git-paid 0.0.0-stage → 2.1.0

package/lib/inbox.js

@@ -0,0 +1,216 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const INBOX_STORE_PATH = path.join(os.tmpdir(), "postbuild-verification-inbox.json");
+
+function loadStore() {
+  try {
+    if (fs.existsSync(INBOX_STORE_PATH)) {
+      return JSON.parse(fs.readFileSync(INBOX_STORE_PATH, "utf8"));
+    }
+  } catch {}
+  return { messages: [] };
+}
+
+function saveStore(store) {
+  try {
+    fs.writeFileSync(INBOX_STORE_PATH, JSON.stringify(store, null, 2), "utf8");
+  } catch {}
+}
+
+/**
+ * Extracts confirmation/verification links and 4-to-8 digit OTP codes from email text/HTML.
+ */
+export function extractVerificationSignals(subject = "", text = "", html = "") {
+  const combined = `${subject}\n${text}\n${html.replace(/<[^>]+>/g, " ")}`;
+
+  // Extract all https:// URLs
+  const urlMatches = `${text}\n${html}`.match(/https?:\/\/[^\s"'<>)+]+/gi) || [];
+  const cleanedUrls = [...new Set(urlMatches.map((u) => u.replace(/[.,;!?]+$/, "")))];
+
+  const verificationKeywords = /verify|confirm|activate|token|magic|auth|validate|callback|accept|claim|submission|approve/i;
+  const verificationLinks = cleanedUrls.filter((u) => verificationKeywords.test(u));
+  const primaryLink = verificationLinks[0] || cleanedUrls[0] || null;
+
+  // Extract 6-digit OTP code (or 4-8 digit code near "code", "OTP", "PIN", "verification")
+  let otpCode = null;
+  const contextualOtp = combined.match(/(?:code|otp|pin|token|verification|confirm)[:\s#-]*([0-9]{4,8})\b/i);
+  if (contextualOtp) {
+    otpCode = contextualOtp[1];
+  } else {
+    const sixDigit = combined.match(/\b([0-9]{6})\b/);
+    if (sixDigit && !/^202[0-9]/.test(sixDigit[1])) {
+      otpCode = sixDigit[1];
+    }
+  }
+
+  return {
+    primaryLink,
+    verificationLinks: verificationLinks.length ? verificationLinks : cleanedUrls.slice(0, 3),
+    otpCode
+  };
+}
+
+/**
+ * Ingests an inbound email webhook payload (Resend `email.received`, Postmark, ForwardEmail, or raw JSON).
+ */
+export async function ingestInboundEmail(rawPayload = {}) {
+  const payload = rawPayload?.data && typeof rawPayload.data === "object" ? rawPayload.data : rawPayload;
+
+  let textBody = String(payload.text || payload.body || payload.rawText || "").trim();
+  let htmlBody = String(payload.html || "").trim();
+  let subject = String(payload.subject || "Confirm your directory submission").trim();
+
+  const resendEmailId = payload.email_id || payload.id;
+  const resendApiKey = (process.env.RESEND_API_KEY || "").trim();
+  if (resendEmailId && resendApiKey && !textBody && !htmlBody) {
+    try {
+      const resp = await fetch(`https://api.resend.com/emails/receiving/${encodeURIComponent(resendEmailId)}`, {
+        headers: { Authorization: `Bearer ${resendApiKey}` }
+      });
+      if (resp.ok) {
+        const fullEmail = await resp.json();
+        textBody = String(fullEmail.text || textBody).trim();
+        htmlBody = String(fullEmail.html || htmlBody).trim();
+        subject = String(fullEmail.subject || subject).trim();
+      }
+    } catch {}
+  }
+
+  const toRaw = payload.to || payload.recipient || payload.envelope?.to || "postbuild-bot@postbuild.dev";
+  const toAddress = (Array.isArray(toRaw) ? toRaw[0] : String(toRaw))
+    .replace(/^.*<([^>]+)>.*$/, "$1")
+    .trim()
+    .toLowerCase();
+
+  const fromRaw = payload.from || payload.sender || payload.envelope?.from || "no-reply@directory-verifier.com";
+  const fromAddress = String(fromRaw).trim();
+
+  const signals = extractVerificationSignals(subject, textBody, htmlBody);
+
+  const msg = {
+    id: resendEmailId || `msg_${Date.now()}_${Math.random().toString(36).slice(2, 7)}`,
+    to: toAddress,
+    from: fromAddress,
+    subject,
+    snippet: (textBody || htmlBody.replace(/<[^>]+>/g, " ")).slice(0, 220).trim(),
+    primaryLink: signals.primaryLink,
+    verificationLinks: signals.verificationLinks,
+    otpCode: signals.otpCode,
+    status: signals.primaryLink || signals.otpCode ? "action_ready" : "received",
+    receivedAt: payload.created_at || new Date().toISOString()
+  };
+
+  const store = loadStore();
+  const existsIdx = store.messages.findIndex((m) => m.id === msg.id);
+  if (existsIdx >= 0) {
+    store.messages[existsIdx] = msg;
+  } else {
+    store.messages.unshift(msg);
+  }
+  store.messages = store.messages.slice(0, 100);
+  saveStore(store);
+
+  return msg;
+}
+
+/**
+ * Syncs recent inbound emails directly from Resend Receiving API (`GET /emails/receiving`)
+ * so serverless cold starts never lose verification emails.
