5.19-bob: Email — Nodemailer

  Sizning botingiz  SMTP server (Gmail/SendGrid)  qabul qiluvchi pochta serveri  foydalanuvchi

  SMTP — "xat yuborish" protokoli (0.4: HTTP "veb" uchun, SMTP "email" uchun)
  IMAP/POP3 — "xat o'qish" (bu bobda kerak emas — biz faqat yuboramiz)

  1. Transporter yaratish — SMTP ulanish sozlamasi (kim orqali yuboramiz)
  2. Xabar tuzish — kimdan, kimga, mavzu, matn/HTML
  3. Yuborish — transporter.sendMail(xabar)

import nodemailer from "nodemailer";

const transporter = nodemailer.createTransport({ /* SMTP */ });   // 1
const xabar = { from, to, subject, html };                        // 2
await transporter.sendMail(xabar);                                // 3

const transporter = nodemailer.createTransport({
  host: "smtp.gmail.com",          // SMTP server manzili
  port: 587,                        // port (587 — TLS; 465 — SSL)
  secure: false,                    // 465  true; 587  false (STARTTLS)
  auth: {
    user: process.env.SMTP_USER,   // login (email) — .env (14, 5.8)
    pass: process.env.SMTP_PASS,   // parol/app password — .env
  },
});

  port 587 + secure:false  — STARTTLS (ulanib, keyin shifrlashga o'tadi) — tavsiya
  port 465 + secure:true   — SSL (boshidan shifrlangan)
  port 25                  — shifrlanmagan (ishlatmang — bloklangan, xavfsiz emas — 14)

const xabar = {
  from: '"Mana Do'kon" <info@mana.uz>',   // kimdan (ism + email)
  to: "user@example.com",                  // kimga (vergul bilan ko'p)
  subject: "Xush kelibsiz!",               // mavzu
  text: "Oddiy matn versiyasi",            // matn (HTML'siz mijozlar uchun)
  html: "<h1>Salom!</h1>",                 // HTML versiyasi (2.6)
  attachments: [],                          // fayllar (2.7)
};

   Email HTML — eski, cheklangan:
  - Tashqi CSS yo'q (inline style ishlatiladi: style="...")
  - Flexbox/Grid (1.3, 1.4) ko'pincha ishlamaydi  <table> bilan layout (eski usul)
  - JavaScript yo'q (xavfsizlik)
  - Har mijoz har xil ko'rsatadi (test kerak)

attachments: [
  { filename: "chek.pdf", path: "./files/chek.pdf" },       // diskdan (5.3)
  { filename: "rasm.png", content: buffer },                 // Buffer'dan (0.1)
  { filename: "hisobot.csv", content: "a,b,c", contentType: "text/csv" },  // matndan
  { filename: "logo.png", path: "./logo.png", cid: "logo" }, // HTML ichida: <img src="cid:logo">
]

// Ilova boshida — sozlama xatosini erta aniqlash
try {
  await transporter.verify();
  console.log("SMTP tayyor");
} catch (err) {
  console.error("SMTP xato:", err);   // kalit/host noto'g'ri — darrov bilasiz
}

   So'rovda email kutish:
  POST /signup  ...  email yubor (3 sek kutadi!)  javob (sekin UX)

   Navbatga qo'yib, darrov javob:
  POST /signup  ...  navbatga "email yubor" qo'sh  javob (tez)
  fonda: worker navbatdan oladi  email yuboradi (foydalanuvchi kutmaydi)

   SPF, DKIM, DMARC — domen autentifikatsiyasi (email haqiqiyligini isbotlaydi)
   Ishonchli "from" domeni (o'z domening: info@mana.uz, gmail emas)
   text + html ikkalasi 2.5-bob
   Spam so'zlardan saqlanish ("BEPUL!!!", ko'p katta harf)
   Production'da dedikatsiyalangan xizmat (SendGrid/Resend — 2.12)

  Mailtrap.io   — test inbox (email yuboriladi, lekin Mailtrap'da ushlanadi — chiqmaydi)
  Ethereal      — Nodemailer'ning test akkaunti (nodemailer.createTestAccount)

  Nodemailer to'g'ridan SMTP (Gmail) — kichik loyiha uchun
  Production — dedikatsiyalangan: SendGrid, Resend, Amazon SES, Mailgun
   yetkazib berish, retry, bounce, analitika — ular hal qiladi (2.10)

  Tasdiqlash xati    — ro'yxatdan o'tgach, email tasdiqlash havolasi/kodi
  Parol tiklash      — "parolni unutdingiz"  tiklash havolasi (token bilan — 14)
  Xush kelibsiz      — ro'yxatdan o'tgach
  Buyurtma cheki     — to'lovdan keyin (PDF attachment — 2.7)
  Bildirishnoma      — hodisa (yangi xabar, eslatma)
  Hisobot            — davriy (haftalik — cron — 5.22)

