Files
accounted/components/settings/InvoiceSenderDomainSettings.tsx
T
Mattsson 0040cadacc feat(invoicing): opt-in invoice email from the company's own sending domain (#1802)
* feat(invoicing): opt-in invoice email from the company's own sending domain

Companies holding the custom_sender_domain capability grant can register
their own domain (Resend sending-only profile), publish DKIM/SPF, and once
verified every invoice email (send, reminders, recurring, payment
confirmation, MCP/v1 sends) leaves as "<name> <faktura@their-domain>"
instead of the platform sender. Reply-To is unchanged.

- New table company_sending_domains (RLS: members read, owner/admin write;
  audit trigger), types, archive-export classification.
- New capability key custom_sender_domain: manually granted per company,
  deliberately outside PAID_CAPABILITIES (never trial-seeded, never written
  by the Stripe sync). Without the grant the settings section is hidden and
  nothing changes.
- Email extension: sending-domain routes (GET/POST/PATCH/DELETE, verify),
  Resend domain lifecycle without orphan adoption, domain.updated handling
  on the delivery webhook, explicit From support in the Resend adapter.
- Core resolveInvoiceSender(): verified + enabled + entitled, else the
  platform sender; never throws.
- Settings -> Invoicing: "Avsändare vid fakturautskick" section (sv/en).
- Unit tests for the resolver, domain helpers, routes, From header; pg-real
  test for RLS and constraints.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(invoicing): harden sending-domain writes, sender fallback, review findings

Skeptic refutations:
- Tenant JWTs could insert/update company_sending_domains with status =
  'verified' and an arbitrary domain through PostgREST (RLS only checked
  membership), then send invoice mail as that domain. New migration
  20260822130000 adds a BEFORE trigger: tenants may only open a pending
  claim and edit sender_local_part/sender_name/enabled; domain and
  verification state are service-role only. claim/verify helpers now take
  a service-role writer for those columns; the route's RLS client still
  does the insert.
- A company domain Resend later rejects made every invoice send fail: the
  Resend adapter retries once as the platform sender when an explicit
  company From is rejected (nothing was sent, so no double send).

Review findings:
- domain.updated webhook: discriminated outcome; DB errors answer 500 so
  Svix retries, unknown domains are acknowledged.
- Display names are RFC 5322-quoted only when they carry specials.
- Sender local part is a strict dot-atom (no trailing/consecutive dots),
  in code and in the CHECK constraint; resend_domain_id index is UNIQUE.
- IME composition guard on the claim input; event bus reset in tests;
  settings section skips its request for non-admins.

Deferred (needs a product call): persisting the effective From address in
the invoice delivery log touches the hardened evidence triggers; recorded
in DECISIONS.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(invoicing): bind sending-domain verification to the claimed domain; fix pg test

Skeptic re-check found a TOCTOU: during the claim's Resend round-trip a
tenant could delete and re-insert its pending row under the same id with a
reserved domain, and the service-role writer updated by id alone. Now:
- the claim's verification-state write filters on (id, company_id, domain,
  resend_domain_id IS NULL) and rolls back on zero rows;
- verify and the domain.updated webhook compare Resend's domain name with
  the row before writing verified;
- resolveInvoiceSender refuses reserved platform domains and non-hostnames
  at send time (reserved-domain logic moved to lib/email/domain-name.ts and
  shared with the claim validator).

pg-real: the case-insensitive uniqueness assertion now expects the
domain_shape CHECK (lowercase enforced) for an uppercase variant and the
unique index for a same-case duplicate.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-23 00:07:30 +02:00

