snapshot of https://github.com/twentyhq/twenty.git (main, 2026-09-17; blobs > 131072B omitted)

packages/twenty-server/test/integration/resend/suites/inbound-email-body-text.integration-spec.ts

@@ -0,0 +1,172 @@
+import { randomUUID } from 'node:crypto';
+
+import { http, HttpResponse } from 'msw';
+
+import { MessageChannelEntity } from 'src/engine/metadata-modules/message-channel/entities/message-channel.entity';
+import { buildSystemAuthContext } from 'src/engine/twenty-orm/utils/build-system-auth-context.util';
+import { type WorkspaceOrmManager } from 'src/engine/twenty-orm/workspace-orm.manager';
+import { MESSAGE_CHANNEL_DATA_SEED_IDS } from 'src/engine/workspace-manager/dev-seeder/core/constants/message-channel-seed-ids.constant';
+import { SEED_APPLE_WORKSPACE_ID } from 'src/engine/workspace-manager/dev-seeder/core/constants/seeder-workspaces.constant';
+import { type MessageWorkspaceEntity } from 'src/modules/messaging/common/standard-objects/message.workspace-entity';
+import { type InboundEmailImportService } from 'src/modules/messaging/message-import-manager/drivers/inbound-email/services/inbound-email-import.service';
+
+import { updateConfigVariable } from 'test/integration/twenty-config/utils/update-config-variable.util';
+import { getAppProviderByClassName } from 'test/integration/utils/get-app-provider-by-class-name.util';
+import { getCoreRepository } from 'test/integration/utils/get-core-repository.util';
+import { setupHttpMock } from 'test/integration/utils/http-mock.util';
+
+const INBOUND_EMAIL_DOMAIN = 'inbound.body-text.test';
+
+const RAW_EMAIL_DOWNLOAD_BASE_URL = 'https://resend-raw.body-text.test';
+
+const buildRawEmail = ({
+  groupHandle,
+  headerMessageId,
+  contentType,
+  body,
+}: {
+  groupHandle: string;
+  headerMessageId: string;
+  contentType: string;
+  body: string;
+}) =>
+  [
+    'From: PayPal <service@paypal.test>',
+    `To: ${groupHandle}`,
+    'Subject: Zahlungseingang',
+    `Message-ID: ${headerMessageId}`,
+    'Date: Mon, 14 Sep 2026 11:19:21 +0000',
+    'MIME-Version: 1.0',
+    `Content-Type: ${contentType}; charset=UTF-8`,
+    '',
+    body,
+  ].join('\r\n');
+
+describe('Inbound email body text (integration)', () => {
+  const httpMock = setupHttpMock();
+
+  const messageChannelRepository =
+    getCoreRepository<MessageChannelEntity>(MessageChannelEntity);
+
+  let groupChannelId: string;
+  let groupHandle: string;
+
+  const importEmail = async (rawEmail: string) => {
+    const receivedEmailId = randomUUID();
+    const downloadUrl = `${RAW_EMAIL_DOWNLOAD_BASE_URL}/${receivedEmailId}`;
+
+    httpMock.use(
+      http.get(
+        `https://api.resend.com/emails/receiving/${receivedEmailId}`,
+        () =>
+          HttpResponse.json({
+            id: receivedEmailId,
+            from: 'service@paypal.test',
+            to: [groupHandle],
+            raw: { download_url: downloadUrl, expires_at: '2099-01-01' },
+          }),
+      ),
+      http.get(downloadUrl, () => HttpResponse.text(rawEmail)),
+    );
+
+    const outcome = await getAppProviderByClassName<InboundEmailImportService>(
+      'InboundEmailImportService',
+    ).importInboundMessage({
+      messageReference: { source: 'RESEND', reference: receivedEmailId },
+      envelopeRecipients: [groupHandle],
+    });
+
+    expect(outcome.kind).toBe('imported');
+  };
+
+  const findTextOfMessage = (headerMessageId: string) => {
+    const workspaceOrmManager = getAppProviderByClassName<WorkspaceOrmManager>(
+      'WorkspaceOrmManager',
+    );
+
+    return workspaceOrmManager.executeInWorkspaceContext(
+      async () => {
+        const message = await workspaceOrmManager
