From 1c8f30fe6f749dd1d02ea0ad14cfa791e1592a92 Mon Sep 17 00:00:00 2001
From: Jennie Robinson Faber <jennie@jenniefaber.com>
Date: Thu, 30 Apr 2026 22:25:41 +0100
Subject: [PATCH] feat(invite): skip Resend dispatch when
 ALLOW_DEV_TEST_ENDPOINTS=true
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pre-registrant invite was the only email route calling Resend directly
(bypassing server/utils/resend.js), so dev/e2e runs were dispatching
real email. Gate just the network call; DB updates (jti, status,
activity log) still run. Mirrors the bypass pattern in
server/middleware/03.rate-limit.js.

Other email routes via server/utils/resend.js still send live in dev
mode — wrapper refactor tracked in BACKLOG.
---
 .../api/admin/pre-registrants/invite.post.js  | 26 ++++++++++++-------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/server/api/admin/pre-registrants/invite.post.js b/server/api/admin/pre-registrants/invite.post.js
index f3d46b3..9256499 100644
--- a/server/api/admin/pre-registrants/invite.post.js
+++ b/server/api/admin/pre-registrants/invite.post.js
@@ -63,17 +63,23 @@ export default defineEventHandler(async (event) => {
         .replace(/\n/g, '<br>')
         .replace(/\{acceptLink\}/g, acceptButton)
 
-      const { error: emailError } = await resend.emails.send({
-        from: 'Ghost Guild <welcome@babyghosts.org>',
-        to: [preReg.email],
-        subject: "You're invited to Ghost Guild! 👻",
-        text: emailText,
-        html: emailHtml,
-      })
+      const subject = "You're invited to Ghost Guild! 👻"
 
-      if (emailError) {
-        results.push({ preRegistrantId: preReg._id, email: preReg.email, success: false, error: emailError.message })
-        continue
+      if (process.env.ALLOW_DEV_TEST_ENDPOINTS === 'true') {
+        console.log('[resend] DEV MODE — skipping invite send', { to: preReg.email, subject })
+      } else {
+        const { error: emailError } = await resend.emails.send({
+          from: 'Ghost Guild <welcome@babyghosts.org>',
+          to: [preReg.email],
+          subject,
+          text: emailText,
+          html: emailHtml,
+        })
+
+        if (emailError) {
+          results.push({ preRegistrantId: preReg._id, email: preReg.email, success: false, error: emailError.message })
+          continue
+        }
       }
 
       await PreRegistration.findByIdAndUpdate(preReg._id, {