|
28 | 28 | use function json_encode; |
29 | 29 |
|
30 | 30 | class IMAPClientFactory { |
31 | | - /** @var ICrypto */ |
32 | | - private $crypto; |
33 | | - |
34 | | - /** @var IConfig */ |
35 | | - private $config; |
36 | | - |
37 | | - /** @var ICacheFactory */ |
38 | | - private $cacheFactory; |
39 | | - |
40 | | - /** @var IEventDispatcher */ |
41 | | - private $eventDispatcher; |
42 | | - |
43 | | - private ITimeFactory $timeFactory; |
44 | | - private HordeCacheFactory $hordeCacheFactory; |
45 | | - private ProvisioningMapper $provisioningMapper; |
46 | | - |
47 | | - public function __construct(ICrypto $crypto, |
48 | | - IConfig $config, |
49 | | - ICacheFactory $cacheFactory, |
50 | | - IEventDispatcher $eventDispatcher, |
51 | | - ITimeFactory $timeFactory, |
52 | | - HordeCacheFactory $hordeCacheFactory, |
53 | | - ProvisioningMapper $provisioningMapper) { |
54 | | - $this->crypto = $crypto; |
55 | | - $this->config = $config; |
56 | | - $this->cacheFactory = $cacheFactory; |
57 | | - $this->eventDispatcher = $eventDispatcher; |
58 | | - $this->timeFactory = $timeFactory; |
59 | | - $this->hordeCacheFactory = $hordeCacheFactory; |
60 | | - $this->provisioningMapper = $provisioningMapper; |
61 | | - } |
62 | | - |
63 | | - /** |
64 | | - * Get the connection object for the given account |
65 | | - * |
66 | | - * Connections are not closed until destruction, so the caller site is |
67 | | - * responsible to log out as soon as possible to keep the number of open |
68 | | - * (and stale) connections at a minimum. |
69 | | - * |
70 | | - * @param Account $account |
71 | | - * @param bool $useCache |
72 | | - * |
73 | | - * @return Horde_Imap_Client_Socket |
74 | | - * @throws ServiceException |
75 | | - */ |
76 | | - public function getClient(Account $account, bool $useCache = true): Horde_Imap_Client_Socket { |
77 | | - $this->eventDispatcher->dispatchTyped( |
78 | | - new BeforeImapClientCreated($account) |
79 | | - ); |
80 | | - $host = $account->getMailAccount()->getInboundHost(); |
81 | | - $user = $account->getMailAccount()->getInboundUser(); |
82 | | - $decryptedPassword = null; |
83 | | - if ($account->getMailAccount()->getInboundPassword() !== null) { |
84 | | - $decryptedPassword = $this->crypto->decrypt($account->getMailAccount()->getInboundPassword()); |
85 | | - } |
86 | | - $port = $account->getMailAccount()->getInboundPort(); |
87 | | - $sslMode = $account->getMailAccount()->getInboundSslMode(); |
88 | | - if ($sslMode === 'none') { |
89 | | - $sslMode = false; |
90 | | - } |
91 | | - |
92 | | - // Check for Dovecot master user authentication |
93 | | - $provisioningId = $account->getMailAccount()->getProvisioningId(); |
94 | | - if ($provisioningId !== null) { |
95 | | - $provisioning = $this->provisioningMapper->get($provisioningId); |
96 | | - if ($provisioning !== null && !empty($provisioning->getMasterUser())) { |
97 | | - $separator = $provisioning->getMasterUserSeparator() ?? '*'; |
98 | | - $user = $user . $separator . $provisioning->getMasterUser(); |
99 | | - } |
100 | | - } |
101 | | - |
102 | | - $params = [ |
103 | | - 'username' => $user, |
104 | | - 'password' => $decryptedPassword, |
105 | | - 'hostspec' => $host, |
106 | | - 'port' => $port, |
107 | | - 'secure' => $sslMode, |
108 | | - 'timeout' => (int)$this->config->getSystemValue('app.mail.imap.timeout', 5), |
109 | | - 'context' => [ |
110 | | - 'ssl' => [ |
111 | | - 'verify_peer' => $this->config->getSystemValueBool('app.mail.verify-tls-peer', true), |
112 | | - 'verify_peer_name' => $this->config->getSystemValueBool('app.mail.verify-tls-peer', true), |
113 | | - ], |
114 | | - ], |
115 | | - ]; |
116 | | - if ($account->getMailAccount()->getAuthMethod() === 'xoauth2') { |
