emailengine-app 2.68.1 → 2.70.0

package/lib/api-routes/account-routes.js

@@ -4,10 +4,13 @@ const crypto = require('crypto');
 const { redis } = require('../db');
 const { Account } = require('../account');
 const getSecret = require('../get-secret');
-const { oauth2Apps, SERVICE_ACCOUNT_PROVIDERS } = require('../oauth2-apps');
+const { oauth2Apps, LEGACY_KEYS, SERVICE_ACCOUNT_PROVIDERS } = require('../oauth2-apps');
+const settings = require('../settings');
+const { autodetectImapSettings } = require('../autodetect-imap-settings');
 const Boom = require('@hapi/boom');
 const Joi = require('joi');
-const { failAction } = require('../tools');
+const { failAction, getSignedFormData, getLogs, verifyAccountInfo } = require('../tools');
+const { handleError } = require('./route-helpers');
 
 const {
     settingsSchema,
@@ -21,11 +24,44 @@ const {
     smtpSchema,
     smtpUpdateSchema,
     oauth2Schema,
-    oauth2UpdateSchema
+    oauth2UpdateSchema,
+    defaultAccountTypeSchema,
+    shortMailboxesSchema,
+    ACCOUNT_DISPLAY_STATES,
+    errorResponses
 } = require('../schemas');
 
 const { REDIS_PREFIX, MAX_FORM_TTL, NONCE_BYTES } = require('../consts');
 
+// OAuth2 scope list stored on the account (accountData.oauth2.scope). Reused with a per-route
+// description/label where the same value is exposed under a different field name
+const accountOauth2ScopesSchema = Joi.array()
+    .items(Joi.string().example('https://mail.google.com/').label('AccountScopeEntry'))
+    .description('OAuth2 scopes granted for this account')
+    .label('AccountOauth2Scopes');
+
+// Per-protocol result block for the account verification response - the IMAP and SMTP results
+// carry the same fields built by verifyAccountInfo, only labels, wording, and the server
+// response example differ
+const verifyResultSchema = (proto, responseTextExample) =>
+    Joi.object({
+        success: Joi.boolean().example(true).description(`Was ${proto.toUpperCase()} account verified`).label(`Verify${proto}Success`),
+        error: Joi.string()
+            .example('Something went wrong')
+            .description(`Error messages for ${proto.toUpperCase()} verification. Only present if success=false`)
+            .label(`Verify${proto}Error`),
+        code: Joi.string().example('ERR_SSL_WRONG_VERSION_NUMBER').description('Error code. Only present if success=false').label(`Verify${proto}Code`),
+        statusCode: Joi.number()
+            .integer()
+            .example(500)
+            .description('HTTP-style status code for the error. Only present if success=false')
+            .label(`Verify${proto}StatusCode`),
+        responseText: Joi.string()
+            .example(responseTextExample)
+            .description('Server response for the failed verification. Only present if success=false')
+            .label(`Verify${proto}ResponseText`)
+    }).label(`Verify${proto}Result`);
+
 /**
  * Validates that delegation fields are only used with OAuth2 accounts.
  */
@@ -46,7 +82,9 @@ async function init(args) {
         imapSchema: imapSchemaArg,
         smtpSchema: smtpSchemaArg,
         CORS_CONFIG,
-        AccountTypeSchema
+        AccountTypeSchema,
+        OAuth2ProviderSchema,
+        metrics
     } = args;
 
     // POST /v1/account - Create account
@@ -133,15 +171,7 @@ async function init(args) {
                 let result = await accountObject.create(request.payload);
                 return result;
             } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
+                handleError(request, err);
             }
         },
 
@@ -150,7 +180,11 @@ async function init(args) {
             notes: 'Registers new IMAP account to be synced',
             tags: ['api', 'Account'],
 
