22 "github.com/mjl-/mox/message"
23 "github.com/mjl-/mox/mlog"
24 "github.com/mjl-/mox/mox-"
25 "github.com/mjl-/mox/queue"
26 "github.com/mjl-/mox/store"
27 "github.com/mjl-/mox/webapi"
28 "github.com/mjl-/mox/webhook"
31var ctxbg = context.Background()
33func tcheckf(t *testing.T, err error, format string, args ...any) {
36 t.Fatalf("%s: %s", fmt.Sprintf(format, args...), err)
40func tcompare(t *testing.T, got, expect any) {
42 if !reflect.DeepEqual(got, expect) {
43 t.Fatalf("got:\n%#v\nexpected:\n%#v", got, expect)
47func terrcode(t *testing.T, err error, code string) {
50 t.Fatalf("no error, expected error with code %q", code)
52 if xerr, ok := err.(webapi.Error); !ok {
53 t.Fatalf("got %v, expected webapi error with code %q", err, code)
54 } else if xerr.Code != code {
55 t.Fatalf("got error code %q, expected %q", xerr.Code, code)
59func TestServer(t *testing.T) {
61 os.RemoveAll("../testdata/webapisrv/data")
63 mox.ConfigStaticPath = filepath.FromSlash("../testdata/webapisrv/mox.conf")
64 mox.MustLoadConfig(true, false)
65 defer store.Switchboard()()
67 tcheckf(t, err, "queue init")
69 log := mlog.New("webapisrv", nil)
70 acc, err := store.OpenAccount(log, "mjl")
71 tcheckf(t, err, "open account")
72 const pw0 = "te\u0301st \u00a0\u2002\u200a" // NFD and various unicode spaces.
73 const pw1 = "tést " // PRECIS normalized, with NFC.
74 err = acc.SetPassword(log, pw0)
75 tcheckf(t, err, "set password")
78 log.Check(err, "closing account")
82 s := NewServer(100*1024, "/webapi/", false).(server)
83 hs := httptest.NewServer(s)
86 // server expects the mount path to be stripped already.
87 client := webapi.Client{BaseURL: hs.URL + "/v0/", Username: "mjl@mox.example", Password: pw0}
89 testHTTPHdrsBody := func(s server, method, path string, headers map[string]string, body string, expCode int, expTooMany bool, expCT, expErrCode string) {
92 r := httptest.NewRequest(method, path, strings.NewReader(body))
93 for k, v := range headers {
96 w := httptest.NewRecorder()
99 if res.StatusCode != http.StatusTooManyRequests || !expTooMany {
100 tcompare(t, res.StatusCode, expCode)
103 tcompare(t, res.Header.Get("Content-Type"), expCT)
105 if expErrCode != "" {
106 dec := json.NewDecoder(res.Body)
107 dec.DisallowUnknownFields()
108 var apierr webapi.Error
109 err := dec.Decode(&apierr)
110 tcheckf(t, err, "decoding json error")
111 tcompare(t, apierr.Code, expErrCode)
114 testHTTP := func(method, path string, expCode int, expCT string) {
116 testHTTPHdrsBody(s, method, path, nil, "", expCode, false, expCT, "")
119 testHTTP("GET", "/", http.StatusSeeOther, "")
120 testHTTP("POST", "/", http.StatusMethodNotAllowed, "")
121 testHTTP("GET", "/v0/", http.StatusOK, "text/html; charset=utf-8")
122 testHTTP("GET", "/other/", http.StatusNotFound, "")
123 testHTTP("GET", "/v0/Send", http.StatusOK, "text/html; charset=utf-8")
124 testHTTP("GET", "/v0/MessageRawGet", http.StatusOK, "text/html; charset=utf-8")
125 testHTTP("GET", "/v0/Bogus", http.StatusNotFound, "")
126 testHTTP("PUT", "/v0/Send", http.StatusMethodNotAllowed, "")
127 testHTTP("POST", "/v0/Send", http.StatusUnauthorized, "")
129 for i := 0; i < 11; i++ {
130 // Missing auth doesn't trigger auth rate limiter.
