@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.10

package/dist/email/providers/smtp-email.provider.js

@@ -0,0 +1,285 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var SmtpEmailProvider_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SmtpEmailProvider = exports.SMTP_CREDENTIAL_PURPOSE = exports.SMTP_CREDENTIAL_NAME = void 0;
+const node_crypto_1 = require("node:crypto");
+const common_1 = require("@nestjs/common");
+const nodemailer = __importStar(require("nodemailer"));
+const index_1 = require("../../credentials/index");
+const base_email_provider_1 = require("../base-email.provider");
+const email_settings_service_1 = require("../email-settings.service");
+const email_options_1 = require("../email.options");
+const email_settings_schema_1 = require("../email-settings.schema");
+const smtp_credential_constants_1 = require("../smtp-credential.constants");
+// =============================================================================
+// SmtpEmailProvider (issue #122, epic #109)
+// =============================================================================
+//
+// The transport for everyone not on SES: a corporate relay, a Postfix box, a
+// third-party submission endpoint. Host, port, TLS flag and username are
+// ordinary settings (see email-settings.schema.ts).
+//
+// THE PASSWORD IS NOT A SETTING. It is read here, at the moment of use, from
+// the encrypted credential store built in #115 (epic #108). That store already
+// enforces the two properties this provider would otherwise have to reinvent:
+//
+//   * NO PLAINTEXT EGRESS -- `getSecret` is the only method that returns
+//     plaintext, and `describe`/`list` return a type with no field capable of
+//     holding a secret, so an admin screen physically cannot read it back.
+//   * BLANK PRESERVES -- an admin form renders the password field empty
+//     (the stored value is unreadable), so an empty submission means "keep
+//     what is stored" and can never mean "erase it". #124's form gets that
+//     behaviour for free by writing through `setSecret`.
+//
+// Reimplementing either of those here would mean a second, subtly different
+// copy of a security guarantee. Use the service.
+//
+// The transport is built LAZILY on send, never in the constructor: a fresh
+// install has no SMTP configuration, and an unconfigured mail server must not
+// prevent the API from starting.
+// =============================================================================
+// The credential store address moved to ../smtp-credential.constants.ts when
+// #124 added the WRITE side of the SMTP password to `EmailSettingsService`.
+// This provider injects that service, so importing the constants back out of
+// this file would make the two modules import each other — and under
+// `emitDecoratorMetadata` a cycle leaves `design:paramtypes` holding
+// `undefined`, which Nest reports as an unresolvable dependency at boot.
+//
+// Re-exported here so every existing import path (and the ../index.ts barrel)
+// keeps working, and so the address still reads as belonging to the transport
+// that consumes it.
+var smtp_credential_constants_2 = require("../smtp-credential.constants");
+Object.defineProperty(exports, "SMTP_CREDENTIAL_NAME", { enumerable: true, get: function () { return smtp_credential_constants_2.SMTP_CREDENTIAL_NAME; } });
+Object.defineProperty(exports, "SMTP_CREDENTIAL_PURPOSE", { enumerable: true, get: function () { return smtp_credential_constants_2.SMTP_CREDENTIAL_PURPOSE; } });
+/**
+ * Socket-level timeouts, in milliseconds.
+ *
+ * WITHOUT THESE THE NEVER-THROW CONTRACT IS TECHNICALLY HELD AND PRACTICALLY
+ * BROKEN. A firewalled SMTP port does not refuse a connection, it blackholes
+ * the SYN: nodemailer's default is to wait a very long time, and a caller in
+ * the middle of a business action would block on it. "Never throw" exists so a
+ * mail server cannot take a request down; a mail server that hangs the request
+ * for two minutes takes it down just as effectively. A bounded wait turns that
+ * into an ordinary `{ success: false, error: 'connection timeout' }`.
+ *
+ * Ten seconds each is generous for a relay that is actually alive, and short
+ * enough that #124's test button answers while the admin is still looking.
+ */
+const SMTP_CONNECTION_TIMEOUT_MS = 10_000;
+const SMTP_GREETING_TIMEOUT_MS = 10_000;
+const SMTP_SOCKET_TIMEOUT_MS = 20_000;
+/**
+ * The SMTP transport (nodemailer). Host, port, TLS and username from the
+ * settings, the password from the credential store; port 465 is implicit TLS.
+ *
+ * @stability experimental
+ */
+let SmtpEmailProvider = SmtpEmailProvider_1 = class SmtpEmailProvider extends base_email_provider_1.BaseEmailProvider {
+    emailSettings;
+    credentials;
+    logger = new common_1.Logger(SmtpEmailProvider_1.name);
+    transportName = 'SMTP';
+    /**
+     * Cached transporter and a fingerprint of the configuration that produced
+     * it.
+     *
+     * Cached because a transporter holds a connection pool; rebuilt whenever the
+     * fingerprint changes so an admin's edit -- including a password rotation --
+     * takes effect on the next send rather than at the next restart. A stale
+     * transporter after a password change is a confusing failure: the admin
+     * fixes the credential, the test button still reports "authentication
+     * failed", and nothing on screen explains why.
+     *
+     * THE FINGERPRINT IS A HASH, NOT THE VALUES. Keying on the password would
+     * park a plaintext copy on this instance for the life of the process, where
+     * a heap dump or a careless `JSON.stringify(this)` in a debug log would find
+     * it. A SHA-256 detects change just as well and carries nothing back out.
+     * (The transporter itself necessarily holds the password to authenticate
+     * with; that is unavoidable and is not a reason to add a second copy.)
+     */
+    cached = null;
+    constructor(emailSettings, credentials, options) {
+        super();
+        this.emailSettings = emailSettings;
+        this.credentials = credentials;
+        this.rateLimitClassifier = options?.classifyRateLimit;
+    }
+    /** Closes the cached transporter (the transport was replaced or the application is shutting down). */
+    destroy() {
+        this.cached?.transport.close();
+        this.cached = null;
+    }
+    /**
+     * @see BaseEmailProvider.deliver -- this may throw freely; `send`, the only
+     * public entry point, converts anything thrown into a failure result. There