-            plugins: {},
+            plugins: {
+                'hapi-swagger': {
+                    responses: errorResponses(400, 401, 403, 404, 429, 500)
+                }
+            },
 
             auth: {
                 strategy: 'api-token',
@@ -248,13 +282,19 @@ async function init(args) {
 
             response: {
                 schema: Joi.object({
-                    account: accountIdSchema.required(),
+                    account: accountIdSchema,
                     state: Joi.string()
-                        .required()
                         .valid('existing', 'new')
                         .example('new')
-                        .description('Is the account new or updated existing')
-                        .label('CreateAccountState')
+                        .description('Is the account new or updated existing. Not present when a redirect URL is returned')
+                        .label('CreateAccountState'),
+                    redirect: Joi.string()
+                        .uri()
+                        .example('https://emailengine.example.com/oauth?account=example')
+                        .description(
+                            'OAuth2 authorization URL. Returned instead of account and state when the request used oauth2.authorize=true - send the user to this URL to complete the OAuth2 flow'
+                        )
+                        .label('CreateAccountRedirect')
                 }).label('CreateAccountResponse'),
                 failAction: 'log'
             }
@@ -281,15 +321,7 @@ async function init(args) {
 
                 return await accountObject.update(request.payload);
             } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
+                handleError(request, err);
             }
         },
         options: {
@@ -297,7 +329,11 @@ async function init(args) {
             notes: 'Updates account information',
             tags: ['api', 'Account'],
 
-            plugins: {},
+            plugins: {
+                'hapi-swagger': {
+                    responses: errorResponses(400, 401, 403, 404, 429, 500)
+                }
+            },
 
             auth: {
                 strategy: 'api-token',
@@ -397,15 +433,7 @@ async function init(args) {
             try {
                 return { reconnect: await accountObject.requestReconnect(request.payload) };
             } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
+                handleError(request, err);
             }
         },
         options: {
@@ -413,7 +441,11 @@ async function init(args) {
             notes: 'Requests connection to be reconnected',
             tags: ['api', 'Account'],
 
-            plugins: {},
+            plugins: {
+                'hapi-swagger': {
+                    responses: errorResponses(400, 401, 403, 404, 429, 500)
+                }
+            },
 
             auth: {
                 strategy: 'api-token',
@@ -464,15 +496,7 @@ async function init(args) {
             try {
                 return { sync: await accountObject.requestSync(request.payload) };
             } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
+                handleError(request, err);
             }
         },
         options: {
@@ -480,7 +504,11 @@ async function init(args) {
             notes: 'Immediately trigger account syncing for IMAP accounts',
             tags: ['api', 'Account'],
 
-            plugins: {},
+            plugins: {
+                'hapi-swagger': {
+                    responses: errorResponses(400, 401, 403, 404, 429, 500)
+                }
+            },
 
             auth: {
                 strategy: 'api-token',
@@ -532,15 +560,7 @@ async function init(args) {
             try {
                 return await accountObject.delete({ revoke: request.query.revoke });
             } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
+                handleError(request, err);
             }
         },
         options: {
@@ -549,7 +569,11 @@ async function init(args) {
 
             tags: ['api', 'Account'],
 
-            plugins: {},
+            plugins: {
+                'hapi-swagger': {
+                    responses: errorResponses(400, 401, 403, 404, 429, 500)
+                }
+            },
 
             auth: {
                 strategy: 'api-token',
@@ -608,15 +632,7 @@ async function init(args) {
             try {
                 return { flush: await accountObject.flush(request.payload) };
             } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
+                handleError(request, err);
             }
         },
         options: {
@@ -624,7 +640,11 @@ async function init(args) {
             notes: 'Deletes all email indexes from Redis and ElasticSearch and re-creates the index for that account. You can only run a single flush operation at a time, so you must wait until the previous flush has finished before initiating a new one.',
             tags: ['api', 'Account'],
 
-            plugins: {},
+            plugins: {
+                'hapi-swagger': {
+                    responses: errorResponses(400, 401, 403, 404, 429, 500)
+                }
+            },
 
             auth: {
                 strategy: 'api-token',
@@ -678,15 +698,7 @@ async function init(args) {
 
                 return await accountObject.listAccounts(request.query.state, request.query.query, request.query.page, request.query.pageSize);
             } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
+                handleError(request, err);
             }
         },
 
@@ -695,7 +707,11 @@ async function init(args) {
             notes: 'Lists registered accounts',
             tags: ['api', 'Account'],
 
