-
-
- """.trimIndent()
- helper.setText(content, true)
-
- params.attachments.forEach {
- helper.addAttachment(it.name, it.inputStreamSource)
- }
-
- helper.addInline(
- "logo.png",
- { ClassPathResource("tolgee-logo.png").inputStream },
- "image/png",
+ val properties =
+ mapOf- Best regards, -
- Tolgee Team - """.trimIndent() } } diff --git a/backend/data/src/main/kotlin/io/tolgee/configuration/HibernateConfig.kt b/backend/data/src/main/kotlin/io/tolgee/configuration/HibernateConfig.kt new file mode 100644 index 00000000000..df265f94818 --- /dev/null +++ b/backend/data/src/main/kotlin/io/tolgee/configuration/HibernateConfig.kt @@ -0,0 +1,31 @@ +/** + * Copyright (C) 2024 Tolgee s.r.o. and contributors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package io.tolgee.configuration + +import io.hypersistence.utils.hibernate.query.QueryStackTraceLogger +import org.hibernate.cfg.AvailableSettings +import org.springframework.boot.autoconfigure.orm.jpa.HibernatePropertiesCustomizer +import org.springframework.context.annotation.Profile +import org.springframework.stereotype.Component + +@Component +@Profile("hibernate-trace") +class HibernateConfig : HibernatePropertiesCustomizer { + override fun customize(hibernateProperties: MutableMap
") + + val template = + m.replaceAll { + if (it.group(1) == null) { + // Opening tag + stack.add(it.group(2)) + + val ref = "intl-ref-${++counter}" + val fragName = "intl-${stack.joinToString("--")}" + val fragExpr = "~{ :: $fragName (~{ :: $ref }) }" + + "
") + } + + return message.replace("\n", "
") + } + + companion object { + // KISS. Matches attribute-less, non-self-closing tags. + // Reference: https://formatjs.github.io/docs/core-concepts/icu-syntax#rich-text-formatting + private val XML_PATTERN = Pattern.compile("<(/)?([a-zA-Z-]+)>") + } +} diff --git a/backend/data/src/main/kotlin/io/tolgee/email/EmailService.kt b/backend/data/src/main/kotlin/io/tolgee/email/EmailService.kt new file mode 100644 index 00000000000..122f2a8002f --- /dev/null +++ b/backend/data/src/main/kotlin/io/tolgee/email/EmailService.kt @@ -0,0 +1,118 @@ +/** + * Copyright (C) 2024 Tolgee s.r.o. and contributors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package io.tolgee.email + +import io.tolgee.configuration.tolgee.TolgeeProperties +import io.tolgee.dtos.misc.EmailAttachment +import jakarta.annotation.PostConstruct +import org.springframework.beans.factory.annotation.Qualifier +import org.springframework.context.ApplicationContext +import org.springframework.mail.javamail.JavaMailSender +import org.springframework.mail.javamail.MimeMessageHelper +import org.springframework.scheduling.annotation.Async +import org.springframework.stereotype.Service +import org.thymeleaf.TemplateEngine +import org.thymeleaf.context.Context +import org.thymeleaf.spring6.expression.ThymeleafEvaluationContext +import java.util.Locale + +@Service +class EmailService( + private val applicationContext: ApplicationContext, + private val tolgeeProperties: TolgeeProperties, + private val mailSender: JavaMailSender, + private val emailGlobalVariablesProvider: EmailGlobalVariablesProvider, + @Qualifier("emailTemplateEngine") private val templateEngine: TemplateEngine, +) { + @PostConstruct + fun validateSmtpConfiguration() { + if (tolgeeProperties.smtp.host != null && tolgeeProperties.smtp.from == null) { + throw IllegalStateException( + "SMTP host is configured but 'tolgee.smtp.from' is missing. " + + "See https://docs.tolgee.io/platform/self_hosting/configuration#smtp", + ) + } + } + + private val smtpFrom + get() = + tolgeeProperties.smtp.from + ?: throw IllegalStateException( + "SMTP sender is not configured. " + + "See https://docs.tolgee.io/platform/self_hosting/configuration#smtp", + ) + + @Async + fun sendEmailTemplate( + recipient: String, + template: String, + locale: Locale, + properties: Map
\ -{0}\ -
\ -If you want to unsubscribe from these emails, please check the notifications settings page.\ -
\ -Regards,
\ -Tolgee +If you want to unsubscribe from these emails, please check the notifications settings page. notifications.email.view-in-tolgee-link=View in Tolgee diff --git a/backend/data/src/test/kotlin/io/tolgee/email/EmailGlobalVariablesProviderTest.kt b/backend/data/src/test/kotlin/io/tolgee/email/EmailGlobalVariablesProviderTest.kt new file mode 100644 index 00000000000..cffd5e85faa --- /dev/null +++ b/backend/data/src/test/kotlin/io/tolgee/email/EmailGlobalVariablesProviderTest.kt @@ -0,0 +1,101 @@ +/** + * Copyright (C) 2025 Tolgee s.r.o. and contributors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package io.tolgee.email + +import io.tolgee.component.FrontendUrlProvider +import io.tolgee.component.publicBillingConfProvider.PublicBillingConfProvider +import io.tolgee.configuration.tolgee.TolgeeProperties +import io.tolgee.dtos.response.PublicBillingConfigurationDTO +import