fix(email): address postguard#197 deliverability + show disclosed signer name

- X-PostGuard header now tracks the pg-core version via a new build.rs
  that parses Cargo.lock, instead of the stale hardcoded "0.1.0". When
  pg-core releases 1.0, the header auto-bumps on the next build.
- Add Reply-To header pointing to the disclosed sender on recipient mail
  so replies reach the human sender, not the noreply From-address.
- Add Auto-Submitted: auto-generated (RFC 3834) on both notification and
  confirmation mail to suppress responder loops and signal "transactional"
  to receiving MTAs.
- Send multipart/alternative with a hand-authored plain-text branch in
  addition to HTML (new templates/email/email.txt).
- Embed the PostGuard logo as a multipart/related CID inline part instead
  of fetching https://postguard.eu/pg_logo.png at render time. Kills the
  HTML-only + remote-image spam fingerprint and keeps the logo rendering
  even with images-blocked-by-default.
- Show the sender's disclosed full name (pbdf.gemeente.personalData.fullname)
  wherever the bare email used to appear in the body; filter it from the
  attribute pill list so it doesn't render twice.

Deliberately not added: List-Unsubscribe — wrong semantic fit for
person-to-person mail, would misrepresent the sender.

Refs encryption4all/postguard#197

Author: rubenhensen

build.rs

@@ -0,0 +1,27 @@
+fn main() {
+    println!("cargo:rerun-if-changed=Cargo.lock");
+
+    let lock = std::fs::read_to_string("Cargo.lock").expect("Cargo.lock not readable");
+    let version = lock
+        .split("[[package]]")
+        .find_map(|block| {
+            let mut name = None;
+            let mut ver = None;
+            for line in block.lines() {
+                if let Some(rest) = line.strip_prefix("name = \"") {
+                    name = rest.strip_suffix('"');
+                }
+                if let Some(rest) = line.strip_prefix("version = \"") {
+                    ver = rest.strip_suffix('"');
+                }
+            }
+            if name == Some("pg-core") {
+                ver
+            } else {
+                None
+            }
+        })
+        .expect("pg-core entry not found in Cargo.lock");
+
+    println!("cargo:rustc-env=PG_CORE_VERSION={}", version);
+}

src/email.rs

@@ -6,7 +6,10 @@ use askama::Template;
 use chrono::{format::Locale, TimeZone};
 
 use lettre::{
-    message::header::{ContentType, Header, HeaderName, HeaderValue},
+    message::{
+        header::{ContentType, Header, HeaderName, HeaderValue},
+        Attachment, Mailbox, MultiPart, SinglePart,
+    },
     transport::smtp::authentication::Credentials,
     Message, SmtpTransport, Transport,
 };
@@ -31,7 +34,38 @@ impl Header for XPostGuard {
     }
 }
 
-const X_POSTGUARD_VERSION: &str = "0.1.0";
+const X_POSTGUARD_VERSION: &str = env!("PG_CORE_VERSION");
+
+/// `Auto-Submitted: auto-generated` per RFC 3834. Signals to receiving MTAs
+/// and mail clients that this is a machine-generated transactional message,
+/// suppresses vacation-responder loops, and is one of the deliverability
+/// signals Gmail's bulk-sender heuristics look for.
+#[derive(Clone, Debug)]
+struct AutoSubmitted;
+
+impl Header for AutoSubmitted {
+    fn name() -> HeaderName {
+        HeaderName::new_from_ascii_str("Auto-Submitted")
+    }
+
+    fn parse(_s: &str) -> Result<Self, Box<dyn std::error::Error + Send + Sync>> {
+        Ok(AutoSubmitted)
+    }
+
+    fn display(&self) -> HeaderValue {
+        HeaderValue::new(Self::name(), "auto-generated".to_owned())
+    }
+}
+
+/// IRMA/Yivi attribute identifier for the signer's full name. When this
+/// attribute appears in `FileState.sender_attributes` we render the name
+/// in place of the bare email everywhere the sender is shown in the body.
+const FULLNAME_ATYPE: &str = "pbdf.gemeente.personalData.fullname";
+
+/// Embedded PostGuard logo, served inline via a `Content-ID: <pg-logo>`
+/// MIME part rather than fetched from postguard.eu. Removes the
+/// HTML-only-plus-remote-image spam signal flagged in postguard#197.
+const LOGO_PNG: &[u8] = include_bytes!("../templates/email/pg_logo.png");
 
 use serde::{Deserialize, Serialize};
 use url::Url;
@@ -105,6 +139,62 @@ struct EmailTemplate<'a> {
     sender_attributes: &'a [(String, String)],
 }
 