   SMTP kalitlari .env'da (kodda emas — 14, 5.8)
   Gmail uchun "App Password" (asosiy parol emas — 2.3, 14)
   Parol tiklash: tasodifiy token (crypto — 5.3), qisqa muddat, bir martalik (5.18 ruhida)
   Email manzilini validatsiya 5.9-bob; foydalanuvchi kiritgan HTML'ni email'ga solmang (XSS — 14)
   Rate limiting (email spam — 5.20)
   Foydalanuvchi ma'lumotini email'da ehtiyotkor (PII — 14)

import nodemailer from "nodemailer";

// Transporter (bir marta — 2.3)
const transporter = nodemailer.createTransport({
  host, port: 587, secure: false, auth: { user, pass },
});

// Tekshirish (2.8)
await transporter.verify();

// Yuborish (2.2)
await transporter.sendMail({
  from: '"Nom" <a@b.uz>', to, subject, text, html,    // (2.5, 2.6)
  attachments: [{ filename, path }],                   // (2.7)
});

import nodemailer from "nodemailer";
import { config } from "../config/index.js";          // (5.8)

// Transporter (bir marta — 2.3)
const transporter = nodemailer.createTransport({
  host: config.smtp.host,                              // smtp.gmail.com
  port: 587,                                            // STARTTLS (2.4)
  secure: false,
  auth: { user: config.smtp.user, pass: config.smtp.pass },   // .env (14)
});

// Yuborish funksiyasi
export async function emailYubor({ to, subject, text, html }) {
  const info = await transporter.sendMail({
    from: `"Mana Do'kon" <${config.smtp.user}>`,       // kimdan (2.5)
    to, subject, text, html,
  });
  return info.messageId;                               // yuborilgan xat ID'si
}

// Ishlatish
await emailYubor({
  to: "user@example.com",
  subject: "Xush kelibsiz!",
  text: "Ro'yxatdan o'tganingiz uchun rahmat",
  html: "<h1>Xush kelibsiz!</h1><p>Ro'yxatdan o'tdingiz.</p>",
});

// Ilova boshida — SMTP to'g'riligini erta aniqlash (2.8)
export async function smtpTekshir() {
  try {
    await transporter.verify();
    console.log(" SMTP ulanish tayyor");
  } catch (err) {
    console.error(" SMTP sozlama xato:", err.message);   // kalit/host noto'g'ri
    // production'da: ogohlantirish (5.12)
  }
}
// server.js da: await smtpTekshir();

// Email HTML — inline style (tashqi CSS ishlamaydi — 2.6)
function xushKelibsizHtml(ism) {
  return `
  <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto;">
    <div style="background: #4f46e5; padding: 24px; text-align: center;">
      <h1 style="color: #fff; margin: 0;">Mana Do'kon</h1>
    </div>
    <div style="padding: 24px; color: #333;">
      <p>Assalomu alaykum, <strong>${ism}</strong>!</p>
      <p>Ro'yxatdan o'tganingiz uchun rahmat.</p>
      <a href="https://mana.uz/start"
         style="display:inline-block; background:#4f46e5; color:#fff;
                padding:12px 24px; border-radius:6px; text-decoration:none;">
        Boshlash
      </a>
    </div>
    <div style="padding:16px; text-align:center; color:#999; font-size:12px;">
      © 2026 Mana Do'kon
    </div>
  </div>`;
}

await emailYubor({
  to: user.email,
  subject: "Xush kelibsiz!",
  text: `Salom ${user.ism}! Ro'yxatdan o'tdingiz.`,    // matn versiya (2.5)
  html: xushKelibsizHtml(user.ism),
});

import crypto from "node:crypto";                      // (5.3)

export const emailTasdiqYubor = async (user) => {
  // Tasodifiy token (5.3, 14)
  const token = crypto.randomBytes(32).toString("hex");
  // DB'da saqlash (muddat bilan — 5.18 ruhida)
  await EmailToken.create({
    userId: user.id, token, expiresAt: new Date(Date.now() + 24 * 3600 * 1000),   // 24 soat
  });
  // Tasdiqlash havolasi
  const url = `${config.clientUrl}/verify-email?token=${token}`;
  await emailYubor({
    to: user.email,
    subject: "Email manzilingizni tasdiqlang",
    text: `Tasdiqlash: ${url}`,
    html: `<p>Tasdiqlash uchun bosing:</p>
           <a href="${url}">Email'ni tasdiqlash</a>
           <p>Havola 24 soat amal qiladi.</p>`,
  });
};

// Tasdiqlash endpoint'i
export const emailTasdiqla = async (req, res, next) => {
  try {
    const { token } = req.query;
    const yozuv = await EmailToken.findOne({ token, expiresAt: { $gt: new Date() } });
    if (!yozuv) return res.status(400).json({ error: "Havola yaroqsiz/muddati tugagan" });
    await User.findByIdAndUpdate(yozuv.userId, { emailTasdiqlangan: true });
    await yozuv.deleteOne();                            // bir martalik (5.18)
    res.json({ message: "Email tasdiqlandi" });
  } catch (err) { next(err); }
};

import crypto from "node:crypto";
import bcrypt from "bcrypt";

