Generate presigned URL for email assets at render time

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/coredata/file.go

@@ -24,6 +24,7 @@ import (
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/filemanager"
 	"go.probo.inc/probo/pkg/gid"
 )
 
@@ -44,6 +45,24 @@ type (
 	Files []*File
 )
 
+func (f *File) GetName() string {
+	return f.FileName
+}
+
+func (f *File) GetObjectKey() string {
+	return f.FileKey
+}
+
+func (f *File) GetBucketName() string {
+	return f.BucketName
+}
+
+func (f *File) GetMimeType() string {
+	return f.MimeType
+}
+
+var _ filemanager.File = (*File)(nil)
+
 // AuthorizationAttributes returns the authorization attributes for policy evaluation.
 func (f *File) AuthorizationAttributes(ctx context.Context, conn pg.Conn) (map[string]string, error) {
 	q := `SELECT organization_id FROM files WHERE id = $1 LIMIT 1;`

pkg/filemanager/service.go

@@ -24,12 +24,20 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/s3"
-	"go.probo.inc/probo/pkg/coredata"
 )
 
-type Service struct {
-	s3Client *s3.Client
-}
+type (
+	Service struct {
+		s3Client *s3.Client
+	}
+
+	File interface {
+		GetObjectKey() string
+		GetName() string
+		GetBucketName() string
+		GetMimeType() string
+	}
+)
 
 func NewService(s3Client *s3.Client) *Service {
 	return &Service{
@@ -39,13 +47,13 @@ func NewService(s3Client *s3.Client) *Service {
 
 func (s *Service) GetFileBase64(
 	ctx context.Context,
-	file *coredata.File,
+	file File,
 ) (base64Data string, mimeType string, err error) {
 	result, err := s.s3Client.GetObject(
 		ctx,
 		&s3.GetObjectInput{
-			Bucket: &file.BucketName,
-			Key:    &file.FileKey,
+			Bucket: aws.String(file.GetBucketName()),
+			Key:    aws.String(file.GetObjectKey()),
 		},
 	)
 	if err != nil {
@@ -59,7 +67,7 @@ func (s *Service) GetFileBase64(
 	}
 
 	if result.ContentType == nil || *result.ContentType == "" {
-		return "", "", fmt.Errorf("no MIME type available for file %s", file.FileKey)
+		return "", "", fmt.Errorf("no MIME type available for file %s", file.GetObjectKey())
 	}
 
 	base64Data = base64.StdEncoding.EncodeToString(fileData)
@@ -89,17 +97,17 @@ func (s *Service) GetFileSize(content io.Reader) (int64, error) {
 
 func (s *Service) PutFile(
 	ctx context.Context,
-	file *coredata.File,
+	file File,
 	content io.Reader,
 	metadata map[string]string,
 ) (int64, error) {
 	_, err := s.s3Client.PutObject(
 		ctx,
 		&s3.PutObjectInput{
-			Bucket:      &file.BucketName,
-			Key:         &file.FileKey,
+			Bucket:      aws.String(file.GetBucketName()),
+			Key:         aws.String(file.GetObjectKey()),
 			Body:        content,
-			ContentType: &file.MimeType,
+			ContentType: aws.String(file.GetMimeType()),
 			Metadata:    metadata,
 		},
 	)
@@ -110,8 +118,8 @@ func (s *Service) PutFile(
 	headOutput, err := s.s3Client.HeadObject(
 		ctx,
 		&s3.HeadObjectInput{
-			Bucket: &file.BucketName,
-			Key:    &file.FileKey,
+			Bucket: aws.String(file.GetBucketName()),
+			Key:    aws.String(file.GetObjectKey()),
 		},
 	)
 	if err != nil {
@@ -123,20 +131,20 @@ func (s *Service) PutFile(
 
 func (s *Service) GenerateFileUrl(
 	ctx context.Context,
-	file *coredata.File,
+	file File,
 	expiresIn time.Duration,
 ) (string, error) {
 	presignClient := s3.NewPresignClient(s.s3Client)
 
