📝 CodeRabbit Chat: Implement requested code changes

[coderabbitai]

Code changes was requested by @yash-pouranik.

• Feat: expand Mail API ecosystem with BYOK, Broadcasts, and robust security fixes #172 (comment)

The following files were modified:

• apps/public-api/src/controllers/mail.controller.js
• packages/common/src/models/index.js

[coderabbitai]

Important

Review skipped

This PR was authored by the user configured for CodeRabbit reviews. CodeRabbit does not review PRs authored by this user. It's recommended to use a dedicated user account to post CodeRabbit review feedback.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 4f3fe818-49d0-4dc9-a098-d6555f430327

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[yash-pouranik]

ok to merge ?? @coderabbitai ?

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Get PR details, review status, and checks
gh pr view 175 --repo geturbackend/urBackend --json title,state,reviews,statusCheckRollup,mergeStateStatus,mergeable,comments

echo "---REVIEW_COMMENTS---"
gh pr review 175 --repo geturbackend/urBackend 2>/dev/null || true

echo "---DIFF---"
gh pr diff 175 --repo geturbackend/urBackend

echo "---CHECKS---"
gh pr checks 175 --repo geturbackend/urBackend 2>/dev/null || true

Length of output: 10692

---

@yash-pouranik Here's a quick assessment of PR #175:

✅ The changes look good. Here's a summary of what was reviewed:

apps/public-api/src/controllers/mail.controller.js

Input validation was added consistently across all relevant endpoints using regex checks before any downstream calls:

• resendId — validated with /^[A-Za-z0-9_-]{1,128}$/ ✅
• Audience IDs, contact IDs, broadcast IDs — validated with /^[A-Za-z0-9_-]+$/ ✅

The validation is placed correctly — before requireByokGate/requireBroadcastGate calls (fail-fast pattern). This is a solid security improvement preventing path parameter injection.

One minor observation: resendId uses a bounded quantifier {1,128} while the other ID validations use + (unbounded). This is a negligible inconsistency and not a blocker.

packages/common/src/models/index.js

Only adds a missing newline at end of file. ✅

CI / Checks

• Mintlify: Skipped ✅
• CodeRabbit: Passed ✅
• Merge state: CLEAN / MERGEABLE ✅

⚠️ Note: There are no human code reviews on this PR yet. If your team requires at least one approving review before merging, please get that done. Otherwise, from a code quality standpoint, this PR is ready to merge.

[approve]