emailengine-app 2.65.0 → 2.67.0

package/static/js/login-passkey.js

@@ -0,0 +1,75 @@
+'use strict';
+
+document.addEventListener('DOMContentLoaded', function () {
+    var passkeyBtn = document.getElementById('passkey-login-btn');
+    if (!passkeyBtn) {
+        return;
+    }
+
+    if (typeof SimpleWebAuthnBrowser === 'undefined' || !SimpleWebAuthnBrowser.browserSupportsWebAuthn()) {
+        passkeyBtn.style.display = 'none';
+        return;
+    }
+
+    passkeyBtn.addEventListener('click', async function () {
+        var errorEl = document.getElementById('passkey-error');
+        errorEl.style.display = 'none';
+        passkeyBtn.disabled = true;
+        passkeyBtn.textContent = 'Waiting for passkey...';
+
+        try {
+            var crumbInput = document.getElementById('crumb');
+            var crumbValue = crumbInput ? crumbInput.value : '';
+
+            var optionsResp = await fetch('/admin/passkey/auth/options', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ crumb: crumbValue })
+            });
+
+            var optionsData = await optionsResp.json();
+
+            if (!optionsResp.ok || optionsData.error) {
+                throw new Error(
+                    optionsData.error === 'no_passkeys' ? 'No passkeys have been registered.' : optionsData.error || 'Could not start authentication.'
+                );
+            }
+
+            var authResponse = await SimpleWebAuthnBrowser.startAuthentication({ optionsJSON: optionsData.options });
+
+            var nextInput = document.querySelector('input[name="next"]');
+            var nextValue = nextInput ? nextInput.value : '';
+
+            var verifyResp = await fetch('/admin/passkey/auth/verify', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    crumb: crumbValue,
+                    challengeId: optionsData.challengeId,
+                    credential: authResponse,
+                    next: nextValue,
+                    // Reads the hidden "remember" input; always "Y" (persistent sessions hardcoded, no UI toggle)
+                    remember: (document.querySelector('input[name="remember"]') || {}).value || false
+                })
+            });
+
+            var verifyData = await verifyResp.json();
+
+            if (verifyData.success) {
+                window.location.href = verifyData.redirect || '/admin';
+            } else {
+                throw new Error(verifyData.error || 'Authentication failed.');
+            }
+        } catch (err) {
+            if (err.name === 'NotAllowedError') {
+                errorEl.textContent = 'Passkey authentication was cancelled or timed out.';
+            } else {
+                errorEl.textContent = err.message || 'Passkey authentication failed.';
+            }
+            errorEl.style.display = 'block';
+        } finally {
+            passkeyBtn.disabled = false;
+            passkeyBtn.textContent = 'Sign in with a passkey';
+        }
+    });
+});

package/static/js/passkey-register.js

@@ -0,0 +1,107 @@
+'use strict';
+
+document.addEventListener('DOMContentLoaded', function () {
+    var registerBtn = document.getElementById('register-passkey-btn');
