@aglyn/plugins-marketing 1.0.0-beta.172 → 1.0.0-beta.174

package/src/lib/server/campaign-send.js

@@ -17,6 +17,7 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  */ import { checkQuota, contactMatchesSegment, isEmailTopicId, DEFAULT_CAMPAIGN_TOPIC_ID, readMarketingBasis, resolveMarketingConsentPolicy, splitByMarketingConsent, createResourceUid, decodeStoredNodes, emailStarterSendBlock, resolveBrandingProfile, visibleToHost } from "@aglyn/aglyn/server";
 import { renderRecipientEmail } from "@aglyn/aglyn/app-utils/recipient-email-render";
 import { assignExperimentVariant } from "../model/index.js";
+import { campaignPlacedOnHost } from "@aglyn/shared-ui-email-campaigns/model";
 import { readPluginRecordCard } from "@aglyn/aglyn/plugin-manager/plugin-record-cards";
 import { hostPublicOrigin } from "@aglyn/aglyn/server";
 import { consentGroupForSite, orgDataCollectionForHost, orgDataQueryForHost, filterSendableForHost, filterTopicSendable, firebaseAdmin, getOrgForHost, meterHostEmail, claimOrgEmailSendBudget, orgCampaignEmailSendsForMonth, readEmailSendRateConfig, readEmailSendRateWindow, reconcileCampaignSendReservation, reserveCampaignEmailSends, resolveHostSendingIdentity } from "@aglyn/tenant-data-admin";
@@ -48,6 +49,7 @@ import { filterCadenceSendable, recordMarketingSends } from "@aglyn/tenant-data-
  * that decides who has already had this email — is the one that must come
  * from the real module.
  */ import { CAMPAIGN_REACH_CEILING, campaignReachCovers, campaignSettledSize, partitionByCampaignReach, readCampaignReach, readCampaignSettled, recordCampaignReach, recordCampaignSkipped } from "./email-campaign-reach.js";
+import { campaignSendSiteStamp, orgCampaignSends, orgEmailCampaigns, sendIsOnHost } from "./campaign-org-refs.js";
 /*
  * The LEAF module for the reputation controls too, and for the same reason
  * as the three above it: every spec that reaches this file mocks the
@@ -69,6 +71,7 @@ import { EMAIL_MAX_AUDIENCE_PER_SEND, EMAIL_MAX_RECIPIENTS_PER_SEND, campaignBat
  * nobody could check against the other two.
  */ const MAX_RECIPIENTS_PER_SEND = EMAIL_MAX_RECIPIENTS_PER_SEND;
 const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+/** What Resend accepts as a tag value; anything else fails the message. */ const RESEND_TAG_VALUE = /^[A-Za-z0-9_-]{1,256}$/;
 /** How many audience documents one Firestore round trip fetches. */ const AUDIENCE_PAGE_SIZE = 500;
 /**
  * The read budget for resolving one audience — a ceiling on the SCAN, not a
@@ -314,8 +317,10 @@ export async function performCampaignSend(options) {
     // `hostId` is deliberately NOT guarded here, and that is measured rather
     // than overlooked: both callers prove it first — the handler resolves the
     // host document and checks the caller's role on it before calling in, and
-    // the scheduled processor passes `hostRef.id` off a document it just read. A
-    // guard here could not fail today. A third caller would need to earn that.
+    // the scheduled processor passes the site a send records only after
+    // `scheduledSendSite` has refused an empty or path-shaped one. The host
+    // read below then refuses a site that does not exist. A guard here could
+    // not fail today. A third caller would need to earn that.
     for (const [name, value] of [
         [
             'campaignId',
@@ -372,6 +377,24 @@ export async function performCampaignSend(options) {
     if (!hostSnapshot.exists) {
         throw new CampaignSendError('Unknown site', 404);
     }
+    /*
+   * THE ORGANIZATION, resolved before anything else is read.
+   *
+   * Every send is recorded under it (`orgs/{orgId}/campaigns`), so no branch
+   * below — the follow-up's checks, the batch's, the final write — can
+   * address the send without it. The consent policy, the plan cap, the
+   * reputation ramp and the branding further down read the same document,
+   * so this is the one read of it.
+   *
+   * A site with no organization cannot send: there is nowhere to record the
+   * send and no plan to charge it to. `getOrgForHost` failing is treated the
+   * same way — refused, with nothing written.
