resend: fix payload mismatch in summary cron job by elie222 · Pull Request #1186 · elie222/inbox-zero

elie222 · 2026-01-04T08:28:26Z

User description

Fixes the mismatch between /api/resend/summary/all (sender) and /api/resend/summary (receiver) payloads.

Moved validation schema to a shared file
Updated cron job to send emailAccountId instead of email
Added type safety to QStash enqueuing to prevent future mismatches

Generated description

Below is a concise technical summary of the changes proposed in this PR:
Align the payload structure for the resend summary cron job by sending emailAccountId instead of email and centralizing its validation schema. Update the Outlook account linking process to consistently use providerAccountId for identifying existing accounts.

Topic Details

Outlook Linking Update

Update the Outlook account linking process to consistently use providerAccountId for identifying existing accounts and simplify the account lookup logic by removing redundant email-based searches.

Modified files (1)

apps/web/app/api/outlook/linking/callback/route.ts

Latest Contributors(2)

User	Commit	Date
elie222	Don-t-force-user-to-lo...	December 04, 2025
eduardoleliss@gmail.com	PR-feedback	August 29, 2025

Resend Payload Fix

Align the payload structure for the resend summary cron job by sending emailAccountId instead of email and centralizing the validation schema for type safety in QStash enqueuing.

Modified files (3)

apps/web/app/api/resend/summary/validation.ts
apps/web/app/api/resend/summary/route.ts
apps/web/app/api/resend/summary/all/route.ts

Latest Contributors(2)

User	Commit	Date
elie222	clean-up-resend-summar...	January 03, 2026
eduardo.lelis@withjoy.com	Adressing-PR-Feedback....	June 12, 2025

This pull request is reviewed by Baz. Review like a pro on (Baz).

Summary by CodeRabbit

Release Notes

Refactor
- Streamlined account identification logic to use unique identifiers instead of email addresses.
- Extracted and centralized validation schemas for email operations across the API.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

Removes insecure email-based account matching that could allow account hijacking when different Microsoft accounts share the same email address (e.g., shared mailboxes). Now matches solely by provider ID, consistent with Google OAuth implementation.

vercel · 2026-01-04T08:28:30Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
inbox-zero	Ready	Preview	Jan 4, 2026 8:32am

coderabbitai · 2026-01-04T08:28:37Z

📝 Walkthrough

Walkthrough

Refactors account identification across Outlook linking and Resend summary endpoints from email-based lookups to ID-based identification, and extracts shared validation schemas into a dedicated module.

Changes

Cohort / File(s)	Summary
Outlook linking callback refactoring `apps/web/app/api/outlook/linking/callback/route.ts`	Simplifies account identification to use `providerAccountId` (from `profile.id`) exclusively, removing email-based lookup path; updates validation and account lookup/creation logic accordingly; replaces all `microsoftProviderAccountId` and email-based references with new `providerAccountId` variable
Resend summary payload refactoring `apps/web/app/api/resend/summary/all/route.ts`	Changes from email-based to ID-based identification; updates Prisma select from `email` to `id`; replaces payload field from `{ email }` to `{ emailAccountId }`; updates error logging to reference `emailAccountId`
Validation schema extraction `apps/web/app/api/resend/summary/route.ts`, `apps/web/app/api/resend/summary/validation.ts`	Extracts inline Zod schema from route handler to dedicated validation module; route now imports `sendSummaryEmailBody` from `./validation` instead of defining it locally; new module exports schema and inferred type `SendSummaryEmailBody`

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

#1172 — Applies the same pattern of switching EmailAccount identification from email field to ID in Prisma queries
#1069 — Modifies the same Outlook linking callback route with different account identification logic changes
#187 — Modifies the same resend summary endpoints and validation structures

Poem

🐰 IDs instead of emails we now hold,
Validation schemas, neatly scrolled,
Outlook links grow ever fine,
Resend summaries by ID align,
Simpler paths through code we've traced! ✨

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	You can run `@coderabbitai generate docstrings` to improve docstring coverage.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: fixing a payload mismatch in the resend summary cron job by aligning sender and receiver endpoints to use emailAccountId consistently.

