zibri 2.3.0 → 2.4.1

package/src/di/default/zibri-di-tokens.default.ts

@@ -1,15 +1,25 @@
 import { AssetServiceInterface } from '../../assets/asset-service.interface';
 import { TwoFactorServiceInterface } from '../../auth/2fa/two-factor-service.interface';
 import { AuthServiceInterface } from '../../auth/auth-service.interface';
+import { EncryptionMasterOptions } from '../../auth/encryption/encryption-master-options.model';
+import { EncryptionServiceInterface } from '../../auth/encryption/encryption-service.interface';
+import { EncryptionStrategyInterface } from '../../auth/encryption/strategies/encryption-strategy.interface';
+import { HashServiceInterface } from '../../auth/hash/hash-service.interface';
+import { HashStrategyInterface } from '../../auth/hash/strategies/hash-strategy.interface';
+import { CookieAuthSessionOptionsInput } from '../../auth/strategies/cookie/cookie-auth.auth-strategy';
 import { PasswordResetEmailTemplate } from '../../auth/strategies/jwt/jwt-auth.controller';
 import { UserServiceInterface } from '../../auth/user/user-service.interface';
 import { BackupServiceInterface } from '../../backup/backup-service.interface';
+import { CacheServiceInterface } from '../../caching/cache-service.interface';
+import { CacheContext } from '../../context/cache/cache.context';
+import { HttpRequestContext } from '../../context/request/http-request.context';
+import { WebsocketRequestContext } from '../../context/request/websocket-request.context';
 import { CronServiceInterface } from '../../cron/cron-service.interface';
 import { DataSourceServiceInterface } from '../../data-source/data-source-service.interface';
 import { EmailServiceInterface } from '../../email/email-service.interface';
 import { EmailConfigInput } from '../../email/models/email-config.model';
 import { GlobalErrorHandler, ErrorPageTemplate } from '../../error-handling/error-handler.model';
-import { HttpRequest } from '../../http/http-request.model';
+import { EventServiceInterface } from '../../event/event-service.interface';
 import { HttpClientInterface } from '../../http-client/http-client.interface';
 import { FormatDateFn } from '../../localization/formatting/format-date-fn.model';
 import { FormatPercentFn } from '../../localization/formatting/format-percent-fn.model';
@@ -22,8 +32,10 @@ import { MetricsServiceInterface } from '../../metrics/metrics-service.interface
 import { MultithreadingOptions } from '../../multithreading/models/multithreading-options.model';
 import { MultithreadingServiceInterface } from '../../multithreading/services/multithreading-service.interface';
 import { OpenApiServiceInterface } from '../../open-api/open-api-service.interface';
+import { CspOptions } from '../../parsing/html/csp-options.model';
 import { ParserInterface } from '../../parsing/parser.interface';
 import { RouterInterface } from '../../routing/router.interface';
+import { Newable } from '../../types/newable.type';
 import { FsPath } from '../../utilities/fs.utilities';
 import { ValidationServiceInterface } from '../../validation/validation-service.interface';
 import { WebsocketOptions } from '../../websocket/models/websocket-options.model';
@@ -41,6 +53,7 @@ function ziToken<T = never>(k: `zi.${string}`): InjectionToken<T> {
  */
 // eslint-disable-next-line typescript/typedef
 export const ZIBRI_DI_TOKENS = {
+    // static/singleton tokens
     ROUTER: ziToken<RouterInterface>('zi.router'),
     LOGGER: ziToken<LoggerInterface>('zi.logger'),
     LOGGER_TRANSPORTS: ziToken<LoggerTransport<BaseLoggerTransportConfig>[]>('zi.logger_transports'),
@@ -62,10 +75,14 @@ export const ZIBRI_DI_TOKENS = {
     JWT_ACCESS_TOKEN_EXPIRES_IN_MS: ziToken<number>('zi.jwt_access_token_expires_in_ms'),
     JWT_REFRESH_TOKEN_SECRET: ziToken<string | undefined>('zi.jwt_refresh_token_secret'),
