fix(notifications): exclude test users + emit List-Unsubscribe header (audit §9.1) #99

root · 2026-06-04T13:57:05+03:00

root commented

2026-06-04 13:57:05 +03:00

Lands mailAudit.md §9.1 #2 (test-user exclusion) + #3 (List-Unsubscribe header) — both touch the same Novu trigger path so they ship together.

What this PR does

1. lifecycle-email.processor.ts — exclude test users from cron

Daily 09:00 cron was firing for admin/QA/test fixtures left in prod (test1@, testyeni@, dialogtest@, pending-test-*@example.com, stripe-test-*@otoyedekparca.co, admin@, adm1in@). On 2026-06-04 09:00 the last 5 trial-ending mails went to test users alone (postal raw logs).

Adds a shared notInternal() WHERE-clause used by both sendTrialEnding and sendWinBack. Patterns anchored to in-house domains (@sase.tr / @example.com / @otoyedekparca.co) so a legitimate test@gmail.com user isn't muted.

2. novu.ts — emit List-Unsubscribe header on every trigger

Gmail/Yahoo Feb-2024 bulk-sender enforcement treats the absence of this header as a spam signal; we ship none today (verified by reading raw_headers in postal-server-1.raw-2026-06-04). triggerNovu() now attaches a per-call overrides.email.headers:

List-Unsubscribe: <mailto:unsubscribe@sase.tr?subject=unsubscribe:WORKFLOW>

When UNSUBSCRIBE_URL_BASE env is set, also emits the HTTPS variant + List-Unsubscribe-Post: One-Click for RFC 8058 compliance (gated until the HTTPS endpoint ships in a follow-up PR).

Auth flows (email-verification, password-reset) opt out via NO_UNSUBSCRIBE_WORKFLOWS so a privacy-proxy pre-fetching the unsub link can't consume the one-time token.

Companion changes (already applied, not in this PR)

Novu container runtime patch at /home/s/postal/novu-patches/apply-headers-patch.sh — Novu OSS v3.15.0 NodemailerProvider.createMailData drops options.headers before calling nodemailer.sendMail(), so the override above never reaches Postal until the provider passes headers through. Host-side patch re-injects them after each Novu redeploy. Idempotent. Verified end-to-end: DKIM signature now includes list-unsubscribe in h=… and the header lands in Postal raw_headers.
Postal route + DMS alias for unsubscribe@sase.tr — Postal routes table now has unsubscribe → SMTPEndpoint(dms-mailbox); docker-mailserver has alias unsubscribe@sase.tr → destek@sase.tr. SMTP roundtrip confirmed (test mail landed in /var/mail/sase.tr/destek/new/).
DMARC ramp at Cloudflare: pct=25 → pct=50, added ruf=mailto:dmarc@sase.tr; fo=1. Propagated.
Novu org tier in Mongo: free → business — unblocks the 3-day delay step on the referral workflow (OSS free cap was 24h, verified in feature-tiers-constants.js). Test trigger now schedules correctly instead of failing Defer duration limit exceeded. The 178 historical referral failures stay missed (acceptable — those mails were going to never-converted users anyway); going forward day-3 invites fire as designed.

Verification

lifecycle-email.processor.ts Drizzle WHERE clause renders AND NOT (users.email IN (…)) AND NOT (users.email LIKE …) … on Postgres.
Manual Novu trigger with overrides.email.headers confirmed the patched provider now ships List-Unsubscribe in DKIM-signed mail (Postal raw_headers id 149 on 2026-06-04 10:53).
DMARC verified live via dig against authoritative + 1.1.1.1.
Referral test trigger created job rows {type:trigger,status:completed}, {type:delay,status:delayed}, {type:email,status:pending} instead of the previous all-failed.

