Merge branch 'pr-503'

# Conflicts:
#	apps/aether-gateway/src/handlers/admin/provider/summary/value.rs
#	apps/aether-gateway/src/lib.rs
#	apps/aether-gateway/src/maintenance/mod.rs
#	apps/aether-gateway/src/maintenance/runtime/workers.rs
#	frontend/src/api/endpoints/types/provider.ts

apps/aether-gateway/src/handlers/public/support/auth_email.rs

@@ -1,11 +1,11 @@
 use super::{
-    decrypt_catalog_secret_with_fallbacks, escape_admin_email_template_html, json,
-    read_admin_email_template_payload, render_admin_email_template_html, system_config_bool,
-    system_config_string, system_config_u16, AppState, GatewayError,
+    escape_admin_email_template_html, json, read_admin_email_template_payload,
+    render_admin_email_template_html, system_config_string, AppState, GatewayError,
     AUTH_EMAIL_VERIFICATION_PREFIX, AUTH_EMAIL_VERIFIED_PREFIX, AUTH_EMAIL_VERIFIED_TTL_SECS,
-    AUTH_SMTP_TIMEOUT_SECS,
 };
-use base64::Engine;
+use crate::email_delivery::{
+    read_smtp_delivery_config, send_smtp_email, ComposedEmail, SmtpDeliveryConfig,
+};
 
 #[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
 pub(super) struct StoredAuthEmailVerificationCode {
@@ -13,25 +13,8 @@ pub(super) struct StoredAuthEmailVerificationCode {
     pub(super) created_at: String,
 }
 
-#[derive(Debug, Clone)]
-pub(super) struct AuthSmtpConfig {
-    pub(super) host: String,
-    pub(super) port: u16,
-    pub(super) user: Option<String>,
-    pub(super) password: Option<String>,
-    pub(super) use_tls: bool,
-    pub(super) use_ssl: bool,
-    pub(super) from_email: String,
-    pub(super) from_name: String,
-}
-
-#[derive(Debug, Clone)]
-pub(super) struct AuthComposedEmail {
-    pub(super) to_email: String,
-    pub(super) subject: String,
-    pub(super) html_body: String,
-    pub(super) text_body: String,
-}
+pub(super) type AuthSmtpConfig = SmtpDeliveryConfig;
+pub(super) type AuthComposedEmail = ComposedEmail;
 
 pub(super) fn auth_email_verification_key(email: &str) -> String {
     format!("{AUTH_EMAIL_VERIFICATION_PREFIX}{email}")
@@ -84,25 +67,6 @@ fn render_auth_template_string(
     Ok(rendered)
 }
 
-fn auth_encode_mime_header(value: &str) -> String {
-    if value.is_ascii() {
-        return value.to_string();
-    }
-    format!(
-        "=?UTF-8?B?{}?=",
-        base64::engine::general_purpose::STANDARD.encode(value.as_bytes())
-    )
-}
-
-fn auth_wrap_base64(value: &str) -> String {
-    let mut wrapped = String::new();
-    for chunk in value.as_bytes().chunks(76) {
-        wrapped.push_str(std::str::from_utf8(chunk).unwrap_or_default());
-        wrapped.push_str("\r\n");
-    }
-    wrapped
-}
-
 fn auth_build_verification_text_body(
     app_name: &str,
     email: &str,
@@ -114,244 +78,6 @@ fn auth_build_verification_text_body(
     )
 }
 
