@hartl-services/medusa-base 2.7.0 → 2.9.0

package/README.md

@@ -50,7 +50,7 @@ packing lists) and S3 file storage, and the turnkey `medusa-config.ts` preset
   `@hartl-services/medusa-base/config` and Sentry's `register()` from
   `@hartl-services/medusa-base/instrumentation` (see "Config helpers" and
   "Sentry instrumentation").
-- Sends the shop's transactional e-mails over SMTP (module `email`, see
+- Sends the shop's transactional e-mails over SMTP or Microsoft 365, chosen in the Admin (module `email`, see
   "E-Mail"), issues invoices, cancellation documents and packing lists as
   private PDFs (module `documents`, see "Dokumente") and stores files in
   S3-compatible storage behind the `/files` gateway (see "Dateispeicher (S3)").
@@ -234,13 +234,18 @@ All optional; the Admin response always carries them (`null`, `[]` or
   unchanged, e.g. by the plugin switch of a switchable plugin). The Admin locks
   the switch of the last enabled top-level feature with a hint. The Admin DTO
   field is `require_enabled_feature: boolean` (`false` when not declared).
-- `setting_groups`: `{ name, description?, note?, requires_feature? }` per
+- `setting_groups`: `{ name, description?, note?, requires_feature?, visible_when? }` per
   settings group. `name` equals the `group` of at least one setting and is
   unique; `requires_feature` is a declared feature key, the Admin dims the group
   (still editable) while that feature is not effectively enabled.
+  `visible_when: { setting, equals }` names a `select` or `boolean` setting
+  outside the group and one of its values: the group applies only while that
+  setting has the value. The Admin hides it otherwise (by the form's current
+  value), and its required settings do not count as `missing`; stored values
+  are kept. The Admin DTO carries `visible_when` or `null`.
 - Per setting: `hint` (short text under the field, shown instead of
   `description`), `placeholder` (not for `boolean`, `select`, `image`,
-  `color`), `width` (`"full"` default or `"half"`: consecutive half settings
+  `color`, `date`), `width` (`"full"` default or `"half"`: consecutive half settings
   share a two-column row; not for `boolean`) and `section` (sub-heading inside
   the group, shared by consecutive settings with the same value).
 
@@ -338,7 +343,7 @@ in-memory copy of the toggle (see "Kontobestätigung per E-Mail").
 
 Configuration a plugin reads at RUN time (for example an external system's
 URL and API key) is declared in the descriptor and edited on the plugin's
-Admin page. Boot-time provider configuration (SMTP, S3, Sentry, Redis) and
+Admin page. Boot-time provider configuration (S3, Sentry, Redis) and
 function-valued options stay in `medusa-config.ts`.
 
 ```ts
@@ -383,7 +388,8 @@ class DemoModuleService extends MedusaService({ /* models */ }) {
   through Medusa's `/admin/uploads` into the public File Module storage and
   previews; replacing or removing it leaves the old file in storage), `color`
   (a hex color `#rrggbb`, stored lowercase; the Admin shows a hex field with a
-  color picker and checks the format before saving). An optional `group`
+  color picker and checks the format before saving), `date` (a calendar day
+  `YYYY-MM-DD`; the Admin shows `AdminDatePicker`). An optional `group`
   (non-empty text) is a section heading: the Admin starts a new section with
   that heading whenever the group changes from one setting to the next. Keys
   follow the feature key format and are unique. A `secret` has no default;
@@ -394,8 +400,8 @@ class DemoModuleService extends MedusaService({ /* models */ }) {
   `api_url` so a stored key is never sent to a new host. `definePluginFeatures`
   throws at import time otherwise (also for an `invalidates` entry that is not
   a secret of the plugin). The Admin renders a `select` as a dropdown, gives
-  number inputs their bounds and shows "Beim Ändern muss … neu eingegeben
-  werden" under a setting with `invalidates`.
+  number inputs their bounds and shows "Wird gelöscht, wenn … sich ändert"
+  under each secret named in an `invalidates`.
 - Precedence per key: stored in the Admin > `pluginSettingsFallback`
   (medusa-config) > declared default > not set. A value that does not fit the
   declared type is skipped. A plugin is `configured` when every required
@@ -1326,7 +1332,7 @@ have no dependency on Medusa; the subpath does not load `@sentry/node`.
 | `resolvePublicOrigin(value, name, allowHttp)`, `shopUrl(origin, path)` | Validate a bare HTTP(S) origin; build an absolute URL that cannot leave the origin |
 | `resolveStripe(values)` | Checks the `sk_` key and the `whsec_` webhook secret |
 | `resolveRedisEventBus(environment, phase)` | `{ url } \| undefined`: optional in development, required at runtime elsewhere, never used in a build, authenticated `rediss://` in production |
-| `createSmtpNotificationModuleConfig`, `resolveSmtp`, `SMTP_ENVIRONMENT_VARIABLES`, `SMTP_BUILD_PLACEHOLDERS`, `defineShopEmailConfiguration` | SMTP notification provider and E-Mail configuration (see "E-Mail") |
+| `createEmailNotificationModuleConfig`, `defineShopEmailConfiguration` (deprecated: `createSmtpNotificationModuleConfig`, `resolveSmtp`, `SMTP_ENVIRONMENT_VARIABLES`, `SMTP_BUILD_PLACEHOLDERS`) | Mail notification provider and E-Mail configuration (see "E-Mail") |
 | `createS3CacheStorageConfig`, `createS3CacheFileModuleConfig`, `resolveS3Credentials`, `resolveExpirationStrategy`, `S3_BUILD_PLACEHOLDERS` | S3 file storage (see "Dateispeicher (S3)") |
 | `createDefaultDocumentHtmlFactory`, `DOCUMENTS_BUILD_PLACEHOLDERS` | Documents markup and build placeholder (see "Dokumente") |
 
@@ -1373,36 +1379,32 @@ this export (or `sentry-logger`) lists `@sentry/node` in its own
 ## E-Mail
 
 The base owns transactional e-mail for the shop: logical email messages,
-attempts, rendering, the Medusa Notification integration, SMTP transport,
-retries and e-mail-specific Admin operations. It is the `email` module, its
-SMTP notification provider (`providers/smtp`), its subscribers, jobs and
+attempts, rendering, the Medusa Notification integration, the SMTP and
+Microsoft 365 transports, retries and e-mail-specific Admin operations. It is
+the `email` module, its notification provider (`providers/smtp`, id `smtp`),
+its subscribers, jobs and
 workflows, and the Admin page `/settings/hartl-services/email`. There is no
 separate e-mail package since 1.0.0.
 
 ### Configuration
 
-The SMTP notification provider is a `modules` entry built by
-`createSmtpNotificationModuleConfig` (from
-`@hartl-services/medusa-base/config`); the branding and rendering
+The notification provider is a `modules` entry built by
+`createEmailNotificationModuleConfig` (from
+`@hartl-services/medusa-base/config`); which service it sends through and the
+credentials are set in the Admin (see "Versand"). The branding and rendering
 configuration goes into the `email` namespace of the base options:
 
