import nodemailer from 'nodemailer'; // Accept either the Laravel-style MAIL_* naming or the legacy SMTP_* names. // MAIL_* wins so the operator can paste their existing .env block straight // in without renaming. MAIL_FROM_ADDRESS is the visible sender (Brevo / // Sendinblue requires this to be a verified domain). const HOST = process.env.MAIL_HOST || process.env.SMTP_HOST; const PORT = process.env.MAIL_PORT || process.env.SMTP_PORT; const USER = process.env.MAIL_USERNAME || process.env.SMTP_USER; const PASS = process.env.MAIL_PASSWORD || process.env.SMTP_PASS; const FROM = process.env.MAIL_FROM_ADDRESS || USER; const FROM_NAME = process.env.MAIL_FROM_NAME || 'Gate Pass'; // Port 465 = implicit TLS. Anything else (587, 2525) = STARTTLS, which // nodemailer negotiates automatically when `secure: false`. Brevo's // SMTP relay on 2525 is STARTTLS. const portNum = PORT ? Number(PORT) : 587; const isSmtpConfigured = !!(HOST && PORT && USER && PASS); const transporter = isSmtpConfigured ? nodemailer.createTransport({ host: HOST, port: portNum, secure: portNum === 465, auth: { user: USER, pass: PASS }, }) : null; // Boot-time visibility. Email sends fail *silently* (logged, not delivered) // when SMTP isn't fully configured — surface the state at startup so a // misconfigured deploy is obvious in the logs instead of a mystery // "invite never arrived". NB: these are API-side vars — setting them in the // web app's .env has no effect. if (transporter) { console.log(`[MAIL] SMTP configured — host=${HOST} port=${portNum} from=${FROM}`); } else { const missing = [ !HOST && 'MAIL_HOST', !PORT && 'MAIL_PORT', !USER && 'MAIL_USERNAME', !PASS && 'MAIL_PASSWORD', ].filter(Boolean).join(', '); console.warn(`[MAIL] SMTP NOT configured — emails will be logged, not sent. Missing: ${missing}. Set these in the API .env.`); } // Optional inline attachments (CID-referenced). Pass a `cid` and reference // it in the html as ``. Embedding via CID is more // reliable than hot-linking the uploads URL — Gmail and Outlook commonly // block external images by default, but render inline CID attachments. export interface MailAttachment { filename: string; content: Buffer; cid?: string; contentType?: string; } export async function sendMail( to: string, subject: string, html: string, options?: { attachments?: MailAttachment[] }, ): Promise { if (transporter) { await transporter.sendMail({ from: FROM_NAME ? `"${FROM_NAME}" <${FROM}>` : FROM, to, subject, html, attachments: options?.attachments, }); } else { console.log(`[DEV MAIL] To: ${to}`); console.log(`[DEV MAIL] Subject: ${subject}`); if (options?.attachments?.length) { console.log(`[DEV MAIL] Attachments: ${options.attachments.map((a) => a.filename).join(', ')}`); } console.log(`[DEV MAIL] Body: ${html}`); } } export async function sendOtpEmail( email: string, otp: string ): Promise { const subject = `${otp} is your Gate Pass verification code`; const html = renderOtpEmail(otp); await sendMail(email, subject, html); } // Transactional email — table-based layout because Outlook + several Gmail // clients still drop modern CSS. All styles inlined. Keep image-free so the // message renders the same in privacy-mode inboxes. function renderOtpEmail(otp: string): string { const escapedOtp = otp.replace(/[^0-9A-Za-z]/g, ''); return ` Verification code
GP Gate Pass

Verification

Sign in to Gate Pass

Enter the code below to finish signing in. The code expires in 10 minutes and can only be used once.

${escapedOtp}

If you didn't request this code, you can safely ignore this email — someone may have typed your address by mistake.

This is an automated message from Gate Pass. Replies are not monitored.

@${new Date().getFullYear()} Gatepass
`; }