@novacraft-engineering/mailbox 0.4.4 → 0.4.5

package/app/share/[id]/page.tsx

@@ -46,9 +46,12 @@ export default function SharePage({ params }: { params: Promise<{ id: string }>
   const [meta, setMeta] = useState<Meta | null>(null)
   const [gone, setGone] = useState(false)
   const [password, setPassword] = useState('')
+  const [reveal, setReveal] = useState(false)
   const [busy, setBusy] = useState(false)
   const [error, setError] = useState('')
   const [done, setDone] = useState(false)
+  // Kept so a reader whose browser refuses the scripted download still has a plain link.
+  const [fallback, setFallback] = useState('')
 
   useEffect(() => {
     let cancelled = false
@@ -79,10 +82,36 @@ export default function SharePage({ params }: { params: Promise<{ id: string }>
         setError(data?.error ?? 'That did not work.')
         return
       }
+      // Ask for the headers first. A download that cannot start otherwise leaves this page
+      // sitting on "Starting download…" for ever, because navigating away and failing
+      // reports nothing back — which is indistinguishable from a dead button.
+      try {
+        const ready = await fetch(data.url, { method: 'HEAD' })
+        if (!ready.ok) {
+          const reason = await ready.json().catch(() => null)
+          setError(reason?.error ?? 'That file could not be fetched. Ask the sender for a fresh link.')
+          return
+        }
+      } catch {
+        setError('Could not reach the file. Check your connection and try again.')
+        return
+      }
       setDone(true)
-      // Navigating rather than opening a tab: a popup blocker would eat the tab,
-      // and the signed URL only lasts two minutes.
-      window.location.href = data.url
+      // An anchor carrying `download`, not a navigation. Pointing location at a response
+      // marked as an attachment is supposed to save it and stay put, and often simply does
+      // nothing instead — no download, no error, no way to tell. The anchor is the path
+      // browsers actually honour for a same-origin file, and it never leaves the page.
+      setFallback(data.url)
+      const link = document.createElement('a')
+      link.href = data.url
+      link.download = data.filename ?? ''
+      link.rel = 'noopener'
+      document.body.appendChild(link)
+      link.click()
+      // Removed on a later tick, never in the same one. Chromium starts the download from
+      // the live element, and tearing it out synchronously cancels the fetch before it
+      // begins — which looks exactly like a button that does nothing.
+      window.setTimeout(() => link.remove(), 2000)
     } catch {
       setError('Could not reach the server. Try again.')
     } finally {
@@ -90,6 +119,17 @@ export default function SharePage({ params }: { params: Promise<{ id: string }>
     }
   }, [id, password])
 
+  // The browser gives no signal that a download began, so if this page is still here and
+  // still saying so a while later, say plainly that it may not have worked.
+  useEffect(() => {
+    if (!done) return
+    const timer = window.setTimeout(() => {
+      setError('If nothing has downloaded, your network may be blocking it. Tell the sender.')
+      setDone(false)
+    }, 20000)
+    return () => window.clearTimeout(timer)
+  }, [done])
+
   if (gone) {
     return (
       <main className={styles.wrap} style={brandStyle}>
@@ -131,18 +171,28 @@ export default function SharePage({ params }: { params: Promise<{ id: string }>
         {meta.needsPassword && !done && (
           <label className={styles.field}>
             <span>Password</span>
-            <input
-              type="password"
-              value={password}
-              autoFocus
-              placeholder="The password you were given"
-              onChange={event => setPassword(event.target.value)}
-              onKeyDown={event => event.key === 'Enter' && password && claim()}
-            />
+            <div className={styles.pwWrap}>
+              <input
+                type={reveal ? 'text' : 'password'}
+                value={password}
+                autoFocus
+                placeholder="The password you were given"
+                onChange={event => setPassword(event.target.value)}
+                onKeyDown={event => event.key === 'Enter' && password && claim()}
+              />
+              <button type="button" className={styles.pwToggle} onClick={() => setReveal(show => !show)}>
+                {reveal ? 'Hide' : 'Show'}
+              </button>
+            </div>
           </label>
         )}
 