 ```ts
-import {
-  createSmtpNotificationModuleConfig,
-  resolveSmtp,
-  SMTP_ENVIRONMENT_VARIABLES,
-} from "@hartl-services/medusa-base/config";
-
-// Validates the seven SMTP_* variables (see "SMTP environment helpers").
-const smtp = resolveSmtp(
-  Object.fromEntries(
-    SMTP_ENVIRONMENT_VARIABLES.map((name) => [name, process.env[name] ?? ""]),
-  ) as Record<(typeof SMTP_ENVIRONMENT_VARIABLES)[number], string>,
-  process.env.NODE_ENV === "development" || process.env.NODE_ENV === "test",
-);
+import { createEmailNotificationModuleConfig } from "@hartl-services/medusa-base/config";
 
 export default defineConfig({
-  modules: [createSmtpNotificationModuleConfig(smtp)],
+  modules: [
+    createEmailNotificationModuleConfig({
+      // Permits "Verschlüsselung: Keine" (a local SMTP server); never in production.
+      allowInsecure:
+        process.env.NODE_ENV === "development" || process.env.NODE_ENV === "test",
+    }),
+  ],
   plugins: [
     {
       resolve: "@hartl-services/medusa-base",
@@ -1456,24 +1458,73 @@ affiliate-reminder and partner-application e-mails come from
 `@hartl-services/medusa-food-supplements-contracts/events/documents` and
 `/events/affiliate`, so installing the base does not pull in Affiliate.
 
-Environment variables (all seven required outside development/test; at least
-one of `SMTP_SECURE`/`SMTP_REQUIRE_TLS` must be `true` outside
-development/test):
-
-```text
-SMTP_HOST=
-SMTP_PORT=
-SMTP_SECURE=
-SMTP_REQUIRE_TLS=
-SMTP_USER=
-SMTP_PASSWORD=
-SMTP_FROM=
-```
+The provider reads no environment variables (since 2.9.0; the former
+`SMTP_*` variables are ignored).
 
 Set `REDIS_URL` to use `@medusajs/event-bus-redis` instead of Medusa's local
 Event Bus; production requires an authenticated `rediss://` URL. See "Event
 Bus" below for retry/backoff behavior.
 