+     * is intentionally no try/catch anywhere in this file.
+     */
+    async deliver(msg, redact) {
+        const transport = await this.getTransport(redact);
+        const info = await transport.sendMail({
+            from: msg.from,
+            to: msg.to,
+            subject: msg.subject,
+            html: msg.html,
+            // Always both parts -- see the same note in the SES provider.
+            text: msg.text,
+            ...(msg.headers ? { headers: msg.headers } : {}),
+            // Inline parts (the layout's brand mark, `cid:<contentId>`) and any
+            // plain attachment (#737). nodemailer builds `multipart/related` around
+            // the HTML when a part carries a `cid`, which is what makes the `cid:`
+            // reference resolve in the recipient's client.
+            ...(msg.attachments && msg.attachments.length > 0
+                ? {
+                    attachments: msg.attachments.map((part) => ({
+                        filename: part.filename,
+                        content: Buffer.from(part.contentBase64, 'base64'),
+                        contentType: part.contentType,
+                        contentDisposition: part.disposition,
+                        ...(part.contentId ? { cid: part.contentId } : {}),
+                    })),
+                }
+                : {}),
+        });
+        // nodemailer synthesises a Message-ID when the server does not return one,
+        // so unlike SES this is effectively always present; the fallback keeps the
+        // delivery record honest rather than writing `undefined`.
+        return {
+            success: true,
+            messageId: info.messageId ?? undefined,
+        };
+    }
+    /**
+     * Resolve settings and the stored password, then build (or reuse) the
+     * transporter.
+     *
+     * Throws a plain `Error` naming the missing piece. Those messages reach an
+     * admin verbatim through #124, so they say which field to fix -- and they
+     * never quote a value.
+     */
+    async getTransport(redact) {
+        const settings = await this.emailSettings.get();
+        if (!settings.smtpHost) {
+            throw new Error('No SMTP host is configured. Set the SMTP server host in email settings.');
+        }
+        const host = settings.smtpHost;
+        const port = settings.smtpPort ?? email_settings_schema_1.DEFAULT_SMTP_PORT;
+        // Absent means TLS. A missing key in a stored blob must not be the reason
+        // a mail password crosses the network in the clear -- the safe reading of
+        // "unspecified" is the strict one, and an operator on a legacy plaintext
+        // relay has to say so explicitly.
+        const useTls = settings.smtpUseTls ?? true;
+        const username = settings.smtpUsername;
+        // Fetched only when there is a username to use it with. An unauthenticated
+        // relay (authorised by source IP, common inside a private network) is a
+        // legitimate configuration, and looking up a credential that is not
+        // supposed to exist would turn that into a spurious error.
+        const password = username
+            ? await this.credentials.getSecret(smtp_credential_constants_1.SMTP_CREDENTIAL_PURPOSE, smtp_credential_constants_1.SMTP_CREDENTIAL_NAME)
+            : null;
+        // Registered IMMEDIATELY on obtaining it, before the connect, the TLS
+        // handshake and the AUTH exchange -- every one of which can throw while
+        // this value is in scope, and at least one of which (a server that echoes
+        // the offending command back in its rejection) can throw with the value
+        // *inside the error text*. See SecretRedactor: this is the whole reason it
+        // exists, because we do not author nodemailer's error strings.
+        redact.protect(password);
+        if (username && !password) {
+            throw new Error('An SMTP username is configured but no password is stored. Save the SMTP password in email settings.');
+        }
+        // Implicit TLS on 465 (the connection is TLS from the first byte);
+        // STARTTLS everywhere else, REQUIRED rather than opportunistic when TLS is
+        // on. Opportunistic STARTTLS silently downgrades to plaintext against a
+        // server that does not advertise it -- which is exactly the case where the
+        // credential most needs protecting.
+        const secure = port === email_settings_schema_1.IMPLICIT_TLS_SMTP_PORT;
+        const requireTLS = useTls && !secure;
+        const fingerprint = (0, node_crypto_1.createHash)('sha256')
+            .update(JSON.stringify([
+            host,
+            port,
+            secure,
+            requireTLS,
+            username ?? null,
+            password ?? null,
+        ]))
+            .digest('hex');
+        if (this.cached?.fingerprint === fingerprint) {
+            return this.cached.transport;
+        }
+        const transport = nodemailer.createTransport({
+            host,
+            port,
+            secure,
+            requireTLS,
+            auth: username && password ? { user: username, pass: password } : undefined,
+            connectionTimeout: SMTP_CONNECTION_TIMEOUT_MS,
+            greetingTimeout: SMTP_GREETING_TIMEOUT_MS,
+            socketTimeout: SMTP_SOCKET_TIMEOUT_MS,
+            // Certificate verification is left at nodemailer's default (on). There
+            // is deliberately no "ignore TLS errors" setting: it is the field every
+            // frustrated operator ticks, it silently converts an authenticated
+            // channel into an interceptable one, and the legitimate case (a private
+            // CA) is solved properly with NODE_EXTRA_CA_CERTS.
+        });
+        // Close the transporter being replaced, or every settings edit leaks a
+        // pool of open SMTP sockets for the life of the process.
+        this.cached?.transport.close();
+        this.cached = { fingerprint, transport };
+        return transport;
+    }
+};
+exports.SmtpEmailProvider = SmtpEmailProvider;
+exports.SmtpEmailProvider = SmtpEmailProvider = SmtpEmailProvider_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(email_settings_service_1.EmailSettingsService)),
+    __param(1, (0, common_1.Inject)(index_1.CredentialsService)),
+    __param(2, (0, common_1.Optional)()),
+    __param(2, (0, common_1.Inject)(email_options_1.EMAIL_OPTIONS)),
+    __metadata("design:paramtypes", [Object, Object, Object])
+], SmtpEmailProvider);
+//# sourceMappingURL=smtp-email.provider.js.map