+          .getRepository<MessageWorkspaceEntity>('message')
+          .createQueryBuilder('message')
+          .where('message.headerMessageId = :headerMessageId', {
+            headerMessageId,
+          })
+          .getOne<MessageWorkspaceEntity>();
+
+        return message?.text;
+      },
+      buildSystemAuthContext(SEED_APPLE_WORKSPACE_ID),
+      { lite: true },
+    );
+  };
+
+  beforeAll(async () => {
+    await updateConfigVariable({
+      input: { key: 'INBOUND_EMAIL_DOMAIN', value: INBOUND_EMAIL_DOMAIN },
+    });
+    await updateConfigVariable({
+      input: { key: 'RESEND_API_KEY', value: 're_integration_test' },
+    });
+
+    const seededGroupChannel = await messageChannelRepository.findOneByOrFail({
+      id: MESSAGE_CHANNEL_DATA_SEED_IDS.SUPPORT_GROUP,
+    });
+
+    const { id: _id, ...groupChannelColumns } = seededGroupChannel;
+
+    groupHandle = `ch_${randomUUID().replace(/-/g, '')}@${INBOUND_EMAIL_DOMAIN}`;
+
+    const groupChannel = await messageChannelRepository.save({
+      ...groupChannelColumns,
+      handle: groupHandle,
+    });
+
+    groupChannelId = groupChannel.id;
+  }, 60000);
+
+  afterAll(async () => {
+    await messageChannelRepository
+      .delete({ id: groupChannelId })
+      .catch(() => undefined);
+  });
+
+  it('stores the text of an email that only has an HTML body', async () => {
+    const headerMessageId = `<${randomUUID()}@paypal.test>`;
+
+    await importEmail(
+      buildRawEmail({
+        groupHandle,
+        headerMessageId,
+        contentType: 'text/html',
+        body: '<html><body><p>Sie haben 49,00 EUR erhalten.</p></body></html>',
+      }),
+    );
+
+    expect(await findTextOfMessage(headerMessageId)).toBe(
+      'Sie haben 49,00 EUR erhalten.',
+    );
+  }, 60000);
+
+  it('drops the quoted history of a reply', async () => {
+    const headerMessageId = `<${randomUUID()}@gmail.test>`;
+
+    await importEmail(
+      buildRawEmail({
+        groupHandle,
+        headerMessageId,
+        contentType: 'text/plain',
+        body: [
+          'Thanks, sounds good.',
+          '',
+          'On Mon, 14 Sep 2026 at 10:00, Archive <archive@acme.test> wrote:',
+          '> Our spring offer',
+        ].join('\r\n'),
+      }),
+    );
+
+    expect(await findTextOfMessage(headerMessageId)).toBe(
+      'Thanks, sounds good.',
+    );
+  }, 60000);
+});

packages/twenty-server/test/integration/resend/suites/inbound-email-exclude-group-emails.integration-spec.ts

@@ -0,0 +1,160 @@
+import { randomUUID } from 'node:crypto';
+
+import { http, HttpResponse } from 'msw';
+
+import { MessageChannelEntity } from 'src/engine/metadata-modules/message-channel/entities/message-channel.entity';
+import { buildSystemAuthContext } from 'src/engine/twenty-orm/utils/build-system-auth-context.util';
+import { type WorkspaceOrmManager } from 'src/engine/twenty-orm/workspace-orm.manager';
+import { MESSAGE_CHANNEL_DATA_SEED_IDS } from 'src/engine/workspace-manager/dev-seeder/core/constants/message-channel-seed-ids.constant';
+import { SEED_APPLE_WORKSPACE_ID } from 'src/engine/workspace-manager/dev-seeder/core/constants/seeder-workspaces.constant';
+import { type MessageWorkspaceEntity } from 'src/modules/messaging/common/standard-objects/message.workspace-entity';
+import { type InboundEmailImportService } from 'src/modules/messaging/message-import-manager/drivers/inbound-email/services/inbound-email-import.service';
+
+import { updateConfigVariable } from 'test/integration/twenty-config/utils/update-config-variable.util';
+import { getAppProviderByClassName } from 'test/integration/utils/get-app-provider-by-class-name.util';
