fix: disable SendGrid link tracking on magic-link emails

[mroderick]

Problem

Magic-link emails were sent as plain text with the sign-in URL embedded directly in the body. SendGrid's click tracking rewrote that link into a long /LsClick tracking redirect, so recipients saw a long codebar.us tracking URL instead of the real sign-in link. This confused users during testing.

Fix

Disable click and open tracking for this email only by passing tracking_settings in the mail/send request body. This overrides the account default per request, so other SendGrid emails keep tracking untouched. The request body is extracted into a pure buildMagicLinkPayload util (src/app/utils/magic-link-email.js) so the shape is unit-testable without a SendGrid call or the auth instance's DB pool.

The magic-link URL now reads as the actual codebar.io destination — which is also more phishing-resistant, since recipients can verify the domain before clicking.

tracking_settings: {
  click_tracking: { enable: false },
  open_tracking: { enable: false },
},

Tests

Added test/unit/magic-link-email.test.js asserting that click/open tracking are disabled and the real URL is embedded in the plain-text body.

Verification

Per-request tracking_settings is a documented field of the SendGrid v3 mail/send API (SendGrid docs: Mail Send) — the official example shows click_tracking.enable and open_tracking.enable toggled per message. This is scoped to one message, unlike the account-level PATCH /v3/tracking_settings/click endpoint (SendGrid docs: update click tracking settings).

[mroderick]

Plain text version

HTML version

[mroderick]

I've verified this in production by deploying the branch and authenticating at https://codebar.io/auth/codebar 👍

[mroderick]

@till do you think we should use the HTML version, which arguably is slightly more difficult for people to recognise as genuinely coming from codebar?

[till]

@mroderick Good question, maybe it's better to show the link in HTML and text versions of the email?

---

Maybe a different ticket, but:

• the email could use a from name
• maybe better subject
• friendlier text?
• footer

---

You requested a link to log into your Codebar account:

If you didn't request this link, there's nothing for you to do.

Footer