@xuda.io/account_module 1.2.2274 → 1.2.2276

package/index.mjs

@@ -1415,7 +1415,30 @@ export const verify_account = async function (req) {
   if (ret.code < 0) {
     return ret_acc;
   }
-  return { code: 1, data: ret_acc.data };
+
+  // Retire the "Confirm your email" banner notification (created at signup)
+  // now that the account is verified: mark it read and push the updated doc
+  // over WS — the dashboard's SAVE_notification mutation removes read docs
+  // live, so any open tab drops the banner without a refresh. Non-fatal.
+  try {
+    const n_ret = await db_module.find_couch_query('xuda_notification', {
+      selector: { uid: account_id, topic: 'confirm_email', read: false },
+      limit: 10,
+    });
+    for (const n_doc of n_ret?.data?.docs || n_ret?.docs || []) {
+      n_doc.read = true;
+      n_doc.read_ts = Date.now();
+      n_doc.read_note = 'account verified';
+      await db_module.save_couch_doc('xuda_notification', n_doc);
+      ws_dashboard_msa.notification({ to: account_id, data: n_doc });
+    }
+  } catch (e) {
+    console.warn('[verify_account] confirm_email banner cleanup failed:', e.message);
+  }
+
+  // is_boarded rides along so the verify route can tell the client whether
+  // onboarding is still pending (it is, for a fresh email signup).
+  return { code: 1, data: { ...ret_acc.data, is_boarded: !!obj.isBoarded } };
 };
 
 export const validate_user_plan = async function (req) {
@@ -2560,6 +2583,36 @@ export const onboarding_completed = async function (req, job_id, headers) {
   }
 };
 
+// One-time admin heads-up to info@xuda.ai on every new signup. Fired from
+// maybe_send_welcome_email (the universal once-per-account choke point) so it
+// covers every signup surface. Prod only (gated by the caller) and idempotent
+// (admin_signup_notified_ts). Fire-and-forget: never blocks or fails the caller.
+const notify_admin_new_signup = function (account_doc) {
+  try {
+    const info = account_doc.account_info || {};
+    const name = [info.first_name, info.last_name].filter(Boolean).join(' ') || info.username || 'Unknown';
+    const email = info.email || 'unknown';
+    const body = `
+      <h2 style="margin:0 0 14px">New signup on Xuda</h2>
+      <table cellpadding="6" style="border-collapse:collapse;font-size:14px">
+        <tr><td><strong>Name</strong></td><td>${_.escape(name)}</td></tr>
+        <tr><td><strong>Email</strong></td><td>${_.escape(email)}</td></tr>
+        <tr><td><strong>Username</strong></td><td>${_.escape(info.username || '')}</td></tr>
+        <tr><td><strong>Account ID</strong></td><td>${_.escape(account_doc._id || '')}</td></tr>
+        <tr><td><strong>Signed up (UTC)</strong></td><td>${new Date().toISOString()}</td></tr>
+      </table>`;
+    email_msa.send_email({
+      email: 'info@xuda.ai',
+      subject: `New signup: ${name} (${email})`,
+      body,
+      ref: account_doc._id,
+      app_id: null,
+    });
+  } catch (err) {
+    console.error('[notify_admin_new_signup]', err.message);
+  }
+};
+
 // Sends the welcome_aboard email exactly once per account. Safe to call from
 // multiple triggers (avatar-completion, onboarding_completed) and across every
 // signup surface (xuda.ai, Google OAuth, xuda.fashion, xuda.network, chat
@@ -2568,11 +2621,26 @@ export const maybe_send_welcome_email = async function (uid) {
   try {
     const account_doc = await db_module.get_couch_doc_native('xuda_accounts', uid);
     if (!account_doc || !account_doc.account_info) return { code: -1, data: 'no account' };
+
+    // Admin new-signup notification (prod only), independent of the user-facing
+    // welcome email so it also covers suppressed ambassadors/mentors. Idempotent
+    // via admin_signup_notified_ts; the flag persists on whichever save below runs.
+    let admin_flag_needs_save = false;
+    if (!_conf.is_debug && !account_doc.admin_signup_notified_ts) {
+      notify_admin_new_signup(account_doc);
+      account_doc.admin_signup_notified_ts = Date.now();
+      admin_flag_needs_save = true;
+    }
+
     if (account_doc.account_info.is_xuda_network_ambassador === true) {
       console.log('[maybe_send_welcome_email] suppressing for xuda.network ambassador/mentor', uid);
+      if (admin_flag_needs_save) await db_module.save_couch_doc('xuda_accounts', account_doc);
       return { code: 0, data: 'ambassador' };
     }
-    if (account_doc.welcome_email_sent_ts) return { code: 0, data: 'already sent' };
+    if (account_doc.welcome_email_sent_ts) {
+      if (admin_flag_needs_save) await db_module.save_couch_doc('xuda_accounts', account_doc);
+      return { code: 0, data: 'already sent' };
+    }
 
     const host = _conf.is_debug ? process.env.XUDA_HOSTNAME || _conf.domain : _conf.domain;
     const username = account_doc.account_info.username || uid;
@@ -2597,6 +2665,252 @@ export const maybe_send_welcome_email = async function (uid) {
   }
 };
 
