import nodemailer from 'nodemailer'; import { db } from '@server/db/drizzle'; import { sql } from 'drizzle-orm'; import { childLogger } from '@server/logger'; import { redactEmail } from '@server/logger/redact'; const log = childLogger('svc.email'); interface SmtpConfig { host: string; port: number; user: string; pass: string; from: string; } function defaultNoReplyAddress(): string { const appUrl = process.env.NEXT_PUBLIC_APP_URL; if (appUrl) { try { const host = new URL(appUrl).hostname; if (host && host !== 'localhost') return `noreply@${host}`; } catch { /* fall through */ } } return 'noreply@localhost'; } function buildTransport(cfg: SmtpConfig) { return nodemailer.createTransport({ host: cfg.host, port: cfg.port, secure: cfg.port === 465, auth: { user: cfg.user, pass: cfg.pass }, }); } function getEnvSmtpConfig(): SmtpConfig | null { const host = process.env.SMTP_HOST; const port = parseInt(process.env.SMTP_PORT ?? '587', 10); const user = process.env.SMTP_USER; const pass = process.env.SMTP_PASS; if (!host || !user || !pass) return null; const from = process.env.SMTP_FROM || user || defaultNoReplyAddress(); return { host, port, user, pass, from }; } async function getBranchSmtpConfig(branchId: string, restaurantId?: string): Promise { try { /* raw: SELECT smtp_host, smtp_port, smtp_user, smtp_pass, smtp_from FROM branches WHERE id = $1 [AND restaurant_id = $2] */ const { rows } = restaurantId ? await db.execute(sql`SELECT smtp_host, smtp_port, smtp_user, smtp_pass, smtp_from FROM branches WHERE id = ${branchId} AND restaurant_id = ${restaurantId}`) : await db.execute(sql`SELECT smtp_host, smtp_port, smtp_user, smtp_pass, smtp_from FROM branches WHERE id = ${branchId}`); const row = rows[0] as Record | undefined; if (!row) return null; const host = row.smtp_host as string | null; const user = row.smtp_user as string | null; const pass = row.smtp_pass as string | null; if (!host || !user || !pass) return null; const port = (row.smtp_port as number | null) ?? 587; const from = (row.smtp_from as string | null) || user || defaultNoReplyAddress(); return { host, port, user, pass, from }; } catch { return null; } } async function resolveSmtpConfig(branchId?: string, restaurantId?: string): Promise<{ transport: ReturnType; from: string } | null> { let cfg: SmtpConfig | null = null; if (branchId) { cfg = await getBranchSmtpConfig(branchId, restaurantId); } if (!cfg) { cfg = getEnvSmtpConfig(); } if (!cfg) return null; return { transport: buildTransport(cfg), from: cfg.from }; } export interface SendPasswordResetEmailOptions { to: string; userName: string; resetLink: string; } function escapeHtml(text: string): string { return text .replace(/&/g, '&') .replace(//g, '>') .replace(/"/g, '"') .replace(/'/g, '''); } function buildPasswordResetHtml(userName: string, resetLink: string): string { if (!/^https?:\/\//i.test(resetLink)) throw new Error('Invalid reset link URL'); const safeLink = resetLink.replace(/"/g, '%22'); return ` Reset your RestroAgent password

🆎 RestroAgent

Reset your password

Hi ${escapeHtml(userName)},
We received a request to reset the password for your RestroAgent account. Click the button below to choose a new password. This link expires in 30 minutes.

Reset Password

If the button above doesn't work, copy and paste this link into your browser:

${escapeHtml(resetLink)}

Didn't request this? If you didn't request a password reset, you can safely ignore this email. Your password will not be changed.

© ${new Date().getFullYear()} RestroAgent — AI-powered restaurant management
You received this email because a password reset was requested for your account.

`; } export interface SendOrderConfirmationOptions { to: string; customerName: string; orderNumber: number | string; items: { name: string; quantity: number; price?: number }[]; total: number; deliveryType: string; restaurantName: string; } function buildOrderConfirmationHtml(opts: SendOrderConfirmationOptions): string { const { customerName, orderNumber, items, total, deliveryType, restaurantName } = opts; const itemRows = items.map(i => `${escapeHtml(i.name)}${escapeHtml(String(i.quantity))}${i.price != null ? '$' + escapeHtml((i.price * i.quantity).toFixed(2)) : ''}` ).join(''); const dtLabel = deliveryType === 'dine-in' ? 'Dine-In' : deliveryType === 'takeaway' ? 'Takeaway' : 'Delivery'; return ` Order Confirmation

🆎 ${escapeHtml(restaurantName)}

✅

Order Confirmed!