+### Versand
+
+The page E-Mail → "Versand" (`/settings/hartl-services/email/delivery`, linked
+under "Verwaltung") edits the plugin's settings. It stays reachable while the
+E-Mail plugin is off, because the login-code mail is still sent then.
+
+| Key | Type | Required |
+|---|---|---|
+| `provider` (Versand über, group "Anbieter") | select `smtp` \| `microsoft365` | yes |
+| `smtp_host`, `smtp_port` (default 587), `smtp_security` (`starttls` default, `tls`, `none`), `smtp_from` (Absender, `Name <address>` allowed) | string / number / select / string | yes, while SMTP |
+| `smtp_user`, `smtp_password` (secret) | string / secret | no (no login without a user) |
+| `microsoft_tenant_id`, `microsoft_client_id`, `microsoft_client_secret` (secret), `microsoft_client_secret_expires_on` (date), `microsoft_mailbox` (Postfach) | string / secret / date | yes, while Microsoft 365 |
+
+The groups "SMTP" and "Microsoft 365" are shown and required only for the
+selected provider (`visible_when`). Changing the host deletes the SMTP
+password; changing tenant or client id deletes the client secret.
+
+The provider reads the settings on every send, never at boot; a shop without
+them boots and its mails fail as `not_configured` (retried like a connection
+failure, then `failed`; a log warning names the missing keys). `none`
+encryption is accepted only with `allowInsecure`. A rejected login (SMTP
+`EAUTH`, a Graph token or 401/403 error) is `auth_failed` and not retried.
+The test mail of the template editor shows both as their own message.
+
+**Microsoft 365** sends with Microsoft Graph `POST /users/{mailbox}/sendMail`
+and an app-only token (client credentials, cached in memory per tenant,
+client and secret). Graph has one body, so the mail goes out as HTML; it is
+saved to the mailbox's Sent Items. A request above 4 MB (large PDF
+attachments) fails as `invalid_content`. 429 and 5xx are temporary, other 4xx
+permanent. Setup:
+
+1. Microsoft Entra admin center → App registrations → New registration
+   (single tenant, no redirect URI). Note the Application (client) ID and
+   Directory (tenant) ID.
+2. Certificates & secrets → New client secret (at most 24 months); copy the
+   value and its expiry date.
+3. Do **not** grant the Graph application permission `Mail.Send` in Entra: it
+   would allow sending as every mailbox. Grant it in Exchange Online, limited
+   to the shop's mailbox (RBAC for Applications), in Exchange Online
+   PowerShell:
+
+   ```powershell
+   New-ServicePrincipal -AppId <client-id> -ObjectId <enterprise-app-object-id> -DisplayName "Shop Mail"
+   New-ManagementScope -Name "Shop Mailbox" -RecipientRestrictionFilter "PrimarySmtpAddress -eq 'shop@example.com'"
+   New-ManagementRoleAssignment -App <client-id> -Role "Application Mail.Send" -CustomResourceScope "Shop Mailbox"
+   ```
+
+   (`<enterprise-app-object-id>` is the object id under Enterprise
+   applications, not the one of the app registration.)
+4. In the Admin: E-Mail → Versand → Anbieter "Microsoft 365", enter tenant
+   id, client id, secret, its expiry date and the mailbox; send a test mail
+   from a template.
+
+Seven days before "Secret gültig bis" (shop time zone) the daily job
+`email-credential-expiry` (07:00 server time, while the E-Mail plugin is on
+and Microsoft 365 is selected) sends the mail `system.credential_expiry.admin`
+to the e-mail of the Shop-Stammdaten, once per client id and expiry date (a
+log warning when the Shop-Stammdaten have no e-mail). A new secret with a new
+date warns again.
+
 ### Feature toggles
 
 The E-Mail module declares its toggles to `@hartl-services/medusa-base` under the
@@ -1996,30 +2047,14 @@ configuration (blank `displayName`, a non-function `layout` or renderer, an
 unknown renderer kind) fails at startup and not at the first send. Custom
 renderers must escape dynamic values in `bodyHtml` themselves.
 
-### SMTP environment helpers
-
-`@hartl-services/medusa-base/config` exports helpers for the SMTP
-deployment variables:
-
-- `SMTP_ENVIRONMENT_VARIABLES` — the seven variable names.
-- `SMTP_BUILD_PLACEHOLDERS` — placeholder values for all seven variables so
-  `medusa build` can load `medusa-config.ts` without deployment secrets. Use
-  them only while building.
-- `resolveSmtp(values, allowInsecure)` — validates the values and returns the
-  `ResolvedSmtpConfiguration` for `createSmtpNotificationModuleConfig`. It
-  rejects a port outside 1–65535, a non-`"true"`/`"false"` boolean and an
-  invalid `SMTP_FROM`. `allowInsecure` permits plain SMTP (development, test,
-  build); otherwise `SMTP_SECURE` or `SMTP_REQUIRE_TLS` must be `true`.
-
-Runtime requires `SMTP_HOST`, `SMTP_PORT`, `SMTP_SECURE`, `SMTP_REQUIRE_TLS`,
-`SMTP_USER`, `SMTP_PASSWORD`, and `SMTP_FROM`. `SMTP_FROM` is a bare address
-or carries the sender's display name: `Example GmbH <info@example.com>` (quote
-the value in a `.env` file). `SMTP_SECURE=true` selects
-implicit TLS; `SMTP_REQUIRE_TLS=true` requires STARTTLS. Outside development
-and test, at least one must be true. Certificate verification is never
-disabled. Development and test may set both to `false` for an isolated local
-SMTP server. SMTP endpoints and credentials never belong in the shop
-configuration.
+### Deprecated SMTP helpers
+
+`createSmtpNotificationModuleConfig(smtp)`, `resolveSmtp`,
+`SMTP_ENVIRONMENT_VARIABLES` and `SMTP_BUILD_PLACEHOLDERS` remain exported
+for shops that still read `SMTP_*` in their `medusa-config.ts`. The values
+given to `createSmtpNotificationModuleConfig` only fill SMTP settings that are
+not stored in the Admin (the Admin status does not count them as configured).
+Use `createEmailNotificationModuleConfig` and the "Versand" page instead.
 