+    if (!registerBtn) {
+        return;
+    }
+
+    if (typeof SimpleWebAuthnBrowser === 'undefined' || !SimpleWebAuthnBrowser.browserSupportsWebAuthn()) {
+        registerBtn.disabled = true;
+        registerBtn.title = 'Your browser does not support passkeys';
+        return;
+    }
+
+    registerBtn.addEventListener('click', function () {
+        var nameInput = document.getElementById('passkey-name');
+        if (nameInput) {
+            nameInput.value = '';
+        }
+        var passwordInput = document.getElementById('passkey-current-password');
+        if (passwordInput) {
+            passwordInput.value = '';
+        }
+        var errorEl = document.getElementById('passkey-register-error');
+        var successEl = document.getElementById('passkey-register-success');
+        if (errorEl) {
+            errorEl.style.display = 'none';
+        }
+        if (successEl) {
+            successEl.style.display = 'none';
+        }
+        var confirmBtn = document.getElementById('passkey-register-confirm-btn');
+        if (confirmBtn) {
+            confirmBtn.disabled = false;
+        }
+        $('#registerPasskeyModal').modal('show');
+    });
+
+    var confirmBtn = document.getElementById('passkey-register-confirm-btn');
+    if (!confirmBtn) {
+        return;
+    }
+
+    confirmBtn.addEventListener('click', async function () {
+        var errorEl = document.getElementById('passkey-register-error');
+        var successEl = document.getElementById('passkey-register-success');
+        errorEl.style.display = 'none';
+        successEl.style.display = 'none';
+        confirmBtn.disabled = true;
+
+        var nameInput = document.getElementById('passkey-name');
+        var name = (nameInput && nameInput.value.trim()) || 'Unnamed passkey';
+
+        var passwordInput = document.getElementById('passkey-current-password');
+        var password = passwordInput ? passwordInput.value : '';
+
+        var crumbInput = document.getElementById('security-crumb');
+        var crumbValue = crumbInput ? crumbInput.value : '';
+
+        try {
+            var optionsResp = await fetch('/admin/account/passkeys/register/options', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ crumb: crumbValue, password: password })
+            });
+
+            if (!optionsResp.ok) {
+                var errData = await optionsResp.json();
+                throw new Error(errData.error || 'Could not start registration.');
+            }
+
+            var optionsData = await optionsResp.json();
+
+            var regResponse = await SimpleWebAuthnBrowser.startRegistration({ optionsJSON: optionsData.options });
+
+            var verifyResp = await fetch('/admin/account/passkeys/register/verify', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    crumb: crumbValue,
+                    challengeId: optionsData.challengeId,
+                    name: name,
+                    credential: regResponse
+                })
+            });
+
+            var verifyData = await verifyResp.json();
+
+            if (verifyData.success) {
+                successEl.style.display = 'block';
