@realtimex/email-automator 2.28.0 → 2.28.1

package/dist/api/src/services/encryptionInit.js

@@ -0,0 +1,135 @@
+import crypto from 'crypto';
+import { setEncryptionKey, getEncryptionKeyHex } from '../utils/encryption.js';
+import { getServiceRoleSupabase } from './supabase.js';
+import { createLogger } from '../utils/logger.js';
+const logger = createLogger('EncryptionInit');
+let isEncryptionInitialized = false;
+/**
+ * Initialize encryption key from Supabase or generate a new one.
+ * In BYOK mode, this might be called multiple times as different Supabase clients become available.
+ *
+ * @param providedSupabase Optional Supabase client (service role recommended)
+ */
+export async function initializePersistenceEncryption(providedSupabase) {
+    try {
+        const supabase = providedSupabase || getServiceRoleSupabase();
+        if (!supabase) {
+            // BYOK mode: Supabase not configured at startup (credentials come via HTTP headers)
+            // If we don't have a key yet, generate a temporary one in memory
+            if (!getEncryptionKeyHex()) {
+                logger.info('Supabase not configured yet (BYOK mode)');
+                logger.info('Generating temporary encryption key in memory - will be reconciled when Supabase becomes available');
+                const newKey = crypto.randomBytes(32).toString('hex');
+                setEncryptionKey(newKey);
+                logger.info('✓ Temporary encryption key generated and loaded in memory');
+            }
+            return;
+        }
+        // 1. Check if ANY user has an encryption key stored
+        // In sandbox mode, encryption key is always in database
+        const { data: users, error } = await supabase
+            .from('user_settings')
+            .select('user_id, encryption_key')
+            .not('encryption_key', 'is', null)
+            .limit(1);
+        if (error) {
+            logger.warn('Failed to query user_settings for encryption key', { error });
+            // If no key in memory, generate one as fallback
+            if (!getEncryptionKeyHex()) {
+                const newKey = crypto.randomBytes(32).toString('hex');
+                setEncryptionKey(newKey);
+                logger.info('✓ Generated fallback encryption key due to DB error');
+            }
+            return;
+        }
+        if (users && users.length > 0 && users[0].encryption_key) {
+            // Found a persisted key in database
+            const dbKey = users[0].encryption_key;
+            const currentKey = getEncryptionKeyHex();
+            if (currentKey && currentKey !== dbKey) {
+                logger.warn('⚠️ In-memory encryption key differs from database. Overwriting with DB key to ensure consistency across instances.');
+            }
+            logger.info('✓ Loaded encryption key from database');
+            setEncryptionKey(dbKey);
+            isEncryptionInitialized = true;
+            return;
+        }
+        // 2. No key in database - use in-memory key or generate and persist
+        // This happens on first run or after fresh database setup
+        let finalKey = getEncryptionKeyHex();
+        if (!finalKey) {
+            logger.info('No encryption key found in database or memory, generating new key...');
+            finalKey = crypto.randomBytes(32).toString('hex');
+            setEncryptionKey(finalKey);
+        }
+        else {
+            logger.info('Persisting in-memory encryption key to new Supabase instance...');
+        }
+        // 3. Persist to all existing users in database
+        const { data: allUsers } = await supabase
+            .from('user_settings')
+            .select('user_id')
+            .limit(100);
+        if (allUsers && allUsers.length > 0) {
+            logger.info(`Saving encryption key to database for ${allUsers.length} user(s)...`);
+            // Update all users with the new key
+            const updates = allUsers.map((user) => supabase
+                .from('user_settings')
+                .update({ encryption_key: finalKey })
+                .eq('user_id', user.user_id));
+            await Promise.all(updates);
+            logger.info('✓ Encryption key saved to database');
+        }
+        else {
+            logger.info('No users found yet, encryption key loaded in memory');
+            logger.info('Key will be persisted when users are created');
+        }
+        isEncryptionInitialized = true;
+    }
+    catch (err) {
+        logger.error('Error initializing encryption:', err);
+        // Always ensure we have a key, even if there was an error
+        if (!getEncryptionKeyHex()) {
+            logger.warn('Generating emergency fallback encryption key');
+            const fallbackKey = crypto.randomBytes(32).toString('hex');
+            setEncryptionKey(fallbackKey);
+        }
+    }
+}
+/**
+ * Periodic sync: Persist in-memory encryption key to users without one
+ * This handles the "first user" case and any users created before key was persisted
+ */
+export async function syncEncryptionKeyToUsers() {
+    try {
+        const supabase = getServiceRoleSupabase();
+        if (!supabase)
+            return;
+        const currentKey = getEncryptionKeyHex();
+        if (!currentKey)
+            return; // No key in memory yet
+        // Find users without encryption key
+        const { data: usersWithoutKey, error } = await supabase
+            .from('user_settings')
+            .select('user_id')
+            .is('encryption_key', null)
+            .limit(100);
+        if (error || !usersWithoutKey || usersWithoutKey.length === 0) {
