id: mail_templates
name: Mail Templates (ACKnowledge)
version: 1.0.3
description: "Turns a subject and a markdown description into an ACKnowledge SOC email (dark theme, header badge, signature with the logo, footer) — nothing is sent: chain the output into exchange-send-mail or mail-sender (`subject` → subject, `html_body` → html_body, `text_body` → body). Eight templates, each with its own badge and colour: sla_breach, incident_notification (colour follows `severity`), incident_update, incident_closure, action_required, escalation, threat_bulletin, info. The description takes markdown: headings (## is the blue capitalised section title), bold, italic, links, lists, quotes, rules, GFM tables, `code` and ``` blocks (hashes, IPs, command lines), and level pills `{{critical}}` `{{high}}` `{{medium}}` `{{low}}` `{{info}}` `{{ok}}` — `{{high:Élevée}}` changes the label. Raw HTML in the inputs is escaped, so alert data can be interpolated safely. The logo is an inline data-URI PNG: exchange-send-mail and mail-sender embed it; the Gmail integration does not, and the logo is lost there. No connection, no secret; stdlib-only."
changelog: "1.0.3 — description and callout_text declare format: markdown: Riposte 0.322+ edits them in a multi-line text area that keeps line breaks (\\n still works on older versions). | 1.0.2 — The playbook editor's input field is a single line and drops pasted newlines, so a pasted description rendered as one heading: description and callout_text without a line break now read the two characters \\n as one. | 1.0.1 — The Test button failed (NameError: __file__) and render-mail-template printed nothing: Riposte runs a script with exec(), without __file__ or __name__. The test no longer imports the renderer and the renderer runs main() unconditionally. | 1.0.0 — Initial release: render-mail-template (8 templates, markdown description with tables, code and level pills, optional callout, action button, case reference and severity, SOC or client footer, French or English) and a self-test."
category: email

# Nothing to connect to. The only setting names the bot in the SOC footer
# ("generated automatically by the <bot_name> bot").
config_schema:
  properties:
    bot_name:
      type: string
      description: "Bot named in the footer of SOC mails (default Riposte)"
      default: Riposte
  required: []

commands:
  - id: render_mail_template
    name: mail-render-template
    description: "Render an ACKnowledge SOC email from a template, a subject and a markdown description. Returns `subject` (prefixed with [case_ref] when case_ref is given and not already in it), `html_body` (table layout with inline styles, for Outlook and webmail), `text_body` (the plain-text part) and `html_bytes`. Sends nothing: pass the outputs to exchange-send-mail or mail-sender."
    risk: read
    inputs_schema:
      properties:
        template:
          type: string
          enum: [sla_breach, incident_notification, incident_update, incident_closure, action_required, escalation, threat_bulletin, info]
          description: "Layout: sla_breach (red, SLA ALERT), incident_notification (colour of `severity`), incident_update (blue, STATUS UPDATE), incident_closure (green, CLOSED), action_required (orange), escalation (magenta), threat_bulletin (violet), info (grey, default)"
        subject: { type: string, description: "Subject, also shown as the title of the mail" }
        description: { type: string, format: markdown, description: "Body in markdown — ## section titles, **bold**, lists, tables, `code`, ``` blocks, {{medium}} pills. On Riposte before 0.322 (one-line field), write each line break as \\n" }
        callout_text: { type: string, format: markdown, description: "Highlighted box above the description (markdown). Empty: no box" }
        callout_title: { type: string, description: "Title of the box (default: the template badge, e.g. ⚠ SLA ALERT)" }
        button_label: { type: string, description: "Action button text, e.g. Open the case in Riposte (needs button_url)" }
        button_url: { type: string, description: "Action button link (http or https)" }
        case_ref: { type: string, description: "Case or ticket reference, shown under the title and prefixed to the subject" }
        severity:
          type: string
          enum: [critical, high, medium, low, info]
          description: "Severity pill under the title; for incident_notification it sets the badge colour and label"
        audience:
          type: string
          enum: [soc, client]
          description: "Footer: soc (generated by the bot, default) or client (confidentiality notice)"
        lang:
          type: string
          enum: [fr, en]
          description: "Language of the badges, date and footer (default fr)"
        date:
          type: string
          description: "ISO 8601 date shown under the title, in UTC (default: now)"
      required: [template, subject, description]
    outputs_schema:
      properties:
        subject: { type: string }
        html_body: { type: string }
        text_body: { type: string }
        template: { type: string }
        lang: { type: string }
        audience: { type: string }
        html_bytes: { type: number }

  - id: test_connection
    name: mail-templates-test
    description: "Check the integration is installed and list its templates; nothing to connect to (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }