admin
cab9cd7c01
DH V2 CI / API · typecheck, tests, build (push) Successful in 38s
Production dependency audit / API · production dependencies (push) Successful in 9s
Production dependency audit / WEB · production dependencies (push) Successful in 8s
DH V2 CI / WEB · typecheck, build (push) Successful in 1m36s
DH V2 CI / Docker / migrations / production images (push) Successful in 1m45s
DH V2 CI / Promote verified main to deploy (push) Successful in 3s
Android CI / RC / Android · lint, tests, debug APK, release compile (push) Successful in 4m5s
274 lines
17 KiB
TypeScript
274 lines
17 KiB
TypeScript
import { createCipheriv, createDecipheriv, randomBytes, randomUUID } from 'node:crypto';
|
|
import { connect as connectNet, Socket } from 'node:net';
|
|
import { connect as connectTls, TLSSocket } from 'node:tls';
|
|
import { Injectable, ServiceUnavailableException } from '@nestjs/common';
|
|
import { ConfigService } from '@nestjs/config';
|
|
import { DataSource } from 'typeorm';
|
|
import { SmtpSecurityMode } from '../database/entities';
|
|
|
|
interface MailAttachment { filename:string; mimeType:string; content:Buffer; }
|
|
interface MailInput { to:string; subject:string; text:string; attachment:MailAttachment; }
|
|
interface Reply { code:number; text:string; }
|
|
|
|
export interface EffectiveSmtpSettings {
|
|
source: 'USER' | 'DATABASE' | 'ENVIRONMENT';
|
|
host: string;
|
|
port: number;
|
|
securityMode: SmtpSecurityMode;
|
|
username: string | null;
|
|
password: string;
|
|
fromName: string | null;
|
|
fromEmail: string;
|
|
replyTo: string | null;
|
|
}
|
|
|
|
class SmtpSession {
|
|
private buffer=''; private waiters:Array<(reply:Reply)=>void>=[]; private replyLines:string[]=[];
|
|
private readonly dataHandler=(chunk:Buffer|string)=>this.onData(typeof chunk==='string'?chunk:chunk.toString('utf8'));
|
|
constructor(private socket:Socket|TLSSocket){ this.attach(socket); }
|
|
private attach(socket:Socket|TLSSocket){ socket.setEncoding('utf8'); socket.setTimeout(15000,()=>socket.destroy(new Error('SMTP timeout'))); socket.on('data',this.dataHandler); }
|
|
detachForUpgrade(){ this.socket.off('data',this.dataHandler); this.socket.setTimeout(0); return this.socket; }
|
|
replaceSocket(socket:Socket|TLSSocket){ this.socket=socket; this.buffer=''; this.attach(socket); }
|
|
private onData(chunk:string){ this.buffer+=chunk; const lines=this.buffer.split(/\r?\n/); this.buffer=lines.pop()??''; for(const line of lines){ if(!line)continue; this.replyLines.push(line); if(/^\d{3} /.test(line)){ const code=Number(line.slice(0,3)); const reply={code,text:this.replyLines.join('\n')}; this.replyLines=[]; const waiter=this.waiters.shift(); if(waiter)waiter(reply); } } }
|
|
reply():Promise<Reply>{return new Promise((resolve,reject)=>{ const onError=(e:Error)=>{this.socket.off('error',onError);reject(e)}; this.socket.once('error',onError); this.waiters.push((reply)=>{this.socket.off('error',onError);resolve(reply)}); });}
|
|
async command(command:string, expected:number|number[]){ this.socket.write(`${command}\r\n`); const reply=await this.reply(); const allowed=Array.isArray(expected)?expected:[expected]; if(!allowed.includes(reply.code))throw new Error(`SMTP ${reply.code}: ${reply.text}`); return reply; }
|
|
write(data:string){this.socket.write(data);}
|
|
end(){this.socket.end();}
|
|
}
|
|
|
|
function subject(value:string){return `=?UTF-8?B?${Buffer.from(value,'utf8').toString('base64')}?=`;}
|
|
function envelope(value:string){const m=value.match(/<([^>]+)>/);return (m?.[1]??value).trim();}
