feat: tabs and a rendered preview for the email templates (#119)

Follow-up to #92, which shipped the editable templates as a column of stacked cards.

With six templates the cart reminder sat below five editors, so reaching it meant scrolling past all of them and which one you were editing was knowable only from a card title you had already scrolled past. They are tabs now, and the Default/Customised tag moves onto the tab label, so which templates have been changed is visible without opening each one.

The larger gap was that there was no way to see what the email would look like. The editor is a markdown textarea; what gets sent is rendered HTML with placeholders substituted and, for the two favorite templates, a consent footer appended by the server. An admin editing copy could not tell whether the result read correctly.

POST /api/admin/email-templates/:key/preview renders the draft in the editor rather than what is stored, so the effect of an edit is visible before committing to it. It renders on the server deliberately: renderTemplate is the only thing in the system that turns this markdown into HTML, and markdown-it is configured there with html: false, which is the control that stops an admin putting script into a customer's inbox. A renderer in the browser would be a second implementation of both, and a preview that disagreed with the mailer would be worse than none. It does not enforce required placeholders - saving refuses a body that dropped one, and previewing it is how the admin sees what they have done.

The preview renders into a sandboxed iframe rather than through dangerouslySetInnerHTML. The markup is safe by construction, but an email is its own styling context: rendered inline, the admin theme's CSS would change how it looks and the preview would lie about the result.

Sample values live beside the template definitions rather than in the route, so adding a placeholder puts the missing sample next to the change that needs it. A unit test asserts every available placeholder has one, because a missing sample renders a literal {{placeholder}} into the preview and teaches the admin their copy is broken when it is not.

This also fixes a test that has been failing on main. email-templates.spec.ts located the Save button by filtering .ant-card for the template name, which matched an outer card containing every template's Save button - six of them - and died on a strict mode violation, taking two more tests with it as unrun. Only the active tab's editor is mounted now, so the labels are unambiguous and the filter is gone.

Verification: eight end-to-end tests, four for editing and four for the preview, covering the draft being previewed rather than the stored copy, sample values replacing placeholders, raw HTML being escaped exactly as the mailer escapes it, and the consent footer appearing on a favorite template and not on a password reset. The full suite goes from 100 passed / 3 failed / 2 unrun to 112 passed / 2 failed / 0 unrun; the two that remain are the pre-existing password-reset failures that need a database on port 55432 and fail identically on main. 38 backend unit tests pass, tsc and ESLint are clean.

