feat(email): send a real test message from admin Email #509
Loading…
Reference in a new issue
No description provided.
Delete branch "feat/BUNYIP-508-admin-test-email-send"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The admin Email page could only prove that the relay accepts AUTH:
Test connectionconnects, negotiates TLS, authenticates and quits without sending anything, so a relay that authenticates but then refuses or drops mail still looked healthy. A second button,Test email, now sends a real message through the saved SMTP settings to the signed-in admin's own address and reports the relay's own reason on the page when it does not arrive.POST /v1/admin/email/test-sendtakes no request body and no recipient parameter: the address comes from the verified admin claims, so the endpoint cannot be pointed at a third party and turned into a relay for arbitrary mail. It resolves the SAVEDemail_configrow throughEmailConfig::from_db_row(not unsaved form edits), sharesRateLimitConfig::SMTP_TESTwith the connection probe since both hammer the same relay, and writes anAuditAction::AdminTestEmailSentrow on both the success and failure paths whose metadata carries host/port/tls andokbut never the recipient address. Like the probe it always answers 200 with{ok, message}: a 5xx would be collapsed to "An unexpected error occurred" byApiError::user_message, hiding the one thing the admin clicked the button to see. The failure stays loud - logged aterrorwith the underlying cause,ok: falseis not a value a successful send can produce, and the page renders a red banner.The message uses a new
smtp_testtemplate pair rather thanwelcome, which states a price and account status that would be fabricated for a test. It names the SMTP host and the UTC send time so the admin can match it to the click, and carries no billing or account language.The orphan
POST /v1/admin/test-emailand itssend_test_emailhandler are removed. Nothing called it, it had no rate limit and no audit row, and it mailed the welcome template with a hardcoded 300 cents, so its "test" told the admin they had been charged $3.00. A source-scanning unit test inroutes/admin.rsfails the build if the route or the handler name comes back.#BUNYIP-508
The admin Email page could only prove that the relay accepts AUTH: `Test connection` connects, negotiates TLS, authenticates and quits without sending anything, so a relay that authenticates but then refuses or drops mail still looked healthy. A second button, `Test email`, now sends a real message through the saved SMTP settings to the signed-in admin's own address and reports the relay's own reason on the page when it does not arrive. `POST /v1/admin/email/test-send` takes no request body and no recipient parameter: the address comes from the verified admin claims, so the endpoint cannot be pointed at a third party and turned into a relay for arbitrary mail. It resolves the SAVED `email_config` row through `EmailConfig::from_db_row` (not unsaved form edits), shares `RateLimitConfig::SMTP_TEST` with the connection probe since both hammer the same relay, and writes an `AuditAction::AdminTestEmailSent` row on both the success and failure paths whose metadata carries host/port/tls and `ok` but never the recipient address. Like the probe it always answers 200 with `{ok, message}`: a 5xx would be collapsed to "An unexpected error occurred" by `ApiError::user_message`, hiding the one thing the admin clicked the button to see. The failure stays loud - logged at `error` with the underlying cause, `ok: false` is not a value a successful send can produce, and the page renders a red banner. The message uses a new `smtp_test` template pair rather than `welcome`, which states a price and account status that would be fabricated for a test. It names the SMTP host and the UTC send time so the admin can match it to the click, and carries no billing or account language. The orphan `POST /v1/admin/test-email` and its `send_test_email` handler are removed. Nothing called it, it had no rate limit and no audit row, and it mailed the welcome template with a hardcoded 300 cents, so its "test" told the admin they had been charged $3.00. A source-scanning unit test in `routes/admin.rs` fails the build if the route or the handler name comes back. #BUNYIP-508