# Moongram Mail API Updates

Last updated: 2026-06-24 00:00 +06:00

Copy the full `Mails/Mail_API` folder contents into cPanel `public_html/Mail_API` after reviewing passwords and paths.

## Completed Update Log

- [x] 2026-04-27 01:47 +06:00 - Added shared `config.php` for SMTP senders, PHPMailer path, API token placeholder, brand logo URLs, and OTP database placeholders.
- [x] 2026-04-27 01:47 +06:00 - Added shared `mail_common.php` for CORS, JSON parsing, optional API token validation, PHPMailer sending, and Moongram email UI templates.
- [x] 2026-04-27 01:47 +06:00 - Rebuilt `otp_mail.php` with `generate_otp`, `send_otp`, `account_otp_verification`, and `verify_otp` actions.
- [x] 2026-04-27 01:47 +06:00 - Added `welcome_mail.php` for account welcome, beta registration, tester request, and moderator application received emails.
- [x] 2026-04-27 01:47 +06:00 - Added `password_reset_mail.php` for password reset and password changed emails.
- [x] 2026-04-27 01:47 +06:00 - Added `alert_mail.php` for login alerts, suspicious activity, email changed, and chat safety notices.
- [x] 2026-04-27 01:47 +06:00 - Added `news_mail.php` for beta release, beta invitation, and general news emails.
- [x] 2026-04-27 01:47 +06:00 - Added `support_mail.php` for report received/status and internal support report notifications.
- [x] 2026-04-27 01:47 +06:00 - Added `moderation_mail.php` for appeals, moderation decisions, content actions, account actions, and internal moderation notifications.
- [x] 2026-05-13 00:00 +06:00 - Fixed OTP expiry clock mismatch by storing and verifying OTP expiration with MySQL `UTC_TIMESTAMP()` instead of mixing PHP `date()` with MySQL `NOW()`.
- [x] 2026-05-13 18:50 +06:00 - Added a backward-compatible OTP fallback for `moongram_request_context_rows()` so `otp_mail.php` does not fatal if cPanel has an older `mail_common.php`.
- [x] 2026-06-23 23:59 +06:00 - Added explicit Main App OTP contexts for `main_signup` and `main_login` so backend auth emails no longer fall back to generic wording.
- [x] 2026-06-23 23:59 +06:00 - Added dedicated Chat Lock reset OTP contexts: `chat_lock_reset` and `chat_lock_reset_otp`.
- [x] 2026-06-23 23:59 +06:00 - Updated login alert wording to respect product context. Main App login alerts now say `Moongram`; Beta wording is used only when explicitly requested.
- [x] 2026-06-23 23:59 +06:00 - Split Main App and Beta fallback URLs for support report and moderation appeal emails.
- [x] 2026-06-24 00:00 +06:00 - Rebuilt the shared email shell into the current Moongram dark premium style and switched brand assets to CDN/R2 URLs.
- [x] 2026-07-10 21:55 +06:00 - Added Moongram Help request emails from `help@moongram.online` for case received, status updates, public replies, workspace assignments, and new workspace case alerts.

## Sender Emails To Create In cPanel

After each mailbox is created in cPanel, tick it here and paste the password only into `config.php`.

- [x] `security@moongram.online`
  Password field in `config.php`: `$MOONGRAM_MAIL_SENDERS['security']['5Eu?M3j}P)ej7{o0']`

- [x] `no-reply@moongram.online`
  Password field in `config.php`: `$MOONGRAM_MAIL_SENDERS['no_reply']['sstA)$Lo{,7_sv3G']`

- [x] `registrations@moongram.online`
  Password field in `config.php`: `$MOONGRAM_MAIL_SENDERS['registrations']['(v7^B^EX_N==@{Y9']`

- [x] `support@moongram.online`
  Password field in `config.php`: `$MOONGRAM_MAIL_SENDERS['support']['X%UP}b,]!O63!-jd']`

- [x] `help@moongram.online`
  Password field in `config.php`: `$MOONGRAM_MAIL_SENDERS['help']['ENTER THE REAL PASS']`

- [x] `beta@moongram.online`
  Password field in `config.php`: `$MOONGRAM_MAIL_SENDERS['beta']['QjFfnT*HwCgDNiTH']`

- [x] `moderation@moongram.online`
  Password field in `config.php`: `$MOONGRAM_MAIL_SENDERS['moderation']['6b@]-immhuaS6mSR']`

- [x] `notifications@moongram.online`
  Password field in `config.php`: `$MOONGRAM_MAIL_SENDERS['notifications']['W.?NVLKL~3(HF*$@']`

## Required Manual Values In `config.php`

- [x] `PHPMAILER_PATH`
  Set this to the real PHPMailer source folder in cPanel if `/Mail_API/PHPMailer/src/` is not correct. # the path is [/PHPMailer/src/]

- [ ] `MAIL_API_TOKEN` , you r making the API now so you know the token just add it
  Replace `ENTER THE REAL API TOKEN` with a long random token before production backend integration.

