docfast/src/services/email.ts
OpenClaw 87a49d8e93 feat: key recovery via email verification (BUG-014)
- POST /v1/recover: request recovery code
- POST /v1/recover/verify: verify code, receive key via email
- Key sent via email only (not in API response) for security
- Rate limited to 3 attempts per hour
- Non-enumerable: same response whether email exists or not
- DKIM-signed emails via postfix/opendkim
2026-02-14 19:26:47 +00:00

43 lines
1.6 KiB
TypeScript

import nodemailer from "nodemailer";
const transporter = nodemailer.createTransport({
host: process.env.SMTP_HOST || "host.docker.internal",
port: Number(process.env.SMTP_PORT || 25),
secure: false,
connectionTimeout: 5000,
greetingTimeout: 5000,
socketTimeout: 10000,
tls: { rejectUnauthorized: false },
});
export async function sendVerificationEmail(email: string, code: string): Promise<boolean> {
try {
const info = await transporter.sendMail({
from: "DocFast <noreply@docfast.dev>",
to: email,
subject: "DocFast - Verify your email",
text: `Your DocFast verification code is: ${code}\n\nThis code expires in 15 minutes.\n\nIf you didn't sign up for DocFast, ignore this email.`,
});
console.log(`📧 Verification email sent to ${email}: ${info.messageId}`);
return true;
} catch (err) {
console.error(`📧 Failed to send verification email to ${email}:`, err);
return false;
}
}
export async function sendRecoveryEmail(email: string, apiKey: string): Promise<boolean> {
try {
const info = await transporter.sendMail({
from: "DocFast <noreply@docfast.dev>",
to: email,
subject: "DocFast - Your API Key Recovery",
text: `Here is your DocFast API key:\n\n${apiKey}\n\nKeep this key safe. Do not share it with anyone.\n\nIf you didn't request this recovery, please ignore this email — your key has not been changed.`,
});
console.log(`📧 Recovery email sent to ${email}: ${info.messageId}`);
return true;
} catch (err) {
console.error(`📧 Failed to send recovery email to ${email}:`, err);
return false;
}
}