383 lines
15 KiB
TypeScript

'use client'
import { useCallback, useEffect, useState } from 'react'
import { useTranslations } from 'next-intl'
import { Badge } from '@/components/ui/badge'
import { Button } from '@/components/ui/button'
import { Input } from '@/components/ui/input'
import { Switch } from '@/components/ui/switch'
import { Skeleton } from '@/components/ui/skeleton'
import { useToast } from '@/components/ui/use-toast'
import { Check, Copy, Loader2, RefreshCw, Trash2 } from 'lucide-react'
import {
SettingsGroup,
SettingsRow,
SettingsRowNote,
} from '@/components/settings/SettingsRows'
import type { CompanySendingDomain, SendingDomainDnsRecord } from '@/types'
import { getErrorMessage as getUserErrorMessage, type ErrorLocale } from '@/lib/errors/get-error-message'
import { useFormat } from '@/lib/hooks/use-format'
import { useCompany } from '@/contexts/CompanyContext'
import { copyToClipboard } from '@/lib/browser/copy-to-clipboard'
const BASE = '/api/extensions/ext/email/sending-domain'
const STATUS_VARIANT: Record<CompanySendingDomain['status'], 'secondary' | 'success' | 'destructive'> = {
pending: 'secondary',
verified: 'success',
failed: 'destructive',
}
/**
* Opt-in "send invoice email from our own domain" section. Rendered only
* when the company holds the capability grant: the GET answers 403
* capability_blocked otherwise and the section renders nothing, so every
* other company keeps the unchanged invoicing settings page.
*
* Three states: no domain (claim form), pending (DNS records + re-check),
* verified (sender address/name, pause toggle). Everything that touches the
* From header is decided server-side; this surface only manages the claim.
*/
export function InvoiceSenderDomainSettings({ companyName }: { companyName: string | null }) {
const t = useTranslations('settings_invoice_sender_domain')
const { toast } = useToast()
const { locale, formatDateLong } = useFormat()
const errorLocale = locale as ErrorLocale
const { role } = useCompany()
const canManage = role === 'owner' || role === 'admin'
const [available, setAvailable] = useState(false)
const [isLoading, setIsLoading] = useState(true)
const [loadFailed, setLoadFailed] = useState(false)
const [domain, setDomain] = useState<CompanySendingDomain | null>(null)
const [domainInput, setDomainInput] = useState('')
const [localPart, setLocalPart] = useState('faktura')
const [senderName, setSenderName] = useState('')
const [isClaiming, setIsClaiming] = useState(false)
const [isChecking, setIsChecking] = useState(false)
const [isSaving, setIsSaving] = useState(false)
const [isRemoving, setIsRemoving] = useState(false)
const applyRow = useCallback((row: CompanySendingDomain | null) => {
setDomain(row)
setLocalPart(row?.sender_local_part ?? 'faktura')
setSenderName(row?.sender_name ?? '')
}, [])
const fetchDomain = useCallback(async () => {
setIsLoading(true)
setLoadFailed(false)
try {
const res = await fetch(BASE)
if (res.status === 403 || res.status === 404) {
// Not opted in (no capability grant) or extension not mounted:
// stay invisible rather than advertise a feature the company lacks.
setAvailable(false)
return
}
if (!res.ok) {
setAvailable(true)
setLoadFailed(true)
return
}
const json = await res.json()
setAvailable(true)
applyRow(json.data ?? null)
} catch {
setAvailable(true)
setLoadFailed(true)
} finally {
setIsLoading(false)
}
}, [applyRow])
useEffect(() => {
// Only owners/admins can ever see the section: skip the request (and its
// capability lookups) for everyone else.
if (!canManage) return
void fetchDomain()
}, [canManage, fetchDomain])
const fail = useCallback(
(title: string, err: unknown) => {
toast({
title,
description: err instanceof Error ? getUserErrorMessage(err, { locale: errorLocale }) : t('try_again'),
variant: 'destructive',
})
},
[errorLocale, t, toast],
)
const handleClaim = useCallback(async () => {
if (!domainInput.trim()) return
setIsClaiming(true)
try {
const res = await fetch(BASE, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ domain: domainInput }),
})
const json = await res.json()
if (!res.ok) throw new Error(json.error ?? t('claim_error_title'))
