Grant Digest Email Metrics: Disable click-tracking for magic links

[TylerHendrickson]

Subtask of User Story: Grant Digest Email Metrics #2749

Blocked by

N/A

Blocks

• Grant Digest Email Metrics: Enable email metrics (feature flag) in Production  #3098

Definition of Done

When magic links sent in passcode-type login emails are clicked, the click event does not show up in SES event logs.

Implementation details

• SES click event payloads (example) provide the hyperlink that was clicked. Since magic links contain credentials, they are considered sensitive and should be excluded from email event logs.
• The ses:no-track HTML attribute can be added to anchor tags in order to disable click-tracking for that particular link in an email. Since this is a nonstandard HTML attribute, SES will remove it from the email body before sending.
  • Example <a ses:no-track href="https://example.com">Clicks for this link will not be tracked!</a>
• In the sendPasscode() function of packages/server/src/lib/email.js, Add the ses:no-track HTML attribute to the <a> tag that provides the "magic link" in passcode emails.

[TylerHendrickson]

Closed by #3163