@novacraft-engineering/mailbox 0.4.4 → 0.4.17

package/README.md

@@ -67,6 +67,23 @@ Attachments go to any S3-compatible bucket through the `S3_*` variables: AWS
 S3, Cloudflare R2, Backblaze B2, MinIO, Wasabi. The older `R2_*` names still
 work if you already set them.
 
+**The bucket needs a CORS rule.** The browser uploads straight to it with a
+signed URL, so the bucket has to allow `PUT`, `GET` and `HEAD` from the address
+the app is served on. Without one every attachment fails, and the browser
+reports it the same way it reports being offline — so it reads as a network
+problem rather than a missing rule. On R2:
+
+```json
+[{ "AllowedOrigins": ["https://mail.example.com"],
+   "AllowedMethods": ["PUT", "GET", "HEAD"],
+   "AllowedHeaders": ["*"],
+   "ExposeHeaders": ["ETag", "Content-Length", "Content-Type", "Content-Disposition", "Content-Range", "Accept-Ranges", "Last-Modified"],
+   "MaxAgeSeconds": 3600 }]
+```
+
+List only your own origin. A wildcard lets any page that obtains a signed URL
+upload with it.
+
 ## Sending
 
 `MAIL_PROVIDER` picks `ses`, `resend` or `brevo` behind one seam, so switching

package/app/api/mail/accessors/reset-link/route.ts

@@ -0,0 +1,46 @@
+import { randomBytes } from 'node:crypto'
+import { NextResponse } from 'next/server'
+import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { createResetToken, getAccount } from '@/lib/mailbox'
+import { publicOrigin } from '@/lib/public-url'
+import { clientKey, rateLimit } from '@/lib/rate-limit'
+
+export const runtime = 'nodejs'
+
+const RESET_TTL_MS = 30 * 60 * 1000
+
+/**
+ * The way out of the loop for somebody with no recovery address: an admin, who can already
+ * read every mailbox here, mints the link and hands it over. Nothing is emailed — the point
+ * is that this person cannot receive email.
+ */
+export async function POST(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const actor = await resolveAccount(req)
+  if (actor.role !== 'admin') {
+    return NextResponse.json({ ok: false, error: 'Admin access required' }, { status: 403 })
+  }
+  const limited = rateLimit(clientKey(req, 'reset-link'), 20, 60 * 60 * 1000)
+  if (limited) return limited
+
+  let body: { email?: string }
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ ok: false, error: 'Invalid JSON' }, { status: 400 })
+  }
+
+  const email = (body.email ?? '').trim().toLowerCase()
+  const account = email ? await getAccount(email) : null
+  if (!account) return NextResponse.json({ ok: false, error: 'No such account' }, { status: 404 })
+
+  const token = randomBytes(32).toString('hex')
+  await createResetToken(email, token, Date.now() + RESET_TTL_MS)
+  return NextResponse.json({
+    ok: true,
+    email,
+    url: `${publicOrigin(req)}/mail/reset?token=${token}`,
+    expiresInMinutes: RESET_TTL_MS / 60000,
+  })
+}

package/app/api/mail/accessors/route.ts

@@ -91,6 +91,22 @@ export async function POST(req: Request) {
   if (existing && existing.status === 'active') {
     return NextResponse.json({ ok: false, error: 'That person already has an account' }, { status: 409 })
   }
+  if (email === inviter.email || email === inviter.address) {
+    return NextResponse.json({ ok: false, error: 'That is your own address' }, { status: 400 })
+  }
+  // An invite has to reach somebody. Sending it to a mailbox on our own domain that nobody
+  // can open yet — the very address this invite would create, most often — posts the link
+  // into a box only the new person could read once they had already accepted it.
+  const inviteeDomain = email.split('@')[1] ?? ''
+  if (ADDRESS_DOMAINS.includes(inviteeDomain)) {
+    const holder = await getAccountByAddress(email)
+    if (!holder || holder.status !== 'active') {
+      return NextResponse.json(
+        { ok: false, error: `Nobody can read ${email} yet. Send the invite to an address they already have.` },
+        { status: 400 },
+      )
+    }
+  }
 
   const role: MailRole = body.role === 'admin' ? 'admin' : 'member'
   const name = body.name?.trim() || null

