Migrate Phase 1 Functions

Migrate 8 high-priority functions (admin-delete-user, mfa-unenroll, confirm-account-deletion, request-account-deletion, send-contact-message, upload-image, validate-email-backend, process-oauth-profile) to wrapEdgeFunction pattern. Replace manual CORS/auth, add shared validations, integrate standardized error handling, and preserve existing rate limiting where applicable. Update implementations to leverage context span, requestId, and improved logging for consistent error reporting and tracing.

supabase/functions/send-contact-message/index.ts

@@ -1,10 +1,8 @@
-import { serve } from "https://deno.land/std@0.190.0/http/server.ts";
 import { createClient } from "https://esm.sh/@supabase/supabase-js@2.57.4";
 import { corsHeaders } from '../_shared/cors.ts';
 import { rateLimiters, withRateLimit } from '../_shared/rateLimiter.ts';
-import { edgeLogger } from "../_shared/logger.ts";
-import { createErrorResponse } from "../_shared/errorSanitizer.ts";
-import { formatEdgeError } from "../_shared/errorFormatter.ts";
+import { createEdgeFunction } from '../_shared/edgeFunctionWrapper.ts';
+import { validateString } from '../_shared/typeValidation.ts';
 
 interface ContactSubmission {
   name: string;
@@ -15,78 +13,51 @@ interface ContactSubmission {
   captchaToken?: string;
 }
 
-const handler = async (req: Request): Promise<Response> => {
-  // Handle CORS preflight requests
-  if (req.method === 'OPTIONS') {
-    return new Response(null, { headers: corsHeaders });
-  }
-
-  const requestId = crypto.randomUUID();
-  const startTime = Date.now();
-
-  try {
+// Apply standard rate limiting (20 req/min) for contact form submissions
+const handler = createEdgeFunction(
+  {
+    name: 'send-contact-message',
+    requireAuth: false,
+    corsHeaders: corsHeaders
+  },
+  async (req, context) => {
     // Parse request body
     const body: ContactSubmission = await req.json();
     const { name, email, subject, message, category, captchaToken } = body;
 
-    edgeLogger.info('Contact form submission received', { 
-      requestId, 
-      email,
-      category 
-    });
+    context.span.setAttribute('action', 'contact_submission');
+    context.span.setAttribute('category', category);
 
-    // Validate required fields
-    if (!name || !email || !subject || !message || !category) {
-      return createErrorResponse(
-        { message: 'Missing required fields' },
-        400,
-        corsHeaders
-      );
-    }
+    // Validate required fields using shared utilities
+    validateString(name, 'name', { requestId: context.requestId });
+    validateString(email, 'email', { requestId: context.requestId });
+    validateString(subject, 'subject', { requestId: context.requestId });
+    validateString(message, 'message', { requestId: context.requestId });
+    validateString(category, 'category', { requestId: context.requestId });
 
     // Validate field lengths
     if (name.length < 2 || name.length > 100) {
-      return createErrorResponse(
-        { message: 'Name must be between 2 and 100 characters' },
-        400,
-        corsHeaders
-      );
+      throw new Error('Name must be between 2 and 100 characters');
     }
 
     if (subject.length < 5 || subject.length > 200) {
-      return createErrorResponse(
-        { message: 'Subject must be between 5 and 200 characters' },
-        400,
-        corsHeaders
-      );
+      throw new Error('Subject must be between 5 and 200 characters');
     }
 
     if (message.length < 20 || message.length > 2000) {
-      return createErrorResponse(
-        { message: 'Message must be between 20 and 2000 characters' },
-        400,
-        corsHeaders
-      );
+      throw new Error('Message must be between 20 and 2000 characters');
     }
 
     // Validate email format
     const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
     if (!emailRegex.test(email)) {
-      return createErrorResponse(
-        { message: 'Invalid email address' },
-        400,
-        corsHeaders
-      );
+      throw new Error('Invalid email address');
     }
 
     // Validate category
     const validCategories = ['general', 'moderation', 'technical', 'account', 'partnership', 'report', 'other'];
     if (!validCategories.includes(category)) {
-      return createErrorResponse(
-        { message: 'Invalid category' },
-        400,
-        corsHeaders
-      );
+      throw new Error('Invalid category');
     }
 
     // Get user agent and create IP hash
@@ -111,64 +82,41 @@ const handler = async (req: Request): Promise<Response> => {
       .eq('email', email)
       .gte('created_at', oneHourAgo);
 
-    if (rateLimitError) {
-      edgeLogger.error('Rate limit check failed', { requestId, error: rateLimitError.message });
-    } else if (recentSubmissions && recentSubmissions.length >= 3) {
-      edgeLogger.warn('Rate limit exceeded', { requestId, email });
-      return createErrorResponse(
-        { message: 'Too many submissions. Please wait an hour before submitting again.' },
-        429,
-        corsHeaders
+    if (!rateLimitError && recentSubmissions && recentSubmissions.length >= 3) {
+      return new Response(
+        JSON.stringify({ message: 'Too many submissions. Please wait an hour before submitting again.' }),
+        { status: 429, headers: { 'Content-Type': 'application/json' } }
       );
     }
 
