feat(feedback): feature-request form — stores feedback + emails owner via Resend

- Migration 0005: adds `feedback` table (id, message, email, name, page, created_at)
- sqlc query InsertFeedback; regenerated querier/models
- internal/mailer: Resend HTTP client; ErrNotConfigured sentinel for no-op when key absent
- internal/feedback: Service + http.HandlerFunc — honeypot drop, 4000-char truncation, best-effort email goroutine
- Config: RESEND_API_KEY, SHOPLIT_FEEDBACK_EMAIL, SHOPLIT_FEEDBACK_FROM
- main.go: wires mailer + feedback service; mounts POST /api/public/feedback
- web: submitFeedback() api-client helper; /feedback page (hero + form card, success/error states)
- NavBar (marketing): Feedback link before Sign in
- Footer: mailto → /feedback Link
- Roadmap: both CTAs switched from mailto to /feedback Link

Author: mayur-tolexo

cmd/shoplit-api/main.go

@@ -19,7 +19,9 @@ import (
 	"github.com/mayur-tolexo/shoplit/internal/db"
 	sqlcgen "github.com/mayur-tolexo/shoplit/internal/db/sqlc"
 	"github.com/mayur-tolexo/shoplit/internal/exttoken"
+	"github.com/mayur-tolexo/shoplit/internal/feedback"
 	"github.com/mayur-tolexo/shoplit/internal/httpx"
+	"github.com/mayur-tolexo/shoplit/internal/mailer"
 	"github.com/mayur-tolexo/shoplit/internal/ogfetch"
 	"github.com/mayur-tolexo/shoplit/internal/publicapi"
 	"github.com/mayur-tolexo/shoplit/internal/redis"
@@ -60,6 +62,8 @@ func run() error {
 	}
 
 	q := sqlcgen.New(pool)
+	mlr := mailer.NewResend(cfg.ResendAPIKey, cfg.FeedbackFrom)
+	fb := feedback.NewService(q, mlr, cfg.FeedbackEmail)
 
 	sm := auth.NewSessionManager(cfg.SessionSecret).
 		WithSecure(cfg.CookieSecure).
@@ -99,6 +103,7 @@ func run() error {
 	// Public, unauthenticated read endpoints
 	r.Route("/api/public", func(r chi.Router) {
 		publicapi.RegisterRoutes(r, svc)
+		r.Post("/feedback", fb.Handler())
 	})
 
 	// Authenticated creator endpoints

internal/config/config.go

@@ -51,6 +51,13 @@ type Config struct {
 	// XHR calls reach the backend cross-origin with credentials.
 	GoogleOAuthRedirectURL string `env:"GOOGLE_OAUTH_REDIRECT_URL" envDefault:"http://localhost:8080/api/v1/auth/google/callback"`
 
+	// Resend (resend.com) API key for sending the feedback notification email.
+	// Optional: if empty, feedback is still stored; the email is skipped (logged).
+	ResendAPIKey string `env:"RESEND_API_KEY"`
+	// Where feature-request notifications are sent, and the From line Resend uses.
+	FeedbackEmail string `env:"SHOPLIT_FEEDBACK_EMAIL" envDefault:"mayur.das4@gmail.com"`
+	FeedbackFrom  string `env:"SHOPLIT_FEEDBACK_FROM" envDefault:"shoplit <onboarding@resend.dev>"`
+
 	// Origin allowed to make credentialed cross-origin requests to the API.
 	// In dev this is the Next.js frontend.
 	CORSAllowedOrigin string `env:"SHOPLIT_CORS_ORIGIN" envDefault:"http://localhost:3000"`

internal/db/migrations/0005_feedback.down.sql

@@ -0,0 +1 @@
+DROP TABLE feedback;

internal/db/migrations/0005_feedback.up.sql

@@ -0,0 +1,10 @@
+-- Feature requests / feedback submitted from the website. Stored durably so
+-- nothing is lost even if the notification email fails.
+CREATE TABLE feedback (
+  id         BIGSERIAL PRIMARY KEY,
+  message    TEXT NOT NULL,
+  email      TEXT,
+  name       TEXT,
+  page       TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);

internal/db/queries.sql

@@ -130,3 +130,8 @@ SELECT id, user_id, revoked_at FROM extension_tokens WHERE token_hash = $1;
 
