feat(cloud): add email unsubscribe

apps/web/package.json

@@ -29,6 +29,7 @@
     "@lingui/conf": "^5.3.2",
     "@lingui/macro": "^5.3.2",
     "@lingui/react": "^5.3.2",
+    "@novu/api": "^3.11.0",
     "@t3-oss/env-nextjs": "^0.11.1",
     "@tailwindcss/typography": "^0.5.16",
     "@tanstack/react-query": "catalog:",
@@ -46,6 +47,7 @@
     "aws-sdk": "^2.1692.0",
     "date-fns": "^4.1.0",
     "geist": "^1.3.1",
+    "jose": "^6.1.2",
     "next": "^15.3.4",
     "next-logger": "^5.0.1",
     "next-runtime-env": "^1.7.2",

apps/web/src/env.ts

@@ -51,6 +51,8 @@ export const env = createEnv({
     VK_CLIENT_SECRET: z.string().optional(),
     LINKEDIN_CLIENT_ID: z.string().optional(),
     LINKEDIN_CLIENT_SECRET: z.string().optional(),
+    NOVU_API_KEY: z.string().optional(),
+    EMAIL_UNSUBSCRIBE_SECRET: z.string().optional(),
     // Generic OIDC Provider
     OIDC_CLIENT_ID: z.string().optional(),
     OIDC_CLIENT_SECRET: z.string().optional(),

apps/web/src/pages/api/unsubscribe.ts

@@ -0,0 +1,104 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+import { Novu } from "@novu/api";
+import { jwtVerify } from "jose";
+import { z } from "zod";
+
+import { env } from "~/env";
+
+const requestSchema = z.object({
+  token: z.string().min(1),
+});
+
+const tokenPayloadSchema = z.object({
+  subscriberId: z.string(),
+});
+
+type ResponseData =
+  | { success: true }
+  | { success: false; error: string; code?: string };
+
+const textEncoder = new TextEncoder();
+
+export default async function handler(
+  req: NextApiRequest,
+  res: NextApiResponse<ResponseData>,
+) {
+  if (process.env.NEXT_PUBLIC_KAN_ENV !== "cloud") {
+    return res.status(404).json({
+      success: false,
+      error: "Unsubscribe endpoint is not available.",
+      code: "UNAVAILABLE",
+    });
+  }
+
+  if (req.method !== "POST") {
+    res.setHeader("Allow", "POST");
+    return res.status(405).json({
+      success: false,
+      error: "Method not allowed.",
+      code: "METHOD_NOT_ALLOWED",
+    });
+  }
+
+  const parsedBody = requestSchema.safeParse(req.body);
+
+  if (!parsedBody.success) {
+    return res.status(400).json({
+      success: false,
+      error: "Invalid request payload.",
+      code: "BAD_REQUEST",
+    });
+  }
+
+  if (!env.EMAIL_UNSUBSCRIBE_SECRET || !env.NOVU_API_KEY) {
+    return res.status(500).json({
+      success: false,
+      error: "Unsubscribe service is not configured.",
+      code: "NOT_CONFIGURED",
+    });
+  }
+
+  let payload: z.infer<typeof tokenPayloadSchema>;
+
+  try {
+    const verified = await jwtVerify(
+      parsedBody.data.token,
+      textEncoder.encode(env.EMAIL_UNSUBSCRIBE_SECRET),
+      {
+        // We intentionally do not use exp/iat claims –
+        // tokens are long-lived and validated only by signature + payload.
+        clockTolerance: "0s",
+      },
+    );
+    payload = tokenPayloadSchema.parse(verified.payload);
+  } catch {
+    return res.status(401).json({
+      success: false,
+      error: "Your unsubscribe link is invalid or has expired.",
+      code: "INVALID_TOKEN",
+    });
+  }
+
+  const novu = new Novu({ secretKey: env.NOVU_API_KEY });
+
+  try {
+    await novu.subscribers.preferences.update(
+      {
+        channels: {
+          email: false,
+        },
+      },
+      payload.subscriberId,
+    );
+  } catch (error) {
+    console.error("Failed to update Novu preferences", error);
+    return res.status(502).json({
+      success: false,
+      error:
+        "We could not update your email preferences right now. Please try again later.",
+      code: "NOVU_ERROR",
+    });
+  }
+
+  return res.status(200).json({ success: true });
+}

apps/web/src/pages/unsubscribe/index.tsx

@@ -0,0 +1,110 @@
+import { useRouter } from "next/router";
+import { t } from "@lingui/core/macro";
+import { useEffect, useState } from "react";
+
+import Button from "~/components/Button";
+import { PageHead } from "~/components/PageHead";
+import PatternedBackground from "~/components/PatternedBackground";
+
+type UnsubscribeStatus = "idle" | "processing" | "success" | "error";
+
+export default function UnsubscribePage() {
+  const router = useRouter();
+  const [token, setToken] = useState("");
+  const [status, setStatus] = useState<UnsubscribeStatus>("idle");
+  const [errorMessage, setErrorMessage] = useState<string | null>(null);
+
+  useEffect(() => {
+    if (!router.isReady) return;
+    const value = router.query.token;
+    if (typeof value === "string") {
+      setToken(value);
+    } else if (Array.isArray(value)) {
+      setToken(value[0] ?? "");
+    } else {
+      setToken("");
+    }
+  }, [router.isReady, router.query.token]);
+
+  const handleUnsubscribe = async () => {
+    if (!token) {
+      setStatus("error");
+      setErrorMessage(
+        t`Your unsubscribe link is missing a token. Please open the latest email and try again.`,
+      );
+      return;
+    }
+
+    setStatus("processing");
+    setErrorMessage(null);
+
+    try {
+      const response = await fetch("/api/unsubscribe", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ token }),
+      });
+
+      if (!response.ok) {
+        const payload = (await response.json().catch(() => null)) as {
+          error?: string;
+        } | null;
+
+        throw new Error(
+          payload?.error ??
+            "We couldn't update your preferences. Please try again.",
+        );
+      }
+
+      setStatus("success");
+    } catch (error) {
+      setStatus("error");
+      setErrorMessage(
+        t`We couldn't update your preferences. Please try again.`,
+      );
+    }
+  };
+
+  const title = t`Unsubscribe`;
+
+  return (
+    <>
+      <PageHead title={`${title} | kan.bn`} />
+      <div className="relative flex min-h-screen items-center justify-center px-4 py-12 sm:px-6 lg:px-8">
+        <PatternedBackground />
+        <div className="z-10 w-full max-w-md space-y-6">
+          <div>
+            <h1 className="mt-6 text-center text-3xl font-bold tracking-tight text-light-1000 dark:text-dark-1000">
+              {t`Do you want to unsubscribe?`}
+            </h1>
+            <p className="mt-4 text-center text-sm text-light-900 dark:text-dark-800">
+              {t`Confirm your email preferences:`}
+            </p>
+          </div>
+
+          <div className="flex justify-center">
+            <Button
+              onClick={handleUnsubscribe}
+              disabled={status === "success"}
+              isLoading={status === "processing"}
+              variant="primary"
+              size="md"
+            >
+              {t`Unsubscribe`}
+            </Button>
+          </div>
+          {status === "success" && (
+            <p className="text-center text-sm text-light-900 dark:text-dark-800">
+              {t`You have been unsubscribed!`}
+            </p>
+          )}
+          {status === "error" && (
+            <p className="mx-auto max-w-[300px] text-center text-sm font-medium text-red-600 dark:text-red-400">
+              {errorMessage}
+            </p>
+          )}
+        </div>
+      </div>
+    </>
+  );
+}