     JWT_REFRESH_TOKEN_EXPIRES_IN_MS: ziToken<number>('zi.jwt_refresh_token_expires_in_ms'),
-    JWT_PASSWORD_RESET_TOKEN_EXPIRES_IN_MS: ziToken<number>('zi.jwt_password_reset_token_expires_in_ms'),
-    JWT_CONFIRM_PASSWORD_RESET_URL: ziToken<string | undefined>('zi.jwt_confirm_password_reset_url'),
+    COOKIE_AUTH_SESSION_OPTIONS: ziToken<CookieAuthSessionOptionsInput>('zi.cookie_auth_session_options'),
+    COOKIE_AUTH_REFRESH_SESSION_OPTIONS: ziToken<CookieAuthSessionOptionsInput>('zi.cookie_auth_refresh_session_options'),
+    COOKIE_AUTH_SESSION_EXPIRES_IN_MS: ziToken<number>('zi.cookie_auth_session_expires_in_ms'),
+    COOKIE_AUTH_REFRESH_SESSION_EXPIRES_IN_MS: ziToken<number>('zi.cookie_auth_refresh_session_expires_in_ms'),
+    PASSWORD_RESET_TOKEN_EXPIRES_IN_MS: ziToken<number>('zi.password_reset_token_expires_in_ms'),
+    CONFIRM_PASSWORD_RESET_URL: ziToken<string | undefined>('zi.confirm_password_reset_url'),
     // eslint-disable-next-line typescript/no-explicit-any
-    JWT_PASSWORD_RESET_EMAIL_TEMPLATE: ziToken<PasswordResetEmailTemplate<any, any> | undefined>('zi.jwt_password_reset_email_template'),
+    PASSWORD_RESET_EMAIL_TEMPLATE: ziToken<PasswordResetEmailTemplate<any, any> | undefined>('zi.password_reset_email_template'),
     USER_SERVICE: ziToken<UserServiceInterface>('zi.user_service'),
     CRON_SERVICE: ziToken<CronServiceInterface>('zi.cron_service'),
     FILE_UPLOAD_TEMP_FOLDER: ziToken<FsPath>('zi.file_upload_temp_folder'),
@@ -76,11 +93,30 @@ export const ZIBRI_DI_TOKENS = {
     FORMAT_PERCENT: ziToken<FormatPercentFn>('zi.format_percent'),
     EMAIL_SERVICE: ziToken<EmailServiceInterface>('zi.email_service'),
     EMAIL_CONFIG: ziToken<EmailConfigInput | undefined>('zi.email_config'),
-    CURRENT_REQUEST: ziToken<HttpRequest | undefined>('zi.current_request'),
     MULTITHREADING_SERVICE: ziToken<MultithreadingServiceInterface>('zi.multithreading_service'),
     MULTITHREADING_OPTIONS: ziToken<MultithreadingOptions>('zi.multithreading_options'),
     // eslint-disable-next-line typescript/no-explicit-any
     WEBSOCKET_SERVICE: ziToken<WebsocketServiceInterface<any>>('zi.websocket_service'),
     WEBSOCKET_OPTIONS: ziToken<WebsocketOptions>('zi.websocket_options'),
-    HTTP_CLIENT: ziToken<HttpClientInterface>('zi.http_client')
+    HTTP_CLIENT: ziToken<HttpClientInterface>('zi.http_client'),
+    EVENT_SERVICE: ziToken<EventServiceInterface<Record<string, unknown>>>('zi.event_service'),
+    CORRELATION_ID_HEADER: ziToken<string>('zi.correlation_id_header'),
+    CSRF_TOKEN_HEADER: ziToken<string>('zi.csrf_token_header'),
+    COOKIE_SIGN_SECRET: ziToken<string | undefined>('zi.cookie_sign_secret'),
+    HASH_SERVICE: ziToken<HashServiceInterface>('zi.hash_service'),
+    HASH_STRATEGIES: ziToken<Newable<HashStrategyInterface<Record<string, unknown>>>[]>('zi.hash_strategies'),
+    ENCRYPTION_SERVICE: ziToken<EncryptionServiceInterface>('zi.encryption_service'),
+    ENCRYPTION_STRATEGIES: ziToken<
+        // eslint-disable-next-line typescript/no-explicit-any
+        Newable<EncryptionStrategyInterface<any, any, any>>[]
+    >('zi.encryption_strategies'),
+    // eslint-disable-next-line typescript/no-explicit-any
+    ENCRYPTION_MASTER_OPTIONS: ziToken<EncryptionMasterOptions<any, any, any> | undefined>(
+        'zi.encryption_master_options'
+    ),
+    CACHE_SERVICE: ziToken<CacheServiceInterface>('zi.cache_service'),
+    // dynamic/context based tokens
+    CURRENT_REQUEST_CONTEXT: ziToken<HttpRequestContext | WebsocketRequestContext | undefined>('zi.current_request_context'),
+    DEFAULT_CSP_OPTIONS: ziToken<CspOptions>('zi.default_csp_options'),
+    CURRENT_CACHE_CONTEXT: ziToken<CacheContext[] | undefined>('zi.current_cache_context')
 } as const satisfies TokenRecord;