 ### Delivery Semantics
 

package/dist/customer-auth/plugin-features.js

@@ -7,32 +7,32 @@ const PASSWORD_RULES = "Passwort-Regeln";
 exports.customerAuthPluginFeatures = (0, descriptor_1.definePluginFeatures)({
     plugin_key: customer_auth_1.CUSTOMER_AUTH_PLUGIN_KEY,
     label: "Kunden-Login",
-    description: "Welche Anmeldemethoden Kunden im Shop nutzen können. Mindestens eine Methode muss eingeschaltet bleiben, sonst kann sich niemand mehr anmelden; Admin-Benutzer melden sich unabhängig davon mit E-Mail und Passwort an. Eine Änderung wirkt innerhalb von etwa 30 Sekunden im Backend, die Storefront übernimmt sie nach ihrem Zwischenspeicher (etwa eine Minute). Die Passwort-Regeln gelten nur für Kunden, solange „E-Mail + Passwort“ eingeschaltet ist; Admin-Benutzer behalten mindestens 15 Zeichen, die bei der ersten Anmeldung eines noch nicht angelegten Admin-Benutzers (Einladung) geprüft werden.",
+    description: "Wie sich Kunden anmelden. Mindestens eine Methode bleibt eingeschaltet; Admin-Benutzer melden sich immer mit E-Mail und Passwort an.",
     summary: "Anmeldemethoden und Passwort-Regeln für Kunden.",
     icon: "ShieldCheck",
     switchable: false,
     features_heading: "Anmeldemethoden",
-    features_note: "Wirkt nach ca. 30 Sekunden im Backend, in der Storefront nach ca. 1 Minute.",
+    features_note: "Wirkt nach ca. 1 Minute.",
     all_off_warning: "Keine Methode eingeschaltet: Kunden können sich nicht mehr anmelden.",
     require_enabled_feature: true,
     features: [
         {
             key: customer_auth_1.CUSTOMER_AUTH_FEATURES.emailPassword,
             label: "E-Mail + Passwort",
-            description: "Anmeldung, Registrierung und Passwort-Zurücksetzen. Aus: Das Backend lehnt diese Wege für Kunden ab; bestehende Konten melden sich dann nur noch mit den anderen eingeschalteten Methoden an.",
+            description: "Anmeldung, Registrierung und Passwort zurücksetzen.",
             default_enabled: true,
         },
         {
             key: customer_auth_1.CUSTOMER_AUTH_FEATURES.emailOtp,
             label: "Anmeldecode per E-Mail",
-            description: "Kunden fordern einen sechsstelligen Code an, der 10 Minuten gültig ist, und melden sich damit an; für neue Adressen entsteht dabei ein Kundenkonto. Ein bestehendes Passwort-Konto derselben Adresse wird nur verknüpft, wenn die Passwort-Anmeldung aus ist oder die Adresse bestätigt wurde. Die Code-Mail geht unabhängig von den Schaltern des E-Mail-Plugins hinaus. Aus: Code-Anfrage und Code-Anmeldung sind nicht möglich.",
+            description: "Anmeldung mit einem 6-stelligen Code per E-Mail; für neue Adressen entsteht ein Konto.",
             default_enabled: false,
         },
     ],
     setting_groups: [
         {
             name: PASSWORD_RULES,
-            description: "Gelten nur für Kunden mit „E-Mail + Passwort“, bei Registrierung und Passwort-Zurücksetzen. Admin-Benutzer behalten mindestens 15 Zeichen.",
+            description: "Für Kunden mit „E-Mail + Passwort“. Admin-Benutzer: mindestens 15 Zeichen.",
             requires_feature: customer_auth_1.CUSTOMER_AUTH_FEATURES.emailPassword,
         },
     ],
@@ -40,8 +40,8 @@ exports.customerAuthPluginFeatures = (0, descriptor_1.definePluginFeatures)({
         {
             key: "password_min_length",
             label: "Mindestlänge",
-            description: "Wie viele Zeichen ein Kundenpasswort mindestens haben muss (8 bis 128). NIST SP 800-63B Rev. 4, die US-Richtlinie für digitale Identität, empfiehlt mindestens 15 Zeichen, wenn das Passwort der einzige Faktor ist. Die Regeln gelten nur, solange „E-Mail + Passwort“ eingeschaltet ist, und nur für Kunden; Admin-Benutzer behalten mindestens 15 Zeichen. Bestehende Passwörter bleiben gültig, die Regeln greifen bei Registrierung und Passwort-Zurücksetzen. Grenze: Wer sich über den Admin-Weg registriert, kann 15 Zeichen ohne Zusammensetzungsregeln wählen, auch wenn der Shop mehr verlangt; das schwächt nur das eigene Passwort.",
-            hint: "8 bis 128 Zeichen. Empfohlen: mindestens 15 (NIST SP 800-63B).",
+            description: "Gilt bei Registrierung und Passwort-Zurücksetzen; bestehende Passwörter bleiben gültig.",
+            hint: "8 bis 128 Zeichen. Empfohlen: 15 (NIST SP 800-63B).",
             group: PASSWORD_RULES,
             width: "half",
             type: "number",
@@ -54,7 +54,7 @@ exports.customerAuthPluginFeatures = (0, descriptor_1.definePluginFeatures)({
             key: "password_require_mixed_case",
             label: "Groß- und Kleinbuchstaben verlangen",
             description: "Mindestens ein Groß- und ein Kleinbuchstabe.",
-            hint: "NIST rät von Zusammensetzungsregeln ab: Sie führen zu vorhersehbaren Passwörtern wie „Passwort1!“. Länge schützt besser.",
+            hint: "NIST rät von Zeichenregeln ab, Länge schützt besser.",
             group: PASSWORD_RULES,
             type: "boolean",
             default: false,
@@ -70,7 +70,7 @@ exports.customerAuthPluginFeatures = (0, descriptor_1.definePluginFeatures)({
         {
             key: "password_require_symbol",
             label: "Sonderzeichen verlangen",
-            description: "Mindestens ein Sonderzeichen (kein Buchstabe, keine Ziffer, kein Leerzeichen).",
+            description: "Mindestens ein Sonderzeichen.",
             group: PASSWORD_RULES,
             type: "boolean",
             default: false,

