# Copyright (C) 2012-2023 Zammad Foundation, https://zammad-foundation.org/
require 'rails_helper'
RSpec.describe SecureMailing::SMIME do
before do
Setting.set('smime_integration', true)
end
let(:raw_body) { 'Some text' }
let(:system_email_address) { 'smime1@example.com' }
let(:customer_email_address) { 'smime2@example.com' }
let(:cc_customer_email_address) { 'smime3@example.com' }
let(:sender_certificate_subject) { "/C=DE/ST=Berlin/L=Berlin/O=Example Security/OU=IT Department/CN=example.com/emailAddress=#{sender_email_address}" }
let(:recipient_certificate_subject) { "/C=DE/ST=Berlin/L=Berlin/O=Example Security/OU=IT Department/CN=example.com/emailAddress=#{recipient_email_address}" }
let(:cc_recipient_certificate_subject) { "/C=DE/ST=Berlin/L=Berlin/O=Example Security/OU=IT Department/CN=example.com/emailAddress=#{cc_recipient_email_address}" }
let(:expired_email_address) { 'expiredsmime1@example.com' }
let(:ca_certificate_subject) { '/emailAddress=RootCA@example.com/C=DE/ST=Berlin/L=Berlin/O=Example Security/OU=IT Department/CN=example.com' }
let(:intermediate_ca_certificate_subject) { '/C=DE/ST=Berlin/O=Example Security/OU=IT Department/CN=example.com/emailAddress=IntermediateCA@example.com' }
let(:content_type) { 'text/plain' }
def build_mail
Channel::EmailBuild.build(
from: sender_email_address,
to: recipient_email_address,
cc: cc_recipient_email_address,
body: raw_body,
content_type: content_type,
security: security_preferences
)
end
describe '.outgoing' do
shared_examples 'HttpLog writer' do |status|
it "logs #{status}" do
expect do
build_mail
rescue
# allow failures
end.to change(HttpLog, :count).by(1)
expect(HttpLog.last.attributes).to include('direction' => 'out', 'status' => status)
end
end
let(:sender_email_address) { system_email_address }
let(:recipient_email_address) { customer_email_address }
let(:cc_recipient_email_address) { cc_customer_email_address }
context 'without security' do
let(:security_preferences) do
nil
end
it 'builds mail' do
expect(build_mail.body).not_to match(SecureMailing::SMIME::Incoming::EXPRESSION_SIGNATURE)
expect(build_mail.body).not_to match(SecureMailing::SMIME::Incoming::EXPRESSION_MIME)
expect(build_mail.body).to eq(raw_body)
end
end
context 'signing' do
let(:security_preferences) do
{
type: 'S/MIME',
sign: {
success: true,
},
encryption: {
success: false,
},
}
end
context 'private key present' do
let!(:sender_certificate) do
create(:smime_certificate, :with_private, fixture: system_email_address)
end
it 'builds mail' do
expect(build_mail.body).to match(SecureMailing::SMIME::Incoming::EXPRESSION_SIGNATURE)
end
it_behaves_like 'HttpLog writer', 'success'
context 'expired certificate' do
let(:system_email_address) { expired_email_address }
it 'raises exception' do
expect { build_mail }.to raise_error RuntimeError
end
it_behaves_like 'HttpLog writer', 'failed'
end
context 'when message is 7bit or 8bit encoded' do
let(:mail) do
smime_mail = build_mail
mail = Channel::EmailParser.new.parse(smime_mail.to_s)
SecureMailing.incoming(mail)
mail
end
context 'when Content-Type is text/plain' do
let(:raw_body) { "\r\n\r\n@john.doe, now known as John Dóe has accepted your invitation to join the Administrator / htmltest project.\r\n\r\nhttp://169.254.169.254:3000/root/htmltest\r\n\r\n-- \r\nYou're receiving this email because of your account on 169.254.169.254.\r\n\r\n\r\n\r\n" }
it 'verifies' do
expect(mail['x-zammad-article-preferences']['security']['sign']['success']).to be true
end
end
context 'when Content-Type is text/html' do
let(:content_type) { 'text/html' }
let(:raw_body) { "
" }
it 'verifies' do
expect(mail['x-zammad-article-preferences']['security']['sign']['success']).to be true
end
end
end
context 'when certificate chain is present' do
