Janady13/missionmatch / internal/platform/orgsettings/settings.go

1// Package orgsettings holds the per organization configuration and the per organization sealed secrets. 2// 3// IT IS A PLATFORM PACKAGE, not a module, because three unrelated callers need it and none of them should 4// depend on each other. The org module serves the settings screen. The auth module needs the mail 5// configuration to deliver an invite. The recruiting module needs the visibility rules to decide whether one 6// recruiter may see another's work. If this lived inside any one of those, the other two would import a 7// sibling module, which is exactly the dependency the package layout rule exists to prevent. 8// 9// SECRETS NEVER LEAVE THIS PACKAGE AS PLAINTEXT BY ACCIDENT. Settings and secrets are deliberately separate 10// types with separate loaders: Load returns configuration a handler may serialise straight to JSON and it 11// CANNOT carry a credential, because no field of it holds one. Reaching a password takes a second, explicit 12// call to OpenSecret, which no HTTP response path calls. The type system carries the rule so a future handler 13// cannot leak a password by adding a field to a response struct. 14package orgsettings 15 16import ( 17 "context" 18 "errors" 19 "fmt" 20 "strings" 21 22 "github.com/shopspring/decimal" 23 "time" 24 25 "github.com/google/uuid" 26 "github.com/jackc/pgx/v5" 27 28 "github.com/missionworkforce/missionmatch/internal/platform/security" 29 "github.com/missionworkforce/missionmatch/internal/platform/tenant" 30) 31 32// ErrNoSecret means the named secret is not stored for this organization. It is a normal outcome, not a 33// fault: an organization that has never configured mail simply has no smtp_password. 34var ErrNoSecret = errors.New("orgsettings: no such secret for this organization") 35 36// ErrSealUnavailable means the server has no organization secret key configured, so a secret cannot be 37// stored. It FAILS CLOSED and says so plainly rather than storing anything unprotected. A node without the 38// key can still read every non secret setting; only writing a credential is refused. 39var ErrSealUnavailable = errors.New("orgsettings: secret storage is not configured on this node, MM_ORG_SECRET_KEK is unset") 40 41// Settings is one organization's configuration. Every field here is safe to return to a caller who holds 42// org.settings.write. NONE of them is a credential. 43type Settings struct { 44 // ---- outbound email ---- 45 EmailDeliveryEnabled bool `json:"email_delivery_enabled"` 46 EmailFromAddress string `json:"email_from_address"` 47 EmailFromName string `json:"email_from_name"` 48 EmailReplyTo string `json:"email_reply_to"` 49 SMTPHost string `json:"smtp_host"` 50 SMTPPort int `json:"smtp_port"` 51 SMTPUsername string `json:"smtp_username"` 52 SMTPSecurity string `json:"smtp_security"` 53 // SMTPPasswordSet reports only WHETHER a password is [credential removed], never anything about it. This is what lets 54 // the settings screen render "password saved, leave blank to keep it" without the value ever being sent 55 // to a browser. 56 SMTPPasswordSet bool `json:"smtp_password_set"` 57 SMTPVerifiedAt *time.Time `json:"smtp_verified_at"` 58 SMTPLastAttemptAt *time.Time `json:"smtp_last_attempt_at"` 59 SMTPLastError string `json:"smtp_last_error"` 60 61 // ---- visibility ---- 62 WorkVisibility security.WorkVisibility `json:"work_visibility"` 63 ShowActivityPresence bool `json:"show_activity_presence"` 64 ClaimRequired bool `json:"claim_required"` 65 ClaimExpiryHours int `json:"claim_expiry_hours"` 66 67 // ---- field sensitivity ---- 68 RateVisibility security.Sensitivity `json:"rate_visibility"` 69 MarginVisibility security.Sensitivity `json:"margin_visibility"` 70 ContactVisibility security.Sensitivity `json:"contact_visibility"` 71 72 // ---- record scope, the third access axis ---- 73 StaffRecordScope security.RecordScope `json:"staff_record_scope"` 74 ManagerRecordScope security.RecordScope `json:"manager_record_scope"` 75 UnownedRecordsVisible bool `json:"unowned_records_visible"` 76 77 // ---- operating defaults ---- 78 InviteExpiryHours int `json:"invite_expiry_hours"` 79 DefaultInviteRole string `json:"default_invite_role"` 80 81 // DefaultBurdenPct is the organization's standard wrap rate, as a FRACTION, so 0.35 is a 35 percent wrap. 82 // It is the cost of employing somebody on top of their pay: payroll taxes, workers compensation, 83 // unemployment insurance, health cover, paid leave, retirement, general and administrative, overhead. 84 // 85 // NIL IS THE SHIPPED STATE AND IS NOT A ZERO. Nil means the firm has not told us its wrap, and per clause A 86 // of migration 0086 no margin may then be reported anywhere: the product shows spreads and says why. A wrap 87 // of zero is a different and legitimate answer, and it produces a margin equal to the spread. Collapsing 88 // the two would invent a cost structure for every organization that has not entered one. 89 // 90 // It is a STRING on the wire, in the decimal discipline the rest of the money follows, because a wrap that 91 // round tripped through a JSON number is a float and a float does not reconcile with an invoice. 92 DefaultBurdenPct *decimal.Decimal `json:"default_burden_pct,omitempty"` 93 94 // AEDTNoticeRequired refuses to score a candidate who has no automated decision notice on file. 95 // 96 // OFF BY DEFAULT, and the migration records why: switching it on for an existing customer would refuse 97 // their whole bench the moment they upgraded, because nobody has notices yet. What ships on for everybody 98 // is the ability to record a notice and to see whether one exists; the enforcement is the owner's call 99 // once their notices are in place. 100 AEDTNoticeRequired bool `json:"aedt_notice_required"` 101 102 UpdatedAt time.Time `json:"updated_at"` 103} 104 105// Defaults returns the same values the migration writes. It exists so a read against an organization whose 106// row is somehow missing returns a SAFE configuration rather than a zero valued one. The distinction matters: 107// the zero value of WorkVisibility is the empty string, which CanSeeOthersWork denies, but the zero value of 108// EmailDeliveryEnabled is false and the zero value of ClaimExpiryHours is zero, which would expire every 109// claim the instant it was made. Defaults are the correct answer, zeroes are not. 110func Defaults() Settings { 111 return Settings{ 112 SMTPSecurity: "starttls", 113 WorkVisibility: security.VisibilityOrganization, 114 ShowActivityPresence: true, 115 ClaimRequired: false, 116 ClaimExpiryHours: 72, 117 StaffRecordScope: security.ScopeOrganization, 118 ManagerRecordScope: security.ScopeOrganization, 119 UnownedRecordsVisible: true, 120 RateVisibility: security.SensitivityManagers, 121 MarginVisibility: security.SensitivityOwner, 122 ContactVisibility: security.SensitivityTeam, 123 InviteExpiryHours: 72, 124 DefaultInviteRole: string(security.RoleRecruiter), 125 } 126} 127 128// Store reads and writes settings and secrets inside the caller's tenant transaction, so RLS decides which 129// organization is reachable and this package never names one. There is no organization_id parameter anywhere 130// in this file, deliberately: a function that took one could be called with the wrong one. 131type Store struct { 132 db *tenant.DB 133 kek []byte 134 // prev decrypts values sealed under the previous key so a rotation does not need a flag day. It is used 135 // only on the read path, never to seal anything new. 136 prev []byte 137 kekVersion int 138} 139 140func NewStore(db *tenant.DB, kek, prev []byte, kekVersion int) *Store { 141 return &Store{db: db, kek: kek, prev: prev, kekVersion: kekVersion} 142} 143 144// SealAvailable reports whether this node can store a secret. Callers use it to give an honest error before 145// asking a user to type a password they cannot save. 146func (s *Store) SealAvailable() bool { return len(s.kek) == security.AESKeySize } 147 148const settingsColumns = ` 149 email_delivery_enabled, coalesce(email_from_address,''), coalesce(email_from_name,''), 150 coalesce(email_reply_to,''), coalesce(smtp_host,''), coalesce(smtp_port,0), 151 coalesce(smtp_username,''), smtp_security, smtp_verified_at, smtp_last_attempt_at, 152 coalesce(smtp_last_error,''), 