agentmail-clone-v1 0.1.0

package/src/lib/store.js

@@ -0,0 +1,638 @@
+import { query, withTransaction } from '../db.js';
+import { monthStartUtc, PLAN_LIMITS } from './plan.js';
+
+export async function createUserWithDefaultOrg({ fullName, email, passwordHash }) {
+  return withTransaction(async (client) => {
+    const inserted = await client.query(
+      `INSERT INTO users (email, full_name, password_hash)
+       VALUES ($1, $2, $3)
+       RETURNING *`,
+      [email.toLowerCase(), fullName, passwordHash]
+    );
+    const user = inserted.rows[0];
+
+    const orgNameBase = fullName?.trim() || email.split('@')[0];
+    const orgInserted = await client.query(
+      'INSERT INTO organizations (name, plan) VALUES ($1, $2) RETURNING *',
+      [`${orgNameBase} Org`, 'free']
+    );
+    const organization = orgInserted.rows[0];
+    await client.query(
+      'INSERT INTO memberships (user_id, org_id, role) VALUES ($1, $2, $3)',
+      [user.id, organization.id, 'owner']
+    );
+
+    return { user, organization };
+  });
+}
+
+export async function getUserByEmail(email) {
+  const result = await query('SELECT * FROM users WHERE email = $1', [String(email ?? '').toLowerCase()]);
+  return result.rows[0] ?? null;
+}
+
+export async function markUserEmailVerified(userId) {
+  const result = await query(
+    `UPDATE users
+     SET email_verified_at = COALESCE(email_verified_at, NOW())
+     WHERE id = $1
+     RETURNING *`,
+    [userId]
+  );
+  return result.rows[0] ?? null;
+}
+
+export async function updateUserPasswordHash(userId, passwordHash) {
+  const result = await query(
+    `UPDATE users
+     SET password_hash = $2
+     WHERE id = $1
+     RETURNING *`,
+    [userId, passwordHash]
+  );
+  return result.rows[0] ?? null;
+}
+
+export async function createAuthToken({ userId, purpose, tokenHash, expiresAt }) {
+  const result = await query(
+    `INSERT INTO auth_tokens (user_id, purpose, token_hash, expires_at)
+     VALUES ($1, $2, $3, $4)
+     RETURNING *`,
+    [userId, purpose, tokenHash, expiresAt]
+  );
+  return result.rows[0];
+}
+
+export async function consumeAuthToken({ purpose, tokenHash }) {
+  const result = await query(
+    `UPDATE auth_tokens
+     SET used_at = NOW()
+     WHERE purpose = $1
+       AND token_hash = $2
+       AND used_at IS NULL
+       AND expires_at > NOW()
+     RETURNING *`,
+    [purpose, tokenHash]
+  );
+  return result.rows[0] ?? null;
+}
+
+export async function getOrCreateDefaultOrganizationForUser({ userId, fullName, email }) {
+  return withTransaction(async (client) => {
+    const membershipResult = await client.query(
+      `SELECT o.*
+       FROM memberships m
+       JOIN organizations o ON o.id = m.org_id
+       WHERE m.user_id = $1
+       ORDER BY m.created_at ASC
+       LIMIT 1`,
+      [userId]
+    );
+
+    if (membershipResult.rowCount === 0) {
+      const orgNameBase = fullName?.trim() || email.split('@')[0];
+      const orgInserted = await client.query(
+        'INSERT INTO organizations (name, plan) VALUES ($1, $2) RETURNING *',
+        [`${orgNameBase} Org`, 'free']
+      );
+      const organization = orgInserted.rows[0];
+      await client.query(
+        'INSERT INTO memberships (user_id, org_id, role) VALUES ($1, $2, $3)',
+        [userId, organization.id, 'owner']
+      );
+      return organization;
+    }
+
+    return membershipResult.rows[0];
+  });
+}
+
+export async function getUserById(userId) {
+  const result = await query('SELECT * FROM users WHERE id = $1', [userId]);
