Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07. Major areas: - Outbound webhooks / Zapier: schema + signed delivery with retries, public v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain. - Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when Spaces is unconfigured instead of silently using ephemeral disk. - Integrations & features (concurrent work): accounting (QuickBooks/Xero), e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding, expanded legal pages. - DB migrations 0006–0009. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-02 13:42:34 -04:00
parent 969d5d4c8a
commit c9968531e4
282 changed files with 41530 additions and 4013 deletions
@@ -1,35 +1,47 @@
-import { resend, FROM_EMAIL, APP_NAME } from "./client"
+import { getTransporter, emailConfigured, FROM_EMAIL, APP_NAME } from "./client"
+import {
+  BRAND,
+  emailShell,
+  detailTable,
+  statusBadge,
+  paragraph,
+  escapeHtml,
+  htmlToText,
+} from "./layout"

-export function escapeHtml(value: unknown): string {
-  return String(value ?? "")
-    .replace(/&/g, "&amp;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&#39;")
-}
+// Re-exported so existing importers (`@/lib/email/send`) keep working.
+export { escapeHtml }

 interface SendEmailOptions {
  to: string
  subject: string
  html: string
+  /** Optional plain-text part. Auto-derived from `html` when omitted. */
+  text?: string
  from?: string
 }

-export async function sendEmail({ to, subject, html, from }: SendEmailOptions) {
-  const { data, error } = await resend.emails.send({
-    from: from ?? `${APP_NAME} <${FROM_EMAIL}>`,
-    to,
-    subject,
-    html,
-  })
+export async function sendEmail({ to, subject, html, text, from }: SendEmailOptions) {
+  if (!emailConfigured()) {
+    console.warn(`[email] SMTP not configured — skipping "${subject}" to ${to}`)
+    return { success: false, error: "email not configured" }
+  }

-  if (error) {
+  try {
+    const info = await getTransporter().sendMail({
+      from: from ?? `${APP_NAME} <${FROM_EMAIL}>`,
+      to,
+      subject,
+      html,
+      // A plain-text alternative improves inbox placement and gives clients
+      // that can't render HTML something clean to show.
+      text: text ?? htmlToText(html),
+    })
+    return { success: true, id: info.messageId }
+  } catch (error) {
    console.error("Email send failed:", error)
    return { success: false, error }
  }
-
-  return { success: true, id: data?.id }
 }

 // ── Email templates ──────────────────────────────────────────────
@@ -49,29 +61,22 @@ export function rentDueReminderHtml({
  dueDate: string
  paymentLink?: string
 }) {
-  return `
-<!DOCTYPE html>
-<html>
-<body style="font-family: sans-serif; background: #09090b; color: #fff; padding: 40px 20px; max-width: 560px; margin: 0 auto;">
-  <div style="background: #16161f; border: 1px solid rgba(255,255,255,0.08); border-radius: 12px; padding: 32px;">
-    <h1 style="font-size: 20px; margin: 0 0 8px; color: #fff;">Rent Due Reminder</h1>
-    <p style="color: rgba(255,255,255,0.6); margin: 0 0 24px;">Hi ${escapeHtml(tenantName)},</p>
-    <p style="color: rgba(255,255,255,0.6); margin: 0 0 24px;">
-      Your rent payment of <strong style="color:#fff">${escapeHtml(amount)}</strong> for
-      <strong style="color:#fff">${escapeHtml(propertyName)} — Unit ${escapeHtml(unitNumber)}</strong>
-      is due on <strong style="color:#fff">${escapeHtml(dueDate)}</strong>.
-    </p>
-    ${paymentLink ? `
-    <a href="${escapeHtml(paymentLink)}" style="display: inline-block; background: #6366f1; color: #fff; padding: 12px 24px; border-radius: 8px; text-decoration: none; font-weight: 600;">
-      Pay Rent Now
-    </a>
-    ` : ""}
-    <p style="color: rgba(255,255,255,0.4); font-size: 12px; margin: 24px 0 0;">
-      Property Management Network
-    </p>
-  </div>
-</body>
-</html>`
+  return emailShell({
+    preheader: `Your rent of ${amount} is due on ${dueDate}.`,
+    eyebrow: "Rent reminder",
+    accent: BRAND.indigo,
+    title: "Your rent is due soon",
+    intro: `Hi ${escapeHtml(tenantName)}, this is a friendly reminder about your upcoming rent payment.`,
+    body: detailTable([
+      { label: "Property", value: `${propertyName} — Unit ${unitNumber}` },
+      { label: "Amount due", value: amount, accent: true },
+      { label: "Due date", value: dueDate },
+    ]),
+    button: paymentLink ? { href: paymentLink, label: "Pay rent now" } : undefined,
+    footerNote: paymentLink
+      ? "If the button doesn't work, contact your landlord for alternative payment options."
+      : "Please arrange payment before the due date. Reach out to your landlord with any questions.",
+  })
 }