package/dist/email/providers/smtp-email.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"smtp-email.provider.js","sourceRoot":"","sources":["../../../src/email/providers/smtp-email.provider.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,6CAAyC;AACzC,2CAAsE;AACtE,uDAAyC;AAGzC,mDAA6D;AAC7D,gEAA2E;AAC3E,sEAAiE;AACjE,oDAAkF;AAClF,oEAGkC;AAClC,4EAGsC;AAGtC,gFAAgF;AAChF,4CAA4C;AAC5C,gFAAgF;AAChF,EAAE;AACF,6EAA6E;AAC7E,yEAAyE;AACzE,oDAAoD;AACpD,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,EAAE;AACF,yEAAyE;AACzE,8EAA8E;AAC9E,2EAA2E;AAC3E,wEAAwE;AACxE,2EAA2E;AAC3E,2EAA2E;AAC3E,yDAAyD;AACzD,EAAE;AACF,4EAA4E;AAC5E,iDAAiD;AACjD,EAAE;AACF,2EAA2E;AAC3E,8EAA8E;AAC9E,iCAAiC;AACjC,gFAAgF;AAEhF,6EAA6E;AAC7E,4EAA4E;AAC5E,6EAA6E;AAC7E,qEAAqE;AACrE,qEAAqE;AACrE,yEAAyE;AACzE,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,oBAAoB;AACpB,0EAGsC;AAFpC,iIAAA,oBAAoB,OAAA;AACpB,oIAAA,uBAAuB,OAAA;AAGzB;;;;;;;;;;;;;GAaG;AACH,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAEtC;;;;;GAKG;AAEI,IAAM,iBAAiB,yBAAvB,MAAM,iBAAkB,SAAQ,uCAAiB;IA6BL;IACF;IA7B5B,MAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5C,aAAa,GAAG,MAAM,CAAC;IAE1C;;;;;;;;;;;;;;;;;OAiBG;IACK,MAAM,GAA2D,IAAI,CAAC;IAE9E,YAKiD,aAAgD,EAClD,WAAkD,EAG5D,OAA+D;QAElG,KAAK,EAAE,CAAC;QANuC,kBAAa,GAAb,aAAa,CAAmC;QAClD,gBAAW,GAAX,WAAW,CAAuC;QAM/F,IAAI,CAAC,mBAAmB,GAAG,OAAO,EAAE,iBAAiB,CAAC;IACxD,CAAC;IAED,sGAAsG;IACtG,OAAO;QACL,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,OAAO,CACrB,GAAiB,EACjB,MAAsB;QAEtB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAElD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC;YACpC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,8DAA8D;YAC9D,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,oEAAoE;YACpE,wEAAwE;YACxE,uEAAuE;YACvE,+CAA+C;YAC/C,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;gBAC/C,CAAC,CAAC;oBACE,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;wBAC1C,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC;wBAClD,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,kBAAkB,EAAE,IAAI,CAAC,WAAW;wBACpC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACnD,CAAC,CAAC;iBACJ;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QAEH,2EAA2E;QAC3E,2EAA2E;QAC3E,0DAA0D;QAC1D,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;SACvC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,YAAY,CAAC,MAAsB;QAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC;QAEhD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,IAAI,yCAAiB,CAAC;QAEpD,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,kCAAkC;QAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC;QAE3C,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC;QAEvC,2EAA2E;QAC3E,wEAAwE;QACxE,oEAAoE;QACpE,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,QAAQ;YACvB,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAC9B,mDAAuB,EACvB,gDAAoB,CACrB;YACH,CAAC,CAAC,IAAI,CAAC;QAET,sEAAsE;QACtE,wEAAwE;QACxE,0EAA0E;QAC1E,wEAAwE;QACxE,2EAA2E;QAC3E,+DAA+D;QAC/D,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEzB,IAAI,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,oCAAoC;QACpC,MAAM,MAAM,GAAG,IAAI,KAAK,8CAAsB,CAAC;QAC/C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;QAErC,MAAM,WAAW,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;aACrC,MAAM,CACL,IAAI,CAAC,SAAS,CAAC;YACb,IAAI;YACJ,IAAI;YACJ,MAAM;YACN,UAAU;YACV,QAAQ,IAAI,IAAI;YAChB,QAAQ,IAAI,IAAI;SACjB,CAAC,CACH;aACA,MAAM,CAAC,KAAK,CAAC,CAAC;QAEjB,IAAI,IAAI,CAAC,MAAM,EAAE,WAAW,KAAK,WAAW,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAC/B,CAAC;QAED,MAAM,SAAS,GAAG,UAAU,CAAC,eAAe,CAAC;YAC3C,IAAI;YACJ,IAAI;YACJ,MAAM;YACN,UAAU;YACV,IAAI,EAAE,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC3E,iBAAiB,EAAE,0BAA0B;YAC7C,eAAe,EAAE,wBAAwB;YACzC,aAAa,EAAE,sBAAsB;YACrC,uEAAuE;YACvE,wEAAwE;YACxE,mEAAmE;YACnE,wEAAwE;YACxE,mDAAmD;SACpD,CAAC,CAAC;QAEH,uEAAuE;QACvE,yDAAyD;QACzD,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;QAEzC,OAAO,SAAS,CAAC;IACnB,CAAC;CACF,CAAA;AA/LY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IA8BR,WAAA,IAAA,eAAM,EAAC,6CAAoB,CAAC,CAAA;IAC5B,WAAA,IAAA,eAAM,EAAC,0BAAkB,CAAC,CAAA;IAG1B,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,6BAAa,CAAC,CAAA;;GAjCzB,iBAAiB,CA+L7B"}

