import type { APIRoute } from "astro"; import nodemailer from "nodemailer"; import { isRateLimited, sanitize, isValidEmail } from "./contact.utils.js"; let transporter: nodemailer.Transporter | null = null; export function _resetTransporter() { transporter = null; } function getTransporter(): nodemailer.Transporter | null { if (transporter) return transporter; const host = process.env.SMTP_HOST || "ssl0.ovh.net"; const port = Number.parseInt(process.env.SMTP_PORT || "465"); const user = process.env.SMTP_USER; const pass = process.env.SMTP_PASSWORD; if (!user || !pass) { console.warn("[contact] SMTP_USER ou SMTP_PASSWORD non configure - emails desactives"); return null; } transporter = nodemailer.createTransport({ host, port, secure: port === 465, auth: { user, pass }, }); console.log(`[contact] SMTP configure : ${user} via ${host}:${port}`); return transporter; } export const POST: APIRoute = async ({ request, clientAddress }) => { const headers = { "Content-Type": "application/json", "X-Content-Type-Options": "nosniff", }; // Rate limit const ip = clientAddress || "unknown"; if (isRateLimited(ip)) { return new Response(JSON.stringify({ error: "Trop de requetes. Reessayez dans quelques minutes." }), { status: 429, headers, }); } // Parse body let body: Record; try { body = await request.json(); } catch { return new Response(JSON.stringify({ error: "Corps de requete invalide." }), { status: 400, headers, }); } // Honeypot if (body.website) { return new Response(JSON.stringify({ ok: true }), { status: 200, headers }); } // Validate const firstName = sanitize(body.firstName); const lastName = sanitize(body.lastName); const email = sanitize(body.email); const company = sanitize(body.company); const phone = sanitize(body.phone); const message = sanitize(body.message); if (!firstName || firstName.length < 2) { return new Response(JSON.stringify({ error: "Prenom invalide." }), { status: 400, headers }); } if (!lastName || lastName.length < 2) { return new Response(JSON.stringify({ error: "Nom invalide." }), { status: 400, headers }); } if (!email || !isValidEmail(email)) { return new Response(JSON.stringify({ error: "Email invalide." }), { status: 400, headers }); } if (!message || message.length < 10) { return new Response(JSON.stringify({ error: "Message trop court (min. 10 caracteres)." }), { status: 400, headers }); } // Send email const t = getTransporter(); if (!t) { console.error("[contact] SMTP non configure - email non envoye"); return new Response(JSON.stringify({ error: "Service email temporairement indisponible." }), { status: 503, headers, }); } const from = process.env.SMTP_FROM || process.env.SMTP_USER!; const to = process.env.CONTACT_TO || process.env.SMTP_USER!; try { await t.sendMail({ from: `Missioflow <${from}>`, to, replyTo: email, subject: `[Missioflow] Demande de ${firstName} ${lastName}`, html: `

Missioflow

Nouvelle demande de contact

${company ? `` : ""} ${phone ? `` : ""}

Prenom

${firstName}

Nom

${lastName}

${email}

Entreprise

${company}

Telephone

${phone}

Message

${message}

Missioflow - Gestion d'interventions terrain

`, text: `Nouvelle demande de contact\n\nPrenom: ${firstName}\nNom: ${lastName}\nEmail: ${email}\nEntreprise: ${company || "-"}\nTelephone: ${phone || "-"}\n\nMessage:\n${message}`, }); console.log(`[contact] Email envoye : ${firstName} ${lastName} <${email}>`); return new Response(JSON.stringify({ ok: true }), { status: 200, headers }); } catch (err) { console.error(`[contact] Erreur envoi : ${(err as Error).message}`); return new Response(JSON.stringify({ error: "Erreur lors de l'envoi. Reessayez plus tard." }), { status: 500, headers, }); } };