التكامل مع الـ Email والـ Search: retries و webhooks و indexes

// integrations.js: email بالـ retries والـ idempotency والـ suppression، و webhooks موقّعة، و search index ماشي مع الـ database
import { createHmac, timingSafeEqual } from "node:crypto";

export class IntegrationError extends Error {
  constructor(code, message = code, extra = {}) {
    super(message);
    this.code = code;
    Object.assign(this, extra);
  }
}

const ESC = { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" };
export const escapeHtml = (s) => String(s).replace(/[&<>"']/g, (c) => ESC[c]);

export function renderTemplate(tpl, data = {}) {
  return tpl.replace(/\{\{\s*(\w+)\s*\}\}/g, (_, name) => {
    if (data[name] == null) throw new IntegrationError("MISSING_VAR", `missing ${name}`);
    return escapeHtml(data[name]);
  });
}

const sleepReal = (ms) => new Promise((r) => setTimeout(r, ms));

export function createMailer({ baseUrl, apiKey, sleep = sleepReal, maxAttempts = 4, baseDelay = 100 }) {
  const suppressed = new Map();
  const seenEvents = new Set();
  const status = new Map();

  async function send({ to, subject, html, idempotencyKey }) {
    const email = String(to).trim().toLowerCase();
    if (suppressed.has(email)) return { status: "suppressed", reason: suppressed.get(email), attempts: 0 };
    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
      let res = null;
      try {
        res = await fetch(`${baseUrl}/emails`, {
          method: "POST",
          headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}`, "idempotency-key": idempotencyKey },
          body: JSON.stringify({ to: email, subject, html }),
        });
      } catch {
        res = null; // network error ← retry
      }
      if (res && res.ok) {
        const { id } = await res.json();
        status.set(id, "sent");
        return { status: "sent", id, attempts: attempt };
      }
      if (res && res.status !== 429 && res.status < 500) throw new IntegrationError("REJECTED", `provider said ${res.status}`, { status: res.status });
      if (attempt === maxAttempts) break;
      const wait = res?.status === 429 ? Number(res.headers.get("retry-after") ?? 1) * 1000 : baseDelay * 2 ** (attempt - 1);
      await sleep(wait);
    }
    throw new IntegrationError("GAVE_UP", "provider kept failing", { attempts: maxAttempts });
  }

  function handleEvent(event) {
    if (seenEvents.has(event.id)) return false;
    seenEvents.add(event.id);
    const email = event.data?.to?.toLowerCase();
    if (event.type === "email.bounced" && event.data.bounceType === "hard") suppressed.set(email, "bounced");
    if (event.type === "email.complained") suppressed.set(email, "complained");
    if (event.data?.emailId) status.set(event.data.emailId, event.type.slice("email.".length));
    return true;
  }

  return {
    send, handleEvent,
    suppress: (email, reason = "manual") => suppressed.set(email.toLowerCase(), reason),
    isSuppressed: (email) => suppressed.has(String(email).toLowerCase()),
    statusOf: (
…

$ node lab.js
— 1) template فيه data من الـ user —
   <p>أهلًا &lt;img src=x onerror=&quot;steal()&quot;&gt;</p>

— 2) الـ provider مش مستقر —
  اتبعت بعد 4 محاولات، والانتظار كان: [ 100, 3000, 400 ] ms
  الـ job اتعاد بنفس الـ key: نفس الـ id ، وعدد الإيميلات اللي اتبعتت فعلًا: 1
  إيميل غلط: REJECTED 422 من غير retry

— 3) الـ webhooks —
  delivered: delivered
  bounce مزوّر: BAD_SIGNATURE
  event موقّع صح بس من ساعة: STALE
  hard bounce حقيقي، أول مرة: true وتاني مرة: false
  نبعت لـ [email protected] تاني: suppressed ، والـ requests للـ provider زادت: 0

— 4) الـ search ماشي مع الـ database —
  v1: indexed
  v3 وصل الأول: indexed ، وبعدين v2 اتأخر: {"status":"stale","current":3}
  الـ index فيه: 3 {"title":"موبايل سامسونج","description":"اسود","price":9000,"inStock":false}
  البحث عن سامسونج: [ 'p1' ]

— 5) reindex من غير downtime —
  اتبنى products_v2 فيه 2 ، والـ alias بقى: products_v2
  البحث عن موبايل: [ 'p1', 'p2' ]