Order #${escapeHtml(String(orderNumber))} • ${escapeHtml(dtLabel)}

Hi ${escapeHtml(customerName)}, thank you for your order! Here's a summary:

${itemRows}

ITEM	QTY	PRICE

Total: $${escapeHtml(total.toFixed(2))}

Our team has received your order and will prepare it shortly. You'll be notified when it's ready.

`; } export async function sendOrderConfirmationEmail(opts: SendOrderConfirmationOptions, branchId?: string, restaurantId?: string): Promise { const smtp = await resolveSmtpConfig(branchId, restaurantId); if (!smtp) { log.warn('SMTP not configured — skipping order confirmation email'); return; } await smtp.transport.sendMail({ from: smtp.from, to: opts.to, subject: `Order Confirmed! #${opts.orderNumber} — ${opts.restaurantName}`, html: buildOrderConfirmationHtml(opts), }); log.info({ to: redactEmail(opts.to), orderNumber: opts.orderNumber }, 'order confirmation email sent'); } export interface SendBookingConfirmationOptions { to: string; guestName: string; bookingRef: string; date: string; time: string; partySize: number | string; restaurantName: string; occasion?: string; } function buildBookingConfirmationHtml(opts: SendBookingConfirmationOptions): string { const { guestName, bookingRef, date, time, partySize, restaurantName, occasion } = opts; return ` Booking Confirmation

🆎 ${escapeHtml(restaurantName)}

📅

Table Booking Confirmed!

Ref: ${escapeHtml(bookingRef)}

Hi ${escapeHtml(guestName)}, your reservation has been confirmed. Here are your details:

${occasion ? `` : ''}

📅 Date	${escapeHtml(date)}
🕐 Time	${escapeHtml(time)}
👥 Guests	${escapeHtml(String(partySize))}
🎉 Occasion	${escapeHtml(occasion)}

We look forward to seeing you! If you need to make any changes, please contact us directly.

`; } export async function sendBookingConfirmationEmail(opts: SendBookingConfirmationOptions, branchId?: string, restaurantId?: string): Promise { const smtp = await resolveSmtpConfig(branchId, restaurantId); if (!smtp) { log.warn('SMTP not configured — skipping booking confirmation email'); return; } await smtp.transport.sendMail({ from: smtp.from, to: opts.to, subject: `Booking Confirmed! Ref: ${opts.bookingRef} — ${opts.restaurantName}`, html: buildBookingConfirmationHtml(opts), }); log.info({ to: redactEmail(opts.to), bookingRef: opts.bookingRef }, 'booking confirmation email sent'); } export async function sendInvoiceNotificationEmail(opts: { to: string; restaurantName: string; invoiceNumber: string; amount: string; currency: string; periodStart: string; periodEnd: string; hostedUrl?: string; pdfUrl?: string; }, restaurantId?: string): Promise { const smtp = await resolveSmtpConfig(undefined, restaurantId); if (!smtp) { log.warn('SMTP not configured — skipping billing contact invoice notification'); return; } const { to, restaurantName, invoiceNumber, amount, currency, periodStart, periodEnd, hostedUrl, pdfUrl } = opts; const viewLink = hostedUrl ? `

View invoice online${pdfUrl ? ` · Download PDF` : ''}

` : ''; const html = `

${escapeHtml(restaurantName)}

Invoice notification for your billing contact

Invoice	${escapeHtml(invoiceNumber)}
Period	${escapeHtml(periodStart)} – ${escapeHtml(periodEnd)}
Amount	${escapeHtml(currency.toUpperCase())} ${escapeHtml(amount)}

${viewLink}

`; await smtp.transport.sendMail({ from: smtp.from, to, subject: `Invoice ${invoiceNumber} — ${restaurantName}`, html, }); log.info({ to: redactEmail(to), invoiceNumber }, 'billing contact invoice notification sent'); } export async function sendPasswordResetEmail( opts: SendPasswordResetEmailOptions ): Promise { const smtp = await resolveSmtpConfig(); if (!smtp) { log.warn( '[Email] SMTP not configured (SMTP_HOST / SMTP_USER / SMTP_PASS missing) — skipping email delivery' ); return; } const info = await smtp.transport.sendMail({ from: smtp.from, to: opts.to, subject: 'Reset your RestroAgent password', html: buildPasswordResetHtml(opts.userName, opts.resetLink), }); log.info({ to: redactEmail(opts.to), messageId: info.messageId }, 'password reset email sent'); }