// 1. Tiklash so'rovi (havola yuborish)
export const parolTiklashSorov = async (req, res, next) => {
  try {
    const { email } = req.body;                         // (5.9)
    const user = await User.findOne({ email });
    //  Foydalanuvchi bor/yo'qligini OSHKOR QILMA (14, 5.15)
    if (user) {
      const token = crypto.randomBytes(32).toString("hex");   // (5.3)
      user.resetToken = await bcrypt.hash(token, 10);    // hash (DB sizsa — 14)
      user.resetExpires = new Date(Date.now() + 3600000); // 1 soat
      await user.save();
      const url = `${config.clientUrl}/reset-password?token=${token}&id=${user.id}`;
      await emailYubor({
        to: email, subject: "Parolni tiklash",
        html: `<p>Parolni tiklash uchun:</p><a href="${url}">Tiklash</a>
               <p>1 soat amal qiladi. So'ramagan bo'lsangiz, e'tiborsiz qoldiring.</p>`,
      });
    }
    // Doim bir xil javob (oshkor qilmaslik — 14)
    res.json({ message: "Agar email mavjud bo'lsa, havola yuborildi" });
  } catch (err) { next(err); }
};

// 2. Yangi parol o'rnatish
export const parolTiklash = async (req, res, next) => {
  try {
    const { id, token, yangiParol } = req.body;
    const user = await User.findById(id).select("+resetToken +resetExpires");
    if (!user || !user.resetExpires || user.resetExpires < new Date() ||
        !(await bcrypt.compare(token, user.resetToken))) {   // tekshirish (14)
      return res.status(400).json({ error: "Havola yaroqsiz/muddati tugagan" });
    }
    user.parol = await bcrypt.hash(yangiParol, 12);     // yangi parol (5.15)
    user.resetToken = undefined; user.resetExpires = undefined;   // bir martalik
    await user.save();
    res.json({ message: "Parol tiklandi" });
  } catch (err) { next(err); }
};

// PDF chek biriktirish (2.7)
await emailYubor({
  to: user.email,
  subject: `Buyurtma #${buyurtma.id} cheki`,
  html: `<p>Buyurtmangiz uchun rahmat! Chek ilova qilingan.</p>`,
  attachments: [
    { filename: `chek-${buyurtma.id}.pdf`, path: `./cheklar/${buyurtma.id}.pdf` },   // diskdan
    { filename: "logo.png", path: "./assets/logo.png", cid: "logo" },                // HTML ichida
  ],
});
// HTML'da: <img src="cid:logo"> — biriktirilgan logo (2.7)

// services/email.js — barcha email mantig'i bir joyda (9: SOLID)
import nodemailer from "nodemailer";
import { config } from "../config/index.js";

class EmailService {
  constructor() {
    this.transporter = nodemailer.createTransport({     // bir marta (2.3)
      host: config.smtp.host, port: 587, secure: false,
      auth: { user: config.smtp.user, pass: config.smtp.pass },
      pool: true,                                        // connection pooling (ko'p email — 2.3)
    });
  }
  async send({ to, subject, text, html, attachments }) {
    return this.transporter.sendMail({
      from: `"${config.appName}" <${config.smtp.user}>`,
      to, subject, text, html, attachments,
    });
  }
  // Maxsus metodlar
  xushKelibsiz(user) {
    return this.send({ to: user.email, subject: "Xush kelibsiz!", html: xushKelibsizHtml(user.ism) });
  }
  parolTiklash(email, url) {
    return this.send({ to: email, subject: "Parolni tiklash", html: `<a href="${url}">Tiklash</a>` });
  }
}
export const emailService = new EmailService();

// Dev'da test SMTP (haqiqiy email yuborilmaydi — 2.11)
const transporter = nodemailer.createTransport(
  config.isProd
    ? { host: config.smtp.host, port: 587, secure: false, auth: {...} }   // production
    : {                                                                     // dev: Mailtrap
        host: "sandbox.smtp.mailtrap.io", port: 2525,
        auth: { user: config.mailtrap.user, pass: config.mailtrap.pass },
      }
);
// Dev'da email Mailtrap panelida ko'rinadi (foydalanuvchiga bormaydi — 2.11)

//  resurs isrofi (2.3)
async function send() { const t = nodemailer.createTransport(...); await t.sendMail(...); }

//  bir marta (modul darajasida)
const transporter = nodemailer.createTransport(...);

//  kodda (14, 5.8)
auth: { user: "a@gmail.com", pass: "parol123" }

//  .env
auth: { user: config.smtp.user, pass: config.smtp.pass }

//  "bunday email yo'q"  hacker emaillarni aniqlaydi (14, Misol 5)
if (!user) return res.json({ error: "Email topilmadi" });

//  doim bir xil javob
res.json({ message: "Agar email mavjud bo'lsa, havola yuborildi" });

//  text yo'q  spam'ga moyil, ba'zi mijoz ko'rmaydi (2.5, 2.10)
{ html: "<h1>...</h1>" }

//  ikkalasi
{ text: "...", html: "<h1>...</h1>" }

//  foydalanuvchi 3 sekund kutadi (2.9)
await emailYubor(...); res.json({ ok: true });

//  navbatga qo'y, darrov javob (5.22)
emailQueue.add("welcome", { userId }); res.json({ ok: true });