@yeaft/webchat-agent 1.0.186 → 1.0.189

package/local-runtime/server/db/user-db.js

@@ -0,0 +1,165 @@
+import { stmts, generateUserId, generateAgentSecret, transaction } from './connection.js';
+
+export const userDb = {
+  getOrCreate(username, displayName = null) {
+    let user = stmts.getUserByUsername.get(username);
+    if (!user) {
+      const id = generateUserId();
+      const now = Date.now();
+      stmts.insertUser.run(id, username, displayName || username, now);
+      user = { id, username, display_name: displayName || username, created_at: now };
+    }
+    return user;
+  },
+
+  createFull(username, passwordHash, email = null, role = 'user') {
+    const id = generateUserId();
+    const now = Date.now();
+    const agentSecret = generateAgentSecret();
+    stmts.insertUserFull.run(id, username, username, passwordHash, email, agentSecret, role, now);
+    return { id, username, display_name: username, password_hash: passwordHash, email, agent_secret: agentSecret, role, created_at: now };
+  },
+
+  migrateUser(username, passwordHash, email, role = 'admin') {
+    const existing = stmts.getUserByUsername.get(username);
+    if (existing) {
+      if (existing.password_hash) {
+        return existing;
+      }
+      const newSecret = generateAgentSecret();
+      stmts.updateUserMigrate.run(passwordHash, email, role, newSecret, existing.id);
+      return { ...existing, password_hash: passwordHash, email, role, agent_secret: existing.agent_secret || newSecret };
+    }
+    return this.createFull(username, passwordHash, email, role);
+  },
+
+  get(id) {
+    return stmts.getUserById.get(id);
+  },
+
+  getByUsername(username) {
+    return stmts.getUserByUsername.get(username);
+  },
+
+  getUserByAgentSecret(secret) {
+    if (!secret) return null;
+    return stmts.getUserByAgentSecret.get(secret) || null;
+  },
+
+  getAll() {
+    return stmts.getAllUsers.all();
+  },
+
+  updateLogin(id) {
+    stmts.updateUserLogin.run(Date.now(), id);
+  },
+
+  updatePassword(userId, passwordHash) {
+    stmts.updateUserPassword.run(passwordHash, userId);
+  },
+
+  updateEmail(userId, email) {
+    stmts.updateUserEmail.run(email, userId);
+  },
+
+  updateDisplayName(userId, displayName) {
+    if (!displayName) return;
+    stmts.updateUserDisplayName.run(displayName, userId);
+  },
+
+  getAgentSecret(userId) {
+    const user = stmts.getUserById.get(userId);
+    return user?.agent_secret || null;
+  },
+
+  resetAgentSecret(userId) {
+    const newSecret = generateAgentSecret();
+    stmts.updateUserAgentSecret.run(newSecret, userId);
+    return newSecret;
+  },
+
+  updateRole(userId, role) {
+    stmts.updateUserRole.run(role, userId);
+  },
+
+  getTotp(username) {
+    const result = stmts.getUserTotp.get(username);
+    if (result) {
+      return {
+        totpSecret: result.totp_secret,
+        totpEnabled: !!result.totp_enabled
+      };
+    }
+    return null;
+  },
+
+  updateTotp(username, totpSecret, totpEnabled) {
+    let user = stmts.getUserByUsername.get(username);
+    if (!user) {
+      const id = generateUserId();
+      const now = Date.now();
+      stmts.insertUser.run(id, username, username, now);
+    }
+    stmts.updateUserTotp.run(totpSecret, totpEnabled ? 1 : 0, username);
+    return true;
+  },
+
+  getByAadOid(aadOid) {
+    if (!aadOid) return null;
+    return stmts.getUserByAadOid.get(aadOid) || null;
+  },
+
+  updateAadOid(userId, aadOid) {
+    stmts.updateUserAadOid.run(aadOid, userId);
+  },
+
+  /**
+   * Create a user from AAD profile (no password, linked by aad_oid).
+   * `displayName` is used as a friendlier label (e.g. the Alipay nickname);
+   * falls back to the username when not provided.