-	encodedFilename := url.QueryEscape(file.FileName)
+	encodedFilename := url.QueryEscape(file.GetName())
 	contentDisposition := fmt.Sprintf("attachment; filename=%q; filename*=UTF-8''%s",
 		encodedFilename, encodedFilename)
 
 	presignedReq, err := presignClient.PresignGetObject(
 		ctx,
 		&s3.GetObjectInput{
-			Bucket:                     &file.BucketName,
-			Key:                        &file.FileKey,
+			Bucket:                     aws.String(file.GetBucketName()),
+			Key:                        aws.String(file.GetObjectKey()),
 			ResponseCacheControl:       aws.String("max-age=3600, public"),
 			ResponseContentDisposition: &contentDisposition,
 		},

pkg/iam/account_service.go

@@ -116,9 +116,9 @@ func (s AccountService) ChangeEmail(ctx context.Context, identityID gid.GID, req
 				return fmt.Errorf("cannot update identity: %w", err)
 			}
 
-			emailPresenter := emails.NewPresenter(s.baseURL, s.emailStaticAssetURLs, identity.FullName)
+			emailPresenter := emails.NewPresenter(s.fm, s.bucket, s.baseURL, identity.FullName)
 
-			subject, textBody, htmlBody, err := emailPresenter.RenderConfirmEmail("/auth/verify-email", confirmationToken)
+			subject, textBody, htmlBody, err := emailPresenter.RenderConfirmEmail(ctx, "/auth/verify-email", confirmationToken)
 			if err != nil {
 				return fmt.Errorf("cannot render confirmation email: %w", err)
 			}

pkg/iam/auth_service.go

@@ -290,9 +290,10 @@ func (s AuthService) SendPasswordResetInstructionByEmail(
 				return fmt.Errorf("cannot load identity: %w", err)
 			}
 
-			emailPresenter := emails.NewPresenter(s.baseURL, s.emailStaticAssetURLs, identity.FullName)
+			emailPresenter := emails.NewPresenter(s.fm, s.bucket, s.baseURL, identity.FullName)
 
 			subject, textBody, htmlBody, err := emailPresenter.RenderPasswordReset(
+				ctx,
 				"/auth/reset-password",
 				token,
 			)
@@ -406,9 +407,9 @@ func (s AuthService) CreateIdentityWithPassword(
 		return nil, nil, fmt.Errorf("cannot generate confirmation token: %w", err)
 	}
 
-	emailPresenter := emails.NewPresenter(s.baseURL, s.emailStaticAssetURLs, req.FullName)
+	emailPresenter := emails.NewPresenter(s.fm, s.bucket, s.baseURL, req.FullName)
 
-	subject, textBody, htmlBody, err := emailPresenter.RenderConfirmEmail("/auth/verify-email", confirmationToken)
+	subject, textBody, htmlBody, err := emailPresenter.RenderConfirmEmail(ctx, "/auth/verify-email", confirmationToken)
 	if err != nil {
 		return nil, nil, fmt.Errorf("cannot render confirmation email: %w", err)
 	}
@@ -569,7 +570,7 @@ func (s AuthService) SendMagicLink(ctx context.Context, req *SendMagicLinkReques
 				return fmt.Errorf("cannot load organization: %w", err)
 			}
 
-			emailPresenterCfg := emails.DefaultPresenterConfig(s.baseURL, s.emailStaticAssetURLs)
+			emailPresenterCfg := emails.DefaultPresenterConfig(s.bucket, s.baseURL)
 			if req.CompliancePageID != nil {
 				var err error
 				emailPresenterCfg, err = s.CompliancePageService.EmailPresenterConfig(ctx, *req.CompliancePageID)
@@ -578,9 +579,10 @@ func (s AuthService) SendMagicLink(ctx context.Context, req *SendMagicLinkReques
 				}
 			}
 
