Provider Email Templates

Where templates live

• Template content is stored in SendGrid as Dynamic Templates.
• AWS Secrets Manager / Postgres does not store template HTML.
• Production runtime configuration lives in lastvet-prod/app (AWS Secrets Manager) as:
• SENDGRID_API_KEY
• SENDGRID_FROM_EMAIL
• SENDGRID_PROVIDER_VERIFICATION_TEMPLATE_ID
• SENDGRID_PROVIDER_MFA_TEMPLATE_ID
• SENDGRID_PROVIDER_PASSWORD_RESET_TEMPLATE_ID

Source of truth

• The versioned source of template design is:
• scripts/sync-sendgrid-provider-templates.mjs
• This script contains the LastVet brand-safe HTML shell (colors/typography) and upserts all provider security templates.

Sync flow

1. Export SENDGRID_API_KEY for the target SendGrid account.
2. Run:

node scripts/sync-sendgrid-provider-templates.mjs

1. Copy returned template IDs into AWS Secrets Manager (lastvet-prod/app) for last.vet-api.

CI automation

• Workflow: .github/workflows/sync-provider-email-templates.yml
• Trigger: manual dispatch only (workflow_dispatch).
• Behavior:
• Syncs LastVet-branded template HTML to SendGrid.
• Updates AWS Secrets Manager template ID keys in lastvet-prod/app.
• Verifies each template ID resolves to the expected template in SendGrid.
• Verifies AWS SM vars match synced IDs.

Required GitHub secrets:

• SENDGRID_API_KEY
• AWS_ACCESS_KEY_ID
• AWS_SECRET_ACCESS_KEY
• Optional: AWS_REGION (defaults to us-west-2)

Fallback behavior

• If template IDs are missing, the API sends a LastVet-themed fallback HTML wrapper from src/services/provider-email.service.ts.
• This prevents plain/unbranded emails in degraded scenarios.

Security guardrail

• On API startup, strict mode checks SendGrid click tracking settings for the account.
• If click tracking is enabled, startup fails fast to prevent auth links from being rewritten through tracking domains.
• Controlled by:
• PROVIDER_AUTH_EMAIL_STRICT_SECURITY=true (default)