+   */
+  createFromAad(username, email, aadOid, role = 'pro', displayName = null) {
+    const id = generateUserId();
+    const now = Date.now();
+    const agentSecret = generateAgentSecret();
+    const display = displayName || username;
+    stmts.insertUserFull.run(id, username, display, null, email, agentSecret, role, now);
+    stmts.updateUserAadOid.run(aadOid, id);
+    return { id, username, display_name: display, email, aad_oid: aadOid, agent_secret: agentSecret, role, created_at: now };
+  },
+
+  /**
+   * Permanently delete a user and ALL data scoped to that user.
+   *
+   * Tables touched (all inside one transaction):
+   *   - user_identities         hard delete (also covered by FK CASCADE, belt-and-braces)
+   *   - sessions                hard delete (messages cascade via FK)
+   *   - user_stats              hard delete
+   *   - daily_stats             hard delete
+   *   - agent_metric_watermarks cascade delete
+   *   - custom_expert_roles     hard delete (custom_expert_actions cascade via FK)
+   *   - invitations.created_by  rows deleted (codes the user issued)
+   *   - invitations.used_by     set NULL (preserve history of *who consumed what* — but we lose the link)
+   *   - users                   row deleted last
+   *
+   * Caller is responsible for revoking JWT sessions (we don't import the
+   * session store from here to keep this layer pure).
+   */
+  deleteUser(userId) {
+    // No inner try/catch — any failure must bubble out so the transaction
+    // rolls back. A partial delete (e.g. users row gone but daily_stats
+    // orphaned) is worse than the operation failing outright.
+    const run = transaction((id) => {
+      stmts.deleteIdentitiesForUser.run(id);
+      stmts.deleteUserSessionsByUser.run(id);
+      stmts.deleteUserStats.run(id);
+      stmts.deleteDailyStatsForUser.run(id);
+      stmts.deleteCustomExpertRolesForUser.run(id);
+      stmts.deleteInvitationsCreatedBy.run(id);
+      stmts.clearInvitationUsedBy.run(id);
+      const result = stmts.deleteUserById.run(id);
+      return result.changes > 0;
+    });
+    return run(userId);
+  }
+};

package/local-runtime/server/db/user-stats-db.js

@@ -0,0 +1,185 @@
+import db from './connection.js';
+import { stmts, transaction } from './connection.js';
+
+/**
+ * Get today's date string in YYYY-MM-DD format (local time).
+ */
+function todayStr() {
+  const d = new Date();
+  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
+}
+
+/**
+ * Get the start date string for a given period.
+ */
+function periodStartDate(period) {
+  const now = new Date();
+  switch (period) {
+    case 'today':
+      return todayStr();
+    case 'week': {
+      const d = new Date(now);
+      d.setDate(d.getDate() - 6); // last 7 days
+      return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
+    }
+    case 'month': {
+      const d = new Date(now);
+      d.setDate(d.getDate() - 29); // last 30 days
+      return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
+    }
+    default: // 'all'
+      return '1970-01-01';
+  }
+}
+
+export const userStatsDb = {
+  /**
+   * Batch flush in-memory deltas to DB.
+   * Writes to both user_stats (cumulative) and daily_stats (per-day).
+   * @param {Map<string, {requests: number, bytesSent: number, bytesReceived: number, messages: number, sessions: number}>} deltaMap
+   */
+  flushDeltas(deltaMap) {
+    if (deltaMap.size === 0) return;
+
+    const now = Date.now();
+    const today = todayStr();
+    const flush = transaction(() => {
+      for (const [userId, delta] of deltaMap) {
+        // Cumulative stats
+        stmts.upsertUserStats.run(
+          userId,
+          delta.messages || 0,
+          delta.sessions || 0,
+          delta.requests || 0,
+          delta.bytesSent || 0,
+          delta.bytesReceived || 0,
+          delta.inputTokens || 0,
+          delta.outputTokens || 0,
+          delta.cacheReadTokens || 0,
+          delta.cacheWriteTokens || 0,
+          delta.totalTokens || 0,
+          now
+        );
+        // Daily stats
+        stmts.upsertDailyStats.run(
+          userId,
+          today,
+          delta.messages || 0,
+          delta.sessions || 0,
+          delta.requests || 0,
+          delta.bytesSent || 0,
+          delta.bytesReceived || 0,
+          delta.inputTokens || 0,
+          delta.outputTokens || 0,
+          delta.cacheReadTokens || 0,
+          delta.cacheWriteTokens || 0,
+          delta.totalTokens || 0
+        );
+      }
+    });
+    flush();
+  },
+
+  getAll() {
+    return stmts.getUserStats.all();
+  },
+
+  /**
+   * Get user stats aggregated by period.
