studio-engine 0.101.0 → 0.102.0.rc1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 246f4e1f6c97a3d413fb3742ee419565546ec4fbcb44c139360a99c69b708cfb
-  data.tar.gz: cae5242cf1894749491d43a2170983eeca8d70088da294084d66b51222d6befc
+  metadata.gz: 7eb8bd189cd5861c7aad2afb33f1d00ebe6bfa103e9e106dade9363d66cb91a4
+  data.tar.gz: 2381d4002f2c80cde9bb8a59243cc4836c99ce3abd90d8f97dfff50f7d89dad7
 SHA512:
-  metadata.gz: da0a0aac743481907e836f5b1e331dea6572a0c9b5f09d12291ea4ccf2e852b81d9750ed01e9ccd765451fa4c1b62e1eef999064fd5586aed3318cbb953e5483
-  data.tar.gz: d4d90ff3d300c6f8a846d4cb747683291171b9e93a90c07e0cfc981c565a12df97512435af135a303f7a0fb20e2ec4844d0ae6abe9b95b1fbadffaab2d2446c0
+  metadata.gz: 87fb049ff0f6cb9041b0c070f9cde7f6c975e9eb04b275aa1cad4f3336ca89552d7ac3962a60e4ad9d12e0e2d970f9c6103403697e7d7d12762bec1c813295e4
+  data.tar.gz: 4b96de3893bf63d4d1ce75971078972e83d1be52189e5f58ffd74e05ebe4a86888168d563b5a1966a9db90934f3fe1c74ba4e684dbdb31879062fdd3fe9d75c6

data/CHANGELOG.md

@@ -4,6 +4,46 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ## Unreleased
 
+## 0.102.0 — 2026-10-10
+
+### Removed
+
+- **The SES mail transport.** AWS was retired on 2026-10-10 (no IAM users, no
+  SES identities), so the engine no longer configures SES SMTP. Removed:
+  `Studio::MailTransport.configure_ses!`, `Studio.ses_transport_ready?`, the
+  `ses:check` and `ses:verify_domain` rake tasks, the banner's SES connector
+  and `ses-favicon.png`. The engine reads no `SES_*` variable and no
+  `AWS_ACCESS_KEY_ID` fallback for mail. Resend and every other transport are
+  unchanged.
+
+  **Consumer note: `MAIL_TRANSPORT=ses` is no longer supported.** It now logs
+  `MAIL_TRANSPORT=ses is no longer supported` and falls through as if unset:
+  Resend when `RESEND_API_KEY` is set, else the existing delivery method. No
+  app in the fleet sets it (verified 2026-10-10: the two QA apps set
+  `MAIL_TRANSPORT=resend`, no Heroku app holds an `SES_*` or `AWS_*` variable).
+  Remove any `MAIL_TRANSPORT=ses` and `SES_*` lines from `.env.example` and docs
+  when you next touch them.
+
+### Changed
+
+- **`ses_from:` is optional and ignored.** `Studio.mailer_from_for_transport`
+  and `Studio.marketing_from_for_transport` still accept it, so every existing
+  initializer keeps booting, but they always answer the Resend sender
+  (`RESEND_MAILER_FROM` / `RESEND_MARKETING_FROM`, then `resend_from:`, then
+  `Studio.resend_mailer_from`). That was already the answer on every app,
+  because none had SES selected. Drop the keyword when convenient.
+
+### Added
+
+- **A failed trash copy is recorded to ErrorLog.** When
+  `Studio::S3::Trash.trash!` (behind `Studio::S3.delete` and the
+  `StudioTrashS3` Active Storage service) cannot copy an object under
+  `trash/`, it now records a `Studio::S3::Trash::CopyFailed` through the host's
+  `ErrorLog.capture!`, naming the bucket, key and trash key, before re-raising
+  the original S3 error. The delete is still never sent after a failed copy.
+  Recording is best-effort: an `ErrorLog` that raises, or a host without one,
+  never masks the copy error.
+
 ## 0.101.0 — 2026-10-10
 
