Relay transactional email through Salesforce instead of SMTP (#9)

Reviewed-on: #9
Co-authored-by: Patrick Müller <patrick@mueller-patrick.tech>
Co-committed-by: Patrick Müller <patrick@mueller-patrick.tech>

src/common/common.mail.nodemailer.ts

@@ -1,42 +0,0 @@
-import * as nodemailer from 'nodemailer';
-
-export namespace MailService {
-    const transporter = nodemailer.createTransport({
-        host: process.env.EMAIL_HOST,
-        pool: true,
-        port: 465,
-        secure: true,
-        auth: {
-            user: process.env.EMAIL_USERNAME,
-            pass: process.env.EMAIL_PASSWORD
-        },
-        tls: {rejectUnauthorized: false}
-    });
-
-    export interface MailAttachment {
-        filename: string;
-        content: string | Buffer;
-        contentType?: string;
-    }
-
-    export interface SendMailOptions {
-        html?: string;
-        attachments?: MailAttachment[];
-    }
-
-    // Builds a fresh options object per call rather than mutating a shared
-    // module-level one - the transporter is pooled, so overlapping sendMail
-    // calls (e.g. two guests redeeming at once) previously risked one
-    // call's recipient/subject/body being overwritten by another's before
-    // transporter.sendMail() read it.
-    export const sendMail = async (recipientAddress: string, subject: string, body: string, options?: SendMailOptions) => {
-        await transporter.sendMail({
-            from: 'noreply@nachklang.art',
-            to: recipientAddress,
-            subject: subject,
-            text: body,
-            html: options?.html,
-            attachments: options?.attachments
-        });
-    };
-}

src/common/common.mail.ts

@@ -0,0 +1,107 @@
+import logger from '../middleware/logger';
+import {salesforceApexRestPost, salesforceEnabled} from './salesforce.client';
+
+// Transactional email for the ticketing/calendar flows (voucher redemption
+// confirmations, account activation links, password-reset tokens) is relayed
+// through the Nachklang Salesforce org rather than sent over our own SMTP host:
+// that host's IP reputation gets it blocked by allowlist-based receivers
+// (notably t-online.de). Salesforce's MTA plus the org's DKIM signature for
+// nachklang.art get the mail delivered. The org endpoint is EmailSendResource
+// (POST /services/apexrest/email/send); the From address is fixed server-side
+// there and is never sent from here.
+//
+// sendMail never throws on a delivery problem. Every caller has already
+// committed its own work (a registration, a password-reset token, a
+// redemption) by the time mail goes out, so a mail failure must not surface as
+// a user-facing error. It returns whether the mail was accepted so the one
+// caller that shows failures to staff (the voucher confirmation) can record it.
+
+export namespace MailService {
+	export interface MailAttachment {
+		filename: string;
+		content: string | Buffer;
+		contentType?: string;
+	}
+
+	export interface SendMailOptions {
+		html?: string;
+		attachments?: MailAttachment[];
+	}
+
+	interface EmailSendResponse {
+		status: 'SENT';
+	}
+
+	// Practical ceiling, well under Apex REST's 6 MB request-body limit once
+	// base64 inflation (~33%) is accounted for. The only attachment today is a
+	// ~1 KB .ics file.
+	const MAX_ATTACHMENT_BYTES = 3 * 1024 * 1024;
+
+	const isRetriable = (err: any): boolean => {
+		const status = err?.response?.status;
+		if (status !== undefined) {
+			return status >= 500;
+		}
+		// No response at all - network error or timeout.
+		return true;
+	};
+
+	/**
+	 * Relays one email through the Salesforce org. Retries once on a transient
+	 * failure (5xx / network / timeout), then logs and returns false rather
+	 * than throwing. Returns false immediately (without a callout) when the
+	 * Salesforce integration is disabled.
+	 */
+	export const sendMail = async (
+		recipientAddress: string,
+		subject: string,
+		body: string,
+		options?: SendMailOptions
+	): Promise<boolean> => {
+		if (!salesforceEnabled()) {
+			logger.info('MailService: SALESFORCE_ENABLED is false, would have sent', {recipientAddress, subject});
+			return false;
+		}
+
+		let attachments: {filename: string; contentType?: string; contentBase64: string}[];
+		try {
+			attachments = (options?.attachments ?? []).map(attachment => {
+				const buffer = Buffer.isBuffer(attachment.content)
+					? attachment.content
+					: Buffer.from(attachment.content, 'utf-8');
+				if (buffer.byteLength > MAX_ATTACHMENT_BYTES) {
+					throw new Error(`attachment ${attachment.filename} is ${buffer.byteLength} bytes, over the ${MAX_ATTACHMENT_BYTES} limit`);
+				}
+				return {filename: attachment.filename, contentType: attachment.contentType, contentBase64: buffer.toString('base64')};
+			});
+		} catch (err: any) {
+			logger.error('MailService: could not prepare attachments', {recipientAddress, subject, detail: err?.message});
+			return false;
+		}
+
+		const payload = {
+			to: recipientAddress,
+			subject,
+			textBody: body,
+			htmlBody: options?.html ?? null,
+			attachments
+		};
+
+		for (let attempt = 1; attempt <= 2; attempt++) {
+			try {
+				await salesforceApexRestPost<EmailSendResponse>('/services/apexrest/email/send', payload);
+				return true;
+			} catch (err: any) {
+				const status = err?.response?.status;
+				const detail = err?.response?.data?.errorCode || err?.response?.data?.message || err?.message || 'unknown error';
+				if (attempt === 1 && isRetriable(err)) {
+					logger.warn('MailService: send failed, retrying once', {recipientAddress, subject, status, detail});
+					continue;
+				}
+				logger.error('MailService: send failed', {recipientAddress, subject, status, detail});
+				return false;
+			}
+		}
+		return false;
+	};
+}