+            return; // No users to update
+        }
+        logger.info(`Found ${usersWithoutKey.length} user(s) without encryption key, persisting...`);
+        // Update all users without a key
+        const updates = usersWithoutKey.map((user) => supabase
+            .from('user_settings')
+            .update({ encryption_key: currentKey })
+            .eq('user_id', user.user_id));
+        await Promise.all(updates);
+        logger.info(`✓ Persisted encryption key to ${usersWithoutKey.length} user(s)`);
+    }
+    catch (err) {
+        logger.warn('Error syncing encryption key to users:', { error: err });
+    }
+}
+export function isEncryptionReady() {
+    return isEncryptionInitialized;
+}

package/dist/api/src/services/processor.js

@@ -4,6 +4,7 @@ import { config } from '../config/index.js';
 import { getGmailService } from './gmail.js';
 import { getMicrosoftService } from './microsoft.js';
 import { getImapService } from './imap-service.js';
+import { initializePersistenceEncryption, isEncryptionReady } from './encryptionInit.js';
 import { getIntelligenceService } from './intelligence.js';
 import { getStorageService } from './storage.js';
 import { generateEmailFilename } from '../utils/filename.js';
@@ -105,164 +106,174 @@ export class EmailProcessorService {
     }
     async syncAccount(accountId, userId) {
         const result = { processed: 0, deleted: 0, drafted: 0, errors: 0 };
-        // Reset stop request flag at the start of a manual sync
-        await this.resetStopRequest(userId);
-        // Zero-Config UX: Auto-seed default rules for new users (self-healing)
         try {
-            const defaultRuleService = new DefaultRuleService(this.supabase);
-            const { installed } = await defaultRuleService.ensureDefaultRules(userId);
-            if (installed) {
-                logger.info(`Seeded default rules for user ${userId}`);
+            // Ensure encryption is ready (especially for background syncs)
+            if (!isEncryptionReady()) {
+                await initializePersistenceEncryption(this.supabase);
             }
-        }
-        catch (error) {
-            // Don't fail sync if pack installation fails
-            logger.error('Failed to auto-install Universal Pack', error);
-        }
-        // Create processing log
-        const { data: log } = await this.supabase
-            .from('processing_logs')
-            .insert({
-            user_id: userId,
-            account_id: accountId,
-            status: 'running',
-        })
-            .select()
-            .single();
-        try {
-            // Fetch account
-            const { data: account, error: accError } = await this.supabase
-                .from('email_accounts')
-                .select('*')
-                .eq('id', accountId)
-                .eq('user_id', userId)
-                .single();
-            if (accError || !account) {
-                throw new Error('Account not found or access denied');
-            }
-            logger.info('Retrieved account settings', {
-                accountId: account.id,
-                sync_start_date: account.sync_start_date,
-                last_sync_checkpoint: account.last_sync_checkpoint
-            });
-            // Refresh token if needed
-            let refreshedAccount = account;
-            if (account.provider === 'gmail') {
-                refreshedAccount = await this.gmailService.refreshTokenIfNeeded(this.supabase, account);
-            }
-            else if (account.provider === 'outlook') {
-                refreshedAccount = await this.microsoftService.refreshTokenIfNeeded(this.supabase, account);
+            // Reset stop request flag at the start of a manual sync
+            await this.resetStopRequest(userId);
+            // Zero-Config UX: Auto-seed default rules for new users (self-healing)
+            try {
+                const defaultRuleService = new DefaultRuleService(this.supabase);
+                const { installed } = await defaultRuleService.ensureDefaultRules(userId);
+                if (installed) {
+                    logger.info(`Seeded default rules for user ${userId}`);
+                }
             }
-            else if (account.provider === 'imap') {
-                // IMAP doesn't need token refresh, but we could verify connection here if we wanted
-                refreshedAccount = account;
+            catch (error) {
+                // Don't fail sync if pack installation fails
+                logger.error('Failed to auto-install Universal Pack', error);
             }
-            // Update status to syncing
-            await this.supabase
-                .from('email_accounts')
-                .update({
-                last_sync_status: 'syncing',
-                last_sync_at: new Date().toISOString()
+            // Create processing log
+            const { data: log } = await this.supabase
+                .from('processing_logs')
+                .insert({
+                user_id: userId,
+                account_id: accountId,
+                status: 'running',
             })
-                .eq('id', accountId);
-            // Fetch user's rules
-            const { data: rules } = await this.supabase
-                .from('rules')
-                .select('*')
-                .eq('user_id', userId)
-                .eq('is_enabled', true);
-            // Fetch user settings for AI preferences
-            const { data: settings } = await this.supabase
-                .from('user_settings')
-                .select('*')
-                .eq('user_id', userId)
