@novacraft-engineering/mailbox 0.4.3 → 0.4.5

package/.env.example

@@ -39,10 +39,12 @@ MAIL_SEATS=[{"email":"info@example.com","address":"info@example.com","name":"Exa
 MAIL_ADDRESS_ALIASES={}
 
 # ─── Store ──────────────────────────────────────────────────────────────────
-# Local SQLite on a mounted volume (recommended):
-TURSO_DATABASE_URL=file:/data/mail.sqlite
-TURSO_AUTH_TOKEN=
-# Falls back to Cloudflare D1 when TURSO_DATABASE_URL is unset.
+# Any SQLite/libSQL database. A file: URL is local SQLite on a mounted volume
+# (simplest, and what a single box wants); a libsql:// URL is a hosted one
+# (Turso or your own sqld) and needs the token below.
+DATABASE_URL=file:/data/mail.sqlite
+DATABASE_AUTH_TOKEN=
+# Optional alternative: Cloudflare D1, used only when DATABASE_URL is unset.
 CLOUDFLARE_ACCOUNT_ID=
 CLOUDFLARE_D1_TOKEN=
 D1_DATABASE_ID=
@@ -52,7 +54,7 @@ D1_DATABASE_ID=
 MAIL_SESSION_SECRET=
 
 # ─── Sending ────────────────────────────────────────────────────────────────
-# ses | resend | brevo
+# Pick one: ses | resend | brevo. Fill in only that provider's keys.
 MAIL_PROVIDER=ses
 SES_ACCESS_KEY_ID=
 SES_SECRET_ACCESS_KEY=
@@ -64,11 +66,15 @@ RESEND_WEBHOOK_SECRET=
 # nothing — pointing this at an address this app receives would loop.
 MAIL_FORWARD_TO=
 
-# ─── Attachments (S3-compatible, e.g. Cloudflare R2) ────────────────────────
-R2_S3_ENDPOINT=
-R2_BUCKET=
-R2_ACCESS_KEY_ID=
-R2_SECRET_ACCESS_KEY=
+# ─── Attachments ────────────────────────────────────────────────────────────
+# Any S3-compatible bucket: AWS S3, Cloudflare R2, Backblaze B2, MinIO, Wasabi.
+S3_ENDPOINT=
+S3_BUCKET=
+S3_ACCESS_KEY_ID=
+S3_SECRET_ACCESS_KEY=
+# Region: real one for AWS, anything for R2 (defaults to "auto").
+S3_REGION=
+# Only if you import an mbox with --store blob (Vercel Blob).
 BLOB_READ_WRITE_TOKEN=
 
 # ─── Optional extras ────────────────────────────────────────────────────────

package/README.md

@@ -1,80 +1,85 @@
-<img src=".github/banner.png" alt="mailbox by Novacraft" width="100%">
+<img src=".github/banner.png" alt="Mailbox" width="100%">
 
 # Mailbox
 
-A shared webmail app: one codebase, one deployment per mailbox. Inbox and
-threads, a rich composer with signatures and templates, attachments on
-S3-compatible storage, sharing links, full-text search, web push, PWA install,
-multi-accessor accounts with roles, and password reset.
+A shared webmail app you host yourself. One codebase, one deployment per
+mailbox. Inbox and threads, a composer with signatures and templates,
+attachments on S3-compatible storage, sharing links, full-text search, web
+push, PWA install, accounts with roles, and password reset.
 
-Every tenant-specific value — name, domain, colours, signature copy, artwork —
+Everything specific to you — name, domain, colours, signature copy, artwork —
 lives in configuration. Nothing in this repository names or pictures any one
 business, and nothing added to it should.
 
-## Deploying — read this first
+## Running your own
 
-**Never deploy, and never `git push`, unless the person you are working with asks
-for it in that same request.** This is a standing rule for every agent and every
-session. A granted deploy covers that one deploy only; it is not permission for
-the next one.
+1. Copy `.env.example` and fill it in.
+2. Put three images on the volume at `BRAND_ASSET_DIR`. See
+   [public/brand/README.md](public/brand/README.md) for the sizes.
+3. Point `DATABASE_URL` at a SQLite file on a mounted volume.
+4. Deploy it anywhere that runs Next.js. The schema is created on first boot
+   and migrates itself forward, so there is no migration step to run.
 
