fix(email): make team org invites more transactional (#732)

* fix(email): make team org invites more transactional

Use org-branded sender and subject instead of the default
"Best from ClassroomIO" marketing identity. Include the inviter
name in the body, remove promotional emojis, and thread optional
subject overrides through the email job pipeline.

Co-authored-by: Rotimi Best <[email protected]>

* fix(email): escape invite fields and sanitize email headers

Address Greptile review: escape inviter/org/role values in the team
invite template, sanitize display names in buildEmailFromName, and
strip control characters from dynamic subjects.

Co-authored-by: Rotimi Best <[email protected]>

* fix(email): use RFC 5322 backslash escaping in display names

Co-authored-by: Rotimi Best <[email protected]>

* test(email): add vitest coverage for email header helpers

Cover escapeHtml, sanitizeEmailDisplayName, sanitizeEmailSubject, and
buildEmailFromName. Collapse repeated whitespace when stripping control
characters from header values.

Co-authored-by: Rotimi Best <[email protected]>

* fix(email): strip all ASCII control chars from email headers

Co-authored-by: Rotimi Best <[email protected]>

---------

Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Rotimi Best <[email protected]>

apps/api/src/services/jobs/email-jobs.ts

@@ -20,6 +20,8 @@ export interface EnqueueTemplateEmailInput<TId extends EmailId> extends CommonOp
   fields: z.infer<EmailSchemaFor<TId>>;
   from?: string;
   replyTo?: string;
+  /** Override the template's default subject (e.g. org-scoped transactional mail). */
+  subject?: string;
   /** Optional iCalendar (.ics) body attached as a text/calendar part. */
   ics?: string;
 }
@@ -84,6 +86,7 @@ export async function enqueueTransactionalEmail<TId extends EmailId>(
         fields: validatedFields,
         from: input.from,
         replyTo: input.replyTo,
+        subject: input.subject,
         ics: input.ics
       },
       { idempotencyKey: recipientKey(input.idempotencyKey, recipient, recipients.length) }

apps/api/src/services/organization/invite.ts

@@ -30,9 +30,9 @@ import crypto from 'node:crypto';
 import { db, type DbOrTxClient } from '@cio/db/drizzle';
 import { getDashboardBaseUrl } from '@cio/core/config/dashboard-url';
 import { parseCourseIdsFromInviteMetadata, parseCohortIdsFromInviteMetadata } from '@api/utils/org';
-import { markUserAndProfileEmailVerified } from '@cio/db/queries/auth/profile';
+import { getProfileById, markUserAndProfileEmailVerified } from '@cio/db/queries/auth/profile';
 import { enqueueTransactionalEmail } from '@api/services/jobs';
-import { buildEmailBranding } from '@cio/email';
+import { buildEmailBranding, buildEmailFromName, sanitizeEmailSubject } from '@cio/email';
 import { ensureComplianceEnrollmentRecordsForProfiles } from '../course/compliance';
 
 type OrganizationInviteStatus = 'ACTIVE' | 'EXPIRED' | 'REVOKED' | 'ACCEPTED';
@@ -220,6 +220,8 @@ export async function inviteTeamMembers(orgId: string, emails: string[], roleId:
 
   const expiresAt = new Date(Date.now() + ORG_INVITE_EXPIRY_MS).toISOString();
   const roleName = getRoleLabel(roleId);
+  const inviterProfile = invitedByProfileId ? await getProfileById(invitedByProfileId) : null;
+  const inviterName = inviterProfile?.fullname?.trim() || undefined;
 
   for (const email of emailsToInvite) {
     try {
@@ -259,10 +261,13 @@ export async function inviteTeamMembers(orgId: string, emails: string[], roleId:
             orgName: organization.name,
             orgSiteName: organization.siteName,
             roleName,
+            inviterName,
             expiresAt: getExpiryLabel(expiresAt),
             inviteLink,
             branding: buildEmailBranding(organization)
           },
+          from: buildEmailFromName(`${organization.name} (via ClassroomIO.com)`),
+          subject: sanitizeEmailSubject(`You have been invited to join ${organization.name} on ClassroomIO`),
           idempotencyKey: `org-invite-teacher:${invite.id}`
         });