131 testHTTP("POST", "/v0/Send", http.StatusUnauthorized, "")
133 for i := 0; i < 21; i++ {
135 expCode := http.StatusUnauthorized
138 expCode = http.StatusTooManyRequests
140 testHTTPHdrsBody(s, "POST", "/v0/Send", map[string]string{"Authorization": "Basic " + base64.StdEncoding.EncodeToString([]byte("mjl@mox.example:badpassword"))}, "", expCode, tooMany, "", "")
144 // Request with missing X-Forwarded-For.
145 sfwd := NewServer(100*1024, "/webapi/", true).(server)
146 testHTTPHdrsBody(sfwd, "POST", "/v0/Send", map[string]string{"Authorization": "Basic " + base64.StdEncoding.EncodeToString([]byte("mjl@mox.example:badpassword"))}, "", http.StatusInternalServerError, false, "", "")
148 // Body must be form, not JSON.
149 authz := "Basic " + base64.StdEncoding.EncodeToString([]byte("mjl@mox.example:"+pw1))
150 testHTTPHdrsBody(s, "POST", "/v0/Send", map[string]string{"Content-Type": "application/json", "Authorization": authz}, "{}", http.StatusBadRequest, false, "application/json; charset=utf-8", "protocol")
151 testHTTPHdrsBody(s, "POST", "/v0/Send", map[string]string{"Content-Type": "multipart/form-data", "Authorization": authz}, "not formdata", http.StatusBadRequest, false, "application/json; charset=utf-8", "protocol")
152 formAuth := map[string]string{
153 "Content-Type": "application/x-www-form-urlencoded",
154 "Authorization": authz,
156 testHTTPHdrsBody(s, "POST", "/v0/Send", formAuth, "not encoded\n\n", http.StatusBadRequest, false, "application/json; charset=utf-8", "protocol")
157 // Missing "request".
158 testHTTPHdrsBody(s, "POST", "/v0/Send", formAuth, "", http.StatusBadRequest, false, "application/json; charset=utf-8", "protocol")
159 // "request" must be JSON.
160 testHTTPHdrsBody(s, "POST", "/v0/Send", formAuth, "request=notjson", http.StatusBadRequest, false, "application/json; charset=utf-8", "protocol")
161 // "request" must be JSON object.
162 testHTTPHdrsBody(s, "POST", "/v0/Send", formAuth, "request=[]", http.StatusBadRequest, false, "application/json; charset=utf-8", "protocol")
164 // Send message. Look for the message in the queue.
167 sendReq := webapi.SendRequest{
168 Message: webapi.Message{
169 From: []webapi.NameAddress{{Name: "møx", Address: "mjl@mox.example"}},
170 To: []webapi.NameAddress{{Name: "móx", Address: "mjl+to@mox.example"}, {Address: "mjl+to2@mox.example"}},
171 CC: []webapi.NameAddress{{Name: "möx", Address: "mjl+cc@mox.example"}},
172 BCC: []webapi.NameAddress{{Name: "møx", Address: "mjl+bcc@mox.example"}},
173 ReplyTo: []webapi.NameAddress{{Name: "reply1", Address: "mox+reply1@mox.example"}, {Name: "reply2", Address: "mox+reply2@mox.example"}},