- [x] SMTP passwords,  i did
  Replace every `ENTER THE REAL PASS` with the real mailbox password.

- [x] OTP database values
  Fill `OTP_DB_NAME`, `OTP_DB_USER`, and `OTP_DB_PASS` only if `otp_mail.php` should store and verify OTP codes itself.

## Public Endpoints

Base folder on cPanel:

`https://axtrioai.com/Mail_API/`

Endpoints:

- `otp_mail.php`
- `welcome_mail.php`
- `password_reset_mail.php`
- `alert_mail.php`
- `news_mail.php`
- `support_mail.php`
- `moderation_mail.php`

## Request Rules

All endpoints use:

```http
POST /Mail_API/{file}.php
Content-Type: application/json
Authorization: Bearer {MAIL_API_TOKEN}
```

`Authorization` is only required after `MAIL_API_TOKEN` is changed from the placeholder.

All endpoints accept either a JSON object or a one-item JSON array.

Example:

```json
{
  "action": "beta_report_received",
  "email": "user@example.com",
  "name": "Adam Cruse",
  "report_id": "483920",
  "report_title": "Chat image not loading",
  "status": "open",
  "action_url": "https://beta.moongram.online/profile/reports/483920"
}
```

## Actions By File

### `otp_mail.php`

- `generate_otp`
- `send_otp`
- `account_otp_verification`
- `verify_otp`

For send actions, accepted fields:

- `email`
- `name`
- `flow` optional; controls email wording. Examples: `main_signup`, `main_login`, `account_creation`, `login`, `beta_login`, `moderation_login`, `support_login`, `password_reset`, `email_change`, `chat_lock_reset_otp`.
- `platform` optional; overrides the product label shown in the email.
- `purpose` optional; overrides the requested-for text shown in the email.
- `expires_minutes` optional, default `15`.
- The API always generates the OTP itself, stores it, then sends it. It does not return the OTP in JSON.

For verify:

- `email`
- `otp_code` or `otp`

### `welcome_mail.php`

- `account_welcome`
- `welcome`
- `registration_success`
- `beta_registration_received`
- `tester_application_received`
- `moderator_application_received`

### `password_reset_mail.php`

- `account_password_reset`
- `password_reset`
- `account_password_changed`
- `password_changed`

### `alert_mail.php`

- `account_login_new_device`
- `login_new_device`
- `account_suspicious_activity`
- `suspicious_activity`
- `account_email_changed`
- `email_changed`
- `main_message_safety_notice`
- `message_safety_notice`

### `news_mail.php`

- `beta_release_published`
- `main_beta_invitation`
- `beta_invitation`
- `general_news`
- `news`

### `support_mail.php`

- `help_case_received`
- `help_report_received`
- `help_appeal_received`
- `help_case_status_updated`
- `help_report_status_updated`
- `help_appeal_status_updated`
- `help_case_resolved`
- `help_case_waiting_for_user`
- `help_case_reply`
- `help_report_reply`
- `help_appeal_reply`
- `help_workspace_case_assigned`
- `help_workspace_new_case`
- `beta_report_received`
- `main_report_received`
- `beta_report_status_updated`
- `main_report_status_updated`
- `beta_admin_new_report`

### `moderation_mail.php`

- `beta_appeal_received`
- `main_appeal_received`
- `beta_appeal_status_updated`
- `main_appeal_decision`
- `appeal_decision`
- `main_content_removed`
- `content_removed`
- `main_account_action`
- `account_action`
- `beta_admin_new_appeal`

## Notes For Future Integration

- Website actions should succeed even if email sending fails. Email should be fired after the database action is already saved.
- Do not call these endpoints directly from public frontend code once `MAIL_API_TOKEN` is set. Call them from Moongram backend code so the token stays private.
- Keep all passwords only in cPanel `config.php`. Do not commit real mailbox passwords.
- The email design uses hosted CDN/R2 brand assets from `config.php`:
  - Moongram text/logo: `MOONGRAM_TEXT_LOGO_URL`
  - Axtrio AI footer logo: `AXTRIO_AI_TEXT_LOGO_URL`
  - Email clients cannot load app-local `/public` files, so keep these as absolute URLs.

