mailery 0.16.0 → 0.16.2

package/dist/index.cjs

@@ -286,15 +286,49 @@ var init_webhook_tolerance = __esm({
 // src/server/providers/sendgrid.ts
 var sendgrid_exports = {};
 __export(sendgrid_exports, {
-  SendGridProvider: () => exports.SendGridProvider
+  SendGridProvider: () => exports.SendGridProvider,
+  normalizeSendGridMessageId: () => normalizeSendGridMessageId,
+  normalizeWebhookVerificationKey: () => normalizeWebhookVerificationKey
 });
+function normalizeWebhookVerificationKey(input) {
+  let key = String(input ?? "").trim().replace(/^["']|["']$/g, "");
+  if (key.includes("\\n")) key = key.replace(/\\n/g, "\n");
+  let pem;
+  if (key.includes(PEM_HEADER)) {
+    pem = key;
+  } else {
+    const b64 = key.replace(/\s+/g, "");
+    if (!b64 || !/^[A-Za-z0-9+/=]+$/.test(b64)) {
+      throw new Error(
+        "SendGridProvider: webhookVerificationKey is neither a PEM public key nor a base64 SPKI key. Copy the Verification Key from SendGrid \u2192 Settings \u2192 Mail Settings \u2192 Signed Event Webhook."
+      );
+    }
+    pem = `${PEM_HEADER}
+${b64.match(/.{1,64}/g).join("\n")}
+${PEM_FOOTER}
+`;
+  }
+  try {
+    crypto2__default.default.createPublicKey(pem);
+  } catch (err) {
+    throw new Error(
+      `SendGridProvider: webhookVerificationKey did not parse as a public key (${String(err?.message ?? err)}). Copy the Verification Key from SendGrid \u2192 Settings \u2192 Mail Settings \u2192 Signed Event Webhook.`
+    );
+  }
+  return pem;
+}
+function normalizeSendGridMessageId(raw) {
+  const id = String(raw ?? "");
+  const marker = /\.(?:filter|recvd)\S*$/i.exec(id);
+  return marker ? id.slice(0, marker.index) : id;
+}
 function normalizeSendGridEvent(e) {
   const type = mapEventType(e.event);
   if (!type) return null;
   return {
     type,
     providerEventId: String(e.sg_event_id ?? e["smtp-id"] ?? `${e.event}-${e.timestamp}-${e.email}`),
-    providerMessageId: String(e.sg_message_id ?? e["smtp-id"] ?? ""),
+    providerMessageId: e.sg_message_id != null ? normalizeSendGridMessageId(e.sg_message_id) : String(e["smtp-id"] ?? ""),
     email: String(e.email ?? "").toLowerCase(),
     occurredAt: new Date(Number(e.timestamp) * 1e3),
     details: {
@@ -326,24 +360,29 @@ function mapEventType(sgEvent) {
       return null;
   }
 }
-var SG_SIG_HEADER, SG_TS_HEADER; exports.SendGridProvider = void 0;
+var SG_SIG_HEADER, SG_TS_HEADER, PEM_HEADER, PEM_FOOTER; exports.SendGridProvider = void 0;
 var init_sendgrid = __esm({
   "src/server/providers/sendgrid.ts"() {
     init_webhook_tolerance();
     SG_SIG_HEADER = "x-twilio-email-event-webhook-signature";
     SG_TS_HEADER = "x-twilio-email-event-webhook-timestamp";
+    PEM_HEADER = "-----BEGIN PUBLIC KEY-----";
+    PEM_FOOTER = "-----END PUBLIC KEY-----";
     exports.SendGridProvider = class {
       constructor(opts) {
         this.opts = opts;
         sgMail__default.default.setApiKey(opts.apiKey);
         this.sendRatePerSecond = opts.sendRatePerSecond ?? 10;
         this.webhookToleranceSeconds = resolveWebhookToleranceSeconds(opts.webhookToleranceSeconds);
+        this.verificationKeyPem = opts.webhookVerificationKey ? normalizeWebhookVerificationKey(opts.webhookVerificationKey) : null;
       }
       opts;
       name = "sendgrid";
       sendRatePerSecond;
       /** Resolved replay window in seconds; `0` means the check is disabled. */
       webhookToleranceSeconds;
+      /** The verification key as PEM, whatever shape it was configured in. */
+      verificationKeyPem;
       async send(args) {
         const msg = {
           to: args.to,
@@ -375,7 +414,7 @@ var init_sendgrid = __esm({
         };
       }
       async verifyWebhook(rawBody, headers) {
-        if (!this.opts.webhookVerificationKey) return false;
+        if (!this.verificationKeyPem) return false;
         const sig = headers[SG_SIG_HEADER];
         const ts = headers[SG_TS_HEADER];
         if (!sig || !ts) return false;
@@ -383,7 +422,7 @@ var init_sendgrid = __esm({
         try {
           const verifier = crypto2__default.default.createVerify("sha256");
           verifier.update(payload);
-          if (!verifier.verify(this.opts.webhookVerificationKey, sig, "base64")) return false;
+          if (!verifier.verify(this.verificationKeyPem, sig, "base64")) return false;
         } catch {
           return false;
         }
@@ -1726,11 +1765,20 @@ async function processWebhookBacklog(ctx, opts = {}) {
     }
   }
 }
+async function findSendForEvent(event, ctx) {
+  if (event.providerMessageId) {
+    const byId = await ctx.collections.sends.findOne({ providerMessageId: event.providerMessageId });
+    if (byId) return byId;
+  }
+  if (!event.email) return null;
+  return ctx.collections.sends.findOne({ emailAtSend: event.email, sentAt: { $ne: null } }, { sort: { sentAt: -1 } });
+}
+function webhookEventsForMessageId(providerMessageId) {
+  const escaped = providerMessageId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return { $or: [{ providerMessageId }, { providerMessageId: { $regex: `^${escaped}\\.` } }] };
+}
 async function applyWebhookEvent(event, ctx) {
-  const send = await ctx.collections.sends.findOne(
-    event.providerMessageId ? { $or: [{ providerMessageId: event.providerMessageId }, { emailAtSend: event.email }] } : { emailAtSend: event.email },
-    { sort: { queuedAt: -1 } }
-  );
+  const send = await findSendForEvent(event, ctx);
   switch (event.type) {
     case "delivered":
       if (send) {
@@ -6484,7 +6532,7 @@ function createAdminApiRouter(mailer, opts = {}) {
       if (!mongodb.ObjectId.isValid(id)) return res.status(400).json({ error: "bad_id" });
       const send = await c.sends.findOne({ _id: new mongodb.ObjectId(id) });
       if (!send) return res.status(404).json({ error: "not_found" });
-      const events = send.providerMessageId ? await c.webhookEvents.find({ providerMessageId: send.providerMessageId }).sort({ receivedAt: -1 }).limit(100).toArray() : [];
+      const events = send.providerMessageId ? await c.webhookEvents.find(webhookEventsForMessageId(send.providerMessageId)).sort({ receivedAt: -1 }).limit(100).toArray() : [];
       return res.json({ send, webhookEvents: events });
     })
   );
@@ -8223,7 +8271,7 @@ function unitToMs2(value, unit) {
 }
 
