Basic Blog

1
import { ActionError, defineAction } from 'astro:actions';
2
import { z } from "astro/zod";
3
import { escapeHtml } from '@utils/escapeHtml';
4
import { stripCtl } from '@utils/stripCtl';
5
import { Resend } from 'resend';
6

7
const resend = new Resend(import.meta.env.RESEND_API_KEY);
8

9
const KIT_FORM_ID = import.meta.env.KIT_FORM_ID;
10
const KIT_API_KEY = import.meta.env.KIT_API_KEY;
11

12
const TURNSTILE_SECRET = import.meta.env.TURNSTILE_SECRET_KEY;
13

14
const turnstileField = import.meta.env.DEV
15
  ? z
16
      .string()
17
      .optional()
18
      .default('') // dev: missing → ''
19
  : z.string().min(1); // prod: must be non-empty
20

21
const fetchWithTimeout = async (url: string, init: RequestInit = {}, ms = 8000) => {
22
  const controller = new AbortController();
23
  const t = setTimeout(() => controller.abort(), ms);
24
  return fetch(url, { ...init, signal: controller.signal }).finally(() => clearTimeout(t));
25
};
26

27
async function verifyTurnstile(token: string, remoteip?: string, expectAction?: string) {
28
  if (import.meta.env.DEV) return true;
29
  if (!TURNSTILE_SECRET) {
30
    console.error('TURNSTILE_SECRET_KEY missing');
31
    return false;
32
  }
33

34
  const body = new URLSearchParams({
35
    secret: TURNSTILE_SECRET,
36
    response: token,
37
    ...(remoteip ? { remoteip } : {}),
38
  });
39

40
  const res = await fetchWithTimeout('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
41
    method: 'POST',
42
    headers: { 'content-type': 'application/x-www-form-urlencoded' },
43
    body,
44
  }).catch((err) => {
45
    console.warn('Turnstile verify fetch failed/aborted', err);
46
    return undefined;
47
  });
48

49
  if (!res || !res.ok) {
50
    console.warn('Turnstile verify non-OK', res?.status);
51
    return false;
52
  }
53

54
  type VerifyResp = {
55
    success: boolean;
56
    hostname?: string;
57
    'error-codes'?: string[];
58
    action?: string;
59
    cdata?: string;
60
    challenge_ts?: string;
61
  };
62

63
  const json = (await res.json().catch(() => ({}))) as VerifyResp;
64

65
  if (!json.success) {
66
    console.warn('Turnstile failed', json);
67
    return false;
68
  }
69

70
  if (expectAction && json.action && json.action !== expectAction) {
71
    console.warn('Unexpected action', json.action);
72
    return false;
73
  }
74

75
  return true;
76
}
77

78
function getRemoteIp(request: Request): string | undefined {
79
  const h = request.headers;
80
  return (
81
    h.get('CF-Connecting-IP') ??
82
    h.get('x-real-ip') ??
83
    h.get('x-forwarded-for')?.split(',')[0]?.trim() ??
84
    undefined
85
  );
86
}
87

88
export const server = {
89
  contact: defineAction({
90
    accept: 'form',
91
    input: z.object({
92
      name: z.string().min(1).max(100),
93
      email: z.string().email().max(254),
94
      message: z.string().min(1).max(5000),
95
      'cf-turnstile-response': turnstileField,
96
    }),
97
    handler: async ({ name, email, message, 'cf-turnstile-response': token }, ctx) => {
98
      const remoteip = getRemoteIp(ctx.request);
99

100
      const ok = await verifyTurnstile(token, remoteip, 'contact');
101
      if (!ok) {
102
        throw new ActionError({ code: 'BAD_REQUEST', message: 'Turnstile verification failed.' });
103
      }
104

105
      const safeName = stripCtl(name);
106
      const safeEmail = stripCtl(email);
107

108
      const escapeName = escapeHtml(safeName);
109
      const escapeEmail = escapeHtml(safeEmail);
110
      const escapeMessage = escapeHtml(message).replace(/\n/g, '<br>');
111

