@novacraft-engineering/mailbox 0.4.23 → 0.4.24

package/.env.example

@@ -44,10 +44,6 @@ MAIL_ADDRESS_ALIASES={}
 # (Turso or your own sqld) and needs the token below.
 DATABASE_URL=file:/data/mail.sqlite
 DATABASE_AUTH_TOKEN=
-# Optional alternative: Cloudflare D1, used only when DATABASE_URL is unset.
-CLOUDFLARE_ACCOUNT_ID=
-CLOUDFLARE_D1_TOKEN=
-D1_DATABASE_ID=
 
 # Signs the session cookie. Without it every request falls back to sending the
 # password on each call, so set it. Rotating the value signs everybody out.

package/README.md

@@ -58,11 +58,6 @@ seat whose mail someone else now reads.
 on a mounted volume, which is what a single box wants. A `libsql://` URL points
 at a hosted one — Turso, or your own `sqld` — and takes `DATABASE_AUTH_TOKEN`.
 
-If you would rather not run a database at all, leave `DATABASE_URL` unset and
-fill in the Cloudflare D1 variables instead; the app falls back to D1 over its
-REST API. Either way the queries are the same SQLite, so you can move between
-them without a coordinated redeploy.
-
 Attachments go to any S3-compatible bucket through the `S3_*` variables: AWS
 S3, Cloudflare R2, Backblaze B2, MinIO, Wasabi. The older `R2_*` names still
 work if you already set them.

package/app/api/mail/send/route.ts

@@ -6,6 +6,7 @@ import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
 import { presign } from '@/lib/r2'
 import { recordContact, recordPixel, recordSentMeta, recordSentMessage } from '@/lib/mailbox'
 import { scheduleSend } from '@/lib/scheduled'
+import { absoluteUrls, stripOwnPixel } from '@/lib/email-html'
 import { publicOrigin } from '@/lib/public-url'
 
 export const runtime = 'nodejs'
@@ -145,7 +146,7 @@ export async function POST(req: Request) {
   const origin = publicOrigin(req)
   const pixelId = randomUUID()
   const trackedHtml = body.html?.trim()
-    ? `${body.html.trim()}<img src="${origin}/api/mail/pixel/${pixelId}" alt="" width="1" height="1" style="display:none;width:1px;height:1px;border:0" />`
+    ? `${stripOwnPixel(absoluteUrls(body.html.trim(), origin))}<img src="${origin}/api/mail/pixel/${pixelId}" alt="" width="1" height="1" style="display:none;width:1px;height:1px;border:0" />`
     : null
 
   // Thread the reply: In-Reply-To/References point at the inbound Message-ID so the

package/app/api/mail/signature-logo/route.ts

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto'
 import { NextResponse } from 'next/server'
 import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { publicOrigin } from '@/lib/public-url'
 import { presign } from '@/lib/r2'
 
 export const runtime = 'nodejs'
@@ -88,5 +89,5 @@ export async function POST(req: Request) {
   }).catch(() => null)
   if (!put?.ok) return NextResponse.json({ ok: false, error: 'Could not store that image.' }, { status: 502 })
 
-  return NextResponse.json({ ok: true, url: `/api/mail/signature-logo?key=${encodeURIComponent(key)}` })
+  return NextResponse.json({ ok: true, url: `${publicOrigin(req)}/api/mail/signature-logo?key=${encodeURIComponent(key)}` })
 }

package/lib/email-html.test.ts

@@ -1,5 +1,5 @@
 import assert from 'node:assert/strict'
-import { inlineEmailStyles, htmlToPlainText, safeHref, dropUnreachableImages, outlookSafeImages, healGooglePrivateImages } from './email-html.ts'
+import { absoluteUrls, inlineEmailStyles, htmlToPlainText, safeHref, dropUnreachableImages, outlookSafeImages, healGooglePrivateImages } from './email-html.ts'
 
 // A paragraph with no styling of its own gets the base inline style.
 assert.match(inlineEmailStyles('<p>Hello</p>'), /<p style="font-family:Arial[^"]*">Hello<\/p>/)
@@ -88,3 +88,25 @@ assert.equal(
   healGooglePrivateImages('<img src="cid:abc"><img src="https://lh3.googleusercontent.com/real.png">'),
   '<img src="cid:abc"><img src="https://lh3.googleusercontent.com/real.png">',
 )
+
+assert.equal(
+  absoluteUrls('<img src="/api/mail/signature-logo?key=signatures%2Fa.png">', 'https://mail.example.com'),
+  '<img src="https://mail.example.com/api/mail/signature-logo?key=signatures%2Fa.png">',
+)
+assert.equal(
+  absoluteUrls('<img src="/brand/mark-email.png">', 'https://mail.example.com/'),
+  '<img src="https://mail.example.com/brand/mark-email.png">',
+)
+// A forwarded sender's own relative links stay theirs: our hostname must not end up behind them.
+assert.equal(
+  absoluteUrls('<a href="/unsubscribe">stop</a><img src="/img/header.png">', 'https://mail.example.com'),
+  '<a href="/unsubscribe">stop</a><img src="/img/header.png">',
+)
+assert.equal(
+  absoluteUrls('<img src="https://cdn.example.com/a.png"><img src="//cdn/b.png">', 'https://mail.example.com'),
+  '<img src="https://cdn.example.com/a.png"><img src="//cdn/b.png">',
+)
+assert.equal(absoluteUrls('<a href="mailto:a@b.com">a</a>', 'https://mail.example.com'), '<a href="mailto:a@b.com">a</a>')
+// Idempotent: already-absolute addresses survive a second pass unchanged.
+const once = absoluteUrls('<img src="/api/mail/pixel/x">', 'https://mail.example.com')
+assert.equal(absoluteUrls(once, 'https://mail.example.com'), once)