-			emailPresenter := emails.NewPresenterFromConfig(emailPresenterCfg, fullName)
+			emailPresenter := emails.NewPresenterFromConfig(s.fm, emailPresenterCfg, fullName)
 
 			subject, textBody, htmlBody, err := emailPresenter.RenderMagicLink(
+				ctx,
 				req.URLPath,
 				tokenString,
 				s.magicLinkTokenValidity,

pkg/iam/compliance_page_service.go

@@ -91,7 +91,7 @@ func (s *CompliancePageService) EmailPresenterConfig(ctx context.Context, compli
 		organization      = &coredata.Organization{}
 		customDomain      *coredata.CustomDomain
 		logoFile          = &coredata.File{}
-		emailPresenterCfg = emails.DefaultPresenterConfig(s.baseURL, s.emailStaticAssetURLs)
+		emailPresenterCfg = emails.DefaultPresenterConfig(s.bucket, s.baseURL)
 	)
 
 	scope := coredata.NewScopeFromObjectID(compliancePageID)
@@ -153,13 +153,13 @@ func (s *CompliancePageService) EmailPresenterConfig(ctx context.Context, compli
 
 		// If logo exists, then we will brand the emails with the org as a sender
 
-		presignedURL, err := s.fm.GenerateFileUrl(ctx, logoFile, 7*24*time.Hour)
-		if err != nil {
-			return emailPresenterCfg, fmt.Errorf("cannot generate file URL: %w", err)
+		emailPresenterCfg.SenderCompanyLogo = emails.Asset{
+			Name:       logoFile.FileName,
+			ObjectKey:  logoFile.FileKey,
+			BucketName: logoFile.BucketName,
+			MimeType:   logoFile.MimeType,
 		}
 
-		emailPresenterCfg.SenderCompanyLogoURL = presignedURL
-
 		emailPresenterCfg.SenderCompanyName = organization.Name
 
 		if organization.WebsiteURL != nil {

pkg/iam/organization_service.go

@@ -464,9 +464,10 @@ func (s *OrganizationService) InviteMember(
 				return fmt.Errorf("cannot generate invitation token: %w", err)
 			}
 
-			emailPresenter := emails.NewPresenter(s.baseURL, s.emailStaticAssetURLs, identity.FullName)
+			emailPresenter := emails.NewPresenter(s.fm, s.bucket, s.baseURL, identity.FullName)
 
 			subject, textBody, htmlBody, err := emailPresenter.RenderInvitation(
+				ctx,
 				"/auth/signup-from-invitation",
 				invitationToken,
 				organization.Name,

pkg/iam/service.go

@@ -11,7 +11,6 @@ import (
 	"go.gearno.de/kit/log"
 	"go.gearno.de/kit/pg"
 	"go.opentelemetry.io/otel/trace"
-	"go.probo.inc/probo/packages/emails"
 	"go.probo.inc/probo/pkg/baseurl"
 	"go.probo.inc/probo/pkg/connector"
 	"go.probo.inc/probo/pkg/coredata"
@@ -29,7 +28,6 @@ type (
 		pg                         *pg.Client
 		fm                         *filemanager.Service
 		hp                         *passwdhash.Profile
-		emailStaticAssetURLs       emails.StaticAssetURLs
 		encryptionKey              cipher.EncryptionKey
 		baseURL                    string
 		tokenSecret                string
@@ -84,7 +82,6 @@ func NewService(
 	pgClient *pg.Client,
 	fm *filemanager.Service,
 	hp *passwdhash.Profile,
-	emailStaticAssetURLs emails.StaticAssetURLs,
 	cfg Config,
 ) (*Service, error) {
 	if cfg.Bucket == "" {
@@ -107,7 +104,6 @@ func NewService(
 		pg:                         pgClient,
 		fm:                         fm,
 		hp:                         hp,
-		emailStaticAssetURLs:       emailStaticAssetURLs,
 		baseURL:                    cfg.BaseURL.String(),
 		tokenSecret:                cfg.TokenSecret,
 		disableSignup:              cfg.DisableSignup,

pkg/probo/document_service.go

@@ -543,9 +543,10 @@ func (s *DocumentService) SendSigningNotifications(
 					return fmt.Errorf("cannot create signing request token: %w", err)
 				}
 