|
|
function mime(input:MailInput,from:string,replyTo:string|null){ const boundary=`dh-${randomUUID()}`; const body=[`From: ${from}`,`To: ${input.to}`,replyTo?`Reply-To: ${replyTo}`:null,`Subject: ${subject(input.subject)}`,'MIME-Version: 1.0',`Content-Type: multipart/mixed; boundary="${boundary}"`,'',`--${boundary}`,'Content-Type: text/plain; charset=utf-8','Content-Transfer-Encoding: base64','',Buffer.from(input.text,'utf8').toString('base64'),`--${boundary}`,`Content-Type: ${input.attachment.mimeType}; name="${input.attachment.filename.replaceAll('"','')}"`,'Content-Transfer-Encoding: base64',`Content-Disposition: attachment; filename="${input.attachment.filename.replaceAll('"','')}"`,'',input.attachment.content.toString('base64').replace(/(.{76})/g,'$1\r\n'),`--${boundary}--`,''].filter((line):line is string=>line!==null).join('\r\n'); return body.replace(/^\./gm,'..'); }
|
|
|
|
@Injectable()
|
|
export class SmtpDeliveryService {
|
|
constructor(
|
|
private readonly dataSource:DataSource,
|
|
private readonly config:ConfigService,
|
|
){}
|
|
|
|
async configured(userId?:string):Promise<boolean>{return Boolean(await this.resolveSettings(userId));}
|
|
|
|
async fromAddress(userId?:string):Promise<string|null>{
|
|
const settings=await this.resolveSettings(userId);
|
|
if(!settings)return null;
|
|
return settings.fromName?`${settings.fromName} <${settings.fromEmail}>`:settings.fromEmail;
|
|
}
|
|
|
|
async publicSettings(){
|
|
const [row]=await this.dataSource.query(`
|
|
SELECT id,host,port,security_mode AS "securityMode",username,
|
|
(password_enc IS NOT NULL) AS "hasPassword",from_name AS "fromName",
|
|
from_email AS "fromEmail",reply_to AS "replyTo",enabled,
|
|
updated_at AS "updatedAt"
|
|
FROM system_smtp_settings ORDER BY created_at LIMIT 1
|
|
`) as Array<Record<string,unknown>>;
|
|
if(row)return {...row,source:'DATABASE'};
|
|
const fallback=await this.resolveEnvironment();
|
|
return fallback?{
|
|
source:'ENVIRONMENT',host:fallback.host,port:fallback.port,
|
|
securityMode:fallback.securityMode,username:fallback.username,
|
|
hasPassword:Boolean(fallback.password),fromName:fallback.fromName,
|
|
fromEmail:fallback.fromEmail,replyTo:fallback.replyTo,enabled:true,
|
|
}:{source:'NONE',enabled:false};
|
|
}
|
|
|
|
async publicUserSettings(userId:string){
|
|
const [user]=await this.dataSource.query(`
|
|
SELECT email,first_name AS "firstName",last_name AS "lastName" FROM users WHERE id=$1
|
|
`,[userId]) as Array<{email:string;firstName:string;lastName:string}>;
|
|
if(!user)throw new Error('Usuario no encontrado');
|
|
const [row]=await this.dataSource.query(`
|
|
SELECT mode,host,port,security_mode AS "securityMode",username,
|
|
(password_enc IS NOT NULL) AS "hasPassword",from_name AS "fromName",
|
|
from_email AS "fromEmail",enabled,updated_at AS "updatedAt"
|
|
FROM user_smtp_settings WHERE user_id=$1
|
|
`,[userId]) as Array<Record<string,unknown>>;
|
|
return {
|
|
mode:row?.mode??'SYSTEM',email:user.email,generalConfigured:Boolean(await this.resolveSystemSettings()),
|
|
custom:row?{
|
|
host:row.host??'',port:row.port??587,securityMode:row.securityMode??'STARTTLS',
|
|
username:row.username??'',hasPassword:Boolean(row.hasPassword),
|
|
fromName:row.fromName??`${user.firstName} ${user.lastName}`,fromEmail:row.fromEmail??user.email,
|
|
enabled:row.enabled!==false,updatedAt:row.updatedAt??null,
|
|
}:null,
|
|
};
|
|
}
|
|
|
|
async saveUserSettings(userId:string,input:{
|
|
mode:'SYSTEM'|'CUSTOM';host?:string;port?:number;securityMode?:SmtpSecurityMode;
