Admin: surface the real email failure instead of a generic one

OP OpenVibers committed 18 Aug 2026 · 1230718930 · 1 file, +19 −1

The first real use of the reset button returned "Email service failed to send
the reset link", which gave no way to find the cause without reading server
logs. The actual reason was a Resend 403: the openvibe.network domain is not
verified.

sendPasswordResetEmail only returns a boolean, but _sendEmail already records
the provider's message in email_delivery_log. Read the most recent failure for
that recipient back and include it in the 502.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Xw6Sf5zzSALw8m93XNu5JE

Changes

ddiff --git a/server/admin/routes.js b/server/admin/routes.js
iindex 5aa876c3..5d84d0ef 100644
---- a/server/admin/routes.js
++++ b/server/admin/routes.js
@@@ -630,7 +630,25 @@ function createAdminRoutes(db, notificationService, emailService, requireAuth) {
              if (!sent) {
                  // The token was already written; leave it — it simply goes unused and
                  // expires. Better than reporting success on an email that never left.
--                return res.status(502).json({ ok: false, error: 'Email service failed to send the reset link' });
++                //
++                // sendPasswordResetEmail only returns a boolean, but _sendEmail records the
++                // provider's reason in email_delivery_log. Read it back so the admin sees
++                // what actually went wrong instead of a generic failure — the first real use
++                // of this button hit "the openvibe.network domain is not verified" and the
++                // generic message gave no way to know that without reading server logs.
++                let reason = null;
++                try {
++                    const row = db.prepare(`
++                        SELECT error_message FROM email_delivery_log
++                        WHERE recipient = ? AND status = 'failed'
++                        ORDER BY id DESC LIMIT 1
++                    `).get(target.email);
++                    reason = row && row.error_message ? String(row.error_message) : null;
++                } catch { /* best effort */ }
++                return res.status(502).json({
++                    ok: false,
++                    error: reason ? `Email service failed: ${reason}` : 'Email service failed to send the reset link',
++                });
              }
  
              db.prepare('INSERT INTO audit_log (user_id, action, details) VALUES (?, ?, ?)').run(

diff --git a/server/admin/routes.js b/server/admin/routes.js

index 5aa876c3..5d84d0ef 100644

--- a/server/admin/routes.js

+++ b/server/admin/routes.js

@@ -630,7 +630,25 @@ function createAdminRoutes(db, notificationService, emailService, requireAuth) {

if (!sent) {

// The token was already written; leave it — it simply goes unused and

// expires. Better than reporting success on an email that never left.

- return res.status(502).json({ ok: false, error: 'Email service failed to send the reset link' });

+ //

+ // sendPasswordResetEmail only returns a boolean, but _sendEmail records the

+ // provider's reason in email_delivery_log. Read it back so the admin sees

+ // what actually went wrong instead of a generic failure — the first real use

+ // of this button hit "the openvibe.network domain is not verified" and the

+ // generic message gave no way to know that without reading server logs.

+ let reason = null;

+ try {

+ const row = db.prepare(`

+ SELECT error_message FROM email_delivery_log

+ WHERE recipient = ? AND status = 'failed'

+ ORDER BY id DESC LIMIT 1

+ `).get(target.email);

+ reason = row && row.error_message ? String(row.error_message) : null;

+ } catch { /* best effort */ }

+ return res.status(502).json({

+ ok: false,

+ error: reason ? `Email service failed: ${reason}` : 'Email service failed to send the reset link',

+ });

}

db.prepare('INSERT INTO audit_log (user_id, action, details) VALUES (?, ?, ?)').run(