prevent deleting address from other domains

src/services/aliases/aliases.class.ts

@@ -110,6 +110,16 @@ export class AliasesService<ServiceParams extends AliasesParams = AliasesParams>
   }
 
   async remove(id: NullableId, params: ServiceParams): Promise<Alias[]> {
+    const { data: addressInfoResponse } = await wildDuckClient.get<Alias>(
+      `addresses/resolve/${id}`,
+    );
+    const allowedDomain: string = config.get("wildDuck.domain");
+
+    // If address does not match the allowed domain, throw an error
+    if (!addressInfoResponse.address.endsWith(allowedDomain)) {
+      throw new BadRequest("Unable to delete address");
+    }
+
     await wildDuckClient.delete<Alias>(`/addresses/${id}`);
 
     const userId = await this.getUserIdByEmailAddress(params);