-				emailPresenter := emails.NewPresenter(s.svc.baseURL, s.svc.emailStaticAssetURLs, people.FullName)
+				emailPresenter := emails.NewPresenter(s.svc.fileManager, s.svc.bucket, s.svc.baseURL, people.FullName)
 
 				subject, textBody, htmlBody, err := emailPresenter.RenderDocumentSigning(
+					ctx,
 					"/documents/signing-requests",
 					token,
 					organization.Name,
@@ -1823,9 +1824,10 @@ func (s *DocumentService) SendExportEmail(
 				return fmt.Errorf("cannot generate download URL: %w", err)
 			}
 
-			emailPresenter := emails.NewPresenter(s.svc.baseURL, s.svc.emailStaticAssetURLs, recipientName)
+			emailPresenter := emails.NewPresenter(s.svc.fileManager, s.svc.bucket, s.svc.baseURL, recipientName)
 
 			subject, textBody, htmlBody, err := emailPresenter.RenderDocumentExport(
+				ctx,
 				downloadURL,
 			)
 			if err != nil {

pkg/probo/framework_service.go

@@ -800,9 +800,10 @@ func (s FrameworkService) SendExportEmail(
 				return fmt.Errorf("cannot generate download URL: %w", err)
 			}
 
-			emailPresenter := emails.NewPresenter(s.svc.baseURL, s.svc.emailStaticAssetURLs, recipientName)
+			emailPresenter := emails.NewPresenter(s.svc.fileManager, s.svc.bucket, s.svc.baseURL, recipientName)
 
 			subject, textBody, htmlBody, err := emailPresenter.RenderFrameworkExport(
+				ctx,
 				downloadURL,
 			)
 			if err != nil {

pkg/probo/service.go

@@ -23,7 +23,6 @@ import (
 	"go.gearno.de/kit/log"
 	"go.gearno.de/kit/pg"
 	"go.gearno.de/x/ref"
-	"go.probo.inc/probo/packages/emails"
 	"go.probo.inc/probo/pkg/agents"
 	"go.probo.inc/probo/pkg/certmanager"
 	"go.probo.inc/probo/pkg/coredata"
@@ -50,19 +49,18 @@ type ExportService interface {
 
 type (
 	Service struct {
-		pg                   *pg.Client
-		s3                   *s3.Client
-		bucket               string
-		encryptionKey        cipher.EncryptionKey
-		baseURL              string
-		tokenSecret          string
-		agentConfig          agents.Config
-		html2pdfConverter    *html2pdf.Converter
-		acmeService          *certmanager.ACMEService
-		fileManager          *filemanager.Service
-		logger               *log.Logger
-		slack                *slack.Service
-		emailStaticAssetURLs emails.StaticAssetURLs
+		pg                *pg.Client
+		s3                *s3.Client
+		bucket            string
+		encryptionKey     cipher.EncryptionKey
+		baseURL           string
+		tokenSecret       string
+		agentConfig       agents.Config
+		html2pdfConverter *html2pdf.Converter
+		acmeService       *certmanager.ACMEService
+		fileManager       *filemanager.Service
+		logger            *log.Logger
+		slack             *slack.Service
 	}
 
 	TenantService struct {
@@ -75,7 +73,6 @@ type (
 		tokenSecret                       string
 		agent                             *agents.Agent
 		fileManager                       *filemanager.Service
-		emailStaticAssetURLs              emails.StaticAssetURLs
 		Frameworks                        *FrameworkService
 		Measures                          *MeasureService
 		Tasks                             *TaskService
@@ -131,7 +128,6 @@ func NewService(
 	logger *log.Logger,
 	slackService *slack.Service,
 	iamService *iam.Service,
-	emailStaticAssetURLs emails.StaticAssetURLs,
 ) (*Service, error) {
 	if bucket == "" {
 		return nil, fmt.Errorf("bucket is required")
@@ -140,19 +136,18 @@ func NewService(
 	iamService.Authorizer.RegisterPolicySet(ProboPolicySet())
 
