fix: use instance-specific emails for service accounts (#2502)

packages/lib/constants/email.ts

@@ -8,8 +8,6 @@ export const DOCUMENSO_INTERNAL_EMAIL = {
   address: FROM_ADDRESS,
 };
 
-export const SERVICE_USER_EMAIL = 'serviceaccount@documenso.com';
-
 export const EMAIL_VERIFICATION_STATE = {
   NOT_FOUND: 'NOT_FOUND',
   VERIFIED: 'VERIFIED',

packages/lib/server-only/user/get-user-by-reset-token.ts

@@ -0,0 +1,24 @@
+import { prisma } from '@documenso/prisma';
+
+import { AppError, AppErrorCode } from '../../errors/app-error';
+
+export interface GetUserByResetTokenOptions {
+  token: string;
+}
+
+export const getUserByResetToken = async ({ token }: GetUserByResetTokenOptions) => {
+  const result = await prisma.passwordResetToken.findFirst({
+    where: {
+      token,
+    },
+    include: {
+      user: true,
+    },
+  });
+
+  if (!result || !result.user) {
+    throw new AppError(AppErrorCode.NOT_FOUND);
+  }
+
+  return result.user;
+};

packages/lib/server-only/user/service-accounts/deleted-account.ts

@@ -1,9 +1,27 @@
 import { prisma } from '@documenso/prisma';
 
+const LEGACY_DELETED_ACCOUNT_EMAIL = 'deleted-account@documenso.com';
+
+export const deletedServiceAccountEmail = () => {
+  try {
+    // eslint-disable-next-line turbo/no-undeclared-env-vars
+    if (process.env.NEXT_PRIVATE_DELETED_SERVICE_ACCOUNT_EMAIL) {
+      // eslint-disable-next-line turbo/no-undeclared-env-vars
+      return process.env.NEXT_PRIVATE_DELETED_SERVICE_ACCOUNT_EMAIL;
+    }
+
+    const { hostname } = new URL(process.env.NEXT_PUBLIC_WEBAPP_URL || 'http://localhost:3000');
+
+    return `deleted-account@${hostname}`;
+  } catch (error) {
+    return LEGACY_DELETED_ACCOUNT_EMAIL;
+  }
+};
+
 export const deletedAccountServiceAccount = async () => {
   const serviceAccount = await prisma.user.findFirst({
     where: {
-      email: 'deleted-account@documenso.com',
+      email: deletedServiceAccountEmail(),
     },
     select: {
       id: true,
@@ -29,3 +47,20 @@ export const deletedAccountServiceAccount = async () => {
 
   return serviceAccount;
 };
+
+export const migrateDeletedAccountServiceAccount = async () => {
+  if (deletedServiceAccountEmail() !== LEGACY_DELETED_ACCOUNT_EMAIL) {
+    console.log(
+      `Migrating deleted account service account to new email: ${deletedServiceAccountEmail()}`,
+    );
+
+    await prisma.user.updateMany({
+      where: {
+        email: LEGACY_DELETED_ACCOUNT_EMAIL,
+      },
+      data: {
+        email: deletedServiceAccountEmail(),
+      },
+    });
+  }
+};

packages/lib/server-only/user/service-accounts/legacy-service-account.ts

@@ -0,0 +1,34 @@
+import { prisma } from '@documenso/prisma';
+
+const LEGACY_SERVICE_ACCOUNT_EMAIL = 'serviceaccount@documenso.com';
+
+export const legacyServiceAccountEmail = () => {
+  try {
+    // eslint-disable-next-line turbo/no-undeclared-env-vars
+    if (process.env.NEXT_PRIVATE_LEGACY_SERVICE_ACCOUNT_EMAIL) {
+      // eslint-disable-next-line turbo/no-undeclared-env-vars
+      return process.env.NEXT_PRIVATE_LEGACY_SERVICE_ACCOUNT_EMAIL;
+    }
+
+    const { hostname } = new URL(process.env.NEXT_PUBLIC_WEBAPP_URL || 'http://localhost:3000');
+
+    return `serviceaccount@${hostname}`;
+  } catch (error) {
+    return LEGACY_SERVICE_ACCOUNT_EMAIL;
+  }
+};
+
+export const migrateLegacyServiceAccount = async () => {
+  if (legacyServiceAccountEmail() !== LEGACY_SERVICE_ACCOUNT_EMAIL) {
+    console.log(`Migrating legacy service account to new email: ${legacyServiceAccountEmail()}`);
+
+    await prisma.user.updateMany({
+      where: {
+        email: LEGACY_SERVICE_ACCOUNT_EMAIL,
+      },
+      data: {
+        email: legacyServiceAccountEmail(),
+      },
+    });
+  }
+};