package/dist/email/ses-credential.constants.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Credential store address for the SES secret access key: the sub-key domain.
+ *
+ * `purpose` is also the AES-GCM sub-key domain (see `CredentialsService`), so
+ * changing this string orphans every already-stored SES secret access key —
+ * they remain in the table and become permanently unreadable. It is not a
+ * rename.
+ *
+ * @stability stable
+ */
+export declare const SES_CREDENTIAL_PURPOSE = "email_ses";
+/**
+ * Discriminator within the purpose. 'default' because this app has one SES
+ * sending identity; a future multi-account setup keys additional rows by
+ * account id without touching anything above.
+ *
+ * @stability stable
+ */
+export declare const SES_CREDENTIAL_NAME = "default";
+/**
+ * Human label written alongside the stored secret.
+ *
+ * NON-SECRET, and it must stay that way: `CredentialMeta` carries a
+ * compile-time proof that it has no secret-bearing field, and this string is
+ * shown verbatim in any credential listing. It exists so a row in that listing
+ * says what it is for rather than only `email_ses/default`.
+ *
+ * @stability stable
+ */
+export declare const SES_CREDENTIAL_LABEL = "SES secret access key";
+/**
+ * The `email_ses` purpose's declaration for the credential purpose registry
+ * (#735), registered by `platform/credentials/credential-purposes.manifest.ts`.
+ *
+ * @stability stable
+ */
+export declare const SES_CREDENTIAL_PURPOSE_DEF: {
+    /** The purpose (and cipher sub-key domain). */
+    readonly purpose: "email_ses";
+    /** The owning slice. */
+    readonly owner: "email";
+    /** The label shown in a credential listing. */
+    readonly label: "SES secret access key";
+    /** Deployment-wide only. */
+    readonly tiers: readonly ["system"];
+};
+//# sourceMappingURL=ses-credential.constants.d.ts.map