174 MessageID: "<random@localhost>",
175 References: []string{"<messageid0@localhost>", "<messageid1@localhost>"},
177 Subject: "¡hello world!",
179 HTML: `<html><img src="cid:x" /></html>`, // Newline will be added.
181 Extra: map[string]string{"a": "123"},
182 Headers: [][2]string{{"x-custom", "header"}},
183 InlineFiles: []webapi.File{
186 ContentType: "image/png",
188 Data: base64.StdEncoding.EncodeToString([]byte("png data")),
191 AttachedFiles: []webapi.File{
193 Data: base64.StdEncoding.EncodeToString([]byte("%PDF-")), // Should be detected as PDF.
200 sendResp, err := client.Send(ctxbg, sendReq)
201 tcheckf(t, err, "send message")
202 tcompare(t, sendResp.MessageID, sendReq.Message.MessageID)
203 tcompare(t, len(sendResp.Submissions), 2+1+1) // 2 to, 1 cc, 1 bcc
204 subs := sendResp.Submissions
205 tcompare(t, subs[0].Address, "mjl+to@mox.example")
206 tcompare(t, subs[1].Address, "mjl+to2@mox.example")
207 tcompare(t, subs[2].Address, "mjl+cc@mox.example")
208 tcompare(t, subs[3].Address, "mjl+bcc@mox.example")
209 tcompare(t, subs[3].QueueMsgID, subs[0].QueueMsgID+3)
210 tcompare(t, subs[0].FromID, "")
211 // todo: look in queue for parameters. parse the message.
213 // Send a custom multipart/form-data POST, with different request parameters, and
215 var sb strings.Builder
216 mp := multipart.NewWriter(&sb)
217 fdSendReq := webapi.SendRequest{
218 Message: webapi.Message{
219 To: []webapi.NameAddress{{Address: "møx@mox.example"}},
220 // Let server assign date, message-id.
224 // Don't let server add its own user-agent.
225 Headers: [][2]string{{"User-Agent", "test"}},
227 sendReqBuf, err := json.Marshal(fdSendReq)
228 tcheckf(t, err, "send request")
229 mp.WriteField("request", string(sendReqBuf))
231 pw, err := mp.CreateFormFile("inlinefile", "test.pdf")
232 tcheckf(t, err, "create inline pdf file")
233 _, err = fmt.Fprint(pw, "%PDF-")
234 tcheckf(t, err, "write pdf")
235 pw, err = mp.CreateFormFile("inlinefile", "test.pdf")
236 tcheckf(t, err, "create second inline pdf file")
237 _, err = fmt.Fprint(pw, "%PDF-")
238 tcheckf(t, err, "write second pdf")
241 fh := textproto.MIMEHeader{}
242 fh.Set("Content-Disposition", `form-data; name="attachedfile"; filename="test.pdf"`)
243 fh.Set("Content-ID", "<testpdf>")
244 pw, err = mp.CreatePart(fh)
245 tcheckf(t, err, "create attached pdf file")
246 _, err = fmt.Fprint(pw, "%PDF-")
247 tcheckf(t, err, "write attached pdf")
248 fdct := mp.FormDataContentType()
250 tcheckf(t, err, "close multipart")
252 // Perform custom POST.
253 req, err := http.NewRequest("POST", hs.URL+"/v0/Send", strings.NewReader(sb.String()))
254 tcheckf(t, err, "new request")
255 req.Header.Set("Content-Type", fdct)
256 // Use a unique MAIL FROM id when delivering.
257 req.Header.Set("Authorization", "Basic "+base64.StdEncoding.EncodeToString([]byte("mjl+fromid@mox.example:"+pw1)))
258 resp, err := http.DefaultClient.Do(req)
259 tcheckf(t, err, "request multipart/form-data")
260 tcompare(t, resp.StatusCode, http.StatusOK)
261 var sendRes webapi.SendResult
262 err = json.NewDecoder(resp.Body).Decode(&sendRes)
263 tcheckf(t, err, "parse send response")
264 tcompare(t, sendRes.MessageID != "", true)
265 tcompare(t, len(sendRes.Submissions), 1)
266 tcompare(t, sendRes.Submissions[0].FromID != "", true)
268 // Trigger various error conditions.
