feat(backend): relay contact requests to SMTP server
This commit is contained in:
513
backend/src/route/contact.rs
Normal file
513
backend/src/route/contact.rs
Normal file
@@ -0,0 +1,513 @@
|
||||
//! Contact form endpoint for handling user submissions and sending emails.
|
||||
//!
|
||||
//! This module provides functionality to:
|
||||
//! - Validate contact form submissions
|
||||
//! - Detect spam using honeypot fields
|
||||
//! - Send emails via SMTP with various TLS configurations
|
||||
|
||||
use lettre::{
|
||||
Message, SmtpTransport, Transport, message::header::ContentType,
|
||||
transport::smtp::authentication::Credentials,
|
||||
};
|
||||
use poem_openapi::{ApiResponse, Object, OpenApi, payload::Json};
|
||||
use validator::Validate;
|
||||
|
||||
use super::ApiCategory;
|
||||
use crate::settings::{EmailSettings, Starttls};
|
||||
|
||||
impl TryFrom<&EmailSettings> for SmtpTransport {
|
||||
type Error = lettre::transport::smtp::Error;
|
||||
|
||||
fn try_from(settings: &EmailSettings) -> Result<Self, Self::Error> {
|
||||
if settings.tls {
|
||||
// Implicit TLS (SMTPS) - typically port 465
|
||||
tracing::event!(target: "backend::contact", tracing::Level::DEBUG, "Using implicit TLS (SMTPS)");
|
||||
let creds = Credentials::new(settings.user.clone(), settings.password.clone());
|
||||
Ok(Self::relay(&settings.host)?
|
||||
.port(settings.port)
|
||||
.credentials(creds)
|
||||
.build())
|
||||
} else {
|
||||
// STARTTLS or no encryption
|
||||
match settings.starttls {
|
||||
Starttls::Never => {
|
||||
// For local development without TLS
|
||||
tracing::event!(target: "backend::contact", tracing::Level::DEBUG, "Using unencrypted connection");
|
||||
let builder = Self::builder_dangerous(&settings.host).port(settings.port);
|
||||
if settings.user.is_empty() {
|
||||
Ok(builder.build())
|
||||
} else {
|
||||
let creds =
|
||||
Credentials::new(settings.user.clone(), settings.password.clone());
|
||||
Ok(builder.credentials(creds).build())
|
||||
}
|
||||
}
|
||||
Starttls::Opportunistic | Starttls::Always => {
|
||||
// STARTTLS - typically port 587
|
||||
tracing::event!(target: "backend::contact", tracing::Level::DEBUG, "Using STARTTLS");
|
||||
let creds = Credentials::new(settings.user.clone(), settings.password.clone());
|
||||
Ok(Self::starttls_relay(&settings.host)?
|
||||
.port(settings.port)
|
||||
.credentials(creds)
|
||||
.build())
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Object, Validate)]
|
||||
struct ContactRequest {
|
||||
#[validate(length(
|
||||
min = 1,
|
||||
max = "100",
|
||||
message = "Name must be between 1 and 100 characters"
|
||||
))]
|
||||
name: String,
|
||||
#[validate(email(message = "Invalid email address"))]
|
||||
email: String,
|
||||
#[validate(length(
|
||||
min = 10,
|
||||
max = 5000,
|
||||
message = "Message must be between 10 and 5000 characters"
|
||||
))]
|
||||
message: String,
|
||||
/// Honeypot field - should always be empty
|
||||
#[oai(rename = "website")]
|
||||
honeypot: Option<String>,
|
||||
}
|
||||
|
||||
#[derive(Debug, Object, serde::Deserialize)]
|
||||
struct ContactResponse {
|
||||
success: bool,
|
||||
message: String,
|
||||
}
|
||||
|
||||
impl From<ContactResponse> for Json<ContactResponse> {
|
||||
fn from(value: ContactResponse) -> Self {
|
||||
Self(value)
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(ApiResponse)]
|
||||
enum ContactApiResponse {
|
||||
/// Success
|
||||
#[oai(status = 200)]
|
||||
Ok(Json<ContactResponse>),
|
||||
/// Bad Request - validation failed
|
||||
#[oai(status = 400)]
|
||||
BadRequest(Json<ContactResponse>),
|
||||
/// Too Many Requests - rate limit exceeded
|
||||
#[oai(status = 429)]
|
||||
TooManyRequests(Json<ContactResponse>),
|
||||
/// Internal Server Error
|
||||
#[oai(status = 500)]
|
||||
InternalServerError(Json<ContactResponse>),
|
||||
}
|
||||
|
||||
/// API for handling contact form submissions and sending emails.
