Email members their git + mailbox credentials on provisioning (#57)

* feat(files): SFTP member storage — private workspaces + shared public area + mgmt TUI Implements M4 (Files). A fully virtual Go SFTP server (pkg/sftp + crypto/ssh, no OS users) wired as an "sftp" subsystem on the existing :22 wish listener, so members reach their files with their login key: sftp files@bbs.profullstack.com # scp/rsync ride the same endpoint Identity is the SSH key (the username is conventional/ignored). Two areas per session: a private, quota-limited /me workspace and a single shared public file area /public (old-school BBS file area; world-read, members-only write by default, operator-moderated). This reverses the old NG1 "no sharing" boundary in favour of one sanctioned, inspectable sharing surface (PRD §9.3 amended). internal/files: - backend.go service, layout, quota/usage, live-session registry, operator API - fs.go per-session virtual FS; resolve() is the single security chokepoint (area confinement + symlink-escape guard) + pkg/sftp request handlers - server.go subsystem handler: key auth -> member session -> request server, with byte metering and force-disconnect - tui.go in-BBS member browser (hub plugin "Files") - admin.go operator management TUI: sessions, workspaces/quotas, public area Operator console: ssh sftp@<host> (allowlist-gated; sftpadmin@/filesadmin@ aliases) — list/disconnect sessions, set per-user quotas, revoke SFTP access, toggle public write, moderate the public area. store: files_access (per-user quota override + revoked) and files_settings (public-write mode) tables + methods. main.go wiring guarded by AGENTBBS_FILES (+ AGENTBBS_FILES_QUOTA_MB, default 1 GiB). Route names reserved. Tests (incl -race): path traversal/confinement, symlink-escape rejection, public-write ACL, quota enforcement, usage accounting, and an end-to-end run against a real SFTP client. Docs: docs/files.md; PRD §5.3/§5.3.1/§9.3 + README updated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Add notify-creds subcommand to (re)email members git + mailbox creds `agentbbs notify-creds` backfills credential emails to verified members who signed up before the git/mailbox welcome emails existed. - git (all verified): forgejo.EnsureUserReset resets each account to a fresh one-time password (must-change) and emails the web login link, username, and password. New method since the original one-time password is not recoverable for existing accounts. - mailbox (all verified): ensures the forwardemail alias and emails the address + webmail link. - Preview by default; --send executes. --git/--mail/--user filters. Refuses --send without SMTP; warns+skips when Forgejo/forwardemail are unconfigured. Also folds in the welcome-email functions (gitWelcomeEmailBody, mailWelcomeEmailBody, EnsureUser password return, provisionGit/ ensurePremium sends) that this builds on. README ops + forgejo tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-08-14 14:57:27 +00:00 · 2026-06-23 03:48:11 -07:00 · 2026-06-23 03:48:11 -07:00 · ce0758b0ec
commit ce0758b0ec
parent 7c794dcf79
5 changed files with 356 additions and 20 deletions
--- a/cmd/agentbbs/main.go
+++ b/cmd/agentbbs/main.go
@ -24,6 +24,8 @@
 //	agentbbs mint-token NAME             issue a WebSocket API token for NAME
 //	agentbbs qrypt-invite NAME           mint a qrypt.chat anonymous invite for NAME
 //	agentbbs qrypt-issuer-keygen         print a fresh qrypt issuer seed + public key
+//	agentbbs notify-creds [flags]        (re)email verified members their git +
+//	                                     mailbox creds/links (preview unless --send)
 package main

 import (
@ -155,6 +157,10 @@ func main() {
 		qryptInviteCmd(st, os.Args[2:])
 		return
 	}
+	if len(os.Args) > 1 && os.Args[1] == "notify-creds" {
+		notifyCreds(st, os.Args[2:])
+		return
+	}
 	if len(os.Args) > 1 && os.Args[1] == "qrypt-issuer-keygen" {
 		qryptIssuerKeygen()
 		return
@ -880,6 +886,22 @@ func (a *app) ensurePremium(u *store.User) bool {
 	return true
 }

+// mailWelcomeEmailBody is the plain-text email sent when a member's @host
+// mailbox alias is provisioned: their new address and the webmail link. Used by
+// the `notify-creds` backfill command (see notifycreds.go).
