(20250122) Mail module adjustment for sending mails from whitelisted IPs.

api/blueprints/message/mail/send/send.py

@@ -233,23 +233,26 @@ async def send_one_mail(
     # ┗┛┗┻┛┛┗┗ ┛ ┛┛┗┗┣┛  ┗┛┛┗┗ ┗┛┗
     #                ┛
 
-    # Get the token based on the key:
-    auth_token = await current_app.mail_controller.get_token_from_key(
-        mongo_data_conn = current_app.data_mongo,
-        token_key = inbound_data.tokenKey
-    )
-    user_info = CoreUserInfoModel(**kwargs["session_info"])
+    # We test ownership only in API calls made from outside:
+    if inbound_headers["Remote-IP"] not in current_app.whitelisted_ips:
 
-    # We check if the token that was used to fetch the mail is owned by this user:
-    if not await token_check.is_authorized(
+        # Get the token based on the key:
+        auth_token = await current_app.mail_controller.get_token_from_key(
             mongo_data_conn = current_app.data_mongo,
-            user_info = user_info,
-            token_ids = [auth_token.authTokenId]
-    ): return ResponseModel(
-        status_code = StatusCodes.FAILED,
-        http_code = HttpCodes.UNAUTHORIZED,
-        message = "The account does not belong to this user."
-    )
+            token_key = inbound_data.tokenKey
+        )
+        user_info = CoreUserInfoModel(**kwargs["session_info"])
+
+        # We check if the token that was used to fetch the mail is owned by this user:
+        if not await token_check.is_authorized(
+                mongo_data_conn = current_app.data_mongo,
+                user_info = user_info,
+                token_ids = [auth_token.authTokenId]
+        ): return ResponseModel(
+            status_code = StatusCodes.FAILED,
+            http_code = HttpCodes.UNAUTHORIZED,
+            message = "The account does not belong to this user."
+        )
 
     # ┏┓     ┓  ┳┳┓  •┓
     # ┗┓┏┓┏┓┏┫  ┃┃┃┏┓┓┃