|
||||
#[derive(Clone)]
|
||||
pub struct ContactApi {
|
||||
settings: EmailSettings,
|
||||
}
|
||||
|
||||
impl From<EmailSettings> for ContactApi {
|
||||
fn from(settings: EmailSettings) -> Self {
|
||||
Self { settings }
|
||||
}
|
||||
}
|
||||
|
||||
#[OpenApi(tag = "ApiCategory::Contact")]
|
||||
impl ContactApi {
|
||||
/// Submit a contact form
|
||||
///
|
||||
/// Send a message through the contact form. Rate limited to prevent spam.
|
||||
#[oai(path = "/contact", method = "post")]
|
||||
async fn submit_contact(
|
||||
&self,
|
||||
body: Json<ContactRequest>,
|
||||
remote_addr: Option<poem::web::Data<&poem::web::RemoteAddr>>,
|
||||
) -> ContactApiResponse {
|
||||
let body = body.0;
|
||||
if body.honeypot.is_some() {
|
||||
tracing::event!(target: "backend::contact", tracing::Level::INFO, "Honeypot triggered, rejecting request silently. IP: {}", remote_addr.map_or_else(|| "No remote address found".to_owned(), |ip| ip.0.to_string()));
|
||||
return ContactApiResponse::Ok(
|
||||
ContactResponse {
|
||||
success: true,
|
||||
message: "Message sent successfully, but not really, you bot".to_owned(),
|
||||
}
|
||||
.into(),
|
||||
);
|
||||
}
|
||||
if let Err(e) = body.validate() {
|
||||
return ContactApiResponse::BadRequest(
|
||||
ContactResponse {
|
||||
success: false,
|
||||
message: format!("Validation error: {e}"),
|
||||
}
|
||||
.into(),
|
||||
);
|
||||
}
|
||||
match self.send_email(&body).await {
|
||||
Ok(()) => {
|
||||
tracing::event!(target: "backend::contact", tracing::Level::INFO, "Message sent successfully from: {}", body.email);
|
||||
ContactApiResponse::Ok(
|
||||
ContactResponse {
|
||||
success: true,
|
||||
message: "Message sent successfully".to_owned(),
|
||||
}
|
||||
.into(),
|
||||
)
|
||||
}
|
||||
Err(e) => {
|
||||
tracing::event!(target: "backend::contact", tracing::Level::ERROR, "Failed to send email: {}", e);
|
||||
ContactApiResponse::InternalServerError(
|
||||
ContactResponse {
|
||||
success: false,
|
||||
message: "Failed to send message. Please try again later.".to_owned(),
|
||||
}
|
||||
.into(),
|
||||
)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
async fn send_email(&self, request: &ContactRequest) -> Result<(), Box<dyn std::error::Error>> {
|
||||
let email_body = format!(
|
||||
r"New contact form submission:
|
||||
|
||||
Name: {}
|
||||
Email: {},
|
||||
|
||||
Message:
|
||||
{}",
|
||||
request.name, request.email, request.message
|
||||
);
|
||||
tracing::event!(target: "email", tracing::Level::DEBUG, "Sending email content: {}", email_body);
|
||||
let email = Message::builder()
|
||||
.from(self.settings.from.parse()?)
