-
Hello,
-
Thank you for subscribing to the StellenScout Daily Digest.
- Please confirm your email address by clicking the button below:
+
+ Thank you for subscribing! Please confirm your email address to start
+ receiving AI-matched job listings:
-
- Confirm subscription
+ font-size:16px;display:inline-block">
+ Confirm subscription ✓
-
+
+ |
+ 🚀
+ AI scores every job against your CV |
+ |
+ ✉️
+ Daily digest with your best matches |
+ |
+ 🔓
+ Unsubscribe any time, data deleted automatically |
+
+
This link is valid for 24 hours. If you did not
sign up, you can safely ignore this email.
diff --git a/stellenscout/pages/verify.py b/stellenscout/pages/verify.py
index 4a70cef..ded477f 100644
--- a/stellenscout/pages/verify.py
+++ b/stellenscout/pages/verify.py
@@ -8,7 +8,17 @@
logger = logging.getLogger(__name__)
# Inject secrets into env vars (same pattern as app.py)
-for key in ("SUPABASE_URL", "SUPABASE_KEY", "SUPABASE_SERVICE_KEY"):
+for key in (
+ "SUPABASE_URL",
+ "SUPABASE_KEY",
+ "SUPABASE_SERVICE_KEY",
+ "RESEND_API_KEY",
+ "RESEND_FROM",
+ "APP_URL",
+ "IMPRESSUM_NAME",
+ "IMPRESSUM_ADDRESS",
+ "IMPRESSUM_EMAIL",
+):
if key not in os.environ:
try:
os.environ[key] = st.secrets[key]
@@ -78,5 +88,32 @@ def _request_metadata() -> tuple[str | None, str | None]:
f"for {SUBSCRIPTION_DAYS} days. You can unsubscribe at any time via the link in each email."
)
st.balloons()
+
+ # Best-effort welcome email — failure doesn't affect confirmation
+ try:
+ import secrets as _secrets
+ from datetime import timedelta as _td
+
+ from stellenscout.db import issue_unsubscribe_token
+ from stellenscout.emailer import send_welcome_email
+
+ _app_url = os.environ.get("APP_URL", "").rstrip("/")
+
+ _unsub_url = ""
+ if _app_url:
+ _unsub_token = _secrets.token_urlsafe(32)
+ _unsub_expires = (_dt.now(_tz.utc) + _td(days=SUBSCRIPTION_DAYS)).isoformat()
+ if issue_unsubscribe_token(db, subscriber["id"], token=_unsub_token, expires_at=_unsub_expires):
+ _unsub_url = f"{_app_url}/unsubscribe?token={_unsub_token}"
+
+ send_welcome_email(
+ email=subscriber["email"],
+ target_location=subscriber.get("target_location", ""),
+ subscription_days=SUBSCRIPTION_DAYS,
+ privacy_url=f"{_app_url}/privacy" if _app_url else "",
+ unsubscribe_url=_unsub_url,
+ )
+ except Exception:
+ logger.exception("Failed to send welcome email")
else:
st.error("This confirmation link is invalid or has expired. Please subscribe again.")
diff --git a/tests/test_emailer.py b/tests/test_emailer.py
index e7ec2fc..9011bba 100644
--- a/tests/test_emailer.py
+++ b/tests/test_emailer.py
@@ -1,8 +1,53 @@
"""Tests for stellenscout.emailer — HTML builder pure functions."""
+from unittest.mock import patch
+
import pytest
-from stellenscout.emailer import _build_html, _build_job_row, _impressum_line
+from stellenscout.emailer import (
+ _build_html,
+ _build_job_row,
+ _impressum_line,
+ _safe_url,
+ send_verification_email,
+ send_welcome_email,
+)
+
+
+class TestSafeUrl:
+ def test_allows_https(self):
+ assert _safe_url("https://example.com") == "https://example.com"
+
+ def test_allows_http(self):
+ assert _safe_url("http://example.com") == "http://example.com"
+
+ def test_blocks_javascript(self):
+ assert _safe_url("javascript:alert(1)") == "#"
+
+ def test_blocks_data_uri(self):
+ assert _safe_url("data:text/html,
hi
") == "#"
+
+ def test_escapes_quotes_in_url(self):
+ assert "&" in _safe_url("https://example.com?a=1&b=2")
+
+ def test_empty_string(self):
+ assert _safe_url("") == ""
+
+
+class TestHtmlEscapingInJobRow:
+ def test_escapes_title_with_html(self):
+ html = _build_job_row({"title": "", "company": "Co", "url": "https://x.com"})
+ assert "