cesnimda
a8e2f4dc4a
b3 of the multi-provider email roadmap. Adds ImapConnection model + table (reconciler pattern, SQLite+MySQL), ImapService (MailKit-backed IMAP client), ImapProvider implementing the existing IEmailProvider contract unchanged, and ImapController for credential-based connect (no OAuth — user supplies host/username/password directly, verified by a live connect before storage). Scope, documented inline with ponytail: comments: - INBOX only, no multi-folder support. - Thread grouping approximates the References/In-Reply-To chain root rather than the IMAP THREAD extension, which not every server implements. - External message ids are IMAP UIDs, scoped to the connection's current UIDVALIDITY. Security: ran the security-audit skill against this diff (credential handling + arbitrary-host connect is exactly the class of change the standing security gate exists for). Found and fixed a real SSRF: the connect endpoint let an authenticated user point the server at an arbitrary host:port with no internal-range check, and connect-vs-auth failure was distinguishable to the caller -- together a working oracle to fingerprint internal services (loopback/RFC1918/link-local/cloud metadata) from the server's network position. Fixed with EnsureHostIsExternalAsync (DNS-resolve + reject internal ranges, re-checked on every reconnect to close the DNS-rebinding gap) and a single generic failure message that no longer distinguishes connect vs auth failure. 7 regression tests added. Dependency: MailKit 4.17.0 (MIT license) on JobTrackerBackend.csproj -- stdlib has no IMAP client; hand-rolling IMAP4rev1 (TLS, SASL, MIME parsing) would be a large, security-sensitive protocol implementation nobody asked for, so this is the correct dependency, not a stdlib substitute. 168/168 green (161 existing + 7 new SSRF regression tests; the earlier 14 IMAP feature tests are included in the 161). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
35 lines
1.6 KiB
XML
35 lines
1.6 KiB
XML
<Project Sdk="Microsoft.NET.Sdk.Web">
|
|
<!--
|
|
Transitional shared-backend project.
|
|
The API host and test project both reference this library so controller/service code can
|
|
be exercised without dragging the web-entry project into every test build.
|
|
Files still live in their original folders for now; a later refactor can move them physically.
|
|
-->
|
|
<PropertyGroup>
|
|
<TargetFramework>net9.0</TargetFramework>
|
|
<ImplicitUsings>enable</ImplicitUsings>
|
|
<Nullable>enable</Nullable>
|
|
<RestoreIgnoreFailedSources>true</RestoreIgnoreFailedSources>
|
|
<OutputType>Library</OutputType>
|
|
</PropertyGroup>
|
|
|
|
<ItemGroup>
|
|
<Compile Include="..\Data\**\*.cs" />
|
|
<Compile Include="..\Models\**\*.cs" />
|
|
<Compile Include="..\JobTrackerApi\Controllers\**\*.cs" />
|
|
<Compile Include="..\JobTrackerApi\Services\**\*.cs" />
|
|
</ItemGroup>
|
|
|
|
<ItemGroup>
|
|
<PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="9.0.14" />
|
|
<PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="9.0.14">
|
|
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
|
|
<PrivateAssets>all</PrivateAssets>
|
|
</PackageReference>
|
|
<PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="9.0.14" />
|
|
<PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="8.14.0" />
|
|
<PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="8.14.0" />
|
|
<PackageReference Include="MailKit" Version="4.17.0" />
|
|
</ItemGroup>
|
|
</Project>
|