src/common/salesforce.client.ts

@@ -0,0 +1,66 @@
+import axios from 'axios';
+
+// Shared server-to-server access to the one Nachklang Salesforce org. Both the
+// newsletter-signup sync (feedback module) and the transactional-email relay
+// (common.mail) authenticate the same way - OAuth 2.0 client credentials
+// against the nk_Nachklang_API_Integration external client app - so the token
+// cache and the retry-once-on-401 live here rather than being duplicated.
+//
+// Salesforce's client-credentials token response does not reliably include
+// expires_in, so the cache lifetime is a conservative guess rather than a
+// value read from the response - a 401 on the next call just triggers a fresh
+// fetch (see salesforceApexRestPost).
+
+const TOKEN_CACHE_MS = 15 * 60 * 1000;
+let cachedToken: {accessToken: string; fetchedAt: number} | null = null;
+
+export const salesforceEnabled = (): boolean => process.env.SALESFORCE_ENABLED === 'true';
+
+const readConfig = (): {instanceUrl: string; clientId: string; clientSecret: string} => {
+	const instanceUrl = process.env.SALESFORCE_API_URL;
+	const clientId = process.env.SALESFORCE_CLIENT_ID;
+	const clientSecret = process.env.SALESFORCE_CLIENT_SECRET;
+	if (!instanceUrl || !clientId || !clientSecret) {
+		throw new Error('SALESFORCE_ENABLED is true but SALESFORCE_API_URL/SALESFORCE_CLIENT_ID/SALESFORCE_CLIENT_SECRET are not fully configured.');
+	}
+	return {instanceUrl, clientId, clientSecret};
+};
+
+const getAccessToken = async (forceRefresh: boolean): Promise<string> => {
+	if (!forceRefresh && cachedToken && Date.now() - cachedToken.fetchedAt < TOKEN_CACHE_MS) {
+		return cachedToken.accessToken;
+	}
+
+	const {instanceUrl, clientId, clientSecret} = readConfig();
+	const res = await axios.post(
+		`${instanceUrl}/services/oauth2/token`,
+		new URLSearchParams({grant_type: 'client_credentials', client_id: clientId, client_secret: clientSecret}).toString(),
+		{headers: {'Content-Type': 'application/x-www-form-urlencoded'}, timeout: 10000}
+	);
+	cachedToken = {accessToken: res.data.access_token, fetchedAt: Date.now()};
+	return cachedToken.accessToken;
+};
+
+/**
+ * POSTs a JSON body to an Apex REST path (e.g. '/services/apexrest/newsletter/signup')
+ * and returns the parsed response body. Retries once with a forced token
+ * refresh on a 401 - the server-side token may have expired even though our
+ * conservative local TTL has not. All other errors propagate to the caller.
+ */
+export const salesforceApexRestPost = async <T>(path: string, body: unknown): Promise<T> => {
+	const {instanceUrl} = readConfig();
+	const url = `${instanceUrl}${path}`;
+
+	try {
+		const token = await getAccessToken(false);
+		const res = await axios.post<T>(url, body, {headers: {Authorization: `Bearer ${token}`}, timeout: 10000});
+		return res.data;
+	} catch (err: any) {
+		if (err?.response?.status === 401) {
+			const token = await getAccessToken(true);
+			const res = await axios.post<T>(url, body, {headers: {Authorization: `Bearer ${token}`}, timeout: 10000});
+			return res.data;
+		}
+		throw err;
+	}
+};