+  return result.rows[0] ?? null;
+}
+
+export async function getOrganizationForUser(userId, orgId) {
+  const result = await query(
+    `SELECT o.*
+     FROM memberships m
+     JOIN organizations o ON o.id = m.org_id
+     WHERE m.user_id = $1 AND o.id = $2
+     LIMIT 1`,
+    [userId, orgId]
+  );
+  return result.rows[0] ?? null;
+}
+
+export async function getOrganizationById(orgId) {
+  const result = await query('SELECT * FROM organizations WHERE id = $1', [orgId]);
+  return result.rows[0] ?? null;
+}
+
+export async function updateOrganizationPlan(orgId, plan) {
+  const result = await query(
+    `UPDATE organizations
+     SET plan = $2
+     WHERE id = $1
+     RETURNING *`,
+    [orgId, plan]
+  );
+  return result.rows[0] ?? null;
+}
+
+function mapPlanRowToLimits(row) {
+  return {
+    maxInboxes: row.max_inboxes,
+    maxCustomDomains: row.max_custom_domains,
+    maxApiKeys: row.max_api_keys,
+    monthlyEmails: row.monthly_emails
+  };
+}
+
+export async function getPlanLimitsForPlan(plan) {
+  const safePlan = plan === 'paid' ? 'paid' : 'free';
+  const result = await query(
+    `SELECT max_inboxes, max_custom_domains, max_api_keys, monthly_emails
+     FROM plan_limits
+     WHERE plan = $1`,
+    [safePlan]
+  );
+
+  if (result.rowCount === 0) {
+    return PLAN_LIMITS[safePlan];
+  }
+
+  return mapPlanRowToLimits(result.rows[0]);
+}
+
+export async function getAllPlanLimits() {
+  const result = await query(
+    `SELECT plan, max_inboxes, max_custom_domains, max_api_keys, monthly_emails
+     FROM plan_limits
+     ORDER BY plan`
+  );
+
+  const merged = {
+    free: { ...PLAN_LIMITS.free },
+    paid: { ...PLAN_LIMITS.paid }
+  };
+
+  for (const row of result.rows) {
+    if (row.plan === 'free' || row.plan === 'paid') {
+      merged[row.plan] = mapPlanRowToLimits(row);
+    }
+  }
+
+  return merged;
+}
+
+export async function upsertPlanLimits(plan, limits) {
+  const safePlan = plan === 'paid' ? 'paid' : 'free';
+  const result = await query(
+    `INSERT INTO plan_limits (plan, max_inboxes, max_custom_domains, max_api_keys, monthly_emails, updated_at)
+     VALUES ($1, $2, $3, $4, $5, NOW())
+     ON CONFLICT (plan)
+     DO UPDATE SET
+       max_inboxes = EXCLUDED.max_inboxes,
+       max_custom_domains = EXCLUDED.max_custom_domains,
+       max_api_keys = EXCLUDED.max_api_keys,
+       monthly_emails = EXCLUDED.monthly_emails,
+       updated_at = NOW()
+     RETURNING plan, max_inboxes, max_custom_domains, max_api_keys, monthly_emails`,
+    [safePlan, limits.maxInboxes, limits.maxCustomDomains, limits.maxApiKeys, limits.monthlyEmails]
+  );
+  return mapPlanRowToLimits(result.rows[0]);
+}
+
+export async function listInboxes(orgId) {
+  const result = await query(
+    `SELECT *
+     FROM inboxes
+     WHERE org_id = $1 AND status = 'active'
+     ORDER BY created_at DESC`,
+    [orgId]
+  );
+  return result.rows;
+}
+
+export async function countActiveInboxes(orgId) {
+  const result = await query(
+    `SELECT COUNT(*)::int AS count
+     FROM inboxes
+     WHERE org_id = $1 AND status = 'active'`,
+    [orgId]
+  );
+  return result.rows[0].count;
+}
+
+export async function createInbox({ orgId, localPart, domainName, displayName }) {
+  const emailAddress = `${localPart}@${domainName}`.toLowerCase();
+  const result = await query(
+    `INSERT INTO inboxes (org_id, local_part, domain_name, email_address, display_name)
+     VALUES ($1, $2, $3, $4, $5)
+     RETURNING *`,
+    [orgId, localPart.toLowerCase(), domainName.toLowerCase(), emailAddress, displayName ?? null]
