deltachat/
mimefactory.rs

1//! # MIME message production.
2
3use std::collections::{BTreeSet, HashSet};
4use std::io::Cursor;
5
6use anyhow::{Context as _, Result, bail, ensure};
7use base64::Engine as _;
8use data_encoding::BASE32_NOPAD;
9use deltachat_contact_tools::sanitize_bidi_characters;
10use iroh_gossip::proto::TopicId;
11use mail_builder::headers::HeaderType;
12use mail_builder::headers::address::{Address, EmailAddress};
13use mail_builder::mime::MimePart;
14use tokio::fs;
15
16use crate::aheader::{Aheader, EncryptPreference};
17use crate::blob::BlobObject;
18use crate::chat::{self, Chat};
19use crate::config::Config;
20use crate::constants::ASM_SUBJECT;
21use crate::constants::{Chattype, DC_FROM_HANDSHAKE};
22use crate::contact::{Contact, ContactId, Origin};
23use crate::context::Context;
24use crate::e2ee::EncryptHelper;
25use crate::ensure_and_debug_assert;
26use crate::ephemeral::Timer as EphemeralTimer;
27use crate::headerdef::HeaderDef;
28use crate::key::{DcKey, SignedPublicKey, self_fingerprint};
29use crate::location;
30use crate::log::{info, warn};
31use crate::message::{Message, MsgId, Viewtype};
32use crate::mimeparser::{SystemMessage, is_hidden};
33use crate::param::Param;
34use crate::peer_channels::{create_iroh_header, get_iroh_topic_for_msg};
35use crate::simplify::escape_message_footer_marks;
36use crate::stock_str;
37use crate::tools::{
38    IsNoneOrEmpty, create_outgoing_rfc724_mid, create_smeared_timestamp, remove_subject_prefix,
39    time,
40};
41use crate::webxdc::StatusUpdateSerial;
42
43// attachments of 25 mb brutto should work on the majority of providers
44// (brutto examples: web.de=50, 1&1=40, t-online.de=32, gmail=25, posteo=50, yahoo=25, all-inkl=100).
45// to get the netto sizes, we subtract 1 mb header-overhead and the base64-overhead.
46pub const RECOMMENDED_FILE_SIZE: u64 = 24 * 1024 * 1024 / 4 * 3;
47
48#[derive(Debug, Clone)]
49#[expect(clippy::large_enum_variant)]
50pub enum Loaded {
51    Message {
52        chat: Chat,
53        msg: Message,
54    },
55    Mdn {
56        rfc724_mid: String,
57        additional_msg_ids: Vec<String>,
58    },
59}
60
61/// Helper to construct mime messages.
62#[derive(Debug, Clone)]
63pub struct MimeFactory {
64    from_addr: String,
65    from_displayname: String,
66
67    /// Goes to the `Sender:`-header, if set.
68    /// For overridden names, `sender_displayname` is set to the
69    /// config-name while `from_displayname` is set to the overridden name.
70    /// From the perspective of the receiver,
71    /// a set `Sender:`-header is used as an indicator that the name is overridden;
72    /// names are alsways read from the `From:`-header.
73    sender_displayname: Option<String>,
74
75    selfstatus: String,
76
77    /// Vector of actual recipient addresses.
78    ///
79    /// This is the list of addresses the message should be sent to.
80    /// It is not the same as the `To` header,
81    /// because in case of "member removed" message
82    /// removed member is in the recipient list,
83    /// but not in the `To` header.
84    /// In case of broadcast channels there are multiple recipients,
85    /// but the `To` header has no members.
86    ///
87    /// If `bcc_self` configuration is enabled,
88    /// this list will be extended with own address later,
89    /// but `MimeFactory` is not responsible for this.
90    recipients: Vec<String>,
91
92    /// Vector of pairs of recipient
93    /// addresses and OpenPGP keys
94    /// to use for encryption.
95    ///
96    /// `None` if the message is not encrypted.
97    encryption_keys: Option<Vec<(String, SignedPublicKey)>>,
98
99    /// Vector of pairs of recipient name and address that goes into the `To` field.
100    ///
101    /// The list of actual message recipient addresses may be different,
102    /// e.g. if members are hidden for broadcast channels
103    /// or if the keys for some recipients are missing
104    /// and encrypted message cannot be sent to them.
105    to: Vec<(String, String)>,
106
107    /// Vector of pairs of past group member names and addresses.
108    past_members: Vec<(String, String)>,
109
110    /// Fingerprints of the members in the same order as in the `to`
111    /// followed by `past_members`.
112    ///
113    /// If this is not empty, its length
114    /// should be the sum of `to` and `past_members` length.
115    member_fingerprints: Vec<String>,
116
117    /// Timestamps of the members in the same order as in the `to`
118    /// followed by `past_members`.
119    ///
120    /// If this is not empty, its length
121    /// should be the sum of `to` and `past_members` length.
122    member_timestamps: Vec<i64>,
123
124    timestamp: i64,
125    loaded: Loaded,
126    in_reply_to: String,
127
128    /// List of Message-IDs for `References` header.
129    references: Vec<String>,
130
131    /// True if the message requests Message Disposition Notification
132    /// using `Chat-Disposition-Notification-To` header.
133    req_mdn: bool,
134
135    last_added_location_id: Option<u32>,
136
137    /// If the created mime-structure contains sync-items,
138    /// the IDs of these items are listed here.
139    /// The IDs are returned via `RenderedEmail`
140    /// and must be deleted if the message is actually queued for sending.
141    sync_ids_to_delete: Option<String>,
142
143    /// True if the avatar should be attached.
144    pub attach_selfavatar: bool,
145
146    /// This field is used to sustain the topic id of webxdcs needed for peer channels.
147    webxdc_topic: Option<TopicId>,
148}
149
150/// Result of rendering a message, ready to be submitted to a send job.
151#[derive(Debug, Clone)]
152pub struct RenderedEmail {
153    pub message: String,
154    // pub envelope: Envelope,
155    pub is_encrypted: bool,
156    pub last_added_location_id: Option<u32>,
157
158    /// A comma-separated string of sync-IDs that are used by the rendered email and must be deleted
159    /// from `multi_device_sync` once the message is actually queued for sending.
160    pub sync_ids_to_delete: Option<String>,
161
162    /// Message ID (Message in the sense of Email)
163    pub rfc724_mid: String,
164
165    /// Message subject.
166    pub subject: String,
167}
168
169fn new_address_with_name(name: &str, address: String) -> Address<'static> {
170    Address::new_address(
171        if name == address || name.is_empty() {
172            None
173        } else {
174            Some(name.to_string())
175        },
176        address,
177    )
178}
179
180impl MimeFactory {
181    pub async fn from_msg(context: &Context, msg: Message) -> Result<MimeFactory> {
182        let now = time();
183        let chat = Chat::load_from_db(context, msg.chat_id).await?;
184        let attach_profile_data = Self::should_attach_profile_data(&msg);
185        let undisclosed_recipients = chat.typ == Chattype::OutBroadcast;
186
187        let from_addr = context.get_primary_self_addr().await?;
188        let config_displayname = context
189            .get_config(Config::Displayname)
190            .await?
191            .unwrap_or_default();
192        let (from_displayname, sender_displayname) =
193            if let Some(override_name) = msg.param.get(Param::OverrideSenderDisplayname) {
194                (override_name.to_string(), Some(config_displayname))
195            } else {
196                let name = match attach_profile_data {
197                    true => config_displayname,
198                    false => "".to_string(),
199                };
200                (name, None)
201            };
202
203        let mut recipients = Vec::new();
204        let mut to = Vec::new();
205        let mut past_members = Vec::new();
206        let mut member_fingerprints = Vec::new();
207        let mut member_timestamps = Vec::new();
208        let mut recipient_ids = HashSet::new();
209        let mut req_mdn = false;
210
211        let encryption_keys;
212
213        let self_fingerprint = self_fingerprint(context).await?;
214
215        if chat.is_self_talk() {
216            to.push((from_displayname.to_string(), from_addr.to_string()));
217
218            encryption_keys = if msg.param.get_bool(Param::ForcePlaintext).unwrap_or(false) {
219                None
220            } else {
221                // Encrypt, but only to self.
222                Some(Vec::new())
223            };
224        } else if chat.is_mailing_list() {
225            let list_post = chat
226                .param
227                .get(Param::ListPost)
228                .context("Can't write to mailinglist without ListPost param")?;
229            to.push(("".to_string(), list_post.to_string()));
230            recipients.push(list_post.to_string());
231
232            // Do not encrypt messages to mailing lists.
