feat(ses): implement email template CRUD with stored, inline, and ARN variants (#573)

* feat(ses): implement email template CRUD with stored, inline, and ARN variants

Adds CreateTemplate / GetTemplate / UpdateTemplate /
DeleteTemplate / ListTemplates on both V2 REST JSON
(/v2/email/templates) and V1 Query.

SendEmail / SendTemplatedEmail resolve templates in three forms
with Mustache-style {{var}} substitution against TemplateData:
  - TemplateName references a stored template
  - TemplateArn extracts the name from the template/<name>
    segment of an SES template ARN (region and account segments
    are not validated, mirroring how KMS / Secrets Manager
    handle ARNs in Floci)
  - TemplateContent (V2 only) supplies inline subject / text /
    html without storing the template first

V2 Content.Template requires exactly one of TemplateName,
TemplateArn, or TemplateContent; violations return
BadRequestException (400). V1 SendTemplatedEmail accepts
TemplateArn either alone or alongside Template (name) — the
name is used for resolution when both are present, matching
AWS where boto3 and the Java SDK keep Template as a required
field and treat TemplateArn as supplementary for cross-account
addressing.

Templates persist region-scoped via StorageFactory in
ses-templates.json. Template names reject leading/trailing
whitespace (same rule as identities) and are validated through
a single validateTemplateName helper reachable from every
resolution path. listTemplates is sorted by CreatedTimestamp
with TemplateName as a tiebreaker for deterministic output.

Error codes: the service layer throws V1-style codes
(TemplateDoesNotExist / AlreadyExists / InvalidTemplate /
InvalidParameterValue); SesController remaps them to
NotFoundException (404) / AlreadyExistsException (400) /
BadRequestException (400) for V2 callers.

* test(ses): add Python and Java SDK compatibility tests for templates

Covers boto3 (ses / sesv2) and AWS Java SDK v2 (SesClient /
SesV2Client) against the SES email template CRUD, inline
TemplateContent, and TemplateArn paths. Happy path,
duplicate-create rejection, missing-template lookups,
Mustache-style variable substitution, and 3-way selector
conflicts on V2 Content.Template are exercised on both SDK
surfaces.

Adds:
- Python: ses_client / sesv2_client conftest fixtures and a
  tests/test_ses_templates.py suite covering V1 + V2
- Java: sesv2 Maven dependency, SesV2Client factory in
  TestFixtures, and a SesTemplateTest covering V1 + V2

* docs(ses): document email template CRUD and templated send

Adds the new V1 template actions (CreateTemplate / GetTemplate
/ UpdateTemplate / DeleteTemplate / ListTemplates /
SendTemplatedEmail) and the V2 /v2/email/templates endpoints
to the SES service reference, and extends the README service
matrix to mention template support on the SES / SES v2 rows.

* fix(ses): add template actions to SES_ACTIONS for unsigned request routing

Unsigned clients (curl, aws --no-sign-request) were falling through to
the SQS handler because the six template Query actions were not
registered in SES_ACTIONS.

* fix(ses): narrow exception catch to JsonProcessingException in template endpoints

Broad Exception catch was masking unexpected errors (e.g. NPE) as 400
responses. Narrowed to JsonProcessingException which is the only
checked exception from objectMapper.readTree().

* test(ses): add template variable substitution edge cases and cross-region isolation

Add SesServiceTemplateTest with 14 unit tests for applyTemplateData
covering undefined variables, spaced/hyphenated names, unclosed braces,
non-string JSON values, regex metacharacters, and case sensitivity.

Add cross-region isolation integration test verifying templates created
in one region are not visible in another.

* test(ses): add awscli compatibility tests for template CRUD and templated send

Cover create, get, update, list, delete template and send-templated-email
via the AWS CLI. Uses JSON parameter format to avoid awscli parser issues
with Mustache-style {{variable}} syntax.

---------

Co-authored-by: Kenshin OKINAKA <[email protected]>

Author: okinaka

README.md

@@ -203,8 +203,8 @@ All default images are configurable via environment variables, useful for pinnin
 | **EC2** | In-process | VPCs, subnets, security groups, instances, AMIs, key pairs, internet gateways, route tables, Elastic IPs, tags |
 | **ACM** | In-process | Certificate issuance, validation lifecycle |
 | **ECR** | In-process + **real OCI registry** | Repositories, image push / pull via stock `docker`, image-backed Lambda functions |
-| **SES** | In-process | Send email / raw email, identity verification, DKIM attributes |
-| **SES v2 (HTTP)** | In-process | REST JSON API, identities, DKIM, feedback attributes, account sending |
+| **SES** | In-process | Send email / raw email, identity verification, DKIM attributes, email templates with `{{var}}` substitution |
+| **SES v2 (HTTP)** | In-process | REST JSON API, identities, DKIM, feedback attributes, account sending, email templates with `{{var}}` substitution |
 | **OpenSearch** | **Real Docker containers** | Domain CRUD, tags, versions, instance types, upgrade stubs |
 | **AppConfig** | In-process | Applications, environments, profiles, hosted configuration versions, deployments |
 | **AppConfigData** | In-process | Configuration sessions, dynamic configuration retrieval |

