mailer: a booker's address is validated at intake, and never written into a header unparsed

[distronode-com]

CodeQL flags internal/mailer/smtp.go's wc.Write(raw) as email-content injection. The weak point it is pointing at is in buildRaw: the To: header is assembled from msg.To, and an address that mail.ParseAddress rejects was appended to the header verbatim. Every other header input is already safe (the subject and the From display name are Q-encoded, attachment filenames are %q-quoted, bodies sit below the blank line inside random-boundary parts); the recipient list was the one raw path, and on the public booking path it is the booker's own input with nothing but an emptiness check in front of it.

It is not exploitable today, and this PR does not claim otherwise: Send calls Rcpt before DATA, and net/smtp's validateLine refuses any CR or LF there, so a CRLF-bearing address aborts at RCPT TO. That protection is incidental, lives in the standard library one call away, and covers only this transport. This change makes the guarantee local, in two layers:

1. Intake. normalizeBookerEmail (trim, mail.ParseAddress, keep a.Address) runs at both places a booker's address enters: CreateBooking for POST /v1/bookings, before the hourly throttle and the Stripe session read it, answering 400 email must be a valid email address; and the top of createBookingForSlug, which the assistant's book tool and MCP create_booking share, so an LLM-extracted address gets the same rule and the assistant gets a retry hint instead of the generic failure. Small deliberate behaviour change: "Bob" <bob@example.com> is stored as bob@example.com, which is what the per-invitee cap, the throttle and the manage-link lookups already assume they hold.
2. buildRaw returns ([]byte, error) and refuses an unparseable or empty recipient list with ErrInvalidRecipient (index, never the value, since the error is logged). Send returns it before anything is dialed.

Tests cover the plain, display-name, two-recipient, CRLF, unparseable and empty cases for buildRaw; a Send that must never dial (listener counting accepts); and the three intake shapes on POST /v1/bookings, including that nothing is persisted on a refusal. The existing subject-encoding test is untouched. CHANGELOG.md gets a line under Unreleased → Security.

Noted and left alone: the invite path (admin-authenticated) does not ParseAddress either; the Resend transport accepts unparsed recipients but posts JSON, so there is no header to inject into; the 400 sentence is English while the throttle errors beside it are translated, and adding a key touches all eight locale files.

🤖 Generated with Claude Code

[pullfrog]

✅ No new issues found.

Reviewed changes One security hardening commit: booker email is validated at intake, and SMTP no longer writes an unparsed recipient into To:.

• Intake normalisation — normalizeBookerEmail (ParseAddress → bare a.Address) on REST CreateBooking (before throttle/Stripe) and on createBookingForSlug (assistant + MCP); assistant gets a dedicated retry hint.
• SMTP buildRaw — returns ([]byte, error); empty/unparseable recipients yield ErrInvalidRecipient (index only) before dial; existing subject/From encoding tests updated via mustBuildRaw.
• Coverage — buildRaw recipient matrix, Send-never-dials listener test, REST reject/normalise/ordinary-email cases; CHANGELOG Security note.

  ^{｜ View workflow run ｜ Using Grok ｜ 𝕏}