Email — Zkrinet plugin

On Zkrinet: add the block under Building blocks in the panel — one click, your own code is untouched and a snapshot is taken first. The installation steps below apply if you run PocketBase yourself, for example after an export.

Ready-made email templates that you edit in the admin panel, a function for sending them, and a log of everything sent. Tested against PocketBase 0.40.4.

#Install

Copy pb_hooks/ and pb_migrations/ into your project and restart. Emails are sent via your own SMTP — configure it under Settings → Mail settings in the admin panel.

#What you get

• zk_mejlmallar — three ready-made templates in Swedish: valkomst, notis, kvitto. Change text, subject and appearance directly in the admin panel. Variables are written {{namn}}. {{app}} is always your app name.
• zk_mejllogg — every email sent, with recipient, template and whether it was delivered or not.
• Welcome email when someone creates an account in users. Off by default — turn it on by checking aktiv on the valkomst template.

#Send from your code

In your own hook (pb_hooks/*.pb.js):

const mejl = require(`${__hooks}/zk_mejl_lib.js`)
mejl.skicka($app, "notis", "anna@exempel.se", { namn: "Anna", rubrik: "New comment", meddelande: "Someone replied to you." })

Or via the API (requires superuser — call it from your server, never from the browser):

POST /api/zk/mejl   {"mall": "kvitto", "till": "anna@exempel.se", "data": {"namn": "Anna", "belopp": "99 kr", ...}}

#Extra headers (for other plugins)

A fifth argument to skicka sets allowlisted headers — nothing else gets through:

mejl.skicka($app, "notis", "anna@exempel.se", { ... }, { svara_till: "bo@exempel.se", avregistrera: "https://…", ett_klick: true })

svara_till → Reply-To (a single valid address). avregistrera → List-Unsubscribe (https only), ett_klick → List-Unsubscribe-Post (RFC 8058). Values containing line breaks or in the wrong format are silently ignored — the email is sent without the header.

#Security

• Variables are automatically HTML-escaped in the HTML part — <script> becomes text.
• Line breaks in the subject line are removed, so no one can sneak in extra recipients.
• The templates and the log are readable by superuser only.
• A broken email never stops an account from being created; the error ends up in the log.

#Limitations

• No attachments yet.
• Emails are sent immediately, without a queue: if your SMTP is down the error is logged but the email is not retried.