mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 12:42:38 +00:00
Oliver Kieselbach
42c45cf567
A delivery log names only the recipient, never the tenant the welcome mail was for. The tenant console's search now matches the notification and contact address as well as domain and tenant id; the quoted exact mode is unchanged, and no other address is searchable (an admin UPN never receives platform mail and would only widen the PII surface of the list). The addresses live in PreviewWhitelist, not on the tenant config, so a new GA/Reader-only GET /api/preview/notification-emails returns them as one map -- a single cross-partition scan instead of a point read per tenant. Both sides join on the lowercased tenant id (address rows carry the JWT tid, a config PartitionKey's casing is not guaranteed) and matching is case-insensitive, because stored addresses keep the casing the user typed. The map is best-effort in the portal: a failed read costs only the search-by-address, never the tenant list. Addresses stay out of the list rows -- they are a search key, and remain visible in the tenant editor. Match rules moved out of the component into tenantSearch.ts with unit pins, and a catalog test pins that the plural route does not resolve to the per-tenant entry one character away (which would demand a tenantId the route does not carry, and hand a delegated caller a rescue path into the whole map). Deploy: backend before web. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>