-fn auth_build_tls_config() -> std::sync::Arc<rustls::ClientConfig> {
-    let _ = rustls::crypto::ring::default_provider().install_default();
-    let root_store =
-        rustls::RootCertStore::from_iter(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
-    let config = rustls::ClientConfig::builder()
-        .with_root_certificates(root_store)
-        .with_no_client_auth();
-    std::sync::Arc::new(config)
-}
-
-fn auth_resolve_server_name(
-    host: &str,
-) -> Result<rustls::pki_types::ServerName<'static>, GatewayError> {
-    let host = host.trim().trim_start_matches('[').trim_end_matches(']');
-    if let Ok(ip) = host.parse::<std::net::IpAddr>() {
-        return Ok(rustls::pki_types::ServerName::from(ip));
-    }
-    rustls::pki_types::ServerName::try_from(host.to_string())
-        .map_err(|err| GatewayError::Internal(err.to_string()))
-}
-
-fn auth_connect_tcp_stream(config: &AuthSmtpConfig) -> Result<std::net::TcpStream, GatewayError> {
-    let stream = std::net::TcpStream::connect((config.host.as_str(), config.port))
-        .map_err(|err| GatewayError::Internal(err.to_string()))?;
-    stream
-        .set_read_timeout(Some(std::time::Duration::from_secs(AUTH_SMTP_TIMEOUT_SECS)))
-        .map_err(|err| GatewayError::Internal(err.to_string()))?;
-    stream
-        .set_write_timeout(Some(std::time::Duration::from_secs(AUTH_SMTP_TIMEOUT_SECS)))
-        .map_err(|err| GatewayError::Internal(err.to_string()))?;
-    Ok(stream)
-}
-
-fn auth_wrap_tls_stream(
-    stream: std::net::TcpStream,
-    host: &str,
-) -> Result<rustls::StreamOwned<rustls::ClientConnection, std::net::TcpStream>, GatewayError> {
-    let server_name = auth_resolve_server_name(host)?;
-    let connection = rustls::ClientConnection::new(auth_build_tls_config(), server_name)
-        .map_err(|err| GatewayError::Internal(err.to_string()))?;
-    Ok(rustls::StreamOwned::new(connection, stream))
-}
-
-fn auth_smtp_read_response<T: std::io::BufRead>(
-    reader: &mut T,
-) -> Result<(u16, String), GatewayError> {
-    let mut message = String::new();
-    let code = loop {
-        let parsed_code;
-        let continuation;
-        let trimmed;
-        {
-            let mut line = String::new();
-            let bytes = reader
-                .read_line(&mut line)
-                .map_err(|err| GatewayError::Internal(err.to_string()))?;
-            if bytes == 0 {
-                return Err(GatewayError::Internal(
-                    "smtp connection closed unexpectedly".to_string(),
-                ));
-            }
-            trimmed = line.trim_end_matches(['\r', '\n']).to_string();
-            if trimmed.len() < 3 {
-                return Err(GatewayError::Internal("invalid smtp response".to_string()));
-            }
-            parsed_code = trimmed[..3]
-                .parse::<u16>()
-                .map_err(|err| GatewayError::Internal(err.to_string()))?;
-            continuation = trimmed.as_bytes().get(3).copied() == Some(b'-');
-        }
-        if !message.is_empty() {
-            message.push('\n');
-        }
-        message.push_str(&trimmed);
-        if !continuation {
-            break parsed_code;
-        }
-    };
-    Ok((code, message))
-}
-
-fn auth_smtp_expect<T: std::io::BufRead>(
-    reader: &mut T,
-    allowed_codes: &[u16],
-) -> Result<String, GatewayError> {
-    let (code, message) = auth_smtp_read_response(reader)?;
-    if allowed_codes.contains(&code) {
-        return Ok(message);
-    }
-    Err(GatewayError::Internal(format!(
-        "unexpected smtp response {code}: {message}"
-    )))
-}
-
-fn auth_smtp_write_line<T: std::io::Write>(writer: &mut T, line: &str) -> Result<(), GatewayError> {
-    writer
-        .write_all(line.as_bytes())
-        .map_err(|err| GatewayError::Internal(err.to_string()))?;
-    writer
-        .write_all(b"\r\n")
-        .map_err(|err| GatewayError::Internal(err.to_string()))?;
-    writer
-        .flush()
-        .map_err(|err| GatewayError::Internal(err.to_string()))
-}
-
-fn auth_smtp_send_command<S: std::io::Read + std::io::Write>(
-    reader: &mut std::io::BufReader<S>,
-    command: &str,
-    allowed_codes: &[u16],
-) -> Result<String, GatewayError> {
-    auth_smtp_write_line(reader.get_mut(), command)?;
-    auth_smtp_expect(reader, allowed_codes)
-}
-
-fn auth_build_email_message(config: &AuthSmtpConfig, email: &AuthComposedEmail) -> String {
-    let boundary = format!("aether-{}", uuid::Uuid::new_v4().simple());
-    let text_body = auth_wrap_base64(
-        &base64::engine::general_purpose::STANDARD.encode(email.text_body.as_bytes()),
-    );
-    let html_body = auth_wrap_base64(
-        &base64::engine::general_purpose::STANDARD.encode(email.html_body.as_bytes()),
-    );
-    let from_header = if config.from_name.trim().is_empty() {
-        format!("<{}>", config.from_email)
-    } else {
-        format!(
-            "{} <{}>",
-            auth_encode_mime_header(config.from_name.trim()),
-            config.from_email
-        )
-    };
-    format!(
-        "From: {from_header}\r\nTo: <{to_email}>\r\nSubject: {subject}\r\nMIME-Version: 1.0\r\nContent-Type: multipart/alternative; boundary=\"{boundary}\"\r\n\r\n--{boundary}\r\nContent-Type: text/plain; charset=\"utf-8\"\r\nContent-Transfer-Encoding: base64\r\n\r\n{text_body}--{boundary}\r\nContent-Type: text/html; charset=\"utf-8\"\r\nContent-Transfer-Encoding: base64\r\n\r\n{html_body}--{boundary}--\r\n",