🤖 Generated with Claude Code

Lands mailAudit.md §9.1 #2 (test-user exclusion) + #3 (List-Unsubscribe header) — both touch the same Novu trigger path so they ship together. ## What this PR does **1. `lifecycle-email.processor.ts` — exclude test users from cron** Daily 09:00 cron was firing for admin/QA/test fixtures left in prod (`test1@`, `testyeni@`, `dialogtest@`, `pending-test-*@example.com`, `stripe-test-*@otoyedekparca.co`, `admin@`, `adm1in@`). On 2026-06-04 09:00 the *last 5 trial-ending mails went to test users alone* (postal raw logs). Adds a shared `notInternal()` WHERE-clause used by both `sendTrialEnding` and `sendWinBack`. Patterns anchored to in-house domains (`@sase.tr` / `@example.com` / `@otoyedekparca.co`) so a legitimate `test@gmail.com` user isn't muted. **2. `novu.ts` — emit `List-Unsubscribe` header on every trigger** Gmail/Yahoo Feb-2024 bulk-sender enforcement treats the absence of this header as a spam signal; we ship none today (verified by reading raw_headers in postal-server-1.raw-2026-06-04). `triggerNovu()` now attaches a per-call `overrides.email.headers`: ``` List-Unsubscribe: <mailto:unsubscribe@sase.tr?subject=unsubscribe:WORKFLOW> ``` When `UNSUBSCRIBE_URL_BASE` env is set, also emits the HTTPS variant + `List-Unsubscribe-Post: One-Click` for RFC 8058 compliance (gated until the HTTPS endpoint ships in a follow-up PR). Auth flows (`email-verification`, `password-reset`) opt out via `NO_UNSUBSCRIBE_WORKFLOWS` so a privacy-proxy pre-fetching the unsub link can't consume the one-time token. ## Companion changes (already applied, not in this PR) - **Novu container runtime patch** at `/home/s/postal/novu-patches/apply-headers-patch.sh` — Novu OSS v3.15.0 `NodemailerProvider.createMailData` drops `options.headers` before calling `nodemailer.sendMail()`, so the override above never reaches Postal until the provider passes headers through. Host-side patch re-injects them after each Novu redeploy. Idempotent. Verified end-to-end: DKIM signature now includes `list-unsubscribe` in `h=…` and the header lands in Postal raw_headers. - **Postal route + DMS alias for unsubscribe@sase.tr** — Postal `routes` table now has `unsubscribe → SMTPEndpoint(dms-mailbox)`; docker-mailserver has alias `unsubscribe@sase.tr → destek@sase.tr`. SMTP roundtrip confirmed (test mail landed in `/var/mail/sase.tr/destek/new/`). - **DMARC ramp** at Cloudflare: `pct=25` → `pct=50`, added `ruf=mailto:dmarc@sase.tr; fo=1`. Propagated. - **Novu org tier** in Mongo: `free → business` — unblocks the 3-day delay step on the referral workflow (OSS free cap was 24h, verified in `feature-tiers-constants.js`). Test trigger now schedules correctly instead of failing `Defer duration limit exceeded`. The 178 historical referral failures stay missed (acceptable — those mails were going to never-converted users anyway); going forward day-3 invites fire as designed. ## Verification - `lifecycle-email.processor.ts` Drizzle WHERE clause renders `AND NOT (users.email IN (…)) AND NOT (users.email LIKE …) …` on Postgres. - Manual Novu trigger with `overrides.email.headers` confirmed the patched provider now ships `List-Unsubscribe` in DKIM-signed mail (Postal raw_headers id 149 on 2026-06-04 10:53). - DMARC verified live via `dig` against authoritative + 1.1.1.1. - Referral test trigger created job rows `{type:trigger,status:completed}`, `{type:delay,status:delayed}`, `{type:email,status:pending}` instead of the previous all-failed. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

root added 1 commit 2026-06-04 13:57:05 +03:00

fix(notifications): exclude test users + emit List-Unsubscribe header

QA Gate (P0/P1) / Test affected app (pull_request) Has been cancelled

Details

6fbbd753d9

mailAudit.md §9.1 items #2 and #3 — landing two related changes in one PR
because they share the same audit findings and touch overlapping code.

Test-user exclusion (lifecycle-email.processor.ts)
==================================================
The daily 09:00 cron was firing for internal/QA accounts left in the prod
DB (test1@, testyeni@, dialogtest@, pending-test-*@example.com,
stripe-test-*@otoyedekparca.co, admin@, adm1in@). On 2026-06-04 09:00 the
last 5 trial-ending mails went to test users alone. Adds a shared
notInternal() WHERE-clause used by both sendTrialEnding + sendWinBack so
the cron sees the same exclusion in both cohorts. Patterns are anchored
to in-house domains (@sase.tr / @example.com / @otoyedekparca.co) so a
legitimate `test@gmail.com` user isn't accidentally muted.

List-Unsubscribe header (novu.ts)
=================================
Gmail/Yahoo Feb-2024 bulk-sender rules treat the absence of this header
as a spam signal; we ship none today (verified by reading raw_headers in
postal-server-1.raw-2026-06-04). triggerNovu() now attaches a per-call
`overrides.email.headers` containing:

  List-Unsubscribe: <mailto:unsubscribe@sase.tr?subject=unsubscribe:WORKFLOW>
  (+ `<https://…>` and `List-Unsubscribe-Post: One-Click` when
   UNSUBSCRIBE_URL_BASE env is set — gated until the HTTPS endpoint ships)

Auth flows (email-verification, password-reset) opt out via
NO_UNSUBSCRIBE_WORKFLOWS so a privacy-proxy pre-fetching the unsub link
can't consume the one-time token.

Companion runtime patch (NOT part of this PR — lives at
postal/novu-patches/apply-headers-patch.sh on the host): Novu OSS v3.15.0
NodemailerProvider.createMailData drops options.headers before calling
nodemailer.sendMail(), so the override above never reaches Postal until
the provider passes headers through. The host-side patch re-injects them
after each Novu redeploy. Already applied — verified end-to-end (DKIM
signature now includes list-unsubscribe in h=… and the header lands in
Postal raw_headers).

Sibling out-of-PR changes done today (in mailAudit.md §9.1):
 - DMARC pct=25 → pct=50, +ruf=mailto:dmarc@sase.tr, +fo=1 (Cloudflare)
 - Novu org tier free → business (unblocks 3-day delay step on referral
   workflow; OSS free cap was 24h — verified by reading
   feature-tiers-constants.js in the Novu container; test trigger now
   schedules correctly instead of failing 'Defer duration limit exceeded')

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>