@open-mercato/channel-ses 0.7.1-develop.7151.1.00d0391847

package/src/modules/channel_ses/lib/adapter.ts

@@ -0,0 +1,154 @@
+import { SESv2Client, SendEmailCommand } from '@aws-sdk/client-sesv2'
+import nodemailer from 'nodemailer'
+import type {
+  ChannelAdapter,
+  ChannelNativeContent,
+  ConvertOutboundInput,
+  GetMessageStatusInput,
+  InboundMessage,
+  MessageStatus,
+  NormalizedInboundMessage,
+  SendMessageInput,
+  SendMessageResult,
+  VerifyWebhookInput,
+} from '@open-mercato/core/modules/communication_channels/lib/adapter'
+import {
+  htmlToText,
+  sanitizeHeaderValue,
+  stringOrUndefined,
+  toAddressList,
+} from '@open-mercato/core/modules/communication_channels/lib/email-mime'
+import { sesCapabilities } from '../capabilities'
+import { sesCredentialsSchema } from './credentials'
+
+type SesAttachment = {
+  filename: string
+  content: string
+  encoding: 'base64'
+  contentType?: string
+}
+
+type SesSendInfo = {
+  messageId?: string
+  response?: string
+}
+
+type SesTransportOptions = {
+  SES: {
+    sesClient: SESv2Client
+    SendEmailCommand: typeof SendEmailCommand
+  }
+}
+
+type SesMailOptions = Parameters<ReturnType<typeof nodemailer.createTransport>['sendMail']>[0] & {
+  ses?: {
+    ConfigurationSetName?: string
+  }
+}
+
+function attachmentsFromMeta(value: unknown): SesAttachment[] | undefined {
+  if (!Array.isArray(value)) return undefined
+  const attachments = value.flatMap((item): SesAttachment[] => {
+    if (!item || typeof item !== 'object') return []
+    const record = item as Record<string, unknown>
+    const filename = stringOrUndefined(record.filename)
+    const content = stringOrUndefined(record.content)
+    if (!filename || !content) return []
+    const contentType = stringOrUndefined(record.contentType)
+    return [{
+      filename,
+      content,
+      encoding: 'base64',
+      ...(contentType ? { contentType } : {}),
+    }]
+  })
+  return attachments.length ? attachments : undefined
+}
+
+class SesChannelAdapter implements ChannelAdapter {
+  readonly providerKey = 'ses'
+  readonly channelType = 'email'
+  readonly capabilities = sesCapabilities
+
+  async sendMessage(input: SendMessageInput): Promise<SendMessageResult> {
+    const credentials = sesCredentialsSchema.parse(input.credentials)
+    const meta = (input.metadata ?? {}) as Record<string, unknown>
+    const to = Array.isArray(meta.to) ? (meta.to as string[]) : []
+    if (to.length === 0) {
+      return { externalMessageId: '', status: 'failed', error: '[internal] Email send requires at least one recipient' }
+    }
+    const subject = stringOrUndefined(meta.subject)
+    if (!subject) {
+      return { externalMessageId: '', status: 'failed', error: '[internal] Email send requires a subject' }
+    }
+
+    const sesClient = new SESv2Client({ region: credentials.region })
+    const transporter = nodemailer.createTransport({
+      SES: { sesClient, SendEmailCommand },
+    } as Parameters<typeof nodemailer.createTransport>[0] & SesTransportOptions)
+    const configurationSetName = stringOrUndefined(credentials.configurationSetName)
+    const options: SesMailOptions = {
+      from: stringOrUndefined(meta.from) ?? credentials.fromAddress,
+      to,
+      subject,
+      ...(input.content.text ? { text: input.content.text } : {}),
+      ...(input.content.html ? { html: input.content.html } : {}),
+      ...(stringOrUndefined(meta.replyTo) ? { replyTo: stringOrUndefined(meta.replyTo) } : {}),
+      ...(attachmentsFromMeta(meta.attachments)?.length ? { attachments: attachmentsFromMeta(meta.attachments) } : {}),
+      ...(configurationSetName ? { ses: { ConfigurationSetName: configurationSetName } } : {}),
+    }
+
+    try {
+      const info = await transporter.sendMail(options) as SesSendInfo
+      return {
+        externalMessageId: info.messageId || `ses:${Date.now()}`,
+        conversationId: input.conversationId,
+        status: 'sent',
+        metadata: info.response ? { response: info.response } : undefined,
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : 'Unknown error'
+      return { externalMessageId: '', status: 'failed', error: `SES_SEND_FAILED: ${message}` }
+    }
+  }
+
+  async verifyWebhook(_input: VerifyWebhookInput): Promise<InboundMessage> {
+    return { raw: {}, eventType: 'other', metadata: { reason: 'ses-system-email-outbound-only' } }
+  }
+
+  async getStatus(_input: GetMessageStatusInput): Promise<MessageStatus> {
+    return { status: 'sent' }
+  }
+
+  async normalizeInbound(_raw: InboundMessage): Promise<NormalizedInboundMessage> {
+    throw new Error('[internal] Amazon SES system email adapter is outbound-only')
+  }
+
+  async convertOutbound(input: ConvertOutboundInput): Promise<ChannelNativeContent> {
+    const meta = (input.channelMetadata ?? {}) as Record<string, unknown>
+    const to = toAddressList(meta.to).map(sanitizeHeaderValue)
+    const subject = stringOrUndefined(meta.subject)
+    const html = input.bodyFormat === 'html' ? input.body : undefined
+    const text = input.bodyFormat === 'html' ? htmlToText(input.body) : input.body
+    return {
+      content: {
+        text,
+        html,
+        bodyFormat: input.bodyFormat,
+      },
+      metadata: {
+        to,
+        subject,
+        from: stringOrUndefined(meta.from),
+        replyTo: stringOrUndefined(meta.replyTo),
+        attachments: attachmentsFromMeta(meta.attachments),
+      },
+    }
+  }
+}
+
+const adapter = new SesChannelAdapter()
+
+export function getSesChannelAdapter(): ChannelAdapter {
+  return adapter
+}

