@aglyn/plugins-marketing 1.0.0-beta.181 → 1.0.0-beta.182

package/src/lib/server/campaign-send.js

@@ -61,6 +61,11 @@ import { campaignSendSiteStamp, orgCampaignSends, orgEmailCampaigns, sendIsOnHos
  */ import { claimOrgEmailSendDay, orgAgeDays, readSenderReputation, reconcileOrgEmailSendDay, recordCampaignAccepted, resolveOrgEmailRamp } from "@aglyn/tenant-data-admin/server/email-sender-reputation";
 import { createHash } from "crypto";
 import { EMAIL_MAX_AUDIENCE_PER_SEND, EMAIL_MAX_RECIPIENTS_PER_SEND, campaignBatchPlan, createProviderRequestPacer, effectiveReputationPolicy, HOST_SENDERS_COLLECTION, isEmailConfigured, rateLimitedRetryAtMs, readHostSender, sendEmail, sendingIdentityRefusal, sentAsStamp } from "@aglyn/shared-util-email";
+/*
+ * The List-Unsubscribe setting sequences share (AGL-3307), from its LEAF
+ * module: the specs that reach this file spread the real barrel under their
+ * own stubs, and a decision that turns a header off must be the real one.
+ */ import { decideListUnsubscribe, listUnsubscribeForcedDetail, listUnsubscribeHeaders, readListUnsubscribeSetting } from "@aglyn/shared-util-email/list-unsubscribe";
 /**
  * Recipients one send may address.
  *
@@ -293,6 +298,11 @@ const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
         preheader: String((_screenSnapshot_get1 = screenSnapshot.get('emailPreheader')) != null ? _screenSnapshot_get1 : '')
     };
 }
+/**
+ * The field on a SEND recording what it did with the List-Unsubscribe header
+ * (AGL-3307) — see {@link CampaignListUnsubscribeRecord} in
+ * `@aglyn/shared-ui-email-campaigns`, which the campaign page reads.
+ */ const LIST_UNSUBSCRIBE_RECORD_FIELD = 'listUnsubscribe';
 export async function performCampaignSend(options) {
     var _ref, _options_senderId, _options_proofFor, _hostPublicOrigin, _options_experimentId;
     var _orgForHost_org, _orgForHost_org1, _consent_get;
@@ -409,6 +419,7 @@ export async function performCampaignSend(options) {
    * Batches this email has already run, so the plan below can tell the second
    * from the twentieth. Zero on every first send.
    */ let batchesSoFar = 0;
+    /** Why an earlier batch of this email carried a forced header, if one did. */ let forcedBefore = null;
     /*==========================================
    * THE NEXT BATCH'S ADMISSION CHECKS.
    *
@@ -453,6 +464,14 @@ export async function performCampaignSend(options) {
             ...settled.skipped
         ]);
         batchesSoFar = Math.max(0, Math.floor(Number((_ref2 = (_sendSnapshot_get2 = sendSnapshot.get('resume')) == null ? void 0 : _sendSnapshot_get2.batch) != null ? _ref2 : 0)) || 0);
+        /*
+     * An earlier batch the bulk guard turned the header back on for keeps
+     * it on for the rest of the email (AGL-3307): one mailing does not lose
+     * its unsubscribe button halfway through because a day rolled over.
+     */ const earlier = sendSnapshot.get(LIST_UNSUBSCRIBE_RECORD_FIELD);
+        if ((earlier == null ? void 0 : earlier.forced) === true && (earlier.reason === 'bulk-volume' || earlier.reason === 'pooled-identity' || earlier.reason === 'volume-unknown')) {
+            forcedBefore = earlier.reason;
+        }
     }
     /**
    * A batch that found nothing left to do: the email is FINISHED, not broken.
@@ -967,6 +986,12 @@ export async function performCampaignSend(options) {
    * every single day and never send anything at all.
