/** * "A document was shared with you" email — sent to every notified user * right after an admin uploads + assigns a document to their role. * Same visual style as document-otp-email-template.ts. */ export interface DocumentSharedEmailContext { recipient_name: string; document_title: string; document_category: string; uploader_name: string; require_otp: boolean; has_password: boolean; portal_url: string; } export function buildDocumentSharedEmail(ctx: DocumentSharedEmailContext): { subject: string; html: string; } { const subject = `New document shared with you: "${ctx.document_title}"`; const securityLine = [ ctx.require_otp ? 'an email OTP code' : null, ctx.has_password ? 'a password' : null, ] .filter(Boolean) .join(' and '); const html = ` ${subject}
CertifyHub — Document Portal

Hello ${escapeHtml(ctx.recipient_name)},

${escapeHtml(ctx.uploader_name)} just shared a new document with you on the Document Portal.

${escapeHtml(ctx.document_title)}
${escapeHtml(ctx.document_category)}
${ securityLine ? `

This document is protected — you'll be asked for ${securityLine} when you open it. Just click "Open" on the document and follow the prompts; any OTP code will be emailed to you at that point.

` : `

No extra verification is needed — just open it from the portal.

` }

You're receiving this because you belong to a role this document was assigned to. Every open, download, and failed attempt is logged for audit purposes.

`.trim(); return { subject, html }; } // Small helpers — never trust user-supplied strings inside HTML. function escapeHtml(s: string): string { return String(s ?? '') .replace(/&/g, '&') .replace(//g, '>') .replace(/"/g, '"') .replace(/'/g, '''); } function escapeAttr(s: string): string { return escapeHtml(s); }