+   */ const orgForHost = await getOrgForHost(hostId).catch(()=>null);
+    const orgId = String((_ref = orgForHost == null ? void 0 : orgForHost.orgId) != null ? _ref : '');
+    if (!orgId) {
+        throw new CampaignSendError('This site is not part of an organization, so it cannot send campaigns.', 409);
+    }
+    const sends = orgCampaignSends(firestore, orgId);
     /*==========================================
    * THE FOLLOW-UP'S ADMISSION CHECKS.
    *
@@ -399,8 +422,8 @@ export async function performCampaignSend(options) {
         if (!options.campaignId) {
             throw new CampaignSendError('A batch has to name the email it is continuing', 400);
         }
-        const sendSnapshot = await hostRef.collection('campaigns').doc(options.campaignId).get();
-        if (!sendSnapshot.exists) {
+        const sendSnapshot = await sends.doc(options.campaignId).get();
+        if (!sendSnapshot.exists || !sendIsOnHost(sendSnapshot, hostId)) {
             throw new CampaignSendError('Unknown email', 404);
         }
         /*
@@ -417,7 +440,7 @@ export async function performCampaignSend(options) {
      * email has already mailed is the only thing standing between a resumed
      * send and a second copy in somebody's inbox, and a batch that cannot
      * read it must not run.
-     */ const settled = await readCampaignSettled(hostId, options.campaignId, firestore);
+     */ const settled = await readCampaignSettled(sends.doc(options.campaignId));
         const sentSoFar = Number((_ref1 = (_sendSnapshot_get1 = sendSnapshot.get('stats')) == null ? void 0 : _sendSnapshot_get1.sent) != null ? _ref1 : 0);
         if (!campaignReachCovers(settled.reached, sentSoFar)) {
             throw new CampaignSendError('This email does not have a complete record of who it reached, so ' + 'the rest of it cannot be sent without risking a second copy for ' + 'somebody who already has it.', 409);
@@ -446,7 +469,7 @@ export async function performCampaignSend(options) {
    */ const finishContinuation = async ()=>{
         var _options_campaignId;
         const sendId = String((_options_campaignId = options.campaignId) != null ? _options_campaignId : '');
-        await hostRef.collection('campaigns').doc(sendId).set({
+        await sends.doc(sendId).set(_extends({}, campaignSendSiteStamp(hostId), {
             status: 'sent',
             resume: {
                 remaining: 0,
@@ -454,7 +477,7 @@ export async function performCampaignSend(options) {
                 nextAtMs: 0
             },
             lastSentAt: firebaseAdmin.firestore.FieldValue.serverTimestamp()
-        }, {
+        }), {
             merge: true
         });
         return {
@@ -473,8 +496,8 @@ export async function performCampaignSend(options) {
         if (!options.campaignId) {
             throw new CampaignSendError('A follow-up has to name the email it is adding to', 400);
         }
-        const sendSnapshot = await hostRef.collection('campaigns').doc(options.campaignId).get();
-        if (!sendSnapshot.exists) {
+        const sendSnapshot = await sends.doc(options.campaignId).get();
+        if (!sendSnapshot.exists || !sendIsOnHost(sendSnapshot, hostId)) {
             throw new CampaignSendError('Unknown email', 404);
         }
         /*
@@ -489,7 +512,7 @@ export async function performCampaignSend(options) {
      * "nobody", and that throw is deliberately not caught: the whole feature
      * rests on being able to name who already has this email, and a send that
      * cannot is a send that must not happen.
-     */ const keys = await readCampaignReach(hostId, options.campaignId, firestore);
+     */ const keys = await readCampaignReach(sends.doc(options.campaignId));
         const sentSoFar = Number((_ref3 = (_sendSnapshot_get3 = sendSnapshot.get('stats')) == null ? void 0 : _sendSnapshot_get3.sent) != null ? _ref3 : 0);
         if (!campaignReachCovers(keys, sentSoFar)) {
             throw new CampaignSendError('This email does not have a complete record of who it reached, so ' + 'it cannot be sent to more people without risking a second copy ' + 'for somebody who already has it. Compose a new email to the ' + 'people you want to add.', 409);
@@ -758,12 +781,9 @@ export async function performCampaignSend(options) {
    * decision informed — it rides the same readout as `audienceSize`, so a
    * merchant sees which population is which before sending.
    *
-   * The org is resolved here rather than at the quota block below because the
-   * policy lives on it and this is the first thing that needs it; the quota
-   * lines further down reuse the same read rather than taking a second one.