+  );
+  return result.rows[0];
+}
+
+export async function getInboxById(orgId, inboxId) {
+  const result = await query(
+    `SELECT * FROM inboxes WHERE org_id = $1 AND id = $2 AND status = 'active'`,
+    [orgId, inboxId]
+  );
+  return result.rows[0] ?? null;
+}
+
+export async function getInboxByEmail(emailAddress) {
+  const result = await query(
+    `SELECT * FROM inboxes WHERE email_address = $1 AND status = 'active' LIMIT 1`,
+    [String(emailAddress ?? '').toLowerCase()]
+  );
+  return result.rows[0] ?? null;
+}
+
+export async function updateInboxDisplayName(orgId, inboxId, displayName) {
+  const result = await query(
+    `UPDATE inboxes
+     SET display_name = $3, updated_at = NOW()
+     WHERE org_id = $1 AND id = $2 AND status = 'active'
+     RETURNING *`,
+    [orgId, inboxId, displayName || null]
+  );
+  return result.rows[0] ?? null;
+}
+
+export async function deleteInbox(orgId, inboxId) {
+  const result = await query(
+    `UPDATE inboxes
+     SET status = 'deleted', deleted_at = NOW(), updated_at = NOW()
+     WHERE org_id = $1 AND id = $2 AND status = 'active'
+     RETURNING *`,
+    [orgId, inboxId]
+  );
+  return result.rows[0] ?? null;
+}
+
+export async function listDomains(orgId) {
+  const result = await query(
+    `SELECT *
+     FROM domains
+     WHERE org_id = $1 AND status <> 'deleted'
+     ORDER BY created_at DESC`,
+    [orgId]
+  );
+  return result.rows;
+}
+
+export async function countCustomDomains(orgId) {
+  const result = await query(
+    `SELECT COUNT(*)::int AS count
+     FROM domains
+     WHERE org_id = $1 AND status <> 'deleted'`,
+    [orgId]
+  );
+  return result.rows[0].count;
+}
+
+export async function createDomain({ orgId, name, providerDomainId, providerRouteId, status, dnsRecords }) {
+  const result = await query(
+    `INSERT INTO domains (org_id, name, provider_domain_id, provider_route_id, status, dns_records_json)
+     VALUES ($1, $2, $3, $4, $5, $6::jsonb)
+     RETURNING *`,
+    [
+      orgId,
+      name.toLowerCase(),
+      providerDomainId ?? null,
+      providerRouteId ?? null,
+      status ?? 'pending',
+      JSON.stringify(dnsRecords ?? [])
+    ]
+  );
+  return result.rows[0];
+}
+
+export async function getDomainById(orgId, domainId) {
+  const result = await query(
+    `SELECT * FROM domains WHERE org_id = $1 AND id = $2 AND status <> 'deleted'`,
+    [orgId, domainId]
+  );
+  return result.rows[0] ?? null;
+}
+
+export async function updateDomainStatusAndRecords(orgId, domainId, status, dnsRecords, providerRouteId = undefined) {
+  const routeValue = providerRouteId === undefined ? null : providerRouteId;
+  const result = await query(
+    `UPDATE domains
+     SET status = $3,
+         dns_records_json = $4::jsonb,
+         provider_route_id = COALESCE($5, provider_route_id),
+         updated_at = NOW()
+     WHERE org_id = $1 AND id = $2
+     RETURNING *`,
+    [orgId, domainId, status, JSON.stringify(dnsRecords ?? []), routeValue]
+  );
+  return result.rows[0] ?? null;
+}
+
+export async function deleteDomain(orgId, domainId) {
+  const result = await query(
+    `UPDATE domains
+     SET status = 'deleted', updated_at = NOW()
+     WHERE org_id = $1 AND id = $2 AND status <> 'deleted'
+     RETURNING *`,
+    [orgId, domainId]
+  );
+  return result.rows[0] ?? null;
+}
+
+export async function createApiKey({ orgId, name, keyPrefix, keyHash, scopes }) {
+  const result = await query(
