@plusscommunities/pluss-core-aws 2.0.26-beta.0 → 2.0.27

package/aws/getDefaultEmailAddress.js

@@ -2,25 +2,24 @@ const AWS = require("aws-sdk");
 
 module.exports = (accessKey, secretKey) => {
 	return new Promise((resolve, reject) => {
-		if (accessKey && secretKey) {
-			AWS.config.update({
-				accessKeyId: accessKey,
-				secretAccessKey: secretKey,
-			});
-
-			const sesv2 = new AWS.SESV2();
-			const params = { PageSize: 1 };
-			sesv2.listEmailIdentities(params, (err, data) => {
-				if (err) return reject(err);
-				const { EmailIdentities } = data;
-				return resolve(
-					EmailIdentities && EmailIdentities.length > 0
-						? EmailIdentities[0]
-						: null,
-				);
-			});
-		} else {
-			resolve(null);
-		}
+		// Without explicit credentials the execution role is used, scoped to
+		// this client so the global SDK config is never mutated
+		const sesv2 =
+			accessKey && secretKey
+				? new AWS.SESV2({
+						accessKeyId: accessKey,
+						secretAccessKey: secretKey,
+					})
+				: new AWS.SESV2();
+		const params = { PageSize: 1 };
+		sesv2.listEmailIdentities(params, (err, data) => {
+			if (err) return reject(err);
+			const { EmailIdentities } = data;
+			return resolve(
+				EmailIdentities && EmailIdentities.length > 0
+					? EmailIdentities[0]
+					: null,
+			);
+		});
 	});
 };

package/aws/getEmailService.js

@@ -2,20 +2,19 @@ const AWS = require("aws-sdk");
 
 module.exports = (accessKey, secretKey) => {
 	return new Promise((resolve, reject) => {
-		if (accessKey && secretKey) {
-			AWS.config.update({
-				accessKeyId: accessKey,
-				secretAccessKey: secretKey,
-			});
-
-			const sesv2 = new AWS.SESV2();
-			const params = {};
-			sesv2.getAccount(params, (err, data) => {
-				if (err) return reject(err);
-				return resolve(data);
-			});
-		} else {
-			resolve(null);
-		}
+		// Without explicit credentials the execution role is used, scoped to
+		// this client so the global SDK config is never mutated
+		const sesv2 =
+			accessKey && secretKey
+				? new AWS.SESV2({
+						accessKeyId: accessKey,
+						secretAccessKey: secretKey,
+					})
+				: new AWS.SESV2();
+		const params = {};
+		sesv2.getAccount(params, (err, data) => {
+			if (err) return reject(err);
+			return resolve(data);
+		});
 	});
 };

package/aws/getEmailServiceInfo.js

@@ -8,26 +8,33 @@ module.exports = async (accessKey, secretKey) => {
 		sender: null,
 	};
 	const { emailConfig } = getConfig();
-	const service = await getEmailService(accessKey, secretKey);
-	console.log("Amazon SES status", {
-		service,
-		allwoSandbox: emailConfig.allwoSandbox,
-		forceFallback: emailConfig.forceFallback,
-	});
+	// Fallback-only configurations must not require any SES permissions
 	if (emailConfig.forceFallback) return result;
-
-	if (
-		service &&
-		service.SendingEnabled &&
-		(emailConfig.allwoSandbox || service.ProductionAccessEnabled) &&
-		service.SendQuota.Max24HourSend > service.SendQuota.SentLast24Hours
-	) {
-		result.enabled = true;
-		const sender = await getDefaultEmailAddress(accessKey, secretKey);
-		console.log("Amazon SES sender", sender);
-		if (sender) {
-			result.sender = sender.IdentityName;
+	try {
+		const service = await getEmailService(accessKey, secretKey);
+		console.log("Amazon SES status", {
+			service,
+			allwoSandbox: emailConfig.allwoSandbox,
+		});
+		if (
+			service &&
+			service.SendingEnabled &&
+			(emailConfig.allwoSandbox || service.ProductionAccessEnabled) &&
+			service.SendQuota.Max24HourSend > service.SendQuota.SentLast24Hours
+		) {
+			const sender = await getDefaultEmailAddress(accessKey, secretKey);
+			console.log("Amazon SES sender", sender);
+			// Enabled only once the sender lookup has succeeded, so partial SES
+			// permissions degrade to the fallback sender
+			result.enabled = true;
+			if (sender) {
+				result.sender = sender.IdentityName;
+			}
 		}
+	} catch (e) {
+		// A role without the SES grants degrades to the fallback sender
+		// instead of failing the send
+		console.log("Amazon SES unavailable", e.message || e);
 	}
 	return result;
 };

package/aws/sendEmail.js

@@ -1,15 +1,16 @@
 const AWS = require("aws-sdk");
-const { getConfig } = require("../config");
 
 module.exports = (from, to, subject, content, access = null, bcc = null) => {
 	return new Promise((resolve, reject) => {
-		const { serverlessConfig } = getConfig();
-		AWS.config.update({
-			accessKeyId: access ? access.key : serverlessConfig.key,
-			secretAccessKey: access ? access.secret : serverlessConfig.secret,
-		});
-
-		const sesv2 = new AWS.SESV2();
+		// Default to the execution role; explicit credentials are only for
+		// cross-account sends. Scoped to this client so the global SDK config
+		// is never mutated
+		const sesv2 = access
+			? new AWS.SESV2({
+					accessKeyId: access.key,
+					secretAccessKey: access.secret,
+				})
+			: new AWS.SESV2();
 		const params = {
 			Content: {
 				Simple: {

package/db/analytics/logAnalyticsActivity.js

@@ -3,7 +3,8 @@ const moment = require("moment");
 const checkActivityExists = require("./checkActivityExists");
 const updateRef = require("../common/updateRef");
 const getRole = require("../users/getRole");
-const { getMultiRowId, getRowId } = require("../../helper");
+const getUser = require("../users/getUser");
+const { getMultiRowId, getRowId, log } = require("../../helper");
 