-Here, pushing *is* deploying — for one tenant. A GitHub webhook on this repository
-points at the Coolify that serves production, so a push to `master` auto-deploys the
-**Novacraft** mailbox. The second tenant is deliberately not wired: it shares this
-repository and branch, but Coolify checks the webhook signature against each
-application's own secret, so it is skipped and still needs a manual deploy from Coolify.
-Finish the work, commit locally, leave it unpushed, and say plainly that it is
-waiting.
-
-## Standing up a new mailbox
-
-1. Copy `.env.example` and fill it in. Nothing is hardcoded to a tenant.
-2. Put three images on the volume at `BRAND_ASSET_DIR` — see `public/brand/README.md`.
-3. Point `TURSO_DATABASE_URL` at a SQLite file on a mounted volume.
-4. Deploy. The schema is created on first boot and migrates itself forward.
+It is a plain Next.js app, so Vercel, Coolify, Docker on a VPS, Fly, Render and
+Railway all work. Nothing in the code assumes a particular host.
 
 ## Trying it locally
 
 Outside production the app seeds one account for you — `test@<MAIL_ADDRESS_DOMAIN>`,
-an admin whose password is the address itself — so a fresh checkout can be signed
-into without configuring seats. It is never seeded when `NODE_ENV=production`.
+an admin whose password is the address itself — so a fresh checkout can be
+signed into without configuring seats. It is never seeded when
+`NODE_ENV=production`.
 
-`node --experimental-strip-types scripts/seed-dev.mjs` then fills that mailbox with
-enough traffic to exercise the list, search, paging and attachments. Create the schema
-first by starting the app once, or by calling `ensureMailSchema()`.
+`node --experimental-strip-types scripts/seed-dev.mjs` then fills that mailbox
+with enough traffic to exercise the list, search, paging and attachments.
+Create the schema first by starting the app once, or by calling
+`ensureMailSchema()`.
 
 The attachments are real files, not records: a PDF, a photo, a short video, a
-spreadsheet and a Word document, generated on the spot and uploaded once. Pictures and
-video need `ffmpeg` and the document needs `zip`; whatever is missing is skipped. With
-no bucket configured the seed still runs and writes the records alone, as it always
-did.
+spreadsheet and a Word document, generated on the spot and uploaded once.
+Pictures and video need `ffmpeg` and the document needs `zip`; whatever is
+missing is skipped. With no bucket configured the seed still runs and writes
+the records alone.
 
 ## Configuration
 
-`lib/brand.ts` is the single server-side source of tenant identity — name,
-domain, signature copy, colours, seats, aliases. `lib/brand.client.ts` is the
-browser half, read from `NEXT_PUBLIC_*` and inlined at build time, so a rebuild
-is required to change client-visible branding.
+`lib/brand.ts` is the server-side source of identity — name, domain, signature
+copy, colours, seats, aliases. `lib/brand.client.ts` is the browser half, read
+from `NEXT_PUBLIC_*` and inlined at build time, so changing anything the
+browser shows means a rebuild.
 
-Seats are JSON in `MAIL_SEATS` and seed on first boot only; afterwards accounts
-are managed in the app. `MAIL_ADDRESS_ALIASES` redirects delivery for a seat
-whose mail someone else now reads.
+Seats are JSON in `MAIL_SEATS` and seed on first boot only; after that you
+manage accounts in the app. `MAIL_ADDRESS_ALIASES` redirects delivery for a
+seat whose mail someone else now reads.
 
 ## Storage
 
-`TURSO_DATABASE_URL` takes precedence; without it the app falls back to
-Cloudflare D1, so moving between the two needs no coordinated redeploy. A
-`file:` URL uses local SQLite, which is what a single box wants.
+`DATABASE_URL` is any SQLite or libSQL database. A `file:` URL is local SQLite
+on a mounted volume, which is what a single box wants. A `libsql://` URL points
+at a hosted one — Turso, or your own `sqld` — and takes `DATABASE_AUTH_TOKEN`.
+
+If you would rather not run a database at all, leave `DATABASE_URL` unset and
+fill in the Cloudflare D1 variables instead; the app falls back to D1 over its
+REST API. Either way the queries are the same SQLite, so you can move between
+them without a coordinated redeploy.
 
