@plusscommunities/pluss-core-aws 2.0.26 → 2.0.27

package/aws/getDefaultEmailAddress.js

@@ -2,25 +2,24 @@ const AWS = require("aws-sdk");
 
 module.exports = (accessKey, secretKey) => {
 	return new Promise((resolve, reject) => {
-		if (accessKey && secretKey) {
-			AWS.config.update({
-				accessKeyId: accessKey,
-				secretAccessKey: secretKey,
-			});
-
-			const sesv2 = new AWS.SESV2();
-			const params = { PageSize: 1 };
-			sesv2.listEmailIdentities(params, (err, data) => {
-				if (err) return reject(err);
-				const { EmailIdentities } = data;
-				return resolve(
-					EmailIdentities && EmailIdentities.length > 0
-						? EmailIdentities[0]
-						: null,
-				);
-			});
-		} else {
-			resolve(null);
-		}
+		// Without explicit credentials the execution role is used, scoped to
+		// this client so the global SDK config is never mutated
+		const sesv2 =
+			accessKey && secretKey
+				? new AWS.SESV2({
+						accessKeyId: accessKey,
+						secretAccessKey: secretKey,
+					})
+				: new AWS.SESV2();
+		const params = { PageSize: 1 };
+		sesv2.listEmailIdentities(params, (err, data) => {
+			if (err) return reject(err);
+			const { EmailIdentities } = data;
+			return resolve(
+				EmailIdentities && EmailIdentities.length > 0
+					? EmailIdentities[0]
+					: null,
+			);
+		});
 	});
 };

package/aws/getEmailService.js

@@ -2,20 +2,19 @@ const AWS = require("aws-sdk");
 
 module.exports = (accessKey, secretKey) => {
 	return new Promise((resolve, reject) => {
-		if (accessKey && secretKey) {
-			AWS.config.update({
-				accessKeyId: accessKey,
-				secretAccessKey: secretKey,
-			});
-
-			const sesv2 = new AWS.SESV2();
-			const params = {};
-			sesv2.getAccount(params, (err, data) => {
-				if (err) return reject(err);
-				return resolve(data);
-			});
-		} else {
-			resolve(null);
-		}
+		// Without explicit credentials the execution role is used, scoped to
+		// this client so the global SDK config is never mutated
+		const sesv2 =
+			accessKey && secretKey
+				? new AWS.SESV2({
+						accessKeyId: accessKey,
+						secretAccessKey: secretKey,
+					})
+				: new AWS.SESV2();
+		const params = {};
+		sesv2.getAccount(params, (err, data) => {
+			if (err) return reject(err);
+			return resolve(data);
+		});
 	});
 };

package/aws/getEmailServiceInfo.js

@@ -8,26 +8,33 @@ module.exports = async (accessKey, secretKey) => {
 		sender: null,
 	};
 	const { emailConfig } = getConfig();
-	const service = await getEmailService(accessKey, secretKey);
-	console.log("Amazon SES status", {
-		service,
-		allwoSandbox: emailConfig.allwoSandbox,
-		forceFallback: emailConfig.forceFallback,
-	});
+	// Fallback-only configurations must not require any SES permissions
 	if (emailConfig.forceFallback) return result;
-
-	if (
-		service &&
-		service.SendingEnabled &&
-		(emailConfig.allwoSandbox || service.ProductionAccessEnabled) &&
-		service.SendQuota.Max24HourSend > service.SendQuota.SentLast24Hours
-	) {
-		result.enabled = true;
-		const sender = await getDefaultEmailAddress(accessKey, secretKey);
-		console.log("Amazon SES sender", sender);
-		if (sender) {
-			result.sender = sender.IdentityName;
+	try {
+		const service = await getEmailService(accessKey, secretKey);
+		console.log("Amazon SES status", {
+			service,
+			allwoSandbox: emailConfig.allwoSandbox,
+		});
+		if (
+			service &&
+			service.SendingEnabled &&
+			(emailConfig.allwoSandbox || service.ProductionAccessEnabled) &&
+			service.SendQuota.Max24HourSend > service.SendQuota.SentLast24Hours
+		) {
+			const sender = await getDefaultEmailAddress(accessKey, secretKey);
+			console.log("Amazon SES sender", sender);
+			// Enabled only once the sender lookup has succeeded, so partial SES
+			// permissions degrade to the fallback sender
+			result.enabled = true;
+			if (sender) {
+				result.sender = sender.IdentityName;
+			}
 		}
+	} catch (e) {
+		// A role without the SES grants degrades to the fallback sender
+		// instead of failing the send
+		console.log("Amazon SES unavailable", e.message || e);
 	}
 	return result;
 };

package/aws/sendEmail.js

@@ -1,15 +1,16 @@
 const AWS = require("aws-sdk");
-const { getConfig } = require("../config");
 
 module.exports = (from, to, subject, content, access = null, bcc = null) => {
 	return new Promise((resolve, reject) => {
-		const { serverlessConfig } = getConfig();
-		AWS.config.update({
-			accessKeyId: access ? access.key : serverlessConfig.key,
-			secretAccessKey: access ? access.secret : serverlessConfig.secret,
-		});
-
-		const sesv2 = new AWS.SESV2();
+		// Default to the execution role; explicit credentials are only for
+		// cross-account sends. Scoped to this client so the global SDK config
+		// is never mutated
+		const sesv2 = access
+			? new AWS.SESV2({
+					accessKeyId: access.key,
+					secretAccessKey: access.secret,
+				})
+			: new AWS.SESV2();
 		const params = {
 			Content: {
 				Simple: {

package/helper/sendEmail.js

@@ -63,8 +63,7 @@ module.exports = async (
 		rateLimitId = null,
 	} = {},
 ) => {
-	const { communityConfig, serverlessConfig, emailConfig, accessConfig } =
-		getConfig();
+	const { communityConfig, emailConfig, accessConfig } = getConfig();
 	const now = moment.utc();
 	let rateLimitIdToUse;
 
@@ -120,10 +119,7 @@ module.exports = async (
                 </div>`;
 	}
 
-	const sesInfo = await getEmailServiceInfo(
-		serverlessConfig.key,
-		serverlessConfig.secret,
-	);
+	const sesInfo = await getEmailServiceInfo();
 
 	const mailOptions = {
 		from: fromEmail || `${communityConfig.name} <${sesInfo.sender}>`,
@@ -142,7 +138,7 @@ module.exports = async (
 				mailOptions.to,
 				mailOptions.subject,
 				mailOptions.html,
-				serverlessConfig,
+				null,
 				mailOptions.bcc,
 			);
 			log("sendEmail", "Success", { toEmail, subject }, logId);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@plusscommunities/pluss-core-aws",
-	"version": "2.0.26",
+	"version": "2.0.27",
 	"description": "Core extension package for Pluss Communities platform",
 	"scripts": {
 		"betapatch": "npm version prepatch --preid=beta",