@remit/smtp-worker 0.0.1

package/src/handlers/resolve-smtp-config.test.ts

@@ -0,0 +1,221 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import type { AccountItem } from "@remit/data-ports";
+import {
+	type EncryptedPayload,
+	serializeEncryptedPayload,
+} from "@remit/secrets-service";
+import { resolveSmtpConfig } from "./resolve-smtp-config.js";
+
+const buildAccount = (overrides: Partial<AccountItem> = {}): AccountItem =>
+	({
+		accountId: "acct-1",
+		accountConfigId: "cfg-1",
+		username: "alice@example.com",
+		email: "alice@example.com",
+		passwordHash: JSON.stringify(
+			serializeEncryptedPayload({
+				encryptedDek: Buffer.from("dek-imap"),
+				encryptedData: Buffer.from("data-imap"),
+				iv: Buffer.from("iv-imap"),
+				authTag: Buffer.from("tag-imap"),
+			}),
+		),
+		imapHost: "imap.example.com",
+		imapPort: 993,
+		imapTls: true,
+		imapStartTls: false,
+		smtpEnabled: true,
+		smtpHost: "smtp.example.com",
+		smtpPort: 587,
+		smtpTls: false,
+		smtpStartTls: true,
+		smtpUsername: "",
+		isActive: true,
+		connectionState: "not_authenticated",
+		createdAt: 0,
+		updatedAt: 0,
+		...overrides,
+	}) as unknown as AccountItem;
+
+const stubSecrets = (calls: EncryptedPayload[]) => ({
+	decrypt: async (payload: EncryptedPayload): Promise<string> => {
+		calls.push(payload);
+		return payload.encryptedDek.toString();
+	},
+});
+
+describe("resolveSmtpConfig", () => {
+	it("returns missing when smtpEnabled is false", async () => {
+		const result = await resolveSmtpConfig(
+			buildAccount({ smtpEnabled: false, smtpHost: "smtp.example.com" }),
+			stubSecrets([]),
+		);
+		assert.equal(result.ok, false);
+		if (!result.ok) assert.match(result.reason, /SMTP not configured/);
+	});
+
+	it("returns missing when smtpEnabled is absent (legacy row not yet backfilled)", async () => {
+		const result = await resolveSmtpConfig(
+			buildAccount({ smtpEnabled: undefined, smtpHost: "smtp.example.com" }),
+			stubSecrets([]),
+		);
+		assert.equal(result.ok, false);
+	});
+
+	it("falls back to IMAP password when smtpPasswordHash is absent (issue #163)", async () => {
+		// This is the regression: the web form does not send smtpPassword
+		// unless "use different credentials for SMTP" is checked, so accounts
+		// that share credentials between IMAP and SMTP have no
+		// smtpPasswordHash. Without the fallback, every send fails with
+		// "SMTP not configured".
+		const calls: EncryptedPayload[] = [];
+		const account = buildAccount({
+			smtpHost: "smtp.example.com",
+			smtpPort: 587,
+			smtpPasswordHash: undefined,
+		});
+		const result = await resolveSmtpConfig(account, stubSecrets(calls));
+
+		assert.equal(result.ok, true);
+		if (!result.ok) return;
+		assert.equal(calls.length, 1);
+		assert.equal(
+			calls[0].encryptedDek.toString(),
+			"dek-imap",
+			"should decrypt the IMAP passwordHash",
+		);
+		assert.equal(result.config.host, "smtp.example.com");
+		assert.equal(result.config.port, 587);
+		assert.equal(result.config.user, "alice@example.com");
+		assert.equal(result.config.credentials.kind, "password");
+		if (result.config.credentials.kind === "password") {
+			assert.equal(result.config.credentials.password, "dek-imap");
+		}
+	});
+
+	it("uses smtpPasswordHash when present, not the IMAP passwordHash", async () => {
+		const calls: EncryptedPayload[] = [];
+		const smtpPasswordHash = JSON.stringify(
+			serializeEncryptedPayload({
+				encryptedDek: Buffer.from("dek-smtp"),
+				encryptedData: Buffer.from("data-smtp"),
+				iv: Buffer.from("iv-smtp"),
+				authTag: Buffer.from("tag-smtp"),
+			}),
+		);
+		const account = buildAccount({
+			smtpHost: "smtp.example.com",
+			smtpPort: 587,
+			smtpUsername: "alice-smtp@example.com",
+			smtpPasswordHash,
+		});
+		const result = await resolveSmtpConfig(account, stubSecrets(calls));
+
+		assert.equal(result.ok, true);
+		if (!result.ok) return;
+		assert.equal(calls.length, 1);
+		assert.equal(calls[0].encryptedDek.toString(), "dek-smtp");
+		assert.equal(result.config.user, "alice-smtp@example.com");