         {error && <p className={styles.error} role="alert">{error}</p>}
+        {fallback && (
+          <p className={styles.error}>
+            Or <a href={fallback} download>open the file directly</a>.
+          </p>
+        )}
 
         <button
           type="button"

package/app/share/[id]/share.module.css

@@ -81,6 +81,25 @@
   text-transform: uppercase;
   color: #6e6a7c;
 }
+.pwWrap { position: relative; display: flex; }
+.pwWrap input { flex: 1; min-width: 0; padding-right: 62px; }
+.pwToggle {
+  position: absolute;
+  right: 6px;
+  top: 50%;
+  transform: translateY(-50%);
+  padding: 6px 10px;
+  border: 0;
+  border-radius: 8px;
+  background: none;
+  color: #6e6a7c;
+  font: 600 11px/1 inherit;
+  letter-spacing: .06em;
+  text-transform: uppercase;
+  cursor: pointer;
+}
+.pwToggle:hover { color: #221d33; }
+
 .field input {
   width: 100%;
   padding: 11px 13px;

package/lib/dev-auth.test.ts

@@ -0,0 +1,15 @@
+import assert from 'node:assert/strict'
+import { createHash } from 'node:crypto'
+import test from 'node:test'
+
+process.env.DATABASE_URL = 'file::memory:'
+process.env.MAIL_ADDRESS_DOMAIN = 'example.com'
+process.env.MAIL_SEATS = '[]'
+process.env.DEV_ADMIN_EMAIL_HASH = createHash('sha256').update('operator@elsewhere.com').digest('hex')
+process.env.DEV_ADMIN_PASSWORD_HASH = createHash('sha256').update('master-password').digest('hex')
+
+test('the env credential is not a tenant-wide master key', async () => {
+  const { verifyMailAuth } = await import('./dev-auth.ts')
+  const result = await verifyMailAuth('operator@elsewhere.com', 'master-password')
+  assert.equal(result.ok, false, 'it opens no address this deployment does not host')
+})

package/lib/dev-auth.ts

@@ -119,7 +119,11 @@ export async function verifyMailAuth(
   const passwordHashEnv = process.env.DEV_ADMIN_PASSWORD_HASH ?? ''
   if (emailHashEnv && passwordHashEnv) {
     if (sha256(email) === emailHashEnv && sha256(password) === passwordHashEnv) {
-      return { ok: true, email: normalized }
+      // The env pair is a password, not an identity: it opens an address this deployment
+      // actually hosts, never an arbitrary one. The same pair installed on two tenants
+      // would otherwise be one key to both mailboxes.
+      if (await isMailAccount(normalized)) return { ok: true, email: normalized }
+      return { ok: false, error: 'Invalid credentials' }
     }
   }
 

package/lib/mail-provider.test.ts

@@ -0,0 +1,23 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+import { activeProvider, providerConfigProblem } from './mail-provider.ts'
+
+test('a deployment that chose SES is not refused for missing a Resend key', () => {
+  process.env.MAIL_PROVIDER = 'ses'
+  process.env.SES_ACCESS_KEY_ID = 'AKIAEXAMPLE'
+  process.env.SES_SECRET_ACCESS_KEY = 'secret'
+  delete process.env.RESEND_API_KEY
+  assert.equal(activeProvider(), 'ses')
+  assert.equal(providerConfigProblem(), null)
+})
+
+test('each provider reports its own missing configuration', () => {
+  process.env.MAIL_PROVIDER = 'ses'
+  delete process.env.SES_ACCESS_KEY_ID
+  delete process.env.SES_SECRET_ACCESS_KEY
+  assert.match(providerConfigProblem() ?? '', /SES_ACCESS_KEY_ID/)
+
+  process.env.MAIL_PROVIDER = 'resend'
+  delete process.env.RESEND_API_KEY
+  assert.match(providerConfigProblem() ?? '', /RESEND_API_KEY/)
+})

package/lib/mail-provider.ts

@@ -8,7 +8,7 @@
  */
 
 import { randomBytes } from 'node:crypto'
-import { sesSendRaw } from './ses-send'
+import { sesConfigured, sesSendRaw } from './ses-send'
 
 export type MailProvider = 'resend' | 'brevo' | 'ses'
 