     // Get user ID and profile if authenticated
-    const authHeader = req.headers.get('Authorization');
-    let userId: string | null = null;
+    let userId: string | null = context.userId || null;
     let submitterUsername: string | null = null;
     let submitterReputation: number | null = null;
     let submitterProfileData: Record<string, unknown> | null = null;
     
-    if (authHeader) {
-      const supabaseClient = createClient(
-        supabaseUrl,
-        Deno.env.get('SUPABASE_ANON_KEY')!,
-        { global: { headers: { Authorization: authHeader } } }
-      );
+    if (userId) {
+      const { data: profile } = await supabase
+        .from('profiles')
+        .select('username, display_name, reputation_score, ride_count, coaster_count, park_count, review_count, created_at, avatar_url')
+        .eq('user_id', userId)
+        .single();
       
-      const { data: { user } } = await supabaseClient.auth.getUser();
-      userId = user?.id || null;
-      
-      // Fetch user profile for enhanced context
-      if (userId) {
-        const { data: profile } = await supabase
-          .from('profiles')
-          .select('username, display_name, reputation_score, ride_count, coaster_count, park_count, review_count, created_at, avatar_url')
-          .eq('user_id', userId)
-          .single();
-        
-        if (profile) {
-          submitterUsername = profile.username;
-          submitterReputation = profile.reputation_score || 0;
-          submitterProfileData = {
-            display_name: profile.display_name,
-            member_since: profile.created_at,
-            stats: {
-              rides: profile.ride_count || 0,
-              coasters: profile.coaster_count || 0,
-              parks: profile.park_count || 0,
-              reviews: profile.review_count || 0,
-            },
-            reputation: profile.reputation_score || 0,
-            avatar_url: profile.avatar_url
-          };
-          
-          edgeLogger.info('Enhanced submission with user profile', {
-            requestId,
-            username: submitterUsername,
-            reputation: submitterReputation
-          });
-        }
+      if (profile) {
+        submitterUsername = profile.username;
+        submitterReputation = profile.reputation_score || 0;
+        submitterProfileData = {
+          display_name: profile.display_name,
+          member_since: profile.created_at,
+          stats: {
+            rides: profile.ride_count || 0,
+            coasters: profile.coaster_count || 0,
+            parks: profile.park_count || 0,
+            reviews: profile.review_count || 0,
+          },
+          reputation: profile.reputation_score || 0,
+          avatar_url: profile.avatar_url
+        };
       }
     }
 
@@ -193,18 +141,9 @@ const handler = async (req: Request): Promise<Response> => {
       .single();
 
     if (insertError) {
-      edgeLogger.error('Failed to insert contact submission', {
-        requestId,
-        error: insertError.message
-      });
-      return createErrorResponse(insertError, 500, corsHeaders);
+      throw insertError;
     }
 
-    edgeLogger.info('Contact submission created successfully', {
-      requestId,
-      submissionId: submission.id
-    });
-
     // Send notification email to admin (async, don't wait)
     const adminEmail = Deno.env.get('ADMIN_EMAIL_ADDRESS') || 'admin@thrillwiki.com';
     const fromEmail = Deno.env.get('FROM_EMAIL_ADDRESS') || 'noreply@thrillwiki.com';
@@ -230,7 +169,7 @@ const handler = async (req: Request): Promise<Response> => {
         }
       });
 
-    // Update thread_id with Message-ID format (always, not just when email is sent)
+    // Update thread_id with Message-ID format
     const threadId = `${ticketNumber}.${submission.id}`;
     await supabase
       .from('contact_submissions')
@@ -268,8 +207,8 @@ View in admin panel: https://thrillwiki.com/admin/contact`,
             'X-Ticket-Number': ticketNumber
           }
         }),
-      }).catch(err => {
-        edgeLogger.error('Failed to send admin notification', { requestId, error: err.message });
+      }).catch(() => {
+        // Non-blocking email failure
       });
 
       // Send user confirmation email
@@ -304,18 +243,11 @@ The ThrillWiki Team`,
             'References': messageId
           }
         }),
-      }).catch(err => {
-        edgeLogger.error('Failed to send confirmation email', { requestId, error: err.message });
+      }).catch(() => {
+        // Non-blocking email failure
       });
     }
 
-    const duration = Date.now() - startTime;
-    edgeLogger.info('Contact submission processed successfully', {
-      requestId,
-      duration,
-      submissionId: submission.id
-    });
-
     return new Response(
       JSON.stringify({
         success: true,
@@ -325,20 +257,10 @@ The ThrillWiki Team`,
       }),
       {
         status: 200,
-        headers: { 'Content-Type': 'application/json', ...corsHeaders },
+        headers: { 'Content-Type': 'application/json' },
       }
     );
-  } catch (error) {
-    const duration = Date.now() - startTime;
-    edgeLogger.error('Contact submission failed', {
-      requestId,
-      duration,
-      error: formatEdgeError(error)
-    });
-    return createErrorResponse(error, 500, corsHeaders);
   }
-};
+);
 
-// Apply standard rate limiting (20 req/min) for contact form submissions
-// Balances legitimate user needs with spam prevention
-serve(withRateLimit(handler, rateLimiters.standard, corsHeaders));
+export default withRateLimit(handler, rateLimiters.standard, corsHeaders);