package/src/di/di-container.ts

@@ -111,7 +111,9 @@ export class DiContainer {
         const instance: T = this.createInstanceFromProvider(provider, resolvingStack);
         resolvingStack.pop();
 
-        this.instances.set(provider.token, instance);
+        if (provider.useValue != undefined || ((provider.useFactory || provider.useClass) && provider.cache !== false)) {
+            this.instances.set(provider.token, instance);
+        }
 
         if (provider.useClass) {
             this.instances.set(provider.useClass as unknown as DiToken<unknown>, instance);
@@ -121,9 +123,12 @@ export class DiContainer {
     }
 
     private createInstanceFromProvider<T>(provider: DiProvider<T>, resolvingStack: Function[]): T {
+        if ('useValue' in provider) {
+            return provider.useValue as T;
+        }
+
         const provide: Newable<T> | ((...deps: unknown[]) => T) | T | undefined = provider.useClass
-            ?? provider.useFactory
-            ?? provider.useValue;
+            ?? provider.useFactory;
 
         if (provide == undefined) {
             throw new Error(`Provider for ${provider.token.toString()} is invalid`);
@@ -153,12 +158,9 @@ export class DiContainer {
         if (provider.useClass) {
             return new provider.useClass(...deps);
         }
-        if (provider.useFactory) {
+        if (provider.useFactory != undefined) {
             return provider.useFactory(...deps);
         }
-        if ('useValue' in provider) {
-            return provider.useValue;
-        }
 
         throw new Error(`Provider for ${(provider as DiProvider<T>).token.toString()} is invalid`);
     }

package/src/di/models/di-provider.model.ts

@@ -39,6 +39,12 @@ type ClassDiProvider<T> = BaseDiProvider<T> & {
      * A class to register for the token.
      */
     useClass: Newable<T>,
+    /**
+     * Whether or not the newly created class instance should be cached or recreated on every injection.
+     *
+     * Defaults to true.
+     */
+    cache?: boolean,
     // eslint-disable-next-line jsdoc/require-jsdoc
     useFactory?: never,
     // eslint-disable-next-line jsdoc/require-jsdoc
@@ -51,6 +57,12 @@ type FactoryDiProvider<T> = BaseDiProvider<T> & {
      * A factory function that resolves the value to register for the token.
      */
     useFactory: (...deps: unknown[]) => T,
+    /**
+     * Whether or not the result of the function should be cached or recomputed on every injection.
+     *
+     * Defaults to true.
+     */
+    cache?: boolean,
     // eslint-disable-next-line jsdoc/require-jsdoc
     useClass?: never,
     // eslint-disable-next-line jsdoc/require-jsdoc

