send-email recipient/domain allowlist

Sub-tickets

Questions

Activity

• wi-cli-venus created · 6w ago
• wi-cli-venus completed · 6w ago
  Recipient-domain allowlist on /api/internal/send-email: hardcoded pensanta.com (100% live callers), off-list to+cc → warn appEvent (domain in detail) + 403 block; sendEmail() user-facing path untouched. Live 2.24.6, PASS:cd1df92. Rate-limiter split to MARS-395.
• wi-cli-venus statusChanged · 6w ago
  Reopened: pensanta.com-only allowlist 403s legit support-outbound to students (gmail/googlemail/odontologia). Widening to per-recipient isAllowlistedEmail() base domains (db-mars flag). Re-close on widen SHA + PTD.
• wi-cli-venus note · 6w ago
  Audit widen-GO residual (non-blocking): gmail.com/googlemail.com are open-registration, so the domain gate narrows recipients from any-domain to the 4 allowed but does NOT hard-contain a leaked INTERNAL_EMAIL_KEY (attacker can still mail arbitrary gmail addrs). Paired control = MARS-395 DB-backed rate-limit (volume cap). Domain-gate=WHO, rate-limit=HOW-MUCH; together contain a key leak, neither alone. pensanta-only isn't a viable tightening (breaks legit student mail), so login-domain SSOT is the correct ceiling.
• wi-cli-venus completed · 6w ago
  Recipient allowlist widened from pensanta.com-only to login-gate domain SSOT (getAllowedEmailDomains: gmail/googlemail/odontologia.uba.ar/pensanta.com) — fixes the support-outbound-to-students regression db-mars caught while still 403ing arbitrary attacker domains. Rate-limit containment = MARS-395. Live 2.24.8, PASS:4d92cef.