backend-manager 5.0.185 → 5.0.187

package/src/manager/libraries/email/transactional/index.js

@@ -188,30 +188,6 @@ Transactional.prototype.build = async function (settings) {
     signoff.urlText = signoff.urlText || '@ianwieds';
   }
 
-  // Process markdown in body fields
-  if (settings?.data?.body?.message) {
-    settings.data.body.message = md.render(settings.data.body.message);
-  }
-  if (settings?.data?.email?.body) {
-    settings.data.email.body = md.render(settings.data.email.body);
-  }
-
-  // Tag links with UTM params for attribution
-  const utmOptions = {
-    brandUrl: brand?.url,
-    brandId: brand?.id,
-    campaign: settings.sender || templateId,
-    type: 'transactional',
-    utm: settings.utm,
-  };
-
-  if (settings?.data?.body?.message) {
-    settings.data.body.message = tagLinks(settings.data.body.message, utmOptions);
-  }
-  if (settings?.data?.email?.body) {
-    settings.data.email.body = tagLinks(settings.data.email.body, utmOptions);
-  }
-
   // Build dynamic template data defaults
   const dynamicTemplateData = {
     email: {
@@ -242,6 +218,30 @@ Transactional.prototype.build = async function (settings) {
     _.merge(dynamicTemplateData, settings.data);
   }
 
+  // Process markdown in body fields (after merge so all data paths are resolved)
+  if (dynamicTemplateData.data?.body?.message) {
+    dynamicTemplateData.data.body.message = md.render(dynamicTemplateData.data.body.message);
+  }
+  if (dynamicTemplateData.email?.body) {
+    dynamicTemplateData.email.body = md.render(dynamicTemplateData.email.body);
+  }
+
+  // Tag links with UTM params for attribution
+  const utmOptions = {
+    brandUrl: brand?.url,
+    brandId: brand?.id,
+    campaign: settings.sender || templateId,
+    type: 'transactional',
+    utm: settings.utm,
+  };
+
+  if (dynamicTemplateData.data?.body?.message) {
+    dynamicTemplateData.data.body.message = tagLinks(dynamicTemplateData.data.body.message, utmOptions);
+  }
+  if (dynamicTemplateData.email?.body) {
+    dynamicTemplateData.email.body = tagLinks(dynamicTemplateData.email.body, utmOptions);
+  }
+
   // Build the email object
   const email = {
     to,

package/src/manager/libraries/email/validation.js

@@ -20,9 +20,13 @@
 const fetch = require('wonderful-fetch');
 const path = require('path');
 
-// Load disposable domains list once at module level
+// Load disposable domains: curated vendor list + custom additions
 const DISPOSABLE_DOMAINS = require(path.join(__dirname, '..', 'disposable-domains.json'));
-const DISPOSABLE_SET = new Set(DISPOSABLE_DOMAINS.map(d => d.toLowerCase()));
+const CUSTOM_DISPOSABLE_DOMAINS = require(path.join(__dirname, '..', 'custom-disposable-domains.json'));
+const DISPOSABLE_SET = new Set([
+  ...DISPOSABLE_DOMAINS.map(d => d.toLowerCase()),
+  ...CUSTOM_DISPOSABLE_DOMAINS.map(d => d.toLowerCase()),
+]);
 
 // Spam/junk local parts — exact matches (checked after stripping +suffix)
 const BLOCKED_LOCAL_PARTS = new Set([
@@ -167,4 +171,23 @@ async function validate(email, options = {}) {
   return result;
 }
 