-            plugins: {},
+            plugins: {
+                'hapi-swagger': {
+                    responses: errorResponses(400, 401, 403, 429, 500)
+                }
+            },
 
             auth: {
                 strategy: 'api-token',
@@ -722,7 +738,7 @@ async function init(args) {
                         .label('PageNumber'),
                     pageSize: Joi.number().integer().min(1).max(1000).default(20).example(20).description('How many entries per page').label('PageSize'),
                     state: Joi.string()
-                        .valid('init', 'syncing', 'connecting', 'connected', 'authenticationError', 'connectError', 'unset', 'disconnected')
+                        .valid(...ACCOUNT_DISPLAY_STATES)
                         .example('connected')
                         .description('Filter accounts by state')
                         .label('AccountState'),
@@ -736,17 +752,27 @@ async function init(args) {
                     page: Joi.number().integer().example(0).description('Current page (0-based index)').label('PageNumber'),
                     pages: Joi.number().integer().example(24).description('Total page count').label('PagesNumber'),
 
+                    query: Joi.string()
+                        .allow(false)
+                        .example(false)
+                        .description('Search term used for filtering, or false when no filter was applied')
+                        .label('AccountsQueryFilter'),
+                    state: Joi.string()
+                        .example('*')
+                        .description('Account state filter used for the listing, or "*" when no filter was applied')
+                        .label('AccountsStateFilter'),
+
                     accounts: Joi.array()
                         .items(
                             Joi.object({
                                 account: accountIdSchema.required(),
-                                name: Joi.string().max(256).example('My Email Account').description('Display name for the account'),
+                                name: Joi.string().allow('').max(256).example('My Email Account').description('Display name for the account'),
                                 email: Joi.string().empty('').email().example('user@example.com').description('Default email address of the account'),
                                 type: AccountTypeSchema,
                                 app: Joi.string().max(256).example('AAABhaBPHscAAAAH').description('OAuth2 application ID'),
                                 state: Joi.string()
                                     .required()
-                                    .valid('init', 'syncing', 'connecting', 'connected', 'authenticationError', 'connectError', 'unset', 'disconnected')
+                                    .valid(...ACCOUNT_DISPLAY_STATES)
                                     .example('connected')
                                     .description('Account state')
                                     .label('AccountListState'),
@@ -762,8 +788,11 @@ async function init(args) {
 
                                 counters: accountCountersSchema,
 
-                                syncTime: Joi.date().iso().example('2021-02-17T13:43:18.860Z').description('Last sync time'),
-                                lastError: lastErrorSchema.allow(null)
+                                syncTime: Joi.date().iso().example('2021-02-17T13:43:18.860Z').description('Last sync time (IMAP accounts only)'),
+                                lastError: lastErrorSchema.allow(null),
+                                delegationError: Joi.string()
+                                    .example('Delegated account was not found')
+                                    .description('Error message if the delegated account could not be resolved')
                             }).label('AccountResponseItem')
                         )
                         .label('AccountEntries')
@@ -866,16 +895,15 @@ async function init(args) {
                     oauth2App = await oauth2Apps.get(accountData.oauth2.provider);
 
                     if (oauth2App) {
+                        result.type = oauth2App.provider;
                         // Check if account is already marked as send-only
                         if (accountData.sendOnly) {
                             result.sendOnly = true;
-                        } else {
-                            result.type = oauth2App.provider;
                         }
                         if (oauth2App.id !== oauth2App.provider) {
                             result.app = oauth2App.id;
                         }
-                        result.baseScopes = oauth2App.baseScope || 'imap';
+                        result.baseScopes = oauth2App.baseScopes || 'imap';
                     } else {
                         result.type = 'oauth2';
                     }
@@ -910,15 +938,7 @@ async function init(args) {
 
                 return result;
             } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
+                handleError(request, err);
             }
         },
         options: {
@@ -926,6 +946,12 @@ async function init(args) {
             notes: 'Returns stored information about the account. Passwords are not included.',
             tags: ['api', 'Account'],
 
+            plugins: {
+                'hapi-swagger': {
+                    responses: errorResponses(400, 401, 403, 404, 429, 500)
+                }
+            },
+
             auth: {
                 strategy: 'api-token',
                 mode: 'required'
@@ -958,7 +984,7 @@ async function init(args) {
                 schema: Joi.object({
                     account: accountIdSchema.required(),
 
-                    name: Joi.string().max(256).example('My Email Account').description('Display name for the account'),
+                    name: Joi.string().allow('').max(256).example('My Email Account').description('Display name for the account'),
                     email: Joi.string().empty('').email().example('user@example.com').description('Default email address of the account'),
 
                     copy: Joi.boolean().example(true).description('Copy submitted messages to Sent folder'),
@@ -974,6 +1000,7 @@ async function init(args) {
                     subconnections: accountSchemas.subconnections,
 
                     webhooks: Joi.string()
+                        .allow('')
                         .uri({
                             scheme: ['http', 'https'],
                             allowRelative: false
@@ -987,10 +1014,22 @@ async function init(args) {
 
                     smtp: Joi.object(smtpSchema).description('SMTP configuration').label('SMTPResponse'),
 
