@antelopejs/dms-mailing 0.3.0 → 0.3.2

package/src/data/templates-table.ts

@@ -39,6 +39,7 @@ import { createTemplateSchema } from "../validation/templates.schema";
 import { parseBody } from "./body";
 
 const DUPLICATE_SLUG = "$dms_mailing.errors.duplicate_slug";
+const SLUG_IMMUTABLE = "$dms_mailing.errors.slug_immutable";
 const SOURCE_NOT_FOUND = "$dms_mailing.errors.template_not_found";
 const CREATE_ONLY = { edit: ReadonlyBehaviorType.disabled };
 // Read-only columns render as empty dashes on the create form; the four fields
@@ -99,9 +100,54 @@ function withSeeding(base: DataControllerCallback): DataControllerCallback {
   };
 }
 
+interface EditParams {
+  id: string;
+}
+
+/**
+ * The body an edit may apply. Sends resolve templates by slug and nothing
+ * enforces its uniqueness but the create checks, so a slug never changes once
+ * set: a different one is refused, a missing one (which the data-api edit
+ * would null) is kept.
+ */
+async function withStoredSlug(
+  tenantId: string,
+  templateId: string,
+  body: Buffer | string,
+): Promise<Buffer | string> {
+  const stored = await GetModel(TemplateModel, tenantId).get(templateId);
+  if (!stored) return body;
+  const edit = parseBody(body);
+  if (edit.slug !== undefined && edit.slug !== stored.slug) {
+    throw new HTTPResult(HTTP_CONFLICT, SLUG_IMMUTABLE);
+  }
+  return JSON.stringify({ ...edit, slug: stored.slug });
+}
+
+function withFixedSlug(base: DataControllerCallback): DataControllerCallback {
+  return {
+    ...base,
+    func: async function (
+      this: unknown,
+      ctx: RequestContext,
+      params: EditParams,
+      body: Buffer | string,
+      ...rest: unknown[]
+    ) {
+      const guarded = await withStoredSlug(
+        getRequestTenantId(ctx),
+        params.id,
+        body,
+      );
+      return base.func.call(this, ctx, params, guarded, ...rest);
+    },
+  };
+}
+
 const templateRoutes = {
   ...TableViewRoutes.All,
   new: withSeeding(TableViewRoutes.New),
+  edit: withFixedSlug(TableViewRoutes.Edit),
 };
 
 @RegisterDataController()

package/src/db/models/sends.model.ts

@@ -14,6 +14,9 @@ type NewSend = Omit<
   "_id" | "createdAt" | "revision" | "isRetiring" | "lastActivityAt"
 >;
 
+/** A send as the metrics read it: everything but the rendered variables. */
+export type SendSummary = Omit<MailingSend, "json_variables">;
+
 type SendActivity = Pick<
   MailingSend,
   "status" | "opens" | "clicks" | "lastEventAt" | "provider"
@@ -74,11 +77,12 @@ export class SendModel extends BasicDataModel(
     return rows[0];
   }
 
-  listBetween(from: Date, to: Date): Promise<MailingSend[]> {
+  listBetween(from: Date, to: Date): Promise<SendSummary[]> {
     return this.table
       .filter((row) => row.key("createdAt").ge(from))
       .filter((row) => row.key("createdAt").lt(to))
-      .run();
+      .without("json_variables")
+      .run() as Promise<SendSummary[]>;
   }
 
   listOlderThan(limit: Date, pageSize: number): Promise<MailingSend[]> {

package/src/db/models/settings.model.ts

@@ -5,7 +5,13 @@ export class SettingsModel extends BasicDataModel(
   MailingSettings,
   MAILING_SETTINGS_TABLE_NAME,
 ) {
-  async getSingleton(): Promise<MailingSettings | undefined> {
+  /**
+   * The tenant's settings row, keyed by the tenant id. Rows written before the
+   * key existed carry a random id and are still found by a scan.
+   */
+  async getSingleton(tenantId: string): Promise<MailingSettings | undefined> {
+    const keyed = await this.get(tenantId);
+    if (keyed) return keyed;
     const rows = await this.getAll();
     return rows[0];
   }

package/src/db/tables/send-events.table.ts

@@ -21,7 +21,6 @@ export class MailingSendEvent extends Table {
   @Field("string")
   declare type: SendEventType;
 
-  @Index()
   @Field("date")
   declare at: Date;
 

package/src/db/tables/sends.table.ts

@@ -20,7 +20,6 @@ export class MailingSend extends Table {
   @Field("date")
   declare createdAt: Date;
 