 	svc := &Service{
-		pg:                   pgClient,
-		s3:                   s3Client,
-		bucket:               bucket,
-		encryptionKey:        encryptionKey,
-		baseURL:              baseURL,
-		tokenSecret:          tokenSecret,
-		agentConfig:          agentConfig,
-		html2pdfConverter:    html2pdfConverter,
-		acmeService:          acmeService,
-		fileManager:          fileManagerService,
-		logger:               logger,
-		slack:                slackService,
-		emailStaticAssetURLs: emailStaticAssetURLs,
+		pg:                pgClient,
+		s3:                s3Client,
+		bucket:            bucket,
+		encryptionKey:     encryptionKey,
+		baseURL:           baseURL,
+		tokenSecret:       tokenSecret,
+		agentConfig:       agentConfig,
+		html2pdfConverter: html2pdfConverter,
+		acmeService:       acmeService,
+		fileManager:       fileManagerService,
+		logger:            logger,
+		slack:             slackService,
 	}
 
 	return svc, nil
@@ -160,16 +155,15 @@ func NewService(
 
 func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 	tenantService := &TenantService{
-		pg:                   s.pg,
-		s3:                   s.s3,
-		bucket:               s.bucket,
-		encryptionKey:        s.encryptionKey,
-		baseURL:              s.baseURL,
-		scope:                coredata.NewScope(tenantID),
-		tokenSecret:          s.tokenSecret,
-		agent:                agents.NewAgent(nil, s.agentConfig),
-		fileManager:          s.fileManager,
-		emailStaticAssetURLs: s.emailStaticAssetURLs,
+		pg:            s.pg,
+		s3:            s.s3,
+		bucket:        s.bucket,
+		encryptionKey: s.encryptionKey,
+		baseURL:       s.baseURL,
+		scope:         coredata.NewScope(tenantID),
+		tokenSecret:   s.tokenSecret,
+		agent:         agents.NewAgent(nil, s.agentConfig),
+		fileManager:   s.fileManager,
 	}
 
 	tenantService.Frameworks = &FrameworkService{

pkg/probo/trust_center_access_service.go

@@ -417,9 +417,9 @@ func (s TrustCenterAccessService) sendAccessEmail(ctx context.Context, tx pg.Con
 		return fmt.Errorf("cannot get compliance page email presenter config: %w", err)
 	}
 
-	emailPresenter := emails.NewPresenterFromConfig(emailPresenterCfg, access.Name)
+	emailPresenter := emails.NewPresenterFromConfig(s.svc.fileManager, emailPresenterCfg, access.Name)
 
-	subject, textBody, htmlBody, err := emailPresenter.RenderTrustCenterAccess(organization.Name)
+	subject, textBody, htmlBody, err := emailPresenter.RenderTrustCenterAccess(ctx, organization.Name)
 	if err != nil {
 		return fmt.Errorf("cannot render trust center access email: %w", err)
 	}

pkg/probo/trust_center_service.go

@@ -609,7 +609,7 @@ func (s *TrustCenterService) EmailPresenterConfig(ctx context.Context, complianc
 		organization      = &coredata.Organization{}
 		customDomain      *coredata.CustomDomain
 		logoFile          = &coredata.File{}
-		emailPresenterCfg = emails.DefaultPresenterConfig(s.svc.baseURL, s.svc.emailStaticAssetURLs)
+		emailPresenterCfg = emails.DefaultPresenterConfig(s.svc.bucket, s.svc.baseURL)
 	)
 
 	scope := coredata.NewScopeFromObjectID(compliancePageID)
@@ -669,13 +669,13 @@ func (s *TrustCenterService) EmailPresenterConfig(ctx context.Context, complianc
 			return emailPresenterCfg, nil
 		}
 
-		presignedURL, err := s.svc.fileManager.GenerateFileUrl(ctx, logoFile, 7*24*time.Hour)
-		if err != nil {
-			return emailPresenterCfg, fmt.Errorf("cannot generate file URL: %w", err)
+		emailPresenterCfg.SenderCompanyLogo = emails.Asset{
+			Name:       logoFile.FileName,
+			ObjectKey:  logoFile.FileKey,
+			BucketName: logoFile.BucketName,
+			MimeType:   logoFile.MimeType,
 		}
 