io.tolgee.email.EmailGlobalVariablesProvider.Companion.SELF_HOSTED_DEFAULT_QUALIFIER +import io.tolgee.testing.assert +import org.junit.jupiter.api.Test +import org.mockito.kotlin.whenever +import org.springframework.beans.factory.annotation.Autowired +import org.springframework.test.context.bean.override.mockito.MockitoBean +import org.springframework.test.context.junit.jupiter.SpringJUnitConfig + +@SpringJUnitConfig(EmailGlobalVariablesProvider::class) +class EmailGlobalVariablesProviderTest { + @MockitoBean + private lateinit var publicBillingConfProvider: PublicBillingConfProvider + + @MockitoBean + private lateinit var tolgeeProperties: TolgeeProperties + + @MockitoBean + private lateinit var frontendUrlProvider: FrontendUrlProvider + + @Autowired + private lateinit var emailGlobalVariablesProvider: EmailGlobalVariablesProvider + + @Test + fun `it returns the correct properties based on config in cloud`() { + whenever(publicBillingConfProvider.invoke()).thenReturn(PublicBillingConfigurationDTO(true)) + whenever(tolgeeProperties.appName).thenReturn("Tolgee Test Edition") + whenever(tolgeeProperties.backEndUrl).thenReturn("https://tolgee.test") + + emailGlobalVariablesProvider() + .assert + .containsEntry("isCloud", true) + .containsEntry("instanceQualifier", "Tolgee Test Edition") + .containsEntry("backendUrl", "https://tolgee.test") + .hasSize(3) + } + + @Test + fun `it returns the correct properties based on config in self-hosted`() { + whenever(publicBillingConfProvider.invoke()).thenReturn(PublicBillingConfigurationDTO(false)) + whenever(tolgeeProperties.appName).thenReturn("Tolgee Test Edition") + whenever(tolgeeProperties.backEndUrl).thenReturn("https://tolgee.test") + + emailGlobalVariablesProvider() + .assert + .containsEntry("isCloud", false) + .containsEntry("instanceQualifier", "tolgee.test") + .containsEntry("backendUrl", "https://tolgee.test") + .hasSize(3) + } + + @Test + fun `it gracefully handles bad frontend url configuration`() { + whenever(publicBillingConfProvider.invoke()).thenReturn(PublicBillingConfigurationDTO(false)) + whenever(tolgeeProperties.appName).thenReturn("Tolgee Test Edition") + whenever(tolgeeProperties.backEndUrl).thenReturn("https:/tolgee.test") + + emailGlobalVariablesProvider() + .assert + .containsEntry("isCloud", false) + .containsEntry("instanceQualifier", SELF_HOSTED_DEFAULT_QUALIFIER) + .containsEntry("backendUrl", "https:/tolgee.test") + .hasSize(3) + } + + @Test + fun `it gracefully handles missing frontend url configuration`() { + // That's a pathological situation to be in... but it can happen... :shrug: + whenever(publicBillingConfProvider.invoke()).thenReturn(PublicBillingConfigurationDTO(false)) + whenever(tolgeeProperties.appName).thenReturn("Tolgee Test Edition") + whenever(tolgeeProperties.frontEndUrl).thenReturn(null) + + emailGlobalVariablesProvider() + .assert + .containsEntry("isCloud", false) + .containsEntry("instanceQualifier", SELF_HOSTED_DEFAULT_QUALIFIER) + .containsEntry("backendUrl", null) + .hasSize(3) + } +} diff --git a/backend/data/src/test/kotlin/io/tolgee/email/EmailServiceTest.kt b/backend/data/src/test/kotlin/io/tolgee/email/EmailServiceTest.kt new file mode 100644 index 00000000000..491b8d4366b --- /dev/null +++ b/backend/data/src/test/kotlin/io/tolgee/email/EmailServiceTest.kt @@ -0,0 +1,289 @@ +/** + * Copyright (C) 2024 Tolgee s.r.o. and contributors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package io.tolgee.email + +import io.tolgee.configuration.tolgee.TolgeeProperties +import io.tolgee.testing.assert +import jakarta.mail.internet.MimeMessage +import jakarta.mail.internet.MimeMultipart +import org.assertj.core.api.AbstractStringAssert +import org.junit.jupiter.api.BeforeEach +import org.junit.jupiter.api.Test +import org.junit.jupiter.api.extension.ExtendWith +import org.mockito.ArgumentCaptor +import org.mockito.Captor +import org.mockito.junit.jupiter.MockitoExtension +import org.mockito.kotlin.verify +import org.mockito.kotlin.whenever +import org.springframework.beans.factory.annotation.Autowired +import org.springframework.mail.javamail.JavaMailSender +import org.springframework.mail.javamail.JavaMailSenderImpl +import org.springframework.test.context.bean.override.mockito.MockitoBean +import org.springframework.test.context.junit.jupiter.SpringJUnitConfig +import java.util.Locale + +@ExtendWith(MockitoExtension::class) +@SpringJUnitConfig(EmailService::class, EmailTemplateConfig::class, EmailTemplateTestConfig::class) +class EmailServiceTest { + @Autowired + private lateinit var tolgeeProperties: TolgeeProperties + + @MockitoBean + private lateinit var mailSender: JavaMailSender + + @MockitoBean + private lateinit var emailGlobalVariablesProvider: EmailGlobalVariablesProvider + + @Autowired + private lateinit var emailService: EmailService + + @Captor + private lateinit var emailCaptor: ArgumentCaptor
Your project has been updated.