+import { getCoreRepository } from 'test/integration/utils/get-core-repository.util';
+import { setupHttpMock } from 'test/integration/utils/http-mock.util';
+
+const INBOUND_EMAIL_DOMAIN = 'inbound.exclude-group.test';
+
+const RAW_EMAIL_DOWNLOAD_BASE_URL = 'https://resend-raw.exclude-group.test';
+
+const buildRawEmail = ({
+  from,
+  groupHandle,
+  headerMessageId,
+}: {
+  from: string;
+  groupHandle: string;
+  headerMessageId: string;
+}) =>
+  [
+    `From: ${from}`,
+    `To: ${groupHandle}`,
+    'Subject: Your order',
+    `Message-ID: ${headerMessageId}`,
+    'Date: Mon, 14 Sep 2026 11:19:21 +0000',
+    'MIME-Version: 1.0',
+    'Content-Type: text/plain; charset=UTF-8',
+    '',
+    'Hello',
+  ].join('\r\n');
+
+describe('Inbound email exclude group emails (integration)', () => {
+  const httpMock = setupHttpMock();
+
+  const messageChannelRepository =
+    getCoreRepository<MessageChannelEntity>(MessageChannelEntity);
+
+  let groupChannelId: string;
+  let groupHandle: string;
+
+  const importEmail = async (rawEmail: string) => {
+    const receivedEmailId = randomUUID();
+    const downloadUrl = `${RAW_EMAIL_DOWNLOAD_BASE_URL}/${receivedEmailId}`;
+
+    httpMock.use(
+      http.get(
+        `https://api.resend.com/emails/receiving/${receivedEmailId}`,
+        () =>
+          HttpResponse.json({
+            id: receivedEmailId,
+            to: [groupHandle],
+            raw: { download_url: downloadUrl, expires_at: '2099-01-01' },
+          }),
+      ),
+      http.get(downloadUrl, () => HttpResponse.text(rawEmail)),
+    );
+
+    return getAppProviderByClassName<InboundEmailImportService>(
+      'InboundEmailImportService',
+    ).importInboundMessage({
+      messageReference: { source: 'RESEND', reference: receivedEmailId },
+      envelopeRecipients: [groupHandle],
+    });
+  };
+
+  const findMessage = (headerMessageId: string) => {
+    const workspaceOrmManager = getAppProviderByClassName<WorkspaceOrmManager>(
+      'WorkspaceOrmManager',
+    );
+
+    return workspaceOrmManager.executeInWorkspaceContext(
+      () =>
+        workspaceOrmManager
+          .getRepository<MessageWorkspaceEntity>('message')
+          .createQueryBuilder('message')
+          .where('message.headerMessageId = :headerMessageId', {
+            headerMessageId,
+          })
+          .getOne<MessageWorkspaceEntity>(),
+      buildSystemAuthContext(SEED_APPLE_WORKSPACE_ID),
+      { lite: true },
+    );
+  };
+
+  beforeAll(async () => {
+    await updateConfigVariable({
+      input: { key: 'INBOUND_EMAIL_DOMAIN', value: INBOUND_EMAIL_DOMAIN },
+    });
+    await updateConfigVariable({
+      input: { key: 'RESEND_API_KEY', value: 're_integration_test' },
+    });
+
+    const seededGroupChannel = await messageChannelRepository.findOneByOrFail({
+      id: MESSAGE_CHANNEL_DATA_SEED_IDS.SUPPORT_GROUP,
+    });
+
+    const { id: _id, ...groupChannelColumns } = seededGroupChannel;
+
+    groupHandle = `ch_${randomUUID().replace(/-/g, '')}@${INBOUND_EMAIL_DOMAIN}`;
+
+    const groupChannel = await messageChannelRepository.save({
+      ...groupChannelColumns,
+      handle: groupHandle,
+      excludeGroupEmails: true,
+    });
+
+    groupChannelId = groupChannel.id;
+  }, 60000);
+
+  afterAll(async () => {
+    await messageChannelRepository
+      .delete({ id: groupChannelId })
+      .catch(() => undefined);
+  });
+
+  it('skips an email sent from a group address', async () => {
+    const headerMessageId = `<${randomUUID()}@shop.test>`;
+
+    const outcome = await importEmail(
+      buildRawEmail({
+        from: 'Shop <noreply@shop.test>',
+        groupHandle,
+        headerMessageId,
+      }),
+    );
+
