Contact

1. 1

   Validate the submitted message

   The public API and signed-in form use contact-owned schemas before persistence.

   Relevant Product code

   • src/app/api/contact/route.ts
   • src/features/contact/shared/schemas.ts
2. 2

   Rate-limit public writes

   The service checks the public contact rate-limit policy before storing a message.

   Relevant Product code

   • src/features/contact/server/services/rate-limit.ts
   • src/features/contact/server/services/submission.ts
3. 3

   Persist and notify

   Messages are stored through the repository and related notifications are queued through the notification boundary.

   Relevant Product code

   • src/features/contact/server/persistence/messages.ts
   • src/features/contact/server/services/submission.ts
4. 4

   Triage and reply

   Admin inbox queries and actions own filtering, status changes, priority, replies, and dashboard counts while users can review the resulting thread.

   Relevant Product code

   • src/features/contact/server/queries/messages.ts
   • src/features/contact/server/actions/messages.ts

Use this example as a starting point, then adapt it to your product's rules and configuration.

Public contact writes are limited by IP and email before persistence or notifications run.

async function enforcePublicContactRateLimit(params: {
  clientIp: string | null;
  email: string;
  requestId: string;
  start: number;
}): Promise<PublicContactServiceResult | null> {
  const ratePolicy = getRateLimitPolicy("public_contact");
  const rateLimit = await checkRateLimit({
    key: buildRateLimitKey({
      prefix: ratePolicy.prefix,
      ip: params.clientIp,
      identifier: params.email,
    }),
    limit: ratePolicy.limit,
    windowSeconds: ratePolicy.windowSeconds,
  });

  if (rateLimit.allowed) {
    return null;
  }