+                .select()
                 .single();
-            const eventLogger = log ? new EventLogger(this.supabase, log.id) : null;
-            if (eventLogger)
-                await eventLogger.info('Running', 'Starting sync process');
-            // --- STOP CHECK ---
-            if (await this.checkStopRequested(userId, eventLogger))
-                return result;
-            // Process based on provider
             try {
-                if (refreshedAccount.provider === 'gmail') {
-                    await this.processGmailAccount(refreshedAccount, rules || [], settings, result, eventLogger);
+                // Fetch account
+                const { data: account, error: accError } = await this.supabase
+                    .from('email_accounts')
+                    .select('*')
+                    .eq('id', accountId)
+                    .eq('user_id', userId)
+                    .single();
+                if (accError || !account) {
+                    throw new Error('Account not found or access denied');
                 }
-                else if (refreshedAccount.provider === 'outlook') {
-                    await this.processOutlookAccount(refreshedAccount, rules || [], settings, result, eventLogger);
+                logger.info('Retrieved account settings', {
+                    accountId: account.id,
+                    sync_start_date: account.sync_start_date,
+                    last_sync_checkpoint: account.last_sync_checkpoint
+                });
+                // Refresh token if needed
+                let refreshedAccount = account;
+                if (account.provider === 'gmail') {
+                    refreshedAccount = await this.gmailService.refreshTokenIfNeeded(this.supabase, account);
                 }
-                else if (refreshedAccount.provider === 'imap') {
-                    await this.processImapAccount(refreshedAccount, rules || [], settings, result, eventLogger);
+                else if (account.provider === 'outlook') {
+                    refreshedAccount = await this.microsoftService.refreshTokenIfNeeded(this.supabase, account);
                 }
-            }
-            catch (providerError) {
-                const providerName = refreshedAccount.provider === 'gmail' ? 'Gmail' :
-                    refreshedAccount.provider === 'outlook' ? 'Outlook' :
-                        'IMAP';
-                throw new Error(`${providerName} Sync Error: ${providerError instanceof Error ? providerError.message : String(providerError)}`);
-            }
-            // After processing new emails, run retention rules for this account
-            if (await this.checkStopRequested(userId, eventLogger))
-                return result;
-            await this.runRetentionRules(refreshedAccount, rules || [], settings, result, eventLogger);
-            // Wait for background worker to process the queue (ensure sync is fully complete before event)
-            await this.processQueue(userId, settings, result).catch(err => logger.error('Background worker failed', err));
-            // Update log and account on success
-            if (log) {
-                if (eventLogger) {
-                    await eventLogger.success('Finished', 'Sync run completed', {
-                        total_processed: result.processed,
-                        deleted: result.deleted,
-                        drafted: result.drafted,
-                        errors: result.errors
-                    });
+                else if (account.provider === 'imap') {
+                    // IMAP doesn't need token refresh, but we could verify connection here if we wanted
+                    refreshedAccount = account;
                 }
+                // Update status to syncing
                 await this.supabase
-                    .from('processing_logs')
+                    .from('email_accounts')
                     .update({
-                    status: 'success',
-                    completed_at: new Date().toISOString(),
-                    emails_processed: result.processed,
-                    emails_deleted: result.deleted,
-                    emails_drafted: result.drafted,
+                    last_sync_status: 'syncing',
+                    last_sync_at: new Date().toISOString()
                 })
-                    .eq('id', log.id);
-            }
-            await this.supabase
-                .from('email_accounts')
-                .update({
-                last_sync_status: 'success',
-                last_sync_error: null,
-                sync_start_date: null // Clear manual override once used successfully
-            })
-                .eq('id', accountId);
-            logger.info('Sync completed and override cleared', { accountId, ...result });
-        }
-        catch (error) {
-            logger.error('Sync failed', error, { accountId });
-            const errMsg = error instanceof Error ? error.message : 'Unknown error';
-            if (log) {
+                    .eq('id', accountId);
+                // Fetch user's rules
+                const { data: rules } = await this.supabase
+                    .from('rules')
+                    .select('*')
+                    .eq('user_id', userId)
+                    .eq('is_enabled', true);
+                // Fetch user settings for AI preferences
+                const { data: settings } = await this.supabase
+                    .from('user_settings')
+                    .select('*')
+                    .eq('user_id', userId)
+                    .single();
