fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

test/smtp_mailer_test.go

@@ -180,6 +180,46 @@ func TestSMTPMailerDelivery(t *testing.T) {
 		})
 	}
 
+	t.Run("Refuses to deliver in clear text to a non-loopback server that offers no STARTTLS", func(t *testing.T) {
+		server := newFakeSMTPServer(t, fakeSMTPOptions{listenAddress: "127.0.0.2:0"})
+
+		err := smtpMailerFor(server, config.SmtpSettings{Host: "127.0.0.2"}).Send("reader@example.org", "verification", verificationData())
+
+		if err == nil || !strings.Contains(err.Error(), "SMTP_ALLOW_INSECURE") {
+			t.Fatalf("expected an error naming SMTP_ALLOW_INSECURE, got %v", err)
+		}
+		if session := server.received()[0]; session.data != "" || session.from != "" {
+			t.Errorf("nothing may be sent in clear text: %+v", session)
+		}
+	})
+
+	t.Run("Delivers in clear text to a non-loopback server when SMTP_ALLOW_INSECURE is set", func(t *testing.T) {
+		server := newFakeSMTPServer(t, fakeSMTPOptions{listenAddress: "127.0.0.2:0"})
+
+		err := smtpMailerFor(server, config.SmtpSettings{Host: "127.0.0.2", AllowInsecure: true}).Send("reader@example.org", "verification", verificationData())
+
+		if err != nil {
+			t.Fatal(err)
+		}
+		if session := server.received()[0]; session.data == "" || session.usedTLS {
+			t.Errorf("expected a clear-text delivery, got %+v", session)
+		}
+	})
+
+	t.Run("Still refuses credentials in clear text when SMTP_ALLOW_INSECURE is set", func(t *testing.T) {
+		server := newFakeSMTPServer(t, fakeSMTPOptions{authMechanisms: "PLAIN", listenAddress: "127.0.0.2:0"})
+		settings := config.SmtpSettings{Login: "user@example.com", Password: "s3cret", Host: "127.0.0.2", AllowInsecure: true}
+
+		err := smtpMailerFor(server, settings).Send("reader@example.org", "verification", verificationData())
+
+		if err == nil {
+			t.Fatal("expected an error")
+		}
+		if session := server.received()[0]; session.password != "" || session.data != "" {
+			t.Errorf("credentials or data leaked: %+v", session)
+		}
+	})
+
 	t.Run("Fails when credentials are configured but the server offers no AUTH", func(t *testing.T) {
 		server := newFakeSMTPServer(t, fakeSMTPOptions{})
 		settings := config.SmtpSettings{Login: "user@example.com", Password: "s3cret"}