@serve.zone/dcrouter 18.0.2 → 18.1.1

package/ts/opsserver/handlers/admin.handler.ts

@@ -18,6 +18,11 @@ type TAdminUser = {
   authSources?: Array<'local' | 'idp.global'>;
 };
 
+type TAuthenticatedAdmin = {
+  user: TAdminUser;
+  authSource: 'local' | 'idp.global';
+};
+
 export class AdminHandler {
   public typedrouter = new plugins.typedrequest.TypedRouter();
   
@@ -330,25 +335,59 @@ export class AdminHandler {
       new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_AdminLoginWithUsernameAndPassword>(
         'adminLoginWithUsernameAndPassword',
         async (dataArg) => {
+          const requestedAuthSource = dataArg.authSource || 'auto';
+          let authenticatedAdmin: TAuthenticatedAdmin | null;
           try {
-            const user = await this.authenticateUser({
+            authenticatedAdmin = await this.authenticateUser({
               username: dataArg.username,
               password: dataArg.password,
-              authSource: dataArg.authSource,
+              authSource: requestedAuthSource,
             });
-            if (!user) {
-              throw new plugins.typedrequest.TypedResponseError('login failed');
-            }
-
-            return {
-              identity: await this.createIdentityForUser(user),
-            };
           } catch (error) {
-            if (error instanceof plugins.typedrequest.TypedResponseError) {
-              throw error;
-            }
+            await this.recordAuthenticationAttempt({
+              username: dataArg.username,
+              success: false,
+              requestedAuthSource,
+              failureReason: String((error as Error).message || '').includes('database is not ready')
+                ? 'serviceUnavailable'
+                : 'internalError',
+            });
             throw new plugins.typedrequest.TypedResponseError('login failed');
           }
+
+          if (!authenticatedAdmin) {
+            await this.recordAuthenticationAttempt({
+              username: dataArg.username,
+              success: false,
+              requestedAuthSource,
+              failureReason: 'invalidCredentials',
+            });
+            throw new plugins.typedrequest.TypedResponseError('login failed');
+          }
+
+          let identity: interfaces.data.IIdentity;
+          try {
+            identity = await this.createIdentityForUser(authenticatedAdmin.user);
+          } catch {
+            await this.recordAuthenticationAttempt({
+              username: dataArg.username,
+              userId: authenticatedAdmin.user.id,
+              success: false,
+              requestedAuthSource,
+              resolvedAuthSource: authenticatedAdmin.authSource,
+              failureReason: 'identityIssuanceFailed',
+            });
+            throw new plugins.typedrequest.TypedResponseError('login failed');
+          }
+
+          await this.recordAuthenticationAttempt({
+            username: dataArg.username,
+            userId: authenticatedAdmin.user.id,
+            success: true,
+            requestedAuthSource,
+            resolvedAuthSource: authenticatedAdmin.authSource,
+          });
+          return { identity };
         }
       )
     );
@@ -492,7 +531,7 @@ export class AdminHandler {
     username: string;
     password: string;
     authSource?: interfaces.requests.TAdminLoginAuthSource;
-  }): Promise<TAdminUser | null> {
+  }): Promise<TAuthenticatedAdmin | null> {
     const accountState = await this.getPersistentAccountState();
     if (accountState.dbEnabled && !accountState.dbReady) {
       throw new plugins.typedrequest.TypedResponseError('database is not ready');
@@ -508,17 +547,37 @@ export class AdminHandler {
         password: optionsArg.password,
         authSource: optionsArg.authSource || 'auto',
       });
-      return result ? this.accountToUser(result.account) : null;
+      return result
+        ? { user: this.accountToUser(result.account), authSource: result.authSource }
+        : null;
     }
 
     for (const [_, userData] of this.users) {
       if (userData.username === optionsArg.username && userData.password === optionsArg.password) {
-        return userData;
+        return { user: userData, authSource: 'local' };
       }
     }
     return null;
   }
 