 ### Breaking

data/README.md

@@ -56,9 +56,7 @@ Studio.configure do |config|
   config.welcome_message = ->(user) { "Welcome, #{user.display_name}!" }
   config.auth_methods = %i[magic_link google]
   config.registration_params = [:name, :email]
-  config.mailer_from = Studio.mailer_from_for_transport(
-    ses_from: "My App <team@example.com>"
-  )
+  config.mailer_from = Studio.mailer_from_for_transport # RESEND_MAILER_FROM, else the shared sender
   config.theme_primary = "#4BAF50"   # Override default violet
   config.theme_logos = ["logo.svg"]
 
@@ -123,8 +121,9 @@ Transactional mail transport is shared through `Studio::MailTransport`:
 Studio::MailTransport.configure!
 ```
 
-It selects SES SMTP when `MAIL_TRANSPORT=ses` and SES SMTP credentials are
-present, otherwise falls back to Resend when `RESEND_API_KEY` is present.
+It selects Resend when `RESEND_API_KEY` is present. The SES transport was
+removed with AWS on 2026-10-10; `MAIL_TRANSPORT=ses` now only logs a warning
+([`docs/EMAIL_TRANSPORT.md`](docs/EMAIL_TRANSPORT.md)).
 
 ## Routes
 
@@ -162,7 +161,7 @@ The environment banner includes:
 
 - a Dev Mode toggle button backed by `Alpine.store("devMode")`
 - an Email status button that links to `/_studio/local_emails`
-- a send/capture signal plus SES/Resend/unknown connector icon
+- a send/capture signal plus Resend/unknown connector icon
 
 Apps with admin Act As / impersonation state can render the matching banner
 with their own users and return route:
@@ -1005,7 +1004,10 @@ avatars/abc.png  ->  trash/2026-10-01/1759302000123/avatars/abc.png
 ```
 
 The copy goes first and the delete second. A copy that fails raises and the
-delete is never sent, so a failure leaves the original in place. The trash copy
+delete is never sent, so a failure leaves the original in place; the failed
+copy is also recorded through the host's `ErrorLog.capture!` as a
+`Studio::S3::Trash::CopyFailed` naming the bucket and key, before the original
+error is re-raised. The trash copy
 keeps the object's content type, cache headers and metadata, and adds
 `original-key`, `deleted-at`, `deleted-env`, and what an Active Storage blob row
 needs to be rebuilt (`blob-content-type`, `blob-byte-size`, `blob-checksum`

data/app/helpers/studio_email_delivery_helper.rb

@@ -30,7 +30,6 @@ module StudioEmailDeliveryHelper
   def email_delivery_transport_label(delivery_method = studio_email_delivery_method,
                                      capture_enabled = Studio.local_email_capture?)
     return "capture" if capture_enabled
-    return "ses" if Studio.ses_transport_ready?
     return "resend" if delivery_method == "resend"
 
     delivery_method.to_s.strip.empty? ? "unknown" : delivery_method
@@ -39,16 +38,13 @@ module StudioEmailDeliveryHelper
   private
 
   def email_delivery_connector(delivery_method, transport)
-    return "ses" if Studio.ses_transport_ready?
-    return "resend" if delivery_method == "resend"
-    return transport if %w[ses resend].include?(transport)
+    return "resend" if delivery_method == "resend" || transport == "resend"
 
     nil
   end
 
   def email_delivery_connector_label(connector)
     case connector
-    when "ses" then "SES"
     when "resend" then "Resend"
     else "Unknown"
     end
@@ -56,7 +52,6 @@ module StudioEmailDeliveryHelper
 
   def email_delivery_provider_icon(connector)
     case connector
-    when "ses" then "ses-favicon.png"
     when "resend" then "resend-favicon.png"
     end
   end

data/lib/active_storage/service/studio_trash_s3_service.rb

@@ -38,7 +38,8 @@ module ActiveStorage
       rescue StandardError => error
         # Logged, then RE-RAISED. Blob#purge has already destroyed the row, so a
         # raise here leaks the object rather than losing it: the failure that
-        # costs storage, never the one that costs a user's file.
+        # costs storage, never the one that costs a user's file. A failed COPY
+        # has already been recorded to ErrorLog by Studio::S3::Trash.trash!.
         log_trash_failure(key, error)
         raise
       end

data/lib/studio/email_smoke.rb

@@ -112,7 +112,6 @@ module Studio
 
       def transport_label(action_mailer:, env: ENV)
         return "capture" if studio_local_email_capture?
-        return "ses" if studio_ses_transport_ready?(env)
 
         delivery_method = action_mailer.delivery_method.to_s
         return "resend" if delivery_method == "resend"
@@ -158,16 +157,6 @@ module Studio
         value if value && !value.to_s.strip.empty?
       end
 
