Resend (one account per domain)          Your app
┌──────────────────────────┐             ┌────────────────────────────┐
│ inbox: sales@a.com       │  webhook →  │ webhook receiver (public)  │
│ inbox: support@a.com     │             │   ↓ verify signature       │
│   threads / emails       │  ← API      │   ↓ sync thread            │
│   labels / drafts        │             │ mirror (DB + object store) │
└──────────────────────────┘             │ access rules (yours alone) │
┌──────────────────────────┐             │ three-pane client UI       │
│ inbox: hello@b.com       │             └────────────────────────────┘
└──────────────────────────┘

func (s *EmailAccounts) ClientForInbox(ctx context.Context, inboxID string) (*resend.Client, *models.Inbox, error) {
	var inbox models.Inbox
	if err := s.db.WithContext(ctx).Preload("Access").First(&inbox, "id = ?", inboxID).Error; err != nil {
		return nil, nil, err
	}
	client, err := s.ClientForAccount(ctx, inbox.AccountID)
	if err != nil {
		return nil, nil, err
	}
	return client, &inbox, nil
}

// After the usual JWT_SECRET validation:
if strings.TrimSpace(cfg.EmailEncryptionKey) == "" {
	// The label gives the two uses separate key material from the same
	// secret, so neither can stand in for the other.
	cfg.EmailEncryptionKey = "app/email-credentials/v1|" + cfg.JWTSecret
} else {
	cfg.EmailEncryptionDedicated = true
}

// AccessLevelFor returns the level this caller has on this inbox, or "".
//
// This is the whole access model, deliberately in one place. A Resend inbox
// is team-wide, so nothing on their side stops a junior reading sales@.
// This does, and it is the only thing that does.
func (i *Inbox) AccessLevelFor(userID, roleSlug string, isOwner bool) string {
	if isOwner {
		return InboxAccessManage // somebody must be able to recover a mailbox
	}
	best := ""
	for _, grant := range i.Access {
		if !grantApplies(grant, userID, roleSlug) {
			continue
		}
		// A person can be granted directly and through a role at once.
		// The higher wins — a named grant adds, never demotes.
		if inboxAccessRank[grant.Level] > inboxAccessRank[best] {
			best = grant.Level
		}
	}
	return best
}
 
func grantApplies(grant InboxAccess, userID, roleSlug string) bool {
	if grant.UserID != "" {
		return grant.UserID == userID
	}
	if grant.RoleSlug != "" {
		return strings.EqualFold(grant.RoleSlug, roleSlug)
	}
	// A grant naming neither must not become a grant to everybody.
	return false
}

// Handlers call this instead of loading an inbox themselves: the only way
// to get the row is to pass the check.
func (s *EmailAccounts) RequireInbox(ctx context.Context, inboxID, userID, roleSlug string, isOwner bool, level string) (*models.Inbox, error) {
	var inbox models.Inbox
	if err := s.db.WithContext(ctx).Preload("Access").First(&inbox, "id = ?", inboxID).Error; err != nil {
		return nil, err
	}
	if !inbox.HasAtLeast(userID, roleSlug, isOwner, level) {
		return nil, ErrNoAccess
	}
	return &inbox, nil
}

resendID, err := client.CreateInbox(ctx, resend.CreateInboxRequest{
	EmailAddress: "sales@example.com",
	Name:         "Sales",
	FromName:     "Example Sales",
	Forwarding:   true, // read receiving_address back with GetInbox
})

POST https://api.yourapp.com/api/webhooks/resend/{account_id}

// One Resend team, which in practice is one domain.
type EmailAccount struct {
	ID     string `gorm:"primarykey;size:36" json:"id"`
	Domain string `gorm:"size:255;uniqueIndex;not null" json:"domain"`
	Name   string `gorm:"size:120" json:"name"`
 
