emailengine-app 2.68.1 → 2.69.0

package/lib/api-routes/account-routes.js

@@ -5,9 +5,12 @@ const { redis } = require('../db');
 const { Account } = require('../account');
 const getSecret = require('../get-secret');
 const { oauth2Apps, SERVICE_ACCOUNT_PROVIDERS } = require('../oauth2-apps');
+const settings = require('../settings');
+const { autodetectImapSettings } = require('../autodetect-imap-settings');
 const Boom = require('@hapi/boom');
 const Joi = require('joi');
-const { failAction } = require('../tools');
+const { failAction, getSignedFormData, getLogs, verifyAccountInfo } = require('../tools');
+const { handleError } = require('./route-helpers');
 
 const {
     settingsSchema,
@@ -21,7 +24,9 @@ const {
     smtpSchema,
     smtpUpdateSchema,
     oauth2Schema,
-    oauth2UpdateSchema
+    oauth2UpdateSchema,
+    defaultAccountTypeSchema,
+    shortMailboxesSchema
 } = require('../schemas');
 
 const { REDIS_PREFIX, MAX_FORM_TTL, NONCE_BYTES } = require('../consts');
@@ -46,7 +51,9 @@ async function init(args) {
         imapSchema: imapSchemaArg,
         smtpSchema: smtpSchemaArg,
         CORS_CONFIG,
-        AccountTypeSchema
+        AccountTypeSchema,
+        OAuth2ProviderSchema,
+        metrics
     } = args;
 
     // POST /v1/account - Create account
@@ -133,15 +140,7 @@ async function init(args) {
                 let result = await accountObject.create(request.payload);
                 return result;
             } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
+                handleError(request, err);
             }
         },
 
@@ -281,15 +280,7 @@ async function init(args) {
 
                 return await accountObject.update(request.payload);
             } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
+                handleError(request, err);
             }
         },
         options: {
@@ -397,15 +388,7 @@ async function init(args) {
             try {
                 return { reconnect: await accountObject.requestReconnect(request.payload) };
             } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
+                handleError(request, err);
             }
         },
         options: {
@@ -464,15 +447,7 @@ async function init(args) {
             try {
                 return { sync: await accountObject.requestSync(request.payload) };
             } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
+                handleError(request, err);
             }
         },
         options: {
@@ -532,15 +507,7 @@ async function init(args) {
             try {
                 return await accountObject.delete({ revoke: request.query.revoke });
             } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
+                handleError(request, err);
             }
         },
         options: {
@@ -608,15 +575,7 @@ async function init(args) {
             try {
                 return { flush: await accountObject.flush(request.payload) };
             } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
+                handleError(request, err);
             }
         },
         options: {
@@ -678,15 +637,7 @@ async function init(args) {
 
                 return await accountObject.listAccounts(request.query.state, request.query.query, request.query.page, request.query.pageSize);
             } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
+                handleError(request, err);
             }
         },
 