+#[derive(Template)]
+#[template(path = "email/email.txt", escape = "none")]
+struct EmailTextTemplate<'a> {
+    header: &'a str,
+    subheader: &'a str,
+    expires_str: &'a str,
+    download_str: &'a str,
+    link_str: &'a str,
+    file_size: &'a str,
+    expiry_date: &'a str,
+    html_content: &'a str,
+    url: &'a str,
+    confirm: &'a str,
+    files_from: &'a str,
+    sender_email: &'a str,
+    sender_attributes: &'a [(String, String)],
+}
+
+/// Resolve the display string and remaining attribute pills for the
+/// sender. When the signer disclosed their full name, the name takes the
+/// place of the bare email everywhere it would otherwise appear in the
+/// body, and is removed from the attribute pill list so it doesn't render
+/// twice.
+/// Assemble the MIME body: a `multipart/alternative` whose HTML branch is
+/// itself a `multipart/related` carrying the HTML part plus the PostGuard
+/// logo as an inline image referenced via `cid:pg-logo`. This shape avoids
+/// the HTML-only + remote-image spam signal flagged in postguard#197 while
+/// keeping graceful degradation for text-only clients.
+fn build_body(
+    html: String,
+    text: String,
+) -> Result<MultiPart, Box<dyn std::error::Error>> {
+    let logo = Attachment::new_inline("pg-logo".to_string())
+        .body(LOGO_PNG.to_vec(), "image/png".parse::<ContentType>()?);
+
+    let related = MultiPart::related()
+        .singlepart(SinglePart::html(html))
+        .singlepart(logo);
+
+    Ok(MultiPart::alternative()
+        .singlepart(SinglePart::plain(text))
+        .multipart(related))
+}
+
+fn sender_display(state: &FileState) -> (String, Vec<(String, String)>) {
+    let mut attrs = state.sender_attributes.clone();
+    let name = attrs
+        .iter()
+        .position(|(t, _)| t == FULLNAME_ATYPE)
+        .map(|i| attrs.remove(i).1);
+    let display = name
+        .or_else(|| state.sender.clone())
+        .unwrap_or_else(|| "Someone".to_string());
+    (display, attrs)
+}
+
 fn format_file_size(size: u64) -> String {
     const UNITS: [&str; 5] = ["B", "kB", "MB", "GB", "TB"];
     if size == 0 {
@@ -128,55 +218,92 @@ fn format_date(date: i64, lang: &Language) -> String {
     dt.format_localized("%e %B %Y", locale).to_string()
 }
 
-fn email_templates(state: &FileState, url: &str) -> (String, String) {
+fn email_templates(state: &FileState, url: &str) -> (String, String, String) {
     let strings = match state.mail_lang {
         Language::En => EN_STRINGS,
         Language::Nl => NL_STRINGS,
     };
 
-    let sender_str = state.sender.clone().unwrap_or("Someone".to_string());
-    let email = EmailTemplate {
-        header: &sender_str,
+    let (display, attrs) = sender_display(state);
+    let file_size = format_file_size(state.uploaded);
+    let expiry_date = format_date(state.expires, &state.mail_lang);
+
+    let html = EmailTemplate {
+        header: &display,
+        subheader: strings.sender_str,
+        expires_str: strings.expires_str,
+        download_str: strings.download_str,
+        link_str: strings.link_str,
+        file_size: &file_size,
+        expiry_date: &expiry_date,
+        html_content: &state.mail_content,
+        confirm: "",
+        files_from: strings.files_from,
+        sender_email: &display,
+        sender_attributes: &attrs,
+        url,
+    };
+    let text = EmailTextTemplate {
+        header: &display,
         subheader: strings.sender_str,
         expires_str: strings.expires_str,
         download_str: strings.download_str,
         link_str: strings.link_str,
-        file_size: &format_file_size(state.uploaded),
-        expiry_date: &format_date(state.expires, &state.mail_lang),
+        file_size: &file_size,
+        expiry_date: &expiry_date,
         html_content: &state.mail_content,
         confirm: "",
         files_from: strings.files_from,
-        sender_email: &sender_str,
-        sender_attributes: &state.sender_attributes,
+        sender_email: &display,
+        sender_attributes: &attrs,
         url,
     };
     let subject = SubjectTemplate {
         subject_str: strings.subject_str,
-        sender: &sender_str,
+        sender: &display,
     };
-    (email.to_string(), subject.to_string())
+    (html.to_string(), text.to_string(), subject.to_string())
 }
 
