@fonderie/courier 5.2.2 → 6.0.0

package/dist/index.d.cts

@@ -1,7 +1,7 @@
 import { IFonderieModule, IReadinessProblem, IFonderieApp, Middleware } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { DefaultTemplateMap, ITemplateResolver, ICourierChannel, IRenderedTemplate } from './types.cjs';
+import { DefaultTemplateMap, ITemplateResolver, ICourierChannel, IRenderedTemplate, ISendResult } from './types.cjs';
 export { IMessageLog, MessageLogStatus } from './types.cjs';
 import { ICourierMessage, IDefaultTemplate } from '@fonderie/core/types';
 export { ICourierMessage, IDefaultTemplate } from '@fonderie/core/types';
@@ -51,6 +51,7 @@ interface ICourierConfig {
             sendgrid?: string;
             mailgun?: string;
         };
+        allowUnverifiedMailtrap?: boolean;
     };
 }
 
@@ -78,7 +79,7 @@ declare class CourierModule implements IFonderieModule {
 
 declare function validateCourierConfig(config: ICourierConfig, registeredChannels: Iterable<string>): void;
 
-declare function handleSendGridDelivery(req: Request, store: IStoreAdapter, webhookSecret?: string): Promise<Response>;
+declare function handleSendGridDelivery(req: Request, store: IStoreAdapter, publicKey?: string): Promise<Response>;
 declare function handleMailgunDelivery(req: Request, store: IStoreAdapter, signingKey?: string): Promise<Response>;
 declare function handleMailtrapDelivery(req: Request, store: IStoreAdapter): Promise<Response>;
 
@@ -104,7 +105,7 @@ declare class EmailChannel implements ICourierChannel {
     readonly name = "email";
     private transport;
     constructor(config: IEmailChannelConfig);
-    send(message: ICourierMessage, template: IRenderedTemplate): Promise<void>;
+    send(message: ICourierMessage, template: IRenderedTemplate): Promise<ISendResult | void>;
     private sendViaResend;
     private sendViaSMTP;
 }

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { IFonderieModule, IReadinessProblem, IFonderieApp, Middleware } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { DefaultTemplateMap, ITemplateResolver, ICourierChannel, IRenderedTemplate } from './types.js';
+import { DefaultTemplateMap, ITemplateResolver, ICourierChannel, IRenderedTemplate, ISendResult } from './types.js';
 export { IMessageLog, MessageLogStatus } from './types.js';
 import { ICourierMessage, IDefaultTemplate } from '@fonderie/core/types';
 export { ICourierMessage, IDefaultTemplate } from '@fonderie/core/types';
@@ -51,6 +51,7 @@ interface ICourierConfig {
             sendgrid?: string;
             mailgun?: string;
         };
+        allowUnverifiedMailtrap?: boolean;
     };
 }
 
@@ -78,7 +79,7 @@ declare class CourierModule implements IFonderieModule {
 
 declare function validateCourierConfig(config: ICourierConfig, registeredChannels: Iterable<string>): void;
 
-declare function handleSendGridDelivery(req: Request, store: IStoreAdapter, webhookSecret?: string): Promise<Response>;
+declare function handleSendGridDelivery(req: Request, store: IStoreAdapter, publicKey?: string): Promise<Response>;
 declare function handleMailgunDelivery(req: Request, store: IStoreAdapter, signingKey?: string): Promise<Response>;
 declare function handleMailtrapDelivery(req: Request, store: IStoreAdapter): Promise<Response>;
 