-  @Index()
   @Field("string")
   declare templateId: string;
 

package/src/db/tables/templates.table.ts

@@ -16,7 +16,6 @@ export class MailingTemplate extends Table {
   @Field("string")
   declare _id: string;
 
-  @Index()
   @CreationTime()
   @Field("date")
   declare createdAt: Date;

package/src/hooks/tenant-export.ts

@@ -64,7 +64,7 @@ export async function* jsonArrayChunks<T>(
 async function exportedSettings(
   tenantId: string,
 ): Promise<ExportedSettings | null> {
-  const row = await GetModel(SettingsModel, tenantId).getSingleton();
+  const row = await GetModel(SettingsModel, tenantId).getSingleton(tenantId);
   if (!row) return null;
   return {
     fallbackLocale: row.fallbackLocale,

package/src/routes/events.ts

@@ -11,7 +11,7 @@ import { getRequestTenantId } from "@antelopejs/interface-dms/request-tenant";
 import { z } from "zod";
 import { API_BASE_PATH, HTTP_FORBIDDEN } from "../constants";
 import { recordEmailEvent, webhookSecretMatches } from "../services/events";
-import { getSettings } from "../services/settings";
+import { findSettings } from "../services/settings";
 import { SEND_STATUSES, type SendStatus } from "../types";
 
 const SECRET_HEADER = "x-mailing-webhook-secret";
@@ -39,9 +39,9 @@ export class MailingEventsController extends Controller(
   ) {
     const event = assertValidation(body, (value) => eventSchema.parse(value));
     const tenantId = event.tenantId ?? getRequestTenantId(this.ctx);
-    const settings = await getSettings(tenantId);
+    const settings = await findSettings(tenantId);
     assert(
-      webhookSecretMatches(secret, settings.webhookSecret),
+      webhookSecretMatches(secret, settings?.webhookSecret),
       HTTP_FORBIDDEN,
       BAD_SECRET,
     );

package/src/routes/metrics.ts

@@ -12,7 +12,7 @@ import type { TopListItem } from "@antelopejs/interface-dms/base";
 import type { User } from "@antelopejs/interface-dms/auth/db";
 import { API_BASE_PATH, HTTP_NOT_FOUND } from "../constants";
 import {
-  type MailingSend,
+  type SendSummary,
   type MailingTemplate,
   SendModel,
   TemplateModel,
@@ -91,7 +91,7 @@ export class MetricsController extends Controller(`${API_BASE_PATH}/metrics`) {
     return readAudience(this.ctx.url.searchParams.get(SEND_AUDIENCE_QUERY_KEY));
   }
 
-  private async load(range: DateRange): Promise<MailingSend[]> {
+  private async load(range: DateRange): Promise<SendSummary[]> {
     const rows = await this.sends.listBetween(range.from, range.to);
     return forAudience(rows, this.audience);
   }
@@ -228,7 +228,7 @@ async function readTracking(): Promise<ProviderTracking | null> {
 
 function toTemplateItem(
   slug: string,
-  rows: MailingSend[],
+  rows: SendSummary[],
   templates: MailingTemplate[],
   extract: (totals: Totals) => number,
 ): TopListItem {

package/src/routes/period.ts

@@ -21,14 +21,19 @@ function parseDate(raw: string | undefined): Date | undefined {
   return Number.isNaN(parsed.getTime()) ? undefined : parsed;
 }
 
+/** Every window is read from the send log in full, so none may exceed the cap. */
+function clampToMaxWindow(requested: Date, to: Date): DateRange {
+  const earliest = to.getTime() - MAX_WINDOW_DAYS * DAY_MS;
+  const from = requested.getTime() < earliest ? new Date(earliest) : requested;
+  return { from, to };
+}
+
 export function currentRange(ctx: RangeContext): DateRange {
   const to = parseDate(readQuery(ctx, "to")) ?? new Date();
   const requested =
     parseDate(readQuery(ctx, "from")) ??
     new Date(to.getTime() - DEFAULT_WINDOW_DAYS * DAY_MS);
-  const earliest = to.getTime() - MAX_WINDOW_DAYS * DAY_MS;
-  const from = requested.getTime() < earliest ? new Date(earliest) : requested;
-  return { from, to };
+  return clampToMaxWindow(requested, to);
 }
 