-module.exports = { validate, DEFAULT_CHECKS, ALL_CHECKS };
+/**
+ * Quick check: is this email from a disposable domain?
+ * Works with a full email address or just a domain.
+ *
+ * @param {string} emailOrDomain
+ * @returns {boolean}
+ */
+function isDisposable(emailOrDomain) {
+  if (!emailOrDomain) {
+    return false;
+  }
+
+  const domain = emailOrDomain.includes('@')
+    ? emailOrDomain.split('@')[1]
+    : emailOrDomain;
+
+  return DISPOSABLE_SET.has(domain.toLowerCase());
+}
+
+module.exports = { validate, isDisposable, DEFAULT_CHECKS, ALL_CHECKS };

package/src/manager/libraries/infer-contact.js

@@ -1,8 +1,8 @@
 /**
  * Shared contact inference library
  *
- * Infers first/last name and company from an email address.
- * Tries AI first (if OPENAI_API_KEY is set), falls back to regex parsing.
+ * Infers first/last name and company from an email address using AI.
+ * Requires BACKEND_MANAGER_OPENAI_API_KEY to be set.
  *
  * Usage:
  *   const { inferContact } = require('./libraries/infer-contact.js');
@@ -13,16 +13,8 @@ const path = require('path');
 
 const PROMPT_PATH = path.join(__dirname, 'prompts', 'infer-contact.md');
 
-// Common email providers (don't infer company from these domains)
-const GENERIC_DOMAINS = new Set([
-  'gmail.com', 'yahoo.com', 'hotmail.com', 'outlook.com', 'aol.com',
-  'icloud.com', 'mail.com', 'protonmail.com', 'proton.me', 'zoho.com',
-  'yandex.com', 'gmx.com', 'live.com', 'msn.com', 'me.com',
-]);
-
 /**
- * Infer contact info from email address
- * Tries AI first (if OPENAI_API_KEY is set), falls back to regex
+ * Infer contact info from email address using AI
  *
  * @param {string} email - Email address
  * @param {object} assistant - Assistant instance (for AI access)
@@ -36,8 +28,6 @@ async function inferContact(email, assistant) {
     }
   }
 
-  // TODO: Re-enable regex fallback if needed
-  // return inferContactFromEmail(email);
   return { firstName: '', lastName: '', company: '', confidence: 0, method: 'none' };
 }
 
@@ -84,46 +74,6 @@ async function inferContactWithAI(email, assistant) {
   return null;
 }
 
-/**
- * Regex-based contact inference from email
- * Extracts name from local part and company from domain
- *
- * @param {string} email - Email address
- * @returns {{ firstName: string, lastName: string, company: string, confidence: number, method: string }}
- */
-function inferContactFromEmail(email) {
-  const [local, domain] = email.split('@');
-
-  // Infer company from domain (skip generic providers)
-  let company = '';
-  if (domain && !GENERIC_DOMAINS.has(domain.toLowerCase())) {
-    const domainName = domain.split('.')[0];
-    company = capitalize(domainName.replace(/[-_]/g, ' '));
-  }
-
-  // Infer name from local part
-  const cleaned = local.replace(/[0-9]+$/, '');
-  const parts = cleaned.split(/[._-]/);
-
-  if (parts.length >= 2) {
-    return {
-      firstName: capitalize(parts[0]),
-      lastName: capitalize(parts.slice(1).join(' ')),
-      company,
-      confidence: 0.5,
-      method: 'regex',
-    };
-  }
-
-  return {
-    firstName: capitalize(cleaned),
-    lastName: '',
-    company,
-    confidence: 0.25,
-    method: 'regex',
-  };
-}
-
 /**
  * Capitalize first letter of each word
  *
@@ -140,4 +90,4 @@ function capitalize(str) {
     .join(' ');
 }
 
-module.exports = { inferContact, inferContactFromEmail, capitalize };
+module.exports = { inferContact, capitalize };

package/src/manager/routes/user/signup/post.js

@@ -1,6 +1,6 @@
 const moment = require('moment');
 const { inferContact } = require('../../../libraries/infer-contact.js');
-const { validate: validateEmail } = require('../../../libraries/email/validation.js');
+const { validate: validateEmail, isDisposable } = require('../../../libraries/email/validation.js');
 
 const MAX_POLL_TIME_MS = 30000;
 const POLL_INTERVAL_MS = 500;
@@ -73,7 +73,7 @@ module.exports = async ({ assistant, user, settings, libraries }) => {
     .set(userRecord, { merge: true });
 