-                    oauth2: Joi.object(oauth2Schema).description('OAuth2 configuration').label('Oauth2Response'),
+                    oauth2: Joi.object(oauth2Schema)
+                        .keys({
+                            scope: accountOauth2ScopesSchema,
+                            tokenType: Joi.string().example('Bearer').description('OAuth2 token type'),
+                            generated: Joi.date().iso().example('2021-03-22T13:13:31.000Z').description('When the current access token was generated'),
+                            refreshTokenGenerated: Joi.date()
+                                .iso()
+                                .example('2021-03-22T13:13:31.000Z')
+                                .description('When the current refresh token was generated'),
+                            userFlag: Joi.object().unknown().description('Account-level OAuth2 error flag, if any').label('AccountOauth2UserFlag')
+                        })
+                        .description('OAuth2 configuration')
+                        .label('Oauth2Response'),
 
                     state: Joi.string()
-                        .valid('init', 'syncing', 'connecting', 'connected', 'authenticationError', 'connectError', 'unset', 'disconnected')
+                        .valid(...ACCOUNT_DISPLAY_STATES)
                         .example('connected')
                         .description('Informational account state')
                         .label('AccountInfoState'),
@@ -1006,11 +1045,30 @@ async function init(args) {
                         description: Joi.string().example('Authentication failed').description('Error information'),
                         responseCode: Joi.number().integer().example(500).description('Error status code'),
                         code: Joi.string().example('EAUTH').description('Error type identifier'),
-                        command: Joi.string().example('AUTH PLAIN').description('SMTP command that failed')
+                        command: Joi.string().example('AUTH PLAIN').description('SMTP command that failed'),
+                        networkRouting: Joi.object()
+                            .unknown()
+                            .allow(null)
+                            .description('Network routing information for the delivery attempt')
+                            .label('SMTPStatusNetworkRouting')
                     })
-                        .description('Information about the last SMTP connection attempt')
+                        .allow(null)
+                        .description('Information about the last SMTP connection attempt. Null when no SMTP connection has been attempted')
                         .label('SMTPInfoStatus'),
 
+                    syncError: Joi.object({
+                        path: Joi.string().example('INBOX').description('Mailbox folder path where the error occurred'),
+                        time: Joi.date().iso().example('2021-07-08T07:06:34.336Z').description('When the error occurred'),
+                        error: Joi.string().example('Failed to open mailbox').description('Error message')
+                    })
+                        .unknown()
+                        .description('Information about the last mailbox sync error (IMAP accounts only)')
+                        .label('AccountSyncError'),
+
+                    connections: Joi.number().integer().example(2).description('Number of open IMAP connections for this account (IMAP accounts only)'),
+
+                    sendOnly: Joi.boolean().example(false).description('Whether this is a send-only account that does not sync messages'),
+
                     webhooksCustomHeaders: settingsSchema.webhooksCustomHeaders.label('AccountWebhooksCustomHeaders'),
 
                     locale: Joi.string().empty('').max(100).example('fr').description('Optional locale'),
@@ -1039,17 +1097,23 @@ async function init(args) {
                             'Account quota information if query argument quota=true. This value will be false if the server does not provide quota information.'
                         ),
 
-                    syncTime: Joi.date().iso().example('2021-02-17T13:43:18.860Z').description('Last sync time'),
+                    syncTime: Joi.date().iso().example('2021-02-17T13:43:18.860Z').description('Last sync time (IMAP accounts only)'),
 