-      def studio_ses_transport_ready?(env)
-        if defined?(Studio) && Studio.respond_to?(:ses_transport_ready?)
-          Studio.ses_transport_ready?(env)
-        else
-          env["MAIL_TRANSPORT"].to_s.downcase == "ses" &&
-            env_value(env, "SES_SMTP_USERNAME") &&
-            env_value(env, "SES_SMTP_PASSWORD")
-        end
-      end
-
       def studio_local_email_capture?
         defined?(Studio) && Studio.respond_to?(:local_email_capture?) && Studio.local_email_capture?
       end

data/lib/studio/engine.rb

@@ -213,7 +213,6 @@ module Studio
 
     rake_tasks do
       load File.expand_path("../tasks/studio_email.rake", __dir__)
-      load File.expand_path("../tasks/studio_ses.rake", __dir__)
     end
 
     # ---- A FOOTER-ONLY CONSUMER: a host with no ActiveRecord ------------------

data/lib/studio/mail_transport.rb

@@ -19,21 +19,17 @@ module Studio
         end
 
         selected = env["MAIL_TRANSPORT"].to_s.downcase
-        ses_ready = selected == "ses" && present?(env["SES_SMTP_USERNAME"]) && present?(env["SES_SMTP_PASSWORD"])
 
-        if selected == "ses" && !ses_ready
-          log(logger, :warn, "[mail] MAIL_TRANSPORT=ses but SES_SMTP_USERNAME/PASSWORD missing - keeping fallback transport")
-        elsif present?(selected) && !%w[ses resend].include?(selected)
+        # SES was retired with AWS on 2026-10-10 (no IAM users, no SES
+        # identities), so MAIL_TRANSPORT=ses no longer selects anything. It
+        # warns and falls through to Resend exactly like an unset value, so a
+        # stale config var never stops mail.
+        if selected == "ses"
+          log(logger, :warn, "[mail] MAIL_TRANSPORT=ses is no longer supported (SES retired) - using Resend when RESEND_API_KEY is set")
+        elsif present?(selected) && selected != "resend"
           log(logger, :warn, "[mail] unknown MAIL_TRANSPORT=#{selected.inspect} - keeping fallback transport")
         end
 
-        if ses_ready
-          configure_ses!(env: env, action_mailer: action_mailer)
-          region = env.fetch("SES_REGION", "us-east-2")
-          log(logger, :info, "[mail] transport=SES region=#{region} from=#{mailer_from}")
-          return Result.new(transport: :ses, delivery_method: action_mailer.delivery_method, message: "SES SMTP active")
-        end
-
         if present?(env["RESEND_API_KEY"])
           resend_loader.call
           resend_configurer.call(env["RESEND_API_KEY"])
@@ -45,19 +41,6 @@ module Studio
         Result.new(transport: :default, delivery_method: action_mailer.delivery_method, message: "no transactional transport configured")
       end
 
-      def configure_ses!(env:, action_mailer:)
-        region = env.fetch("SES_REGION", "us-east-2")
-        action_mailer.delivery_method = :smtp
-        action_mailer.smtp_settings = {
-          address: env.fetch("SES_SMTP_HOST", "email-smtp.#{region}.amazonaws.com"),
-          port: env.fetch("SES_SMTP_PORT", 587).to_i,
-          user_name: env["SES_SMTP_USERNAME"],
-          password: env["SES_SMTP_PASSWORD"],
-          authentication: :login,
-          enable_starttls_auto: true
-        }
-      end
-
       def load_resend!
         require "resend"
       end