package/src/email/email.service.test.ts

@@ -0,0 +1,382 @@
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, jest } from '@jest/globals';
+import SMTPTransport from 'nodemailer/lib/smtp-transport';
+
+import { EmailService } from './email.service';
+import { CreateEmailData, QueueEmailData } from './models/create-email-data.model';
+import { EmailPriority } from './models/email-priority.enum';
+import { EmailStatus } from './models/email-status.enum';
+import { Email } from './models/email.model';
+import { defaultTestServerProviders } from '../__testing__/test-server/providers';
+import { startTestServer, StartedTestServer } from '../__testing__/test-server/start-test-server.function';
+import { Repository } from '../data-source/repository';
+import { EmailConfig } from './models/email-config.model';
+import { InjectRepository, repositoryTokenFor } from '../di/decorators/inject-repository.decorator';
+import { Inject } from '../di/decorators/inject.decorator';
+import { Injectable } from '../di/decorators/injectable.decorator';
+import { ZIBRI_DI_TOKENS } from '../di/default/zibri-di-tokens.default';
+import { inject } from '../di/inject.function';
+import { type LoggerInterface } from '../logging/logger.interface';
+
+// ---------- Test email service (mocks the transporter) ----------
+
+// eslint-disable-next-line typescript/typedef
+const mockSendMail = jest.fn<() => Promise<SMTPTransport.SentMessageInfo>>();
+
+const testConfig: EmailConfig = {
+    host: 'smtp.example.com',
+    port: 587,
+    maxEmailsPerHour: 1000,
+    defaultSender: 'noreply@example.com',
+    pool: false,
+    auth: { user: 'user', pass: 'pass' }
+};
+
+@Injectable({ register: 'onUse' })
+class TestEmailService extends EmailService {
+    constructor(
+        @Inject(ZIBRI_DI_TOKENS.LOGGER) logger: LoggerInterface,
+        @InjectRepository(Email) emailRepository: Repository<Email, CreateEmailData>
+    ) {
+        super(logger, emailRepository, testConfig);
+    }
+
+    protected override async send(email: Email): Promise<void> {
+        await this.validateAttachments(email.attachments);
+        const res: SMTPTransport.SentMessageInfo = await mockSendMail();
+        const status: EmailStatus = res.rejected.length ? EmailStatus.FAILED : EmailStatus.SENT;
+
+        if (status === EmailStatus.FAILED) {
+            const rejectedRecipients: string[] = res.rejected.map((e) => typeof e === 'string' ? e : e.address);
+            await this['logger'].warn(`mail to ${rejectedRecipients.join(', ')} was rejected`);
+        }
+
+        if (email.persist) {
+            await this['emailRepository'].updateById(email.id, { status });
+            return;
+        }
+
+        await this['emailRepository'].deleteById(email.id);
+    }
+}
+
+// ---------- Helpers ----------
+
+function sentMessageInfo(overrides: Partial<SMTPTransport.SentMessageInfo> = {}): SMTPTransport.SentMessageInfo {
+    return {
+        accepted: ['recipient@example.com'],
+        rejected: [],
+        pending: [],
+        response: '250 OK',
+        envelope: { from: 'noreply@example.com', to: ['recipient@example.com'] },
+        messageId: 'test-message-id',
+        ...overrides
+    } as SMTPTransport.SentMessageInfo;
+}
+
+function makeQueueData(overrides: Partial<QueueEmailData> = {}): QueueEmailData {
+    return {
+        html: '<p>Hello</p>',
+        subject: 'Test subject',
+        recipients: ['recipient@example.com'],
+        ...overrides
+    } as QueueEmailData;
+}
+
+// ---------- Test setup ----------
+
+let server: StartedTestServer;
+let emailService: TestEmailService;
+let emailRepo: Repository<Email, CreateEmailData>;
+
+beforeAll(async () => {
+    server = await startTestServer({
+        providers: [
+            ...defaultTestServerProviders,