                     outlookSubscription: Joi.object({
                         id: Joi.string().description('Microsoft Graph subscription ID'),
-                        expirationDateTime: Joi.date().iso().description('When the subscription expires'),
+                        expirationDateTime: Joi.date().iso().allow(null).description('When the subscription expires'),
                         state: Joi.object({
-                            state: Joi.string().valid('creating', 'created', 'error').description('Subscription state'),
+                            state: Joi.string().valid('creating', 'created', 'renewing', 'error').description('Subscription state'),
                             time: Joi.number().description('Timestamp of last state change'),
-                            error: Joi.string().description('Error message if state is error')
-                        }).description('Current subscription state')
-                    }).description('Microsoft Graph subscription details (Outlook accounts only)'),
+                            error: Joi.string().allow(null).description('Error message if state is error, null after a successful renewal'),
+                            retryCount: Joi.number().integer().description('How many times the subscription renewal has been retried'),
+                            createRetryCount: Joi.number().integer().description('How many times the subscription creation has been retried')
+                        })
+                            .unknown()
+                            .description('Current subscription state')
+                    })
+                        .unknown()
+                        .description('Microsoft Graph subscription details (Outlook accounts only)'),
 
                     lastError: lastErrorSchema.allow(null)
                 }).label('AccountResponse'),
@@ -1057,6 +1121,520 @@ async function init(args) {
             }
         }
     });
+
+    server.route({
+        method: 'GET',
+        path: '/v1/account/{account}/oauth-token',
+
+        async handler(request) {
+            let enableOAuthTokensApi = await settings.get('enableOAuthTokensApi');
+            if (!enableOAuthTokensApi) {
+                let error = Boom.boomify(new Error('Disabled API endpoint'), { statusCode: 403 });
+                error.output.payload.code = 'ApiEndpointDisabled';
+                throw error;
+            }
+
+            let accountObject = new Account({
+                redis,
+                account: request.params.account,
+                call,
+                secret: await getSecret(),
+                timeout: request.headers['x-ee-timeout']
+            });
+
+            try {
+                const tokenData = await accountObject.getActiveAccessTokenData();
+
+                // Account data stores the OAuth2 app ID as the provider value. Resolve it to the
+                // provider name and expose the app ID separately. Legacy app IDs already equal
+                // their provider name, so skip the lookup for these.
+                if (tokenData.provider && !LEGACY_KEYS.includes(tokenData.provider)) {
+                    let oauth2App = await oauth2Apps.get(tokenData.provider);
+                    if (oauth2App) {
+                        if (oauth2App.id !== oauth2App.provider) {
+                            tokenData.app = oauth2App.id;
+                        }
+                        tokenData.provider = oauth2App.provider;
+                    }
+                }
+
+                // Record metric if token was actually refreshed (not cached)
+                if (!tokenData.cached) {
+                    const provider = tokenData.provider || 'unknown';
+                    metrics(request.logger, 'oauth2TokenRefresh', 'inc', { status: 'success', provider, statusCode: '200' });
+                }
+
+                return tokenData;
+            } catch (err) {
+                // Record failed token refresh
+                const statusCode = String(err.statusCode || 0);
+                metrics(request.logger, 'oauth2TokenRefresh', 'inc', { status: 'failure', provider: 'unknown', statusCode });
+
+                handleError(request, err);
+            }
+        },
+
+        options: {
+            description: 'Get OAuth2 access token',
+            notes: 'Get the active OAuth2 access token for an account. NB! This endpoint is disabled by default and needs activation on the Service configuration page.',
+            tags: ['api', 'Account'],
+
+            plugins: {
+                'hapi-swagger': {
+                    responses: errorResponses(400, 401, 403, 404, 429, 500)
+                }
+            },
+
+            auth: {
+                strategy: 'api-token',
+                mode: 'required'
+            },
+            cors: CORS_CONFIG,
+
+            validate: {
+                options: {
+                    stripUnknown: false,
+                    abortEarly: false,
+                    convert: true
+                },
+                failAction,
+                params: Joi.object({
+                    account: accountIdSchema.required()
+                })
+            },
+
+            response: {
+                schema: Joi.object({
+                    account: accountIdSchema.required(),
+                    user: Joi.string().max(256).required().example('user@example.com').description('Username'),
+                    accessToken: Joi.string()
+                        .max(4 * 4096)
+                        .example('aGVsbG8gd29ybGQ=')
+                        .description('Access Token. Can be missing if the external authentication server provided password-based credentials')