+// ---- Email bounce lifecycle helpers -----------------------------------------
+const _bounce_settings_url = () => {
+  const host = _conf.is_debug ? process.env.XUDA_HOSTNAME || _conf.domain : _conf.domain;
+  return `https://${host}/dashboard/settings`;
+};
+
+// Alert the user to update their email (banner + SMS per the topic's delivery
+// methods). SMS is gated/log-only in notification_module until sms_enabled.
+const _send_bounce_alert = async (account, attempt, max) => {
+  const eb = account.account_email_bounce || {};
+  return await notification_msa.submit_notification({
+    type: 'account',
+    app_id: null,
+    uid_arr: [account._id],
+    topic: 'email_bounce_update_required',
+    params: {
+      recipient_email: eb.recipient || account.account_info?.email || '',
+      settings_url: _bounce_settings_url(),
+      attempt,
+      max,
+    },
+  });
+};
+
+// Hard-email-bounce flag. Called (via account_ms RPC) by email_module's
+// scan_platform_bounces when a platform email to this account's address bounces
+// permanently (5.x.x). Records the flag and, on the FIRST transition into
+// flagged, fires alert #1 immediately (attempts 2..max + suspend are driven by
+// the daily sweep_email_bounces cron). Idempotent: repeated bounces for an
+// already-flagged/suspended account only refresh last_bounce_ts (no re-alert).
+export const flag_email_bounce = async function (req) {
+  const { uid, recipient, reason, status_code, message_id, source } = req || {};
+  if (!uid) return { code: -1, data: 'uid required' };
+  try {
+    const acct_ret = await db_module.get_couch_doc('xuda_accounts', uid);
+    if (acct_ret.code < 0) return { code: -1, data: 'account not found' };
+    const account = acct_ret.data;
+    const now = Date.now();
+    const eb = account.account_email_bounce || {};
+    const was_active = eb.status === 'flagged' || eb.status === 'suspended';
+    const max = Number(_conf.bounce_monitor?.suspend_after_alerts || 3);
+
+    eb.recipient = recipient || eb.recipient;
+    eb.reason = reason || eb.reason;
+    eb.status_code = status_code || eb.status_code;
+    eb.last_message_id = message_id || eb.last_message_id;
+    eb.source = source || eb.source || 'dsn';
+    eb.last_bounce_ts = now;
+    eb.bounce_count = (eb.bounce_count || 0) + 1;
+    if (eb.status !== 'suspended') {
+      eb.status = 'flagged';
+      eb.first_bounce_ts = eb.first_bounce_ts || now;
+      if (!was_active) {
+        // Fresh flag -> immediate first alert.
+        eb.attempt_count = 1;
+        eb.first_alert_ts = now;
+        eb.last_attempt_ts = now;
+      } else if (eb.attempt_count == null) {
+        eb.attempt_count = 0;
+      }
+    }
+
+    account.account_email_bounce = eb;
+    const save_ret = await db_module.save_couch_doc('xuda_accounts', account);
+    if (save_ret.code < 0) return save_ret;
+
+    if (!was_active) {
+      try { await _send_bounce_alert(account, 1, max); } catch (e) { console.error('flag_email_bounce alert #1 failed:', e.message); }
+    }
+    console.log(`flag_email_bounce: ${uid} <${recipient}> ${status_code || ''} -> status=${eb.status} attempt=${eb.attempt_count} bounce_count=${eb.bounce_count}${!was_active ? ' (alert #1 sent)' : ''}`);
+    return { code: 1, data: { uid, status: eb.status, attempt_count: eb.attempt_count, bounce_count: eb.bounce_count } };
+  } catch (err) {
+    console.error('flag_email_bounce error:', err);
+    return { code: -10, data: err.message };
+  }
+};
+
+// Daily retry/escalation sweep for flagged accounts (controller cron). For each
+// account with account_email_bounce.status === 'flagged':
+//   - if the user changed their email away from the bounced address -> CLEAR;
+//   - else if under the alert cap and >= alert_interval since last -> next alert;
+//   - else (cap reached) -> SUSPEND (account_email_bounce_suspended) + ops alert.
+// `req` overrides: { interval_ms, max, limit, uids }.
+export const sweep_email_bounces = async function (req = {}) {
+  const bm = _conf.bounce_monitor || {};
+  const DAY_MS = 24 * 60 * 60 * 1000;
+  const interval = Number(req.interval_ms ?? bm.alert_interval_ms ?? DAY_MS);
+  const max = Number(req.max ?? bm.suspend_after_alerts ?? 3);
+  const now = Date.now();
+  const summary = { flagged: 0, cleared: 0, alerted: 0, suspended: 0, skipped: 0 };
+  try {
+    const selector = { 'account_email_bounce.status': 'flagged' };
+    if (Array.isArray(req.uids) && req.uids.length) selector._id = { $in: req.uids };
+    const find_ret = await db_module.find_couch_query('xuda_accounts', {
+      selector,
+      fields: ['_id'],
+      limit: req.limit ?? 99999,
+    });
+    const rows = find_ret?.data?.docs || find_ret?.docs || [];
+    summary.flagged = rows.length;
+
+    for (const row of rows) {
+      const acct_ret = await db_module.get_couch_doc('xuda_accounts', row._id);
+      if (acct_ret.code < 0) continue;
+      const account = acct_ret.data;
+      const eb = account.account_email_bounce;
+      if (!eb || eb.status !== 'flagged') { summary.skipped++; continue; }
+
+      // CLEAR: the user updated their email away from the bounced address.
+      const cur_email = (account.account_info?.email || '').toLowerCase().trim();
+      if (cur_email && cur_email !== (eb.recipient || '').toLowerCase().trim()) {
+        eb.status = 'cleared';
+        eb.cleared_ts = now;
+        account.account_email_bounce = eb;
+        await db_module.save_couch_doc('xuda_accounts', account);
+        summary.cleared++;
+        continue;
+      }
+
+      // Cadence gate.
+      if (eb.last_attempt_ts && now - eb.last_attempt_ts < interval) { summary.skipped++; continue; }
+
+      if ((eb.attempt_count || 0) < max) {
+        const next = (eb.attempt_count || 0) + 1;
+        eb.attempt_count = next;
+        eb.last_attempt_ts = now;
