26-Jun-2026 — unrestricted recipient selection for delete/disable workflows, with GDPR-safe deletion... #293

build 721 — commit 6c9f14f

Email composer member picker

Membership-expiry and other removal workflows need to reach members regardless of deliverability or group membership, because the recipient is deleted or disabled afterwards.

• Undisable suppressed members for removal workflows. deliverabilityOptional now also returns true when the notification config carries a BULK_DELETE_GROUP_MEMBER or DISABLE_GROUP_MEMBER action, so unsubscribed, blocked and no-email members are selectable rather than greyed out. They stay in their labelled categories ("unsubscribed or blocked from email", "no email address", etc.) so it is clear why they differ from the rest.
• Include non-group members in the candidate pool. The composer now loads every member once (allMembers) and derives the group-member list from it. candidateMembers() uses the full pool for removal workflows, so members with groupMember: false (e.g. already-expired members) can be selected. The cache invalidates when the workflow type changes.
• Correct expiry tense. The expiry qualifier reads "expires " for future dates and "expired " for past ones, instead of always past tense.
• No bogus blocking validation. For a removal workflow, undeliverable members are includable on purpose, so the "N chosen members cannot be emailed
• remove them to continue" step error no longer fires. Forcing their removal would have left expired-but-undeliverable members in the database forever, which is the gap this feature exists to close.

Removal workflows delete every selected recipient

• Skipped recipients are still deleted. The send post-actions now apply to every selected member who exists, sent or skipped, not just those who were emailed or had no email address. Previously a member skipped because they were already unsubscribed or had no Head Office consent was never deleted, so the whole reason for selecting them was lost.
• Honest per-recipient notes. A skipped recipient's note reads as a pre-existing state ("Already unsubscribed from all mailing lists") alongside the real outcome ("Deleted from database"), rather than implying the workflow unsubscribed them.
• Whole-list campaign audience fix. applyCampaignPostSendActions resolves its audience from the same member list used for the recipient count, so whole-list campaign sends run their post-send delete against the members actually emailed.

The database is King: provider and Salesforce kept in step

• Deletion is GDPR-complete. Every member-deletion path (the expiry/disable post-send actions, the manual bulk-delete route, and single/all deletes from member admin) now removes the member's Brevo contact and writes the full opt-out back to Salesforce at the moment of deletion, via bulkDeleteMembersCascade. A member removed from the database never leaves an orphaned contact behind.
• Sync repairs orphans. "Update Brevo Mailing Lists" no longer short-circuits on local member signatures; it always reconciles Brevo against the database and deletes contacts with no matching eligible member, so anything that ever slipped through is cleaned up. Contact queries now page through every contact, not just the first 1000.

Marketing consent is always a real boolean

• Coerced on save. emailMarketingConsent and the granular group/area/other consents are coerced to a real boolean (via booleanOf) when a member is saved, so a "Yes"/"No" or "true"/"false" string can never be stored as the value.
• Existing records migrated. A migration converts any string consent value already in the database to its boolean equivalent. This fixes both the display (a string like "No" was truthy and showed as "consent given") and the send-exclusion (emailMarketingConsent === false never matched the string "No", so a non-consenting member could be emailed).

Member admin

• Filter selection persists to the URL via a generic filter= query param (StoredValue.FILTER) and localStorage, so a chosen filter survives a reload and is shareable.
• New "Not Committee Member" filter under Administrators.

Brevo mailing-list sync tolerates a switched Brevo account

The contact sync no longer fails when subscribed list IDs do not exist in the connected Brevo account, which happens when a site is pointed at a different Brevo account. The import and create paths fetch the account's actual lists once and skip any list ID that is not present, instead of 404-ing the whole batch. Where a contact ends up with no valid list, its attributes are still updated via the batch-update endpoint (which does not require a list) rather than the import endpoint (which does). The import-completion notification email Brevo sends on each sync is also suppressed.

Email-config editor and Brevo admin fixes

• Email content editor disables editing with an "automatically generated" note only when a built-in process generates the body in code: that is, a workflow-linked config (forgot-password, walk, expense, contact-us, booking, member-sync) whose template is only the BODY_CONTENT placeholder. A user-configured email with a placeholder template stays editable
• the body is either written here or composed in the Email Composer
• rather than being wrongly blanked out.
• "Reset to default" is now a dropdown to reset the body to any available branded template, backed by a new /templates/local-names endpoint.
• Domain configuration no longer crashes when Brevo returns a null DNS record (null-guarded mapDnsRecord).

Email composer: config content block and step-skip persistence

• The composer now shows the read-only template-content block whenever the chosen configuration has body content, not only when the template carries BODY_CONTENT_TOP/BOTTOM placeholders. A fixed-content config such as "Your Login Details" previously showed no content block on the Compose step.

• The "Skip the Compose step" and "Skip the Events step" configuration flags (omitComposeStep, omitEventsStep) now persist. They were present on the client model and the editor but missing from the server notification-config schema, so Mongoose strict mode silently dropped them on every save.

• A "Compose email" button beside the Email Configuration selector on the Email Configurations page opens the Email Composer directly with that configuration pre-selected (via the config-id query param), so you can go straight from editing a configuration to sending with it. The button is hidden for built-in process configurations (forgot-password, walk, expense, contact-us, booking, member-sync), which are system-triggered and cannot be started by hand from the composer.