/** * 500-error alert email. Plain table of the request context plus the * stack — no branding, no CTA. It's read by developers, not customers. * * Only server-controlled values are interpolated. Request bodies, * headers and cookies are deliberately NOT included: they carry * passwords, tokens and PII (security.md — logging). */ export interface ErrorAlertTemplateInput { env: string; occurredAt: string; method: string; url: string; statusCode: number; message: string; /** Null when the thrown value carried no stack. */ stack: string | null; tenantId: string | null; userId: string | null; requestId: string | null; /** How many times this same error fired during the mute window. */ repeatCount: number; } export function errorAlertTemplate(input: ErrorAlertTemplateInput): { subject: string; html: string; text: string; } { const rows: Array<[string, string]> = [ ['When', input.occurredAt], ['Environment', input.env], ['Request', `${input.method} ${input.url}`], ['Status', String(input.statusCode)], ['Message', input.message], ['Tenant', input.tenantId || '—'], ['User', input.userId || '—'], ['Request id', input.requestId || '—'], ]; if (input.repeatCount > 1) { rows.push(['Repeats', `${input.repeatCount} occurrences since the last alert`]); } const subject = `[${input.env}] 500 on ${input.method} ${input.url}`; const html = ` ${escapeHtml(subject)}

Server error (500)

${rows .map( ([label, value]) => ``, ) .join('\n ')}

${escapeHtml(label)}

${escapeHtml(value)}

${ input.stack ? `

${escapeHtml(input.stack)}

` : '' }

`.trim(); const text = [ 'Server error (500)', '', ...rows.map(([label, value]) => `${label}: ${value}`), '', input.stack || '(no stack trace)', ].join('\n'); return { subject, html, text }; } /** Same minimal escape as the password-reset template. */ function escapeHtml(s: string): string { return String(s) .replace(/&/g, '&') .replace(//g, '>') .replace(/"/g, '"') .replace(/'/g, '''); }