peter
10c0ca4cf7
Twelve mails carried hardcoded English while the app itself has enforced HU/EN parity since E5.
A mail is the one user-facing surface nobody can re-render by switching the UI language: it arrives
once, in whatever language we picked, and stays that way. That made the epic's own headline mail —
"one mail, one click" — English for a Hungarian reader.
The text moved to a catalog (`mailtext.py`) with a `text(key, lang, **vars)` renderer, and the parity
rule is now a test rather than a habit: every key must carry both languages AND the same
`{placeholders}`. A translation that drops `{link}` sends a mail with no link in it; one that invents
a placeholder raises inside a background task nobody is watching. Both are silent in production.
Every `send_*` takes the language as its second argument, resolved by the REQUEST handler and never
inside the mail — these all run as background tasks, after the request's session is gone, which is
the same reason the approval mail computes its link in the handler.
Where the language comes from, in order: the account's own preference; failing that, the language the
person asked us in; failing that, English. The middle one is new — `invites.lang`, migration `0082` —
because the mails an access request produces go to an address that usually has no account yet, and
the signal does exist: the page their form was submitted from, or the locale Google reported for a
sign-in we refused. Captured rather than derived, for the third time in this epic (`google_email` in
S3, `preferences.language` in S6 taught the same lesson): a signal that exists only in one moment
cannot be backfilled later. So the admin is asked in exactly one place — the invitation to an address
they typed in themselves, where nobody has ever told us anything.
That send is now a dialog rather than a bare click, which is also where the "you already wrote to
them" warning belongs — it used to live only in a tooltip the admin may never hover, guarding the one
action whose failure mode is mailing a real person twice.
S6's registration `lang` field turned out to be dead on arrival: the backend accepted it, the
frontend never sent it, so every account has been storing nothing. The request builders now stamp the
UI language themselves — a signal that has to be passed in by every caller is one every caller can
forget, which is exactly how it shipped unset.
Admins are notified one mail per language group instead of one blast to everyone. They are people
with their own UI language; a single message would have to pick one of them and be wrong for the rest.
Also removes a duplicated `invited_at` column declaration on `Invite` (two identical definitions
landed in S6).
122 lines
4.5 KiB
Python
122 lines
4.5 KiB
Python
"""Every outbound mail carries an HTML alternative, so its link is actually clickable.
|
|
|
|
The bodies are plain text and stay that way — but a bare URL in a text/plain mail is only a link if
|
|
the CLIENT chooses to linkify it. Gmail/Outlook/Apple Mail do; lighter web clients render the body
|
|
verbatim and leave the verification or password-reset link as dead text, which is the entire point of
|
|
those two messages. So `_send` now attaches an HTML part generated from the same plain body.
|
|
|
|
These are pure-logic tests except the last one, which drives the real `_send` against a fake SMTP so
|
|
the wire format itself is pinned, not just the helper.
|
|
"""
|
|
|
|
import pytest
|
|
|
|
from app import email as email_mod
|
|
|
|
_SMTP_OK = {
|
|
"host": "smtp.example.com",
|
|
"port": 587,
|
|
"user": "u",
|
|
"password": "p",
|
|
"from": "Siftlode <u@example.com>",
|
|
}
|
|
|
|
|
|
def test_a_bare_url_becomes_a_real_link():
|
|
# THE regression: this is what a client that does not linkify plain text was leaving as dead text.
|
|
out = email_mod._html_body(
|
|
"Confirm your email:\n\nhttps://siftlode.example/#verify=tok123\n\n— Siftlode"
|
|
)
|
|
assert '<a href="https://siftlode.example/#verify=tok123">' in out
|
|
|
|
|
|
def test_interpolated_content_cannot_inject_markup():
