RunicGateway/docs
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request 'Modernize email: Gmail OAuth2 sending + admin sidebar redesign' (#46) from feature/email-oauth2 into main

Browse Source 
Reviewed-on: UOM/website#46
Reviewed-by: Colby Whitlock <whitlocktech@gmail.com>
This commit is contained in:
Colby Whitlock
2026-07-08 03:33:42 +00:00
parent fb5f236f5f efe17d2965
commit 47737dbf86
1 changed files with 8 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
website/BACKEND_DESIGN.md
View File

@@ -234,10 +234,13 @@ who"; `activity_log` provides the history feed.
## 7. Email ## 7. Email
`utils/mailer.js` (nodemailer) configured from `SMTP_HOST/PORT/USER/PASS`, sending to `utils/mailer.js` (nodemailer) sends through **Gmail over OAuth2 (SMTP XOAUTH2)**, configured in
`CONTACT_TO` (default UOMysticmoon@gmail.com). No Gmail password in code — env only. Admin → Settings → Email — not env. The mailbox is authorized by an in-app "Connect Gmail" consent
If SMTP is unconfigured, `POST /public/contact` returns `{fallback:"mailto", email}` so the flow (`/admin/email/*`) that captures a refresh token, stored AES-GCM-encrypted in the `email_config`
client renders a `mailto:` link instead. Site mode changes / errors never leak SMTP creds. singleton (never returned over the API). The OAuth client id/secret are reused from the `google`
auth-providers row. Recipient is the `contact_email` site setting. If email is unconfigured/disabled,
`POST /public/contact` returns `{fallback:"mailto", email}` so the client renders a `mailto:` link
instead. Errors never leak credentials.
--- ---
@@ -287,11 +290,7 @@ COOKIE_SECURE=true
COOKIE_NAME=uomm_token COOKIE_NAME=uomm_token
ADMIN_USERNAME= ADMIN_USERNAME=
ADMIN_PASSWORD= ADMIN_PASSWORD=
SMTP_HOST= # Email: configured in Admin → Settings → Email (Gmail OAuth2), not via env
SMTP_PORT=587
SMTP_USER=
SMTP_PASS=
CONTACT_TO=UOMysticmoon@gmail.com
CLIENT_ORIGIN=http://localhost:5173 CLIENT_ORIGIN=http://localhost:5173
``` ```