package/app/api/mail/emails/[id]/route.ts

@@ -59,7 +59,7 @@ export async function GET(req: Request, { params }: { params: Promise<{ id: stri
   if (id.startsWith('mbox-') || !resend) {
     const archived = await fromArchive(id)
     if (archived) return archived
-    return NextResponse.json({ ok: false, error: resend ? 'Not found' : 'RESEND_API_KEY not configured' }, { status: resend ? 404 : 500 })
+    return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })
   }
 
   const { data, error } = await resend.emails.get(id)
@@ -102,7 +102,11 @@ export async function PATCH(req: Request, { params }: { params: Promise<{ id: st
   const guard = await mailAuthGuard(req)
   if (guard) return guard
   const resend = getResend()
-  if (!resend) return NextResponse.json({ ok: false, error: 'RESEND_API_KEY not configured' }, { status: 500 })
+  // Rescheduling and cancelling live in Resend's API; there is no equivalent to call on
+  // another provider, so this is a missing feature rather than a missing key.
+  if (!resend) {
+    return NextResponse.json({ ok: false, error: 'Scheduled mail can only be changed on the Resend provider' }, { status: 501 })
+  }
 
   const { id } = await params
   if (!(await mayReadSent(await resolveAccount(req), id))) return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })
@@ -125,7 +129,11 @@ export async function DELETE(req: Request, { params }: { params: Promise<{ id: s
   const guard = await mailAuthGuard(req)
   if (guard) return guard
   const resend = getResend()
-  if (!resend) return NextResponse.json({ ok: false, error: 'RESEND_API_KEY not configured' }, { status: 500 })
+  // Rescheduling and cancelling live in Resend's API; there is no equivalent to call on
+  // another provider, so this is a missing feature rather than a missing key.
+  if (!resend) {
+    return NextResponse.json({ ok: false, error: 'Scheduled mail can only be changed on the Resend provider' }, { status: 501 })
+  }
 
   const { id } = await params
   if (!(await mayReadSent(await resolveAccount(req), id))) return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })

package/app/api/mail/emails/route.ts

@@ -48,6 +48,8 @@ export async function GET(req: Request) {
     sharedAddress: SHARED_ADDRESS,
     query,
     limit: query ? SEARCH_LIMIT : 500,
+    // Automated sends are shown rather than hidden, tagged so the list can say so.
+    includeAuto: true,
   }).catch(() => [])
   const [flags, opens, sentMeta, accounts] = await Promise.all([
     readSentFlags().catch(() => ({})),
@@ -85,15 +87,23 @@ export async function GET(req: Request) {
     return accountAddresses.has(from) ? from : SHARED_ADDRESS
   }
 
+  const isAutomated = (email: SentEmail): boolean => {
+    const meta = metaMap[email.id]
+    // Sends that predate the tagging carry no meta row, so they are still read by shape.
+    return meta ? meta.isAuto : looksAutomated(email)
+  }
+
   const emails = all
     .filter(email => {
-      const meta = metaMap[email.id]
-      if (meta?.isAuto) return false // tagged automated → never in Sent
-      if (!meta && looksAutomated(email)) return false // pre-existing automated → excluded
       if (ownerScope) return sentOwner(email) === ownerScope
       return true
     })
-    .map(email => ({ ...email, owner: sentOwner(email), inReplyTo: metaMap[email.id]?.inReplyTo ?? null }))
+    .map(email => ({
+      ...email,
+      owner: sentOwner(email),
+      inReplyTo: metaMap[email.id]?.inReplyTo ?? null,
+      isAuto: isAutomated(email),
+    }))
     .filter(email =>
       !query ||
       matchesQuery(query, {

package/app/api/mail/inbox/counts/route.ts

@@ -3,14 +3,14 @@ import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
 import { scopeFor } from '@/lib/scope'
 import { countFolders, countFoldersCached } from '@/lib/mailbox'
 
