@technomoron/mail-magic 1.0.13 → 1.0.14

package/CHANGES

@@ -1,3 +1,8 @@
+Version 1.0.14 (2026-02-01)
+
+- Consolidated the API domain/user assertion into a shared helper to keep
+  validation logic consistent across modules.
+
 Version 1.0.13 (2026-01-31)
 
 - Fixed the per-package release script name and tag format used to trigger

package/dist/api/assets.js

@@ -1,10 +1,9 @@
 import fs from 'fs';
 import path from 'path';
 import { ApiError, ApiModule } from '@technomoron/api-server-base';
-import { api_domain } from '../models/domain.js';
+import { assert_domain_and_user } from './auth.js';
 import { api_form } from '../models/form.js';
 import { api_txmail } from '../models/txmail.js';
-import { api_user } from '../models/user.js';
 import { decodeComponent, sendFileAsync } from '../util.js';
 const DOMAIN_PATTERN = /^[a-z0-9][a-z0-9._-]*$/i;
 const SEGMENT_PATTERN = /^[a-zA-Z0-9._-]+$/;
@@ -21,25 +20,6 @@ export class AssetAPI extends ApiModule {
         }
         return '';
     }
-    async assertDomainAndUser(apireq) {
-        const domainName = this.getBodyValue(apireq.req.body ?? {}, 'domain');
-        if (!domainName) {
-            throw new ApiError({ code: 401, message: 'Missing domain' });
-        }
-        const user = await api_user.findOne({ where: { token: apireq.token } });
-        if (!user) {
-            throw new ApiError({ code: 401, message: `Invalid/Unknown API Key/Token '${apireq.token}'` });
-        }
-        const dbdomain = await api_domain.findOne({ where: { name: domainName } });
-        if (!dbdomain) {
-            throw new ApiError({ code: 401, message: `Unable to look up the domain ${domainName}` });
-        }
-        if (dbdomain.user_id !== user.user_id) {
-            throw new ApiError({ code: 403, message: `Domain ${domainName} is not owned by this user` });
-        }
-        apireq.domain = dbdomain;
-        apireq.user = user;
-    }
     normalizeSubdir(value) {
         if (!value) {
             return '';
@@ -129,7 +109,7 @@ export class AssetAPI extends ApiModule {
         throw new ApiError({ code: 400, message: 'templateType must be "tx" or "form"' });
     }
     async postAssets(apireq) {
-        await this.assertDomainAndUser(apireq);
+        await assert_domain_and_user(apireq);
         const rawFiles = Array.isArray(apireq.req.files) ? apireq.req.files : [];
         if (!rawFiles.length) {
             throw new ApiError({ code: 400, message: 'No files uploaded' });

package/dist/api/auth.js

@@ -0,0 +1,37 @@
+import { ApiError } from '@technomoron/api-server-base';
+import { api_domain } from '../models/domain.js';
+import { api_user } from '../models/user.js';
+function getBodyValue(body, ...keys) {
+    for (const key of keys) {
+        const value = body[key];
+        if (Array.isArray(value) && value.length > 0) {
+            return String(value[0]);
+        }
+        if (value !== undefined && value !== null) {
+            return String(value);
+        }
+    }
+    return '';
+}
+export async function assert_domain_and_user(apireq) {
+    const body = apireq.req.body ?? {};
+    const domain = getBodyValue(body, 'domain');
+    const locale = getBodyValue(body, 'locale');
+    if (!domain) {
+        throw new ApiError({ code: 401, message: 'Missing domain' });
+    }
+    const user = await api_user.findOne({ where: { token: apireq.token } });
+    if (!user) {
+        throw new ApiError({ code: 401, message: `Invalid/Unknown API Key/Token '${apireq.token}'` });
+    }
+    const dbdomain = await api_domain.findOne({ where: { name: domain } });
+    if (!dbdomain) {
+        throw new ApiError({ code: 401, message: `Unable to look up the domain ${domain}` });
+    }
+    if (dbdomain.user_id !== user.user_id) {
+        throw new ApiError({ code: 403, message: `Domain ${domain} is not owned by this user` });
+    }
+    apireq.domain = dbdomain;
+    apireq.user = user;
+    apireq.locale = locale || 'en';
+}

