chore: import upstream snapshot with attribution

apps/sim/app/api/users/me/settings/route.ts

@@ -0,0 +1,79 @@
+import { db } from '@sim/db'
+import { settings } from '@sim/db/schema'
+import { createLogger } from '@sim/logger'
+import { generateShortId } from '@sim/utils/id'
+import { type NextRequest, NextResponse } from 'next/server'
+import { updateUserSettingsContract } from '@/lib/api/contracts'
+import { parseRequest, validationErrorResponse } from '@/lib/api/server'
+import { getSession } from '@/lib/auth'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { defaultUserSettings, getUserSettings } from '@/lib/users/queries'
+
+const logger = createLogger('UserSettingsAPI')
+
+export const GET = withRouteHandler(async () => {
+  const requestId = generateRequestId()
+
+  try {
+    const session = await getSession()
+    const data = await getUserSettings(session?.user?.id ?? null)
+    return NextResponse.json({ data }, { status: 200 })
+  } catch (error: any) {
+    logger.error(`[${requestId}] Settings fetch error`, error)
+    return NextResponse.json({ data: defaultUserSettings }, { status: 200 })
+  }
+})
+
+export const PATCH = withRouteHandler(async (request: NextRequest) => {
+  const requestId = generateRequestId()
+
+  try {
+    const session = await getSession()
+
+    if (!session?.user?.id) {
+      logger.info(
+        `[${requestId}] Settings update attempted by unauthenticated user - acknowledged without saving`
+      )
+      return NextResponse.json({ success: true }, { status: 200 })
+    }
+
+    const userId = session.user.id
+
+    const parsed = await parseRequest(
+      updateUserSettingsContract,
+      request,
+      {},
+      {
+        validationErrorResponse: (error) => {
+          logger.warn(`[${requestId}] Invalid settings data`, { errors: error.issues })
+          return validationErrorResponse(error, 'Invalid settings data')
+        },
+      }
+    )
+    if (!parsed.success) return parsed.response
+
+    const validatedData = parsed.data.body
+
+    await db
+      .insert(settings)
+      .values({
+        id: generateShortId(),
+        userId,
+        ...validatedData,
+        updatedAt: new Date(),
+      })
+      .onConflictDoUpdate({
+        target: [settings.userId],
+        set: {
+          ...validatedData,
+          updatedAt: new Date(),
+        },
+      })
+
+    return NextResponse.json({ success: true }, { status: 200 })
+  } catch (error: any) {
+    logger.error(`[${requestId}] Settings update error`, error)
+    return NextResponse.json({ success: true }, { status: 200 })
+  }
+})