package/src/modules/channel_ses/lib/credentials.ts

@@ -0,0 +1,9 @@
+import { z } from 'zod'
+
+export const sesCredentialsSchema = z.object({
+  region: z.string().min(1),
+  fromAddress: z.string().email(),
+  configurationSetName: z.string().min(1).optional(),
+})
+
+export type SesCredentials = z.infer<typeof sesCredentialsSchema>

package/src/modules/channel_ses/lib/health.ts

@@ -0,0 +1,53 @@
+import { GetAccountCommand, SESv2Client } from '@aws-sdk/client-sesv2'
+import type { IntegrationScope } from '@open-mercato/shared/modules/integrations/types'
+import { withTimeout } from '@open-mercato/shared/lib/http/fetchWithTimeout'
+import { sesCredentialsSchema } from './credentials'
+
+type HealthCheckResult = {
+  status: 'healthy' | 'unhealthy'
+  message: string
+  details: Record<string, unknown>
+}
+
+export const channelSesHealthCheck = {
+  async check(
+    credentials: Record<string, unknown> | null,
+    _scope: IntegrationScope,
+  ): Promise<HealthCheckResult> {
+    const parsed = sesCredentialsSchema.safeParse(credentials ?? {})
+    if (!parsed.success) {
+      return {
+        status: 'unhealthy',
+        message: `Amazon SES credentials invalid: ${parsed.error.issues[0]?.message ?? 'unknown validation error'}`,
+        details: { reason: 'invalid_credentials' },
+      }
+    }
+
+    const client = new SESv2Client({ region: parsed.data.region })
+    try {
+      const account = await withTimeout(
+        (signal) => client.send(new GetAccountCommand({}), { abortSignal: signal }),
+        8_000,
+        'Amazon SES GetAccount',
+      )
+      return {
+        status: 'healthy',
+        message: 'Amazon SES account is reachable',
+        details: {
+          region: parsed.data.region,
+          productionAccessEnabled: account.ProductionAccessEnabled ?? false,
+          sendingEnabled: account.SendingEnabled ?? false,
+        },
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : 'Amazon SES request failed'
+      return {
+        status: 'unhealthy',
+        message: `Amazon SES health check failed: ${message}`,
+        details: { reason: 'request_failed', region: parsed.data.region },
+      }
+    } finally {
+      client.destroy()
+    }
+  },
+}

