auth: expand Resend email event handling

[aspiers]

Summary

Expand the optional Resend integration with additional operational events and avoid unnecessary retries for known email events that ePDS intentionally does not log.

Changes

• Normalize and log email.complained, email.suppressed, and email.scheduled.
• Emit complaint and suppression events at warn level.
• Acknowledge signed email.clicked and inbound email.received events without logging their payloads.
• Keep unknown event types rejected as invalid payloads.
• Update webhook configuration guidance, release notes, and testing-gap documentation.
• Ratchet the line coverage threshold from 56% to 57%.

Testing

• pnpm format:check
• pnpm lint
• TypeScript project build (tsc --build tsconfig.json)
• pnpm test — 1,067 tests passed
• pnpm test:coverage — 58.29% statements, 57.53% branches, 71.52% functions, 57.10% lines

Notes

This is a follow-up to PR #198. Webhook data remains logging-only and the integration remains optional and email-provider agnostic.

Summary by CodeRabbit

• New Features

  • Expanded optional Resend email event logging to include delivery, complaints, suppressions, and scheduled emails.
  • Unsupported click and inbound events are acknowledged without logging their payloads.
  • Warning-level logs now identify delayed deliveries, complaints, and suppressions.

• Documentation

  • Updated configuration guidance and environment variable examples for the expanded webhook events.
  • Refreshed webhook coverage documentation.

• Tests

  • Added coverage for new event types, logging levels, and ignored events.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
epds-demo	Ready	Preview, Comment	Jul 20, 2026 2:24pm

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[changeset-bot]

⚠️ No Changeset found

Latest commit: c060319

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1f5fa6dc-2261-4c44-937c-460ee3f40c31

📥 Commits

Reviewing files that changed from the base of the PR and between fd558aa and c060319.

📒 Files selected for processing (7)

• .changeset/resend-delivery-webhooks.md
• docs/configuration.md
• docs/design/testing-gaps.md
• packages/auth-service/.env.example
• packages/auth-service/src/__tests__/resend-webhook.test.ts
• packages/auth-service/src/routes/resend-webhook.ts
• vitest.config.ts

---

📝 Walkthrough

Walkthrough

The Resend webhook route now distinguishes logged, warning, and ignored events, normalizes additional email event types, and acknowledges unsupported events without payload logging. Tests, coverage configuration, environment guidance, and operator documentation were updated accordingly.

Changes

Resend webhook event handling

Layer / File(s)	Summary
Event classification and logging packages/auth-service/src/routes/resend-webhook.ts	Separate logged, ignored, and warning event sets; normalize additional events; apply warning severity to delivery, complaint, and suppression events; acknowledge ignored events with a debug log.
Event handling validation packages/auth-service/src/__tests__/resend-webhook.test.ts, vitest.config.ts, docs/design/testing-gaps.md	Add table-driven coverage for normalization, warning events, ignored events, and unknown event rejection; increase the configured coverage threshold and update coverage documentation.
Operator configuration and documentation docs/configuration.md, packages/auth-service/.env.example, .changeset/resend-delivery-webhooks.md	Document expanded event subscriptions, normalized logging behavior, webhook verification, sender filtering, non-persistence, and ignored events.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Resend
  participant WebhookHandler
  participant Logger
  Resend->>WebhookHandler: Send signed email webhook
  WebhookHandler->>WebhookHandler: Validate and classify event
  WebhookHandler->>Logger: Log supported event at info or warn
  WebhookHandler-->>Resend: Return received or ignored response

Loading

Possibly related PRs

• hypercerts-org/ePDS#198: Modifies the same Resend webhook route and tests for event filtering, normalization, and logging.

Suggested reviewers: copilot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: expanding Resend email event handling in auth.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/resend-webhook-additional-events

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coveralls-official]

Coverage Report for CI Build 29750494073

Coverage increased (+0.09%) to 57.272%

Details

• Coverage increased (+0.09%) from the base build.
• Patch coverage: 11 of 11 lines across 1 file are fully covered (100%).
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	3068
Covered Lines:	1752
Line Coverage:	57.11%
Relevant Branches:	1910
Covered Branches:	1099
Branch Coverage:	57.54%
Branches in Coverage %:	Yes
Coverage Strength:	6.06 hits per line

---

💛 - Coveralls