269 _, err = client.Send(ctxbg, webapi.SendRequest{
270 Message: webapi.Message{
271 To: []webapi.NameAddress{{Address: "mjl@mox.example"}},
275 terrcode(t, err, "missingBody")
277 _, err = client.Send(ctxbg, webapi.SendRequest{
278 Message: webapi.Message{
279 From: []webapi.NameAddress{{Address: "other@mox.example"}},
280 To: []webapi.NameAddress{{Address: "mjl@mox.example"}},
285 terrcode(t, err, "badFrom")
287 _, err = client.Send(ctxbg, webapi.SendRequest{
288 Message: webapi.Message{
289 From: []webapi.NameAddress{{Address: "mox@mox.example"}, {Address: "mox@mox.example"}},
290 To: []webapi.NameAddress{{Address: "mjl@mox.example"}},
295 terrcode(t, err, "multipleFrom")
297 _, err = client.Send(ctxbg, webapi.SendRequest{Message: webapi.Message{Subject: "test", Text: "hi"}})
298 terrcode(t, err, "noRecipients")
300 _, err = client.Send(ctxbg, webapi.SendRequest{
301 Message: webapi.Message{
302 MessageID: "missingltgt@localhost",
303 To: []webapi.NameAddress{{Address: "møx@mox.example"}},
308 terrcode(t, err, "malformedMessageID")
310 _, err = client.Send(ctxbg, webapi.SendRequest{
311 Message: webapi.Message{
312 MessageID: "missingltgt@localhost",
313 To: []webapi.NameAddress{{Address: "møx@mox.example"}},
318 terrcode(t, err, "malformedMessageID")
320 // todo: messageLimitReached, recipientLimitReached
323 supListRes, err := client.SuppressionList(ctxbg, webapi.SuppressionListRequest{})
324 tcheckf(t, err, "listing suppressions")
325 tcompare(t, len(supListRes.Suppressions), 0)
328 supAddReq := webapi.SuppressionAddRequest{EmailAddress: "Remote.Last-catchall@xn--74h.localhost", Manual: true, Reason: "tests"}
329 _, err = client.SuppressionAdd(ctxbg, supAddReq)
330 tcheckf(t, err, "add address to suppression list")
331 _, err = client.SuppressionAdd(ctxbg, supAddReq)
332 terrcode(t, err, "error") // Already present.
333 supAddReq2 := webapi.SuppressionAddRequest{EmailAddress: "remotelast@☺.localhost", Manual: false, Reason: "tests"}
334 _, err = client.SuppressionAdd(ctxbg, supAddReq2)
335 terrcode(t, err, "error") // Already present, same base address.
336 supAddReq3 := webapi.SuppressionAddRequest{EmailAddress: "not an address"}
337 _, err = client.SuppressionAdd(ctxbg, supAddReq3)
338 terrcode(t, err, "badAddress")
340 supListRes, err = client.SuppressionList(ctxbg, webapi.SuppressionListRequest{})
341 tcheckf(t, err, "listing suppressions")
342 tcompare(t, len(supListRes.Suppressions), 1)
343 supListRes.Suppressions[0].Created = now
344 tcompare(t, supListRes.Suppressions, []webapi.Suppression{
349 BaseAddress: "remotelast@☺.localhost",
350 OriginalAddress: "Remote.Last-catchall@☺.localhost",
356 // SuppressionPresent
357 supPresRes, err := client.SuppressionPresent(ctxbg, webapi.SuppressionPresentRequest{EmailAddress: "not@localhost"})
358 tcheckf(t, err, "address present")
359 tcompare(t, supPresRes.Present, false)
360 supPresRes, err = client.SuppressionPresent(ctxbg, webapi.SuppressionPresentRequest{EmailAddress: "remotelast@xn--74h.localhost"})
361 tcheckf(t, err, "address present")
362 tcompare(t, supPresRes.Present, true)
363 supPresRes, err = client.SuppressionPresent(ctxbg, webapi.SuppressionPresentRequest{EmailAddress: "Remote.Last-catchall@☺.localhost"})
364 tcheckf(t, err, "address present")
365 tcompare(t, supPresRes.Present, true)
366 supPresRes, err = client.SuppressionPresent(ctxbg, webapi.SuppressionPresentRequest{EmailAddress: "not an address"})
367 terrcode(t, err, "badAddress")
370 _, err = client.SuppressionRemove(ctxbg, webapi.SuppressionRemoveRequest{EmailAddress: "remote.LAST+more@☺.LocalHost"})
371 tcheckf(t, err, "remove suppressed address")
372 _, err = client.SuppressionRemove(ctxbg, webapi.SuppressionRemoveRequest{EmailAddress: "remote.LAST+more@☺.LocalHost"})
373 terrcode(t, err, "error") // Absent.