-const COUNTS_TTL_MS = 20 * 1000
-const countsCache = new Map<string, { at: number; value: Awaited<ReturnType<typeof countFolders>> }>()
+/**
+ * Counts come from the durable cache, which every write that moves mail clears. An extra
+ * in-process copy used to sit in front of it, and nothing could reach in to drop it: a
+ * delete cleared the shared row and this map went on answering with figures from before
+ * it for another twenty seconds, per running instance.
+ */
 async function cachedCounts(owner: string | null, fresh: boolean) {
-  const hit = countsCache.get(owner ?? '*all')
-  if (!fresh && hit && Date.now() - hit.at < COUNTS_TTL_MS) return hit.value
-  const value = fresh ? await countFolders(owner ?? undefined) : await countFoldersCached(owner)
-  countsCache.set(owner ?? '*all', { at: Date.now(), value })
-  return value
+  return fresh ? countFolders(owner ?? undefined) : countFoldersCached(owner)
 }
 
 export const runtime = 'nodejs'

package/app/api/mail/inbox/route.ts

@@ -2,8 +2,8 @@ import { createHmac, timingSafeEqual } from 'node:crypto'
 import { NextResponse } from 'next/server'
 import { mailAuthGuard, isLocalOrigin, resolveAccount } from '@/lib/dev-auth'
 import { scopeFor } from '@/lib/scope'
-import { searchInbox, appendEvent, appendInbound, recordContact, setInboundFlags, setInboundFlagsForThread, setInboundLabels, setThreadSnooze, setInboxOwner, readInbox, claimWebhookEvent, completeWebhookEvent, releaseWebhookEvent, pruneWebhookEvents, type InboundFlags } from '@/lib/mailbox'
-import { attributeOwner, forwardToAccounts, ingestReceived, parseSender } from '@/lib/receive'
+import { searchInbox, appendEvent, appendInbound, recordContact, setInboundFlags, setInboundSpam, setInboundFlagsForThread, setInboundLabels, setThreadSnooze, setInboxOwner, readInbox, claimWebhookEvent, completeWebhookEvent, releaseWebhookEvent, pruneWebhookEvents, type InboundFlags } from '@/lib/mailbox'
+import { addressedToUs, attributeOwner, forwardToAccounts, ingestReceived, parseSender } from '@/lib/receive'
 import { isBrevoInbound, normalizeBrevoInbound } from '@/lib/mail-provider'
 
 export const runtime = 'nodejs'
@@ -27,7 +27,7 @@ export async function GET(req: Request) {
   const threadId = params.get('thread') ?? undefined
   if (text || limitRaw || offset || cursor || threadId) {
     const folderParam = params.get('folder')
-    const folder = (['inbox', 'archive', 'trash', 'starred', 'snoozed'] as const).find(f => f === folderParam)
+    const folder = (['inbox', 'archive', 'trash', 'starred', 'snoozed', 'spam'] as const).find(f => f === folderParam)
     const { rows, total, nextCursor } = await searchInbox({
       text,
       owner: ownerFilter ?? undefined,
@@ -45,6 +45,7 @@ export async function GET(req: Request) {
       label: params.get('label') ?? undefined,
       from: params.get('from') ?? undefined,
       to: params.get('to') ?? undefined,
+      addressed: params.get('addressed') ?? undefined,
     })
     return NextResponse.json({ ok: true, emails: rows, total, offset, nextCursor })
   }
@@ -56,7 +57,7 @@ export async function GET(req: Request) {
 export async function PATCH(req: Request) {
   const guard = await mailAuthGuard(req)
   if (guard) return guard
-  let body: { id?: string; ids?: string[]; threadId?: string; labels?: string[]; owner?: string; snoozedUntil?: string | null } & InboundFlags
+  let body: { id?: string; ids?: string[]; threadId?: string; labels?: string[]; owner?: string; snoozedUntil?: string | null; spam?: boolean } & InboundFlags
   try {
     body = await req.json()
   } catch {
@@ -109,6 +110,11 @@ export async function PATCH(req: Request) {
     const changed = await setInboundFlagsForThread(account.address ?? ' no-address', body.threadId, flags)
     return NextResponse.json({ ok: true, ids: changed })
   }
+  // Quarantine is its own move: it teaches the sender's standing, which a flag does not.
+  if (body.spam !== undefined) {
+    await Promise.all(ids.map(id => setInboundSpam(id, Boolean(body.spam))))
+    return NextResponse.json({ ok: true, ids })
+  }
   await Promise.all(ids.map(id => setInboundFlags(id, flags)))
   return NextResponse.json({ ok: true, ids })
 }
@@ -239,6 +245,19 @@ export async function POST(req: Request) {
 