 /**
  * Creates an analytics entry
@@ -42,33 +43,56 @@ module.exports = async (
 		}
 	}
 
-	// Enrich analytics events with the user's site-specific role type and category.
-	// Always resolved here via getRole rather than expecting callers to provide them because:
-	// 1. Most callers can't — stream handlers only have minimal embedded objects with no
-	//    type/category fields.
-	// 2. user.type only carries the primary role, not the site-specific role.
-	// 3. user.category doesn't exist on the user object — category (staff/primary/linked)
-	//    lives on the role record.
-	// Centralising here avoids burdening call sites with role resolution and guarantees
-	// accuracy (always reads current role, not potentially stale caller-provided values).
-	// getRole is a DynamoDB point-read (~5ms) and this runs async, so no user-facing latency impact.
+	// Never fail on a missing user — persist with null enrichment.
+	const actor = user || {};
+
+	// Type/category are per-site role facts, so resolve them here — callers only
+	// carry minimal user objects.
 	let userType = null;
 	let userCategory = null;
+	let enrichmentFailed = false;
 
 	try {
-		const role = await getRole(site, user.id);
+		const role = await getRole(site, actor.id);
 		if (role) {
 			userType = role.type || null;
 			userCategory = role.category || null;
 		}
 	} catch (e) {
-		// getRole failed — fall through to master fallback below
+		// Log so an outage is distinguishable from a missing role, then fall
+		// through to the master fallback.
+		enrichmentFailed = true;
+		log("logActivity", "RoleLookupFailed", {
+			site,
+			userId: actor.id || null,
+			err: e,
+		});
 	}
 
-	// Best-effort fallback: user.type is set from primary role, may not always be present
-	if (!userType && user.type === "master") {
+	// Master fallback: previews omit type (undefined ≠ the system user's explicit
+	// null), so resolve it from the user record.
+	let primaryType = actor.type;
+	if (!userType && primaryType === undefined && actor.id) {
+		try {
+			const fullUser = await getUser(actor.id);
+			primaryType = fullUser ? fullUser.type : null;
+		} catch (e) {
+			// Best-effort — log so a lookup failure is distinguishable from a
+			// genuinely uncategorised user, but never block the activity write.
+			enrichmentFailed = true;
+			log("logActivity", "EnrichmentLookupFailed", {
+				site,
+				userId: actor.id,
+				err: e,
+			});
+		}
+	}
+	if (!userType && primaryType === "master") {
 		userType = "master";
-		userCategory = "master";
+	}
+	// Masters count as staff for category filtering.
+	if (userType === "master" && !userCategory) {
+		userCategory = "staff";
 	}
 
 	// Log the activity
@@ -78,8 +102,8 @@ module.exports = async (
 		Timestamp: timestamp || moment.utc().valueOf(),
 		EntityType: entityType,
 		SubjectId: entityId,
-		UserId: user.id,
-		User: user,
+		UserId: actor.id || null,
+		User: user || null,
 		Site: site,
 		EntityId: getRowId(entityId, entityType),
 		ActivityId: getMultiRowId([entityId, entityType, actionType]),
@@ -88,6 +112,14 @@ module.exports = async (
 		userCategory,
 	};
 
+	// An unresolved lookup failure means enrichment didn't happen — omit the
+	// keys so aggregation applies pre-enrichment totals semantics rather than
+	// recording a falsely "enriched but uncategorised" event.
+	if (enrichmentFailed && userType === null && userCategory === null) {
+		delete activity.userType;
+		delete activity.userCategory;
+	}
+
 	await updateRef(`analytics`, activity);
 	return true;
 };

package/helper/sendEmail.js

@@ -63,8 +63,7 @@ module.exports = async (
 		rateLimitId = null,
 	} = {},
 ) => {
-	const { communityConfig, serverlessConfig, emailConfig, accessConfig } =
-		getConfig();
+	const { communityConfig, emailConfig, accessConfig } = getConfig();
 	const now = moment.utc();
 	let rateLimitIdToUse;
 
@@ -120,10 +119,7 @@ module.exports = async (
                 </div>`;
 	}
 
-	const sesInfo = await getEmailServiceInfo(
-		serverlessConfig.key,
-		serverlessConfig.secret,
-	);
+	const sesInfo = await getEmailServiceInfo();
 
 	const mailOptions = {
 		from: fromEmail || `${communityConfig.name} <${sesInfo.sender}>`,
@@ -142,7 +138,7 @@ module.exports = async (
 				mailOptions.to,
 				mailOptions.subject,
 				mailOptions.html,
-				serverlessConfig,
+				null,
 				mailOptions.bcc,
 			);
 			log("sendEmail", "Success", { toEmail, subject }, logId);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@plusscommunities/pluss-core-aws",
-	"version": "2.0.26-beta.0",
+	"version": "2.0.27",
 	"description": "Core extension package for Pluss Communities platform",
 	"scripts": {
 		"betapatch": "npm version prepatch --preid=beta",