// signup.naive.js: الـ email والـ search جُوّه الـ request، والـ webhook من غير أي check
export async function signup(req, db, provider, search) {
  const user = await db.insertUser(req.body); // commit
  // لو الـ provider بطيء، الـ user مستني. ولو رجّع 503، الـ signup كله فشل؟ والـ user اتعمل خلاص
  await provider.send({ to: req.body.email, html: `<p>أهلًا ${req.body.name}</p>` }); // الاسم في HTML زي ما هو
  // fire and forget: لو وقع، الـ index مش هيعرف أبدًا
  search.index("users", user.id, user).catch(() => {}); // والـ document فيه الـ passwordHash
  return user;
}

export async function providerWebhook(req, db) {
  // أي حد يقدر يبعت هنا bounced لإيميل أي حد
  const event = JSON.parse(req.body);
  if (event.type === "email.bounced") await db.markBounced(event.data.to);
}
// وكمان: بنكمّل نبعت لإيميلات عملت bounce، فالـ reputation بتاعة الـ domain بتقع، والإيميلات بتروح spam

// providers.js: email provider و search engine وهميين على HTTP، شبه Resend و SES و Elasticsearch. ما تعدّلش فيه.
import { createServer } from "node:http";
import { createHmac, randomUUID } from "node:crypto";

const listen = async (handler) => {
  const server = createServer(async (req, res) => {
    let raw = "";
    for await (const c of req) raw += c;
    const send = (status, body, headers = {}) => res.writeHead(status, { "content-type": "application/json", ...headers }).end(JSON.stringify(body ?? {}));
    try { await handler(req, raw, send, new URL(req.url, "http://x")); } catch (e) { send(500, { error: e.message }); }
  });
  await new Promise((r) => server.listen(0, "127.0.0.1", r));
  return { url: `http://127.0.0.1:${server.address().port}`, close: () => new Promise((r) => server.close(r)) };
};

// email: POST /emails. plan = لستة status codes الـ provider هيرجّعها للـ requests الجاية (زي 503 و 429) قبل ما ينجح
export async function startEmailProvider({ apiKey, webhookSecret }) {
  const sent = [];
  const byKey = new Map();
  const state = { plan: [], requests: 0, retryAfter: 1 };
  const srv = await listen((req, raw, send, url) => {
    if (req.method !== "POST" || url.pathname !== "/emails") return send(404, { error: "not_found" });
    state.requests++;
    if (req.headers.authorization !== `Bearer ${apiKey}`) return send(401, { error: "unauthorized" });
    const next = state.plan.shift();
    if (next === 429) return send(429, { error: "rate_limited" }, { "retry-after": String(state.retryAfter) });
    if (next) return send(next, { error: "provider_error" });
    const key = req.headers["idempotency-key"];
    if (key && byKey.has(key)) return send(200, { id: byKey.get(key) });
    const body = JSON.parse(raw);
    if (!body.to || !/^[^@\s]+@[^@\s]+$/.test(body.to)) return send(422, { error: "invalid_to" });
    const id = `em_${randomUUID().slice(0, 8)}`;
    if (key) byKey.set(key, id);
    sent.push({ id, ...body });
    send(200, { id });
  });
  return {
    ...srv, sent, state,
    // event موقّع زي ما الـ provider بيبعته للـ webhook بتاعك
    signEvent(event, { at = Date.now(), secret = webhookSecret } = {}) {
      const body = JSON.stringify(event);
      const t = Math.floor(at / 1000);
      const sig = createHmac("sha256", secret).update(`${t}.${body}`).digest("hex");
      return { body, headers: { "webhook-signature": `t=${t},v1=${sig}` } };
    },
  };
}

// search: indexes فيها documents بـ external version، و aliases
export async function startSearch() {
  const indexes = new Map(); // name -> Map(id -> { version, doc | null })
  const aliases = new Map();
  const resolve = (name) => aliases.get(name) ?? name;
  const srv = await listen((req, raw, send, url) => {
    const parts = url.pathname.split("/").filter(Boolean);
    if (parts[0] === "aliases" && req.method === "POST") {
      const { alias, index } = JSON.parse(raw);
      if (!indexes.has(index)) return send(404, { error: "no_index" });
      aliases.s
…