Juergen Kunz
b82468ab1e
Phase 3 of the Rust migration: the Rust security bridge is now mandatory and all TypeScript security fallback implementations have been removed. - UnifiedEmailServer.start() throws if Rust bridge fails to start - SpfVerifier gutted to thin wrapper (parseSpfRecord stays in TS) - DKIMVerifier gutted to thin wrapper delegating to bridge.verifyDkim() - IPReputationChecker delegates to bridge.checkIpReputation(), keeps LRU cache - DmarcVerifier keeps alignment logic (works with pre-computed results) - DKIM signing via bridge.signDkim() in all 4 locations - Removed mailauth and ip packages from plugins.ts (~1,200 lines deleted)
42 lines
1.2 KiB
TypeScript
42 lines
1.2 KiB
TypeScript
import * as plugins from '../../plugins.js';
|
|
import type { UnifiedEmailServer } from '../routing/classes.unified.email.server.js';
|
|
import { RustSecurityBridge } from '../../security/classes.rustsecuritybridge.js';
|
|
|
|
interface Headers {
|
|
[key: string]: string;
|
|
}
|
|
|
|
interface IEmailSignJobOptions {
|
|
domain: string;
|
|
selector: string;
|
|
headers: Headers;
|
|
body: string;
|
|
}
|
|
|
|
export class EmailSignJob {
|
|
emailServerRef: UnifiedEmailServer;
|
|
jobOptions: IEmailSignJobOptions;
|
|
|
|
constructor(emailServerRef: UnifiedEmailServer, options: IEmailSignJobOptions) {
|
|
this.emailServerRef = emailServerRef;
|
|
this.jobOptions = options;
|
|
}
|
|
|
|
async loadPrivateKey(): Promise<string> {
|
|
const keyInfo = await this.emailServerRef.dkimCreator.readDKIMKeys(this.jobOptions.domain);
|
|
return keyInfo.privateKey;
|
|
}
|
|
|
|
public async getSignatureHeader(emailMessage: string): Promise<string> {
|
|
const privateKey = await this.loadPrivateKey();
|
|
const bridge = RustSecurityBridge.getInstance();
|
|
const signResult = await bridge.signDkim({
|
|
rawMessage: emailMessage,
|
|
domain: this.jobOptions.domain,
|
|
selector: this.jobOptions.selector,
|
|
privateKey,
|
|
});
|
|
return signResult.header;
|
|
}
|
|
}
|