/** * OTP email for the staff document portal. * Same visual style as the other audit-request / auditor-assignment templates. */ export interface DocumentOtpEmailContext { recipient_name: string; document_title: string; document_category: string; otp: string; expires_in_minutes: number; requester_ip?: string | null; } export function buildDocumentOtpEmail(ctx: DocumentOtpEmailContext): { subject: string; html: string; } { const subject = `Your access code for "${ctx.document_title}"`; const html = ` ${subject}
CertifyHub — Document Portal

Hello ${escapeHtml(ctx.recipient_name)},

You just requested access to ${escapeHtml(ctx.document_title)} (${escapeHtml(ctx.document_category)}). Use the code below to unlock it.

${escapeHtml(ctx.otp)}

Valid for ${ctx.expires_in_minutes} minutes. Do not share this code with anyone.

${ ctx.requester_ip ? `

Requested from IP ${escapeHtml(ctx.requester_ip)}

` : '' }

If you didn't request this code, you can safely ignore this email — access has not been granted. Every failed attempt is logged.

`.trim(); return { subject, html }; } // Small helper — never trust user-supplied strings inside HTML. function escapeHtml(s: string): string { return String(s ?? '') .replace(/&/g, '&') .replace(//g, '>') .replace(/"/g, '"') .replace(/'/g, '''); }