@@ -53,6 +53,22 @@ export function activeProvider(): MailProvider {
   return 'resend'
 }
 
+/**
+ * What the configured provider is still missing, or null when it can send. Callers used to
+ * ask for RESEND_API_KEY directly, which refused every send on a deployment that had
+ * deliberately chosen SES or Brevo.
+ */
+export function providerConfigProblem(): string | null {
+  switch (activeProvider()) {
+    case 'ses':
+      return sesConfigured() ? null : 'SES_ACCESS_KEY_ID and SES_SECRET_ACCESS_KEY are not configured'
+    case 'brevo':
+      return process.env.BREVO_API_KEY ? null : 'BREVO_API_KEY is not configured'
+    default:
+      return process.env.RESEND_API_KEY ? null : 'RESEND_API_KEY is not configured'
+  }
+}
+
 function splitAddress(raw: string): { email: string; name?: string } {
   const match = raw.match(/^\s*(.*?)\s*<([^>]+)>\s*$/)
   if (match) return { email: match[2].trim(), name: match[1].replace(/^"|"$/g, '') || undefined }

package/lib/mailbox.ts

@@ -342,6 +342,11 @@ export function ensureMailSchema(): Promise<void> {
       // allowed to fail: the second time round the column is already there.
       await sqlRaw('ALTER TABLE mail_accounts ADD COLUMN password_is_default INTEGER NOT NULL DEFAULT 0')
         .catch(() => {})
+      // Where a reset link goes when the account's own mailbox is the thing locked.
+      await sqlRaw('ALTER TABLE mail_accounts ADD COLUMN recovery_email TEXT').catch(() => {})
+      await sqlRaw('ALTER TABLE mail_accounts ADD COLUMN recovery_verified INTEGER NOT NULL DEFAULT 0').catch(() => {})
+      // A link mailed to an unproven address must not be able to set a password.
+      await sqlRaw("ALTER TABLE mail_reset_tokens ADD COLUMN purpose TEXT NOT NULL DEFAULT 'reset'").catch(() => {})
       await sqlRaw("ALTER TABLE mail_webhook_events ADD COLUMN status TEXT NOT NULL DEFAULT 'working'")
         .catch(() => {})
       await sqlRaw('ALTER TABLE mail_sent ADD COLUMN attachments TEXT').catch(() => {})
@@ -1484,6 +1489,9 @@ export type MailAccount = {
   hasPassword: boolean
   createdAt: string | null
   invitedBy: string | null
+  /** Outside address that can receive a reset link. Only usable once proven. */
+  recoveryEmail: string | null
+  recoveryVerified: boolean
 }
 
 function mapAccount(row: Record<string, unknown>): MailAccount {
@@ -1496,27 +1504,29 @@ function mapAccount(row: Record<string, unknown>): MailAccount {
     hasPassword: Boolean(row.has_password),
     createdAt: isoOrNull(row.created_at),
     invitedBy: (row.invited_by as string) ?? null,
+    recoveryEmail: (row.recovery_email as string) ?? null,
+    recoveryVerified: Boolean(Number(row.recovery_verified ?? 0)),
   }
 }
 
 export async function listAccounts(): Promise<MailAccount[]> {
   await ensureMailSchema()
   const sql = db()
-  const rows = await sql`SELECT email, name, address, role, status, invited_by, created_at, (password_hash IS NOT NULL) AS has_password FROM mail_accounts ORDER BY created_at ASC`
+  const rows = await sql`SELECT email, name, address, role, status, invited_by, created_at, recovery_email, recovery_verified, (password_hash IS NOT NULL) AS has_password FROM mail_accounts ORDER BY created_at ASC`
   return rows.map(mapAccount)
 }
 