+    expect(outcome.kind).toBe('excluded');
+    expect(
+      (await findMessage(headerMessageId))?.headerMessageId,
+    ).toBeUndefined();
+  }, 60000);
+
+  it('imports an email sent from a person', async () => {
+    const headerMessageId = `<${randomUUID()}@customer.test>`;
+
+    const outcome = await importEmail(
+      buildRawEmail({
+        from: 'Customer <jane@customer.test>',
+        groupHandle,
+        headerMessageId,
+      }),
+    );
+
+    expect(outcome.kind).toBe('imported');
+    expect((await findMessage(headerMessageId))?.headerMessageId).toBe(
+      headerMessageId,
+    );
+  }, 60000);
+});

packages/twenty-server/test/integration/resend/suites/inbound-email-reply-threading.integration-spec.ts

@@ -0,0 +1,269 @@
+import { randomUUID } from 'node:crypto';
+
+import { isNonEmptyString } from '@sniptt/guards';
+import { http, HttpResponse } from 'msw';
+
+import { MessageChannelEntity } from 'src/engine/metadata-modules/message-channel/entities/message-channel.entity';
+import { buildSystemAuthContext } from 'src/engine/twenty-orm/utils/build-system-auth-context.util';
+import { type WorkspaceOrmManager } from 'src/engine/twenty-orm/workspace-orm.manager';
+import { MESSAGE_CHANNEL_DATA_SEED_IDS } from 'src/engine/workspace-manager/dev-seeder/core/constants/message-channel-seed-ids.constant';
+import { SEED_APPLE_WORKSPACE_ID } from 'src/engine/workspace-manager/dev-seeder/core/constants/seeder-workspaces.constant';
+import { MessageDirection } from 'src/modules/messaging/common/enums/message-direction.enum';
+import { type MessageChannelMessageAssociationWorkspaceEntity } from 'src/modules/messaging/common/standard-objects/message-channel-message-association.workspace-entity';
+import { type MessageThreadWorkspaceEntity } from 'src/modules/messaging/common/standard-objects/message-thread.workspace-entity';
+import { type MessageWorkspaceEntity } from 'src/modules/messaging/common/standard-objects/message.workspace-entity';
+import { type InboundEmailImportService } from 'src/modules/messaging/message-import-manager/drivers/inbound-email/services/inbound-email-import.service';
+
+import { updateConfigVariable } from 'test/integration/twenty-config/utils/update-config-variable.util';
+import { getAppProviderByClassName } from 'test/integration/utils/get-app-provider-by-class-name.util';
+import { getCoreRepository } from 'test/integration/utils/get-core-repository.util';
+import { setupHttpMock } from 'test/integration/utils/http-mock.util';
+
+const INBOUND_EMAIL_DOMAIN = 'inbound.threading.test';
+
+const RAW_EMAIL_DOWNLOAD_BASE_URL = 'https://resend-raw.threading.test';
+
+const buildRawReply = ({
+  groupHandle,
+  headerMessageId,
+  inReplyTo,
+  references,
+}: {
+  groupHandle: string;
+  headerMessageId: string;
+  inReplyTo?: string;
+  references?: string;
+}) => {
+  const headerLines = [
+    'From: Customer <customer@external.test>',
+    `To: ${groupHandle}`,
+    'Subject: Re: Spring offer',
+    `Message-ID: ${headerMessageId}`,
+    'Date: Mon, 14 Sep 2026 11:19:21 +0000',
+    'MIME-Version: 1.0',
+    'Content-Type: text/plain; charset=UTF-8',
+  ];
+
+  if (isNonEmptyString(inReplyTo)) {
+    headerLines.push(`In-Reply-To: ${inReplyTo}`);
+  }
+
+  if (isNonEmptyString(references)) {
+    headerLines.push(`References: ${references}`);
+  }
+
+  return [...headerLines, '', 'Thanks, sounds good.'].join('\r\n');
+};
+
+describe('Inbound email reply threading (integration)', () => {
+  const httpMock = setupHttpMock();
+
+  const messageChannelRepository =
+    getCoreRepository<MessageChannelEntity>(MessageChannelEntity);
+
+  let groupChannelId: string;
+  let groupHandle: string;
+