+                setTimeout(function () {
+                    window.location.reload();
+                }, 1000);
+            } else {
+                throw new Error(verifyData.error || 'Registration failed.');
+            }
+        } catch (err) {
+            if (err.name === 'NotAllowedError') {
+                errorEl.textContent = 'Passkey registration was cancelled or timed out.';
+            } else {
+                errorEl.textContent = err.message || 'Registration failed.';
+            }
+            errorEl.style.display = 'block';
+            confirmBtn.disabled = false;
+        }
+    });
+});

package/static/licenses.html

@@ -1,6 +1,6 @@
 <!doctype html><html><head><meta charset="utf-8"><title>EmailEngine Licenses</title><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@4.6.1/dist/css/bootstrap.min.css" integrity="sha384-zCbKRCUGaJDkqS1kPbPd7TveP5iyJE0EjAuZQTgFLD2ylzuqKfdKlfG/eSrtxUkn" crossorigin="anonymous"></head><body>
 <div class="container-fluid">
-<h1>EmailEngine v2.64.0</h1><p>EmailEngine includes code from the following software packages:</p>
+<h1>EmailEngine v2.66.0</h1><p>EmailEngine includes code from the following software packages:</p>
 <table class="table table-sm">
 <tr><thead class="thead-dark"><th>Package</th><th>Version</th><th>License</th><th>Publisher</th><th>Publisher's Email</th><th>Package URL</th></tr>
 <tbody>
@@ -216,7 +216,7 @@
 </tr>
 <tr>
 <td><a href="https://npmjs.com/package/@csstools/css-syntax-patches-for-csstree">@csstools/css-syntax-patches-for-csstree</a></td>
-<td>1.1.1</td>
+<td>1.1.2</td>
 <td>MIT-0</td>
 <td></td>
 <td></td>
@@ -735,6 +735,16 @@
 </td
 </tr>
 <tr>
+<td><a href="https://npmjs.com/package/@hexagon/base64">@hexagon/base64</a></td>
+<td>1.1.28</td>
+<td>MIT</td>
+<td>Hexagon</td>
+<td>github.com/hexagon</td>
+<td>
+<a href="https://github.com/hexagon/base64">github.com/hexagon/base64</a>
+</td
+</tr>
+<tr>
 <td><a href="https://npmjs.com/package/@humanfs/core">@humanfs/core</a></td>
 <td>0.19.1</td>
 <td>Apache-2.0</td>
@@ -776,16 +786,6 @@
 </tr>
 <tr>
 <td><a href="https://npmjs.com/package/@ioredis/commands">@ioredis/commands</a></td>
-<td>1.5.0</td>
-<td>MIT</td>
-<td>Zihua Li</td>
-<td>i@zihua.li</td>
-<td>
-<a href="https://github.com/ioredis/commands">github.com/ioredis/commands</a>
-</td
-</tr>
-<tr>
-<td><a href="https://npmjs.com/package/@ioredis/commands">@ioredis/commands</a></td>
 <td>1.5.1</td>
 <td>MIT</td>
 <td>Zihua Li</td>
@@ -815,6 +815,16 @@
 </td
 </tr>
 <tr>
+<td><a href="https://npmjs.com/package/@levischuck/tiny-cbor">@levischuck/tiny-cbor</a></td>
+<td>0.2.11</td>
+<td>MIT</td>
+<td></td>
+<td></td>
+<td>
+<a href="https://github.com/levischuck/tiny-cbor">github.com/levischuck/tiny-cbor</a>
+</td
+</tr>
+<tr>
 <td><a href="https://npmjs.com/package/@msgpackr-extract/msgpackr-extract-darwin-arm64">@msgpackr-extract/msgpackr-extract-darwin-arm64</a></td>
 <td>3.0.3</td>
 <td>MIT</td>
@@ -836,7 +846,7 @@
 </tr>
 <tr>
 <td><a href="https://npmjs.com/package/@opentelemetry/api">@opentelemetry/api</a></td>
-<td>1.9.0</td>
+<td>1.9.1</td>
 <td>Apache-2.0</td>
 <td>OpenTelemetry Authors</td>
