ServerID and MessageStream are discarded and all addresses share a site-wide suppression decision. Sites receiving multiple streams cannot express when one stream's event should apply globally or only to that source.
Reviewed 1.0.0-alpha1, source commit 02fd9d36af5237e712cecb7155d79725f7824880. Location: src/Controller/PostmarkWebhookController.php:89.
Design limitation in a single-policy module, not an authorization vulnerability in a promised multi-tenant product.
Preserve validated source identity and support explicit source-to-policy mapping with a backward-compatible site-wide default. Bind configured credentials to allowed sources where feasible; a payload source label alone must not grant authority. Keep transactional and broadcast consent decisions explicit.
Test identical addresses/message IDs across sources, unknown-source handling, legacy migration and global versus scoped policy. Document that Drupal mail paths need a reliable source context to use scoped decisions.
Comments
Comment #2
jmcerdaImplemented explicit global/source policy mappings and a trusted server/stream context for the shared policy and core mail. Unmapped and legacy sources remain global; missing sending context remains conservative. A settings-only allowlist can bind accepted credentials to known source pairs, with authentication checked first. Invalid mappings fail closed and imports reject duplicates. The full PostgreSQL suite passed on Drupal 10 and 11 (52 tests each); focused tests also verify actual core transport and source restrictions. Review is ongoing; integration and release remain pending.
Comment #5
jmcerdaIntegrated into the 1.x development branch and included in 1.0.0-alpha2. The release tag and branch are mirrored to Drupalcode. The six-job Drupal 10/11 and Mailer Plus integration matrix passes. See the release notes for database updates and retained-history limitations. This records module publication; site deployment is a separate operation.