package/dist/email/ses-credential.constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ses-credential.constants.d.ts","sourceRoot":"","sources":["../../src/email/ses-credential.constants.ts"],"names":[],"mappings":"AAgCA;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,cAAc,CAAC;AAElD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B;IACrC,+CAA+C;;IAE/C,wBAAwB;;IAExB,+CAA+C;;IAE/C,4BAA4B;;CAEW,CAAC"}

package/dist/email/ses-credential.constants.js

@@ -0,0 +1,79 @@
+"use strict";
+// =============================================================================
+// SES credential address (issue #585, epic #109)
+// =============================================================================
+//
+// The `(purpose, name)` pair the SES secret access key is stored under in the
+// encrypted credential store (#115, epic #108).
+//
+// WHY THESE MOVED OUT OF `providers/ses-email.provider.ts`:
+//
+// #585 adds the WRITE side of the SES secret access key to
+// `EmailSettingsService`, and `SesEmailProvider` already injects
+// `EmailSettingsService`. Had the service imported these constants from the
+// provider, the two modules would import each other, and with
+// `emitDecoratorMetadata` a cycle is not a style problem: `design:paramtypes`
+// is evaluated at class-decoration time, so whichever module CommonJS begins
+// loading second sees `undefined` where a constructor parameter type should
+// be, and Nest fails to resolve the dependency at boot.
+//
+// So the shared value lives in a leaf module that imports nothing at run time. The
+// provider re-exports both names, so `SES_CREDENTIAL_PURPOSE` and
+// `SES_CREDENTIAL_NAME` remain importable from exactly where #585 put them
+// and the `../email` barrel is unchanged.
+//
+// ONE DEFINITION, TWO SIDES. The write path (#585's settings PUT) and the read
+// path (`SesEmailProvider.buildClient`) must address the same row; `purpose`
+// is ALSO the cipher's sub-key domain, so a second string literal that differs
+// by a character produces a credential that saves without complaint and can
+// never be decrypted back. There is deliberately nothing to keep in sync.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SES_CREDENTIAL_PURPOSE_DEF = exports.SES_CREDENTIAL_LABEL = exports.SES_CREDENTIAL_NAME = exports.SES_CREDENTIAL_PURPOSE = void 0;
+/**
+ * Credential store address for the SES secret access key: the sub-key domain.
+ *
+ * `purpose` is also the AES-GCM sub-key domain (see `CredentialsService`), so
+ * changing this string orphans every already-stored SES secret access key —
+ * they remain in the table and become permanently unreadable. It is not a
+ * rename.
+ *
+ * @stability stable
+ */
+exports.SES_CREDENTIAL_PURPOSE = 'email_ses';
+/**
+ * Discriminator within the purpose. 'default' because this app has one SES
+ * sending identity; a future multi-account setup keys additional rows by
+ * account id without touching anything above.
+ *
+ * @stability stable
+ */
+exports.SES_CREDENTIAL_NAME = 'default';
+/**
+ * Human label written alongside the stored secret.
+ *
+ * NON-SECRET, and it must stay that way: `CredentialMeta` carries a
+ * compile-time proof that it has no secret-bearing field, and this string is
+ * shown verbatim in any credential listing. It exists so a row in that listing
+ * says what it is for rather than only `email_ses/default`.
+ *
+ * @stability stable
+ */
+exports.SES_CREDENTIAL_LABEL = 'SES secret access key';
+/**
+ * The `email_ses` purpose's declaration for the credential purpose registry
+ * (#735), registered by `platform/credentials/credential-purposes.manifest.ts`.
+ *
+ * @stability stable
+ */
+exports.SES_CREDENTIAL_PURPOSE_DEF = {
+    /** The purpose (and cipher sub-key domain). */
+    purpose: exports.SES_CREDENTIAL_PURPOSE,
+    /** The owning slice. */
+    owner: 'email',
+    /** The label shown in a credential listing. */
+    label: 'SES secret access key',
+    /** Deployment-wide only. */
+    tiers: ['system'],
+};
+//# sourceMappingURL=ses-credential.constants.js.map

