Repository navigation
Let a transactional send set its own sender name - #204
Merged
Merged
Conversation
POST /emails and the send_email MCP tool take an optional fromName, the From name for that email instead of the delivery source's. Only the name changes: the address stays the delivery source's verified one. So the name can't break the From header or pass for an address, it is refused when it holds control characters, invisible formatting characters (such as right-to-left overrides and zero-width spaces), <, > or @. A name with RFC 5322 specials such as a comma is now quoted in the From header, which also fixes such names on teams.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
An integrator that sends mail for many of its own customers through one SendLit team can only use the team's sender name today. CourseLit sends every school's learner mail (sign-in codes, receipts, notifications) through shared platform teams, so all of it currently goes out as "CourseLit" instead of the school's name.
What changes
POST /emailsand thesend_emailMCP tool take an optionalfromName, used as the From name for that email instead of the delivery source's.getEmailFromnow quotes a display name that holds RFC 5322 specials (a comma, a period, quotes and so on). Before, a name such asSmith, J.produced a broken From header. This also applies to team sender names.developers/transactional.mdx), the OpenAPI spec and a changeset for thesendlitSDK are updated.Security
A caller-chosen display name is a phishing risk, so
fromNameis refused when it holds:\p{Cc}), including CR/LF, so no header injection;\p{Cf}), such as right-to-left overrides and zero-width spaces, which can make a name read as something else;<,>or@, so the name can't pass for an address (support@paypal.com).It is limited to 100 characters. The REST schema checks it, and
createTransactionalEmailchecks it again for MCP callers (invalid_from_name).Display-name spoofing from a team's own verified domain stays possible, as it already is through the team sender name in settings and on any ESP that allows custom names.
Tests
utils/mail.test.ts: quoting.transactional/queries.test.ts: the name is used with the pinned address and trimmed, and the cases above are refused without queueing.transactional/queries.test.ts,mcp/tools/transactional.test.ts,routes-purpose.test.tsand each MCP test file pass; the API, contract and SDK typechecks andcheck:driftpass.Consumer
CourseLit already sends
fromNameon learner mail (codelitdev/courselit#881). Until this ships, SendLit drops the unknown field and the mail keeps going out as "CourseLit".