package/dist/email/config/index.d.ts

@@ -1,15 +1,20 @@
 import type { ResolvedSmtpConfiguration, ShopEmailConfiguration } from "../types";
-export { createSmtpNotificationModuleConfig } from "./notification-module";
+export { createEmailNotificationModuleConfig, createSmtpNotificationModuleConfig, } from "./notification-module";
 export declare const defineShopEmailConfiguration: <Configuration extends ShopEmailConfiguration>(configuration: Configuration) => Configuration;
 export type { ResolvedSmtpConfiguration, ShopEmailConfiguration, } from "../types";
+/** @deprecated The provider is set in the Admin (E-Mail > Versand). */
 export declare const SMTP_ENVIRONMENT_VARIABLES: readonly ["SMTP_HOST", "SMTP_PORT", "SMTP_SECURE", "SMTP_USER", "SMTP_PASSWORD", "SMTP_FROM", "SMTP_REQUIRE_TLS"];
 /**
+ * @deprecated The provider is set in the Admin (E-Mail > Versand).
+ *
  * `medusa build` loads the configuration without deployment secrets. These
  * placeholders only satisfy the required-variable checks of a build; they
  * never reach a running server.
  */
 export declare const SMTP_BUILD_PLACEHOLDERS: Readonly<Record<string, string>>;
 /**
+ * @deprecated The provider is set in the Admin (E-Mail > Versand).
+ *
  * Validates the SMTP environment values and returns the transport
  * configuration. `allowInsecure` permits plain SMTP for development, tests
  * and builds; otherwise `SMTP_SECURE` or `SMTP_REQUIRE_TLS` must be `true`.

package/dist/email/config/index.js

@@ -1,12 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveSmtp = exports.SMTP_BUILD_PLACEHOLDERS = exports.SMTP_ENVIRONMENT_VARIABLES = exports.defineShopEmailConfiguration = exports.createSmtpNotificationModuleConfig = void 0;
+exports.resolveSmtp = exports.SMTP_BUILD_PLACEHOLDERS = exports.SMTP_ENVIRONMENT_VARIABLES = exports.defineShopEmailConfiguration = exports.createSmtpNotificationModuleConfig = exports.createEmailNotificationModuleConfig = void 0;
 const config_1 = require("../../public/config");
 const sender_1 = require("../domain/sender");
 var notification_module_1 = require("./notification-module");
+Object.defineProperty(exports, "createEmailNotificationModuleConfig", { enumerable: true, get: function () { return notification_module_1.createEmailNotificationModuleConfig; } });
 Object.defineProperty(exports, "createSmtpNotificationModuleConfig", { enumerable: true, get: function () { return notification_module_1.createSmtpNotificationModuleConfig; } });
 const defineShopEmailConfiguration = (configuration) => configuration;
 exports.defineShopEmailConfiguration = defineShopEmailConfiguration;
+/** @deprecated The provider is set in the Admin (E-Mail > Versand). */
 exports.SMTP_ENVIRONMENT_VARIABLES = [
     "SMTP_HOST",
     "SMTP_PORT",
@@ -17,6 +19,8 @@ exports.SMTP_ENVIRONMENT_VARIABLES = [
     "SMTP_REQUIRE_TLS",
 ];
 /**
+ * @deprecated The provider is set in the Admin (E-Mail > Versand).
+ *
  * `medusa build` loads the configuration without deployment secrets. These
  * placeholders only satisfy the required-variable checks of a build; they
  * never reach a running server.
@@ -31,6 +35,8 @@ exports.SMTP_BUILD_PLACEHOLDERS = {
     SMTP_USER: "build-user",
 };
 /**
+ * @deprecated The provider is set in the Admin (E-Mail > Versand).
+ *
  * Validates the SMTP environment values and returns the transport
  * configuration. `allowInsecure` permits plain SMTP for development, tests
  * and builds; otherwise `SMTP_SECURE` or `SMTP_REQUIRE_TLS` must be `true`.

