Repository navigation
Harden sending, add mail stats, open the MCP to all staff - #1
Conversation
Sending - Record each recipient as soon as SES answers, so a database error mid-batch cannot mail anyone twice. - Stop a send, and put its rows back, when SES refuses a whole batch the same way (sandbox, unverified sender, daily quota) instead of failing the list. - Refuse a live send without an *|UNSUB|* link; warn about leftover merge tags and mail Gmail would clip. - A reminder (resend) skips everyone an earlier reminder reached. Bounces and complaints - Suppress only the address that got the mail, never other addresses a report names. - A complaint suppresses even after the reader unsubscribed. - A soft bounce suppresses only for a full mailbox seen twice in 30 days (events.detail). Stats - Split opens and clicks made by people from those made by link scanners and Apple's privacy proxy (events.machine; no IP or user agent kept). - Rates per send, 30-day sending health against SES limits, list growth per month, on the dashboard and as MCP tools. Company-wide MCP - config.members: everyone at the listed domains may connect an assistant, draft, test to themselves, read stats and ask for sends. Admins still approve each send. - Lists a colleague makes through an assistant (list_create, list_add, list_remove, list_delete): addresses go in but never come back out, only the owner or an admin changes a list, replies go to the owner, no public web version. - Approval requests are mailed to admins and stay open 24 hours; at most 10 requests an hour per person. - Tokens stop working when their owner is no longer a member. Schema: migrations/0005_stats_lists.sql. Apply it before deploying. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2d06b4ce1f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (!send) return notFound(env.CONFIG); | ||
| .bind(key).first<{ html: string; list: string; fname_fallback: string }>(); | ||
| // A mailing to people a colleague named (an event's guests) is theirs, not the public's. | ||
| if (!send || env.CONFIG.lists[send.list]?.adhoc) return notFound(env.CONFIG); |
There was a problem hiding this comment.
If the lists query fails, withLists() catches the error and returns the config-only environment. An ad hoc list is then absent from env.CONFIG.lists, so this condition allows its private mailing to be served publicly, with a public cache header. I reproduced this by making the lists table unreadable after creating an ad hoc send: its archive changed from 404 to 200 and exposed the message body. Require a positively identified public newsletter list, or propagate metadata-loading failures, rather than treating missing metadata as permission to publish.
Useful? React with 👍 / 👎.
|
|
||
| // A mail to a list needs a link a reader can use to leave it, not just the tag in a comment or in text. | ||
| export function hasUnsubscribeLink(html: string): boolean { | ||
| return /\shref\s*=\s*["']?\*\|UNSUB\|\*/i.test(stripComments(html)); |
There was a problem hiding this comment.
For HTML containing <a href="*|unsub|*">Unsubscribe</a>, this case-insensitive check returns true, but render() only replaces the exact uppercase *|UNSUB|* tag. Consequently, createSend() and requestSend() accept a live mailing whose body unsubscribe link does not work; mailWarnings() also returns no warning for this example. Keep tag validation consistent with rendering so this input is either rejected or correctly expanded.
Useful? React with 👍 / 👎.
Gets Utskick ready for the first live send and for use by everyone at the company.
Sending
*|UNSUB|*link. A dry run warns about leftover merge tags and about mail Gmail would clip.Bounces and complaints
Stats
Company-wide MCP
membersin the config: everyone at the listed domains may connect an assistant, draft, test to themselves, read stats and ask for sends. Admins still approve each send.Before deploying
migrations/0005_stats_lists.sql.config/sourceful.json.docs/setup.md(SNS topic policy, the SES simulator test).Tests
206 pass.
npm run typecheckandcf buildpass.🤖 Generated with Claude Code