diff --git a/src/services/aliases/aliases.class.ts b/src/services/aliases/aliases.class.ts index 3013d2f..489f41d 100644 --- a/src/services/aliases/aliases.class.ts +++ b/src/services/aliases/aliases.class.ts @@ -110,6 +110,16 @@ export class AliasesService } async remove(id: NullableId, params: ServiceParams): Promise { + const { data: addressInfoResponse } = await wildDuckClient.get( + `addresses/resolve/${id}`, + ); + const allowedDomain: string = config.get("wildDuck.domain"); + + // If address does not match the allowed domain, throw an error + if (!addressInfoResponse.address.endsWith(allowedDomain)) { + throw new BadRequest("Unable to delete address"); + } + await wildDuckClient.delete(`/addresses/${id}`); const userId = await this.getUserIdByEmailAddress(params);