 <td></td>
@@ -846,7 +856,7 @@
 </tr>
 <tr>
 <td><a href="https://npmjs.com/package/@opentelemetry/core">@opentelemetry/core</a></td>
-<td>2.6.0</td>
+<td>2.6.1</td>
 <td>Apache-2.0</td>
 <td>OpenTelemetry Authors</td>
 <td></td>
@@ -875,6 +885,116 @@
 </td
 </tr>
 <tr>
+<td><a href="https://npmjs.com/package/@peculiar/asn1-android">@peculiar/asn1-android</a></td>
+<td>2.6.0</td>
+<td>MIT</td>
+<td>PeculiarVentures, LLC</td>
+<td></td>
+<td>
+</td
+</tr>
+<tr>
+<td><a href="https://npmjs.com/package/@peculiar/asn1-cms">@peculiar/asn1-cms</a></td>
+<td>2.6.1</td>
+<td>MIT</td>
+<td>PeculiarVentures, LLC</td>
+<td></td>
+<td>
+</td
+</tr>
+<tr>
+<td><a href="https://npmjs.com/package/@peculiar/asn1-csr">@peculiar/asn1-csr</a></td>
+<td>2.6.1</td>
+<td>MIT</td>
+<td>PeculiarVentures, LLC</td>
+<td></td>
+<td>
+</td
+</tr>
+<tr>
+<td><a href="https://npmjs.com/package/@peculiar/asn1-ecc">@peculiar/asn1-ecc</a></td>
+<td>2.6.1</td>
+<td>MIT</td>
+<td>PeculiarVentures, LLC</td>
+<td></td>
+<td>
+</td
+</tr>
+<tr>
+<td><a href="https://npmjs.com/package/@peculiar/asn1-pfx">@peculiar/asn1-pfx</a></td>
+<td>2.6.1</td>
+<td>MIT</td>
+<td>PeculiarVentures, LLC</td>
+<td></td>
+<td>
+</td
+</tr>
+<tr>
+<td><a href="https://npmjs.com/package/@peculiar/asn1-pkcs8">@peculiar/asn1-pkcs8</a></td>
+<td>2.6.1</td>
+<td>MIT</td>
+<td>PeculiarVentures, LLC</td>
+<td></td>
+<td>
+</td
+</tr>
+<tr>
+<td><a href="https://npmjs.com/package/@peculiar/asn1-pkcs9">@peculiar/asn1-pkcs9</a></td>
+<td>2.6.1</td>
+<td>MIT</td>
+<td>PeculiarVentures, LLC</td>
+<td></td>
+<td>
+<a href="https://github.com/PeculiarVentures/asn1-schema">github.com/PeculiarVentures/asn1-schema</a>
+</td
+</tr>
+<tr>
+<td><a href="https://npmjs.com/package/@peculiar/asn1-rsa">@peculiar/asn1-rsa</a></td>
+<td>2.6.1</td>
+<td>MIT</td>
+<td>PeculiarVentures, LLC</td>
+<td></td>
+<td>
+</td
+</tr>
+<tr>
+<td><a href="https://npmjs.com/package/@peculiar/asn1-schema">@peculiar/asn1-schema</a></td>
+<td>2.6.0</td>
+<td>MIT</td>
+<td>PeculiarVentures, LLC</td>
+<td></td>
+<td>
+</td
+</tr>
+<tr>
+<td><a href="https://npmjs.com/package/@peculiar/asn1-x509-attr">@peculiar/asn1-x509-attr</a></td>
+<td>2.6.1</td>
+<td>MIT</td>
+<td>PeculiarVentures, LLC</td>
+<td></td>
+<td>
+</td
+</tr>
+<tr>
+<td><a href="https://npmjs.com/package/@peculiar/asn1-x509">@peculiar/asn1-x509</a></td>
+<td>2.6.1</td>
+<td>MIT</td>
+<td>PeculiarVentures, LLC</td>
+<td></td>
+<td>
+</td
+</tr>
+<tr>
+<td><a href="https://npmjs.com/package/@peculiar/x509">@peculiar/x509</a></td>
+<td>1.14.3</td>
+<td>MIT</td>
+<td>Peculiar Ventures LLC</td>
+<td></td>
+<td>
+<a href="https://github.com/PeculiarVentures/x509">github.com/PeculiarVentures/x509</a>
+</td
+</tr>
+<tr>
 <td><a href="https://npmjs.com/package/@phc/format">@phc/format</a></td>
 <td>0.5.0</td>
 <td>MIT</td>
@@ -936,7 +1056,7 @@
 </tr>
 <tr>
 <td><a href="https://npmjs.com/package/@postalsys/email-ai-tools">@postalsys/email-ai-tools</a></td>
-<td>1.12.1</td>
+<td>1.13.0</td>
 <td>MIT</td>
 <td>Postal Systems O&#xDC;</td>
 <td></td>
@@ -976,7 +1096,7 @@
 </tr>
 <tr>
 <td><a href="https://npmjs.com/package/@postalsys/templates">@postalsys/templates</a></td>