   // 5. Process affiliate referral (writes to referrer's doc, not this user's)
-  await processAffiliate(assistant, uid, settings);
+  await processAffiliate(assistant, uid, email, settings);
 
   // 6. Send emails + marketing (non-blocking, fire-and-forget)
   syncMarketingContact(assistant, uid, email);
@@ -181,7 +181,7 @@ async function inferUserContact(assistant, email) {
  * Process affiliate referral if affiliate code provided
  * Writes to the referrer's doc (not the current user's)
  */
-async function processAffiliate(assistant, uid, settings) {
+async function processAffiliate(assistant, uid, email, settings) {
   const { admin } = assistant.Manager.libraries;
   const affiliateCode = settings.attribution?.affiliate?.code
     || settings.affiliateCode
@@ -191,6 +191,12 @@ async function processAffiliate(assistant, uid, settings) {
     return;
   }
 
+  // Skip referral credit for disposable email signups (affiliate fraud prevention)
+  if (isDisposable(email)) {
+    assistant.log(`processAffiliate(): Skipping referral — disposable email ${email}`);
+    return;
+  }
+
   assistant.log(`processAffiliate(): Looking for referrer with code ${affiliateCode}`);
 
   const snapshot = await admin.firestore().collection('users')

package/src/manager/schemas/admin/email/post.js

@@ -21,5 +21,5 @@ module.exports = () => ({
   data: { types: ['object'], default: {} },
   categories: { types: ['array'], default: [] },
   copy: { types: ['boolean'], default: undefined },
-  html: { types: ['string'], default: undefined },
+  html: { types: ['string'], default: undefined, sanitize: false },
 });

package/src/test/test-accounts.js

@@ -153,6 +153,15 @@ const STATIC_ACCOUNTS = {
       subscription: { product: { id: 'basic' }, status: 'active' },
     },
   },
+  'referred-disposable': {
+    id: 'referred-disposable',
+    uid: '_test-referred-disposable',
+    email: '_test.referred-disposable@mailinator.com',
+    properties: {
+      roles: {},
+      subscription: { product: { id: 'basic' }, status: 'active' },
+    },
+  },
 };
 
 /**

package/test/functions/general/add-marketing-contact.js

@@ -128,9 +128,10 @@ module.exports = {
       },
     },
 
-    // Test 5: Name inferred from email
+    // Test 5: Name inferred from email (AI only — requires extended mode)
     {
       name: 'name-inferred-from-email',
+      skip: !process.env.TEST_EXTENDED_MODE ? 'TEST_EXTENDED_MODE not set (AI inference requires OPENAI_API_KEY)' : false,
       auth: 'admin',
       timeout: 30000,
 

package/test/functions/user/sign-up.js

@@ -196,6 +196,44 @@ module.exports = {
       },
     },
 
+    // --- Disposable email referral test ---
+    {
+      name: 'disposable-email-referral-skipped',
+      async run({ http, firestore, assert, state, accounts }) {
+        // Record current referral count before disposable signup
+        const referrerBefore = await firestore.get(`users/${state.referrerUid}`);
+        const referralsBefore = referrerBefore?.affiliate?.referrals || [];
+        state.referralCountBefore = referralsBefore.length;
+
+        // Sign up a disposable email account with the referrer's affiliate code
+        // The signup itself should succeed (account was created via Admin SDK, bypassing beforeCreate)
+        // But the referral credit should be SKIPPED because the email is disposable
+        const signupResponse = await http.as('referred-disposable').command('user:sign-up', {
+          attribution: {
+            affiliate: { code: state.referrerAffiliateCode },
+          },
+        });
+
+        assert.isSuccess(signupResponse, 'Disposable email signup should succeed');
+
+        // Verify NO new referral was added to the referrer
+        // Small delay to ensure any async writes would have completed
+        await new Promise((resolve) => setTimeout(resolve, 3000));
+
+        const referrerAfter = await firestore.get(`users/${state.referrerUid}`);
+        const referralsAfter = referrerAfter?.affiliate?.referrals || [];
+
+        assert.equal(
+          referralsAfter.length,
+          state.referralCountBefore,
+          `Referrer should NOT get credit for disposable email referral (before=${state.referralCountBefore}, after=${referralsAfter.length})`
+        );
+
+        const disposableReferral = referralsAfter.find(r => r.uid === accounts['referred-disposable'].uid);
+        assert.ok(!disposableReferral, 'Disposable account should NOT appear in referrals');
+      },
+    },
+
     // --- Auth rejection test (at end per convention) ---
     {
       name: 'unauthenticated-rejected',