+            { token: ZIBRI_DI_TOKENS.EMAIL_CONFIG, useValue: testConfig },
+            { token: ZIBRI_DI_TOKENS.EMAIL_SERVICE, useClass: TestEmailService }
+        ]
+    });
+    await server.start();
+
+    emailService = inject(TestEmailService);
+    emailRepo = inject(repositoryTokenFor(Email));
+}, 15000);
+
+afterAll(async () => {
+    await server.shutdown();
+});
+
+beforeEach(async () => {
+    await emailRepo.deleteAll({});
+    mockSendMail.mockReset();
+    mockSendMail.mockResolvedValue(sentMessageInfo());
+});
+
+// ---------- Tests ----------
+
+describe('EmailService.queue', () => {
+    it('creates an email with QUEUED status', async () => {
+        await emailService.queue(makeQueueData());
+
+        const emails: Email[] = await emailRepo.findAll({});
+        expect(emails).toHaveLength(1);
+        expect(emails[0].status).toBe(EmailStatus.QUEUED);
+    });
+
+    it('defaults to NORMAL priority', async () => {
+        await emailService.queue(makeQueueData());
+
+        const emails: Email[] = await emailRepo.findAll({});
+        expect(emails[0].priority).toBe(EmailPriority.NORMAL);
+    });
+
+    it('respects provided priority', async () => {
+        await emailService.queue(makeQueueData({ priority: EmailPriority.HIGH }));
+
+        const emails: Email[] = await emailRepo.findAll({});
+        expect(emails[0].priority).toBe(EmailPriority.HIGH);
+    });
+
+    it('defaults to defaultSender from config when no sender provided', async () => {
+        await emailService.queue(makeQueueData());
+
+        const emails: Email[] = await emailRepo.findAll({});
+        expect(emails[0].sender).toBe(testConfig.defaultSender);
+    });
+
+    it('respects provided sender', async () => {
+        await emailService.queue(makeQueueData({ sender: 'custom@example.com' }));
+
+        const emails: Email[] = await emailRepo.findAll({});
+        expect(emails[0].sender).toBe('custom@example.com');
+    });
+
+    it('defaults persist to false', async () => {
+        await emailService.queue(makeQueueData());
+
+        const emails: Email[] = await emailRepo.findAll({});
+        expect(emails[0].persist).toBe(false);
+    });
+
+    it('respects provided persist flag', async () => {
+        await emailService.queue(makeQueueData({ persist: true }));
+
+        const emails: Email[] = await emailRepo.findAll({});
+        expect(emails[0].persist).toBe(true);
+    });
+});
+
+describe('EmailService.sendQueuedEmails', () => {
+    afterEach(() => void jest.restoreAllMocks());
+
+    it('returns false and sends nothing when no emails are queued', async () => {
+        const result: boolean = await emailService.sendQueuedEmails();
+
+        expect(result).toBe(false);
+        expect(mockSendMail).not.toHaveBeenCalled();
+    });
+
+    it('returns true after sending emails (indicating there may be more)', async () => {
+        await emailService.queue(makeQueueData());
+
+        const result: boolean = await emailService.sendQueuedEmails();
+
+        expect(result).toBe(true);
+        expect(mockSendMail).toHaveBeenCalledTimes(1);
+    });
+
+    it('deletes email after sending when persist is false', async () => {
+        await emailService.queue(makeQueueData({ persist: false }));
+
+        await emailService.sendQueuedEmails();
+
+        const emails: Email[] = await emailRepo.findAll({});
+        expect(emails).toHaveLength(0);
+    });
+
+    it('updates email status to SENT when persist is true', async () => {
+        await emailService.queue(makeQueueData({ persist: true }));
+
+        await emailService.sendQueuedEmails();
+
+        const emails: Email[] = await emailRepo.findAll({});
+        expect(emails).toHaveLength(1);
+        expect(emails[0].status).toBe(EmailStatus.SENT);