 // src/server/api/agent.ts
-var VERSION = "0.16.0" ;
+var VERSION = "0.16.2" ;
 var MIN_AGENT_TOKEN_LENGTH = 24;
 function createAgentRouter(mailer, opts) {
   if (!opts || !Array.isArray(opts.tokens) || opts.tokens.length === 0) {
@@ -8426,7 +8474,7 @@ function createAgentRouter(mailer, opts) {
         if (reached || Date.now() - started >= timeoutMs) break;
         await sleep2(1e3);
       }
-      const webhookEvents = send.providerMessageId ? await c.webhookEvents.find({ providerMessageId: send.providerMessageId }).sort({ receivedAt: 1 }).limit(100).toArray() : [];
+      const webhookEvents = send.providerMessageId ? await c.webhookEvents.find(webhookEventsForMessageId(send.providerMessageId)).sort({ receivedAt: 1 }).limit(100).toArray() : [];
       res.json({ reached, target, waitedMs: Date.now() - started, send: sendSummary(send), webhookEvents });
     })
   );
@@ -9923,7 +9971,7 @@ var DEDUPE_POLICIES = [
 ];
 
 // src/server/index.ts
-var VERSION2 = "0.16.0" ;
+var VERSION2 = "0.16.2" ;
 
 exports.DEDUPE_POLICIES = DEDUPE_POLICIES;
 exports.DEFAULT_BOT_UA_RE = DEFAULT_BOT_UA_RE;