package/test/helpers/email-validation.js

@@ -5,7 +5,7 @@
  * Format, local part, and disposable tests always run (free, regex-based).
  * Mailbox verification tests require TEST_EXTENDED_MODE + ZEROBOUNCE_API_KEY.
  */
-const { validate, DEFAULT_CHECKS, ALL_CHECKS } = require('../../src/manager/libraries/email/validation.js');
+const { validate, isDisposable, DEFAULT_CHECKS, ALL_CHECKS } = require('../../src/manager/libraries/email/validation.js');
 
 module.exports = {
   description: 'Email validation',
@@ -287,6 +287,59 @@ module.exports = {
       },
     },
 
+    // --- isDisposable helper ---
+
+    {
+      name: 'isDisposable-vendor-domain-detected',
+      timeout: 5000,
+
+      async run({ assert }) {
+        assert.equal(isDisposable('user@mailinator.com'), true, 'mailinator.com should be disposable');
+        assert.equal(isDisposable('user@guerrillamail.com'), true, 'guerrillamail.com should be disposable');
+      },
+    },
+
+    {
+      name: 'isDisposable-custom-domain-detected',
+      timeout: 5000,
+
+      async run({ assert }) {
+        assert.equal(isDisposable('user@sharebot.net'), true, 'Custom list domain should be disposable');
+        assert.equal(isDisposable('user@pickmemail.com'), true, 'Custom list domain should be disposable');
+      },
+    },
+
+    {
+      name: 'isDisposable-legitimate-domain-passes',
+      timeout: 5000,
+
+      async run({ assert }) {
+        assert.equal(isDisposable('user@gmail.com'), false, 'gmail.com should not be disposable');
+        assert.equal(isDisposable('user@somiibo.com'), false, 'Custom domain should not be disposable');
+      },
+    },
+
+    {
+      name: 'isDisposable-accepts-domain-only',
+      timeout: 5000,
+
+      async run({ assert }) {
+        assert.equal(isDisposable('mailinator.com'), true, 'Should work with bare domain');
+        assert.equal(isDisposable('gmail.com'), false, 'Should work with bare domain');
+      },
+    },
+
+    {
+      name: 'isDisposable-handles-edge-cases',
+      timeout: 5000,
+
+      async run({ assert }) {
+        assert.equal(isDisposable(''), false, 'Empty string should return false');
+        assert.equal(isDisposable(null), false, 'Null should return false');
+        assert.equal(isDisposable(undefined), false, 'Undefined should return false');
+      },
+    },
+
     // --- Selective checks ---
 
     {

package/test/helpers/infer-contact.js

@@ -2,10 +2,9 @@
  * Test: libraries/infer-contact.js
  * Unit tests for contact inference from email addresses
  *
- * Tests capitalize, inferContactFromEmail (regex), and inferContact (AI fallback).
  * AI tests only run when TEST_EXTENDED_MODE is set.
  */
-const { inferContact, inferContactFromEmail, capitalize } = require('../../src/manager/libraries/infer-contact.js');
+const { inferContact, capitalize } = require('../../src/manager/libraries/infer-contact.js');
 
 module.exports = {
   description: 'Infer contact from email',
@@ -63,205 +62,28 @@ module.exports = {
       },
     },
 
