feat(api): marketing email consent + code-based broadcast sender + admin concept

src/Orbit.Api/Controllers/AdminController.cs

@@ -0,0 +1,46 @@
+using MediatR;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Orbit.Api.Extensions;
+using Orbit.Api.RateLimiting;
+using Orbit.Application.Common;
+using Orbit.Application.Marketing.Commands;
+
+namespace Orbit.Api.Controllers;
+
+[ApiController]
+[Route("api/admin")]
+[Authorize(Policy = AdminPolicy.Name)]
+public partial class AdminController(IMediator mediator, ILogger<AdminController> logger) : ControllerBase
+{
+    public record BroadcastRequest(
+        string SubjectEn,
+        string SubjectPt,
+        string BodyHtmlEn,
+        string BodyHtmlPt,
+        string? TestEmail);
+
+    [HttpPost("marketing/broadcast")]
+    [DistributedRateLimit("admin-broadcast")]
+    [ProducesResponseType(StatusCodes.Status202Accepted)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    public async Task<IActionResult> SendMarketingBroadcast(
+        [FromBody] BroadcastRequest request,
+        CancellationToken cancellationToken)
+    {
+        var command = new SendMarketingBroadcastCommand(
+            request.SubjectEn, request.SubjectPt, request.BodyHtmlEn, request.BodyHtmlPt, request.TestEmail);
+
+        var result = await mediator.Send(command, cancellationToken);
+        if (result.IsFailure)
+            return result.ToErrorResult();
+
+        LogBroadcastRequested(logger, HttpContext.GetUserId(), result.Value.RecipientCount, result.Value.WasTest);
+        return Accepted(new { recipientCount = result.Value.RecipientCount, test = result.Value.WasTest });
+    }
+
+    [LoggerMessage(EventId = 1, Level = LogLevel.Information, Message = "Marketing broadcast requested by admin {UserId}: {RecipientCount} recipients, test={IsTest}")]
+    private static partial void LogBroadcastRequested(ILogger logger, Guid userId, int recipientCount, bool isTest);
+}

src/Orbit.Api/Controllers/MarketingController.cs

@@ -0,0 +1,77 @@
+using MediatR;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Orbit.Api.RateLimiting;
+using Orbit.Application.Common;
+using Orbit.Application.Marketing.Commands;
+
+namespace Orbit.Api.Controllers;
+
+[ApiController]
+[Route("api/marketing")]
+[AllowAnonymous]
+public class MarketingController(IMediator mediator) : ControllerBase
+{
+    [HttpGet("unsubscribe")]
+    [DistributedRateLimit("marketing-unsubscribe")]
+    [ApiExplorerSettings(IgnoreApi = true)]
+    public async Task<IActionResult> Unsubscribe(
+        [FromQuery] string token,
+        [FromQuery] string? lang,
+        CancellationToken cancellationToken)
+    {
+        var result = await mediator.Send(new UnsubscribeMarketingCommand(token ?? ""), cancellationToken);
+        var isPtBr = LocaleHelper.IsPortuguese(lang);
+
+        return result.IsSuccess
+            ? Content(ConfirmationPageHtml(isPtBr), "text/html")
+            : new ContentResult
+            {
+                Content = InvalidPageHtml(isPtBr),
+                ContentType = "text/html",
+                StatusCode = StatusCodes.Status400BadRequest,
+            };
+    }
+
+    [HttpPost("unsubscribe")]
+    [DistributedRateLimit("marketing-unsubscribe")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    public async Task<IActionResult> UnsubscribeOneClick(
+        [FromQuery] string token,
+        CancellationToken cancellationToken)
+    {
+        var result = await mediator.Send(new UnsubscribeMarketingCommand(token ?? ""), cancellationToken);
+        return result.IsSuccess ? Ok() : BadRequest();
+    }
+
+    private static string ConfirmationPageHtml(bool isPtBr)
+    {
+        var (title, message) = isPtBr
+            ? ("Inscrição cancelada", "Você não receberá mais e-mails de novidades do Orbit.")
+            : ("You're unsubscribed", "You will no longer receive product-update emails from Orbit.");
+        return Page(title, message);
+    }
+
+    private static string InvalidPageHtml(bool isPtBr)
+    {
+        var (title, message) = isPtBr
+            ? ("Link inválido", "Este link para cancelar inscrição é inválido ou expirou.")
+            : ("Invalid link", "This unsubscribe link is invalid or has expired.");
+        return Page(title, message);
+    }
+
+    private static string Page(string title, string message) =>
+        $"""
+        <!DOCTYPE html>
+        <html lang="en">
+        <head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>{title}</title></head>
+        <body style="margin:0;background-color:#020618;font-family:-apple-system,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;">
+          <div style="max-width:480px;margin:0 auto;padding:80px 24px;text-align:center;color:#F8FAFC;">
+            <h1 style="font-size:22px;margin:0 0 12px;">{title}</h1>
+            <p style="font-size:15px;line-height:1.5;color:#90A1B9;margin:0;">{message}</p>
+          </div>
+        </body>
+        </html>
+        """;
+}

