feat(imap): postkasser kan læses, og det er bevist mod en rigtig server
Handlere til at forbinde, koble fra og hente nu, plus baggrundssynk hvert tiende minut ved siden af Gmails. Forbindelsen prøves FØR den gemmes: en postkasse, der blev taget imod og så fejler stille hvert tiende minut, er værre end en, der blev afvist ved døren, mens man stadig sidder med kodeordet i hånden. Ingen "set"-liste til deduplikering som Gmail har. Uid'er er monotone, så last_uid er hele svaret — og den skrives også, når budgettet løb ud, for en kørsel, der lavede opgaver og glemte hvor langt den nåede, laver dem alle igen næste gang. Rundturen køres nu mod go-imap's egen server i processen: flaget post kommer med, uflaget gør ikke, og fortsættelsen fra et uid henter kun det nyere. De hidtidige prøver dækkede de rene dele og ville alle have bestået med selve hentningen i stykker. Testen kræver et selvsigneret certifikat, og klienten nægter dem. Account.RootCAs lader en test TILFØJE tillid; der er stadig ingen måde at fjerne den på. Forskellen er en søm og ikke et hul — en prøve viser, at samme server afvises uden. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Kristian Wind
co-authored by
Claude Opus 5
Claude Opus 5
parent
1e59886d86
commit
6b4ef5b2f2
@@ -0,0 +1,183 @@
|
||||
package imap
|
||||
|
||||
import (
|
||||
"crypto/ecdsa"
|
||||
"crypto/elliptic"
|
||||
"crypto/rand"
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"crypto/x509/pkix"
|
||||
"encoding/pem"
|
||||
"math/big"
|
||||
"net"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/emersion/go-imap/v2"
|
||||
"github.com/emersion/go-imap/v2/imapserver"
|
||||
"github.com/emersion/go-imap/v2/imapserver/imapmemserver"
|
||||
)
|
||||
|
||||
// The round trip, against a real IMAP server rather than a stub of one. The
|
||||
// earlier tests cover the pure parts — what a sender renders as, where a snippet
|
||||
// is cut — and would all have passed with the fetch itself broken.
|
||||
func TestFlaggedMailComesBackAsMessages(t *testing.T) {
|
||||
addr, pool := serveMailbox(t, []mail{
|
||||
{subject: "Faktura 4711", from: "Anders Bo <anders@example.dk>", body: "Vedhæftet.", flagged: true},
|
||||
{subject: "Nyhedsbrev", from: "noreply@example.com", body: "Læs mere", flagged: false},
|
||||
{subject: "Kontrakt", from: "jura@example.dk", body: "Til underskrift", flagged: true},
|
||||
})
|
||||
|
||||
client, err := Dial(Account{
|
||||
Host: addr, Username: "kw", Password: "hemmelig", RootCAs: pool,
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
defer client.Close()
|
||||
|
||||
msgs, err := client.Since(0, 25)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
// Two of the three. The newsletter is unflagged, and flagging is the whole
|
||||
// signal: unread is a state the owner is still using.
|
||||
if len(msgs) != 2 {
|
||||
t.Fatalf("got %d messages, want the 2 flagged ones", len(msgs))
|
||||
}
|
||||
if msgs[0].Subject != "Faktura 4711" {
|
||||
t.Errorf("first subject is %q", msgs[0].Subject)
|
||||
}
|
||||
if !strings.Contains(msgs[0].From, "anders@example.dk") {
|
||||
t.Errorf("first sender is %q", msgs[0].From)
|
||||
}
|
||||
if msgs[0].UID == 0 {
|
||||
t.Error("no uid came back, so a second run would fetch everything again")
|
||||
}
|
||||
|
||||
// And reading on from a marker returns only what is newer, which is the whole
|
||||
// of the deduplication.
|
||||
rest, err := client.Since(msgs[0].UID, 25)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if len(rest) != 1 || rest[0].Subject != "Kontrakt" {
|
||||
t.Fatalf("reading on from uid %d gave %d messages", msgs[0].UID, len(rest))
|
||||
}
|
||||
}
|
||||
|
||||
func TestAWrongPasswordIsRefusedClearly(t *testing.T) {
|
||||
addr, pool := serveMailbox(t, nil)
|
||||
_, err := Dial(Account{Host: addr, Username: "kw", Password: "forkert", RootCAs: pool})
|
||||
if err == nil {
|
||||
t.Fatal("a wrong password was accepted")
|
||||
}
|
||||
// Hosts say everything from AUTHENTICATIONFAILED to a sentence about the web,
|
||||
// so the reply names the host and the user rather than repeating their words.