+    });
+
+    it('updates email status to FAILED when the send is rejected', async () => {
+        mockSendMail.mockResolvedValue(sentMessageInfo({
+            rejected: ['recipient@example.com'],
+            accepted: []
+        }));
+        await emailService.queue(makeQueueData({ persist: true }));
+
+        await emailService.sendQueuedEmails();
+
+        const emails: Email[] = await emailRepo.findAll({});
+        expect(emails[0].status).toBe(EmailStatus.FAILED);
+    });
+
+    it('sends HIGH priority emails before NORMAL and LOW', async () => {
+        // eslint-disable-next-line typescript/require-await
+        mockSendMail.mockImplementation(async () => {
+            return sentMessageInfo();
+        });
+
+        // Queue in reverse priority order to ensure ordering is by priority, not insertion
+        await emailService.queue(makeQueueData({ priority: EmailPriority.LOW, subject: 'low' }));
+        await emailService.queue(makeQueueData({ priority: EmailPriority.NORMAL, subject: 'normal' }));
+        await emailService.queue(makeQueueData({ priority: EmailPriority.HIGH, subject: 'high' }));
+
+        // Capture send order by intercepting the underlying send call
+        const calls: Email[] = [];
+        jest.spyOn(emailService as unknown as { send: (e: Email) => Promise<void> }, 'send')
+            // eslint-disable-next-line typescript/require-await
+            .mockImplementation(async (email: Email) => {
+                calls.push(email);
+            });
+
+        await emailService.sendQueuedEmails();
+
+        expect(calls[0].priority).toBe(EmailPriority.HIGH);
+        expect(calls[1].priority).toBe(EmailPriority.NORMAL);
+        expect(calls[2].priority).toBe(EmailPriority.LOW);
+    });
+
+    it('sends at most 10 emails per batch across all priorities', async () => {
+        // Need all three priorities to fill 10 slots: HIGH(8) + NORMAL(1 reserved) + LOW(1 reserved)
+        for (let i: number = 0; i < 10; i++) {
+            await emailService.queue(makeQueueData({ priority: EmailPriority.HIGH, subject: `High ${i}` }));
+        }
+        for (let i: number = 0; i < 5; i++) {
+            await emailService.queue(makeQueueData({ priority: EmailPriority.NORMAL, subject: `Normal ${i}` }));
+        }
+        for (let i: number = 0; i < 5; i++) {
+            await emailService.queue(makeQueueData({ priority: EmailPriority.LOW, subject: `Low ${i}` }));
+        }
+
+        await emailService.sendQueuedEmails();
+
+        // 8 high + 1 normal + 1 low = 10 (normal is capped at 10 - 1 - highCount)
+        expect(mockSendMail).toHaveBeenCalledTimes(10);
+    });
+
+    it('sends at most 8 HIGH priority emails per batch', async () => {
+        for (let i: number = 0; i < 10; i++) {
+            await emailService.queue(makeQueueData({ priority: EmailPriority.HIGH, subject: `High ${i}` }));
+        }
+
+        await emailService.sendQueuedEmails();
+
+        // HIGH is capped at 8; no NORMAL or LOW queued, so total = 8
+        expect(mockSendMail).toHaveBeenCalledTimes(8);
+    });
+
+    it('fills remaining slots with NORMAL and LOW after HIGH', async () => {
+        for (let i: number = 0; i < 8; i++) {
+            await emailService.queue(makeQueueData({ priority: EmailPriority.HIGH, subject: `High ${i}` }));
+        }
+        for (let i: number = 0; i < 5; i++) {
+            await emailService.queue(makeQueueData({ priority: EmailPriority.NORMAL, subject: `Normal ${i}` }));
+        }
+        for (let i: number = 0; i < 5; i++) {
+            await emailService.queue(makeQueueData({ priority: EmailPriority.LOW, subject: `Low ${i}` }));
+        }
+
+        await emailService.sendQueuedEmails();
+
+        // 8 high + 1 normal (10 - 1 - 8 = 1) + 1 low (10 - 8 - 1 = 1) = 10
