{"record":{"id":"7e37d0a8d88d7cb2","repo":"kriasoft/react-starter-kit","slug":"invalid-email-address-email","errorCode":null,"errorMessage":"Invalid email address: ${email}","messagePattern":"Invalid email address: (.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"apps/api/lib/email.ts","lineNumber":39,"sourceCode":"type EmailEnv = Pick<Env, \"RESEND_API_KEY\" | \"RESEND_EMAIL_FROM\">;\n\ntype TemplateEnv = EmailEnv & Pick<Env, \"APP_NAME\" | \"APP_ORIGIN\">;\n\n/**\n * Send an email using the Resend client.\n *\n * @param env Environment variables containing Resend configuration\n * @param options Email configuration\n */\nexport async function sendEmail(env: EmailEnv, options: EmailOptions) {\n  const emailSchema = z.email();\n\n  // Validate all recipients before sending\n  const recipients = Array.isArray(options.to) ? options.to : [options.to];\n  for (const email of recipients) {\n    const result = emailSchema.safeParse(email);\n    if (!result.success) {\n      throw new Error(`Invalid email address: ${email}`);\n    }\n  }\n\n  if (!env.RESEND_API_KEY) {\n    throw new Error(\"RESEND_API_KEY environment variable is required\");\n  }\n\n  if (!env.RESEND_EMAIL_FROM) {\n    throw new Error(\"RESEND_EMAIL_FROM environment variable is required\");\n  }\n\n  // A fresh client per send: the Workers runtime reuses an isolate across\n  // requests, and a module-level client would outlive the env it was built from.\n  const resend = new Resend(env.RESEND_API_KEY);\n\n  try {\n    const result = await resend.emails.send({\n      from: options.from || env.RESEND_EMAIL_FROM,","sourceCodeStart":21,"sourceCodeEnd":57,"githubUrl":"https://github.com/kriasoft/react-starter-kit/blob/0aa7603435f16159ad0b8fef68fb7f6280be7ca1/apps/api/lib/email.ts#L21-L57","documentation":"sendEmail() validates every recipient with the Zod schema z.email() before touching the Resend client. If any address in options.to (string or array) fails safeParse, it throws this plain Error with the offending address interpolated. It is a pre-flight guard so malformed recipients never reach the provider API.","triggerScenarios":"Calling sendVerificationEmail/sendPasswordReset/sendOTP with a user.email that is empty, missing an @, contains spaces, or any sendEmail call with options.to being '', 'not-an-email', or an array containing such a value.","commonSituations":"Unverified user-supplied input stored in the database (e.g. legacy rows or OAuth accounts without an email), concatenating form fields incorrectly, or passing a display string like 'Jane <jane@x.com>' instead of a bare address.","solutions":["Log the interpolated address in the message and fix the upstream code or data that produced it","Validate the recipient with z.email().safeParse() (or check it with a regex) before calling any send* function","Treat 'Jane <jane@x.com>' style headers as invalid: strip to the bare address or use Resend's displayName support on the 'from' field, not 'to'","Add a NOT NULL / format constraint on the email column in the database to stop bad values at write time"],"exampleFix":"// before\nawait sendOTP(env, { email: userInput.name + '@', otp, type: 'sign-in' });\n// after\nconst parsed = z.email().safeParse(userInput.email);\nif (!parsed.success) return { ok: false, reason: 'invalid-email' };\nawait sendOTP(env, { email: parsed.data, otp, type: 'sign-in' });","handlingStrategy":"validation","validationCode":"import { z } from 'zod';\nconst emailSchema = z.email();\nfunction assertValidRecipient(to: string | string[]) {\n  const list = Array.isArray(to) ? to : [to];\n  for (const e of list) {\n    const r = emailSchema.safeParse(e.trim());\n    if (!r.success) throw new Error(`Refusing to send: invalid recipient '${e}'`);\n  }\n}","typeGuard":"function isValidEmail(value: unknown): value is string {\n  return typeof value === 'string' && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(value);\n}","tryCatchPattern":"try {\n  await sendVerificationEmail(env, { user, url });\n} catch (error) {\n  if (error instanceof Error && error.message.startsWith('Invalid email address:')) {\n    // surface a field-level validation error to the user, not a 500\n    return { ok: false, field: 'email', message: 'Please provide a valid email address' };\n  }\n  throw error;\n}","preventionTips":["Validate email at every write boundary (forms, OAuth profile import) with z.email()","Never store display-name formatted strings ('Name <a@b.com>') in the email column","Reject empty/whitespace strings early instead of letting them reach sendEmail","Add DB constraints (NOT NULL + application-level format check) so bad values can't persist"],"tags":["validation","zod","email"],"backgroundTag":"email-address-validation-failed","analyzedSha":"0aa7603435f16159ad0b8fef68fb7f6280be7ca1","analyzedAt":"2026-08-31T21:50:55.742Z","schemaVersion":2},"datasetVersion":"2026-08-31T22:30:34.772Z"}