	// Never returned to a client: json:"-" plus the handler shapes the
	// response by hand.
	APIKeyEncrypted        string `gorm:"type:text" json:"-"`
	APIKeyHint             string `gorm:"size:8" json:"api_key_hint,omitempty"` // last 4
	WebhookSecretEncrypted string `gorm:"type:text" json:"-"`
 
	Inboxes []Inbox `gorm:"foreignKey:AccountID" json:"inboxes,omitempty"`
	// timestamps…
}
 
type Inbox struct {
	ID            string `gorm:"primarykey;size:36" json:"id"`
	AccountID     string `gorm:"size:36;index;not null" json:"account_id"`
	ResendInboxID string `gorm:"size:64;index" json:"resend_inbox_id"`
 
	EmailAddress string `gorm:"size:320;uniqueIndex;not null" json:"email_address"`
	Name         string `gorm:"size:120" json:"name"`
	FromName     string `gorm:"size:120" json:"from_name"`
 
	Forwarding       bool   `gorm:"default:false" json:"forwarding"`
	ReceivingAddress string `gorm:"size:320" json:"receiving_address,omitempty"`
 
	MirrorMessages bool `gorm:"default:true" json:"mirror_messages"`
 
	Access      []InboxAccess `gorm:"foreignKey:InboxID" json:"access,omitempty"`
	UnreadCount int64         `gorm:"-" json:"unread_count"` // computed, never stored
}
 
type InboxAccess struct {
	ID      string `gorm:"primarykey;size:36" json:"id"`
	InboxID string `gorm:"size:36;index;not null" json:"inbox_id"`
	// Exactly one of these.
	UserID   string `gorm:"size:36;index" json:"user_id,omitempty"`
	RoleSlug string `gorm:"size:40;index" json:"role_slug,omitempty"`
	Level    string `gorm:"size:10;not null;default:'read'" json:"level"` // read|send|manage
}
 
type EmailThread struct {
	ID             string `gorm:"primarykey;size:36" json:"id"`
	InboxID        string `gorm:"size:36;index;not null" json:"inbox_id"`
	ResendThreadID string `gorm:"size:64;index" json:"resend_thread_id"`
 
	Subject string `gorm:"size:500" json:"subject"`
	Snippet string `gorm:"size:500" json:"snippet"`
	Folder  string `gorm:"size:20;index;default:'inbox'" json:"folder"`
	Unread  bool   `gorm:"index;default:true" json:"unread"`
 
	Participants  string    `gorm:"type:text" json:"participants"`
	LabelIDs      string    `gorm:"type:text" json:"label_ids,omitempty"`
	MessageCount  int       `gorm:"default:0" json:"message_count"`
	LastMessageAt time.Time `gorm:"index" json:"last_message_at"`
 
	// The reason a mirror is worth having: Resend cannot do this.
	BookingID  string `gorm:"size:36;index" json:"booking_id,omitempty"`
	AssignedTo string `gorm:"size:36;index" json:"assigned_to,omitempty"`
 
	Messages []EmailMessage `gorm:"foreignKey:ThreadID" json:"messages,omitempty"`
}
 
type EmailMessage struct {
	ID            string `gorm:"primarykey;size:36" json:"id"`
	ThreadID      string `gorm:"size:36;index;not null" json:"thread_id"`
	InboxID       string `gorm:"size:36;index;not null" json:"inbox_id"`
	ResendEmailID string `gorm:"size:64;index" json:"resend_email_id"`
	Direction     string `gorm:"size:10;index" json:"direction"` // inbound|outbound
 
	FromAddress string `gorm:"size:320" json:"from_address"`
	FromName    string `gorm:"size:200" json:"from_name"`
	ToAddresses string `gorm:"type:text" json:"to_addresses"`
	CCAddresses string `gorm:"type:text" json:"cc_addresses,omitempty"`
 
	Subject string `gorm:"size:500" json:"subject"`
	HTML    string `gorm:"type:text" json:"html,omitempty"` // only when mirroring
	Text    string `gorm:"type:text" json:"text,omitempty"`
 