153 work_visibility, show_activity_presence, claim_required, claim_expiry_hours, 154 rate_visibility, margin_visibility, contact_visibility, 155 staff_record_scope, manager_record_scope, unowned_records_visible, 156 invite_expiry_hours, default_invite_role, default_burden_pct::text, aedt_notice_required, updated_at` 157 158func scanSettings(row pgx.Row) (Settings, error) { 159 var st Settings 160 var burden *string 161 err := row.Scan( 162 &st.EmailDeliveryEnabled, &st.EmailFromAddress, &st.EmailFromName, 163 &st.EmailReplyTo, &st.SMTPHost, &st.SMTPPort, 164 &st.SMTPUsername, &st.SMTPSecurity, &st.SMTPVerifiedAt, &st.SMTPLastAttemptAt, 165 &st.SMTPLastError, 166 &st.WorkVisibility, &st.ShowActivityPresence, &st.ClaimRequired, &st.ClaimExpiryHours, 167 &st.RateVisibility, &st.MarginVisibility, &st.ContactVisibility, 168 &st.StaffRecordScope, &st.ManagerRecordScope, &st.UnownedRecordsVisible, 169 &st.InviteExpiryHours, &st.DefaultInviteRole, &burden, &st.AEDTNoticeRequired, &st.UpdatedAt, 170 ) 171 if err == nil && burden != nil { 172 // Parsed rather than trusted. A value that reached the column can only have come through the CHECK, so 173 // a parse failure here would mean the column type changed under us, and a silently dropped wrap would 174 // turn every margin in the product into a spread again without saying so. 175 d, perr := decimal.NewFromString(*burden) 176 if perr != nil { 177 return Settings{}, fmt.Errorf("orgsettings: default_burden_pct %q is not a number: %w", *burden, perr) 178 } 179 st.DefaultBurdenPct = &d 180 } 181 return st, err 182} 183 184// LoadTx reads the settings for the tenant already established on tx. A missing row returns Defaults with no 185// error, because an organization created before this migration, or one whose backfill has not run, should 186// behave like a correctly configured new organization rather than fail. 187func (s *Store) LoadTx(ctx context.Context, tx pgx.Tx) (Settings, error) { 188 st, err := scanSettings(tx.QueryRow(ctx, `SELECT `+settingsColumns+` FROM org_settings`)) 189 if errors.Is(err, pgx.ErrNoRows) { 190 return Defaults(), nil 191 } 192 if err != nil { 193 return Settings{}, fmt.Errorf("orgsettings: load: %w", err) 194 } 195 var n int 196 if err := tx.QueryRow(ctx, `SELECT count(*)::int FROM org_secrets WHERE name = 'smtp_password'`).Scan(&n); err != nil { 197 return Settings{}, fmt.Errorf("orgsettings: probe smtp password: %w", err) 198 } 199 st.SMTPPasswordSet = n > 0 200 return st, nil 201} 202 203// Load opens its own tenant transaction for callers that are not already inside one. 204func (s *Store) Load(ctx context.Context) (Settings, error) { 205 var out Settings 206 err := s.db.RunInTenantTx(ctx, func(ctx context.Context, tx pgx.Tx) error { 207 var e error 208 out, e = s.LoadTx(ctx, tx) 209 return e 210 }) 211 return out, err 212} 213 214// Update is a sparse patch: only the fields a caller actually set are written. A pointer per field rather 215// than a whole Settings value, because a settings screen that submits the entire object would silently 216// overwrite a colleague's concurrent change to a field the submitter never touched. 217type Update struct { 218 EmailDeliveryEnabled *bool 219 EmailFromAddress *string 220 EmailFromName *string 221 EmailReplyTo *string 222 SMTPHost *string 223 SMTPPort *int 224 SMTPUsername *string 225 SMTPSecurity *string 226 227 WorkVisibility *string 228 ShowActivityPresence *bool 229 ClaimRequired *bool 230 ClaimExpiryHours *int 231 232 RateVisibility *string 233 MarginVisibility *string 234 ContactVisibility *string 235 236 StaffRecordScope *string 237 ManagerRecordScope *string 238 UnownedRecordsVisible *bool 239 240 InviteExpiryHours *int 241 DefaultInviteRole *string 242 243 // DefaultBurdenPct is a POINTER TO A POINTER on purpose, which is the only shape that can express the three 244 // things an owner can mean. Absent, the outer nil, means leave the wrap alone. Present and pointing at nil 245 // means CLEAR it, which returns the organization to reporting spreads and no margins. Present and pointing 246 // at a number sets it. A plain pointer could not tell "do not touch" apart from "clear", and clearing a 247 // wrap by accident silently changes every margin in the product to a different number. 