package/src/modules/channel_ses/lib/preset.ts

@@ -0,0 +1,91 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { AppContainer } from '@open-mercato/shared/lib/di/container'
+import { normalizeEnvString, resolveDefaultEmailFromAddress } from '@open-mercato/shared/lib/email/config'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { ensureSystemEmailChannel } from '@open-mercato/core/modules/communication_channels/lib/ensure-system-email-channel'
+import { isSelectedSystemEmailProvider } from '@open-mercato/core/modules/communication_channels/lib/system-email-provider-config'
+import { sesCapabilities } from '../capabilities'
+
+const logger = createLogger('channel_ses')
+
+type PresetScope = {
+  em: EntityManager
+  container: AppContainer
+  tenantId: string
+  organizationId: string
+}
+
+type CredentialsServiceLike = {
+  save: (
+    integrationId: string,
+    credentials: Record<string, unknown>,
+    scope: { organizationId: string; tenantId: string; userId?: string | null },
+  ) => Promise<void>
+}
+
+type IntegrationStateServiceLike = {
+  upsert: (
+    integrationId: string,
+    input: { isEnabled: boolean },
+    scope: { organizationId: string; tenantId: string },
+  ) => Promise<unknown>
+}
+
+export function readSesEnvPreset(): { region: string; fromAddress: string; configurationSetName?: string } | null {
+  const fromAddress = resolveDefaultEmailFromAddress()
+  const region = normalizeEnvString(process.env.AWS_SES_REGION) || normalizeEnvString(process.env.AWS_REGION)
+  if (!fromAddress || !region) return null
+  const configurationSetName = normalizeEnvString(process.env.AWS_SES_CONFIGURATION_SET)
+  return {
+    fromAddress,
+    region,
+    ...(configurationSetName ? { configurationSetName } : {}),
+  }
+}
+
+export async function applySesEnvPreset(ctx: PresetScope): Promise<void> {
+  // Only the provider this instance actually selected seeds anything. `AWS_REGION` is not an email
+  // variable here — `.env.example` ships it uncommented for vector search, and every AWS runtime
+  // injects it — so without this gate a Resend instance would advertise an Enabled SES integration
+  // and a `status: 'connected'` SES channel nobody configured. That is the same misleading admin
+  // state #5531 was filed for, pointed the other way.
+  if (!isSelectedSystemEmailProvider('ses')) return
+  const preset = readSesEnvPreset()
+  if (!preset) return
+
+  let credentialsService: CredentialsServiceLike
+  try {
+    credentialsService = ctx.container.resolve('integrationCredentialsService') as CredentialsServiceLike
+  } catch {
+    return
+  }
+
+  await credentialsService.save('channel_ses', preset, {
+    tenantId: ctx.tenantId,
+    organizationId: ctx.organizationId,
+    userId: null,
+  })
+
+  try {
+    const integrationStateService = ctx.container.resolve('integrationStateService') as IntegrationStateServiceLike
+    await integrationStateService.upsert('channel_ses', { isEnabled: true }, {
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId,
+    })
+  } catch (err) {
+    logger.warn('Failed to enable the SES integration state; Integrations will read Disabled while email is live', {
+      err,
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId,
+    })
+  }
+
+  await ensureSystemEmailChannel(ctx.em, {
+    tenantId: ctx.tenantId,
+    organizationId: ctx.organizationId,
+    providerKey: 'ses',
+    externalIdentifier: preset.fromAddress,
+    displayName: 'Amazon SES system email',
+    capabilities: { ...sesCapabilities },
+  })
+}

package/src/modules/channel_ses/lib/system-email-config.ts

@@ -0,0 +1,10 @@
+import { registerSystemEmailProviderConfigResolver } from '@open-mercato/core/modules/communication_channels/lib/system-email-provider-config'
+import { readSesEnvPreset } from './preset'
+
+export function registerSesSystemEmailConfigResolver(): void {
+  registerSystemEmailProviderConfigResolver({
+    providerKey: 'ses',
+    isConfigured: () => Boolean(readSesEnvPreset()),
+    resolveCredentials: ({ fromAddress }) => readSesEnvPreset() ?? { fromAddress },
+  })
+}

package/src/modules/channel_ses/setup.ts

@@ -0,0 +1,30 @@
+import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'
+import {
+  hasChannelAdapter,
+  registerChannelAdapter,
+} from '@open-mercato/core/modules/communication_channels/lib/adapter-registry-singleton'
+import { getSesChannelAdapter } from './lib/adapter'
+import { applySesEnvPreset } from './lib/preset'
+import { registerSesSystemEmailConfigResolver } from './lib/system-email-config'
+
+function ensureSesAdapterRegistered(): void {
+  if (hasChannelAdapter('ses')) return
+  registerChannelAdapter(getSesChannelAdapter())
+}
+
+ensureSesAdapterRegistered()
+registerSesSystemEmailConfigResolver()
+
+export const setup: ModuleSetupConfig = {
+  defaultRoleFeatures: {
+    superadmin: ['channel_ses.view', 'channel_ses.configure'],
+    admin: ['channel_ses.view', 'channel_ses.configure'],
+  },
+  async seedDefaults(ctx) {
+    ensureSesAdapterRegistered()
+    registerSesSystemEmailConfigResolver()
+    await applySesEnvPreset(ctx)
+  },
+}
+
+export default setup

package/tsconfig.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "https://json.schemastore.org/tsconfig",
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "noEmit": true
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist", "**/__tests__/**"]
+}

package/watch.mjs

@@ -0,0 +1,7 @@
+import { watch } from '../../scripts/watch.mjs'
+import { dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+
+watch(__dirname)