	SentBy      string            `gorm:"size:36;index" json:"sent_by,omitempty"` // your user
	Attachments []EmailAttachment `gorm:"foreignKey:MessageID" json:"attachments,omitempty"`
	SentAt      time.Time         `gorm:"index" json:"sent_at"`
}
 
// StorageKey is the point of this table — it does not expire.
type EmailAttachment struct {
	ID                 string `gorm:"primarykey;size:36" json:"id"`
	MessageID          string `gorm:"size:36;index;not null" json:"message_id"`
	Filename           string `gorm:"size:255" json:"filename"`
	ContentType        string `gorm:"size:120" json:"content_type"`
	Size               int64  `json:"size"`
	StorageKey         string `gorm:"size:500" json:"storage_key,omitempty"`
	ResendAttachmentID string `gorm:"size:64" json:"resend_attachment_id,omitempty"`
	FetchError         string `gorm:"size:255" json:"fetch_error,omitempty"`
}

const scheme = "v1:"
 
func New(passphrase string) (*Sealer, error) {
	if strings.TrimSpace(passphrase) == "" {
		return nil, ErrNoKey
	}
	// SHA-256, not a password KDF: this is a high-entropy secret from the
	// environment, not a human-chosen password facing offline guessing.
	sum := sha256.Sum256([]byte(passphrase))
	block, err := aes.NewCipher(sum[:])
	if err != nil {
		return nil, err
	}
	aead, err := cipher.NewGCM(block)
	if err != nil {
		return nil, err
	}
	return &Sealer{aead: aead}, nil
}
 
func (s *Sealer) Seal(plaintext string) (string, error) {
	nonce := make([]byte, s.aead.NonceSize())
	if _, err := rand.Read(nonce); err != nil {
		return "", err
	}
	return scheme + base64.StdEncoding.EncodeToString(
		s.aead.Seal(nonce, nonce, []byte(plaintext), nil)), nil
}
 
func (s *Sealer) Open(stored string) (string, error) {
	if !strings.HasPrefix(stored, scheme) {
		// A column holding a bare plain-text key is refused, not handed on.
		return "", ErrNotEncrypted
	}
	raw, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(stored, scheme))
	if err != nil {
		return "", err
	}
	size := s.aead.NonceSize()
	if len(raw) < size {
		return "", ErrNotEncrypted
	}
	// GCM authenticates as it decrypts: a tampered row fails here, not as a
	// confusing 401 from Resend an hour later.
	plaintext, err := s.aead.Open(nil, raw[:size], raw[size:], nil)
	if err != nil {
		return "", err
	}
	return string(plaintext), nil
}

func do[T any](ctx context.Context, c *Client, method, path string, body any, out *T) error {
	return doWithKey(ctx, c, method, path, body, out, "")
}
 
func doWithKey[T any](ctx context.Context, c *Client, method, path string, body any, out *T, idempotencyKey string) error {
	var reader io.Reader
	if body != nil {
		encoded, err := json.Marshal(body)
		if err != nil {
			return err
		}
		reader = bytes.NewReader(encoded)
	}
	req, err := http.NewRequestWithContext(ctx, method, c.baseURL+path, reader)
	if err != nil {
		return err
	}
	req.Header.Set("Authorization", "Bearer "+c.apiKey)
	if body != nil {
		req.Header.Set("Content-Type", "application/json")
	}
	if idempotencyKey != "" {
		req.Header.Set("Idempotency-Key", idempotencyKey)
	}
 
	resp, err := c.http.Do(req)
	if err != nil {
		return fmt.Errorf("resend: %s %s: %w", method, path, err)
	}
	defer resp.Body.Close()
 
