Jul 17 - Fill the gaps between Single-tenant mode and Multi-tenant mode - MT7

2026-07-17 12:54:07 -04:00
parent 8d9730e3df
commit c706489480
8 changed files with 178 additions and 16 deletions
@@ -179,7 +179,6 @@ def _send_invite_email(user, token, base_url=None):
    from flask import current_app, render_template_string
    from flask_mail import Message
    from app import mail
-    from urllib.parse import urlparse
    import threading

    if not current_app.config.get('MAIL_SERVER'):
@@ -189,8 +188,14 @@ def _send_invite_email(user, token, base_url=None):
    effective_base = (base_url or current_app.config.get('APP_BASE_URL', '')).rstrip('/')
    setup_link     = f'{effective_base}{url_for("customers.set_password", token=token)}'

-    host   = urlparse(effective_base).netloc or 'janitorialqc.local'
-    sender = f'noreply@{host}'
+    # Branded From as a (display_name, address) tuple. The display NAME tracks
+    # the tenant (e.g. "Gov Services QC"); the ADDRESS is branded only for
+    # DNS-authorized domains and otherwise stays the authenticated identity so
+    # the mail always delivers. The previous `noreply@{host}` sent from whatever
+    # host the browser was on, which fails SPF/DMARC for any domain this mail
+    # server isn't authorized for. See app/utils/mail_utils.py and rule 64.
+    from app.utils.mail_utils import branded_sender
+    sender = branded_sender(effective_base)

    html_body = render_template_string("""<!DOCTYPE html>
 <html>