+    `INSERT INTO api_keys (org_id, name, key_prefix, key_hash, scopes)
+     VALUES ($1, $2, $3, $4, $5)
+     RETURNING id, org_id, name, key_prefix, scopes, created_at`,
+    [orgId, name, keyPrefix, keyHash, scopes]
+  );
+  return result.rows[0];
+}
+
+export async function listApiKeys(orgId) {
+  const result = await query(
+    `SELECT id, name, key_prefix, scopes, last_used_at, revoked_at, created_at
+     FROM api_keys
+     WHERE org_id = $1
+     ORDER BY created_at DESC`,
+    [orgId]
+  );
+  return result.rows;
+}
+
+export async function countActiveApiKeys(orgId) {
+  const result = await query(
+    `SELECT COUNT(*)::int AS count
+     FROM api_keys
+     WHERE org_id = $1 AND revoked_at IS NULL`,
+    [orgId]
+  );
+  return result.rows[0].count;
+}
+
+export async function getActiveApiKeyById(orgId, apiKeyId) {
+  const result = await query(
+    `SELECT id, org_id, name, key_prefix, scopes, created_at
+     FROM api_keys
+     WHERE org_id = $1 AND id = $2 AND revoked_at IS NULL
+     LIMIT 1`,
+    [orgId, apiKeyId]
+  );
+  return result.rows[0] ?? null;
+}
+
+export async function revokeApiKey(orgId, apiKeyId) {
+  const result = await query(
+    `UPDATE api_keys
+     SET revoked_at = NOW()
+     WHERE org_id = $1 AND id = $2 AND revoked_at IS NULL
+     RETURNING id`,
+    [orgId, apiKeyId]
+  );
+  return result.rowCount > 0;
+}
+
+export async function getApiKeyByHash(hash) {
+  const result = await query(
+    `SELECT *
+     FROM api_keys
+     WHERE key_hash = $1 AND revoked_at IS NULL
+     LIMIT 1`,
+    [hash]
+  );
+  return result.rows[0] ?? null;
+}
+
+export async function touchApiKey(apiKeyId) {
+  await query('UPDATE api_keys SET last_used_at = NOW() WHERE id = $1', [apiKeyId]);
+}
+
+export async function listEmails(orgId, inboxId) {
+  const result = await query(
+    `SELECT *
+     FROM emails
+     WHERE org_id = $1
+       AND ($2::uuid IS NULL OR inbox_id = $2)
+       AND status = 'active'
+     ORDER BY created_at DESC
+     LIMIT 200`,
+    [orgId, inboxId ?? null]
+  );
+  return result.rows;
+}
+
+export async function getEmailById(orgId, emailId) {
+  const result = await query(
+    `SELECT *
+     FROM emails
+     WHERE org_id = $1 AND id = $2 AND status = 'active'`,
+    [orgId, emailId]
+  );
+  return result.rows[0] ?? null;
+}
+
+export async function createEmail({
+  orgId,
+  inboxId,
+  direction,
+  deliveryStatus,
+  messageId,
+  subject,
+  fromAddress,
+  toAddresses,
+  textBody,
+  htmlBody,
+  providerPayload,
+  isRead = false
+}) {
+  const result = await query(
+    `INSERT INTO emails (
+       org_id, inbox_id, direction, delivery_status, message_id, subject, from_address,
+       to_addresses, text_body, html_body, provider_payload, is_read
+     )
+     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11::jsonb, $12)
+     RETURNING *`,
+    [
+      orgId,
+      inboxId ?? null,
+      direction,
+      deliveryStatus ?? 'unknown',
+      messageId ?? null,
+      subject ?? '',
+      fromAddress,
+      toAddresses ?? [],
+      textBody ?? null,
+      htmlBody ?? null,
+      JSON.stringify(providerPayload ?? {}),
+      isRead
+    ]
+  );
+  return result.rows[0];
+}
+
+export async function updateEmailReadStatus(orgId, emailId, isRead) {
+  const result = await query(
+    `UPDATE emails
+     SET is_read = $3
+     WHERE org_id = $1 AND id = $2 AND status = 'active'
+     RETURNING *`,
+    [orgId, emailId, Boolean(isRead)]
+  );
+  return result.rows[0] ?? null;
+}
+