@@ -104,7 +105,7 @@ declare class EmailChannel implements ICourierChannel {
     readonly name = "email";
     private transport;
     constructor(config: IEmailChannelConfig);
-    send(message: ICourierMessage, template: IRenderedTemplate): Promise<void>;
+    send(message: ICourierMessage, template: IRenderedTemplate): Promise<ISendResult | void>;
     private sendViaResend;
     private sendViaSMTP;
 }

package/dist/index.js

@@ -19,6 +19,14 @@ async function insertMessageLog(entry, store) {
   );
   return row?.id ?? "";
 }
+async function setMessageProviderId(id, providerMessageId, store) {
+  await store.query(
+    `UPDATE fonderie_message_log
+		 SET provider_message_id = $2
+		 WHERE id = $1`,
+    [id, providerMessageId]
+  );
+}
 async function markMessageSent(id, store) {
   await store.query(
     `UPDATE fonderie_message_log
@@ -116,8 +124,13 @@ var Dispatcher = class {
         if (message.locale) logEntry.locale = message.locale;
         const logId = this.store ? await insertMessageLog(logEntry, this.store).catch(() => "") : "";
         try {
-          await channel.send(message, template);
+          const result = await channel.send(message, template);
           if (this.store && logId) {
+            if (result?.providerMessageId) {
+              await setMessageProviderId(logId, result.providerMessageId, this.store).catch(
+                () => void 0
+              );
+            }
             markMessageSent(logId, this.store).catch(() => void 0);
           }
         } catch (err) {
@@ -264,12 +277,12 @@ var EmailChannel = class {
       return;
     }
     if (this.config.provider === "resend") {
-      await this.sendViaResend(to, template);
-    } else if (this.config.provider === "smtp") {
-      await this.sendViaSMTP(to, template);
-    } else {
-      console.warn(`[courier:email] provider ${this.config.provider} not implemented`);
+      return this.sendViaResend(to, template);
     }
+    if (this.config.provider === "smtp") {
+      return this.sendViaSMTP(to, template);
+    }
+    console.warn(`[courier:email] provider ${this.config.provider} not implemented`);
   }
   async sendViaResend(to, template) {
     if (!this.config.apiKey) {
@@ -293,18 +306,23 @@ var EmailChannel = class {
       const body2 = await res.text();
       throw new Error(`[courier:email] Resend error ${res.status}: ${body2}`);
     }
+    const data = await res.json().catch(() => null);
+    return typeof data?.id === "string" ? { providerMessageId: data.id } : {};
   }
   async sendViaSMTP(to, template) {
     if (!this.transport) {
       throw new Error("SMTP transport not initialised \u2014 check smtp config");
     }
-    await this.transport.sendMail({
+    const info = await this.transport.sendMail({
       from: this.config.from,
       to,
       subject: template.subject ?? "(no subject)",
       text: template.text,
       ...template.html !== void 0 ? { html: template.html } : {}
     });
+    const raw = typeof info?.messageId === "string" ? info.messageId : "";
+    const providerMessageId = raw.replace(/^<|>$/g, "");
+    return providerMessageId ? { providerMessageId } : {};
   }
 };
 
@@ -589,31 +607,36 @@ function validateCourierConfig(config, registeredChannels) {
 }
 