 export function comparisonRange(
@@ -37,7 +42,7 @@ export function comparisonRange(
 ): DateRange {
   const from = parseDate(readQuery(ctx, "compareFrom"));
   const to = parseDate(readQuery(ctx, "compareTo"));
-  if (from && to) return { from, to };
+  if (from && to) return clampToMaxWindow(from, to);
   const span = current.to.getTime() - current.from.getTime();
   return {
     from: new Date(current.from.getTime() - span),

package/src/services/attention.ts

@@ -1,4 +1,4 @@
-import type { MailingSend, MailingTemplate } from "../db";
+import type { SendSummary, MailingTemplate } from "../db";
 import { PROBLEM_STATUSES } from "../types";
 
 export type AttentionTone = "error" | "warning" | "neutral";
@@ -24,7 +24,7 @@ const isStaleDraft = (template: MailingTemplate, now: number): boolean =>
   !template.publishedAt &&
   now - new Date(template.updatedAt).getTime() > STALE_DRAFT_DAYS * DAY_MS;
 
-function problemsItem(sends: MailingSend[]): AttentionItem[] {
+function problemsItem(sends: SendSummary[]): AttentionItem[] {
   const problems = sends.filter((send) =>
     PROBLEM_STATUSES.includes(send.status),
   );
@@ -62,7 +62,7 @@ function staleDraftsItem(templates: MailingTemplate[]): AttentionItem[] {
 
 function neverSentItem(
   templates: MailingTemplate[],
-  sends: MailingSend[],
+  sends: SendSummary[],
 ): AttentionItem[] {
   const used = new Set(sends.map((send) => send.templateSlug));
   const unused = templates.filter(
@@ -89,8 +89,8 @@ function neverSentItem(
  */
 export interface AttentionWindow {
   templates: MailingTemplate[];
-  sends: MailingSend[];
-  excluded: MailingSend[];
+  sends: SendSummary[];
+  excluded: SendSummary[];
   /** What the configured provider can report; `null` when it is unreachable. */
   tracking: ProviderTracking | null;
 }

package/src/services/events.ts

@@ -104,14 +104,14 @@ export async function recordEmailEvent(
 /**
  * Whether a webhook request carries the tenant's secret.
  *
- * Fails closed on a blank stored secret: the event endpoint is the module's
- * only unauthenticated route, so "no secret configured" must refuse everything
- * rather than accept an empty header. The comparison itself is constant-time;
+ * Fails closed on a blank or missing stored secret: the event endpoint is the
+ * module's only unauthenticated route, so "no secret configured" must refuse
+ * everything rather than accept an empty header. The comparison itself is constant-time;
  * only the length is observable.
  */
 export function webhookSecretMatches(
   provided: string | undefined,
-  stored: string,
+  stored: string | undefined,
 ): boolean {
   if (!stored || !provided) return false;
   const left = Buffer.from(provided);

package/src/services/metrics.ts

@@ -1,4 +1,4 @@
-import type { MailingSend } from "../db";
+import type { SendSummary } from "../db";
 import {
   BUSINESS_AUDIENCE,
   OPERATIONAL_AUDIENCE,
@@ -6,7 +6,7 @@ import {
   type SendStatus,
 } from "../types";
 
-const AUDIENCE_KEEPS: Record<SendAudience, (send: MailingSend) => boolean> = {
+const AUDIENCE_KEEPS: Record<SendAudience, (send: SendSummary) => boolean> = {
   [BUSINESS_AUDIENCE]: (send) => !send.isTest,
   [OPERATIONAL_AUDIENCE]: () => true,
 };
@@ -22,9 +22,9 @@ export function readAudience(raw: string | null | undefined): SendAudience {
 }
 
 export function forAudience(
-  sends: MailingSend[],
+  sends: SendSummary[],
   audience: SendAudience,
-): MailingSend[] {
+): SendSummary[] {
   return sends.filter(AUDIENCE_KEEPS[audience]);
 }
 
@@ -72,13 +72,13 @@ export const ratio = (part: number, whole: number): number =>
   whole ? (part / whole) * PERCENT : 0;
 
 const countIf = (
-  sends: MailingSend[],
-  predicate: (send: MailingSend) => boolean,
+  sends: SendSummary[],
+  predicate: (send: SendSummary) => boolean,
 ): number => sends.filter(predicate).length;
 
 const byStatus =
   (status: SendStatus) =>
-  (send: MailingSend): boolean =>
+  (send: SendSummary): boolean =>
     send.status === status;
 
 function median(values: number[]): number {
@@ -87,7 +87,7 @@ function median(values: number[]): number {
   return sorted[Math.floor(sorted.length / 2)] as number;
 }
 
