You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Blog: subscribe and unsubscribe from post emails #89
Part of #87 — Blog: read posts in-app and manage the email subscription
Subscribe with POST /api/blog/subscribe { email }, defaulting to the signed-in account's
address, and explain the double opt-in — the user must confirm from the email before
anything arrives.
Handle the confirmation link (GET /api/blog/subscribe/confirm) as a deep link.
Offer unsubscribe (POST /api/blog/unsubscribe), and handle the human-facing unsubscribe link
from an email footer as a deep link too.
Tests: subscribe round-trip; confirm and unsubscribe deep-link parsing.
Filed from the parity review of feature/parity-wip @ 14d7795 against interlinedlist.com (OpenAPI /api/openapi.json, 233 paths) and the public help centre.
Implemented in the PR above (branch issue/89-blog-subscribe). Closing here — review and any follow-up happens on the PR.
One item could not be built as specified, and the reason matters. This issue asks for POST /api/blog/unsubscribe as an in-app action, and separately says not to implement RFC-8058 one-click — but live, those are the same endpoint. It was probed six ways (?token=, {"token"}, {"email"}, form-encoded, malformed JSON, List-Unsubscribe=One-Click, bare) and every one returns a bare 200 with no body. It acts only on a valid emailed token and never reports anything, so a button wired to it could only pretend to work. The app instead handles the emailed unsubscribe link itself, using the informative GET, which returns a 307 whose Location carries subscription=confirmed|unsubscribed|invalid.
If an address-only unsubscribe is wanted from the app, the API needs to grow one — that is a server-side change.
The link URLs were established by probing rather than guessed: the emails point straight at the API routes (/api/blog/subscribe/confirm and /api/blog/unsubscribe, both 307), while five plausible page-style paths all 404.
Activity
Adron commentedon Sep 16, 2026
Implemented in the PR above (branch
issue/89-blog-subscribe). Closing here — review and any follow-up happens on the PR.One item could not be built as specified, and the reason matters. This issue asks for
POST /api/blog/unsubscribeas an in-app action, and separately says not to implement RFC-8058 one-click — but live, those are the same endpoint. It was probed six ways (?token=,{"token"},{"email"}, form-encoded, malformed JSON,List-Unsubscribe=One-Click, bare) and every one returns a bare 200 with no body. It acts only on a valid emailed token and never reports anything, so a button wired to it could only pretend to work. The app instead handles the emailed unsubscribe link itself, using the informativeGET, which returns a 307 whoseLocationcarriessubscription=confirmed|unsubscribed|invalid.If an address-only unsubscribe is wanted from the app, the API needs to grow one — that is a server-side change.
The link URLs were established by probing rather than guessed: the emails point straight at the API routes (
/api/blog/subscribe/confirmand/api/blog/unsubscribe, both 307), while five plausible page-style paths all 404.merge: #89 blog email subscription (PR #127)
merge: bring issue/30 up to date with parity/queue