data/lib/studio/s3/trash.rb

@@ -21,7 +21,9 @@ module Studio
     # THE ORDER IS THE SAFETY. Copy first, delete second, and a copy that fails
     # RAISES before the delete is ever sent. A failure anywhere leaves the
     # original where it was: a leaked object costs storage, a lost one costs a
-    # user's photo.
+    # user's photo. A failed copy is also recorded to the host's ErrorLog
+    # (CopyFailed, naming the object) before the original error is re-raised,
+    # so a leak is visible on /error_logs rather than only in a log line.
     #
     # Everything here works on REAL object keys (any Studio.s3_key_prefix
     # already applied) and an explicit client + bucket, so Studio::S3 and the
@@ -52,6 +54,11 @@ module Studio
       class ProductionBucketRefused < Studio::S3::Error; end
       class NotTrash < Studio::S3::Error; end
       class RestoreConflict < Studio::S3::Error; end
+      # What a failed trash copy records to the host's ErrorLog: the S3 error
+      # alone names no object, so this carries bucket, key and trash key, with
+      # the failing copy's backtrace. It is RECORDED, never raised; trash!
+      # re-raises the original error so callers rescue what they always did.
+      class CopyFailed < Studio::S3::Error; end
 
       TRASH_KEY = %r{\Atrash/(\d{4}-\d{2}-\d{2})/(\d+)/(.+)\z}m
 
@@ -71,14 +78,19 @@ module Studio
           end
 
           trash_key = key_for(key, now: now)
-          client.copy_object(
-            bucket: bucket,
-            copy_source: copy_source(bucket, key),
-            key: trash_key,
-            metadata_directive: "REPLACE",
-            metadata: trash_metadata(head, key: key, env: env, now: now),
-            **carried_headers(head)
-          )
+          begin
+            client.copy_object(
+              bucket: bucket,
+              copy_source: copy_source(bucket, key),
+              key: trash_key,
+              metadata_directive: "REPLACE",
+              metadata: trash_metadata(head, key: key, env: env, now: now),
+              **carried_headers(head)
+            )
+          rescue StandardError => error
+            record_copy_failure(error, bucket: bucket, key: key, trash_key: trash_key)
+            raise
+          end
           # Reached only when the copy returned. A raise above never deletes.
           client.delete_object(bucket: bucket, key: key)
           trash_key
@@ -181,6 +193,23 @@ module Studio
 
         private
 
+        # Record a failed copy through the host's ErrorLog (the engine's
+        # non-request error primitive) when it has one. Best-effort: ErrorLog
+        # writes to the database and can itself raise, and that must never
+        # replace the copy error trash! is about to re-raise.
+        def record_copy_failure(error, bucket:, key:, trash_key:)
+          return unless defined?(::ErrorLog) && ::ErrorLog.respond_to?(:capture!)
+
+          record = CopyFailed.new(
+            "trash copy of #{bucket}/#{key} to #{trash_key} failed, object left in place: " \
+            "#{error.class}: #{error.message}"
+          )
+          record.set_backtrace(error.backtrace || caller)
+          ::ErrorLog.capture!(record)
+        rescue StandardError, ScriptError
+          nil
+        end
+
         def head(client, bucket, key)
           client.head_object(bucket: bucket, key: key)
         rescue Aws::S3::Errors::NotFound, Aws::S3::Errors::NoSuchKey

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.101.0"
+  VERSION = "0.102.0.rc1"
 end

data/lib/studio.rb

@@ -1136,29 +1136,20 @@ module Studio
     yield self
   end
 
-  def self.mailer_from_for_transport(env: ENV, ses_from:, resend_from: nil)
-    if ses_transport_ready?(env)
-      env_value(env, "MAILER_FROM") || ses_from
-    else
-      env_value(env, "RESEND_MAILER_FROM") || resend_from || resend_mailer_from
-    end
-  end
-
-  def self.marketing_from_for_transport(env: ENV, ses_from:, resend_from: nil)
-    if ses_transport_ready?(env)
-      env_value(env, "MARKETING_MAILER_FROM") || ses_from
-    else
-      env_value(env, "RESEND_MARKETING_FROM") ||
-        env_value(env, "RESEND_MAILER_FROM") ||
-        resend_from ||
-        resend_mailer_from
-    end
+  # The sender for transactional mail. Resend is the only provider (SES was
+  # retired 2026-10-10): RESEND_MAILER_FROM, then resend_from, then
+  # Studio.resend_mailer_from. `ses_from:` is still ACCEPTED so existing
+  # consumer initializers keep booting, and IGNORED; drop it at your leisure.
+  def self.mailer_from_for_transport(env: ENV, ses_from: nil, resend_from: nil)
+    env_value(env, "RESEND_MAILER_FROM") || resend_from || resend_mailer_from
   end
 
