updated layout for webmail and added http dns letsencrypt

internal/smtpserver/log_privacy_test.go

@@ -0,0 +1,86 @@
+package smtpserver
+
+import "testing"
+
+// TestEmailLogBodyOmittedByDefault confirms the admin-visible email log gets the
+// message headers but never the body by default — only Subject/headers are diagnostic
+// metadata; the body is content, which shouldn't sit in a log unless explicitly opted
+// into (store_message_content) or the message needed spam review (see
+// TestEmailLogBodyKeptWhenQuarantined).
+func TestEmailLogBodyOmittedByDefault(t *testing.T) {
+	backend, _ := newTestBackendWithMailbox(t) // spam_reject_score set sky-high, so nothing quarantines here
+	addr := startTestServer(t, backend)
+
+	if err := sendTestMessage(t, addr, "hello"); err != nil {
+		t.Fatalf("send: %v", err)
+	}
+
+	logs, err := backend.DB.ListEmailLogsPage(0, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(logs) != 1 {
+		t.Fatalf("expected 1 email log entry, got %d", len(logs))
+	}
+	if logs[0].MessageBody != "" {
+		t.Errorf("expected no body logged by default, got %q", logs[0].MessageBody)
+	}
+	if logs[0].EmailHeaders == "" {
+		t.Error("expected headers to still be logged even with body omitted")
+	}
+}
+
+// TestEmailLogBodyKeptWhenStoreMessageContentEnabled confirms the sender's own
+// "Store Full Message Content" opt-in (esrv_senders.store_message_content) still works
+// despite the new default-off body logging.
+func TestEmailLogBodyKeptWhenStoreMessageContentEnabled(t *testing.T) {
+	backend, _ := newTestBackendWithMailbox(t)
+	if _, err := backend.DB.Exec(`UPDATE esrv_senders SET store_message_content = 1 WHERE email = 'test@example.com'`); err != nil {
+		t.Fatal(err)
+	}
+	addr := startTestServer(t, backend)
+
+	if err := sendTestMessage(t, addr, "hello"); err != nil {
+		t.Fatalf("send: %v", err)
+	}
+
+	logs, err := backend.DB.ListEmailLogsPage(0, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(logs) != 1 || logs[0].MessageBody == "" {
+		t.Fatalf("expected the opted-in sender's message body to be logged, got %+v", logs)
+	}
+}
+
+// TestEmailLogBodyKeptWhenQuarantined confirms a message quarantined to Spam still
+// gets its body logged even without any opt-in, so an admin can actually review a
+// spam/abuse report — the one deliberate exception to the default-off rule.
+func TestEmailLogBodyKeptWhenQuarantined(t *testing.T) {
+	backend, mailboxID := newTestBackendWithMailbox(t)
+	rspamd := fakeRspamd(t, 20, "add header")
+	backend.Cfg.Section("Rspamd").Key("enabled").SetValue("true")
+	backend.Cfg.Section("Rspamd").Key("url").SetValue(rspamd.URL)
+	backend.Cfg.Section("Rspamd").Key("reject_score").SetValue("15")
+	addr := startTestServer(t, backend)
+
+	if err := sendTestMessage(t, addr, "hello"); err != nil {
+		t.Fatalf("send: %v", err)
+	}
+
+	spamMsgs, err := backend.DB.ListMessagesInFolder(mailboxID, "Spam")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(spamMsgs) != 1 {
+		t.Fatalf("expected the message quarantined to Spam, got %d Spam messages", len(spamMsgs))
+	}
+
+	logs, err := backend.DB.ListEmailLogsPage(0, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(logs) != 1 || logs[0].MessageBody == "" {
+		t.Fatalf("expected the quarantined message's body to be logged for review, got %+v", logs)
+	}
+}