✨ Finishing touches

📝 Generate docstrings

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

macroscopeapp · 2026-01-04T08:29:05Z

Fix Resend summary cron by enqueueing `emailAccountId` payloads and require `providerAccountId` + email in `GET /api/outlook/linking/callback`

Switch the Resend summary cron job to publish emailAccountId payloads and validate them via a new shared schema; update the Outlook linking callback to require profile.id and email and resolve accounts only by providerAccountId.

📍Where to Start

Start with the sendSummaryAllUpdate publisher in apps/web/app/api/resend/summary/all/route.ts, then review the request validation in apps/web/app/api/resend/summary/validation.ts, and finally the account resolution logic in apps/web/app/api/outlook/linking/callback/route.ts.

📊 Macroscope summarized 83f7b89. 3 files reviewed, 2 issues evaluated, 2 issues filtered, 0 comments posted. View details

cubic-dev-ai

No issues found across 4 files

coderabbitai

Actionable comments posted: 0

🧹 Nitpick comments (1)

apps/web/app/api/resend/summary/validation.ts (1)
3-5: Consider adding stricter validation for emailAccountId.

The current schema only validates that emailAccountId is a string. Consider adding .min(1) to prevent empty strings, which would cause database query failures.
🔎 Proposed enhancement
 export const sendSummaryEmailBody = z.object({
-  emailAccountId: z.string(),
+  emailAccountId: z.string().min(1),
 });

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 52a2895 and 83f7b89.

📒 Files selected for processing (4)

apps/web/app/api/outlook/linking/callback/route.ts
apps/web/app/api/resend/summary/all/route.ts
apps/web/app/api/resend/summary/route.ts
apps/web/app/api/resend/summary/validation.ts

🧰 Additional context used

📓 Path-based instructions (20)

**/*.{ts,tsx}

📄 CodeRabbit inference engine (.cursor/rules/data-fetching.mdc)

**/*.{ts,tsx}: For API GET requests to server, use the swr package
Use result?.serverError with toastError from @/components/Toast for error handling in async operations

**/*.{ts,tsx}: Use wrapper functions for Gmail message operations (get, list, batch, etc.) from @/utils/gmail/message.ts instead of direct API calls
Use wrapper functions for Gmail thread operations from @/utils/gmail/thread.ts instead of direct API calls
Use wrapper functions for Gmail label operations from @/utils/gmail/label.ts instead of direct API calls

**/*.{ts,tsx}: For early access feature flags, create hooks using the naming convention use[FeatureName]Enabled that return a boolean from useFeatureFlagEnabled("flag-key")
For A/B test variant flags, create hooks using the naming convention use[FeatureName]Variant that define variant types, use useFeatureFlagVariantKey() with type casting, and provide a default "control" fallback
Use kebab-case for PostHog feature flag keys (e.g., inbox-cleaner, pricing-options-2)
Always define types for A/B test variant flags (e.g., type PricingVariant = "control" | "variant-a" | "variant-b") and provide type safety through type casting

**/*.{ts,tsx}: Don't use primitive type aliases or misleading types
Don't use empty type parameters in type aliases and interfaces
Don't use this and super in static contexts
Don't use any or unknown as type constraints
Don't use the TypeScript directive @ts-ignore
Don't use TypeScript enums
Don't export imported variables
Don't add type annotations to variables, parameters, and class properties that are initialized with literal expressions
Don't use TypeScript namespaces
Don't use non-null assertions with the ! postfix operator
Don't use parameter properties in class constructors
Don't use user-defined types
Use as const instead of literal types and type annotations
Use either T[] or Array<T> consistently
Initialize each enum member value explicitly
Use export type for types
Use `impo...

Files:

apps/web/app/api/resend/summary/validation.ts
apps/web/app/api/resend/summary/all/route.ts
apps/web/app/api/outlook/linking/callback/route.ts
apps/web/app/api/resend/summary/route.ts

**/*.{ts,tsx,js,jsx}

📄 CodeRabbit inference engine (.cursor/rules/prisma-enum-imports.mdc)

Always import Prisma enums from @/generated/prisma/enums instead of @/generated/prisma/client to avoid Next.js bundling errors in client components

Import Prisma using the project's centralized utility: import prisma from '@/utils/prisma'

Files:

apps/web/app/api/resend/summary/validation.ts
apps/web/app/api/resend/summary/all/route.ts
apps/web/app/api/outlook/linking/callback/route.ts
apps/web/app/api/resend/summary/route.ts

apps/web/**/*.{ts,tsx}

📄 CodeRabbit inference engine (.cursor/rules/project-structure.mdc)

