BREAKING CHANGE(smartmta): Rebrand package to @push.rocks/smartmta, add consolidated email security verification and IPC handler

ts/security/classes.ipreputationchecker.ts

@@ -2,6 +2,7 @@ import * as plugins from '../plugins.js';
 import * as paths from '../paths.js';
 import { logger } from '../logger.js';
 import { SecurityLogger, SecurityLogLevel, SecurityEventType } from './classes.securitylogger.js';
+import { RustSecurityBridge } from './classes.rustsecuritybridge.js';
 import { LRUCache } from 'lru-cache';
 
 /**
@@ -156,7 +157,7 @@ export class IPReputationChecker {
         logger.log('warn', `Invalid IP address format: ${ip}`);
         return this.createErrorResult(ip, 'Invalid IP address format');
       }
-      
+
       // Check cache first
       const cachedResult = this.reputationCache.get(ip);
       if (cachedResult) {
@@ -166,8 +167,37 @@ export class IPReputationChecker {
         });
         return cachedResult;
       }
-      
-      // Initialize empty result
+
+      // Try Rust bridge first (parallel DNSBL via tokio — faster than Node sequential DNS)
+      const bridge = RustSecurityBridge.getInstance();
+      if (bridge.running) {
+        try {
+          const rustResult = await bridge.checkIpReputation(ip);
+          const result: IReputationResult = {
+            score: rustResult.score,
+            isSpam: rustResult.listed_count > 0,
+            isProxy: rustResult.ip_type === 'proxy',
+            isTor: rustResult.ip_type === 'tor',
+            isVPN: rustResult.ip_type === 'vpn',
+            blacklists: rustResult.dnsbl_results
+              .filter(d => d.listed)
+              .map(d => d.server),
+            timestamp: Date.now(),
+          };
+          this.reputationCache.set(ip, result);
+          if (this.options.enableLocalCache) {
+            this.saveCache().catch(error => {
+              logger.log('error', `Failed to save IP reputation cache: ${error.message}`);
+            });
+          }
+          this.logReputationCheck(ip, result);
+          return result;
+        } catch (err) {
+          logger.log('warn', `Rust IP reputation check failed, falling back to TS: ${(err as Error).message}`);
+        }
+      }
+
+      // Fallback: TypeScript DNSBL implementation
       const result: IReputationResult = {
         score: 100, // Start with perfect score
         isSpam: false,
@@ -176,43 +206,43 @@ export class IPReputationChecker {
         isVPN: false,
         timestamp: Date.now()
       };
-      
+
       // Check IP against DNS blacklists if enabled
       if (this.options.enableDNSBL) {
         const dnsblResult = await this.checkDNSBL(ip);
-        
+
         // Update result with DNSBL information
         result.score -= dnsblResult.listCount * 10; // Subtract 10 points per blacklist
         result.isSpam = dnsblResult.listCount > 0;
         result.blacklists = dnsblResult.lists;
       }
-      
+
       // Get additional IP information if enabled
       if (this.options.enableIPInfo) {
         const ipInfo = await this.getIPInfo(ip);
-        
+
         // Update result with IP info
         result.country = ipInfo.country;
         result.asn = ipInfo.asn;
         result.org = ipInfo.org;
-        
+
         // Adjust score based on IP type
         if (ipInfo.type === IPType.PROXY || ipInfo.type === IPType.TOR || ipInfo.type === IPType.VPN) {
           result.score -= 30; // Subtract 30 points for proxies, Tor, VPNs
-          
+
           // Set proxy flags
           result.isProxy = ipInfo.type === IPType.PROXY;
           result.isTor = ipInfo.type === IPType.TOR;
           result.isVPN = ipInfo.type === IPType.VPN;
         }
       }
-      
+
       // Ensure score is between 0 and 100
       result.score = Math.max(0, Math.min(100, result.score));
-      
+
       // Update cache with result
       this.reputationCache.set(ip, result);
-      
+
       // Save cache if enabled
       if (this.options.enableLocalCache) {
         // Fire and forget the save operation
@@ -220,17 +250,17 @@ export class IPReputationChecker {
           logger.log('error', `Failed to save IP reputation cache: ${error.message}`);
         });
       }
-      
+
       // Log the reputation check
       this.logReputationCheck(ip, result);
-      
+
       return result;
     } catch (error) {
       logger.log('error', `Error checking IP reputation for ${ip}: ${error.message}`, {
         ip,
         stack: error.stack
       });
-      
+
       return this.createErrorResult(ip, error.message);
     }
   }

