// Node.js 18+, no dependencies. Save as verify-email.mjs and run:
//   MAILSAC_API_KEY=your_key node verify-email.mjs
import assert from 'node:assert/strict';
import { randomUUID } from 'node:crypto';

const API = process.env.MAILSAC_API_URL ?? 'https://mailsac.com/api';
const KEY = process.env.MAILSAC_API_KEY; // server-side only; never in browser code
if (!KEY) throw new Error('Set MAILSAC_API_KEY');
const APP_URL = 'http://localhost:3000'; // PLACEHOLDER: your app
const SUBJECT = 'Verify your email'; // PLACEHOLDER: your email's subject

async function mailsac(path, as = 'json') {
  const headers = { 'Mailsac-Key': KEY };
  const res = await fetch(API + path, { headers, signal: AbortSignal.timeout(10_000) });
  // Fail fast on errors. A 429 means the account hit its monthly Ops limit; retrying won't help.
  if (!res.ok) throw new Error(`Mailsac API returned ${res.status} for ${path}`);
  return as === 'json' ? res.json() : res.text();
}

// 1. A unique address per run. Anyone can read a public @mailsac.com inbox.
const email = `verify-${randomUUID()}@mailsac.com`; // or your private custom domain
const receivedAfter = Date.now();

// 2. PLACEHOLDER: replace with whatever makes your app send the email.
const body = new URLSearchParams({ email });
const signup = await fetch(`${APP_URL}/signup`, { method: 'POST', body, signal: AbortSignal.timeout(10_000) });
assert.ok(signup.ok, `Signup returned ${signup.status}`);

// 3. Poll for up to 60 s. Newest first; ignore mail received before the trigger.
const isMatch = (m) =>
  Date.parse(m.received) >= receivedAfter && m.subject?.includes(SUBJECT);
const deadline = Date.now() + 60_000;
let message;
while (!message) {
  if (Date.now() > deadline) throw new Error(`No matching email for ${email} in 60 s`);
  message = (await mailsac(`/addresses/${email}/messages?limit=10`)).find(isMatch);
  if (!message) await new Promise((resolve) => setTimeout(resolve, 2_000));
}

// 4. Check the code (plain text) and the link (the metadata's links[], parsed by Mailsac).
const meta = await mailsac(`/addresses/${email}/messages/${message._id}`);
const text = await mailsac(`/text/${email}/${message._id}`, 'text');
const codes = [...new Set(text.match(/\b\d{6}\b/g))];
// Plain-text links can keep trailing punctuation, e.g. <url> or [url]; drop it before comparing.
const links = [...new Set((meta.links ?? []).map((url) => url.replace(/[>\]).,;:!?'"*]+$/, '')))]
  .filter((url) => url.startsWith(`${APP_URL}/verify`));
assert.equal(codes.length, 1, `Expected one 6-digit code, found ${codes.length}`);
assert.equal(links.length, 1, `Expected one verification link, found ${links.length}`);
const [code] = codes;
const [link] = links;
console.log('Verification email OK', { code, link });

npm install --save-dev cypress@16.1.0 @mailsac/cypress@0.1.0