|
|
username?:string|null;password?:string|null;fromName?:string|null;enabled?:boolean;
|
|
}){
|
|
const [user]=await this.dataSource.query(`SELECT email,first_name AS "firstName",last_name AS "lastName" FROM users WHERE id=$1`,[userId]) as Array<{email:string;firstName:string;lastName:string}>;
|
|
if(!user?.email)throw new Error('El usuario debe tener un email configurado');
|
|
const [existing]=await this.dataSource.query(`SELECT password_enc AS "passwordEnc" FROM user_smtp_settings WHERE user_id=$1`,[userId]) as Array<{passwordEnc:string|null}>;
|
|
if(input.mode==='SYSTEM'){
|
|
await this.dataSource.query(`
|
|
INSERT INTO user_smtp_settings(user_id,mode,updated_by) VALUES($1,'SYSTEM',$1)
|
|
ON CONFLICT(user_id) DO UPDATE SET mode='SYSTEM',updated_by=$1,updated_at=CURRENT_TIMESTAMP
|
|
`,[userId]);
|
|
return this.publicUserSettings(userId);
|
|
}
|
|
if(!input.host||!input.port||!input.securityMode)throw new Error('La configuración SMTP propia está incompleta');
|
|
const passwordEnc=input.password===undefined?existing?.passwordEnc??null:input.password?this.encryptSecret(input.password):null;
|
|
const fromName=input.fromName?.trim()||`${user.firstName} ${user.lastName}`.trim();
|
|
await this.dataSource.query(`
|
|
INSERT INTO user_smtp_settings(user_id,mode,host,port,security_mode,username,password_enc,from_name,from_email,reply_to,enabled,updated_by)
|
|
VALUES($1,'CUSTOM',$2,$3,$4,$5,$6,$7,$8,$8,$9,$1)
|
|
ON CONFLICT(user_id) DO UPDATE SET mode='CUSTOM',host=EXCLUDED.host,port=EXCLUDED.port,
|
|
security_mode=EXCLUDED.security_mode,username=EXCLUDED.username,password_enc=EXCLUDED.password_enc,
|
|
from_name=EXCLUDED.from_name,from_email=EXCLUDED.from_email,reply_to=EXCLUDED.reply_to,
|
|
enabled=EXCLUDED.enabled,updated_by=$1,updated_at=CURRENT_TIMESTAMP
|
|
`,[userId,input.host,input.port,input.securityMode,input.username?.trim()||null,passwordEnc,fromName,user.email,input.enabled!==false]);
|
|
return this.publicUserSettings(userId);
|
|
}
|
|
|
|
async saveSettings(input:{
|
|
host:string;port:number;securityMode:SmtpSecurityMode;username?:string|null;
|
|
password?:string|null;fromName:string;fromEmail:string;replyTo?:string|null;enabled:boolean;
|
|
},userId:string){
|
|
const [existing]=await this.dataSource.query(`SELECT id,password_enc AS "passwordEnc" FROM system_smtp_settings ORDER BY created_at LIMIT 1`) as Array<{id:string;passwordEnc:string|null}>;
|
|
const passwordEnc=input.password===undefined
|
|
? existing?.passwordEnc??null
|
|
: input.password?this.encryptSecret(input.password):null;
|
|
if(existing){
|
|
await this.dataSource.query(`
|
|
UPDATE system_smtp_settings SET host=$2,port=$3,security_mode=$4,username=$5,
|
|
password_enc=$6,from_name=$7,from_email=$8,reply_to=$9,enabled=$10,
|
|
updated_by=$11,updated_at=CURRENT_TIMESTAMP WHERE id=$1
|
|
`,[existing.id,input.host,input.port,input.securityMode,input.username??null,passwordEnc,input.fromName,input.fromEmail,input.replyTo??null,input.enabled,userId]);
|
|
}else{
|
|
await this.dataSource.query(`
|
|
INSERT INTO system_smtp_settings(host,port,security_mode,username,password_enc,from_name,from_email,reply_to,enabled,updated_by)
|
|
VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10)
|
|
`,[input.host,input.port,input.securityMode,input.username??null,passwordEnc,input.fromName,input.fromEmail,input.replyTo??null,input.enabled,userId]);
|
|
}
|
|
return this.publicSettings();
|
|
}
|
|
|
|
async send(input:MailInput,userId?:string):Promise<{messageId:string}>{
|
|