233            encryption_keys = None;
234        } else {
235            let email_to_remove = if msg.param.get_cmd() == SystemMessage::MemberRemovedFromGroup {
236                msg.param.get(Param::Arg)
237            } else {
238                None
239            };
240
241            let is_encrypted = if msg
242                .param
243                .get_bool(Param::ForcePlaintext)
244                .unwrap_or_default()
245            {
246                false
247            } else {
248                msg.param.get_bool(Param::GuaranteeE2ee).unwrap_or_default()
249                    || chat.is_encrypted(context).await?
250            };
251
252            let mut keys = Vec::new();
253            let mut missing_key_addresses = BTreeSet::new();
254            context
255                .sql
256                // Sort recipients by `add_timestamp DESC` so that if the group is large and there
257                // are multiple SMTP messages, a newly added member receives the member addition
258                // message earlier and has gossiped keys of other members (otherwise the new member
259                // may receive messages from other members earlier and fail to verify them).
260                .query_map(
261                    "SELECT
262                     c.authname,
263                     c.addr,
264                     c.fingerprint,
265                     c.id,
266                     cc.add_timestamp,
267                     cc.remove_timestamp,
268                     k.public_key
269                     FROM chats_contacts cc
270                     LEFT JOIN contacts c ON cc.contact_id=c.id
271                     LEFT JOIN public_keys k ON k.fingerprint=c.fingerprint
272                     WHERE cc.chat_id=?
273                     AND (cc.contact_id>9 OR (cc.contact_id=1 AND ?))
274                     ORDER BY cc.add_timestamp DESC",
275                    (msg.chat_id, chat.typ == Chattype::Group),
276                    |row| {
277                        let authname: String = row.get(0)?;
278                        let addr: String = row.get(1)?;
279                        let fingerprint: String = row.get(2)?;
280                        let id: ContactId = row.get(3)?;
281                        let add_timestamp: i64 = row.get(4)?;
282                        let remove_timestamp: i64 = row.get(5)?;
283                        let public_key_bytes_opt: Option<Vec<u8>> = row.get(6)?;
284                        Ok((authname, addr, fingerprint, id, add_timestamp, remove_timestamp, public_key_bytes_opt))
285                    },
286                    |rows| {
287                        let mut past_member_timestamps = Vec::new();
288                        let mut past_member_fingerprints = Vec::new();
289
290                        for row in rows {
291                            let (authname, addr, fingerprint, id, add_timestamp, remove_timestamp, public_key_bytes_opt) = row?;
292
293                            let public_key_opt = if let Some(public_key_bytes) = &public_key_bytes_opt {
294                                Some(SignedPublicKey::from_slice(public_key_bytes)?)
295                            } else {
296                                None
297                            };
298
299                            let addr = if id == ContactId::SELF {
300                                from_addr.to_string()
301                            } else {
302                                addr
303                            };
304                            let name = match attach_profile_data {
305                                true => authname,
306                                false => "".to_string(),
307                            };
308                            if add_timestamp >= remove_timestamp {
309                                if !recipients_contain_addr(&to, &addr) {
310                                    if id != ContactId::SELF {
311                                        recipients.push(addr.clone());
312                                    }
313                                    if !undisclosed_recipients {
314                                        to.push((name, addr.clone()));
315
316                                        if is_encrypted {
317                                            if !fingerprint.is_empty() {
318                                                member_fingerprints.push(fingerprint);
319                                            } else if id == ContactId::SELF {
320                                                member_fingerprints.push(self_fingerprint.to_string());
321                                            } else {
322                                                ensure_and_debug_assert!(member_fingerprints.is_empty(), "If some past member is a key-contact, all other past members should be key-contacts too");
323                                            }
324                                        }
325                                        member_timestamps.push(add_timestamp);
326                                    }
327                                }
328                                recipient_ids.insert(id);
329
330                                if let Some(public_key) = public_key_opt {
331                                    keys.push((addr.clone(), public_key))
332                                } else if id != ContactId::SELF {
333                                    missing_key_addresses.insert(addr.clone());
334                                    if is_encrypted {
335                                        warn!(context, "Missing key for {addr}");
336                                    }
337                                }
338                            } else if remove_timestamp.saturating_add(60 * 24 * 3600) > now {
339                                // Row is a tombstone,
340                                // member is not actually part of the group.
341                                if !recipients_contain_addr(&past_members, &addr) {
342                                    if let Some(email_to_remove) = email_to_remove {
343                                        if email_to_remove == addr {
344                                            // This is a "member removed" message,
345                                            // we need to notify removed member
346                                            // that it was removed.
347                                            if id != ContactId::SELF {
348                                                recipients.push(addr.clone());
349                                            }
350
351                                            if let Some(public_key) = public_key_opt {
352                                                keys.push((addr.clone(), public_key))
353                                            } else if id != ContactId::SELF {
354                                                missing_key_addresses.insert(addr.clone());
355                                                if is_encrypted {
356                                                    warn!(context, "Missing key for {addr}");
357                                                }
358                                            }
359                                        }
360                                    }
361                                    if !undisclosed_recipients {
362                                        past_members.push((name, addr.clone()));
363                                        past_member_timestamps.push(remove_timestamp);
364
365                                        if is_encrypted {
366                                            if !fingerprint.is_empty() {
367                                                past_member_fingerprints.push(fingerprint);
368                                            } else if id == ContactId::SELF {
369                                                // It's fine to have self in past members
370                                                // if we are leaving the group.
371                                                past_member_fingerprints.push(self_fingerprint.to_string());
372                                            } else {
373                                                ensure_and_debug_assert!(past_member_fingerprints.is_empty(), "If some past member is a key-contact, all other past members should be key-contacts too");
374                                            }
375                                        }
376                                    }
377                                }
378                            }
379                        }
380
381                        ensure_and_debug_assert!(
382                            member_timestamps.len() >= to.len(),
383                            "member_timestamps.len() ({}) < to.len() ({})",
384                            member_timestamps.len(), to.len());
385                        ensure_and_debug_assert!(
386                            member_fingerprints.is_empty() || member_fingerprints.len() >= to.len(),
387                            "member_fingerprints.len() ({}) < to.len() ({})",
388                            member_fingerprints.len(), to.len());
389
390                        if to.len() > 1 {
391                            if let Some(position) = to.iter().position(|(_, x)| x == &from_addr) {
392                                to.remove(position);
393                                member_timestamps.remove(position);
394                                if is_encrypted {
395                                    member_fingerprints.remove(position);
396                                }
397                            }
398                        }
399
400                        member_timestamps.extend(past_member_timestamps);
401                        if is_encrypted {
402                            member_fingerprints.extend(past_member_fingerprints);
403                        }
404                        Ok(())
405                    },
406                )
407                .await?;
408            let recipient_ids: Vec<_> = recipient_ids.into_iter().collect();
409            ContactId::scaleup_origin(context, &recipient_ids, Origin::OutgoingTo).await?;
410
411            if !msg.is_system_message()
412                && msg.param.get_int(Param::Reaction).unwrap_or_default() == 0
413                && context.should_request_mdns().await?
414            {
415                req_mdn = true;
416            }
417
418            encryption_keys = if !is_encrypted {
419                None
420            } else {
421                if keys.is_empty() && !recipients.is_empty() {
422                    bail!("No recipient keys are available, cannot encrypt to {recipients:?}.");
423                }
424
425                // Remove recipients for which the key is missing.
426                if !missing_key_addresses.is_empty() {
427                    recipients.retain(|addr| !missing_key_addresses.contains(addr));
428                }
429
430                Some(keys)
431            };
432        }
433
434        let (in_reply_to, references) = context
435            .sql
436            .query_row(
437                "SELECT mime_in_reply_to, IFNULL(mime_references, '')
438                 FROM msgs WHERE id=?",
439                (msg.id,),
440                |row| {
441                    let in_reply_to: String = row.get(0)?;
442                    let references: String = row.get(1)?;
443
444                    Ok((in_reply_to, references))
445                },
446            )
447            .await?;
448        let references: Vec<String> = references
449            .trim()
450            .split_ascii_whitespace()
451            .map(|s| s.trim_start_matches('<').trim_end_matches('>').to_string())
452            .collect();
453        let selfstatus = match attach_profile_data {
454            true => context
455                .get_config(Config::Selfstatus)
456                .await?