-   */ const orgForHost = await getOrgForHost(hostId).catch(()=>null);
-    const orgId = String((_ref = orgForHost == null ? void 0 : orgForHost.orgId) != null ? _ref : '');
-    /*
+   * The policy lives on the org document resolved at the top of this
+   * function; the quota lines further down reuse the same read.
+   */ /*
    * THE SENDING IDENTITY, and the refusal when it is not usable.
    *
    * Resolved ABOVE the dry run on purpose. `preview` is where a merchant finds
@@ -1603,6 +1623,18 @@ export async function performCampaignSend(options) {
                         name: 'campaignId',
                         value: campaignId
                     },
+                    /*
+           * The org the send is recorded under, so the webhook finds it
+           * without a site lookup. Only a value Resend accepts is tagged —
+           * ASCII letters, digits, `_` and `-`, which every generated org id
+           * is — because a rejected tag fails the whole message; the webhook
+           * resolves the org from the site when the tag is missing.
+           */ ...RESEND_TAG_VALUE.test(orgId) ? [
+                        {
+                            name: 'orgId',
+                            value: orgId
+                        }
+                    ] : [],
                     ...experiment ? [
                         {
                             name: 'experimentId',
@@ -1716,7 +1748,7 @@ export async function performCampaignSend(options) {
    * has to. The other order would leave the record short and refuse the
    * follow-up, which is also safe but loses the feature over a transient.
    */ if (options.recordCampaign !== false) {
-        await recordCampaignReach(hostId, campaignId, reached, firestore);
+        await recordCampaignReach(sends.doc(campaignId), reached);
         /*
      * And who it decided NOT to mail, under a field of its own.
      *
@@ -1725,7 +1757,7 @@ export async function performCampaignSend(options) {
      * anybody asks for one, and the batch that asks is the NEXT invocation of
      * this function, which will have no way to know that these five hundred
      * addresses were already considered.
-     */ await recordCampaignSkipped(hostId, campaignId, settledOut, firestore);
+     */ await recordCampaignSkipped(sends.doc(campaignId), settledOut);
     }
     // Sends are the email variant's exposures (AGL-255).
     if (experiment && experiment.status === 'running') {
@@ -1822,7 +1854,7 @@ export async function performCampaignSend(options) {
    * stand, which is the same "recorded, not recomputed" rule the populations
    * below are stored under: they are true of the send that happened.
    */ const measuresTheAudience = !options.continuation;
-    await hostRef.collection('campaigns').doc(campaignId).set(_extends({
+    await sends.doc(campaignId).set(_extends({}, campaignSendSiteStamp(hostId), {
         subject,
         body,
         audience
@@ -2490,7 +2522,7 @@ function storedSendOptionsFrom(snapshot, hostId, senderUid, followUp) {
         error: 'Unauthenticated'
     });
     try {
-        var _hostSnapshot_get, _ref11, _ref12, _ref13, _ref14;
+        var _hostSnapshot_get, _ref11, _ref12, _ref13, _ref14, _ref15;
         var _req_body15, _req_body16, _req_body17, _req_body18, _req_body19;
         const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
         /*
@@ -2538,6 +2570,45 @@ function storedSendOptionsFrom(snapshot, hostId, senderUid, followUp) {
                 error: 'Not a site admin or editor'
             });
         }
+        /*==========================================
+     * THE ORGANIZATION'S SENDS, AND WHICH OF THEM THIS SITE MAY TOUCH.
+     *
+     * Sends and campaigns are recorded under the org, so every branch below
+     * that reads or writes one goes through `orgSends`. It is null for a site
+     * with no organization, and each such branch refuses rather than
+     * guessing where to write.
+     *
+     * The role above is a role on THIS site, while the collection holds every
+     * site's mail. So a send addressed by id is acted on only when it is sent
+     * as this site (`sendIsOnHost`); a sibling site's send answers exactly as
+     * a send that does not exist, which is what it is from here.
+     *=========================================*/ const orgForSite = await getOrgForHost(hostId).catch(()=>null);
+        const siteOrgId = String((_ref11 = orgForSite == null ? void 0 : orgForSite.orgId) != null ? _ref11 : '');
+        const orgSends = siteOrgId ? orgCampaignSends(firestore, siteOrgId) : null;
+        const needsOrg = action !== 'proofOptions' && action !== 'test' && action !== 'renderPreview' && action !== 'preview';
+        if (needsOrg && !orgSends) {
+            return res.status(409).json({
+                error: 'This site is not part of an organization, so it cannot hold ' + 'campaign emails.'