+        expect(mockSendMail).toHaveBeenCalledTimes(10);
+    });
+});
+
+// describe('EmailService rate limiting', () => {
+//     // A separate server with a very low rate limit so we can exhaust it with real sends
+//     const rateLimitConfig: EmailConfig = { ...testConfig, maxEmailsPerHour: 3 };
+
+//     let rateLimitServer: StartedTestServer;
+//     let rateLimitEmailService: TestEmailService;
+//     let rateLimitEmailRepo: Repository<Email, CreateEmailData>;
+
+//     beforeAll(async () => {
+//         rateLimitServer = await startTestServer({
+//             dataSources: [
+//                 createTestDataSource({
+//                     entities: [...defaultTestServerEntities, Email]
+//                 })
+//             ],
+//             controllers: [],
+//             cronJobs: [],
+//             providers: [
+//                 ...defaultTestServerProviders,
+//                 { token: ZIBRI_DI_TOKENS.EMAIL_CONFIG, useValue: rateLimitConfig },
+//                 { token: ZIBRI_DI_TOKENS.EMAIL_SERVICE, useClass: TestEmailService }
+//             ]
+//         });
+//         await rateLimitServer.start();
+//         rateLimitEmailService = inject(TestEmailService);
+//         rateLimitEmailRepo = inject(repositoryTokenFor(Email));
+//     }, 15000);
+
+//     afterAll(async () => {
+//         await rateLimitServer.shutdown();
+//     });
+
+//     beforeEach(async () => {
+//         await rateLimitEmailRepo.deleteAll({});
+//         mockSendMail.mockReset();
+//         mockSendMail.mockResolvedValue(sentMessageInfo());
+//     });
+
+//     it('returns false and sends nothing when the rate limit is exhausted', async () => {
+//         // Exhaust the limit: queue and send 3 emails (maxEmailsPerHour: 3)
+//         for (let i = 0; i < 3; i++) {
+//             await rateLimitEmailService.queue(makeQueueData({ subject: `Email ${i}` }));
+//         }
+//         await rateLimitEmailService.sendQueuedEmails();
+//         expect(mockSendMail).toHaveBeenCalledTimes(3);
+
+//         // Queue one more — rate limiter should now block it
+//         await rateLimitEmailService.queue(makeQueueData({ subject: 'One too many' }));
+//         mockSendMail.mockReset();
+
+//         const result = await rateLimitEmailService.sendQueuedEmails();
+
+//         expect(result).toBe(false);
+//         expect(mockSendMail).not.toHaveBeenCalled();
+//     });
+// });
+
+describe('EmailService attachment validation', () => {
+    it('throws when an attachment path does not exist', async () => {
+        await emailService.queue(makeQueueData({
+            persist: true,
+            attachments: [{ filename: 'missing.pdf', path: '/nonexistent/missing.pdf' as never }]
+        }));
+        mockSendMail.mockResolvedValue(sentMessageInfo());
+
+        await expect(emailService.sendQueuedEmails()).rejects.toThrow('does not exist');
+    });
+
+    it('does not throw when attachments is undefined', async () => {
+        await emailService.queue(makeQueueData({ persist: true }));
+
+        await expect(emailService.sendQueuedEmails()).resolves.not.toThrow();
+    });
+
+    it('does not throw when attachments is an empty array', async () => {
+        await emailService.queue(makeQueueData({ persist: true, attachments: [] }));
+
+        await expect(emailService.sendQueuedEmails()).resolves.not.toThrow();
+    });
+
+    it('does not throw when attachment path exists', async () => {
+        // __filename is always a real path
+        await emailService.queue(makeQueueData({
+            persist: true,
+            attachments: [{ filename: 'test.ts', path: __filename as never }]
+        }));
+
+        await expect(emailService.sendQueuedEmails()).resolves.not.toThrow();
+    });
+});

