Allow always showing images from trusted senders

Signed-off-by: Christoph Wurst <[email protected]>

appinfo/info.xml

@@ -12,7 +12,7 @@
 - **🙈 We’re not reinventing the wheel!** Based on the great [Horde](http://horde.org) libraries.
 - **📬 Want to host your own mail server?** We don’t have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!
 	]]></description>
-	<version>1.8.0-alpha.1</version>
+	<version>1.8.0-alpha.2</version>
 	<licence>agpl</licence>
 	<author>Christoph Wurst</author>
 	<author>Greta Doçi</author>

appinfo/routes.php

@@ -189,6 +189,16 @@
 			'url' => '/api/settings/provisioning',
 			'verb' => 'DELETE'
 		],
+		[
+			'name' => 'trusted_senders#setTrusted',
+			'url' => '/api/trustedsenders/{email}',
+			'verb' => 'PUT'
+		],
+		[
+			'name' => 'trusted_senders#removeTrust',
+			'url' => '/api/trustedsenders/{email}',
+			'verb' => 'DELETE'
+		],
 	],
 	'resources' => [
 		'accounts' => ['url' => '/api/accounts'],

lib/AppInfo/Application.php

@@ -31,6 +31,7 @@
 use OCA\Mail\Contracts\IMailManager;
 use OCA\Mail\Contracts\IMailSearch;
 use OCA\Mail\Contracts\IMailTransmission;
+use OCA\Mail\Contracts\ITrustedSenderService;
 use OCA\Mail\Contracts\IUserPreferences;
 use OCA\Mail\Dashboard\ImportantMailWidget;
 use OCA\Mail\Dashboard\UnreadMailWidget;
@@ -60,6 +61,7 @@
 use OCA\Mail\Service\MailManager;
 use OCA\Mail\Service\MailTransmission;
 use OCA\Mail\Service\Search\MailSearch;
+use OCA\Mail\Service\TrustedSenderService;
 use OCA\Mail\Service\UserPreferenceSevice;
 use OCP\AppFramework\App;
 use OCP\AppFramework\Bootstrap\IBootContext;
@@ -96,6 +98,7 @@ public function register(IRegistrationContext $context): void {
 		$context->registerServiceAlias(IMailManager::class, MailManager::class);
 		$context->registerServiceAlias(IMailSearch::class, MailSearch::class);
 		$context->registerServiceAlias(IMailTransmission::class, MailTransmission::class);
+		$context->registerServiceAlias(ITrustedSenderService::class, TrustedSenderService::class);
 		$context->registerServiceAlias(IUserPreferences::class, UserPreferenceSevice::class);
 
 		$context->registerEventListener(DraftSavedEvent::class, DeleteDraftListener::class);

lib/Contracts/ITrustedSenderService.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * @copyright 2020 Christoph Wurst <[email protected]>
+ *
+ * @author 2020 Christoph Wurst <[email protected]>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+namespace OCA\Mail\Contracts;
+
+interface ITrustedSenderService {
+	public function isTrusted(string $uid, string $email): bool;
+
+	public function trust(string $uid, string $email, ?bool $trust = true);
+}

lib/Controller/MessagesController.php

@@ -34,6 +34,8 @@
 use OC\Security\CSP\ContentSecurityPolicyNonceManager;
 use OCA\Mail\Contracts\IMailManager;
 use OCA\Mail\Contracts\IMailSearch;
+use OCA\Mail\Contracts\ITrustedSenderService;
+use OCA\Mail\Db\Message;
 use OCA\Mail\Exception\ClientException;
 use OCA\Mail\Exception\ServiceException;
 use OCA\Mail\Http\AttachmentDownloadResponse;
@@ -91,6 +93,9 @@ class MessagesController extends Controller {
 	/** @var ContentSecurityPolicyNonceManager */
 	private $nonceManager;
 
+	/** @var ITrustedSenderService */
+	private $trustedSenderService;
+
 	/**
 	 * @param string $appName
 	 * @param IRequest $request
@@ -105,6 +110,7 @@ class MessagesController extends Controller {
 	 * @param IMimeTypeDetector $mimeTypeDetector
 	 * @param IURLGenerator $urlGenerator
 	 * @param ContentSecurityPolicyNonceManager $nonceManager
+	 * @param ITrustedSenderService $trustedSenderService
 	 */
 	public function __construct(string $appName,
 								IRequest $request,
@@ -118,7 +124,8 @@ public function __construct(string $appName,
 								IL10N $l10n,
 								IMimeTypeDetector $mimeTypeDetector,
 								IURLGenerator $urlGenerator,
-								ContentSecurityPolicyNonceManager $nonceManager) {
+								ContentSecurityPolicyNonceManager $nonceManager,
+								ITrustedSenderService $trustedSenderService) {
 		parent::__construct($appName, $request);
 
 		$this->accountService = $accountService;
@@ -133,6 +140,7 @@ public function __construct(string $appName,
 		$this->urlGenerator = $urlGenerator;
 		$this->mailManager = $mailManager;
 		$this->nonceManager = $nonceManager;
+		$this->trustedSenderService = $trustedSenderService;
 	}
 
