From 2361165642a3f98ee864c6bbe17a472e27353f69 Mon Sep 17 00:00:00 2001
From: "Aaron K. Clark" <cryptojones@owasp.org>
Date: Thu, 18 Jun 2026 20:45:48 -0400
Subject: [PATCH] feat: source links + spam reminder on login and in the email
 (1.7.5)

- Login page: add a "check your spam folder" reminder (magic-link mail often
  lands in spam on a new sending domain) and an "Open source on GitHub" link,
  on both the initial card and the "check your inbox" confirmation.
- Magic-link email: add the GitHub repo link at the bottom (HTML footer + the
  plain-text body).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 api/ApplyTrack.Api/ApplyTrack.Api.csproj   | 2 +-
 api/ApplyTrack.Api/Auth/SmtpEmailSender.cs | 4 +++-
 api/ApplyTrack.Api/wwwroot/app.js          | 8 +++++---
 pyproject.toml                             | 2 +-
 4 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/api/ApplyTrack.Api/ApplyTrack.Api.csproj b/api/ApplyTrack.Api/ApplyTrack.Api.csproj
index 8e6fc8b..127b298 100644
--- a/api/ApplyTrack.Api/ApplyTrack.Api.csproj
+++ b/api/ApplyTrack.Api/ApplyTrack.Api.csproj
@@ -5,7 +5,7 @@
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
     <RootNamespace>ApplyTrack.Api</RootNamespace>
-    <Version>1.7.4</Version>
+    <Version>1.7.5</Version>
     <Authors>Aaron K. Clark</Authors>
     <Copyright>Copyright 2026 Aaron K. Clark</Copyright>
     <PackageLicenseExpression>Apache-2.0</PackageLicenseExpression>
diff --git a/api/ApplyTrack.Api/Auth/SmtpEmailSender.cs b/api/ApplyTrack.Api/Auth/SmtpEmailSender.cs
index fd8902a..d454ac3 100644
--- a/api/ApplyTrack.Api/Auth/SmtpEmailSender.cs
+++ b/api/ApplyTrack.Api/Auth/SmtpEmailSender.cs
@@ -34,7 +34,8 @@ public async Task SendMagicLinkAsync(string email, string link)
             TextBody =
                 $"Sign in to OSApplyTrack:\n\n{link}\n\n"
                 + "This link is single-use and expires in 15 minutes. "
-                + "If you didn't request it, you can ignore this email.",
+                + "If you didn't request it, you can ignore this email.\n\n"
+                + "Open source: https://github.com/CryptoJones/OSApplyTrack",
             // A LIGHT layout with cyberdeck branding (the cyan applytrack wordmark on a
             // near-black header band). This is deliberate, not a fallback: a forced-dark
             // background does not survive — iOS/Apple Mail and Gmail auto-INVERT a
@@ -68,6 +69,7 @@ public async Task SendMagicLinkAsync(string email, string link)
                         </td></tr>
                       </table>
                       <div style="max-width:460px;font-size:11px;line-height:1.5;color:#9aa6b2;padding:16px 4px 0;font-family:Menlo,Consolas,monospace;">If you didn't request this, you can safely ignore this email.</div>
+                      <div style="max-width:460px;font-size:11px;line-height:1.5;color:#9aa6b2;padding:6px 4px 0;font-family:Menlo,Consolas,monospace;"><a href="https://github.com/CryptoJones/OSApplyTrack" style="color:#0e8f78;text-decoration:none;">github.com/CryptoJones/OSApplyTrack</a></div>
                     </td>
                   </tr>
                 </table>
diff --git a/api/ApplyTrack.Api/wwwroot/app.js b/api/ApplyTrack.Api/wwwroot/app.js
index c901f10..553e2d0 100644
--- a/api/ApplyTrack.Api/wwwroot/app.js
+++ b/api/ApplyTrack.Api/wwwroot/app.js
@@ -97,7 +97,8 @@ function showLogin() {
       <input id="login-email" class="login-input" type="email" required autocomplete="email"
         inputmode="email" placeholder="you@example.com" aria-label="Email address" />
       <button type="submit" class="btn btn-primary login-btn">Send magic link</button>
-      <p class="login-note">We email you a link to sign in. Self-hosting? It's printed to the server logs.</p>
+      <p class="login-note">We email you a link to sign in — check your spam folder if it doesn't arrive. Self-hosting? It's printed to the server logs.</p>
+      <p class="login-note"><a href="https://github.com/CryptoJones/OSApplyTrack" target="_blank" rel="noopener" style="color:var(--accent);text-decoration:none">Open source on GitHub ↗</a></p>
     </form>`;
   document.body.appendChild(overlay);
 
@@ -114,8 +115,9 @@ function showLogin() {
     form.innerHTML = `
       <h1 class="login-mark font-display"><span class="text-stamp">apply</span><span>track</span></h1>
       <p class="login-sub">Check your inbox.</p>
-      <p class="login-note">If <strong>${escapeHtml(email)}</strong> can sign in, a link is on its way.
-        Self-hosting? Look for it in the server logs.</p>`;
+      <p class="login-note">If <strong>${escapeHtml(email)}</strong> can sign in, a link is on its way —
+        check your spam folder too. Self-hosting? Look for it in the server logs.</p>
+      <p class="login-note"><a href="https://github.com/CryptoJones/OSApplyTrack" target="_blank" rel="noopener" style="color:var(--accent);text-decoration:none">Open source on GitHub ↗</a></p>`;
   });
   overlay.querySelector("#login-email").focus();
 }
diff --git a/pyproject.toml b/pyproject.toml
index 37d5e4b..c735fd9 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "applytrack-poller"
-version = "1.7.4"
+version = "1.7.5"
 description = "Discovery poller for OSApplyTrack — fetches and scores remote job leads into shared Postgres."
 requires-python = ">=3.10"
 license = { text = "Apache-2.0" }