ts/security/classes.rustsecuritybridge.ts

@@ -0,0 +1,307 @@
+import * as plugins from '../plugins.js';
+import * as paths from '../paths.js';
+import { logger } from '../logger.js';
+
+// ---------------------------------------------------------------------------
+// IPC command type map — mirrors the methods in mailer-bin's management mode
+// ---------------------------------------------------------------------------
+
+interface IDkimVerificationResult {
+  is_valid: boolean;
+  domain: string | null;
+  selector: string | null;
+  status: string;
+  details: string | null;
+}
+
+interface ISpfResult {
+  result: string;
+  domain: string;
+  ip: string;
+  explanation: string | null;
+}
+
+interface IDmarcResult {
+  passed: boolean;
+  policy: string;
+  domain: string;
+  dkim_result: string;
+  spf_result: string;
+  action: string;
+  details: string | null;
+}
+
+interface IEmailSecurityResult {
+  dkim: IDkimVerificationResult[];
+  spf: ISpfResult | null;
+  dmarc: IDmarcResult | null;
+}
+
+interface IValidationResult {
+  valid: boolean;
+  formatValid: boolean;
+  score: number;
+  error: string | null;
+}
+
+interface IBounceDetection {
+  bounce_type: string;
+  severity: string;
+  category: string;
+  should_retry: boolean;
+  recommended_action: string;
+  details: string;
+}
+
+interface IReputationResult {
+  ip: string;
+  score: number;
+  risk_level: string;
+  ip_type: string;
+  dnsbl_results: Array<{ server: string; listed: boolean; response: string | null }>;
+  listed_count: number;
+  total_checked: number;
+}
+
+interface IVersionInfo {
+  bin: string;
+  core: string;
+  security: string;
+  smtp: string;
+}
+
+/**
+ * Type-safe command map for the mailer-bin IPC bridge.
+ */
+type TMailerCommands = {
+  ping: {
+    params: Record<string, never>;
+    result: { pong: boolean };
+  };
+  version: {
+    params: Record<string, never>;
+    result: IVersionInfo;
+  };
+  validateEmail: {
+    params: { email: string };
+    result: IValidationResult;
+  };
+  detectBounce: {
+    params: { smtpResponse?: string; diagnosticCode?: string; statusCode?: string };
+    result: IBounceDetection;
+  };
+  checkIpReputation: {
+    params: { ip: string };
+    result: IReputationResult;
+  };
+  verifyDkim: {
+    params: { rawMessage: string };
+    result: IDkimVerificationResult[];
+  };
+  signDkim: {
+    params: { rawMessage: string; domain: string; selector?: string; privateKey: string };
+    result: { header: string; signedMessage: string };
+  };
+  checkSpf: {
+    params: { ip: string; heloDomain: string; hostname?: string; mailFrom: string };
+    result: ISpfResult;
+  };
+  verifyEmail: {
+    params: {
+      rawMessage: string;
+      ip: string;
+      heloDomain: string;
+      hostname?: string;
+      mailFrom: string;
+    };
+    result: IEmailSecurityResult;
+  };
+};
+
+// ---------------------------------------------------------------------------
+// RustSecurityBridge — singleton wrapper around smartrust.RustBridge
+// ---------------------------------------------------------------------------
+
+/**
+ * Bridge between TypeScript and the Rust `mailer-bin` binary.
+ *
+ * Uses `@push.rocks/smartrust` for JSON-over-stdin/stdout IPC.
+ * Singleton — access via `RustSecurityBridge.getInstance()`.
+ */
+export class RustSecurityBridge {
+  private static instance: RustSecurityBridge | null = null;
+
+  private bridge: InstanceType<typeof plugins.smartrust.RustBridge<TMailerCommands>>;
+  private _running = false;
+
+  private constructor() {
+    this.bridge = new plugins.smartrust.RustBridge<TMailerCommands>({
+      binaryName: 'mailer-bin',
+      cliArgs: ['--management'],
+      requestTimeoutMs: 30_000,
+      readyTimeoutMs: 10_000,
+      localPaths: [
+        plugins.path.join(paths.packageDir, 'dist_rust', 'mailer-bin'),
+        plugins.path.join(paths.packageDir, 'rust', 'target', 'release', 'mailer-bin'),
+        plugins.path.join(paths.packageDir, 'rust', 'target', 'debug', 'mailer-bin'),
+      ],
+      searchSystemPath: false,
+    });
+
+    // Forward lifecycle events
+    this.bridge.on('ready', () => {
+      this._running = true;
+      logger.log('info', 'Rust security bridge is ready');
+    });
+
+    this.bridge.on('exit', (code: number | null, signal: string | null) => {
+      this._running = false;
+      logger.log('warn', `Rust security bridge exited (code=${code}, signal=${signal})`);
+    });
+
+    this.bridge.on('stderr', (line: string) => {
+      logger.log('debug', `[rust-bridge] ${line}`);
+    });
+  }
+
+  /** Get or create the singleton instance. */
+  public static getInstance(): RustSecurityBridge {
+    if (!RustSecurityBridge.instance) {
