# Sieve: SMS Extranet Code Filter

Extracts a Booking.com Extranet challenge code from an incoming email and
POSTs it to the room-cal `/sms/code` API so the service can complete
two-factor authentication automatically.

## Files

| File | Purpose |
|------|---------|
| `sms_code.sieve` | Sieve rule — matches the message body and pipes to the shell script |
| `sms_code_filter.sh` | Pipe target — extracts the code and POSTs it to the API |

## How it works

1. Dovecot delivers an incoming email through the Sieve rule.
2. If the body contains `"Extranet code:"`, the message is piped (`:copy`, so
   it still lands in the inbox) to `sms_code_filter.sh`.
3. The script greps for `Extranet code: \K[0-9]{6}` and POSTs
   `{"code": "<digits>"}` to `${SMS_API_URL}/sms/code` with an
   `X-SMS-Secret` header.
4. The room-cal API queues the code for the next `GET /sms/code` long-poll.

## Deployment

### 1. Install the Dovecot extprograms plugin

```bash
apt install dovecot-sieve   # Debian/Ubuntu — sieve_extprograms is bundled
```

### 2. Configure Dovecot (`/etc/dovecot/conf.d/90-sieve.conf`)

```
plugin {
  sieve_plugins = sieve_extprograms
  sieve_pipe_bin_dir = /etc/dovecot/sieve-pipe
}
```

### 3. Install the filter script

```bash
cp scripts/sieve/sms_code_filter.sh /etc/dovecot/sieve-pipe/
chmod +x /etc/dovecot/sieve-pipe/sms_code_filter.sh
chown root:dovecot /etc/dovecot/sieve-pipe/sms_code_filter.sh
```

### 4. Set environment variables

Edit the top of `sms_code_filter.sh` (or export from Dovecot's environment):

```bash
SMS_API_URL=https://your-room-cal-host      # base URL, no trailing slash
SMS_GATEWAY_SECRET=your-secret-here         # matches SMS_GATEWAY_SECRET in the API
```

### 5. Activate the Sieve rule

**Per-user** — copy or symlink to the user's active script:

```bash
cp scripts/sieve/sms_code.sieve /home/zib/sieve/sms_code.sieve
# then reference it from ~/.dovecot.sieve or include it in the active script
```

**Global** (applies to all users) — add to `sieve_global_path` or
`sieve_before` in `90-sieve.conf`:

```
plugin {
  sieve_before = /etc/dovecot/sieve/sms_code.sieve
}
```

### 6. Reload Dovecot

```bash
doveadm reload
```

## Testing

Send a test message with body `Extranet code: 123456 (don't share)` and check
that the API receives it:

```bash
curl -s -H "X-SMS-Secret: $SMS_GATEWAY_SECRET" \
  "${SMS_API_URL}/sms/code?timeout=5"
# → {"code": "123456"}
```

Check Dovecot logs (`/var/log/mail.log`) for pipe errors if nothing arrives.