+export async function updateEmailDeliveryStatus(orgId, messageId, deliveryStatus, providerPayload) {
+  const result = await query(
+    `UPDATE emails
+     SET delivery_status = $3,
+         provider_payload = COALESCE($4::jsonb, provider_payload)
+     WHERE org_id = $1 AND message_id = $2
+     RETURNING *`,
+    [orgId, messageId, deliveryStatus, providerPayload ? JSON.stringify(providerPayload) : null]
+  );
+  return result.rows;
+}
+
+export async function deleteEmail(orgId, emailId) {
+  const result = await query(
+    `UPDATE emails
+     SET status = 'deleted'
+     WHERE org_id = $1 AND id = $2 AND status = 'active'
+     RETURNING *`,
+    [orgId, emailId]
+  );
+  return result.rows[0] ?? null;
+}
+
+export async function incrementUsage(orgId, type, amount = 1) {
+  const monthStart = monthStartUtc();
+  if (type !== 'sent' && type !== 'inbound') {
+    throw new Error('Invalid usage type');
+  }
+
+  const sentDelta = type === 'sent' ? amount : 0;
+  const inboundDelta = type === 'inbound' ? amount : 0;
+
+  await query(
+    `INSERT INTO usage_monthly (org_id, month_start, sent_count, inbound_count)
+     VALUES ($1, $2, $3, $4)
+     ON CONFLICT (org_id, month_start)
+     DO UPDATE SET
+       sent_count = usage_monthly.sent_count + EXCLUDED.sent_count,
+       inbound_count = usage_monthly.inbound_count + EXCLUDED.inbound_count,
+       updated_at = NOW()`,
+    [orgId, monthStart, sentDelta, inboundDelta]
+  );
+}
+
+export async function getUsageForCurrentMonth(orgId) {
+  const monthStart = monthStartUtc();
+  const result = await query(
+    `SELECT sent_count, inbound_count
+     FROM usage_monthly
+     WHERE org_id = $1 AND month_start = $2`,
+    [orgId, monthStart]
+  );
+
+  if (result.rowCount === 0) {
+    return { sent_count: 0, inbound_count: 0 };
+  }
+
+  return result.rows[0];
+}
+
+export async function cleanupExpiredIdempotency() {
+  await query('DELETE FROM idempotency_records WHERE expires_at < NOW()');
+}
+
+export async function getIdempotencyRecord(orgId, idempotencyKey, method, requestPath) {
+  const result = await query(
+    `SELECT *
+     FROM idempotency_records
+     WHERE org_id = $1
+       AND idempotency_key = $2
+       AND method = $3
+       AND request_path = $4
+     LIMIT 1`,
+    [orgId, idempotencyKey, method, requestPath]
+  );
+  return result.rows[0] ?? null;
+}
+
+export async function createIdempotencyRecord({ orgId, idempotencyKey, method, requestPath, requestHash }) {
+  const result = await query(
+    `INSERT INTO idempotency_records
+       (org_id, idempotency_key, method, request_path, request_hash, status)
+     VALUES ($1, $2, $3, $4, $5, 'in_progress')
+     ON CONFLICT (org_id, idempotency_key, method, request_path)
+     DO NOTHING
+     RETURNING *`,
+    [orgId, idempotencyKey, method, requestPath, requestHash]
+  );
+  return result.rows[0] ?? null;
+}
+
+export async function completeIdempotencyRecord(recordId, responseStatus, responseBody) {
+  await query(
+    `UPDATE idempotency_records
+     SET status = 'completed',
+         response_status = $2,
+         response_body = $3::jsonb
+     WHERE id = $1`,
+    [recordId, responseStatus, JSON.stringify(responseBody ?? {})]
+  );
+}
+
+export async function deleteIdempotencyRecord(recordId) {
+  await query('DELETE FROM idempotency_records WHERE id = $1', [recordId]);
+}
+
+export async function recordWebhookEvent(provider, eventId, eventType, payload) {
+  const result = await query(
+    `INSERT INTO webhook_events (provider, event_id, event_type, payload)
+     VALUES ($1, $2, $3, $4::jsonb)