248 DefaultBurdenPct **decimal.Decimal 249 AEDTNoticeRequired *bool 250} 251 252// maxBurden is five, meaning a wrap of five hundred percent, matching the CHECK migration 0098 puts on every 253// burden column. It is high enough to admit a genuinely heavy government wrap once general and administrative 254// and fee are layered on, and low enough to catch the one error that would otherwise pass silently: typing 35 255// to mean 35 percent. 256var maxBurden = decimal.NewFromInt(5) 257 258// Validate checks everything the database checks, plus the things it cannot: that a time zone actually 259// exists, that a role is a real role, that an address looks like an address. Returning the offending field 260// name lets the settings screen mark the input rather than show a banner. 261func (u Update) Validate() (field string, err error) { 262 if u.DefaultBurdenPct != nil && *u.DefaultBurdenPct != nil { 263 b := **u.DefaultBurdenPct 264 if b.IsNegative() { 265 return "default_burden_pct", errors.New("a wrap rate cannot be negative") 266 } 267 if b.GreaterThan(maxBurden) { 268 // The message names the likely mistake rather than restating the bound, because somebody who typed 269 // 35 does not need to be told the limit is 5, they need to be told the field is a fraction. 270 return "default_burden_pct", errors.New( 271 "a wrap rate is a fraction, so a 35 percent wrap is 0.35 rather than 35") 272 } 273 } 274 if u.SMTPPort != nil && (*u.SMTPPort < 1 || *u.SMTPPort > 65535) { 275 return "smtp_port", errors.New("a port must be between 1 and 65535") 276 } 277 if u.SMTPSecurity != nil && *u.SMTPSecurity != "starttls" && *u.SMTPSecurity != "implicit_tls" { 278 return "smtp_security", errors.New("transport security must be starttls or implicit_tls, plaintext mail is not offered") 279 } 280 for f, v := range map[string]*string{ 281 "email_from_address": u.EmailFromAddress, 282 "email_reply_to": u.EmailReplyTo, 283 } { 284 if v != nil && *v != "" && !plausibleAddress(*v) { 285 return f, errors.New("that does not look like an email address") 286 } 287 } 288 if u.WorkVisibility != nil && !security.ValidWorkVisibility(security.WorkVisibility(*u.WorkVisibility)) { 289 return "work_visibility", errors.New("visibility must be private, team or organization") 290 } 291 for f, v := range map[string]*string{ 292 "rate_visibility": u.RateVisibility, 293 "margin_visibility": u.MarginVisibility, 294 "contact_visibility": u.ContactVisibility, 295 } { 296 if v != nil && !security.ValidSensitivity(security.Sensitivity(*v)) { 297 return f, errors.New("sensitivity must be owner, managers, team or organization") 298 } 299 } 300 if u.StaffRecordScope != nil && !security.ValidRecordScope(security.RecordScope(*u.StaffRecordScope)) { 301 return "staff_record_scope", errors.New("a record scope must be own, team or organization") 302 } 303 // own is deliberately not offered at the manager tier: a manager who cannot see their team's records 304 // cannot run a desk, and the setting exists to choose between the team and the floor. 305 if u.ManagerRecordScope != nil && !security.ValidManagerScope(security.RecordScope(*u.ManagerRecordScope)) { 306 return "manager_record_scope", errors.New("a manager may be scoped to team or organization, not to their own records alone") 307 } 308 if u.ClaimExpiryHours != nil && (*u.ClaimExpiryHours < 1 || *u.ClaimExpiryHours > 2160) { 309 return "claim_expiry_hours", errors.New("a claim may last between one hour and ninety days") 310 } 311 if u.InviteExpiryHours != nil && (*u.InviteExpiryHours < 1 || *u.InviteExpiryHours > 336) { 312 return "invite_expiry_hours", errors.New("an invite may last between one hour and fourteen days") 313 } 314 if u.DefaultInviteRole != nil { 315 r := security.Role(*u.DefaultInviteRole) 316 if !security.ValidRole(r) || r == security.RoleOwner { 317 return "default_invite_role", errors.New("the default invited role must be a real role below owner") 318 } 319 } 320 return "", nil 321} 322 323// invalidatesVerification reports whether a patch changes anything that a previous successful test send 324// proved. Changing the host, port, username, security or sender means the old proof no longer describes the 325// current configuration, so verification is cleared and mail stops until somebody tests again. 