+		assert.equal(result.config.credentials.kind, "password");
+		if (result.config.credentials.kind === "password") {
+			assert.equal(result.config.credentials.password, "dek-smtp");
+		}
+	});
+
+	it("uses smtpTls flag for the secure setting", async () => {
+		const result = await resolveSmtpConfig(
+			buildAccount({
+				smtpHost: "smtp.example.com",
+				smtpPort: 465,
+				smtpTls: true,
+			}),
+			stubSecrets([]),
+		);
+		assert.equal(result.ok, true);
+		if (!result.ok) return;
+		assert.equal(result.config.secure, true);
+	});
+
+	it("defaults secure to false when smtpTls is absent", async () => {
+		const result = await resolveSmtpConfig(
+			buildAccount({
+				smtpHost: "smtp.example.com",
+				smtpPort: 587,
+				smtpTls: undefined,
+			}),
+			stubSecrets([]),
+		);
+		assert.equal(result.ok, true);
+		if (!result.ok) return;
+		assert.equal(result.config.secure, false);
+	});
+
+	describe("OAuth accounts — pre-resolved accessToken credential", () => {
+		// OAuth accounts: the caller (send-message-core) already resolved
+		// credentials via resolveConnectionCredentials (the single authType branch).
+		// resolveSmtpConfig receives the access token as SmtpCredentials.
+
+		it("builds OAUTH2 SmtpConfig from pre-resolved accessToken credential", async () => {
+			const account = buildAccount({
+				authType: "oauthMicrosoft",
+				smtpHost: "smtp.office365.com",
+				smtpPort: 587,
+			});
+
+			const result = await resolveSmtpConfig(account, stubSecrets([]), {
+				kind: "accessToken",
+				accessToken: "my-access-token",
+			});
+
+			assert.equal(result.ok, true);
+			if (!result.ok) return;
+			assert.equal(result.config.credentials.kind, "accessToken");
+			if (result.config.credentials.kind === "accessToken") {
+				assert.equal(result.config.credentials.accessToken, "my-access-token");
+			}
+			assert.equal(result.config.user, "alice@example.com");
+			assert.equal(result.config.host, "smtp.office365.com");
+			assert.equal(result.config.port, 587);
+		});
+
+		it("ignores the password credential and uses the SMTP-specific hash (issue #163)", async () => {
+			// The upstream resolver returns the IMAP password as a password
+			// credential. For SMTP we must honour the account's distinct
+			// smtpPasswordHash rather than the IMAP password — so the credential
+			// argument is ignored and the stored SMTP hash is decrypted.
+			const calls: EncryptedPayload[] = [];
+			const smtpPasswordHash = JSON.stringify(
+				serializeEncryptedPayload({
+					encryptedDek: Buffer.from("dek-smtp"),
+					encryptedData: Buffer.from("data-smtp"),
+					iv: Buffer.from("iv-smtp"),
+					authTag: Buffer.from("tag-smtp"),
+				}),
+			);
+			const account = buildAccount({
+				smtpHost: "smtp.example.com",
+				smtpPort: 587,
+				smtpPasswordHash,
+			});
+
+			const result = await resolveSmtpConfig(account, stubSecrets(calls), {
+				kind: "password",
+				password: "imap-password-should-be-ignored",
+			});
+
+			assert.equal(result.ok, true);
+			if (!result.ok) return;
+			assert.equal(calls.length, 1, "must decrypt the SMTP-specific hash");
+			assert.equal(calls[0].encryptedDek.toString(), "dek-smtp");
+			assert.equal(result.config.credentials.kind, "password");
+			if (result.config.credentials.kind === "password") {
+				assert.equal(
+					result.config.credentials.password,
+					"dek-smtp",
+					"must use the decrypted SMTP password, not the IMAP credential",
+				);
+			}
+		});
+	});
+});

package/src/handlers/resolve-smtp-config.ts

@@ -0,0 +1,105 @@
+import type { AccountItem } from "@remit/data-ports";
+import {
+	deserializeEncryptedPayload,
+	type SecretsService,
+} from "@remit/secrets-service";
+import type { SmtpConfig } from "@remit/smtp-service";
+
+export interface SmtpConfigMissing {
+	ok: false;
+	reason: string;
+}
+
+export interface SmtpConfigResolved {
+	ok: true;
+	config: SmtpConfig;
+}
+
+export type ResolvedSmtpConfig = SmtpConfigResolved | SmtpConfigMissing;
+
+/**
+ * Resolved SMTP credentials — either a password or an OAuth2 access token.
