intuitem / ciso-assistant-community

CISO Assistant is a one-stop-shop for GRC, covering Risk, AppSec and Audit Management and supporting +48 frameworks worldwide: NIST CSF, ISO 27001, SOC2, CIS, PCI DSS, NIS2, CMMC, PSPF, GDPR, HIPAA, Essential Eight, NYDFS-500, DORA, NIST AI RMF, 800-53, 800-171, CyFun, CJIS, AirCyber, NCSC, ECC, SCF and so much more
https://intuitem.com
GNU Affero General Public License v3.0
913 stars 93 forks source link

Allow mailer configuration from settings in the web application rather than via environment variables #592

Open AlexLaroche opened 5 days ago

ab-smith commented 2 days ago

we will have to think about this one and how it will fit for the 1st init and how it would interact in SaaS enviornments

nas-tabchiche commented 12 hours ago

We could do it by writing an EmailSettings model and providing a connection to the send_mail function. The User.mailing method would essentially look like this:

+ from settings.models import EmailSettings
...
    def mailing(self, email_template_name, subject, pk=False):
        """
        Sending a mail to a user for password resetting or creation
        """
+       email_settings = EmailSettings.objects.get()
        header = {
            "email": self.email,
            "root_url": CISO_ASSISTANT_URL,
            "uid": urlsafe_base64_encode(force_bytes(self.pk)),
            "user": self,
            "token": default_token_generator.make_token(self),
            "protocol": "https",
            "pk": str(pk) if pk else None,
        }
        email = render_to_string(email_template_name, header)
        try:
            send_mail(
                subject=subject,
                message=email,
                from_emailNone,
                recipient_list[self.email],
                fail_silently=False,
                html_message=email,
+               connection=get_connection(host=email_settings.email_host, port=email_settings.email_port, ...)
            )
            logger.info("email sent", recipient=self.email, subject=subject)
            ...

https://docs.djangoproject.com/en/dev/topics/email/#obtaining-an-instance-of-an-email-backend https://docs.djangoproject.com/en/dev/topics/email/#send-mail

I'm quite confident it would work well, however we should think thoroughly about the potential blast radius of this change.