-		emailPresenterCfg.SenderCompanyLogoURL = presignedURL
-
 		emailPresenterCfg.SenderCompanyName = organization.Name
 
 		if organization.WebsiteURL != nil {

pkg/probod/probod.go

@@ -293,12 +293,11 @@ func (impl *Implm) Run(
 		}
 	}
 
-	emailStaticAssetURLs, err := emails.GenerateStaticAssetURLs(
+	if err := emails.UpdloadStaticAssets(
 		ctx,
 		s3Client,
 		impl.cfg.AWS.Bucket,
-	)
-	if err != nil {
+	); err != nil {
 		return fmt.Errorf("cannot generate email static asset URLs: %w", err)
 	}
 
@@ -307,7 +306,6 @@ func (impl *Implm) Run(
 		pgClient,
 		fileManagerService,
 		hp,
-		emailStaticAssetURLs,
 		iam.Config{
 			DisableSignup:                  impl.cfg.Auth.DisableSignup,
 			InvitationTokenValidity:        time.Duration(impl.cfg.Auth.InvitationConfirmationTokenValidity) * time.Second,
@@ -387,7 +385,6 @@ func (impl *Implm) Run(
 		l.Named("probo"),
 		slackService,
 		iamService,
-		emailStaticAssetURLs,
 	)
 	if err != nil {
 		return fmt.Errorf("cannot create probo service: %w", err)
@@ -405,7 +402,6 @@ func (impl *Implm) Run(
 		fileManagerService,
 		l,
 		slackService,
-		emailStaticAssetURLs,
 	)
 
 	serverHandler, err := server.NewServer(

pkg/trust/service.go

@@ -22,7 +22,6 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"go.gearno.de/kit/log"
 	"go.gearno.de/kit/pg"
-	"go.probo.inc/probo/packages/emails"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/crypto/cipher"
 	"go.probo.inc/probo/pkg/filemanager"
@@ -36,19 +35,18 @@ import (
 
 type (
 	Service struct {
-		pg                   *pg.Client
-		s3                   *s3.Client
-		bucket               string
-		proboSvc             *probo.Service
-		encryptionKey        cipher.EncryptionKey
-		slackSigningSecret   string
-		baseURL              string
-		iam                  *iam.Service
-		html2pdfConverter    *html2pdf.Converter
-		fileManager          *filemanager.Service
-		logger               *log.Logger
-		slack                *slack.Service
-		emailStaticAssetURLs emails.StaticAssetURLs
+		pg                 *pg.Client
+		s3                 *s3.Client
+		bucket             string
+		proboSvc           *probo.Service
+		encryptionKey      cipher.EncryptionKey
+		slackSigningSecret string
+		baseURL            string
+		iam                *iam.Service
+		html2pdfConverter  *html2pdf.Converter
+		fileManager        *filemanager.Service
+		logger             *log.Logger
+		slack              *slack.Service
 	}
 
 	TenantService struct {
@@ -63,7 +61,6 @@ type (
 		html2pdfConverter     *html2pdf.Converter
 		fileManager           *filemanager.Service
 		logger                *log.Logger
-		emailStaticAssetURLs  emails.StaticAssetURLs
 		TrustCenters          *TrustCenterService
 		Documents             *DocumentService
 		Audits                *AuditService
@@ -90,38 +87,35 @@ func NewService(
 	fileManagerService *filemanager.Service,
 	logger *log.Logger,
 	slack *slack.Service,
-	emailStaticAssetURLs emails.StaticAssetURLs,
 ) *Service {
 	return &Service{
-		pg:                   pgClient,
-		s3:                   s3Client,
-		bucket:               bucket,
-		encryptionKey:        encryptionKey,
-		slackSigningSecret:   slackSigningSecret,
-		baseURL:              baseURL,
-		iam:                  iam,
-		html2pdfConverter:    html2pdfConverter,
-		fileManager:          fileManagerService,
-		logger:               logger,
-		slack:                slack,
-		emailStaticAssetURLs: emailStaticAssetURLs,
+		pg:                 pgClient,
+		s3:                 s3Client,
+		bucket:             bucket,
+		encryptionKey:      encryptionKey,
+		slackSigningSecret: slackSigningSecret,
+		baseURL:            baseURL,
+		iam:                iam,
+		html2pdfConverter:  html2pdfConverter,
+		fileManager:        fileManagerService,
+		logger:             logger,
+		slack:              slack,
 	}
 }
 