326// 327// THIS IS THE HONEST BEHAVIOUR AND IT IS DELIBERATELY INCONVENIENT. The alternative, leaving the old 328// verified_at in place, means an admin edits a host name, saves, and the platform silently keeps claiming 329// mail works until the first invite disappears into nothing. 330func (u Update) invalidatesVerification() bool { 331 return u.SMTPHost != nil || u.SMTPPort != nil || u.SMTPUsername != nil || 332 u.SMTPSecurity != nil || u.EmailFromAddress != nil 333} 334 335// Save applies a sparse patch inside tx. It returns the settings as they now stand. 336func (s *Store) Save(ctx context.Context, tx pgx.Tx, u Update, actor uuid.UUID) (Settings, error) { 337 set := make([]string, 0, 20) 338 args := make([]any, 0, 20) 339 add := func(col string, v any) { 340 args = append(args, v) 341 set = append(set, fmt.Sprintf("%s = $%d", col, len(args))) 342 } 343 if u.EmailDeliveryEnabled != nil { 344 add("email_delivery_enabled", *u.EmailDeliveryEnabled) 345 } 346 if u.EmailFromAddress != nil { 347 add("email_from_address", nilIfEmpty(*u.EmailFromAddress)) 348 } 349 if u.EmailFromName != nil { 350 add("email_from_name", nilIfEmpty(*u.EmailFromName)) 351 } 352 if u.EmailReplyTo != nil { 353 add("email_reply_to", nilIfEmpty(*u.EmailReplyTo)) 354 } 355 if u.SMTPHost != nil { 356 add("smtp_host", nilIfEmpty(strings.TrimSpace(*u.SMTPHost))) 357 } 358 if u.SMTPPort != nil { 359 add("smtp_port", *u.SMTPPort) 360 } 361 if u.SMTPUsername != nil { 362 add("smtp_username", nilIfEmpty(*u.SMTPUsername)) 363 } 364 if u.SMTPSecurity != nil { 365 add("smtp_security", *u.SMTPSecurity) 366 } 367 if u.WorkVisibility != nil { 368 add("work_visibility", *u.WorkVisibility) 369 } 370 if u.ShowActivityPresence != nil { 371 add("show_activity_presence", *u.ShowActivityPresence) 372 } 373 if u.ClaimRequired != nil { 374 add("claim_required", *u.ClaimRequired) 375 } 376 if u.ClaimExpiryHours != nil { 377 add("claim_expiry_hours", *u.ClaimExpiryHours) 378 } 379 if u.RateVisibility != nil { 380 add("rate_visibility", *u.RateVisibility) 381 } 382 if u.MarginVisibility != nil { 383 add("margin_visibility", *u.MarginVisibility) 384 } 385 if u.ContactVisibility != nil { 386 add("contact_visibility", *u.ContactVisibility) 387 } 388 if u.StaffRecordScope != nil { 389 add("staff_record_scope", *u.StaffRecordScope) 390 } 391 if u.ManagerRecordScope != nil { 392 add("manager_record_scope", *u.ManagerRecordScope) 393 } 394 if u.UnownedRecordsVisible != nil { 395 add("unowned_records_visible", *u.UnownedRecordsVisible) 396 } 397 if u.InviteExpiryHours != nil { 398 add("invite_expiry_hours", *u.InviteExpiryHours) 399 } 400 if u.DefaultInviteRole != nil { 401 add("default_invite_role", *u.DefaultInviteRole) 402 } 403 if u.AEDTNoticeRequired != nil { 404 add("aedt_notice_required", *u.AEDTNoticeRequired) 405 } 406 if u.DefaultBurdenPct != nil { 407 // The inner nil is a deliberate CLEAR, written as a NULL, not skipped. An owner who removes their wrap 408 // is telling the product it no longer knows their cost structure, and the honest consequence is that 409 // every margin disappears and every spread stays. 410 if *u.DefaultBurdenPct == nil { 411 add("default_burden_pct", nil) 412 } else { 413 add("default_burden_pct", (*u.DefaultBurdenPct).String()) 414 } 415 } 416 if u.invalidatesVerification() { 417 set = append(set, "smtp_verified_at = NULL") 418 // Delivery is switched off at the same moment, because the CHECK constraint refuses a row that has 419 // delivery enabled with no verification, and because an admin editing a host mid flight should not 420 // have invites silently queue against a configuration nobody has proved. 