+   * @param {'today'|'week'|'month'|'all'} period
+   */
+  getByPeriod(period) {
+    if (period === 'all') {
+      return this.getAll();
+    }
+    const startDate = periodStartDate(period);
+    return stmts.getDailyStatsAll.all(startDate);
+  },
+
+  getByUserId(userId) {
+    return stmts.getUserStatsById.get(userId) || null;
+  },
+
+  /**
+   * Convert one cumulative agent snapshot into an idempotent user delta.
+   * A new metric epoch means the agent process restarted and counters began at
+   * zero. Repeated or lower snapshots in the same epoch never add usage.
+   */
+  recordAgentTokenSnapshot(userId, agentInstanceId, metrics = {}) {
+    const metricEpoch = typeof metrics.metricEpoch === 'string' ? metrics.metricEpoch : '';
+    if (!userId || !agentInstanceId || !metricEpoch) return null;
+
+    const fields = [
+      ['inputTokens', 'input_tokens'],
+      ['outputTokens', 'output_tokens'],
+      ['cacheReadTokens', 'cache_read_tokens'],
+      ['cacheWriteTokens', 'cache_write_tokens'],
+      ['totalTokens', 'total_tokens'],
+    ];
+    const current = {};
+    for (const [metricKey] of fields) {
+      current[metricKey] = Math.max(0, Number(metrics[metricKey]) || 0);
+    }
+
+    const now = Date.now();
+    return transaction(() => {
+      const previous = stmts.getAgentMetricWatermark.get(userId, agentInstanceId, metricEpoch);
+      const delta = {};
+      const watermark = {};
+      for (const [metricKey, column] of fields) {
+        const previousValue = Number(previous?.[column]) || 0;
+        delta[metricKey] = Math.max(0, current[metricKey] - previousValue);
+        watermark[metricKey] = Math.max(previousValue, current[metricKey]);
+      }
+      stmts.upsertAgentMetricWatermark.run(
+        userId,
+        agentInstanceId,
+        metricEpoch,
+        watermark.inputTokens,
+        watermark.outputTokens,
+        watermark.cacheReadTokens,
+        watermark.cacheWriteTokens,
+        watermark.totalTokens,
+        now
+      );
+      if (Object.values(delta).some(value => value > 0)) {
+        stmts.upsertUserStats.run(
+          userId, 0, 0, 0, 0, 0,
+          delta.inputTokens,
+          delta.outputTokens,
+          delta.cacheReadTokens,
+          delta.cacheWriteTokens,
+          delta.totalTokens,
+          now
+        );
+        stmts.upsertDailyStats.run(
+          userId, todayStr(), 0, 0, 0, 0, 0,
+          delta.inputTokens,
+          delta.outputTokens,
+          delta.cacheReadTokens,
+          delta.cacheWriteTokens,
+          delta.totalTokens
+        );
+      }
+      return delta;
+    })();
+  },
+
+  getDashboardTotals() {
+    return stmts.getDashboardTotals.get();
+  },
+
+  getDashboardTokenTotals() {
+    return stmts.getDashboardTokenTotals.get();
+  },
+
+  getTodayActiveUsers() {
+    const row = stmts.getTodayActiveUsers.get(todayStr());
+    return row?.count || 0;
+  },
+
+  getTodayMessages() {
+    const row = stmts.getTodayMessages.get(todayStr());
+    return row?.count || 0;
+  }
+};

package/local-runtime/server/db/yeaft-session-db.js

@@ -0,0 +1,258 @@
+/**
+ * yeaft-session-db.js — server-side persistence for yeaft sessions.
+ *
+ * Mirrors session-db.js but for the yeaft engine's per-user multi-VP
+ * sessions. The agent owns the canonical session state on disk (under
+ * `~/.yeaft/sessions/<id>/`); this table is a shadow registry the
+ * server uses to:
+ *
+ *   1. Show the user's yeaft sessions in the sidebar BEFORE any agent
+ *      comes online (so a reload doesn't blank the list).