-<td>2.0.0</td>
+<td>2.0.1</td>
 <td>ISC</td>
 <td>Postal Systems O&#xDC;</td>
 <td></td>
@@ -1115,6 +1235,26 @@
 </td
 </tr>
 <tr>
+<td><a href="https://npmjs.com/package/@simplewebauthn/browser">@simplewebauthn/browser</a></td>
+<td>13.3.0</td>
+<td>MIT</td>
+<td>Matthew Miller</td>
+<td>matthew@millerti.me</td>
+<td>
+<a href="https://github.com/MasterKale/SimpleWebAuthn">github.com/MasterKale/SimpleWebAuthn</a>
+</td
+</tr>
+<tr>
+<td><a href="https://npmjs.com/package/@simplewebauthn/server">@simplewebauthn/server</a></td>
+<td>13.3.0</td>
+<td>MIT</td>
+<td>Matthew Miller</td>
+<td>matthew@millerti.me</td>
+<td>
+<a href="https://github.com/MasterKale/SimpleWebAuthn">github.com/MasterKale/SimpleWebAuthn</a>
+</td
+</tr>
+<tr>
 <td><a href="https://npmjs.com/package/@standard-schema/spec">@standard-schema/spec</a></td>
 <td>1.1.0</td>
 <td>MIT</td>
@@ -1425,6 +1565,16 @@
 </td
 </tr>
 <tr>
+<td><a href="https://npmjs.com/package/asn1js">asn1js</a></td>
+<td>3.0.7</td>
+<td>BSD-3-Clause</td>
+<td>Yury Strozhevsky</td>
+<td>yury@strozhevsky.com</td>
+<td>
+<a href="https://github.com/PeculiarVentures/asn1.js">github.com/PeculiarVentures/asn1.js</a>
+</td
+</tr>
+<tr>
 <td><a href="https://npmjs.com/package/assertion-error">assertion-error</a></td>
 <td>1.1.0</td>
 <td>MIT</td>
@@ -1566,7 +1716,7 @@
 </tr>
 <tr>
 <td><a href="https://npmjs.com/package/brace-expansion">brace-expansion</a></td>
-<td>1.1.12</td>
+<td>1.1.13</td>
 <td>MIT</td>
 <td>Julian Gruber</td>
 <td>mail@juliangruber.com</td>
@@ -1576,7 +1726,7 @@
 </tr>
 <tr>
 <td><a href="https://npmjs.com/package/brace-expansion">brace-expansion</a></td>
-<td>2.0.2</td>
+<td>2.0.3</td>
 <td>MIT</td>
 <td>Julian Gruber</td>
 <td>mail@juliangruber.com</td>
@@ -1586,7 +1736,7 @@
 </tr>
 <tr>
 <td><a href="https://npmjs.com/package/brace-expansion">brace-expansion</a></td>
-<td>5.0.4</td>
+<td>5.0.5</td>
 <td>MIT</td>
 <td></td>
 <td></td>
@@ -1616,7 +1766,7 @@
 </tr>
 <tr>
 <td><a href="https://npmjs.com/package/bullmq">bullmq</a></td>
-<td>5.71.0</td>
+<td>5.71.1</td>
 <td>MIT</td>
 <td>Taskforce.sh Inc.</td>
 <td></td>
@@ -3205,7 +3355,7 @@
 </tr>
 <tr>
 <td><a href="https://npmjs.com/package/handlebars">handlebars</a></td>
-<td>4.7.8</td>
+<td>4.7.9</td>
 <td>MIT</td>
 <td>Yehuda Katz</td>
 <td></td>
@@ -3475,7 +3625,7 @@
 </tr>
 <tr>
 <td><a href="https://npmjs.com/package/imapflow">imapflow</a></td>
-<td>1.2.16</td>
+<td>1.2.18</td>
 <td>MIT</td>
 <td>Postal Systems O&#xDC;</td>
 <td></td>
@@ -3554,16 +3704,6 @@
 </td
 </tr>
 <tr>
-<td><a href="https://npmjs.com/package/ioredis">ioredis</a></td>
-<td>5.9.3</td>
-<td>MIT</td>
-<td>Zihua Li</td>
-<td>i@zihua.li</td>
-<td>
-<a href="https://github.com/luin/ioredis">github.com/luin/ioredis</a>
-</td
-</tr>
-<tr>
 <td><a href="https://npmjs.com/package/ip-address">ip-address</a></td>
 <td>10.1.0</td>
 <td>MIT</td>
@@ -4135,7 +4275,7 @@
 </tr>
 <tr>
 <td><a href="https://npmjs.com/package/mailparser">mailparser</a></td>
-<td>3.9.5</td>
+<td>3.9.6</td>
 <td>MIT</td>
 <td>Andris Reinman</td>
 <td></td>
@@ -4285,7 +4425,7 @@
 </tr>
 <tr>
 <td><a href="https://npmjs.com/package/minimatch">minimatch</a></td>