Closes #119
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

frontend/src/admin/EmailTemplateCard.tsx

@@ -1,115 +0,0 @@
-import { useState } from 'react';
-import Card from 'antd/es/card';
-import Input from 'antd/es/input';
-import Button from 'antd/es/button';
-import Space from 'antd/es/space';
-import Tag from 'antd/es/tag';
-import Typography from 'antd/es/typography';
-import message from 'antd/es/message';
-import { EmailTemplate, saveEmailTemplate, resetEmailTemplate } from './emailTemplatesApi';
-
-const { Text, Paragraph } = Typography;
-
-type Props = Readonly<{
-  template: EmailTemplate;
-  onChanged: (updated: EmailTemplate) => void;
-}>;
-
-export default function EmailTemplateCard({ template, onChanged }: Props) {
-  // Falls back to the default so the editor starts from the real copy rather
-  // than an empty box. `subject`/`body` being null means "never customised",
-  // which is why the badge below can say so.
-  const [subject, setSubject] = useState(template.subject ?? template.defaultSubject);
-  const [body, setBody] = useState(template.body ?? template.defaultBody);
-  const [saving, setSaving] = useState(false);
-
-  const customised = template.subject !== null || template.body !== null;
-
-  async function handleSave() {
-    setSaving(true);
-    try {
-      const updated = await saveEmailTemplate(template.key, subject, body);
-      onChanged(updated);
-      message.success(`${template.label} saved`);
-    } catch (err) {
-      // The server's refusal names the placeholder that is missing, which is
-      // the only useful thing to say here — so it is shown rather than replaced
-      // with something generic.
-      message.error((err as Error).message);
-    } finally {
-      setSaving(false);
-    }
-  }
-
-  async function handleReset() {
-    setSaving(true);
-    try {
-      const restored = await resetEmailTemplate(template.key);
-      setSubject(template.defaultSubject);
-      setBody(template.defaultBody);
-      onChanged(restored);
-      message.success(`${template.label} restored to the default`);
-    } catch (err) {
-      message.error((err as Error).message);
-    } finally {
-      setSaving(false);
-    }
-  }
-
-  return (
-    <Card
-      style={{ marginBottom: 16 }}
-      title={
-        <Space>
-          {template.label}
-          {customised ? <Tag color="blue">Customised</Tag> : <Tag>Default</Tag>}
-        </Space>
-      }
-    >
-      <Paragraph type="secondary" style={{ marginBottom: 8 }}>
-        Markdown. Placeholders are replaced when the email is sent
-        {template.required.length > 0 && (
-          <>
-            {' '}— <Text strong>{template.required.map((n) => `{{${n}}}`).join(' and ')}</Text>{' '}
-            {template.required.length === 1 ? 'is' : 'are'} required and cannot be removed
-          </>
-        )}
-        .
-      </Paragraph>
-
-      <Space wrap size={[4, 4]} style={{ marginBottom: 12 }}>
-        {template.available.map((name) => (
-          <Tag key={name} style={{ fontFamily: 'monospace' }}>{`{{${name}}}`}</Tag>
-        ))}
-      </Space>
-
-      <Input
-        aria-label={`${template.label} subject`}
-        value={subject}
-        onChange={(e) => setSubject(e.target.value)}
-        placeholder="Subject"
-        style={{ marginBottom: 8 }}
-      />
-      <Input.TextArea
-        aria-label={`${template.label} body`}
-        value={body}
-        onChange={(e) => setBody(e.target.value)}
-        autoSize={{ minRows: 6, maxRows: 16 }}
-        style={{ fontFamily: 'monospace', marginBottom: 12 }}
-      />
-
-      <Space>
-        <Button type="primary" loading={saving} onClick={handleSave}>
-          Save
-        </Button>
-        {/* Only offered when there is something to restore, so the button is
-            not a no-op that looks like it did something. */}
-        {customised && (
-          <Button loading={saving} onClick={handleReset}>
-            Restore default
-          </Button>
-        )}
-      </Space>
-    </Card>
-  );
-}