 func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 	tenantService := &TenantService{
-		pg:                   s.pg,
-		s3:                   s.s3,
-		bucket:               s.bucket,
-		scope:                coredata.NewScope(tenantID),
-		proboSvc:             s.proboSvc,
-		encryptionKey:        s.encryptionKey,
-		baseURL:              s.baseURL,
-		iam:                  s.iam,
-		html2pdfConverter:    s.html2pdfConverter,
-		fileManager:          s.fileManager,
-		logger:               s.logger,
-		emailStaticAssetURLs: s.emailStaticAssetURLs,
+		pg:                s.pg,
+		s3:                s.s3,
+		bucket:            s.bucket,
+		scope:             coredata.NewScope(tenantID),
+		proboSvc:          s.proboSvc,
+		encryptionKey:     s.encryptionKey,
+		baseURL:           s.baseURL,
+		iam:               s.iam,
+		html2pdfConverter: s.html2pdfConverter,
+		fileManager:       s.fileManager,
+		logger:            s.logger,
 	}
 
 	tenantService.TrustCenters = &TrustCenterService{svc: tenantService}

pkg/trust/trust_center_access_service.go

@@ -483,9 +483,9 @@ func (s *TrustCenterAccessService) sendAccessEmail(ctx context.Context, tx pg.Co
 		return fmt.Errorf("cannot get compliance page email presenter config: %w", err)
 	}
 
-	emailPresenter := emails.NewPresenterFromConfig(emailPresenterCfg, access.Name)
+	emailPresenter := emails.NewPresenterFromConfig(s.svc.fileManager, emailPresenterCfg, access.Name)
 
-	subject, textBody, htmlBody, err := emailPresenter.RenderTrustCenterAccess(organization.Name)
+	subject, textBody, htmlBody, err := emailPresenter.RenderTrustCenterAccess(ctx, organization.Name)
 	if err != nil {
 		return fmt.Errorf("cannot render trust center access email: %w", err)
 	}
@@ -606,9 +606,10 @@ func (s *TrustCenterAccessService) sendDocumentAccessRejectedEmail(
 	if fullName == "" {
 		fullName = access.Email.Username()
 	}
-	emailPresenter := emails.NewPresenterFromConfig(emailPresenterCfg, fullName)
+	emailPresenter := emails.NewPresenterFromConfig(s.svc.fileManager, emailPresenterCfg, fullName)
 
 	subject, textBody, htmlBody, err := emailPresenter.RenderTrustCenterDocumentAccessRejected(
+		ctx,
 		fileNames,
 		organization.Name,
 	)

pkg/trust/trust_center_service.go

@@ -226,7 +226,7 @@ func (s *TrustCenterService) EmailPresenterConfig(ctx context.Context, complianc
 		organization      = &coredata.Organization{}
 		customDomain      *coredata.CustomDomain
 		logoFile          = &coredata.File{}
-		emailPresenterCfg = emails.DefaultPresenterConfig(s.svc.baseURL, s.svc.emailStaticAssetURLs)
+		emailPresenterCfg = emails.DefaultPresenterConfig(s.svc.bucket, s.svc.baseURL)
 	)
 
 	scope := coredata.NewScopeFromObjectID(compliancePageID)
@@ -288,13 +288,13 @@ func (s *TrustCenterService) EmailPresenterConfig(ctx context.Context, complianc
 
 		// If logo exists, then we will brand the emails with the org as a sender
 
-		presignedURL, err := s.svc.fileManager.GenerateFileUrl(ctx, logoFile, 7*24*time.Hour)
-		if err != nil {
-			return emailPresenterCfg, fmt.Errorf("cannot generate file URL: %w", err)
+		emailPresenterCfg.SenderCompanyLogo = emails.Asset{
+			Name:       logoFile.FileName,
+			ObjectKey:  logoFile.FileKey,
+			BucketName: logoFile.BucketName,
+			MimeType:   logoFile.MimeType,
 		}
 
-		emailPresenterCfg.SenderCompanyLogoURL = presignedURL
-
 		emailPresenterCfg.SenderCompanyName = organization.Name
 
 		if organization.WebsiteURL != nil {