@dealdesk/server 2026.527.0-canary.0

package/dist/deal-desk/tools/__tests__/outreach-approve.test.js

@@ -0,0 +1,258 @@
+import { describe, it, expect, vi } from "vitest";
+import express from "express";
+import request from "supertest";
+import { outreachApproveHandler, outreachRejectHandler } from "../outreach-approve.js";
+import { collectStringParams } from "./helpers/where-introspection.js";
+const loadContactForEnrichmentMock = vi.fn();
+const ensureContactEmailFromApolloMock = vi.fn();
+vi.mock("../../enrichment/resolve-contact-email.js", async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        loadContactForEnrichment: (...args) => loadContactForEnrichmentMock(...args),
+        ensureContactEmailFromApollo: (...args) => ensureContactEmailFromApolloMock(...args),
+        contactNeedsApolloEnrichment: actual.contactNeedsApolloEnrichment,
+    };
+});
+describe("POST /outreach/sends/:id/approve", () => {
+    it("loads the send, auto-enriches, sends, updates row", async () => {
+        loadContactForEnrichmentMock.mockResolvedValueOnce({
+            id: "c-1",
+            email: "test@example.com",
+            source: "manual",
+            emailStatus: "unverified",
+        });
+        ensureContactEmailFromApolloMock.mockResolvedValueOnce({
+            ok: true,
+            email: "bob@example.com",
+            emailStatus: "verified",
+            enriched: true,
+        });
+        const fakeDb = {
+            query: {
+                ddOutreachSends: {
+                    findFirst: vi.fn().mockResolvedValue({
+                        id: "send-1",
+                        dealDeskCompanyId: "co-1",
+                        subject: "Hello",
+                        body: "Hi",
+                        contactId: "c-1",
+                        status: "awaiting_approval",
+                    }),
+                },
+                ddContacts: {
+                    findFirst: vi.fn().mockResolvedValue({
+                        id: "c-1",
+                        email: "bob@example.com",
+                    }),
+                },
+                ddEmailAccounts: {
+                    findFirst: vi.fn().mockResolvedValue({
+                        id: "acc-1",
+                        emailAddress: "alice@example.com",
+                        secretId: "sec-1",
+                    }),
+                },
+            },
+            update: () => ({ set: (v) => ({ where: async () => v }) }),
+        };
+        const fakeSendGmail = vi.fn().mockResolvedValue({ messageId: "g-1", threadId: "t-1" });
+        const fakeLoadTokens = vi.fn().mockResolvedValue({
+            accessToken: "at",
+            refreshToken: "rt",
+            expiresAt: Date.now() + 600_000,
+            scope: "x",
+        });
+        const fakeEnsureFresh = vi.fn().mockImplementation(async (i) => i.tokens);
+        const app = express();
+        app.use((req, _res, next) => {
+            req.actor = {
+                type: "board",
+                userId: "11111111-1111-4111-8111-111111111111",
+                source: "session",
+            };
+            next();
+        });
+        app.post("/outreach/sends/:id/approve", outreachApproveHandler({
+            db: fakeDb,
+            loadClientConfig: async () => ({ clientId: "c", clientSecret: "s" }),
+            loadApolloKey: async () => "apollo-key",
+            sendGmail: fakeSendGmail,
+            loadGmailTokens: fakeLoadTokens,
+            ensureFreshAccessToken: fakeEnsureFresh,
+        }));
+        const res = await request(app).post("/outreach/sends/send-1/approve");
+        expect(res.status).toBe(200);
+        expect(res.body).toMatchObject({ messageId: "g-1", recipientEmail: "bob@example.com" });
+        expect(fakeSendGmail).toHaveBeenCalledWith(expect.objectContaining({
+            from: "alice@example.com",
+            to: "bob@example.com",
+            subject: "Hello",
+            body: "Hi",
+        }), expect.anything());
+    });
+    it("returns 422 when Apollo plan is blocked", async () => {
+        loadContactForEnrichmentMock.mockResolvedValueOnce({
+            id: "c-1",
+            email: null,
+            source: null,
+            emailStatus: "unverified",
+        });
+        ensureContactEmailFromApolloMock.mockResolvedValueOnce({
+            ok: false,
+            code: "apollo_plan_blocked",
+            reason: "Apollo cannot reveal emails on this plan",
+        });
+        const fakeDb = {
+            query: {
+                ddOutreachSends: {
+                    findFirst: vi.fn().mockResolvedValue({
+                        id: "send-1",
+                        dealDeskCompanyId: "co-1",
+                        subject: "Hello",