+                        .label('OAuthAccessToken'),
+                    provider: OAuth2ProviderSchema,
+                    app: Joi.string().max(256).example('AAABhaBPHscAAAAH').description('OAuth2 application ID'),
+                    registeredScopes: accountOauth2ScopesSchema.description('OAuth2 scopes registered for this account').label('RegisteredScopes'),
+                    expires: Joi.date().iso().example('2021-03-22T13:13:31.000Z').description('When the access token expires'),
+                    cached: Joi.boolean().example(false).description('Whether the token was returned from cache or was freshly renewed')
+                }).label('AccountTokenResponse'),
+                failAction: 'log'
+            }
+        }
+    });
+
+    server.route({
+        method: 'GET',
+        path: '/v1/account/{account}/server-signatures',
+
+        async handler(request) {
+            let accountObject = new Account({
+                redis,
+                account: request.params.account,
+                call,
+                secret: await getSecret(),
+                timeout: request.headers['x-ee-timeout']
+            });
+            try {
+                return await accountObject.listSignatures(request.query);
+            } catch (err) {
+                handleError(request, err);
+            }
+        },
+
+        options: {
+            description: 'List Account Signatures',
+            notes: 'Returns signatures associated with the account. Currently only Gmail is supported, and only "new message" signatures from the "sendAs" list are returned.',
+            tags: ['api', 'Account'],
+
+            plugins: {
+                'hapi-swagger': {
+                    responses: errorResponses(400, 401, 403, 404, 429, 500)
+                }
+            },
+
+            auth: {
+                strategy: 'api-token',
+                mode: 'required'
+            },
+            cors: CORS_CONFIG,
+
+            validate: {
+                options: {
+                    stripUnknown: false,
+                    abortEarly: false,
+                    convert: true
+                },
+                failAction,
+                params: Joi.object({
+                    account: accountIdSchema.required()
+                })
+            },
+
+            response: {
+                schema: Joi.object({
+                    signatures: Joi.array()
+                        .items(
+                            Joi.object({
+                                address: Joi.string().email().example('user@example.com').description('Email address associated with the signature').required(),
+                                signature: Joi.string().example('<div>Best regards,</div>').description('Signature HTML code').required()
+                            }).label('SignatureResponseItem')
+                        )
+                        .label('SignatureEntries'),
+                    signaturesSupported: Joi.boolean()
+                        .example(true)
+                        .description('Whether the account type supports listing signatures (currently Gmail API accounts only)')
+                }).label('AccountSignaturesResponse'),
+                failAction: 'log'
+            }
+        }
+    });
+
+    server.route({
+        method: 'POST',
+        path: '/v1/authentication/form',
+
+        async handler(request) {
+            try {
+                let { data, signature } = await getSignedFormData({
+                    account: request.payload.account,
+                    name: request.payload.name,
+                    email: request.payload.email,
+                    syncFrom: request.payload.syncFrom,
+                    notifyFrom: request.payload.notifyFrom,
+                    subconnections: request.payload.subconnections,
+                    redirectUrl: request.payload.redirectUrl,
+                    delegated: request.payload.delegated,
+                    path: request.payload.path && !request.payload.path.includes('*') ? request.payload.path : null,
+                    // identify request
+                    n: crypto.randomBytes(NONCE_BYTES).toString('base64url'),
+                    t: Date.now()
+                });
+
+                let serviceUrl = await settings.get('serviceUrl');
+                if (!serviceUrl) {
+                    let err = new Error('Service URL not set up');
+                    err.code = 'MissingServiceURLSetup';
+                    throw err;
+                }
+
+                let url = new URL(`accounts/new`, serviceUrl);
+
+                url.searchParams.append('data', data);
+                if (signature) {
+                    url.searchParams.append('sig', signature);
+                }
+
+                let type = request.payload.type;
+
+                if (type && type !== 'imap') {
+                    let oauth2app = await oauth2Apps.get(type);
+                    if (!oauth2app || !oauth2app.enabled) {
+                        type = false;
+                    }
+                }
+
+                if (!type) {
+                    let oauth2apps = (await oauth2Apps.list(0, 100)).apps.filter(app => app.includeInListing);
+                    if (!oauth2apps.length) {
+                        type = 'imap';
+                    }
+                }
+
+                if (type) {
+                    url.searchParams.append('type', type);
+                }
+
+                return {
+                    url: url.href
+                };
+            } catch (err) {
+                handleError(request, err);
+            }
+        },
+
+        options: {
+            description: 'Generate authentication link',