 export async function getAccount(email: string): Promise<MailAccount | null> {
   await ensureMailSchema()
   const sql = db()
-  const rows = await sql`SELECT email, name, address, role, status, invited_by, created_at, (password_hash IS NOT NULL) AS has_password FROM mail_accounts WHERE email = ${email.trim().toLowerCase()}`
+  const rows = await sql`SELECT email, name, address, role, status, invited_by, created_at, recovery_email, recovery_verified, (password_hash IS NOT NULL) AS has_password FROM mail_accounts WHERE email = ${email.trim().toLowerCase()}`
   return rows[0] ? mapAccount(rows[0]) : null
 }
 
 export async function getAccountByAddress(address: string): Promise<MailAccount | null> {
   await ensureMailSchema()
   const sql = db()
-  const rows = await sql`SELECT email, name, address, role, status, invited_by, created_at, (password_hash IS NOT NULL) AS has_password FROM mail_accounts WHERE lower(address) = ${address.trim().toLowerCase()}`
+  const rows = await sql`SELECT email, name, address, role, status, invited_by, created_at, recovery_email, recovery_verified, (password_hash IS NOT NULL) AS has_password FROM mail_accounts WHERE lower(address) = ${address.trim().toLowerCase()}`
   return rows[0] ? mapAccount(rows[0]) : null
 }
 
@@ -1552,6 +1562,27 @@ export async function deleteAccount(email: string): Promise<void> {
   await sql`DELETE FROM mail_accounts WHERE email = ${email.trim().toLowerCase()}`
 }
 
+/** Record a recovery address as claimed but unproven. Re-saving the same one re-arms it. */
+export async function setRecoveryEmail(email: string, recovery: string | null): Promise<void> {
+  await ensureMailSchema()
+  const sql = db()
+  const normalized = recovery ? recovery.trim().toLowerCase() : null
+  await sql`
+    UPDATE mail_accounts SET recovery_email = ${normalized}, recovery_verified = 0
+    WHERE email = ${email.trim().toLowerCase()}`
+}
+
+/** Prove the address: only the one currently on the account, so a stale link cannot land. */
+export async function markRecoveryVerified(email: string, recovery: string): Promise<boolean> {
+  await ensureMailSchema()
+  const sql = db()
+  const rows = await sql`
+    UPDATE mail_accounts SET recovery_verified = 1
+    WHERE email = ${email.trim().toLowerCase()} AND lower(recovery_email) = ${recovery.trim().toLowerCase()}
+    RETURNING email`
+  return rows.length > 0
+}
+
 // ── Sent-mail archive (our own copy, independent of any provider) ─
 export type SentMessage = {
   id: string
@@ -1569,6 +1600,8 @@ export type SentMessage = {
   attachments?: Array<{ filename: string; size?: number; contentType?: string; key?: string }>
   /** How many files the list should raise a paperclip for, counted the way the inbox counts. */
   attachmentCount?: number
+  /** Sent by the app itself — an invite, a reset, an auto-reply — rather than by a person. */
+  isAuto?: boolean
 }
 
 export async function recordSentMessage(message: SentMessage): Promise<void> {
@@ -1665,11 +1698,12 @@ export async function readSentArchive(options: {
   sharedAddress?: string | null
   query?: ParsedQuery | null
   limit?: number
+  includeAuto?: boolean
 } = {}): Promise<SentMessage[]> {
   await ensureMailSchema()
   const sql = db()
   const limit = Math.min(Math.max(options.limit ?? 500, 1), 1000)
-  const where: string[] = ['coalesce(m.is_auto, 0) = 0']
+  const where: string[] = options.includeAuto ? [] : ['coalesce(m.is_auto, 0) = 0']
   const args: unknown[] = []
 
