intake

type AddressedMailDeliverer interface {
	Execute(
		ctx context.Context, mail jumbleservice.ReceivedMail,
	) (jumbleservice.MailDeliveryResult, error)
}

type AddressedMailIntake struct {
	Deliveries AddressedMailDeliverer
	Limits     MailLimits
	// Key is HUBTASK_MAIL_INBOUND_KEY. Empty leaves the door shut: an installation without a key
	// takes nothing at it.
	Key string
}

type Mail struct {
	// Sender is the address the message claims to come from, decoded and normalised. Data, never
	// an identity: a From header authenticates nothing (security.md §4), and every consumer of
	// this field treats it as text somebody typed.
	Sender string
	// SenderName is the display name the From header carried, decoded. As untrusted as the address.
	SenderName string
	// Recipients are the addresses the message names as where it went: the envelope headers an
	// inbound service writes first (X-Original-To, Delivered-To), then To and Cc. Lowercased.
	Recipients []string
	// Signals are what the headers say about the message rather than in it.
	Signals MailSignals
	// Subject is the decoded subject line, RFC 2047 words included.
	Subject string
	// Text is what a person reads: the plain part where there is one, and the HTML part's source
	// as text where there is not. Never rendered markup - an HTML mail read here is somebody
	// reading tags, which is the honest thing for an inbox that must not run them.
	Text string
	// Attachments are the files the mail carried, decoded and bounded. The HTML alternative of a
	// mail that also had a plain part is one of them, carried as text: keeping it is what "stored
	// alongside" means, and keeping it out of Text is what stops a second copy of the same message
	// from being the message.
	Attachments []MailAttachment
	// MessageID is the Message-ID header without its angle brackets, which is what makes a message
	// received twice one message (ADR-0094 decision 6). Empty where the sender wrote none.
	MessageID string
}

type MailAttachment struct {
	FileName    string
	ContentType string
	Content     []byte
}

type MailDeliverer interface {
	Execute(ctx context.Context, delivery jumbleservice.MailDelivery) (domain.Entry, error)
}

type MailIntake struct {
	Deliveries MailDeliverer
	// Limits are the parser's bounds. Zero fields take the documented defaults, so an installation
	// that configures nothing is bounded rather than unbounded.
	Limits MailLimits
}

type MailLimits struct {
	// MaxParts is how many MIME parts one message may have, counted across the whole tree.
	MaxParts int
	// MaxDepth is how deeply parts may nest. A multipart/mixed holding a multipart/alternative is
	// depth two, which is what an ordinary mail with a text, an HTML alternative and a file looks
	// like; four leaves room for the unordinary one.
	MaxDepth int
	// MaxAttachments is how many files one mail may carry into the jumble.
	MaxAttachments int
	// MaxAttachmentBytes bounds one attachment, decoded.
	MaxAttachmentBytes int64
	// MaxTextBytes bounds the text this becomes, decoded. The jumble's own bound on a body is the
	// domain's (jumble.MaxBodyBytes); this one is the parser's, so an over-long part is cut here
	// rather than refused three layers later.
	MaxTextBytes int64
}

type MailSignals struct {
	// Automatic is a message a machine sent on its own: `Auto-Submitted` other than `no` (RFC 3834),
	// or Hubtask's own notification header. Such a message is discarded - a loop ends at its first
	// turn.
	Automatic bool
	// Spam is the inbound service's verdict where it wrote one: `X-Spam-Flag: YES`, an
	// `X-Spam-Status` beginning with yes, or Mailgun's `X-Mailgun-Sflag: Yes`.
	Spam bool
	// AuthFailed is SPF or DMARC reported as failed in `Authentication-Results` or `Received-SPF`.
	// The sender is then nobody the workspace knows.
	AuthFailed bool
}

type WebhookIntake struct {
	Deliveries jumbleservice.IntakeJumbleEntry
}