package/dist/email/ses-credential.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ses-credential.constants.js","sourceRoot":"","sources":["../../src/email/ses-credential.constants.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,iDAAiD;AACjD,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,gDAAgD;AAChD,EAAE;AACF,4DAA4D;AAC5D,EAAE;AACF,2DAA2D;AAC3D,iEAAiE;AACjE,4EAA4E;AAC5E,8DAA8D;AAC9D,8EAA8E;AAC9E,6EAA6E;AAC7E,4EAA4E;AAC5E,wDAAwD;AACxD,EAAE;AACF,mFAAmF;AACnF,kEAAkE;AAClE,2EAA2E;AAC3E,0CAA0C;AAC1C,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,4EAA4E;AAC5E,0EAA0E;AAC1E,gFAAgF;;;AAIhF;;;;;;;;;GASG;AACU,QAAA,sBAAsB,GAAG,WAAW,CAAC;AAElD;;;;;;GAMG;AACU,QAAA,mBAAmB,GAAG,SAAS,CAAC;AAE7C;;;;;;;;;GASG;AACU,QAAA,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D;;;;;GAKG;AACU,QAAA,0BAA0B,GAAG;IACxC,+CAA+C;IAC/C,OAAO,EAAE,8BAAsB;IAC/B,wBAAwB;IACxB,KAAK,EAAE,OAAO;IACd,+CAA+C;IAC/C,KAAK,EAAE,uBAAuB;IAC9B,4BAA4B;IAC5B,KAAK,EAAE,CAAC,QAAQ,CAAC;CACsB,CAAC"}

package/dist/email/smtp-credential.constants.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Credential store address for the SMTP password: the sub-key domain.
+ *
+ * `purpose` is also the AES-GCM sub-key domain (see `CredentialsService`), so
+ * changing this string orphans every already-stored SMTP password — they
+ * remain in the table and become permanently unreadable. It is not a rename.
+ *
+ * @stability stable
+ */
+export declare const SMTP_CREDENTIAL_PURPOSE = "smtp";
+/**
+ * Discriminator within the purpose. 'default' because this app has one mail
+ * transport; a future multi-relay setup keys additional rows by relay id
+ * without touching anything above.
+ *
+ * @stability stable
+ */
+export declare const SMTP_CREDENTIAL_NAME = "default";
+/**
+ * Human label written alongside the stored password.
+ *
+ * NON-SECRET, and it must stay that way: `CredentialMeta` carries a
+ * compile-time proof that it has no secret-bearing field, and this string is
+ * shown verbatim in any credential listing. It exists so a row in that listing
+ * says what it is for rather than only `smtp/default`.
+ *
+ * @stability stable
+ */
+export declare const SMTP_CREDENTIAL_LABEL = "SMTP password";
+/**
+ * The `smtp` purpose's declaration for the credential purpose registry (#735),
+ * registered by `platform/credentials/credential-purposes.manifest.ts`.
+ *
+ * @stability stable
+ */
+export declare const SMTP_CREDENTIAL_PURPOSE_DEF: {
+    /** The purpose (and cipher sub-key domain). */
+    readonly purpose: "smtp";
+    /** The owning slice. */
+    readonly owner: "email";
+    /** The label shown in a credential listing. */
+    readonly label: "SMTP password";
+    /** Deployment-wide only. */
+    readonly tiers: readonly ["system"];
+};
+//# sourceMappingURL=smtp-credential.constants.d.ts.map