   if (type === 'email.received') {
     const emailId = String(data.email_id ?? data.id ?? `in_${Date.now()}`)
+    // The signature proves the provider sent it, not that it is ours. One provider account
+    // can hold several tenants' domains and posts all of their mail to the single webhook
+    // it knows about, so anything addressed elsewhere is acknowledged and dropped — a 2xx
+    // rather than an error, because retrying will never make it ours.
+    const addressed = [
+      ...(Array.isArray(data.to) ? (data.to as string[]) : [String(data.to ?? '')]),
+      ...(Array.isArray(data.cc) ? (data.cc as string[]) : []),
+      ...(Array.isArray(data.bcc) ? (data.bcc as string[]) : []),
+    ].filter(Boolean)
+    if (addressed.length && !addressedToUs(addressed)) {
+      console.warn('[mail] refused inbound for another tenant', { emailId, to: addressed })
+      return NextResponse.json({ ok: true, ignored: 'not addressed to this mailbox' })
+    }
     // Keyed on the delivery id, which a retry reuses, so a redelivery of something we
     // already finished is a no-op rather than a second forwarded copy.
     const deliveryId = req.headers.get('svix-id') || `received:${emailId}`

package/app/api/mail/maintenance/received/route.ts

@@ -43,22 +43,27 @@ export async function POST(req: Request) {
   if (!apiKey) return NextResponse.json({ ok: false, error: 'No provider key' }, { status: 400 })
   const url = new URL(req.url)
   const one = url.searchParams.get('id')
+  // Repair works on messages already stored, so the delivery claim is deliberately not
+  // consulted: it says "handled", which is exactly the state being corrected.
+  const repair = url.searchParams.get('repair') === '1'
   const targets = one ? [one] : (await findMissingReceived(apiKey, sinceFrom(req))).map(item => item.id)
 
   const taken: Array<{ id: string; owner: string; subject: string }> = []
   const skipped: string[] = []
   const failed: Array<{ id: string; error: string }> = []
   for (const id of targets) {
-    const claim = await claimWebhookEvent(`received:${id}`)
-    if (claim !== 'claimed') { skipped.push(id); continue }
+    if (!repair) {
+      const claim = await claimWebhookEvent(`received:${id}`)
+      if (claim !== 'claimed') { skipped.push(id); continue }
+    }
     try {
-      const result = await ingestReceived(id)
-      await completeWebhookEvent(`received:${id}`)
+      const result = await ingestReceived(id, {}, repair ? 'repair' : 'store')
+      if (!repair) await completeWebhookEvent(`received:${id}`)
       taken.push({ id, owner: result.owner, subject: result.subject })
     } catch (err) {
-      await releaseWebhookEvent(`received:${id}`)
+      if (!repair) await releaseWebhookEvent(`received:${id}`)
       failed.push({ id, error: err instanceof Error ? err.message : String(err) })
     }
   }
-  return NextResponse.json({ ok: true, taken, skipped, failed })
+  return NextResponse.json({ ok: true, repaired: repair, taken, skipped, failed })
 }

package/app/api/mail/maintenance/rejudge/route.ts

@@ -0,0 +1,32 @@
+import { timingSafeEqual } from 'node:crypto'
+import { NextResponse } from 'next/server'
+import { rejudgeStored } from '@/lib/mailbox'
+
+export const runtime = 'nodejs'
+export const maxDuration = 300
+
+function authorised(req: Request): boolean {
+  const secret = process.env.MAINTENANCE_TOKEN
+  if (!secret) return false
+  const token = (req.headers.get('authorization') ?? '').replace(/^Bearer\s+/i, '')
+  if (token.length !== secret.length) return false
+  try {
+    return timingSafeEqual(Buffer.from(token), Buffer.from(secret))
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Re-reads stored mail through the current judgement and writes back what changed, a page
+ * at a time — `cursor` in the answer is the `before` for the next call.
+ */
+export async function POST(req: Request) {
+  if (!authorised(req)) return NextResponse.json({ ok: false, error: 'Unauthorised' }, { status: 403 })
+  const url = new URL(req.url)
+  const result = await rejudgeStored({
+    before: url.searchParams.get('before') ?? undefined,
+    limit: Number(url.searchParams.get('limit') ?? 200) || 200,
+  })
+  return NextResponse.json({ ok: true, ...result })
+}

