feat(auth): Use libs email in auth server #19952

nshirley · 2026-01-27T21:14:43Z

Because:

We've moved email sending and rendering out of auth-server

This Commit:

Updates several emails to send using the new fxa-mailer, renderer and sender

Closes: FXA-12883

Checklist

Put an x in the boxes that apply

My commit is GPG signed.
If applicable, I have modified or added tests which pass locally.
I have added necessary documentation (if appropriate).
I have verified that my changes render correctly in RTL (if appropriate).

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

Any other information that is important to this pull request.

packages/fxa-auth-server/lib/routes/account.ts

packages/fxa-auth-server/lib/routes/emails.js

packages/fxa-auth-server/lib/routes/utils/signin.js

packages/fxa-auth-server/lib/senders/fxa-mailer.ts

dschom · 2026-01-27T23:28:23Z

packages/fxa-auth-server/test/local/routes/account.js

+            mockFxaMailer.sendVerifyEmail.callCount,
            0,
-            'mailer.sendVerifyEmail was not called'
+            'mockFxaMailer.sendVerifyEmail was called'


Good call - I was fixing some of them since they weren't right and just mixed this one up

nshirley · 2026-01-29T16:34:13Z

packages/fxa-auth-server/lib/senders/fxa-mailer.ts

+   * @param opts
+   * @returns
+   */
+  async sendVerifySecondaryCodeEmail(


So, this was the problem function in MOST of the integration and functional test failures. Because of the setup we just take whatever to is provided on the options. Since we use the formatter and pass in the account, it was trying to send the verification code to the primary email address, not secondary.

I figured it makes most sense to address that here. email is a required property on the type (used in the template) and so, we can swap the to out right before we send

packages/fxa-auth-server/scripts/recorded-future/check-and-reset.ts

Because: - We've moved email sending and rendering out of auth-server This Commit: - Updates several emails to send using the new fxa-mailer, renderer and sender Closes: FXA-12883

nshirley · 2026-01-29T19:10:47Z

packages/fxa-auth-server/scripts/recorded-future/check-and-reset.ts

+      if (fxaMailer.canSend('passwordChangeRequired')) {
+        // the new fxa-mailer is more type script, so we create a 'fake'
+        // request to satisfy the type checking
+        const request = {


@dschom - curious if you have a better idea for how to handle this. The mailer functions being type safe means it's expecting all of this, but also I don't want to just cast request as unknown as any

dschom · 2026-01-29T20:57:14Z

packages/fxa-auth-server/lib/senders/fxa-mailer.ts

+      resetLink: this.linkBuilder.buildResetLink(template, metricsEnabled, {
+        email: opts.to,
+      }),
+      link: this.linkBuilder.buildResetLink(template, metricsEnabled, {


Just double checking that both resetLink and link are both used and are supposed to have the same value. It's possible 'link' is not needed here, but I didn't fully check this.

I'll double check all of these - when I dug through the original implementation it was wonky so I probably crossed some wires. It is nice that we have this so explicit now so in the future it won't be so hand-wavy

dschom · 2026-01-29T20:59:29Z

packages/fxa-auth-server/lib/senders/fxa-mailer.ts

+        metricsEnabled,
+        { email: opts.to }
+      ),
+      link: this.linkBuilder.buildPasswordChangeRequiredLink(


Same question as above. Here it seems like maybe only 'link' is required?

dschom · 2026-01-29T20:59:55Z

packages/fxa-auth-server/lib/senders/fxa-mailer.ts

+    const links = {
+      supportUrl: this.linkBuilder.buildSupportLink(template, metricsEnabled),
+      privacyUrl: this.linkBuilder.buildPrivacyLink(template, metricsEnabled),
+      resetLink: this.linkBuilder.buildResetLink(template, metricsEnabled, {


dschom · 2026-01-29T21:02:13Z

packages/fxa-auth-server/lib/senders/fxa-mailer.ts

+      OmitCommonLinks<TemplateData> &
+      OmitCommonLinks<verifyPrimary.TemplateData> & {
+        code: string;
+        service?: string;


I wonder if this should be ({ code:string } || { code: string, service:string, redirectTo:string, resule:string }). I think you had a similar comment during your review on my code. I am pretty sure if we have a service we want resume and redirectTo also.