+ * Callers should obtain this via resolveConnectionCredentials from
+ * @remit/mailbox-service (the single authType branch in the codebase).
+ */
+export type SmtpCredentials =
+	| { kind: "password"; password: string }
+	| { kind: "accessToken"; accessToken: string };
+
+/**
+ * Resolve a SmtpConfig from a stored account.
+ *
+ * Credential resolution (authType branching) is handled upstream by
+ * resolveConnectionCredentials in @remit/mailbox-service. For OAuth
+ * accounts the resolved access token is passed in via `credentials` and used
+ * directly. For password accounts the credential is IGNORED here: SMTP must
+ * honour the account's SMTP-specific password (`smtpPasswordHash`) when present,
+ * which is distinct from the IMAP password the upstream resolver returns.
+ *
+ * The web form treats "use different credentials for SMTP" as opt-in: when
+ * disabled (the default), the IMAP password is reused for SMTP and no
+ * smtpPasswordHash is persisted. The SMTP worker must mirror that, otherwise
+ * sends fail with "SMTP not configured" for every account that uses the same
+ * credentials for IMAP and SMTP (issue #163).
+ *
+ * - `smtpEnabled` false => account isn't configured for sending (RFC 032 Tier 2:
+ *   the explicit marker, not inferred from `smtpHost` presence).
+ * - Missing smtpPasswordHash => fall back to passwordHash (the IMAP secret).
+ * - Empty smtpUsername => fall back to username (the IMAP login).
+ *
+ * @param credentials - Pre-resolved credentials from resolveConnectionCredentials.
+ *   Only the `accessToken` kind is consumed (OAuth accounts). For password
+ *   accounts the SMTP-specific hash path always runs so per-SMTP passwords work.
+ */
+export const resolveSmtpConfig = async (
+	account: AccountItem,
+	secrets: Pick<SecretsService, "decrypt">,
+	credentials?: SmtpCredentials,
+): Promise<ResolvedSmtpConfig> => {
+	if (!account.smtpEnabled) {
+		return { ok: false, reason: "SMTP not configured for this account" };
+	}
+
+	const smtpHost = account.smtpHost ?? "";
+	const smtpPort = account.smtpPort ?? 587;
+	const smtpUser = account.smtpUsername || account.username;
+
+	// OAuth accounts: use the pre-minted access token directly.
+	if (credentials?.kind === "accessToken") {
+		return {
+			ok: true,
+			config: {
+				host: smtpHost,
+				port: smtpPort,
+				secure: account.smtpTls ?? false,
+				user: smtpUser,
+				credentials: {
+					kind: "accessToken",
+					accessToken: credentials.accessToken,
+				},
+			},
+		};
+	}
+
+	// Password accounts: prefer the SMTP-specific secret, falling back to the
+	// IMAP password hash (issue #163). The upstream password credential is the
+	// IMAP password and must NOT override an account's separate SMTP password.
