Import upstream v0.16.22, stripped

Upstream commit: 474dd0229cb20cf513036619781ed97bd8073c3f Enterprise-only files removed or emptied: 63 Enterprise-only snippets removed: 117 in 50 files Dangling module declarations removed: 5 Cargo edits turning enterprise off: 14 Verification: clean Enterprise feature gates left for rebuilt features: 19 in 18 files Produced by tools/fork/strip.py. The full report is in docs/fork/strip-reports/ on main.
2026-09-18 10:21:56 -07:00
commit 7dae9b29fd
1650 changed files with 485521 additions and 0 deletions
@@ -0,0 +1,115 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use crate::{
+    Session, State,
+    protocol::{Command, Mechanism, request},
+};
+use common::{
+    auth::AuthRequest,
+    network::{SessionStream, limiter::LimiterResult},
+};
+use directory::Credentials;
+use mail_parser::decoders::base64::base64_decode;
+use registry::schema::enums::Permission;
+
+impl<T: SessionStream> Session<T> {
+    pub async fn handle_sasl(
+        &mut self,
+        mechanism: Mechanism,
+        mut params: Vec<String>,
+    ) -> trc::Result<()> {
+        match mechanism {
+            Mechanism::Plain | Mechanism::OAuthBearer | Mechanism::XOauth2 => {
+                if !params.is_empty() {
+                    let credentials = base64_decode(params.pop().unwrap().as_bytes())
+                        .and_then(|challenge| {
+                            if mechanism == Mechanism::Plain {
+                                Credentials::decode_sasl_challenge_plain(&challenge)
+                            } else {
+                                Credentials::decode_sasl_challenge_oauth(&challenge)
+                            }
+                        })
+                        .ok_or_else(|| {
+                            trc::AuthEvent::Error
+                                .into_err()
+                                .details("Invalid SASL challenge")
+                        })?;
+
+                    Box::pin(self.handle_auth(credentials)).await
+                } else {
+                    // TODO: This hack is temporary until the SASL library is developed
+                    self.receiver.state = request::State::Argument {
+                        request: Command::Auth {
+                            mechanism: mechanism.as_str().as_bytes().to_vec(),
+                            params: vec![],
+                        },
+                        num: 1,
+                        last_is_space: true,
+                    };
+
+                    self.write_bytes("+\r\n").await
+                }
+            }
+            _ => Err(trc::AuthEvent::Error
+                .into_err()
+                .details("Authentication mechanism not supported.")),
+        }
+    }
+
+    pub async fn handle_auth(&mut self, credentials: Credentials) -> trc::Result<()> {
+        // Authenticate
+        let access_token = self
+            .server
+            .authenticate(&AuthRequest::from_credentials(
+                credentials,
+                self.session_id,
+                self.remote_addr,
+            ))
+            .await
+            .map_err(|err| {
+                if err.matches(trc::EventType::Auth(trc::AuthEvent::Failed)) {
+                    match &self.state {
+                        State::NotAuthenticated {
+                            auth_failures,
+                            username,
+                        } if *auth_failures < self.server.core.imap.max_auth_failures => {
+                            self.state = State::NotAuthenticated {
+                                auth_failures: auth_failures + 1,
+                                username: username.clone(),
+                            };
+                        }
+                        _ => {
+                            return trc::AuthEvent::TooManyAttempts.into_err().caused_by(err);
+                        }
+                    }
+                }
+
+                err
+            })
+            .and_then(|token| token.assert_has_permission(Permission::Pop3Authenticate))?;
+
+        // Enforce concurrency limits
+        let in_flight = match access_token.is_imap_request_allowed() {
+            LimiterResult::Allowed(in_flight) => Some(in_flight),
+            LimiterResult::Forbidden => {
+                return Err(trc::LimitEvent::ConcurrentRequest.into_err());
+            }
+            LimiterResult::Disabled => None,
+        };
+
+        // Fetch mailbox
+        let mailbox = self.fetch_mailbox(access_token.account_id()).await?;
+
+        // Create session
+        self.state = State::Authenticated {
+            in_flight,
+            mailbox,
+            access_token,
+        };
+        self.write_ok("Authentication successful").await
+    }
+}