src/models/calendar/users/users.service.ts

@@ -4,7 +4,7 @@ import {Guid} from 'guid-typescript';
 import {User} from './user.interface';
 import {Session} from './session.interface';
 import {NachklangCalendarDB} from '../Calendar.db';
-import {MailService} from "../../../common/common.mail.nodemailer";
+import {MailService} from "../../../common/common.mail";
 
 dotenv.config();
 
@@ -54,7 +54,10 @@ export const createUser = async (email: string, password: string, fullName: stri
 			sessionId = row.session_id;
 		}
 
-		// Send email with activation link (after commit so we don't block on email delivery)
+		// Send email with activation link (after commit so we don't block on email
+		// delivery). sendMail never throws on a delivery failure - it logs and
+		// returns false - so a mail-server problem here can't roll back the
+		// already-committed user and leave registration reporting a false error.
 		await MailService.sendMail(email, 'Activate your Nachklang account', `Hi ${fullName},\n\nPlease click on the following link to activate your account:\n\nhttps://api.nachklang.art/calendar/users/activate?id=${userId}&token=${activationToken}`);
 
 		return {

src/models/feedback/integrations/salesforce.service.ts

@@ -1,6 +1,6 @@
-import axios from 'axios';
 import {NachklangFeedbackDB} from '../Feedback.db';
 import logger from '../../../middleware/logger';
+import {salesforceApexRestPost} from '../../../common/salesforce.client';
 
 // Newsletter opt-ins sync to Salesforce, which already runs a full
 // double-opt-in subscription flow (Person Account for existing constituents,
@@ -9,7 +9,8 @@ import logger from '../../../middleware/logger';
 // This is the one file that knows that contract exists; submissions.service.ts
 // only ever calls syncNewsletterSignup(signupId) after its own transaction
 // commits, fire-and-forget, so a Salesforce outage can never delay or fail a
-// visitor's feedback submission.
+// visitor's feedback submission. The OAuth token cache and retry-once-on-401
+// live in common/salesforce.client.ts, shared with the transactional-email relay.
 
 interface SalesforceSuccessResponse {
 	status: 'PENDING_CONFIRMATION' | 'ALREADY_SUBSCRIBED';
@@ -26,54 +27,8 @@ interface NewsletterSignupRow {
 	event_name: string;
 }
 