+     ON CONFLICT (provider, event_id)
+     DO NOTHING
+     RETURNING id`,
+    [provider, eventId, eventType ?? null, JSON.stringify(payload ?? {})]
+  );
+  return result.rowCount > 0;
+}
+
+export async function getOrgMetricsSnapshot(orgId) {
+  const [usage, inboxCount, domainCount, apiKeyCount] = await Promise.all([
+    getUsageForCurrentMonth(orgId),
+    countActiveInboxes(orgId),
+    countCustomDomains(orgId),
+    countActiveApiKeys(orgId)
+  ]);
+
+  return {
+    sentCount: usage.sent_count,
+    inboundCount: usage.inbound_count,
+    inboxCount,
+    customDomainCount: domainCount,
+    apiKeyCount
+  };
+}
+
+export async function getGlobalAdminMetrics() {
+  const [inboxes, domains, apiKeys] = await Promise.all([
+    query('SELECT COUNT(*)::bigint AS count FROM inboxes'),
+    query('SELECT COUNT(*)::bigint AS count FROM domains'),
+    query('SELECT COUNT(*)::bigint AS count FROM api_keys')
+  ]);
+
+  return {
+    totalInboxesCreated: Number(inboxes.rows[0].count),
+    totalDomainsCreated: Number(domains.rows[0].count),
+    totalApiKeysCreated: Number(apiKeys.rows[0].count)
+  };
+}

package/src/lib/transactional-mailer.js

@@ -0,0 +1,54 @@
+import { config } from '../config.js';
+import { mailgun } from './mailgun.js';
+import {
+  buildPasswordResetEmailTemplate,
+  buildVerificationEmailTemplate,
+  buildWelcomeEmailTemplate
+} from './email-templates.js';
+
+function senderDomain() {
+  return String(config.mailgunAccountDomain || config.appSharedDomain || '').toLowerCase();
+}
+
+function senderFrom() {
+  if (config.mailFromEmail) {
+    return config.mailFromEmail;
+  }
+  const domain = senderDomain();
+  return `EmailAgent <no-reply@${domain}>`;
+}
+
+async function sendTemplateEmail({ to, template }) {
+  if (!mailgun.isConfigured()) {
+    return { skipped: true, reason: 'mailgun_not_configured' };
+  }
+
+  const domain = senderDomain();
+  if (!domain) {
+    throw new Error('No sending domain configured for transactional emails');
+  }
+
+  return mailgun.sendMessage({
+    domain,
+    from: senderFrom(),
+    to,
+    subject: template.subject,
+    text: template.text,
+    html: template.html
+  });
+}
+
+export async function sendVerificationEmail({ to, fullName, verifyUrl }) {
+  const template = buildVerificationEmailTemplate({ fullName, verifyUrl });
+  return sendTemplateEmail({ to, template });
+}
+
+export async function sendWelcomeEmail({ to, fullName }) {
+  const template = buildWelcomeEmailTemplate({ fullName, appUrl: config.appBaseUrl });
+  return sendTemplateEmail({ to, template });
+}
+
+export async function sendPasswordResetEmail({ to, fullName, resetUrl }) {
+  const template = buildPasswordResetEmailTemplate({ fullName, resetUrl });
+  return sendTemplateEmail({ to, template });
+}

package/src/lib/validation.js

@@ -0,0 +1,30 @@
+export function normalizeLocalPart(value) {
+  return String(value ?? '')
+    .trim()
+    .toLowerCase();
+}
+
+export function normalizeDomain(value) {
+  return String(value ?? '')
+    .trim()
+    .toLowerCase();
+}
+
+export function parseEmailList(csv) {
+  return String(csv ?? '')
+    .split(',')
+    .map((x) => x.trim())
+    .filter(Boolean);
+}
+
+export function isValidLocalPart(value) {
+  return /^[a-z0-9._%+-]{2,64}$/.test(value);
+}
+
+export function isValidDomain(value) {
+  return /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(value);
+}
+
+export function isValidEmail(value) {
+  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value);
+}