 export function rentOverdueHtml({
@@ -87,25 +92,25 @@ export function rentOverdueHtml({
  amount: string
  dueDate: string
 }) {
-  return `
-<!DOCTYPE html>
-<html>
-<body style="font-family: sans-serif; background: #09090b; color: #fff; padding: 40px 20px; max-width: 560px; margin: 0 auto;">
-  <div style="background: #16161f; border: 1px solid rgba(239,68,68,0.3); border-radius: 12px; padding: 32px;">
-    <h1 style="font-size: 20px; margin: 0 0 8px; color: #ef4444;">Rent Overdue</h1>
-    <p style="color: rgba(255,255,255,0.6); margin: 0 0 24px;">Hi ${escapeHtml(tenantName)},</p>
-    <p style="color: rgba(255,255,255,0.6); margin: 0 0 24px;">
-      Your rent payment of <strong style="color:#fff">${escapeHtml(amount)}</strong> for
-      <strong style="color:#fff">${escapeHtml(propertyName)} — Unit ${escapeHtml(unitNumber)}</strong>
-      was due on <strong style="color:#ef4444">${escapeHtml(dueDate)}</strong> and is now overdue.
-      Please make payment as soon as possible.
-    </p>
-    <p style="color: rgba(255,255,255,0.4); font-size: 12px; margin: 24px 0 0;">
-      Property Management Network
-    </p>
-  </div>
-</body>
-</html>`
+  return emailShell({
+    preheader: `Your rent payment of ${amount} is now overdue.`,
+    eyebrow: "Action needed",
+    accent: BRAND.red,
+    title: "Your rent is overdue",
+    intro: `Hi ${escapeHtml(tenantName)}, our records show the payment below hasn't been received yet.`,
+    body:
+      detailTable(
+        [
+          { label: "Property", value: `${propertyName} — Unit ${unitNumber}` },
+          { label: "Amount due", value: amount, accent: true },
+          { label: "Was due", value: dueDate, accent: true },
+        ],
+        BRAND.red
+      ) +
+      paragraph(
+        "Please make payment as soon as possible to avoid any late fees. If you've already paid, you can disregard this notice."
+      ),
+  })
 }

 export function leaseExpiryHtml({
@@ -121,24 +126,22 @@ export function leaseExpiryHtml({
  leaseEnd: string
  daysLeft: number
 }) {
-  return `
-<!DOCTYPE html>
-<html>
-<body style="font-family: sans-serif; background: #09090b; color: #fff; padding: 40px 20px; max-width: 560px; margin: 0 auto;">
-  <div style="background: #16161f; border: 1px solid rgba(245,158,11,0.3); border-radius: 12px; padding: 32px;">
-    <h1 style="font-size: 20px; margin: 0 0 8px; color: #f59e0b;">Lease Expiring Soon</h1>
-    <p style="color: rgba(255,255,255,0.6); margin: 0 0 24px;">Hi ${escapeHtml(tenantName)},</p>
-    <p style="color: rgba(255,255,255,0.6); margin: 0 0 24px;">
-      Your lease for <strong style="color:#fff">${escapeHtml(propertyName)} — Unit ${escapeHtml(unitNumber)}</strong>
-      expires on <strong style="color:#f59e0b">${escapeHtml(leaseEnd)}</strong>
-      (${escapeHtml(daysLeft)} days from now). Please contact your landlord to discuss renewal.
-    </p>
-    <p style="color: rgba(255,255,255,0.4); font-size: 12px; margin: 24px 0 0;">
-      Property Management Network
-    </p>
-  </div>
-</body>
-</html>`
+  return emailShell({
+    preheader: `Your lease ends on ${leaseEnd} (${daysLeft} days away).`,
+    eyebrow: "Lease update",
+    accent: BRAND.amber,
+    title: "Your lease is expiring soon",
+    intro: `Hi ${escapeHtml(tenantName)}, your current lease is coming to an end.`,
+    body:
+      detailTable(
+        [
+          { label: "Property", value: `${propertyName} — Unit ${unitNumber}` },
+          { label: "Lease ends", value: leaseEnd, accent: true },
+          { label: "Time remaining", value: `${daysLeft} days` },
+        ],
+        BRAND.amber
+      ) + paragraph("Please contact your landlord to discuss renewal options or next steps."),
+  })
 }