", + "recipientName" to "Alice", + ), + subject = "Project Update", + ) + verify(mailSender).send(emailCaptor.capture()) + + val email = emailCaptor.value + email.subject.assert.isEqualTo("Project Update") + email + .assertContents() + // Header is rendered + .contains("Important Update") + // Content is injected as HTML + .contains("Your project has been updated.
") + // Personalized greeting branch is taken (recipientName is set) + // Note: the i18n key 'email-greetings' uses {username} as ICU param + .doesNotContain("Hello!") + // Signature + .contains("Kind Regards,") + // No unresolved Thymeleaf attributes + .doesNotContain(" th:") + .doesNotContain(" data-th") + .doesNotContain("[DEFAULT]") + } + + @Test + fun `default template renders generic greeting without recipientName`() { + emailService.sendEmailTemplate( + "test@tolgee.test", + "default", + Locale.ENGLISH, + mapOf( + "content" to "Some notification text.", + ), + subject = "Notification", + ) + verify(mailSender).send(emailCaptor.capture()) + + emailCaptor.value + .assertContents() + // Falls back to generic greeting + .contains("Hello!") + .doesNotContain("Hello Alice") + .doesNotContain(" th:") + .doesNotContain(" data-th") + .doesNotContain("[DEFAULT]") + } + + @Test + fun `registration-confirm template renders for signup`() { + emailService.sendEmailTemplate( + "test@tolgee.test", + "registration-confirm", + Locale.ENGLISH, + mapOf( + "username" to "bob@example.com", + "confirmUrl" to "https://app.tolgee.io/verify/123/abc", + "isSignup" to true, + ), + ) + verify(mailSender).send(emailCaptor.capture()) + + val email = emailCaptor.value + email.subject.assert.isEqualTo("Confirm your account") + email + .assertContents() + // Greeting with username + .contains("Hello bob@example.com") + // Welcome text shown for signup + .contains("Welcome and thank you for creating an account!") + // Confirm email text + .contains("To start using Tolgee, you need to confirm your email.") + // CTA button + .contains("Confirm my email") + // Confirmation URL in link + .contains("https://app.tolgee.io/verify/123/abc") + // Enjoy your stay + .contains("enjoy your experience") + // Signature + .contains("Kind Regards,") + // No unresolved Thymeleaf + .doesNotContain(" th:") + .doesNotContain(" data-th") + .doesNotContain("[DEFAULT]") + } + + private fun MimeMessage.assertContents(): AbstractStringAssert<*> { + return this.content + .let { it as MimeMultipart } + .let { it.getBodyPart(0).content as MimeMultipart } + .let { it.getBodyPart(0).content as String } + .assert + } + + companion object { + private val TEST_PROPERTIES = + mapOf( + "testVar" to "test!!", + "testList" to + listOf( + mapOf("name" to "Name #1"), + mapOf("name" to "Name #2"), + mapOf("name" to "Name #3"), + ), + "tolgee" to "Tolgee", + "header" to "Test header from var", + ) + + private val TEST_PROPERTIES_MEOW = + mapOf( + "testVar" to "meow", + "testList" to + listOf( + mapOf("name" to "Name #1"), + mapOf("name" to "Name #2"), + mapOf("name" to "Name #3"), + ), + ) + + private val TEST_PROPERTIES_INJECT = + mapOf( + "testVar" to "totally legit textpwn[[\${7*7}]]", + "testList" to emptyList`. This is handled by the previewer, and must be correctly +handled by the renderer (by replacing all newlines from ICU format output by `
`). + +HTML injection attacks are prevented by Thymeleaf and the template pre-processing, by making sure variables are always +escaped by default (via `Var` or an ICU string). + +### `` +Injects a variable as plaintext. Easy, simple. Only useful when a variable is used outside an ICU string. + +It takes the following arguments: +- `variable` (required): name of the variable +- `demoValue` (required): value used for the preview +- `dangerouslyInjectValueAsHtmlWithoutSanitization` (optional): whether to inject this variable as raw HTML. **VERY DANGEROUS. WILL LEAD TO XSS ATTACKS IF MISUSED.** Defaults to `false` + +### `