+                        body: "Hi",
+                        contactId: "c-1",
+                        status: "awaiting_approval",
+                    }),
+                },
+            },
+            update: () => ({ set: () => ({ where: async () => undefined }) }),
+        };
+        const app = express();
+        app.use((req, _res, next) => {
+            req.actor = { type: "board", userId: "u-1", source: "session" };
+            next();
+        });
+        app.post("/outreach/sends/:id/approve", outreachApproveHandler({
+            db: fakeDb,
+            loadClientConfig: async () => ({ clientId: "c", clientSecret: "s" }),
+            loadApolloKey: async () => "apollo-key",
+        }));
+        const res = await request(app).post("/outreach/sends/send-1/approve");
+        expect(res.status).toBe(422);
+        expect(res.body.code).toBe("apollo_plan_blocked");
+    });
+    it("returns 412 when company has no OAuth client configured", async () => {
+        const fakeDb = {
+            query: {
+                ddOutreachSends: {
+                    findFirst: vi.fn().mockResolvedValue({
+                        id: "s-1",
+                        dealDeskCompanyId: "co-1",
+                        subject: "X",
+                        body: "Y",
+                        contactId: "c-1",
+                        status: "awaiting_approval",
+                    }),
+                },
+            },
+        };
+        const app = express();
+        app.use((req, _res, next) => {
+            req.actor = { type: "board", userId: "u-1", source: "session" };
+            next();
+        });
+        app.post("/outreach/sends/:id/approve", outreachApproveHandler({
+            db: fakeDb,
+            loadClientConfig: async () => null,
+        }));
+        const res = await request(app).post("/outreach/sends/s-1/approve");
+        expect(res.status).toBe(412);
+    });
+    it("returns 403 when actor is an agent (only board may approve)", async () => {
+        const findFirst = vi.fn();
+        const fakeDb = {
+            query: {
+                ddOutreachSends: { findFirst },
+            },
+        };
+        const fakeSendGmail = vi.fn();
+        const app = express();
+        app.use((req, _res, next) => {
+            req.actor = { type: "agent", agentId: "a1", companyId: "co-A" };
+            req.params = { ...req.params, companyId: "co-A" };
+            next();
+        });
+        app.post("/companies/:companyId/outreach/sends/:id/approve", outreachApproveHandler({
+            db: fakeDb,
+            loadClientConfig: async () => ({ clientId: "c", clientSecret: "s" }),
+            sendGmail: fakeSendGmail,
+        }));
+        const res = await request(app)
+            .post("/companies/co-A/outreach/sends/send-1/approve");
+        expect(res.status).toBe(403);
+        expect(res.body).toMatchObject({ ok: false });
+        expect(findFirst).not.toHaveBeenCalled();
+        expect(fakeSendGmail).not.toHaveBeenCalled();
+    });
+    it("returns 404 when sendId belongs to a different company (IDOR guard)", async () => {
+        // Simulate scoped DB: findFirst only returns the send when the where clause
+        // restricts by BOTH id and dealDeskCompanyId. The send belongs to co-B but
+        // the URL is /companies/co-A/.../sends/send-B/approve — so the scoped query
+        // returns undefined and the handler responds 404.
+        const SEND = {
+            id: "send-B",
+            dealDeskCompanyId: "co-B",
+            subject: "Hello",
+            body: "Hi",
+            contactId: "c-1",
+            status: "awaiting_approval",
+        };
+        // Conditional mock: emulate a real tenant-scoped DB.
+        // - If the where clause mentions co-A (correct scoped query) -> no such row -> undefined.
+        // - If the where clause does NOT mention co-A (handler is unscoped) -> return the
+        //   seeded SEND row so an unscoped handler would proceed past the 404 and the test
+        //   would fail at the status assertion. This gives the IDOR mock real teeth.
+        const findFirst = vi.fn(async (args) => {
+            const params = collectStringParams(args.where);
+            if (params.includes("co-A"))
+                return undefined;
+            return SEND;
+        });
+        const fakeDb = {
+            query: {
+                ddOutreachSends: { findFirst },
+            },
+        };
+        const fakeSendGmail = vi.fn();
+        const app = express();
+        app.use((req, _res, next) => {
+            req.actor = { type: "board", userId: "u-1", source: "session" };
+            // Inject URL companyId param the way the real router does.