@@ -910,15 +861,7 @@ async function init(args) {
 
                 return result;
             } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
+                handleError(request, err);
             }
         },
         options: {
@@ -1057,6 +1000,481 @@ async function init(args) {
             }
         }
     });
+
+    server.route({
+        method: 'GET',
+        path: '/v1/account/{account}/oauth-token',
+
+        async handler(request) {
+            let enableOAuthTokensApi = await settings.get('enableOAuthTokensApi');
+            if (!enableOAuthTokensApi) {
+                let error = Boom.boomify(new Error('Disabled API endpoint'), { statusCode: 403 });
+                error.output.payload.code = 'ApiEndpointDisabled';
+                throw error;
+            }
+
+            let accountObject = new Account({
+                redis,
+                account: request.params.account,
+                call,
+                secret: await getSecret(),
+                timeout: request.headers['x-ee-timeout']
+            });
+
+            try {
+                const tokenData = await accountObject.getActiveAccessTokenData();
+
+                // Record metric if token was actually refreshed (not cached)
+                if (!tokenData.cached) {
+                    const provider = tokenData.provider || 'unknown';
+                    metrics(request.logger, 'oauth2TokenRefresh', 'inc', { status: 'success', provider, statusCode: '200' });
+                }
+
+                return tokenData;
+            } catch (err) {
+                // Record failed token refresh
+                const statusCode = String(err.statusCode || 0);
+                metrics(request.logger, 'oauth2TokenRefresh', 'inc', { status: 'failure', provider: 'unknown', statusCode });
+
+                handleError(request, err);
+            }
+        },
+
+        options: {
+            description: 'Get OAuth2 access token',
+            notes: 'Get the active OAuth2 access token for an account. NB! This endpoint is disabled by default and needs activation on the Service configuration page.',
+            tags: ['api', 'Account'],
+
+            plugins: {},
+
+            auth: {
+                strategy: 'api-token',
+                mode: 'required'
+            },
+            cors: CORS_CONFIG,
+
+            validate: {
+                options: {
+                    stripUnknown: false,
+                    abortEarly: false,
+                    convert: true
+                },
+                failAction,
+                params: Joi.object({
+                    account: accountIdSchema.required()
+                })
+            },
+
+            response: {
+                schema: Joi.object({
+                    account: accountIdSchema.required(),
+                    user: Joi.string().max(256).required().example('user@example.com').description('Username'),
+                    accessToken: Joi.string().max(256).required().example('aGVsbG8gd29ybGQ=').description('Access Token').label('OAuthAccessToken'),
+                    provider: OAuth2ProviderSchema
+                }).label('AccountTokenResponse'),
+                failAction: 'log'
+            }
+        }
+    });
+
+    server.route({
+        method: 'GET',
+        path: '/v1/account/{account}/server-signatures',
+
+        async handler(request) {
+            let accountObject = new Account({
+                redis,
+                account: request.params.account,
+                call,
+                secret: await getSecret(),
+                timeout: request.headers['x-ee-timeout']
+            });
+            try {
+                return await accountObject.listSignatures(request.query);
+            } catch (err) {
+                handleError(request, err);
+            }
+        },
+
+        options: {
+            description: 'List Account Signatures',
+            notes: 'Returns signatures associated with the account. Currently only Gmail is supported, and only "new message" signatures from the "sendAs" list are returned.',
+            tags: ['api', 'Account'],
+
+            plugins: {},
+
+            auth: {
+                strategy: 'api-token',
+                mode: 'required'
+            },
+            cors: CORS_CONFIG,
+
+            validate: {
+                options: {
+                    stripUnknown: false,
+                    abortEarly: false,
+                    convert: true
+                },
+                failAction,
+                params: Joi.object({
+                    account: accountIdSchema.required()
+                })
+            },
+
+            response: {
+                schema: Joi.object({
+                    signatures: Joi.array()
+                        .items(
+                            Joi.object({
+                                address: Joi.string().email().example('user@example.com').description('Email address associated with the signature').required(),
+                                signature: Joi.string().example('<div>Best regards,</div>').description('Signature HTML code').required()
+                            }).label('SignatureResponseItem')
+                        )
+                        .label('SignatureEntries')
+                }).label('AccountSignaturesResponse'),
+                failAction: 'log'
+            }
+        }
+    });
+
+    server.route({
+        method: 'POST',
+        path: '/v1/authentication/form',
+
+        async handler(request) {
+            try {
+                let { data, signature } = await getSignedFormData({
+                    account: request.payload.account,
+                    name: request.payload.name,
+                    email: request.payload.email,
+                    syncFrom: request.payload.syncFrom,
+                    notifyFrom: request.payload.notifyFrom,
+                    subconnections: request.payload.subconnections,
+                    redirectUrl: request.payload.redirectUrl,
+                    delegated: request.payload.delegated,
+                    path: request.payload.path && !request.payload.path.includes('*') ? request.payload.path : null,
+                    // identify request
+                    n: crypto.randomBytes(NONCE_BYTES).toString('base64url'),
+                    t: Date.now()
+                });
+
