As a DevSecOps I want to be able to send email notifications from the app without having to manually renew the refresh token every week.

[rlho]

Background

We need to send approval request emails to approvers when a user makes requests, and confirmation emails to users after they've completed their booking.

Goal

Implement a method for our application to send emails to users

Options with pros and cons

1. Sending emails via GCP Service Account

Pros:

• No need to prepare and publish an OAuth app

Cons:

• The sender will be a service account
• Requires domain-wide authority delegation from Google Workspace admin

Requirements:

• Domain-wide authority delegation for a service account from NYU Google Workspace admin
  • https://developers.google.com/cloud-search/docs/guides/delegation#delegate_domain-wide_authority_to_your_service_account

2. Sending emails via GCP OAuth App

Pros:

• Can use any email address

Cons:

• If published externally, need to prepare privacy policy and demo video
• If kept internal, requires an @nyu.edu account within the same organization as the app

Requirements:

• For internal app: An email address under the nyu.edu domain
  • https://support.google.com/cloud/answer/10311615?
• For external app: Privacy policy, demo video
  • OAuth App Verification Requirements

3. Using External Service (SendGrid)

Pros:

• Free to set our email address. (needs investigation)

Cons:

• Additional cost
• Requires management of another service

For more information on SendGrid, see:

• SendGrid Documentation