frontend/src/admin/EmailTemplateEditor.tsx

@@ -0,0 +1,170 @@
+import { useEffect, useState } from 'react';
+import Input from 'antd/es/input';
+import Button from 'antd/es/button';
+import Space from 'antd/es/space';
+import Tag from 'antd/es/tag';
+import Row from 'antd/es/row';
+import Col from 'antd/es/col';
+import Alert from 'antd/es/alert';
+import Typography from 'antd/es/typography';
+import message from 'antd/es/message';
+import {
+  EmailTemplate,
+  saveEmailTemplate,
+  resetEmailTemplate,
+  previewEmailTemplate
+} from './emailTemplatesApi';
+
+const { Text, Paragraph } = Typography;
+
+type Props = Readonly<{
+  template: EmailTemplate;
+  onChanged: (updated: EmailTemplate) => void;
+}>;
+
+// Long enough that the preview is not re-rendered on every keystroke, short
+// enough that it feels like it is following what you type.
+const PREVIEW_DEBOUNCE_MS = 400;
+
+export default function EmailTemplateEditor({ template, onChanged }: Props) {
+  // Falls back to the default so the editor starts from the real copy rather
+  // than an empty box. `subject`/`body` being null means "never customised",
+  // which is why the badge on the tab can say so.
+  const [subject, setSubject] = useState(template.subject ?? template.defaultSubject);
+  const [body, setBody] = useState(template.body ?? template.defaultBody);
+  const [saving, setSaving] = useState(false);
+  const [preview, setPreview] = useState<{ subject: string; html: string } | null>(null);
+  const [previewError, setPreviewError] = useState<string | null>(null);
+
+  const customised = template.subject !== null || template.body !== null;
+
+  // Previews the draft in the editor, not what is stored, so the effect of an
+  // edit is visible before committing to it. Debounced, and the timer is
+  // cleared on change so an abandoned keystroke never issues a request.
+  useEffect(() => {
+    const timer = setTimeout(() => {
+      previewEmailTemplate(template.key, subject, body)
+        .then((rendered) => {
+          setPreview(rendered);
+          setPreviewError(null);
+        })
+        .catch((err: Error) => setPreviewError(err.message));
+    }, PREVIEW_DEBOUNCE_MS);
+    return () => clearTimeout(timer);
+  }, [template.key, subject, body]);
+
+  async function handleSave() {
+    setSaving(true);
+    try {
+      const updated = await saveEmailTemplate(template.key, subject, body);
+      onChanged(updated);
+      message.success(`${template.label} saved`);
+    } catch (err) {
+      // The server's refusal names the placeholder that is missing, which is
+      // the only useful thing to say here — so it is shown rather than replaced
+      // with something generic.
+      message.error((err as Error).message);
+    } finally {
+      setSaving(false);
+    }
+  }
+
+  async function handleReset() {
+    setSaving(true);
+    try {
+      const restored = await resetEmailTemplate(template.key);
+      setSubject(template.defaultSubject);
+      setBody(template.defaultBody);
+      onChanged(restored);
+      message.success(`${template.label} restored to the default`);
+    } catch (err) {
+      message.error((err as Error).message);
+    } finally {
+      setSaving(false);
+    }
+  }
+
+  return (
+    <Row gutter={24}>
+      <Col xs={24} lg={13}>
+        <Paragraph type="secondary" style={{ marginBottom: 8 }}>
+          Markdown. Placeholders are replaced when the email is sent
+          {template.required.length > 0 && (
+            <>
+              {' '}— <Text strong>{template.required.map((n) => `{{${n}}}`).join(' and ')}</Text>{' '}
+              {template.required.length === 1 ? 'is' : 'are'} required and cannot be removed
+            </>
+          )}
+          .
+        </Paragraph>
+
+        <Space wrap size={[4, 4]} style={{ marginBottom: 12 }}>
+          {template.available.map((name) => (
+            <Tag key={name} style={{ fontFamily: 'monospace' }}>{`{{${name}}}`}</Tag>
+          ))}
+        </Space>
+
+        <Input
+          aria-label={`${template.label} subject`}
+          value={subject}
+          onChange={(e) => setSubject(e.target.value)}
+          placeholder="Subject"
+          style={{ marginBottom: 8 }}
+        />
+        <Input.TextArea
+          aria-label={`${template.label} body`}
+          value={body}
+          onChange={(e) => setBody(e.target.value)}
+          autoSize={{ minRows: 10, maxRows: 24 }}
+          style={{ fontFamily: 'monospace', marginBottom: 12 }}
+        />
+
+        <Space>
+          <Button type="primary" loading={saving} onClick={handleSave}>
+            Save
+          </Button>
+          {/* Only offered when there is something to restore, so the button is
+              not a no-op that looks like it did something. */}
+          {customised && (
+            <Button loading={saving} onClick={handleReset}>
+              Restore default
+            </Button>
+          )}
+        </Space>
+      </Col>
+
+      <Col xs={24} lg={11}>
+        <Paragraph type="secondary" style={{ marginBottom: 8 }}>
+          Preview, with sample values in place of the placeholders.
+        </Paragraph>
+        {previewError && (
+          <Alert type="error" showIcon message={previewError} style={{ marginBottom: 8 }} />
+        )}
+        <div
+          style={{
+            border: '1px solid rgba(128,128,128,0.3)',
+            borderRadius: 8,
+            overflow: 'hidden'
+          }}
+        >
+          <div style={{ padding: '8px 12px', borderBottom: '1px solid rgba(128,128,128,0.3)' }}>
+            <Text type="secondary">Subject: </Text>
+            <Text strong data-testid="preview-subject">{preview?.subject ?? ''}</Text>
+          </div>
+          {/* An iframe rather than dangerouslySetInnerHTML. The markup is safe
+              by construction — the server renders it with markdown-it's raw HTML
+              disabled — but an email is its own styling context, and rendering
+              it inline would let the admin theme's CSS change how it looks and
+              so make the preview lie. sandbox with no allow-* keeps script
+              inert even if that guarantee ever slipped. */}
+          <iframe
+            title={`${template.label} preview`}
+            sandbox=""
+            srcDoc={preview?.html ?? ''}
+            style={{ width: '100%', height: 420, border: 0, background: '#fff' }}
+          />
+        </div>
+      </Col>
+    </Row>
+  );
+}