|
||||
if !strings.Contains(err.Error(), "kw") {
|
||||
t.Errorf("the error does not say whose login was refused: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// A certificate this process signed itself must not be enough on its own.
|
||||
func TestAnUntrustedCertificateIsRefused(t *testing.T) {
|
||||
addr, _ := serveMailbox(t, nil)
|
||||
if _, err := Dial(Account{Host: addr, Username: "kw", Password: "hemmelig"}); err == nil {
|
||||
t.Fatal("a self-signed certificate was accepted without being trusted")
|
||||
}
|
||||
}
|
||||
|
||||
type mail struct {
|
||||
subject, from, body string
|
||||
flagged bool
|
||||
}
|
||||
|
||||
// serveMailbox starts an in-process IMAP server over TLS and returns its address
|
||||
// and the pool that trusts it.
|
||||
func serveMailbox(t *testing.T, mails []mail) (string, *x509.CertPool) {
|
||||
t.Helper()
|
||||
|
||||
cert, pool := selfSigned(t)
|
||||
memServer := imapmemserver.New()
|
||||
user := imapmemserver.NewUser("kw", "hemmelig")
|
||||
if err := user.Create("INBOX", nil); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
memServer.AddUser(user)
|
||||
|
||||
for _, m := range mails {
|
||||
flags := []imap.Flag{}
|
||||
if m.flagged {
|
||||
flags = append(flags, imap.FlagFlagged)
|
||||
}
|
||||
raw := "From: " + m.from + "\r\nSubject: " + m.subject +
|
||||
"\r\nDate: Tue, 18 Aug 2026 10:00:00 +0200\r\n\r\n" + m.body + "\r\n"
|
||||
if _, err := user.Append("INBOX", strings.NewReader(raw), &imap.AppendOptions{
|
||||
Flags: flags,
|
||||
}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
|
||||
srv := imapserver.New(&imapserver.Options{
|
||||
NewSession: func(_ *imapserver.Conn) (imapserver.Session, *imapserver.GreetingData, error) {
|
||||
return memServer.NewSession(), nil, nil
|
||||
},
|
||||
TLSConfig: &tls.Config{Certificates: []tls.Certificate{cert}},
|
||||
InsecureAuth: false,
|
||||
})
|
||||
t.Cleanup(func() { srv.Close() })
|
||||
|
||||
ln, err := tls.Listen("tcp", "127.0.0.1:0", &tls.Config{Certificates: []tls.Certificate{cert}})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
go srv.Serve(ln)
|
||||
|
||||
// "localhost", not the loopback address: the certificate names a host, and the
|
||||
// client checks that name — as it should.
|
||||
_, port, _ := net.SplitHostPort(ln.Addr().String())
|
||||
return net.JoinHostPort("localhost", port), pool
|
||||
}
|
||||
|
||||
func selfSigned(t *testing.T) (tls.Certificate, *x509.CertPool) {
|
||||
t.Helper()
|
||||
|
||||
key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
template := x509.Certificate{
|
||||
SerialNumber: big.NewInt(1),
|
||||
Subject: pkix.Name{CommonName: "localhost"},
|
||||
DNSNames: []string{"localhost"},
|
||||
IPAddresses: []net.IP{net.ParseIP("127.0.0.1")},
|
||||
NotBefore: time.Now().Add(-time.Hour),
|
||||
NotAfter: time.Now().Add(time.Hour),
|
||||
KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
|
||||
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
|
||||
IsCA: true,
|
||||
BasicConstraintsValid: true,
|
||||
}
|
||||
der, err := x509.CreateCertificate(rand.Reader, &template, &template, &key.PublicKey, key)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
|
||||
keyDER, err := x509.MarshalECPrivateKey(key)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
keyPEM := pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER})
|
||||
|
||||
cert, err := tls.X509KeyPair(certPEM, keyPEM)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
pool := x509.NewCertPool()
|
||||
pool.AppendCertsFromPEM(certPEM)
|
||||
return cert, pool
|
||||
}
|
||||
Reference in New Issue
Block a user