fix(workflows): enforce sandbox sender save validation - #111424

Problem

Teams can save sandbox senders in broadcasts, destinations and custom sender identities. The sandbox sender supports workflow email steps and test sends.

Implements Silthus/posthog#231, following the sandbox sender spec.

Changes

• Broadcasts and destinations reject the sandbox sender with an actionable 400.
• Sandbox email steps reject other senders, custom From addresses, From names, and Reply-To.
• New selections require the project's flag; unchanged stored sender configurations remain editable after it turns off.
• Workflow drafts enforce these rules alongside the existing lenient editor validation.
• Mechanical: request caches share sender lookups and flag evaluation across email steps.

Stored configurations match the complete From object and Reply-To for the same action. Matching only the sender ID would allow edited identity overrides.

This fork PR includes #111368. Review this layer.

Before:

flowchart LR
    Save[Save email configuration] --> Validate[Existing validation] --> Stored[Stored configuration]
    classDef phRed fill:#f54e00,stroke:#f54e00,color:#fff;
    classDef phBlue fill:#1d4aff,stroke:#1d4aff,color:#fff;
    classDef phGray fill:#e5e7eb,stroke:#c7ccd1,color:#000;
    class Save phRed;
    class Validate phBlue;
    class Stored phGray;

After:

flowchart LR
    Save[Save email configuration] --> Sandbox[Sandbox sender rules]
    Sandbox --> Error[Actionable 400]
    Sandbox --> Validate[Existing validation] --> Stored[Stored configuration]
    classDef phRed fill:#f54e00,stroke:#f54e00,color:#fff;
    classDef phBlue fill:#1d4aff,stroke:#1d4aff,color:#fff;
    classDef phGray fill:#e5e7eb,stroke:#c7ccd1,color:#000;
    classDef phYellow fill:#f9bd2b,stroke:#f9bd2b,color:#000;
    class Save phRed;
    class Sandbox,Validate phBlue;
    class Stored phGray;
    class Error phYellow;

How did you test this code?

The API tests use real Postgres and a facade-created sandbox row. Analytics is mocked at the external SDK boundary.

Verify with .codex/with-flox hogli test products/workflows/backend/tests/api/test_sandbox_sender_validation.py. Allowed workflow saves return 201; rejected selections return actionable 400 responses.

Test rationale: test_literal_off_domain_sender_override_is_rejected_at_save and test_stored_off_domain_sender_override_survives_a_resave cover own-domain overrides. New API cases cover sandbox policy, lenient drafts and stored configurations; the public invocation serializer covers test-send acceptance.

API and adjacent input-validation suites: 179 passed in 23.76s
Repo-wide mypy: no issues in 22549 source files
Strict preflight: 0 failures
Ruff lint and formatting: passed
OpenAPI regeneration: no generated diff

Unchecked: delivery, frontend rendering, and remote patch coverage. These tests do not read event properties; no new-events-schema expansion applies.

Backend CI and Python CI await maintainer approval. This is an unrun CI gap, not a green result.

Release status

• No feature flag controls this change
• This change is behind a feature flag and is not available to users
• This change makes a previously flagged feature available to everyone

Automatic notifications

• Publish to changelog?

Docs update

No existing document covers sender save validation.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Agent: Codex, GPT-6.1 Sol. The inherited base is Claude Code, claude-opus-5-5, documented in #111368.

Skills: /tdd, /writing-tests, /improving-drf-endpoints, /writing-user-facing-copy, /running-ci-preflight, /qa-swarm, /stacking-prs, /writing-pr-descriptions, /writing-voice, /unslop, /principle-prove-it-works, /hogli, /querying-local-postgres, /reviewing-with-coderabbit, /leaving-pr-comments, /writing-for-agents.

CodeRabbit CLI was signed out; the local pass was skipped. The fresh QA swarm and remote CodeRabbit reviewed this layer on 97b86630a25.

One clean round: six GPT-6.1 Sol lenses found no issues. Claude Sonnet5.5's flag-check duplication suggestion was rejected after both matching gates were verified.

CodeRabbit's duplicate-validation nit was rejected: the precheck enforces policy before lenient draft validation can swallow errors.

No fixes or decisions remain open. The code is ready for human review; the PR remains draft with the maintainer-approval CI gap above.

No duplicate validation PR was found. Fixtures use invented example.com addresses. GitHub denied assigning the verified author due account permissions.