+            req.params = { ...req.params, companyId: "co-A" };
+            next();
+        });
+        app.post("/companies/:companyId/outreach/sends/:id/approve", outreachApproveHandler({
+            db: fakeDb,
+            loadClientConfig: async () => ({ clientId: "c", clientSecret: "s" }),
+            sendGmail: fakeSendGmail,
+        }));
+        app.post("/companies/:companyId/outreach/sends/:id/reject", outreachRejectHandler({
+            db: fakeDb,
+        }));
+        const approveRes = await request(app)
+            .post("/companies/co-A/outreach/sends/send-B/approve");
+        expect(approveRes.status).toBe(404);
+        expect(approveRes.body).toMatchObject({ ok: false });
+        expect(fakeSendGmail).not.toHaveBeenCalled();
+        const rejectRes = await request(app)
+            .post("/companies/co-A/outreach/sends/send-B/reject");
+        expect(rejectRes.status).toBe(404);
+        expect(rejectRes.body).toMatchObject({ ok: false });
+        // Assert the handler actually requested a scoped lookup — the where clause
+        // is the result of and(eq(id), eq(dealDeskCompanyId)). Pre-fix the where
+        // was just eq(id), so the captured call would not contain "co-A" anywhere
+        // in its param values. We walk the drizzle SQL object and collect string
+        // params, avoiding circular column<->table refs.
+        expect(findFirst).toHaveBeenCalledTimes(2);
+        for (const call of findFirst.mock.calls) {
+            const [args] = call;
+            const params = collectStringParams(args.where);
+            expect(params).toContain("co-A");
+            expect(params).toContain("send-B");
+            // sanity: we never queried for co-B (the send's real owner)
+            expect(params).not.toContain(SEND.dealDeskCompanyId);
+        }
+    });
+});
+//# sourceMappingURL=outreach-approve.test.js.map

package/dist/deal-desk/tools/__tests__/outreach-approve.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outreach-approve.test.js","sourceRoot":"","sources":["../../../../src/deal-desk/tools/__tests__/outreach-approve.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAEvE,MAAM,4BAA4B,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC7C,MAAM,gCAAgC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAEjD,EAAE,CAAC,IAAI,CAAC,2CAA2C,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC5E,MAAM,MAAM,GAAG,MAAM,cAAc,EAA8D,CAAC;IAClG,OAAO;QACL,GAAG,MAAM;QACT,wBAAwB,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,IAAI,CAAC;QACvF,4BAA4B,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CACnD,gCAAgC,CAAC,GAAG,IAAI,CAAC;QAC3C,4BAA4B,EAAE,MAAM,CAAC,4BAA4B;KAClE,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,4BAA4B,CAAC,qBAAqB,CAAC;YACjD,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,kBAAkB;YACzB,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,YAAY;SAC1B,CAAC,CAAC;QACH,gCAAgC,CAAC,qBAAqB,CAAC;YACrD,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,UAAU;YACvB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,MAAM,MAAM,GAAG;YACb,KAAK,EAAE;gBACL,eAAe,EAAE;oBACf,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;wBACnC,EAAE,EAAE,QAAQ;wBACZ,iBAAiB,EAAE,MAAM;wBACzB,OAAO,EAAE,OAAO;wBAChB,IAAI,EAAE,IAAI;wBACV,SAAS,EAAE,KAAK;wBAChB,MAAM,EAAE,mBAAmB;qBAC5B,CAAC;iBACH;gBACD,UAAU,EAAE;oBACV,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;wBACnC,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,iBAAiB;qBACzB,CAAC;iBACH;gBACD,eAAe,EAAE;oBACf,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;wBACnC,EAAE,EAAE,OAAO;wBACX,YAAY,EAAE,mBAAmB;wBACjC,QAAQ,EAAE,OAAO;qBAClB,CAAC;iBACH;aACF;YACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;SACpE,CAAC;QACF,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACvF,MAAM,cAAc,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;YAC/C,WAAW,EAAE,IAAI;YACjB,YAAY,EAAE,IAAI;YAClB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAC/B,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAE1E,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACzB,GAAW,CAAC,KAAK,GAAG;gBACnB,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,sCAAsC;gBAC9C,MAAM,EAAE,SAAS;aAClB,CAAC;YACF,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,sBAAsB,CAAC;YAC7D,EAAE,EAAE,MAAe;YACnB,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;YACpE,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY;YACvC,SAAS,EAAE,aAAa;YACxB,eAAe,EAAE,cAAc;YAC/B,sBAAsB,EAAE,eAAe;SACxC,CAAC,CAAC,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACxF,MAAM,CAAC,aAAa,CAAC,CAAC,oBAAoB,CACxC,MAAM,CAAC,gBAAgB,CAAC;YACtB,IAAI,EAAE