feat: add sender/recipient accept gates, security+stress test harnesses, nix flake, and docs

tests/test_email_to_smol.py

@@ -1,7 +1,60 @@
 from email.message import EmailMessage
+from types import SimpleNamespace
 
 from pneumatube.email_to_smol import EmailToSmolBridge, _single_line
 
+_DEFAULT_PORT = 1961
+
+
+class _Address:
+    def __init__(self, user, host, port):
+        self.user, self.host, self.port = user, host, port
+
+    @property
+    def short(self):
+        return f"{self.user}@{self.host}" + ("" if self.port == _DEFAULT_PORT else f":{self.port}")
+
+
+class _StubAddressClass:
+    @staticmethod
+    def parse(text):
+        user, _, hostport = text.partition("@")
+        host, _, port = hostport.partition(":")
+        return _Address(user, host, int(port) if port else _DEFAULT_PORT)
+
+
+class _StubSmol:
+    Address = _StubAddressClass
+
+
+class _StubStore:
+    def __init__(self, tokens):
+        self.tokens = tokens
+
+    def one(self, sql, address):
+        return (b"token",) if address in self.tokens else None
+
+
+def test_recipient_accepted_gateway_true_when_token_held():
+    bridge = EmailToSmolBridge(_StubSmol(), _StubStore({"alice@smol.example"}),
+                                config=SimpleNamespace(smolmail_domain="smol.example"))
+    assert bridge.recipient_accepted_gateway("alice") is True
+
+
+def test_recipient_accepted_gateway_false_when_no_token():
+    bridge = EmailToSmolBridge(_StubSmol(), _StubStore(set()),
+                                config=SimpleNamespace(smolmail_domain="smol.example"))
+    assert bridge.recipient_accepted_gateway("alice") is False
+
+
+def test_recipient_accepted_gateway_normalizes_default_port():
+    """A configured smolmail_domain carrying an explicit default port must
+    still match a token stored under Address.short's normalized form (which
+    drops it) -- naive string concatenation would never match."""
+    bridge = EmailToSmolBridge(_StubSmol(), _StubStore({"alice@smol.example"}),
+                                config=SimpleNamespace(smolmail_domain="smol.example:1961"))
+    assert bridge.recipient_accepted_gateway("alice") is True
+
 
 def test_single_line_strips_crlf():
     assert _single_line("alice@example.org\r\nAccept: forged") == "alice@example.org  Accept: forged"