	payload, err := io.ReadAll(io.LimitReader(resp.Body, 20<<20))
	if err != nil {
		return err
	}
	if resp.StatusCode/100 != 2 {
		apiErr := &APIError{Status: resp.StatusCode}
		// A gateway in front of Resend may return HTML; the status is the
		// useful part, so an unparseable body must not hide it.
		_ = json.Unmarshal(payload, apiErr)
		if apiErr.Status == 0 {
			apiErr.Status = resp.StatusCode
		}
		return apiErr
	}
	if out == nil || len(payload) == 0 {
		return nil
	}
	return json.Unmarshal(payload, out)
}

func (c *Client) FetchAttachment(ctx context.Context, downloadURL string) ([]byte, error) {
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, downloadURL, nil)
	if err != nil {
		return nil, err
	}
	resp, err := c.http.Do(req) // no Authorization header
	…
}

draftID, err := client.CreateDraft(ctx, inbox.ResendInboxID, key+"-draft", resend.DraftRequest{
	To: to, CC: cc, Subject: subject, HTML: html, Attachments: attachments,
})
if err != nil { return err }
sentID, err := client.SendDraft(ctx, inbox.ResendInboxID, draftID, key)
if err != nil {
	// The draft exists and was not sent. Say so — it is recoverable from
	// Drafts, and silently losing a typed message is worse.
	return fmt.Errorf("%w — the message was saved to Drafts (%s)", err, draftID)
}

const (
	secretPrefix = "whsec_"
	tolerance    = 5 * time.Minute
)
 
func VerifyWebhook(secret string, h WebhookHeaders, body []byte, now time.Time) error {
	if h.ID == "" || h.Timestamp == "" || h.Signature == "" {
		return ErrNoSignature
	}
	if strings.TrimSpace(secret) == "" {
		// No secret means we cannot tell real from forged. Accepting
		// "because it is probably fine" makes this an open door.
		return errors.New("resend: no webhook signing secret configured")
	}
	if err := checkTimestamp(h.Timestamp, now); err != nil {
		return err
	}
 
	// The bytes AFTER the whsec_ prefix are base64, and the decoded value is
	// the key. Hashing the printable form is the classic way to build a
	// verifier that never matches anything.
	key, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(secret, secretPrefix))
	if err != nil {
		return err
	}
 
	mac := hmac.New(sha256.New, key)
	mac.Write([]byte(h.ID))
	mac.Write([]byte("."))
	mac.Write([]byte(h.Timestamp))
	mac.Write([]byte("."))
	mac.Write(body)
	want := mac.Sum(nil)
 
	// A space-separated list: during a rotation Resend signs with both the
	// old and new secret. Any entry matching is a pass.
	for _, part := range strings.Split(h.Signature, " ") {
		version, encoded, ok := strings.Cut(part, ",")
		if !ok || version != "v1" {
			continue
		}
		got, err := base64.StdEncoding.DecodeString(encoded)
		if err != nil {
			continue
		}
		if hmac.Equal(got, want) { // constant time
			return nil
		}
	}
	return ErrSignatureInvalid
}
 
func checkTimestamp(raw string, now time.Time) error {
	seconds, err := strconv.ParseInt(raw, 10, 64)
	if err != nil {
		return fmt.Errorf("unreadable webhook timestamp %q", raw)
	}
	drift := now.Sub(time.Unix(seconds, 0))
	if drift < 0 {
		drift = -drift
	}
	// Both directions: too old is a replay; too far ahead means a clock is
	// wrong and the age check is meaningless.
	if drift > tolerance {
		return ErrSignatureExpired
	}
	return nil
}

func (h *EmailWebhookHandler) Receive(c *gin.Context) {
	accountID := c.Param("account_id")
 