-Attachments go to any S3-compatible bucket via the `R2_*` variables.
+Attachments go to any S3-compatible bucket through the `S3_*` variables: AWS
+S3, Cloudflare R2, Backblaze B2, MinIO, Wasabi. The older `R2_*` names still
+work if you already set them.
 
 ## Sending
 
-`MAIL_PROVIDER` selects `ses`, `resend` or `brevo` behind one seam. SES is
-signed in-process; no SDK.
+`MAIL_PROVIDER` picks `ses`, `resend` or `brevo` behind one seam, so switching
+providers is an environment change rather than a code change. SES is signed
+in-process, with no SDK. Adding a fourth provider means one send function and one case in
+`lib/mail-provider.ts`.
 
 ## Tests
 
 ```
 npx tsx --test lib/*.test.ts
 ```
+
+## Licence
+
+MIT. See [LICENSE](LICENSE).

package/app/api/mail/accessors/reset-link/route.ts

@@ -0,0 +1,46 @@
+import { randomBytes } from 'node:crypto'
+import { NextResponse } from 'next/server'
+import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { createResetToken, getAccount } from '@/lib/mailbox'
+import { publicOrigin } from '@/lib/public-url'
+import { clientKey, rateLimit } from '@/lib/rate-limit'
+
+export const runtime = 'nodejs'
+
+const RESET_TTL_MS = 30 * 60 * 1000
+
+/**
+ * The way out of the loop for somebody with no recovery address: an admin, who can already
+ * read every mailbox here, mints the link and hands it over. Nothing is emailed — the point
+ * is that this person cannot receive email.
+ */
+export async function POST(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const actor = await resolveAccount(req)
+  if (actor.role !== 'admin') {
+    return NextResponse.json({ ok: false, error: 'Admin access required' }, { status: 403 })
+  }
+  const limited = rateLimit(clientKey(req, 'reset-link'), 20, 60 * 60 * 1000)
+  if (limited) return limited
+
+  let body: { email?: string }
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ ok: false, error: 'Invalid JSON' }, { status: 400 })
+  }
+
+  const email = (body.email ?? '').trim().toLowerCase()
+  const account = email ? await getAccount(email) : null
+  if (!account) return NextResponse.json({ ok: false, error: 'No such account' }, { status: 404 })
+
+  const token = randomBytes(32).toString('hex')
+  await createResetToken(email, token, Date.now() + RESET_TTL_MS)
+  return NextResponse.json({
+    ok: true,
+    email,
+    url: `${publicOrigin(req)}/mail/reset?token=${token}`,
+    expiresInMinutes: RESET_TTL_MS / 60000,
+  })
+}

package/app/api/mail/accessors/route.ts

@@ -91,6 +91,22 @@ export async function POST(req: Request) {
   if (existing && existing.status === 'active') {
     return NextResponse.json({ ok: false, error: 'That person already has an account' }, { status: 409 })
   }
+  if (email === inviter.email || email === inviter.address) {
+    return NextResponse.json({ ok: false, error: 'That is your own address' }, { status: 400 })
+  }
+  // An invite has to reach somebody. Sending it to a mailbox on our own domain that nobody
+  // can open yet — the very address this invite would create, most often — posts the link
+  // into a box only the new person could read once they had already accepted it.
+  const inviteeDomain = email.split('@')[1] ?? ''
+  if (ADDRESS_DOMAINS.includes(inviteeDomain)) {
+    const holder = await getAccountByAddress(email)
+    if (!holder || holder.status !== 'active') {
+      return NextResponse.json(
+        { ok: false, error: `Nobody can read ${email} yet. Send the invite to an address they already have.` },
+        { status: 400 },
+      )
+    }
+  }
 
   const role: MailRole = body.role === 'admin' ? 'admin' : 'member'
   const name = body.name?.trim() || null

package/app/api/mail/emails/[id]/route.ts

@@ -59,7 +59,7 @@ export async function GET(req: Request, { params }: { params: Promise<{ id: stri
   if (id.startsWith('mbox-') || !resend) {
     const archived = await fromArchive(id)
     if (archived) return archived
-    return NextResponse.json({ ok: false, error: resend ? 'Not found' : 'RESEND_API_KEY not configured' }, { status: resend ? 404 : 500 })
+    return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })
   }
 