+            notes: 'Generates a redirect link to the hosted authentication form',
+            tags: ['api', 'Account'],
+
+            plugins: {
+                'hapi-swagger': {
+                    responses: errorResponses(400, 401, 403, 404, 429, 500)
+                }
+            },
+
+            auth: {
+                strategy: 'api-token',
+                mode: 'required'
+            },
+            cors: CORS_CONFIG,
+
+            validate: {
+                options: {
+                    stripUnknown: false,
+                    abortEarly: false,
+                    convert: true
+                },
+                failAction,
+
+                payload: Joi.object({
+                    account: Joi.string()
+                        .empty('')
+                        .trim()
+                        .max(256)
+                        .allow(null)
+                        .example('example')
+                        .default(null)
+                        .description(
+                            'Account ID. If set to `null`, a unique ID will be generated automatically. If you provide an existing account ID, the settings for that account will be updated instead'
+                        ),
+
+                    name: Joi.string().empty('').max(256).example('My Email Account').description('Display name for the account'),
+
+                    email: Joi.string()
+                        .empty('')
+                        .email()
+                        .example('user@example.com')
+                        .description('Specifies the default email address for this account. Users can change it if needed.'),
+
+                    delegated: Joi.boolean()
+                        .empty('')
+                        .truthy('Y', 'true', '1')
+                        .falsy('N', 'false', 0)
+                        .default(false)
+                        .description('If true, configures this account as a shared mailbox. Currently supported by MS365 OAuth2 accounts'),
+
+                    syncFrom: accountSchemas.syncFrom,
+                    notifyFrom: accountSchemas.notifyFrom,
+
+                    subconnections: accountSchemas.subconnections,
+
+                    path: accountPathSchema.example(['*']).label('AccountFormPath'),
+                    redirectUrl: Joi.string()
+                        .empty('')
+                        .uri({ scheme: ['http', 'https'], allowRelative: false })
+                        .required()
+                        .example('https://myapp/account/settings.php')
+                        .description('After the authentication process is completed, the user is redirected to this URL'),
+
+                    type: defaultAccountTypeSchema
+                }).label('RequestAuthForm')
+            },
+
+            response: {
+                schema: Joi.object({
+                    url: Joi.string()
+                        .empty('')
+                        .uri({ scheme: ['http', 'https'], allowRelative: false })
+                        .required()
+                        .example('https://ee.example.com/accounts/new?data=eyJhY2NvdW50IjoiZXhh...L0W_BkFH5HW6Krwmr7c&type=imap')
+                        .description('Generated URL to the hosted authentication form')
+                }).label('RequestAuthFormResponse'),
+                failAction: 'log'
+            }
+        }
+    });
+
+    server.route({
+        method: 'GET',
+        path: '/v1/logs/{account}',
+
+        async handler(request) {
+            return getLogs(redis, request.params.account);
+        },
+        options: {
+            description: 'Return IMAP logs for an account',
+            notes: 'Output is a downloadable text file',
+            tags: ['api', 'Logs'],
+
+            auth: {
+                strategy: 'api-token',
+                mode: 'required'
+            },
+            cors: CORS_CONFIG,
+
+            plugins: {
+                'hapi-swagger': {
+                    produces: ['text/plain'],
+                    responses: errorResponses(400, 401, 403, 429, 500)
+                }
+            },
+
+            validate: {
+                options: {
+                    stripUnknown: false,
+                    abortEarly: false,
+                    convert: true
+                },
+                failAction,
+
+                params: Joi.object({
+                    account: accountIdSchema.required()
+                })
+            }
+        }
+    });
+
+    server.route({
+        method: 'POST',
+        path: '/v1/verifyAccount',
+
+        async handler(request) {
+            try {
+                return await verifyAccountInfo(redis, request.payload, request.logger.child({ action: 'verify-account' }));
+            } catch (err) {
+                handleError(request, err);
+            }
+        },
+        options: {
+            description: 'Verify IMAP and SMTP settings',
+            notes: 'Checks if can connect and authenticate using provided account info',
+            tags: ['api', 'Account'],
+
+            plugins: {
+                'hapi-swagger': {
+                    responses: errorResponses(400, 401, 403, 429, 500)
+                }
+            },
+
+            auth: {
+                strategy: 'api-token',
+                mode: 'required'
+            },
+            cors: CORS_CONFIG,
+
+            validate: {
+                options: {
+                    stripUnknown: false,
+                    abortEarly: false,
+                    convert: true
+                },
+                failAction,
+
+                payload: Joi.object({
+                    mailboxes: Joi.boolean().example(false).description('Include mailbox listing in response').default(false).label('IncludeMailboxes'),