+  const inWorkspace = <TResult>(
+    work: (workspaceOrmManager: WorkspaceOrmManager) => Promise<TResult>,
+  ): Promise<TResult> => {
+    const workspaceOrmManager = getAppProviderByClassName<WorkspaceOrmManager>(
+      'WorkspaceOrmManager',
+    );
+
+    return workspaceOrmManager.executeInWorkspaceContext(
+      () => work(workspaceOrmManager),
+      buildSystemAuthContext(SEED_APPLE_WORKSPACE_ID),
+      { lite: true },
+    );
+  };
+
+  const buildSesProviderMessageId = () =>
+    `010701a0${randomUUID().replace(/-/g, '').slice(0, 8)}-${randomUUID()}-000000`;
+
+  const seedSentMessage = ({
+    messageChannelId,
+    providerMessageId,
+    threadExternalId,
+  }: {
+    messageChannelId: string;
+    providerMessageId: string;
+    threadExternalId: string;
+  }) =>
+    inWorkspace(async (workspaceOrmManager) => {
+      const messageThreadId = randomUUID();
+      const messageId = randomUUID();
+
+      await workspaceOrmManager
+        .getRepository<MessageThreadWorkspaceEntity>('messageThread')
+        .insert({ id: messageThreadId });
+
+      await workspaceOrmManager
+        .getRepository<MessageWorkspaceEntity>('message')
+        .insert({
+          id: messageId,
+          headerMessageId: providerMessageId,
+          subject: 'Spring offer',
+          text: 'Our spring offer',
+          messageThreadId,
+        });
+
+      await workspaceOrmManager
+        .getRepository<MessageChannelMessageAssociationWorkspaceEntity>(
+          'messageChannelMessageAssociation',
+        )
+        .insert({
+          id: randomUUID(),
+          messageId,
+          messageChannelId,
+          messageExternalId: providerMessageId,
+          messageThreadExternalId: threadExternalId,
+          direction: MessageDirection.OUTGOING,
+        });
+
+      return messageThreadId;
+    });
+
+  const importReply = async (rawReply: string) => {
+    const receivedEmailId = randomUUID();
+    const downloadUrl = `${RAW_EMAIL_DOWNLOAD_BASE_URL}/${receivedEmailId}`;
+
+    httpMock.use(
+      http.get(
+        `https://api.resend.com/emails/receiving/${receivedEmailId}`,
+        () =>
+          HttpResponse.json({
+            id: receivedEmailId,
+            from: 'customer@external.test',
+            to: [groupHandle],
+            raw: { download_url: downloadUrl, expires_at: '2099-01-01' },
+          }),
+      ),
+      http.get(downloadUrl, () => HttpResponse.text(rawReply)),
+    );
+
+    const outcome = await getAppProviderByClassName<InboundEmailImportService>(
+      'InboundEmailImportService',
+    ).importInboundMessage({
+      messageReference: { source: 'RESEND', reference: receivedEmailId },
+      envelopeRecipients: [groupHandle],
+    });
+
+    expect(outcome.kind).toBe('imported');
+  };
+
+  const findThreadIdOfMessage = (headerMessageId: string) =>
+    inWorkspace(async (workspaceOrmManager) => {
+      const message = await workspaceOrmManager
+        .getRepository<MessageWorkspaceEntity>('message')
+        .createQueryBuilder('message')
+        .where('message.headerMessageId = :headerMessageId', {
+          headerMessageId,
+        })
+        .getOne<MessageWorkspaceEntity>();
+
+      return message?.messageThreadId;
+    });
+
+  beforeAll(async () => {
+    await updateConfigVariable({
+      input: { key: 'INBOUND_EMAIL_DOMAIN', value: INBOUND_EMAIL_DOMAIN },
+    });
+    await updateConfigVariable({
+      input: { key: 'RESEND_API_KEY', value: 're_integration_test' },
+    });
+
+    const seededGroupChannel = await messageChannelRepository.findOneByOrFail({
+      id: MESSAGE_CHANNEL_DATA_SEED_IDS.SUPPORT_GROUP,
+    });
+
+    const { id: _id, ...groupChannelColumns } = seededGroupChannel;
