60 lines
1003 B
Markdown
60 lines
1003 B
Markdown
# Contact Feature Spec
|
|
|
|
## Current Implementation
|
|
|
|
### Public flow
|
|
|
|
- Public contact page exists at
|
|
|
|
`/contact`
|
|
|
|
- Form fields:
|
|
- name
|
|
- email
|
|
- phone
|
|
- company
|
|
- message
|
|
- Submission uses a server action
|
|
- Success redirects to
|
|
|
|
`/success`
|
|
|
|
### Protection
|
|
|
|
- Validation uses
|
|
|
|
`zod`
|
|
|
|
- Optional Cloudflare Turnstile verification
|
|
- Optional rate limiting by IP window
|
|
|
|
### Delivery
|
|
|
|
- Messages are sent by SMTP through
|
|
|
|
`nodemailer`
|
|
|
|
- Recipient configuration comes from admin settings
|
|
- Messages are not persisted in the database
|
|
|
|
### Admin controls
|
|
|
|
- SMTP settings page
|
|
- Test email action
|
|
- Contact protection settings page
|
|
|
|
## Risks
|
|
|
|
- Contact history is lost if email delivery succeeds but later needs auditing
|
|
- Rate-limit counters are stored in
|
|
|
|
`AppConfig`
|
|
|
|
which mixes operational and business configuration
|
|
|
|
## Recommended Improvements
|
|
|
|
- Store contact submissions if the business needs pipeline visibility
|
|
- Add spam and abuse observability
|
|
- Add structured delivery error reporting
|