Import specific lodash functions rather than entire lodash library to minimize bundle size (e.g., import groupBy from 'lodash/groupBy')

apps/web/**/*.{ts,tsx}: Use TypeScript with strict null checks
Do not export types/interfaces that are only used within the same file. Export later if needed

Files:

apps/web/app/api/resend/summary/validation.ts
apps/web/app/api/resend/summary/all/route.ts
apps/web/app/api/outlook/linking/callback/route.ts
apps/web/app/api/resend/summary/route.ts

apps/web/app/api/**/*.{ts,tsx}

📄 CodeRabbit inference engine (.cursor/rules/security-audit.mdc)

apps/web/app/api/**/*.{ts,tsx}: API routes must use withAuth, withEmailAccount, or withError middleware for authentication
All database queries must include user scoping with emailAccountId or userId filtering in WHERE clauses
Request parameters must be validated before use; avoid direct parameter usage without type checking
Use generic error messages instead of revealing internal details; throw SafeError instead of exposing user IDs, resource IDs, or system information
API routes should only return necessary fields using select in database queries to prevent unintended information disclosure
Cron endpoints must use hasCronSecret or hasPostCronSecret to validate cron requests and prevent unauthorized access
Request bodies should use Zod schemas for validation to ensure type safety and prevent injection attacks

Files:

apps/web/app/api/resend/summary/validation.ts
apps/web/app/api/resend/summary/all/route.ts
apps/web/app/api/outlook/linking/callback/route.ts
apps/web/app/api/resend/summary/route.ts

**/app/api/**/*.ts

📄 CodeRabbit inference engine (.cursor/rules/security.mdc)

**/app/api/**/*.ts: ALL API routes that handle user data MUST use appropriate middleware: use withEmailAccount for email-scoped operations, use withAuth for user-scoped operations, or use withError with proper validation for public/custom auth endpoints
Use withEmailAccount middleware for operations scoped to a specific email account, including reading/writing emails, rules, schedules, or any operation using emailAccountId
Use withAuth middleware for user-level operations such as user settings, API keys, and referrals that use only userId
Use withError middleware only for public endpoints, custom authentication logic, or cron endpoints. For cron endpoints, MUST use hasCronSecret() or hasPostCronSecret() validation
Cron endpoints without proper authentication can be triggered by anyone. CRITICAL: All cron endpoints MUST validate cron secret using hasCronSecret(request) or hasPostCronSecret(request) and capture unauthorized attempts with captureException()
Always validate request bodies using Zod schemas to ensure type safety and prevent invalid data from reaching database operations
Maintain consistent error response format across all API routes to avoid information disclosure while providing meaningful error feedback

Files:

apps/web/app/api/resend/summary/validation.ts
apps/web/app/api/resend/summary/all/route.ts
apps/web/app/api/outlook/linking/callback/route.ts
apps/web/app/api/resend/summary/route.ts

**/*.ts

📄 CodeRabbit inference engine (.cursor/rules/security.mdc)

**/*.ts: ALL database queries MUST be scoped to the authenticated user/account by including user/account filtering in WHERE clauses to prevent unauthorized data access
Always validate that resources belong to the authenticated user before performing operations, using ownership checks in WHERE clauses or relationships
Always validate all input parameters for type, format, and length before using them in database queries
Use SafeError for error responses to prevent information disclosure. Generic error messages should not reveal internal IDs, logic, or resource ownership details
Only return necessary fields in API responses using Prisma's select option. Never expose sensitive data such as password hashes, private keys, or system flags
Prevent Insecure Direct Object References (IDOR) by validating resource ownership before operations. All findUnique/findFirst calls MUST include ownership filters
Prevent mass assignment vulnerabilities by explicitly whitelisting allowed fields in update operations instead of accepting all user-provided data
Prevent privilege escalation by never allowing users to modify system fields, ownership fields, or admin-only attributes through user input
All findMany queries MUST be scoped to the user's data by including appropriate WHERE filters to prevent returning data from other users
Use Prisma relationships for access control by leveraging nested where clauses (e.g., emailAccount: { id: emailAccountId }) to validate ownership