-export function aggregate(sends: MailingSend[]): Totals {
+export function aggregate(sends: SendSummary[]): Totals {
   const delivered = countIf(sends, (send) =>
     DELIVERED_LIKE.includes(send.status),
   );
@@ -138,7 +138,7 @@ const dayKey = (date: Date): string =>
  * still counted it.
  */
 export function dailySeries(
-  sends: MailingSend[],
+  sends: SendSummary[],
   from: Date,
   to: Date,
 ): SeriesPoint[] {

package/src/services/settings.ts

@@ -44,15 +44,43 @@ function toRow(values: MailingSettingsValues): Partial<MailingSettings> {
   return { ...rest, json_categories: JSON.stringify(categories) };
 }
 
+/** The tenant's stored settings, without creating them when there are none. */
+export async function findSettings(
+  tenantId: string,
+): Promise<MailingSettingsValues | undefined> {
+  const existing = await GetModel(SettingsModel, tenantId).getSingleton(
+    tenantId,
+  );
+  return existing ? toValues(existing) : undefined;
+}
+
+/**
+ * Creates the tenant's row under its tenant id, so two concurrent first
+ * readers cannot both insert one: the loser's insert is refused on the key.
+ * Resolves false when another writer created the row first.
+ */
+async function insertKeyedSettings(
+  tenantId: string,
+  values: MailingSettingsValues,
+): Promise<boolean> {
+  const model = GetModel(SettingsModel, tenantId);
+  try {
+    await model.insert({ ...toRow(values), _id: tenantId });
+    return true;
+  } catch (error) {
+    if (await model.get(tenantId)) return false;
+    throw error;
+  }
+}
+
 export async function getSettings(
   tenantId: string,
 ): Promise<MailingSettingsValues> {
-  const model = GetModel(SettingsModel, tenantId);
-  const existing = await model.getSingleton();
-  if (existing) return toValues(existing);
+  const existing = await findSettings(tenantId);
+  if (existing) return existing;
   const created = defaults();
-  await model.insert(toRow(created));
-  return created;
+  if (await insertKeyedSettings(tenantId, created)) return created;
+  return (await findSettings(tenantId)) as MailingSettingsValues;
 }
 
 export async function saveSettings(
@@ -60,9 +88,10 @@ export async function saveSettings(
   values: MailingSettingsValues,
 ): Promise<MailingSettingsValues> {
   const model = GetModel(SettingsModel, tenantId);
-  const existing = await model.getSingleton();
+  const existing = await model.getSingleton(tenantId);
   if (existing) await model.update(existing._id, toRow(values));
-  else await model.insert(toRow(values));
+  else if (!(await insertKeyedSettings(tenantId, values)))
+    await model.update(tenantId, toRow(values));
   return values;
 }
 

package/src/test/integration/events.test.ts

@@ -3,11 +3,12 @@ import {
   clearEmailEventSubscriptions,
   emailEventTrigger,
 } from "../../automation/email-event-trigger";
-import { authorizedClient } from "../helpers/http";
+import { authorizedClient, createClient } from "../helpers/http";
 import { ensureOwnerSession } from "../helpers/owner";
 
 const HTTP_OK = 200;
 const HTTP_FORBIDDEN = 403;
+const SECRET_LENGTH = 48;
 const TABLE = "/api/mailing/tables/templates";
 
 interface EventRow {
@@ -100,6 +101,28 @@ describe("[integration] events", () => {
   });
 });
 
+describe("[integration] webhook for a tenant without settings", () => {
+  // The endpoint is unauthenticated and takes the tenant from the body: reading
+  // the secret must not create a settings row for whatever tenant id it names.
+  it("refuses the event and stores nothing", async () => {
+    const { GetModel } =
+      await import("@antelopejs/interface-database-decorators");
+    const { SettingsModel } = await import("../../db");
+    const tenantId = `unknown-tenant-${Date.now()}`;
+
+    const hook = await createClient().post(
+      "/api/mailing/events/manual",
+      { messageId: "unknown-message", type: "opened", tenantId },
+      { headers: { "x-mailing-webhook-secret": "a".repeat(SECRET_LENGTH) } },
+    );
+
+    expect(hook.status).to.equal(HTTP_FORBIDDEN);
+    expect(await GetModel(SettingsModel, tenantId).getAll()).to.have.lengthOf(
+      0,
+    );
+  });
+});
+
 describe("[integration] send event purge", () => {
   // The retention cron deletes a send's events in one filtered statement. A
   // wrong predicate there would take another send's history with it, so pin

package/src/test/integration/sends.test.ts

@@ -45,6 +45,39 @@ describe("[integration] sends", () => {
     expect(detail.data.events[0].type).to.equal(detail.data.send.status);
   });
 