+ *   2. List sessions across ALL of the user's agents in one place
+ *      (cross-agent unified sidebar) — same way chat conversations
+ *      pull from the `sessions` table regardless of which agent is
+ *      currently selected.
+ *
+ * Rows are upserted whenever the agent emits a `group_list_updated`
+ * snapshot (full state) or a `group_roster_changed` delta. They are
+ * deleted when the agent emits a `session_crud_result` with op=delete
+ * or op=archive.
+ */
+
+import { stmts } from './connection.js';
+
+function safeJsonParse(s, fallback) {
+  if (s == null || s === '') return fallback;
+  try { return JSON.parse(s); }
+  catch (_) { return fallback; }
+}
+
+function safeJsonStringify(v) {
+  if (v == null) return null;
+  try { return JSON.stringify(v); }
+  catch (_) { return null; }
+}
+
+function sessionOrderKey(agentId, sessionId) {
+  return `${agentId || ''}\u001f${sessionId || ''}`;
+}
+
+function mapRow(row) {
+  if (!row) return row;
+  return {
+    id: row.id,
+    userId: row.user_id || null,
+    agentId: row.agent_id,
+    name: row.name || row.id,
+    roster: safeJsonParse(row.roster_json, []),
+    defaultVpId: row.default_vp_id || null,
+    workDir: row.work_dir || '',
+    config: safeJsonParse(row.config_json, {}),
+    announcement: row.announcement || '',
+    createdAt: row.created_at || null,
+    updatedAt: row.updated_at,
+    isArchived: row.is_archived === 1,
+    // fix-yeaft-session-list-and-menu: persisted pin state. Decorated
+    // onto outgoing snapshots in server/handlers/agent-output.js so the
+    // web sees `pinned: true/false` on each session row.
+    // Keep `isPinned` for existing server-side callers, and expose `pinned`
+    // because the web session store consumes neutral session metadata using
+    // that field name during DB hydration.
+    isPinned: row.is_pinned === 1,
+    pinned: row.is_pinned === 1,
+    sortOrder: Number.isFinite(row.sort_order) ? row.sort_order : null,
+  };
+}
+
+export const yeaftSessionDb = {
+  /**
+   * Upsert one session from a snapshot row. Returns nothing.
+   *
+   * @param {string} userId
+   * @param {string} agentId
+   * @param {object} session  Shape from `web-bridge.snapshotSessions()`:
+   *   { id, name, roster[], defaultVpId, workDir, config, announcement, createdAt }
+   */
+  upsertFromSnapshot(userId, agentId, session) {
+    if (!session || !session.id || !agentId) return;
+    const now = Date.now();
+    stmts.upsertYeaftSession.run(
+      session.id,
+      userId || null,
+      agentId,
+      session.name || session.id,
+      safeJsonStringify(Array.isArray(session.roster) ? session.roster : []),
+      session.defaultVpId || null,
+      session.workDir || '',
+      safeJsonStringify(session.config && typeof session.config === 'object' ? session.config : {}),
+      typeof session.announcement === 'string' ? session.announcement : '',
+      session.createdAt || now,
+      now,
+      0,
+    );
+  },
+
+  /**
+   * Bulk reconciliation from a full snapshot. Sessions not present in
+   * the incoming array (but currently in the DB for this user+agent)
+   * are deleted — the agent has authoritatively said "these are my
+   * sessions right now". Behaviour matches the web `applySnapshot`
+   * per-agent replacement so server + client stay in sync.
+   *
+   * @param {string} userId
+   * @param {string} agentId
+   * @param {object[]} sessions
+   */
+  reconcileFromSnapshot(userId, agentId, sessions) {
+    const arr = Array.isArray(sessions) ? sessions : [];
+    const incomingIds = new Set();
+    for (const s of arr) {
+      if (s && s.id) {
+        incomingIds.add(s.id);
+        this.upsertFromSnapshot(userId, agentId, s);
+      }
+    }
+    // Drop rows for this (user, agent) not in the snapshot.
+    const existing = stmts.getYeaftSessionsByAgent.all(agentId);
+    for (const row of existing) {
+      // Only touch rows belonging to this user — guards against
+      // accidentally wiping another user's rows if agent ownership is
+      // ever shared (currently it isn't, but be defensive).
+      // Treat NULL user_id as foreign too — never cross-delete.
