Repository navigation
fix(email): scope templates to the sending team and substitute variables literally - #478
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
No actionable comments were generated in the recent review.
 |
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 4 files. | Write docstrings for the functions missing them to satisfy the coverage threshold. |
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely summarizes the two main changes: team-scoped template lookup and literal variable substitution. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request.
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Warning
Some tools did not complete. Review the errors below.
🔧 ESLint
-
If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.
apps/web/src/server/public-api/api/emails/send-email.api.test.ts
-
ESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox.
apps/web/src/server/service/double-opt-in-service.ts
-
ESLint skipped: the matched ESLint configuration already failed (missing-dependency).
apps/web/src/server/service/email-service.ts
-
ESLint skipped: the matched ESLint configuration already failed (missing-dependency).
- 1 others
-
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Deploying usesend with
|
| Latest commit: |
41ba431
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://4c64c4cd.usesend.pages.dev |
| Branch Preview URL: | https://hq-template-scope.usesend.pages.dev |
What changed
Template lookup is scoped to the sending team (
apps/web/src/server/service/email-service.ts)sendEmail, the suppressed-recipient path insendBulkEmails, and the mainsendBulkEmailspath now share a singleloadTeamTemplate(templateId, teamId)helper that queries{ id, teamId }. This matches the dashboard'stemplateProcedure.renderTemplatehelper, which replaces three copies of the same code.sendBulkEmailsloads every referenced template before it writes anything, so an unknown template can't leave a batch half-created. The batch template cache used to key onNumber(templateId). Every cuid becomesNaN, so all templates in a batch shared one cache entry. It now keys onteamId:templateId.Variable substitution is literal
replaceVariablesuses stringsplit/joininstead ofnew RegExp(\{{${key}}}`). Keys are matched as plain text, so.*,[,name|codeand(a+)+no longer act as regex patterns. It runs in linear time and can't throw on any key. Values are inserted as-is, with no$&/ `` $`` /$'expansion. Normal `{{name}}` substitution works exactly as before.replaceTemplateTokens(double opt-in) already escaped its keys. It now also passes the value through a function so replacement patterns are never expanded.API behavior change
When
POST /v1/emailsorPOST /v1/emails/batchgets atemplateIdthat doesn't exist or belongs to another team, it now returns 404NOT_FOUND"Template not found". Before, it ignored the template and sent using the request'ssubject/html. For batch, the whole request fails and nothing is created.How tested
email-service.unit.test.ts:replaceVariables: normal substitution, unknown placeholders left alone, special-character keys treated literally, a pathological key on a 5k-char subject (<100ms), and$&/$`/$'/$$/$1values inserted literally.sendEmail: a same-team template renders, and another team's template is rejected with NOT_FOUND before any email is created or queued.sendBulkEmails: two different templates in one batch each render correctly (covers the cache fix), and another team's template rejects the batch before any record is created, including suppressed records.send-email.api.test.ts:POST /v1/emailswith another team'stemplateIdreturns 404 and the lookup includesteamId.pnpm --filter=web test:unit(147 passed),test:api(23 passed),typecheckclean.Summary by CodeRabbit