+                    imap: Joi.object(imapSchema).allow(false).description('IMAP configuration').label('ImapConfiguration'),
+                    smtp: Joi.object(smtpSchema).allow(false).description('SMTP configuration').label('SmtpConfiguration'),
+                    proxy: settingsSchema.proxyUrl,
+                    smtpEhloName: settingsSchema.smtpEhloName
+                }).label('VerifyAccount')
+            },
+            response: {
+                schema: Joi.object({
+                    imap: verifyResultSchema('Imap', 'NO [AUTHENTICATIONFAILED] Invalid credentials'),
+                    smtp: verifyResultSchema('Smtp', '535 Authentication failed'),
+                    mailboxes: shortMailboxesSchema
+                }).label('VerifyAccountResponse'),
+                failAction: 'log'
+            }
+        }
+    });
+
+    server.route({
+        method: 'GET',
+        path: '/v1/autoconfig',
+
+        async handler(request) {
+            try {
+                let serverSettings = await autodetectImapSettings(request.query.email, request.app.gt);
+                return serverSettings;
+            } catch (err) {
+                request.logger.error({ msg: 'API request failed', err });
+                if (Boom.isBoom(err)) {
+                    throw err;
+                }
+                return { imap: false, smtp: false, _source: 'unknown' };
+            }
+        },
+
+        options: {
+            description: 'Discover Email settings',
+            notes: 'Try to discover IMAP and SMTP settings for an email account',
+            tags: ['api', 'Settings'],
+
+            plugins: {
+                'hapi-swagger': {
+                    responses: errorResponses(400, 401, 403, 429, 500)
+                }
+            },
+
+            auth: {
+                strategy: 'api-token',
+                mode: 'required'
+            },
+            cors: CORS_CONFIG,
+
+            validate: {
+                options: {
+                    stripUnknown: false,
+                    abortEarly: false,
+                    convert: true
+                },
+                failAction,
+
+                query: Joi.object({
+                    email: Joi.string()
+                        .email()
+                        .required()
+                        .example('sender@example.com')
+                        .description('Email address to discover email settings for')
+                        .label('EmailAddress')
+                }).label('AutodiscoverQuery')
+            },
+
+            response: {
+                schema: Joi.object({
+                    imap: Joi.object({
+                        auth: Joi.object({
+                            user: Joi.string().max(256).example('myuser@gmail.com').description('Account username')
+                        }).label('DetectedAuthenticationInfo'),
+
+                        host: Joi.string().hostname().example('imap.gmail.com').description('Hostname to connect to'),
+                        port: Joi.number()
+                            .integer()
+                            .min(1)
+                            .max(64 * 1024)
+                            .example(993)
+                            .description('Service port number'),
+                        secure: Joi.boolean().default(false).example(true).description('Should connection use TLS. Usually true for port 993')
+                    })
+                        .allow(false)
+                        .description('Discovered IMAP settings. False if IMAP settings were not found')
+                        .label('ResolvedServerSettings'),
+                    smtp: Joi.object({
+                        auth: Joi.object({
+                            user: Joi.string().max(256).example('myuser@gmail.com').description('Account username')
+                        }).label('DetectedAuthenticationInfo'),
+
+                        host: Joi.string().hostname().example('smtp.gmail.com').description('Hostname to connect to'),
+                        port: Joi.number()
+                            .integer()
+                            .min(1)
+                            .max(64 * 1024)
+                            .example(465)
+                            .description('Service port number'),
+                        secure: Joi.boolean().default(false).example(true).description('Should connection use TLS. Usually true for port 465')
+                    })
+                        .allow(false)
+                        .description('Discovered SMTP settings. False if SMTP settings were not found')
+                        .label('DiscoveredServerSettings'),
+                    appPassword: Joi.object({
+                        required: Joi.boolean().example(true).description('Whether the provider requires an app password'),
+                        provider: Joi.string().example('Gmail').description('Provider name'),
+                        instructions: Joi.string()
+                            .example('Use an app password instead of the regular account password')
+                            .description('Instructions for setting up an app password')
+                    })
+                        .unknown()
+                        .description('App password requirements for the provider, if known')
+                        .label('DiscoveredAppPasswordInfo'),
+                    _source: Joi.string().example('srv').description('Source for the detected info')
+                }).label('DiscoveredEmailSettings'),
+                failAction: 'log'
+            }
+        }
+    });
 }
 
 module.exports = init;