+            });
+        }
+        /*
+     * THE CAMPAIGN A SEND JOINS has to be one this site can see.
+     *
+     * The id is a pointer the console chose from a picker, but the request
+     * could carry any container in the org — including one placed only on a
+     * sibling site, which this site's editors cannot read — or one that has
+     * been deleted. Filing a send under either would put it where its own
+     * editors cannot find it. Checked only for the actions that store it.
+     */ if (emailCampaignId && (action === 'draft' || action === 'schedule' || action === 'send')) {
+            const container = await orgEmailCampaigns(firestore, siteOrgId).doc(emailCampaignId).get();
+            if (!container.exists || container.get('deletedAt') != null || !campaignPlacedOnHost({
+                visibleTo: container.get('visibleTo')
+            }, hostId)) {
+                return res.status(400).json({
+                    error: 'Unknown campaign'
+                });
+            }
+        }
         if (action === 'proofOptions') {
             var _decoded_email;
             /*
@@ -2565,7 +2636,7 @@ function storedSendOptionsFrom(snapshot, hostId, senderUid, followUp) {
             });
         }
         if (action === 'test') {
-            var _decoded_email1, _ref15, _ref16;
+            var _decoded_email1, _ref16, _ref17;
             var _req_body20, _req_body21;
             /*
        * PROOF ONE EMAIL: as somebody, to somebody, from an identity — and
@@ -2577,7 +2648,7 @@ function storedSendOptionsFrom(snapshot, hostId, senderUid, followUp) {
        * to. Which identity it leaves on is not among them: that is resolved
        * from the host document, and no request field reaches it.
        */ const ownEmail = String((_decoded_email1 = decoded.email) != null ? _decoded_email1 : '').trim().toLowerCase();
-            const requestedTo = String((_ref15 = (_req_body20 = req.body) == null ? void 0 : _req_body20.to) != null ? _ref15 : '').trim().toLowerCase();
+            const requestedTo = String((_ref16 = (_req_body20 = req.body) == null ? void 0 : _req_body20.to) != null ? _ref16 : '').trim().toLowerCase();
             const testEmail = requestedTo || ownEmail;
             if (!testEmail) {
                 return res.status(400).json({
@@ -2618,7 +2689,7 @@ function storedSendOptionsFrom(snapshot, hostId, senderUid, followUp) {
        * taken from the request, so what a proof shows is what the audience
        * document actually holds — a persona assembled from a request would
        * demonstrate the composer's own typing rather than the merge.
-       */ const persona = await resolveProofPersona(hostId, String((_ref16 = (_req_body21 = req.body) == null ? void 0 : _req_body21.personaEmail) != null ? _ref16 : ''));
+       */ const persona = await resolveProofPersona(hostId, String((_ref17 = (_req_body21 = req.body) == null ? void 0 : _req_body21.personaEmail) != null ? _ref17 : ''));
             const result = await performCampaignSend(_extends({
                 hostId,
                 subject,
@@ -2673,8 +2744,7 @@ function storedSendOptionsFrom(snapshot, hostId, senderUid, followUp) {
                 cname: hostSnapshot.get('cname'),
                 subdomain: hostSnapshot.get('subdomain')
             })) != null ? _hostPublicOrigin : '';
-            const orgForHost = await getOrgForHost(hostId);
-            const branding = resolveBrandingProfile(orgForHost == null ? void 0 : orgForHost.org);
+            const branding = resolveBrandingProfile(orgForSite == null ? void 0 : orgForSite.org);
             /*
        * Personalized for the REQUESTER, because a preview showing raw
        * `{{firstName|there}}` tells a merchant nothing about what a recipient
@@ -2712,7 +2782,7 @@ function storedSendOptionsFrom(snapshot, hostId, senderUid, followUp) {
             } : {}));
         }
         if (action === 'preview') {
-            var _ref17, _ref18;
+            var _ref18, _ref19;
             var _req_body22, _req_body23, _req_body24;
             // Read-only, and it needs the same admin/editor role as a send: the
             // audience size of someone else's site is not public information.