+        account.account_email_bounce = eb;
+        await db_module.save_couch_doc('xuda_accounts', account);
+        try { await _send_bounce_alert(account, next, max); } catch (e) { console.error('bounce alert failed:', e.message); }
+        summary.alerted++;
+      } else {
+        // SUSPEND after the alert cap. Dedicated flag (enforced at
+        // router_module.validate_app_active_status alongside billing
+        // suspension) so we never clobber account_suspension_status.
+        eb.status = 'suspended';
+        eb.suspended_ts = now;
+        account.account_email_bounce = eb;
+        account.account_email_bounce_suspended = 1;
+        await db_module.save_couch_doc('xuda_accounts', account);
+
+        const host = _conf.is_debug ? process.env.XUDA_HOSTNAME || _conf.domain : _conf.domain;
+        const supers = _conf.superuser_account_ids || [];
+        if (supers.length) {
+          try {
+            await notification_msa.submit_notification({
+              type: 'account',
+              app_id: null,
+              uid_arr: supers,
+              topic: 'email_bounce_suspended',
+              system: true,
+              params: {
+                uid: account._id,
+                account_email: account.account_info?.email || eb.recipient || '',
+                recipient: eb.recipient || '',
+                reason: eb.reason || '',
+                status_code: eb.status_code || '',
+                attempts: eb.attempt_count || max,
+                domain: host,
+              },
+            });
+          } catch (e) { console.error('ops bounce-suspend alert failed:', e.message); }
+        }
+        summary.suspended++;
+      }
+    }
+    console.log('sweep_email_bounces:', JSON.stringify(summary));
+    return { code: 1, data: summary };
+  } catch (err) {
+    console.error('sweep_email_bounces error:', err);
+    return { code: -10, data: err.message };
+  }
+};
+
+// Every-3-days verification nudge for accounts still at stat 1 (unverified).
+// Runs from the controller's daily cron (master/dev only); the daily tick plus
+// the per-account 3-day gate below yields the every-3-days cadence. Each email
+// carries a rotating did-you-know card. Capped at MAX_VERIFICATION_REMINDERS
+// per account. `req` may override the knobs for testing:
+//   { min_age_ms, interval_ms, max, limit, uids: ['acc_…'] }
+// (`uids` restricts the sweep to specific accounts — for E2E tests.)
+export const send_verification_reminders = async function (req) {
+  const DAY_MS = 24 * 60 * 60 * 1000;
+  const MIN_AGE_MS = req?.min_age_ms ?? 3 * DAY_MS; // don't nudge before 3 days old
+  const INTERVAL_MS = req?.interval_ms ?? 3 * DAY_MS; // and at most every 3 days
+  const MAX_VERIFICATION_REMINDERS = req?.max ?? 5;
+  try {
+    const selector = { stat: 1, docType: 'account' };
+    if (Array.isArray(req?.uids) && req.uids.length) selector._id = { $in: req.uids };
+    const find_ret = await db_module.find_couch_query('xuda_accounts', {
+      selector,
+      fields: ['_id', 'date_created_ts', 'verification_reminder_last_ts', 'verification_reminder_count', 'account_info.email'],
+      limit: req?.limit ?? 99999,
+    });
+    const rows = find_ret?.data?.docs || find_ret?.docs || [];
+    const now = Date.now();
+    const host = _conf.is_debug ? process.env.XUDA_HOSTNAME || _conf.domain : _conf.domain;
+    const base = `https://${host}`;
+    const tips = load_did_you_know_tips();
+    let sent = 0;
+
+    for (const row of rows) {
+      const uid = row._id;
+      const count = row.verification_reminder_count || 0;
+      if (count >= MAX_VERIFICATION_REMINDERS) continue;
+      if (!row.account_info?.email) continue;
+      const age = now - (row.date_created_ts || 0);
+      if (!row.date_created_ts || age < MIN_AGE_MS) continue;
+      if (row.verification_reminder_last_ts && now - row.verification_reminder_last_ts < INTERVAL_MS) continue;
+
+      // Rotate the card: offset by a uid hash so users don't all get the same
+      // tip, advance by count so each reminder shows a fresh one.
+      let card = { title: 'Did you know?', text: 'Xuda is an all-in-one AI platform — chats, apps, websites, hosting and more.', image: '', url: `${base}/dashboard` };
+      if (tips.length) {
+        const uid_hash = String(uid).split('').reduce((a, c) => a + c.charCodeAt(0), 0);
+        const tip = tips[(uid_hash + count) % tips.length];
+        card = { title: tip.title, text: tip.text, image: tip.image ? `${base}${tip.image}` : '', url: tip.url || `${base}/dashboard` };
+      }
+
+      await notification_msa.submit_notification({
+        type: 'account',
+        app_id: null,
+        uid_arr: [uid],
+        topic: 'verification_reminder',
+        params: { hostname: host, ref: uid, card_title: card.title, card_text: card.text, card_image: card.image, card_url: card.url },
+        ref: null,
+        email: null,
+      });
+
+      // Persist the cadence state on the account doc.
+      const account_doc = await db_module.get_couch_doc_native('xuda_accounts', uid);
+      if (account_doc) {
+        account_doc.verification_reminder_last_ts = now;
+        account_doc.verification_reminder_count = count + 1;
+        await db_module.save_couch_doc('xuda_accounts', account_doc);
+      }
+      sent++;
+    }
+
+    console.log(`[send_verification_reminders] scanned ${rows.length} unverified accounts, sent ${sent}`);
+    return { code: 1, data: { scanned: rows.length, sent } };
+  } catch (err) {
+    console.error('[send_verification_reminders]', err.message);
+    return { code: -1, data: err.message };
+  }
+};
+
 // Resolve an account uid from a public username (account_info.username).
 // Used by the public-profile route so /public_profiles/<username> resolves.
 export const get_uid_by_username = async function (username) {