117 | | - try { |
118 | | - $oauthAccessToken = $account->getMailAccount()->getOauthAccessToken(); |
119 | | - if ($oauthAccessToken === null) { |
120 | | - throw new ServiceException('Missing access token for xoauth2 account'); |
121 | | - } |
122 | | - $decryptedAccessToken = $this->crypto->decrypt($oauthAccessToken); |
123 | | - } catch (Exception $e) { |
124 | | - throw new ServiceException('Could not decrypt account access token: ' . $e->getMessage(), 0, $e); |
125 | | - } |
126 | | - |
127 | | - $params['password'] = $decryptedAccessToken; // Not used, but Horde wants this |
128 | | - $params['xoauth2_token'] = new Horde_Imap_Client_Password_Xoauth2( |
129 | | - $account->getEmail(), |
130 | | - $decryptedAccessToken, |
131 | | - ); |
132 | | - } |
133 | | - $paramHash = hash( |
134 | | - 'sha512', |
135 | | - implode('-', [ |
136 | | - $this->config->getSystemValueString('secret'), |
137 | | - $account->getId(), |
138 | | - json_encode($params) |
139 | | - ]), |
140 | | - ); |
141 | | - if ($useCache) { |
142 | | - $params['cache'] = [ |
143 | | - 'backend' => $this->hordeCacheFactory->newCache($account), |
144 | | - ]; |
145 | | - } |
146 | | - if ($account->getDebug() || $this->config->getSystemValueBool('app.mail.debug')) { |
147 | | - $fn = 'mail-' . $account->getUserId() . '-' . $account->getId() . '-imap.log'; |
148 | | - $params['debug'] = $this->config->getSystemValue('datadirectory') . '/' . $fn; |
149 | | - } |
150 | | - |
151 | | - $client = new HordeImapClient($params); |
152 | | - |
153 | | - $rateLimitingCache = $this->cacheFactory->createDistributed('mail_imap_ratelimit'); |
154 | | - if ($rateLimitingCache instanceof IMemcache) { |
155 | | - $client->enableRateLimiter($rateLimitingCache, $paramHash, $this->timeFactory); |
156 | | - } |
157 | | - |
158 | | - return $client; |
159 | | - } |
| 31 | + /** @var ICrypto */ |
| 32 | + private $crypto; |
| 33 | + |
| 34 | + /** @var IConfig */ |
| 35 | + private $config; |
| 36 | + |
| 37 | + /** @var ICacheFactory */ |
| 38 | + private $cacheFactory; |
| 39 | + |
| 40 | + /** @var IEventDispatcher */ |
| 41 | + private $eventDispatcher; |
| 42 | + |
| 43 | + private ITimeFactory $timeFactory; |
| 44 | + private HordeCacheFactory $hordeCacheFactory; |
| 45 | + private ProvisioningMapper $provisioningMapper; |
| 46 | + |
| 47 | + public function __construct(ICrypto $crypto, |
| 48 | + IConfig $config, |
| 49 | + ICacheFactory $cacheFactory, |
| 50 | + IEventDispatcher $eventDispatcher, |
| 51 | + ITimeFactory $timeFactory, |
| 52 | + HordeCacheFactory $hordeCacheFactory, |
| 53 | + ProvisioningMapper $provisioningMapper) { |
| 54 | + $this->crypto = $crypto; |
| 55 | + $this->config = $config; |
| 56 | + $this->cacheFactory = $cacheFactory; |
| 57 | + $this->eventDispatcher = $eventDispatcher; |
| 58 | + $this->timeFactory = $timeFactory; |
| 59 | + $this->hordeCacheFactory = $hordeCacheFactory; |
| 60 | + $this->provisioningMapper = $provisioningMapper; |
| 61 | + } |
| 62 | + |
| 63 | + /** |
| 64 | + * Get the connection object for the given account |
| 65 | + * |
| 66 | + * Connections are not closed until destruction, so the caller site is |
| 67 | + * responsible to log out as soon as possible to keep the number of open |
| 68 | + * (and stale) connections at a minimum. |
| 69 | + * |
| 70 | + * @param Account $account |
| 71 | + * @param bool $useCache |
| 72 | + * |
| 73 | + * @return Horde_Imap_Client_Socket |
| 74 | + * @throws ServiceException |
| 75 | + */ |
| 76 | + public function getClient(Account $account, bool $useCache = true): Horde_Imap_Client_Socket { |
| 77 | + $this->eventDispatcher->dispatchTyped( |