457                .unwrap_or_default(),
458            false => "".to_string(),
459        };
460        let attach_selfavatar = Self::should_attach_selfavatar(context, &msg).await;
461
462        ensure_and_debug_assert!(
463            member_timestamps.is_empty()
464                || to.len() + past_members.len() == member_timestamps.len(),
465            "to.len() ({}) + past_members.len() ({}) != member_timestamps.len() ({})",
466            to.len(),
467            past_members.len(),
468            member_timestamps.len(),
469        );
470        let webxdc_topic = get_iroh_topic_for_msg(context, msg.id).await?;
471        let factory = MimeFactory {
472            from_addr,
473            from_displayname,
474            sender_displayname,
475            selfstatus,
476            recipients,
477            encryption_keys,
478            to,
479            past_members,
480            member_fingerprints,
481            member_timestamps,
482            timestamp: msg.timestamp_sort,
483            loaded: Loaded::Message { msg, chat },
484            in_reply_to,
485            references,
486            req_mdn,
487            last_added_location_id: None,
488            sync_ids_to_delete: None,
489            attach_selfavatar,
490            webxdc_topic,
491        };
492        Ok(factory)
493    }
494
495    pub async fn from_mdn(
496        context: &Context,
497        from_id: ContactId,
498        rfc724_mid: String,
499        additional_msg_ids: Vec<String>,
500    ) -> Result<MimeFactory> {
501        let contact = Contact::get_by_id(context, from_id).await?;
502        let from_addr = context.get_primary_self_addr().await?;
503        let timestamp = create_smeared_timestamp(context);
504
505        let addr = contact.get_addr().to_string();
506        let encryption_keys = if contact.is_key_contact() {
507            if let Some(key) = contact.public_key(context).await? {
508                Some(vec![(addr.clone(), key)])
509            } else {
510                Some(Vec::new())
511            }
512        } else {
513            None
514        };
515
516        let res = MimeFactory {
517            from_addr,
518            from_displayname: "".to_string(),
519            sender_displayname: None,
520            selfstatus: "".to_string(),
521            recipients: vec![addr],
522            encryption_keys,
523            to: vec![("".to_string(), contact.get_addr().to_string())],
524            past_members: vec![],
525            member_fingerprints: vec![],
526            member_timestamps: vec![],
527            timestamp,
528            loaded: Loaded::Mdn {
529                rfc724_mid,
530                additional_msg_ids,
531            },
532            in_reply_to: String::default(),
533            references: Vec::new(),
534            req_mdn: false,
535            last_added_location_id: None,
536            sync_ids_to_delete: None,
537            attach_selfavatar: false,
538            webxdc_topic: None,
539        };
540
541        Ok(res)
542    }
543
544    fn should_skip_autocrypt(&self) -> bool {
545        match &self.loaded {
546            Loaded::Message { msg, .. } => {
547                msg.param.get_bool(Param::SkipAutocrypt).unwrap_or_default()
548            }
549            Loaded::Mdn { .. } => false,
550        }
551    }
552
553    fn should_attach_profile_data(msg: &Message) -> bool {
554        msg.param.get_cmd() != SystemMessage::SecurejoinMessage || {
555            let step = msg.param.get(Param::Arg).unwrap_or_default();
556            // Don't attach profile data at the earlier SecureJoin steps:
557            // - The corresponding messages, i.e. "v{c,g}-request" and "v{c,g}-auth-required" are
558            //   deleted right after processing, so other devices won't see the avatar etc.
559            // - It's also good for privacy because the contact isn't yet verified and these
560            //   messages are auto-sent unlike usual unencrypted messages.
561            step == "vg-request-with-auth"
562                || step == "vc-request-with-auth"
563                || step == "vg-member-added"
564                || step == "vc-contact-confirm"
565        }
566    }
567
568    async fn should_attach_selfavatar(context: &Context, msg: &Message) -> bool {
569        Self::should_attach_profile_data(msg)
570            && match chat::shall_attach_selfavatar(context, msg.chat_id).await {
571                Ok(should) => should,
572                Err(err) => {
573                    warn!(
574                        context,
575                        "should_attach_selfavatar: cannot get selfavatar state: {err:#}."
576                    );
577                    false
578                }
579            }
580    }
581
582    fn grpimage(&self) -> Option<String> {
583        match &self.loaded {
584            Loaded::Message { chat, msg } => {
585                let cmd = msg.param.get_cmd();
586
587                match cmd {
588                    SystemMessage::MemberAddedToGroup => {
589                        return chat.param.get(Param::ProfileImage).map(Into::into);
590                    }
591                    SystemMessage::GroupImageChanged => {
592                        return msg.param.get(Param::Arg).map(Into::into);
593                    }
594                    _ => {}
595                }
596
597                if msg
598                    .param
599                    .get_bool(Param::AttachGroupImage)
600                    .unwrap_or_default()
601                {
602                    return chat.param.get(Param::ProfileImage).map(Into::into);
603                }
604
605                None
606            }
607            Loaded::Mdn { .. } => None,
608        }
609    }
610
611    async fn subject_str(&self, context: &Context) -> Result<String> {
612        let subject = match &self.loaded {
613            Loaded::Message { chat, msg } => {
614                let quoted_msg_subject = msg.quoted_message(context).await?.map(|m| m.subject);
615
616                if !msg.subject.is_empty() {
617                    return Ok(msg.subject.clone());
618                }
619
620                if (chat.typ == Chattype::Group || chat.typ == Chattype::OutBroadcast)
621                    && quoted_msg_subject.is_none_or_empty()
622                {
623                    let re = if self.in_reply_to.is_empty() {
624                        ""
625                    } else {
626                        "Re: "
627                    };
628                    return Ok(format!("{}{}", re, chat.name));
629                }
630
631                let parent_subject = if quoted_msg_subject.is_none_or_empty() {
632                    chat.param.get(Param::LastSubject)
633                } else {
634                    quoted_msg_subject.as_deref()
635                };
636                if let Some(last_subject) = parent_subject {
637                    return Ok(format!("Re: {}", remove_subject_prefix(last_subject)));
638                }
639
640                let self_name = match Self::should_attach_profile_data(msg) {
641                    true => context.get_config(Config::Displayname).await?,
642                    false => None,
643                };
644                let self_name = &match self_name {
645                    Some(name) => name,
646                    None => context.get_config(Config::Addr).await?.unwrap_or_default(),
647                };
648                stock_str::subject_for_new_contact(context, self_name).await
649            }
650            Loaded::Mdn { .. } => "Receipt Notification".to_string(), // untranslated to no reveal sender's language
651        };
652
653        Ok(subject)
654    }
655
656    pub fn recipients(&self) -> Vec<String> {
657        self.recipients.clone()
658    }
659
660    /// Consumes a `MimeFactory` and renders it into a message which is then stored in
661    /// `smtp`-table to be used by the SMTP loop
662    pub async fn render(mut self, context: &Context) -> Result<RenderedEmail> {
663        let mut headers = Vec::<(&'static str, HeaderType<'static>)>::new();
664
665        let from = new_address_with_name(&self.from_displayname, self.from_addr.clone());
666
667        let mut to: Vec<Address<'static>> = Vec::new();
668        for (name, addr) in &self.to {
669            to.push(Address::new_address(
670                if name.is_empty() {
671                    None
672                } else {
673                    Some(name.to_string())
674                },
675                addr.clone(),
676            ));
677        }
678
679        let mut past_members: Vec<Address<'static>> = Vec::new(); // Contents of `Chat-Group-Past-Members` header.
680        for (name, addr) in &self.past_members {
681            past_members.push(Address::new_address(
682                if name.is_empty() {
683                    None
684                } else {
685                    Some(name.to_string())
686                },
687                addr.clone(),
688            ));
689        }
690
691        ensure_and_debug_assert!(
692            self.member_timestamps.is_empty()
693                || to.len() + past_members.len() == self.member_timestamps.len(),
694            "to.len() ({}) + past_members.len() ({}) != self.member_timestamps.len() ({})",
695            to.len(),
696            past_members.len(),
697            self.member_timestamps.len(),
698        );
699        if to.is_empty() {
700            to.push(hidden_recipients());
701        }
702
703        // Start with Internet Message Format headers in the order of the standard example
704        // <https://datatracker.ietf.org/doc/html/rfc5322#appendix-A.1.1>.
705        headers.push(("From", from.into()));
706
707        if let Some(sender_displayname) = &self.sender_displayname {
708            let sender = new_address_with_name(sender_displayname, self.from_addr.clone());
709            headers.push(("Sender", sender.into()));
710        }
711        headers.push((
712            "To",
713            mail_builder::headers::address::Address::new_list(to.clone()).into(),
714        ));
715        if !past_members.is_empty() {
716            headers.push((
717                "Chat-Group-Past-Members",
718                mail_builder::headers::address::Address::new_list(past_members.clone()).into(),
719            ));
720        }
721
722        if let Loaded::Message { chat, .. } = &self.loaded {
723            if chat.typ == Chattype::Group {
724                if !self.member_timestamps.is_empty() && !chat.member_list_is_stale(context).await?