-  def self.ses_transport_ready?(env = ENV)
-    env["MAIL_TRANSPORT"].to_s.downcase == "ses" &&
-      env_value(env, "SES_SMTP_USERNAME") &&
-      env_value(env, "SES_SMTP_PASSWORD")
+  # The sender for marketing mail, by the same rule; `ses_from:` is ignored.
+  def self.marketing_from_for_transport(env: ENV, ses_from: nil, resend_from: nil)
+    env_value(env, "RESEND_MARKETING_FROM") ||
+      env_value(env, "RESEND_MAILER_FROM") ||
+      resend_from ||
+      resend_mailer_from
   end
 
   def self.env_value(env, key)

data/lib/tasks/studio_trash.rake

@@ -14,7 +14,7 @@
 #
 # Logic lives in Studio::S3::Trash (unit-tested); these tasks only resolve the
 # bucket and print.
-# Guarded like studio_email.rake and studio_ses.rake: an app that also loads
+# Guarded like studio_email.rake: an app that also loads
 # this file must not register a second copy of each action.
 unless Rake::Task.task_defined?("studio:trash:restore")
   namespace :studio do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.101.0
+  version: 0.102.0.rc1
 platform: ruby
 authors:
 - Alex McRitchie
@@ -256,7 +256,6 @@ files:
 - app/assets/images/emails/magic-link.gif
 - app/assets/images/emails/newsletter-subscribed-background.gif
 - app/assets/images/resend-favicon.png
-- app/assets/images/ses-favicon.png
 - app/assets/images/state-flags/ak.svg
 - app/assets/images/state-flags/al.svg
 - app/assets/images/state-flags/ar.svg
@@ -778,7 +777,6 @@ files:
 - lib/studio/version.rb
 - lib/tasks/studio_email.rake
 - lib/tasks/studio_knowledge.rake
-- lib/tasks/studio_ses.rake
 - lib/tasks/studio_trash.rake
 - studio-engine.gemspec
 - tailwind/studio.tailwind.config.js