|
|
# Bodies carry untrusted values — a requester's address in the admin notice, the operator contact.
|
|
# Escaping must run BEFORE linkification, or a crafted address becomes markup in every admin's mail.
|
|
out = email_mod._html_body('A request from <script>alert("x")</script> & co')
|
|
assert "<script>" not in out
|
|
assert "<script>" in out
|
|
assert "& co" in out
|
|
|
|
|
|
def test_a_query_string_keeps_its_escaped_ampersand_inside_the_href():
|
|
# `&` is escaped to `&` before the linkifier sees it, which is also what an HTML attribute
|
|
# wants — so the href must carry the escaped form and nothing may be trimmed off it.
|
|
out = email_mod._html_body("https://siftlode.example/x?a=1&b=2")
|
|
assert (
|
|
'<a href="https://siftlode.example/x?a=1&b=2">https://siftlode.example/x?a=1&b=2</a>'
|
|
in out
|
|
)
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"body,href,trail",
|
|
[
|
|
("See https://siftlode.example/x.", "https://siftlode.example/x", "."),
|
|
("See https://siftlode.example/x, then sign in", "https://siftlode.example/x", ","),
|
|
("See (https://siftlode.example/x)", "https://siftlode.example/x", ")"),
|
|
],
|
|
)
|
|
def test_sentence_punctuation_stays_out_of_the_href(body, href, trail):
|
|
out = email_mod._html_body(body)
|
|
assert f'<a href="{href}">{href}</a>{trail}' in out
|
|
|
|
|
|
def test_a_token_ending_in_a_url_safe_character_is_not_trimmed():
|
|
# token_urlsafe output can end in `-` or `_`; trimming either would hand the user a dead link.
|
|
for tok in ("abc-", "abc_"):
|
|
out = email_mod._html_body(f"https://siftlode.example/#reset={tok}")
|
|
assert f'href="https://siftlode.example/#reset={tok}"' in out
|
|
|
|
|
|
def test_blank_lines_become_paragraphs_and_single_breaks_stay_inline():
|
|
out = email_mod._html_body("Hi,\n\nline one\nline two\n\n— Siftlode")
|
|
assert out.count("<p>") == 3
|
|
assert "<p>line one<br>line two</p>" in out
|
|
|
|
|
|
def test_the_sent_message_is_multipart_with_the_plain_body_intact(monkeypatch):
|
|
# The wire format, not just the helper: text/plain stays the primary part and the source of
|
|
# truth, with text/html alongside it.
|
|
monkeypatch.setattr(email_mod, "_smtp", lambda: _SMTP_OK)
|
|
sent = []
|
|
|
|
class _FakeSMTP:
|
|
def __init__(self, *a, **kw):
|
|
pass
|
|
|
|
def __enter__(self):
|
|
return self
|
|
|
|
def __exit__(self, *a):
|
|
return False
|
|
|
|
def starttls(self, *a, **kw):
|
|
pass
|
|
|
|
def login(self, *a, **kw):
|
|
pass
|
|
|
|
def send_message(self, msg):
|
|
sent.append(msg)
|
|
|
|
monkeypatch.setattr(email_mod.smtplib, "SMTP", _FakeSMTP)
|
|
|
|
assert (
|
|
email_mod.send_verify_email(
|
|
"someone@example.com", "en", "https://siftlode.example/#verify=tok"
|
|
)
|
|
is True
|
|
)
|
|
|
|
(msg,) = sent
|
|
assert msg.get_content_type() == "multipart/alternative"
|
|
plain = msg.get_body(preferencelist=("plain",))
|
|
rich = msg.get_body(preferencelist=("html",))
|
|
assert plain is not None and rich is not None
|
|
# The plain part must be byte-for-byte the template's own body — the HTML part is derived from
|
|
# it, never a second copy that could drift.
|
|
assert "https://siftlode.example/#verify=tok" in plain.get_content()
|
|
assert "<a href=" not in plain.get_content()
|
|
assert '<a href="https://siftlode.example/#verify=tok">' in rich.get_content()
|