,mBAAmB;YACzB,EAAE,EAAE,iBAAiB;YACrB,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,IAAI;SACX,CAAC,EACF,MAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,4BAA4B,CAAC,qBAAqB,CAAC;YACjD,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,YAAY;SAC1B,CAAC,CAAC;QACH,gCAAgC,CAAC,qBAAqB,CAAC;YACrD,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,0CAA0C;SACnD,CAAC,CAAC;QACH,MAAM,MAAM,GAAG;YACb,KAAK,EAAE;gBACL,eAAe,EAAE;oBACf,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;wBACnC,EAAE,EAAE,QAAQ;wBACZ,iBAAiB,EAAE,MAAM;wBACzB,OAAO,EAAE,OAAO;wBAChB,IAAI,EAAE,IAAI;wBACV,SAAS,EAAE,KAAK;wBAChB,MAAM,EAAE,mBAAmB;qBAC5B,CAAC;iBACH;aACF;YACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;SAClE,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACzB,GAAW,CAAC,KAAK,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACzE,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,sBAAsB,CAAC;YAC7D,EAAE,EAAE,MAAe;YACnB,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;YACpE,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY;SACxC,CAAC,CAAC,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,MAAM,GAAG;YACb,KAAK,EAAE;gBACL,eAAe,EAAE;oBACf,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;wBACnC,EAAE,EAAE,KAAK;wBACT,iBAAiB,EAAE,MAAM;wBACzB,OAAO,EAAE,GAAG;wBACZ,IAAI,EAAE,GAAG;wBACT,SAAS,EAAE,KAAK;wBAChB,MAAM,EAAE,mBAAmB;qBAC5B,CAAC;iBACH;aACF;SACF,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACzB,GAAW,CAAC,KAAK,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACzE,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,sBAAsB,CAAC;YAC7D,EAAE,EAAE,MAAe;YACnB,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;SACnC,CAAC,CAAC,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QACnE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG;YACb,KAAK,EAAE;gBACL,eAAe,EAAE,EAAE,SAAS,EAAE;aAC/B;SACF,CAAC;QACF,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACzB,GAAW,CAAC,KAAK,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YACxE,GAAW,CAAC,MAAM,GAAG,EAAE,GAAI,GAAW,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YACpE,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,kDAAkD,EAAE,sBAAsB,CAAC;YAClF,EAAE,EAAE,MAAe;YACnB,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;YACpE,SAAS,EAAE,aAAa;SACzB,CAAC,CAAC,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAC3B,IAAI,CAAC,+CAA+C,CAAC,CAAC;QACzD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACzC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,4EAA4E;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,kDAAkD;QAClD,MAAM,IAAI,GAAG;YACX,EAAE,EAAE,QAAQ;YACZ,iBAAiB,EAAE,MAAM;YACzB,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,mBAA4B;SACrC,CAAC;QACF,qDAAqD;QACrD,0FAA0F;QAC1F,kFAAkF;QAClF,mFAAmF;QACnF,6EAA6E;QAC7E,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,IAAwB,EAAE,EAAE;YACzD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG;YACb,KAAK,EAAE;gBACL,eAAe,EAAE,EAAE,SAAS,EAAE;aAC/B;SACF,CAAC;QACF,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACzB,GAAW,CAAC,KAAK,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACzE,2DAA2D;YAC1D,GAAW,CAAC,MAAM,GAAG,EAAE,GAAI,GAAW,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YACpE,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,kDAAkD,EAAE,sBAAsB,CAAC;YAClF,EAAE,EAAE,MAAe;YACnB,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;YACpE,SAAS,EAAE,aAAa;SACzB,CAAC,CAAC,CAAC;QACJ,GAAG,CAAC,IAAI,CAAC,iDAAiD,EAAE,qBAAqB,CAAC;YAChF,EAAE,EAAE,MAAe;SACpB,CAAC,CAAC,CAAC;QAEJ,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAClC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QACzD,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAE7C,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aACjC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACxD,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAEpD,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,iDAAiD;QACjD,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,GAAG,IAA4B,CAAC;YAC5C,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACnC,4DAA4D;YAC5D,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACvD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/deal-desk/tools/__tests__/outreach-draft.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=outreach-draft.test.d.ts.map

package/dist/deal-desk/tools/__tests__/outreach-draft.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outreach-draft.test.d.ts","sourceRoot":"","sources":["../../../../src/deal-desk/tools/__tests__/outreach-draft.test.ts"],"names":[],"mappings":""}

package/dist/deal-desk/tools/__tests__/outreach-draft.test.js