    */ let batchCap = MAX_RECIPIENTS_PER_SEND;
     /** Today's ramp, resolved once and claimed against below. */ let ramp = null;
+    /**
+   * Campaign messages this workspace has sent in the last day, for the
+   * List-Unsubscribe bulk guard (AGL-3307). `null` when the window could not
+   * be read, which the guard answers by carrying the header. Zero on a test
+   * send, which is one message to somebody on the workspace.
+   */ let recentCampaignVolume = 0;
     if (!proofOnly) {
         var _orgForHost_org2, _orgForHost_org3;
         /** This workspace's seven-day grade, and the window both controls read. */ const reputation = await readSenderReputation({
@@ -974,6 +999,7 @@ export async function performCampaignSend(options) {
             policy: reputationPolicy,
             reinstatedUntilMs: orgForHost == null ? void 0 : (_orgForHost_org2 = orgForHost.org) == null ? void 0 : _orgForHost_org2['emailReputationReinstatedUntilMs']
         });
+        recentCampaignVolume = reputation.degraded ? null : reputation.window.acceptedLastTwoDays;
         /*
      * THE CIRCUIT BREAKER.
      *
@@ -1459,7 +1485,42 @@ export async function performCampaignSend(options) {
    * when, not about whom, and settling a recipient on one would drop somebody
    * the provider never even looked at while the campaign closed as complete.
    * They break the loop into `deferred` instead; see the branch below.
-   */ const sendableSet = new Set(sendable);
+   */ /*==========================================
+   * THE MAIL-CLIENT UNSUBSCRIBE BUTTON (AGL-3307).
+   *
+   * The campaign's `listUnsubscribe` setting, ON unless somebody turned it
+   * off — and turned back on for this send when leaving it off would break
+   * Gmail's and Yahoo's bulk-sender rule, see `decideListUnsubscribe`. The
+   * volume is what the workspace sent in the last day plus EVERYONE this
+   * email still has to reach, not just this batch, so an email that will
+   * make the workspace a bulk sender carries the header from its first
+   * message rather than from the batch that crosses the line.
+   *
+   * The footer link is not part of this: `renderRecipientEmail` writes it
+   * into every message whatever the header does.
+   *
+   * An unreadable campaign reads as the default, ON, and an unreadable
+   * volume forces it on: the header is the safe direction to be wrong in.
+   *=========================================*/ let listUnsubscribeRequested = true;
+    if (options.emailCampaignId) {
+        try {
+            const container = await orgEmailCampaigns(firestore, orgId).doc(options.emailCampaignId).get();
+            listUnsubscribeRequested = readListUnsubscribeSetting(container.exists ? container.get('listUnsubscribe') : undefined, true);
+        } catch (error) {
+            console.error('[campaign] campaign unreadable — keeping the unsubscribe header on', error);
+        }
+    }
+    const listUnsubscribe = decideListUnsubscribe({
+        requested: listUnsubscribeRequested,
+        recentVolume: recentCampaignVolume != null ? recentCampaignVolume : 0,
+        sendVolume: proofOnly ? sendable.length : consentSplit.mailable.length,
+        pooled: sendingIdentity.source === 'shared',
+        forcedBefore: recentCampaignVolume === null ? 'volume-unknown' : forcedBefore
+    });
+    if (listUnsubscribe.forced) {
+        console.warn(`[campaign] ${options.campaignId || 'new send'}: unsubscribe header ` + `forced on (${listUnsubscribe.reason}, ` + `${listUnsubscribe.volume}/${listUnsubscribe.threshold})`);
+    }
+    const sendableSet = new Set(sendable);
     const settledOut = recipients.filter((email)=>!sendableSet.has(email));
     let sent = 0;
     /** Recipients a rate refusal left untouched mid-batch, if any. */ let deferred = 0;
@@ -1513,9 +1574,9 @@ export async function performCampaignSend(options) {
        * reference `{{unsubscribeUrl}}`, and because the page it opens is still
        * where you go to unsubscribe — with "Unsubscribe from everything" on
        * it, one button away.
