pangolin/server/internal/auth/mailer.go

package auth

import (
	"context"
	"fmt"
	"log"
	"net/mail"
	"net/smtp"
	"strings"
)

// Mailer delivers a verification code to an email address. Implementations must
// be safe for concurrent use; Send is typically invoked from a goroutine.
type Mailer interface {
	SendCode(ctx context.Context, to, code string) error
	// SendAlreadyRegistered notifies an address that it already has an account.
	// Sent instead of a verification code when registration is attempted for an
	// existing email, so the code-send API response is uniform regardless of
	// whether the email is registered (defends against account enumeration).
	SendAlreadyRegistered(ctx context.Context, to string) error
}

// --------------------------------------------------------------------------
// SMTP implementation
// --------------------------------------------------------------------------

// SMTPConfig configures the SMTP mailer.
type SMTPConfig struct {
	Host     string // SMTP host (no port)
	Port     int    // SMTP port, e.g. 587
	Username string
	Password string
	From     string // From header, e.g. "Pangolin <no-reply@pangolin.app>"
}

// SMTPMailer sends verification codes over SMTP with STARTTLS (PlainAuth).
type SMTPMailer struct {
	cfg SMTPConfig
}

// NewSMTPMailer builds an SMTPMailer.
func NewSMTPMailer(cfg SMTPConfig) *SMTPMailer { return &SMTPMailer{cfg: cfg} }

// envelopeFrom returns the bare address used for the SMTP envelope (MAIL FROM).
// cfg.From may carry a display name ("穿山甲 <noreply@x>") for the From: header,
// but the envelope sender must be a bare address — otherwise servers reject the
// MAIL FROM with "501 Bad sender address syntax". Falls back to cfg.From when it
// is already a bare address (ParseAddress still succeeds) or unparseable.
func (m *SMTPMailer) envelopeFrom() string {
	if a, err := mail.ParseAddress(m.cfg.From); err == nil {
		return a.Address
	}
	return m.cfg.From
}

// SendCode delivers the verification code. The message body intentionally
// contains no product-identifying or destination wording beyond a neutral
// account-verification notice.
func (m *SMTPMailer) SendCode(_ context.Context, to, code string) error {
	subject := "Your verification code / 验证码"
	body := fmt.Sprintf(
		"Your verification code is %s. It expires in 10 minutes.\r\n"+
			"您的验证码为 %s，10 分钟内有效。请勿向他人泄露。\r\n",
		code, code)

	msg := strings.Join([]string{
		"From: " + m.cfg.From,
		"To: " + to,
		"Subject: " + subject,
		"MIME-Version: 1.0",
		"Content-Type: text/plain; charset=UTF-8",
		"",
		body,
	}, "\r\n")

	addr := fmt.Sprintf("%s:%d", m.cfg.Host, m.cfg.Port)
	auth := smtp.PlainAuth("", m.cfg.Username, m.cfg.Password, m.cfg.Host)
	if err := smtp.SendMail(addr, auth, m.envelopeFrom(), []string{to}, []byte(msg)); err != nil {
		return fmt.Errorf("auth: smtp send: %w", err)
	}
	return nil
}

// SendAlreadyRegistered notifies an address that it already has an account.
func (m *SMTPMailer) SendAlreadyRegistered(_ context.Context, to string) error {
	subject := "Account notice / 账号提醒"
	body := "This email already has an account. Please sign in instead of registering.\r\n" +
		"该邮箱已注册账号，请直接登录，无需重新注册。如非本人操作可忽略此邮件。\r\n"

	msg := strings.Join([]string{
		"From: " + m.cfg.From,
		"To: " + to,
		"Subject: " + subject,
		"MIME-Version: 1.0",
		"Content-Type: text/plain; charset=UTF-8",
		"",
		body,
	}, "\r\n")

	addr := fmt.Sprintf("%s:%d", m.cfg.Host, m.cfg.Port)
	auth := smtp.PlainAuth("", m.cfg.Username, m.cfg.Password, m.cfg.Host)
	if err := smtp.SendMail(addr, auth, m.envelopeFrom(), []string{to}, []byte(msg)); err != nil {
		return fmt.Errorf("auth: smtp send (already-registered): %w", err)
	}
	return nil
}

// --------------------------------------------------------------------------
// Development log implementation
// --------------------------------------------------------------------------

// LogMailer is a development-only Mailer that prints the code to the process
// log instead of sending an email. It MUST NOT be used in production — it is
// the single deliberate exception to the no-secret-in-logs rule, scoped to
// local development where no real mailbox exists.
type LogMailer struct {
	logger *log.Logger
}

// NewLogMailer builds a LogMailer. If logger is nil, the standard logger is used.
func NewLogMailer(logger *log.Logger) *LogMailer {
	return &LogMailer{logger: logger}
}

// SendCode logs the code for local development.
func (m *LogMailer) SendCode(_ context.Context, to, code string) error {
	if m.logger != nil {
		m.logger.Printf("[dev-mailer] verification code for %s: %s", to, code)
	} else {
		log.Printf("[dev-mailer] verification code for %s: %s", to, code)
	}
	return nil
}

// SendAlreadyRegistered logs an already-registered notice for local development.
func (m *LogMailer) SendAlreadyRegistered(_ context.Context, to string) error {
	if m.logger != nil {
		m.logger.Printf("[dev-mailer] already-registered notice for %s", to)
	} else {
		log.Printf("[dev-mailer] already-registered notice for %s", to)
	}
	return nil
}