chore: change postman credentials (#812)

## Problem

Right now, email is sent from `[email protected]` but we want to
change it to `[email protected]`

## Solution

Introduce a flag on LD to toggle between the old and new credentials
- Turn on to use new credentials
- This is in case the new credentials don't work, can easily use back
the old credentials

Created a new group email: [email protected], and ensured that two API
keys are created for staging and prod respectively, with the rate limit
of 250 applied to the user.

## TODO
- [x] Add to parameter store for staging and prod

## Tests
- [x] Check that email can be sent through test step
- [x] Check that OTP email can be sent
- [x] Check that blacklist and error emails can be sent

**New environment variables**:

- `POSTMAN_OLD_FROM_ADDRESS` : [email protected] (this is the
old from address)
- `POSTMAN_OLD_API_KEY`: for staging and prod

Author: m0nggh

ecs/env.json

@@ -34,6 +34,10 @@
     },
     {
       "name": "POSTMAN_FROM_ADDRESS",
+      "value": "[email protected]"
+    },
+    {
+      "name": "POSTMAN_OLD_FROM_ADDRESS",
       "value": "[email protected]"
     },
     {
@@ -110,6 +114,10 @@
       "name": "POSTMAN_API_KEY",
       "valueFrom": "plumber-<ENVIRONMENT>-postman-api-key"
     },
+    {
+      "name": "POSTMAN_OLD_API_KEY",
+      "valueFrom": "plumber-<ENVIRONMENT>-postman-old-api-key"
+    },
     {
       "name": "FORMSG_API_KEY",
       "valueFrom": "plumber-formsg-api-key"

packages/backend/.env-example

@@ -20,6 +20,7 @@ REDIS_CLUSTER_MODE=false
 ENABLE_BULLMQ_DASHBOARD=false
 [email protected]
 POSTMAN_API_KEY=api_key
+POSTMAN_OLD_API_KEY=api_key
 FORMSG_API_KEY=sample-formsg-api-key
 FORMSG_STAGING_API_KEY=sample-formsg-api-key
 FORMSG_UAT_API_KEY=sample-formsg-api-key

packages/backend/src/apps/postman/__tests__/actions/send-transactional-email.test.ts

@@ -14,6 +14,7 @@ const mocks = vi.hoisted(() => ({
   getObjectFromS3Id: vi.fn(),
   getDefaultReplyTo: vi.fn(() => '[email protected]'),
   sendBlacklistEmail: vi.fn(),
+  getLdFlagValue: vi.fn(),
 }))
 
 vi.mock('@/helpers/s3', async () => {
@@ -36,6 +37,10 @@ vi.mock('../../common/send-blacklist-email', () => ({
   createRequestBlacklistFormLink: vi.fn(),
 }))
 
+vi.mock('@/helpers/launch-darkly', () => ({
+  getLdFlagValue: mocks.getLdFlagValue,
+}))
+
 describe('send transactional email', () => {
   let $: IGlobalVariable
 

packages/backend/src/apps/postman/common/email-helper.ts

@@ -5,6 +5,7 @@ import { sortBy } from 'lodash'
 
 import appConfig from '@/config/app'
 import HttpError from '@/errors/http'
+import { getLdFlagValue } from '@/helpers/launch-darkly'
 
 import {
   PostmanEmailDataOut,
@@ -79,14 +80,24 @@ export async function sendTransactionalEmails(
   errorStatus?: PostmanEmailSendStatus
   error?: HttpError
 }> {
+  const shouldUseNewCredentials = await getLdFlagValue<boolean>(
+    'new_postman_credentials',
+    '[email protected]', // mock email
+    false,
+  )
+
   const promises = recipients.map(async (recipientEmail) => {
     const requestData = new FormData()
     requestData.append('subject', email.subject)
     requestData.append('body', email.body)
     requestData.append('recipient', recipientEmail)
     requestData.append(
       'from',
-      `${email.senderName} <${appConfig.postman.fromAddress}>`,
+      `${email.senderName} <${
+        shouldUseNewCredentials
+          ? appConfig.postman.fromAddress
+          : appConfig.postman.oldFromAddress
+      }>`,
     )
     requestData.append('disable_tracking', 'true')
     if (email.ccList?.length > 0) {
@@ -112,7 +123,11 @@ export async function sendTransactionalEmails(
         {
           headers: {
             ...requestData.getHeaders(),
-            Authorization: `Bearer ${appConfig.postman.apiKey}`,
+            Authorization: `Bearer ${
+              shouldUseNewCredentials
+                ? appConfig.postman.apiKey
+                : appConfig.postman.oldApiKey
+            }`,
           },
         },
       )

packages/backend/src/config/app.ts

@@ -36,6 +36,8 @@ type AppConfig = {
     apiKey: string
     fromAddress: string
     rateLimit: number
+    oldApiKey: string
+    oldFromAddress: string
   }
   isWorker: boolean
   workerActionConcurrency: number
@@ -100,9 +102,11 @@ const appConfig: AppConfig = {
   },
   postman: {
     apiKey: process.env.POSTMAN_API_KEY,
-    fromAddress:
-      process.env.POSTMAN_FROM_ADDRESS || '[email protected]',
+    fromAddress: process.env.POSTMAN_FROM_ADDRESS || '[email protected]',
     rateLimit: parseInt(process.env.POSTMAN_RATE_LIMIT) || 169,
+    oldApiKey: process.env.POSTMAN_OLD_API_KEY,
+    oldFromAddress:
+      process.env.POSTMAN_OLD_FROM_ADDRESS || '[email protected]',
   },
   launchDarklySdkKey: process.env.LAUNCH_DARKLY_SDK_KEY,
   maxJobAttempts: Number(process.env.MAX_JOB_ATTEMPTS ?? '10'),
@@ -124,6 +128,10 @@ if (!appConfig.postman.apiKey) {
   throw new Error('POSTMAN_API_KEY environment variable needs to be set!')
 }
 
+if (!appConfig.postman.oldApiKey) {
+  throw new Error('POSTMAN_OLD_API_KEY environment variable needs to be set!')
+}
+
 if (
   !appConfig.sgid ||
   !appConfig.sgid.clientId ||

packages/backend/src/helpers/send-email.ts

@@ -3,6 +3,7 @@ import axios from 'axios'
 import appConfig from '@/config/app'
 import HttpError from '@/errors/http'
 
+import { getLdFlagValue } from './launch-darkly'
 import logger from './logger'
 
 export interface PostmanEmailRequestBody {
@@ -19,20 +20,34 @@ export async function sendEmail({
   replyTo,
 }: PostmanEmailRequestBody): Promise<void> {
   try {
+    const shouldUseNewCredentials = await getLdFlagValue<boolean>(
+      'new_postman_credentials',
+      '[email protected]', // mock email
+      false,
+    )
+
     await axios.post(
       'https://api.postman.gov.sg/v1/transactional/email/send',
       {
         subject,
         body,
         recipient,
-        from: `Plumber <${appConfig.postman.fromAddress}>`,
+        from: `Plumber <${
+          shouldUseNewCredentials
+            ? appConfig.postman.fromAddress
+            : appConfig.postman.oldFromAddress
+        }>`,
         ...(replyTo && { reply_to: replyTo }),
         disable_tracking: true,
       },
       {
         headers: {
           'Content-Type': 'application/json',
-          Authorization: `Bearer ${appConfig.postman.apiKey}`,
+          Authorization: `Bearer ${
+            shouldUseNewCredentials
+              ? appConfig.postman.apiKey
+              : appConfig.postman.oldApiKey
+          }`,
         },
       },
     )