const settings=await this.resolveSettings(userId);
|
|
if(!settings)throw new Error('SMTP no configurado');
|
|
const {host,port,securityMode,userName,password}= {
|
|
host:settings.host,port:settings.port,securityMode:settings.securityMode,
|
|
userName:settings.username??'',password:settings.password,
|
|
};
|
|
const implicitTls=securityMode===SmtpSecurityMode.TLS;
|
|
const base=await new Promise<Socket|TLSSocket>((resolve,reject)=>{
|
|
if(implicitTls){ const tls=connectTls({host,port,servername:host,rejectUnauthorized:true},()=>resolve(tls)); tls.once('error',reject); }
|
|
else { const raw=connectNet({host,port},()=>resolve(raw)); raw.once('error',reject); }
|
|
});
|
|
const session=new SmtpSession(base);
|
|
const welcome=await session.reply();
|
|
if(welcome.code!==220)throw new Error(`SMTP ${welcome.code}: ${welcome.text}`);
|
|
let ehlo=await session.command('EHLO dh-inspeccion',250);
|
|
if(securityMode===SmtpSecurityMode.STARTTLS){
|
|
if(!/STARTTLS/i.test(ehlo.text))throw new Error('El servidor SMTP no ofrece STARTTLS');
|
|
await session.command('STARTTLS',220);
|
|
const rawForTls=session.detachForUpgrade() as Socket;
|
|
const upgraded=await new Promise<TLSSocket>((resolve,reject)=>{ const tls=connectTls({socket:rawForTls,servername:host,rejectUnauthorized:true},()=>resolve(tls)); tls.once('error',reject); });
|
|
session.replaceSocket(upgraded);
|
|
ehlo=await session.command('EHLO dh-inspeccion',250);
|
|
}
|
|
if(userName){
|
|
if(/AUTH[^\n]*PLAIN/i.test(ehlo.text)){ const token=Buffer.from(`\u0000${userName}\u0000${password}`,'utf8').toString('base64'); await session.command(`AUTH PLAIN ${token}`,235); }
|
|
else { await session.command('AUTH LOGIN',334); await session.command(Buffer.from(userName).toString('base64'),334); await session.command(Buffer.from(password).toString('base64'),235); }
|
|
}
|
|
const from=settings.fromName?`${settings.fromName} <${settings.fromEmail}>`:settings.fromEmail;
|
|
await session.command(`MAIL FROM:<${envelope(from)}>`,250);
|
|
await session.command(`RCPT TO:<${input.to}>`,[250,251]);
|
|
await session.command('DATA',354);
|
|
session.write(`${mime(input,from,settings.replyTo)}\r\n.\r\n`);
|
|
const sent=await session.reply();
|
|
if(sent.code!==250)throw new Error(`SMTP ${sent.code}: ${sent.text}`);
|
|
await session.command('QUIT',221).catch(()=>undefined);
|
|
session.end();
|
|
const match=sent.text.match(/(?:queued as|id=|message-id[=:]?)[\s<]*([^\s>]+)/i);
|
|
return {messageId:match?.[1]??randomUUID()};
|
|
}
|
|
|
|
private async resolveSettings(userId?:string):Promise<EffectiveSmtpSettings|null>{
|
|
if(userId){
|
|
const [row]=await this.dataSource.query(`
|
|
SELECT settings.mode,settings.host,settings.port,settings.security_mode AS "securityMode",
|
|
settings.username,settings.password_enc AS "passwordEnc",settings.from_name AS "fromName",
|
|
settings.enabled,user_account.email AS "userEmail"
|
|
FROM users user_account
|
|
LEFT JOIN user_smtp_settings settings ON settings.user_id=user_account.id
|
|
WHERE user_account.id=$1
|
|
`,[userId]) as Array<{
|
|
mode:'SYSTEM'|'CUSTOM'|null;host:string|null;port:number|null;securityMode:SmtpSecurityMode|null;
|
|
username:string|null;passwordEnc:string|null;fromName:string|null;enabled:boolean|null;userEmail:string;
|
|
}>;
|
|
if(row?.mode==='CUSTOM'&&row.enabled!==false&&row.host&&row.port&&row.securityMode&&row.userEmail){
|
|
return {
|
|
source:'USER',host:row.host,port:Number(row.port),securityMode:row.securityMode,
|
|
