@serve.zone/dcrouter 18.0.2 → 18.1.1

package/ts/db/documents/classes.smtp-account.doc.ts

@@ -0,0 +1,103 @@
+import * as plugins from '../../plugins.js';
+import { DcRouterDb } from '../classes.dcrouter-db.js';
+import type { ISmtpScramVerifier } from '@push.rocks/smartmta';
+import type {
+  ISmtpAccountInfo,
+  ISmtpAccountMailPolicy,
+  ISmtpAccountRecipientScope,
+  ISmtpAccountSenderScope,
+} from '../../../ts_interfaces/data/smtp-account.js';
+
+const getDb = () => DcRouterDb.getInstance().getDb();
+
+/**
+ * Operator-managed authenticated SMTP submission account.
+ *
+ * At rest the credential is exclusively a hashed SCRAM-SHA-256 verifier —
+ * the plaintext password is machine-generated, shown once at create/rotate
+ * time, and never persisted. `toApiObject()` never exposes the verifier.
+ */
+@plugins.smartdata.Collection(() => getDb())
+export class SmtpAccountDoc extends plugins.smartdata.SmartDataDbDoc<SmtpAccountDoc, SmtpAccountDoc> {
+  @plugins.smartdata.unI()
+  @plugins.smartdata.svDb()
+  public id!: string;
+
+  @plugins.smartdata.index({ unique: true })
+  @plugins.smartdata.svDb()
+  public username!: string;
+
+  @plugins.smartdata.svDb()
+  public description: string = '';
+
+  @plugins.smartdata.svDb()
+  public enabled: boolean = true;
+
+  /** Hashed credential only — never a plaintext password. */
+  @plugins.smartdata.svDb()
+  public credentialVerifier!: ISmtpScramVerifier;
+
+  @plugins.smartdata.svDb()
+  public senderScope!: ISmtpAccountSenderScope;
+
+  @plugins.smartdata.svDb()
+  public recipientScope!: ISmtpAccountRecipientScope;
+
+  @plugins.smartdata.svDb()
+  public mailPolicy!: ISmtpAccountMailPolicy;
+
+  @plugins.smartdata.svDb()
+  public createdAt!: number;
+
+  @plugins.smartdata.svDb()
+  public updatedAt!: number;
+
+  @plugins.smartdata.svDb()
+  public createdBy!: string;
+
+  @plugins.smartdata.svDb()
+  public lastRotatedAt?: number;
+
+  constructor() {
+    super();
+  }
+
+  /** Wire representation — never carries the verifier or any secret. */
+  public toApiObject(): ISmtpAccountInfo {
+    return {
+      id: this.id,
+      username: this.username,
+      description: this.description || '',
+      enabled: this.enabled,
+      senderScope: {
+        addresses: [...(this.senderScope?.addresses || [])],
+        domains: [...(this.senderScope?.domains || [])],
+      },
+      recipientScope: {
+        mode: this.recipientScope?.mode || 'any',
+        addresses: [...(this.recipientScope?.addresses || [])],
+        domains: [...(this.recipientScope?.domains || [])],
+      },
+      mailPolicy: {
+        dkimSign: Boolean(this.mailPolicy?.dkimSign),
+        ...(this.mailPolicy?.queue ? { queue: this.mailPolicy.queue } : {}),
+      },
+      createdAt: this.createdAt,
+      updatedAt: this.updatedAt,
+      createdBy: this.createdBy,
+      ...(this.lastRotatedAt ? { lastRotatedAt: this.lastRotatedAt } : {}),
+    };
+  }
+
+  public static async findById(id: string): Promise<SmtpAccountDoc | null> {
+    return await SmtpAccountDoc.getInstance({ id });
+  }
+
+  public static async findByUsername(username: string): Promise<SmtpAccountDoc | null> {
+    return await SmtpAccountDoc.getInstance({ username });
+  }
+
+  public static async findAll(): Promise<SmtpAccountDoc[]> {
+    return await SmtpAccountDoc.getInstances({});
+  }
+}

package/ts/db/documents/index.ts

@@ -4,6 +4,8 @@ export * from './classes.cached.ip.reputation.js';
 export * from './classes.ip-intelligence.doc.js';
 export * from './classes.security-block-rule.doc.js';
 export * from './classes.security-policy-audit.doc.js';
+export * from './classes.authentication-event.doc.js';
+export * from './classes.email-traffic-bucket.doc.js';
 
