refactor: extract shared email validation to packages/lib/src/validators #840

Summary

The email validation regex is duplicated verbatim in 3 files across 3 apps. A fourth contact route uses Zod's .email() validator instead. There is no shared email validation utility.

Duplicate Locations

1. apps/marketing/src/app/api/contact/route.ts:67 — inline regex
2. apps/web/src/app/api/internal/contact/route.ts:37 — inline regex
3. apps/control-plane/src/validation/tenant-validation.ts:40 — emailPattern variable

Existing Infrastructure

• packages/lib/src/validators/index.ts already exports ID validators
• apps/web/src/app/api/contact/route.ts uses Zod .email() — consider standardizing on this

Recommended Fix

Add isValidEmail() to packages/lib/src/validators/ and replace all inline regex usages. Include RFC 5321 length check (254 chars) in the shared function.

Risk

Low — maintenance drift. If the regex needs updating again, 3 files must be changed in sync.

Last reviewed: 2026-04-08 — identified during ReDoS triage (CodeQL #102, #103, #124)