-    // ─── inferContactFromEmail: name parsing ───
+    // ─── inferContact: returns empty without AI key ───
 
     {
-      name: 'regex-first-dot-last',
+      name: 'infer-contact-no-ai-returns-none',
       async run({ assert }) {
-        const result = inferContactFromEmail('john.doe@gmail.com');
+        // Without BACKEND_MANAGER_OPENAI_API_KEY, should return empty result
+        const originalKey = process.env.BACKEND_MANAGER_OPENAI_API_KEY;
+        delete process.env.BACKEND_MANAGER_OPENAI_API_KEY;
 
-        assert.equal(result.firstName, 'John', 'First name from local part before dot');
-        assert.equal(result.lastName, 'Doe', 'Last name from local part after dot');
-        assert.equal(result.method, 'regex', 'Method should be regex');
-        assert.equal(result.confidence, 0.5, 'Two-part name should have 0.5 confidence');
-      },
-    },
-
-    {
-      name: 'regex-first-underscore-last',
-      async run({ assert }) {
-        const result = inferContactFromEmail('jane_smith@yahoo.com');
-
-        assert.equal(result.firstName, 'Jane', 'First name from local part before underscore');
-        assert.equal(result.lastName, 'Smith', 'Last name from local part after underscore');
-      },
-    },
-
-    {
-      name: 'regex-first-hyphen-last',
-      async run({ assert }) {
-        const result = inferContactFromEmail('bob-jones@hotmail.com');
-
-        assert.equal(result.firstName, 'Bob', 'First name from local part before hyphen');
-        assert.equal(result.lastName, 'Jones', 'Last name from local part after hyphen');
-      },
-    },
-
-    {
-      name: 'regex-three-part-name',
-      async run({ assert }) {
-        const result = inferContactFromEmail('mary.jane.watson@example.com');
-
-        assert.equal(result.firstName, 'Mary', 'First name is first part');
-        assert.equal(result.lastName, 'Jane Watson', 'Last name joins remaining parts');
-      },
-    },
-
-    {
-      name: 'regex-single-word-local-part',
-      async run({ assert }) {
-        const result = inferContactFromEmail('admin@example.com');
-
-        assert.equal(result.firstName, 'Admin', 'Single word becomes first name');
-        assert.equal(result.lastName, '', 'No last name for single word');
-        assert.equal(result.confidence, 0.25, 'Single-part name should have 0.25 confidence');
-      },
-    },
-
-    {
-      name: 'regex-strips-trailing-numbers',
-      async run({ assert }) {
-        const result = inferContactFromEmail('john.doe42@gmail.com');
-
-        assert.equal(result.firstName, 'John', 'Trailing numbers stripped before parsing');
-        assert.equal(result.lastName, 'Doe', 'Name parsed correctly after stripping');
-      },
-    },
-
-    {
-      name: 'regex-only-numbers-after-name',
-      async run({ assert }) {
-        const result = inferContactFromEmail('user123@gmail.com');
-
-        assert.equal(result.firstName, 'User', 'Numbers stripped, name capitalized');
-        assert.equal(result.lastName, '', 'No last name');
-      },
-    },
-
-    // ─── inferContactFromEmail: company inference ───
-
-    {
-      name: 'regex-company-from-custom-domain',
-      async run({ assert }) {
-        const result = inferContactFromEmail('john@acme.com');
-
-        assert.equal(result.company, 'Acme', 'Company from custom domain');
-      },
-    },
-
-    {
-      name: 'regex-company-from-hyphenated-domain',
-      async run({ assert }) {
-        const result = inferContactFromEmail('john@my-company.com');
-
-        assert.equal(result.company, 'My Company', 'Hyphens replaced with spaces');
-      },
-    },
-
-    {
-      name: 'regex-company-from-underscored-domain',
-      async run({ assert }) {
-        const result = inferContactFromEmail('john@my_company.com');
-
-        assert.equal(result.company, 'My Company', 'Underscores replaced with spaces');
-      },
-    },
-
-    {
-      name: 'regex-no-company-from-gmail',
-      async run({ assert }) {
-        const result = inferContactFromEmail('john@gmail.com');
-
-        assert.equal(result.company, '', 'Gmail is generic, no company');
-      },
-    },
-
-    {
-      name: 'regex-no-company-from-yahoo',
-      async run({ assert }) {
-        const result = inferContactFromEmail('john@yahoo.com');
-
-        assert.equal(result.company, '', 'Yahoo is generic, no company');
-      },
-    },
+        try {
+          const result = await inferContact('alice.wonderland@example.com');
 
