diff --git a/.github/workflows/update-security-policy.yaml b/.github/workflows/update-security-policy.yaml index 2367eb6..49fc786 100644 --- a/.github/workflows/update-security-policy.yaml +++ b/.github/workflows/update-security-policy.yaml @@ -14,11 +14,11 @@ jobs: runs-on: ubuntu-latest steps: - - name: Checkout default branch using Silver Bot token + - name: Checkout default branch using OpenGovMail Bot token uses: actions/checkout@v4 with: ref: ${{ github.event.repository.default_branch }} - token: ${{ secrets.SILVER_BOT_TOKEN }} + token: ${{ secrets.OPENGOVMAIL_BOT_TOKEN }} - name: Update docs/SECURITY.md supported versions env: @@ -77,14 +77,14 @@ jobs: security_md_path.write_text("\n".join(content) + "\n", encoding="utf-8") PY - - name: Create Pull Request as Silver Bot + - name: Create Pull Request as OpenGovMail Bot uses: peter-evans/create-pull-request@v6 with: - token: ${{ secrets.SILVER_BOT_TOKEN }} + token: ${{ secrets.OPENGOVMAIL_BOT_TOKEN }} commit-message: "chore(security): update supported versions for ${{ github.event.release.tag_name }}" - committer: "${{ vars.SILVER_BOT_NAME }} <${{ vars.SILVER_BOT_EMAIL }}>" - author: "${{ vars.SILVER_BOT_NAME }} <${{ vars.SILVER_BOT_EMAIL }}>" - branch: silver-bot/update-security-${{ github.event.release.tag_name }} + committer: "${{ vars.OPENGOVMAIL_BOT_NAME }} <${{ vars.OPENGOVMAIL_BOT_EMAIL }}>" + author: "${{ vars.OPENGOVMAIL_BOT_NAME }} <${{ vars.OPENGOVMAIL_BOT_EMAIL }}>" + branch: opengovmail-bot/update-security-${{ github.event.release.tag_name }} base: ${{ github.event.repository.default_branch }} title: "chore(security): update supported versions for ${{ github.event.release.tag_name }}" body: | @@ -92,6 +92,6 @@ jobs: Release: `${{ github.event.release.tag_name }}` - Generated automatically by Silver Bot. + Generated automatically by OpenGovMail Bot. add-paths: | docs/SECURITY.md \ No newline at end of file diff --git a/.github/workflows/welcome-outside-contributors.yaml b/.github/workflows/welcome-outside-contributors.yaml index 9d2635a..fd74171 100644 --- a/.github/workflows/welcome-outside-contributors.yaml +++ b/.github/workflows/welcome-outside-contributors.yaml @@ -25,7 +25,7 @@ jobs: - name: Welcome first-time outside commenters on issues uses: actions/github-script@v7 with: - github-token: ${{ secrets.SILVER_BOT_TOKEN || github.token }} + github-token: ${{ secrets.OPENGOVMAIL_BOT_TOKEN || github.token }} script: | const issueNumber = context.payload.issue.number; const login = context.payload.comment.user.login; diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md index 21757a5..37696b3 100644 --- a/docs/CONTRIBUTING.md +++ b/docs/CONTRIBUTING.md @@ -1,6 +1,6 @@ -# Contributing to Raven (Silver Go IMAP) +# Contributing to Raven (OpenGovMail Go IMAP) -Thank you for your interest in contributing to the Raven (Silver Go IMAP) project! This document provides guidelines and instructions for contributing. +Thank you for your interest in contributing to the Raven (OpenGovMail Go IMAP) project! This document provides guidelines and instructions for contributing. ## Table of Contents diff --git a/internal/server/auth/authenticate_oauth_test.go b/internal/server/auth/authenticate_oauth_test.go