 export function maintenanceUpdateHtml({
@@ -152,20 +155,109 @@ export function maintenanceUpdateHtml({
  status: string
  resolutionNotes?: string
 }) {
-  return `
-<!DOCTYPE html>
-<html>
-<body style="font-family: sans-serif; background: #09090b; color: #fff; padding: 40px 20px; max-width: 560px; margin: 0 auto;">
-  <div style="background: #16161f; border: 1px solid rgba(255,255,255,0.08); border-radius: 12px; padding: 32px;">
-    <h1 style="font-size: 20px; margin: 0 0 8px;">Maintenance Update</h1>
-    <p style="color: rgba(255,255,255,0.6); margin: 0 0 24px;">Hi ${escapeHtml(tenantName)},</p>
-    <p style="color: rgba(255,255,255,0.6); margin: 0 0 12px;">
-      Your maintenance request "<strong style="color:#fff">${escapeHtml(title)}</strong>"
-      has been updated to: <strong style="color:#6366f1; text-transform: capitalize;">${escapeHtml(status).replace("_", " ")}</strong>
-    </p>
-    ${resolutionNotes ? `<p style="color: rgba(255,255,255,0.5); margin: 0 0 24px; font-size: 14px;">${escapeHtml(resolutionNotes)}</p>` : ""}
-    <p style="color: rgba(255,255,255,0.4); font-size: 12px; margin: 24px 0 0;">Property Management Network</p>
-  </div>
-</body>
-</html>`
+  const prettyStatus = status.replace(/_/g, " ")
+  const fontStack =
+    "-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif"
+  return emailShell({
+    preheader: `Your maintenance request is now "${prettyStatus}".`,
+    eyebrow: "Maintenance",
+    accent: BRAND.indigo,
+    title: "Update on your maintenance request",
+    intro: `Hi ${escapeHtml(tenantName)}, there's an update on your request.`,
+    body:
+      `<table role="presentation" width="100%" cellspacing="0" cellpadding="0" border="0" style="margin:8px 0 20px;background:${BRAND.panel};border:1px solid ${BRAND.line};border-radius:12px;">
+                <tr><td style="padding:18px 22px;">
+                  <p style="margin:0 0 12px;font-family:${fontStack};font-size:15px;font-weight:600;color:${BRAND.ink};">${escapeHtml(title)}</p>
+                  ${statusBadge(prettyStatus, BRAND.indigo)}
+                </td></tr>
+              </table>` +
+      (resolutionNotes ? paragraph(escapeHtml(resolutionNotes), { muted: true }) : ""),
+  })
+}
+
+export function resetPasswordHtml(url: string) {
+  return emailShell({
+    preheader: "Reset your Property Management Network password.",
+    eyebrow: "Security",
+    title: "Reset your password",
+    intro:
+      "We received a request to reset your password. Click the button below to choose a new one — this link will expire shortly for your security.",
+    button: { href: url, label: "Reset password" },
+    footerNote:
+      "If you didn't request a password reset, you can safely ignore this email — your password won't change.",
+  })
+}
+
+export function verifyEmailHtml(url: string) {
+  return emailShell({
+    preheader: "Confirm your email to finish setting up your account.",
+    eyebrow: "Welcome",
+    title: "Verify your email address",
+    intro:
+      "Thanks for signing up! Please confirm your email address to finish setting up your account.",
+    button: { href: url, label: "Verify email" },
+    footerNote: "If you didn't create an account, you can safely ignore this email.",
+  })
+}
+
+export function teamInviteHtml({
+  inviterName,
+  inviteUrl,
+  role,
+}: {
+  inviterName: string
+  inviteUrl: string
+  role: "member" | "viewer"
+}) {
+  const roleLabel = role === "viewer" ? "view" : "manage"
+  return emailShell({
+    preheader: `${inviterName} invited you to their property portfolio.`,
+    eyebrow: "Team invitation",
+    title: "You've been invited to a team",
+    intro: `<strong style="color:${BRAND.ink};">${escapeHtml(inviterName)}</strong> has invited you to ${escapeHtml(roleLabel)} their property portfolio on ${escapeHtml(APP_NAME)}.`,
+    button: { href: inviteUrl, label: "Accept invitation" },
+    footerNote:
+      "If you don't have an account yet, you'll be asked to sign in or sign up first.",
+  })
+}
+
+export function followUpHtml(message: string) {
+  return emailShell({
+    preheader: message.slice(0, 140),
+    accent: BRAND.indigo,
+    title: "A quick note from your landlord",
+    body: paragraph(escapeHtml(message).replace(/\n/g, "<br/>")),
+    footerNote: "Sent automatically by your landlord's follow-up system.",
+  })
+}
+
+export function paymentLinkHtml({
+  tenantName,
+  amount,
+  dueDate,
+  propertyLabel,
+  senderName,
+  paymentLink,
+}: {
+  tenantName: string
+  amount: string
+  dueDate: string
+  propertyLabel: string
+  senderName: string
+  paymentLink?: string
+}) {
+  return emailShell({
+    preheader: `Rent payment of ${amount} due ${dueDate}.`,
+    eyebrow: "Rent payment",
+    accent: BRAND.indigo,
+    title: "Your rent payment is due",
+    intro: `Hi ${escapeHtml(tenantName)}, here are the details for your upcoming rent payment.`,
+    body: detailTable([
+      { label: "Property", value: propertyLabel },
+      { label: "Amount due", value: amount, accent: true },
+      { label: "Due date", value: dueDate },
+    ]),
+    button: paymentLink ? { href: paymentLink, label: "Pay rent now" } : undefined,
+    footerNote: `Sent by ${escapeHtml(senderName)} via ${escapeHtml(APP_NAME)}.`,
+  })
 }