let(:system_email_address) { 'chain@example.com' }
let!(:chain) do
[
sender_certificate,
create(:smime_certificate, fixture: 'IntermediateCA'),
create(:smime_certificate, fixture: 'RootCA'),
]
end
let(:p7enc) do
mail = Channel::EmailParser.new.parse(build_mail.to_s)
OpenSSL::PKCS7.read_smime(mail[:raw])
end
it 'is included in the generated mail' do
expect(p7enc.certificates.map(&:subject).sort).to eq(chain.map { |x| x.parsed.subject }.sort)
end
end
end
context 'no private key present' do
before do
create(:smime_certificate, fixture: system_email_address)
end
it 'raises exception' do
expect { build_mail }.to raise_error RuntimeError
end
it_behaves_like 'HttpLog writer', 'failed'
end
end
context 'encryption' do
let(:security_preferences) do
{
type: 'S/MIME',
sign: {
success: false,
},
encryption: {
success: true,
},
}
end
context 'public key present' do
before do
create(:smime_certificate, fixture: recipient_email_address)
create(:smime_certificate, fixture: cc_recipient_email_address)
end
it 'builds mail' do
mail = build_mail
expect(mail['Content-Type'].value).to match(SecureMailing::SMIME::Incoming::EXPRESSION_MIME)
expect(mail.body).not_to include(raw_body)
end
it_behaves_like 'HttpLog writer', 'success'
context 'expired certificate' do
let(:recipient_email_address) { expired_email_address }
it 'raises exception' do
expect { build_mail }.to raise_error RuntimeError
end
it_behaves_like 'HttpLog writer', 'failed'
end
end
context 'no public key present' do
it 'raises exception' do
expect { build_mail }.to raise_error ActiveRecord::RecordNotFound
end
it_behaves_like 'HttpLog writer', 'failed'
end
end
end
describe '.incoming' do
shared_examples 'HttpLog writer' do |status|
it "logs #{status}" do
expect do
mail
rescue
# allow failures
end.to change(HttpLog, :count).by(2)
expect(HttpLog.last.attributes).to include('direction' => 'in', 'status' => status)
end
end
let(:sender_email_address) { customer_email_address }
let(:recipient_email_address) { system_email_address }
let(:cc_recipient_email_address) { cc_customer_email_address }
context 'signature verification' do
let(:allow_expired) { false }
let(:security_preferences) do
{
type: 'S/MIME',
sign: {
success: true,
allow_expired: allow_expired,
},
encryption: {
success: false,
},
}
end
context 'sender certificate present' do
before do
create(:smime_certificate, :with_private, fixture: sender_email_address)
end
let(:mail) do
smime_mail = build_mail
mail = Channel::EmailParser.new.parse(smime_mail.to_s)
SecureMailing.incoming(mail)
mail
end
it 'verifies' do
expect(mail[:body]).to include(raw_body)
expect(mail['x-zammad-article-preferences'][:security][:sign][:success]).to be true
expect(mail['x-zammad-article-preferences'][:security][:sign][:comment]).to eq(sender_certificate_subject)
expect(mail['x-zammad-article-preferences'][:security][:encryption][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:encryption][:comment]).to be_nil
end
it_behaves_like 'HttpLog writer', 'success'
context 'expired' do
# required to build mail with expired certificate
let(:allow_expired) { true }
let(:sender_email_address) { expired_email_address }
it 'verifies with comment' do
expect(mail[:body]).to include(raw_body)
expect(mail['x-zammad-article-preferences'][:security][:sign][:success]).to be true
expect(mail['x-zammad-article-preferences'][:security][:sign][:comment]).to include(expired_email_address).and include('expired')
expect(mail['x-zammad-article-preferences'][:security][:encryption][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:encryption][:comment]).to be_nil
end
it_behaves_like 'HttpLog writer', 'success'
end
context 'with wrapped mime-type S/MIME signature (e.g. for Microsoft Outlook)' do
