fix(security): quoted local-part email mask — strip delimiter quotes, split on last @ (DC-109) [glm-grade=A]

dashcaddy-api/__tests__/redact-log-pii.test.js

@@ -177,3 +177,37 @@ describe('DC-098 redact-log-pii.js end-to-end', () => {
     expect(stderr).toContain('error:');
   });
 });
+
+describe('DC-109 quoted local-part mask edge (maskEmailAddress)', () => {
+  test('quoted local-part: quotes stripped, 2 REAL chars kept, no stray quote', () => {
+    expect(maskEmailAddress('"john doe"@example.com')).toBe('jo****@example.com');
+    expect(maskEmailAddress('"a"@example.com')).toBe('a****@example.com');
+    expect(maskEmailAddress('ab"cd@e.f"@example.com')).toBe('ab****@example.com'); // mixed, no strip
+  });
+
+  test('quoted local-part containing "@" splits on LAST @ (real domain boundary)', () => {
+    expect(maskEmailAddress('"a@b"@example.com')).toBe('a@****@example.com');
+  });
+
+  test('empty quoted local-part masks to bare ****@domain', () => {
+    expect(maskEmailAddress('""@example.com')).toBe('****@example.com');
+  });
+
+  test('plain addresses unchanged by DC-109 (canonical shape preserved)', () => {
+    expect(maskEmailAddress('sami@example.com')).toBe('sa****@example.com');
+    expect(maskEmailAddress('ab@x.io')).toBe('a****@x.io');
+    expect(maskEmailAddress('a@x.io')).toBe('a****@x.io');
+  });
+
+  test('masked quoted output cannot re-match EMAIL_RE (idempotence on splice line)', () => {
+    const line = 'contact "john.doe@x"@example.com or root@web-1 ok';
+    const masked = maskEmailsInString(line);
+    const re = new RegExp(EMAIL_RE.source, EMAIL_RE.flags);
+    // After one pass nothing that still contains the original address OR a
+    // fresh matchable email-shaped token may remain.
+    expect(masked).not.toContain('john.doe');
+    expect(re.test(masked)).toBe(false);
+    const twice = maskEmailsInString(masked);
+    expect(twice).toBe(masked); // fully idempotent
+  });
+});