 -- name: TouchExtensionToken :exec
 UPDATE extension_tokens SET last_used_at = now() WHERE id = $1;
+
+-- ─── FEEDBACK ────────────────────────────────────────────────────────────────
+
+-- name: InsertFeedback :exec
+INSERT INTO feedback (message, email, name, page) VALUES ($1, $2, $3, $4);

internal/db/sqlc/models.go

@@ -0,0 +1,109 @@
+// Package feedback handles feature-request and feedback submissions.
+package feedback
+
+import (
+	"context"
+	"encoding/json"
+	"log/slog"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgtype"
+	"github.com/mayur-tolexo/shoplit/internal/mailer"
+	sqlcgen "github.com/mayur-tolexo/shoplit/internal/db/sqlc"
+)
+
+// Mailer is the interface used to send notification emails.
+type Mailer interface {
+	Send(ctx context.Context, to, subject, text string) error
+}
+
+// Service stores feedback and fires notification emails.
+type Service struct {
+	q      *sqlcgen.Queries
+	mailer Mailer
+	to     string
+}
+
+// NewService constructs a Service.
+func NewService(q *sqlcgen.Queries, m Mailer, to string) *Service {
+	return &Service{q: q, mailer: m, to: to}
+}
+
+type feedbackRequest struct {
+	Message string `json:"message"`
+	Email   string `json:"email"`
+	Name    string `json:"name"`
+	Page    string `json:"page"`
+	HP      string `json:"hp"`
+}
+
+// Handler returns an http.HandlerFunc that accepts feedback submissions.
+func (s *Service) Handler() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		var req feedbackRequest
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			http.Error(w, "invalid JSON", http.StatusBadRequest)
+			return
+		}
+
+		// Honeypot — silently drop bots.
+		if req.HP != "" {
+			w.WriteHeader(http.StatusNoContent)
+			return
+		}
+
+		req.Message = strings.TrimSpace(req.Message)
+		if req.Message == "" {
+			http.Error(w, "message required", http.StatusBadRequest)
+			return
+		}
+		const maxLen = 4000
+		if len(req.Message) > maxLen {
+			req.Message = req.Message[:maxLen]
+		}
+
+		toText := func(v string) pgtype.Text {
+			return pgtype.Text{String: v, Valid: v != ""}
+		}
+
+		if err := s.q.InsertFeedback(r.Context(), sqlcgen.InsertFeedbackParams{
+			Message: req.Message,
+			Email:   toText(req.Email),
+			Name:    toText(req.Name),
+			Page:    toText(req.Page),
+		}); err != nil {
+			slog.Error("feedback: insert", "err", err)
+			http.Error(w, "internal error", http.StatusInternalServerError)
+			return
+		}
+
+		// Best-effort email — run in background so a Resend hiccup never fails the user.
+		go func() {
+			ctx, cancel := context.WithTimeout(context.Background(), 12*time.Second)
+			defer cancel()
+
+			var parts []string
+			parts = append(parts, "Message:\n"+req.Message)
+			if req.Name != "" {
+				parts = append(parts, "From: "+req.Name)
+			}
+			if req.Email != "" {
+				parts = append(parts, "Email: "+req.Email)
+			}
+			if req.Page != "" {
+				parts = append(parts, "Page: "+req.Page)
+			}
+			body := strings.Join(parts, "\n\n")
+
+			if err := s.mailer.Send(ctx, s.to, "shoplit feature request", body); err != nil {
+				if err != mailer.ErrNotConfigured {
+					slog.Error("feedback: send email", "err", err)
+				}
+			}
+		}()
+
+		w.WriteHeader(http.StatusNoContent)
+	}
+}

internal/db/sqlc/querier.go

@@ -0,0 +1,49 @@
+// Package mailer sends transactional email via the Resend HTTP API.
+package mailer
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"time"
+)
+
+// ErrNotConfigured is returned when no API key is set (email is a no-op).
+var ErrNotConfigured = errors.New("mailer: not configured")
+
+type Resend struct {
+	key, from string
+	client    *http.Client
+}
+
+func NewResend(key, from string) *Resend {
+	return &Resend{key: key, from: from, client: &http.Client{Timeout: 10 * time.Second}}
+}
+
+// Send delivers a plain-text email. No-op error if not configured.
+func (r *Resend) Send(ctx context.Context, to, subject, text string) error {
+	if r.key == "" {
+		return ErrNotConfigured
+	}
+	payload, _ := json.Marshal(map[string]any{
+		"from": r.from, "to": []string{to}, "subject": subject, "text": text,
+	})
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, "https://api.resend.com/emails", bytes.NewReader(payload))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Authorization", "Bearer "+r.key)
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := r.client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 300 {
+		return fmt.Errorf("mailer: resend status %d", resp.StatusCode)
+	}
+	return nil
+}