feat(email): generic webhook for all notification emails, hide SMTP UI

- Renamed the password-setup webhook (email_webhook.*, /system/email-webhook-config)
  and made it the single transport for all notification emails.
- New webhook_email_service.py shared by password_setup_service and
  notification_service.
- Wired test validated/rejected, campaign completed, and new-MITRE-technique
  notifications through the webhook (previously dead SMTP code, never triggered).
- Added POST /system/email-webhook-test to send a real test email.
- Hid the Email/SMTP settings tab from the UI (SMTP code kept intact, unused).
- Redact email_webhook.api_key on config export.

backend/tests/test_email_webhook_notifications.py

@@ -0,0 +1,115 @@
+"""Coverage for the generic email webhook: the admin test endpoint, and
+the new notification-dispatch helpers that route test/campaign/MITRE
+events through it (see webhook_email_service.py, notification_service.py).
+"""
+
+import uuid
+from unittest.mock import patch
+
+import pytest
+
+from app.services.notification_service import (
+    _preference_allows,
+    notify_all_users_by_email,
+    notify_user_by_email,
+)
+
+
+def test_email_webhook_test_endpoint_requires_admin(api, red_lead_headers):
+    resp = api(
+        "post", "/api/v1/system/email-webhook-test", red_lead_headers,
+        json={"to": "someone@test.com"},
+    )
+    assert resp.status_code == 403
+
+
+def test_email_webhook_test_endpoint_fails_without_config(api, auth_headers):
+    resp = api(
+        "post", "/api/v1/system/email-webhook-test", auth_headers,
+        json={"to": "someone@test.com"},
+    )
+    assert resp.status_code == 502
+
+
+def test_email_webhook_test_endpoint_sends_via_configured_webhook(api, auth_headers):
+    api(
+        "patch", "/api/v1/system/email-webhook-config", auth_headers,
+        json={"url": "https://example.com/power-automate-hook", "api_key": "super-secret-key"},
+    )
+    with patch("app.services.webhook_email_service.requests.post") as mock_post:
+        resp = api(
+            "post", "/api/v1/system/email-webhook-test", auth_headers,
+            json={"to": "marcos.luna@kaseya.com"},
+        )
+    assert resp.status_code == 200, resp.text
+    mock_post.assert_called_once()
+    call_kwargs = mock_post.call_args
+    assert call_kwargs.args[0] == "https://example.com/power-automate-hook"
+    assert call_kwargs.kwargs["headers"] == {"x-api-key": "super-secret-key"}
+    payload = call_kwargs.kwargs["json"]
+    assert payload["to"] == "marcos.luna@kaseya.com"
+    assert "Purple Team Engineering" in payload["body"]
+
+
+class _FakeUser:
+    def __init__(self, email="user@test.com", full_name="A User", prefs=None):
+        self.email = email
+        self.full_name = full_name
+        self.notification_preferences = prefs
+
+
+def test_preference_allows_defaults_to_true_when_missing():
+    assert _preference_allows(_FakeUser(prefs=None), "email_on_test_validated") is True
+    assert _preference_allows(_FakeUser(prefs={}), "email_on_test_validated") is True
+
+
+def test_preference_allows_respects_explicit_false():
+    user = _FakeUser(prefs={"email_on_test_validated": False})
+    assert _preference_allows(user, "email_on_test_validated") is False
+
+
+def test_preference_allows_false_without_email():
+    assert _preference_allows(_FakeUser(email=None), "email_on_test_validated") is False
+    assert _preference_allows(None, "email_on_test_validated") is False
+
+
+def test_notify_user_by_email_sends_when_allowed(db, auth_headers, api):
+    resp = api(
+        "post", "/api/v1/users", auth_headers,
+        json={"full_name": "Notify Me", "email": "notifyme@test.com", "role": "viewer"},
+    )
+    assert resp.status_code == 201, resp.text
+    user_id = resp.json()["id"]
+
+    with patch("app.services.webhook_email_service.send_webhook_email") as mock_send:
+        notify_user_by_email(
+            db, uuid.UUID(user_id),
+            preference_key="email_on_test_validated",
+            subject="Test Validated: Some Test",
+            message='Your test "Some Test" has been validated successfully.',
+        )
+    mock_send.assert_called_once()
+    assert mock_send.call_args.kwargs["to"] == "notifyme@test.com"
+
+
+def test_notify_all_users_by_email_skips_opted_out(db):
+    allowed = _FakeUser(email="allowed@test.com", prefs={"email_on_new_mitre_techniques": True})
+    blocked = _FakeUser(email="blocked@test.com", prefs={"email_on_new_mitre_techniques": False})
+
+    class _FakeQuery:
+        def filter(self, *args, **kwargs):
+            return self
+
+        def all(self):
+            return [allowed, blocked]
+
+    with patch.object(db, "query", return_value=_FakeQuery()), \
+         patch("app.services.webhook_email_service.send_webhook_email") as mock_send:
+        notify_all_users_by_email(
+            db,
+            preference_key="email_on_new_mitre_techniques",
+            subject="MITRE ATT&CK Updated: 3 new techniques",
+            message="3 new techniques were added and 1 were updated.",
+        )
+    mock_send.assert_called_once()
+    assert mock_send.call_args.kwargs["to"] == "allowed@test.com"