+  private async recordAuthenticationAttempt(optionsArg: {
+    username: string;
+    userId?: string;
+    success: boolean;
+    requestedAuthSource: interfaces.requests.TAdminLoginAuthSource;
+    resolvedAuthSource?: 'local' | 'idp.global';
+    failureReason?: interfaces.data.TAuthenticationFailureReason;
+  }): Promise<void> {
+    const eventManager = this.opsServerRef.dcRouterRef.authenticationEventManager;
+    if (!eventManager) return;
+    try {
+      await eventManager.recordAttempt(optionsArg);
+    } catch (error) {
+      // Authentication availability must not depend on telemetry persistence.
+      console.warn(`Authentication event recording unavailable: ${(error as Error).message}`);
+    }
+  }
+
   private async resolveUser(userIdArg: string): Promise<TAdminUser | null> {
     const accountState = await this.getPersistentAccountState();
     if (accountState.dbEnabled && !accountState.dbReady) {

package/ts/opsserver/handlers/email-settings.handler.ts

@@ -54,9 +54,19 @@ export class EmailSettingsHandler {
     const mailerBridgeState = dcRouter.emailServer?.getBridgeState() as
       | interfaces.data.TEmailBridgeState
       | undefined;
+    const smtpAccountCount = dcRouter.smtpAccountManager?.getAccountCount() ?? 0;
+    const smtpListenerActive = dcRouter.emailServer
+      ? dcRouter.emailServer.isSmtpListenerActive()
+      : undefined;
     const manager = dcRouter.emailSettingsManager;
     if (manager) {
-      return { ...manager.getPublicSettings(), outboundEgress, mailerBridgeState };
+      return {
+        ...manager.getPublicSettings(),
+        outboundEgress,
+        mailerBridgeState,
+        smtpAccountCount,
+        ...(smtpListenerActive !== undefined ? { smtpListenerActive } : {}),
+      };
     }
     const emailConfig = dcRouter.options.emailConfig;
     const emailPortConfig = dcRouter.options.emailPortConfig;
@@ -75,6 +85,8 @@ export class EmailSettingsHandler {
       domainCount: emailConfig?.domains?.length || 0,
       routeCount: emailConfig?.routes?.length || 0,
       authUserCount: emailConfig?.auth?.users?.length || 0,
+      smtpAccountCount,
+      ...(smtpListenerActive !== undefined ? { smtpListenerActive } : {}),
       updatedAt: 0,
       updatedBy: 'runtime-options',
     };

package/ts/opsserver/handlers/index.ts

@@ -21,6 +21,7 @@ export * from './dns-authority.handler.js';
 export * from './dns-record.handler.js';
 export * from './acme-config.handler.js';
 export * from './email-domain.handler.js';
+export * from './smtp-account.handler.js';
 export * from './gatewayclient.handler.js';
 export * from './realtime.handler.js';
 export * from './config-event.handler.js';

package/ts/opsserver/handlers/security.handler.ts

@@ -27,6 +27,9 @@ export class SecurityHandler {
               malwareDetected: metrics.malwareDetected,
               phishingDetected: metrics.phishingDetected,
               authenticationFailures: metrics.authFailures,
+              authenticationSuccesses: metrics.authSuccesses,
+              authenticationWindowStart: metrics.authWindowStart,
+              authenticationEvents: metrics.authEvents,
               suspiciousActivities: metrics.suspiciousActivities,
             },
             trends: dataArg.includeDetails ? {
@@ -309,6 +312,9 @@ export class SecurityHandler {
     malwareDetected: number;
     phishingDetected: number;
     authFailures: number;
+    authSuccesses: number;
+    authWindowStart: number;
+    authEvents: interfaces.data.IAuthenticationEvent[];
     suspiciousActivities: number;
     trends: {
       spam: Array<{ timestamp: number; value: number }>;
@@ -316,6 +322,15 @@ export class SecurityHandler {
       phishing: Array<{ timestamp: number; value: number }>;
     };
   }> {
+    const authenticationEventManager = this.opsServerRef.dcRouterRef.authenticationEventManager;
+    const authentication = authenticationEventManager
+      ? await authenticationEventManager.getWindowStats()
+      : {
+          windowStart: Date.now() - 86_400_000,
+          successes: 0,
+          failures: 0,
+          events: [],
+        };
     // Get metrics from MetricsManager if available
     if (this.opsServerRef.dcRouterRef.metricsManager) {
       const securityStats = await this.opsServerRef.dcRouterRef.metricsManager.getSecurityStats();
@@ -328,7 +343,10 @@ export class SecurityHandler {
         },
         malwareDetected: securityStats.malwareDetected,
         phishingDetected: securityStats.phishingDetected,
-        authFailures: securityStats.authFailures,
+        authFailures: authentication.failures,
+        authSuccesses: authentication.successes,
+        authWindowStart: authentication.windowStart,
+        authEvents: authentication.events,
         suspiciousActivities: 0,
         trends: {
           spam: [],
@@ -348,7 +366,10 @@ export class SecurityHandler {
       },
       malwareDetected: 0,
       phishingDetected: 0,
-      authFailures: 0,
+      authFailures: authentication.failures,
+      authSuccesses: authentication.successes,
+      authWindowStart: authentication.windowStart,
+      authEvents: authentication.events,
       suspiciousActivities: 0,
       trends: {
         spam: [],

