screentinker/server/services
screentinker cf4c71d7d0
feat(email): SMTP transport as an alternative to Microsoft Graph [#173] (#179)
Adds a pluggable email transport so self-hosters without Azure/M365 can send
mail through any standard SMTP server (Postfix, Gmail, Mailgun, SendGrid, corp
relay). Graph stays the default; behavior is byte-for-byte unchanged when
EMAIL_TRANSPORT is unset or "graph".

- config: EMAIL_TRANSPORT ("graph"|"smtp", default graph) + SMTP_HOST/PORT/
  SECURE/USER/PASSWORD/FROM.
- services/email.js: branch by transport behind the SAME public sendEmail()/
  isConfigured() surface. SMTP via nodemailer (lazy-required, like MSAL).
  Shared across both transports: the "[ScreenTinker] " subject prefix (unless
  rawSubject), the GRAPH_DEV_RESTRICT_TO allow-list, html-from-text derivation,
  and the never-throws contract (failures log + return sent:false). SMTP_SECURE
  true=implicit TLS(465)/false=STARTTLS(587). Auth optional (unauthenticated
  relay ok); SMTP_USER without SMTP_PASSWORD is flagged. SMTP_FROM parses
  "Name <addr>". New emailConfigStatus() for startup diagnostics.
- server.js: startup logs the transport and a LOUD error when the selected
  transport is partially configured (some fields set, others missing) or when
  EMAIL_TRANSPORT is invalid (falls back to graph). A fully-unset transport
  stays a silent stdout fallback (unchanged dev behavior).
- nodemailer ^6.9.16 added as a production dep (bundled in the Docker image).
- .env.example + README: SMTP config section, Gmail example, transport table.
- test/email-transport.test.js: 15 tests — transport selection, config
  validation (missing/partial/invalid), SMTP message building (from/prefix/
  fromName override/text alt), sendEmail routing (mocked nodemailer), rawSubject,
  dev-restrict on smtp, and the smtp_error never-throws path.

462/462 server tests pass. Boot verified for all four states (configured,
misconfigured, invalid, default).

Closes #173

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-13 15:56:22 -05:00
..
activationNudge.js feat(signup): T+3 activation nudge for users with zero paired screens 2026-05-30 20:28:24 -05:00
activity.js feat(workspaces): rename via switcher dropdown - new PATCH /api/workspaces/:id route, per-row pencil affordance in switcher (visible only when caller can_admin), small rename modal with name + slug fields, validation (name <=80 chars, slug ^[a-z0-9]+(?:-[a-z0-9]+)*$ <=60 chars, blank slug -> NULL), 409 on per-org slug collision. Permission gating via new canAdminWorkspace(db, user, ws) helper in lib/permissions.js - reused-ready for future Phase 3 admin actions. /me query now joins organization_members to compute can_admin per accessible_workspaces entry. Drive-by fixes surfaced: (1) activityLogger method filter was missing PATCH, added; (2) routes that operate on a target workspace by URL param need to stamp req.workspaceId from the param so activityLogger captures the right tenant attribution - documented in the route. Smoke fixture: switcher-test@local.test is workspace_admin of Studio A and workspace_editor of Field Crew (no org_owner) so the can_admin true/false split is exercised in one login. 2026-05-12 11:06:55 -05:00
agency-digest.js feat(api): batched email digest for agency uploads (#73) 2026-06-14 13:59:37 -05:00
alerts.js feat(email): Microsoft Graph send + alert spam protection + preferences UI 2026-05-12 18:16:40 -05:00
content-expiry.js feat(device-owner): tier foundation + QR provisioning + content-expiry & device enhancements (#168) 2026-07-12 19:41:07 -05:00
email.js feat(email): SMTP transport as an alternative to Microsoft Graph [#173] (#179) 2026-07-13 15:56:22 -05:00
heartbeat.js feat(diagnostics): device incident log — offline cause, network-vs-reboot, display-sleep (#175) 2026-07-13 11:26:04 -05:00
loop-lag.js fix(#146) P3.7: coalescer carries the PEAK numeric over the window 2026-06-30 22:10:45 -05:00
scheduler.js feat(device-owner): tier foundation + QR provisioning + content-expiry & device enhancements (#168) 2026-07-12 19:41:07 -05:00
signupEmails.js fix(signup): make admin-notify recipient env-driven, not hardcoded 2026-05-30 16:16:33 -05:00