|
||||
.reply_to(format!("{} <{}>", request.name, request.email).parse()?)
|
||||
.to(self.settings.recipient.parse()?)
|
||||
.subject(format!("Contact Form: {}", request.name))
|
||||
.header(ContentType::TEXT_PLAIN)
|
||||
.body(email_body)?;
|
||||
tracing::event!(target: "email", tracing::Level::DEBUG, "Email to be sent: {}", format!("{email:?}"));
|
||||
|
||||
let mailer = SmtpTransport::try_from(&self.settings)?;
|
||||
mailer.send(&email)?;
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
// Tests for ContactRequest validation
|
||||
#[test]
|
||||
fn contact_request_valid() {
|
||||
let request = ContactRequest {
|
||||
name: "John Doe".to_string(),
|
||||
email: "john@example.com".to_string(),
|
||||
message: "This is a test message that is long enough.".to_string(),
|
||||
honeypot: None,
|
||||
};
|
||||
assert!(request.validate().is_ok());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn contact_request_name_too_short() {
|
||||
let request = ContactRequest {
|
||||
name: String::new(),
|
||||
email: "john@example.com".to_string(),
|
||||
message: "This is a test message that is long enough.".to_string(),
|
||||
honeypot: None,
|
||||
};
|
||||
assert!(request.validate().is_err());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn contact_request_name_too_long() {
|
||||
let request = ContactRequest {
|
||||
name: "a".repeat(101),
|
||||
email: "john@example.com".to_string(),
|
||||
message: "This is a test message that is long enough.".to_string(),
|
||||
honeypot: None,
|
||||
};
|
||||
assert!(request.validate().is_err());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn contact_request_name_at_max_length() {
|
||||
let request = ContactRequest {
|
||||
name: "a".repeat(100),
|
||||
email: "john@example.com".to_string(),
|
||||
message: "This is a test message that is long enough.".to_string(),
|
||||
honeypot: None,
|
||||
};
|
||||
assert!(request.validate().is_ok());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn contact_request_invalid_email() {
|
||||
let request = ContactRequest {
|
||||
name: "John Doe".to_string(),
|
||||
email: "not-an-email".to_string(),
|
||||
message: "This is a test message that is long enough.".to_string(),
|
||||
honeypot: None,
|
||||
};
|
||||
assert!(request.validate().is_err());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn contact_request_message_too_short() {
|
||||
let request = ContactRequest {
|
||||
name: "John Doe".to_string(),
|
||||
email: "john@example.com".to_string(),
|
||||
message: "Short".to_string(),
|
||||
honeypot: None,
|
||||
};
|
||||
assert!(request.validate().is_err());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn contact_request_message_too_long() {
|
||||
let request = ContactRequest {
|
||||
name: "John Doe".to_string(),
|
||||
email: "john@example.com".to_string(),
|
||||
message: "a".repeat(5001),
|
||||
honeypot: None,
|
||||
};
|
||||
assert!(request.validate().is_err());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn contact_request_message_at_min_length() {
|
||||
let request = ContactRequest {
|
||||
name: "John Doe".to_string(),
|
||||
email: "john@example.com".to_string(),
|
||||
message: "a".repeat(10),
|
||||
honeypot: None,
|
||||
};
|
||||
assert!(request.validate().is_ok());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn contact_request_message_at_max_length() {
|
||||
let request = ContactRequest {
|
||||
name: "John Doe".to_string(),
|
||||
email: "john@example.com".to_string(),
|
||||
message: "a".repeat(5000),
|
||||
honeypot: None,
|
||||
};
|
||||
assert!(request.validate().is_ok());
|
||||
}
|
||||
|
||||
// Tests for SmtpTransport TryFrom implementation
|
||||
#[test]
|
||||
fn smtp_transport_implicit_tls() {
