chore: import upstream snapshot with attribution

apps/sim/lib/messaging/email/mailer.test.ts

@@ -0,0 +1,330 @@
+import { createEnvMock } from '@sim/testing'
+import { beforeEach, describe, expect, it, type Mock, vi } from 'vitest'
+
+const mockSend = vi.fn()
+const mockBatchSend = vi.fn()
+const mockAzureBeginSend = vi.fn()
+const mockAzurePollUntilDone = vi.fn()
+
+vi.mock('resend', () => {
+  return {
+    Resend: vi.fn().mockImplementation(
+      class {
+        emails = {
+          send: (...args: any[]) => mockSend(...args),
+        }
+        batch = {
+          send: (...args: any[]) => mockBatchSend(...args),
+        }
+      }
+    ),
+  }
+})
+
+vi.mock('@azure/communication-email', () => {
+  return {
+    EmailClient: vi.fn().mockImplementation(
+      class {
+        beginSend = (...args: any[]) => mockAzureBeginSend(...args)
+      }
+    ),
+  }
+})
+
+vi.mock('@/lib/messaging/email/unsubscribe', () => ({
+  isUnsubscribed: vi.fn(),
+  generateUnsubscribeToken: vi.fn(),
+}))
+
+vi.mock('@/lib/auth/access-control', () => ({
+  getAccessControlConfig: vi.fn().mockResolvedValue({
+    blockedSignupDomains: [],
+    blockedEmails: [],
+    allowedLoginEmails: [],
+    allowedLoginDomains: [],
+    blockedEmailMxHosts: [],
+  }),
+  isEmailBlockedByAccessControl: vi.fn().mockReturnValue(false),
+}))
+
+vi.mock('@/lib/core/config/env', () =>
+  createEnvMock({
+    RESEND_API_KEY: 'test-api-key',
+    AZURE_ACS_CONNECTION_STRING: 'test-azure-connection-string',
+    AZURE_COMMUNICATION_EMAIL_DOMAIN: 'test.azurecomm.net',
+    NEXT_PUBLIC_APP_URL: 'https://test.sim.ai',
+    FROM_EMAIL_ADDRESS: 'Sim <noreply@sim.ai>',
+  })
+)
+
+vi.mock('@/lib/core/utils/urls', () => ({
+  getEmailDomain: vi.fn().mockReturnValue('sim.ai'),
+  getBaseUrl: vi.fn().mockReturnValue('https://test.sim.ai'),
+  getBaseDomain: vi.fn().mockReturnValue('test.sim.ai'),
+}))
+
+vi.mock('@/lib/messaging/email/utils', () => ({
+  getFromEmailAddress: vi.fn().mockReturnValue('Sim <noreply@sim.ai>'),
+  hasEmailHeaderControlChars: vi.fn().mockImplementation((value: string) => /[\r\n]/.test(value)),
+  EMAIL_HEADER_CONTROL_CHARS_REGEX: /[\r\n]/,
+  NO_EMAIL_HEADER_CONTROL_CHARS_REGEX: /^[^\r\n]*$/,
+}))
+
+import { isEmailBlockedByAccessControl } from '@/lib/auth/access-control'
+import { type EmailType, hasEmailService, sendBatchEmails, sendEmail } from './mailer'
+import { generateUnsubscribeToken, isUnsubscribed } from './unsubscribe'
+
+describe('mailer', () => {
+  const testEmailOptions = {
+    to: 'test@example.com',
+    subject: 'Test Subject',
+    html: '<p>Test email content</p>',
+  }
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    ;(isEmailBlockedByAccessControl as Mock).mockReturnValue(false)
+    ;(isUnsubscribed as Mock).mockResolvedValue(false)
+    ;(generateUnsubscribeToken as Mock).mockReturnValue('mock-token-123')
+
+    mockSend.mockResolvedValue({
+      data: { id: 'test-email-id' },
+      error: null,
+    })
+
+    mockBatchSend.mockResolvedValue({
+      data: [{ id: 'batch-email-1' }, { id: 'batch-email-2' }],
+      error: null,
+    })
+
+    mockAzurePollUntilDone.mockResolvedValue({
+      status: 'Succeeded',
+      id: 'azure-email-id',
+    })
+
+    mockAzureBeginSend.mockReturnValue({
+      pollUntilDone: mockAzurePollUntilDone,
+    })
+  })
+
+  describe('hasEmailService', () => {
+    it('should return true when email service is configured', () => {
+      const result = hasEmailService()
+      expect(typeof result).toBe('boolean')
+    })
+  })
+
+  describe('sendEmail', () => {