package/dist/email/config/notification-module.d.ts

@@ -1,4 +1,29 @@
 import type { ResolvedSmtpConfiguration } from "../types";
+/**
+ * The Notification Module with the shop's mail provider. Provider and
+ * credentials are set in the Admin (E-Mail > Versand); `allowInsecure`
+ * (development and tests only) permits SMTP without encryption there.
+ */
+export declare const createEmailNotificationModuleConfig: (options?: Readonly<{
+    allowInsecure?: boolean;
+}>) => {
+    resolve: string;
+    options: {
+        providers: {
+            id: string;
+            options: {
+                allowInsecure: boolean;
+                channels: string[];
+            };
+            resolve: string;
+        }[];
+    };
+};
+/**
+ * @deprecated Use `createEmailNotificationModuleConfig` and set the provider
+ * in the Admin (E-Mail > Versand). The SMTP values given here only fill the
+ * SMTP settings that are not stored in the Admin.
+ */
 export declare const createSmtpNotificationModuleConfig: (smtp: ResolvedSmtpConfiguration) => {
     resolve: string;
     options: {

package/dist/email/config/notification-module.js

@@ -1,6 +1,32 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createSmtpNotificationModuleConfig = void 0;
+exports.createSmtpNotificationModuleConfig = exports.createEmailNotificationModuleConfig = void 0;
+/**
+ * The Notification Module with the shop's mail provider. Provider and
+ * credentials are set in the Admin (E-Mail > Versand); `allowInsecure`
+ * (development and tests only) permits SMTP without encryption there.
+ */
+const createEmailNotificationModuleConfig = (options = {}) => ({
+    resolve: "@medusajs/medusa/notification",
+    options: {
+        providers: [
+            {
+                id: "smtp",
+                options: {
+                    allowInsecure: options.allowInsecure === true,
+                    channels: ["email"],
+                },
+                resolve: "@hartl-services/medusa-base/providers/smtp",
+            },
+        ],
+    },
+});
+exports.createEmailNotificationModuleConfig = createEmailNotificationModuleConfig;
+/**
+ * @deprecated Use `createEmailNotificationModuleConfig` and set the provider
+ * in the Admin (E-Mail > Versand). The SMTP values given here only fill the
+ * SMTP settings that are not stored in the Admin.
+ */
 const createSmtpNotificationModuleConfig = (smtp) => ({
     resolve: "@medusajs/medusa/notification",
     options: {

package/dist/email/types/email-kinds.d.ts

@@ -1,5 +1,5 @@
 import { z } from "@medusajs/framework/zod";
-export declare const EMAIL_KINDS: readonly ["order.received", "order.received.admin", "order.shipped", "order.canceled", "order.return_requested", "order.return_received", "order.refunded", "auth.password_reset", "affiliate.consignment_report_due", "affiliate.application_submitted.admin", "user.invite", "auth.verification", "auth.login_code"];
+export declare const EMAIL_KINDS: readonly ["order.received", "order.received.admin", "order.shipped", "order.canceled", "order.return_requested", "order.return_received", "order.refunded", "auth.password_reset", "affiliate.consignment_report_due", "affiliate.application_submitted.admin", "user.invite", "auth.verification", "auth.login_code", "system.credential_expiry.admin"];
 export declare const EmailKindSchema: z.ZodEnum<{
     "order.received": "order.received";
     "order.received.admin": "order.received.admin";
@@ -14,6 +14,7 @@ export declare const EmailKindSchema: z.ZodEnum<{
     "user.invite": "user.invite";
     "auth.verification": "auth.verification";
     "auth.login_code": "auth.login_code";
+    "system.credential_expiry.admin": "system.credential_expiry.admin";
 }>;
 export type EmailKind = (typeof EMAIL_KINDS)[number];
 /**

package/dist/email/types/email-kinds.js

@@ -16,6 +16,7 @@ exports.EMAIL_KINDS = [
     "user.invite",
     "auth.verification",
     "auth.login_code",
+    "system.credential_expiry.admin",
 ];
 exports.EmailKindSchema = zod_1.z.enum(exports.EMAIL_KINDS);
 /**

