Send magic-link, invite, and email-change mail as multipart HTML with the verify URL in an href, so quoted-printable wrapping can no longer turn token= into token=3D and look like an expired link.
Fall back From to the Cloudron mailbox when SMTP_FROM is unset; read retryAfterMs from the API error body on 429; mention spam/promotions in the login success copy.
Create-flow QA on this branch: method-card modals open with editable fields and tertiary defaults, unsaved wizard/module edits warn on tab close, and custom decision cards no longer seed a 75% consensus value.
Cloudron manifest 0.1.12. Ops docs note SES-relayed mail and that Cloudron Status skips SPF/DKIM while a relay is on.
Test plan
Request a magic link on staging, open the message, confirm the link is a real <a href> (not a wrapped plaintext URL), and sign in succeeds within 15 minutes.
Repeat from a non-Gmail inbox if possible (the original failure was a mangled token, not missing mail).
429 on magic-link request still surfaces a retry wait.
Create-flow: open a method card, edit fields, close the tab and confirm the unload warning; publish a custom decision card and confirm wizard copy is used instead of a seeded 75% consensus.
## Summary
- Send magic-link, invite, and email-change mail as multipart HTML with the verify URL in an `href`, so quoted-printable wrapping can no longer turn `token=` into `token=3D` and look like an expired link.
- Fall back `From` to the Cloudron mailbox when `SMTP_FROM` is unset; read `retryAfterMs` from the API error body on 429; mention spam/promotions in the login success copy.
- Create-flow QA on this branch: method-card modals open with editable fields and tertiary defaults, unsaved wizard/module edits warn on tab close, and custom decision cards no longer seed a 75% consensus value.
- Cloudron manifest `0.1.12`. Ops docs note SES-relayed mail and that Cloudron Status skips SPF/DKIM while a relay is on.
## Test plan
- [ ] Request a magic link on staging, open the message, confirm the link is a real `<a href>` (not a wrapped plaintext URL), and sign in succeeds within 15 minutes.
- [ ] Repeat from a non-Gmail inbox if possible (the original failure was a mangled token, not missing mail).
- [ ] 429 on magic-link request still surfaces a retry wait.
- [ ] Create-flow: open a method card, edit fields, close the tab and confirm the unload warning; publish a custom decision card and confirm wizard copy is used instead of a seeded 75% consensus.
an.di
self-assigned this 2026-09-01 16:09:17 +00:00
Seeded section text should look like the form default state, not locked primary, and Customize stays on the kebab instead of unlocking the body.
Co-authored-by: Cursor <cursoragent@cursor.com>
Staging was delivering magic links that looked expired because the token query string was encoded and wrapped in plaintext MIME. Also read rate-limit retry from the API error body, mention spam in the success copy, and document SES relay DNS.
Co-authored-by: Cursor <cursoragent@cursor.com>
an.di
merged commit fa928d1b2c into main2026-09-01 16:09:31 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
href, so quoted-printable wrapping can no longer turntoken=intotoken=3Dand look like an expired link.Fromto the Cloudron mailbox whenSMTP_FROMis unset; readretryAfterMsfrom the API error body on 429; mention spam/promotions in the login success copy.0.1.12. Ops docs note SES-relayed mail and that Cloudron Status skips SPF/DKIM while a relay is on.Test plan
<a href>(not a wrapped plaintext URL), and sign in succeeds within 15 minutes.