Email (Resend)

All transactional email in the system flows through one Netlify function: send-email.js, which lives in studio-website. The admin has no email function of its own — it calls this endpoint. Email is sent via Resend from hello@sitecrate.ca.

The send-email function

netlify/functions/send-email.js:

• Accepts a small request body: { type, token } (plus any type-specific flags).
• Resolves the project from the DB by token using the service-role key.
• Builds all recipients and content server-side — never from the request body. A forged body cannot redirect the email or inject content.
• Locks CORS to SiteCrate origins.
• Sends through Resend.

It requires SUPABASE_SERVICE_ROLE_KEY and the Supabase URL in the function env. See Environments.

Why resolve server-side

The caller only ever sends a token and a type. Everything that determines who gets the email and what it says is looked up from the project row on the server. This means the public anon caller — or anyone who forges a request — can’t make the function email an arbitrary address or leak data: the token only maps to one project, and the content is derived, not supplied.

Email types

Type	Fired by	Trigger
intake	studio-website intake form	New intake submitted (non-blocking)
review	sitecrate-admin	Stage → review (requires preview_url)
launch	sitecrate-admin	Stage → live
feedback	studio-website status page	Client submits feedback
approved	studio-website status page	Client approves their site

The review guard

Caution

The review type validates that preview_url is set before sending. If it’s missing, the function returns HTTP 400 and sends nothing — so a client never receives a review email with a broken or empty link. In the admin, this surfaces as an amber warning on the Detail panel after save.

Who calls it

Caller	Types	Notes
studio-website intake	intake	Fired after create_intake returns the token; non-blocking
studio-website status page	feedback, approved	Fired after the matching RPC write
sitecrate-admin Detail panel	review, launch	Fired on stage transition; calls https://sitecrate.ca/.netlify/functions/send-email

Email log (admin)

The admin’s email-log.js function reads the last 20 Resend emails matching a subject query. It exposes client email metadata, so it’s gated — any active team member can call it, but only with a valid Bearer JWT verified against user_roles. See sitecrate-admin.