updated mailbox app password

internal/smtpserver/headers.go

@@ -47,12 +47,13 @@ func existingHeaders(content string) map[string]string {
 	lines := strings.Split(content, "\n")
 	out := map[string]string{}
 	var lastKey string
+	trackFold := false
 	for _, raw := range lines {
 		line := strings.TrimRight(raw, "\r")
 		if line == "" {
 			break
 		}
-		if (strings.HasPrefix(line, " ") || strings.HasPrefix(line, "\t")) && lastKey != "" {
+		if (strings.HasPrefix(line, " ") || strings.HasPrefix(line, "\t")) && trackFold {
 			out[lastKey] += " " + strings.TrimSpace(line)
 			continue
 		}
@@ -62,8 +63,20 @@ func existingHeaders(content string) map[string]string {
 		}
 		key := strings.ToLower(strings.TrimSpace(line[:idx]))
 		val := strings.TrimSpace(line[idx+1:])
-		out[key] = val
-		lastKey = key
+		// Unconditional out[key]=val here would keep the *last* duplicate instead of
+		// the first (e.g. a client-supplied "Content-Type: text/html" sent alongside
+		// swaks/library-generated "Content-Type: multipart/mixed; boundary=..." for an
+		// attachment) — discarding the boundary and causing the raw multipart body,
+		// left untouched below, to be delivered under the wrong Content-Type entirely.
+		// mail.ReadMessage's Header.Get (used elsewhere, e.g. parseMessage) already
+		// takes the first occurrence of a duplicated header, so this matches that.
+		if _, exists := out[key]; !exists {
+			out[key] = val
+			lastKey = key
+			trackFold = true
+		} else {
+			trackFold = false
+		}
 	}
 	return out
 }