username:row.username,password:row.passwordEnc?this.decryptSecret(row.passwordEnc):'',
|
|
fromName:row.fromName,fromEmail:row.userEmail,replyTo:row.userEmail,
|
|
};
|
|
}
|
|
const general=await this.resolveSystemSettings();
|
|
return general&&row?.userEmail?{...general,replyTo:row.userEmail}:general;
|
|
}
|
|
return this.resolveSystemSettings();
|
|
}
|
|
|
|
private async resolveSystemSettings():Promise<EffectiveSmtpSettings|null>{
|
|
const [row]=await this.dataSource.query(`
|
|
SELECT host,port,security_mode AS "securityMode",username,password_enc AS "passwordEnc",
|
|
from_name AS "fromName",from_email AS "fromEmail",reply_to AS "replyTo",enabled
|
|
FROM system_smtp_settings ORDER BY created_at LIMIT 1
|
|
`) as Array<{
|
|
host:string;port:number;securityMode:SmtpSecurityMode;username:string|null;passwordEnc:string|null;
|
|
fromName:string;fromEmail:string;replyTo:string|null;enabled:boolean;
|
|
}>;
|
|
if(row){
|
|
if(!row.enabled)return null;
|
|
return {
|
|
source:'DATABASE',host:row.host,port:Number(row.port),securityMode:row.securityMode,
|
|
username:row.username,password:row.passwordEnc?this.decryptSecret(row.passwordEnc):'',
|
|
fromName:row.fromName,fromEmail:row.fromEmail,replyTo:row.replyTo,
|
|
};
|
|
}
|
|
return this.resolveEnvironment();
|
|
}
|
|
|
|
private async resolveEnvironment():Promise<EffectiveSmtpSettings|null>{
|
|
const host=this.config.get<string>('SMTP_HOST');
|
|
const rawFrom=this.config.get<string>('MAIL_FROM');
|
|
if(!host||!rawFrom)return null;
|
|
const fromEmail=envelope(rawFrom);
|
|
const fromName=rawFrom.includes('<')?rawFrom.slice(0,rawFrom.indexOf('<')).trim().replace(/^"|"$/g,'')||null:null;
|
|
const secure=String(this.config.get<string>('SMTP_SECURE')??'false').toLowerCase()==='true';
|
|
return {
|
|
source:'ENVIRONMENT',host,port:Number(this.config.get<string>('SMTP_PORT')??(secure?465:587)),
|
|
securityMode:secure?SmtpSecurityMode.TLS:SmtpSecurityMode.STARTTLS,
|
|
username:this.config.get<string>('SMTP_USER')??null,password:this.config.get<string>('SMTP_PASS')??'',
|
|
fromName,fromEmail,replyTo:null,
|
|
};
|
|
}
|
|
|
|
private encryptionKey():Buffer{
|
|
const raw=this.config.get<string>('SMTP_SETTINGS_MASTER_KEY');
|
|
if(!raw)throw new ServiceUnavailableException({ code:'SMTP_SETTINGS_MASTER_KEY_NOT_CONFIGURED', message:'La clave maestra para proteger credenciales SMTP no está configurada en el servidor' });
|
|
const key=/^[0-9a-fA-F]{64}$/.test(raw)?Buffer.from(raw,'hex'):Buffer.from(raw,'base64');
|
|
if(key.length!==32)throw new ServiceUnavailableException({ code:'SMTP_SETTINGS_MASTER_KEY_INVALID', message:'La clave maestra SMTP del servidor tiene un formato inválido' });
|
|
return key;
|
|
}
|
|
|
|
private encryptSecret(value:string):string{
|
|
const iv=randomBytes(12); const cipher=createCipheriv('aes-256-gcm',this.encryptionKey(),iv);
|
|
const encrypted=Buffer.concat([cipher.update(value,'utf8'),cipher.final()]);
|
|
const tag=cipher.getAuthTag();
|
|
return `v1:${iv.toString('base64')}:${tag.toString('base64')}:${encrypted.toString('base64')}`;
|
|
}
|
|
|
|
private decryptSecret(value:string):string{
|
|
const [version,ivB64,tagB64,cipherB64]=value.split(':');
|
|
if(version!=='v1'||!ivB64||!tagB64||!cipherB64)throw new Error('Credencial SMTP cifrada inválida');
|
|
const decipher=createDecipheriv('aes-256-gcm',this.encryptionKey(),Buffer.from(ivB64,'base64'));
|
|
decipher.setAuthTag(Buffer.from(tagB64,'base64'));
|
|
return Buffer.concat([decipher.update(Buffer.from(cipherB64,'base64')),decipher.final()]).toString('utf8');
|
|
}
|
|
}
|