+func mailWelcomeEmailBody(name, address, webmail string) string {
+	b := "Hi " + name + ",\n\n" +
+		"Your member mailbox is live:\n\n" +
+		"    " + address + "\n\n" +
+		"Mail sent there forwards to this address.\n"
+	if webmail != "" {
+		b += "\nRead and send from the webmail interface here:\n\n" +
+			"    " + webmail + "\n"
+	}
+	b += "\nIf you didn't request this, you can ignore this email.\n"
+	return b
+}
+
 // showPremiumWelcome prints a premium member's perks: custom domains and the
 // in-hub Tor shell. (Email is free for all members — see the join@ summary.)
 func (a *app) showPremiumWelcome(s ssh.Session, u store.User) {
@ -1028,14 +1050,15 @@ func (a *app) provisionGit(u *store.User, pubKey string) {
 	if u == nil || !a.forgejo.Configured() || u.Name == "" || u.Email == "" {
 		return
 	}
-	created, err := a.forgejo.EnsureUser(u.Name, u.Email)
+	created, password, err := a.forgejo.EnsureUser(u.Name, u.Email)
 	if err != nil {
 		log.Error("forgejo provision", "user", u.Name, "err", err)
 		return
 	}
-	if created {
-		log.Info("provisioned git account", "user", u.Name, "host", a.forgejo.BaseURL)
+	if !created {
+		return
 	}
+	log.Info("provisioned git account", "user", u.Name, "host", a.forgejo.BaseURL)
 	// Register the BBS SSH key so the member can push with the same key they sign
 	// in with. No-op when called without a session key (e.g. the web verify flow).
 	if pubKey != "" {
@ -1045,11 +1068,21 @@ func (a *app) provisionGit(u *store.User, pubKey string) {
 			log.Info("registered git ssh key", "user", u.Name)
 		}
 	}
+	// Email the verified address their web sign-in link + one-time password so
+	// they can log in to the Forgejo UI and create repositories. Best-effort:
+	// the account already exists, so a mail failure must not block anything.
+	if a.mail.Configured() {
+		if err := a.mail.Send(u.Email, "Your git.profullstack.com account is ready",
+			gitWelcomeEmailBody(u.Name, password, a.forgejo.LoginURL())); err != nil {
+			log.Error("git welcome email", "user", u.Name, "err", err)
+		}
+	}
 }

-// gitWelcomeEmailBody is the plain-text email sent by the notify-creds ops
-// command when a member's AgentGit (Forgejo) account is created or reset: web
-// login link, username, and the one-time password to change on first sign-in.
+// gitWelcomeEmailBody is the plain-text email sent when a member's AgentGit
+// (Forgejo) account is created or reset — on provisioning and by the
+// notify-creds ops command: web login link, username, and the one-time password
+// they must change on first sign-in.
 func gitWelcomeEmailBody(name, password, loginURL string) string {
 	return "Hi " + name + ",\n\n" +
 		"Your git account is ready. Sign in to the web interface here:\n\n" +
--- a/cmd/agentbbs/notifycreds.go
+++ b/cmd/agentbbs/notifycreds.go
@ -0,0 +1,155 @@
+package main
+
+// notify-creds re-emails verified members their account credentials and links:
+//   - git:  their git.profullstack.com (Forgejo/AgentGit) web login URL, username,
+//           and a freshly reset one-time password (must change on first sign-in).
+//   - mail: their <name>@<mail-domain> mailbox address and the webmail link, after
+//           ensuring the forwardemail alias exists.
+//
+// Both features were added after some accounts already existed, so this lets the
+// operator backfill notifications to everyone who never received them.
+//
+// It is a PREVIEW by default — it scans and prints what it would do without
+// touching Forgejo, forwardemail, or sending any email. Pass --send to execute.
+// Resetting git passwords clobbers any password a member set themselves, which is
+// why it only runs under --send.
+//
+//	agentbbs notify-creds                      # preview for all verified members
+//	agentbbs notify-creds --send               # really send git + mail to everyone
+//	agentbbs notify-creds --git --send         # git creds only
+//	agentbbs notify-creds --mail --send        # mailbox creds only
+//	agentbbs notify-creds --user alice,bob --send
+
+import (
+	"flag"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/profullstack/agentbbs/internal/forgejo"
+	"github.com/profullstack/agentbbs/internal/forwardemail"
+	"github.com/profullstack/agentbbs/internal/mail"
+	"github.com/profullstack/agentbbs/internal/store"
+)
+
+func notifyCreds(st store.Store, args []string) {
+	fs := flag.NewFlagSet("notify-creds", flag.ExitOnError)
+	send := fs.Bool("send", false, "actually reset passwords and send email (default: preview only)")
+	gitFlag := fs.Bool("git", false, "include git account creds/links")
+	mailFlag := fs.Bool("mail", false, "include mailbox creds/links")
+	only := fs.String("user", "", "comma-separated usernames to target (default: all verified)")
+	limit := fs.Int("limit", 100000, "max accounts to scan")
+	fs.Parse(args)
+
+	// Default (neither flag given) is both; either flag alone narrows it.