+  // Metrics load every send of their window; the rendered variables are the
+  // one unbounded field and none of them reads it.
+  it("reads a metrics window without the rendered variables", async () => {
+    const session = await ensureOwnerSession();
+    const client = authorizedClient(session.accessToken);
+    const created = await client.post(`${TABLE}/new`, {
+      slug: "metrics-window",
+      name: "Metrics window",
+      category: "orders",
+    });
+    const sent = await client.post(
+      `/api/mailing/templates/${created.data[0]}/test-send`,
+      { to: ["metrics@example.test"], locale: "en", data: { any: "value" } },
+    );
+    expect(sent.status, JSON.stringify(sent.data)).to.equal(HTTP_OK);
+    const sendId = sent.data.results[0].sendId as string;
+
+    const { GetModel } =
+      await import("@antelopejs/interface-database-decorators");
+    const { DEFAULT_TENANT_ID } =
+      await import("@antelopejs/interface-dms/constants");
+    const { SendModel } = await import("../../db");
+    const now = Date.now();
+    const rows = await GetModel(SendModel, DEFAULT_TENANT_ID).listBetween(
+      new Date(now - DAY_MS),
+      new Date(now + DAY_MS),
+    );
+
+    const row = rows.find((candidate) => candidate._id === sendId);
+    expect(row?.templateSlug).to.equal("metrics-window");
+    expect(row).to.not.have.property("json_variables");
+  });
+
   it("refuses a real send on a draft template", async () => {
     const session = await ensureOwnerSession();
     const client = authorizedClient(session.accessToken);

package/src/test/integration/settings.test.ts

@@ -48,3 +48,81 @@ describe("[integration] settings", () => {
     expect(restored.status).to.equal(HTTP_OK);
   });
 });
+
+const CONCURRENT_READERS = 5;
+const LEGACY_RETENTION_DAYS = 45;
+const LEGACY_SECRET = "l".repeat(48);
+
+async function loadSettingsModules() {
+  const { GetModel } =
+    await import("@antelopejs/interface-database-decorators");
+  const { SettingsModel } = await import("../../db");
+  const settings = await import("../../services/settings");
+  return {
+    ...settings,
+    rowsOf: (tenantId: string) => GetModel(SettingsModel, tenantId).getAll(),
+    insertLegacyRow: (tenantId: string) =>
+      GetModel(SettingsModel, tenantId).insert({
+        fallbackLocale: "en",
+        logRetentionDays: LEGACY_RETENTION_DAYS,
+        blockOnMissingVariables: false,
+        senderName: "",
+        senderEmail: "",
+        replyTo: "",
+        json_categories: "[]",
+        webhookSecret: LEGACY_SECRET,
+      }),
+  };
+}
+
+describe("[integration] settings row per tenant", () => {
+  // Every request path reads the settings, so a tenant's first reads arrive
+  // together. Each used to insert its own default row with its own webhook
+  // secret; the row is now keyed by the tenant id so only one can land.
+  it("creates a single row when first readers race", async () => {
+    const { getSettings, rowsOf } = await loadSettingsModules();
+    const tenantId = `settings-race-${Date.now()}`;
+
+    const reads = await Promise.all(
+      Array.from({ length: CONCURRENT_READERS }, () => getSettings(tenantId)),
+    );
+
+    const rows = await rowsOf(tenantId);
+    expect(rows).to.have.lengthOf(1);
+    expect(rows[0]?._id).to.equal(tenantId);
+    for (const read of reads) {
+      expect(read.webhookSecret).to.equal(rows[0]?.webhookSecret);
+    }
+  });
+
+  it("keeps reading and updating a row written before the key existed", async () => {
+    const { getSettings, saveSettings, rowsOf, insertLegacyRow } =
+      await loadSettingsModules();
+    const tenantId = `settings-legacy-${Date.now()}`;
+    await insertLegacyRow(tenantId);
+
+    const read = await getSettings(tenantId);
+    expect(read.webhookSecret).to.equal(LEGACY_SECRET);
+    await saveSettings(tenantId, {
+      ...read,
+      logRetentionDays: UPDATED_RETENTION_DAYS,
+    });
+
+    const rows = await rowsOf(tenantId);
+    expect(rows).to.have.lengthOf(1);
+    expect(rows[0]?.logRetentionDays).to.equal(UPDATED_RETENTION_DAYS);
+  });
+
+  it("saves a tenant's first settings under the tenant id", async () => {
+    const { getSettings, saveSettings, rowsOf } = await loadSettingsModules();
+    const tenantId = `settings-first-save-${Date.now()}`;
+    const values = await getSettings(`settings-template-${Date.now()}`);
+
+    await saveSettings(tenantId, { ...values, webhookSecret: LEGACY_SECRET });
+
+    const rows = await rowsOf(tenantId);
+    expect(rows).to.have.lengthOf(1);
+    expect(rows[0]?._id).to.equal(tenantId);
+    expect(rows[0]?.webhookSecret).to.equal(LEGACY_SECRET);
+  });
+});