374 _, err = client.SuppressionRemove(ctxbg, webapi.SuppressionRemoveRequest{EmailAddress: "not an address"})
375 terrcode(t, err, "badAddress")
377 supListRes, err = client.SuppressionList(ctxbg, webapi.SuppressionListRequest{})
378 tcheckf(t, err, "listing suppressions")
379 tcompare(t, len(supListRes.Suppressions), 0)
381 // MessageGet, we retrieve the message we sent first.
382 msgRes, err := client.MessageGet(ctxbg, webapi.MessageGetRequest{MsgID: 1})
383 tcheckf(t, err, "remove suppressed address")
384 sentMsg := sendReq.Message
385 sentMsg.Date = msgRes.Message.Date
387 tcompare(t, msgRes.Message, sentMsg)
388 // The structure is: mixed (related (alternative text html) inline-png) attached-pdf).
389 pdfpart := msgRes.Structure.Parts[1]
390 tcompare(t, pdfpart.ContentType, "application/pdf")
391 // structure compared below, parsed again from raw message.
392 // todo: compare Meta
394 _, err = client.MessageGet(ctxbg, webapi.MessageGetRequest{MsgID: 1 + 999})
395 terrcode(t, err, "messageNotFound")
398 r, err := client.MessageRawGet(ctxbg, webapi.MessageRawGetRequest{MsgID: 1})
399 tcheckf(t, err, "get raw message")
401 _, err = io.Copy(&b, r)
403 tcheckf(t, err, "reading raw message")
404 part, err := message.EnsurePart(log.Logger, true, bytes.NewReader(b.Bytes()), int64(b.Len()))
405 tcheckf(t, err, "parsing raw message")
406 tcompare(t, webhook.PartStructure(&part), msgRes.Structure)
408 _, err = client.MessageRawGet(ctxbg, webapi.MessageRawGetRequest{MsgID: 1 + 999})
409 terrcode(t, err, "messageNotFound")
412 // The structure is: mixed (related (alternative text html) inline-png) attached-pdf).
413 r, err = client.MessagePartGet(ctxbg, webapi.MessagePartGetRequest{MsgID: 1, PartPath: []int{0, 0, 1}})
414 tcheckf(t, err, "get message part")
415 tdata(t, r, sendReq.HTML+"\r\n") // Part returns the raw data with \r\n line endings.
418 r, err = client.MessagePartGet(ctxbg, webapi.MessagePartGetRequest{MsgID: 1, PartPath: []int{}})
419 tcheckf(t, err, "get message part")
422 _, err = client.MessagePartGet(ctxbg, webapi.MessagePartGetRequest{MsgID: 1, PartPath: []int{2}})
423 terrcode(t, err, "partNotFound")
425 _, err = client.MessagePartGet(ctxbg, webapi.MessagePartGetRequest{MsgID: 1 + 999, PartPath: []int{}})
426 terrcode(t, err, "messageNotFound")
428 _, err = client.MessageFlagsAdd(ctxbg, webapi.MessageFlagsAddRequest{MsgID: 1, Flags: []string{`\answered`, "$Forwarded", "custom"}})
429 tcheckf(t, err, "add flags")
431 msgRes, err = client.MessageGet(ctxbg, webapi.MessageGetRequest{MsgID: 1})
432 tcheckf(t, err, "get message")
433 tcompare(t, slices.Contains(msgRes.Meta.Flags, `\answered`), true)
434 tcompare(t, slices.Contains(msgRes.Meta.Flags, "$forwarded"), true)
435 tcompare(t, slices.Contains(msgRes.Meta.Flags, "custom"), true)
437 // Setting duplicate flags doesn't make a change.
