feat: short base62 tokens for email tracking links (#2691)

* fix: keep campaign sender daily limit default at 500 in UI

Use a frontend constant for senderDailyLimit default and stop overriding
it from sender-options payload. Also render toast CTA on a new line under
the message text.

* shorten email tracking links via nuxt server routes

* refactor: move tracking redirect helper to shared edge utils

* fix: remove unnecessary async in short-link routes

* feat: switch email tracking links to short base62 tokens

Author: baderdean

deno.lock

@@ -0,0 +1,31 @@
+# Shared HTTP Redirect Helper (Design)
+
+Goal
+
+- Centralize redirect response construction for edge functions so CORS headers are always included.
+
+Scope
+
+- Move buildRedirectResponse into shared utilities.
+- Update email-campaigns to import shared helper.
+- No behavior changes to redirect status or destination URLs.
+
+Architecture
+
+- New shared module: `supabase/functions/_shared/http.ts`.
+- Helper uses existing `cors.ts` and returns a 302 with Location.
+- Edge functions call helper instead of inline Response construction.
+
+Components & Data Flow
+
+- `_shared/http.ts`: `buildRedirectResponse(location)`.
+- `email-campaigns/index.ts`: uses helper in `/track/click/:token` and `/unsubscribe/:token` paths.
+- Future edge functions can reuse the helper to avoid CORS drift.
+
+Error Handling
+
+- No new error behavior; redirects remain 302 and preserve target URL.
+
+Testing
+
+- Deno unit test validates status, Location, and CORS headers for helper.

docs/plans/2026-03-04-shared-http-helper-design.md

@@ -0,0 +1,133 @@
+# Shared HTTP Redirect Helper Implementation Plan
+
+> **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.
+
+**Goal:** Move the redirect helper into shared edge-function utilities so multiple functions can reuse it consistently.
+
+**Architecture:** Create `_shared/http.ts` with `buildRedirectResponse` and update email-campaigns to import it. Keep redirect behavior unchanged.
+
+**Tech Stack:** Supabase Edge Functions (Deno), Hono
+
+---
+
+### Task 1: Move helper into shared utilities
+
+**Files:**
+
+- Create: `supabase/functions/_shared/http.ts`
+- Modify: `supabase/functions/email-campaigns/http.ts`
+- Modify: `supabase/functions/email-campaigns/http.test.ts`
+
+**Step 1: Write the failing test**
+
+Update `supabase/functions/email-campaigns/http.test.ts` to import from shared:
+
+```ts
+import { buildRedirectResponse } from "../_shared/http.ts";
+```
+
+Expected failure until shared helper exists.
+
+**Step 2: Run test to verify it fails**
+
+Run: `deno test -A supabase/functions/email-campaigns/http.test.ts`
+Expected: FAIL with module not found `../_shared/http.ts`
+
+**Step 3: Implement shared helper**
+
+Create `supabase/functions/_shared/http.ts`:
+
+```ts
+import corsHeaders from "./cors.ts";
+
+export const buildRedirectResponse = (location: string): Response => {
+  const headers = new Headers(corsHeaders);
+  headers.set("Location", location);
+
+  return new Response(null, {
+    status: 302,
+    headers,
+  });
+};
+```
+
+**Step 4: Re-export from email-campaigns (temporary)**
+
+Update `supabase/functions/email-campaigns/http.ts` to re-export:
+
+```ts
+export { buildRedirectResponse } from "../_shared/http.ts";
+```
+
+**Step 5: Run test to verify it passes**
+
+Run: `deno test -A supabase/functions/email-campaigns/http.test.ts`
+Expected: PASS
+
+**Step 6: Commit**
+
+```bash
+git add supabase/functions/_shared/http.ts supabase/functions/email-campaigns/http.ts supabase/functions/email-campaigns/http.test.ts
+git commit -m "refactor: share redirect response helper"
+```
+
+---
+
+### Task 2: Update email-campaigns imports to shared helper
+
+**Files:**
+
+- Modify: `supabase/functions/email-campaigns/index.ts`
+
+**Step 1: Write the failing test**
+
+No new unit test required; rely on existing `http.test.ts` and lint/type-check.
+
+**Step 2: Update imports**
+
+Change import to:
+
+```ts
+import { buildRedirectResponse } from "../_shared/http.ts";
+```
+
+**Step 3: Run tests**
+
+Run: `deno test -A supabase/functions/email-campaigns/http.test.ts`
+Expected: PASS
+
+**Step 4: Commit**
+
+```bash
+git add supabase/functions/email-campaigns/index.ts
+git commit -m "refactor: use shared redirect helper"
+```
+
+---
+
+### Task 3: Remove email-campaigns helper shim
+
+**Files:**
+
+- Delete: `supabase/functions/email-campaigns/http.ts`
+
+**Step 1: Update test import to shared helper**
+
+Ensure `supabase/functions/email-campaigns/http.test.ts` already imports from `../_shared/http.ts`.
+
+**Step 2: Remove file**
+
+Delete `supabase/functions/email-campaigns/http.ts`.
+
+**Step 3: Run tests**
+
+Run: `deno test -A supabase/functions/email-campaigns/http.test.ts`
+Expected: PASS
+
+**Step 4: Commit**
+
+```bash
+git add supabase/functions/email-campaigns/http.test.ts
+git rm supabase/functions/email-campaigns/http.ts
+git commit -m "refactor: remove email-campaigns redirect shim"
+```

docs/plans/2026-03-04-shared-http-helper-plan.md

@@ -0,0 +1,46 @@
+# Short URLs for Email Tracking (Design)
+
+Goal
+
+- Replace long Supabase function URLs in email tracking (open/click/unsubscribe) with short frontend-domain paths.
+- Keep existing tokens and tracking data model unchanged.
+
+Scope
+
+- Nuxt server routes for /o/:token, /c/:token, /u/:token to proxy to the email-campaigns edge function.
+- Email-campaigns edge function generates short links using the frontend domain.
+- No new database columns or tokens.
+
+Architecture
+
+- Nuxt/Nitro handles public short routes and forwards requests to Supabase edge function paths.
+- Edge function remains the source of truth for tracking, logging events, and redirects.
+- URL base for short links: FRONTEND_HOST (preferred) or public Supabase URL fallback.
+
+Data Flow
+
+- Email send flow generates tracking URLs using buildOpenTrackingUrl/buildClickTrackingUrl/buildUnsubscribeUrl.
+- Email HTML includes short links and pixel URL.
+- Nuxt routes proxy to:
+  - /track/open/:token (returns 1x1 GIF)
+  - /track/click/:token (logs click, 302 to original URL)
+  - /unsubscribe/:token (updates consent, 302 to frontend success/failure)
+
+Error Handling
+
+- Missing token in Nuxt route returns 400.
+- Missing SAAS_SUPABASE_PROJECT_URL in frontend config returns 500.
+- Invalid tracking token returns 404 from edge function.
+- Redirect responses include CORS headers for consistency.
+
+Risks and Mitigations
+
+- Misconfigured FRONTEND_HOST could break unsubscribe redirects: ensure env is set in edge function runtime.
+- Proxy failures return explicit errors to aid debugging.
+- No new persistence changes reduces migration risk.
+
+Testing
+
+- Local end-to-end: create campaign, verify /o, /c, /u links resolve and log events.
+- Verify redirects preserve status codes and headers.
+- Spot-check unsubscribe success/failure paths.