before do
# We need to disable the open ssl detached flag, to force the smime-type with 'signed-data'.
stub_const('OpenSSL::PKCS7::DETACHED', nil)
end
it 'check that mail was verified' do
expect(mail['x-zammad-article-preferences'][:security][:sign][:success]).to be true
end
it 'check that signe comment exists' do
expect(mail['x-zammad-article-preferences'][:security][:sign][:comment]).to eq(sender_certificate_subject)
end
it 'check that body was verified' do
expect(mail[:body]).to include(raw_body)
end
end
context 'sender is signer' do
let(:sender_email_address) { system_email_address }
let(:mail) do
smime_mail = Rails.root.join('spec/fixtures/files/smime/sender_is_signer.eml').read
mail = Channel::EmailParser.new.parse(smime_mail.to_s)
SecureMailing.incoming(mail)
mail
end
it 'verifies' do
expect(mail['x-zammad-article-preferences'][:security][:sign][:success]).to be true
expect(mail['x-zammad-article-preferences'][:security][:sign][:comment]).to eq(sender_certificate_subject)
expect(mail['x-zammad-article-preferences'][:security][:encryption][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:encryption][:comment]).to be_nil
end
end
context 'sender is signer, with upcased sender address' do
let(:sender_email_address) { system_email_address }
let(:mail) do
smime_mail = Rails.root.join('spec/fixtures/files/smime/sender_is_signer.eml').read.sub('smime1@example.com', 'SMIME1@example.com')
mail = Channel::EmailParser.new.parse(smime_mail.to_s)
SecureMailing.incoming(mail)
mail
end
it 'verifies' do
expect(mail['x-zammad-article-preferences'][:security][:sign][:success]).to be true
expect(mail['x-zammad-article-preferences'][:security][:sign][:comment]).to eq(sender_certificate_subject)
expect(mail['x-zammad-article-preferences'][:security][:encryption][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:encryption][:comment]).to be_nil
end
end
context 'sender is not signer' do
before do
create(:smime_certificate, :with_private, fixture: system_email_address)
end
let(:mail) do
smime_mail = Rails.root.join('spec/fixtures/files/smime/sender_not_signer.eml').read
mail = Channel::EmailParser.new.parse(smime_mail.to_s)
SecureMailing.incoming(mail)
mail
end
it 'verifies with comment' do
expect(mail['x-zammad-article-preferences'][:security][:sign][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:sign][:comment]).to eq('This message was not signed by its sender.')
expect(mail['x-zammad-article-preferences'][:security][:encryption][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:encryption][:comment]).to be_nil
end
end
context 'sender certificate with another sender name signed by trusted CA (#4457)' do
before do
create(:smime_certificate, fixture: 'SenderCA')
end
let(:mail) do
smime_mail = Rails.root.join('spec/fixtures/files/smime/sender_is_signer_with_ca.eml').read
mail = Channel::EmailParser.new.parse(smime_mail.to_s)
SecureMailing.incoming(mail)
mail
end
it 'verifies' do
expect(mail[:from]).to include('Zammad Helpdesk ')
expect(mail[:body]).to include(raw_body)
expect(mail['x-zammad-article-preferences'][:security][:sign][:success]).to be true
expect(mail['x-zammad-article-preferences'][:security][:sign][:comment]).to eq('/emailAddress=SenderCA@example.com/C=DE/ST=Berlin/L=Berlin/O=Example Security/OU=IT Department/CN=example.com')
expect(mail['x-zammad-article-preferences'][:security][:encryption][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:encryption][:comment]).to be_nil
end
end
end
context 'no sender certificate' do
let!(:sender_certificate) { create(:smime_certificate, :with_private, fixture: sender_email_address) }
let(:mail) do
smime_mail = build_mail
mail = Channel::EmailParser.new.parse(smime_mail.to_s)
sender_certificate.destroy!
