redlight/server/config/mailer.js

import nodemailer from 'nodemailer';
import { log } from './logger.js';

let transporter;

// Escape HTML special characters to prevent injection in email bodies
function escapeHtml(str) {
  if (!str) return '';
  return String(str)
    .replace(/&/g, '&')
    .replace(/</g, '&lt;')
    .replace(/>/g, '&gt;')
    .replace(/"/g, '&quot;')
    .replace(/'/g, '&#39;');
}

export function initMailer() {
  const host = process.env.SMTP_HOST;
  const port = parseInt(process.env.SMTP_PORT || '587', 10);
  const user = process.env.SMTP_USER;
  const pass = process.env.SMTP_PASS;

  if (!host || !user || !pass) {
    log.mailer.warn('SMTP not configured – email verification disabled');
    return false;
  }

  transporter = nodemailer.createTransport({
    host,
    port,
    secure: port === 465,
    auth: { user, pass },
    connectionTimeout: 10_000,  // 10 s to establish TCP connection
    greetingTimeout: 10_000,   // 10 s to receive SMTP greeting
    socketTimeout: 15_000,     // 15 s of inactivity before abort
  });

  log.mailer.info('SMTP mailer configured');
  return true;
}

export function isMailerConfigured() {
  return !!transporter;
}

/**
 * Send the verification email with a clickable link.
 * @param {string} to      – recipient email
 * @param {string} name    – user's display name
 * @param {string} verifyUrl – full verification URL
 * @param {string} appName  – branding app name (default "Redlight")
 */
// S3: sanitize name for use in email From header (strip quotes, newlines, control chars)
function sanitizeHeaderValue(str) {
  return String(str).replace(/["\\\r\n\x00-\x1f]/g, '').trim().slice(0, 100);
}

export async function sendVerificationEmail(to, name, verifyUrl, appName = 'Redlight') {
  if (!transporter) {
    throw new Error('SMTP not configured');
  }

  const from = process.env.SMTP_FROM || process.env.SMTP_USER;
  const headerAppName = sanitizeHeaderValue(appName);
  const safeName = escapeHtml(name);
  const safeAppName = escapeHtml(appName);

  await transporter.sendMail({
    from: `"${headerAppName}" <${from}>`,
    to,
    subject: `${headerAppName} – Verify your email`,
    html: `
      <div style="font-family:Arial,sans-serif;max-width:520px;margin:0 auto;padding:32px;background:#1e1e2e;color:#cdd6f4;border-radius:12px;">
        <h2 style="color:#cba6f7;margin-top:0;">Hey ${safeName} 👋</h2>
        <p>Please verify your email address by clicking the button below:</p>
        <p style="text-align:center;margin:28px 0;">
          <a href="${verifyUrl}"
             style="display:inline-block;background:#cba6f7;color:#1e1e2e;padding:12px 32px;border-radius:8px;text-decoration:none;font-weight:bold;">
            Verify Email
          </a>
        </p>
        <p style="font-size:13px;color:#7f849c;">
          Or copy this link in your browser:<br/>
          <a href="${verifyUrl}" style="color:#89b4fa;word-break:break-all;">${escapeHtml(verifyUrl)}</a>
        </p>
        <p style="font-size:13px;color:#7f849c;">This link is valid for 24 hours.</p>
        <hr style="border:none;border-top:1px solid #313244;margin:24px 0;"/>
        <p style="font-size:12px;color:#585b70;">If you didn't register, please ignore this email.</p>
      </div>
    `,
    text: `Hey ${name},\n\nPlease verify your email: ${verifyUrl}\n\nThis link is valid for 24 hours.\n\n– ${appName}`,
  });
}

/**
 * Send a federation meeting invitation email.
 * @param {string} to          – recipient email
 * @param {string} name        – recipient display name
 * @param {string} fromUser    – sender federated address (user@domain)
 * @param {string} roomName    – name of the invited room
 * @param {string} message     – optional personal message
 * @param {string} inboxUrl    – URL to the federation inbox
 * @param {string} appName     – branding app name (default "Redlight")
 */
export async function sendFederationInviteEmail(to, name, fromUser, roomName, message, inboxUrl, appName = 'Redlight') {
  if (!transporter) return; // silently skip if SMTP not configured

  const from = process.env.SMTP_FROM || process.env.SMTP_USER;
  const headerAppName = sanitizeHeaderValue(appName);
  const safeName = escapeHtml(name);
  const safeFromUser = escapeHtml(fromUser);
  const safeRoomName = escapeHtml(roomName);
  const safeMessage = message ? escapeHtml(message) : null;
  const safeAppName = escapeHtml(appName);

  await transporter.sendMail({
    from: `"${headerAppName}" <${from}>`,
    to,
    subject: `${headerAppName} – Meeting invitation from ${sanitizeHeaderValue(fromUser)}`,
    html: `
      <div style="font-family:Arial,sans-serif;max-width:520px;margin:0 auto;padding:32px;background:#1e1e2e;color:#cdd6f4;border-radius:12px;">
        <h2 style="color:#cba6f7;margin-top:0;">Hey ${safeName} 👋</h2>
        <p>You have received a meeting invitation from <strong style="color:#cdd6f4;">${safeFromUser}</strong>.</p>
        <div style="background:#313244;border-radius:8px;padding:16px;margin:20px 0;">
          <p style="margin:0 0 8px 0;font-size:13px;color:#7f849c;">Room:</p>
          <p style="margin:0;font-size:16px;font-weight:bold;color:#cdd6f4;">${safeRoomName}</p>
          ${safeMessage ? `<p style="margin:12px 0 0 0;font-size:13px;color:#a6adc8;font-style:italic;">&quot;${safeMessage}&quot;</p>` : ''}
        </div>
        <p style="text-align:center;margin:28px 0;">
          <a href="${inboxUrl}"
             style="display:inline-block;background:#cba6f7;color:#1e1e2e;padding:12px 32px;border-radius:8px;text-decoration:none;font-weight:bold;">
            View Invitation
          </a>
        </p>
        <hr style="border:none;border-top:1px solid #313244;margin:24px 0;"/>
        <p style="font-size:12px;color:#585b70;">Open the link above to accept or decline the invitation.</p>
      </div>
    `,
    text: `Hey ${name},\n\nYou have received a meeting invitation from ${fromUser}.\nRoom: ${roomName}${message ? `\nMessage: "${message}"` : ''}\n\nView invitation: ${inboxUrl}\n\n– ${appName}`,
  });
}