1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
|
/**
* Copyright (C) 2021-2024 Saturneric <eric@bktus.com>
*
* This file is part of GpgFrontend.
*
* GpgFrontend is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* GpgFrontend is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with GpgFrontend. If not, see <https://www.gnu.org/licenses/>.
*
* The initial version of the source code is inherited from
* the gpg4usb project, which is under GPL-3.0-or-later.
*
* All the source code of GpgFrontend was modified and released by
* Saturneric <eric@bktus.com> starting on May 12, 2021.
*
* SPDX-License-Identifier: GPL-3.0-or-later
*
*/
#pragma once
#include <QJsonObject>
#include <QList>
#include <QString>
#include <QStringList>
/**
* @brief How a transport reaches its server.
*
* Deliberately three values and not a free-form "port + a checkbox". The
* security of the connection is the thing being chosen; the port follows from
* it. A port number never implies a security level -- 143 means STARTTLS on
* 143, not cleartext on 143.
*/
enum class MailTlsMode : uint8_t {
kIMPLICIT = 0, ///< TLS from the first byte (993 / 465)
kSTARTTLS, ///< negotiate on the cleartext port (143 / 587)
kNONE, ///< cleartext; only ever legal for a loopback host
};
auto MailTlsModeToString(MailTlsMode mode) -> QString;
auto MailTlsModeFromString(const QString& s) -> MailTlsMode;
/**
* @brief Whether a host may legally be spoken to in the clear.
*
* The whole of the plaintext policy, in one function, so it cannot drift
* between the settings page and the transports. Only loopback qualifies, and
* there is deliberately no override for anything else: an override that exists
* is eventually used to work around a certificate problem it was never meant
* to solve.
*
* @param host hostname or literal address as the user typed it
* @return true when kNONE is a permissible choice for @p host
*/
auto MailHostAllowsCleartext(const QString& host) -> bool;
/**
* @brief The port a transport uses when the user has not overridden it.
*
* @param imap true for IMAP, false for SMTP
* @param mode the chosen security
* @return the well-known port, or 0 when @p mode has none
*/
auto MailDefaultPort(bool imap, MailTlsMode mode) -> quint16;
/**
* @brief One transport of an account.
*
* IMAP and SMTP are configured independently and either may be absent: an
* account is a grouping for the user's convenience, not a claim that both
* protocols exist. Nothing may require one because the other is present.
*/
struct MailTransportConfig {
bool enabled{false};
QString host;
/// Not configurable and not persisted. The port follows from @ref tls as a
/// matter of policy, which is what MailDefaultPort expresses: a port number
/// must never be able to imply a security level. This field exists only so
/// a test can reach a fake server on an ephemeral loopback port; 0, its
/// value everywhere else, means "use the policy port".
quint16 port{0};
MailTlsMode tls{MailTlsMode::kIMPLICIT};
QString username;
/// Fingerprint of the one certificate the user chose to trust for this
/// transport, lowercase hex, empty when none. A pin is not "ignore TLS
/// errors": it excuses an untrusted or self-signed chain and nothing else,
/// so expiry and hostname mismatch still fail with one in place.
QString pinned_cert_sha256;
[[nodiscard]] auto EffectivePort(bool imap) const -> quint16 {
return port != 0 ? port : MailDefaultPort(imap, tls);
}
[[nodiscard]] auto ToJson() const -> QJsonObject;
static auto FromJson(const QJsonObject& json) -> MailTransportConfig;
};
/**
* @brief A configured mail account.
*
* Holds no password. @ref secret_ref names an entry in the credential store;
* the secret itself never appears in this struct, is never serialized with it,
* and so cannot leak through a settings export or a log line that prints one
* of these.
*/
struct MailAccountConfig {
/// Stable identity of the account, minted once. Also the credential key, so
/// it must not change when the user renames or re-hosts the account.
QString id;
QString display_name;
QString address;
QString reply_to;
/// Fingerprint of the key to offer by default when signing from this
/// identity. Advisory: the user can always choose another.
QString default_key_fpr;
MailTransportConfig imap;
MailTransportConfig smtp;
/// Folder to look in for a Sent copy, when the server does not advertise one
/// via RFC 6154 SPECIAL-USE. Empty means "discover it", which is the normal
/// case; this exists because discovery genuinely fails on some servers.
QString sent_folder_override;
/// Rows per page in the message picker. Clamped to the allowed set on read,
[[nodiscard]] auto Label() const -> QString;
/// Whether this account is coherent enough to be used at all.
[[nodiscard]] auto IsUsable() const -> bool;
[[nodiscard]] auto ToJson() const -> QJsonObject;
static auto FromJson(const QJsonObject& json) -> MailAccountConfig;
};
/// The page sizes the picker offers. Small, fixed, and the only listing knob.
auto MailAllowedPageSizes() -> QList<int>;
/// Nearest allowed page size to @p requested.
auto MailClampPageSize(int requested) -> int;
/**
* @brief Most rows one picker session will ever retain.
*
* A ceiling on the session, not on the mailbox: on reaching it the picker stops
* loading and asks the user to narrow with a search, rather than growing until
* something gives.
*/
constexpr int kMailMaxRetainedRows = 1000;
/// Rows loaded before the user asks for more.
constexpr int kMailDefaultPageSize = 50;
/**
* @brief Largest message this application will load, encoded.
*
* One number, applied identically to opening a file and to fetching over IMAP,
* so the two can never disagree about what is too big. It is a limit on the
* *encoded* message: base64 inflates an attachment by about 4/3, so this admits
* roughly three quarters of its value in actual attachment bytes.
*/
constexpr qint64 kMailMaxMessageSize = 64LL * 1024 * 1024;
|