-// Salesforce's client-credentials token response does not reliably include
-// expires_in, so the cache lifetime is a conservative guess rather than a
-// value read from the response - a 401 on the next call just triggers a
-// fresh fetch (see the retry-once logic in postSignup).
-const TOKEN_CACHE_MS = 15 * 60 * 1000;
-let cachedToken: {accessToken: string; fetchedAt: number} | null = null;
-
-const getAccessToken = async (forceRefresh: boolean): Promise<string> => {
-	if (!forceRefresh && cachedToken && Date.now() - cachedToken.fetchedAt < TOKEN_CACHE_MS) {
-		return cachedToken.accessToken;
-	}
-
-	const instanceUrl = process.env.SALESFORCE_API_URL;
-	const clientId = process.env.SALESFORCE_CLIENT_ID;
-	const clientSecret = process.env.SALESFORCE_CLIENT_SECRET;
-	if (!instanceUrl || !clientId || !clientSecret) {
-		throw new Error('SALESFORCE_ENABLED is true but SALESFORCE_API_URL/SALESFORCE_CLIENT_ID/SALESFORCE_CLIENT_SECRET are not fully configured.');
-	}
-
-	const res = await axios.post(
-		`${instanceUrl}/services/oauth2/token`,
-		new URLSearchParams({grant_type: 'client_credentials', client_id: clientId, client_secret: clientSecret}).toString(),
-		{headers: {'Content-Type': 'application/x-www-form-urlencoded'}, timeout: 10000}
-	);
-	cachedToken = {accessToken: res.data.access_token, fetchedAt: Date.now()};
-	return cachedToken.accessToken;
-};
-
-const postSignup = async (payload: {firstName: string; lastName: string; email: string; eventName: string}): Promise<SalesforceSuccessResponse> => {
-	const instanceUrl = process.env.SALESFORCE_API_URL;
-	const url = `${instanceUrl}/services/apexrest/newsletter/signup`;
-
-	try {
-		const token = await getAccessToken(false);
-		const res = await axios.post<SalesforceSuccessResponse>(url, payload, {headers: {Authorization: `Bearer ${token}`}, timeout: 10000});
-		return res.data;
-	} catch (err: any) {
-		// The cached token may have expired server-side even though our
-		// conservative local TTL hasn't - retry once with a forced refresh
-		// before treating this as a real failure.
-		if (err?.response?.status === 401) {
-			const token = await getAccessToken(true);
-			const res = await axios.post<SalesforceSuccessResponse>(url, payload, {headers: {Authorization: `Bearer ${token}`}, timeout: 10000});
-			return res.data;
-		}
-		throw err;
-	}
-};
+const postSignup = (payload: {firstName: string; lastName: string; email: string; eventName: string}): Promise<SalesforceSuccessResponse> =>
+	salesforceApexRestPost<SalesforceSuccessResponse>('/services/apexrest/newsletter/signup', payload);
 
 const markSynced = async (signupId: number, externalId: string): Promise<void> => {
 	let conn = await NachklangFeedbackDB.getConnection();

src/models/tickets/admin/redemptions.admin.router.ts

@@ -204,6 +204,55 @@ redemptionsAdminRouter.post('/:redemptionId/undo', async (req: Request, res: Res
 	}
 });
 