-        to_email = email.to_email,
-        subject = auth_encode_mime_header(&email.subject),
-    )
-}
-
-fn auth_smtp_authenticate<S: std::io::Read + std::io::Write>(
-    reader: &mut std::io::BufReader<S>,
-    config: &AuthSmtpConfig,
-) -> Result<(), GatewayError> {
-    let Some(username) = config
-        .user
-        .as_deref()
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-    else {
-        return Ok(());
-    };
-    let password = config.password.as_deref().unwrap_or("");
-    auth_smtp_send_command(reader, "AUTH LOGIN", &[334])?;
-    auth_smtp_send_command(
-        reader,
-        &base64::engine::general_purpose::STANDARD.encode(username.as_bytes()),
-        &[334],
-    )?;
-    auth_smtp_send_command(
-        reader,
-        &base64::engine::general_purpose::STANDARD.encode(password.as_bytes()),
-        &[235],
-    )?;
-    Ok(())
-}
-
-fn auth_smtp_deliver_message<S: std::io::Read + std::io::Write>(
-    reader: &mut std::io::BufReader<S>,
-    config: &AuthSmtpConfig,
-    email: &AuthComposedEmail,
-) -> Result<(), GatewayError> {
-    auth_smtp_send_command(
-        reader,
-        &format!("MAIL FROM:<{}>", config.from_email),
-        &[250],
-    )?;
-    auth_smtp_send_command(
-        reader,
-        &format!("RCPT TO:<{}>", email.to_email),
-        &[250, 251],
-    )?;
-    auth_smtp_send_command(reader, "DATA", &[354])?;
-    let message = auth_build_email_message(config, email);
-    reader
-        .get_mut()
-        .write_all(message.as_bytes())
-        .map_err(|err| GatewayError::Internal(err.to_string()))?;
-    reader
-        .get_mut()
-        .write_all(b"\r\n.\r\n")
-        .map_err(|err| GatewayError::Internal(err.to_string()))?;
-    reader
-        .get_mut()
-        .flush()
-        .map_err(|err| GatewayError::Internal(err.to_string()))?;
-    let _ = auth_smtp_expect(reader, &[250])?;
-    let _ = auth_smtp_send_command(reader, "QUIT", &[221]);
-    Ok(())
-}
-
-fn auth_smtp_send_message<S: std::io::Read + std::io::Write>(
-    reader: &mut std::io::BufReader<S>,
-    config: &AuthSmtpConfig,
-    email: &AuthComposedEmail,
-) -> Result<(), GatewayError> {
-    auth_smtp_send_command(reader, "EHLO aether.local", &[250])?;
-    auth_smtp_authenticate(reader, config)?;
-    auth_smtp_deliver_message(reader, config, email)
-}
-
-fn send_auth_email_blocking(
-    config: AuthSmtpConfig,
-    email: AuthComposedEmail,
-) -> Result<(), GatewayError> {
-    if config.use_ssl {
-        let stream = auth_connect_tcp_stream(&config)?;
-        let tls_stream = auth_wrap_tls_stream(stream, &config.host)?;
-        let mut reader = std::io::BufReader::new(tls_stream);
-        let _ = auth_smtp_expect(&mut reader, &[220])?;
-        return auth_smtp_send_message(&mut reader, &config, &email);
-    }
-
-    let stream = auth_connect_tcp_stream(&config)?;
-    let mut reader = std::io::BufReader::new(stream);
-    let _ = auth_smtp_expect(&mut reader, &[220])?;
-    let _ = auth_smtp_send_command(&mut reader, "EHLO aether.local", &[250])?;
-    if config.use_tls {
-        let _ = auth_smtp_send_command(&mut reader, "STARTTLS", &[220])?;
-        let stream = reader.into_inner();
-        let tls_stream = auth_wrap_tls_stream(stream, &config.host)?;
-        let mut reader = std::io::BufReader::new(tls_stream);
-        return auth_smtp_send_message(&mut reader, &config, &email);
-    }
-
-    auth_smtp_authenticate(&mut reader, &config)?;
-    auth_smtp_deliver_message(&mut reader, &config, &email)
-}
-
 pub(super) async fn read_auth_email_verification_code(
     state: &AppState,
     email: &str,
@@ -423,40 +149,7 @@ pub(super) async fn store_auth_email_verification_code(
 pub(super) async fn read_auth_smtp_config(
     state: &AppState,
 ) -> Result<Option<AuthSmtpConfig>, GatewayError> {
-    let smtp_host = state.read_system_config_json_value("smtp_host").await?;
-    let smtp_from_email = state
-        .read_system_config_json_value("smtp_from_email")
-        .await?;
-    let Some(host) = system_config_string(smtp_host.as_ref()) else {
-        return Ok(None);
-    };
-    let Some(from_email) = system_config_string(smtp_from_email.as_ref()) else {
-        return Ok(None);
-    };
-    let smtp_port = state.read_system_config_json_value("smtp_port").await?;
-    let smtp_user = state.read_system_config_json_value("smtp_user").await?;
-    let smtp_password = state.read_system_config_json_value("smtp_password").await?;
-    let smtp_use_tls = state.read_system_config_json_value("smtp_use_tls").await?;
-    let smtp_use_ssl = state.read_system_config_json_value("smtp_use_ssl").await?;
-    let smtp_from_name = state
-        .read_system_config_json_value("smtp_from_name")
-        .await?;
-
-    let password = system_config_string(smtp_password.as_ref()).map(|value| {
-        decrypt_catalog_secret_with_fallbacks(state.encryption_key(), &value).unwrap_or(value)
-    });
-
-    Ok(Some(AuthSmtpConfig {
-        host,
-        port: system_config_u16(smtp_port.as_ref(), 587),
-        user: system_config_string(smtp_user.as_ref()),
-        password,
-        use_tls: system_config_bool(smtp_use_tls.as_ref(), true),
-        use_ssl: system_config_bool(smtp_use_ssl.as_ref(), false),
-        from_email,
-        from_name: system_config_string(smtp_from_name.as_ref())
-            .unwrap_or_else(|| "Aether".to_string()),
-    }))
+    read_smtp_delivery_config(state).await
 }
 
