inbox-check.ts

scripts/inbox-check.ts

1. /**
2. * Does the Gmail service account actually work? Ask Google directly.
3. *
4. * Verifying the credential through the Worker is slow or impossible:
5. * `wrangler dev` cannot see secrets set with `secret put`, so it always reports
6. * "not set"; `wrangler dev --remote` can, but its preview-session API is
7. * unreliable on the pinned wrangler; and a deployed Worker only reads Gmail
8. * when its cron fires. So the one question that matters during setup (is the
9. * delegation right?) needs its own fast answer.
10. *
11. * This asks Google the same question the Worker will, through the same client
12. * code, with no Cloudflare in the middle.
13. *
14. * Read-only; writes nothing. It lists one message per mailbox to prove the
15. * impersonation works, prints no subjects and no senders, and stores nothing.
16. *
17. * pnpm inbox:check ~/Downloads/meridian-dashboard-inbox-abc123.json
18. *
19. * Or, if you have already deleted the key file and put it in your environment:
20. *
21. * pnpm inbox:check
22. */
24. import { readFileSync } from 'node:fs'
25. import { INBOX_MAILBOXES } from '../config/inbox.js'
26. import { GMAIL_SCOPE, GMAIL_SCOPES, readMailbox, type ServiceAccount } from '@meridian/gmail-client'
27. import { errorMessage } from '@meridian/shared'
29. function credentials(): ServiceAccount {
30. const file = process.argv[2]
31. if (file) {
32. let parsed: { client_email?: string; private_key?: string }
33. try {
34. parsed = JSON.parse(readFileSync(file, 'utf8')) as typeof parsed
35. } catch (err) {
36. console.error(`Could not read ${file}: ${errorMessage(err)}`)
37. process.exit(1)
38. }
39. if (!parsed.client_email || !parsed.private_key) {
40. console.error(`${file} has no client_email / private_key. Is it the service account key JSON?`)
41. process.exit(1)
42. }
43. return { email: parsed.client_email, privateKey: parsed.private_key }
44. }
46. const email = process.env.GMAIL_SA_EMAIL
47. const privateKey = process.env.GMAIL_SA_KEY
48. if (!email || !privateKey) {
49. console.error('Usage: pnpm inbox:check <path-to-service-account-key.json>')
50. console.error(' or: set GMAIL_SA_EMAIL and GMAIL_SA_KEY and run with no argument.')
51. process.exit(1)
52. }
53. return { email, privateKey }
54. }
56. const sa = credentials()
57. console.log(`\nService account: ${sa.email}`)
58. console.log(`Scopes: ${GMAIL_SCOPE}\n`)
60. let ok = 0
61. const failures: string[] = []
63. for (const m of INBOX_MAILBOXES) {
64. // One message is enough to prove impersonation. Nothing about it is printed.
65. const r = await readMailbox(m.email, sa, { maxMessages: 1 })
66. if (r.ok) {
67. ok++
68. console.log(` OK ${m.email.padEnd(28)} (${r.messages.length} message read)`)
69. } else {
70. failures.push(m.email)
71. console.log(` FAILED ${m.email.padEnd(28)} ${r.error}`)
72. }
73. }
75. console.log(`\n${ok} of ${INBOX_MAILBOXES.length} mailboxes readable.`)
77. if (failures.length === INBOX_MAILBOXES.length) {
78. // Every mailbox failing is a different diagnosis from one failing, and the
79. // difference is worth stating rather than leaving to be inferred from a wall
80. // of identical errors.
81. console.log(
82. `\nAll of them failed, which points at the delegation rather than at any\n` +
83. `individual mailbox. Check, in this order:\n` +
84. ` 1. Google Admin -> Security -> Access and data control -> API controls\n` +
85. ` -> Domain-wide delegation has an entry for this service account's\n` +
86. ` UNIQUE ID (the long number, not the email).\n` +
87. ` 2. Its scopes are exactly (that field is COMMA-separated, unlike\n` +
88. ` the OAuth parameter above): ${GMAIL_SCOPES.join(',')}\n` +
89. ` 3. It has been a few minutes: Admin changes propagate slowly.\n` +
90. ` 4. The Gmail API is enabled on the Cloud project.`,
91. )
92. } else if (failures.length) {
93. console.log(`\nSome mailboxes read and some did not, so the delegation is working.`)
94. console.log(`The failures are about those addresses: ${failures.join(', ')}.`)
95. console.log(`A mailbox that does not exist, is suspended, or is a group rather`)
96. console.log(`than a mailbox will fail this way.`)
97. } else if (process.argv[2]) {
98. console.log(`\nAll good. Delete the key file now: it opens every mailbox in the domain:`)
99. console.log(` rm ${process.argv[2]}`)
100. }