-<td>10.2.4</td>
+<td>10.2.5</td>
 <td>BlueOak-1.0.0</td>
 <td>Isaac Z. Schlueter</td>
 <td>i@izs.me</td>
@@ -4495,7 +4635,7 @@
 </tr>
 <tr>
 <td><a href="https://npmjs.com/package/nodemailer">nodemailer</a></td>
-<td>8.0.3</td>
+<td>8.0.4</td>
 <td>MIT-0</td>
 <td>Andris Reinman</td>
 <td></td>
@@ -4905,7 +5045,7 @@
 </tr>
 <tr>
 <td><a href="https://npmjs.com/package/picomatch">picomatch</a></td>
-<td>2.3.1</td>
+<td>2.3.2</td>
 <td>MIT</td>
 <td>Jon Schlinkert</td>
 <td></td>
@@ -5065,7 +5205,7 @@
 </tr>
 <tr>
 <td><a href="https://npmjs.com/package/pubface">pubface</a></td>
-<td>1.0.19</td>
+<td>1.1.0</td>
 <td>MIT-0</td>
 <td>Postal Systems O&#xDC;</td>
 <td></td>
@@ -5144,6 +5284,26 @@
 </td
 </tr>
 <tr>
+<td><a href="https://npmjs.com/package/pvtsutils">pvtsutils</a></td>
+<td>1.3.6</td>
+<td>MIT</td>
+<td>PeculiarVentures</td>
+<td></td>
+<td>
+<a href="https://github.com/PeculiarVentures/pvtsutils">github.com/PeculiarVentures/pvtsutils</a>
+</td
+</tr>
+<tr>
+<td><a href="https://npmjs.com/package/pvutils">pvutils</a></td>
+<td>1.1.5</td>
+<td>MIT</td>
+<td>Yury Strozhevsky</td>
+<td>yury@strozhevsky.com</td>
+<td>
+<a href="https://github.com/PeculiarVentures/pvutils">github.com/PeculiarVentures/pvutils</a>
+</td
+</tr>
+<tr>
 <td><a href="https://npmjs.com/package/qrcode">qrcode</a></td>
 <td>1.5.4</td>
 <td>MIT</td>
@@ -5284,6 +5444,16 @@
 </td
 </tr>
 <tr>
+<td><a href="https://npmjs.com/package/reflect-metadata">reflect-metadata</a></td>
+<td>0.2.2</td>
+<td>Apache-2.0</td>
+<td>Ron Buckton</td>
+<td>ron.buckton@microsoft.com</td>
+<td>
+<a href="https://github.com/rbuckton/reflect-metadata">github.com/rbuckton/reflect-metadata</a>
+</td
+</tr>
+<tr>
 <td><a href="https://npmjs.com/package/require-directory">require-directory</a></td>
 <td>2.1.1</td>
 <td>MIT</td>
@@ -5565,7 +5735,7 @@
 </tr>
 <tr>
 <td><a href="https://npmjs.com/package/smtp-server">smtp-server</a></td>
-<td>3.18.2</td>
+<td>3.18.3</td>
 <td>MIT-0</td>
 <td>Andris Reinman</td>
 <td></td>
@@ -6045,6 +6215,16 @@
 </tr>
 <tr>
 <td><a href="https://npmjs.com/package/tslib">tslib</a></td>
+<td>1.14.1</td>
+<td>0BSD</td>
+<td>Microsoft Corp.</td>
+<td></td>
+<td>
+<a href="https://github.com/Microsoft/tslib">github.com/Microsoft/tslib</a>
+</td
+</tr>
+<tr>
+<td><a href="https://npmjs.com/package/tslib">tslib</a></td>
 <td>2.8.1</td>
 <td>0BSD</td>
 <td>Microsoft Corp.</td>
@@ -6064,6 +6244,16 @@
 </td
 </tr>
 <tr>
+<td><a href="https://npmjs.com/package/tsyringe">tsyringe</a></td>
+<td>4.10.0</td>
+<td>MIT</td>
+<td>Steven Hobson-Campbell</td>
+<td></td>
+<td>
+<a href="https://github.com/Microsoft/tsyringe">github.com/Microsoft/tsyringe</a>
+</td
+</tr>
+<tr>
 <td><a href="https://npmjs.com/package/type-check">type-check</a></td>
 <td>0.4.0</td>
 <td>MIT</td>
@@ -6154,6 +6344,16 @@
 </td
 </tr>
 <tr>
+<td><a href="https://npmjs.com/package/undici">undici</a></td>
+<td>7.24.6</td>
+<td>MIT</td>
+<td></td>
+<td></td>
+<td>
+<a href="https://github.com/nodejs/undici">github.com/nodejs/undici</a>
+</td
+</tr>
+<tr>
 <td><a href="https://npmjs.com/package/uri-js">uri-js</a></td>
 <td>4.4.1</td>
 <td>BSD-2-Clause</td>