+    it('should send a transactional email successfully', async () => {
+      const result = await sendEmail({
+        ...testEmailOptions,
+        emailType: 'transactional',
+      })
+
+      expect(result.success).toBe(true)
+      expect(isUnsubscribed).not.toHaveBeenCalled()
+    })
+
+    it('should check unsubscribe status for marketing emails', async () => {
+      const result = await sendEmail({
+        ...testEmailOptions,
+        emailType: 'marketing',
+      })
+
+      expect(result.success).toBe(true)
+      expect(isUnsubscribed).toHaveBeenCalledWith(testEmailOptions.to, 'marketing')
+    })
+
+    it('should skip sending if user has unsubscribed', async () => {
+      ;(isUnsubscribed as Mock).mockResolvedValue(true)
+
+      const result = await sendEmail({
+        ...testEmailOptions,
+        emailType: 'marketing',
+      })
+
+      expect(result.success).toBe(true)
+      expect(result.message).toBe('Email skipped (user unsubscribed)')
+      expect(result.data).toEqual({ id: 'skipped-unsubscribed' })
+    })
+
+    it('should not include unsubscribe when includeUnsubscribe is false', async () => {
+      await sendEmail({
+        ...testEmailOptions,
+        emailType: 'marketing',
+        includeUnsubscribe: false,
+      })
+
+      expect(generateUnsubscribeToken).not.toHaveBeenCalled()
+    })
+
+    it('should handle text-only emails without HTML', async () => {
+      const result = await sendEmail({
+        to: 'test@example.com',
+        subject: 'Text Only',
+        text: 'Plain text content',
+      })
+
+      expect(result.success).toBe(true)
+    })
+
+    it('should sanitize CRLF characters in subjects before sending', async () => {
+      const result = await sendEmail({
+        to: 'test@example.com',
+        subject: 'Hello\r\nBcc: attacker@evil.com',
+        text: 'Plain text content',
+      })
+
+      expect(result.success).toBe(true)
+      expect(mockSend).toHaveBeenCalledWith(
+        expect.objectContaining({
+          subject: 'Hello Bcc: attacker@evil.com',
+        })
+      )
+    })
+
+    it('should reject reply-to values containing header control characters', async () => {
+      const result = await sendEmail({
+        to: 'test@example.com',
+        subject: 'Test Subject',
+        text: 'Plain text content',
+        replyTo: 'user@example.com\r\nBcc: attacker@evil.com',
+      })
+
+      expect(result.success).toBe(false)
+      expect(result.message).toBe('Failed to send email')
+      expect(mockSend).not.toHaveBeenCalled()
+    })
+
+    it('should handle multiple recipients as array', async () => {
+      const recipients = ['user1@example.com', 'user2@example.com', 'user3@example.com']
+      const result = await sendEmail({
+        ...testEmailOptions,
+        to: recipients,
+        emailType: 'marketing',
+      })
+
+      expect(result.success).toBe(true)
+      expect(isUnsubscribed).toHaveBeenCalledWith('user1@example.com', 'marketing')
+    })
+
+    it('should skip sending when the recipient is on the ban list', async () => {
+      ;(isEmailBlockedByAccessControl as Mock).mockReturnValue(true)
+
+      const result = await sendEmail({
+        ...testEmailOptions,
+        emailType: 'transactional',
+      })
+
+      expect(result.success).toBe(true)
+      expect(result.message).toBe('Email skipped (recipient on access-control ban list)')
+      expect(result.data).toEqual({ id: 'skipped-banned' })
+      expect(mockSend).not.toHaveBeenCalled()
+      expect(isUnsubscribed).not.toHaveBeenCalled()
+    })
+