	// Raw bytes first. Nothing has parsed this yet, and nothing must.
	body, err := io.ReadAll(io.LimitReader(c.Request.Body, 1<<20))
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "unreadable body"})
		return
	}
 
	secret, err := h.Accounts.WebhookSecret(c.Request.Context(), accountID)
	if err != nil {
		log.Printf("email webhook: no signing secret for %s: %v", accountID, err)
		c.JSON(http.StatusUnauthorized, gin.H{"error": "unverified"})
		return
	}
 
	headers := resend.WebhookHeaders{
		ID:        c.GetHeader("svix-id"),
		Timestamp: c.GetHeader("svix-timestamp"),
		Signature: c.GetHeader("svix-signature"),
	}
	if err := resend.VerifyWebhook(secret, headers, body, time.Now()); err != nil {
		// Logged with the reason, answered without it: a detailed error
		// tells whoever is probing which part of the forgery to fix.
		log.Printf("email webhook: rejected delivery for %s: %v", accountID, err)
		c.JSON(http.StatusUnauthorized, gin.H{"error": "unverified"})
		return
	}
 
	var event webhookEvent
	if err := json.Unmarshal(body, &event); err != nil {
		// Signed but unparseable — a retry sends the same bytes.
		c.JSON(http.StatusOK, gin.H{"status": "ignored"})
		return
	}
 
	status, err := h.handle(c, event)
	if err != nil {
		// Non-2xx asks Resend to retry, which is what you want for a
		// transient failure: a database blip must not cost you the message.
		c.JSON(http.StatusInternalServerError, gin.H{"error": "retry"})
		return
	}
	c.JSON(http.StatusOK, gin.H{"status": status})
}

func TestVerifyWebhook_RejectsReencodedBody(t *testing.T) {
	// Semantically identical JSON must fail. If it passed, the check would
	// not be covering the payload.
	original := []byte(`{"a":1,"b":2}`)
	reencoded := []byte(`{"b":2,"a":1}`)
	headers := WebhookHeaders{ID: "msg_abc", Timestamp: stamp,
		Signature: sign(t, testSecret, "msg_abc", stamp, original)}
	if err := VerifyWebhook(testSecret, headers, reencoded, time.Now()); err == nil {
		t.Fatal("re-encoded JSON accepted; signature is not covering the raw body")
	}
}

func (h *EmailWebhookHandler) handle(c *gin.Context, event webhookEvent) (string, error) {
	switch event.Type {
	case "inbox.email.received", "inbox.email.sent", "inbox.thread.created",
		"inbox.thread.folder.updated", "inbox.thread.labels.updated":
		return h.syncThread(c, event)
	case "inbox.deleted":
		// Keep the local record: it holds your access grants and the
		// mirrored mail, which exists precisely because Resend does not
		// keep it.
		return "noted", nil
	default:
		return "ignored", nil // 200 stops pointless retries
	}
}

// A broadcast would be simpler and wrong: the event carries a subject and a
// sender, so every connected client would see the contents of sales@.
recipients, err := h.Accounts.UsersWithAccess(c.Request.Context(), inbox)
h.Hub.SendToUsers(recipients, realtime.Event{Type: "email.received", Payload: payload})

func (m *EmailMirror) SyncThread(ctx context.Context, inbox *models.Inbox, threadID string) error {
	client, err := m.accounts.ClientForAccount(ctx, inbox.AccountID)
	if err != nil {
		return err
	}
	thread, err := client.GetThread(ctx, inbox.ResendInboxID, threadID)
	if err != nil {
		return err
	}
	// Includes html and text, so one call gets every body in the thread.
	emails, _, err := client.ListThreadEmails(ctx, inbox.ResendInboxID, threadID, 100, "")
	if err != nil {
		return err
	}
 
	local, err := m.upsertThread(ctx, inbox, thread, emails)
	if err != nil {
		return err
	}
	for _, email := range emails {
		if err := m.upsertMessage(ctx, inbox, local, client, email); err != nil {
			// One unreadable message must not abandon the thread.
			log.Printf("email: mirror message %s: %v", email.ID, err)
		}
	}
	return nil
}

