sase.tr/apps/api/src/notifications/email-preferences.service.ts

import { createHmac, timingSafeEqual } from "node:crypto";
import { Inject, Injectable, Logger } from "@nestjs/common";
import { and, eq } from "drizzle-orm";
import { DATABASE, type Database } from "../database/database.provider";
import * as schema from "../database/schema/core";

/**
 * Workflows the user can opt out of. Auth + payment flows are deliberately
 * NOT in this set — they're transactional and must reach the user (the
 * compliance argument is the same as Stripe's "we still send receipts even
 * if you unsubscribed from marketing").
 */
export const OPTIONAL_WORKFLOWS = new Set<string>([
  "welcome",
  "trial-ending",
  "win-back",
  "referral",
  "referral-qualified",
  "referral-reward",
]);

/**
 * Stateless HMAC token in the List-Unsubscribe URL — no DB lookup needed to
 * validate. Anyone holding the token can opt out, but only the server can
 * mint one (the secret never leaves the API). Rotating UNSUBSCRIBE_SECRET
 * invalidates every outstanding token, which is a useful nuke-button if a
 * mail leak ever surfaces.
 */
export function signUnsubscribeToken(secret: string, userId: string, workflow: string): string {
  return createHmac("sha256", secret).update(`${userId}|${workflow}`).digest("hex");
}

export function verifyUnsubscribeToken(
  secret: string,
  userId: string,
  workflow: string,
  token: string,
): boolean {
  if (!secret) return false;
  if (!/^[0-9a-f]+$/i.test(token) || token.length % 2 !== 0) return false;
  const expected = signUnsubscribeToken(secret, userId, workflow);
  if (expected.length !== token.length) return false;
  try {
    return timingSafeEqual(Buffer.from(expected, "hex"), Buffer.from(token, "hex"));
  } catch {
    return false;
  }
}

@Injectable()
export class EmailPreferencesService {
  private readonly logger = new Logger(EmailPreferencesService.name);

  constructor(@Inject(DATABASE) private readonly db: Database) {}

  /** True if the user has explicitly opted out of `workflow`. */
  async isOptedOut(userId: string, workflow: string): Promise<boolean> {
    if (!OPTIONAL_WORKFLOWS.has(workflow)) return false;
    const [row] = await this.db
      .select({ optedOut: schema.emailPreferences.optedOut })
      .from(schema.emailPreferences)
      .where(
        and(
          eq(schema.emailPreferences.userId, userId),
          eq(schema.emailPreferences.workflow, workflow),
        ),
      )
      .limit(1);
    return row?.optedOut === true;
  }

  /**
   * Mark a (user, workflow) pair as opted-out. Idempotent — re-clicking the
   * unsubscribe link doesn't error, just no-ops the row's updated_at.
   * `source` is captured for audit (`one_click`, `settings_page`,
   * `admin_panel`, …).
   */
  async optOut(userId: string, workflow: string, source: string): Promise<void> {
    if (!OPTIONAL_WORKFLOWS.has(workflow)) {
      this.logger.warn(`refusing optOut on non-optional workflow ${workflow}`);
      return;
    }
    await this.db
      .insert(schema.emailPreferences)
      .values({ userId, workflow, optedOut: true, source })
      .onConflictDoUpdate({
        target: [schema.emailPreferences.userId, schema.emailPreferences.workflow],
        set: { optedOut: true, source, updatedAt: new Date() },
      });
  }

  /** Re-subscribe — used by the dashboard settings UI when a user toggles back on. */
  async optIn(userId: string, workflow: string): Promise<void> {
    await this.db
      .delete(schema.emailPreferences)
      .where(
        and(
          eq(schema.emailPreferences.userId, userId),
          eq(schema.emailPreferences.workflow, workflow),
        ),
      );
  }
}