@nocobase/plugin-workflow-mailer 2.2.17 → 2.2.18

package/dist/node_modules/nodemailer/lib/xoauth2/index.js

@@ -1,9 +1,10 @@
 'use strict';
 
-const Stream = require('stream').Stream;
+const { Stream } = require('stream');
 const nmfetch = require('../fetch');
 const crypto = require('crypto');
 const shared = require('../shared');
+const errors = require('../errors');
 
 /**
  * XOAUTH2 access_token generator for Gmail.
@@ -32,6 +33,7 @@ const shared = require('../shared');
  * @param {Number} options.expires Optional Access Token expire time in ms
  * @param {Number} options.timeout Optional TTL for Access Token in seconds
  * @param {Function} options.provisionCallback Function to run when a new access token is required
+ * @param {Object} options.tls Optional TLS options forwarded to the HTTPS token request. Defaults to strict cert validation; supply { rejectUnauthorized: false } only for self-hosted OAuth providers on private CAs.
  */
 class XOAuth2 extends Stream {
     constructor(options, logger) {
@@ -41,11 +43,13 @@ class XOAuth2 extends Stream {
 
         if (options && options.serviceClient) {
             if (!options.privateKey || !options.user) {
-                setImmediate(() => this.emit('error', new Error('Options "privateKey" and "user" are required for service account!')));
+                const err = new Error('Options "privateKey" and "user" are required for service account!');
+                err.code = errors.EOAUTH2;
+                setImmediate(() => this.emit('error', err));
                 return;
             }
 
-            let serviceRequestTimeout = Math.min(Math.max(Number(this.options.serviceRequestTimeout) || 0, 0), 3600);
+            const serviceRequestTimeout = Math.min(Math.max(Number(this.options.serviceRequestTimeout) || 0, 0), 3600);
             this.options.serviceRequestTimeout = serviceRequestTimeout || 5 * 60;
         }
 
@@ -69,9 +73,12 @@ class XOAuth2 extends Stream {
         if (this.options.expires && Number(this.options.expires)) {
             this.expires = this.options.expires;
         } else {
-            let timeout = Math.max(Number(this.options.timeout) || 0, 0);
+            const timeout = Math.max(Number(this.options.timeout) || 0, 0);
             this.expires = (timeout && Date.now() + timeout * 1000) || 0;
         }
+
+        this.renewing = false; // Track if renewal is in progress
+        this.renewalQueue = []; // Queue for pending requests during renewal
     }
 
     /**
@@ -82,14 +89,63 @@ class XOAuth2 extends Stream {
      */
     getToken(renew, callback) {
         if (!renew && this.accessToken && (!this.expires || this.expires > Date.now())) {
+            this.logger.debug(
+                {
+                    tnx: 'OAUTH2',
+                    user: this.options.user,
+                    action: 'reuse'
+                },
+                'Reusing existing access token for %s',
+                this.options.user
+            );
             return callback(null, this.accessToken);
         }
 
-        let generateCallback = (...args) => {
-            if (args[0]) {
+        // check if it is possible to renew, if not, return the current token or error
+        if (!this.provisionCallback && !this.options.refreshToken && !this.options.serviceClient) {
+            if (this.accessToken) {
+                this.logger.debug(
+                    {
+                        tnx: 'OAUTH2',
+                        user: this.options.user,
+                        action: 'reuse'
+                    },
+                    'Reusing existing access token (no refresh capability) for %s',
+                    this.options.user
+                );
+                return callback(null, this.accessToken);
+            }
+            this.logger.error(
+                {
+                    tnx: 'OAUTH2',
+                    user: this.options.user,
+                    action: 'renew'
+                },
+                'Cannot renew access token for %s: No refresh mechanism available',
+                this.options.user
+            );
+            const err = new Error("Can't create new access token for user");
+            err.code = errors.EOAUTH2;
+            return callback(err);
+        }
+
+        // If renewal already in progress, queue this request instead of starting another
+        if (this.renewing) {
+            return this.renewalQueue.push({ renew, callback });
+        }
+
+        this.renewing = true;
+
+        // Handles token renewal completion - processes queued requests and cleans up
+        const generateCallback = (err, accessToken) => {
+            this.renewalQueue.forEach(item => item.callback(err, accessToken));
+            this.renewalQueue = [];
+            this.renewing = false;
+
+            if (err) {
                 this.logger.error(
                     {
-                        err: args[0],
+                        err,
                         tnx: 'OAUTH2',
                         user: this.options.user,
                         action: 'renew'
@@ -108,7 +164,8 @@ class XOAuth2 extends Stream {
                     this.options.user
                 );
             }
-            callback(...args);
+            // Complete original request
+            callback(err, accessToken);
         };
 