725                {
726                    headers.push((
727                        "Chat-Group-Member-Timestamps",
728                        mail_builder::headers::raw::Raw::new(
729                            self.member_timestamps
730                                .iter()
731                                .map(|ts| ts.to_string())
732                                .collect::<Vec<String>>()
733                                .join(" "),
734                        )
735                        .into(),
736                    ));
737                }
738
739                if !self.member_fingerprints.is_empty() {
740                    headers.push((
741                        "Chat-Group-Member-Fpr",
742                        mail_builder::headers::raw::Raw::new(
743                            self.member_fingerprints
744                                .iter()
745                                .map(|fp| fp.to_string())
746                                .collect::<Vec<String>>()
747                                .join(" "),
748                        )
749                        .into(),
750                    ));
751                }
752            }
753        }
754
755        let subject_str = self.subject_str(context).await?;
756        headers.push((
757            "Subject",
758            mail_builder::headers::text::Text::new(subject_str.to_string()).into(),
759        ));
760
761        let date = chrono::DateTime::<chrono::Utc>::from_timestamp(self.timestamp, 0)
762            .unwrap()
763            .to_rfc2822();
764        headers.push(("Date", mail_builder::headers::raw::Raw::new(date).into()));
765
766        let rfc724_mid = match &self.loaded {
767            Loaded::Message { msg, .. } => msg.rfc724_mid.clone(),
768            Loaded::Mdn { .. } => create_outgoing_rfc724_mid(),
769        };
770        headers.push((
771            "Message-ID",
772            mail_builder::headers::message_id::MessageId::new(rfc724_mid.clone()).into(),
773        ));
774
775        // Reply headers as in <https://datatracker.ietf.org/doc/html/rfc5322#appendix-A.2>.
776        if !self.in_reply_to.is_empty() {
777            headers.push((
778                "In-Reply-To",
779                mail_builder::headers::message_id::MessageId::new(self.in_reply_to.clone()).into(),
780            ));
781        }
782        if !self.references.is_empty() {
783            headers.push((
784                "References",
785                mail_builder::headers::message_id::MessageId::<'static>::new_list(
786                    self.references.iter().map(|s| s.to_string()),
787                )
788                .into(),
789            ));
790        }
791
792        // Automatic Response headers <https://www.rfc-editor.org/rfc/rfc3834>
793        if let Loaded::Mdn { .. } = self.loaded {
794            headers.push((
795                "Auto-Submitted",
796                mail_builder::headers::raw::Raw::new("auto-replied".to_string()).into(),
797            ));
798        } else if context.get_config_bool(Config::Bot).await? {
799            headers.push((
800                "Auto-Submitted",
801                mail_builder::headers::raw::Raw::new("auto-generated".to_string()).into(),
802            ));
803        } else if let Loaded::Message { msg, .. } = &self.loaded {
804            if msg.param.get_cmd() == SystemMessage::SecurejoinMessage {
805                let step = msg.param.get(Param::Arg).unwrap_or_default();
806                if step != "vg-request" && step != "vc-request" {
807                    headers.push((
808                        "Auto-Submitted",
809                        mail_builder::headers::raw::Raw::new("auto-replied".to_string()).into(),
810                    ));
811                }
812            }
813        }
814
815        if let Loaded::Message { chat, .. } = &self.loaded {
816            if chat.typ == Chattype::OutBroadcast || chat.typ == Chattype::InBroadcast {
817                headers.push((
818                    "List-ID",
819                    mail_builder::headers::text::Text::new(format!(
820                        "{} <{}>",
821                        chat.name, chat.grpid
822                    ))
823                    .into(),
824                ));
825            }
826        }
827
828        if let Loaded::Message { msg, .. } = &self.loaded {
829            if let Some(original_rfc724_mid) = msg.param.get(Param::TextEditFor) {
830                headers.push((
831                    "Chat-Edit",
832                    mail_builder::headers::message_id::MessageId::new(
833                        original_rfc724_mid.to_string(),
834                    )
835                    .into(),
836                ));
837            } else if let Some(rfc724_mid_list) = msg.param.get(Param::DeleteRequestFor) {
838                headers.push((
839                    "Chat-Delete",
840                    mail_builder::headers::message_id::MessageId::new(rfc724_mid_list.to_string())
841                        .into(),
842                ));
843            }
844        }
845
846        // Non-standard headers.
847        headers.push((
848            "Chat-Version",
849            mail_builder::headers::raw::Raw::new("1.0").into(),
850        ));
851
852        if self.req_mdn {
853            // we use "Chat-Disposition-Notification-To"
854            // because replies to "Disposition-Notification-To" are weird in many cases
855            // eg. are just freetext and/or do not follow any standard.
856            headers.push((
857                "Chat-Disposition-Notification-To",
858                mail_builder::headers::raw::Raw::new(self.from_addr.clone()).into(),
859            ));
860        }
861
862        let grpimage = self.grpimage();
863        let skip_autocrypt = self.should_skip_autocrypt();
864        let encrypt_helper = EncryptHelper::new(context).await?;
865
866        if !skip_autocrypt {
867            // unless determined otherwise we add the Autocrypt header
868            let aheader = encrypt_helper.get_aheader().to_string();
869            headers.push((
870                "Autocrypt",
871                mail_builder::headers::raw::Raw::new(aheader).into(),
872            ));
873        }
874
875        let is_encrypted = self.encryption_keys.is_some();
876
877        // Add ephemeral timer for non-MDN messages.
878        // For MDNs it does not matter because they are not visible
879        // and ignored by the receiver.
880        if let Loaded::Message { msg, .. } = &self.loaded {
881            let ephemeral_timer = msg.chat_id.get_ephemeral_timer(context).await?;
882            if let EphemeralTimer::Enabled { duration } = ephemeral_timer {
883                headers.push((
884                    "Ephemeral-Timer",
885                    mail_builder::headers::raw::Raw::new(duration.to_string()).into(),
886                ));
887            }
888        }
889
890        let is_securejoin_message = if let Loaded::Message { msg, .. } = &self.loaded {
891            msg.param.get_cmd() == SystemMessage::SecurejoinMessage
892        } else {
893            false
894        };
895
896        let message: MimePart<'static> = match &self.loaded {
897            Loaded::Message { msg, .. } => {
898                let msg = msg.clone();
899                let (main_part, mut parts) = self
900                    .render_message(context, &mut headers, &grpimage, is_encrypted)
901                    .await?;
902                if parts.is_empty() {
903                    // Single part, render as regular message.
904                    main_part
905                } else {
906                    parts.insert(0, main_part);
907
908                    // Multiple parts, render as multipart.
909                    if msg.param.get_cmd() == SystemMessage::MultiDeviceSync {
910                        MimePart::new("multipart/report; report-type=multi-device-sync", parts)
911                    } else if msg.param.get_cmd() == SystemMessage::WebxdcStatusUpdate {
912                        MimePart::new("multipart/report; report-type=status-update", parts)
913                    } else {
914                        MimePart::new("multipart/mixed", parts)
915                    }
916                }
917            }
918            Loaded::Mdn { .. } => self.render_mdn()?,
919        };
920
921        // Split headers based on header confidentiality policy.
922
923        // Headers that must go into IMF header section.
924        //
925        // These are standard headers such as Date, In-Reply-To, References, which cannot be placed
926        // anywhere else according to the standard. Placing headers here also allows them to be fetched
927        // individually over IMAP without downloading the message body. This is why Chat-Version is
928        // placed here.
929        let mut unprotected_headers: Vec<(&'static str, HeaderType<'static>)> = Vec::new();
930
931        // Headers that MUST NOT (only) go into IMF header section:
932        // - Large headers which may hit the header section size limit on the server, such as
933        //   Chat-User-Avatar with a base64-encoded image inside.
934        // - Headers duplicated here that servers mess up with in the IMF header section, like
935        //   Message-ID.
936        // - Nonstandard headers that should be DKIM-protected because e.g. OpenDKIM only signs
937        //   known headers.
938        //
939        // The header should be hidden from MTA
940        // by moving it either into protected part
941        // in case of encrypted mails
942        // or unprotected MIME preamble in case of unencrypted mails.
943        let mut hidden_headers: Vec<(&'static str, HeaderType<'static>)> = Vec::new();
944
945        // Opportunistically protected headers.
946        //
947        // These headers are placed into encrypted part *if* the message is encrypted. Place headers
948        // which are not needed before decryption (e.g. Chat-Group-Name) or are not interesting if the
949        // message cannot be decrypted (e.g. Chat-Disposition-Notification-To) here.
950        //
951        // If the message is not encrypted, these headers are placed into IMF header section, so make
952        // sure that the message will be encrypted if you place any sensitive information here.
953        let mut protected_headers: Vec<(&'static str, HeaderType<'static>)> = Vec::new();
954
955        // MIME header <https://datatracker.ietf.org/doc/html/rfc2045>.
956        unprotected_headers.push((
957            "MIME-Version",
958            mail_builder::headers::raw::Raw::new("1.0").into(),
959        ));
960        for header @ (original_header_name, _header_value) in &headers {
961            let header_name = original_header_name.to_lowercase();
962            if header_name == "message-id" {
963                unprotected_headers.push(header.clone());
964                hidden_headers.push(header.clone());
965            } else if is_hidden(&header_name) {
966                hidden_headers.push(header.clone());
967            } else if header_name == "autocrypt"
968                && !context.get_config_bool(Config::ProtectAutocrypt).await?