+ */
+async function syncFromResendReceivingApi(targetInbox = "") {
+  const resendApiKey = (process.env.RESEND_API_KEY || "").trim();
+  if (!resendApiKey) return;
+
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 3500);
+    const resp = await fetch("https://api.resend.com/emails/receiving?limit=20", {
+      headers: { Authorization: `Bearer ${resendApiKey}` },
+      signal: controller.signal
+    });
+    clearTimeout(timer);
+    if (!resp.ok) return;
+
+    const data = await resp.json();
+    const items = Array.isArray(data?.data) ? data.data : Array.isArray(data) ? data : [];
+    const store = loadStore();
+    const knownIds = new Set(store.messages.map((m) => m.id));
+    const prefix = targetInbox ? targetInbox.split("@")[0].toLowerCase() : "";
+
+    for (const item of items.slice(0, 12)) {
+      const id = item.id || item.email_id;
+      if (!id || knownIds.has(id)) continue;
+
+      const toList = Array.isArray(item.to) ? item.to.join(" ").toLowerCase() : String(item.to || "").toLowerCase();
+      if (prefix && !toList.includes(prefix) && !toList.includes("postbuild.dev")) continue;
+
+      await ingestInboundEmail(item);
+    }
+  } catch {}
+}
+
+/**
+ * Lists verification emails for a given bot inbox address (e.g., postbuild-bot@postbuild.dev).
+ * Queries Resend Receiving API directly when RESEND_API_KEY is present, or syncs from postbuild.dev when run via local CLI.
+ */
+export async function listInboxMessages(inboxAddress = "", options = {}) {
+  const normalized = String(inboxAddress || "postbuild-bot@postbuild.dev").trim().toLowerCase();
+
+  if (process.env.RESEND_API_KEY) {
+    await syncFromResendReceivingApi(normalized);
+  } else if (options.allowRemoteFallback !== false && !process.env.VERCEL) {
+    try {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), 3000);
+      const remoteResp = await fetch(
+        `https://www.postbuild.dev/api/dispatch?action=inbox_list&inbox=${encodeURIComponent(normalized)}`,
+        { signal: controller.signal }
+      );
+      clearTimeout(timer);
+      if (remoteResp.ok) {
+        const remoteData = await remoteResp.json();
+        if (Array.isArray(remoteData.messages) && remoteData.messages.length > 0) {
+          const store = loadStore();
+          const existingIds = new Set(store.messages.map((m) => m.id));
+          for (const rm of remoteData.messages) {
+            if (!existingIds.has(rm.id)) store.messages.push(rm);
+          }
+          saveStore(store);
+        }
+      }
+    } catch {}
+  }
+
+  const store = loadStore();
+  const filtered = normalized
+    ? store.messages.filter((m) => m.to === normalized || m.to.includes(normalized.split("@")[0]))
+    : store.messages;
+
+  return {
+    inboxAddress: normalized,
+    count: filtered.length,
+    messages: filtered
+  };
+}
+
+/**
+ * Generates a realistic test verification email so users can verify the inbox pipeline immediately.
+ */
+export async function sendTestVerificationEmail(inboxAddress = "postbuild-bot@postbuild.dev", domain = "postbuild.dev") {
+  const cleanInbox = String(inboxAddress || "postbuild-bot@postbuild.dev").trim().toLowerCase();
+  const otp = String(Math.floor(100000 + Math.random() * 900000));
+  const token = Buffer.from(`${domain}:${Date.now()}`).toString("base64url");
+  const verifyUrl = `https://postbuild.dev/?verified_directory=betalist&domain=${encodeURIComponent(domain)}&token=${token}`;
+
+  return ingestInboundEmail({
+    type: "email.received",
+    data: {
+      to: [cleanInbox],
+      from: "BetaList Launch Bot <verify@betalist.com>",
+      subject: `[Action Required] Verify ${domain} submission on BetaList (Code: ${otp})`,
+      text: `Hi ${domain} team,\n\nWe received your directory launch submission via postbuild. Your one-time verification code is ${otp}.\n\nOr click the instant confirmation link below to publish your listing immediately:\n${verifyUrl}\n`
+    }
+  });
+}