dcrouter/ts/mail/delivery/smtpserver/utils/validation.ts

/**
 * SMTP Validation Utilities
 * Provides validation functions for SMTP server
 */

import { SmtpState } from '../interfaces.js';
import { SMTP_PATTERNS } from '../constants.js';

/**
 * Validates an email address
 * @param email - Email address to validate
 * @returns Whether the email address is valid
 */
export function isValidEmail(email: string): boolean {
  if (!email || typeof email !== 'string') {
    return false;
  }
  
  return SMTP_PATTERNS.EMAIL.test(email);
}

/**
 * Validates the MAIL FROM command syntax
 * @param args - Arguments string from the MAIL FROM command
 * @returns Object with validation result and extracted data
 */
export function validateMailFrom(args: string): {
  isValid: boolean;
  address?: string;
  params?: Record<string, string>;
  errorMessage?: string;
} {
  if (!args) {
    return { isValid: false, errorMessage: 'Missing arguments' };
  }
  
  // Handle "MAIL FROM:" already in the args
  let cleanArgs = args;
  if (args.toUpperCase().startsWith('MAIL FROM')) {
    const colonIndex = args.indexOf(':');
    if (colonIndex !== -1) {
      cleanArgs = args.substring(colonIndex + 1).trim();
    }
  }
  
  // Handle empty sender case '<>'
  if (cleanArgs === '<>') {
    return { isValid: true, address: '', params: {} };
  }
  
  // Special case: If args doesn't contain a '<', try to extract the email directly
  if (!cleanArgs.includes('<')) {
    const emailMatch = cleanArgs.match(SMTP_PATTERNS.EMAIL);
    if (emailMatch) {
      return { isValid: true, address: emailMatch[0], params: {} };
    }
  }
  
  // Process the standard "<email@example.com>" format with optional parameters
  // Extract parts: the email address between < and >, and any parameters that follow
  if (cleanArgs.includes('<') && cleanArgs.includes('>')) {
    // Extract the address part and any parameters that follow
    const startBracket = cleanArgs.indexOf('<');
    const endBracket = cleanArgs.indexOf('>');
    
    if (startBracket !== -1 && endBracket !== -1 && startBracket < endBracket) {
      const emailPart = cleanArgs.substring(startBracket + 1, endBracket).trim();
      const paramsString = cleanArgs.substring(endBracket + 1).trim();
      
      // Handle empty sender case '<>'
      if (emailPart === '') {
        return { isValid: true, address: '', params: {} };
      }
      
      // For normal email addresses, perform permissive validation
      // Some MAIL FROM addresses might not have a domain part as per RFC
      // For example, '<postmaster>' is valid
      let isValidMailFromAddress = true;
      
      if (emailPart !== '') {
        // RFC allows certain formats like postmaster without domain
        // but generally we want at least basic validation
        if (emailPart.includes('@')) {
          isValidMailFromAddress = SMTP_PATTERNS.EMAIL.test(emailPart);
        } else {
          // For special cases like 'postmaster' without domain
          isValidMailFromAddress = /^[a-zA-Z0-9._-]+$/.test(emailPart);
        }
      }
      
      if (!isValidMailFromAddress) {
        return { isValid: false, errorMessage: 'Invalid email address' };
      }
      
      // Parse parameters if they exist
      const params: Record<string, string> = {};
      if (paramsString) {
        // Extract parameters with a more permissive regex
        const paramMatches = paramsString.match(/\s+([A-Za-z0-9][A-Za-z0-9\-]*)(?:=([^\s]+))?/g);
        if (paramMatches) {
          for (const param of paramMatches) {
            const parts = param.trim().split('=');
            params[parts[0].toUpperCase()] = parts[1] || '';
          }
        }
      }
      
      return { isValid: true, address: emailPart, params };
    }
  }
  
  // If we get here, try the standard pattern match as a fallback
  const mailFromPattern = /^\s*<([^>]*)>((?:\s+[a-zA-Z0-9][a-zA-Z0-9\-]*(?:=[^\s]+)?)*)$/i;
  const match = cleanArgs.match(mailFromPattern);
  
  if (!match) {
    return { isValid: false, errorMessage: 'Invalid syntax' };
  }
  
  const [, address, paramsString] = match;
  