         if (this.provisionCallback) {
@@ -154,8 +211,8 @@ class XOAuth2 extends Stream {
         let loggedUrlOptions;
         if (this.options.serviceClient) {
             // service account - https://developers.google.com/identity/protocols/OAuth2ServiceAccount
-            let iat = Math.floor(Date.now() / 1000); // unix time
-            let tokenData = {
+            const iat = Math.floor(Date.now() / 1000); // unix time
+            const tokenData = {
                 iss: this.options.serviceClient,
                 scope: this.options.scope || 'https://mail.google.com/',
                 sub: this.options.user,
@@ -166,8 +223,10 @@ class XOAuth2 extends Stream {
             let token;
             try {
                 token = this.jwtSignRS256(tokenData);
-            } catch (err) {
-                return callback(new Error('Can\x27t generate token. Check your auth options'));
+            } catch (_err) {
+                const err = new Error("Can't generate token. Check your auth options");
+                err.code = errors.EOAUTH2;
+                return callback(err);
             }
 
             urlOptions = {
@@ -181,7 +240,9 @@ class XOAuth2 extends Stream {
             };
         } else {
             if (!this.options.refreshToken) {
-                return callback(new Error('Can\x27t create new access token for user'));
+                const err = new Error("Can't create new access token for user");
+                err.code = errors.EOAUTH2;
+                return callback(err);
             }
 
             // web app - https://developers.google.com/identity/protocols/OAuth2WebServer
@@ -200,10 +261,8 @@ class XOAuth2 extends Stream {
             };
         }
 
-        Object.keys(this.options.customParams).forEach(key => {
-            urlOptions[key] = this.options.customParams[key];
-            loggedUrlOptions[key] = this.options.customParams[key];
-        });
+        Object.assign(urlOptions, this.options.customParams);
+        Object.assign(loggedUrlOptions, this.options.customParams);
 
         this.logger.debug(
             {
@@ -238,17 +297,15 @@ class XOAuth2 extends Stream {
                     'Response: %s',
                     (body || '').toString()
                 );
-                return callback(new Error('Invalid authentication response'));
+                const err = new Error('Invalid authentication response');
+                err.code = errors.EOAUTH2;
+                return callback(err);
             }
 
-            let logData = {};
-            Object.keys(data).forEach(key => {
-                if (key !== 'access_token') {
-                    logData[key] = data[key];
-                } else {
-                    logData[key] = (data[key] || '').toString().substr(0, 6) + '...';
-                }
-            });
+            const logData = Object.assign({}, data);
+            if (logData.access_token) {
+                logData.access_token = (logData.access_token || '').toString().substr(0, 6) + '...';
+            }
 
             this.logger.debug(
                 {
@@ -269,7 +326,9 @@ class XOAuth2 extends Stream {
                 if (data.error_uri) {
                     errorMessage += ' (' + data.error_uri + ')';
                 }
-                return callback(new Error(errorMessage));
+                const err = new Error(errorMessage);
+                err.code = errors.EOAUTH2;
+                return callback(err);
             }
 
             if (data.access_token) {
@@ -277,7 +336,9 @@ class XOAuth2 extends Stream {
                 return callback(null, this.accessToken);
             }
 
-            return callback(new Error('No access token'));
+            const err = new Error('No access token');
+            err.code = errors.EOAUTH2;
+            return callback(err);
         });
     }
 
@@ -288,7 +349,7 @@ class XOAuth2 extends Stream {
      * @return {String} Base64 encoded token for IMAP or SMTP login
      */
     buildXOAuth2Token(accessToken) {
-        let authData = ['user=' + (this.options.user || ''), 'auth=Bearer ' + (accessToken || this.accessToken), '', ''];
+        const authData = ['user=' + (this.options.user || ''), 'auth=Bearer ' + (accessToken || this.accessToken), '', ''];
         return Buffer.from(authData.join('\x01'), 'utf-8').toString('base64');
     }
 
@@ -307,15 +368,26 @@ class XOAuth2 extends Stream {
     postRequest(url, payload, params, callback) {
         let returned = false;
 
-        let chunks = [];
+        const chunks = [];
         let chunklen = 0;
 
-        let req = nmfetch(url, {
+        const fetchOptions = {
             method: 'post',
             headers: params.customHeaders,
             body: payload,
             allowErrorResponse: true
-        });
+        };
+
+        // OAuth2 token endpoints are credential-bearing. lib/fetch already
+        // validates certs by default; pin rejectUnauthorized:true here so the
+        // token fetch stays strict, while still layering params.tls (the
+        // user's options.tls) on top so callers with a self-hosted provider on
+        // a private CA can override.
+        if (/^https:/i.test(url)) {
+            fetchOptions.tls = Object.assign({ rejectUnauthorized: true }, params.tls || {});
+        }
+
+        const req = nmfetch(url, fetchOptions);
 