+
+    groupHandle = `ch_${randomUUID().replace(/-/g, '')}@${INBOUND_EMAIL_DOMAIN}`;
+
+    const groupChannel = await messageChannelRepository.save({
+      ...groupChannelColumns,
+      handle: groupHandle,
+    });
+
+    groupChannelId = groupChannel.id;
+  }, 60000);
+
+  afterAll(async () => {
+    await messageChannelRepository
+      .delete({ id: groupChannelId })
+      .catch(() => undefined);
+  });
+
+  it('joins the sent thread when the reply carries the Twenty token in References', async () => {
+    const threadToken = `<${randomUUID()}@acme.com>`;
+    const providerMessageId = buildSesProviderMessageId();
+    const sentHeaderMessageId = `<${providerMessageId}@eu-central-1.amazonses.com>`;
+    const replyHeaderMessageId = `<${randomUUID()}@outlook.test>`;
+
+    const sentThreadId = await seedSentMessage({
+      messageChannelId: groupChannelId,
+      providerMessageId,
+      threadExternalId: threadToken,
+    });
+
+    await importReply(
+      buildRawReply({
+        groupHandle,
+        headerMessageId: replyHeaderMessageId,
+        inReplyTo: sentHeaderMessageId,
+        references: `${threadToken} ${sentHeaderMessageId}`,
+      }),
+    );
+
+    expect(await findThreadIdOfMessage(replyHeaderMessageId)).toBe(
+      sentThreadId,
+    );
+  }, 60000);
+
+  it('joins the sent thread when the mail app dropped References and only kept an In-Reply-To whose part before @ is the provider id', async () => {
+    const providerMessageId = buildSesProviderMessageId();
+    const replyHeaderMessageId = `<${randomUUID()}@icloud.test>`;
+
+    const sentThreadId = await seedSentMessage({
+      messageChannelId: groupChannelId,
+      providerMessageId,
+      threadExternalId: `<${randomUUID()}@acme.com>`,
+    });
+
+    await importReply(
+      buildRawReply({
+        groupHandle,
+        headerMessageId: replyHeaderMessageId,
+        inReplyTo: `<${providerMessageId}@email.amazonses.com>`,
+      }),
+    );
+
+    expect(await findThreadIdOfMessage(replyHeaderMessageId)).toBe(
+      sentThreadId,
+    );
+  }, 60000);
+
+  it('starts a new thread when the referenced thread belongs to another channel', async () => {
+    const threadToken = `<${randomUUID()}@acme.com>`;
+    const replyHeaderMessageId = `<${randomUUID()}@gmail.test>`;
+
+    const otherChannelThreadId = await seedSentMessage({
+      messageChannelId: MESSAGE_CHANNEL_DATA_SEED_IDS.SUPPORT_GROUP,
+      providerMessageId: buildSesProviderMessageId(),
+      threadExternalId: threadToken,
+    });
+
+    await importReply(
+      buildRawReply({
+        groupHandle,
+        headerMessageId: replyHeaderMessageId,
+        references: threadToken,
+      }),
+    );
+
+    expect(await findThreadIdOfMessage(replyHeaderMessageId)).not.toBe(
+      otherChannelThreadId,
+    );
+  }, 60000);
+});

packages/twenty-server/test/integration/resend/suites/resend-webhook.integration-spec.ts

@@ -0,0 +1,247 @@
+import { createHmac, randomUUID } from 'node:crypto';
+
+import request from 'supertest';
+
+import { MessageSuppressionEntity } from 'src/engine/core-modules/emailing-domain/message-suppression.entity';
+import { UnsubscribeTokenService } from 'src/engine/core-modules/emailing-domain/services/unsubscribe-token.service';
+import { MessageSuppressionReason } from 'src/engine/core-modules/emailing-domain/types/message-suppression-reason.type';
+import { SEED_APPLE_WORKSPACE_ID } from 'src/engine/workspace-manager/dev-seeder/core/constants/seeder-workspaces.constant';
+
+import { updateConfigVariable } from 'test/integration/twenty-config/utils/update-config-variable.util';