@@ -2721,8 +2791,8 @@ function storedSendOptionsFrom(snapshot, hostId, senderUid, followUp) {
                 subject: subject || 'preview',
                 body: body || 'preview',
                 audience,
-                segmentId: String((_ref17 = (_req_body22 = req.body) == null ? void 0 : _req_body22.segmentId) != null ? _ref17 : ''),
-                listId: String((_ref18 = (_req_body23 = req.body) == null ? void 0 : _req_body23.listId) != null ? _ref18 : ''),
+                segmentId: String((_ref18 = (_req_body22 = req.body) == null ? void 0 : _req_body22.segmentId) != null ? _ref18 : ''),
+                listId: String((_ref19 = (_req_body23 = req.body) == null ? void 0 : _req_body23.listId) != null ? _ref19 : ''),
                 topicId: topicId || undefined,
                 emails: Array.isArray((_req_body24 = req.body) == null ? void 0 : _req_body24.emails) ? req.body.emails.map(String) : undefined,
                 templateScreenId: templateScreenId || undefined
@@ -2735,7 +2805,7 @@ function storedSendOptionsFrom(snapshot, hostId, senderUid, followUp) {
             return res.status(200).json(result);
         }
         if (action === 'followUp') {
-            var _ref19;
+            var _ref20;
             var _req_body25, _req_body26;
             /*
        * SEND AN EMAIL THAT HAS ALREADY GONE OUT TO THE PEOPLE IT HAS NOT
@@ -2751,14 +2821,14 @@ function storedSendOptionsFrom(snapshot, hostId, senderUid, followUp) {
        * `dryRun` rides through so the console can ask how many people are
        * left before offering the button, and the answer comes from the code
        * that would do the sending rather than from a count of its own.
-       */ const followUpId = String((_ref19 = (_req_body25 = req.body) == null ? void 0 : _req_body25.campaignId) != null ? _ref19 : '');
+       */ const followUpId = String((_ref20 = (_req_body25 = req.body) == null ? void 0 : _req_body25.campaignId) != null ? _ref20 : '');
             if (!isDocumentId(followUpId)) {
                 return res.status(400).json({
                     error: 'Invalid campaignId'
                 });
             }
-            const sendSnapshot = await hostRef.collection('campaigns').doc(followUpId).get();
-            if (!sendSnapshot.exists) {
+            const sendSnapshot = await orgSends.doc(followUpId).get();
+            if (!sendSnapshot.exists || !sendIsOnHost(sendSnapshot, hostId)) {
                 return res.status(404).json({
                     error: 'Unknown email'
                 });
@@ -2794,16 +2864,16 @@ function storedSendOptionsFrom(snapshot, hostId, senderUid, followUp) {
      * escape on its own; `performCampaignSend` is the only thing that mails
      * it, and only when somebody asks.
      *=========================================*/ if (action === 'draft' || action === 'schedule' || action === 'update') {
-            var _ref20, _ref21, _targetSnapshot_get;
+            var _ref21, _ref22, _targetSnapshot_get;
             var _req_body27, _req_body28, _req_body29, _req_body30, _req_body31, _req_body32;
             const scheduling = action === 'schedule';
-            const sendAtMs = Number((_ref20 = (_req_body27 = req.body) == null ? void 0 : _req_body27.sendAtMs) != null ? _ref20 : 0);
+            const sendAtMs = Number((_ref21 = (_req_body27 = req.body) == null ? void 0 : _req_body27.sendAtMs) != null ? _ref21 : 0);
             if (scheduling && (!Number.isFinite(sendAtMs) || sendAtMs <= Date.now())) {
                 return res.status(400).json({
                     error: 'Pick a future send time'
                 });
             }
-            const campaignId = String((_ref21 = (_req_body28 = req.body) == null ? void 0 : _req_body28.campaignId) != null ? _ref21 : '') || createResourceUid();
+            const campaignId = String((_ref22 = (_req_body28 = req.body) == null ? void 0 : _req_body28.campaignId) != null ? _ref22 : '') || createResourceUid();
             // AGL-1771: this branch WRITES, and it is the only campaign write that
             // does not go through `performCampaignSend`'s guard. A `campaignId` of
             // `a/b/c` scheduled the campaign at `campaigns/a/b/c` — which the
@@ -2815,8 +2885,17 @@ function storedSendOptionsFrom(snapshot, hostId, senderUid, followUp) {
                     error: 'Invalid campaignId'
                 });
             }
-            const targetRef = hostRef.collection('campaigns').doc(campaignId);
+            const targetRef = orgSends.doc(campaignId);
             const targetSnapshot = await targetRef.get();
+            /*
+       * An id that names a sibling site's send is refused, not adopted: the
+       * merge below would otherwise rewrite that site's email under this
+       * site's name.