package/dist/email/smtp-credential.constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"smtp-credential.constants.d.ts","sourceRoot":"","sources":["../../src/email/smtp-credential.constants.ts"],"names":[],"mappings":"AA+BA;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,SAAS,CAAC;AAE9C;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAE9C;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B;IACtC,+CAA+C;;IAE/C,wBAAwB;;IAExB,+CAA+C;;IAE/C,4BAA4B;;CAEW,CAAC"}

package/dist/email/smtp-credential.constants.js

@@ -0,0 +1,77 @@
+"use strict";
+// =============================================================================
+// SMTP credential address (issue #122, moved here by #124, epic #109)
+// =============================================================================
+//
+// The `(purpose, name)` pair the SMTP password is stored under in the
+// encrypted credential store (#115, epic #108).
+//
+// WHY THESE MOVED OUT OF `providers/smtp-email.provider.ts`:
+//
+// #124 adds the WRITE side of the SMTP password to `EmailSettingsService`, and
+// `SmtpEmailProvider` already injects `EmailSettingsService`. Had the service
+// imported these constants from the provider, the two modules would import
+// each other, and with `emitDecoratorMetadata` a cycle is not a style problem:
+// `design:paramtypes` is evaluated at class-decoration time, so whichever
+// module CommonJS begins loading second sees `undefined` where a constructor
+// parameter type should be, and Nest fails to resolve the dependency at boot.
+//
+// So the shared value lives in a leaf module that imports nothing at run time. The
+// provider re-exports both names, so `SMTP_CREDENTIAL_PURPOSE` and
+// `SMTP_CREDENTIAL_NAME` remain importable from exactly where #122 put them
+// and the `../email` barrel is unchanged.
+//
+// ONE DEFINITION, TWO SIDES. The write path (#124's settings PUT) and the read
+// path (`SmtpEmailProvider.getTransport`) must address the same row; `purpose`
+// is ALSO the cipher's sub-key domain, so a second string literal that differs
+// by a character produces a credential that saves without complaint and can
+// never be decrypted back. There is deliberately nothing to keep in sync.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SMTP_CREDENTIAL_PURPOSE_DEF = exports.SMTP_CREDENTIAL_LABEL = exports.SMTP_CREDENTIAL_NAME = exports.SMTP_CREDENTIAL_PURPOSE = void 0;
+/**
+ * Credential store address for the SMTP password: the sub-key domain.
+ *
+ * `purpose` is also the AES-GCM sub-key domain (see `CredentialsService`), so
+ * changing this string orphans every already-stored SMTP password — they
+ * remain in the table and become permanently unreadable. It is not a rename.
+ *
+ * @stability stable
+ */
+exports.SMTP_CREDENTIAL_PURPOSE = 'smtp';
+/**
+ * Discriminator within the purpose. 'default' because this app has one mail
+ * transport; a future multi-relay setup keys additional rows by relay id
+ * without touching anything above.
+ *
+ * @stability stable
+ */
+exports.SMTP_CREDENTIAL_NAME = 'default';
+/**
+ * Human label written alongside the stored password.
+ *
+ * NON-SECRET, and it must stay that way: `CredentialMeta` carries a
+ * compile-time proof that it has no secret-bearing field, and this string is
+ * shown verbatim in any credential listing. It exists so a row in that listing
+ * says what it is for rather than only `smtp/default`.
+ *
+ * @stability stable
+ */
+exports.SMTP_CREDENTIAL_LABEL = 'SMTP password';
+/**
+ * The `smtp` purpose's declaration for the credential purpose registry (#735),
+ * registered by `platform/credentials/credential-purposes.manifest.ts`.
+ *
+ * @stability stable
+ */
+exports.SMTP_CREDENTIAL_PURPOSE_DEF = {
+    /** The purpose (and cipher sub-key domain). */
+    purpose: exports.SMTP_CREDENTIAL_PURPOSE,
+    /** The owning slice. */
+    owner: 'email',
+    /** The label shown in a credential listing. */
+    label: 'SMTP password',
+    /** Deployment-wide only. */
+    tiers: ['system'],
+};
+//# sourceMappingURL=smtp-credential.constants.js.map