969            {
970                unprotected_headers.push(header.clone());
971            } else if header_name == "from" {
972                // Unencrypted securejoin messages should _not_ include the display name:
973                if is_encrypted || !is_securejoin_message {
974                    protected_headers.push(header.clone());
975                }
976
977                unprotected_headers.push((
978                    original_header_name,
979                    Address::new_address(None::<&'static str>, self.from_addr.clone()).into(),
980                ));
981            } else if header_name == "to" {
982                protected_headers.push(header.clone());
983                if is_encrypted {
984                    let mut to_without_names = to
985                        .clone()
986                        .into_iter()
987                        .filter_map(|header| match header {
988                            Address::Address(mb) => Some(Address::Address(EmailAddress {
989                                name: None,
990                                email: mb.email,
991                            })),
992                            _ => None,
993                        })
994                        .collect::<Vec<_>>();
995                    if to_without_names.is_empty() {
996                        to_without_names.push(hidden_recipients());
997                    }
998                    unprotected_headers.push((
999                        original_header_name,
1000                        Address::new_list(to_without_names).into(),
1001                    ));
1002                } else {
1003                    unprotected_headers.push(header.clone());
1004                }
1005            } else if is_encrypted {
1006                protected_headers.push(header.clone());
1007
1008                match header_name.as_str() {
1009                    "subject" => {
1010                        unprotected_headers.push((
1011                            "Subject",
1012                            mail_builder::headers::raw::Raw::new("[...]").into(),
1013                        ));
1014                    }
1015                    "date"
1016                    | "in-reply-to"
1017                    | "references"
1018                    | "auto-submitted"
1019                    | "chat-version"
1020                    | "autocrypt-setup-message" => {
1021                        unprotected_headers.push(header.clone());
1022                    }
1023                    _ => {
1024                        // Other headers are removed from unprotected part.
1025                    }
1026                }
1027            } else {
1028                // Copy the header to the protected headers
1029                // in case of signed-only message.
1030                // If the message is not signed, this value will not be used.
1031                protected_headers.push(header.clone());
1032                unprotected_headers.push(header.clone())
1033            }
1034        }
1035
1036        let outer_message = if let Some(encryption_keys) = self.encryption_keys {
1037            // Store protected headers in the inner message.
1038            let message = protected_headers
1039                .into_iter()
1040                .fold(message, |message, (header, value)| {
1041                    message.header(header, value)
1042                });
1043
1044            // Add hidden headers to encrypted payload.
1045            let mut message: MimePart<'static> = hidden_headers
1046                .into_iter()
1047                .fold(message, |message, (header, value)| {
1048                    message.header(header, value)
1049                });
1050
1051            // Add gossip headers in chats with multiple recipients
1052            let multiple_recipients =
1053                encryption_keys.len() > 1 || context.get_config_bool(Config::BccSelf).await?;
1054
1055            let gossip_period = context.get_config_i64(Config::GossipPeriod).await?;
1056            let now = time();
1057
1058            match &self.loaded {
1059                Loaded::Message { chat, msg } => {
1060                    if chat.typ != Chattype::OutBroadcast {
1061                        for (addr, key) in &encryption_keys {
1062                            let fingerprint = key.dc_fingerprint().hex();
1063                            let cmd = msg.param.get_cmd();
1064                            let should_do_gossip = cmd == SystemMessage::MemberAddedToGroup
1065                                || cmd == SystemMessage::SecurejoinMessage
1066                                || multiple_recipients && {
1067                                    let gossiped_timestamp: Option<i64> = context
1068                                        .sql
1069                                        .query_get_value(
1070                                            "SELECT timestamp
1071                                         FROM gossip_timestamp
1072                                         WHERE chat_id=? AND fingerprint=?",
1073                                            (chat.id, &fingerprint),
1074                                        )
1075                                        .await?;
1076
1077                                    // `gossip_period == 0` is a special case for testing,
1078                                    // enabling gossip in every message.
1079                                    //
1080                                    // If current time is in the past compared to
1081                                    // `gossiped_timestamp`, we also gossip because
1082                                    // either the `gossiped_timestamp` or clock is wrong.
1083                                    gossip_period == 0
1084                                        || gossiped_timestamp
1085                                            .is_none_or(|ts| now >= ts + gossip_period || now < ts)
1086                                };
1087
1088                            if !should_do_gossip {
1089                                continue;
1090                            }
1091
1092                            let header = Aheader {
1093                                addr: addr.clone(),
1094                                public_key: key.clone(),
1095                                // Autocrypt 1.1.0 specification says that
1096                                // `prefer-encrypt` attribute SHOULD NOT be included.
1097                                prefer_encrypt: EncryptPreference::NoPreference,
1098                                verified: false,
1099                            }
1100                            .to_string();
1101
1102                            message = message.header(
1103                                "Autocrypt-Gossip",
1104                                mail_builder::headers::raw::Raw::new(header),
1105                            );
1106
1107                            context
1108                                .sql
1109                                .execute(
1110                                    "INSERT INTO gossip_timestamp (chat_id, fingerprint, timestamp)
1111                                     VALUES                       (?, ?, ?)
1112                                     ON CONFLICT                  (chat_id, fingerprint)
1113                                     DO UPDATE SET timestamp=excluded.timestamp",
1114                                    (chat.id, &fingerprint, now),
1115                                )
1116                                .await?;
1117                        }
1118                    }
1119                }
1120                Loaded::Mdn { .. } => {
1121                    // Never gossip in MDNs.
1122                }
1123            }
1124
1125            // Set the appropriate Content-Type for the inner message.
1126            for (h, v) in &mut message.headers {
1127                if h == "Content-Type" {
1128                    if let mail_builder::headers::HeaderType::ContentType(ct) = v {
1129                        *ct = ct.clone().attribute("protected-headers", "v1");
1130                    }
1131                }
1132            }
1133
1134            // Disable compression for SecureJoin to ensure
1135            // there are no compression side channels
1136            // leaking information about the tokens.
1137            let compress = match &self.loaded {
1138                Loaded::Message { msg, .. } => {
1139                    msg.param.get_cmd() != SystemMessage::SecurejoinMessage
1140                }
1141                Loaded::Mdn { .. } => true,
1142            };
1143
1144            // Encrypt to self unconditionally,
1145            // even for a single-device setup.
1146            let mut encryption_keyring = vec![encrypt_helper.public_key.clone()];
1147            encryption_keyring.extend(encryption_keys.iter().map(|(_addr, key)| (*key).clone()));
1148
1149            // XXX: additional newline is needed
1150            // to pass filtermail at
1151            // <https://github.com/deltachat/chatmail/blob/4d915f9800435bf13057d41af8d708abd34dbfa8/chatmaild/src/chatmaild/filtermail.py#L84-L86>
1152            let encrypted = encrypt_helper
1153                .encrypt(context, encryption_keyring, message, compress)
1154                .await?
1155                + "\n";
1156
1157            // Set the appropriate Content-Type for the outer message
1158            MimePart::new(
1159                "multipart/encrypted; protocol=\"application/pgp-encrypted\"",
1160                vec![
1161                    // Autocrypt part 1
1162                    MimePart::new("application/pgp-encrypted", "Version: 1\r\n").header(
1163                        "Content-Description",
1164                        mail_builder::headers::raw::Raw::new("PGP/MIME version identification"),
1165                    ),
1166                    // Autocrypt part 2
1167                    MimePart::new(
1168                        "application/octet-stream; name=\"encrypted.asc\"",
1169                        encrypted,
1170                    )
1171                    .header(
1172                        "Content-Description",
1173                        mail_builder::headers::raw::Raw::new("OpenPGP encrypted message"),
1174                    )
1175                    .header(
1176                        "Content-Disposition",
1177                        mail_builder::headers::raw::Raw::new("inline; filename=\"encrypted.asc\";"),
1178                    ),
1179                ],
1180            )
1181        } else if matches!(self.loaded, Loaded::Mdn { .. }) {
1182            // Never add outer multipart/mixed wrapper to MDN
1183            // as multipart/report Content-Type is used to recognize MDNs
1184            // by Delta Chat receiver and Chatmail servers
1185            // allowing them to be unencrypted and not contain Autocrypt header
1186            // without resetting Autocrypt encryption or triggering Chatmail filter
1187            // that normally only allows encrypted mails.
1188
1189            // Hidden headers are dropped.