package/dist/email/types/template-data.d.ts

@@ -376,6 +376,11 @@ export declare const EmailPersistedDataSchemas: {
         locale: z.ZodNullable<z.ZodString>;
     }, z.core.$strict>;
     readonly "auth.login_code": z.ZodObject<{}, z.core.$strict>;
+    readonly "system.credential_expiry.admin": z.ZodObject<{
+        provider: z.ZodLiteral<"microsoft365">;
+        client_id: z.ZodString;
+        expires_on: z.ZodString;
+    }, z.core.$strict>;
 };
 export declare const EmailRenderDataSchemas: {
     readonly "auth.password_reset": z.ZodObject<{
@@ -619,6 +624,11 @@ export declare const EmailRenderDataSchemas: {
         company_name: z.ZodNullable<z.ZodString>;
         message: z.ZodNullable<z.ZodString>;
     }, z.core.$strict>;
+    readonly "system.credential_expiry.admin": z.ZodObject<{
+        provider: z.ZodLiteral<"microsoft365">;
+        client_id: z.ZodString;
+        expires_on: z.ZodString;
+    }, z.core.$strict>;
 };
 export type EmailPersistedDataMap = {
     readonly [Kind in EmailKind]: Readonly<z.infer<(typeof EmailPersistedDataSchemas)[Kind]>>;

package/dist/email/types/template-data.js

@@ -233,6 +233,13 @@ exports.EmailPersistedDataSchemas = {
         .strict(),
     // The code itself is never stored: it only exists in the render context.
     "auth.login_code": zod_1.z.object({}).strict(),
+    "system.credential_expiry.admin": zod_1.z
+        .object({
+        provider: zod_1.z.literal("microsoft365"),
+        client_id: NonEmptyStringSchema,
+        expires_on: affiliate_1.CalendarDateSchema,
+    })
+        .strict(),
 };
 exports.EmailRenderDataSchemas = {
     ...exports.EmailPersistedDataSchemas,

package/dist/public/descriptor.js

@@ -15,6 +15,7 @@ const SETTING_TYPES = new Set([
     "select",
     "image",
     "color",
+    "date",
 ]);
 const HEX_COLOR_PATTERN = /^#[0-9a-f]{6}$/;
 const ACTION_MODES = new Set(["sync", "background"]);
@@ -24,7 +25,7 @@ const ADMIN_PAGE_PATTERN = /^\/settings\/hartl-services(\/[a-z0-9][a-z0-9_-]*)+$
 const ICON_NAMES = new Set(plugin_icons_1.PLUGIN_ICON_NAMES);
 const SETTING_WIDTHS = new Set(["full", "half"]);
 /** Types an input placeholder makes no sense for. */
-const NO_PLACEHOLDER_TYPES = new Set(["boolean", "select", "image", "color"]);
+const NO_PLACEHOLDER_TYPES = new Set(["boolean", "select", "image", "color", "date"]);
 const invalid = (pluginKey, message) => new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, `Ungültige Funktionsschalter für Plugin "${pluginKey}": ${message}`);
 const defaultMatchesType = (setting) => {
     const value = setting.default;
@@ -36,6 +37,8 @@ const defaultMatchesType = (setting) => {
             return typeof value === "string" && (0, lib_1.isHttpUrl)(value);
         case "color":
             return typeof value === "string" && HEX_COLOR_PATTERN.test(value);
+        case "date":
+            return typeof value === "string" && (0, lib_1.isCalendarDate)(value);
         case "number":
             return (typeof value === "number" &&
                 Number.isFinite(value) &&
@@ -222,9 +225,26 @@ const validateAdminPage = (pluginKey, path) => {
         throw invalid(pluginKey, `admin_page "${String(path)}" muss unter "${ADMIN_PAGE_PREFIX}<plugin>" liegen und darf nicht mit "${BASE_PAGE_PREFIX}" beginnen.`);
     }
 };
+/**
+ * `visible_when` points at a select or boolean setting outside the group and
+ * `equals` is one of its possible values.
+ */
+const validateVisibleWhen = (pluginKey, groupName, condition, settings) => {
+    if (condition === undefined) {
+        return;
+    }
+    const { setting: key, equals } = (condition ?? {});
+    const target = settings.find((setting) => setting.key === key);
+    const fits = target?.type === "select"
+        ? (target.options ?? []).some((option) => option.value === equals)
+        : target?.type === "boolean" && typeof equals === "boolean";
+    if (!target || target.group === groupName || !fits) {
+        throw invalid(pluginKey, `Einstellungsgruppe "${groupName}": visible_when muss auf eine Auswahl oder einen Schalter außerhalb der Gruppe mit einem ihrer Werte zeigen.`);
+    }
+};
 /**
  * Metadata per settings group: unique names, each used by a setting's
- * `group`, `requires_feature` a declared feature key.
+ * `group`, `requires_feature` a declared feature key, `visible_when` valid.
  */
 const validateSettingGroups = (pluginKey, groups, settings, featureKeys) => {
     if (groups === undefined) {
@@ -255,6 +275,7 @@ const validateSettingGroups = (pluginKey, groups, settings, featureKeys) => {
             !featureKeys.has(group.requires_feature)) {
             throw invalid(pluginKey, `Einstellungsgruppe "${group.name}": requires_feature "${String(group.requires_feature)}" ist kein Feature dieses Plugins.`);
         }
+        validateVisibleWhen(pluginKey, group.name, group.visible_when, settings);
     }
 };
 /** Optional texts and icon of the plugin's Admin page. */