applyRow(json.data)
setDomainInput('')
toast({ title: t('claim_success_title'), description: t('claim_success_description') })
} catch (err) {
fail(t('claim_error_title'), err)
} finally {
setIsClaiming(false)
}
}, [applyRow, domainInput, fail, t, toast])
const handleVerify = useCallback(async () => {
setIsChecking(true)
try {
const res = await fetch(`${BASE}/verify`, { method: 'POST' })
const json = await res.json()
if (!res.ok) throw new Error(json.error ?? t('verify_error_title'))
applyRow(json.data)
toast(
json.data.status === 'verified'
? { title: t('verify_success_title'), description: t('verify_success_description') }
: { title: t('verify_pending_title'), description: t('verify_pending_description') },
)
} catch (err) {
fail(t('verify_error_title'), err)
} finally {
setIsChecking(false)
}
}, [applyRow, fail, t, toast])
const patch = useCallback(
async (body: { sender_local_part?: string; sender_name?: string | null; enabled?: boolean }) => {
setIsSaving(true)
try {
const res = await fetch(BASE, {
method: 'PATCH',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify(body),
})
const json = await res.json()
if (!res.ok) throw new Error(json.error ?? t('save_error_title'))
applyRow(json.data)
toast({ title: t('saved_title') })
} catch (err) {
fail(t('save_error_title'), err)
} finally {
setIsSaving(false)
}
},
[applyRow, fail, t, toast],
)
const handleSaveSender = useCallback(() => {
const name = senderName.trim()
void patch({ sender_local_part: localPart.trim(), sender_name: name ? name : null })
}, [localPart, patch, senderName])
const handleRemove = useCallback(async () => {
if (!domain) return
if (!confirm(t('remove_confirm', { domain: domain.domain }))) return
setIsRemoving(true)
try {
const res = await fetch(BASE, { method: 'DELETE' })
const json = await res.json()
if (!res.ok) throw new Error(json.error ?? t('remove_error_title'))
applyRow(null)
toast({ title: t('remove_success_title') })
} catch (err) {
fail(t('remove_error_title'), err)
} finally {
setIsRemoving(false)
}
}, [applyRow, domain, fail, t, toast])
const handleCopy = useCallback(
async (value: string) => {
const result = await copyToClipboard(value)
toast(
result === 'copied'
? { title: t('copied') }
: { title: t('copy_failed_title'), description: t('copy_failed_description'), variant: 'destructive' },
)
},
[t, toast],
)
if (!canManage) return null
// Stay invisible until the opt-in is confirmed: no skeleton flash for the
// companies that do not hold the grant (i.e. almost all of them).
if (!available) return null
const records: SendingDomainDnsRecord[] = domain?.dns_records ?? []
const statusLabels: Record<CompanySendingDomain['status'], string> = {
pending: t('status_pending'),
verified: t('status_verified'),
failed: t('status_failed'),
}
const effectiveName = (domain?.sender_name ?? companyName ?? '').trim()
const previewAddress = domain ? `${domain.sender_local_part}@${domain.domain}` : ''
return (
<SettingsGroup label={t('heading')} help={t('description')}>
{isLoading ? (
<div className="space-y-3 px-1 py-3">
<Skeleton className="h-8 w-full" />
<Skeleton className="h-16 w-full" />
</div>
) : loadFailed ? (
<div role="status" className="flex items-center justify-between gap-4 px-1 py-3 text-sm">
<p className="text-muted-foreground">{t('load_error')}</p>
<Button variant="outline" size="sm" onClick={() => void fetchDomain()}>
{t('retry')}
</Button>
</div>
) : !domain ? (
<>
<SettingsRow label={t('domain_label')} htmlFor="invoice-sender-domain" help={t('domain_hint')}>
<Input
id="invoice-sender-domain"
value={domainInput}
onChange={(e) => setDomainInput(e.target.value)}
placeholder="dittbolag.se"
className="max-w-xs"
onKeyDown={(e) => {
if (e.nativeEvent.isComposing) return
if (e.key === 'Enter') void handleClaim()
}}
/>
<Button size="sm" onClick={() => void handleClaim()} disabled={isClaiming || !domainInput.trim()}>
{isClaiming ? <Loader2 className="mr-2 h-4 w-4 animate-spin" /> : null}
{t('add_button')}
</Button>
</SettingsRow>
<SettingsRowNote className="block px-1 pt-2">{t('fallback_note')}</SettingsRowNote>
</>
) : (
<>