index 9dd2b6a..382e63c 100644 --- a/internal/server/auth/authenticate_oauth_test.go +++ b/internal/server/auth/authenticate_oauth_test.go @@ -222,7 +222,7 @@ func TestAuthenticateOAuth_RejectsSASLUserEmailMismatch(t *testing.T) { "aud": []string{aud}, "exp": time.Now().Add(2 * time.Minute).Unix(), "username": "user2", - "email": "user2@silver.example.com", + "email": "user2@opengovmail.example.com", "sub": "subject-2", }) if err != nil { diff --git a/internal/server/auth/authenticateuser_test.go b/internal/server/auth/authenticateuser_test.go index 1c31973..972d393 100644 --- a/internal/server/auth/authenticateuser_test.go +++ b/internal/server/auth/authenticateuser_test.go @@ -243,7 +243,7 @@ func TestAuthenticateUser_SubdomainEmailFromIDP(t *testing.T) { authServer := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "application/json") w.WriteHeader(http.StatusOK) - _, _ = w.Write([]byte(`{"id":"user2@silver.example.com","type":"test-user","ouId":"silver"}`)) + _, _ = w.Write([]byte(`{"id":"user2@opengovmail.example.com","type":"test-user","ouId":"opengovmail"}`)) })) defer authServer.Close() @@ -261,14 +261,14 @@ func TestAuthenticateUser_SubdomainEmailFromIDP(t *testing.T) { conn := server.NewMockTLSConn() state := &models.ClientState{} - s.HandleLogin(conn, "A001", []string{"A001", "LOGIN", "user2@silver.example.com", "password"}, state) + s.HandleLogin(conn, "A001", []string{"A001", "LOGIN", "user2@opengovmail.example.com", "password"}, state) response := conn.GetWrittenData() if !strings.Contains(response, "A001 OK") { t.Fatalf("Expected successful login, got: %s", response) } - if state.Email != "user2@silver.example.com" { + if state.Email != "user2@opengovmail.example.com" { t.Fatalf("Expected canonical subdomain email, got: %s", state.Email) } } @@ -284,7 +284,7 @@ func TestAuthenticateUser_SubdomainEmailFromOrgUnitHierarchy(t *testing.T) { case "/auth/credentials/authenticate": w.Header().Set("Content-Type", "application/json") w.WriteHeader(http.StatusOK) - _, _ = w.Write([]byte(`{"id":"019cf0a6-114a-7dad-bea1-9a36bc728ece","type":"silveruser","ouId":"019cf0a5-4109-79ac-857b-07fc7b5c19ac"}`)) + _, _ = w.Write([]byte(`{"id":"019cf0a6-114a-7dad-bea1-9a36bc728ece","type":"opengovmailuser","ouId":"019cf0a5-4109-79ac-857b-07fc7b5c19ac"}`)) case "/flow/execute": var payload map[string]any if err := json.NewDecoder(r.Body).Decode(&payload); err != nil { @@ -333,7 +333,7 @@ func TestAuthenticateUser_SubdomainEmailFromOrgUnitHierarchy(t *testing.T) { } w.Header().Set("Content-Type", "application/json") w.WriteHeader(http.StatusOK) - _, _ = w.Write([]byte(`{"id":"019cf0a5-4109-79ac-857b-07fc7b5c19ac","handle":"silver","parent":"019cf0a3-c234-7190-a4c9-d5f6860a44e9"}`)) + _, _ = w.Write([]byte(`{"id":"019cf0a5-4109-79ac-857b-07fc7b5c19ac","handle":"opengovmail","parent":"019cf0a3-c234-7190-a4c9-d5f6860a44e9"}`)) case "/organization-units/019cf0a3-c234-7190-a4c9-d5f6860a44e9": if r.Header.Get("Authorization") != "Bearer test-assertion" { w.WriteHeader(http.StatusUnauthorized) @@ -367,14 +367,14 @@ func TestAuthenticateUser_SubdomainEmailFromOrgUnitHierarchy(t *testing.T) { conn := server.NewMockTLSConn() state := &models.ClientState{} - s.HandleLogin(conn, "A001", []string{"A001", "LOGIN", "user2@silver.example.com", "password"}, state) + s.HandleLogin(conn, "A001", []string{"A001", "LOGIN", "user2@opengovmail.example.com", "password"}, state) response := conn.GetWrittenData() if !strings.Contains(response, "A001 OK") { t.Fatalf("Expected successful login, got: %s", response) } - if state.Email != "user2@silver.example.com" { + if state.Email != "user2@opengovmail.example.com" { t.Fatalf("Expected OU-derived subdomain email, got: %s", state.Email) } @@ -394,7 +394,7 @@ func TestAuthenticateUser_UsernameWithDomainMismatchFromOrgUnit(t *testing.T) { case "/auth/credentials/authenticate": w.Header().Set("Content-Type", "application/json") w.WriteHeader(http.StatusOK) - _, _ = w.Write([]byte(`{"id":"019cf0a6-114a-7dad-bea1-9a36bc728ece","type":"silveruser","ouId":"019cf0a5-4109-79ac-857b-07fc7b5c19ac"}`)) + _, _ = w.Write([]byte(`{"id":"019cf0a6-114a-7dad-bea1-9a36bc728ece","type":"opengovmailuser","ouId":"019cf0a5-4109-79ac-857b-07fc7b5c19ac"}`)) case "/flow/execute": var payload map[string]any if err := json.NewDecoder(r.Body).Decode(&payload); err != nil { @@ -415,7 +415,7 @@ func TestAuthenticateUser_UsernameWithDomainMismatchFromOrgUnit(t *testing.T) { } w.Header().Set("Content-Type", "application/json") w.WriteHeader(http.StatusOK) - _, _ = w.Write([]byte(`{"id":"019cf0a5-4109-79ac-857b-07fc7b5c19ac","handle":"silver","parent":"019cf0a3-c234-7190-a4c9-d5f6860a44e9"}`)) + _, _ = w.Write([]byte(`{"id":"019cf0a5-4109-79ac-857b-07fc7b5c19ac","handle":"opengovmail","parent":"019cf0a3-c234-7190-a4c9-d5f6860a44e9"}`)) case "/organization-units/019cf0a3-c234-7190-a4c9-d5f6860a44e9": if r.Header.Get("Authorization") != "Bearer test-assertion" { w.WriteHeader(http.StatusUnauthorized) @@ -463,7 +463,7 @@ func TestAuthenticateUser_UsernameWithDomainMatchesOrgUnit(t *testing.T) { case "/auth/credentials/authenticate": w.Header().Set("Content-Type", "application/json") w.WriteHeader(http.StatusOK) - _, _ = w.Write([]byte(`{"id":"019cf0a6-114a-7dad-bea1-9a36bc728ece","type":"silveruser","ouId":"019cf0a5-4109-79ac-857b-07fc7b5c19ac"}`)) + _, _ = w.Write([]byte(`{"id":"019cf0a6-114a-7dad-bea1-9a36bc728ece","type":"opengovmailuser","ouId":"019cf0a5-4109-79ac-857b-07fc7b5c19ac"}`)) case "/flow/execute": var payload map[string]any if err := json.NewDecoder(r.Body).Decode(&payload); err != nil { @@ -484,7 +484,7 @@ func TestAuthenticateUser_UsernameWithDomainMatchesOrgUnit(t *testing.T) { } w.Header().Set("Content-Type", "application/json") w.WriteHeader(http.StatusOK) - _, _ = w.Write([]byte(`{"id":"019cf0a5-4109-79ac-857b-07fc7b5c19ac","handle":"silver","parent":"019cf0a3-c234-7190-a4c9-d5f6860a44e9"}`)) + _, _ = w.Write([]byte(`{"id":"019cf0a5-4109-79ac-857b-07fc7b5c19ac","handle":"opengovmail","parent":"019cf0a3-c234-7190-a4c9-d5f6860a44e9"}`)) case "/organization-units/019cf0a3-c234-7190-a4c9-d5f6860a44e9": if r.Header.Get("Authorization") != "Bearer test-assertion" { w.WriteHeader(http.StatusUnauthorized) @@ -513,7 +513,7 @@ func TestAuthenticateUser_UsernameWithDomainMatchesOrgUnit(t *testing.T) { conn := server.NewMockTLSConn() state := &models.ClientState{} - s.HandleLogin(conn, "A001", []string{"A001", "LOGIN", "user2@silver.example.com", "password"}, state) + s.HandleLogin(conn, "A001", []string{"A001", "LOGIN", "user2@opengovmail.example.com", "password"}, state) response := conn.GetWrittenData() if !strings.Contains(response, "A001 OK") { diff --git a/internal/server/auth/helpers_internal_test.go b/internal/server/auth/helpers_internal_test.go index 064a56f..366f95f 100644 --- a/internal/server/auth/helpers_internal_test.go +++ b/internal/server/auth/helpers_internal_test.go @@ -26,22 +26,22 @@ func TestResolveMailboxEmailPriority(t *testing.T) { name: "login email wins", loginIdentity: " user@example.com ", authID: "id@example.net", - domain: "silver.example.com", + domain: "opengovmail.example.com", want: "user@example.com", }, { name: "auth id email used", loginIdentity: "user2", - authID: "user2@silver.example.com", + authID: "user2@opengovmail.example.com", domain: "example.com", - want: "user2@silver.example.com", + want: "user2@opengovmail.example.com", }, { name: "derived domain fallback", loginIdentity: "user2", authID: "019cf0a6-114a", - domain: "silver.example.com", - want: "user2@silver.example.com", + domain: "opengovmail.example.com", + want: "user2@opengovmail.example.com", }, { name: "empty when nothing resolvable", @@ -133,7 +133,7 @@ func TestResolveOrganizationUnitDomainAndCycle(t *testing.T) { w.Header().Set("Content-Type", "application/json") switch r.URL.Path { case "/organization-units/ou-child": - _, _ = w.Write([]byte(`{"id":"ou-child","handle":"silver","parent":"ou-root"}`)) + _, _ = w.Write([]byte(`{"id":"ou-child","handle":"opengovmail","parent":"ou-root"}`)) case "/organization-units/ou-root": _, _ = w.Write([]byte(`{"id":"ou-root","handle":"example.com","parent":null}`)) default: @@ -146,8 +146,8 @@ func TestResolveOrganizationUnitDomainAndCycle(t *testing.T) { if err != nil { t.Fatalf("resolveOrganizationUnitDomain() unexpected error: %v", err) } - if domain != "silver.example.com" { - t.Fatalf("domain = %q, want %q", domain, "silver.example.com") + if domain != "opengovmail.example.com" { + t.Fatalf("domain = %q, want %q", domain, "opengovmail.example.com") } }) @@ -275,7 +275,7 @@ func TestResolveDomainFromOrganizationUnit_AdditionalBranches(t *testing.T) { return } w.Header().Set("Content-Type", "application/json") - _, _ = w.Write([]byte(`{"id":"ou-child","handle":"silver","parent":"ou-root"}`)) + _, _ = w.Write([]byte(`{"id":"ou-child","handle":"opengovmail","parent":"ou-root"}`)) case "/organization-units/ou-root": if r.Header.Get("Authorization") != "Bearer assertion-user" { w.WriteHeader(http.StatusUnauthorized) @@ -298,8 +298,8 @@ func TestResolveDomainFromOrganizationUnit_AdditionalBranches(t *testing.T) { t.Fatalf("extractBaseURL() = %q, want %q", baseURL, srv.URL) } - if got := resolveDomainFromOrganizationUnit(srv.URL+"/auth/credentials/authenticate", "ou-child", "user2", "pass"); got != "silver.example.com" { - t.Fatalf("resolveDomainFromOrganizationUnit() = %q, want %q", got, "silver.example.com") + if got := resolveDomainFromOrganizationUnit(srv.URL+"/auth/credentials/authenticate", "ou-child", "user2", "pass"); got != "opengovmail.example.com" { + t.Fatalf("resolveDomainFromOrganizationUnit() = %q, want %q", got, "opengovmail.example.com") } }