package/app/api/mail/recovery/route.ts

@@ -0,0 +1,95 @@
+import { BRAND, ADDRESS_DOMAINS } from '@/lib/brand'
+import { randomBytes } from 'node:crypto'
+import { NextResponse } from 'next/server'
+import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { createResetToken, getAccount, recordSentMeta, setRecoveryEmail } from '@/lib/mailbox'
+import { sendMail } from '@/lib/mail-provider'
+import { renderActionEmail } from '@/lib/emails'
+import { publicOrigin } from '@/lib/public-url'
+import { clientKey, rateLimit } from '@/lib/rate-limit'
+
+export const runtime = 'nodejs'
+
+const VERIFY_TTL_MS = 24 * 60 * 60 * 1000
+
+export async function GET(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const identity = await resolveAccount(req)
+  const account = await getAccount(identity.email)
+  return NextResponse.json({
+    ok: true,
+    recoveryEmail: account?.recoveryEmail ?? null,
+    verified: Boolean(account?.recoveryVerified),
+  })
+}
+
+export async function POST(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const identity = await resolveAccount(req)
+  if (!identity.email) return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 403 })
+
+  const limited = rateLimit(clientKey(req, `recovery:${identity.email}`), 6, 60 * 60 * 1000)
+  if (limited) return limited
+
+  let body: { recovery?: string | null }
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ ok: false, error: 'Invalid JSON' }, { status: 400 })
+  }
+
+  const recovery = (body.recovery ?? '').trim().toLowerCase()
+  if (!recovery) {
+    await setRecoveryEmail(identity.email, null)
+    return NextResponse.json({ ok: true, recoveryEmail: null, verified: false })
+  }
+  if (!/^[^@\s]+@[^@\s.]+\.[^@\s]+$/.test(recovery)) {
+    return NextResponse.json({ ok: false, error: 'That is not an email address we can send to.' }, { status: 400 })
+  }
+  // A recovery address inside the mailbox it recovers is no recovery at all: the reset
+  // link would land in the inbox the person cannot open.
+  if (ADDRESS_DOMAINS.includes(recovery.split('@')[1] ?? '')) {
+    return NextResponse.json(
+      { ok: false, error: `Use an address outside ${BRAND.name} Mail — a locked mailbox cannot receive its own reset link.` },
+      { status: 400 },
+    )
+  }
+
+  await setRecoveryEmail(identity.email, recovery)
+
+  const token = randomBytes(32).toString('hex')
+  await createResetToken(identity.email, token, Date.now() + VERIFY_TTL_MS, 'verify-recovery')
+  const verifyUrl = `${publicOrigin(req)}/api/mail/recovery/verify?token=${token}`
+  const from = (process.env.MAIL_FROM ?? process.env.RESEND_FROM ?? BRAND.supportEmail).replace(/^.*<|>$/g, '').trim()
+
+  try {
+    const { id } = await sendMail({
+      from,
+      fromName: `${BRAND.name} Mail`,
+      to: [recovery],
+      subject: `Confirm this address for ${BRAND.name} Mail recovery`,
+      text: `${identity.email} listed this address as the recovery address for their ${BRAND.name} Mail account.\n\nConfirm it: ${verifyUrl}\n\nThe link expires in 24 hours. Until it is used, no reset can be sent here.`,
+      html: renderActionEmail({
+        eyebrow: `${BRAND.name} · Mail`,
+        accent: BRAND.colors.accent,
+        title: 'Confirm your recovery address',
+        body: `${identity.email} listed this address as where password resets for their ${BRAND.name} Mail account should go. Confirm it and it becomes the only place a reset link is sent.`,
+        actionLabel: 'Confirm this address',
+        actionUrl: verifyUrl,
+        expiry: 'This link expires in 24 hours.',
+        footer: "Didn't expect this? Ignore it — nothing is sent here until the link is used.",
+      }),
+    })
+    if (id) await recordSentMeta(id, null, true).catch(() => {})
+  } catch (err) {
+    console.error('[mail] recovery verification email failed:', err)
+    return NextResponse.json(
+      { ok: false, error: 'Saved, but the confirmation email could not be sent', recoveryEmail: recovery, verified: false },
+      { status: 502 },
+    )
+  }
+
+  return NextResponse.json({ ok: true, recoveryEmail: recovery, verified: false })
+}