package/index_ms.mjs

@@ -209,6 +209,18 @@ export const maybe_send_welcome_email = async function (...args) {
   return await broker.send_to_queue("maybe_send_welcome_email", ...args);
 };
 
+export const flag_email_bounce = async function (...args) {
+  return await broker.send_to_queue("flag_email_bounce", ...args);
+};
+
+export const sweep_email_bounces = async function (...args) {
+  return await broker.send_to_queue("sweep_email_bounces", ...args);
+};
+
+export const send_verification_reminders = async function (...args) {
+  return await broker.send_to_queue("send_verification_reminders", ...args);
+};
+
 export const get_uid_by_username = async function (...args) {
   return await broker.send_to_queue("get_uid_by_username", ...args);
 };

package/index_msa.mjs

@@ -209,6 +209,18 @@ export const maybe_send_welcome_email =  function (...args) {
    broker.send_to_queue_async("maybe_send_welcome_email", ...args);
 };
 
+export const flag_email_bounce =  function (...args) {
+   broker.send_to_queue_async("flag_email_bounce", ...args);
+};
+
+export const sweep_email_bounces =  function (...args) {
+   broker.send_to_queue_async("sweep_email_bounces", ...args);
+};
+
+export const send_verification_reminders =  function (...args) {
+   broker.send_to_queue_async("send_verification_reminders", ...args);
+};
+
 export const get_uid_by_username =  function (...args) {
    broker.send_to_queue_async("get_uid_by_username", ...args);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xuda.io/account_module",
-  "version": "1.2.2274",
+  "version": "1.2.2276",
   "description": "Xuda Account Server Module",
   "main": "index.mjs",
   "dependencies": {