+      RustSecurityBridge.instance = new RustSecurityBridge();
+    }
+    return RustSecurityBridge.instance;
+  }
+
+  /** Whether the Rust process is currently running and accepting commands. */
+  public get running(): boolean {
+    return this._running;
+  }
+
+  // -----------------------------------------------------------------------
+  // Lifecycle
+  // -----------------------------------------------------------------------
+
+  /**
+   * Spawn the Rust binary and wait for the ready signal.
+   * @returns `true` if the binary started successfully, `false` otherwise.
+   */
+  public async start(): Promise<boolean> {
+    if (this._running) {
+      return true;
+    }
+    try {
+      const ok = await this.bridge.spawn();
+      this._running = ok;
+      if (ok) {
+        logger.log('info', 'Rust security bridge started');
+      } else {
+        logger.log('warn', 'Rust security bridge failed to start (binary not found or timeout)');
+      }
+      return ok;
+    } catch (err) {
+      logger.log('error', `Failed to start Rust security bridge: ${(err as Error).message}`);
+      return false;
+    }
+  }
+
+  /** Kill the Rust process. */
+  public async stop(): Promise<void> {
+    if (!this._running) {
+      return;
+    }
+    try {
+      this.bridge.kill();
+      this._running = false;
+      logger.log('info', 'Rust security bridge stopped');
+    } catch (err) {
+      logger.log('error', `Error stopping Rust security bridge: ${(err as Error).message}`);
+    }
+  }
+
+  // -----------------------------------------------------------------------
+  // Commands — thin typed wrappers over sendCommand
+  // -----------------------------------------------------------------------
+
+  /** Ping the Rust process. */
+  public async ping(): Promise<boolean> {
+    const res = await this.bridge.sendCommand('ping', {} as any);
+    return res?.pong === true;
+  }
+
+  /** Get version information for all Rust crates. */
+  public async getVersion(): Promise<IVersionInfo> {
+    return this.bridge.sendCommand('version', {} as any);
+  }
+
+  /** Validate an email address. */
+  public async validateEmail(email: string): Promise<IValidationResult> {
+    return this.bridge.sendCommand('validateEmail', { email });
+  }
+
+  /** Detect bounce type from SMTP response / diagnostic code. */
+  public async detectBounce(opts: {
+    smtpResponse?: string;
+    diagnosticCode?: string;
+    statusCode?: string;
+  }): Promise<IBounceDetection> {
+    return this.bridge.sendCommand('detectBounce', opts);
+  }
+
+  /** Check IP reputation via DNSBL. */
+  public async checkIpReputation(ip: string): Promise<IReputationResult> {
+    return this.bridge.sendCommand('checkIpReputation', { ip });
+  }
+
+  /** Verify DKIM signatures on a raw email message. */
+  public async verifyDkim(rawMessage: string): Promise<IDkimVerificationResult[]> {
+    return this.bridge.sendCommand('verifyDkim', { rawMessage });
+  }
+
+  /** Sign an email with DKIM. */
+  public async signDkim(opts: {
+    rawMessage: string;
+    domain: string;
+    selector?: string;
+    privateKey: string;
+  }): Promise<{ header: string; signedMessage: string }> {
+    return this.bridge.sendCommand('signDkim', opts);
+  }
+
+  /** Check SPF for a sender. */
+  public async checkSpf(opts: {
+    ip: string;
+    heloDomain: string;
+    hostname?: string;
+    mailFrom: string;
+  }): Promise<ISpfResult> {
+    return this.bridge.sendCommand('checkSpf', opts);
+  }
+
+  /**
+   * Compound email security verification: DKIM + SPF + DMARC in one IPC call.
+   *
+   * This is the preferred method for inbound email verification — it avoids
+   * 3 sequential round-trips and correctly passes raw mail-auth types internally.
+   */
+  public async verifyEmail(opts: {
+    rawMessage: string;
+    ip: string;
+    heloDomain: string;
+    hostname?: string;
+    mailFrom: string;
+  }): Promise<IEmailSecurityResult> {
+    return this.bridge.sendCommand('verifyEmail', opts);
+  }
+}
+
+// Re-export interfaces for consumers
+export type {
+  IDkimVerificationResult,
+  ISpfResult,
+  IDmarcResult,
+  IEmailSecurityResult,
+  IValidationResult,
+  IBounceDetection,
+  IReputationResult as IRustReputationResult,
+  IVersionInfo,
+};

ts/security/index.ts

@@ -18,4 +18,16 @@ export {
   ThreatCategory,
   type IScanResult,
   type IContentScannerOptions
-} from './classes.contentscanner.js';
+} from './classes.contentscanner.js';
+
+export {
+  RustSecurityBridge,
+  type IDkimVerificationResult,
+  type ISpfResult,
+  type IDmarcResult,
+  type IEmailSecurityResult,
+  type IValidationResult,
+  type IBounceDetection,
+  type IRustReputationResult,
+  type IVersionInfo,
+} from './classes.rustsecuritybridge.js';