package/dist/email/smtp-credential.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"smtp-credential.constants.js","sourceRoot":"","sources":["../../src/email/smtp-credential.constants.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,sEAAsE;AACtE,gFAAgF;AAChF,EAAE;AACF,sEAAsE;AACtE,gDAAgD;AAChD,EAAE;AACF,6DAA6D;AAC7D,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,2EAA2E;AAC3E,+EAA+E;AAC/E,0EAA0E;AAC1E,6EAA6E;AAC7E,8EAA8E;AAC9E,EAAE;AACF,mFAAmF;AACnF,mEAAmE;AACnE,4EAA4E;AAC5E,0CAA0C;AAC1C,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,0EAA0E;AAC1E,gFAAgF;;;AAIhF;;;;;;;;GAQG;AACU,QAAA,uBAAuB,GAAG,MAAM,CAAC;AAE9C;;;;;;GAMG;AACU,QAAA,oBAAoB,GAAG,SAAS,CAAC;AAE9C;;;;;;;;;GASG;AACU,QAAA,qBAAqB,GAAG,eAAe,CAAC;AAErD;;;;;GAKG;AACU,QAAA,2BAA2B,GAAG;IACzC,+CAA+C;IAC/C,OAAO,EAAE,+BAAuB;IAChC,wBAAwB;IACxB,KAAK,EAAE,OAAO;IACd,+CAA+C;IAC/C,KAAK,EAAE,eAAe;IACtB,4BAA4B;IAC5B,KAAK,EAAE,CAAC,QAAQ,CAAC;CACsB,CAAC"}

package/dist/email/templates/allowlist-invitation.email.d.ts

@@ -0,0 +1,47 @@
+import { type EmailRenderContext } from './render-context';
+import { type RenderedEmail } from './email-template.types';
+/**
+ * Everything the invitation renders.
+ *
+ * Note what is absent: no user id, no display name, no preferences, no notes.
+ * The recipient is an email address and nothing more, which is exactly what
+ * being newly allowlisted means.
+ *
+ * @stability experimental
+ */
+export interface AllowlistInvitationEmailData {
+    /** The address that was allowlisted, and the one they must sign in with. */
+    recipientEmail: string;
+    /**
+     * The administrator who added them — their display name or email — when
+     * known.
+     *
+     * Optional because `allowed_emails.added_by_id` is nullable
+     * (`onDelete: SetNull`), so an entry outlives the admin who created it.
+     *
+     * DISCLOSED ON PURPOSE, and it is a deliberate trade rather than an
+     * oversight. It reveals one internal address to somebody outside the system;
+     * in exchange the message is credible ("Oscar added you") instead of
+     * anonymous, and the recipient has somebody to ask if they were not
+     * expecting it. An unattributed invitation to an unfamiliar application is
+     * indistinguishable from a phishing attempt, and the whole point of sending
+     * it is that they act on it.
+     */
+    invitedBy?: string;
+    /**
+     * Absolute URL of the sign-in page, for the CTA.
+     *
+     * THE ENTIRE POINT OF THE MESSAGE, and still optional: with no `APP_URL`
+     * configured there is no honest link to offer, and a button pointing
+     * nowhere is worse than a message that names the application and asks them
+     * to find it. The layout omits the button when this is absent.
+     */
+    signInUrl?: string;
+}
+/**
+ * Render the invitation.
+ *
+ * @stability experimental
+ */
+export declare function allowlistInvitationEmail(data: AllowlistInvitationEmailData, ctx?: EmailRenderContext): RenderedEmail;
+//# sourceMappingURL=allowlist-invitation.email.d.ts.map

package/dist/email/templates/allowlist-invitation.email.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist-invitation.email.d.ts","sourceRoot":"","sources":["../../../src/email/templates/allowlist-invitation.email.ts"],"names":[],"mappings":"AACA,OAAO,EAA6B,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,wBAAwB,CAAC;AAsChC;;;;;;;;GAQG;AACH,MAAM,WAAW,4BAA4B;IAC3C,4EAA4E;IAC5E,cAAc,EAAE,MAAM,CAAC;IAEvB;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,4BAA4B,EAClC,GAAG,CAAC,EAAE,kBAAkB,GACvB,aAAa,CA0Ef"}