- POST /v1/recover: request recovery code - POST /v1/recover/verify: verify code, receive key via email - Key sent via email only (not in API response) for security - Rate limited to 3 attempts per hour - Non-enumerable: same response whether email exists or not - DKIM-signed emails via postfix/opendkim
43 lines
1.6 KiB
TypeScript
43 lines
1.6 KiB
TypeScript
import nodemailer from "nodemailer";
|
|
|
|
const transporter = nodemailer.createTransport({
|
|
host: process.env.SMTP_HOST || "host.docker.internal",
|
|
port: Number(process.env.SMTP_PORT || 25),
|
|
secure: false,
|
|
connectionTimeout: 5000,
|
|
greetingTimeout: 5000,
|
|
socketTimeout: 10000,
|
|
tls: { rejectUnauthorized: false },
|
|
});
|
|
|
|
export async function sendVerificationEmail(email: string, code: string): Promise<boolean> {
|
|
try {
|
|
const info = await transporter.sendMail({
|
|
from: "DocFast <noreply@docfast.dev>",
|
|
to: email,
|
|
subject: "DocFast - Verify your email",
|
|
text: `Your DocFast verification code is: ${code}\n\nThis code expires in 15 minutes.\n\nIf you didn't sign up for DocFast, ignore this email.`,
|
|
});
|
|
console.log(`📧 Verification email sent to ${email}: ${info.messageId}`);
|
|
return true;
|
|
} catch (err) {
|
|
console.error(`📧 Failed to send verification email to ${email}:`, err);
|
|
return false;
|
|
}
|
|
}
|
|
|
|
export async function sendRecoveryEmail(email: string, apiKey: string): Promise<boolean> {
|
|
try {
|
|
const info = await transporter.sendMail({
|
|
from: "DocFast <noreply@docfast.dev>",
|
|
to: email,
|
|
subject: "DocFast - Your API Key Recovery",
|
|
text: `Here is your DocFast API key:\n\n${apiKey}\n\nKeep this key safe. Do not share it with anyone.\n\nIf you didn't request this recovery, please ignore this email — your key has not been changed.`,
|
|
});
|
|
console.log(`📧 Recovery email sent to ${email}: ${info.messageId}`);
|
|
return true;
|
|
} catch (err) {
|
|
console.error(`📧 Failed to send recovery email to ${email}:`, err);
|
|
return false;
|
|
}
|
|
}
|