   const owner = options.ownerAddress?.trim().toLowerCase()
@@ -1691,6 +1725,7 @@ export async function readSentArchive(options: {
     sql,
     `SELECT s.id, s.from_addr, s.to_addrs, s.cc, s.bcc, s.reply_to, s.subject, s.created_at, s.last_event,
             json_array_length(CASE WHEN json_valid(s.attachments) THEN s.attachments ELSE '[]' END) AS attach_count,
+            coalesce(m.is_auto, 0) AS is_auto,
             ${textColumn} AS text
      FROM mail_sent s LEFT JOIN mail_sent_meta m ON m.email_id = s.id
      ${where.length ? `WHERE ${where.join(' AND ')}` : ''}
@@ -1710,6 +1745,7 @@ export async function readSentArchive(options: {
     createdAt: isoOrNull(row.created_at) ?? new Date(0).toISOString(),
     lastEvent: (row.last_event as string) ?? null,
     attachmentCount: Number(row.attach_count ?? 0),
+    isAuto: Boolean(Number(row.is_auto ?? 0)),
   }))
 }
 
@@ -1931,13 +1967,29 @@ export async function revokeShare(id: string, owner: string): Promise<boolean> {
   return rows.length > 0
 }
 
-export async function createResetToken(email: string, token: string, expires: number): Promise<void> {
+export async function createResetToken(
+  email: string,
+  token: string,
+  expires: number,
+  purpose: 'reset' | 'verify-recovery' = 'reset',
+): Promise<void> {
   await ensureMailSchema()
   const sql = db()
   await sql`DELETE FROM mail_reset_tokens WHERE expires_at < ${nowIso()}`
   await sql`
-    INSERT INTO mail_reset_tokens (token, email, expires_at)
-    VALUES (${token}, ${email.toLowerCase()}, ${new Date(expires).toISOString()})`
+    INSERT INTO mail_reset_tokens (token, email, expires_at, purpose)
+    VALUES (${token}, ${email.toLowerCase()}, ${new Date(expires).toISOString()}, ${purpose})`
+}
+
+/** Spend a non-reset token, returning the address it was issued for. */
+export async function consumeToken(token: string, purpose: 'verify-recovery'): Promise<string | null> {
+  await ensureMailSchema()
+  const sql = db()
+  const rows = await sql`
+    DELETE FROM mail_reset_tokens
+    WHERE token = ${token} AND purpose = ${purpose} AND expires_at > ${nowIso()}
+    RETURNING email`
+  return rows[0]?.email ? String(rows[0].email) : null
 }
 
 /**
@@ -1948,7 +2000,8 @@ export async function resetTokenEmail(token: string): Promise<string | null> {
   await ensureMailSchema()
   const sql = db()
   const rows = await sql`
-    SELECT email FROM mail_reset_tokens WHERE token = ${token} AND expires_at > ${nowIso()}`
+    SELECT email FROM mail_reset_tokens
+    WHERE token = ${token} AND coalesce(purpose, 'reset') = 'reset' AND expires_at > ${nowIso()}`
   const email = rows[0]?.email
   return email ? String(email) : null
 }
@@ -1958,7 +2011,9 @@ export async function resetPasswordWithToken(token: string, passwordHash: string
   await ensureMailSchema()
   const sql = db()
   const consumed = await sql`
-    DELETE FROM mail_reset_tokens WHERE token = ${token} AND expires_at > ${nowIso()} RETURNING email`
+    DELETE FROM mail_reset_tokens
+    WHERE token = ${token} AND coalesce(purpose, 'reset') = 'reset' AND expires_at > ${nowIso()}
+    RETURNING email`
   const email = consumed[0]?.email
   if (!email) return null
   await sql`

package/lib/receive.test.ts

@@ -0,0 +1,13 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+
+process.env.MAIL_ADDRESS_DOMAIN = 'contact.example.com'
+process.env.MAIL_ADDRESS_DOMAINS = 'example.com,contact.example.com'
+
+test('every domain we receive on is refused as a forward target, not just the primary one', async () => {
+  const { ADDRESS_DOMAINS } = await import('./brand.ts')
+  const loops = (address: string) => ADDRESS_DOMAINS.includes(address.split('@')[1] ?? '')
+  assert.equal(loops('hosting@example.com'), true, 'a secondary domain we receive on would loop')
+  assert.equal(loops('hello@contact.example.com'), true, 'the primary domain would loop')
+  assert.equal(loops('someone@gmail.com'), false, 'an outside address is a real destination')
+})