@@ -0,0 +1,115 @@
+import { describe, it, expect, vi } from "vitest";
+import express from "express";
+import request from "supertest";
+import { outreachDraftHandler } from "../outreach-draft.js";
+const ensureContactEmailFromApolloMock = vi.fn();
+const loadContactForEnrichmentMock = vi.fn();
+vi.mock("../../enrichment/resolve-contact-email.js", async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        ensureContactEmailFromApollo: (...args) => ensureContactEmailFromApolloMock(...args),
+        loadContactForEnrichment: (...args) => loadContactForEnrichmentMock(...args),
+    };
+});
+describe("POST /outreach/draft", () => {
+    it("returns 400 when subject is missing", async () => {
+        const app = express();
+        app.use(express.json());
+        app.post("/outreach/draft", outreachDraftHandler({ db: {} }));
+        const res = await request(app).post("/outreach/draft").send({
+            campaignId: "11111111-1111-1111-1111-111111111111",
+            targetId: "22222222-2222-2222-2222-222222222222",
+            contactId: "33333333-3333-3333-3333-333333333333",
+            body: "hello",
+        });
+        expect(res.status).toBe(400);
+    });
+    it("inserts a row after Apollo enrichment succeeds", async () => {
+        loadContactForEnrichmentMock.mockResolvedValueOnce({
+            id: "contact-1",
+            email: null,
+            source: null,
+            emailStatus: "unverified",
+        });
+        ensureContactEmailFromApolloMock.mockResolvedValueOnce({
+            ok: true,
+            email: "bob@example.com",
+            emailStatus: "verified",
+            enriched: true,
+        });
+        const inserted = [];
+        const fakeDb = {
+            query: {
+                ddContacts: {
+                    findFirst: vi.fn().mockResolvedValue({ id: "contact-1", targetId: "22222222-2222-2222-2222-222222222222" }),
+                },
+            },
+            insert: () => ({
+                values: (v) => ({
+                    returning: async () => {
+                        inserted.push(v);
+                        return [{ id: "send-1" }];
+                    },
+                }),
+            }),
+        };
+        const app = express();
+        app.use(express.json());
+        app.post("/c/:companyId/outreach/draft", outreachDraftHandler({
+            db: fakeDb,
+            loadApolloKey: async () => "apollo-key",
+        }));
+        const res = await request(app)
+            .post("/c/co-1/outreach/draft")
+            .send({
+            campaignId: "11111111-1111-1111-1111-111111111111",
+            targetId: "22222222-2222-2222-2222-222222222222",
+            contactId: "33333333-3333-3333-3333-333333333333",
+            subject: "Hello",
+            body: "Body text",
+        });
+        expect(res.status).toBe(201);
+        expect(res.body).toEqual({ id: "send-1" });
+        expect(inserted[0]).toMatchObject({ status: "awaiting_approval", subject: "Hello" });
+    });
+    it("returns 422 when Apollo cannot find an email", async () => {
+        loadContactForEnrichmentMock.mockResolvedValueOnce({
+            id: "contact-1",
+            email: null,
+            source: null,
+            emailStatus: "unverified",
+        });
+        ensureContactEmailFromApolloMock.mockResolvedValueOnce({
+            ok: false,
+            code: "no_email_found",
+            reason: "No email found",
+        });
+        const fakeDb = {
+            query: {
+                ddContacts: {
+                    findFirst: vi.fn().mockResolvedValue({ id: "contact-1", targetId: "22222222-2222-2222-2222-222222222222" }),
+                },
+            },
+            insert: vi.fn(),
+        };
+        const app = express();
+        app.use(express.json());
+        app.post("/c/:companyId/outreach/draft", outreachDraftHandler({
+            db: fakeDb,
+            loadApolloKey: async () => "apollo-key",
+        }));
+        const res = await request(app)
+            .post("/c/co-1/outreach/draft")
+            .send({
+            campaignId: "11111111-1111-1111-1111-111111111111",
+            targetId: "22222222-2222-2222-2222-222222222222",
+            contactId: "33333333-3333-3333-3333-333333333333",
+            subject: "Hello",
+            body: "Body text",
+        });
+        expect(res.status).toBe(422);
+        expect(res.body.code).toBe("no_email_found");
+    });
+});
+//# sourceMappingURL=outreach-draft.test.js.map