src/Orbit.Api/Controllers/ProfileController.cs

@@ -28,6 +28,7 @@ public record SetThemePreferenceRequest(string? ThemePreference);
     public record SetColorSchemeRequest(string? ColorScheme);
     public record SetHandleRequest(string Handle);
     public record SetSocialOptInRequest([property: JsonRequired] bool Enabled);
+    public record UpdateMarketingConsentRequest([property: JsonRequired] bool Enabled);
     public record UpdatePublicProfileRequest(
         [property: JsonRequired] bool Enabled,
         bool ShowStreak,
@@ -311,6 +312,23 @@ public async Task<IActionResult> SetSocialOptIn(
         return result.ToPayGateAwareResult(() => NoContent());
     }
 
+    [HttpPut("marketing-consent")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
+    public async Task<IActionResult> UpdateMarketingConsent(
+        [FromBody] UpdateMarketingConsentRequest request,
+        CancellationToken cancellationToken)
+    {
+        var command = new UpdateMarketingConsentCommand(HttpContext.GetUserId(), request.Enabled);
+        var result = await mediator.Send(command, cancellationToken);
+
+        if (result.IsSuccess)
+            LogMarketingConsentChanged(logger, request.Enabled ? "enabled" : "disabled", HttpContext.GetUserId());
+
+        return result.ToPayGateAwareResult(() => NoContent());
+    }
+
     [HttpPut("public")]
     [ProducesResponseType(StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status400BadRequest)]
@@ -403,6 +421,9 @@ public async Task<IActionResult> ExportUserData(CancellationToken cancellationTo
     [LoggerMessage(EventId = 12, Level = LogLevel.Information, Message = "Public profile {State} for user {UserId}")]
     private static partial void LogPublicProfileUpdated(ILogger logger, string state, Guid userId);
 
+    [LoggerMessage(EventId = 14, Level = LogLevel.Information, Message = "Marketing email consent {State} for user {UserId}")]
+    private static partial void LogMarketingConsentChanged(ILogger logger, string state, Guid userId);
+
     [LoggerMessage(EventId = 13, Level = LogLevel.Information, Message = "Proactive Astra check-ins {State} for user {UserId}")]
     private static partial void LogProactiveAstraToggled(ILogger logger, string state, Guid userId);
 

src/Orbit.Api/Extensions/ServiceCollectionExtensions.Infrastructure.cs

@@ -50,7 +50,10 @@ private static void AddEmailAndSupabaseClients(WebApplicationBuilder builder, Ti
 
         builder.Services.Configure<WaitlistSettings>(
             builder.Configuration.GetSection(WaitlistSettings.SectionName));
+        builder.Services.Configure<MarketingSettings>(
+            builder.Configuration.GetSection(MarketingSettings.SectionName));
         builder.Services.AddSingleton<IWaitlistConfirmationTokenService, WaitlistConfirmationTokenService>();
+        builder.Services.AddSingleton<IMarketingUnsubscribeTokenService, MarketingUnsubscribeTokenService>();
         builder.Services.AddScoped<IMarketingContactsService, ResendContactsService>();
     }
 

src/Orbit.Api/Extensions/ServiceCollectionExtensions.cs

@@ -154,7 +154,11 @@
             };
         });
 
-        builder.Services.AddAuthorization();
+        builder.Services.AddAuthorization(options =>
+        {
+            options.AddPolicy(AdminPolicy.Name, policy =>
+                policy.RequireClaim(AdminPolicy.ClaimType, AdminPolicy.ClaimValue));
+        });
 
         return builder;
     }

src/Orbit.Api/appsettings.json

@@ -51,7 +51,9 @@
   "Resend": {
     "ApiKey": "REPLACE-IN-DEVELOPMENT-JSON",
     "FromEmail": "Orbit <noreply@send.useorbit.org>",
-    "SupportEmail": "REPLACE-IN-DEVELOPMENT-JSON"
+    "SupportEmail": "REPLACE-IN-DEVELOPMENT-JSON",
+    "MarketingFromEmail": "Orbit <news@updates.useorbit.org>",
+    "MarketingRetryBaseDelayMs": 500
   },
   "Waitlist": {
     "SigningKey": "",
@@ -74,6 +76,11 @@
   "Frontend": {
     "BaseUrl": "https://app.useorbit.org"
   },
+  "Marketing": {
+    "ApiBaseUrl": "https://api.useorbit.org",
+    "SendDelayMilliseconds": 100,
+    "UnsubscribeSigningKey": ""
+  },
   "Cors": {
     "AllowedOrigins": [
       "http://localhost:3000",

src/Orbit.Application/Auth/Commands/GoogleAuthCommand.cs

@@ -44,7 +44,7 @@
         if (wasReactivated || request.GoogleAccessToken is not null)
             await unitOfWork.SaveChangesAsync(cancellationToken);
 