Files:

apps/web/app/api/resend/summary/validation.ts
apps/web/app/api/resend/summary/all/route.ts
apps/web/app/api/outlook/linking/callback/route.ts
apps/web/app/api/resend/summary/route.ts

**/*.{tsx,ts}

📄 CodeRabbit inference engine (.cursor/rules/ui-components.mdc)

**/*.{tsx,ts}: Use Shadcn UI and Tailwind for components and styling
Use next/image package for images
For API GET requests to server, use the swr package with hooks like useSWR to fetch data
For text inputs, use the Input component with registerProps for form integration and error handling

Files:

apps/web/app/api/resend/summary/validation.ts
apps/web/app/api/resend/summary/all/route.ts
apps/web/app/api/outlook/linking/callback/route.ts
apps/web/app/api/resend/summary/route.ts

**/*.{tsx,ts,css}

📄 CodeRabbit inference engine (.cursor/rules/ui-components.mdc)

Implement responsive design with Tailwind CSS using a mobile-first approach

Files:

apps/web/app/api/resend/summary/validation.ts
apps/web/app/api/resend/summary/all/route.ts
apps/web/app/api/outlook/linking/callback/route.ts
apps/web/app/api/resend/summary/route.ts

**/*.{js,jsx,ts,tsx}

📄 CodeRabbit inference engine (.cursor/rules/ultracite.mdc)

**/*.{js,jsx,ts,tsx}: Don't use accessKey attribute on any HTML element
Don't set aria-hidden="true" on focusable elements
Don't add ARIA roles, states, and properties to elements that don't support them
Don't use distracting elements like <marquee> or <blink>
Only use the scope prop on <th> elements
Don't assign non-interactive ARIA roles to interactive HTML elements
Make sure label elements have text content and are associated with an input
Don't assign interactive ARIA roles to non-interactive HTML elements
Don't assign tabIndex to non-interactive HTML elements
Don't use positive integers for tabIndex property
Don't include "image", "picture", or "photo" in img alt prop
Don't use explicit role property that's the same as the implicit/default role
Make static elements with click handlers use a valid role attribute
Always include a title element for SVG elements
Give all elements requiring alt text meaningful information for screen readers
Make sure anchors have content that's accessible to screen readers
Assign tabIndex to non-interactive HTML elements with aria-activedescendant
Include all required ARIA attributes for elements with ARIA roles
Make sure ARIA properties are valid for the element's supported roles
Always include a type attribute for button elements
Make elements with interactive roles and handlers focusable
Give heading elements content that's accessible to screen readers (not hidden with aria-hidden)
Always include a lang attribute on the html element
Always include a title attribute for iframe elements
Accompany onClick with at least one of: onKeyUp, onKeyDown, or onKeyPress
Accompany onMouseOver/onMouseOut with onFocus/onBlur
Include caption tracks for audio and video elements
Use semantic elements instead of role attributes in JSX
Make sure all anchors are valid and navigable
Ensure all ARIA properties (aria-*) are valid
Use valid, non-abstract ARIA roles for elements with ARIA roles
Use valid AR...

Files:

apps/web/app/api/resend/summary/validation.ts
apps/web/app/api/resend/summary/all/route.ts
apps/web/app/api/outlook/linking/callback/route.ts
apps/web/app/api/resend/summary/route.ts

!(pages/_document).{jsx,tsx}

📄 CodeRabbit inference engine (.cursor/rules/ultracite.mdc)

Don't use the next/head module in pages/_document.js on Next.js projects

Files:

apps/web/app/api/resend/summary/validation.ts
apps/web/app/api/resend/summary/all/route.ts
apps/web/app/api/outlook/linking/callback/route.ts
apps/web/app/api/resend/summary/route.ts

**/*.{js,ts,jsx,tsx}

📄 CodeRabbit inference engine (.cursor/rules/utilities.mdc)

**/*.{js,ts,jsx,tsx}: Use lodash utilities for common operations (arrays, objects, strings)
Import specific lodash functions to minimize bundle size (e.g., import groupBy from 'lodash/groupBy')

Files:

apps/web/app/api/resend/summary/validation.ts
apps/web/app/api/resend/summary/all/route.ts
apps/web/app/api/outlook/linking/callback/route.ts
apps/web/app/api/resend/summary/route.ts

apps/web/**/*.{ts,tsx,js,jsx}