package/dist/deal-desk/tools/__tests__/outreach-draft.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outreach-draft.test.js","sourceRoot":"","sources":["../../../../src/deal-desk/tools/__tests__/outreach-draft.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,MAAM,gCAAgC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AACjD,MAAM,4BAA4B,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAE7C,EAAE,CAAC,IAAI,CAAC,2CAA2C,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC5E,MAAM,MAAM,GAAG,MAAM,cAAc,EAA8D,CAAC;IAClG,OAAO;QACL,GAAG,MAAM;QACT,4BAA4B,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CACnD,gCAAgC,CAAC,GAAG,IAAI,CAAC;QAC3C,wBAAwB,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,IAAI,CAAC;KACxF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,EAAE,EAAE,EAAE,EAAW,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC;YAC1D,UAAU,EAAE,sCAAsC;YAClD,QAAQ,EAAE,sCAAsC;YAChD,SAAS,EAAE,sCAAsC;YACjD,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,4BAA4B,CAAC,qBAAqB,CAAC;YACjD,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,YAAY;SAC1B,CAAC,CAAC;QACH,gCAAgC,CAAC,qBAAqB,CAAC;YACrD,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,UAAU;YACvB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG;YACb,KAAK,EAAE;gBACL,UAAU,EAAE;oBACV,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,sCAAsC,EAAE,CAAC;iBAC5G;aACF;YACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACb,MAAM,EAAE,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC;oBACvB,SAAS,EAAE,KAAK,IAAI,EAAE;wBACpB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;wBACjB,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;oBAC5B,CAAC;iBACF,CAAC;aACH,CAAC;SACH,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,oBAAoB,CAAC;YAC5D,EAAE,EAAE,MAAe;YACnB,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY;SACxC,CAAC,CAAC,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAC3B,IAAI,CAAC,wBAAwB,CAAC;aAC9B,IAAI,CAAC;YACJ,UAAU,EAAE,sCAAsC;YAClD,QAAQ,EAAE,sCAAsC;YAChD,SAAS,EAAE,sCAAsC;YACjD,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;QACL,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,4BAA4B,CAAC,qBAAqB,CAAC;YACjD,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,YAAY;SAC1B,CAAC,CAAC;QACH,gCAAgC,CAAC,qBAAqB,CAAC;YACrD,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG;YACb,KAAK,EAAE;gBACL,UAAU,EAAE;oBACV,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,sCAAsC,EAAE,CAAC;iBAC5G;aACF;YACD,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;SAChB,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,oBAAoB,CAAC;YAC5D,EAAE,EAAE,MAAe;YACnB,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY;SACxC,CAAC,CAAC,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAC3B,IAAI,CAAC,wBAAwB,CAAC;aAC9B,IAAI,CAAC;YACJ,UAAU,EAAE,sCAAsC;YAClD,QAAQ,EAAE,sCAAsC;YAChD,SAAS,EAAE,sCAAsC;YACjD,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;QACL,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/deal-desk/tools/__tests__/outreach-edit.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=outreach-edit.test.d.ts.map

package/dist/deal-desk/tools/__tests__/outreach-edit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outreach-edit.test.d.ts","sourceRoot":"","sources":["../../../../src/deal-desk/tools/__tests__/outreach-edit.test.ts"],"names":[],"mappings":""}

package/dist/deal-desk/tools/__tests__/outreach-edit.test.js

@@ -0,0 +1,169 @@
+import express from "express";
+import request from "supertest";
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { outreachEditHandler } from "../outreach-edit.js";
+import { collectStringParams } from "./helpers/where-introspection.js";
+function makeApp(deps) {
+    const app = express();
+    app.use(express.json());
+    app.use((req, _res, next) => {
+        req.actor = {
+            type: "board",
+            userId: "11111111-1111-4111-8111-111111111111",
+            source: "session",
+        };
+        next();
+    });
+    app.patch("/sends/:id", outreachEditHandler(deps));
+    return app;
+}
+describe("PATCH /outreach/sends/:id", () => {
+    let updateSet;
+    let updateWhere;
+    let selectLimit;
+    beforeEach(() => {
+        selectLimit = vi.fn().mockResolvedValue([
+            { id: "send-1", status: "awaiting_approval", contactId: "contact-1" },
+        ]);
+        updateSet = vi.fn().mockReturnThis();
+        updateWhere = vi.fn().mockResolvedValue([{ id: "send-1" }]);
+    });
+    const db = () => ({
+        select: () => ({ from: () => ({ where: () => ({ limit: selectLimit }) }) }),
+        update: () => ({ set: updateSet, where: updateWhere }),
+    });
+    it("rejects when status is not awaiting_approval", async () => {