1190            message
1191        } else {
1192            let message = hidden_headers
1193                .into_iter()
1194                .fold(message, |message, (header, value)| {
1195                    message.header(header, value)
1196                });
1197            let message = MimePart::new("multipart/mixed", vec![message]);
1198            let mut message = protected_headers
1199                .iter()
1200                .fold(message, |message, (header, value)| {
1201                    message.header(*header, value.clone())
1202                });
1203
1204            if skip_autocrypt || !context.get_config_bool(Config::SignUnencrypted).await? {
1205                // Deduplicate unprotected headers that also are in the protected headers:
1206                let protected: HashSet<&str> =
1207                    HashSet::from_iter(protected_headers.iter().map(|(header, _value)| *header));
1208                unprotected_headers.retain(|(header, _value)| !protected.contains(header));
1209
1210                message
1211            } else {
1212                for (h, v) in &mut message.headers {
1213                    if h == "Content-Type" {
1214                        if let mail_builder::headers::HeaderType::ContentType(ct) = v {
1215                            *ct = ct.clone().attribute("protected-headers", "v1");
1216                        }
1217                    }
1218                }
1219
1220                let signature = encrypt_helper.sign(context, &message).await?;
1221                MimePart::new(
1222                    "multipart/signed; protocol=\"application/pgp-signature\"; protected",
1223                    vec![
1224                        message,
1225                        MimePart::new(
1226                            "application/pgp-signature; name=\"signature.asc\"",
1227                            signature,
1228                        )
1229                        .header(
1230                            "Content-Description",
1231                            mail_builder::headers::raw::Raw::<'static>::new(
1232                                "OpenPGP digital signature",
1233                            ),
1234                        )
1235                        .attachment("signature"),
1236                    ],
1237                )
1238            }
1239        };
1240
1241        // Store the unprotected headers on the outer message.
1242        let outer_message = unprotected_headers
1243            .into_iter()
1244            .fold(outer_message, |message, (header, value)| {
1245                message.header(header, value)
1246            });
1247
1248        let MimeFactory {
1249            last_added_location_id,
1250            ..
1251        } = self;
1252
1253        let mut buffer = Vec::new();
1254        let cursor = Cursor::new(&mut buffer);
1255        outer_message.clone().write_part(cursor).ok();
1256        let message = String::from_utf8_lossy(&buffer).to_string();
1257
1258        Ok(RenderedEmail {
1259            message,
1260            // envelope: Envelope::new,
1261            is_encrypted,
1262            last_added_location_id,
1263            sync_ids_to_delete: self.sync_ids_to_delete,
1264            rfc724_mid,
1265            subject: subject_str,
1266        })
1267    }
1268
1269    /// Returns MIME part with a `message.kml` attachment.
1270    fn get_message_kml_part(&self) -> Option<MimePart<'static>> {
1271        let Loaded::Message { msg, .. } = &self.loaded else {
1272            return None;
1273        };
1274
1275        let latitude = msg.param.get_float(Param::SetLatitude)?;
1276        let longitude = msg.param.get_float(Param::SetLongitude)?;
1277
1278        let kml_file = location::get_message_kml(msg.timestamp_sort, latitude, longitude);
1279        let part = MimePart::new("application/vnd.google-earth.kml+xml", kml_file)
1280            .attachment("message.kml");
1281        Some(part)
1282    }
1283
1284    /// Returns MIME part with a `location.kml` attachment.
1285    async fn get_location_kml_part(
1286        &mut self,
1287        context: &Context,
1288    ) -> Result<Option<MimePart<'static>>> {
1289        let Loaded::Message { msg, .. } = &self.loaded else {
1290            return Ok(None);
1291        };
1292
1293        let Some((kml_content, last_added_location_id)) =
1294            location::get_kml(context, msg.chat_id).await?
1295        else {
1296            return Ok(None);
1297        };
1298
1299        let part = MimePart::new("application/vnd.google-earth.kml+xml", kml_content)
1300            .attachment("location.kml");
1301        if !msg.param.exists(Param::SetLatitude) {
1302            // otherwise, the independent location is already filed
1303            self.last_added_location_id = Some(last_added_location_id);
1304        }
1305        Ok(Some(part))
1306    }
1307
1308    async fn render_message(
1309        &mut self,
1310        context: &Context,
1311        headers: &mut Vec<(&'static str, HeaderType<'static>)>,
1312        grpimage: &Option<String>,
1313        is_encrypted: bool,
1314    ) -> Result<(MimePart<'static>, Vec<MimePart<'static>>)> {
1315        let Loaded::Message { chat, msg } = &self.loaded else {
1316            bail!("Attempt to render MDN as a message");
1317        };
1318        let chat = chat.clone();
1319        let msg = msg.clone();
1320        let command = msg.param.get_cmd();
1321        let mut placeholdertext = None;
1322
1323        let send_verified_headers = match chat.typ {
1324            Chattype::Single => true,
1325            Chattype::Group => true,
1326            // Mailinglists and broadcast channels can actually never be verified:
1327            Chattype::Mailinglist => false,
1328            Chattype::OutBroadcast | Chattype::InBroadcast => false,
1329        };
1330        if chat.is_protected() && send_verified_headers {
1331            headers.push((
1332                "Chat-Verified",
1333                mail_builder::headers::raw::Raw::new("1").into(),
1334            ));
1335        }
1336
1337        if chat.typ == Chattype::Group {
1338            // Send group ID unless it is an ad hoc group that has no ID.
1339            if !chat.grpid.is_empty() {
1340                headers.push((
1341                    "Chat-Group-ID",
1342                    mail_builder::headers::raw::Raw::new(chat.grpid.clone()).into(),
1343                ));
1344            }
1345        }
1346
1347        if chat.typ == Chattype::Group
1348            || chat.typ == Chattype::OutBroadcast
1349            || chat.typ == Chattype::InBroadcast
1350        {
1351            headers.push((
1352                "Chat-Group-Name",
1353                mail_builder::headers::text::Text::new(chat.name.to_string()).into(),
1354            ));
1355            if let Some(ts) = chat.param.get_i64(Param::GroupNameTimestamp) {
1356                headers.push((
1357                    "Chat-Group-Name-Timestamp",
1358                    mail_builder::headers::text::Text::new(ts.to_string()).into(),
1359                ));
1360            }
1361
1362            match command {
1363                SystemMessage::MemberRemovedFromGroup => {
1364                    ensure!(chat.typ != Chattype::OutBroadcast);
1365                    let email_to_remove = msg.param.get(Param::Arg).unwrap_or_default();
1366
1367                    if email_to_remove
1368                        == context
1369                            .get_config(Config::ConfiguredAddr)
1370                            .await?
1371                            .unwrap_or_default()
1372                    {
1373                        placeholdertext = Some(stock_str::msg_group_left_remote(context).await);
1374                    } else {
1375                        placeholdertext =
1376                            Some(stock_str::msg_del_member_remote(context, email_to_remove).await);
1377                    };
1378
1379                    if !email_to_remove.is_empty() {
1380                        headers.push((
1381                            "Chat-Group-Member-Removed",
1382                            mail_builder::headers::raw::Raw::new(email_to_remove.to_string())
1383                                .into(),
1384                        ));
1385                    }
1386                }
1387                SystemMessage::MemberAddedToGroup => {
1388                    ensure!(chat.typ != Chattype::OutBroadcast);
1389                    // TODO: lookup the contact by ID rather than email address.
1390                    // We are adding key-contacts, the cannot be looked up by address.
1391                    let email_to_add = msg.param.get(Param::Arg).unwrap_or_default();
1392                    placeholdertext =
1393                        Some(stock_str::msg_add_member_remote(context, email_to_add).await);
1394
1395                    if !email_to_add.is_empty() {
1396                        headers.push((
1397                            "Chat-Group-Member-Added",
1398                            mail_builder::headers::raw::Raw::new(email_to_add.to_string()).into(),
1399                        ));
1400                    }
1401                    if 0 != msg.param.get_int(Param::Arg2).unwrap_or_default() & DC_FROM_HANDSHAKE {
1402                        info!(
1403                            context,
1404                            "Sending secure-join message {:?}.", "vg-member-added",
1405                        );
1406                        headers.push((
1407                            "Secure-Join",
1408                            mail_builder::headers::raw::Raw::new("vg-member-added".to_string())
1409                                .into(),
1410                        ));
1411                    }
1412                }
1413                SystemMessage::GroupNameChanged => {
1414                    let old_name = msg.param.get(Param::Arg).unwrap_or_default().to_string();
1415                    headers.push((
1416                        "Chat-Group-Name-Changed",
1417                        mail_builder::headers::text::Text::new(old_name).into(),
1418                    ));
1419                }
1420                SystemMessage::GroupImageChanged => {
1421                    headers.push((
1422                        "Chat-Content",
1423                        mail_builder::headers::text::Text::new("group-avatar-changed").into(),
1424                    ));
1425                    if grpimage.is_none() {
1426                        headers.push((
1427                            "Chat-Group-Avatar",
1428                            mail_builder::headers::raw::Raw::new("0").into(),
1429                        ));
1430                    }
1431                }
1432                _ => {}
1433            }
1434        }
1435
1436        match command {
1437            SystemMessage::LocationStreamingEnabled => {
1438                headers.push((
1439                    "Chat-Content",
1440                    mail_builder::headers::raw::Raw::new("location-streaming-enabled").into(),
1441                ));
1442            }
1443            SystemMessage::EphemeralTimerChanged => {
1444                headers.push((
1445                    "Chat-Content",
1446                    mail_builder::headers::raw::Raw::new("ephemeral-timer-changed").into(),
1447                ));
1448            }
1449            SystemMessage::LocationOnly
1450            | SystemMessage::MultiDeviceSync
1451            | SystemMessage::WebxdcStatusUpdate => {
1452                // This should prevent automatic replies,
1453                // such as non-delivery reports.
