added Cc and Bcc headers to the sendmail command

CHANGELOG.md

@@ -1,6 +1,8 @@
 ## v0.39.6 (WIP)
 
-- (@todo prepare announcement explaining the options) Added extra hardening options to the Microsoft OAuth2 provider allowing devs to specify the preferred safe email extraction method.
+- Added `Cc` and `Bcc` recipients to the dev `sendmail` command for consistency with the SMTP mailer.
+
+- (@todo prepare announcement explaining the options) Added extra hardening options to the Microsoft OAuth2 provider allowing developers to specify the preferred safe email extraction method.
 
 - (@todo) Bumped the min Go GitHub action version to 1.26.5 as it includes some [minor security fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.26.5).
 

tools/mailer/sendmail.go

@@ -49,6 +49,14 @@ func (c *Sendmail) send(m *Message) error {
 	headers.Set("Content-Type", "text/html; charset=UTF-8")
 	headers.Set("To", strings.Join(toAddresses, ","))
 
+	if len(m.Cc) > 0 {
+		headers.Set("Cc", strings.Join(addressesToStrings(m.Cc, false), ","))
+	}
+
+	if len(m.Bcc) > 0 {
+		headers.Set("Bcc", strings.Join(addressesToStrings(m.Bcc, false), ","))
+	}
+
 	cmdPath, err := findSendmailPath()
 	if err != nil {
 		return err
@@ -75,7 +83,7 @@ func (c *Sendmail) send(m *Message) error {
 	}
 	// ---
 
-	sendmail := exec.Command(cmdPath, strings.Join(toAddresses, ","))
+	sendmail := exec.Command(cmdPath, "-i", "-t")
 	sendmail.Stdin = &buffer
 
 	return sendmail.Run()