@lenne.tech/nest-server 11.24.2 → 11.24.3

package/src/core/common/interfaces/server-options.interface.ts

@@ -10,7 +10,12 @@ import { MongoosePingCheckSettings } from '@nestjs/terminus/dist/health-indicato
 import { DiskHealthIndicatorOptions } from '@nestjs/terminus/dist/health-indicator/disk/disk-health-options.type';
 import compression from 'compression';
 import { CollationOptions } from 'mongodb';
+import type * as JSONTransport from 'nodemailer/lib/json-transport';
+import type * as SendmailTransport from 'nodemailer/lib/sendmail-transport';
+import type * as SESTransport from 'nodemailer/lib/ses-transport';
+import type * as SMTPPool from 'nodemailer/lib/smtp-pool';
 import * as SMTPTransport from 'nodemailer/lib/smtp-transport';
+import type * as StreamTransport from 'nodemailer/lib/stream-transport';
 
 import { Falsy } from '../types/falsy.type';
 import { IPermissions } from '../../modules/permissions/interfaces/permissions.interface';
@@ -24,6 +29,29 @@ import { MailjetOptions } from './mailjet-options.interface';
  */
 export type BetterAuthFieldType = 'boolean' | 'date' | 'json' | 'number' | 'number[]' | 'string' | 'string[]';
 
+/**
+ * All transport configurations accepted by `nodemailer.createTransport()`.
+ *
+ * Covers every built-in transport nodemailer ships with. `JSONTransport` is
+ * particularly useful in CI / e2e tests: `{ jsonTransport: true }` serializes
+ * outgoing mail to a JSON string and returns a valid response without any
+ * network I/O — no SMTP server, no credentials, no flakiness.
+ */
+export type MailTransportOptions =
+  | JSONTransport
+  | JSONTransport.Options
+  | SendmailTransport
+  | SendmailTransport.Options
+  | SESTransport
+  | SESTransport.Options
+  | SMTPPool
+  | SMTPPool.Options
+  | SMTPTransport
+  | SMTPTransport.Options
+  | StreamTransport
+  | StreamTransport.Options
+  | string;
+
 /**
  * Interface for Auth configuration
  *
@@ -1147,9 +1175,13 @@ export interface IServerOptions {
     passwordResetLink?: string;
 
     /**
-     * SMTP configuration for nodemailer
+     * Mail transport configuration for nodemailer.
+     *
+     * Accepts any transport type supported by `nodemailer.createTransport()`.
+     * See {@link MailTransportOptions} for the full list including
+     * `JSONTransport` / `{ jsonTransport: true }` for CI and e2e tests.
      */
-    smtp?: SMTPTransport | SMTPTransport.Options | string;
+    smtp?: MailTransportOptions;
 
     /**
      * Verification link for email

package/src/core/common/services/email.service.ts

@@ -1,11 +1,10 @@
-import type SMTPPool = require('nodemailer/lib/smtp-pool');
-
 import { createHash } from 'crypto';
 import { Injectable, OnModuleDestroy } from '@nestjs/common';
 import nodemailer = require('nodemailer');
 import { Attachment } from 'nodemailer/lib/mailer';
 
 import { isNonEmptyString, isTrue, returnFalse } from '../helpers/input.helper';
+import { MailTransportOptions } from '../interfaces/server-options.interface';
 import { ConfigService } from './config.service';
 import { TemplateService } from './template.service';
 
@@ -49,7 +48,7 @@ export class EmailService implements OnModuleDestroy {
       htmlTemplate?: string;
       senderEmail?: string;
       senderName?: string;
-      smtp?: SMTPPool | SMTPPool.Options;
+      smtp?: MailTransportOptions;
       templateData?: { [key: string]: any };
       text?: string;
       textTemplate?: string;
@@ -90,6 +89,21 @@ export class EmailService implements OnModuleDestroy {
       isNonEmptyString(html);
     }
 
+    // Guard: JSONTransport silently discards all mail — block in production / staging
+    // to prevent accidental misconfiguration that causes password-reset, 2FA, and
+    // verification emails to vanish without error.
+    // Uses truthy check (not strict === true) because nodemailer activates
+    // JSONTransport for any truthy value of options.jsonTransport.
+    const env = this.configService.getFastButReadOnly<string>('env');
+    if (env === 'production' || env === 'staging') {
+      if (typeof smtp === 'object' && smtp !== null && !!(smtp as Record<string, unknown>).jsonTransport) {
+        throw new Error(
+          'JSONTransport (jsonTransport: true) is not permitted in production/staging environments. ' +
+            'It silently discards all outgoing email. Check email.smtp in your config.',
+        );
+      }
+    }
+
     // Reuse transporter if SMTP config hasn't changed (avoids creating new connections per email)
     // Use hash instead of raw JSON to avoid keeping credentials as a string in memory
     const smtpKey = createHash('sha256').update(JSON.stringify(smtp)).digest('hex');