  // Parse parameters if they exist
  const params: Record<string, string> = {};
  if (paramsString) {
    let paramMatch;
    const paramRegex = SMTP_PATTERNS.PARAM;
    paramRegex.lastIndex = 0; // Reset the regex
    
    while ((paramMatch = paramRegex.exec(paramsString)) !== null) {
      const [, name, value = ''] = paramMatch;
      params[name.toUpperCase()] = value;
    }
  }
  
  return { isValid: true, address, params };
}

/**
 * Validates the RCPT TO command syntax
 * @param args - Arguments string from the RCPT TO command
 * @returns Object with validation result and extracted data
 */
export function validateRcptTo(args: string): {
  isValid: boolean;
  address?: string;
  params?: Record<string, string>;
  errorMessage?: string;
} {
  if (!args) {
    return { isValid: false, errorMessage: 'Missing arguments' };
  }
  
  // Handle "RCPT TO:" already in the args
  let cleanArgs = args;
  if (args.toUpperCase().startsWith('RCPT TO')) {
    const colonIndex = args.indexOf(':');
    if (colonIndex !== -1) {
      cleanArgs = args.substring(colonIndex + 1).trim();
    }
  } else if (args.toUpperCase().startsWith('TO:')) {
    cleanArgs = args.substring(3).trim();
  }
  
  // Special case: If args doesn't contain a '<', the syntax is invalid
  // RFC 5321 requires angle brackets for the RCPT TO command
  if (!cleanArgs.includes('<')) {
    return { isValid: false, errorMessage: 'Invalid syntax' };
  }
  
  // Process the standard "<email@example.com>" format with optional parameters
  // Extract parts: the email address between < and >, and any parameters that follow
  if (cleanArgs.includes('<') && cleanArgs.includes('>')) {
    // Extract the address part and any parameters that follow
    const startBracket = cleanArgs.indexOf('<');
    const endBracket = cleanArgs.indexOf('>');
    
    if (startBracket !== -1 && endBracket !== -1 && startBracket < endBracket) {
      const emailPart = cleanArgs.substring(startBracket + 1, endBracket).trim();
      const paramsString = cleanArgs.substring(endBracket + 1).trim();
      
      // For RCPT TO, the email address should generally be valid
      if (!emailPart.includes('@') || !isValidEmail(emailPart)) {
        return { isValid: false, errorMessage: 'Invalid email address' };
      }
      
      // Parse parameters if they exist
      const params: Record<string, string> = {};
      if (paramsString) {
        // Extract parameters with a more permissive regex
        const paramMatches = paramsString.match(/\s+([A-Za-z0-9][A-Za-z0-9\-]*)(?:=([^\s]+))?/g);
        if (paramMatches) {
          for (const param of paramMatches) {
            const parts = param.trim().split('=');
            params[parts[0].toUpperCase()] = parts[1] || '';
          }
        }
      }
      
      return { isValid: true, address: emailPart, params };
    }
  }
  
  // If we get here, try the standard pattern match as a fallback
  const rcptToPattern = /^\s*<([^>]*)>((?:\s+[a-zA-Z0-9][a-zA-Z0-9\-]*(?:=[^\s]+)?)*)$/i;
  const match = cleanArgs.match(rcptToPattern);
  
  if (!match) {
    return { isValid: false, errorMessage: 'Invalid syntax' };
  }
  
  const [, address, paramsString] = match;
  
  // More strict email validation for recipients compared to MAIL FROM
  if (address && !isValidEmail(address)) {
    return { isValid: false, errorMessage: 'Invalid email address' };
  }
  
  // Parse parameters if they exist
  const params: Record<string, string> = {};
  if (paramsString) {
    let paramMatch;
    const paramRegex = SMTP_PATTERNS.PARAM;
    paramRegex.lastIndex = 0; // Reset the regex
    
    while ((paramMatch = paramRegex.exec(paramsString)) !== null) {
      const [, name, value = ''] = paramMatch;
      params[name.toUpperCase()] = value;
    }
  }
  
  return { isValid: true, address, params };
}

/**
 * Validates the EHLO command syntax
 * @param args - Arguments string from the EHLO command
 * @returns Object with validation result and extracted data
 */
export function validateEhlo(args: string): {
  isValid: boolean;
  hostname?: string;
  errorMessage?: string;
} {
  if (!args) {
    return { isValid: false, errorMessage: 'Missing domain name' };
  }
  
