Files
inbuxa-server/tools/fork/renames.py
T
jcoffey-dev 17426f6d60 Bundle the spam filter rules with the server
The server fetched upstream's latest published rules from GitHub at run
time: a version nobody here tested, code-like expressions from an account
we don't control, and the upstream name as a default in the admin form.

The published rules of spam-filter v3.0.2 are now embedded
(resources/spam-filter/, MIT, in THIRD-PARTY.md) and used whenever no other
source is configured. An empty setting and upstream's old default both mean
the bundled rules, so existing installs switch without a settings change;
the URL stays an operator override (https:// or file://). The schema default
is dropped and its description says what empty means, and the strip's
rename pass does the same to each import.

Rules load on first boot as before, and again whenever the bundled version
differs from the last one loaded, which only adds missing rules and tags.
That brings the AI classifier's LLM_* scores to installs that predate them:
production has none today.

upstream-watch now also opens an issue when spam-filter publishes a newer
release; resources/spam-filter/README.md says how to take it.

The antispam test now runs on the bundled rules, the path production
takes; SPAM_RULES_URL tests another set. Unit tests cover the URL handling
and that the bundled rules parse and score the AI tags as the AI spec says.
2026-09-22 22:01:30 -07:00

150 lines
6.3 KiB
Python

#!/usr/bin/env python3
# SPDX-FileCopyrightText: 2026 Coffey Labs
# SPDX-License-Identifier: AGPL-3.0-only
"""
The upstream name where it's an identifier, and its replacement.
tools/fork/renames.py DIR # apply to a tree; prints what changed
Clients, users and operators meet the upstream name in a few places that
aren't notices: wire-protocol names (the JMAP registry capability, WebDAV
state tokens, Sieve extensions), the web interface's OAuth client id, store keys an
operator sees as blob names, and configuration defaults (SQL database and
user, the log file prefix). docs/spec/SPEC.md §2.4 renames them all.
strip.py applies this to every upstream import, so each release arrives
already renamed and those lines never conflict in the merge. `main` was
renamed with it once, on 2026-09-22. Don't run it on `main` again: code
written since that names the old spelling on purpose (the migrations that
retire it) would be renamed too. Those strings are listed in
name-allowlist.txt instead.
Names nobody sees keep upstream's spelling: the OAuth key-derivation contexts
and the hashed application prefix. Renaming them would only destroy state.
Copyright notices and prose (`.md`, `.txt`) are never touched.
"""
import gzip
import hashlib
import base64
import re
import sys
from pathlib import Path
# Plain substrings, in code and data: (old, new, the roots it applies under).
TEXT_RENAMES = [
# Upstream's JMAP capability for its registry (`x:`) objects. Not plain
# `urn:inbuxa:jmap`, which is the fork's own capability (contract C-1);
# listed before the general prefix below so it wins.
('urn:stalwart:jmap', 'urn:inbuxa:jmap:registry', None),
('urn:stalwart:', 'urn:inbuxa:', None),
('vnd.stalwart.', 'vnd.inbuxa.', None),
('(vnd.stalwart)', '(vnd.inbuxa)', None),
('stalwart-webui', 'inbuxa-webui', None),
('STALWART_SPAM_', 'INBUXA_SPAM_', None),
# Configuration defaults, as upstream's generated registry code spells
# them. Server code only: the tests use the same spelling for fixtures
# that must match their containers and identity provider (database users,
# passwords, an OIDC audience), and name their databases explicitly.
('"stalwart".to_string()', '"inbuxa".to_string()', ('crates',)),
# The spam filter rules ship with the server (common::manager::spam_rules);
# upstream's default of fetching its latest from GitHub becomes unset.
('spam_filter_rules_url: Some("https://github.com/stalwartlabs/spam-filter/releases/latest/download/spam-filter-rules.json.gz".to_string()),',
'spam_filter_rules_url: None,', ('crates',)),
]
ROOTS = ('crates', 'tests', 'resources')
SKIP_SUFFIXES = {'.md', '.txt'}
TEXT_SUFFIXES = {'.rs', '.toml', '.py', '.sh', '.json', '.yml', '.yaml', '.js', '.ts', '.html', '.sieve', '.sql'}
COPYRIGHT = re.compile(r'(?i)(?:SPDX-FileCopyrightText:|\bcopyright\b|©)')
# The JSON Schema the server serves to INBUXA Admin, and its checksum.
SCHEMA = Path('resources/schema/schema.json.gz')
SCHEMA_HASH = Path('resources/schema/schema.json.sha256')
SCHEMA_RENAMES = [
('"stalwart"', '"inbuxa"'),
('vnd.stalwart', 'vnd.inbuxa'),
# The bundled spam rules: no default URL, and say what empty means.
('"spamFilterRulesUrl":"https://github.com/stalwartlabs/spam-filter/releases/latest/download/spam-filter-rules.json.gz",', ''),
('"URL to download spam filter rules from"',
'"URL to download spam filter rules from. Empty uses the rules bundled with the server."'),
]
def rename_line(line, root):
"""Returns (new line, [(old, new, count)]) for a line of a file under `root`."""
if COPYRIGHT.search(line):
return line, []
done = []
for old, new, roots in TEXT_RENAMES:
if roots is not None and root not in roots:
continue
if old in line:
done.append((old, new, line.count(old)))
line = line.replace(old, new)
return line, done
def schema_bytes(gz):
"""The renamed schema, gzipped deterministically, and its checksum."""
text = gzip.decompress(gz).decode('utf-8')
for old, new in SCHEMA_RENAMES:
text = text.replace(old, new)
out = gzip.compress(text.encode('utf-8'), compresslevel=9, mtime=0)
digest = base64.urlsafe_b64encode(hashlib.sha256(out).digest()).decode().rstrip('=')
return out, digest
def apply(tree):
"""Apply every rename under `tree`; returns {"old → new": {file: count}}."""
tree = Path(tree)
done = {}
def note(old, new, rel, count):
done.setdefault(f'{old}{new}', {})
done[f'{old}{new}'][rel] = done[f'{old}{new}'].get(rel, 0) + count
for root in ROOTS:
base = tree / root
if not base.is_dir():
continue
for path in sorted(base.rglob('*')):
if not path.is_file() or path.suffix in SKIP_SUFFIXES:
continue
if path.suffix not in TEXT_SUFFIXES and not path.name.startswith('Dockerfile'):
continue
try:
lines = path.read_text(encoding='utf-8').split('\n')
except UnicodeDecodeError:
continue
changed = False
rel = str(path.relative_to(tree))
for n, line in enumerate(lines):
new_line, subs = rename_line(line, root)
for old, new, count in subs:
note(old, new, rel, count)
if subs:
lines[n] = new_line
changed = True
if changed:
path.write_text('\n'.join(lines), encoding='utf-8')
schema = tree / SCHEMA
if schema.is_file():
before = schema.read_bytes()
text = gzip.decompress(before).decode('utf-8')
counts = {old: text.count(old) for old, _ in SCHEMA_RENAMES}
out, digest = schema_bytes(before)
if any(counts.values()):
schema.write_bytes(out)
(tree / SCHEMA_HASH).write_text(digest, encoding='utf-8')
for old, new in SCHEMA_RENAMES:
if counts[old]:
note(old, new, str(SCHEMA), counts[old])
return {k: dict(sorted(v.items())) for k, v in sorted(done.items())}
if __name__ == '__main__':
if len(sys.argv) != 2:
sys.exit(__doc__.split('\n\n')[1])
for sub, files in apply(sys.argv[1]).items():
print(f'{sub}: ' + ', '.join(f'{f} ({n})' for f, n in files.items()))