1454                //
1455                // See <https://tools.ietf.org/html/rfc3834>
1456                //
1457                // Adding this header without encryption leaks some
1458                // information about the message contents, but it can
1459                // already be easily guessed from message timing and size.
1460                headers.push((
1461                    "Auto-Submitted",
1462                    mail_builder::headers::raw::Raw::new("auto-generated").into(),
1463                ));
1464            }
1465            SystemMessage::AutocryptSetupMessage => {
1466                headers.push((
1467                    "Autocrypt-Setup-Message",
1468                    mail_builder::headers::raw::Raw::new("v1").into(),
1469                ));
1470
1471                placeholdertext = Some(ASM_SUBJECT.to_string());
1472            }
1473            SystemMessage::SecurejoinMessage => {
1474                let step = msg.param.get(Param::Arg).unwrap_or_default();
1475                if !step.is_empty() {
1476                    info!(context, "Sending secure-join message {step:?}.");
1477                    headers.push((
1478                        "Secure-Join",
1479                        mail_builder::headers::raw::Raw::new(step.to_string()).into(),
1480                    ));
1481
1482                    let param2 = msg.param.get(Param::Arg2).unwrap_or_default();
1483                    if !param2.is_empty() {
1484                        headers.push((
1485                            if step == "vg-request-with-auth" || step == "vc-request-with-auth" {
1486                                "Secure-Join-Auth"
1487                            } else {
1488                                "Secure-Join-Invitenumber"
1489                            },
1490                            mail_builder::headers::text::Text::new(param2.to_string()).into(),
1491                        ));
1492                    }
1493
1494                    let fingerprint = msg.param.get(Param::Arg3).unwrap_or_default();
1495                    if !fingerprint.is_empty() {
1496                        headers.push((
1497                            "Secure-Join-Fingerprint",
1498                            mail_builder::headers::raw::Raw::new(fingerprint.to_string()).into(),
1499                        ));
1500                    }
1501                    if let Some(id) = msg.param.get(Param::Arg4) {
1502                        headers.push((
1503                            "Secure-Join-Group",
1504                            mail_builder::headers::raw::Raw::new(id.to_string()).into(),
1505                        ));
1506                    };
1507                }
1508            }
1509            SystemMessage::ChatProtectionEnabled => {
1510                headers.push((
1511                    "Chat-Content",
1512                    mail_builder::headers::raw::Raw::new("protection-enabled").into(),
1513                ));
1514            }
1515            SystemMessage::ChatProtectionDisabled => {
1516                headers.push((
1517                    "Chat-Content",
1518                    mail_builder::headers::raw::Raw::new("protection-disabled").into(),
1519                ));
1520            }
1521            SystemMessage::IrohNodeAddr => {
1522                let node_addr = context
1523                    .get_or_try_init_peer_channel()
1524                    .await?
1525                    .get_node_addr()
1526                    .await?;
1527
1528                // We should not send `null` as relay URL
1529                // as this is the only way to reach the node.
1530                debug_assert!(node_addr.relay_url().is_some());
1531                headers.push((
1532                    HeaderDef::IrohNodeAddr.into(),
1533                    mail_builder::headers::text::Text::new(serde_json::to_string(&node_addr)?)
1534                        .into(),
1535                ));
1536            }
1537            SystemMessage::CallAccepted => {
1538                headers.push((
1539                    "Chat-Content",
1540                    mail_builder::headers::raw::Raw::new("call-accepted").into(),
1541                ));
1542            }
1543            SystemMessage::CallEnded => {
1544                headers.push((
1545                    "Chat-Content",
1546                    mail_builder::headers::raw::Raw::new("call-ended").into(),
1547                ));
1548            }
1549            _ => {}
1550        }
1551
1552        if let Some(grpimage) = grpimage {
1553            info!(context, "setting group image '{}'", grpimage);
1554            let avatar = build_avatar_file(context, grpimage)
1555                .await
1556                .context("Cannot attach group image")?;
1557            headers.push((
1558                "Chat-Group-Avatar",
1559                mail_builder::headers::raw::Raw::new(format!("base64:{avatar}")).into(),
1560            ));
1561        }
1562
1563        if msg.viewtype == Viewtype::Sticker {
1564            headers.push((
1565                "Chat-Content",
1566                mail_builder::headers::raw::Raw::new("sticker").into(),
1567            ));
1568        } else if msg.viewtype == Viewtype::Call {
1569            headers.push((
1570                "Chat-Content",
1571                mail_builder::headers::raw::Raw::new("call").into(),
1572            ));
1573            placeholdertext = Some(
1574                "[This is a 'Call'. The sender uses an experiment not supported on your version yet]".to_string(),
1575            );
1576        }
1577
1578        if let Some(offer) = msg.param.get(Param::WebrtcRoom) {
1579            headers.push((
1580                "Chat-Webrtc-Room",
1581                mail_builder::headers::raw::Raw::new(b_encode(offer)).into(),
1582            ));
1583        } else if let Some(answer) = msg.param.get(Param::WebrtcAccepted) {
1584            headers.push((
1585                "Chat-Webrtc-Accepted",
1586                mail_builder::headers::raw::Raw::new(b_encode(answer)).into(),
1587            ));
1588        }
1589
1590        if msg.viewtype == Viewtype::Voice
1591            || msg.viewtype == Viewtype::Audio
1592            || msg.viewtype == Viewtype::Video
1593        {
1594            if msg.viewtype == Viewtype::Voice {
1595                headers.push((
1596                    "Chat-Voice-Message",
1597                    mail_builder::headers::raw::Raw::new("1").into(),
1598                ));
1599            }
1600            let duration_ms = msg.param.get_int(Param::Duration).unwrap_or_default();
1601            if duration_ms > 0 {
1602                let dur = duration_ms.to_string();
1603                headers.push((
1604                    "Chat-Duration",
1605                    mail_builder::headers::raw::Raw::new(dur).into(),
1606                ));
1607            }
1608        }
1609
1610        // add text part - we even add empty text and force a MIME-multipart-message as:
1611        // - some Apps have problems with Non-text in the main part (eg. "Mail" from stock Android)
1612        // - we can add "forward hints" this way
1613        // - it looks better
1614
1615        let afwd_email = msg.param.exists(Param::Forwarded);
1616        let fwdhint = if afwd_email {
1617            Some(
1618                "---------- Forwarded message ----------\r\n\
1619                 From: Delta Chat\r\n\
1620                 \r\n"
1621                    .to_string(),
1622            )
1623        } else {
1624            None
1625        };
1626
1627        let final_text = placeholdertext.as_deref().unwrap_or(&msg.text);
1628
1629        let mut quoted_text = None;
1630        if let Some(msg_quoted_text) = msg.quoted_text() {
1631            let mut some_quoted_text = String::new();
1632            for quoted_line in msg_quoted_text.split('\n') {
1633                some_quoted_text += "> ";
1634                some_quoted_text += quoted_line;
1635                some_quoted_text += "\r\n";
1636            }
1637            some_quoted_text += "\r\n";
1638            quoted_text = Some(some_quoted_text)
1639        }
1640
1641        if !is_encrypted && msg.param.get_bool(Param::ProtectQuote).unwrap_or_default() {
1642            // Message is not encrypted but quotes encrypted message.
1643            quoted_text = Some("> ...\r\n\r\n".to_string());
1644        }
1645        if quoted_text.is_none() && final_text.starts_with('>') {
1646            // Insert empty line to avoid receiver treating user-sent quote as topquote inserted by
1647            // Delta Chat.
1648            quoted_text = Some("\r\n".to_string());
1649        }
1650
1651        let is_reaction = msg.param.get_int(Param::Reaction).unwrap_or_default() != 0;
1652
1653        let footer = if is_reaction { "" } else { &self.selfstatus };
1654
1655        let message_text = format!(
1656            "{}{}{}{}{}{}",
1657            fwdhint.unwrap_or_default(),
1658            quoted_text.unwrap_or_default(),
1659            escape_message_footer_marks(final_text),
1660            if !final_text.is_empty() && !footer.is_empty() {
1661                "\r\n\r\n"
1662            } else {
1663                ""
1664            },
1665            if !footer.is_empty() { "-- \r\n" } else { "" },
1666            footer
1667        );
1668
1669        let mut main_part = MimePart::new("text/plain", message_text);
1670        if is_reaction {
1671            main_part = main_part.header(
1672                "Content-Disposition",
1673                mail_builder::headers::raw::Raw::new("reaction"),
1674            );
1675        }
1676
1677        let mut parts = Vec::new();
1678
1679        // add HTML-part, this is needed only if a HTML-message from a non-delta-client is forwarded;
1680        // for simplificity and to avoid conversion errors, we're generating the HTML-part from the original message.