   const { data, error } = await resend.emails.get(id)
@@ -102,7 +102,11 @@ export async function PATCH(req: Request, { params }: { params: Promise<{ id: st
   const guard = await mailAuthGuard(req)
   if (guard) return guard
   const resend = getResend()
-  if (!resend) return NextResponse.json({ ok: false, error: 'RESEND_API_KEY not configured' }, { status: 500 })
+  // Rescheduling and cancelling live in Resend's API; there is no equivalent to call on
+  // another provider, so this is a missing feature rather than a missing key.
+  if (!resend) {
+    return NextResponse.json({ ok: false, error: 'Scheduled mail can only be changed on the Resend provider' }, { status: 501 })
+  }
 
   const { id } = await params
   if (!(await mayReadSent(await resolveAccount(req), id))) return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })
@@ -125,7 +129,11 @@ export async function DELETE(req: Request, { params }: { params: Promise<{ id: s
   const guard = await mailAuthGuard(req)
   if (guard) return guard
   const resend = getResend()
-  if (!resend) return NextResponse.json({ ok: false, error: 'RESEND_API_KEY not configured' }, { status: 500 })
+  // Rescheduling and cancelling live in Resend's API; there is no equivalent to call on
+  // another provider, so this is a missing feature rather than a missing key.
+  if (!resend) {
+    return NextResponse.json({ ok: false, error: 'Scheduled mail can only be changed on the Resend provider' }, { status: 501 })
+  }
 
   const { id } = await params
   if (!(await mayReadSent(await resolveAccount(req), id))) return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })

package/app/api/mail/emails/route.ts

@@ -48,6 +48,8 @@ export async function GET(req: Request) {
     sharedAddress: SHARED_ADDRESS,
     query,
     limit: query ? SEARCH_LIMIT : 500,
+    // Automated sends are shown rather than hidden, tagged so the list can say so.
+    includeAuto: true,
   }).catch(() => [])
   const [flags, opens, sentMeta, accounts] = await Promise.all([
     readSentFlags().catch(() => ({})),
@@ -85,15 +87,23 @@ export async function GET(req: Request) {
     return accountAddresses.has(from) ? from : SHARED_ADDRESS
   }
 
+  const isAutomated = (email: SentEmail): boolean => {
+    const meta = metaMap[email.id]
+    // Sends that predate the tagging carry no meta row, so they are still read by shape.
+    return meta ? meta.isAuto : looksAutomated(email)
+  }
+
   const emails = all
     .filter(email => {
-      const meta = metaMap[email.id]
-      if (meta?.isAuto) return false // tagged automated → never in Sent
-      if (!meta && looksAutomated(email)) return false // pre-existing automated → excluded
       if (ownerScope) return sentOwner(email) === ownerScope
       return true
     })
-    .map(email => ({ ...email, owner: sentOwner(email), inReplyTo: metaMap[email.id]?.inReplyTo ?? null }))
+    .map(email => ({
+      ...email,
+      owner: sentOwner(email),
+      inReplyTo: metaMap[email.id]?.inReplyTo ?? null,
+      isAuto: isAutomated(email),
+    }))
     .filter(email =>
       !query ||
       matchesQuery(query, {

