feat(cloud): email unsubscribe (#258)

* feat(cloud): add email unsubscribe

* chore: add translations

packages/auth/src/auth.ts

@@ -18,6 +18,7 @@ import * as userRepo from "@kan/db/repository/user.repo";
 import * as workspaceRepo from "@kan/db/repository/workspace.repo";
 import * as schema from "@kan/db/schema";
 import { notificationClient, sendEmail } from "@kan/email";
+import { createEmailUnsubscribeLink } from "@kan/shared";
 import { createStripeClient } from "@kan/stripe";
 
 export const configuredProviders = socialProviderList.reduce<
@@ -401,6 +402,10 @@ export const initAuth = (db: dbClient) => {
                   ? `${env("NEXT_PUBLIC_STORAGE_URL")}/${env("NEXT_PUBLIC_AVATAR_BUCKET_NAME")}/${avatarKey}`
                   : undefined;
 
+                const unsubscribeUrl = await createEmailUnsubscribeLink(
+                  user.id,
+                );
+
                 await notificationClient.trigger({
                   to: {
                     subscriberId: user.id,
@@ -415,6 +420,9 @@ export const initAuth = (db: dbClient) => {
                       updatedAt: user.updatedAt,
                     },
                   },
+                  payload: {
+                    emailUnsubscribeUrl: unsubscribeUrl,
+                  },
                   workflowId: "user-signup",
                 });
 
@@ -489,6 +497,8 @@ async function triggerWorkflow(
 
     if (!user || !notificationClient) return;
 
+    const unsubscribeUrl = await createEmailUnsubscribeLink(user.id);
+
     await notificationClient.trigger({
       to: {
         subscriberId: user.id,
@@ -496,6 +506,7 @@ async function triggerWorkflow(
       payload: {
         ...subscription,
         cancellationDetails,
+        emailUnsubscribeUrl: unsubscribeUrl,
       },
       workflowId,
     });

packages/shared/src/utils/email.ts

@@ -0,0 +1,31 @@
+import { SignJWT } from "jose";
+
+const encoder = new TextEncoder();
+
+/**
+ * Creates a long‑lived unsubscribe link for a given user/subscriber.
+ *
+ * `${NEXT_PUBLIC_BASE_URL}/unsubscribe?token=<jwt>`
+ *
+ * The JWT payload only contains the subscriberId. There is no expiry
+ * on purpose – unsubscribe links should remain valid indefinitely.
+ *
+ */
+export async function createEmailUnsubscribeLink(
+  userId: string,
+): Promise<string | null> {
+  const baseUrl = process.env.NEXT_PUBLIC_BASE_URL;
+  const secret = process.env.EMAIL_UNSUBSCRIBE_SECRET;
+
+  if (!baseUrl || !secret) {
+    // Environment not configured for unsubscribe links.
+    return null;
+  }
+
+  const token = await new SignJWT({ subscriberId: userId })
+    .setProtectedHeader({ alg: "HS256" })
+    // No expiration on purpose; unsubscribe links are long‑lived.
+    .sign(encoder.encode(secret));
+
+  return `${baseUrl}/unsubscribe?token=${encodeURIComponent(token)}`;
+}

packages/shared/src/utils/index.ts

@@ -1,3 +1,4 @@
 export * from "./generateUID";
 export * from "./generateSlug";
 export * from "./subscriptions";
+export * from "./email";