Posting Comments Using Reply Emails And Postmark's Inbound Streams In ColdFusion 2021

{
	"To": "myuniqueinboxid+data@inbound.postmarkapp.com",
	"TextBody": "...",
	"HtmlBody": "...",
	"StrippedTextReply": "...",
	"MailboxHash": "data"
}

component {

	public void function addComment() {

		for ( var subscriber in getSubscribers() ) {

			// Create the mailbox hash to use for this particular SUBSCRIBER.
			// It has to relay both the user AND the entry so that we know
			// which entry will receive the reply-to comment.
			// --
			// NOTE: We should include the subscriber ID and NOT RELY on the
			// email address that sends the inbound email to Postmark - users
			// have all kinds of complex email-forwarding and aliases
			// constructs which make the "from" address unpredictable.
			var hashData = {
				userID: subscriber.id,
				entryID: entry.id
			};

			// When we serialize the mailbox hash-data and include it in the
			// Inbound email address, we have to utilize some sort of security
			// method to make sure the data isn't tampered with. This could
			// be encryption; it could include a one-way hash signature; or,
			// it could include some sort of one-time use token. The choice
			// is yours.
			var replyToEmail = (
				"myuniqueinboxid+" &
				serializeAndEncrypt( hashData ) &
				"@inbound.postmarkapp.com"
			);

			cfmail(
				to = subscriber.email,
				from = config.postmark.from,
				replyTo = replyToEmail,
				subject = "A comment was posted to: #entry.name#",
				type = "HTML"
				) {

				include "/transactional-emails/new-comment.cfm";
			}

		}

	}

}

component {

	public void function addCommentFromInboundWebhook() {

		var httpRequestData = getHttpRequestData();
		var httpHeaders = httpRequestData.headers;
		var httpContent = httpRequestData.content;

		// Postmark always sends Inbound emails from a fixed set of IP
		// addresses. For security purposes, we should verify the origin.
		testInboundIpAddress( httpHeaders );

		var inboundData = deserializeJson( httpContent );

		// The mailbox hash is specific to BOTH the subscriber and the blog
		// post. This way, we know where to direct the new comment.
		var mailboxHashData = decryptAndDeserialize( inboundData.MailboxHash );
		var userID = mailboxHashData.userID;
		var entryID = mailboxHashData.entryID;

		// When a user replies to an email, Postmark populates the
		// StrippedTextReply field with the reply-only content (as determined
		// by PostMark). However, this is only populated by Reply emails -
		// not by "mailto:" emails (even when addressed to the inbound
		// mailbox). For "mailto:" links, we have to use the "TextBody", which
		// has not been "cleaned up" by Postmark.
		var rawTextReply = ( inboundData.StrippedTextReply.len() )
			? inboundData.StrippedTextReply.trim()
			: inboundData.TextBody.trim()
		;
		// Regardless of the text being provided by PostMark, we still have to
		// apply some additional normalization and sanitization (especially if
		// the user used a "mailto:" link).
		var commentMarkdown = plainTextEmailParser
			.parseReply( rawTextReply )
		;

		saveCommentForModeration( entryID, userID, commentMarkdown );

	}

}

component
	output = false
	hint = "I provide parsing / sanitization methods for plain-text email content."
	{

	/**
	* I parse and normalize the given plain-text email content, returning the part that
	* represents the main reply-content.
	*/
	public string function parseReply( required string content ) {

		content = normalizeLineEndings( content );
		content = normalizeSpaces( content );
		content = normalizeEmptyLines( content );
		// Now that we've normalized the whitespace markers, let's strip-off common
		// signature formats. This is going to be an ONGOING GAME OF CAT-AND-MOUSE since
		// signatures vary greatly across users and languages. However, since we're using
		// comment moderation for all inbound emails, we can review and update this logic
		// as the reply-based commenting receives usage.
		content = stripSignature( content );
		content = normalizeWrappedLines( content );
		content = normalizeQuotes( content );
		content = normalizeBullets( content );

		return( content );

	}

	// ---
	// PRIVATE METHODS.
	// ---

	/**
	* I use Java's Pattern engine to return all the content that comes before the first
	* match of the given RegEx pattern.
	*/
	private string function jreBefore(
		required string content,
		required string pattern
		) {

		// Using the pattern to SPLIT the text, limit the parts to 2 so that we can
		// reduce the amount of processing that we have to perform - we know that the
		// content we're interested in will always be the first match.
		var parts = javaCast( "string", content ).split(
			javaCast( "string", pattern ),
			javaCast( "int", 2 )
		);

		return( parts[ 1 ].trim() );