+import { getAppProviderByClassName } from 'test/integration/utils/get-app-provider-by-class-name.util';
+import { getCoreRepository } from 'test/integration/utils/get-core-repository.util';
+
+const SECRET_BYTES = Buffer.from('resend-integration-signing-secret');
+const SIGNING_SECRET = `whsec_${SECRET_BYTES.toString('base64')}`;
+
+const RESEND_WEBHOOK_PATH = '/webhooks/messaging/resend';
+
+const SUPPRESSION_WAIT_TIMEOUT_MS = 20_000;
+const SUPPRESSION_POLL_INTERVAL_MS = 250;
+const SUPPRESSION_SETTLE_MS = 5_000;
+
+const signRawBody = ({
+  svixId,
+  svixTimestamp,
+  rawBody,
+}: {
+  svixId: string;
+  svixTimestamp: string;
+  rawBody: string;
+}) =>
+  createHmac('sha256', SECRET_BYTES)
+    .update(`${svixId}.${svixTimestamp}.${rawBody}`)
+    .digest('base64');
+
+const postResendWebhook = (
+  rawBody: string,
+  { signed = true }: { signed?: boolean } = {},
+) => {
+  const svixId = `msg_${randomUUID()}`;
+  const svixTimestamp = `${Math.floor(Date.now() / 1000)}`;
+  const signature = signed
+    ? signRawBody({ svixId, svixTimestamp, rawBody })
+    : Buffer.from('invalid-signature-material').toString('base64');
+
+  return request(`http://localhost:${APP_PORT}`)
+    .post(RESEND_WEBHOOK_PATH)
+    .set('Content-Type', 'application/json')
+    .set('svix-id', svixId)
+    .set('svix-timestamp', svixTimestamp)
+    .set('svix-signature', `v1,${signature}`)
+    .send(rawBody);
+};
+
+describe('Resend webhook (integration)', () => {
+  let unsubscribeTokenService: UnsubscribeTokenService;
+
+  const readSuppressionReasons = async (emailAddress: string) => {
+    const suppressions = await getCoreRepository<MessageSuppressionEntity>(
+      MessageSuppressionEntity,
+    ).findBy({ workspaceId: SEED_APPLE_WORKSPACE_ID, emailAddress });
+
+    return suppressions.map((suppression) => suppression.reason);
+  };
+
+  const waitForSuppressionReasons = async (emailAddress: string) => {
+    const deadline = Date.now() + SUPPRESSION_WAIT_TIMEOUT_MS;
+    let reasons = await readSuppressionReasons(emailAddress);
+
+    while (reasons.length === 0 && Date.now() < deadline) {
+      await new Promise((resolve) =>
+        setTimeout(resolve, SUPPRESSION_POLL_INTERVAL_MS),
+      );
+
+      reasons = await readSuppressionReasons(emailAddress);
+    }
+
+    return reasons;
+  };
+
+  const readSuppressionReasonsAfterSettle = async (emailAddress: string) => {
+    await new Promise((resolve) =>
+      setTimeout(resolve, SUPPRESSION_SETTLE_MS),
+    );
+
+    return readSuppressionReasons(emailAddress);
+  };
+
+  beforeAll(async () => {
+    await updateConfigVariable({
+      input: { key: 'RESEND_WEBHOOK_SIGNING_SECRET', value: SIGNING_SECRET },
+    });
+
+    unsubscribeTokenService =
+      getAppProviderByClassName<UnsubscribeTokenService>(
+        'UnsubscribeTokenService',
+      );
+  }, 60000);
+
+  it('suppresses recipients of a permanently bounced email', async () => {
+    const emailAddress = `bounce-${randomUUID()}@acme.com`;
+
+    const response = await postResendWebhook(
+      JSON.stringify({
+        type: 'email.bounced',
+        data: {
+          email_id: `email_${randomUUID()}`,
+          to: [emailAddress],
+          bounce: { type: 'Permanent' },
+          tags: { workspace_id: SEED_APPLE_WORKSPACE_ID },
+        },
+      }),
+    );
+
+    expect(response.status).toBe(200);
+    expect(await waitForSuppressionReasons(emailAddress)).toEqual([
+      MessageSuppressionReason.BOUNCE,
+    ]);
+  }, 60000);
+
+  it('suppresses recipients of a complained email carrying array-shaped tags', async () => {
+    const emailAddress = `complaint-${randomUUID()}@acme.com`;
+
+    const response = await postResendWebhook(
+      JSON.stringify({