SecureMailing.incoming(mail)
mail
end
it 'fails' do
expect(mail[:body]).to include(raw_body)
expect(mail['x-zammad-article-preferences'][:security][:sign][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:sign][:comment]).to eq('The certificate for verification could not be found.')
expect(mail['x-zammad-article-preferences'][:security][:encryption][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:encryption][:comment]).to be_nil
end
context 'public key present in signature' do
let(:not_related_fixture) { 'smime3@example.com' }
let!(:not_related_certificate) { create(:smime_certificate, fixture: not_related_fixture) }
context 'not related certificate present' do
it 'fails' do
expect(mail[:body]).to include(raw_body)
expect(mail['x-zammad-article-preferences'][:security][:sign][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:sign][:comment]).to eq('The certificate for verification could not be found.')
expect(mail['x-zammad-article-preferences'][:security][:encryption][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:encryption][:comment]).to be_nil
end
it_behaves_like 'HttpLog writer', 'failed'
context 'CA' do
let(:not_related_fixture) { 'ExpiredCA' }
it 'fails' do
expect(mail[:body]).to include(raw_body)
expect(mail['x-zammad-article-preferences'][:security][:sign][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:sign][:comment]).to eq('The certificate for verification could not be found.')
expect(mail['x-zammad-article-preferences'][:security][:encryption][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:encryption][:comment]).to be_nil
end
it_behaves_like 'HttpLog writer', 'failed'
end
end
context 'usage not prevented' do
before do
# remove OpenSSL::PKCS7::NOINTERN
stub_const('SecureMailing::SMIME::Incoming::OPENSSL_PKCS7_VERIFY_FLAGS', OpenSSL::PKCS7::NOVERIFY)
end
it "won't perform verification" do
expect(mail[:body]).to include(raw_body)
expect(mail['x-zammad-article-preferences'][:security][:sign][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:sign][:comment]).to eq('The certificate for verification could not be found.')
expect(mail['x-zammad-article-preferences'][:security][:encryption][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:encryption][:comment]).to be_nil
end
end
end
context 'intermediate CA present' do
before do
create(:smime_certificate, fixture: ca_fixture)
end
let(:ca_fixture) { 'IntermediateCA' }
it 'verifies' do
expect(mail[:body]).to include(raw_body)
expect(mail['x-zammad-article-preferences'][:security][:sign][:success]).to be true
expect(mail['x-zammad-article-preferences'][:security][:sign][:comment]).to eq(intermediate_ca_certificate_subject)
expect(mail['x-zammad-article-preferences'][:security][:encryption][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:encryption][:comment]).to be_nil
end
it_behaves_like 'HttpLog writer', 'success'
context 'expired' do
let(:ca_fixture) { 'ExpiredIntermediateCA' }
it 'fails' do
expect(mail[:body]).to include(raw_body)
expect(mail['x-zammad-article-preferences'][:security][:sign][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:sign][:comment]).to eq('The certificate for verification could not be found.')
expect(mail['x-zammad-article-preferences'][:security][:encryption][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:encryption][:comment]).to be_nil
end
it_behaves_like 'HttpLog writer', 'failed'
context 'allowed' do
let(:allow_expired) { true }
# ATTENTION: expired CA is a special case where `allow_expired` does not count
it 'fails' do
expect(mail[:body]).to include(raw_body)
expect(mail['x-zammad-article-preferences'][:security][:sign][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:sign][:comment]).to eq('The certificate for verification could not be found.')
expect(mail['x-zammad-article-preferences'][:security][:encryption][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:encryption][:comment]).to be_nil
end
it_behaves_like 'HttpLog writer', 'failed'
end
end
end
context 'certificate chain' do
let(:sender_email_address) { 'chain@example.com' }
let(:ca_subject_chain) { ca_chain.reverse.map { |cert| cert.parsed.subject }.join(', ') }
context 'incomplete certificate chain present' do
before do
create(:smime_certificate, fixture: 'RootCA')
end
it 'fails' do
expect(mail[:body]).to include(raw_body)
expect(mail['x-zammad-article-preferences'][:security][:sign][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:sign][:comment]).to eq('The certificate for verification could not be found.')
