reply.go

package main

import (
	"encoding/json"
	"fmt"
	"net/http"
	"strings"
	"time"
)

func handleReplyAPI(w http.ResponseWriter, r *http.Request) {
	if r.Method != http.MethodPost {
		writeJSON(w, 405, map[string]any{"ok": false, "error": "POST only"})
		return
	}
	var req struct {
		ID      string `json:"id"`
		Text    string `json:"text"`
		From    string `json:"from"`
		To      string `json:"to"`
		Subject string `json:"subject"`
		// "text" (default), "html", or "markdown" — same as compose (see
		// composeReq.Format in compose.go), rendered through the same
		// renderBody so both paths produce identical output for the same input.
		Format string `json:"format"`
	}
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil || req.ID == "" || req.Text == "" {
		writeJSON(w, 400, map[string]any{"ok": false, "error": "id and text required"})
		return
	}
	// A message id alone must not let one tenant reply as another: without
	// this, replyMessage derives its Resend credentials purely from the
	// TARGET message's own mailbox, so any signed-in tenant could send mail
	// through a different tenant's Resend account just by supplying its
	// message id. Same class of gap as handleAttachmentOpen already guards.
	if !authIsAdmin(r) {
		p := newPocheFromEnv()
		doc, err := loadDoc(p, req.ID)
		if err != nil {
			writeJSON(w, 404, map[string]any{"ok": false, "error": "message not found"})
			return
		}
		mbID := authMailboxID(r)
		if mbID == "" || strField(doc, "mailbox_id") != mbID {
			writeJSON(w, 403, map[string]any{"ok": false, "error": "forbidden"})
			return
		}
	}
	data, err := replyMessage(req.ID, req.Text, req.From, req.To, req.Subject, req.Format)
	if err != nil {
		writeJSON(w, 500, map[string]any{"ok": false, "error": err.Error()})
		return
	}
	writeJSON(w, 200, map[string]any{"ok": true, "data": data})
}

func replyMessage(localID, text, fromOverride, toOverride, subjOverride, format string) (map[string]any, error) {
	p := newPocheFromEnv()
	doc, err := loadDoc(p, localID)
	if err != nil {
		return nil, err
	}
	from := fromOverride
	if from == "" {
		from, _ = doc["received_for"].(string)
	}
	if from == "" {
		from, _ = doc["to_addr"].(string)
	}
	// If the derived from address is missing, disallowed by domain allowlist, or
	// does not belong to the mailbox (e.g. stale 'inbox@local' from old payloads),
	// fall back to the mailbox primary address so replies can still be sent.
	mbID, _ := doc["mailbox_id"].(string)
	pForAddr := newPocheFromEnv()
	var mb *mailboxRecord
	if mbID != "" {
		mb, _ = getMailboxByID(pForAddr, mbID)
	}
	isMailboxAddr := mb != nil && mailboxOwnsAddress(pForAddr, mb, from)
	if from == "" || !fromAllowed(from) || (mb != nil && !isMailboxAddr) {
		if mb != nil && fromAllowed(mb.Address) {
			from = mb.Address
		}
	}
	if from == "" || !fromAllowed(from) {
		return nil, fmt.Errorf("from not allowed (set MAIL_FROM_ALLOWLIST): %s", from)
	}
	if mb != nil && !mailboxOwnsAddress(pForAddr, mb, from) {
		return nil, fmt.Errorf("from address %s does not belong to this mailbox", from)
	}
	to := toOverride
	if to == "" {
		to = emailOf(fmt.Sprint(doc["from_addr"]))
	}
	if to == "" {
		return nil, fmt.Errorf("no recipient")
	}
	subj := subjOverride
	if subj == "" {
		subj = reSubject(fmt.Sprint(doc["subject"]))
	}
	mid, _ := doc["message_id"].(string)
	// Continue the mailbox's own thread_id, not the specific message being
	// replied to: if you reply to the 3rd message in a conversation, the
	// new message must join the SAME thread everything else is in, not
	// start grouping around message #3's own id.
	threadID, _ := doc["thread_id"].(string)
	if threadID == "" {
		threadID = mid
	}
	textPart, htmlPart, err := renderBody(text, format)
	if err != nil {
		return nil, fmt.Errorf("render %s body: %w", normalizeFormat(format), err)
	}
	if strings.TrimSpace(stripTags(htmlPart)) == "" && strings.TrimSpace(textPart) == "" {
		return nil, fmt.Errorf("body is empty after rendering")
	}
	payload := map[string]any{
		"from":    from,
		"to":      []string{to},
		"subject": subj,
		"text":    textPart,
	}
	if htmlPart != "" {
		payload["html"] = htmlPart
	}
	// References carries the whole ancestor chain (RFC 5322), not just the
	// direct parent — needed for the recipient's own mail client to thread
	// correctly, and for our own findThreadIDByMessageID (sync.go) to find
	// a match even when the direct parent was never stored.
	existingRefs, _ := doc["references"].(string)
	refs := strings.TrimSpace(existingRefs + " " + mid)
	if mid != "" {
		payload["headers"] = map[string]string{
			"In-Reply-To": mid,
			"References":  refs,
		}
	}
	re := resendForMailbox(mb)
	sent, err := re.sendEmail(payload)
	if err != nil {
		return nil, err
	}
	sentID, _ := sent["id"].(string)
	sentMbID, _ := doc["mailbox_id"].(string)
	outDoc := map[string]any{
		"mailbox_id":     sentMbID,
		"from_addr":      from,
		"to_addr":        to,
		"subject":        subj,
		"preview":        truncate(textPart, 200),
		"body_text":      textPart,
		"body_html":      htmlPart,
		"html_sanitized": true,
		"search_text":    strings.ToLower(subj + " " + from + " " + to + " " + textPart),
		"thread_id":      threadID,
		"unread":         false,
		"starred":        false,
		"resend_id":      sentID,
		"message_id":     "",
		"received_for":   from,
		"direction":      "out",
		"in_reply_to":    mid,
		"references":     refs,
		"created_at":     time.Now().UnixMilli(),
	}
	_, err = p.Create("messages", outDoc)
	if err == nil {
		updateMailboxUsage(p, mbID, 1, messageSizeBytes(outDoc))
	}
	return map[string]any{
		"sent_id": sentID,
		"from":    from,
		"to":      to,
		"subject": subj,
	}, nil
}

func reSubject(subj string) string {
	l := strings.ToLower(strings.TrimSpace(subj))
	if strings.HasPrefix(l, "re:") {
		return subj
	}
	return "Re: " + subj
}