fix: add recipients to BCC when email is hidden

Package requests are sent to the ML as well as users (CC).
For those who chose to hide their mail address,
we should add them to the BCC list instead.

Signed-off-by: moson-mo <mo-son@mailbox.org>

aurweb/scripts/notify.py

@@ -45,6 +45,9 @@ class Notification:
     def get_cc(self):
         return []
 
+    def get_bcc(self):
+        return []
+
     def get_body_fmt(self, lang):
         body = ""
         for line in self.get_body(lang).splitlines():
@@ -114,7 +117,7 @@ class Notification:
                     server.login(user, passwd)
 
                 server.set_debuglevel(0)
-                deliver_to = [to] + self.get_cc()
+                deliver_to = [to] + self.get_cc() + self.get_bcc()
                 server.sendmail(sender, deliver_to, msg.as_bytes())
                 server.quit()
 
@@ -578,10 +581,11 @@ class RequestOpenNotification(Notification):
                 ),
             )
             .filter(and_(PackageRequest.ID == reqid, User.Suspended == 0))
-            .with_entities(User.Email)
+            .with_entities(User.Email, User.HideEmail)
             .distinct()
         )
-        self._cc = [u.Email for u in query]
+        self._cc = [u.Email for u in query if u.HideEmail == 0]
+        self._bcc = [u.Email for u in query if u.HideEmail == 1]
 
         pkgreq = (
             db.query(PackageRequest.Comments).filter(PackageRequest.ID == reqid).first()
@@ -598,6 +602,9 @@ class RequestOpenNotification(Notification):
     def get_cc(self):
         return self._cc
 
+    def get_bcc(self):
+        return self._bcc
+
     def get_subject(self, lang):
         return "[PRQ#%d] %s Request for %s" % (
             self._reqid,
@@ -665,10 +672,11 @@ class RequestCloseNotification(Notification):
                 ),
             )
             .filter(and_(PackageRequest.ID == reqid, User.Suspended == 0))
-            .with_entities(User.Email)
+            .with_entities(User.Email, User.HideEmail)
             .distinct()
         )
-        self._cc = [u.Email for u in query]
+        self._cc = [u.Email for u in query if u.HideEmail == 0]
+        self._bcc = [u.Email for u in query if u.HideEmail == 1]
 
         pkgreq = (
             db.query(PackageRequest)
@@ -695,6 +703,9 @@ class RequestCloseNotification(Notification):
     def get_cc(self):
         return self._cc
 
+    def get_bcc(self):
+        return self._bcc
+
     def get_subject(self, lang):
         return "[PRQ#%d] %s Request for %s %s" % (
             self._reqid,

po/aurweb.pot

@@ -2366,3 +2366,11 @@ msgstr ""
 #: templates/requests.html
 msgid "Package name"
 msgstr ""
+
+#: templates/partials/account_form.html
+msgid "Note that if you hide your email address, it'll "
+"end up on the BCC list for any request notifications. "
+"In case someone replies to these notifications, you won't "
+"receive an email. However, replies are typically sent to the "
+"mailing-list and would then be visible in the archive."
+msgstr ""

templates/partials/account_form.html

@@ -115,7 +115,12 @@
             <em>{{ "If you do not hide your email address, it is "
             "visible to all registered AUR users. If you hide your "
             "email address, it is visible to members of the Arch "
-            "Linux staff only." | tr }}</em>
+            "Linux staff only." | tr }}</em><br/>
+            <em>{{ "Note that if you hide your email address, it'll "
+            "end up on the BCC list for any request notifications. "
+            "In case someone replies to these notifications, you won't "
+            "receive an email. However, replies are typically sent to the "
+            "mailing-list and would then be visible in the archive." | tr }}</em>
         </p>
 
         <!-- Backup Email -->

test/test_notify.py

@@ -479,6 +479,44 @@ def test_close_request_comaintainer_cc(
     assert email.headers.get("Cc") == ", ".join([user.Email, user2.Email])
 
 
+def test_open_close_request_hidden_email(
+    user2: User, pkgreq: PackageRequest, pkgbases: list[PackageBase]
+):
+    pkgbase = pkgbases[0]
+
+    # Enable the "HideEmail" option for our requester
+    with db.begin():
+        user2.HideEmail = 1
+
+    # Send an open request notification.
+    notif = notify.RequestOpenNotification(
+        user2.ID, pkgreq.ID, pkgreq.RequestType.Name, pkgbase.ID
+    )
+
+    # Make sure our address got added to the bcc list
+    assert user2.Email in notif.get_bcc()
+
+    notif.send()
+    assert Email.count() == 1
+
+    email = Email(1).parse()
+    # Make sure we don't have our address in the Cc header
+    assert user2.Email not in email.headers.get("Cc")
+
+    # Create a closure notification on the pkgbase we just opened.
+    notif = notify.RequestCloseNotification(user2.ID, pkgreq.ID, "rejected")
+
+    # Make sure our address got added to the bcc list
+    assert user2.Email in notif.get_bcc()
+
+    notif.send()
+    assert Email.count() == 2
+
+    email = Email(2).parse()
+    # Make sure we don't have our address in the Cc header
+    assert user2.Email not in email.headers.get("Cc")
+
+
 def test_close_request_closure_comment(
     user: User, user2: User, pkgreq: PackageRequest, pkgbases: list[PackageBase]
 ):