+                let serviceUrl = await settings.get('serviceUrl');
+                if (!serviceUrl) {
+                    let err = new Error('Service URL not set up');
+                    err.code = 'MissingServiceURLSetup';
+                    throw err;
+                }
+
+                let url = new URL(`accounts/new`, serviceUrl);
+
+                url.searchParams.append('data', data);
+                if (signature) {
+                    url.searchParams.append('sig', signature);
+                }
+
+                let type = request.payload.type;
+
+                if (type && type !== 'imap') {
+                    let oauth2app = await oauth2Apps.get(type);
+                    if (!oauth2app || !oauth2app.enabled) {
+                        type = false;
+                    }
+                }
+
+                if (!type) {
+                    let oauth2apps = (await oauth2Apps.list(0, 100)).apps.filter(app => app.includeInListing);
+                    if (!oauth2apps.length) {
+                        type = 'imap';
+                    }
+                }
+
+                if (type) {
+                    url.searchParams.append('type', type);
+                }
+
+                return {
+                    url: url.href
+                };
+            } catch (err) {
+                handleError(request, err);
+            }
+        },
+
+        options: {
+            description: 'Generate authentication link',
+            notes: 'Generates a redirect link to the hosted authentication form',
+            tags: ['api', 'Account'],
+
+            plugins: {},
+
+            auth: {
+                strategy: 'api-token',
+                mode: 'required'
+            },
+            cors: CORS_CONFIG,
+
+            validate: {
+                options: {
+                    stripUnknown: false,
+                    abortEarly: false,
+                    convert: true
+                },
+                failAction,
+
+                payload: Joi.object({
+                    account: Joi.string()
+                        .empty('')
+                        .trim()
+                        .max(256)
+                        .allow(null)
+                        .example('example')
+                        .default(null)
+                        .description(
+                            'Account ID. If set to `null`, a unique ID will be generated automatically. If you provide an existing account ID, the settings for that account will be updated instead'
+                        ),
+
+                    name: Joi.string().empty('').max(256).example('My Email Account').description('Display name for the account'),
+
+                    email: Joi.string()
+                        .empty('')
+                        .email()
+                        .example('user@example.com')
+                        .description('Specifies the default email address for this account. Users can change it if needed.'),
+
+                    delegated: Joi.boolean()
+                        .empty('')
+                        .truthy('Y', 'true', '1')
+                        .falsy('N', 'false', 0)
+                        .default(false)
+                        .description('If true, configures this account as a shared mailbox. Currently supported by MS365 OAuth2 accounts'),
+
+                    syncFrom: accountSchemas.syncFrom,
+                    notifyFrom: accountSchemas.notifyFrom,
+
+                    subconnections: accountSchemas.subconnections,
+
+                    path: accountPathSchema.example(['*']).label('AccountFormPath'),
+                    redirectUrl: Joi.string()
+                        .empty('')
+                        .uri({ scheme: ['http', 'https'], allowRelative: false })
+                        .required()
+                        .example('https://myapp/account/settings.php')
+                        .description('After the authentication process is completed, the user is redirected to this URL'),
+
+                    type: defaultAccountTypeSchema
+                }).label('RequestAuthForm')
+            },
+
+            response: {
+                schema: Joi.object({
+                    url: Joi.string()
+                        .empty('')
+                        .uri({ scheme: ['http', 'https'], allowRelative: false })
+                        .required()
+                        .example('https://ee.example.com/accounts/new?data=eyJhY2NvdW50IjoiZXhh...L0W_BkFH5HW6Krwmr7c&type=imap')
+                        .description('Generated URL to the hosted authentication form')
+                }).label('RequestAuthFormResponse'),
+                failAction: 'log'
+            }
+        }
+    });
+
+    server.route({
+        method: 'GET',
+        path: '/v1/logs/{account}',
+
+        async handler(request) {
+            return getLogs(redis, request.params.account);
+        },
+        options: {
+            description: 'Return IMAP logs for an account',
+            notes: 'Output is a downloadable text file',
+            tags: ['api', 'Logs'],
+
+            auth: {
+                strategy: 'api-token',
+                mode: 'required'
+            },
+            cors: CORS_CONFIG,
+
+            plugins: {
+                'hapi-swagger': {
+                    produces: ['text/plain']
+                }
+            },
+
+            validate: {
+                options: {
+                    stripUnknown: false,
+                    abortEarly: false,
+                    convert: true
+                },
+                failAction,
+
+                params: Joi.object({
+                    account: accountIdSchema.required()
+                })
+            }
+        }
+    });
+
+    server.route({
+        method: 'POST',
+        path: '/v1/verifyAccount',
+
+        async handler(request) {
+            try {
+                return await verifyAccountInfo(redis, request.payload, request.logger.child({ action: 'verify-account' }));
+            } catch (err) {
+                handleError(request, err);
+            }
+        },
+        options: {
+            description: 'Verify IMAP and SMTP settings',
+            notes: 'Checks if can connect and authenticate using provided account info',
+            tags: ['api', 'Account'],
+
+            plugins: {},
+
+            auth: {