-fn email_confirm(state: &FileState, url: &str) -> (String, String) {
+fn email_confirm(state: &FileState, url: &str) -> (String, String, String) {
     let strings = match state.mail_lang {
         Language::En => EN_STRINGS,
         Language::Nl => NL_STRINGS,
     };
 
-    let sender_str = state.sender.clone().unwrap_or("Someone".to_string());
-    let email = EmailTemplate {
+    let (display, attrs) = sender_display(state);
+    let file_size = format_file_size(state.uploaded);
+    let expiry_date = format_date(state.expires, &state.mail_lang);
+    let recipients = state.recipients.to_string();
+
+    let html = EmailTemplate {
         header: strings.header_confirm,
-        subheader: &state.recipients.to_string(),
+        subheader: &recipients,
         expires_str: strings.expires_str,
         link_str: strings.link_str,
-        file_size: &format_file_size(state.uploaded),
-        expiry_date: &format_date(state.expires, &state.mail_lang),
+        file_size: &file_size,
+        expiry_date: &expiry_date,
         html_content: &state.mail_content,
         download_str: strings.download_str,
         confirm: strings.confirm,
         files_from: strings.files_from,
-        sender_email: &sender_str,
-        sender_attributes: &state.sender_attributes,
+        sender_email: &display,
+        sender_attributes: &attrs,
+        url,
+    };
+    let text = EmailTextTemplate {
+        header: strings.header_confirm,
+        subheader: &recipients,
+        expires_str: strings.expires_str,
+        link_str: strings.link_str,
+        file_size: &file_size,
+        expiry_date: &expiry_date,
+        html_content: &state.mail_content,
+        download_str: strings.download_str,
+        confirm: strings.confirm,
+        files_from: strings.files_from,
+        sender_email: &display,
+        sender_attributes: &attrs,
         url,
     };
 
@@ -185,7 +312,7 @@ fn email_confirm(state: &FileState, url: &str) -> (String, String) {
         sender: "",
     };
 
-    (email.to_string(), subject.to_string())
+    (html.to_string(), text.to_string(), subject.to_string())
 }
 
 pub async fn send_email(
@@ -228,14 +355,21 @@ pub async fn send_email(
                 .append_pair("uuid", uuid)
                 .append_pair("recipient", &format!("{}", recipient.email));
 
-            let (email, subject) = email_templates(state, url.as_str());
-            let email = Message::builder()
-                .header(ContentType::TEXT_HTML)
+            let (html, text, subject) = email_templates(state, url.as_str());
+            let mut builder = Message::builder()
                 .header(XPostGuard(X_POSTGUARD_VERSION.to_owned()))
+                .header(AutoSubmitted)
                 .from(config.email_from()) // checked in config
                 .to(recipient.clone())
-                .subject(subject)
-                .body(email)?;
+                .subject(subject);
+            if let Some(reply_to) = state
+                .sender
+                .as_deref()
+                .and_then(|s| s.parse::<Mailbox>().ok())
+            {
+                builder = builder.reply_to(reply_to);
+            }
+            let email = builder.multipart(build_body(html, text)?)?;
 
             // send email
             log::info!("Sending email to {}", recipient.email);
@@ -264,14 +398,14 @@ pub async fn send_email(
             .append_pair("uuid", uuid)
             .append_pair("recipient", &sender);
 
