claude-mail: tolerate spaces/case in secret phrase; restore after Purelymail password reset

261df12e0df1a4dd856f9ed920798847352cf70c · 2026-06-25 15:23:06 -0700 · Steve

Files touched

M lib.js

Diff

commit 261df12e0df1a4dd856f9ed920798847352cf70c
Author: Steve <steve@designerwallcoverings.com>
Date:   Thu Jun 25 15:23:06 2026 -0700

    claude-mail: tolerate spaces/case in secret phrase; restore after Purelymail password reset
---
 lib.js | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/lib.js b/lib.js
index cfe1e44..f81b481 100644
--- a/lib.js
+++ b/lib.js
@@ -62,9 +62,12 @@ function gate(parsed) {
   if (!cfg.allowed.includes(from)) return { ok: false, reason: `sender not allowlisted: ${from}` };
 
   const subject = (parsed.subject || '');
-  const sLower = subject.toLowerCase();
-  const pLower = cfg.phrase.toLowerCase();
-  const hasPhrase = pLower && (sLower.includes(`[ok:${pLower}]`) || sLower.includes(pLower));
+  // Normalize away case + every non-alphanumeric char on BOTH sides so the
+  // phrase still matches when a human types it naturally: "DUST 2026",
+  // "[ok:DUST2026]", "dust-2026" all collapse to "dust2026". This loosens
+  // formatting, NOT security — a stranger still can't guess the token.
+  const norm = (s) => (s || '').toLowerCase().replace(/[^a-z0-9]/g, '');
+  const hasPhrase = cfg.phrase && norm(subject).includes(norm(cfg.phrase));
   if (!hasPhrase) return { ok: false, reason: 'missing secret phrase in subject' };
 
   if (cfg.requireAuthPass) {

← ed14dd7 auto-save: 2026-06-25T15:04:49 (1 files) — tmp-godaddy-login · back to Claude Mail · claude-mail: add read-only inbox/sent audit diagnostics ec9022a →