<SettingsRow label={t('domain_label')}>
<code className="truncate font-mono text-sm">{domain.domain}</code>
<Badge variant={STATUS_VARIANT[domain.status]}>{statusLabels[domain.status]}</Badge>
<div className="ml-auto flex shrink-0 items-center gap-2">
<Button variant="outline" size="sm" onClick={() => void handleVerify()} disabled={isChecking}>
{isChecking ? (
<Loader2 className="mr-1.5 h-3.5 w-3.5 animate-spin" />
) : (
<RefreshCw className="mr-1.5 h-3.5 w-3.5" />
)}
{t('check_again')}
</Button>
<Button
variant="outline"
size="icon"
onClick={() => void handleRemove()}
disabled={isRemoving}
aria-label={t('remove_aria')}
>
{isRemoving ? <Loader2 className="h-3.5 w-3.5 animate-spin" /> : <Trash2 className="h-3.5 w-3.5" />}
</Button>
</div>
</SettingsRow>
{domain.status === 'verified' ? (
<>
<SettingsRow label={t('enabled_label')} help={t('enabled_hint')}>
<Switch
checked={domain.enabled}
disabled={isSaving}
onCheckedChange={(checked) => void patch({ enabled: checked })}
aria-label={t('enabled_label')}
/>
<SettingsRowNote>{domain.enabled ? t('enabled_on') : t('enabled_off')}</SettingsRowNote>
</SettingsRow>
<SettingsRow label={t('address_label')} htmlFor="invoice-sender-local-part" help={t('address_hint')}>
<Input
id="invoice-sender-local-part"
value={localPart}
onChange={(e) => setLocalPart(e.target.value)}
className="max-w-[10rem] font-mono"
/>
<span className="font-mono text-sm text-muted-foreground">@{domain.domain}</span>
</SettingsRow>
<SettingsRow label={t('name_label')} htmlFor="invoice-sender-name" help={t('name_hint')}>
<Input
id="invoice-sender-name"
value={senderName}
onChange={(e) => setSenderName(e.target.value)}
placeholder={companyName ?? ''}
className="max-w-xs"
/>
</SettingsRow>
<div className="flex items-start gap-3 rounded-lg border border-border p-4 text-sm">
<Check className="mt-0.5 h-4 w-4 shrink-0 text-muted-foreground" />
<div className="space-y-1">
<p className="font-medium">
{t('preview_label')}{' '}
<code className="font-mono text-xs">
{effectiveName ? `${effectiveName} <${previewAddress}>` : previewAddress}
</code>
</p>
<p className="text-muted-foreground">
{domain.verified_at
? t('verified_description_with_date', { date: formatDateLong(domain.verified_at) })
: t('verified_description')}
</p>
</div>
</div>
<div className="flex justify-end px-1 pt-4">
<Button type="button" size="sm" onClick={handleSaveSender} disabled={isSaving}>
{isSaving ? t('saving') : t('save')}
</Button>
</div>
</>
) : (
<div className="space-y-3 px-1 py-3">
<p className="text-sm text-muted-foreground">{t('dns_instructions')}</p>
{records.length > 0 ? (
<div className="overflow-x-auto rounded-lg border border-border">
<table className="w-full text-sm">
<thead>
<tr className="border-b border-border">
<th className="px-3 py-2 text-left text-[11px] font-medium uppercase tracking-wider text-muted-foreground">{t('dns_type')}</th>
<th className="px-3 py-2 text-left text-[11px] font-medium uppercase tracking-wider text-muted-foreground">{t('dns_name')}</th>
<th className="px-3 py-2 text-left text-[11px] font-medium uppercase tracking-wider text-muted-foreground">{t('dns_value')}</th>
<th className="px-3 py-2 text-left text-[11px] font-medium uppercase tracking-wider text-muted-foreground">{t('dns_status')}</th>
<th className="px-3 py-2" />
</tr>
</thead>
<tbody>
{records.map((r, i) => (
<tr key={`${r.type}-${r.name}-${i}`} className="border-b border-border last:border-0">
<td className="px-3 py-2 font-mono text-xs">{r.type}</td>
<td className="px-3 py-2 font-mono text-xs break-all">{r.name}</td>
<td className="px-3 py-2 font-mono text-xs break-all">{r.value}</td>
<td className="px-3 py-2 font-mono text-xs">{r.status}</td>
<td className="px-3 py-2 text-right">
<Button
type="button"
variant="ghost"
size="icon"
onClick={() => void handleCopy(r.value)}
aria-label={t('copy_record_aria', { type: r.type })}
>
<Copy className="h-3.5 w-3.5" />
</Button>
</td>
</tr>
))}
</tbody>
</table>
</div>
) : (
<p className="text-sm text-muted-foreground">{t('dns_empty')}</p>
)}
<SettingsRowNote className="block">{t('fallback_note')}</SettingsRowNote>
</div>
)}
</>
)}
</SettingsGroup>
)
}