expect(mail['x-zammad-article-preferences'][:security][:encryption][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:encryption][:comment]).to be_nil
end
end
context 'certificate chain only partly present' do
let(:ca_certificate_subject) { subject_chain }
let!(:ca_chain) do
create_list(:smime_certificate, 1, fixture: 'IntermediateCA')
end
it 'verifies' do
expect(mail[:body]).to include(raw_body)
expect(mail['x-zammad-article-preferences'][:security][:sign][:success]).to be true
expect(mail['x-zammad-article-preferences'][:security][:sign][:comment]).to eq(ca_subject_chain)
expect(mail['x-zammad-article-preferences'][:security][:encryption][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:encryption][:comment]).to be_nil
end
end
context 'complete certificate chain present' do
let!(:ca_chain) do
create_list(:smime_certificate, 1, fixture: 'ChainCA')
end
it 'verifies' do
allow(Rails.logger).to receive(:warn)
expect(mail[:body]).to include(raw_body)
expect(mail['x-zammad-article-preferences'][:security][:sign][:success]).to be true
expect(mail['x-zammad-article-preferences'][:security][:sign][:comment]).to eq(ca_subject_chain)
expect(mail['x-zammad-article-preferences'][:security][:encryption][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:encryption][:comment]).to be_nil
expect(Rails.logger).not_to have_received(:warn).with(%r{#{Regexp.escape(ca_certificate_subject)}})
end
end
end
end
end
context 'decryption' do
let(:allow_expired) { false }
let(:security_preferences) do
{
type: 'S/MIME',
sign: {
success: false,
},
encryption: {
success: true,
allow_expired: allow_expired,
},
}
end
let!(:sender_certificate) { create(:smime_certificate, :with_private, fixture: sender_email_address) }
let!(:recipient_certificate) { create(:smime_certificate, :with_private, fixture: recipient_email_address) }
let!(:cc_recipient_certificate) { create(:smime_certificate, :with_private, fixture: cc_recipient_email_address) }
context 'private key present' do
let(:mail) do
smime_mail = build_mail
mail = Channel::EmailParser.new.parse(smime_mail.to_s)
SecureMailing.incoming(mail)
mail
end
it 'decrypts' do
expect(mail[:body]).to include(raw_body)
expect(mail['x-zammad-article-preferences'][:security][:sign][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:sign][:comment]).to be_nil
expect(mail['x-zammad-article-preferences'][:security][:encryption][:success]).to be true
expect(mail['x-zammad-article-preferences'][:security][:encryption][:comment]).to eq(recipient_certificate_subject)
end
it_behaves_like 'HttpLog writer', 'success'
context 'expired allowed' do
let(:allow_expired) { true }
let(:system_email_address) { expired_email_address }
it 'decrypts with comment' do
expect(mail[:body]).to include(raw_body)
expect(mail['x-zammad-article-preferences'][:security][:sign][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:sign][:comment]).to be_nil
expect(mail['x-zammad-article-preferences'][:security][:encryption][:success]).to be true
expect(mail['x-zammad-article-preferences'][:security][:encryption][:comment]).to include(expired_email_address).and include('expired')
end
it_behaves_like 'HttpLog writer', 'success'
end
end
context 'no private key present' do
let(:mail) do
smime_mail = build_mail
mail = Channel::EmailParser.new.parse(smime_mail.to_s)
sender_certificate.destroy!
recipient_certificate.destroy!
cc_recipient_certificate.destroy!
