@flink-app/email-plugin 2.0.0-alpha.127 → 2.0.0-alpha.128

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @flink-app/email-plugin
 
+## 2.0.0-alpha.128
+
+### Patch Changes
+
+-   55bd361: Bump `@sendgrid/mail` to `^8.1.6`, which moves its internal HTTP client from vulnerable `axios` 0.26 to 1.x. The SendGrid API surface used by the plugin is unchanged
+-   c004433: Bump `axios` from 0.27 to `^1.20.0` to fix several high-severity advisories. Requests sent to Flowmailer, MailerSend and 46elks are unchanged apart from an added `Accept-Encoding` header
+
+    The `http` parameter of `mailersendClient` is now typed as the new exported `MailersendHttp` interface (only `post` is used) instead of `AxiosInstance`, so instances from any axios version, or a test double, are accepted
+
+-   ac10540: - sms-plugin: stop logging the full axios error when a 46elks send fails, which leaked the Basic auth credentials into logs. Only status, message and response body are logged now
+    -   email-plugin: Flowmailer client now fetches an access token before the first send instead of always making one failed request with an empty bearer token
+-   Updated dependencies [5b666f2]
+    -   @flink-app/flink@2.0.0-alpha.128
+
 ## 2.0.0-alpha.127
 
 ### Patch Changes

package/dist/flowmailerClient.js

@@ -148,32 +148,34 @@ var flowMailerClient = /** @class */ (function () {
                         _i = 0;
                         _d.label = 1;
                     case 1:
-                        if (!(_i < _b.length)) return [3 /*break*/, 8];
+                        if (!(_i < _b.length)) return [3 /*break*/, 10];
                         _c = _b[_i];
-                        if (!(_c in _a)) return [3 /*break*/, 7];
+                        if (!(_c in _a)) return [3 /*break*/, 9];
                         i = _c;
-                        if (!this.client_secrect) {
-                            this.getToken();
-                        }
-                        return [4 /*yield*/, this.sendEmail(email, email.to[i])];
+                        if (!!this.accessToken) return [3 /*break*/, 3];
+                        return [4 /*yield*/, this.getToken()];
                     case 2:
+                        _d.sent();
+                        _d.label = 3;
+                    case 3: return [4 /*yield*/, this.sendEmail(email, email.to[i])];
+                    case 4:
                         success = _d.sent();
-                        if (!!success) return [3 /*break*/, 4];
+                        if (!!success) return [3 /*break*/, 6];
                         return [4 /*yield*/, this.getToken()];
-                    case 3:
+                    case 5:
                         _d.sent();
-                        return [3 /*break*/, 5];
-                    case 4: return [3 /*break*/, 7];
-                    case 5: return [4 /*yield*/, this.sendEmail(email, email.to[i])];
-                    case 6:
+                        return [3 /*break*/, 7];
+                    case 6: return [3 /*break*/, 9];
+                    case 7: return [4 /*yield*/, this.sendEmail(email, email.to[i])];
+                    case 8:
                         success = _d.sent();
                         if (!success)
                             failure = true;
-                        _d.label = 7;
-                    case 7:
+                        _d.label = 9;
+                    case 9:
                         _i++;
                         return [3 /*break*/, 1];
-                    case 8: return [2 /*return*/, !failure];
+                    case 10: return [2 /*return*/, !failure];
                 }
             });
         });

package/dist/index.d.ts

@@ -6,7 +6,7 @@ export { flowMailerClient } from "./flowmailerClient";
 export { sesClient } from "./sesClient";
 export { postmarkClient } from "./postmarkClient";
 export { mailersendClient, toMailersendAddress } from "./mailersendClient";
-export type { mailersendClientOptions, MailersendResult } from "./mailersendClient";
+export type { mailersendClientOptions, MailersendResult, MailersendHttp } from "./mailersendClient";
 export type { email } from "./schemas/email";
 export type { emailSes } from "./schemas/emailSes";
 export type { emailPostmark, PostmarkAttachment } from "./schemas/emailPostmark";

package/dist/mailersendClient.d.ts

@@ -1,4 +1,3 @@
-import { AxiosInstance } from "axios";
 import { client } from "./schemas/client";
 import { emailMailersend as email, MailersendAddress } from "./schemas/emailMailersend";
 export interface mailersendClientOptions {
@@ -33,6 +32,15 @@ export interface MailersendResult {
         details?: any;
     };
 }
+/**
+ * The part of an HTTP client (such as an axios instance) used to talk to
+ * MailerSend. Kept minimal so instances from any axios version fit.
+ */
+export interface MailersendHttp {
+    post(url: string, data?: any): Promise<{
+        headers?: any;
+    }>;
+}
 type MailersendAddressPayload = {
     email: string;
     name?: string;
@@ -45,7 +53,7 @@ export declare function toMailersendAddress(address: MailersendAddress): Mailers
 export declare class mailersendClient implements client {
     private http;
     private defaultFrom?;
-    constructor(options: mailersendClientOptions, http?: AxiosInstance);
+    constructor(options: mailersendClientOptions, http?: MailersendHttp);
     /**
      * Send an email via MailerSend. Implements the base `client` interface.
      * Returns `true` on success, `false` on failure.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flink-app/email-plugin",
-  "version": "2.0.0-alpha.127",
+  "version": "2.0.0-alpha.128",
   "description": "Flink plugin that provides multi-provider email sending capabilities with support for SendGrid, SMTP, Flowmailer, AWS SES, Postmark, and MailerSend",
   "author": "johan@frost.se",
   "publishConfig": {
@@ -11,9 +11,9 @@
   "main": "dist/index.js",
   "dependencies": {
     "@aws-sdk/client-sesv2": "^3.700.0",
-    "@sendgrid/mail": "^7.4.5",
+    "@sendgrid/mail": "^8.1.6",
     "@types/nodemailer": "^6.4.4",
-    "axios": "^0.27.2",
+    "axios": "^1.20.0",
     "nodemailer": "^6.6.2",
     "postmark": "^4.0.7",
     "querystring": "^0.2.1"
@@ -21,11 +21,11 @@
   "devDependencies": {
     "@types/jasmine": "^3.7.1",
     "@types/node": "22.13.10",
-    "@flink-app/flink": "2.0.0-alpha.127"
+    "@flink-app/flink": "2.0.0-alpha.128"
   },
   "gitHead": "4243e3b3cd6d4e1ca001a61baa8436bf2bbe4113",
   "peerDependencies": {
-    "@flink-app/flink": ">=2.0.0-alpha.127"
+    "@flink-app/flink": ">=2.0.0-alpha.128"
   },
   "scripts": {
     "test": "jasmine-ts --config=./spec/support/jasmine.json",

