@k2b/cloud 0.28.0 → 0.29.1

package/src/contracts/outgoing-mail.ts

@@ -2,7 +2,7 @@ import type { PageParams, Paginated, ServiceError } from "@k2b/stdlib";
 import { z } from "zod";
 import { type RequestActor, ServiceAccountSchema, UserSchema } from "./shared";
 
-export const PlatformPermissionSchema = z.enum(["mail:send"]);
+export const PlatformPermissionSchema = z.enum(["mail:send", "mail:read"]);
 export type PlatformPermission = z.infer<typeof PlatformPermissionSchema>;
 export const MailRetentionSchema = z.object({ contentDays: z.int().min(1).max(36500), recordDays: z.int().min(1).max(36500) }).strict();
 export type MailRetention = z.infer<typeof MailRetentionSchema>;
@@ -74,6 +74,7 @@ export type MailProfile = z.infer<typeof MailProfileSchema>;
 export const MailErrorCodeSchema = z.enum([
   "bad_input",
   "profile_not_allowed",
+  "app_not_allowed",
   "profile_required",
   "quota_exceeded",
   "backlog_full",
@@ -110,14 +111,31 @@ export const AdminMailProfileSchema = MailProfileInputSchema.omit({ smtpPassword
   appCount: z.int(),
 });
 export type AdminMailProfile = z.infer<typeof AdminMailProfileSchema>;
-export type AdminMailApp = {
-  appId: string;
-  name: string;
-  registered: boolean;
-  declared: boolean;
-  mode: "default" | "selected";
-  profiles: string[];
-};
+export const AdminMailAppSchema = z.object({
+  appId: z.string(),
+  name: z.string(),
+  registered: z.boolean(),
+  declared: z.boolean(),
+  mode: z.enum(["default", "selected"]),
+  profiles: z.array(z.string()),
+  /** Whether the registered app declares `mail:read`; grants in `logApps` only apply with it. */
+  readDeclared: z.boolean(),
+  /** Other apps whose send log this app may read, besides its own. */
+  logApps: z.array(z.string()),
+});
+export type AdminMailApp = z.infer<typeof AdminMailAppSchema>;
+/** Application IDs as registered, like sender access; Core's own mail is never readable by apps. */
+export const MailLogAppIdSchema = z.string().min(1);
+/** How many other apps' send logs an administrator can let one app read. */
+const MAIL_LOG_GRANT_LIMIT = 100;
+export const MailLogAccessSchema = z
+  .object({ apps: z.array(MailLogAppIdSchema).max(MAIL_LOG_GRANT_LIMIT) })
+  .strict()
+  .refine(
+    (value) => new Set(value.apps).size === value.apps.length && !value.apps.includes("core"),
+    "Choose distinct apps other than core",
+  );
+export type MailLogAccess = z.infer<typeof MailLogAccessSchema>;
 