421 set = append(set, "email_delivery_enabled = false") 422 } 423 if len(set) == 0 { 424 return s.LoadTx(ctx, tx) 425 } 426 add("updated_by", actor) 427 set = append(set, "updated_at = now()") 428 429 // The row is guaranteed FIRST, then updated. This was written as a single INSERT ... ON CONFLICT DO 430 // UPDATE, which is wrong in a way that passed every review and failed the first walkthrough: an 431 // organization with no row yet took the INSERT branch, where the SET clause does not apply, so the very 432 // first save an owner performed reported 200 and changed nothing. provision_org does not create a 433 // settings row, so EVERY newly provisioned customer hit it. Two statements, no cleverness. 434 if err := s.ensureRow(ctx, tx); err != nil { 435 return Settings{}, err 436 } 437 if _, err := tx.Exec(ctx, `UPDATE org_settings SET `+strings.Join(set, ", "), args...); err != nil { 438 return Settings{}, fmt.Errorf("orgsettings: save: %w", err) 439 } 440 return s.LoadTx(ctx, tx) 441} 442 443// ensureRow creates this organization's settings row if it does not have one, so every writer below can be a 444// plain UPDATE. An UPDATE against a missing row affects zero rows and reports success, which is the failure 445// mode this exists to remove. 446func (s *Store) ensureRow(ctx context.Context, tx pgx.Tx) error { 447 _, err := tx.Exec(ctx, ` 448 INSERT INTO org_settings (organization_id) 449 VALUES (NULLIF(current_setting('app.current_org_id', true), '')::uuid) 450 ON CONFLICT (organization_id) DO NOTHING`) 451 if err != nil { 452 return fmt.Errorf("orgsettings: ensure settings row: %w", err) 453 } 454 return nil 455} 456 457// MarkVerified records that a test send actually succeeded. It is the ONLY writer of smtp_verified_at, which 458// is what makes that column mean what it says. 459func (s *Store) MarkVerified(ctx context.Context, tx pgx.Tx) error { 460 if err := s.ensureRow(ctx, tx); err != nil { 461 return err 462 } 463 _, err := tx.Exec(ctx, `UPDATE org_settings 464 SET smtp_verified_at = now(), smtp_last_attempt_at = now(), smtp_last_error = NULL, updated_at = now()`) 465 return err 466} 467 468// MarkAttemptFailed records a failed send with the transport's own message, so an admin can fix a typo 469// without reading a server log they have no access to. 470// 471// THE MESSAGE IS SCRUBBED FIRST. A transport error can echo the credentials it was rejecting, and this column 472// is readable by anyone holding org.settings.write and is returned over the API. redactCredentials removes 473// the username and password from the text before it is stored, so the worst case is a less useful error 474// rather than a password sitting in a readable column. 475func (s *Store) MarkAttemptFailed(ctx context.Context, tx pgx.Tx, cause string, username, password string) error { 476 msg := redactCredentials(cause, username, password) 477 if len(msg) > 500 { 478 msg = msg[:500] 479 } 480 if err := s.ensureRow(ctx, tx); err != nil { 481 return err 482 } 483 _, err := tx.Exec(ctx, `UPDATE org_settings 484 SET smtp_verified_at = NULL, email_delivery_enabled = false, 485 smtp_last_attempt_at = now(), smtp_last_error = $1, updated_at = now()`, msg) 486 return err 487} 488 489func redactCredentials(s, username, password string) string { 490 for _, secret := range []string{password, username} { 491 // Short values are skipped: redacting a two character username would replace half the alphabet in the 492 // message and tell the reader nothing. 493 if len(secret) >= 4 { 494 s = strings.ReplaceAll(s, secret, "[redacted]") 495 } 496 } 497 return s 498} 499 500func nilIfEmpty(s string) any { 501 if strings.TrimSpace(s) == "" { 502 return nil 503 } 504 return s 505} 506 507// plausibleAddress is a deliberately loose check. Address syntax is far wider than most validators admit, and 508// rejecting a valid address is a worse failure than accepting an invalid one that simply bounces. It catches 509// the actual mistakes: a name with no address, spaces, a missing at sign, a missing dot in the domain. 510func plausibleAddress(v string) bool { 511 v = strings.TrimSpace(v) 512 if len(v) < 6 || len(v) > 320 || strings.ContainsAny(v, " \t\r\n<>,;") { 513 return false 514 } 515 at := strings.LastIndexByte(v, '@') 516 if at <= 0 || at == len(v)-1 { 517 return false 518 } 519 domain := v[at+1:] 520 dot := strings.IndexByte(domain, '.') 521 return dot > 0 && dot < len(domain)-1 522} 523