-        let (email, subject) = email_confirm(state, url.as_str());
+        let (html, text, subject) = email_confirm(state, url.as_str());
         let email = Message::builder()
-            .header(ContentType::TEXT_HTML)
             .header(XPostGuard(X_POSTGUARD_VERSION.to_owned()))
+            .header(AutoSubmitted)
             .from(config.email_from())
             .to(sender.parse()?)
             .subject(subject)
-            .body(email)?;
+            .multipart(build_body(html, text)?)?;
 
         log::info!("Sending confirmation email to {}", sender);
         let mailer = mailer_builder.build();
@@ -345,10 +479,47 @@ mod tests {
         assert_eq!(format!("{}", XPostGuard::name()), "X-PostGuard");
     }
 
+    #[test]
+    fn auto_submitted_header_emits_auto_generated() {
+        use lettre::message::Mailbox;
+        let msg = Message::builder()
+            .from("noreply@example.com".parse::<Mailbox>().unwrap())
+            .to("to@example.com".parse::<Mailbox>().unwrap())
+            .subject("t")
+            .header(AutoSubmitted)
+            .body(String::from("hi"))
+            .expect("build");
+        let raw = String::from_utf8(msg.formatted()).expect("utf8");
+        assert!(
+            raw.contains("Auto-Submitted: auto-generated"),
+            "expected Auto-Submitted header, got: {}",
+            raw
+        );
+    }
+
+    #[test]
+    fn sender_display_promotes_disclosed_name() {
+        let state = filestate_with_attrs(vec![
+            (FULLNAME_ATYPE.to_owned(), "Jan Jansen".to_owned()),
+            ("orgName".to_owned(), "Acme".to_owned()),
+        ]);
+        let (display, remaining) = sender_display(&state);
+        assert_eq!(display, "Jan Jansen");
+        assert_eq!(remaining, vec![("orgName".to_owned(), "Acme".to_owned())]);
+    }
+
+    #[test]
+    fn sender_display_falls_back_to_email_when_no_name_disclosed() {
+        let state = filestate_with_attrs(vec![("orgName".to_owned(), "Acme".to_owned())]);
+        let (display, remaining) = sender_display(&state);
+        assert_eq!(display, "sender@example.com");
+        assert_eq!(remaining, vec![("orgName".to_owned(), "Acme".to_owned())]);
+    }
+
     #[test]
     fn x_postguard_header_round_trips() {
-        let parsed = XPostGuard::parse("0.1.0").expect("parse");
-        assert_eq!(parsed.0, "0.1.0");
+        let parsed = XPostGuard::parse(X_POSTGUARD_VERSION).expect("parse");
+        assert_eq!(parsed.0, X_POSTGUARD_VERSION);
     }
 
     #[test]
@@ -362,9 +533,11 @@ mod tests {
             .body(String::from("hi"))
             .expect("build");
         let raw = String::from_utf8(msg.formatted()).expect("utf8");
+        let expected = format!("X-PostGuard: {}", X_POSTGUARD_VERSION);
         assert!(
-            raw.contains("X-PostGuard: 0.1.0"),
-            "expected X-PostGuard header in message, got: {}",
+            raw.contains(&expected),
+            "expected `{}` header in message, got: {}",
+            expected,
             raw
         );
     }
@@ -401,6 +574,12 @@ mod tests {
         assert_eq!(format_file_size(1024_u64.pow(4)), "1.0 TB");
     }
 
+    fn filestate_with_attrs(attrs: Vec<(String, String)>) -> FileState {
+        let mut state = staging_filestate();
+        state.sender_attributes = attrs;
+        state
+    }
+
     fn staging_filestate() -> FileState {
         use lettre::message::{Mailbox, Mailboxes};
         let mut mboxes = Mailboxes::new();

templates/email/email.html

@@ -9,7 +9,7 @@
     <div style="background:#F2F8FD;background-color:#F2F8FD;padding:1em;">
         <div style="background:#F2F8FD;width:100%;max-width:600px;margin-left:auto;margin-right:auto;text-align:center;">
             <div style="margin:50px 0 20px 0">
-                <img src="https://postguard.eu/pg_logo.png" alt="PostGuard" width="200" height="109" style="display:block;margin:0 auto;" />
+                <img src="cid:pg-logo" alt="PostGuard" width="200" height="109" style="display:block;margin:0 auto;" />
             </div>
             <div style="background:#FFFFFF;padding:60px 50px;border-radius:8px;text-align:center;">
                 <p style="font-size:22px;font-weight:700;color:#030E17;margin:0 0 5px 0;line-height:30px;">