package/dist/public/types.d.ts

@@ -36,8 +36,9 @@ export type PluginFeatureDefinition<K extends string = string> = {
 /**
  * `image`: public http(s) URL of an image the Admin uploads (PNG/JPEG).
  * `color`: lowercase hex color `#rrggbb`.
+ * `date`: calendar day `YYYY-MM-DD`.
  */
-export type PluginSettingType = "string" | "url" | "number" | "boolean" | "secret" | "select" | "image" | "color";
+export type PluginSettingType = "string" | "url" | "number" | "boolean" | "secret" | "select" | "image" | "color" | "date";
 /** One allowed value of a `"select"` setting. */
 export type PluginSettingOption = {
     readonly value: string;
@@ -76,7 +77,7 @@ export type PluginSettingDefinition<S extends string = string> = {
      * Short text under the field; the Admin shows `hint ?? description`.
      */
     readonly hint?: string;
-    /** Input placeholder; not for boolean, select, image and color. */
+    /** Input placeholder; not for boolean, select, image, color and date. */
     readonly placeholder?: string;
     /**
      * `"half"`: consecutive half-width settings share one two-column row.
@@ -90,7 +91,7 @@ export type PluginSettingDefinition<S extends string = string> = {
     readonly section?: string;
 };
 /** Metadata of one settings group, keyed by the `group` name of its settings. */
-export type PluginSettingGroupDefinition<K extends string = string> = {
+export type PluginSettingGroupDefinition<K extends string = string, S extends string = string> = {
     /** Equals the `group` of at least one setting; unique per plugin. */
     readonly name: string;
     /** Explanatory text under the group heading. */
@@ -102,6 +103,15 @@ export type PluginSettingGroupDefinition<K extends string = string> = {
      * (still editable) while the feature is not effectively enabled.
      */
     readonly requires_feature?: K;
+    /**
+     * The group applies only while the select or boolean setting `setting`
+     * (of another group) resolves to `equals`. Otherwise the Admin hides it and
+     * its required settings do not count as missing; stored values are kept.
+     */
+    readonly visible_when?: {
+        readonly setting: S;
+        readonly equals: string | boolean;
+    };
 };
 export type PluginActionMode = "sync" | "background";
 export type PluginActionDefinition<A extends string = string> = {
@@ -161,7 +171,7 @@ export type PluginFeatureDescriptor<K extends string = string, S extends string
      */
     readonly require_enabled_feature?: true;
     /** Metadata for the groups used in `settings[].group`. */
-    readonly setting_groups?: readonly PluginSettingGroupDefinition<K>[];
+    readonly setting_groups?: readonly PluginSettingGroupDefinition<K, S>[];
 };
 /** Values a plugin received from medusa-config; the base shows them as source "config". */
 export type PluginSettingsFallback<S extends string = string> = Partial<Record<S, PluginSettingValue | null | undefined>>;

package/dist/shared/lib/dates.d.ts

@@ -10,3 +10,5 @@ export declare const toWireDate: (value: Date | string) => string;
 export declare const toOptionalWireDate: (value: Date | string | null | undefined) => string | null;
 /** Whether the value is an IANA time zone this runtime knows ("Europe/Vienna"). */
 export declare const isValidTimeZone: (value: unknown) => value is string;
+/** Whether the value is an existing calendar day written `yyyy-mm-dd`. */
+export declare const isCalendarDate: (value: unknown) => value is string;

package/dist/shared/lib/dates.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isValidTimeZone = exports.toOptionalWireDate = exports.toWireDate = exports.toIsoDate = exports.startOfUtcDate = exports.toValidDate = void 0;
+exports.isCalendarDate = exports.isValidTimeZone = exports.toOptionalWireDate = exports.toWireDate = exports.toIsoDate = exports.startOfUtcDate = exports.toValidDate = void 0;
 const utils_1 = require("@medusajs/framework/utils");
 /** A valid `Date`; throws `INVALID_DATA` for an unparsable value. */
 const toValidDate = (value, message = "Invalid date.") => {
@@ -40,3 +40,9 @@ const isValidTimeZone = (value) => {
     }
 };
 exports.isValidTimeZone = isValidTimeZone;
+/** Whether the value is an existing calendar day written `yyyy-mm-dd`. */
+const isCalendarDate = (value) => typeof value === "string" &&
+    /^\d{4}-\d{2}-\d{2}$/.test(value) &&
+    !Number.isNaN(Date.parse(`${value}T00:00:00Z`)) &&
+    new Date(`${value}T00:00:00Z`).toISOString().slice(0, 10) === value;
+exports.isCalendarDate = isCalendarDate;