sass-mohfarawati/specs/contact.md

Contact Feature Spec

Current Implementation

Public flow

• Public contact page exists at

/contact

• Form fields:
  • name
  • email
  • phone
  • company
  • message
• Submission uses a server action
• Success redirects to

/success

Protection

• Validation uses

zod

• Optional Cloudflare Turnstile verification
• Optional rate limiting by IP window

Delivery

• Messages are sent by SMTP through

nodemailer

• Recipient configuration comes from admin settings
• Messages are not persisted in the database

Admin controls

• SMTP settings page
• Test email action
• Contact protection settings page

Risks

• Contact history is lost if email delivery succeeds but later needs auditing
• Rate-limit counters are stored in

AppConfig

which mixes operational and business configuration

Recommended Improvements

• Store contact submissions if the business needs pipeline visibility
• Add spam and abuse observability
• Add structured delivery error reporting