package/ts/opsserver/handlers/smtp-account.handler.ts

@@ -0,0 +1,199 @@
+import * as plugins from '../../plugins.js';
+import type { OpsServer } from '../classes.opsserver.js';
+import * as interfaces from '../../../ts_interfaces/index.js';
+import { requireOpsAuth } from '../helpers/auth.js';
+import { logger } from '../../logger.js';
+
+/**
+ * CRUD handler for operator-managed SMTP submission accounts, plus the
+ * legacy-route retirement lever.
+ *
+ * Auth: admin JWT or API token with `smtp-accounts:read` / `smtp-accounts:write`
+ * scope; every write additionally requires an admin identity when a JWT is
+ * used. Successful admin actions are audit-logged to the ops log.
+ */
+export class SmtpAccountHandler {
+  public typedrouter = new plugins.typedrequest.TypedRouter();
+
+  constructor(private opsServerRef: OpsServer) {
+    this.opsServerRef.typedrouter.addTypedRouter(this.typedrouter);
+    this.registerHandlers();
+  }
+
+  private async requireAuth(
+    request: { identity?: interfaces.data.IIdentity; apiToken?: string },
+    requiredScope: interfaces.data.TApiTokenScope,
+  ): Promise<string> {
+    const auth = await requireOpsAuth(this.opsServerRef, request, {
+      scope: requiredScope,
+      requireAdminIdentity: requiredScope.endsWith(':write'),
+    });
+    return auth.userId;
+  }
+
+  private get manager() {
+    return this.opsServerRef.dcRouterRef.smtpAccountManager;
+  }
+
+  private failure(errorArg: unknown, fallbackMessageArg: string): interfaces.requests.ISmtpAccountActionResult {
+    return {
+      success: false,
+      message: errorArg instanceof Error ? errorArg.message : fallbackMessageArg,
+      code: 'SMTP_ACCOUNT_ACTION_FAILED',
+    };
+  }
+
+  private registerHandlers(): void {
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_GetSmtpAccounts>(
+        'getSmtpAccounts',
+        async (dataArg) => {
+          await this.requireAuth(dataArg, 'smtp-accounts:read');
+          if (!this.manager?.isStarted()) return { accounts: [] };
+          return { accounts: await this.manager.listAccounts() };
+        },
+      ),
+    );
+
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_CreateSmtpAccount>(
+        'createSmtpAccount',
+        async (dataArg) => {
+          const userId = await this.requireAuth(dataArg, 'smtp-accounts:write');
+          if (!this.manager?.isStarted()) {
+            return { success: false, message: 'SmtpAccountManager not initialized', code: 'SMTP_ACCOUNT_MANAGER_UNAVAILABLE' };
+          }
+          try {
+            const result = await this.manager.createAccount({
+              username: dataArg.username,
+              description: dataArg.description,
+              senderScope: dataArg.senderScope,
+              recipientScope: dataArg.recipientScope,
+              mailPolicy: dataArg.mailPolicy,
+              createdBy: userId,
+            });
+            return {
+              success: true,
+              warnings: result.warnings.length > 0 ? result.warnings : undefined,
+              account: result.account,
+              password: result.password,
+            };
+          } catch (err: unknown) {
+            return this.failure(err, 'Failed to create SMTP account');
+          }
+        },
+      ),
+    );
+
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_UpdateSmtpAccount>(
+        'updateSmtpAccount',
+        async (dataArg) => {
+          const userId = await this.requireAuth(dataArg, 'smtp-accounts:write');
+          if (!this.manager?.isStarted()) {
+            return { success: false, message: 'SmtpAccountManager not initialized', code: 'SMTP_ACCOUNT_MANAGER_UNAVAILABLE' };
+          }
+          try {
+            const result = await this.manager.updateAccount(dataArg.id, {
+              description: dataArg.description,
+              senderScope: dataArg.senderScope,
+              recipientScope: dataArg.recipientScope,
+              mailPolicy: dataArg.mailPolicy,
+            }, userId);
+            return {