 pub(super) async fn auth_email_app_name(state: &AppState) -> Result<String, GatewayError> {
@@ -516,27 +209,20 @@ pub(super) async fn send_auth_email(
     if record_auth_email_delivery_for_tests(
         state,
         json!({
-            "to_email": email.to_email,
-            "subject": email.subject,
-            "html_body": email.html_body,
-            "text_body": email.text_body,
+            "to_email": email.to_email.clone(),
+            "subject": email.subject.clone(),
+            "html_body": email.html_body.clone(),
+            "text_body": email.text_body.clone(),
         }),
     ) {
         return Ok(());
     }
 
-    tokio::task::spawn_blocking(move || send_auth_email_blocking(config, email))
-        .await
-        .map_err(|err| GatewayError::Internal(err.to_string()))?
+    send_smtp_email(config, email).await
 }
 
 pub(super) async fn auth_registration_email_configured(
     state: &AppState,
 ) -> Result<bool, GatewayError> {
-    let smtp_host = state.read_system_config_json_value("smtp_host").await?;
-    let smtp_from_email = state
-        .read_system_config_json_value("smtp_from_email")
-        .await?;
-    Ok(system_config_string(smtp_host.as_ref()).is_some()
-        && system_config_string(smtp_from_email.as_ref()).is_some())
+    Ok(read_smtp_delivery_config(state).await?.is_some())
 }

apps/aether-gateway/src/handlers/public/support/auth_helpers.rs

@@ -121,7 +121,6 @@ pub(super) const AUTH_REFRESH_TOKEN_EXPIRATION_DAYS: i64 = 7;
 pub(super) const AUTH_EMAIL_VERIFICATION_PREFIX: &str = "email:verification:";
 pub(super) const AUTH_EMAIL_VERIFIED_PREFIX: &str = "email:verified:";
 pub(super) const AUTH_EMAIL_VERIFIED_TTL_SECS: u64 = 3600;
-pub(super) const AUTH_SMTP_TIMEOUT_SECS: u64 = 30;
 
 pub(crate) fn build_auth_json_response(
     status: http::StatusCode,