backend/tests/test_password_setup_flow.py

@@ -26,19 +26,19 @@ def test_send_password_email_requires_webhook_configured(api, auth_headers, new_
 
 def test_admin_can_configure_password_webhook(api, auth_headers):
     resp = api(
-        "patch", "/api/v1/system/password-webhook-config", auth_headers,
+        "patch", "/api/v1/system/email-webhook-config", auth_headers,
         json={"url": "https://example.com/power-automate-hook"},
     )
     assert resp.status_code == 200, resp.text
     assert resp.json()["configured"] is True
 
-    get_resp = api("get", "/api/v1/system/password-webhook-config", auth_headers)
+    get_resp = api("get", "/api/v1/system/email-webhook-config", auth_headers)
     assert get_resp.json()["url"] == "https://example.com/power-automate-hook"
 
 
 def test_admin_can_configure_webhook_api_key(api, auth_headers):
     resp = api(
-        "patch", "/api/v1/system/password-webhook-config", auth_headers,
+        "patch", "/api/v1/system/email-webhook-config", auth_headers,
         json={"url": "https://example.com/power-automate-hook", "api_key": "super-secret-key"},
     )
     assert resp.status_code == 200, resp.text
@@ -50,10 +50,10 @@ def test_admin_can_configure_webhook_api_key(api, auth_headers):
 
 def test_send_password_email_sends_api_key_header(api, db, auth_headers, new_user_id):
     api(
-        "patch", "/api/v1/system/password-webhook-config", auth_headers,
+        "patch", "/api/v1/system/email-webhook-config", auth_headers,
         json={"url": "https://example.com/power-automate-hook", "api_key": "super-secret-key"},
     )
-    with patch("app.services.password_setup_service.requests.post") as mock_post:
+    with patch("app.services.webhook_email_service.requests.post") as mock_post:
         api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
     call_kwargs = mock_post.call_args
     assert call_kwargs.kwargs["headers"] == {"x-api-key": "super-secret-key"}
@@ -61,11 +61,11 @@ def test_send_password_email_sends_api_key_header(api, db, auth_headers, new_use
 
 def test_send_password_email_posts_to_webhook_and_issues_token(api, db, auth_headers, new_user_id):
     api(
-        "patch", "/api/v1/system/password-webhook-config", auth_headers,
+        "patch", "/api/v1/system/email-webhook-config", auth_headers,
         json={"url": "https://example.com/power-automate-hook"},
     )
 
-    with patch("app.services.password_setup_service.requests.post") as mock_post:
+    with patch("app.services.webhook_email_service.requests.post") as mock_post:
         resp = api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
     assert resp.status_code == 200, resp.text
     mock_post.assert_called_once()
@@ -86,10 +86,10 @@ def test_send_password_email_posts_to_webhook_and_issues_token(api, db, auth_hea
 
 def test_set_password_with_valid_token_succeeds(api, db, auth_headers, new_user_id):
     api(
-        "patch", "/api/v1/system/password-webhook-config", auth_headers,
+        "patch", "/api/v1/system/email-webhook-config", auth_headers,
         json={"url": "https://example.com/power-automate-hook"},
     )
-    with patch("app.services.password_setup_service.requests.post"):
+    with patch("app.services.webhook_email_service.requests.post"):
         api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
 
     from app.models.password_setup_token import PasswordSetupToken
@@ -115,10 +115,10 @@ def test_set_password_with_valid_token_succeeds(api, db, auth_headers, new_user_
 
 def test_set_password_token_cannot_be_reused(api, db, auth_headers, new_user_id):
     api(
-        "patch", "/api/v1/system/password-webhook-config", auth_headers,
+        "patch", "/api/v1/system/email-webhook-config", auth_headers,
         json={"url": "https://example.com/power-automate-hook"},
     )
-    with patch("app.services.password_setup_service.requests.post"):
+    with patch("app.services.webhook_email_service.requests.post"):
         api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
 
     from app.models.password_setup_token import PasswordSetupToken
@@ -150,7 +150,7 @@ def test_set_password_invalid_token_rejected(api):
 
 
 def test_password_webhook_config_requires_admin(api, red_lead_headers):
-    resp = api("get", "/api/v1/system/password-webhook-config", red_lead_headers)
+    resp = api("get", "/api/v1/system/email-webhook-config", red_lead_headers)
     assert resp.status_code == 403