+/**
+ * @swagger
+ * /tickets/admin/redemptions/{redemptionId}/resend-confirmation:
+ *      post:
+ *          summary: Resend the redemption confirmation email
+ *          description: Rebuilds the confirmation email from the stored redemption data and sends it again, then records the outcome on the redemption. Intended for redemptions whose original confirmation email failed.
+ *          tags: [tickets-admin]
+ *          parameters:
+ *              - $ref: '#/components/parameters/SessionIdHeader'
+ *              - $ref: '#/components/parameters/SessionKeyHeader'
+ *              - in: path
+ *                name: redemptionId
+ *                required: true
+ *                schema:
+ *                    type: integer
+ *          responses:
+ *              200:
+ *                  description: The email was accepted for delivery
+ *              404:
+ *                  description: Unknown redemption
+ *              409:
+ *                  description: Redemption is not active
+ *              502:
+ *                  description: The email relay rejected the send
+ *              401:
+ *                  description: Unauthorized
+ */
+redemptionsAdminRouter.post('/:redemptionId/resend-confirmation', async (req: Request, res: Response) => {
+	try {
+		const result = await RedemptionsAdminService.resendRedemptionConfirmation(Number(req.params.redemptionId));
+		switch (result) {
+			case 'SENT':
+				res.status(200).send({status: 'OK'});
+				return;
+			case 'NOT_FOUND':
+				res.status(404).send({status: 'NOT_FOUND'});
+				return;
+			case 'NOT_ACTIVE':
+				res.status(409).send({status: 'NOT_ACTIVE', message: 'This redemption is not active.'});
+				return;
+			case 'FAILED':
+				res.status(502).send({status: 'SEND_FAILED', message: 'Die E-Mail konnte nicht versendet werden. Bitte später erneut versuchen.'});
+				return;
+		}
+	} catch (e: any) {
+		sendServerError(res, e);
+	}
+});
+
 /**
  * @swagger
  * /tickets/admin/vouchers/{code}/history:

src/models/tickets/admin/redemptions.admin.service.ts

@@ -1,5 +1,6 @@
 import {NachklangTicketsDB} from '../Tickets.db';
 import {getEventTicketState} from '../tickets.capacity';
+import {recordConfirmationEmailResult, sendRedemptionConfirmation} from '../tickets.confirmation-email';
 import {AuditLogEntry, RedemptionSummary} from '../tickets.interface';
 import {isValidEmail} from '../tickets.validation';
 
@@ -13,7 +14,8 @@ const mapRedemptionRow = (row: any, guests: string[]): RedemptionSummary => ({
 	contactAddress: row.contact_address,
 	guestCount: row.guest_count,
 	guests,
-	redeemedAt: row.redeemed_at
+	redeemedAt: row.redeemed_at,
+	confirmationEmailStatus: row.confirmation_email_status ?? null
 });
 
 export interface ListRedemptionsFilter {
@@ -227,6 +229,29 @@ export const editRedemption = async (redemptionId: number, input: EditRedemption
 	}
 };
 
+export type ResendConfirmationResult = 'SENT' | 'FAILED' | 'NOT_FOUND' | 'NOT_ACTIVE';
+
+/**
+ * Rebuilds and re-sends the redemption confirmation email from the stored
+ * redemption data, then records the new outcome on the row. Used by the admin
+ * UI's "resend" action on a redemption whose confirmation email failed. Only
+ * active redemptions can be resent.
+ */
+export const resendRedemptionConfirmation = async (redemptionId: number): Promise<ResendConfirmationResult> => {
+	const redemption = await getRedemption(redemptionId);
+	if (!redemption) return 'NOT_FOUND';
+	if (redemption.status !== 'ACTIVE') return 'NOT_ACTIVE';
+
+	const sent = await sendRedemptionConfirmation({
+		eventId: redemption.eventId,
+		contactName: redemption.contactName,
+		contactEmail: redemption.contactEmail,
+		guestNames: redemption.guests
+	});
+	await recordConfirmationEmailResult(redemptionId, sent);
+	return sent ? 'SENT' : 'FAILED';
+};
+
 export const getAuditHistory = async (code: string): Promise<AuditLogEntry[]> => {
 	let conn = await NachklangTicketsDB.getConnection();
 	try {

src/models/tickets/public/voucher.public.service.ts

@@ -1,20 +1,11 @@
 import * as EventsService from '../../calendar/events/events.service';
-import * as IcalService from '../../calendar/events/icalgenerator.service';
-import {MailService} from '../../../common/common.mail.nodemailer';
 import logger from '../../../middleware/logger';
 import {NachklangTicketsDB} from '../Tickets.db';
 import {getEventTicketState} from '../tickets.capacity';
+import {recordConfirmationEmailResult, sendRedemptionConfirmation} from '../tickets.confirmation-email';
 import {EligibleEvent, RedeemRequest, VoucherValidation} from '../tickets.interface';
 import {isValidEmail} from '../tickets.validation';
 
