Email retention

src/app/(main)/api/auth/signup/route.ts

@@ -7,6 +7,7 @@ import { csrfProtection } from '@/lib/csrf';
 import { rateLimit, getClientIdentifier, RateLimits } from '@/lib/rateLimit';
 import { getAuthCookieOptions } from '@/lib/cookieConfig';
 import { signupSchema, validateRequest } from '@/lib/validationSchemas';
+import { sendWelcomeEmail } from '@/lib/email';
 
 export async function POST(request: NextRequest) {
   try {
@@ -74,6 +75,13 @@ export async function POST(request: NextRequest) {
       },
     });
 
+    // Send welcome email (fire-and-forget — never block signup)
+    try {
+      await sendWelcomeEmail(user.email, user.name ?? 'there');
+    } catch (emailError) {
+      console.error('Welcome email failed:', emailError);
+    }
+
     // Create response
     const response = NextResponse.json({
       success: true,

src/app/(main)/api/cron/retention-emails/route.ts

@@ -0,0 +1,113 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { db } from '@/lib/db';
+import { sendActivationNudgeEmail, sendUpgradeNudgeEmail, sendThirtyDayNudgeEmail } from '@/lib/email';
+
+// Protect with a shared secret — set CRON_SECRET in Vercel env vars
+function isAuthorized(request: NextRequest): boolean {
+  const authHeader = request.headers.get('authorization');
+  const cronSecret = process.env.CRON_SECRET;
+  if (!cronSecret) return false;
+  return authHeader === `Bearer ${cronSecret}`;
+}
+
+export async function GET(request: NextRequest) {
+  if (!isAuthorized(request)) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  const now = new Date();
+  const threeDaysAgo = new Date(now.getTime() - 3 * 24 * 60 * 60 * 1000);
+  const sevenDaysAgo = new Date(now.getTime() - 7 * 24 * 60 * 60 * 1000);
+  const thirtyDaysAgo = new Date(now.getTime() - 30 * 24 * 60 * 60 * 1000);
+
+  let activationSent = 0;
+  let upgradeSent = 0;
+  let thirtyDaySent = 0;
+
+  // Day-3: signed up > 3 days ago, never created a QR code, hasn't received this email yet
+  const activationCandidates = await db.user.findMany({
+    where: {
+      createdAt: { lt: threeDaysAgo },
+      activationNudgeSentAt: null,
+    },
+    include: {
+      _count: { select: { qrCodes: true } },
+    },
+  });
+
+  for (const user of activationCandidates) {
+    if (user._count.qrCodes === 0 && user.email) {
+      try {
+        await sendActivationNudgeEmail(user.email, user.name ?? 'there');
+        await db.user.update({
+          where: { id: user.id },
+          data: { activationNudgeSentAt: now },
+        });
+        activationSent++;
+      } catch (err) {
+        console.error(`Activation nudge failed for ${user.email}:`, err);
+      }
+    }
+  }
+
+  // Day-7: signed up > 7 days ago, has ≥1 QR code, still FREE, hasn't received this email yet
+  const upgradeCandidates = await db.user.findMany({
+    where: {
+      createdAt: { lt: sevenDaysAgo },
+      upgradeNudgeSentAt: null,
+      plan: 'FREE',
+    },
+    include: {
+      _count: { select: { qrCodes: true } },
+    },
+  });
+
+  for (const user of upgradeCandidates) {
+    if (user._count.qrCodes > 0 && user.email) {
+      try {
+        await sendUpgradeNudgeEmail(user.email, user.name ?? 'there', user._count.qrCodes);
+        await db.user.update({
+          where: { id: user.id },
+          data: { upgradeNudgeSentAt: now },
+        });
+        upgradeSent++;
+      } catch (err) {
+        console.error(`Upgrade nudge failed for ${user.email}:`, err);
+      }
+    }
+  }
+
+  // Day-30: signed up > 30 days ago, has ≥1 QR code, still FREE, hasn't received this email yet
+  const thirtyDayCandidates = await (db.user as any).findMany({
+    where: {
+      createdAt: { lt: thirtyDaysAgo },
+      thirtyDayNudgeSentAt: null,
+      plan: 'FREE',
+    },
+    include: {
+      _count: { select: { qrCodes: true } },
+    },
+  });
+
+  for (const user of thirtyDayCandidates) {
+    if (user._count.qrCodes > 0 && user.email) {
+      try {
+        await sendThirtyDayNudgeEmail(user.email, user.name ?? 'there', user._count.qrCodes);
+        await (db.user as any).update({
+          where: { id: user.id },
+          data: { thirtyDayNudgeSentAt: now },
+        });
+        thirtyDaySent++;
+      } catch (err) {
+        console.error(`30-day nudge failed for ${user.email}:`, err);
+      }
+    }
+  }
+
+  return NextResponse.json({
+    ok: true,
+    activationNudgesSent: activationSent,
+    upgradeNudgesSent: upgradeSent,
+    thirtyDayNudgesSent: thirtyDaySent,
+  });
+}