dschom · 2026-01-29T21:03:11Z

packages/fxa-auth-server/lib/senders/fxa-mailer.ts

+      ...opts,
+      ...links,
+    });
+    // explicitly override the `to` to ensure we send to the right email


dschom · 2026-01-29T21:04:59Z

packages/fxa-auth-server/lib/senders/fxa-mailer.ts

+        metricsEnabled,
+        { email: opts.to }
+      ),
+      link: this.linkBuilder.buildVerifyEmailLink(template, metricsEnabled, {


Is this actually used?

dschom · 2026-01-29T21:07:58Z

packages/fxa-auth-server/lib/senders/fxa-mailer.ts

    const from = cmsRpFromName
      ? `${cmsRpFromName} <${this.mailerConfig.sender}>`
      : this.mailerConfig.sender;
+    console.debug(`!!! From: ${from} !!!`);


Stray debug!

dschom · 2026-01-29T21:11:02Z

packages/fxa-auth-server/scripts/recorded-future/check-and-reset.ts

  const mailer: any = senders.email;
  const accountEventManager = new AccountEventsManager();

+  // setup for fxa-mailer, since this runs outside of the key_server context we


Is there a reason we couldn't hoist this to the top of the file? It seems a little wasteful to construct these everytime we run this function.

I tried, but one of the required objects for constructing the FxaMailer were down here... Though as I say that I realize I can hoist that up too 🤦

dschom · 2026-01-29T21:16:05Z

packages/fxa-auth-server/scripts/recorded-future/check-and-reset.ts

+                postalCode: '',
+              },
+            },
+            acceptLanguage: 'en/US',


The browser posts something like this: en-US,en;q=0.9. I think en is the safest fallback. Basically I'm a little unsure if the /US is valid?

We also have a locale column on the accounts table in the database. I think in this case we should use that to target the language that's most likely what the user is used to.

dschom · 2026-01-29T21:17:37Z

packages/fxa-auth-server/scripts/delete-account.ts

+    new NodeRendererBindings({
+      translations: {
+        basePath: join(__dirname, '../public/locales'),
+        ftlFileName: 'auth.ftl',


Thanks for making sure to grab this change!

nshirley force-pushed the FXA-12883 branch from 2a03ec8 to 6ef2019 Compare January 27, 2026 23:05

dschom reviewed Jan 27, 2026

View reviewed changes

packages/fxa-auth-server/lib/routes/account.ts Outdated Show resolved Hide resolved

dschom reviewed Jan 27, 2026

View reviewed changes

packages/fxa-auth-server/lib/routes/emails.js Outdated Show resolved Hide resolved

dschom reviewed Jan 27, 2026

View reviewed changes

packages/fxa-auth-server/lib/routes/utils/signin.js Show resolved Hide resolved

dschom reviewed Jan 27, 2026

View reviewed changes

packages/fxa-auth-server/lib/routes/utils/signin.js Show resolved Hide resolved

dschom reviewed Jan 27, 2026

View reviewed changes

packages/fxa-auth-server/lib/senders/fxa-mailer.ts Outdated Show resolved Hide resolved

dschom reviewed Jan 27, 2026

View reviewed changes

nshirley force-pushed the FXA-12883 branch 4 times, most recently from b5529cc to 9ecdac7 Compare January 29, 2026 16:15

nshirley marked this pull request as ready for review January 29, 2026 16:15

nshirley requested a review from a team as a code owner January 29, 2026 16:15

nshirley requested a review from dschom January 29, 2026 16:15

nshirley commented Jan 29, 2026

View reviewed changes

nshirley force-pushed the FXA-12883 branch from 9ecdac7 to be03066 Compare January 29, 2026 17:04

nshirley commented Jan 29, 2026

View reviewed changes

packages/fxa-auth-server/scripts/recorded-future/check-and-reset.ts Show resolved Hide resolved

feat(auth): Use libs email in auth server

8120093

Because: - We've moved email sending and rendering out of auth-server This Commit: - Updates several emails to send using the new fxa-mailer, renderer and sender Closes: FXA-12883

nshirley force-pushed the FXA-12883 branch from be03066 to 8120093 Compare January 29, 2026 18:20

nshirley commented Jan 29, 2026

View reviewed changes

dschom reviewed Jan 29, 2026

View reviewed changes

feat(auth): Use libs email in auth server #19952

Are you sure you want to change the base?

feat(auth): Use libs email in auth server #19952

Conversation

nshirley commented Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Screenshots (Optional)

Other information (Optional)

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dschom Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dschom Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dschom Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

nshirley commented Jan 27, 2026 •

edited

Loading

dschom Jan 29, 2026 •

edited

Loading

dschom Jan 29, 2026 •

edited

Loading

dschom Jan 29, 2026 •

edited

Loading