- [x] 2026-04-27 02:28 +06:00 - Generated and filled a strong 64-character MAIL_API_TOKEN in config.php.
- [x] 2026-04-27 02:28 +06:00 - Improved OTP email body with stronger visual hierarchy, expiry context, and security note.
- [x] 2026-04-27 02:28 +06:00 - Added Mails/MAIL_API_TESTING.md with Postman setup, OTP send/verify tests, examples for each endpoint, and troubleshooting.

- [x] 2026-04-27 02:50 +06:00 - Fixed token validation for cPanel by accepting Authorization, X-Mail-Api-Token, api_token, mail_api_token, token, and api_key; token values are now normalized for quotes/spaces/Bearer prefix.
- [x] 2026-04-27 02:50 +06:00 - Added .htaccess to help Apache/cPanel pass Authorization headers to PHP.
- [x] 2026-04-27 02:50 +06:00 - Updated Mails/MAIL_API_TESTING.md to recommend X-Mail-Api-Token for Postman and document body fallback.

- [x] 2026-04-27 02:55 +06:00 - Fixed PHPMailer loading for cPanel by auto-detecting Mail_API/PHPMailer/src, public_html/PHPMailer/src, account-root PHPMailer/src, and document-root variants.
- [x] 2026-04-27 02:55 +06:00 - Replaced fatal require_once behavior with a clean JSON error that lists checked PHPMailer paths if files are still missing.
- [x] 2026-04-27 02:55 +06:00 - Updated Mails/MAIL_API_TESTING.md PHPMailer troubleshooting instructions.

- [x] 2026-04-27 03:10 +06:00 - Simplified OTP into production two-step flow: generate/store/send first, then verify by email+OTP. Added context-aware copy for account creation, login, beta, moderation, support center, password reset, and email change. Removed custom OTP injection from send flow.

- [x] 2026-04-27 03:18 +06:00 - Fixed OTP DB connection bootstrap: config now attempts PDO when DB constants are filled instead of comparing against real DB names. Added automatic otp_codes table creation and check_otp_config / otp_health actions for Postman diagnostics.

- [x] 2026-04-27 03:19 +06:00 - Made OTP PDO/table errors return OTP database error JSON instead of generic email-send error.

- [x] 2026-04-27 11:43 +06:00 - Deliverability fix: changed SMTP host to mail.moongram.online so @moongram.online sender aligns with SPF/DKIM mail domain. Added envelope sender, domain-aligned Message-ID, transactional headers, and Mails/MAIL_DELIVERABILITY_CHECKLIST.md.

- [x] 2026-04-27 11:51 +06:00 - Reverted SMTP host to mail.axtrioai.com because Axtrio AI is the cPanel main mail server. Added separate MOONGRAM_MESSAGE_ID_DOMAIN so Message-ID stays moongram.online while SMTP connects to Axtrio. Updated deliverability checklist with required moongram.online SPF DNS fix for 144.76.64.174.

- [x] 2026-04-28 19:25 +06:00 - Rebuilt the OTP and login alert email layouts into the new cleaner Moongram style: brand header with icon/divider/text logo, flat detail rows, account avatar support for login alerts, area/IP/device/time details, and `From Axtrio AI` footer image.

- [x] 2026-04-28 19:25 +06:00 - Refined the modern mail header to use a white background, black Moongram text logo, balanced divider spacing, and rounded app logo clipping. Login alerts now show account avatar, full name, and username instead of exposing the email in the visible account row.

- [x] 2026-04-28 19:25 +06:00 - Replaced the oversized combined `From Axtrio AI` footer image with controlled small `From` text plus the standalone Axtrio AI text logo.

- [x] 2026-04-28 19:25 +06:00 - Removed the old `moongram_text_logo.png` dependency from mail config and added versioned black/white text logo URLs to avoid stale cached email images.

- [x] 2026-04-29 14:27 +06:00 - Applied the modern Moongram email shell to all older mail actions that used `moongram_email_html`, including welcome, password reset, news, support, moderation, and secondary security alerts. Detail rows now use the flatter line-row style, and the `From` / Axtrio AI footer mark is smaller.

- [x] 2026-04-29 14:42 +06:00 - Added smarter dynamic content across mail endpoints: request/device/area/IP context rows, IDs and status tracking, screenshots/attachments counts, moderator/admin action guidance, appeal decision context, release highlights, beta invite metadata, and per-action next-step/security notes.

- [x] 2026-05-01 18:18 +06:00 - Updated support status/reply emails to accept `reply_title`, show it in the email body, use it as the email headline/subject, and documented the new Postman field in `Mails/MAIL_API_TESTING.md`.

- [x] 2026-05-01 18:49 +06:00 - Fixed global mail detail-row alignment so values such as Team note, status, IDs, and context rows render left-aligned instead of pushed to the right.