[BackStacked]

Requested by Himanshu · project thread

What and why

Before: password-reset links could only be sent through MAIL_WEBHOOK_URL, a hand-built relay that posted a plain-text body. With no relay set, no email went out.

After: with SMTP_URL and MAIL_FROM set, the worker sends the password-reset mail using mail-kit. The api also sends it directly when there is no Redis. The mail is written in mail-kit's mail design language and goes out as branded HTML plus plain text, using the lab's name, address and phone from report-kit's lab profile. MAIL_WEBHOOK_URL still works when SMTP_URL is not set.

How:

• src/jobs/mailer.ts: mailKitMailer implements the api's Mailer with mail-kit's password-reset template. mailerFromConfig picks mail-kit (SMTP_URL), then the webhook, then none. The api's own mail queue already holds the job, and the worker creates the reset token, so mail-kit gets no queue and the raw token never sits in Redis.
• src/config/env.ts: SMTP_URL (smtp:// or smtps://) and MAIL_FROM. In production, MAIL_FROM is required whenever SMTP_URL is set.
• kits.json and package.json: mail-kit at the merge commit of mail-kit feat: GraphQL backend over the kits, one endpoint #1.
• Docs updated: configuration, worker, deployment, auth, architecture and the local-agent brief. The generated files were regenerated.

Type

• Bug fix
• Feature
• Test data (ranges, units, prices) — source linked below
• Docs
• Refactor / tooling

Checklist

• Opened on a branch (not main)
• npm run typecheck passes
• The repo's tests pass (TEST_BACKENDS=pg npm test: 104 passed; 8 new [mail] checks covering the rendered reset mail, escaping, IST expiry, brand footer and config rules)
• Docs updated
• HTTP contract changed? (no; the GraphQL schema is unchanged)
• No real patient data, contact details or signatures

🤖 Generated with Claude Code

https://claude.ai/code/session_01ExvzEi3nvXSWrvbbMYaWTQ

---

Generated by Claude Code