageUrl !== null) {
$body .= "Or scan the QR code on your phone — open this image URL:\n"
$body .= "\nOr scan the QR code on your phone — open this image URL:\n"
. $qrImageUrl . "\n";
$escUrl = htmlspecialchars($shortUrl, ENT_QUOTES | ENT_HTML5, 'UTF-8');
$escQr = htmlspecialchars($qrImageUrl, ENT_QUOTES | ENT_HTML5, 'UTF-8');
$bodyHtml = '<!DOCTYPE html><html><body style="font-family:sans-serif;line-height:1.5">'
. '<p>Open this link to verify your email (valid 24h):</p>'
. '<p><a href="' . $escUrl . '">' . $escUrl . '</a></p>'
. '<p>Or scan this QR code on your phone:</p>'
. '<p><img src="' . $escQr . '" alt="Verify email QR code" width="256" height="256"></p>'
. '</body></html>';
}
// Hosted QR image (no PNG attachment) — Gmail blocks short-link + attachment as phishing.
return self::send($to, $subject, $body, [], $bodyHtml);
// Plain text only — Gmail relay flags multipart HTML + short links + remote QR images.
return self::send($to, $subject, $body);
}
private static function resolveFromAddress(string $smtpUser): string {
$from = (string) cfg('mail.from', 'Android Cast <noreply@apps.f0xx.org>');
$host = strtolower((string) cfg('mail.smtp.host', ''));
if ($host === 'smtp.gmail.com' && $smtpUser !== '') {
return $smtpUser;
}
return self::normalizeFrom($from, $smtpUser);
}
private static function normalizeFrom(string $from, string $smtpUser = ''): string {
if (preg_match('/<[^>]+>/', trim($from))) {
return trim($from);
}
if (preg_match('/\S+@\S+/', $from, $m)) {
$email = $m[0];
$name = trim(str_replace($email, '', $from));
return $name !== '' ? "{$name} <{$email}>" : $email;
}
if ($smtpUser !== '' && str_contains($smtpUser, '@')) {
return $smtpUser;
}
return trim($from);
}
/**
@@ -119,7 +135,16 @@ final class AuthMailer {
fclose($fp);
return false;
}
$ehloHost = 'localhost';
$ehloHost = (string) cfg('mail.smtp.ehlo', '');
if ($ehloHost === '') {
$ehloHost = php_uname('n') ?: 'localhost';
if ($ehloHost === 'localhost' || !str_contains($ehloHost, '.')) {
$origin = (string) cfg('public_origin', '');
if ($origin !== '' && ($host = parse_url($origin, PHP_URL_HOST))) {
$ehloHost = (string) $host;
}
}
}
fwrite($fp, "EHLO {$ehloHost}\r\n");
if (!self::smtpExpect($fp, [250])) {
fclose($fp);
@@ -175,18 +200,7 @@ final class AuthMailer {
return false;
}
$payload = self::buildMessageBody($body, $attachments, $bodyHtml);
$msg = "From: {$from}\r\n";
if ($replyTo !== '') {
$msg .= "Reply-To: {$replyTo}\r\n";
}
$msg .= "To: {$to}\r\nSubject: {$subject}\r\n";
if ($payload['mime'] === null) {
$msg .= "Content-Type: text/plain; charset=UTF-8\r\n\r\n{$body}\r\n.\r\n";
} else {
$msg .= "MIME-Version: 1.0\r\n";
$msg .= 'Content-Type: ' . $payload['mime'] . '; boundary="' . $payload['boundary'] . "\"\r\n\r\n";
$msg .= $payload['body'] . "\r\n.\r\n";
}
$msg = self::buildSmtpHeaders($from, $to, $replyTo, $subject, $payload);
fwrite($fp, $msg);
if (!self::smtpExpect($fp, [250])) {
fclose($fp);
@@ -197,6 +211,43 @@ final class AuthMailer {
return true;
}
/**
* @param array{mime:?string,boundary:?string,body:string} $payload
*/
private static function buildSmtpHeaders(
string $from,
string $to,
string $replyTo,
string $subject,
array $payload
): string {
$msg = 'Date: ' . gmdate('D, d M Y H:i:s') . " +0000\r\n";
$msg .= 'Message-ID: <' . bin2hex(random_bytes(16)) . '@androidcast.local>' . "\r\n";
$msg .= "From: {$from}\r\n";
if ($replyTo !== '') {
$msg .= "Reply-To: {$replyTo}\r\n";
}
$msg .= "To: {$to}\r\n";
$msg .= 'Subject: ' . self::encodeHeader($subject) . "\r\n";
$msg .= "MIME-Version: 1.0\r\n";
if ($payload['mime'] === null) {
$msg .= "Content-Type: text/plain; charset=UTF-8\r\n";
$msg .= "Content-Transfer-Encoding: 8bit\r\n\r\n";
$msg .= $payload['body'] . "\r\n.\r\n";
return $msg;
}
$msg .= 'Content-Type: ' . $payload['mime'] . '; boundary="' . $payload['boundary'] . "\"\r\n\r\n";
$msg .= $payload['body'] . "\r\n.\r\n";
return $msg;
}
private static function encodeHeader(string $value): string {
if (preg_match('/^[\x20-\x7E]*$/', $value)) {
return $value;
}
return '=?UTF-8?B?' . base64_encode($value) . '?=';
}
/**
* @param list<array{name:string,data:string,type:string}> $attachments
* @return array{mime:?string,boundary:?string,body:string}