/** * Password-reset email template. * * Inline HTML — kept here as a small render function rather than a * full templating engine to keep the dep tree clean. If/when we add * more email templates, swap to handlebars + a `templates/*.hbs` * folder; until then a typed render function is enough. * * Plain-text fallback returned alongside HTML for clients that * disable images / strip CSS — ensures the link is always visible. */ export interface PasswordResetTemplateInput { recipientName: string; /** Fully-formed reset URL including the tenant subdomain so the * user lands on the right tenant's login after redemption. */ resetUrl: string; /** Display string for the expiry, e.g. "30 minutes". */ expiresIn: string; /** Tenant name for letterhead / "from " wording. */ companyName: string; } export function passwordResetTemplate(input: PasswordResetTemplateInput): { html: string; text: string; } { const { recipientName, resetUrl, expiresIn, companyName } = input; const safeName = recipientName ? escapeHtml(recipientName) : 'there'; const safeCompany = escapeHtml(companyName); const html = ` Reset your password

${safeCompany}

Hi ${safeName},

We received a request to reset the password for your ${safeCompany} account. Click the button below to choose a new password.

Reset password

If the button doesn't work, copy and paste this link into your browser:

${escapeHtml(resetUrl)}

This link expires in ${escapeHtml(expiresIn)} and can only be used once.

If you didn't request this, you can safely ignore this email — your password won't change.

${safeCompany} · This is an automated email; please don't reply.

`.trim(); const text = [ `Hi ${recipientName || 'there'},`, '', `We received a request to reset the password for your ${companyName} account.`, '', `Reset link (expires in ${expiresIn}, single-use):`, resetUrl, '', `If you didn't request this, you can safely ignore this email — your password won't change.`, '', `— ${companyName}`, ].join('\n'); return { html, text }; } /** * Minimal HTML-entity escape for the small set of fields we * interpolate. Not a full sanitizer — we only ever interpolate * server-controlled / user-display strings, never raw user-typed * HTML. Per security.md A03 (XSS). */ function escapeHtml(s: string): string { return String(s) .replace(/&/g, '&') .replace(//g, '>') .replace(/"/g, '"') .replace(/'/g, '''); }