 // src/delivery.ts
-import { createHmac } from "crypto";
+import { createHmac, createPublicKey, verify as cryptoVerify } from "crypto";
 import { constantTimeEqual } from "@fonderie/core";
-async function handleSendGridDelivery(req, store, webhookSecret) {
-  if (webhookSecret) {
-    const sig = req.headers.get("x-twilio-email-event-webhook-signature") ?? "";
-    const ts = req.headers.get("x-twilio-email-event-webhook-timestamp") ?? "";
-    const body2 = await req.text();
-    if (!verifySendGridSignature(webhookSecret, ts, body2, sig)) {
-      return Response.json({ error: "INVALID_SIGNATURE" }, { status: 401 });
-    }
-    const events2 = parseJson(body2);
-    if (!Array.isArray(events2)) return Response.json({ ok: true });
-    await processSendGridEvents(events2, store);
-    return Response.json({ ok: true });
+async function handleSendGridDelivery(req, store, publicKey) {
+  if (!publicKey) {
+    return Response.json({ error: "VERIFICATION_NOT_CONFIGURED" }, { status: 401 });
   }
-  const events = await req.json();
+  const sig = req.headers.get("x-twilio-email-event-webhook-signature") ?? "";
+  const ts = req.headers.get("x-twilio-email-event-webhook-timestamp") ?? "";
+  const body2 = await req.text();
+  if (!verifySendGridSignature(publicKey, ts, body2, sig)) {
+    return Response.json({ error: "INVALID_SIGNATURE" }, { status: 401 });
+  }
+  const events = parseJson(body2);
   if (!Array.isArray(events)) return Response.json({ ok: true });
   await processSendGridEvents(events, store);
   return Response.json({ ok: true });
 }
-function verifySendGridSignature(secret, timestamp, body2, signature) {
+function verifySendGridSignature(publicKeyB64, timestamp, body2, signature) {
   try {
-    const payload = timestamp + body2;
-    const expected = createHmac("sha256", secret).update(payload).digest("base64");
-    return constantTimeEqual(Buffer.from(signature, "base64"), Buffer.from(expected, "base64"));
+    const key = createPublicKey({
+      key: Buffer.from(publicKeyB64, "base64"),
+      format: "der",
+      type: "spki"
+    });
+    return cryptoVerify(
+      "sha256",
+      Buffer.from(timestamp + body2),
+      key,
+      Buffer.from(signature, "base64")
+    );
   } catch {
     return false;
   }
@@ -642,12 +665,13 @@ async function processSendGridEvents(events, store) {
   }
 }
 async function handleMailgunDelivery(req, store, signingKey) {
+  if (!signingKey) {
+    return Response.json({ error: "VERIFICATION_NOT_CONFIGURED" }, { status: 401 });
+  }
   const body2 = await req.json();
-  if (signingKey) {
-    const { signature } = body2;
-    if (!signature || !verifyMailgunSignature(signingKey, signature.timestamp, signature.token, signature.signature)) {
-      return Response.json({ error: "INVALID_SIGNATURE" }, { status: 401 });
-    }
+  const { signature } = body2;
+  if (!signature || !verifyMailgunSignature(signingKey, signature.timestamp, signature.token, signature.signature)) {
+    return Response.json({ error: "INVALID_SIGNATURE" }, { status: 401 });
   }
   const event = body2["event-data"];
   if (event) {
@@ -892,22 +916,29 @@ var CourierModule = class {
   install(app) {
     validateCourierConfig(this.config, this.dispatcher.channelNames());
     const store = this.store;
-    const signingKeys = this.config.delivery?.signingKeys;
-    app.addRoute(
-      "POST",
-      "/courier/delivery/sendgrid",
-      (ctx) => handleSendGridDelivery(ctx.request, store, signingKeys?.sendgrid)
-    );
-    app.addRoute(
-      "POST",
-      "/courier/delivery/mailgun",
-      (ctx) => handleMailgunDelivery(ctx.request, store, signingKeys?.mailgun)
-    );
-    app.addRoute(
-      "POST",
-      "/courier/delivery/mailtrap",
-      (ctx) => handleMailtrapDelivery(ctx.request, store)
-    );
+    const delivery = this.config.delivery;
+    const signingKeys = delivery?.signingKeys;
+    if (signingKeys?.sendgrid) {
+      app.addRoute(
+        "POST",
+        "/courier/delivery/sendgrid",
+        (ctx) => handleSendGridDelivery(ctx.request, store, signingKeys.sendgrid)
+      );
+    }
+    if (signingKeys?.mailgun) {
+      app.addRoute(
+        "POST",
+        "/courier/delivery/mailgun",
+        (ctx) => handleMailgunDelivery(ctx.request, store, signingKeys.mailgun)
+      );
+    }
+    if (delivery?.allowUnverifiedMailtrap) {
+      app.addRoute(
+        "POST",
+        "/courier/delivery/mailtrap",
+        (ctx) => handleMailtrapDelivery(ctx.request, store)
+      );
+    }
     if (this.config.adminToken) {
       if (!store) {
         throw new Error("[courier] adminToken requires @fonderie/store (db templates)");