+       */ if (targetSnapshot.exists && !sendIsOnHost(targetSnapshot, hostId)) {
+                return res.status(404).json({
+                    error: 'Unknown email'
+                });
+            }
             const targetState = targetSnapshot.exists ? String((_targetSnapshot_get = targetSnapshot.get('status')) != null ? _targetSnapshot_get : '') : '';
             /*==========================================
        * WHAT IS ALREADY IN AN INBOX IS NOT EDITABLE.
@@ -2851,9 +2930,9 @@ function storedSendOptionsFrom(snapshot, hostId, senderUid, followUp) {
                         error: 'Unknown email'
                     });
                 }
-                await targetRef.set({
+                await targetRef.set(_extends({}, campaignSendSiteStamp(hostId), {
                     displayName
-                }, {
+                }), {
                     merge: true
                 });
                 return res.status(200).json({
@@ -2861,7 +2940,7 @@ function storedSendOptionsFrom(snapshot, hostId, senderUid, followUp) {
                     displayName
                 });
             }
-            await targetRef.set(_extends({
+            await targetRef.set(_extends({}, campaignSendSiteStamp(hostId), {
                 subject,
                 body,
                 audience
@@ -2938,9 +3017,9 @@ function storedSendOptionsFrom(snapshot, hostId, senderUid, followUp) {
             });
         }
         if (action === 'cancel') {
-            var _ref22;
+            var _ref23;
             var _req_body33;
-            const campaignId = String((_ref22 = (_req_body33 = req.body) == null ? void 0 : _req_body33.campaignId) != null ? _ref22 : '');
+            const campaignId = String((_ref23 = (_req_body33 = req.body) == null ? void 0 : _req_body33.campaignId) != null ? _ref23 : '');
             // AGL-1771: the ref used to be built one line ABOVE the `campaignId ?`
             // check below, which defeated that check — `.doc('')` throws on an empty
             // path segment, so the 400 this branch intends became a 500. Guarding
@@ -2950,18 +3029,18 @@ function storedSendOptionsFrom(snapshot, hostId, senderUid, followUp) {
                     error: 'Not a scheduled campaign'
                 });
             }
-            const campaignRef = hostRef.collection('campaigns').doc(campaignId);
+            const campaignRef = orgSends.doc(campaignId);
             const campaignSnapshot = await campaignRef.get();
-            if (!(campaignSnapshot == null ? void 0 : campaignSnapshot.exists) || campaignSnapshot.get('status') !== 'scheduled') {
+            if (!(campaignSnapshot == null ? void 0 : campaignSnapshot.exists) || !sendIsOnHost(campaignSnapshot, hostId) || campaignSnapshot.get('status') !== 'scheduled') {
                 return res.status(400).json({
                     error: 'Not a scheduled campaign'
                 });
             }
-            await campaignRef.set({
+            await campaignRef.set(_extends({}, campaignSendSiteStamp(hostId), {
                 status: 'canceled',
                 canceledAt: firebaseAdmin.firestore.FieldValue.serverTimestamp(),
                 canceledBy: decoded.uid
-            }, {
+            }), {
                 merge: true
             });
             return res.status(200).json({
@@ -2970,7 +3049,7 @@ function storedSendOptionsFrom(snapshot, hostId, senderUid, followUp) {
             });
         }
         if (action === 'sendNow') {
-            var _ref23, _sendNowSnapshot_get, _ref24;
+            var _ref24, _sendNowSnapshot_get, _ref25;
             var _req_body34, _sendNowSnapshot_get1;
             /*==========================================
        * MAIL A DRAFTED OR SCHEDULED EMAIL, NOW.
@@ -2987,15 +3066,15 @@ function storedSendOptionsFrom(snapshot, hostId, senderUid, followUp) {
        * lists, the same topic filtering, the same monthly reservation and the
        * same hourly governor — because it is the same function the scheduled
        * processor and the composer both call.