-    {
-      name: 'regex-no-company-from-outlook',
-      async run({ assert }) {
-        const result = inferContactFromEmail('john@outlook.com');
-
-        assert.equal(result.company, '', 'Outlook is generic, no company');
-      },
-    },
-
-    {
-      name: 'regex-no-company-from-protonmail',
-      async run({ assert }) {
-        const result = inferContactFromEmail('john@protonmail.com');
-
-        assert.equal(result.company, '', 'Protonmail is generic, no company');
-      },
-    },
-
-    {
-      name: 'regex-no-company-from-icloud',
-      async run({ assert }) {
-        const result = inferContactFromEmail('john@icloud.com');
-
-        assert.equal(result.company, '', 'iCloud is generic, no company');
-      },
-    },
-
-    {
-      name: 'regex-generic-domain-case-insensitive',
-      async run({ assert }) {
-        const result = inferContactFromEmail('john@GMAIL.COM');
-
-        assert.equal(result.company, '', 'Generic domain check should be case-insensitive');
-      },
-    },
-
-    // ─── inferContactFromEmail: combined name + company ───
-
-    {
-      name: 'regex-full-result-custom-domain',
-      async run({ assert }) {
-        const result = inferContactFromEmail('sarah.connor@skynet.io');
-
-        assert.equal(result.firstName, 'Sarah', 'First name parsed');
-        assert.equal(result.lastName, 'Connor', 'Last name parsed');
-        assert.equal(result.company, 'Skynet', 'Company from domain');
-        assert.equal(result.method, 'regex', 'Method is regex');
-        assert.equal(result.confidence, 0.5, 'Confidence 0.5 for two-part name');
-      },
-    },
-
-    {
-      name: 'regex-single-name-custom-domain',
-      async run({ assert }) {
-        const result = inferContactFromEmail('info@acme.com');
-
-        assert.equal(result.firstName, 'Info', 'Single word capitalized');
-        assert.equal(result.lastName, '', 'No last name');
-        assert.equal(result.company, 'Acme', 'Company inferred');
-        assert.equal(result.confidence, 0.25, 'Lower confidence for single name');
-      },
-    },
-
-    // ─── inferContact: regex fallback (no OPENAI_API_KEY) ───
-
-    {
-      name: 'infer-contact-regex-fallback',
-      async run({ assert, skip }) {
-        if (!process.env.TEST_EXTENDED_MODE || !process.env.BACKEND_MANAGER_OPENAI_API_KEY) {
-          skip('TEST_EXTENDED_MODE or BACKEND_MANAGER_OPENAI_API_KEY not set');
+          assert.equal(result.firstName, '', 'No first name without AI');
+          assert.equal(result.lastName, '', 'No last name without AI');
+          assert.equal(result.company, '', 'No company without AI');
+          assert.equal(result.method, 'none', 'Method should be none');
+          assert.equal(result.confidence, 0, 'Confidence should be 0');
+        } finally {
+          if (originalKey) {
+            process.env.BACKEND_MANAGER_OPENAI_API_KEY = originalKey;
+          }
         }
-
-        const result = await inferContact('alice.wonderland@example.com');
-
-        assert.equal(result.firstName, 'Alice', 'AI inferred first name');
-        assert.equal(result.lastName, 'Wonderland', 'AI inferred last name');
-        assert.ok(result.method === 'ai', 'Should use AI');
       },
     },