package/spec/flowmailerClient.spec.ts

@@ -0,0 +1,64 @@
+import axios from "axios";
+import { flowMailerClient } from "../src/flowmailerClient";
+
+const TOKEN_URL = "https://login.flowmailer.net/oauth/token";
+
+function createClient() {
+  return new flowMailerClient({ client_id: "id", client_secrect: "secret", account_id: "acc" });
+}
+
+const email = { from: "a@example.com", to: ["b@example.com", "c@example.com"], subject: "Hi", text: "Body" };
+
+describe("flowMailerClient", () => {
+  let post: jasmine.Spy;
+  let tokenRequests: number;
+
+  beforeEach(() => {
+    tokenRequests = 0;
+    post = spyOn(axios, "post").and.callFake((async (url: string) => {
+      if (url === TOKEN_URL) {
+        tokenRequests++;
+        return { status: 200, data: { access_token: `tok-${tokenRequests}` } };
+      }
+      return { status: 201 };
+    }) as any);
+  });
+
+  function submitAuthHeaders() {
+    return post.calls
+      .all()
+      .filter((c) => c.args[0] !== TOKEN_URL)
+      .map((c) => c.args[2].headers.Authorization);
+  }
+
+  it("fetches a token before the first send and reuses it", async () => {
+    expect(await createClient().send(email)).toBe(true);
+
+    expect(tokenRequests).toBe(1);
+    expect(post.calls.first().args[0]).toBe(TOKEN_URL);
+    expect(submitAuthHeaders()).toEqual(["Bearer tok-1", "Bearer tok-1"]);
+  });
+
+  it("refreshes the token and retries once when a send fails", async () => {
+    const client = createClient();
+    await client.send({ ...email, to: ["b@example.com"] });
+
+    let rejected = false;
+    post.and.callFake((async (url: string) => {
+      if (url === TOKEN_URL) {
+        tokenRequests++;
+        return { status: 200, data: { access_token: `tok-${tokenRequests}` } };
+      }
+      if (!rejected) {
+        rejected = true;
+        throw { response: { status: 401, data: { error: "invalid_token" } } };
+      }
+      return { status: 201 };
+    }) as any);
+    post.calls.reset();
+
+    expect(await client.send({ ...email, to: ["b@example.com"] })).toBe(true);
+    expect(tokenRequests).toBe(2);
+    expect(submitAuthHeaders()).toEqual(["Bearer tok-1", "Bearer tok-2"]);
+  });
+});

package/src/flowmailerClient.ts

@@ -89,8 +89,8 @@ export class flowMailerClient implements client {
     async send(email: email) {
         let failure = false;
         for (const i in email.to) {
-            if (!this.client_secrect) {
-                this.getToken();
+            if (!this.accessToken) {
+                await this.getToken();
             }
             let success = await this.sendEmail(email, email.to[i]);
             if (!success) {

package/src/index.ts

@@ -6,7 +6,7 @@ export { flowMailerClient } from "./flowmailerClient";
 export { sesClient } from "./sesClient";
 export { postmarkClient } from "./postmarkClient";
 export { mailersendClient, toMailersendAddress } from "./mailersendClient";
-export type { mailersendClientOptions, MailersendResult } from "./mailersendClient";
+export type { mailersendClientOptions, MailersendResult, MailersendHttp } from "./mailersendClient";
 export type { email } from "./schemas/email";
 export type { emailSes } from "./schemas/emailSes";
 export type { emailPostmark, PostmarkAttachment } from "./schemas/emailPostmark";

package/src/mailersendClient.ts

@@ -1,4 +1,4 @@
-import axios, { AxiosInstance } from "axios";
+import axios from "axios";
 import { client } from "./schemas/client";
 import {
   emailMailersend as email,
@@ -41,6 +41,14 @@ export interface MailersendResult {
   };
 }
 
+/**
+ * The part of an HTTP client (such as an axios instance) used to talk to
+ * MailerSend. Kept minimal so instances from any axios version fit.
+ */
+export interface MailersendHttp {
+  post(url: string, data?: any): Promise<{ headers?: any }>;
+}
+
 type MailersendAddressPayload = { email: string; name?: string };
 
 type MailersendPayload = {
@@ -83,10 +91,10 @@ export function toMailersendAddress(
 }
 
 export class mailersendClient implements client {
-  private http: AxiosInstance;
+  private http: MailersendHttp;
   private defaultFrom?: MailersendAddress;
 
-  constructor(options: mailersendClientOptions, http?: AxiosInstance) {
+  constructor(options: mailersendClientOptions, http?: MailersendHttp) {
     this.defaultFrom = options.defaultFrom;
     this.http =
       http ??