Release Mail Tools 0.1.0

tests/core/mime.test.ts

@@ -0,0 +1,94 @@
+import { describe, expect, it } from "vitest";
+import {
+  attachments,
+  decodeHeaderValue,
+  parseHeaders,
+  parseMessage,
+  walkParts,
+} from "../../src/core/mime";
+
+const MULTIPART = `From: =?UTF-8?Q?Ada_=E2=9C=93?= <ada@example.test>\r
+Subject: folded\r
+ value\r
+MIME-Version: 1.0\r
+Content-Type: multipart/mixed; boundary="b"\r
+\r
+--b\r
+Content-Type: text/plain; charset=utf-8\r
+Content-Transfer-Encoding: quoted-printable\r
+\r
+hello=20world\r
+--b\r
+Content-Type: application/octet-stream\r
+Content-Disposition: attachment; filename*=UTF-8''report%20one.txt\r
+Content-Transfer-Encoding: base64\r
+\r
+YWJj\r
+--b--`;
+
+describe("MIME parser", () => {
+  it("unfolds fields and decodes RFC 2047 words", () => {
+    const headers = parseHeaders(
+      "Subject: =?UTF-8?Q?Hello_=E2=9C=93?=\r\n\tworld",
+    );
+    expect(headers[0]?.value).toBe("Hello ✓ world");
+    expect(decodeHeaderValue("=?ISO-8859-1?Q?Andr=E9?=")).toBe("André");
+    expect(decodeHeaderValue("=?UTF-8?Q?joined?=   =?UTF-8?Q?_words?=")).toBe(
+      "joined words",
+    );
+  });
+
+  it("builds nested parts and decodes transfer encodings", () => {
+    const parsed = parseMessage(MULTIPART);
+    expect(walkParts(parsed.root).map((part) => part.mediaType)).toEqual([
+      "multipart/mixed",
+      "text/plain",
+      "application/octet-stream",
+    ]);
+    expect(parsed.root.children[0]?.text).toBe("hello world");
+    expect([...parsed.root.children[1]!.bytes]).toEqual([97, 98, 99]);
+    expect(attachments(parsed.root)[0]).toMatchObject({
+      filename: "report one.txt",
+      size: 3,
+    });
+  });
+
+  it("parses nested message/rfc822 entities", () => {
+    const parsed = parseMessage(
+      "From: a@example.test\nContent-Type: message/rfc822\n\nFrom: b@example.test\nContent-Type: text/plain\n\nnested",
+    );
+    expect(parsed.root.children[0]?.text).toBe("nested");
+  });
+
+  it("decodes and exposes transferred message attachments", () => {
+    const nested = btoa(
+      "From: b@example.test\r\nContent-Type: text/plain\r\n\r\nnested",
+    );
+    const parsed = parseMessage(
+      `From: a@example.test\nContent-Type: message/rfc822; name="forwarded.eml"\nContent-Disposition: attachment; filename="forwarded.eml"\nContent-Transfer-Encoding: base64\n\n${nested}`,
+    );
+    expect(parsed.root.children[0]?.text).toBe("nested");
+    expect(attachments(parsed.root)[0]).toMatchObject({
+      filename: "forwarded.eml",
+    });
+    expect(attachments(parsed.root)[0]?.size).toBeGreaterThan(0);
+  });
+
+  it("fails closed for malformed and excessive structures", () => {
+    expect(() => parseMessage("Bad header\n\nbody")).toThrow(
+      /malformed header/iu,
+    );
+    expect(() =>
+      parseMessage("Content-Type: multipart/mixed; boundary=x\n\nnone"),
+    ).toThrow(/boundary/iu);
+    expect(() =>
+      parseMessage("From: a@example.test\n\n12345", {
+        maxChars: 4,
+        maxHeaders: 2,
+        maxParts: 2,
+        maxDepth: 2,
+        maxDecodedBytes: 8,
+      }),
+    ).toThrow(/limit/iu);
+  });
+});

tests/core/security-export.test.ts

@@ -0,0 +1,60 @@
+import { describe, expect, it } from "vitest";
+import { compareBodies } from "../../src/core/compare";
+import { diagnoseMessage } from "../../src/core/diagnostics";
+import { canonicalMessage, redactMessage } from "../../src/core/export";
+import { parseMessage } from "../../src/core/mime";
+import { sanitizeMailHtml } from "../../src/core/sanitize";
+
+describe("inert rendering and output", () => {
+  it("removes active and remote HTML while embedding a deny-all policy", () => {
+    const output = sanitizeMailHtml(
+      '<script>alert(1)</script><a href="https://bad.test">link</a><img src="https://bad.test/pixel"><p style="background:url(https://bad.test)">safe</p>',
+    );
+    expect(output).toContain("default-src 'none'");
+    expect(output).toContain("safe");
+    expect(output).not.toMatch(
+      /bad\.test|script|href=|src=|style="background/iu,
+    );
+  });
+
+  it("produces a bounded line comparison", () => {
+    expect(compareBodies("a\nb", "a\nc")).toMatchObject({
+      added: 1,
+      removed: 1,
+      equal: false,
+    });
+    expect(compareBodies("a\nb", "a\nb")).toMatchObject({ equal: true });
+    expect(compareBodies("a\nb\nc", "d\ne\nf", 2).truncated).toBe(true);
+  });
+
+  it("labels authentication fields as claims", () => {
+    const parsed = parseMessage(
+      "From: Ada <ada@example.test>\nDate: Tue, 01 Sep 2026 10:00:00 +0000\nAuthentication-Results: mx.test; spf=pass; dkim=fail\nDKIM-Signature: v=1; d=example.test; s=mail; a=rsa-sha256\n\nbody",
+    );
+    const diagnostics = diagnoseMessage(parsed);
+    expect(
+      diagnostics.some(
+        (item) => item.code === "auth.claim" && /spf, dkim/u.test(item.summary),
+      ),
+    ).toBe(true);
+    expect(
+      diagnostics.find((item) => item.code === "dkim.signature")?.detail,
+    ).toMatch(/not cryptographically verified/iu);
+  });
+
+  it("normalizes canonical output and reports focused redaction", () => {
+    const parsed = parseMessage(
+      "From: a@example.test\nReceived: from private.example\nAuthentication-Results: mx; spf=pass\nSubject: hello\n\nline1\nline2",
+    );
+    expect(canonicalMessage(parsed)).toContain(
+      "From: a@example.test\r\nReceived:",
+    );
+    const redacted = redactMessage(parsed);
+    expect(redacted.output).not.toMatch(/Received|Authentication-Results/iu);
+    expect(redacted.output).toContain("Subject: hello\r\n\r\nline1\r\nline2");
+    expect(JSON.parse(redacted.report)).toMatchObject({
+      operation: "mail-header-redaction",
+      retainedHeaderCount: 2,
+    });
+  });
+});