+                strategy: 'api-token',
+                mode: 'required'
+            },
+            cors: CORS_CONFIG,
+
+            validate: {
+                options: {
+                    stripUnknown: false,
+                    abortEarly: false,
+                    convert: true
+                },
+                failAction,
+
+                payload: Joi.object({
+                    mailboxes: Joi.boolean().example(false).description('Include mailbox listing in response').default(false).label('IncludeMailboxes'),
+                    imap: Joi.object(imapSchema).allow(false).description('IMAP configuration').label('ImapConfiguration'),
+                    smtp: Joi.object(smtpSchema).allow(false).description('SMTP configuration').label('SmtpConfiguration'),
+                    proxy: settingsSchema.proxyUrl,
+                    smtpEhloName: settingsSchema.smtpEhloName
+                }).label('VerifyAccount')
+            },
+            response: {
+                schema: Joi.object({
+                    imap: Joi.object({
+                        success: Joi.boolean().example(true).description('Was IMAP account verified').label('VerifyImapSuccess'),
+                        error: Joi.string()
+                            .example('Something went wrong')
+                            .description('Error messages for IMAP verification. Only present if success=false')
+                            .label('VerifyImapError'),
+                        code: Joi.string()
+                            .example('ERR_SSL_WRONG_VERSION_NUMBER')
+                            .description('Error code. Only present if success=false')
+                            .label('VerifyImapCode')
+                    }).label('VerifyImapResult'),
+                    smtp: Joi.object({
+                        success: Joi.boolean().example(true).description('Was SMTP account verified').label('VerifySmtpSuccess'),
+                        error: Joi.string()
+                            .example('Something went wrong')
+                            .description('Error messages for SMTP verification. Only present if success=false')
+                            .label('VerifySmtpError'),
+                        code: Joi.string()
+                            .example('ERR_SSL_WRONG_VERSION_NUMBER')
+                            .description('Error code. Only present if success=false')
+                            .label('VerifySmtpCode')
+                    }).label('VerifySmtpResult'),
+                    mailboxes: shortMailboxesSchema
+                }).label('VerifyAccountResponse'),
+                failAction: 'log'
+            }
+        }
+    });
+
+    server.route({
+        method: 'GET',
+        path: '/v1/autoconfig',
+
+        async handler(request) {
+            try {
+                let serverSettings = await autodetectImapSettings(request.query.email, request.app.gt);
+                return serverSettings;
+            } catch (err) {
+                request.logger.error({ msg: 'API request failed', err });
+                if (Boom.isBoom(err)) {
+                    throw err;
+                }
+                return { imap: false, smtp: false, _source: 'unknown' };
+            }
+        },
+
+        options: {
+            description: 'Discover Email settings',
+            notes: 'Try to discover IMAP and SMTP settings for an email account',
+            tags: ['api', 'Settings'],
+
+            plugins: {},
+
+            auth: {
+                strategy: 'api-token',
+                mode: 'required'
+            },
+            cors: CORS_CONFIG,
+
+            validate: {
+                options: {
+                    stripUnknown: false,
+                    abortEarly: false,
+                    convert: true
+                },
+                failAction,
+
+                query: Joi.object({
+                    email: Joi.string()
+                        .email()
+                        .required()
+                        .example('sender@example.com')
+                        .description('Email address to discover email settings for')
+                        .label('EmailAddress')
+                }).label('AutodiscoverQuery')
+            },
+
+            response: {
+                schema: Joi.object({
+                    imap: Joi.object({
+                        auth: Joi.object({
+                            user: Joi.string().max(256).example('myuser@gmail.com').description('Account username')
+                        }).label('DetectedAuthenticationInfo'),
+
+                        host: Joi.string().hostname().required().example('imap.gmail.com').description('Hostname to connect to'),
+                        port: Joi.number()
+                            .integer()
+                            .min(1)
+                            .max(64 * 1024)
+                            .required()
+                            .example(993)
+                            .description('Service port number'),
+                        secure: Joi.boolean().default(false).example(true).description('Should connection use TLS. Usually true for port 993')
+                    }).label('ResolvedServerSettings'),
+                    smtp: Joi.object({
+                        auth: Joi.object({
+                            user: Joi.string().max(256).example('myuser@gmail.com').description('Account username')
+                        }).label('DetectedAuthenticationInfo'),
+
+                        host: Joi.string().hostname().required().example('imap.gmail.com').description('Hostname to connect to'),
+                        port: Joi.number()
+                            .integer()
+                            .min(1)
+                            .max(64 * 1024)
+                            .required()
+                            .example(993)
+                            .description('Service port number'),
+                        secure: Joi.boolean().default(false).example(true).description('Should connection use TLS. Usually true for port 993')
+                    }).label('DiscoveredServerSettings'),
+                    _source: Joi.string().example('srv').description('Source for the detected info')
+                }).label('DiscoveredEmailSettings'),
+                failAction: 'log'
+            }
+        }
+    });
 }
 
 module.exports = init;