fix(email): correctly classify final MIME header in PGP email encryption

[fallenbagel]

Description

OpenPGP encrypted emails were rendering as raw HTML and MIME source code in mail clients instead of formatted content after decryption.

The PGP encryptor splits outgoing email headers into two groups:

1. transport headers that stay on the outer message,
2. and content headers that get included inside the encrypted payload.

The header parsing loop had a special case for the final header line that merged it into the previous header unconditionally, causing it to be misclassified. In practice this meant the Content-Type multipart/alternative header (which declares the MIME boundaries) ended up in the outer transport headers instead of inside the encrypted payload.

After decryption, mail clients had no Content-Type header to interpret the MIME structure, so they rendered the raw boundaries and HTML source as plain text. The parsing loop now classifies every header independently, including the final one, so the encrypted payload contains the correct content headers for proper rendering after decryption.

• Fixes [Bug]: OpenPGP encrypted emails render as raw HTML/MIME source code in mail clients #2599

How Has This Been Tested?

Screenshots / Logs (if applicable)

Checklist:

• I have read and followed the contribution guidelines.
• Disclosed any use of AI (see our policy)
• I have updated the documentation accordingly.
• All new and existing tests passed.
• Successful build pnpm build
• Translation keys pnpm i18n:extract
• Database migration (if required)

Summary by CodeRabbit

• Refactor
  • Internal optimization of email header processing logic in encryption operations. No changes to end-user functionality or behavior.

[coderabbitai]

📝 Walkthrough

Walkthrough

Refactors header splitting logic in OpenPGP encryption to push accumulated headers upon encountering new header lines instead of via edge-case handling. Adds classification of headers into contentHeaders or emailHeaders based on content-type inspection, with post-loop finalization of remaining headers.

Changes

Cohort / File(s)	Summary
OpenPGP Header Processing server/lib/email/openpgpEncrypt.ts	Simplifies header splitting logic by categorizing accumulated headers (content vs. email headers) when new header lines are encountered, removing explicit last-header edge-case handling and deferring finalization to a post-loop check. No change to overall encryption flow.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Poem

🐰 whispers in bunny tongue
Headers hop in proper place,
Content split with careful grace,
MIME structure now holds true,
Encryption magic shines right through! ✨

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main fix: correcting the classification of the final MIME header in PGP email encryption, which directly addresses the bug causing encrypted emails to render as raw MIME.
Linked Issues check	✅ Passed	The code changes correctly implement the fix to classify headers independently, ensuring the final Content-Type header is placed inside the encrypted payload as required by RFC 3156, resolving issue #2599.
Out of Scope Changes check	✅ Passed	All changes are focused on fixing the header classification logic in the OpenPGP encryption module to resolve the MIME structure issue; no unrelated modifications detected.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR fixes a bug where OpenPGP-encrypted emails rendered as raw HTML/MIME source code in mail clients after decryption (issue #2599). The root cause was a flawed header parsing loop in the PGP encryptor that incorrectly merged the last header line into the previous header, causing content headers like Content-Type: multipart/alternative to be misrouted into the outer transport headers instead of the encrypted payload.

Changes:

• Rewrote the header classification loop in PGPEncryptor._flush to use a clean "flush-on-new-header" pattern, removing the special-cased last-line logic that caused the misclassification
• Added a post-loop block to correctly classify the final accumulated header after the loop ends

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

🧹 Nitpick comments (1)

server/lib/email/openpgpEncrypt.ts (1)

100-108: Consider extracting duplicated header-classification logic into a helper.

The same contentHeaders vs emailHeaders branching appears both in-loop and in post-loop finalization. A small helper would reduce drift risk.

♻️ Suggested refactor

+      const pushClassifiedHeader = (headerLines: string[]) => {
+        if (headerLines.length === 0) return;
+        if (
+          /^(content-type|content-transfer-encoding):/i.test(headerLines[0])
+        ) {
+          contentHeaders.push(headerLines);
+        } else {
+          emailHeaders.push(headerLines);
+        }
+      };
+
       for (let i = 0; i < linesInHeader.length; i++) {
         const line = linesInHeader[i];
 
         if (/^\s/.test(line) || i === 0) {
           previousHeader.push(line);
         } else {
-          if (
-            /^(content-type|content-transfer-encoding):/i.test(
-              previousHeader[0]
-            )
-          ) {
-            contentHeaders.push(previousHeader);
-          } else {
-            emailHeaders.push(previousHeader);
-          }
+          pushClassifiedHeader(previousHeader);
           previousHeader = [line];
         }
       }
 
       if (previousHeader.length > 0) {
-        if (
-          /^(content-type|content-transfer-encoding):/i.test(previousHeader[0])
-        ) {
-          contentHeaders.push(previousHeader);
-        } else {
-          emailHeaders.push(previousHeader);
-        }
+        pushClassifiedHeader(previousHeader);
       }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@server/lib/email/openpgpEncrypt.ts` around lines 100 - 108, Extract the
header-classification logic into a small helper (e.g., classifyHeader or
pushHeaderByType) that accepts previousHeader and the two arrays contentHeaders
and emailHeaders; replace the duplicated branching in the loop and the post-loop
finalization with calls to this helper so the test
/^(content-type|content-transfer-encoding):/i and push behavior for
contentHeaders vs emailHeaders is defined once and reused (update any references
to previousHeader handling in openpgpEncrypt.ts accordingly).

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@server/lib/email/openpgpEncrypt.ts`:
- Around line 100-108: Extract the header-classification logic into a small
helper (e.g., classifyHeader or pushHeaderByType) that accepts previousHeader
and the two arrays contentHeaders and emailHeaders; replace the duplicated
branching in the loop and the post-loop finalization with calls to this helper
so the test /^(content-type|content-transfer-encoding):/i and push behavior for
contentHeaders vs emailHeaders is defined once and reused (update any references
to previousHeader handling in openpgpEncrypt.ts accordingly).

---

ℹ️ Review info

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between c23117e and 79fee52.

📒 Files selected for processing (1)

• server/lib/email/openpgpEncrypt.ts

[0xSysR3ll]

success