Email Service

Service Function (sendWelcomeEmail, sendContactConfirmation, ...)
    |
    |--- 1. Rate limit check (was this email recently sent?)
    |--- 2. Render React Email template to HTML
    |--- 3. Log attempt to database (status: PENDING)
    |
    v
Email Client (client.ts)
    |--- Sends via Resend SDK
    |--- Retries on failure (3 attempts, exponential backoff)
    |--- Skips retry on validation errors (4xx)
    |
    v
Resend API
    |--- Delivers to recipient inbox
    |--- Fires webhook events (delivered, opened, clicked, bounced)
    |
    v
Webhook Route (/api/webhooks/resend)
    |--- Verifies HMAC-SHA256 signature
    |--- Updates EmailLog status in database
    |--- Tracks: DELIVERED → OPENED → CLICKED or BOUNCED

export async function sendWelcomeEmail(
  userId: string,
  email: string,
  name?: string
): Promise<boolean> {
  try {
    // Check rate limiting
    const recentlySent = await wasEmailRecentlySent(
      email,
      EmailType.WELCOME,
      60 * 24 // 24 hours
    )

    if (recentlySent) {
      console.log(`[Email] Welcome email recently sent to ${email}, skipping`)
      return false
    }

    // Render email template
    const html = await render(
      WelcomeEmail({
        name: name || 'there',
        email,
        dashboardUrl: `${process.env.NEXT_PUBLIC_APP_URL}/dashboard`,
      })
    )

    // Log attempt
    const emailLog = await logEmail({
      user: { connect: { id: userId } },
      to: email,
      from: process.env.RESEND_FROM_EMAIL,
      subject: 'Welcome to Our Platform!',
      type: EmailType.WELCOME,
      status: EmailStatus.PENDING,
      metadata: { templateUsed: 'welcome' },
    })

    // Send email
    const result = await sendEmail({
      to: formatEmailAddress(email, name),
      subject: 'Welcome to Our Platform!',
      html,
    })

export async function sendEmail(options: EmailOptions): Promise<EmailResult> {
  const {
    from = DEFAULT_FROM_EMAIL,
    retries = 3,
    retryDelay = 1000,
    ...emailOptions
  } = options

  let lastError: Error | null = null
  let attempt = 0

  while (attempt < retries) {
    try {
      const response = await resend.emails.send({
        from,
        ...emailOptions,
      } as CreateEmailOptions)

      // Check for Resend API errors
      if ('error' in response && response.error) {
        throw new Error(response.error.message || 'Unknown Resend error')
      }

      return {
        success: true,
        data: response as CreateEmailResponse,
      }
    } catch (error) {
      lastError = error as Error
      attempt++

      // Don't retry on validation errors (4xx)
      if (isValidationError(error)) {
        break
      }

      // Wait before retrying (exponential backoff)
      if (attempt < retries) {
        await delay(retryDelay * Math.pow(2, attempt - 1))
      }
    }
  }

  // All retries failed
  const errorMessage = lastError?.message || 'Failed to send email'
  console.error('[Email] Send failed after retries:', errorMessage)

  return {
    success: false,
    error: errorMessage,
  }
}

import { Heading, Section, Text } from '@react-email/components'
import { Button } from '../components/button'
import { EmailFooter } from '../components/footer'
import { EmailHeader } from '../components/header'

interface WelcomeEmailProps {
  name?: string
  email: string
  dashboardUrl?: string
}

export default function WelcomeEmail({
  name = 'there',
  email,
  dashboardUrl = 'https://example.com/dashboard',
}: WelcomeEmailProps) {
  const preview = `Welcome to our platform, ${name}!`

  return (
    <EmailHeader preview={preview}>
      <Section style={box}>
        <Heading style={heading}>Welcome aboard! 🎉</Heading>
        <Text style={paragraph}>Hi {name},</Text>
        <Text style={paragraph}>
          We&apos;re thrilled to have you join our community! Your account has
          been successfully created with the email address:{' '}
          <strong>{email}</strong>
        </Text>
        <Text style={paragraph}>Here&apos;s what you can do next:</Text>
        <Section style={list}>
          <Text style={listItem}>✓ Complete your profile</Text>
          <Text style={listItem}>✓ Explore our features</Text>
          <Text style={listItem}>✓ Connect with other users</Text>
          <Text style={listItem}>✓ Customize your settings</Text>
        </Section>
        <Section style={buttonContainer}>
          <Button href={dashboardUrl}>Go to Dashboard</Button>
        </Section>
        <Text style={paragraph}>
          If you have any questions or need help getting started, our support
          team is here to help. Simply reply to this email or visit our help
          center.
        </Text>
        <Text style={paragraph}>
          Best regards,
          <br />
          The Team
        </Text>
      </Section>
      <EmailFooter />
    </EmailHeader>
  )
}

import { NextRequest, NextResponse } from 'next/server'
import { headers } from 'next/headers'
import crypto from 'crypto'
import { processEmailWebhook } from '@/lib/email/service'
import { withRateLimit } from '@/lib/security/rate-limit-middleware'

/**
 * Verify webhook signature from Resend
 */
function verifyWebhookSignature(
  payload: string,
  signature: string,
  secret: string
): boolean {
  try {
    const expectedSignature = crypto
      .createHmac('sha256', secret)
      .update(payload)
      .digest('hex')

    return crypto.timingSafeEqual(
      Buffer.from(signature),
      Buffer.from(expectedSignature)
    )
  } catch (error) {
    console.error('[Webhook] Signature verification error:', error)
    return false
  }
}

export const POST = withRateLimit('webhooks', async (request: NextRequest) => {
  try {
    // Get raw body for signature verification
    const rawBody = await request.text()

    // Get signature from headers
    const headersList = await headers()
    const signature = headersList.get('resend-signature')

    // Verify webhook signature if secret is configured
    const webhookSecret = process.env.RESEND_WEBHOOK_SECRET
    if (webhookSecret && signature) {
      const isValid = verifyWebhookSignature(rawBody, signature, webhookSecret)
      if (!isValid) {
        console.warn('[Webhook] Invalid signature')
        return NextResponse.json(
          { error: 'Invalid signature' },
          { status: 401 }
        )
      }
    } else if (process.env.NODE_ENV === 'production') {
      // In production, webhook secret should always be configured
      console.error('[Webhook] No webhook secret configured')
      return NextResponse.json(
        { error: 'Webhook not configured' },
        { status: 500 }
      )
    }

EmailLog
├── id           # Auto-generated UUID
├── userId       # Linked to User (optional for system emails)
├── to           # Recipient email
├── from         # Sender email
├── subject      # Email subject line
├── type         # WELCOME | TRANSACTION | NOTIFICATION | SYSTEM | ...
├── status       # PENDING → SENT → DELIVERED → OPENED → CLICKED
├── messageId    # Resend message ID (for webhook correlation)
├── metadata     # JSON — template used, webhook data, error details
├── createdAt    # When the email was queued
└── updatedAt    # Last status change