-const formatGermanDateTime = (date: Date): string => {
-	return new Intl.DateTimeFormat('de-DE', {
-		dateStyle: 'full',
-		timeStyle: 'short',
-		timeZone: 'Europe/Berlin'
-	}).format(date);
-};
-
 /**
  * Builds the eligible-events list for a code: for each event it's linked
  * to, merges live Calendar event details with the Tickets module's own
@@ -173,43 +164,21 @@ export const redeemVoucher = async (code: string, request: RedeemRequest): Promi
 	}
 
 	// Sent after commit, mirroring the Calendar/Feedback convention: a mail
-	// delivery failure shouldn't roll back a successful redemption. Caught
-	// rather than left to propagate - the redemption already succeeded, so
-	// a mail-server hiccup must not turn into a false failure response to
-	// a guest who has, in fact, already secured their spot.
+	// delivery failure shouldn't roll back a successful redemption, and the
+	// guest has in fact already secured their spot. The send itself no longer
+	// throws on a delivery problem; its result is recorded on the redemption
+	// so staff can spot and resend a failed confirmation from the admin UI.
 	try {
-		await sendConfirmationEmail(eventId, request, redemptionId);
+		const sent = await sendRedemptionConfirmation({
+			eventId,
+			contactName: request.contactName,
+			contactEmail: request.contactEmail,
+			guestNames: request.guests.map(g => g.name)
+		});
+		await recordConfirmationEmailResult(redemptionId, sent);
 	} catch (e: any) {
-		logger.error('Redemption ' + redemptionId + ' succeeded but confirmation email failed to send: ' + e.message);
+		logger.error('Redemption ' + redemptionId + ' committed but the confirmation email step failed: ' + e.message);
 	}
 
 	return {status: 'OK', redemptionId};
 };
-
-const sendConfirmationEmail = async (eventId: number, request: RedeemRequest, redemptionId: number): Promise<void> => {
-	const event = await EventsService.getEventById(eventId);
-	if (!event) return;
-
-	const guestList = request.guests.map(g => `- ${g.name}`).join('\n');
-	const body = `Hallo ${request.contactName},\n\n` +
-		`vielen Dank für deine Anmeldung zu "${event.name}"!\n\n` +
-		`Termin: ${formatGermanDateTime(event.startDateTime)}\n` +
-		`Ort: ${event.location}\n\n` +
-		`Angemeldete Gäste:\n${guestList}\n\n` +
-		`Wir freuen uns auf dich!\n\nDein Nachklang-Team`;
-
-	let icsAttachment;
-	try {
-		const ics = await IcalService.convertToIcal([event]);
-		icsAttachment = [{filename: 'konzert.ics', content: ics, contentType: 'text/calendar'}];
-	} catch {
-		icsAttachment = undefined;
-	}
-
-	await MailService.sendMail(
-		request.contactEmail,
-		`Bestätigung: ${event.name}`,
-		body,
-		{attachments: icsAttachment}
-	);
-};