package/app/api/mail/recovery/route.ts

@@ -0,0 +1,95 @@
+import { BRAND, ADDRESS_DOMAINS } from '@/lib/brand'
+import { randomBytes } from 'node:crypto'
+import { NextResponse } from 'next/server'
+import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { createResetToken, getAccount, recordSentMeta, setRecoveryEmail } from '@/lib/mailbox'
+import { sendMail } from '@/lib/mail-provider'
+import { renderActionEmail } from '@/lib/emails'
+import { publicOrigin } from '@/lib/public-url'
+import { clientKey, rateLimit } from '@/lib/rate-limit'
+
+export const runtime = 'nodejs'
+
+const VERIFY_TTL_MS = 24 * 60 * 60 * 1000
+
+export async function GET(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const identity = await resolveAccount(req)
+  const account = await getAccount(identity.email)
+  return NextResponse.json({
+    ok: true,
+    recoveryEmail: account?.recoveryEmail ?? null,
+    verified: Boolean(account?.recoveryVerified),
+  })
+}
+
+export async function POST(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const identity = await resolveAccount(req)
+  if (!identity.email) return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 403 })
+
+  const limited = rateLimit(clientKey(req, `recovery:${identity.email}`), 6, 60 * 60 * 1000)
+  if (limited) return limited
+
+  let body: { recovery?: string | null }
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ ok: false, error: 'Invalid JSON' }, { status: 400 })
+  }
+
+  const recovery = (body.recovery ?? '').trim().toLowerCase()
+  if (!recovery) {
+    await setRecoveryEmail(identity.email, null)
+    return NextResponse.json({ ok: true, recoveryEmail: null, verified: false })
+  }
+  if (!/^[^@\s]+@[^@\s.]+\.[^@\s]+$/.test(recovery)) {
+    return NextResponse.json({ ok: false, error: 'That is not an email address we can send to.' }, { status: 400 })
+  }
+  // A recovery address inside the mailbox it recovers is no recovery at all: the reset
+  // link would land in the inbox the person cannot open.
+  if (ADDRESS_DOMAINS.includes(recovery.split('@')[1] ?? '')) {
+    return NextResponse.json(
+      { ok: false, error: `Use an address outside ${BRAND.name} Mail — a locked mailbox cannot receive its own reset link.` },
+      { status: 400 },
+    )
+  }
+
+  await setRecoveryEmail(identity.email, recovery)
+
+  const token = randomBytes(32).toString('hex')
+  await createResetToken(identity.email, token, Date.now() + VERIFY_TTL_MS, 'verify-recovery')
+  const verifyUrl = `${publicOrigin(req)}/api/mail/recovery/verify?token=${token}`
+  const from = (process.env.MAIL_FROM ?? process.env.RESEND_FROM ?? BRAND.supportEmail).replace(/^.*<|>$/g, '').trim()
+
+  try {
+    const { id } = await sendMail({
+      from,
+      fromName: `${BRAND.name} Mail`,
+      to: [recovery],
+      subject: `Confirm this address for ${BRAND.name} Mail recovery`,
+      text: `${identity.email} listed this address as the recovery address for their ${BRAND.name} Mail account.\n\nConfirm it: ${verifyUrl}\n\nThe link expires in 24 hours. Until it is used, no reset can be sent here.`,
+      html: renderActionEmail({
+        eyebrow: `${BRAND.name} · Mail`,
+        accent: BRAND.colors.accent,
+        title: 'Confirm your recovery address',
+        body: `${identity.email} listed this address as where password resets for their ${BRAND.name} Mail account should go. Confirm it and it becomes the only place a reset link is sent.`,
+        actionLabel: 'Confirm this address',
+        actionUrl: verifyUrl,
+        expiry: 'This link expires in 24 hours.',
+        footer: "Didn't expect this? Ignore it — nothing is sent here until the link is used.",
+      }),
+    })
+    if (id) await recordSentMeta(id, null, true).catch(() => {})
+  } catch (err) {
+    console.error('[mail] recovery verification email failed:', err)
+    return NextResponse.json(
+      { ok: false, error: 'Saved, but the confirmation email could not be sent', recoveryEmail: recovery, verified: false },
+      { status: 502 },
+    )
+  }
+
+  return NextResponse.json({ ok: true, recoveryEmail: recovery, verified: false })
+}

package/app/api/mail/recovery/verify/route.ts

@@ -0,0 +1,29 @@
+import { NextResponse } from 'next/server'
+import { consumeToken, getAccount, markRecoveryVerified } from '@/lib/mailbox'
+import { publicOrigin } from '@/lib/public-url'
+import { clientKey, rateLimit } from '@/lib/rate-limit'
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+/**
+ * Opened from the recovery inbox itself, so proving the address is the whole point and no
+ * session is required. It only flips a flag: the token cannot set a password.
+ */
+export async function GET(req: Request) {
+  const limited = rateLimit(clientKey(req, 'verify-recovery'), 20, 15 * 60 * 1000)
+  if (limited) return limited
+
+  const token = new URL(req.url).searchParams.get('token')?.trim() ?? ''
+  const home = `${publicOrigin(req)}/mail`
+  if (!token) return NextResponse.redirect(`${home}?recovery=invalid`, 303)
+
+  const email = await consumeToken(token, 'verify-recovery')
+  if (!email) return NextResponse.redirect(`${home}?recovery=invalid`, 303)
+
+  const account = await getAccount(email)
+  if (!account?.recoveryEmail) return NextResponse.redirect(`${home}?recovery=invalid`, 303)
+
+  const done = await markRecoveryVerified(email, account.recoveryEmail)
+  return NextResponse.redirect(`${home}?recovery=${done ? 'verified' : 'invalid'}`, 303)
+}