package/lib/email-html.ts

@@ -135,6 +135,22 @@ export function healGooglePrivateImages(html: string, mark?: string | null): str
   })
 }
 
+/**
+ * A root-relative address resolves against our own app, and nowhere else. Sent out as-is it
+ * points a recipient's client at its own host, so the signature logo the composer showed
+ * happily arrives broken in every other mailbox.
+ *
+ * Only our own asset paths are rewritten. A forwarded message carries the original
+ * sender's markup verbatim, and their "/unsubscribe" belongs to their site, not ours —
+ * giving it our hostname would put our domain behind someone else's link.
+ */
+const OWN_ASSET_PATH = /\b(src|href)\s*=\s*(["'])(\/(?:api|brand)\/[^"']*)\2/gi
+
+export function absoluteUrls(html: string, origin: string): string {
+  const root = origin.replace(/\/+$/, '')
+  return html.replace(OWN_ASSET_PATH, (_tag, attribute, quote, path) => `${attribute}=${quote}${root}${path}${quote}`)
+}
+
 export function stripCidPlaceholders(text: string): string {
   return text
     .replace(/\[cid:[^\]\n]{0,300}\]/gi, '')

package/lib/mailbox.ts

@@ -1,6 +1,6 @@
 import { ADDRESS_ALIASES, MAIL_SEATS, type MailRole } from './brand'
 /**
- * Durable mail state on Cloudflare D1 (SQLite). Inbox, delivery events, account
+ * Durable mail state on libSQL (SQLite). Inbox, delivery events, account
  * credentials, reset tokens, and a per-account stash for drafts + saved templates.
  *
  * SQLite differences that matter here: booleans are 0/1, JSON columns are TEXT and come
@@ -8,7 +8,6 @@ import { ADDRESS_ALIASES, MAIL_SEATS, type MailRole } from './brand'
  * supplied by the app rather than `now()`.
  */
 
-import { d1, d1Batch, d1Query } from './d1'
 import { stripCidPlaceholders } from './email-html'
 import { hashPassword } from './password'
 import { duration, type ParsedQuery } from '@/app/mail/search'
@@ -67,24 +66,21 @@ export type StashItem = {
 const MAX_INBOX = 500
 const MAX_EVENTS = 150
 
-/** SQLite/libSQL once it is configured, D1 until then, so the switch needs no redeploy dance. */
-const tursoConfigured = () => Boolean(process.env.DATABASE_URL ?? process.env.TURSO_DATABASE_URL)
-
 export function db() {
-  return tursoConfigured() ? turso() : d1()
+  return turso()
 }
 
 /** Raw SQL with positional args, for queries whose shape is built at runtime. */
 function tagged(_sql: unknown, text: string, args: unknown[]): Promise<Record<string, unknown>[]> {
-  return tursoConfigured() ? tursoQuery(text, args) : d1Query(text, args)
+  return tursoQuery(text, args)
 }
 
 function sqlRaw(text: string, args: unknown[] = []): Promise<Record<string, unknown>[]> {
-  return tursoConfigured() ? tursoQuery(text, args) : d1Query(text, args)
+  return tursoQuery(text, args)
 }
 
 function dbBatch(statements: string[]): Promise<void> {
-  return tursoConfigured() ? tursoBatch(statements) : d1Batch(statements)
+  return tursoBatch(statements)
 }
 
 function nowIso(): string {
@@ -116,8 +112,8 @@ function isoOrNull(value: unknown): string | null {
 }
 