 export const MailStatusSchema = z.enum(["queued", "sending", "sent", "failed", "bounced", "cancelled"]);
 export type MailStatus = z.infer<typeof MailStatusSchema>;
@@ -218,11 +236,38 @@ export const MailFilterSchema = z
     batchId: z.uuid().optional(),
     status: z.array(MailStatusSchema).max(6).optional(),
     since: z.iso.datetime({ offset: true }).optional(),
+    /** Exclusive upper bound on `createdAt`. */
+    until: z.iso.datetime({ offset: true }).optional(),
+    /**
+     * Apps whose records to read; omitted means only the calling app. Others need `mail:read` and an
+     * administrator grant. Holds everything `mail.readableApps()` returns: the caller and every grant.
+     */
+    apps: z
+      .array(MailLogAppIdSchema)
+      .min(1)
+      .max(MAIL_LOG_GRANT_LIMIT + 1)
+      .refine((apps) => new Set(apps).size === apps.length, "Choose distinct apps")
+      .optional(),
+    /**
+     * Case-insensitive substring of a recipient address or the subject. Three letters or digits in a row
+     * give the trigram index something to look up; without them every record would be a candidate.
+     */
+    q: z
+      .string()
+      .refine((value) => !/[\x00-\x1f\x7f]/.test(value), "Search must not contain control characters")
+      .trim()
+      .max(200)
+      .regex(/[\p{L}\p{N}]{3}/u, "Search needs three letters or digits in a row")
+      .optional(),
+    /** One recipient address, matched exactly but case-insensitively. */
+    recipient: z.string().trim().pipe(mailAddress).optional(),
   })
   .strict();
 export type MailFilter = z.infer<typeof MailFilterSchema>;
 export const MailRecordSchema = z.object({
   id: z.uuid(),
+  /** The app that sent the record. */
+  appId: z.string(),
   batchId: z.uuid().optional(),
   profile: z.string(),
   ref: ref.optional(),
@@ -241,7 +286,6 @@ export const MailRecordSchema = z.object({
 });
 export type MailRecord = z.infer<typeof MailRecordSchema>;
 export const AdminMailRecordSchema = MailRecordSchema.omit({ text: true }).extend({
-  appId: z.string(),
   errorCode: z.string().optional(),
   response: z.string().optional(),
 });
@@ -252,9 +296,10 @@ export type MailPage<T = MailRecord> = Paginated<T> & { nextCursor?: string };
 export const MailPageParamsSchema = z
   .object({ page: z.int().min(1).optional(), perPage: z.int().min(1).max(100).optional(), cursor: z.string().max(1024).optional() })
   .strict();
-export const AdminMailFilterSchema = MailFilterSchema.extend({
+export const AdminMailFilterSchema = MailFilterSchema.omit({ apps: true }).extend({
   app: z.string().min(1).optional(),
   profile: MailProfileKeySchema.optional(),
+  /** Administrators search a recipient substring. */
   recipient: z.string().max(320).optional(),
 });
 export type AdminMailFilter = z.infer<typeof AdminMailFilterSchema>;

package/src/contracts/registry.ts

@@ -16,6 +16,7 @@ export type AppRegistryNav = {
   section: "primary" | "more" | "hidden";
   requiresAuth?: boolean;
   requiresRoles?: Role[];
+  badge?: string;
   adminHref?: string;
 };
 

package/src/contracts/user-notifications.ts

@@ -58,6 +58,80 @@ export const UserNotificationHistoryResponseSchema = z.object({
 });
 export type UserNotificationHistoryResponse = z.infer<typeof UserNotificationHistoryResponseSchema>;
 