func (m *EmailMirror) fetchAttachment(ctx context.Context, client *resend.Client,
	inbox *models.Inbox, message *models.EmailMessage, row *models.EmailAttachment) error {
 
	full, err := client.ReceivedAttachment(ctx, message.ResendEmailID, row.ResendAttachmentID)
	if err != nil {
		return err
	}
	row.ContentType = full.ContentType
	if row.Size > attachmentSizeLimit {
		return fmt.Errorf("attachment is %d bytes, over the limit", row.Size)
	}
	payload, err := client.FetchAttachment(ctx, full.DownloadURL) // valid ~1h
	if err != nil {
		return err
	}
 
	// The sender chose the filename, so sanitise before it decides where the
	// file lands: a name containing ../ is a path traversal.
	key := attachmentKey(inbox.ID, message.ID, row.Filename)
	if err := m.storage.Upload(ctx, key, bytes.NewReader(payload), full.ContentType); err != nil {
		return err
	}
	row.StorageKey = key
	row.FetchError = ""
	return nil
}

export function readingFrame(html: string, showImages: boolean): string {
  const policy = showImages
    ? "default-src 'none'; img-src https: data: cid:; style-src 'unsafe-inline'"
    : "default-src 'none'; img-src data:; style-src 'unsafe-inline'";
  return `<!doctype html><html><head><meta charset="utf-8">
<meta http-equiv="Content-Security-Policy" content="${policy}">
<style>body{margin:0;font:14px/1.6 system-ui;overflow-wrap:break-word}
img,table{max-width:100%!important;height:auto}</style></head><body>${html}</body></html>`;
}

<iframe title="Message" sandbox="" srcDoc={html} style={{ height }} />

function buttonBlock(label: string, url: string): string {
  return (
    `<table role="presentation" cellpadding="0" cellspacing="0" border="0" style="margin:18px 0">` +
    `<tr><td style="background:${ACCENT};border-radius:8px">` +
    `<a href="${attr(url)}" style="display:inline-block;padding:11px 22px;font-family:${FONT};` +
    `font-size:14px;font-weight:600;color:#ffffff;text-decoration:none">${esc(label)}</a>` +
    `</td></tr></table>`
  );
}

// Bold should produce <b>, not <span style>. Clients handle tags far better.
document.execCommand("styleWithCSS", false, "false");
 
// Paste as plain text: pasting from Word otherwise drags in a page of
// foreign markup the sender cannot see and no client renders alike.
function onPaste(event: React.ClipboardEvent) {
  event.preventDefault();
  document.execCommand(
    "insertText",
    false,
    event.clipboardData.getData("text/plain")
  );
}

const emitted = useRef(value);
useEffect(() => {
  if (value !== emitted.current && body.current) {
    body.current.innerHTML = value; // only when it came from outside
    emitted.current = value;
  }
}, [value]);

export function cleanForSend(html: string): string {
  return html.replace(/ data-block="[^"]*"/g, "");
}

useEffect(() => {
  if (!compose) return;
  const content = draftFingerprint(compose);
  if (!content || content === lastSaved.current) return;
  const timer = window.setTimeout(() => {
    lastSaved.current = content;
    autoSave.mutate(compose);
  }, 4000);
  return () => window.clearTimeout(timer);
}, [compose]);

// Lazy: the map holds functions, and only the tokens the template actually
// mentions are called, so a one-line acknowledgement reads no tables.
"{{room_catalogue}}": func() string { return s.roomCatalogue(ctx) },

err := s.db.WithContext(ctx).Clauses(clause.OnConflict{
	Columns: []clause.Column{{Name: "address"}},
	DoUpdates: clause.Assignments(map[string]any{
		"last_seen_at":    now,
		"times_contacted": gorm.Expr("email_contacts.times_contacted + 1"),
	}),
	// Subscribed, Source and FirstSeenAt are deliberately absent: the first
	// two are decisions, the third is a fact that does not change.
}).Create(&contact).Error