438 _, err = client.MessageFlagsAdd(ctxbg, webapi.MessageFlagsAddRequest{MsgID: 1, Flags: []string{`\Answered`, "$forwarded", "custom"}})
439 tcheckf(t, err, "add flags")
440 msgRes2, err := client.MessageGet(ctxbg, webapi.MessageGetRequest{MsgID: 1})
441 tcheckf(t, err, "get message")
442 tcompare(t, msgRes.Meta.Flags, msgRes2.Meta.Flags)
444 // Non-existing message gives generic user error.
445 _, err = client.MessageFlagsAdd(ctxbg, webapi.MessageFlagsAddRequest{MsgID: 1 + 999, Flags: []string{`\answered`, "$Forwarded", "custom"}})
446 terrcode(t, err, "messageNotFound")
448 // MessageFlagsRemove
449 _, err = client.MessageFlagsRemove(ctxbg, webapi.MessageFlagsRemoveRequest{MsgID: 1, Flags: []string{`\Answered`, "$forwarded", "custom"}})
450 tcheckf(t, err, "remove")
451 msgRes, err = client.MessageGet(ctxbg, webapi.MessageGetRequest{MsgID: 1})
452 tcheckf(t, err, "get message")
453 tcompare(t, slices.Contains(msgRes.Meta.Flags, `\answered`), false)
454 tcompare(t, slices.Contains(msgRes.Meta.Flags, "$forwarded"), false)
455 tcompare(t, slices.Contains(msgRes.Meta.Flags, "custom"), false)
456 // Can try removing again, no change.
457 _, err = client.MessageFlagsRemove(ctxbg, webapi.MessageFlagsRemoveRequest{MsgID: 1, Flags: []string{`\Answered`, "$forwarded", "custom"}})
458 tcheckf(t, err, "remove")
460 _, err = client.MessageFlagsRemove(ctxbg, webapi.MessageFlagsRemoveRequest{MsgID: 1 + 999, Flags: []string{`\Answered`, "$forwarded", "custom"}})
461 terrcode(t, err, "messageNotFound")
464 tcompare(t, msgRes.Meta.MailboxName, "Sent")
465 _, err = client.MessageMove(ctxbg, webapi.MessageMoveRequest{MsgID: 1, DestMailboxName: "Inbox"})
466 tcheckf(t, err, "move to inbox")
467 msgRes, err = client.MessageGet(ctxbg, webapi.MessageGetRequest{MsgID: 1})
468 tcheckf(t, err, "get message")
469 tcompare(t, msgRes.Meta.MailboxName, "Inbox")
470 _, err = client.MessageMove(ctxbg, webapi.MessageMoveRequest{MsgID: 1, DestMailboxName: "Bogus"})
471 terrcode(t, err, "user")
472 _, err = client.MessageMove(ctxbg, webapi.MessageMoveRequest{MsgID: 1 + 999, DestMailboxName: "Inbox"})
473 terrcode(t, err, "messageNotFound")
476 _, err = client.MessageDelete(ctxbg, webapi.MessageDeleteRequest{MsgID: 1})
477 tcheckf(t, err, "delete message")
478 _, err = client.MessageDelete(ctxbg, webapi.MessageDeleteRequest{MsgID: 1})
479 terrcode(t, err, "user") // No longer.
480 _, err = client.MessageGet(ctxbg, webapi.MessageGetRequest{MsgID: 1})
481 terrcode(t, err, "messageNotFound") // No longer.
482 _, err = client.MessageDelete(ctxbg, webapi.MessageDeleteRequest{MsgID: 1 + 999})
483 terrcode(t, err, "messageNotFound")
486func tdata(t *testing.T, r io.Reader, exp string) {
488 buf, err := io.ReadAll(r)
489 tcheckf(t, err, "reading body")
490 tcompare(t, string(buf), exp)