domma-cms 0.110.0 → 0.111.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "0.110.0",
+  "version": "0.111.0",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/server/services/email.js

@@ -104,23 +104,46 @@ export async function createTransport(smtp) {
     });
 }
 
+/**
+ * The From header as nodemailer's {name, address} object, never a string: a
+ * string is re-parsed as an address list, so a display name holding `"`, `<`
+ * or a comma could name a different sender - and some callers pass a name a
+ * site user typed. nodemailer encodes an object's name as a phrase.
+ *
+ * @param {string} name
+ * @param {string} address
+ * @returns {{name: string, address: string}|string}
+ */
+export function fromHeader(name, address) {
+    const clean = String(name ?? '').replace(/[\r\n]+/g, ' ').trim();
+    return clean ? {name: clean, address} : address;
+}
+
 /**
  * Send a generic transactional email.
  *
+ * `replyTo`, `headers` and `attachments` are passed to nodemailer only when
+ * given - an inline image is an attachment with a `cid` the html refers to
+ * as `<img src="cid:...">`.
+ *
  * @param {import('nodemailer').Transporter} transport
- * @param {{ from: string, fromName: string, to: string, subject: string, html: string, text: string }} opts
+ * @param {{ from: string, fromName: string, to: string, subject: string, html: string, text: string, replyTo?: string, headers?: Record<string, string>, attachments?: Array<object> }} opts
  * @returns {Promise<void>}
  * @throws {Error} If sending the email fails.
  */
-export async function sendEmail(transport, {from, fromName, to, subject, html, text}) {
+export async function sendEmail(transport, {from, fromName, to, subject, html, text, replyTo, headers, attachments}) {
     try {
-        const info = await transport.sendMail({
-            from: `"${fromName}" <${from}>`,
+        const message = {
+            from: fromHeader(fromName, from),
             to,
             subject,
             text,
             html
-        });
+        };
+        if (replyTo) message.replyTo = replyTo;
+        if (headers && Object.keys(headers).length) message.headers = headers;
+        if (Array.isArray(attachments) && attachments.length) message.attachments = attachments;
+        const info = await transport.sendMail(message);
         recordSendResult(true, info.messageId);
 
         const previewUrl = nodemailer.getTestMessageUrl(info);
@@ -176,7 +199,7 @@ export async function sendFormEmail(transport, { from, fromName, to, subject, fo
 
     try {
         const info = await transport.sendMail({
-            from: `"${fromName}" <${from}>`,
+            from: fromHeader(fromName, from),
             to,
             subject,
             text,