+	doGit, doMail := *gitFlag, *mailFlag
+	if !doGit && !doMail {
+		doGit, doMail = true, true
+	}
+
+	// Resolve the same configs main() builds for the live server.
+	smtp := mail.ConfigFromEnv()
+	fe := forwardemail.ConfigFromEnv()
+	if fe.Domain == "" {
+		fe.Domain = env("AGENTBBS_MAIL_DOMAIN", "mail.profullstack.com")
+	}
+	fj := forgejo.ConfigFromEnv()
+
+	// Optional username allow-list.
+	var want map[string]bool
+	if strings.TrimSpace(*only) != "" {
+		want = map[string]bool{}
+		for _, n := range strings.Split(*only, ",") {
+			if n = strings.ToLower(strings.TrimSpace(n)); n != "" {
+				want[n] = true
+			}
+		}
+	}
+
+	users, err := st.ListUsers(*limit)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "list users:", err)
+		os.Exit(1)
+	}
+
+	if !*send {
+		fmt.Println("PREVIEW (no email sent, no passwords reset) — re-run with --send to execute")
+	}
+	if doGit && !fj.Configured() {
+		fmt.Fprintln(os.Stderr, "warning: Forgejo not configured (AGENTBBS_FORGEJO_URL/_ADMIN_TOKEN) — skipping git")
+		doGit = false
+	}
+	if doMail && !fe.Configured() {
+		fmt.Fprintln(os.Stderr, "warning: forwardemail not configured (AGENTBBS_FORWARDEMAIL_API_KEY/_DOMAIN) — skipping mail")
+		doMail = false
+	}
+	if *send && !smtp.Configured() {
+		fmt.Fprintln(os.Stderr, "error: SMTP not configured (AGENTBBS_SMTP_HOST/_FROM) — cannot send email")
+		os.Exit(1)
+	}
+	if !doGit && !doMail {
+		fmt.Fprintln(os.Stderr, "nothing to do")
+		os.Exit(2)
+	}
+
+	var targeted, gitOK, gitErr, mailOK, mailErr int
+	for _, u := range users {
+		if want != nil && !want[strings.ToLower(u.Name)] {
+			continue
+		}
+		if !u.EmailVerified || u.Email == "" || u.Banned {
+			continue
+		}
+		targeted++
+
+		if doGit {
+			if !*send {
+				fmt.Printf("  [git]  %-20s -> %s  (reset password + email %s)\n", u.Name, fj.LoginURL(), u.Email)
+			} else {
+				created, pw, err := fj.EnsureUserReset(u.Name, u.Email)
+				if err != nil {
+					gitErr++
+					fmt.Fprintf(os.Stderr, "  [git]  %s: %v\n", u.Name, err)
+				} else if err := smtp.Send(u.Email, "Your git.profullstack.com account is ready",
+					gitWelcomeEmailBody(u.Name, pw, fj.LoginURL())); err != nil {
+					gitErr++
+					fmt.Fprintf(os.Stderr, "  [git]  %s: send: %v\n", u.Name, err)
+				} else {
+					gitOK++
+					verb := "reset+emailed"
+					if created {
+						verb = "created+emailed"
+					}
+					fmt.Printf("  [git]  %-20s %s -> %s\n", u.Name, verb, u.Email)
+				}
+			}
+		}
+
+		if doMail {
+			addr := fe.Address(u.Name)
+			if !*send {
+				fmt.Printf("  [mail] %-20s -> %s  (ensure alias + email %s)\n", u.Name, addr, u.Email)
+			} else {
+				if err := fe.CreateAlias(u.Name, u.Email); err != nil {
+					mailErr++
+					fmt.Fprintf(os.Stderr, "  [mail] %s: alias: %v\n", u.Name, err)
+				} else if err := smtp.Send(u.Email, "Your "+fe.Domain+" mailbox is ready",
+					mailWelcomeEmailBody(u.Name, addr, fe.WebmailURL())); err != nil {
+					mailErr++
+					fmt.Fprintf(os.Stderr, "  [mail] %s: send: %v\n", u.Name, err)
+				} else {
+					mailOK++
+					fmt.Printf("  [mail] %-20s ensured+emailed -> %s\n", u.Name, addr)
+				}
+			}
+		}
+	}
+
+	fmt.Printf("\n%d verified account(s) targeted.\n", targeted)
+	if *send {
+		fmt.Printf("git:  %d sent, %d failed\nmail: %d sent, %d failed\n", gitOK, gitErr, mailOK, mailErr)
+		if gitErr > 0 || mailErr > 0 {
+			os.Exit(1)
+		}
+	}
+}