package/src/test/integration/templates.test.ts

@@ -5,6 +5,7 @@ import { ensureOwnerSession } from "../helpers/owner";
 const HTTP_OK = 200;
 const HTTP_BAD_REQUEST = 400;
 const HTTP_NOT_FOUND = 404;
+const HTTP_CONFLICT = 409;
 const TABLE = "/api/mailing/tables/templates";
 
 interface TemplateRow {
@@ -116,6 +117,43 @@ describe("[integration] templates table", () => {
     expect(row.data.category).to.equal("billing");
   });
 
+  // Sends resolve a template by slug and only the create paths check it is
+  // free, so an edit must neither move it nor, by omitting it, clear it.
+  it("refuses a slug change on edit and keeps the slug when it is omitted", async () => {
+    const session = await ensureOwnerSession();
+    const client = authorizedClient(session.accessToken);
+    const created = await client.post(`${TABLE}/new`, {
+      slug: "fixed-slug",
+      name: "Fixed slug",
+      category: "orders",
+    });
+    const id = created.data[0] as string;
+
+    const moved = await client.put(`${TABLE}/edit?id=${id}`, {
+      slug: "order-confirmed",
+      name: "Fixed slug",
+      category: "orders",
+    });
+    expect(moved.status).to.equal(HTTP_CONFLICT);
+    expect(JSON.stringify(moved.data)).to.contain("slug_immutable");
+
+    const omitted = await client.put(`${TABLE}/edit?id=${id}`, {
+      name: "Renamed without slug",
+      category: "orders",
+    });
+    expect(omitted.status, JSON.stringify(omitted.data)).to.equal(HTTP_OK);
+    const row = await client.get(`${TABLE}/get?id=${id}`);
+    expect(row.data.slug).to.equal("fixed-slug");
+    expect(row.data.name).to.equal("Renamed without slug");
+
+    const { GetModel } =
+      await import("@antelopejs/interface-database-decorators");
+    const { DEFAULT_TENANT_ID } =
+      await import("@antelopejs/interface-dms/constants");
+    const { TemplateModel } = await import("../../db");
+    await GetModel(TemplateModel, DEFAULT_TENANT_ID).delete(id);
+  });
+
   it("refuses an unknown source template", async () => {
     const session = await ensureOwnerSession();
     const client = authorizedClient(session.accessToken);
@@ -211,12 +249,17 @@ describe("[integration] template content and status", () => {
   it("previews the current content with test data and reports missing variables", async () => {
     const session = await ensureOwnerSession();
     const client = authorizedClient(session.accessToken);
-    const list = await client.get(`${TABLE}/list`);
-    const id = (
-      list.data.results.find(
-        (item: TemplateRow) => item.slug === "welcome",
-      ) as TemplateRow
-    )._id;
+    // Looked up by slug rather than on the table's first page, which other
+    // tests fill with their own templates.
+    const { GetModel } =
+      await import("@antelopejs/interface-database-decorators");
+    const { DEFAULT_TENANT_ID } =
+      await import("@antelopejs/interface-dms/constants");
+    const { TemplateModel } = await import("../../db");
+    const welcome = await GetModel(TemplateModel, DEFAULT_TENANT_ID).getBySlug(
+      "welcome",
+    );
+    const id = welcome?._id as string;
     const preview = await client.post(`/api/mailing/templates/${id}/preview`, {
       locale: "en",
       data: {},