+	const passwordHash = account.smtpPasswordHash ?? account.passwordHash;
+	if (!passwordHash) {
+		return { ok: false, reason: "No password configured for this account" };
+	}
+	const smtpPassword = await secrets.decrypt(
+		deserializeEncryptedPayload(JSON.parse(passwordHash)),
+	);
+
+	return {
+		ok: true,
+		config: {
+			host: smtpHost,
+			port: smtpPort,
+			secure: account.smtpTls ?? false,
+			user: smtpUser,
+			credentials: { kind: "password", password: smtpPassword },
+		},
+	};
+};

package/src/handlers/send-message-core.ts

@@ -0,0 +1,270 @@
+import type {
+	AccountItem,
+	MessageItem,
+	OutboxMessageItem,
+	UpdateOutboxMessageInput,
+} from "@remit/data-ports";
+import { AccountAuthType } from "@remit/domain-enums";
+import type { Logger } from "@remit/logger-lambda";
+import { RefreshTokenError } from "@remit/mail-oauth-service";
+import type { SecretsService } from "@remit/secrets-service";
+import {
+	buildMailMessage,
+	type SendResult,
+	SmtpConnectionError,
+	type sendMail,
+} from "@remit/smtp-service";
+import type { SendMessageEvent } from "../events.js";
+import { writeEngagementCounters } from "./engagement-counters.js";
+import {
+	resolveSmtpConfig,
+	type SmtpCredentials,
+} from "./resolve-smtp-config.js";
+
+/** Tenant scope carried from the loaded account, never read off a looked-up row. */
+export interface SendTenant {
+	accountConfigId: string;
+	accountId: string;
+}
+
+export interface EngagementCounterDeps {
+	resolveAddressId: (accountConfigId: string, email: string) => string;
+	incrementOutboundCount: (
+		accountConfigId: string,
+		addressId: string,
+		now: number,
+	) => Promise<void>;
+	incrementReplyCount: (
+		accountConfigId: string,
+		addressId: string,
+		now: number,
+	) => Promise<void>;
+	findMessageByHeader: (
+		accountId: string,
+		messageIdHeader: string,
+	) => Promise<MessageItem | null>;
+	getEnvelopeFromEmail: (messageId: string) => Promise<string | null>;
+}
+
+export interface SendMessageDeps {
+	getOutbox: (
+		accountConfigId: string,
+		id: string,
+	) => Promise<OutboxMessageItem>;
+	getAccount: (id: string) => Promise<AccountItem>;
+	updateOutbox: (
+		accountConfigId: string,
+		id: string,
+		patch: UpdateOutboxMessageInput,
+	) => Promise<unknown>;
+	updateOutboxStatus: (
+		accountConfigId: string,
+		id: string,
+		status: OutboxMessageItem["status"],
+	) => Promise<unknown>;
+	markOutboxSent: (
+		accountConfigId: string,
+		id: string,
+		fields: { sentAt: number; smtpMessageId?: string },
+	) => Promise<unknown>;
+	secrets: Pick<SecretsService, "decrypt">;
+	/**
+	 * Resolve credentials for the account. Called after fetching the account.
+	 * For password accounts this may resolve immediately from the stored hash.
+	 * For OAuth accounts this mints an access token via the token service.
+	 * Throws RefreshTokenError on OAuth failures — callers should not need to
+	 * handle this here; the caller of sendMessage handles it.
+	 */
+	resolveCredentials: (account: AccountItem) => Promise<SmtpCredentials>;
+	/**
+	 * Persist the account's connectionState. Called when a terminal OAuth/SMTP
+	 * auth failure is detected so the account is fenced off until the user
+	 * re-auths (mirrors the IMAP withOAuthLifecycle contract).
+	 */
+	updateConnectionState: (accountId: string, state: string) => Promise<void>;
+	send: typeof sendMail;
+	emitAppendSentMessage: (
+		accountId: string,
+		outboxMessageId: string,
+	) => Promise<void>;
+	engagement: EngagementCounterDeps;
+}
+
+export const sendMessage = async (
+	event: SendMessageEvent,
+	log: Logger,
+	deps: SendMessageDeps,
+): Promise<void> => {
+	const { outboxMessageId, accountId } = event;
+
+	log.info({ outboxMessageId, accountId }, "Processing send message event");
+
+	// Load the account first: its accountConfigId scopes every outbox lookup and
+	// update. The worker's tenant comes from the account it loads by accountId,
+	// never off the outbox row it fetches.
+	const account = await deps.getAccount(accountId);
+	const { accountConfigId } = account;
+
+	const outbox = await deps.getOutbox(accountConfigId, outboxMessageId);
+	if (outbox.status === "sent") {
+		log.info({ outboxMessageId }, "Message already sent, skipping");
+		return;
+	}
+
+	// Tombstone fence: drop events for deleted accounts (#228)
+	if (account.deletedAt) {
+		log.info(
+			{ accountId, deletedAt: account.deletedAt },
+			"Account deleted, dropping send event",
+		);
+		return;
+	}
+
+	// Reauth fence: skip accounts that need re-authentication. No SMTP traffic
+	// until the user re-auths (mirrors the IMAP reauth/ACK contract, #472).
+	if (account.connectionState === "reauth_required") {
+		log.info(
+			{ accountId, connectionState: account.connectionState },
+			"Account requires reauth, dropping send event",
+		);
+		return;
+	}
+
+	// Resolve credentials. On a terminal OAuth auth failure (token revoked),
+	// flip the account to reauth_required and ACK — do not retry. Transient /
+	// config failures rethrow for SQS retry/backoff.