package/app/api/mail/request-reset/route.ts

@@ -1,8 +1,8 @@
-import { BRAND } from '@/lib/brand'
+import { BRAND, ADDRESS_DOMAINS } from '@/lib/brand'
 import { randomBytes } from 'node:crypto'
 import { NextResponse } from 'next/server'
 import { isMailAccount } from '@/lib/dev-auth'
-import { createResetToken, recordSentMeta } from '@/lib/mailbox'
+import { createResetToken, getAccount, recordSentMeta } from '@/lib/mailbox'
 import { sendMail } from '@/lib/mail-provider'
 import { renderActionEmail } from '@/lib/emails'
 import { publicOrigin } from '@/lib/public-url'
@@ -12,6 +12,18 @@ export const runtime = 'nodejs'
 
 const RESET_TTL_MS = 30 * 60 * 1000
 
+/** j••••@outlook.com — enough to recognise the inbox, not enough to learn it. */
+function mask(address: string): string {
+  const [local, domain] = address.split('@')
+  if (!domain) return address
+  return `${local.slice(0, 1)}${'•'.repeat(Math.max(3, local.length - 1))}@${domain}`
+}
+
+/** Nothing can be mailed to an address this deployment itself hosts and has locked. */
+const isOurOwn = (address: string) => ADDRESS_DOMAINS.includes(address.split('@')[1] ?? '')
+
+const ASK_ADMIN = 'No confirmed recovery address is set for that mailbox. Ask an administrator on your company mailbox to reset it for you.'
+
 export async function POST(req: Request) {
   const limited = rateLimit(clientKey(req, 'request-reset'), 5, 60 * 60 * 1000)
   if (limited) return limited
@@ -28,9 +40,25 @@ export async function POST(req: Request) {
   // Also capped per address, so a rotating-IP caller cannot bury someone in reset mail.
   const perAddress = rateLimit(`request-reset-address:${email}`, 5, 60 * 60 * 1000)
   if (perAddress) return NextResponse.json({ ok: true })
-  // Always answer ok so we never reveal which addresses are valid accounts.
+  // An unknown address gets the same answer as a known one with nowhere to send, so the
+  // reply still cannot be used to learn who has a mailbox here.
   if (!(await isMailAccount(email))) {
-    return NextResponse.json({ ok: true })
+    return NextResponse.json({ ok: true, needsAdmin: true, message: ASK_ADMIN })
+  }
+
+  // Where the link can actually be read: the confirmed recovery address first, else the
+  // sign-in address when that is somewhere else already. An address inside this mailbox
+  // is no use — it is the thing being recovered.
+  const account = await getAccount(email)
+  const destination =
+    account?.recoveryVerified && account.recoveryEmail
+      ? account.recoveryEmail
+      : !isOurOwn(email)
+        ? email
+        : null
+
+  if (!destination) {
+    return NextResponse.json({ ok: true, needsAdmin: true, message: ASK_ADMIN })
   }
 
   const token = randomBytes(32).toString('hex')
@@ -44,14 +72,14 @@ export async function POST(req: Request) {
     const { id } = await sendMail({
       from,
       fromName: `${BRAND.name} Mail`,
-      to: [email],
+      to: [destination],
       subject: `Reset your ${BRAND.name} Mail password`,
-      text: `Someone requested a password reset for ${BRAND.name} Mail.\n\nSet a new password: ${resetUrl}\n\nThis link expires in 30 minutes. If you didn't request it, ignore this email — your password won't change.`,
+      text: `Someone requested a password reset for ${email} on ${BRAND.name} Mail.\n\nSet a new password: ${resetUrl}\n\nThis link expires in 30 minutes. If you didn't request it, ignore this email — your password won't change.`,
       html: renderActionEmail({
         eyebrow: `${BRAND.name} · Mail`,
         accent: BRAND.colors.accent,
         title: 'Reset your password',
-        body: `Someone asked to reset the password for your ${BRAND.name} Mail account. Choose a new one below.`,
+        body: `Someone asked to reset the password for ${email} on ${BRAND.name} Mail. Choose a new one below.`,
         actionLabel: 'Set a new password',
         actionUrl: resetUrl,
         expiry: 'This link expires in 30 minutes and can be used once.',
@@ -65,5 +93,5 @@ export async function POST(req: Request) {
     return NextResponse.json({ ok: false, error: 'Could not send the reset email' }, { status: 502 })
   }
 