SecureMailing.incoming(mail)
mail
end
it 'fails' do
expect(mail[:body]).to include('no visible content')
expect(mail['x-zammad-article-preferences'][:security][:sign][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:sign][:comment]).to be_nil
expect(mail['x-zammad-article-preferences'][:security][:encryption][:success]).to be false
expect(mail['x-zammad-article-preferences'][:security][:encryption][:comment]).to eq('The private key for decryption could not be found.')
end
it_behaves_like 'HttpLog writer', 'failed'
end
end
context 'with signature verification and decryption' do
let!(:sender_certificate) { create(:smime_certificate, :with_private, fixture: sender_email_address) }
let!(:recipient_certificate) { create(:smime_certificate, :with_private, fixture: recipient_email_address) }
let!(:cc_recipient_certificate) { create(:smime_certificate, :with_private, fixture: cc_recipient_email_address) }
let(:security_preferences) do
{
type: 'S/MIME',
sign: {
success: true,
},
encryption: {
success: true,
},
}
end
let(:mail) do
smime_mail = build_mail
mail = Channel::EmailParser.new.parse(smime_mail.to_s)
SecureMailing.incoming(mail)
mail
end
context 'with wrapped mime-type S/MIME signature (e.g. for Microsoft Outlook)' do
before do
# We need to disable the open ssl detached flag, to force the smime-type with 'signed-data'.
stub_const('OpenSSL::PKCS7::DETACHED', nil)
end
it 'check that mail was decrypted' do
expect(mail['x-zammad-article-preferences'][:security][:encryption][:success]).to be true
end
it 'check that encryption comment exists' do
expect(mail['x-zammad-article-preferences'][:security][:encryption][:comment]).to eq(recipient_certificate_subject)
end
it 'check that mail was verified' do
expect(mail['x-zammad-article-preferences'][:security][:sign][:success]).to be true
end
it 'check that signe comment exists' do
expect(mail['x-zammad-article-preferences'][:security][:sign][:comment]).to eq(sender_certificate_subject)
end
it 'check that body was encrypted and verified' do
expect(mail[:body]).to include(raw_body)
end
end
end
end
describe '.retry' do
let(:sender_email_address) { customer_email_address }
let(:recipient_email_address) { system_email_address }
let(:cc_recipient_email_address) { system_email_address }
let(:security_preferences) do
{
type: 'S/MIME',
sign: {
success: true,
},
encryption: {
success: true,
},
}
end
let(:mail) do
sender_certificate = create(:smime_certificate, :with_private, fixture: sender_email_address)
recipient_certificate = create(:smime_certificate, :with_private, fixture: system_email_address)
smime_mail = Channel::EmailBuild.build(
from: sender_email_address,
to: recipient_email_address,
body: raw_body,
content_type: 'text/plain',
security: security_preferences,
attachments: [
{
content_type: 'text/plain',
content: 'blub',
filename: 'test-file1.txt',
},
],
)
mail = Channel::EmailParser.new.parse(smime_mail.to_s)
sender_certificate.destroy
recipient_certificate.destroy
mail
end
let!(:article) do
_ticket, article, _user, _mail = Channel::EmailParser.new.process({}, mail['raw'])
article
end
context 'private key added' do
before do
create(:smime_certificate, :with_private, fixture: recipient_email_address)
create(:smime_certificate, fixture: sender_email_address)
end
it 'succeeds' do
SecureMailing.retry(article)
expect(article.preferences[:security][:sign][:success]).to be true
expect(article.preferences[:security][:sign][:comment]).to eq(sender_certificate_subject)
expect(article.preferences[:security][:encryption][:success]).to be true
expect(article.preferences[:security][:encryption][:comment]).to eq(recipient_certificate_subject)
expect(article.body).to include(raw_body)
expect(article.attachments.count).to eq(1)
expect(article.attachments.first.filename).to eq('test-file1.txt')
end
context 'S/MIME activated' do
before do
Setting.set('smime_integration', false)
end
it 'succeeds' do
Setting.set('smime_integration', true)
SecureMailing.retry(article)
expect(article.preferences[:security][:sign][:success]).to be true
expect(article.preferences[:security][:sign][:comment]).to eq(sender_certificate_subject)
expect(article.preferences[:security][:encryption][:success]).to be true
expect(article.preferences[:security][:encryption][:comment]).to eq(recipient_certificate_subject)
expect(article.body).to include(raw_body)
expect(article.attachments.count).to eq(1)
expect(article.attachments.first.filename).to eq('test-file1.txt')
end
end
end
end
end