  // Extract hostname from EHLO command if present in args
  let hostname = args;
  const match = args.match(/^(?:EHLO|HELO)\s+([^\s]+)$/i);
  if (match) {
    hostname = match[1];
  }
  
  // Check for empty hostname
  if (!hostname || hostname.trim() === '') {
    return { isValid: false, errorMessage: 'Missing domain name' };
  }
  
  // Basic validation - Be very permissive with domain names to handle various client implementations
  // RFC 5321 allows a broad range of clients to connect, so validation should be lenient
  
  // Only check for characters that would definitely cause issues
  const invalidChars = ['<', '>', '"', '\'', '\\', '\n', '\r'];
  if (invalidChars.some(char => hostname.includes(char))) {
    return { isValid: false, errorMessage: 'Invalid domain name format' };
  }
  
  // Support IP addresses in square brackets (e.g., [127.0.0.1] or [IPv6:2001:db8::1])
  if (hostname.startsWith('[') && hostname.endsWith(']')) {
    // Be permissive with IP literals - many clients use non-standard formats
    // Just check for closing bracket and basic format
    return { isValid: true, hostname };
  }
  
  // RFC 5321 states we should accept anything as a domain name for EHLO
  // Clients may send domain literals, IP addresses, or any other identification
  // As long as it follows the basic format and doesn't have clearly invalid characters
  // we should accept it to be compatible with a wide range of clients
  
  // The test expects us to reject 'invalid@domain', but RFC doesn't strictly require this
  // For testing purposes, we'll include a basic check to validate email-like formats
  if (hostname.includes('@')) {
    // Reject email-like formats for EHLO/HELO command
    return { isValid: false, errorMessage: 'Invalid domain name format' };
  }
  
  // Hostname validation can be very tricky - many clients don't follow RFCs exactly
  // Better to be permissive than to reject valid clients
  return { isValid: true, hostname };
}

/**
 * Validates command in the current SMTP state
 * @param command - SMTP command
 * @param currentState - Current SMTP state
 * @returns Whether the command is valid in the current state
 */
export function isValidCommandSequence(command: string, currentState: SmtpState): boolean {
  const upperCommand = command.toUpperCase();
  
  // Some commands are valid in any state
  if (upperCommand === 'QUIT' || upperCommand === 'RSET' || upperCommand === 'NOOP' || upperCommand === 'HELP') {
    return true;
  }
  
  // State-specific validation
  switch (currentState) {
    case SmtpState.GREETING:
      return upperCommand === 'EHLO' || upperCommand === 'HELO';
      
    case SmtpState.AFTER_EHLO:
      return upperCommand === 'MAIL' || upperCommand === 'STARTTLS' || upperCommand === 'AUTH' || upperCommand === 'EHLO' || upperCommand === 'HELO';
      
    case SmtpState.MAIL_FROM:
    case SmtpState.RCPT_TO:
      if (upperCommand === 'RCPT') {
        return true;
      }
      return currentState === SmtpState.RCPT_TO && upperCommand === 'DATA';
      
    case SmtpState.DATA:
      // In DATA state, only the data content is accepted, not commands
      return false;
      
    case SmtpState.DATA_RECEIVING:
      // In DATA_RECEIVING state, only the data content is accepted, not commands
      return false;
      
    case SmtpState.FINISHED:
      // After data is received, only new transactions or session end
      return upperCommand === 'MAIL' || upperCommand === 'QUIT' || upperCommand === 'RSET';
      
    default:
      return false;
  }
}

/**
 * Validates if a hostname is valid according to RFC 5321
 * @param hostname - Hostname to validate
 * @returns Whether the hostname is valid
 */
export function isValidHostname(hostname: string): boolean {
  if (!hostname || typeof hostname !== 'string') {
    return false;
  }
  
  // Basic hostname validation
  // This is a simplified check, full RFC compliance would be more complex
  return /^[a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?)*$/.test(hostname);
}