package/app/api/mail/recovery/verify/route.ts

@@ -0,0 +1,29 @@
+import { NextResponse } from 'next/server'
+import { consumeToken, getAccount, markRecoveryVerified } from '@/lib/mailbox'
+import { publicOrigin } from '@/lib/public-url'
+import { clientKey, rateLimit } from '@/lib/rate-limit'
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+/**
+ * Opened from the recovery inbox itself, so proving the address is the whole point and no
+ * session is required. It only flips a flag: the token cannot set a password.
+ */
+export async function GET(req: Request) {
+  const limited = rateLimit(clientKey(req, 'verify-recovery'), 20, 15 * 60 * 1000)
+  if (limited) return limited
+
+  const token = new URL(req.url).searchParams.get('token')?.trim() ?? ''
+  const home = `${publicOrigin(req)}/mail`
+  if (!token) return NextResponse.redirect(`${home}?recovery=invalid`, 303)
+
+  const email = await consumeToken(token, 'verify-recovery')
+  if (!email) return NextResponse.redirect(`${home}?recovery=invalid`, 303)
+
+  const account = await getAccount(email)
+  if (!account?.recoveryEmail) return NextResponse.redirect(`${home}?recovery=invalid`, 303)
+
+  const done = await markRecoveryVerified(email, account.recoveryEmail)
+  return NextResponse.redirect(`${home}?recovery=${done ? 'verified' : 'invalid'}`, 303)
+}

package/app/api/mail/request-reset/route.ts

@@ -1,8 +1,8 @@
-import { BRAND } from '@/lib/brand'
+import { BRAND, ADDRESS_DOMAINS } from '@/lib/brand'
 import { randomBytes } from 'node:crypto'
 import { NextResponse } from 'next/server'
 import { isMailAccount } from '@/lib/dev-auth'
-import { createResetToken, recordSentMeta } from '@/lib/mailbox'
+import { createResetToken, getAccount, recordSentMeta } from '@/lib/mailbox'
 import { sendMail } from '@/lib/mail-provider'
 import { renderActionEmail } from '@/lib/emails'
 import { publicOrigin } from '@/lib/public-url'
@@ -12,6 +12,18 @@ export const runtime = 'nodejs'
 
 const RESET_TTL_MS = 30 * 60 * 1000
 
+/** j••••@outlook.com — enough to recognise the inbox, not enough to learn it. */
+function mask(address: string): string {
+  const [local, domain] = address.split('@')
+  if (!domain) return address
+  return `${local.slice(0, 1)}${'•'.repeat(Math.max(3, local.length - 1))}@${domain}`
+}
+
+/** Nothing can be mailed to an address this deployment itself hosts and has locked. */
+const isOurOwn = (address: string) => ADDRESS_DOMAINS.includes(address.split('@')[1] ?? '')
+
+const ASK_ADMIN = 'No confirmed recovery address is set for that mailbox. Ask an administrator on your company mailbox to reset it for you.'
+
 export async function POST(req: Request) {
   const limited = rateLimit(clientKey(req, 'request-reset'), 5, 60 * 60 * 1000)
   if (limited) return limited
@@ -28,9 +40,25 @@ export async function POST(req: Request) {
   // Also capped per address, so a rotating-IP caller cannot bury someone in reset mail.
   const perAddress = rateLimit(`request-reset-address:${email}`, 5, 60 * 60 * 1000)
   if (perAddress) return NextResponse.json({ ok: true })
-  // Always answer ok so we never reveal which addresses are valid accounts.
+  // An unknown address gets the same answer as a known one with nowhere to send, so the
+  // reply still cannot be used to learn who has a mailbox here.
   if (!(await isMailAccount(email))) {
-    return NextResponse.json({ ok: true })
+    return NextResponse.json({ ok: true, needsAdmin: true, message: ASK_ADMIN })
+  }
+
+  // Where the link can actually be read: the confirmed recovery address first, else the
+  // sign-in address when that is somewhere else already. An address inside this mailbox
+  // is no use — it is the thing being recovered.
+  const account = await getAccount(email)
+  const destination =
+    account?.recoveryVerified && account.recoveryEmail
+      ? account.recoveryEmail
+      : !isOurOwn(email)
+        ? email
+        : null
+
+  if (!destination) {
+    return NextResponse.json({ ok: true, needsAdmin: true, message: ASK_ADMIN })
   }
 