data/lib/tasks/studio_ses.rake

@@ -1,130 +0,0 @@
-# frozen_string_literal: true
-
-unless Rake::Task.task_defined?("ses:check")
-  namespace :ses do
-    def studio_ses_env_value(name)
-      value = ENV[name]
-      return nil if value.nil? || value.to_s.strip.empty?
-
-      value
-    end
-
-    def studio_ses_credential(name)
-      studio_ses_env_value("SES_#{name}") || studio_ses_env_value(name)
-    end
-
-    def studio_ses_credential_source(name)
-      return "SES_#{name}" if studio_ses_env_value("SES_#{name}")
-      return name if studio_ses_env_value(name)
-
-      "missing"
-    end
-
-    def studio_ses_signer(region)
-      require "aws-sigv4"
-
-      access_key_id = studio_ses_credential("AWS_ACCESS_KEY_ID")
-      secret_access_key = studio_ses_credential("AWS_SECRET_ACCESS_KEY")
-      missing = []
-      missing << "SES_AWS_ACCESS_KEY_ID or AWS_ACCESS_KEY_ID" unless access_key_id
-      missing << "SES_AWS_SECRET_ACCESS_KEY or AWS_SECRET_ACCESS_KEY" unless secret_access_key
-      abort "ses:* needs #{missing.join(' and ')}." if missing.any?
-
-      Aws::Sigv4::Signer.new(
-        service: "ses",
-        region: region,
-        access_key_id: access_key_id,
-        secret_access_key: secret_access_key
-      )
-    rescue LoadError
-      abort "ses:* needs aws-sigv4; it is usually available through aws-sdk-s3."
-    end
-
-    def studio_ses_request(signer, region, method, path, body = nil)
-      require "net/http"
-      require "json"
-
-      url = "https://email.#{region}.amazonaws.com#{path}"
-      headers = body ? { "content-type" => "application/json" } : {}
-      sig = signer.sign_request(http_method: method, url: url, body: body, headers: headers)
-      uri = URI(url)
-      http = Net::HTTP.new(uri.host, 443)
-      http.use_ssl = true
-      req = Net::HTTP.const_get(method.capitalize).new(uri)
-      headers.each { |key, value| req[key] = value }
-      sig.headers.each { |key, value| req[key] = value }
-      req.body = body if body
-      res = http.request(req)
-      [res.code.to_i, (JSON.parse(res.body) rescue { "raw" => res.body.to_s[0, 300] })]
-    end
-
-    def studio_ses_error(body)
-      body["message"] || body["Message"] || body["raw"]
-    end
-
-    desc "Check SES account status and verified identities"
-    task check: :environment do
-      region = ENV.fetch("SES_REGION", "us-east-2")
-      signer = studio_ses_signer(region)
-      get = ->(path) { studio_ses_request(signer, region, "GET", path) }
-
-      code, account = get.call("/v2/email/account")
-      puts "GetAccount (region #{region}) -> HTTP #{code}"
-      puts "  CredentialSource=#{studio_ses_credential_source('AWS_ACCESS_KEY_ID')}"
-      if code == 200
-        puts "  SendingEnabled=#{account['SendingEnabled']} ProductionAccessEnabled=#{account['ProductionAccessEnabled']} Enforcement=#{account['EnforcementStatus']}"
-      else
-        puts "  ERROR: #{studio_ses_error(account)}"
-      end
-
-      code, identities = get.call("/v2/email/identities")
-      puts "ListEmailIdentities -> HTTP #{code}"
-      if code == 200
-        list = identities["EmailIdentities"] || []
-        names = list.map { |identity| "#{identity['IdentityName']}(#{identity['VerifiedForSendingStatus'] ? 'verified' : 'pending'})" }
-        puts "  identities: #{names.empty? ? '(none yet)' : names.join(', ')}"
-      else
-        puts "  ERROR: #{studio_ses_error(identities)}"
-      end
-
-      transport = ENV.fetch("MAIL_TRANSPORT", "(unset -> resend)")
-      puts "Live transport: MAIL_TRANSPORT=#{transport} delivery_method=#{ActionMailer::Base.delivery_method}"
-    end
-
-    desc "Create a SES domain identity and print DKIM CNAME records"
-    task :verify_domain, [:domain] => :environment do |_task, args|
-      abort "Usage: ses:verify_domain[domain]" if args[:domain].blank?
-
-      domain = args[:domain]
-      region = ENV.fetch("SES_REGION", "us-east-2")
-      signer = studio_ses_signer(region)
-      body = { EmailIdentity: domain }.to_json
-      code, response = studio_ses_request(signer, region, "POST", "/v2/email/identities", body)
-      already_exists = "#{response['message']} #{response['Message']}".match?(/already exist/i)
-
-      if code == 409 || ([400, 409].include?(code) && already_exists)
-        code, response = studio_ses_request(signer, region, "GET", "/v2/email/identities/#{domain}")
-      end
-
-      if code != 200
-        puts "#{domain}: ERROR (HTTP #{code}) #{studio_ses_error(response)}"
-        next
-      end
-
-      tokens = response.dig("DkimAttributes", "Tokens") || []
-      status = response.dig("DkimAttributes", "Status") || response["VerifiedForSendingStatus"]
-      puts "== #{domain} (region #{region}, DKIM status: #{status}) =="
-      if tokens.empty?
-        puts "  (no DKIM tokens returned)"
-      else
-        puts "  Add these 3 CNAME records to #{domain}'s DNS:"
-        tokens.each do |token|
-          puts "    NAME:  #{token}._domainkey.#{domain}"
-          puts "    TYPE:  CNAME"
-          puts "    VALUE: #{token}.dkim.amazonses.com"
-          puts ""
-        end
-      end
-    end
-  end
-end