+              success: true,
+              warnings: result.warnings.length > 0 ? result.warnings : undefined,
+              account: result.account,
+            };
+          } catch (err: unknown) {
+            return this.failure(err, 'Failed to update SMTP account');
+          }
+        },
+      ),
+    );
+
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_ToggleSmtpAccount>(
+        'toggleSmtpAccount',
+        async (dataArg) => {
+          const userId = await this.requireAuth(dataArg, 'smtp-accounts:write');
+          if (!this.manager?.isStarted()) {
+            return { success: false, message: 'SmtpAccountManager not initialized', code: 'SMTP_ACCOUNT_MANAGER_UNAVAILABLE' };
+          }
+          try {
+            const result = await this.manager.toggleAccount(dataArg.id, dataArg.enabled, userId);
+            return { success: true, account: result.account };
+          } catch (err: unknown) {
+            return this.failure(err, 'Failed to toggle SMTP account');
+          }
+        },
+      ),
+    );
+
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_RotateSmtpAccountPassword>(
+        'rotateSmtpAccountPassword',
+        async (dataArg) => {
+          const userId = await this.requireAuth(dataArg, 'smtp-accounts:write');
+          if (!this.manager?.isStarted()) {
+            return { success: false, message: 'SmtpAccountManager not initialized', code: 'SMTP_ACCOUNT_MANAGER_UNAVAILABLE' };
+          }
+          try {
+            const result = await this.manager.rotatePassword(dataArg.id, userId);
+            return { success: true, account: result.account, password: result.password };
+          } catch (err: unknown) {
+            return this.failure(err, 'Failed to rotate SMTP account password');
+          }
+        },
+      ),
+    );
+
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_DeleteSmtpAccount>(
+        'deleteSmtpAccount',
+        async (dataArg) => {
+          const userId = await this.requireAuth(dataArg, 'smtp-accounts:write');
+          if (!this.manager?.isStarted()) {
+            return { success: false, message: 'SmtpAccountManager not initialized', code: 'SMTP_ACCOUNT_MANAGER_UNAVAILABLE' };
+          }
+          try {
+            await this.manager.deleteAccount(dataArg.id, userId);
+            return { success: true };
+          } catch (err: unknown) {
+            return this.failure(err, 'Failed to delete SMTP account');
+          }
+        },
+      ),
+    );
+
+    // Internal-relay retirement lever: removes one persisted legacy route by
+    // exact name through the standard settings restart path. Guarded in
+    // EmailSettingsManager (unknown names and generated managed names fail).
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_RemoveLegacyEmailRoute>(
+        'removeLegacyEmailRoute',
+        async (dataArg) => {
+          const userId = await this.requireAuth(dataArg, 'smtp-accounts:write');
+          const routeName = (dataArg.routeName || '').trim();
+          logger.log('info', `removeLegacyEmailRoute invoked by ${userId} for route '${routeName}'`);
+          if (!routeName) {
+            return { success: false, message: 'routeName is required', code: 'SMTP_ACCOUNT_ACTION_FAILED' };
+          }
+          if (!this.opsServerRef.dcRouterRef.emailSettingsManager) {
+            return { success: false, message: 'EmailSettingsManager not initialized', code: 'EMAIL_SETTINGS_MANAGER_UNAVAILABLE' };
+          }
+          try {
+            await this.opsServerRef.dcRouterRef.updateEmailServerSettings(
+              { removeRouteNames: [routeName] },
+              userId,
+            );
+            logger.log('info', `Legacy email route '${routeName}' removed from persisted settings by ${userId}`);
+            return { success: true, message: `Route '${routeName}' removed` };
+          } catch (err: unknown) {
+            return this.failure(err, 'Failed to remove legacy email route');
+          }
+        },
+      ),
+    );
+  }
+}