   const token = randomBytes(32).toString('hex')
@@ -44,14 +72,14 @@ export async function POST(req: Request) {
     const { id } = await sendMail({
       from,
       fromName: `${BRAND.name} Mail`,
-      to: [email],
+      to: [destination],
       subject: `Reset your ${BRAND.name} Mail password`,
-      text: `Someone requested a password reset for ${BRAND.name} Mail.\n\nSet a new password: ${resetUrl}\n\nThis link expires in 30 minutes. If you didn't request it, ignore this email — your password won't change.`,
+      text: `Someone requested a password reset for ${email} on ${BRAND.name} Mail.\n\nSet a new password: ${resetUrl}\n\nThis link expires in 30 minutes. If you didn't request it, ignore this email — your password won't change.`,
       html: renderActionEmail({
         eyebrow: `${BRAND.name} · Mail`,
         accent: BRAND.colors.accent,
         title: 'Reset your password',
-        body: `Someone asked to reset the password for your ${BRAND.name} Mail account. Choose a new one below.`,
+        body: `Someone asked to reset the password for ${email} on ${BRAND.name} Mail. Choose a new one below.`,
         actionLabel: 'Set a new password',
         actionUrl: resetUrl,
         expiry: 'This link expires in 30 minutes and can be used once.',
@@ -65,5 +93,5 @@ export async function POST(req: Request) {
     return NextResponse.json({ ok: false, error: 'Could not send the reset email' }, { status: 502 })
   }
 
-  return NextResponse.json({ ok: true })
+  return NextResponse.json({ ok: true, message: `Reset link sent to ${mask(destination)}.` })
 }

package/app/api/mail/scheduled/route.ts

@@ -0,0 +1,48 @@
+import { NextResponse } from 'next/server'
+import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { scopeFor } from '@/lib/scope'
+import { listScheduled, cancelScheduled, rescheduleSend } from '@/lib/scheduled'
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+export async function GET(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const account = await resolveAccount(req)
+  const scope = scopeFor(account, new URL(req.url).searchParams.get('mailbox'))
+  return NextResponse.json({ ok: true, scheduled: await listScheduled(scope) })
+}
+
+export async function DELETE(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const account = await resolveAccount(req)
+  const id = new URL(req.url).searchParams.get('id') ?? ''
+  if (!id) return NextResponse.json({ ok: false, error: 'id is required' }, { status: 400 })
+  const cancelled = await cancelScheduled(id, account.address ?? '')
+  if (!cancelled) {
+    return NextResponse.json({ ok: false, error: 'That message is not waiting to be sent' }, { status: 404 })
+  }
+  return NextResponse.json({ ok: true })
+}
+
+export async function PATCH(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const account = await resolveAccount(req)
+  const body = (await req.json().catch(() => null)) as { id?: string; scheduledAt?: string } | null
+  const id = body?.id ?? new URL(req.url).searchParams.get('id') ?? ''
+  const when = body?.scheduledAt ? new Date(body.scheduledAt) : null
+  if (!id || !when || Number.isNaN(when.getTime())) {
+    return NextResponse.json({ ok: false, error: 'id and a valid scheduledAt are required' }, { status: 400 })
+  }
+  if (when.getTime() <= Date.now()) {
+    return NextResponse.json({ ok: false, error: 'Pick a time in the future' }, { status: 400 })
+  }
+  const moved = await rescheduleSend(id, account.address ?? '', when.toISOString())
+  if (!moved) {
+    return NextResponse.json({ ok: false, error: 'That message is not waiting to be sent' }, { status: 404 })
+  }
+  return NextResponse.json({ ok: true, scheduledAt: when.toISOString() })
+}

package/app/api/mail/scheduled/run/route.ts

@@ -0,0 +1,19 @@
+import { NextResponse } from 'next/server'
+import { dispatchDue } from '@/lib/scheduled'
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+/**
+ * Sends everything now due. Driven by a timer rather than by someone having the mailbox
+ * open, because a message written on Friday for Monday has nobody watching when its turn
+ * comes. Safe to call as often as you like: each row is claimed before it is sent.
+ */
+export async function POST(req: Request) {
+  const expected = (process.env.MAINTENANCE_TOKEN ?? '').trim()
+  const offered = (req.headers.get('authorization') ?? '').replace(/^Bearer\s+/i, '').trim()
+  if (!expected || offered !== expected) {
+    return NextResponse.json({ ok: false, error: 'Unauthorized' }, { status: 401 })
+  }
+  return NextResponse.json({ ok: true, ...(await dispatchDue()) })
+}