apps/sim/app/api/users/me/settings/unsubscribe/route.ts

@@ -0,0 +1,194 @@
+import { createLogger } from '@sim/logger'
+import { type NextRequest, NextResponse } from 'next/server'
+import {
+  unsubscribeFormContract,
+  unsubscribeGetContract,
+  unsubscribePostContract,
+} from '@/lib/api/contracts/user'
+import { parseRequest } from '@/lib/api/server'
+import { enforceIpRateLimit } from '@/lib/core/rate-limiter'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import type { EmailType } from '@/lib/messaging/email/mailer'
+import {
+  getEmailPreferences,
+  isTransactionalEmail,
+  unsubscribeFromAll,
+  updateEmailPreferences,
+  verifyUnsubscribeToken,
+} from '@/lib/messaging/email/unsubscribe'
+
+const logger = createLogger('UnsubscribeAPI')
+
+const UNSUBSCRIBE_RATE_LIMIT = {
+  maxTokens: 10,
+  refillRate: 10,
+  refillIntervalMs: 60_000,
+}
+
+export const GET = withRouteHandler(async (req: NextRequest) => {
+  const requestId = generateRequestId()
+
+  const rateLimited = await enforceIpRateLimit('unsubscribe', req, UNSUBSCRIBE_RATE_LIMIT)
+  if (rateLimited) return rateLimited
+
+  try {
+    const parsed = await parseRequest(
+      unsubscribeGetContract,
+      req,
+      {},
+      {
+        validationErrorResponse: () =>
+          NextResponse.json({ error: 'Missing email or token parameter' }, { status: 400 }),
+      }
+    )
+    if (!parsed.success) {
+      logger.warn(`[${requestId}] Missing email or token in GET request`)
+      return parsed.response
+    }
+    const { email, token } = parsed.data.query
+
+    const tokenVerification = verifyUnsubscribeToken(email, token)
+    if (!tokenVerification.valid) {
+      logger.warn(`[${requestId}] Invalid unsubscribe token for email: ${email}`)
+      return NextResponse.json({ error: 'Invalid or expired unsubscribe link' }, { status: 400 })
+    }
+
+    const emailType = tokenVerification.emailType as EmailType
+    const isTransactional = isTransactionalEmail(emailType)
+
+    const preferences = await getEmailPreferences(email)
+
+    logger.info(
+      `[${requestId}] Valid unsubscribe GET request for email: ${email}, type: ${emailType}`
+    )
+
+    return NextResponse.json({
+      success: true,
+      email,
+      token,
+      emailType,
+      isTransactional,
+      currentPreferences: preferences || {},
+    })
+  } catch (error) {
+    logger.error(`[${requestId}] Error processing unsubscribe GET request:`, error)
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+  }
+})
+
+export const POST = withRouteHandler(async (req: NextRequest) => {
+  const requestId = generateRequestId()
+
+  const rateLimited = await enforceIpRateLimit('unsubscribe', req, UNSUBSCRIBE_RATE_LIMIT)
+  if (rateLimited) return rateLimited
+
+  try {
+    const contentType = req.headers.get('content-type') || ''
+
+    let email: string
+    let token: string
+    let type: 'all' | 'marketing' | 'updates' | 'notifications' = 'all'
+
+    if (contentType.includes('application/x-www-form-urlencoded')) {
+      const parsed = await parseRequest(
+        unsubscribeFormContract,
+        req,
+        {},
+        {
+          validationErrorResponse: () =>
+            NextResponse.json({ error: 'Missing email or token parameter' }, { status: 400 }),
+        }
+      )
+      if (!parsed.success) {
+        logger.warn(`[${requestId}] One-click unsubscribe missing email or token in URL`)
+        return parsed.response
+      }
+
+      email = parsed.data.query.email
+      token = parsed.data.query.token
+
+      logger.info(`[${requestId}] Processing one-click unsubscribe for: ${email}`)
+    } else {
+      const parsed = await parseRequest(
+        unsubscribePostContract,
+        req,
+        {},
+        {
+          validationErrorResponse: (error) =>
+            NextResponse.json(
+              { error: 'Invalid request data', details: error.issues },
+              { status: 400 }
+            ),
+        }
+      )
+      if (!parsed.success) {
+        logger.warn(`[${requestId}] Invalid unsubscribe POST data`)
+        return parsed.response
+      }
+
+      email = parsed.data.body.email
+      token = parsed.data.body.token
+      type = parsed.data.body.type
+    }
+
+    const tokenVerification = verifyUnsubscribeToken(email, token)
+    if (!tokenVerification.valid) {
+      logger.warn(`[${requestId}] Invalid unsubscribe token for email: ${email}`)
+      return NextResponse.json({ error: 'Invalid or expired unsubscribe link' }, { status: 400 })
+    }
+
+    const emailType = tokenVerification.emailType as EmailType
+    const isTransactional = isTransactionalEmail(emailType)
+
+    if (isTransactional) {
+      logger.warn(`[${requestId}] Attempted to unsubscribe from transactional email: ${email}`)
+      return NextResponse.json(
+        {
+          error: 'Cannot unsubscribe from transactional emails',
+          isTransactional: true,
+          message:
+            'Transactional emails cannot be unsubscribed from as they contain important account information.',
+        },
+        { status: 400 }
+      )
+    }
+
+    let success = false
+    switch (type) {
+      case 'all':
+        success = await unsubscribeFromAll(email)
+        break
+      case 'marketing':
+        success = await updateEmailPreferences(email, { unsubscribeMarketing: true })
+        break
+      case 'updates':
+        success = await updateEmailPreferences(email, { unsubscribeUpdates: true })
+        break
+      case 'notifications':
+        success = await updateEmailPreferences(email, { unsubscribeNotifications: true })
+        break
+    }
+
+    if (!success) {
+      logger.error(`[${requestId}] Failed to update unsubscribe preferences for: ${email}`)
+      return NextResponse.json({ error: 'Failed to process unsubscribe request' }, { status: 500 })
+    }
+
+    logger.info(`[${requestId}] Successfully unsubscribed ${email} from ${type}`)
+
+    return NextResponse.json(
+      {
+        success: true,
+        message: `Successfully unsubscribed from ${type} emails`,
+        email,
+        type,
+        emailType,
+      },
+      { status: 200 }
+    )
+  } catch (error) {
+    logger.error(`[${requestId}] Error processing unsubscribe POST request:`, error)
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+  }
+})