frontend/src/admin/Settings.tsx

@@ -5,9 +5,12 @@ import Button from 'antd/es/button';
 import Typography from 'antd/es/typography';
 import message from 'antd/es/message';
 import Card from 'antd/es/card';
+import Tabs from 'antd/es/tabs';
+import Tag from 'antd/es/tag';
+import Space from 'antd/es/space';
 import { fetchAdminSettings, updateAdminSettings } from './adminSettingsApi';
 import { EmailTemplate, fetchEmailTemplates } from './emailTemplatesApi';
-import EmailTemplateCard from './EmailTemplateCard';
+import EmailTemplateEditor from './EmailTemplateEditor';
 
 const { Title, Text } = Typography;
 
@@ -67,11 +70,28 @@ export default function Settings() {
     <Text type="secondary">
       The wording customers receive. Leave one alone and it sends the built-in copy.
     </Text>
-    <div style={{ marginTop: 16 }}>
-      {templates.map(template => (
-        <EmailTemplateCard key={template.key} template={template} onChanged={handleTemplateChanged} />
-      ))}
-    </div>
+    {/* Tabs rather than a stacked column. With six templates the cart reminder
+        sat below five editors, so which one you were editing was knowable only
+        from a card title you had already scrolled past. The Default/Customised
+        tag moves onto the tab label, so which templates have been changed is
+        visible without opening each one. */}
+    <Tabs
+      style={{ marginTop: 16 }}
+      items={templates.map(template => ({
+        key: template.key,
+        label: (
+          <Space size={4}>
+            {template.label}
+            {template.subject !== null || template.body !== null
+              ? <Tag color="blue">Customised</Tag>
+              : <Tag>Default</Tag>}
+          </Space>
+        ),
+        children: (
+          <EmailTemplateEditor template={template} onChanged={handleTemplateChanged} />
+        )
+      }))}
+    />
     </div>
   );
 }

frontend/src/admin/emailTemplatesApi.ts

@@ -54,3 +54,28 @@ export async function resetEmailTemplate(key: string): Promise<EmailTemplate> {
   );
   return json<EmailTemplate>(res);
 }
+
+export interface RenderedEmail {
+  subject: string;
+  html: string;
+}
+
+// Rendered by the server, which owns the only markdown renderer in the system
+// and the html: false setting that keeps script out of a customer's inbox. A
+// preview rendered in the browser would be a second implementation of both, and
+// one that disagreed with the mailer would be worse than none.
+export async function previewEmailTemplate(
+  key: string,
+  subject: string,
+  body: string
+): Promise<RenderedEmail> {
+  const res = await expectOk(
+    await fetch(`/api/admin/email-templates/${key}/preview`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ subject, body })
+    }),
+    'could not render the preview'
+  );
+  return json<RenderedEmail>(res);
+}