 	/**
@@ -149,6 +157,7 @@ public function __construct(string $appName,
 	 * @throws ClientException
 	 * @throws ServiceException
 	 */
+
 	public function index(int $mailboxId,
 						  int $cursor = null,
 						  string $filter = null,
@@ -246,10 +255,27 @@ public function getBody(int $id): JSONResponse {
 		$json['accountId'] = $account->getId();
 		$json['mailboxId'] = $mailbox->getId();
 		$json['databaseId'] = $message->getId();
+		$json['isSenderTrusted'] = $this->isSenderTrusted($message);
 
 		return new JSONResponse($json);
 	}
 
+	private function isSenderTrusted(Message $message): bool {
+		$from = $message->getFrom();
+		$first = $from->first();
+		if ($first === null) {
+			return false;
+		}
+		$email = $first->getEmail();
+		if ($email === null) {
+			return false;
+		}
+		return $this->trustedSenderService->isTrusted(
+			$this->currentUserId,
+			$email
+		);
+	}
+
 	/**
 	 * @NoAdminRequired
 	 * @NoCSRFRequired

lib/Controller/TrustedSendersController.php

@@ -0,0 +1,86 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * @copyright 2020 Christoph Wurst <[email protected]>
+ *
+ * @author 2020 Christoph Wurst <[email protected]>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+namespace OCA\Mail\Controller;
+
+use OCA\Mail\AppInfo\Application;
+use OCA\Mail\Contracts\ITrustedSenderService;
+use OCA\Mail\Http\JsonResponse;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http;
+use OCP\IRequest;
+
+class TrustedSendersController extends Controller {
+
+	/** @var string|null */
+	private $uid;
+
+	/** @var ITrustedSenderService */
+	private $trustedSenderService;
+
+	public function __construct(IRequest $request,
+								?string $UserId,
+								ITrustedSenderService $trustedSenderService) {
+		parent::__construct(Application::APP_ID, $request);
+
+		$this->uid = $UserId;
+		$this->trustedSenderService = $trustedSenderService;
+	}
+
+	/**
+	 * @NoAdminRequired
+	 * @TrapError
+	 *
+	 * @param string $email
+	 *
+	 * @return JsonResponse
+	 */
+	public function setTrusted(string $email): JsonResponse {
+		$this->trustedSenderService->trust(
+			$this->uid,
+			$email
+		);
+
+		return JsonResponse::success(null, Http::STATUS_CREATED);
+	}
+
+	/**
+	 * @NoAdminRequired
+	 * @TrapError
+	 *
+	 * @param string $email
+	 *
+	 * @return JsonResponse
+	 */
+	public function removeTrust(string $email): JsonResponse {
+		$this->trustedSenderService->trust(
+			$this->uid,
+			$email,
+			false
+		);
+
+		return JsonResponse::success(null);
+	}
+}

lib/Db/TrustedSender.php

@@ -0,0 +1,43 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * @copyright 2020 Christoph Wurst <[email protected]>
+ *
+ * @author 2020 Christoph Wurst <[email protected]>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+namespace OCA\Mail\Db;
+
+use OCP\AppFramework\Db\Entity;
+
+/**
+ * @method setEmail(string $email): void
+ * @method getEmail(): string
+ * @method setUserId(string $userId): void
+ * @method getUserId(): string
+ */
+class TrustedSender extends Entity {
+
+	/** @var string */
+	protected $email;
+
+	/** @var string */
+	protected $userId;
+}

lib/Db/TrustedSenderMapper.php

@@ -0,0 +1,75 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * @copyright 2020 Christoph Wurst <[email protected]>
+ *
+ * @author 2020 Christoph Wurst <[email protected]>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+namespace OCA\Mail\Db;
+
+use OCP\AppFramework\Db\QBMapper;
+use OCP\IDBConnection;
+
+class TrustedSenderMapper extends QBMapper {
+	public function __construct(IDBConnection $db) {
+		parent::__construct($db, 'mail_trusted_senders');
+	}
+
+	public function exists(string $uid, string $email): bool {
+		$qb = $this->db->getQueryBuilder();
+
+		$select = $qb->select('*')
+			->from($this->getTableName())
+			->where(
+				$qb->expr()->eq('user_id', $qb->createNamedParameter($uid)),
+				$qb->expr()->eq('email', $qb->createNamedParameter($email))
+			);
+
+		/** @var TrustedSender[] $rows */
+		$rows = $this->findEntities($select);
+
+		return !empty($rows);
+	}
+
+	public function create(string $uid, string $email): void {
+		$qb = $this->db->getQueryBuilder();
+
+		$insert = $qb->insert($this->getTableName())
+			->values([
+				'user_id' => $qb->createNamedParameter($uid),
+				'email' => $qb->createNamedParameter($email),
+			]);
+
+		$insert->execute();
+	}
+
+	public function remove(string $uid, string $email): void {
+		$qb = $this->db->getQueryBuilder();
+
+		$delete = $qb->delete($this->getTableName())
+			->where(
+				$qb->expr()->eq('user_id', $qb->createNamedParameter($uid)),
+				$qb->expr()->eq('email', $qb->createNamedParameter($email))
+			);
+
+		$delete->execute();
+	}
+}