+        selectLimit = vi.fn().mockResolvedValue([{ id: "send-1", status: "sent" }]);
+        const app = makeApp({ db: db() });
+        const res = await request(app)
+            .patch("/sends/send-1")
+            .send({ subject: "Hi" });
+        expect(res.status).toBe(409);
+        expect(res.body.reason).toMatch(/awaiting_approval/);
+    });
+    it("returns 404 when send not found", async () => {
+        selectLimit = vi.fn().mockResolvedValue([]);
+        const app = makeApp({ db: db() });
+        const res = await request(app).patch("/sends/missing").send({ subject: "Hi" });
+        expect(res.status).toBe(404);
+    });
+    it("updates subject + body and writes audit fields", async () => {
+        updateSet = vi.fn().mockImplementation((patch) => {
+            expect(patch.subject).toBe("New subject");
+            expect(patch.body).toBe("New body");
+            expect(patch.editedByUserId).toBe("11111111-1111-4111-8111-111111111111");
+            expect(patch.editedAt).toBeInstanceOf(Date);
+            return { where: updateWhere };
+        });
+        const app = makeApp({ db: db() });
+        const res = await request(app)
+            .patch("/sends/send-1")
+            .send({ subject: "New subject", body: "New body" });
+        expect(res.status).toBe(200);
+        expect(res.body.ok).toBe(true);
+    });
+    it("rejects empty body when all fields missing", async () => {
+        const app = makeApp({ db: db() });
+        const res = await request(app).patch("/sends/send-1").send({});
+        expect(res.status).toBe(400);
+    });
+    it("updates recipient email on linked contact", async () => {
+        const sets = [];
+        updateSet = vi.fn().mockImplementation((patch) => {
+            sets.push(patch);
+            return { where: updateWhere };
+        });
+        const app = makeApp({ db: db() });
+        const res = await request(app)
+            .patch("/sends/send-1")
+            .send({ recipientEmail: "bob@example.com" });
+        expect(res.status).toBe(200);
+        expect(sets.some((patch) => patch.email === "bob@example.com")).toBe(true);
+    });
+    it("returns 404 when sendId belongs to a different company (IDOR guard)", async () => {
+        // Conditional mock emulating a tenant-scoped DB:
+        // - If the where clause mentions co-A (correct scoped query) -> no row -> [].
+        // - Otherwise (unscoped) -> return the seeded send so an unscoped handler would
+        //   advance past the 404 and the test would fail.
+        const SEND = {
+            id: "send-B",
+            status: "awaiting_approval",
+            contactId: "c-1",
+            intermediaryId: null,
+            dealDeskCompanyId: "co-B",
+        };
+        const selectLimitFn = vi.fn(async () => [SEND]);
+        let lastSelectWhere = undefined;
+        let lastUpdateWhere = undefined;
+        const updateWhereFn = vi.fn(async (clause) => {
+            lastUpdateWhere = clause;
+            return [];
+        });
+        const db = {
+            select: () => ({
+                from: () => ({
+                    where: (clause) => {
+                        lastSelectWhere = clause;
+                        const params = collectStringParams(clause);
+                        // Override the default mock based on where-shape
+                        if (params.includes("co-A")) {
+                            return { limit: vi.fn(async () => []) };
+                        }
+                        return { limit: selectLimitFn };
+                    },
+                }),
+            }),
+            update: () => ({
+                set: () => ({ where: updateWhereFn }),
+            }),
+        };
+        const app = express();
+        app.use(express.json());
+        app.use((req, _res, next) => {
+            req.actor = {
+                type: "board",
+                userId: "11111111-1111-4111-8111-111111111111",
+                source: "session",
+            };
+            next();
+        });
+        app.patch("/companies/:companyId/outreach/sends/:id", outreachEditHandler({ db }));
+        const res = await request(app)
+            .patch("/companies/co-A/outreach/sends/send-B")
+            .send({ subject: "Hi" });
+        expect(res.status).toBe(404);
+        expect(res.body).toMatchObject({ ok: false });
+        expect(updateWhereFn).not.toHaveBeenCalled();
+        // Confirm the handler issued a scoped lookup (where contains co-A + send-B,
+        // never the send's real owner co-B).