src/models/tickets/tickets.confirmation-email.ts

@@ -0,0 +1,76 @@
+import * as EventsService from '../calendar/events/events.service';
+import * as IcalService from '../calendar/events/icalgenerator.service';
+import {MailService} from '../../common/common.mail';
+import logger from '../../middleware/logger';
+import {NachklangTicketsDB} from './Tickets.db';
+
+export type ConfirmationEmailStatus = 'SENT' | 'FAILED';
+
+// The redemption confirmation email is built and sent from here so the public
+// redeem path and the admin "resend" action share one copy of the German text
+// and the .ics attachment logic.
+
+const formatGermanDateTime = (date: Date): string =>
+	new Intl.DateTimeFormat('de-DE', {
+		dateStyle: 'full',
+		timeStyle: 'short',
+		timeZone: 'Europe/Berlin'
+	}).format(date);
+
+export interface ConfirmationRecipient {
+	eventId: number;
+	contactName: string;
+	contactEmail: string;
+	guestNames: string[];
+}
+
+/**
+ * Sends the redemption confirmation email for one redemption. Returns whether
+ * the mail was accepted by the relay. Never throws: a missing event is treated
+ * as "not sent", and MailService.sendMail already swallows delivery failures.
+ */
+export const sendRedemptionConfirmation = async (recipient: ConfirmationRecipient): Promise<boolean> => {
+	const event = await EventsService.getEventById(recipient.eventId);
+	if (!event) {
+		logger.error('Confirmation email skipped: event ' + recipient.eventId + ' no longer exists');
+		return false;
+	}
+
+	const guestList = recipient.guestNames.map(name => `- ${name}`).join('\n');
+	const body =
+		`Hallo ${recipient.contactName},\n\n` +
+		`vielen Dank für deine Anmeldung zu "${event.name}"!\n\n` +
+		`Termin: ${formatGermanDateTime(event.startDateTime)}\n` +
+		`Ort: ${event.location}\n\n` +
+		`Angemeldete Gäste:\n${guestList}\n\n` +
+		`Wir freuen uns auf dich!\n\nDein Nachklang-Team`;
+
+	let icsAttachment;
+	try {
+		const ics = await IcalService.convertToIcal([event]);
+		icsAttachment = [{filename: 'konzert.ics', content: ics, contentType: 'text/calendar'}];
+	} catch (e: any) {
+		// Non-fatal: the confirmation still goes out, just without the calendar file.
+		logger.warn('Confirmation email for event ' + recipient.eventId + ' sent without .ics attachment: ' + e?.message);
+		icsAttachment = undefined;
+	}
+
+	return MailService.sendMail(recipient.contactEmail, `Bestätigung: ${event.name}`, body, {attachments: icsAttachment});
+};
+
+/**
+ * Records the outcome of a confirmation-email send on the redemption row so the
+ * admin UI can flag failures. Best-effort: a failure to write the flag is
+ * logged, never thrown - the redemption itself already succeeded.
+ */
+export const recordConfirmationEmailResult = async (redemptionId: number, sent: boolean): Promise<void> => {
+	const status: ConfirmationEmailStatus = sent ? 'SENT' : 'FAILED';
+	let conn = await NachklangTicketsDB.getConnection();
+	try {
+		await conn.query('UPDATE redemptions SET confirmation_email_status = ? WHERE redemption_id = ?', [status, redemptionId]);
+	} catch (err: any) {
+		logger.error('Could not record confirmation email status for redemption ' + redemptionId + ': ' + err?.message);
+	} finally {
+		await conn.end();
+	}
+};

src/models/tickets/tickets.interface.ts

@@ -109,6 +109,11 @@
  *         redeemedAt:
  *           type: string
  *           format: date-time
+ *         confirmationEmailStatus:
+ *           type: string
+ *           enum: [SENT, FAILED]
+ *           nullable: true
+ *           description: Outcome of the redemption confirmation email. null until the send resolves.
  *     VoucherCode:
  *       type: object
  *       required: [code, status, maxGuests, createdByEmail, createdAt, eligibleEventIds]
@@ -258,6 +263,8 @@ export interface RedemptionSummary {
 	guestCount: number;
 	guests: string[];
 	redeemedAt: Date;
+	// null until the post-redemption confirmation email send resolves.
+	confirmationEmailStatus: 'SENT' | 'FAILED' | null;
 }
 
 export interface VoucherCode {