+      if (userId && row.user_id !== userId) continue;
+      if (!incomingIds.has(row.id)) {
+        stmts.deleteYeaftSessionForAgent.run(row.id, userId, agentId);
+      }
+    }
+  },
+
+  /** All non-archived rows for this user (across all agents). */
+  getByUser(userId) {
+    if (!userId) return [];
+    return stmts.getYeaftSessionsByUser.all(userId).map(mapRow);
+  },
+
+  getByAgent(agentId) {
+    return stmts.getYeaftSessionsByAgent.all(agentId).map(mapRow);
+  },
+
+  get(id) {
+    return mapRow(stmts.getYeaftSession.get(id));
+  },
+
+  getForAgent(userId, agentId, id) {
+    if (!userId || !agentId || !id) return null;
+    return mapRow(stmts.getYeaftSessionForAgent.get(id, userId, agentId));
+  },
+
+  delete(id) {
+    stmts.deleteYeaftSession.run(id);
+  },
+
+  deleteForAgent(userId, agentId, id) {
+    if (!userId || !agentId || !id) return;
+    stmts.deleteYeaftSessionForAgent.run(id, userId, agentId);
+  },
+
+  setArchived(id, archived) {
+    stmts.setYeaftSessionArchived.run(archived ? 1 : 0, Date.now(), id);
+  },
+
+  setArchivedForAgent(userId, agentId, id, archived) {
+    if (!userId || !agentId || !id) return;
+    stmts.setYeaftSessionArchivedForAgent.run(archived ? 1 : 0, Date.now(), id, userId, agentId);
+  },
+
+  /**
+   * Persist the per-session pin state. fix-yeaft-session-list-and-menu:
+   * yeaft sidebar's "置顶" menu item flips this — the existing
+   * `pin_session` / `unpin_session` WebSocket handler in
+   * server/handlers/client-conversation.js detects yeaft-owned ids and
+   * routes here (chat-owned ids fall back to sessionDb.setPinned).
+   *
+   * upsertFromSnapshot does NOT touch is_pinned (the snapshot is
+   * agent-authored and the agent has no notion of pin); the column is
+   * preserved across snapshot upserts naturally because is_pinned is
+   * absent from the ON CONFLICT update set in connection.js.
+   */
+  setPinned(id, pinned) {
+    stmts.setYeaftSessionPinned.run(pinned ? 1 : 0, Date.now(), id);
+  },
+
+  setPinnedForAgentRow(userId, agentId, id, pinned) {
+    if (!userId || !agentId || !id) return;
+    stmts.setYeaftSessionPinnedForAgent.run(pinned ? 1 : 0, Date.now(), id, userId, agentId);
+  },
+
+  setOrderForAgent(userId, agentId, sessionIds) {
+    if (!userId || !agentId || !Array.isArray(sessionIds)) return false;
+    const owned = new Set(
+      stmts.getYeaftSessionsByAgent.all(agentId)
+        .filter(row => row && row.user_id === userId)
+        .map(row => row.id),
+    );
+    const seen = new Set();
+    const ordered = [];
+    for (const rawId of sessionIds) {
+      const id = typeof rawId === 'string' ? rawId : String(rawId || '');
+      if (!id || seen.has(id) || !owned.has(id)) continue;
+      seen.add(id);
+      ordered.push(id);
+    }
+    if (ordered.length === 0) return false;
+    const now = Date.now();
+    ordered.forEach((id, index) => {
+      stmts.setYeaftSessionSortOrder.run(index, now, id, userId, agentId);
+    });
+    return true;
+  },
+
+  setOrderForUser(userId, sessions) {
+    if (!userId || !Array.isArray(sessions)) return false;
+    const owned = new Set(
+      stmts.getYeaftSessionsByUser.all(userId)
+        .filter(row => row && row.user_id === userId && row.agent_id && row.id)
+        .map(row => sessionOrderKey(row.agent_id, row.id)),
+    );
+    const seen = new Set();
+    const ordered = [];
+    for (const item of sessions) {
+      const agentId = typeof item?.agentId === 'string' ? item.agentId : '';
+      const sessionId = typeof item?.sessionId === 'string'
+        ? item.sessionId
+        : (typeof item?.id === 'string' ? item.id : '');
+      const key = sessionOrderKey(agentId, sessionId);
+      if (!agentId || !sessionId || seen.has(key) || !owned.has(key)) continue;
+      seen.add(key);
+      ordered.push({ agentId, sessionId });
+    }
+    if (ordered.length === 0) return false;
+    const now = Date.now();
+    ordered.forEach(({ agentId, sessionId }, index) => {
+      stmts.setYeaftSessionSortOrder.run(index, now, sessionId, userId, agentId);
+    });
+    return true;
+  },
+
+  /**
+   * Persist pin state for a Yeaft Session even if the agent snapshot has not
+   * reached the server-side shadow table yet. This keeps the UI pin action
+   * durable across reloads in the bootstrap race where the user pins a row
+   * that exists in the web/agent session list but not in `yeaft_sessions`.
