gamertan
494b72fa3b
verify / verify (push) Successful in 4m29s
Reviewed source export adds verified TLS mail, encrypted outbox, mailbox verification and password reset protocols. Preserve public ancestry; omit local development history and operational queue. Consumer deployment and inbox delivery proof remain separate.
33 lines
2.0 KiB
Markdown
33 lines
2.0 KiB
Markdown
<!-- SPDX-License-Identifier: MPL-2.0 -->
|
|
|
|
# Transactional mail transport
|
|
|
|
`mail.Message` is one bounded UTF-8 plain-text message with a stable ID/date and
|
|
one ASCII envelope recipient. `NewSMTP` binds a fixed, configured sender and
|
|
dedicated SMTP credentials. Use implicit TLS (normally465) or required STARTTLS
|
|
(normally587). Certificate chain and hostname verification are mandatory; no
|
|
plaintext fallback or caller-provided arbitrary headers/attachments exist.
|
|
|
|
The standard-library transport uses a bounded connection deadline and cancellation
|
|
across TLS and SMTP. Message IDs survive retries. Errors expose only a fixed
|
|
stage, numeric SMTP code and retry classification; raw server responses are not
|
|
propagated because they can contain addresses or credentials. Successful DATA
|
|
acceptance is success even if QUIT fails. A connection failure around acceptance
|
|
can still produce duplicate delivery on retry: SMTP is not exactly-once transport,
|
|
and acceptance is not proof of inbox placement.
|
|
|
|
Applications own authorized recipients, email templates, trusted HTTPS link
|
|
origins, rate limits, encrypted persistence and the worker. Never log message
|
|
content or serialize credentials into ordinary diagnostics. Debug string methods
|
|
redact sensitive content but are not a substitute for safe logging policy.
|
|
No account verification/reset protocol is implemented by this transport itself.
|
|
|
|
Verified locally with disposable SMTP servers: implicit/STARTTLS delivery,
|
|
certificate/hostname rejection, no-downgrade behavior, auth/recipient error
|
|
classification, cancellation after connection, MIME round-trip, injection/bounds
|
|
and acceptance followed by QUIT failure. `go test -race ./mail` and `go vet ./mail`
|
|
pass on Go1.26.6. No real credentials, message delivery, public package release or
|
|
consumer deployment are claimed. The [encrypted outbox](../mailsqlite/README.md)
|
|
adds transactional persistence; [authmail](../authmail/README.md) supplies optional
|
|
account protocols with consumer-owned forms and authorization boundaries.
|