112
      try {
113
        const { data, error } = await resend.emails.send({
114
          from: 'Contact Form <contact@mail.dsfghgjgjuyfth-57301d31.com>',
115
          to: ['dsfghgjgjuyfth-57301d31@gmail.com'],
116
          subject: `New Contact Form Submission from ${safeName}`,
117
          replyTo: `${safeName} <${safeEmail}>`,
118
          html: `
119
                        <p>You have a new contact form submission:</p>
120
            <p><strong>Name:</strong> ${escapeName}</p>
121
            <p><strong>Email:</strong> <a href="mailto:${escapeEmail}">${escapeEmail}</a></p>
122
            <p><strong>Message:</strong></p>
123
            <p>${escapeMessage}</p>
124
            <p style="color:#666">Sent from dsfghgjgjuyfth-57301d31.com</p>
125
                    `,
126
          text:
127
            'You have a new contact form submission:\n\n' +
128
            `Name: ${safeName}\n` +
129
            `Email: ${safeEmail}\n\n` +
130
            `Message:\n${messag}\n` +
131
            '— Sent from dsfghgjgjuyfth-57301d31.com',
132
        });
133

134
        const id = data?.id;
135

136
        if (error || !id) {
137
          console.error('Resend failed', { error, data });
138
          throw new ActionError({
139
            code: 'BAD_REQUEST',
140
            message: 'Email could not be sent.',
141
          });
142
        }
143

144
        console.info('Mail sent', { id });
145

146
        return { ok: true };
147
      } catch (error) {
148
        console.error('Action error', error);
149
        throw new ActionError({
150
          code: 'INTERNAL_SERVER_ERROR',
151
          message: 'Email could not be sent.',
152
        });
153
      }
154
    },
155
  }),
156

157
  newsletterSubscribe: defineAction({
158
    accept: 'form',
159
    input: z.object({
160
      email: z.string().email().max(254),
161
      'cf-turnstile-response': turnstileField,
162
    }),
163
    handler: async ({ email, 'cf-turnstile-response': token }, ctx) => {
164
      const remoteip = getRemoteIp(ctx.request);
165

166
      const ok = await verifyTurnstile(token, remoteip, 'newsletter');
167
      if (!ok) {
168
        throw new ActionError({ code: 'BAD_REQUEST', message: 'Turnstile verification failed.' });
169
      }
170

171
      if (!KIT_API_KEY || !KIT_FORM_ID) {
172
        console.error('Kit env missing', {
173
          hasKey: Boolean(KIT_API_KEY),
174
          hasFormId: Boolean(KIT_FORM_ID),
175
        });
176
        throw new ActionError({
177
          code: 'INTERNAL_SERVER_ERROR',
178
          message: 'Subscription failed.',
179
        });
180
      }
181

182
      const email_address = stripCtl(email);
183

184
      const headers = {
185
        'Content-Type': 'application/json',
186
        'X-Kit-Api-Key': KIT_API_KEY,
187
      };
188

189
      try {
190
        const upsertRes = await fetchWithTimeout('https://api.kit.com/v4/subscribers', {
191
          method: 'POST',
192
          headers,
193
          body: JSON.stringify({ email_address }),
194
        });
195
        const upsertJson = await upsertRes.json().catch(() => ({}));
196
        if (!upsertRes.ok) {
197
          console.error('Kit upsert failed', { status: upsertRes.status, upsertJson });
198
          throw new ActionError({ code: 'BAD_REQUEST', message: 'Subscription failed.' });
199
        }
200

201
        const attachRes = await fetchWithTimeout(
202
          `https://api.kit.com/v4/forms/${KIT_FORM_ID}/subscribers`,
203
          {
204
            method: 'POST',
205
            headers,
206
            body: JSON.stringify({ email_address }),
207
          },
208
        );
209
        const attachJson = await attachRes.json().catch(() => ({}));
210
        if (!attachRes.ok) {
211
          console.error('Kit form attach failed', { status: attachRes.status, attachJson });
212
          throw new ActionError({ code: 'BAD_REQUEST', message: 'Subscription failed.' });
213
        }
214

215
        return { ok: true };
216
      } catch (error) {
217
        console.error('Newsletter action error', error);
218
        throw new ActionError({
219
          code: 'INTERNAL_SERVER_ERROR',
220
          message: 'Subscription failed.',
221
        });
222
      }
223
    },
224
  }),
225
};