 // Config document classes
 export * from './classes.route.doc.js';
@@ -42,6 +44,7 @@ export * from './classes.acme-config.doc.js';
 // Email domain management
 export * from './classes.email-domain.doc.js';
 export * from './classes.email-server-settings.doc.js';
+export * from './classes.smtp-account.doc.js';
 
 // Web Push provider documents
 export * from './classes.webpush-binding.doc.js';

package/ts/email/classes.accepted-email-spool.ts

@@ -256,6 +256,7 @@ export class AcceptedEmailSpool {
       await this.notifyEmailQueuePersisted(cachedEmail, 'email-accepted-without-queue');
     }
 
+    this.trackAcceptedInboundEmail(cachedEmail);
     return {
       accepted: true,
       smtpCode: 250,
@@ -319,6 +320,7 @@ export class AcceptedEmailSpool {
       await this.notifyEmailQueuePersisted(cachedEmail, 'raw-email-accepted-without-queue');
     }
 
+    this.trackAcceptedInboundEmail(cachedEmail);
     return {
       accepted: true,
       spoolItemId: cachedEmail.id,
@@ -480,6 +482,12 @@ export class AcceptedEmailSpool {
         logger.log('warn', `Durable envelope ${cachedEmail.id}: ${failed.length}/${dispatchResult.results.length} non-store recipients failed dispatch: ${failed.map((result) => `${result.recipient}=${result.message || result.status}`).join('; ')}`);
       }
     }
+    this.trackAcceptedInboundEmail(cachedEmail);
+  }
+
+  private trackAcceptedInboundEmail(cachedEmailArg: CachedEmail): void {
+    if (cachedEmailArg.direction !== 'inbound') return;
+    this.dcRouterRef.metricsManager?.trackEmailReceived(cachedEmailArg.from);
   }
 
   /**

package/ts/email/classes.email-settings.manager.ts

@@ -1,6 +1,8 @@
 import type { IUnifiedEmailServerOptions } from '@push.rocks/smartmta';
 import { EmailServerSettingsDoc } from '../db/index.js';
 import { logger } from '../logger.js';
+import { isSmtpAccountRouteName } from './classes.smtp-account.manager.js';
+import { isWorkAppManagedMailRouteName } from './classes.workapp-mail-manager.js';
 import type { IDcRouterOptions } from '../classes.dcrouter.js';
 import type {
   IEmailPortConfig,
@@ -216,6 +218,10 @@ export class EmailSettingsManager {
       }
     }
 
+    if (hasOwn(updates, 'removeRouteNames') && updates.removeRouteNames?.length) {
+      nextConfig.routes = this.removeRoutesByName(nextConfig.routes || [], updates.removeRouteNames);
+    }
+
     if (nextEnabled) {
       if (!nextConfig.hostname?.trim()) {
         throw new Error('Email hostname is required when email is enabled');
@@ -228,6 +234,34 @@ export class EmailSettingsManager {
     return nextConfig;
   }
 
+  /**
+   * Remove persisted legacy routes by exact name — the internal-relay
+   * retirement lever, not a general route editor. Refuses generated managed
+   * route names (those are composed at runtime, never persisted here) and
+   * fails loudly on unknown names instead of silently no-oping.
+   */
+  private removeRoutesByName(
+    routes: NonNullable<IUnifiedEmailServerOptions['routes']>,
+    routeNames: string[],
+  ): NonNullable<IUnifiedEmailServerOptions['routes']> {
+    let remaining = routes;
+    for (const routeName of routeNames) {
+      const name = (routeName || '').trim();
+      if (!name) {
+        throw new Error('Route removal requires a non-empty route name');
+      }
+      if (isWorkAppManagedMailRouteName(name) || isSmtpAccountRouteName(name)) {
+        throw new Error(`Route '${name}' is a generated managed route and cannot be removed from persisted settings`);
+      }
+      const next = remaining.filter((route) => route.name !== name);
+      if (next.length === remaining.length) {
+        throw new Error(`Email route not found in persisted settings: ${name}`);
+      }
+      remaining = next;
+    }
+    return remaining;
+  }
+
   private patchEmailPortConfig(
     existingPortConfig: IEmailPortConfig | undefined,
     updates: TEmailServerSettingsUpdate,