domma-cms 0.116.1 → 0.116.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "0.116.1",
+  "version": "0.116.2",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/plugins/_lib/mail/imapPool.js

@@ -206,7 +206,7 @@ export function createPool(config) {
             } catch {
                 // Already down - nothing to close.
             }
-            return {ok: false, error: describeError(err)};
+            return {ok: false, error: describeError(err, connection)};
         }
     }
 
@@ -261,19 +261,52 @@ export function createPool(config) {
 }
 
 /**
- * Turn an IMAP/network error into something worth showing a user.
+ * Turn an IMAP/SMTP/network error into something worth showing a user.
  *
  * ImapFlow's own messages are decent but its auth failures surface as raw
- * server responses, which vary by server and read like a stack trace.
+ * server responses, which vary by server and read like a stack trace. TLS
+ * failures are worse: OpenSSL's text ("…:tls_validate_record_header:wrong
+ * version number:…") names nothing the user can change. nodemailer also wraps
+ * every socket error as `ESOCKET`, dropping the TLS code, so those are
+ * recognised by `reason`/message as well as by code.
  *
- * @param   {Error & {code?: string, authenticationFailed?: boolean}} err
+ * @param   {Error & {code?: string, reason?: string, authenticationFailed?: boolean}} err
+ * @param   {{host?: string, port?: number, secure?: boolean}} [connection] - what was tried, so the message can name it
  * @returns {string}
  */
-export function describeError(err) {
+export function describeError(err, connection = {}) {
     if (!err) return 'Unknown error.';
-    if (err.authenticationFailed) return 'The mail server rejected that username and password.';
+    if (err.authenticationFailed || err.code === 'EAUTH') return 'The mail server rejected that username and password.';
 
-    switch (err.code) {
+    const host = connection.host || 'The mail server';
+    const port = connection.port ? `Port ${connection.port}` : 'That port';
+    const text = `${err.reason || ''} ${err.message || ''}`;
+
+    // Implicit TLS against a port that starts in plain text (587, 143, 25):
+    // the "server hello" is a greeting line, which OpenSSL reads as a bad version.
+    if (err.code === 'ERR_SSL_WRONG_VERSION_NUMBER' || /wrong version number/i.test(text)) {
+        return connection.secure
+            ? `${port} does not start with TLS, so Implicit TLS must be off for it - ports 587 and 143 switch to TLS with STARTTLS. Untick Implicit TLS, or use the implicit-TLS port (465 to send, 993 to read).`
+            : `${port} answered in a different TLS mode from the one chosen. Check the port and the Implicit TLS setting.`;
+    }
+    if (['DEPTH_ZERO_SELF_SIGNED_CERT', 'SELF_SIGNED_CERT_IN_CHAIN'].includes(err.code) || /self[- ]signed certificate/i.test(text)) {
+        return `${host === 'The mail server' ? 'The mail server’s' : `${host}’s`} TLS certificate is self-signed, so the server cannot prove who it is. `
+            + `Install a trusted certificate (Let’s Encrypt, for example) that covers this hostname on the mail server. `
+            + `For a server you control, the plugin’s allowInsecureTLS setting accepts it instead.`;
+    }
+    if (err.code === 'ERR_TLS_CERT_ALTNAME_INVALID' || /altnames|does not match certificate/i.test(text)) {
+        return `The mail server’s TLS certificate does not cover ${connection.host || 'that hostname'}. Use the hostname the certificate was issued for, or reissue it to include this one.`;
+    }
+    if (err.code === 'CERT_HAS_EXPIRED' || /certificate has expired/i.test(text)) {
+        return 'The mail server’s TLS certificate has expired. It needs renewing on the server.';
+    }
+    if (['UNABLE_TO_VERIFY_LEAF_SIGNATURE', 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY'].includes(err.code) || /unable to (verify the first certificate|get local issuer)/i.test(text)) {
+        return 'The mail server’s TLS certificate could not be verified - it is missing its intermediate certificate, or was issued by an authority this server does not trust.';
+    }
+
+    // nodemailer reports these as ESOCKET/EDNS; the system code survives only in the message.
+    const netCode = text.match(/\b(ENOTFOUND|EAI_AGAIN|ECONNREFUSED|ETIMEDOUT|ECONNRESET)\b/)?.[1] ?? err.code;
+    switch (netCode) {
         case 'ENOTFOUND':
         case 'EAI_AGAIN':
             return 'That mail server hostname could not be resolved.';
@@ -282,11 +315,6 @@ export function describeError(err) {
         case 'ETIMEDOUT':
         case 'ECONNRESET':
             return 'The mail server did not respond in time.';
-        case 'CERT_HAS_EXPIRED':
-        case 'DEPTH_ZERO_SELF_SIGNED_CERT':
-        case 'SELF_SIGNED_CERT_IN_CHAIN':
-        case 'ERR_TLS_CERT_ALTNAME_INVALID':
-            return 'The mail server’s TLS certificate could not be verified.';
         default:
             return err.message || 'The mail server connection failed.';
     }

package/plugins/_lib/mail/send.js

@@ -13,6 +13,7 @@ import {createRequire} from 'node:module';
 import nodemailer from 'nodemailer';
 
 import {bareAddress, formatFrom} from '../admin/mail/identity.js';
+import {describeError} from './imapPool.js';
 import {normalisePriority, priorityHeaders} from './priority.js';
 
 // MailComposer is not on nodemailer's public export, but it is the piece that
@@ -389,7 +390,7 @@ export async function verifySmtp(transportConfig, allowInsecureTLS = false) {
         await transport.verify();
         return {ok: true};
     } catch (err) {
-        return {ok: false, error: err.message};
+        return {ok: false, error: describeError(err, transportConfig)};
     } finally {
         transport.close();
     }