| 78 | + new BeforeImapClientCreated($account) |
| 79 | + ); |
| 80 | + $host = $account->getMailAccount()->getInboundHost(); |
| 81 | + $user = $account->getMailAccount()->getInboundUser(); |
| 82 | + $decryptedPassword = null; |
| 83 | + if ($account->getMailAccount()->getInboundPassword() !== null) { |
| 84 | + $decryptedPassword = $this->crypto->decrypt($account->getMailAccount()->getInboundPassword()); |
| 85 | + } |
| 86 | + $port = $account->getMailAccount()->getInboundPort(); |
| 87 | + $sslMode = $account->getMailAccount()->getInboundSslMode(); |
| 88 | + if ($sslMode === 'none') { |
| 89 | + $sslMode = false; |
| 90 | + } |
| 91 | + |
| 92 | + // Check for Dovecot master user authentication |
| 93 | + $provisioningId = $account->getMailAccount()->getProvisioningId(); |
| 94 | + if ($provisioningId !== null) { |
| 95 | + $provisioning = $this->provisioningMapper->get($provisioningId); |
| 96 | + if ($provisioning !== null && !empty($provisioning->getMasterUser())) { |
| 97 | + $separator = $provisioning->getMasterUserSeparator() ?? '*'; |
| 98 | + $user = $user . $separator . $provisioning->getMasterUser(); |
| 99 | + } |
| 100 | + } |
| 101 | + |
| 102 | + $params = [ |
| 103 | + 'username' => $user, |
| 104 | + 'password' => $decryptedPassword, |
| 105 | + 'hostspec' => $host, |
| 106 | + 'port' => $port, |
| 107 | + 'secure' => $sslMode, |
| 108 | + 'timeout' => (int)$this->config->getSystemValue('app.mail.imap.timeout', 5), |
| 109 | + 'context' => [ |
| 110 | + 'ssl' => [ |
| 111 | + 'verify_peer' => $this->config->getSystemValueBool('app.mail.verify-tls-peer', true), |
| 112 | + 'verify_peer_name' => $this->config->getSystemValueBool('app.mail.verify-tls-peer', true), |
| 113 | + ], |
| 114 | + ], |
| 115 | + ]; |
| 116 | + if ($account->getMailAccount()->getAuthMethod() === 'xoauth2') { |
| 117 | + try { |
| 118 | + $oauthAccessToken = $account->getMailAccount()->getOauthAccessToken(); |
| 119 | + if ($oauthAccessToken === null) { |
| 120 | + throw new ServiceException('Missing access token for xoauth2 account'); |
| 121 | + } |
| 122 | + $decryptedAccessToken = $this->crypto->decrypt($oauthAccessToken); |
| 123 | + } catch (Exception $e) { |
| 124 | + throw new ServiceException('Could not decrypt account access token: ' . $e->getMessage(), 0, $e); |
| 125 | + } |
| 126 | + |
| 127 | + $params['password'] = $decryptedAccessToken; // Not used, but Horde wants this |
| 128 | + $params['xoauth2_token'] = new Horde_Imap_Client_Password_Xoauth2( |
| 129 | + $account->getEmail(), |
| 130 | + $decryptedAccessToken, |
| 131 | + ); |
| 132 | + } |
| 133 | + $paramHash = hash( |
| 134 | + 'sha512', |
| 135 | + implode('-', [ |
| 136 | + $this->config->getSystemValueString('secret'), |
| 137 | + $account->getId(), |
| 138 | + json_encode($params) |
| 139 | + ]), |
| 140 | + ); |
| 141 | + if ($useCache) { |
| 142 | + $params['cache'] = [ |
| 143 | + 'backend' => $this->hordeCacheFactory->newCache($account), |
| 144 | + ]; |
| 145 | + } |
| 146 | + if ($account->getDebug() || $this->config->getSystemValueBool('app.mail.debug')) { |
| 147 | + $fn = 'mail-' . $account->getUserId() . '-' . $account->getId() . '-imap.log'; |
| 148 | + $params['debug'] = $this->config->getSystemValue('datadirectory') . '/' . $fn; |
| 149 | + } |
| 150 | + |
| 151 | + $client = new HordeImapClient($params); |
| 152 | + |
| 153 | + $rateLimitingCache = $this->cacheFactory->createDistributed('mail_imap_ratelimit'); |
| 154 | + if ($rateLimitingCache instanceof IMemcache) { |
| 155 | + $client->enableRateLimiter($rateLimitingCache, $paramHash, $this->timeFactory); |
| 156 | + } |
| 157 | + |
| 158 | + return $client; |
| 159 | + } |
160 | 160 | } |
0 commit comments