package/dist/api/forms.js

@@ -2,9 +2,9 @@ import path from 'path';
 import { ApiModule, ApiError } from '@technomoron/api-server-base';
 import emailAddresses from 'email-addresses';
 import nunjucks from 'nunjucks';
+import { assert_domain_and_user } from './auth.js';
 import { api_domain } from '../models/domain.js';
 import { api_form } from '../models/form.js';
-import { api_user } from '../models/user.js';
 import { buildRequestMeta, normalizeSlug } from '../util.js';
 export class FormAPI extends ApiModule {
     validateEmail(email) {
@@ -14,28 +14,8 @@ export class FormAPI extends ApiModule {
         }
         return undefined;
     }
-    async assertDomainAndUser(apireq) {
-        const { domain, locale } = apireq.req.body;
-        if (!domain) {
-            throw new ApiError({ code: 401, message: 'Missing domain' });
-        }
-        const user = await api_user.findOne({ where: { token: apireq.token } });
-        if (!user) {
-            throw new ApiError({ code: 401, message: `Invalid/Unknown API Key/Token '${apireq.token}'` });
-        }
-        const dbdomain = await api_domain.findOne({ where: { name: domain } });
-        if (!dbdomain) {
-            throw new ApiError({ code: 401, message: `Unable to look up the domain ${domain}` });
-        }
-        if (dbdomain.user_id !== user.user_id) {
-            throw new ApiError({ code: 403, message: `Domain ${domain} is not owned by this user` });
-        }
-        apireq.domain = dbdomain;
-        apireq.locale = locale || 'en';
-        apireq.user = user;
-    }
     async postFormTemplate(apireq) {
-        await this.assertDomainAndUser(apireq);
+        await assert_domain_and_user(apireq);
         const { template, sender = '', recipient = '', idname, subject = '', locale = '', secret = '' } = apireq.req.body;
         if (!template) {
             throw new ApiError({ code: 400, message: 'Missing template data' });

package/dist/api/mailer.js

@@ -2,9 +2,8 @@ import { ApiModule, ApiError } from '@technomoron/api-server-base';
 import emailAddresses from 'email-addresses';
 import { convert } from 'html-to-text';
 import nunjucks from 'nunjucks';
-import { api_domain } from '../models/domain.js';
+import { assert_domain_and_user } from './auth.js';
 import { api_txmail } from '../models/txmail.js';
-import { api_user } from '../models/user.js';
 import { buildRequestMeta } from '../util.js';
 export class MailerAPI extends ApiModule {
     //
@@ -38,29 +37,9 @@ export class MailerAPI extends ApiModule {
         });
         return { valid, invalid };
     }
-    async assert_domain_and_user(apireq) {
-        const { domain, locale } = apireq.req.body;
-        if (!domain) {
-            throw new ApiError({ code: 401, message: 'Missing domain' });
-        }
-        const user = await api_user.findOne({ where: { token: apireq.token } });
-        if (!user) {
-            throw new ApiError({ code: 401, message: `Invalid/Unknown API Key/Token '${apireq.token}'` });
-        }
-        const dbdomain = await api_domain.findOne({ where: { name: domain } });
-        if (!dbdomain) {
-            throw new ApiError({ code: 401, message: `Unable to look up the domain ${domain}` });
-        }
-        if (dbdomain.user_id !== user.user_id) {
-            throw new ApiError({ code: 403, message: `Domain ${domain} is not owned by this user` });
-        }
-        apireq.domain = dbdomain;
-        apireq.locale = locale || 'en';
-        apireq.user = user;
-    }
     // Store a template in the database
     async post_template(apireq) {
-        await this.assert_domain_and_user(apireq);
+        await assert_domain_and_user(apireq);
         const { template, sender = '', name, subject = '', locale = '' } = apireq.req.body;
         if (!template) {
             throw new ApiError({ code: 400, message: 'Missing template data' });
@@ -100,8 +79,8 @@ export class MailerAPI extends ApiModule {
     }
     // Send a template using posted arguments.
     async post_send(apireq) {
-        await this.assert_domain_and_user(apireq);
         const { name, rcpt, domain = '', locale = '', vars = {}, replyTo, reply_to, headers } = apireq.req.body;
+        await assert_domain_and_user(apireq);
         if (!name || !rcpt || !domain) {
             throw new ApiError({ code: 400, message: 'name/rcpt/domain required' });
         }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@technomoron/mail-magic",
-	"version": "1.0.13",
+	"version": "1.0.14",
 	"main": "dist/index.js",
 	"type": "module",
 	"bin": {