package/ts/opsserver/handlers/stats.handler.ts

@@ -66,10 +66,10 @@ export class StatsHandler {
             stats: {
               sent: stats.sentToday,
               received: stats.receivedToday,
-              bounced: Math.floor(stats.sentToday * stats.bounceRate / 100),
+              bounced: stats.bouncedToday,
               queued: stats.queueSize,
-              failed: 0,
-              averageDeliveryTime: 0,
+              failed: stats.failedToday,
+              averageDeliveryTime: stats.averageDeliveryTime,
               deliveryRate: stats.deliveryRate,
               bounceRate: stats.bounceRate,
             },
@@ -219,10 +219,10 @@ export class StatsHandler {
                 metrics.email = {
                   sent: stats.sentToday,
                   received: stats.receivedToday,
-                  bounced: Math.floor(stats.sentToday * stats.bounceRate / 100),
+                  bounced: stats.bouncedToday,
                   queued: stats.queueSize,
-                  failed: 0,
-                  averageDeliveryTime: 0,
+                  failed: stats.failedToday,
+                  averageDeliveryTime: stats.averageDeliveryTime,
                   deliveryRate: stats.deliveryRate,
                   bounceRate: stats.bounceRate,
                   timeSeries,
@@ -256,7 +256,15 @@ export class StatsHandler {
           
           if (sections.security && this.opsServerRef.dcRouterRef.metricsManager) {
             promises.push(
-              this.opsServerRef.dcRouterRef.metricsManager.getSecurityStats().then(stats => {
+              Promise.all([
+                this.opsServerRef.dcRouterRef.metricsManager.getSecurityStats(),
+                this.opsServerRef.dcRouterRef.authenticationEventManager
+                  ? this.opsServerRef.dcRouterRef.authenticationEventManager.getWindowStats()
+                  : Promise.resolve({
+                      windowStart: Date.now() - 86_400_000,
+                      successes: 0, failures: 0, events: [],
+                    }),
+              ]).then(([stats, authentication]) => {
                 // Get recent events from the SecurityLogger singleton
                 const securityLogger = SecurityLogger.getInstance();
                 const recentEvents = securityLogger.getRecentEvents(50).map((evt) => ({
@@ -276,7 +284,10 @@ export class StatsHandler {
                   spamDetected: stats.spamDetected,
                   malwareDetected: stats.malwareDetected,
                   phishingDetected: stats.phishingDetected,
-                  authenticationFailures: stats.authFailures,
+                  authenticationFailures: authentication.failures,
+                  authenticationSuccesses: authentication.successes,
+                  authenticationWindowStart: authentication.windowStart,
+                  authenticationEvents: authentication.events,
                   suspiciousActivities: stats.totalThreatsBlocked,
                   recentEvents,
                 };
@@ -463,9 +474,12 @@ export class StatsHandler {
     sentToday: number;
     receivedToday: number;
     bounceRate: number;
+    failedToday: number;
+    bouncedToday: number;
     deliveryRate: number;
     queueSize: number;
     domainBreakdown?: { [domain: string]: interfaces.data.IEmailStats };
+    averageDeliveryTime: number;
   }> {
     // Get metrics from MetricsManager if available
     if (this.opsServerRef.dcRouterRef.metricsManager) {
@@ -474,8 +488,11 @@ export class StatsHandler {
         sentToday: emailStats.sentToday,
         receivedToday: emailStats.receivedToday,
         bounceRate: emailStats.bounceRate,
+        failedToday: emailStats.failedToday,
+        bouncedToday: emailStats.bouncedToday,
         deliveryRate: emailStats.deliveryRate,
         queueSize: emailStats.queueSize,
+        averageDeliveryTime: emailStats.averageDeliveryTime,
       };
     }
     
@@ -484,8 +501,11 @@ export class StatsHandler {
       sentToday: 0,
       receivedToday: 0,
       bounceRate: 0,
-      deliveryRate: 100,
+      deliveryRate: 1,
+      failedToday: 0,
+      bouncedToday: 0,
       queueSize: 0,
+      averageDeliveryTime: 0,
     };
   }