+                const eventLogger = log ? new EventLogger(this.supabase, log.id) : null;
+                if (eventLogger)
+                    await eventLogger.info('Running', 'Starting sync process');
+                // --- STOP CHECK ---
+                if (await this.checkStopRequested(userId, eventLogger))
+                    return result;
+                // Process based on provider
+                try {
+                    if (refreshedAccount.provider === 'gmail') {
+                        await this.processGmailAccount(refreshedAccount, rules || [], settings, result, eventLogger);
+                    }
+                    else if (refreshedAccount.provider === 'outlook') {
+                        await this.processOutlookAccount(refreshedAccount, rules || [], settings, result, eventLogger);
+                    }
+                    else if (refreshedAccount.provider === 'imap') {
+                        await this.processImapAccount(refreshedAccount, rules || [], settings, result, eventLogger);
+                    }
+                }
+                catch (providerError) {
+                    const providerName = refreshedAccount.provider === 'gmail' ? 'Gmail' :
+                        refreshedAccount.provider === 'outlook' ? 'Outlook' :
+                            'IMAP';
+                    throw new Error(`${providerName} Sync Error: ${providerError instanceof Error ? providerError.message : String(providerError)}`);
+                }
+                // After processing new emails, run retention rules for this account
+                if (await this.checkStopRequested(userId, eventLogger))
+                    return result;
+                await this.runRetentionRules(refreshedAccount, rules || [], settings, result, eventLogger);
+                // Wait for background worker to process the queue (ensure sync is fully complete before event)
+                await this.processQueue(userId, settings, result).catch(err => logger.error('Background worker failed', err));
+                // Update log and account on success
+                if (log) {
+                    if (eventLogger) {
+                        await eventLogger.success('Finished', 'Sync run completed', {
+                            total_processed: result.processed,
+                            deleted: result.deleted,
+                            drafted: result.drafted,
+                            errors: result.errors
+                        });
+                    }
+                    await this.supabase
+                        .from('processing_logs')
+                        .update({
+                        status: 'success',
+                        completed_at: new Date().toISOString(),
+                        emails_processed: result.processed,
+                        emails_deleted: result.deleted,
+                        emails_drafted: result.drafted,
+                    })
+                        .eq('id', log.id);
+                }
                 await this.supabase
-                    .from('processing_logs')
+                    .from('email_accounts')
                     .update({
-                    status: 'failed',
-                    completed_at: new Date().toISOString(),
-                    error_message: errMsg,
+                    last_sync_status: 'success',
+                    last_sync_error: null,
+                    sync_start_date: null // Clear manual override once used successfully
                 })
-                    .eq('id', log.id);
+                    .eq('id', accountId);
+                logger.info('Sync completed and override cleared', { accountId, ...result });
             }
-            await this.supabase
-                .from('email_accounts')
-                .update({
-                last_sync_status: 'error',
-                last_sync_error: errMsg
-            })
-                .eq('id', accountId);
-            // If it's a fatal setup error (e.g. Account not found), throw it
-            if (errMsg.includes('Account not found') || errMsg.includes('access denied')) {
-                throw error;
+            catch (error) {
+                logger.error('Sync failed', error, { accountId });
+                const errMsg = error instanceof Error ? error.message : 'Unknown error';
+                if (log) {
+                    await this.supabase
+                        .from('processing_logs')
+                        .update({
+                        status: 'failed',
+                        completed_at: new Date().toISOString(),
+                        error_message: errMsg,
+                    })
+                        .eq('id', log.id);
+                }
+                await this.supabase
+                    .from('email_accounts')
+                    .update({
+                    last_sync_status: 'error',
+                    last_sync_error: errMsg
+                })
+                    .eq('id', accountId);
+                // If it's a fatal setup error (e.g. Account not found), throw it
+                if (errMsg.includes('Account not found') || errMsg.includes('access denied')) {
+                    throw error;
+                }
+                // Otherwise, increment error count and return partial results
+                result.errors++;
             }
-            // Otherwise, increment error count and return partial results
+        }
+        catch (globalError) {
+            logger.error('Global sync execution failed', globalError);
             result.errors++;
         }
         return result;