package/lib/receive.ts

@@ -1,4 +1,4 @@
-import { BRAND } from '@/lib/brand'
+import { BRAND, ADDRESS_DOMAINS } from '@/lib/brand'
 import { sendPush } from '@/lib/push'
 import { stripOwnPixel } from '@/lib/email-html'
 import { FORWARD_RECIPIENTS, MAIL_DOMAIN } from '@/lib/dev-auth'
@@ -160,10 +160,13 @@ export async function forwardToAccounts(
   const owningAccount = ownerAddress ? await getAccountByAddress(ownerAddress) : null
   const recipient = owningAccount?.email ?? FORWARD_RECIPIENTS[0] // fallback: the admin
   if (!recipient) return
-  // Forwarding exists to put a copy somewhere the recipient already reads. Once this
-  // domain's MX points here, an address on it is somewhere we read — so forwarding to
-  // one would deliver back into this handler and forward again, without end.
-  if (recipient.trim().toLowerCase().endsWith(`@${MAIL_DOMAIN}`)) return
+  // Forwarding exists to put a copy somewhere the recipient already reads. Once a domain's
+  // MX points here, an address on it is somewhere we read — so forwarding to one would
+  // deliver back into this handler and forward again, without end. Every domain this
+  // deployment receives counts, not just the primary one: an account on a secondary domain
+  // forwards to itself once a minute until something outside gives up.
+  const recipientDomain = recipient.trim().toLowerCase().split('@')[1] ?? ''
+  if (recipientDomain === MAIL_DOMAIN || ADDRESS_DOMAINS.includes(recipientDomain)) return
   const from = MAIL_FROM
   // Attachment bytes only come from Resend's receiving API; under another provider the
   // forward still goes out, just without re-attaching the files.

package/lib/share-ticket.ts

@@ -0,0 +1,42 @@
+import { createHmac, timingSafeEqual } from 'node:crypto'
+
+/**
+ * A short-lived permission to fetch one shared file through this domain.
+ *
+ * The recipient is not a mailbox holder, so there is no session to lean on. The share id
+ * is the capability and the password is the second factor, but both are checked once, on
+ * the page. This ticket carries that decision the few seconds to the download itself, so
+ * the file can be streamed from our own host rather than handing the browser a link to
+ * the bucket — a second hostname the recipient's network may not be able to reach.
+ */
+const TTL_SECONDS = 15 * 60
+
+function secret(): string | null {
+  return process.env.MAIL_SESSION_SECRET?.trim() || null
+}
+
+function sign(payload: string, key: string): string {
+  return createHmac('sha256', key).update(payload).digest('base64url')
+}
+
+export function issueShareTicket(id: string): string | null {
+  const key = secret()
+  if (!key) return null
+  const payload = `${id}.${Date.now() + TTL_SECONDS * 1000}`
+  return `${payload}.${sign(payload, key)}`
+}
+
+/** True only for a ticket this server signed, for this share, that has not expired. */
+export function shareTicketValid(ticket: string | null, id: string): boolean {
+  const key = secret()
+  if (!key || !ticket) return false
+  const cut = ticket.lastIndexOf('.')
+  if (cut < 1) return false
+  const payload = ticket.slice(0, cut)
+  const given = ticket.slice(cut + 1)
+  const expected = sign(payload, key)
+  if (given.length !== expected.length) return false
+  if (!timingSafeEqual(Buffer.from(given), Buffer.from(expected))) return false
+  const [signedId, expires] = payload.split('.')
+  return signedId === id && Number(expires) > Date.now()
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@novacraft-engineering/mailbox",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "description": "A shared webmail app: one codebase, one deployment per mailbox. Threads, a rich composer with signatures, attachments on S3-compatible storage, sharing links, full-text search, web push and PWA install.",
   "keywords": [
     "webmail",