+        type: 'email.complained',
+        data: {
+          email_id: `email_${randomUUID()}`,
+          to: [emailAddress],
+          tags: [{ name: 'workspace_id', value: SEED_APPLE_WORKSPACE_ID }],
+        },
+      }),
+    );
+
+    expect(response.status).toBe(200);
+    expect(await waitForSuppressionReasons(emailAddress)).toEqual([
+      MessageSuppressionReason.COMPLAINT,
+    ]);
+  }, 60000);
+
+  it('suppresses nothing for a transient bounce', async () => {
+    const emailAddress = `transient-${randomUUID()}@acme.com`;
+
+    const response = await postResendWebhook(
+      JSON.stringify({
+        type: 'email.bounced',
+        data: {
+          email_id: `email_${randomUUID()}`,
+          to: [emailAddress],
+          bounce: { type: 'Transient' },
+          tags: { workspace_id: SEED_APPLE_WORKSPACE_ID },
+        },
+      }),
+    );
+
+    expect(response.status).toBe(200);
+    expect(
+      await readSuppressionReasonsAfterSettle(emailAddress),
+    ).toEqual([]);
+  }, 60000);
+
+  it('suppresses nothing for a bounce without a workspace tag', async () => {
+    const emailAddress = `untagged-${randomUUID()}@acme.com`;
+
+    const response = await postResendWebhook(
+      JSON.stringify({
+        type: 'email.bounced',
+        data: {
+          email_id: `email_${randomUUID()}`,
+          to: [emailAddress],
+          bounce: { type: 'Permanent' },
+        },
+      }),
+    );
+
+    expect(response.status).toBe(200);
+    expect(
+      await readSuppressionReasonsAfterSettle(emailAddress),
+    ).toEqual([]);
+  }, 60000);
+
+  it('suppresses the sender of a received email addressed to the unsubscribe mailbox', async () => {
+    const emailAddress = `unsub-${randomUUID()}@acme.com`;
+
+    const response = await postResendWebhook(
+      JSON.stringify({
+        type: 'email.received',
+        data: {
+          email_id: `email_${randomUUID()}`,
+          received_for: ['unsubscribe@campaigns.acme.com'],
+          subject: unsubscribeTokenService.sign({
+            workspaceId: SEED_APPLE_WORKSPACE_ID,
+            emailAddress,
+          }),
+        },
+      }),
+    );
+
+    expect(response.status).toBe(200);
+    expect(await waitForSuppressionReasons(emailAddress)).toEqual([
+      MessageSuppressionReason.UNSUBSCRIBE,
+    ]);
+  }, 60000);
+
+  it('ignores event types it does not handle', async () => {
+    const response = await postResendWebhook(
+      JSON.stringify({
+        type: 'email.delivered',
+        data: { email_id: `email_${randomUUID()}` },
+      }),
+    );
+
+    expect(response.status).toBe(200);
+  }, 60000);
+
+  it('rejects a payload whose signature does not verify', async () => {
+    const response = await postResendWebhook(
+      JSON.stringify({
+        type: 'email.bounced',
+        data: {
+          email_id: `email_${randomUUID()}`,
+          to: [`rejected-${randomUUID()}@acme.com`],
+          bounce: { type: 'Permanent' },
+          tags: { workspace_id: SEED_APPLE_WORKSPACE_ID },
+        },
+      }),
+      { signed: false },
+    );
+
+    expect(response.status).toBe(403);
+  }, 60000);
+
+  it('rejects a payload without Svix signature headers', async () => {
+    const response = await request(`http://localhost:${APP_PORT}`)
+      .post(RESEND_WEBHOOK_PATH)
+      .set('Content-Type', 'application/json')
+      .send(JSON.stringify({ type: 'email.bounced' }));
+
+    expect(response.status).toBe(403);
+  }, 60000);
+
+  it('rejects a correctly signed body that is not valid JSON', async () => {
+    const response = await postResendWebhook('not-json');
+
+    expect(response.status).toBe(400);
+  }, 60000);
+});