         req.on('readable', () => {
             let chunk;
@@ -368,7 +440,7 @@ class XOAuth2 extends Stream {
      */
     jwtSignRS256(payload) {
         payload = ['{"alg":"RS256","typ":"JWT"}', JSON.stringify(payload)].map(val => this.toBase64URL(val)).join('.');
-        let signature = crypto.createSign('RSA-SHA256').update(payload).sign(this.options.privateKey);
+        const signature = crypto.createSign('RSA-SHA256').update(payload).sign(this.options.privateKey);
         return payload + '.' + this.toBase64URL(signature);
     }
 }

package/dist/node_modules/nodemailer/package.json

@@ -1 +1 @@
-{"name":"nodemailer","version":"6.9.13","description":"Easy as cake e-mail sending from your Node.js applications","main":"lib/nodemailer.js","scripts":{"test":"node --test --test-concurrency=1 test/**/*.test.js test/**/*-test.js","test:coverage":"c8 node --test --test-concurrency=1 test/**/*.test.js test/**/*-test.js","lint":"eslint .","update":"rm -rf node_modules/ package-lock.json && ncu -u && npm install"},"repository":{"type":"git","url":"https://github.com/nodemailer/nodemailer.git"},"keywords":["Nodemailer"],"author":"Andris Reinman","license":"MIT-0","bugs":{"url":"https://github.com/nodemailer/nodemailer/issues"},"homepage":"https://nodemailer.com/","devDependencies":{"@aws-sdk/client-ses":"3.529.1","bunyan":"1.8.15","c8":"9.1.0","eslint":"8.57.0","eslint-config-nodemailer":"1.2.0","eslint-config-prettier":"9.1.0","libbase64":"1.3.0","libmime":"5.3.4","libqp":"2.1.0","nodemailer-ntlm-auth":"1.0.4","proxy":"1.0.2","proxy-test-server":"1.0.0","smtp-server":"3.13.3"},"engines":{"node":">=6.0.0"},"_lastModified":"2026-09-24T00:59:07.639Z"}
+{"name":"nodemailer","version":"9.1.1","description":"Easy as cake e-mail sending from your Node.js applications","main":"lib/nodemailer.js","scripts":{"test":"node --test --test-concurrency=1 $(find test \\( -name '*-test.js' -o -name '*.test.js' \\))","test:coverage":"c8 node --test --test-concurrency=1 $(find test \\( -name '*-test.js' -o -name '*.test.js' \\))","format":"prettier --write \"**/*.{js,json,md}\"","format:check":"prettier --check \"**/*.{js,json,md}\"","lint":"eslint .","lint:fix":"eslint . --fix","update":"rm -rf node_modules/ package-lock.json && ncu -u && npm install","test:syntax":"docker run --rm -v \"$PWD:/app:ro\" -w /app node:6-alpine node test/syntax-compat.js"},"repository":{"type":"git","url":"https://github.com/nodemailer/nodemailer.git"},"keywords":["Nodemailer"],"author":"Andris Reinman","license":"MIT-0","bugs":{"url":"https://github.com/nodemailer/nodemailer/issues"},"homepage":"https://nodemailer.com/","devDependencies":{"@aws-sdk/client-sesv2":"3.1121.0","bunyan":"1.8.15","c8":"12.0.0","eslint":"10.9.1","eslint-config-prettier":"10.1.8","globals":"17.11.0","libbase64":"1.3.0","libmime":"5.4.2","libqp":"2.1.1","prettier":"3.9.6","proxy":"1.0.2","proxy-test-server":"1.0.0","smtp-server":"3.19.4"},"engines":{"node":">=6.0.0"},"_lastModified":"2026-09-25T14:54:18.536Z"}

package/package.json

@@ -6,7 +6,7 @@
   "description": "Send email in workflow.",
   "description.ru-RU": "Отправляет электронное письмо в рамках рабочего процесса.",
   "description.zh-CN": "可用于在工作流中发送电子邮件。",
-  "version": "2.2.17",
+  "version": "2.2.18",
   "license": "Apache-2.0",
   "main": "./dist/server/index.js",
   "homepage": "https://docs.nocobase.com/handbook/workflow-smtp-mailer",
@@ -14,8 +14,8 @@
   "homepage.ru-RU": "https://docs-ru.nocobase.com/handbook/workflow-smtp-mailer",
   "devDependencies": {
     "antd": "5.x",
-    "joi": "^17.13.3",
-    "nodemailer": "6.9.13",
+    "joi": "^17.13.6",
+    "nodemailer": "^9.1.1",
     "react": "18.x"
   },
   "peerDependencies": {
@@ -27,7 +27,7 @@
     "@nocobase/server": "2.x",
     "@nocobase/test": "2.x"
   },
-  "gitHead": "08565a7d1c326c4c2d190150f303596dda9c6450",
+  "gitHead": "0c464cd27b2c1ccdf10b00d339bf6599b18bee22",
   "keywords": [
     "NocoBase",
     "Workflow",