+   */
+  setPinnedForAgent(userId, agentId, session, pinned) {
+    const id = typeof session === 'string' ? session : session?.id;
+    if (!id || !agentId) return false;
+    const existing = this.getForAgent(userId, agentId, id);
+    if (existing && existing.userId && userId && existing.userId !== userId) return false;
+    if (!existing) {
+      this.upsertFromSnapshot(userId, agentId, {
+        ...(session && typeof session === 'object' ? session : {}),
+        id,
+        name: (session && typeof session === 'object' && session.name) ? session.name : id,
+      });
+    }
+    this.setPinnedForAgentRow(userId, agentId, id, pinned);
+    return true;
+  },
+};

package/local-runtime/server/email.js

@@ -0,0 +1,96 @@
+import nodemailer from 'nodemailer';
+import { CONFIG } from './config.js';
+
+let transporter = null;
+
+/**
+ * Get or create email transporter
+ * @returns {nodemailer.Transporter}
+ */
+function getTransporter() {
+  if (!transporter) {
+    transporter = nodemailer.createTransport({
+      host: CONFIG.smtp.host,
+      port: CONFIG.smtp.port,
+      secure: CONFIG.smtp.secure,
+      auth: {
+        user: CONFIG.smtp.user,
+        pass: CONFIG.smtp.pass
+      }
+    });
+  }
+  return transporter;
+}
+
+/**
+ * Send verification code email
+ * @param {string} to - Recipient email address
+ * @param {string} code - Verification code
+ * @param {string} username - Username for personalization
+ * @returns {Promise<void>}
+ */
+export async function sendVerificationCode(to, code, username) {
+  const transport = getTransporter();
+
+  const htmlContent = `
+    <!DOCTYPE html>
+    <html>
+    <head>
+      <meta charset="utf-8">
+      <style>
+        body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; }
+        .container { max-width: 600px; margin: 0 auto; padding: 20px; }
+        .code { font-size: 32px; font-weight: bold; letter-spacing: 8px; color: #2563eb; padding: 20px; background: #f0f9ff; border-radius: 8px; text-align: center; margin: 20px 0; }
+        .footer { color: #6b7280; font-size: 12px; margin-top: 20px; }
+      </style>
+    </head>
+    <body>
+      <div class="container">
+        <h2>WebChat Login Verification</h2>
+        <p>Hello ${username},</p>
+        <p>Your verification code is:</p>
+        <div class="code">${code}</div>
+        <p>This code will expire in 5 minutes.</p>
+        <p>If you did not request this code, please ignore this email.</p>
+        <div class="footer">
+          <p>This email was sent by WebChat. Do not reply to this email.</p>
+        </div>
+      </div>
+    </body>
+    </html>
+  `;
+
+  const textContent = `
+WebChat Login Verification
+
+Hello ${username},
+
+Your verification code is: ${code}
+
+This code will expire in 5 minutes.
+
+If you did not request this code, please ignore this email.
+  `.trim();
+
+  await transport.sendMail({
+    from: CONFIG.smtp.from,
+    to,
+    subject: `WebChat Verification Code: ${code}`,
+    text: textContent,
+    html: htmlContent
+  });
+}
+
+/**
+ * Test email configuration
+ * @returns {Promise<{success: boolean, error?: string}>}
+ */
+export async function testEmailConfig() {
+  try {
+    const transport = getTransporter();
+    await transport.verify();
+    return { success: true };
+  } catch (err) {
+    return { success: false, error: err.message };
+  }
+}