-        var sessionResult = await authSessionService.CreateSessionAsync(user.Id, user.Email, cancellationToken);
+        var sessionResult = await authSessionService.CreateSessionAsync(user.Id, user.Email, user.IsAdmin, cancellationToken);
         if (sessionResult.IsFailure)
             return sessionResult.PropagateError<LoginResponse>();
 
@@ -152,7 +152,7 @@
     }
 
     private bool HandlePostLogin(
         User user, GoogleAuthCommand request, bool isNewUser, CancellationToken cancellationToken)
     {
         if (isNewUser && !string.IsNullOrWhiteSpace(request.ReferralCode))
             ProcessReferralInBackground(user.Id, request.ReferralCode);

src/Orbit.Application/Auth/Commands/VerifyCodeCommand.cs

@@ -40,7 +40,7 @@ public async Task<Result<LoginResponse>> Handle(VerifyCodeCommand request, Cance
 
         var wasReactivated = await HandlePostLoginAsync(user, isNewUser, request, cancellationToken);
 
-        var sessionResult = await authSessionService.CreateSessionAsync(user.Id, user.Email, cancellationToken);
+        var sessionResult = await authSessionService.CreateSessionAsync(user.Id, user.Email, user.IsAdmin, cancellationToken);
         if (sessionResult.IsFailure)
             return sessionResult.PropagateError<LoginResponse>();
 

src/Orbit.Application/Common/AdminPolicy.cs

@@ -0,0 +1,14 @@
+namespace Orbit.Application.Common;
+
+/// <summary>
+/// Names the single administrative authorization boundary. A user's IsAdmin flag mints the
+/// admin claim into the JWT; the "Admin" policy (RequireClaim on that claim) gates admin-only
+/// endpoints. The first admin is granted by a direct DB update (Users.IsAdmin = true); there is
+/// no email-based gate.
+/// </summary>
+public static class AdminPolicy
+{
+    public const string Name = "Admin";
+    public const string ClaimType = "admin";
+    public const string ClaimValue = "true";
+}

src/Orbit.Application/Common/ErrorCodes.cs

@@ -63,6 +63,7 @@ public static class ErrorCodes
     public const string InvalidWebhookSignature = "INVALID_WEBHOOK_SIGNATURE";
     public const string WebhookStripeApiError = "WEBHOOK_STRIPE_API_ERROR";
     public const string WebhookProcessingFailed = "WEBHOOK_PROCESSING_FAILED";
+    public const string InvalidUnsubscribeToken = "INVALID_UNSUBSCRIBE_TOKEN";
     public const string PlayNotificationVerificationFailed = "PLAY_NOTIFICATION_VERIFICATION_FAILED";
     public const string CodeRequestCooldown = "CODE_REQUEST_COOLDOWN";
     public const string GoogleEmailUnavailable = "GOOGLE_EMAIL_UNAVAILABLE";

src/Orbit.Application/Common/ErrorMessages.cs

@@ -55,6 +55,7 @@ public static class ErrorMessages
     public static readonly AppError InvalidWebhookSignature = new(ErrorCodes.InvalidWebhookSignature, "Invalid webhook signature");
     public static readonly AppError WebhookStripeApiError = new(ErrorCodes.WebhookStripeApiError, "Stripe API error processing webhook event");
     public static readonly AppError WebhookProcessingFailed = new(ErrorCodes.WebhookProcessingFailed, "Webhook processing failed");
+    public static readonly AppError InvalidUnsubscribeToken = new(ErrorCodes.InvalidUnsubscribeToken, "Invalid or expired unsubscribe link");
     public static readonly AppError PlayNotificationVerificationFailed = new(ErrorCodes.PlayNotificationVerificationFailed, "Failed to verify Play notification");
     public static readonly AppError CodeRequestCooldown = new(ErrorCodes.CodeRequestCooldown, "Please wait before requesting a new code");
     public static readonly AppError VerificationCodeExpired = new(ErrorCodes.CodeExpired, "Verification code expired or not found");

src/Orbit.Application/Common/MarketingSettings.cs

@@ -0,0 +1,10 @@
+namespace Orbit.Application.Common;
+
+public class MarketingSettings
+{
+    public const string SectionName = "Marketing";
+
+    public string ApiBaseUrl { get; set; } = "https://api.useorbit.org";
+    public int SendDelayMilliseconds { get; set; } = 100;
+    public string UnsubscribeSigningKey { get; set; } = "";
+}