coulomb/email-connect
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

EMAIL-WP-0005-T02: add GreenMail test harness
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Adds tests/harness/docker-compose.yml running GreenMail 2.1.12 (digest-pinned)
with SMTP 3025, IMAP 3143 and the API bound to 127.0.0.1 only, plus a
config/harness-imap.yml scanner profile and harness README. Auth is disabled
and no users are declared, so a mailbox is created on first login and per-test
users need no provisioning.

GreenMail standalone offers no STARTTLS, only plaintext or implicit TLS, while
SMTPProvider hardcoded starttls() -- so no send could reach it. SMTPProvider
now takes a security mode via EMAIL_CONNECT_SMTP_SECURITY, defaulting to
starttls. plaintext is refused for any non-loopback host, and hostnames are
never resolved to decide that, so a misconfigured deployment fails at startup
rather than sending credentials in the clear. Trusting GreenMail's self-signed
cert was rejected as the wider risk; see DECISIONS.md.

Verified end to end against the live harness: SMTPProvider.send -> GreenMail ->
ImapMailboxSource, and the documented scan-mailbox CLI. Suite: 52 passed with
the harness down.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-14 01:41:38 +02:00
parent 86f22c2e65
commit 89fd13ac2d
8 changed files with 329 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

28
DECISIONS.md
View file

@ -160,3 +160,31 @@ local server; those classes stay on crafted fixtures plus an optional provider
simulator tier.
---
## Test harness mail server: GreenMail, and plaintext SMTP for loopback only
**Date:** 2026-08-14
**Decided by:** codex (EMAIL-WP-0005-T02)
GreenMail `2.1.12` (digest-pinned) is the harness mail server. It serves SMTP
and IMAP from one container and, with `greenmail.auth.disabled`, creates a
mailbox on first login — so per-test users need no provisioning step. Mailpit
was the alternative but offers no IMAP, which would leave the scanner's IMAP
source untested.
GreenMail standalone supports only plaintext or implicit-TLS setups; it has no
STARTTLS option (verified against the shipped jar's property builder). The
transactional service previously hardcoded `starttls()`, so no send could reach
it.
`SMTPProvider` therefore takes a `security` mode, `EMAIL_CONNECT_SMTP_SECURITY`,
defaulting to `starttls`. `plaintext` is refused for any non-loopback host, and
hostnames are never resolved to decide this — a name pointing at 127.0.0.1 today
is not a durable guarantee. A misconfigured deployment fails at startup instead
of putting credentials on the wire.
The alternative was trusting GreenMail's self-signed certificate for implicit
TLS, which would have meant shipping certificate-verification bypass code in the
send path. A loopback-guarded plaintext mode is the narrower risk.
---