-       */ const oneClickUrl = buildUnsubscribeUrl(_extends({}, link, {
+       */ const oneClickUrl = listUnsubscribe.on ? buildUnsubscribeUrl(_extends({}, link, {
                 surface: 'one-click'
-            }));
+            })) : '';
             const unsubscribeUrl = buildUnsubscribeUrl(_extends({}, link, {
                 surface: 'preferences'
             }));
@@ -1592,10 +1653,13 @@ export async function performCampaignSend(options) {
                 // person can choose on a page; they change nothing about what a
                 // machine POSTing this header is promised, which is that the
                 // recipient stops hearing from this site.
-                headers: {
-                    'List-Unsubscribe': `<${oneClickUrl}>`,
-                    'List-Unsubscribe-Post': 'List-Unsubscribe=One-Click'
-                },
+                //
+                // Only when the campaign's setting — or the bulk guard — says so
+                // (AGL-3307). Off, the footer link above is the way out, and the
+                // pair is written by the builder sequences use.
+                headers: listUnsubscribeHeaders({
+                    url: oneClickUrl
+                }),
                 // The campaign's own display name where the composer set one, and the
                 // org's branding default otherwise. Either way the ADDRESS is the
                 // resolved identity's — `applyFromName` replaces the display name in
@@ -1808,6 +1872,11 @@ export async function performCampaignSend(options) {
    * the hour or the day THREW rather than reaching here, so the only reason
    * this is not immediate is a batch that ran to the end of its own cap.
    */ const nextAtMs = plan.resuming ? Date.now() : 0;
+    const listUnsubscribeResult = {
+        on: listUnsubscribe.on,
+        forced: listUnsubscribe.forced,
+        reason: listUnsubscribe.reason
+    };
     if (options.recordCampaign === false) {
         return _extends({
             campaignId,
@@ -1819,7 +1888,9 @@ export async function performCampaignSend(options) {
             sent
         }, deferred ? {
             deferred
-        } : {});
+        } : {}, {
+            listUnsubscribe: listUnsubscribeResult
+        });
     }
     /*==========================================
    * ADDING TO A COUNTER, AS AGAINST REPLACING IT.
@@ -1892,7 +1963,25 @@ export async function performCampaignSend(options) {
         displayName: options.displayName
     } : {}, options.emailCampaignId ? {
         emailCampaignId: options.emailCampaignId
-    } : {}, experiment ? {
+    } : {}, {
+        /*
+       * WHAT THIS EMAIL DID WITH THE UNSUBSCRIBE HEADER, and why (AGL-3307).
+       * Written absolutely on every batch; a batch after a forced one is
+       * forced too, so the last write is the email's answer. The campaign
+       * page reads `forced` and `detail` to say it was turned back on.
+       */ [LIST_UNSUBSCRIBE_RECORD_FIELD]: _extends({
+            requested: listUnsubscribe.requested,
+            on: listUnsubscribe.on,
+            forced: listUnsubscribe.forced
+        }, listUnsubscribe.reason ? {
+            reason: listUnsubscribe.reason,
+            detail: listUnsubscribeForcedDetail(listUnsubscribe)
+        } : {}, {
+            volume: listUnsubscribe.volume,
+            threshold: listUnsubscribe.threshold,
+            atMs: Date.now()
+        })
+    }, experiment ? {
         experimentId: experiment.$id
     } : {}, {
         stats: _extends({
@@ -1995,7 +2084,9 @@ export async function performCampaignSend(options) {
         batch: plan.batch
     }, plan.resuming ? {
         nextAtMs
-    } : {});
+    } : {}, {
+        listUnsubscribe: listUnsubscribeResult
+    });
 }
 /**
  * THE ADDRESSES A TEST SEND MAY BE DELIVERED TO.
@@ -2710,6 +2801,8 @@ function storedSendOptionsFrom(snapshot, hostId, senderUid, followUp) {
                 preheader
             }, persona ? {
                 proofPersona: persona
+            } : {}, emailCampaignId ? {
+                emailCampaignId
             } : {}, {
                 recordCampaign: false,
                 senderUid: decoded.uid,