-  return NextResponse.json({ ok: true })
+  return NextResponse.json({ ok: true, message: `Reset link sent to ${mask(destination)}.` })
 }

package/app/api/mail/send/route.ts

@@ -1,7 +1,7 @@
 import { BRAND } from '@/lib/brand'
 import { randomUUID } from 'node:crypto'
 import { NextResponse } from 'next/server'
-import { sendMail } from '@/lib/mail-provider'
+import { providerConfigProblem, sendMail } from '@/lib/mail-provider'
 import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
 import { presign } from '@/lib/r2'
 import { recordContact, recordPixel, recordSentMeta, recordSentMessage } from '@/lib/mailbox'
@@ -31,9 +31,9 @@ export async function POST(req: Request) {
 
   const account = await resolveAccount(req)
 
-  const apiKey = process.env.RESEND_API_KEY
-  if (!apiKey) {
-    return NextResponse.json({ ok: false, error: 'RESEND_API_KEY not configured' }, { status: 500 })
+  const configProblem = providerConfigProblem()
+  if (configProblem) {
+    return NextResponse.json({ ok: false, error: configProblem }, { status: 500 })
   }
 
   let body: SendBody

package/app/api/share/[id]/download/route.ts

@@ -0,0 +1,71 @@
+import { NextResponse } from 'next/server'
+import { getShare } from '@/lib/mailbox'
+import { getObject, objectExists } from '@/lib/r2'
+import { shareTicketValid } from '@/lib/share-ticket'
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+const GONE = { ok: false as const, error: 'This link is no longer available.' }
+
+/**
+ * The bytes of a shared file, served from this domain.
+ *
+ * The share page used to send the browser to a signed bucket URL. That is a second
+ * hostname for the recipient's network to resolve and reach, and on the networks this
+ * office deals with it sometimes cannot be — which looked exactly like a dead button,
+ * because a failed navigation reports nothing back to the page it left. Every other
+ * attachment in this product is already served from here; this one now is too.
+ */
+async function resolve(id: string, ticket: string | null) {
+  if (!shareTicketValid(ticket, id)) return { error: NextResponse.json(GONE, { status: 403 }) }
+  const share = await getShare(id)
+  if (!share || share.revoked) return { error: NextResponse.json(GONE, { status: 404 }) }
+  if (share.expiresAt && new Date(share.expiresAt) < new Date()) {
+    return { error: NextResponse.json(GONE, { status: 410 }) }
+  }
+  return { share }
+}
+
+function disposition(filename: string): string {
+  const plain = filename.replace(/["\\]/g, '')
+  return `attachment; filename="${plain}"; filename*=UTF-8''${encodeURIComponent(filename)}`
+}
+
+/** Lets the page check the file is reachable before it sends the reader away from it. */
+export async function HEAD(req: Request, context: { params: Promise<{ id: string }> }) {
+  const { id } = await context.params
+  const { share, error } = await resolve(id, new URL(req.url).searchParams.get('t'))
+  if (error) return error
+  if (!(await objectExists(share.objectKey))) return NextResponse.json(GONE, { status: 410 })
+  return new Response(null, {
+    headers: {
+      'content-type': share.contentType || 'application/octet-stream',
+      'content-length': String(share.size),
+      'content-disposition': disposition(share.filename),
+    },
+  })
+}
+
+export async function GET(req: Request, context: { params: Promise<{ id: string }> }) {
+  const { id } = await context.params
+  const { share, error } = await resolve(id, new URL(req.url).searchParams.get('t'))
+  if (error) return error
+
+  const object = await getObject(share.objectKey)
+  if (!object?.body) {
+    return NextResponse.json(
+      { ok: false, error: 'This file is no longer stored. Ask whoever sent it to upload it again.' },
+      { status: 410 },
+    )
+  }
+  const length = object.headers.get('content-length')
+  return new Response(object.body, {
+    headers: {
+      'content-type': share.contentType || object.headers.get('content-type') || 'application/octet-stream',
+      'content-disposition': disposition(share.filename),
+      ...(length ? { 'content-length': length } : {}),
+      'cache-control': 'private, no-store',
+    },
+  })
+}