+        const selectParams = collectStringParams(lastSelectWhere);
+        expect(selectParams).toContain("co-A");
+        expect(selectParams).toContain("send-B");
+        expect(selectParams).not.toContain("co-B");
+        expect(lastUpdateWhere).toBeUndefined();
+    });
+    it("allows local_trusted board edits without a uuid user id", async () => {
+        const app = express();
+        app.use(express.json());
+        app.use((req, _res, next) => {
+            req.actor = {
+                type: "board",
+                userId: "local-board",
+                source: "local_implicit",
+            };
+            next();
+        });
+        app.patch("/sends/:id", outreachEditHandler({ db: db() }));
+        updateSet = vi.fn().mockImplementation((patch) => {
+            expect(patch.editedByUserId).toBeNull();
+            expect(patch.editedAt).toBeInstanceOf(Date);
+            return { where: updateWhere };
+        });
+        const res = await request(app)
+            .patch("/sends/send-1")
+            .send({ subject: "Local edit" });
+        expect(res.status).toBe(200);
+        expect(res.body.ok).toBe(true);
+    });
+});
+//# sourceMappingURL=outreach-edit.test.js.map

package/dist/deal-desk/tools/__tests__/outreach-edit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outreach-edit.test.js","sourceRoot":"","sources":["../../../../src/deal-desk/tools/__tests__/outreach-edit.test.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAEvE,SAAS,OAAO,CAAC,IAA+C;IAC9D,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QACzB,GAAW,CAAC,KAAK,GAAG;YACnB,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,sCAAsC;YAC9C,MAAM,EAAE,SAAS;SAClB,CAAC;QACF,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,IAAI,SAAmC,CAAC;IACxC,IAAI,WAAqC,CAAC;IAC1C,IAAI,WAAqC,CAAC;IAE1C,UAAU,CAAC,GAAG,EAAE;QACd,WAAW,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;YACtC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,mBAAmB,EAAE,SAAS,EAAE,WAAW,EAAE;SACtE,CAAC,CAAC;QACH,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,EAAE,CAAC;QACrC,WAAW,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,MAAM,EAAE,GAAG,GAAQ,EAAE,CAAC,CAAC;QACrB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3E,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;KACvD,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,WAAW,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC5E,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAC3B,KAAK,CAAC,eAAe,CAAC;aACtB,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,WAAW,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;YAC/C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACpC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;YAC1E,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAC3B,KAAK,CAAC,eAAe,CAAC;aACtB,IAAI,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,IAAI,GAAc,EAAE,CAAC;QAC3B,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;YAC/C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjB,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAC3B,KAAK,CAAC,eAAe,CAAC;aACtB,IAAI,CAAC,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CACJ,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAE,KAA4B,CAAC,KAAK,KAAK,iBAAiB,CAAC,CAChF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,iDAAiD;QACjD,8EAA8E;QAC9E,gFAAgF;QAChF,kDAAkD;QAClD,MAAM,IAAI,GAAG;YACX,EAAE,EAAE,QAAQ;YACZ,MAAM,EAAE,mBAA4B;YACpC,SAAS,EAAE,KAAK;YAChB,cAAc,EAAE,IAAI;YACpB,iBAAiB,EAAE,MAAM;SAC1B,CAAC;QACF,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,IAAI,eAAe,GAAY,SAAS,CAAC;QACzC,IAAI,eAAe,GAAY,SAAS,CAAC;QACzC,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,MAAe,EAAE,EAAE;YACpD,eAAe,GAAG,MAAM,CAAC;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QAEH,MAAM,EAAE,GAAQ;YACd,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACb,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;oBACX,KAAK,EAAE,CAAC,MAAe,EAAE,EAAE;wBACzB,eAAe,GAAG,MAAM,CAAC;wBACzB,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;wBAC3C,iDAAiD;wBACjD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;4BAC5B,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;wBAC1C,CAAC;wBACD,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;oBAClC,CAAC;iBACF,CAAC;aACH,CAAC;YACF,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACb,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;aACtC,CAAC;SACH,CAAC;QAEF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACzB,GAAW,CAAC,KAAK,GAAG;gBACnB,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,sCAAsC;gBAC9C,MAAM,EAAE,SAAS;aAClB,CAAC;YACF,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,KAAK,CACP,0CAA0C,EAC1C,mBAAmB,CAAC,EAAE,EAAE,EAAE,CAAC,CAC5B,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAC3B,KAAK,CAAC,uCAAuC,CAAC;aAC9C,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAE7C,4EAA4E;QAC5E,qCAAqC;QACrC,MAAM,YAAY,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,CAAC,eAAe,CAAC,CAAC,aAAa,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACzB,GAAW,CAAC,KAAK,GAAG;gBACnB,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,gBAAgB;aACzB,CAAC;YACF,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,mBAAmB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3D,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;YAC/C,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAC3B,KAAK,CAAC,eAAe,CAAC;aACtB,IAAI,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/deal-desk/tools/__tests__/outreach-list-pending.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=outreach-list-pending.test.d.ts.map

package/dist/deal-desk/tools/__tests__/outreach-list-pending.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outreach-list-pending.test.d.ts","sourceRoot":"","sources":["../../../../src/deal-desk/tools/__tests__/outreach-list-pending.test.ts"],"names":[],"mappings":""}