 /**
- * Create the schema on first use. D1 has no migration runner either, but unlike the
- * Postgres original we own the full CREATE, so there are no incremental ALTERs to replay.
+ * Create the schema on first use. There is no migration runner, but unlike the Postgres
+ * original we own the full CREATE, so there are no incremental ALTERs to replay.
  * Memoized per server instance.
  */
 let schemaReady: Promise<void> | null = null

package/lib/scheduled.ts

@@ -1,3 +1,5 @@
+import { BRAND } from '@/lib/brand'
+import { absoluteUrls } from '@/lib/email-html'
 import { randomUUID } from 'node:crypto'
 import { db, ensureMailSchema, recordContact, recordPixel, recordSentMeta, recordSentMessage } from '@/lib/mailbox'
 import { sendMail, type SendPayload } from '@/lib/mail-provider'
@@ -149,7 +151,9 @@ export async function dispatchDue(limit = 25): Promise<{ due: number; sent: numb
     try {
       // scheduledAt is deliberately dropped: the wait already happened here.
       const { scheduledAt: _ignored, ...payload } = send.payload
-      const result = await sendMail(payload)
+      const result = await sendMail(
+        payload.html ? { ...payload, html: absoluteUrls(payload.html, BRAND.publicUrl) } : payload,
+      )
       await recordSend(send, result?.id ?? null)
       await sql`
         UPDATE mail_scheduled SET status = 'sent', sent_id = ${result?.id ?? null}, last_error = NULL WHERE id = ${id}`

package/lib/turso.ts

@@ -1,5 +1,5 @@
 /**
- * Turso (libSQL) over HTTP, exposing the same tagged-template shape the D1 client used
+ * Turso (libSQL) over HTTP, exposing a tagged-template shape
  * so every call site in `mailbox.ts` reads unchanged. libSQL is SQLite, so the schema
  * and its `ON CONFLICT` clauses port without translation.
  *
@@ -45,7 +45,7 @@ export function turso(): SqlTag {
 }
 
 /**
- * Run several statements as one transaction. The D1 client could only loop, so a
+ * Run several statements as one transaction. A plain loop cannot roll back, so a
  * half-applied schema was possible; libSQL gives us the real thing.
  */
 export async function tursoBatch(statements: string[]): Promise<void> {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@novacraft-engineering/mailbox",
-  "version": "0.4.23",
+  "version": "0.4.24",
   "description": "A shared webmail app: one codebase, one deployment per mailbox. Threads, a rich composer with signatures, attachments on S3-compatible storage, sharing links, full-text search, web push and PWA install.",
   "keywords": [
     "webmail",

package/lib/d1.ts

@@ -1,64 +0,0 @@
-/**
- * Cloudflare D1 over the REST API, shaped like the `neon()` tagged-template client so
- * query call sites read the same. The app runs on Vercel, so there is no Worker binding
- * available — every statement is an HTTPS round-trip to Cloudflare.
- */
-
-type Param = string | number | null
-export type D1Sql = (strings: TemplateStringsArray, ...values: unknown[]) => Promise<Record<string, unknown>[]>
-
-const API = 'https://api.cloudflare.com/client/v4'
-
-function config() {
-  const accountId = process.env.CLOUDFLARE_ACCOUNT_ID
-  const databaseId = process.env.D1_DATABASE_ID
-  const token = process.env.CLOUDFLARE_D1_TOKEN
-  if (!accountId || !databaseId || !token) {
-    throw new Error('CLOUDFLARE_ACCOUNT_ID, D1_DATABASE_ID and CLOUDFLARE_D1_TOKEN must be configured')
-  }
-  return { accountId, databaseId, token }
-}
-
-/** SQLite has no boolean or object types — normalise before binding. */
-function toParam(value: unknown): Param {
-  if (value === undefined || value === null) return null
-  if (typeof value === 'boolean') return value ? 1 : 0
-  if (typeof value === 'number') return value
-  if (value instanceof Date) return value.toISOString()
-  if (typeof value === 'object') return JSON.stringify(value)
-  return String(value)
-}
-
-export async function d1Query(sql: string, params: unknown[] = []): Promise<Record<string, unknown>[]> {
-  const { accountId, databaseId, token } = config()
-  const response = await fetch(`${API}/accounts/${accountId}/d1/database/${databaseId}/query`, {
-    method: 'POST',
-    headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
-    body: JSON.stringify({ sql, params: params.map(toParam) }),
-  })
-  const payload = (await response.json()) as {
-    success?: boolean
-    errors?: Array<{ message?: string }>
-    result?: Array<{ results?: Record<string, unknown>[]; success?: boolean; error?: string }>
-  }
-  if (!response.ok || !payload.success) {
-    const detail = payload.errors?.map(entry => entry.message).filter(Boolean).join('; ') || `HTTP ${response.status}`
-    throw new Error(`D1 query failed: ${detail}`)
-  }
-  const first = payload.result?.[0]
-  if (first?.error) throw new Error(`D1 query failed: ${first.error}`)
-  return first?.results ?? []
-}
-
-/** Tagged-template entry point: interpolations become bound `?` parameters. */
-export function d1(): D1Sql {
-  return (strings, ...values) => d1Query(strings.raw.join('?'), values)
-}
-
-/** Run several statements in order — used for schema setup. */
-export async function d1Batch(statements: string[]): Promise<void> {
-  for (const statement of statements) {
-    const trimmed = statement.trim()
-    if (trimmed) await d1Query(trimmed)
-  }
-}