node_modules: update (#355)

Co-authored-by: dawidd6 <9713907+dawidd6@users.noreply.github.com>

node_modules/nodemailer/dist/esm/mailer/index.d.ts

@@ -4,7 +4,7 @@ import DKIM, { type DKIMOptions } from '../dkim/index.js';
 import MailMessage, { type MailDefaults, type SendMailOptions } from './mail-message.js';
 import net from 'node:net';
 import type { ConnectionOptions } from 'node:tls';
-import type { MailComposerAlternative, MailComposerAttachment, MailComposerIcalEvent, MailComposerListHeaderEntry, MailComposerListHeaders, MailComposerTextEncoding } from '../mail-composer/index.js';
+import type { MailComposerAlternative, MailComposerAttachment, MailComposerIcalEvent, MailComposerListHeaderEntry, MailComposerListHeaders, MailComposerOtp, MailComposerTextEncoding } from '../mail-composer/index.js';
 import type { Callback, NodemailerError, ResultCallback } from '../errors.js';
 import type { ParsedUrl } from '../shared/url.js';
 import type { MimeNodeAddress, MimeNodeEnvelope, MimeNodeEnvelopeInput, MimeNodeHeaders, MimeNodeOptions } from '../mime-node/index.js';
@@ -227,11 +227,12 @@ declare namespace Mail {
     type Headers = MimeNodeHeaders;
     type ListHeader = MailComposerListHeaderEntry;
     type ListHeaders = MailComposerListHeaders;
+    type Otp = MailComposerOtp;
     type Envelope = MimeNodeEnvelopeInput;
     type Connection = SocketOptions;
     type TextEncoding = MailComposerTextEncoding;
     type PluginFunction<T = SentMessageInfo> = MailPluginFunction<T>;
 }
 /** The same aliases as module level exports, for `import * as Mail` and `import Mail = require()` */
-export type { SendMailOptions as Options, MimeNodeAddress as Address, MailComposerAttachment as Attachment, MailComposerAlternative as AttachmentLike, MailComposerAlternative as AmpAttachment, MailComposerIcalEvent as IcalAttachment, MimeNodeHeaders as Headers, MailComposerListHeaderEntry as ListHeader, MailComposerListHeaders as ListHeaders, MimeNodeEnvelopeInput as Envelope, SocketOptions as Connection, MailComposerTextEncoding as TextEncoding };
+export type { SendMailOptions as Options, MimeNodeAddress as Address, MailComposerAttachment as Attachment, MailComposerAlternative as AttachmentLike, MailComposerAlternative as AmpAttachment, MailComposerIcalEvent as IcalAttachment, MimeNodeHeaders as Headers, MailComposerListHeaderEntry as ListHeader, MailComposerListHeaders as ListHeaders, MailComposerOtp as Otp, MimeNodeEnvelopeInput as Envelope, SocketOptions as Connection, MailComposerTextEncoding as TextEncoding };
 export default Mail;

node_modules/nodemailer/dist/esm/mailer/index.js

@@ -145,6 +145,7 @@ class Mail extends EventEmitter {
                 mail.setMailerHeader();
                 mail.setPriorityHeaders();
                 mail.setListHeaders();
+                mail.setOtpHeader();
                 recipientCount = mail.message.getEnvelope().to.length;
             }
             catch (err) {

node_modules/nodemailer/dist/esm/mailer/mail-message.d.ts

@@ -103,4 +103,11 @@ export default class MailMessage<T = SentMessageInfo> {
     setMailerHeader(): void;
     setPriorityHeaders(): void;
     setListHeaders(): void;
+    /**
+     * Sets the OTP-Token header from the otp option. The header is defined by
+     * draft-goto-otp-token-01, an Internet-Draft that expires on 25 March 2027. By then check
+     * for a newer revision of the draft or a published RFC, the header name and its
+     * parameters are still open questions in the draft.
+     */
+    setOtpHeader(): void;
 }

node_modules/nodemailer/dist/esm/mailer/mail-message.js

@@ -1,6 +1,7 @@
 import * as shared from '../shared/index.js';
 import MimeNode from '../mime-node/index.js';
 import * as mimeFuncs from '../mime-funcs/index.js';
+import * as errors from '../errors.js';
 // Only an own key counts as already set. `key in obj` also matches every member of
 // Object.prototype, which silently drops a transporter default legitimately named
 // toString or constructor.
@@ -262,6 +263,26 @@ export default class MailMessage {
             });
         });
     }
+    /**
+     * Sets the OTP-Token header from the otp option. The header is defined by
+     * draft-goto-otp-token-01, an Internet-Draft that expires on 25 March 2027. By then check
+     * for a newer revision of the draft or a published RFC, the header name and its
+     * parameters are still open questions in the draft.
+     */
+    setOtpHeader() {
+        const otp = this.data.otp;
+        if (!this.message || !otp) {
+            return;
+        }
+        // a structured field String can only hold printable ascii. The code is a secret the recipient
+        // compares against the one in the message body, so it is rejected rather than cleaned up
+        if (typeof otp.code !== 'string' || !/^[\x20-\x7e]+$/.test(otp.code)) {
+            throw otpError('The otp code must be a non-empty string of printable ASCII characters');
+        }
+        // a structured field String escapes the same two characters as a quoted-string. setHeader
+        // replaces any OTP-Token from the custom headers, the field may appear only once
+        this.message.setHeader('OTP-Token', mimeFuncs.quoteString(otp.code) + '; origin=' + mimeFuncs.quoteString(getOtpOrigin(otp.origin)));
+    }
     /** @internal */
     _getListHeaders(listData) {
         // make sure an url looks like <protocol:url>
@@ -321,3 +342,36 @@ export default class MailMessage {
         return '<http://' + url + '>';
     }
 }
+/**
+ * Returns the canonical ascii serialization of the origin the code is bound to. The draft
+ * requires a potentially trustworthy origin, so only https is accepted, plus http on a
+ * loopback host for local development
+ */
+function getOtpOrigin(origin) {
+    let url;
+    try {
+        url = new URL(String(origin));
+    }
+    catch {
+        // handled below
+    }
+    // the WHATWG parser lets characters such as a quote or a brace into a host, which the
+    // origin grammar the draft requires (RFC 6454) does not allow, so a receiver would discard
+    // the header. Only a DNS name, an IPv4 address or a bracketed IPv6 address is accepted.
+    // Userinfo is refused as well, an origin never has it and it turns a value built as
+    // 'https://example.com' + input into the origin of whatever host follows an "@"
+    if (!url || url.username || url.password || !/^([a-z0-9_-]+\.)*[a-z0-9_-]+$|^\[[0-9a-f:.]+\]$/.test(url.hostname)) {
+        throw otpError('The otp origin must be an absolute https URL');
+    }
+    const isLoopback = /^(localhost|.+\.localhost|127(\.\d+){3}|\[::1\])$/.test(url.hostname);
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && isLoopback)) {
+        throw otpError('The otp origin must be an https URL, or an http URL on a loopback host');
+    }
+    // the URL parser already lowercases the host, converts it to punycode and drops the default port
+    return url.origin;
+}
+function otpError(message) {
+    const err = new Error(message);
+    err.code = errors.EOTP;
+    return err;
+}