|
||||
let settings = EmailSettings {
|
||||
host: "smtp.example.com".to_string(),
|
||||
port: 465,
|
||||
user: "user@example.com".to_string(),
|
||||
password: "password".to_string(),
|
||||
from: "from@example.com".to_string(),
|
||||
recipient: "to@example.com".to_string(),
|
||||
tls: true,
|
||||
starttls: Starttls::Never,
|
||||
};
|
||||
|
||||
let result = SmtpTransport::try_from(&settings);
|
||||
assert!(result.is_ok());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn smtp_transport_starttls_always() {
|
||||
let settings = EmailSettings {
|
||||
host: "smtp.example.com".to_string(),
|
||||
port: 587,
|
||||
user: "user@example.com".to_string(),
|
||||
password: "password".to_string(),
|
||||
from: "from@example.com".to_string(),
|
||||
recipient: "to@example.com".to_string(),
|
||||
tls: false,
|
||||
starttls: Starttls::Always,
|
||||
};
|
||||
|
||||
let result = SmtpTransport::try_from(&settings);
|
||||
assert!(result.is_ok());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn smtp_transport_starttls_opportunistic() {
|
||||
let settings = EmailSettings {
|
||||
host: "smtp.example.com".to_string(),
|
||||
port: 587,
|
||||
user: "user@example.com".to_string(),
|
||||
password: "password".to_string(),
|
||||
from: "from@example.com".to_string(),
|
||||
recipient: "to@example.com".to_string(),
|
||||
tls: false,
|
||||
starttls: Starttls::Opportunistic,
|
||||
};
|
||||
|
||||
let result = SmtpTransport::try_from(&settings);
|
||||
assert!(result.is_ok());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn smtp_transport_no_encryption_with_credentials() {
|
||||
let settings = EmailSettings {
|
||||
host: "localhost".to_string(),
|
||||
port: 1025,
|
||||
user: "user@example.com".to_string(),
|
||||
password: "password".to_string(),
|
||||
from: "from@example.com".to_string(),
|
||||
recipient: "to@example.com".to_string(),
|
||||
tls: false,
|
||||
starttls: Starttls::Never,
|
||||
};
|
||||
|
||||
let result = SmtpTransport::try_from(&settings);
|
||||
assert!(result.is_ok());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn smtp_transport_no_encryption_no_credentials() {
|
||||
let settings = EmailSettings {
|
||||
host: "localhost".to_string(),
|
||||
port: 1025,
|
||||
user: String::new(),
|
||||
password: String::new(),
|
||||
from: "from@example.com".to_string(),
|
||||
recipient: "to@example.com".to_string(),
|
||||
tls: false,
|
||||
starttls: Starttls::Never,
|
||||
};
|
||||
|
||||
let result = SmtpTransport::try_from(&settings);
|
||||
assert!(result.is_ok());
|
||||
}
|
||||
|
||||
// Integration tests for contact API endpoint
|
||||
#[tokio::test]
|
||||
async fn contact_endpoint_honeypot_triggered() {
|
||||
let app = crate::get_test_app();
|
||||
let cli = poem::test::TestClient::new(app);
|
||||
|
||||
let body = serde_json::json!({
|
||||
"name": "Bot Name",
|
||||
"email": "bot@example.com",
|
||||
"message": "This is a spam message from a bot.",
|
||||
"website": "http://spam.com"
|
||||
});
|
||||
|
||||
let resp = cli.post("/api/contact").body_json(&body).send().await;
|
||||
resp.assert_status_is_ok();
|
||||
|
||||
let json_text = resp.0.into_body().into_string().await.unwrap();
|
||||
let json: ContactResponse = serde_json::from_str(&json_text).unwrap();
|
||||
assert!(json.success);
|
||||
assert!(json.message.contains("not really"));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn contact_endpoint_validation_error_empty_name() {
|
||||
let app = crate::get_test_app();
|
||||
let cli = poem::test::TestClient::new(app);
|
||||
|
||||
let body = serde_json::json!({
|
||||
"name": "",
|
||||
"email": "test@example.com",
|
||||
"message": "This is a valid message that is long enough."