+    it('should drop only the banned recipients from a multi-recipient send', async () => {
+      ;(isEmailBlockedByAccessControl as Mock).mockImplementation(
+        (email: string) => email === 'banned@example.com'
+      )
+
+      const result = await sendEmail({
+        ...testEmailOptions,
+        to: ['good@example.com', 'banned@example.com'],
+        emailType: 'transactional',
+      })
+
+      expect(result.success).toBe(true)
+      expect(mockSend).toHaveBeenCalledWith(expect.objectContaining({ to: 'good@example.com' }))
+    })
+
+    it('should handle general exceptions gracefully', async () => {
+      ;(isUnsubscribed as Mock).mockRejectedValue(new Error('Database connection failed'))
+
+      const result = await sendEmail({
+        ...testEmailOptions,
+        emailType: 'marketing',
+      })
+
+      expect(result.success).toBe(false)
+      expect(result.message).toBe('Failed to send email')
+    })
+  })
+
+  describe('sendBatchEmails', () => {
+    const testBatchEmails = [
+      { ...testEmailOptions, to: 'user1@example.com' },
+      { ...testEmailOptions, to: 'user2@example.com' },
+    ]
+
+    it('should handle empty batch', async () => {
+      const result = await sendBatchEmails({ emails: [] })
+
+      expect(result.success).toBe(true)
+      expect(result.results).toHaveLength(0)
+    })
+
+    it('should process multiple emails in batch', async () => {
+      const result = await sendBatchEmails({ emails: testBatchEmails })
+
+      expect(result.success).toBe(true)
+      expect(result.results.length).toBeGreaterThanOrEqual(0)
+    })
+
+    it('should sanitize CRLF characters in batch email subjects', async () => {
+      await sendBatchEmails({
+        emails: [
+          {
+            ...testEmailOptions,
+            subject: 'Batch\r\nCc: attacker@evil.com',
+          },
+        ],
+      })
+
+      expect(mockBatchSend).toHaveBeenCalledWith([
+        expect.objectContaining({
+          subject: 'Batch Cc: attacker@evil.com',
+        }),
+      ])
+    })
+
+    it('should handle transactional emails without unsubscribe check', async () => {
+      const batchEmails = [
+        { ...testEmailOptions, to: 'user1@example.com', emailType: 'transactional' as EmailType },
+        { ...testEmailOptions, to: 'user2@example.com', emailType: 'transactional' as EmailType },
+      ]
+
+      await sendBatchEmails({ emails: batchEmails })
+
+      expect(isUnsubscribed).not.toHaveBeenCalled()
+    })
+
+    it('should skip banned recipients in a batch', async () => {
+      ;(isEmailBlockedByAccessControl as Mock).mockImplementation(
+        (email: string) => email === 'user2@example.com'
+      )
+
+      const result = await sendBatchEmails({ emails: testBatchEmails })
+
+      expect(result.results).toHaveLength(2)
+      const bannedEntry = result.results.find(
+        (r) => r.message === 'Email skipped (recipient on access-control ban list)'
+      )
+      expect(bannedEntry).toBeDefined()
+    })
+
+    it('should degrade isUnsubscribed rejections to per-entry failures', async () => {
+      ;(isUnsubscribed as Mock).mockRejectedValue(new Error('Database connection failed'))
+
+      const result = await sendBatchEmails({
+        emails: [
+          { ...testEmailOptions, to: 'user1@example.com', emailType: 'marketing' as EmailType },
+          { ...testEmailOptions, to: 'user2@example.com', emailType: 'marketing' as EmailType },
+        ],
+      })
+
+      expect(result.results).toHaveLength(2)
+      expect(result.results.every((r) => r.success === false)).toBe(true)
+    })
+  })
+})