Marketing

pleate_backend.marketing backs the forms of a landing page: Newsletter with double opt in, ContactForm with a honeypot, and a waitlist with referral codes. It is mounted at /api/marketing. The public endpoints accept anonymous visitors, still enforce CSRF and are throttled with the contact scope (5 per hour per IP).

Newsletter

subscribe answers the same way whatever the state of the email, so it cannot be used to find out who is subscribed. With NEWSLETTER_DOUBLE_OPT_IN the newsletter_confirm email links to FRONTEND_PATHS["NEWSLETTER_CONFIRM"]; a signed in user subscribing their own verified email skips it. Without it, an unsubscribed address still gets the confirmation email instead of being subscribed again, so nobody can sign someone else back up.

from pleate_backend.marketing.models import NewsletterSubscriber
from pleate_backend.marketing.services import unsubscribe_url

for subscriber in NewsletterSubscriber.objects.filter(status="subscribed"):
    send_email("weekly_recipes", subscriber.email, {"unsubscribe_url": unsubscribe_url(subscriber)})

The confirmation and unsubscribe pages call the client with the token from the link:

const token = useSearchParams().get("token")!;
await client.marketing.confirmSubscription(token);   // or client.marketing.unsubscribe(token)

Contact form

Messages are stored, then CONTACT_RECIPIENTS (or every active staff user when empty) get the contact_message email with Reply-To set to the sender. website is a honeypot field hidden by ContactForm: when a bot fills it, the message is stored as spam, nothing is sent, and the answer is the same so the bot learns nothing.

Waitlist

Joining is idempotent: an email already on the list gets the same shape with every field null, so nobody can read someone else's code by typing their email. Each person gets a referral code; every referral moves them up WAITLIST_REFERRAL_BONUS places:

position = max(1, rank - bonus * referrals)     # rank: 1 + people still waiting who joined earlier
position = 0                                     # once invited

const waitlist = useWaitlist();
const status = await waitlist.mutateAsync({ email, ref: searchParams.get("ref") ?? undefined });
// {position: 128, referral_code: "k3j9x2", referrals: 0, invited: false}
share(`https://plate.app/?ref=${status.referral_code}`);

Staff invite people from the list; the waitlist_invite email links to WAITLIST_INVITE.

Endpoints

Public

Staff

Settings

PLEATE["MARKETING"]:

Frontend paths: NEWSLETTER_CONFIRM, NEWSLETTER_UNSUBSCRIBE (with {token}) and WAITLIST_INVITE (with {code} and {email}).