|
||||
});
|
||||
|
||||
let resp = cli.post("/api/contact").body_json(&body).send().await;
|
||||
resp.assert_status(poem::http::StatusCode::BAD_REQUEST);
|
||||
|
||||
let json_text = resp.0.into_body().into_string().await.unwrap();
|
||||
let json: ContactResponse = serde_json::from_str(&json_text).unwrap();
|
||||
assert!(!json.success);
|
||||
assert!(json.message.contains("Validation error"));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn contact_endpoint_validation_error_invalid_email() {
|
||||
let app = crate::get_test_app();
|
||||
let cli = poem::test::TestClient::new(app);
|
||||
|
||||
let body = serde_json::json!({
|
||||
"name": "Test User",
|
||||
"email": "not-an-email",
|
||||
"message": "This is a valid message that is long enough."
|
||||
});
|
||||
|
||||
let resp = cli.post("/api/contact").body_json(&body).send().await;
|
||||
resp.assert_status(poem::http::StatusCode::BAD_REQUEST);
|
||||
|
||||
let json_text = resp.0.into_body().into_string().await.unwrap();
|
||||
let json: ContactResponse = serde_json::from_str(&json_text).unwrap();
|
||||
assert!(!json.success);
|
||||
assert!(json.message.contains("Validation error"));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn contact_endpoint_validation_error_message_too_short() {
|
||||
let app = crate::get_test_app();
|
||||
let cli = poem::test::TestClient::new(app);
|
||||
|
||||
let body = serde_json::json!({
|
||||
"name": "Test User",
|
||||
"email": "test@example.com",
|
||||
"message": "Short"
|
||||
});
|
||||
|
||||
let resp = cli.post("/api/contact").body_json(&body).send().await;
|
||||
resp.assert_status(poem::http::StatusCode::BAD_REQUEST);
|
||||
|
||||
let json_text = resp.0.into_body().into_string().await.unwrap();
|
||||
let json: ContactResponse = serde_json::from_str(&json_text).unwrap();
|
||||
assert!(!json.success);
|
||||
assert!(json.message.contains("Validation error"));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn contact_endpoint_validation_error_name_too_long() {
|
||||
let app = crate::get_test_app();
|
||||
let cli = poem::test::TestClient::new(app);
|
||||
|
||||
let body = serde_json::json!({
|
||||
"name": "a".repeat(101),
|
||||
"email": "test@example.com",
|
||||
"message": "This is a valid message that is long enough."
|
||||
});
|
||||
|
||||
let resp = cli.post("/api/contact").body_json(&body).send().await;
|
||||
resp.assert_status(poem::http::StatusCode::BAD_REQUEST);
|
||||
|
||||
let json_text = resp.0.into_body().into_string().await.unwrap();
|
||||
let json: ContactResponse = serde_json::from_str(&json_text).unwrap();
|
||||
assert!(!json.success);
|
||||
assert!(json.message.contains("Validation error"));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn contact_endpoint_validation_error_message_too_long() {
|
||||
let app = crate::get_test_app();
|
||||
let cli = poem::test::TestClient::new(app);
|
||||
|
||||
let body = serde_json::json!({
|
||||
"name": "Test User",
|
||||
"email": "test@example.com",
|
||||
"message": "a".repeat(5001)
|
||||
});
|
||||
|
||||
let resp = cli.post("/api/contact").body_json(&body).send().await;
|
||||
resp.assert_status(poem::http::StatusCode::BAD_REQUEST);
|
||||
|
||||
let json_text = resp.0.into_body().into_string().await.unwrap();
|
||||
let json: ContactResponse = serde_json::from_str(&json_text).unwrap();
|
||||
assert!(!json.success);
|
||||
assert!(json.message.contains("Validation error"));
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user