+	let credentials: SmtpCredentials;
+	try {
+		credentials = await deps.resolveCredentials(account);
+	} catch (err) {
+		if (err instanceof RefreshTokenError) {
+			if (err.error.kind === "reauth-required") {
+				log.warn(
+					{ accountId, errorKind: err.error.kind, errorCode: err.error.code },
+					"OAuth token revoked; marking account reauth_required",
+				);
+				await deps.updateConnectionState(accountId, "reauth_required");
+				return; // ACK — do not retry
+			}
+			// transient or config: let-it-crash (SQS retry / DLQ)
+			throw err;
+		}
+		if (err instanceof SmtpConnectionError && err.kind === "auth") {
+			// Only OAuth accounts have a re-auth recovery path. For password
+			// accounts, rethrow to preserve pre-PR batch-item-failure behaviour.
+			if (account.authType !== AccountAuthType.OauthMicrosoft) {
+				throw err;
+			}
+			log.warn(
+				{ accountId, errorKind: err.kind },
+				"SMTP auth rejected; marking account reauth_required",
+			);
+			await deps.updateConnectionState(accountId, "reauth_required");
+			return; // ACK — do not retry
+		}
+		throw err;
+	}
+	const resolved = await resolveSmtpConfig(account, deps.secrets, credentials);
+	if (!resolved.ok) {
+		// `blocked` is distinct from `failed`: no auto-retry — the user has to
+		// reconfigure the account first (issue #192).
+		await deps.updateOutbox(accountConfigId, outboxMessageId, {
+			status: "blocked",
+			lastError: resolved.reason,
+		});
+		log.error({ accountId, reason: resolved.reason }, "SMTP not configured");
+		return;
+	}
+	const smtpConfig = resolved.config;
+
+	await deps.updateOutboxStatus(accountConfigId, outboxMessageId, "sending");
+
+	const message = buildMailMessage(outbox);
+
+	log.info(
+		{ outboxMessageId, to: outbox.toAddresses, subject: outbox.subject },
+		"Sending message via SMTP",
+	);
+	let result: SendResult;
+	try {
+		result = await deps.send(smtpConfig, message);
+	} catch (err) {
+		// A terminal SMTP auth rejection (e.g. expired OAuth token surfaced at
+		// connect time) flips the account to reauth_required and ACKs.
+		// Only OAuth accounts have a re-auth recovery path. For password
+		// accounts, rethrow to preserve pre-PR batch-item-failure behaviour.
+		if (err instanceof SmtpConnectionError && err.kind === "auth") {
+			if (account.authType !== AccountAuthType.OauthMicrosoft) {
+				throw err;
+			}
+			log.warn(
+				{ accountId, errorKind: err.kind },
+				"SMTP auth rejected during send; marking account reauth_required",
+			);
+			await deps.updateConnectionState(accountId, "reauth_required");
+			return; // ACK — do not retry
+		}
+		throw err;
+	}
+
+	if (result.success) {
+		await deps.markOutboxSent(accountConfigId, outboxMessageId, {
+			sentAt: Date.now(),
+			smtpMessageId: result.messageId,
+		});
+		log.info(
+			{ outboxMessageId, smtpMessageId: result.messageId },
+			"Message sent successfully",
+		);
+
+		await writeEngagementCounters(
+			outbox,
+			{ accountConfigId, accountId: account.accountId },
+			deps.engagement,
+			log,
+		).catch((error: unknown) => {
+			log.warn(
+				{ outboxMessageId, error: String(error) },
+				"Failed to write engagement counters (best-effort)",
+			);
+		});
+
+		await deps
+			.emitAppendSentMessage(accountId, outboxMessageId)
+			.catch((error: unknown) => {
+				log.warn(
+					{ outboxMessageId, error: String(error) },
+					"Failed to enqueue APPEND_SENT_MESSAGE (best-effort)",
+				);
+			});
+		return;
+	}
+
+	if (result.isTransient) {
+		log.warn(
+			{
+				outboxMessageId,
+				smtpCode: result.smtpCode,
+				error: result.error?.message,
+			},
+			"Transient failure, will retry",
+		);
+		await deps.updateOutboxStatus(accountConfigId, outboxMessageId, "queued");
+		throw new Error(`SMTP transient error: ${result.error?.message}`);
+	}
+
+	// Permanent failure - mark as failed, don't throw (no retry)
+	await deps.updateOutbox(accountConfigId, outboxMessageId, {
+		status: "failed",
+		lastError: result.error?.message,
+		lastSmtpCode: result.smtpCode,
+	});
+	log.error(
+		{
+			outboxMessageId,
+			smtpCode: result.smtpCode,
+			error: result.error?.message,
+		},
+		"Permanent failure",
+	);
+};