DLP phase 3: hold for review #108

Merged

jcoffey-dev merged 1 commits from feature/dlp-hold into main

2026-09-29 01:43:44 +00:00

jcoffey-dev commented

2026-09-29 01:33:27 +00:00

Owner

The hold action now holds (spec §2.6); until now it blocked.

At DATA: queued with its release a century off (the queue's future-release mechanism; stored format unchanged, older nodes never send it), transport rules still applied, 250 Held for review. Review record inbuxa:HeldMessage (sender, recipients, subject, size, rules, detector counts). Sender told when the rule asks.
Release / reject / expiry (smtp/queue/held.rs): release reschedules each recipient from now; reject removes it and tells the sender with the reviewer's note; the daily clean-up rejects what nobody reviewed in 7 days.
inbuxa:HeldMessage get/set: sysDlpReviewGet lists and reads (preview only when asked, recorded as blobAccess); sysDlpReviewUpdate releases or rejects with a required, audited reason. Server-level only.
Guards: Emails › Queue can't change or delete held mail; the sender can't unsend it.
Privacy catalog entry; spec §2.6 as built.

Tests: the full flow in mail_rules_tests (hold, list, notice, guards, preview audit, reject with note, release delivers, expiry, audited reasons); smtp inbound, system_tests, features and common unit tests pass.

The hold action now holds (spec §2.6); until now it blocked. - **At DATA**: queued with its release a century off (the queue's future-release mechanism; stored format unchanged, older nodes never send it), transport rules still applied, `250 Held for review`. Review record `inbuxa:HeldMessage` (sender, recipients, subject, size, rules, detector counts). Sender told when the rule asks. - **Release / reject / expiry** (`smtp/queue/held.rs`): release reschedules each recipient from now; reject removes it and tells the sender with the reviewer's note; the daily clean-up rejects what nobody reviewed in 7 days. - **`inbuxa:HeldMessage` get/set**: sysDlpReviewGet lists and reads (preview only when asked, recorded as blobAccess); sysDlpReviewUpdate releases or rejects with a required, audited reason. Server-level only. - **Guards**: Emails › Queue can't change or delete held mail; the sender can't unsend it. - Privacy catalog entry; spec §2.6 as built. Tests: the full flow in `mail_rules_tests` (hold, list, notice, guards, preview audit, reject with note, release delivers, expiry, audited reasons); smtp inbound, system_tests, features and common unit tests pass.

jcoffey-dev added 1 commit 2026-09-29 01:33:27 +00:00

DLP phase 3: hold for review

ci / fork-checks (pull_request) Successful in 33s

Details

ci / build (pull_request) Successful in 9m58s

Details

f44382fb09

The hold action now holds (dlp-and-mail-flow-rules spec, §2.6), where
until now it blocked.

- At DATA a hold decision queues the message with its release a century
  off (the queue's future-release mechanism, so the stored format is
  unchanged and an older node just never sends it), transport rules
  still applied, and replies 250 Held for review. A review record under
  R/h + queue id keeps the sender, recipients, subject, size, rules and
  detector counts. The sender is told when the rule asks.
- smtp/queue/held.rs: release (each recipient due now, its next notice
  as far off as it was, its lifetime counted from the release), reject
  (removed from the queue, the sender told, with the reviewer's note),
  and expiry: the daily clean-up rejects what nobody reviewed in 7 days,
  recorded as the server's doing.
- inbuxa:HeldMessage get/set: the review queue, sysDlpReviewGet to list
  and read (preview, 64 KB of text, only when asked for and recorded as
  blobAccess), sysDlpReviewUpdate to release or reject, a reason
  required and audited by the request layer; no create or destroy;
  server-level only.
- Guards: Emails > Queue refuses to change or delete held mail; the
  sender can't unsend it.
- Privacy catalog entry for inbuxa:HeldMessage; spec §2.6 as built.

Tests: mail_rules_tests gains the whole flow (held and listed with
counts, sender notified and nothing delivered, queue and unsend
refused, preview recorded, reject needs a reason and tells the sender
the note, release delivers, expiry returns it, decisions audited with
reasons). smtp inbound, system_tests (after one BlobNotFound in
antispam, the known flake, then clean), features and common unit tests.

jcoffey-dev merged commit e99f84bd01 into main

2026-09-29 01:43:44 +00:00

jcoffey-dev deleted branch feature/dlp-hold

2026-09-29 01:43:44 +00:00

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: inbuxa/inbuxa-server#108