compatibility-tests/sdk-test-awscli/test/ses.bats

@@ -140,3 +140,97 @@ teardown_file() {
     refute_output --partial "$TEST_EMAIL"
     refute_output --partial "$TEST_DOMAIN"
 }
+
+# ──────────────── Template CRUD ────────────────
+
+@test "SES: create template" {
+    local tpl_json
+    tpl_json=$(cat <<TMPL
+{"TemplateName":"cli-tpl-${BATS_ROOT_PID}","SubjectPart":"Hello {{name}}","TextPart":"Hi {{name}} from {{team}}","HtmlPart":"<p>Hi {{name}}</p>"}
+TMPL
+    )
+    run aws_cmd ses create-template --template "$tpl_json"
+    assert_success
+}
+
+@test "SES: create template - duplicate rejected" {
+    local tpl_json
+    tpl_json=$(cat <<TMPL
+{"TemplateName":"cli-tpl-${BATS_ROOT_PID}","SubjectPart":"Dup","TextPart":"Dup"}
+TMPL
+    )
+    run aws_cmd ses create-template --template "$tpl_json"
+    assert_failure
+    assert_output --partial "AlreadyExists"
+}
+
+@test "SES: get template" {
+    run aws_cmd ses get-template --template-name "cli-tpl-${BATS_ROOT_PID}"
+    assert_success
+    name=$(json_get "$output" '.Template.TemplateName')
+    subject=$(json_get "$output" '.Template.SubjectPart')
+    [ "$name" = "cli-tpl-${BATS_ROOT_PID}" ]
+    [ "$subject" = "Hello {{name}}" ]
+}
+
+@test "SES: get template - not found" {
+    run aws_cmd ses get-template --template-name "nonexistent-tpl"
+    assert_failure
+    assert_output --partial "TemplateDoesNotExist"
+}
+
+@test "SES: update template" {
+    local tpl_json
+    tpl_json=$(cat <<TMPL
+{"TemplateName":"cli-tpl-${BATS_ROOT_PID}","SubjectPart":"Updated {{name}}","TextPart":"Updated {{name}} {{team}}","HtmlPart":"<p>Updated {{name}}</p>"}
+TMPL
+    )
+    run aws_cmd ses update-template --template "$tpl_json"
+    assert_success
+
+    run aws_cmd ses get-template --template-name "cli-tpl-${BATS_ROOT_PID}"
+    assert_success
+    subject=$(json_get "$output" '.Template.SubjectPart')
+    [ "$subject" = "Updated {{name}}" ]
+}
+
+@test "SES: list templates includes created" {
+    run aws_cmd ses list-templates
+    assert_success
+    assert_output --partial "cli-tpl-${BATS_ROOT_PID}"
+}
+
+@test "SES: send templated email" {
+    # Ensure an identity exists for sending
+    aws_cmd ses verify-email-identity --email-address "[email protected]" >/dev/null 2>&1 || true
+
+    run aws_cmd ses send-templated-email \
+        --source "[email protected]" \
+        --destination "[email protected]" \
+        --template "cli-tpl-${BATS_ROOT_PID}" \
+        --template-data '{"name":"Alice","team":"floci"}'
+    assert_success
+    message_id=$(json_get "$output" '.MessageId')
+    [ -n "$message_id" ]
+}
+
+@test "SES: send templated email - unknown template" {
+    run aws_cmd ses send-templated-email \
+        --source "[email protected]" \
+        --destination "[email protected]" \
+        --template "nonexistent-tpl" \
+        --template-data '{}'
+    assert_failure
+    assert_output --partial "TemplateDoesNotExist"
+}
+
+@test "SES: delete template" {
+    run aws_cmd ses delete-template --template-name "cli-tpl-${BATS_ROOT_PID}"
+    assert_success
+}
+
+@test "SES: delete template - not found" {
+    run aws_cmd ses delete-template --template-name "nonexistent-tpl"
+    assert_failure
+    assert_output --partial "TemplateDoesNotExist"
+}

compatibility-tests/sdk-test-java/pom.xml

@@ -174,6 +174,11 @@
             <groupId>software.amazon.awssdk</groupId>
             <artifactId>ses</artifactId>
         </dependency>
+        <!-- SES V2 client -->
+        <dependency>
+            <groupId>software.amazon.awssdk</groupId>
+            <artifactId>sesv2</artifactId>
+        </dependency>
         <!-- OpenSearch Service management client -->
         <dependency>
             <groupId>software.amazon.awssdk</groupId>

compatibility-tests/sdk-test-java/src/main/java/com/floci/test/TestFixtures.java

@@ -21,6 +21,7 @@
 import software.amazon.awssdk.services.s3control.endpoints.S3ControlEndpointProvider;
 import software.amazon.awssdk.services.secretsmanager.SecretsManagerClient;
 import software.amazon.awssdk.services.ses.SesClient;
+import software.amazon.awssdk.services.sesv2.SesV2Client;
 import software.amazon.awssdk.services.sfn.SfnClient;
 import software.amazon.awssdk.services.sns.SnsClient;
 import software.amazon.awssdk.services.sqs.SqsClient;
@@ -392,6 +393,14 @@ public static SesClient sesClient() {
                 .build();
     }
 
+    public static SesV2Client sesV2Client() {
+        return SesV2Client.builder()
+                .endpointOverride(ENDPOINT)
+                .region(REGION)
+                .credentialsProvider(CREDENTIALS)
+                .build();
+    }
+
     public static RdsClient rdsClient() {
         return RdsClient.builder()
                 .endpointOverride(ENDPOINT)