276 lines
9.0 KiB
JavaScript
276 lines
9.0 KiB
JavaScript
import fs from 'fs/promises'
|
|
import path from 'path'
|
|
import { getUserFromToken, hasAnyRole } from '../../../utils/auth.js'
|
|
import { getRecipientsByGroup, getNewsletterSubscribers, generateUnsubscribeToken } from '../../../utils/newsletter.js'
|
|
import nodemailer from 'nodemailer'
|
|
|
|
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
|
|
// filename is always a hardcoded constant (e.g., 'newsletter.json'), never user input
|
|
const getDataPath = (filename) => {
|
|
const cwd = process.cwd()
|
|
if (cwd.endsWith('.output')) {
|
|
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
|
|
return path.join(cwd, '../server/data', filename)
|
|
}
|
|
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
|
|
return path.join(cwd, 'server/data', filename)
|
|
}
|
|
|
|
const NEWSLETTERS_FILE = getDataPath('newsletters.json')
|
|
|
|
async function readNewsletters() {
|
|
try {
|
|
const data = await fs.readFile(NEWSLETTERS_FILE, 'utf-8')
|
|
return JSON.parse(data)
|
|
} catch (error) {
|
|
if (error.code === 'ENOENT') {
|
|
return []
|
|
}
|
|
throw error
|
|
}
|
|
}
|
|
|
|
async function writeNewsletters(newsletters) {
|
|
await fs.writeFile(NEWSLETTERS_FILE, JSON.stringify(newsletters, null, 2), 'utf-8')
|
|
}
|
|
|
|
// Lädt Config für Logo und Clubname
|
|
async function loadConfig() {
|
|
try {
|
|
const configPath = getDataPath('config.json')
|
|
const data = await fs.readFile(configPath, 'utf-8')
|
|
return JSON.parse(data)
|
|
} catch {
|
|
return {
|
|
verein: { name: 'Harheimer Tischtennis-Club 1954 e.V.' }
|
|
}
|
|
}
|
|
}
|
|
|
|
// Erstellt Newsletter-HTML mit Header und Footer
|
|
async function createNewsletterHTML(newsletter, unsubscribeToken = null) {
|
|
const config = await loadConfig()
|
|
const clubName = config.verein?.name || 'Harheimer Tischtennis-Club 1954 e.V.'
|
|
const baseUrl = process.env.NUXT_PUBLIC_BASE_URL || 'http://localhost:3100'
|
|
|
|
let unsubscribeLink = ''
|
|
if (unsubscribeToken) {
|
|
const unsubscribeUrl = `${baseUrl}/newsletter/unsubscribe?token=${unsubscribeToken}`
|
|
unsubscribeLink = `
|
|
<div style="margin-top: 40px; padding-top: 20px; border-top: 1px solid #e5e7eb; text-align: center; color: #6b7280; font-size: 12px;">
|
|
<p>Sie erhalten diese E-Mail, weil Sie sich für unseren Newsletter angemeldet haben.</p>
|
|
<p style="margin-top: 10px;">
|
|
<a href="${unsubscribeUrl}" style="color: #dc2626; text-decoration: underline;">Newsletter abmelden</a>
|
|
</p>
|
|
</div>
|
|
`
|
|
}
|
|
|
|
return `
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
</head>
|
|
<body style="margin: 0; padding: 0; font-family: Arial, sans-serif; background-color: #f3f4f6;">
|
|
<table width="100%" cellpadding="0" cellspacing="0" style="background-color: #f3f4f6; padding: 20px 0;">
|
|
<tr>
|
|
<td align="center">
|
|
<table width="600" cellpadding="0" cellspacing="0" style="background-color: #ffffff; border-radius: 8px; overflow: hidden; box-shadow: 0 2px 4px rgba(0,0,0,0.1);">
|
|
<!-- Header -->
|
|
<tr>
|
|
<td style="background-color: #dc2626; padding: 30px; text-align: center;">
|
|
<h1 style="margin: 0; color: #ffffff; font-size: 24px; font-weight: bold;">
|
|
${clubName}
|
|
</h1>
|
|
</td>
|
|
</tr>
|
|
|
|
<!-- Content -->
|
|
<tr>
|
|
<td style="padding: 30px;">
|
|
<h2 style="margin: 0 0 20px 0; color: #111827; font-size: 20px;">
|
|
${newsletter.title}
|
|
</h2>
|
|
<div style="color: #374151; line-height: 1.6;">
|
|
${newsletter.content}
|
|
</div>
|
|
${unsubscribeLink}
|
|
</td>
|
|
</tr>
|
|
|
|
<!-- Footer -->
|
|
<tr>
|
|
<td style="background-color: #f9fafb; padding: 20px; text-align: center; color: #6b7280; font-size: 12px; border-top: 1px solid #e5e7eb;">
|
|
<p style="margin: 0;">
|
|
${clubName}<br>
|
|
<a href="${baseUrl}" style="color: #dc2626; text-decoration: none;">${baseUrl}</a>
|
|
</p>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</body>
|
|
</html>
|
|
`
|
|
}
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
try {
|
|
// Authentifizierung prüfen
|
|
const token = getCookie(event, 'auth_token') || getHeader(event, 'authorization')?.replace('Bearer ', '')
|
|
|
|
if (!token) {
|
|
throw createError({
|
|
statusCode: 401,
|
|
statusMessage: 'Nicht authentifiziert'
|
|
})
|
|
}
|
|
|
|
const user = await getUserFromToken(token)
|
|
if (!user || !hasAnyRole(user, 'admin', 'vorstand', 'newsletter')) {
|
|
throw createError({
|
|
statusCode: 403,
|
|
statusMessage: 'Keine Berechtigung'
|
|
})
|
|
}
|
|
|
|
const newsletterId = getRouterParam(event, 'id')
|
|
|
|
const newsletters = await readNewsletters()
|
|
const newsletterIndex = newsletters.findIndex(n => n.id === newsletterId)
|
|
|
|
if (newsletterIndex === -1) {
|
|
throw createError({
|
|
statusCode: 404,
|
|
statusMessage: 'Newsletter nicht gefunden'
|
|
})
|
|
}
|
|
|
|
const newsletter = newsletters[newsletterIndex]
|
|
|
|
if (newsletter.status === 'sent') {
|
|
throw createError({
|
|
statusCode: 400,
|
|
statusMessage: 'Newsletter wurde bereits versendet'
|
|
})
|
|
}
|
|
|
|
// Prüfe ob Newsletter Inhalt hat
|
|
if (!newsletter.content || newsletter.content.trim() === '' || newsletter.content === '<p><br></p>') {
|
|
throw createError({
|
|
statusCode: 400,
|
|
statusMessage: 'Newsletter hat keinen Inhalt. Bitte fügen Sie Inhalte hinzu, bevor Sie den Newsletter versenden.'