package/src/email/email.service.ts

@@ -11,7 +11,6 @@ import { InjectRepository } from '../di/decorators/inject-repository.decorator';
 import { Inject } from '../di/decorators/inject.decorator';
 import { Injectable } from '../di/decorators/injectable.decorator';
 import { ZIBRI_DI_TOKENS } from '../di/default/zibri-di-tokens.default';
-import { inject } from '../di/inject.function';
 import { type LoggerInterface } from '../logging/logger.interface';
 import { RateLimiter } from '../rate-limiting/rate-limiter';
 import { FsUtilities } from '../utilities/fs.utilities';
@@ -44,9 +43,10 @@ export class EmailService implements EmailServiceInterface, OnAppInit, OnAppShut
         @Inject(ZIBRI_DI_TOKENS.LOGGER)
         private readonly logger: LoggerInterface,
         @InjectRepository(Email)
-        private readonly emailRepository: Repository<Email, CreateEmailData>
+        private readonly emailRepository: Repository<Email, CreateEmailData>,
+        @Inject(ZIBRI_DI_TOKENS.EMAIL_CONFIG)
+        config: EmailConfigInput | undefined
     ) {
-        const config: EmailConfigInput | undefined = inject(ZIBRI_DI_TOKENS.EMAIL_CONFIG);
         if (!config) {
             throw new Error('no email config was provided for the token "ZIBRI_DI_TOKENS.MAIL_CONFIG"');
         }
@@ -60,7 +60,9 @@ export class EmailService implements EmailServiceInterface, OnAppInit, OnAppShut
 
     // eslint-disable-next-line jsdoc/require-jsdoc
     onAppInit(app: ZibriApplication): void {
-        app.options.cronJobs.push(SendQueuedEmailsCronJob);
+        if (!app.options.cronJobs.includes(SendQueuedEmailsCronJob)) {
+            app.options.cronJobs.push(SendQueuedEmailsCronJob);
+        }
     }
 
     // eslint-disable-next-line jsdoc/require-jsdoc
@@ -156,8 +158,7 @@ export class EmailService implements EmailServiceInterface, OnAppInit, OnAppShut
                 status: EmailStatus.QUEUED,
                 priority
             },
-            take: amount,
-            order: { createdAt: 'ASC' }
+            take: amount
         });
     }
 }

package/src/email/models/email.model.ts

@@ -8,7 +8,7 @@ import { Property } from '../../entity/decorators/property.decorator';
 /**
  * Definition of a Email.
  */
-@Entity()
+@Entity({ defaultOrder: { createdAt: 'ASC' } })
 export class Email extends BaseEntity {
     /**
      * The createdAt date. Is set to now by default.

package/src/email/send-queued-emails.cron-job.ts

@@ -1,4 +1,5 @@
 import { type EmailServiceInterface } from './email-service.interface';
+import { CronExpression } from '../cron/cron-expression.utilities';
 import { CronJob, InitialCronConfig } from '../cron/cron-job.model';
 import { Inject } from '../di/decorators/inject.decorator';
 import { ZIBRI_DI_TOKENS } from '../di/default/zibri-di-tokens.default';
@@ -10,7 +11,7 @@ export class SendQueuedEmailsCronJob extends CronJob {
     // eslint-disable-next-line jsdoc/require-jsdoc
     initialConfig: InitialCronConfig = {
         name: 'send queued emails',
-        cron: '*/5 * * * * *',
+        cron: CronExpression.every(5, 'seconds').build(),
         runOnInit: false
     };