-       *=========================================*/ const sendNowId = String((_ref23 = (_req_body34 = req.body) == null ? void 0 : _req_body34.campaignId) != null ? _ref23 : '');
+       *=========================================*/ const sendNowId = String((_ref24 = (_req_body34 = req.body) == null ? void 0 : _req_body34.campaignId) != null ? _ref24 : '');
             if (!isDocumentId(sendNowId)) {
                 return res.status(400).json({
                     error: 'Invalid campaignId'
                 });
             }
-            const sendNowRef = hostRef.collection('campaigns').doc(sendNowId);
+            const sendNowRef = orgSends.doc(sendNowId);
             const sendNowSnapshot = await sendNowRef.get();
-            if (!sendNowSnapshot.exists) {
+            if (!sendNowSnapshot.exists || !sendIsOnHost(sendNowSnapshot, hostId)) {
                 return res.status(404).json({
                     error: 'Unknown email'
                 });
@@ -3028,7 +3107,7 @@ function storedSendOptionsFrom(snapshot, hostId, senderUid, followUp) {
        * beat — so there is nothing for a merchant to ask for here, and
        * "Send now" on a send already in flight is a request made under a
        * misunderstanding the answer should correct.
-       *=========================================*/ const resumeRemaining = Math.floor(Number((_ref24 = (_sendNowSnapshot_get1 = sendNowSnapshot.get('resume')) == null ? void 0 : _sendNowSnapshot_get1.remaining) != null ? _ref24 : 0));
+       *=========================================*/ const resumeRemaining = Math.floor(Number((_ref25 = (_sendNowSnapshot_get1 = sendNowSnapshot.get('resume')) == null ? void 0 : _sendNowSnapshot_get1.remaining) != null ? _ref25 : 0));
             if (Number.isFinite(resumeRemaining) && resumeRemaining > 0) {
                 return res.status(409).json({
                     error: 'This email is already being sent, and the rest of it goes out ' + 'on its own. Sending it now would mail a second copy to ' + 'everyone it has already reached.'
@@ -3102,7 +3181,7 @@ function storedSendOptionsFrom(snapshot, hostId, senderUid, followUp) {
      * Reaching the people an existing email has NOT reached is `followUp`,
      * which takes no copy from the request at all and subtracts everyone the
      * earlier sends recorded.
-     *=========================================*/ const sendId = String((_ref11 = (_req_body15 = req.body) == null ? void 0 : _req_body15.campaignId) != null ? _ref11 : '');
+     *=========================================*/ const sendId = String((_ref12 = (_req_body15 = req.body) == null ? void 0 : _req_body15.campaignId) != null ? _ref12 : '');
         if (sendId) {
             var _existing_get;
             if (!isDocumentId(sendId)) {
@@ -3110,7 +3189,12 @@ function storedSendOptionsFrom(snapshot, hostId, senderUid, followUp) {
                     error: 'Invalid campaignId'
                 });
             }
-            const existing = await hostRef.collection('campaigns').doc(sendId).get();
+            const existing = await orgSends.doc(sendId).get();
+            if (existing.exists && !sendIsOnHost(existing, hostId)) {
+                return res.status(404).json({
+                    error: 'Unknown email'
+                });
+            }
             const existingState = existing.exists ? String((_existing_get = existing.get('status')) != null ? _existing_get : '') : '';
             if (existing.exists && existingState !== 'draft' && existingState !== 'scheduled') {
                 return res.status(409).json({
@@ -3123,12 +3207,12 @@ function storedSendOptionsFrom(snapshot, hostId, senderUid, followUp) {
             subject,
             body,
             audience,
-            segmentId: String((_ref12 = (_req_body16 = req.body) == null ? void 0 : _req_body16.segmentId) != null ? _ref12 : ''),
-            listId: String((_ref13 = (_req_body17 = req.body) == null ? void 0 : _req_body17.listId) != null ? _ref13 : ''),
+            segmentId: String((_ref13 = (_req_body16 = req.body) == null ? void 0 : _req_body16.segmentId) != null ? _ref13 : ''),
+            listId: String((_ref14 = (_req_body17 = req.body) == null ? void 0 : _req_body17.listId) != null ? _ref14 : ''),
             topicId: topicId || undefined,
             emails: Array.isArray((_req_body18 = req.body) == null ? void 0 : _req_body18.emails) ? req.body.emails : undefined,
             campaignId: sendId,
-            experimentId: String((_ref14 = (_req_body19 = req.body) == null ? void 0 : _req_body19.experimentId) != null ? _ref14 : ''),
+            experimentId: String((_ref15 = (_req_body19 = req.body) == null ? void 0 : _req_body19.experimentId) != null ? _ref15 : ''),
             templateScreenId: templateScreenId || undefined
         }, plainText ? {
             plainText