	}


	/**
	* I use Java's Pattern engine to perform a RegEx replace on the given content.
	*/
	private string function jreReplace(
		required string content,
		required string pattern,
		string replacement = ""
		) {

		var result = javaCast( "string", content ).replaceAll(
			javaCast( "string", pattern ),
			javaCast( "string", replacement )
		);

		return( result );

	}


	/**
	* I replace special bullets with an ASCII asterisk.
	*/
	private string function normalizeBullets( required string content ) {

		content = jreReplace( content, "\u2022|\u2023|\u2043|\u2219|\u25cb|\u25cf|\u25e6", "*" );

		return( content );

	}


	/**
	* I trim lines that contain nothing but spaces.
	*/
	private string function normalizeEmptyLines( required string content ) {

		return( jreReplace( content, "(?m)^[\s&&[^\n]]+$", "" ).trim() );

	}


	/**
	* I convert all the line-breaks to NewLine characters. This will make subsequent
	* pattern matching easier to perform.
	*/
	private string function normalizeLineEndings( required string content ) {

		return( jreReplace( content, "\r\n?", chr( 10 ) ).trim() );

	}


	/**
	* I replace "smart quotes" with standard ASCII quotes.
	*/
	private string function normalizeQuotes( required string content ) {

		content = jreReplace( content, "\u2018|\u2019|\u201b|\u275b|\u275c", "'" );
		content = jreReplace( content, "\u201c|\u201d|\u201e|\u201f|\u275d|\u275e|\u301d|\u301e|\u301f|\uff02", """" );

		return( content );

	}


	/**
	* I convert any special spaces to regular spaces.
	*/
	private string function normalizeSpaces( required string content ) {

		return( jreReplace( content, "\u00a0|\u2000|\u2001|\u2002|\u2003|\u2004|\u2005|\u2006|\u2007|\u2008|\u2009|\u200a|\u2028|\u2029", " " ).trim() );

	}


	/**
	* I attempt to remove any artificial line-breaks that were added by the SMTP server.
	* Some SMTP servers will force a line to wrap if it is longer than 70 characters.
	*/
	private string function normalizeWrappedLines( required string content ) {

		// The pattern tries to find lines that hard-wrap after (at least) 60 characters.
		// Notice that the start of the pattern is either the line-start (^) OR the last
		// match (\G). This allows the pattern to keep matching several connected lines.
		var wrappedLinePattern = (
			"(?mi)" &
			"(?:^|\G)" &
			"([^\n]{60,})" &
			"\n" &
			"([^\n]+)"
		);

		var pattern = createObject( "java", "java.util.regex.Pattern" )
			.compile( javaCast( "string", wrappedLinePattern ) )
		;

		// Since the pattern only matches on a single line-break, it will fail to catch
		// a single line that has been artificially split across more than 2-lines. As
		// such, we have to keep applying the normalization until we find no matches.
		do {

			var matchCount = 0;
			var matcher = pattern.matcher( javaCast( "string", content ) );
			var buffer = createObject( "java", "java.lang.StringBuffer" ).init();

			// Replace each match with the first and second line joined with a space.
			while ( matcher.find() ) {

				matcher.appendReplacement( buffer, javaCast( "string", "$1 $2" ) );
				matchCount++;

			}

			matcher.appendTail( buffer );
			content = buffer.toString();

		} while ( matchCount );

		return( content.trim() );

	}


	/**
	* I strip off common signatures and any content that comes after those signatures.
	*/
	private string function stripSignature( required string content ) {

		// Vertical tabbing (ie, someone putting in a bunch of line-breaks so that their
		// reply isn't scrunched-up against the original email content).
		content = jreBefore( content, "\n{4,}" );

		// Horizontal rule indicators.
		content = jreBefore( content, "(?m)^_{7}" );
		content = jreBefore( content, "(?m)^-----" );

		// Common pre-signature marks.
		content = jreBefore( content, "(?m)^-- +\n" );
		content = jreBefore( content, "(?m)^---\n" );
		content = jreBefore( content, "(?m)^--[A-Z]" );
		content = jreBefore( content, "\n{2,}--+\n" );
		content = jreBefore( content, "(?m)^(\u2014)+ +\n" ); // Em-dash.

		// Common "On wrote:" quotations.
		content = jreBefore( content, "(?mi)^On [^\n]+?\bwrote:\n" );
		content = jreBefore( content, "(?mi)^On [^\n]+?\n[^\n]+?\bwrote:\n" );

		// Common origin device indicators.
		content = jreBefore( content, "(?mi)^Sent from (Mailbox)" );
		content = jreBefore( content, "(?mi)^Sent from my (Android|Blackberry|iPhone|iPad|iPod|Mobile|Verizon|Windows)" );
		content = jreBefore( content, "(?mi)^Get Outlook for (iOS)" );

		return( content );

	}

}