|
|
})
|
|
}
|
|
|
|
// SMTP-Credentials prüfen
|
|
const smtpUser = process.env.SMTP_USER
|
|
const smtpPass = process.env.SMTP_PASS
|
|
|
|
if (!smtpUser || !smtpPass) {
|
|
throw createError({
|
|
statusCode: 500,
|
|
statusMessage: 'SMTP-Credentials fehlen! Bitte setzen Sie SMTP_USER und SMTP_PASS in der .env Datei.'
|
|
})
|
|
}
|
|
|
|
const transporter = nodemailer.createTransport({
|
|
host: process.env.SMTP_HOST || 'smtp.gmail.com',
|
|
port: process.env.SMTP_PORT || 587,
|
|
secure: false,
|
|
auth: {
|
|
user: smtpUser,
|
|
pass: smtpPass
|
|
}
|
|
})
|
|
|
|
// Empfänger bestimmen
|
|
let recipients = []
|
|
|
|
if (newsletter.type === 'subscription') {
|
|
// Abonnenten-Newsletter
|
|
recipients = await getNewsletterSubscribers(!newsletter.sendToExternal)
|
|
} else if (newsletter.type === 'group') {
|
|
// Gruppen-Newsletter
|
|
recipients = await getRecipientsByGroup(newsletter.targetGroup)
|
|
}
|
|
|
|
if (recipients.length === 0) {
|
|
throw createError({
|
|
statusCode: 400,
|
|
statusMessage: 'Keine Empfänger gefunden'
|
|
})
|
|
}
|
|
|
|
// Newsletter versenden
|
|
let sentCount = 0
|
|
let failedCount = 0
|
|
const failedEmails = []
|
|
|
|
for (const recipient of recipients) {
|
|
try {
|
|
// Abmelde-Token generieren (nur für Abonnenten-Newsletter)
|
|
let unsubscribeToken = null
|
|
if (newsletter.type === 'subscription') {
|
|
unsubscribeToken = await generateUnsubscribeToken(recipient.email)
|
|
}
|
|
|
|
const htmlContent = await createNewsletterHTML(newsletter, unsubscribeToken)
|
|
|
|
await transporter.sendMail({
|
|
from: process.env.SMTP_FROM || 'noreply@harheimertc.de',
|
|
to: recipient.email,
|
|
subject: newsletter.title,
|
|
html: htmlContent
|
|
})
|
|
|
|
sentCount++
|
|
} catch (error) {
|
|
// nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring
|
|
// recipient.email is validated and from trusted source (subscribers list)
|
|
// nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring
|
|
console.error(`Fehler beim Senden an ${recipient.email}:`, error)
|
|
failedCount++
|
|
failedEmails.push(recipient.email)
|
|
}
|
|
}
|
|
|
|
// Newsletter als versendet markieren
|
|
newsletters[newsletterIndex].status = 'sent'
|
|
newsletters[newsletterIndex].sentAt = new Date().toISOString()
|
|
newsletters[newsletterIndex].sentTo = {
|
|
total: recipients.length,
|
|
sent: sentCount,
|
|
failed: failedCount,
|
|
failedEmails: failedEmails.length > 0 ? failedEmails : undefined
|
|
}
|
|
|
|
await writeNewsletters(newsletters)
|
|
|
|
return {
|
|
success: true,
|
|
message: `Newsletter erfolgreich versendet`,
|
|
stats: {
|
|
total: recipients.length,
|
|
sent: sentCount,
|
|
failed: failedCount,
|
|
failedEmails: failedEmails.length > 0 ? failedEmails : undefined
|
|
}
|
|
}
|
|
} catch (error) {
|
|
console.error('Fehler beim Versenden des Newsletters:', error)
|
|
if (error.statusCode) {
|
|
throw error
|
|
}
|
|
throw createError({
|
|
statusCode: 500,
|
|
statusMessage: error.message || 'Fehler beim Versenden des Newsletters'
|
|
})
|
|
}
|
|
})
|
|
|