1681        if msg.has_html() {
1682            let html = if let Some(orig_msg_id) = msg.param.get_int(Param::Forwarded) {
1683                MsgId::new(orig_msg_id.try_into()?)
1684                    .get_html(context)
1685                    .await?
1686            } else {
1687                msg.param.get(Param::SendHtml).map(|s| s.to_string())
1688            };
1689            if let Some(html) = html {
1690                main_part = MimePart::new(
1691                    "multipart/alternative",
1692                    vec![main_part, MimePart::new("text/html", html)],
1693                )
1694            }
1695        }
1696
1697        // add attachment part
1698        if msg.viewtype.has_file() {
1699            let file_part = build_body_file(context, &msg).await?;
1700            parts.push(file_part);
1701        }
1702
1703        if let Some(msg_kml_part) = self.get_message_kml_part() {
1704            parts.push(msg_kml_part);
1705        }
1706
1707        if location::is_sending_locations_to_chat(context, Some(msg.chat_id)).await? {
1708            if let Some(part) = self.get_location_kml_part(context).await? {
1709                parts.push(part);
1710            }
1711        }
1712
1713        // we do not piggyback sync-files to other self-sent-messages
1714        // to not risk files becoming too larger and being skipped by download-on-demand.
1715        if command == SystemMessage::MultiDeviceSync {
1716            let json = msg.param.get(Param::Arg).unwrap_or_default();
1717            let ids = msg.param.get(Param::Arg2).unwrap_or_default();
1718            parts.push(context.build_sync_part(json.to_string()));
1719            self.sync_ids_to_delete = Some(ids.to_string());
1720        } else if command == SystemMessage::WebxdcStatusUpdate {
1721            let json = msg.param.get(Param::Arg).unwrap_or_default();
1722            parts.push(context.build_status_update_part(json));
1723        } else if msg.viewtype == Viewtype::Webxdc {
1724            let topic = self
1725                .webxdc_topic
1726                .map(|top| BASE32_NOPAD.encode(top.as_bytes()).to_ascii_lowercase())
1727                .unwrap_or(create_iroh_header(context, msg.id).await?);
1728            headers.push((
1729                HeaderDef::IrohGossipTopic.get_headername(),
1730                mail_builder::headers::raw::Raw::new(topic).into(),
1731            ));
1732            if let (Some(json), _) = context
1733                .render_webxdc_status_update_object(
1734                    msg.id,
1735                    StatusUpdateSerial::MIN,
1736                    StatusUpdateSerial::MAX,
1737                    None,
1738                )
1739                .await?
1740            {
1741                parts.push(context.build_status_update_part(&json));
1742            }
1743        }
1744
1745        if self.attach_selfavatar {
1746            match context.get_config(Config::Selfavatar).await? {
1747                Some(path) => match build_avatar_file(context, &path).await {
1748                    Ok(avatar) => headers.push((
1749                        "Chat-User-Avatar",
1750                        mail_builder::headers::raw::Raw::new(format!("base64:{avatar}")).into(),
1751                    )),
1752                    Err(err) => warn!(context, "mimefactory: cannot attach selfavatar: {}", err),
1753                },
1754                None => headers.push((
1755                    "Chat-User-Avatar",
1756                    mail_builder::headers::raw::Raw::new("0").into(),
1757                )),
1758            }
1759        }
1760
1761        Ok((main_part, parts))
1762    }
1763
1764    /// Render an MDN
1765    fn render_mdn(&mut self) -> Result<MimePart<'static>> {
1766        // RFC 6522, this also requires the `report-type` parameter which is equal
1767        // to the MIME subtype of the second body part of the multipart/report
1768        let Loaded::Mdn {
1769            rfc724_mid,
1770            additional_msg_ids,
1771        } = &self.loaded
1772        else {
1773            bail!("Attempt to render a message as MDN");
1774        };
1775
1776        // first body part: always human-readable, always REQUIRED by RFC 6522.
1777        // untranslated to no reveal sender's language.
1778        // moreover, translations in unknown languages are confusing, and clients may not display them at all
1779        let text_part = MimePart::new("text/plain", "This is a receipt notification.");
1780
1781        let mut message = MimePart::new(
1782            "multipart/report; report-type=disposition-notification",
1783            vec![text_part],
1784        );
1785
1786        // second body part: machine-readable, always REQUIRED by RFC 6522
1787        let message_text2 = format!(
1788            "Original-Recipient: rfc822;{}\r\n\
1789             Final-Recipient: rfc822;{}\r\n\
1790             Original-Message-ID: <{}>\r\n\
1791             Disposition: manual-action/MDN-sent-automatically; displayed\r\n",
1792            self.from_addr, self.from_addr, rfc724_mid
1793        );
1794
1795        let extension_fields = if additional_msg_ids.is_empty() {
1796            "".to_string()
1797        } else {
1798            "Additional-Message-IDs: ".to_string()
1799                + &additional_msg_ids
1800                    .iter()
1801                    .map(|mid| render_rfc724_mid(mid))
1802                    .collect::<Vec<String>>()
1803                    .join(" ")
1804                + "\r\n"
1805        };
1806
1807        message.add_part(MimePart::new(
1808            "message/disposition-notification",
1809            message_text2 + &extension_fields,
1810        ));
1811
1812        Ok(message)
1813    }
1814}
1815
1816fn hidden_recipients() -> Address<'static> {
1817    Address::new_group(Some("hidden-recipients".to_string()), Vec::new())
1818}
1819
1820async fn build_body_file(context: &Context, msg: &Message) -> Result<MimePart<'static>> {
1821    let file_name = msg.get_filename().context("msg has no file")?;
1822    let blob = msg
1823        .param
1824        .get_file_blob(context)?
1825        .context("msg has no file")?;
1826    let mimetype = msg
1827        .param
1828        .get(Param::MimeType)
1829        .unwrap_or("application/octet-stream")
1830        .to_string();
1831    let body = fs::read(blob.to_abs_path()).await?;
1832
1833    // create mime part, for Content-Disposition, see RFC 2183.
1834    // `Content-Disposition: attachment` seems not to make a difference to `Content-Disposition: inline`
1835    // at least on tested Thunderbird and Gma'l in 2017.
1836    // But I've heard about problems with inline and outl'k, so we just use the attachment-type until we
1837    // run into other problems ...
1838    let mail = MimePart::new(mimetype, body).attachment(sanitize_bidi_characters(&file_name));
1839
1840    Ok(mail)
1841}
1842
1843async fn build_avatar_file(context: &Context, path: &str) -> Result<String> {
1844    let blob = match path.starts_with("$BLOBDIR/") {
1845        true => BlobObject::from_name(context, path)?,
1846        false => BlobObject::from_path(context, path.as_ref())?,
1847    };
1848    let body = fs::read(blob.to_abs_path()).await?;
1849    let encoded_body = base64::engine::general_purpose::STANDARD
1850        .encode(&body)
1851        .chars()
1852        .enumerate()
1853        .fold(String::new(), |mut res, (i, c)| {
1854            if i % 78 == 77 {
1855                res.push(' ')
1856            }
1857            res.push(c);
1858            res
1859        });
1860    Ok(encoded_body)
1861}
1862
1863fn recipients_contain_addr(recipients: &[(String, String)], addr: &str) -> bool {
1864    let addr_lc = addr.to_lowercase();
1865    recipients
1866        .iter()
1867        .any(|(_, cur)| cur.to_lowercase() == addr_lc)
1868}
1869
1870fn render_rfc724_mid(rfc724_mid: &str) -> String {
1871    let rfc724_mid = rfc724_mid.trim().to_string();
1872
1873    if rfc724_mid.chars().next().unwrap_or_default() == '<' {
1874        rfc724_mid
1875    } else {
1876        format!("<{rfc724_mid}>")
1877    }
1878}
1879
1880/// Encodes UTF-8 string as a single B-encoded-word.
1881///
1882/// We manually encode some headers because as of
1883/// version 0.4.4 mail-builder crate does not encode
1884/// newlines correctly if they appear in a text header.
1885fn b_encode(value: &str) -> String {
1886    format!(
1887        "=?utf-8?B?{}?=",
1888        base64::engine::general_purpose::STANDARD.encode(value)
1889    )
1890}
1891
1892#[cfg(test)]
1893mod mimefactory_tests;