+// Contracts reach the browser bundle, so this uses Intl directly instead of the stdlib date helpers.
+const isTimeZone = (value: string): boolean => {
+  try {
+    new Intl.DateTimeFormat("en", { timeZone: value }).format(0);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+/** Wall-clock time `HH:MM` in the quiet hours' time zone. */
+const QuietTimeOfDaySchema = z.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/, "Use a time from 00:00 to 23:59");
+
+/**
+ * One recurring quiet period. Days are ISO weekdays (1 = Monday … 7 = Sunday). A period that ends at or before
+ * its start runs overnight into the next day; equal start and end make 24 hours quiet, so 00:00 to 00:00 is the
+ * whole day.
+ */
+export const NotificationQuietPeriodSchema = z.object({
+  days: z
+    .array(z.number().int().min(1).max(7))
+    .min(1)
+    .max(7)
+    .refine((days) => new Set(days).size === days.length, "Each weekday can appear only once"),
+  start: QuietTimeOfDaySchema,
+  end: QuietTimeOfDaySchema,
+});
+export type NotificationQuietPeriod = z.infer<typeof NotificationQuietPeriodSchema>;
+
+/** One period per weekday is the most a weekly schedule needs, so seven periods bound the schedule. */
+export const NOTIFICATION_QUIET_PERIOD_LIMIT = 7;
+
+export const NotificationQuietHoursSchema = z.object({
+  timeZone: z.string().trim().min(1).max(64).refine(isTimeZone, "Unknown time zone"),
+  periods: z.array(NotificationQuietPeriodSchema).max(NOTIFICATION_QUIET_PERIOD_LIMIT),
+});
+export type NotificationQuietHours = z.infer<typeof NotificationQuietHoursSchema>;
+
+export const NotificationQuietReasonSchema = z.enum(["doNotDisturb", "quietHours"]);
+export type NotificationQuietReason = z.infer<typeof NotificationQuietReasonSchema>;
+
+/** Whether Cloud holds back browser notifications right now and, when known, until when. */
+export const NotificationQuietStateSchema = z.object({
+  active: z.boolean(),
+  reason: NotificationQuietReasonSchema.nullable(),
+  /** End of the current quiet time; null when inactive or when no end lies within the next week. */
+  until: z.string().datetime().nullable(),
+  /** Start of the next quiet hours while inactive; null when active or when none starts within the next week. */
+  nextStart: z.string().datetime().nullable(),
+});
+export type NotificationQuietState = z.infer<typeof NotificationQuietStateSchema>;
+
+export const NotificationQuietSettingsSchema = z.object({
+  doNotDisturbUntil: z.string().datetime().nullable(),
+  quietHours: NotificationQuietHoursSchema,
+  state: NotificationQuietStateSchema,
+});
+export type NotificationQuietSettings = z.infer<typeof NotificationQuietSettingsSchema>;
+
+/**
+ * Do not disturb is a pause, so it ends within a year (366 days covers the same date next year). Holding back
+ * browser notifications for longer is turning them off, which the notification preferences and the device do.
+ */
+export const NOTIFICATION_DO_NOT_DISTURB_MAX_DAYS = 366;
+
+export const UpdateNotificationQuietSettingsSchema = z
+  .object({
+    /** A future instant at most `NOTIFICATION_DO_NOT_DISTURB_MAX_DAYS` ahead pauses browser notifications until then; null resumes them. */
+    doNotDisturbUntil: z.iso.datetime({ offset: true }).nullable().optional(),
+    quietHours: NotificationQuietHoursSchema.optional(),
+  })
+  .refine((value) => value.doNotDisturbUntil !== undefined || value.quietHours !== undefined, "Nothing to update");
+export type UpdateNotificationQuietSettings = z.infer<typeof UpdateNotificationQuietSettingsSchema>;
+
 export const isSafeBrowserPushEndpoint = (value: string): boolean => {
   try {
     if (/[\\\u0000-\u001f\u007f]/.test(value)) return false;

package/src/server/middleware/request-logger.ts

@@ -1,6 +1,8 @@
 import { createMiddleware } from "hono/factory";
 import { logger } from "../../services/logging";
+import { redactSensitivePath } from "../../services/logging/redaction";
 import type { AuthContext } from "./auth";
+import { matchedRouteTemplate } from "./route-template";
 
 const log = logger("http");
 
@@ -15,11 +17,18 @@ const SKIP_PREFIXES = ["/public/", "/_ssr/", "/favicon", "/branding/"];
  * - Everything else (2xx, 3xx, 400, 404) → not logged (too noisy)
  */
 export const requestLogger = createMiddleware<AuthContext>(async (c, next) => {
-  const path = c.req.path;
-  if (SKIP_PREFIXES.some((p) => path.startsWith(p))) return next();
+  const requestPath = c.req.path;
+  if (SKIP_PREFIXES.some((p) => requestPath.startsWith(p))) return next();
 
   const start = Date.now();
   await next();
+  let path: string | null = null;
+  try {
+    path = matchedRouteTemplate(c);
+  } catch {
+    // Best-effort: an unrouted context must never break request logging.
+  }
+  path ??= redactSensitivePath(requestPath);
   const status = c.res.status;
   const duration = Date.now() - start;
 

package/src/services/accounts/avatar.ts

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { sql } from "bun";
 import { MAX_AVATAR_BYTES, MAX_AVATAR_DATA_URL_LENGTH } from "../../contracts/profile";
 import type { MutationResult } from "../../contracts/shared";
+import { stripImageMetadata } from "../image-metadata";
 
 export { MAX_AVATAR_BYTES, MAX_AVATAR_DATA_URL_LENGTH } from "../../contracts/profile";
 
@@ -95,10 +96,12 @@ export const setAvatar = async (params: { id: string; dataUrl: string }): Promis
   const parsed = parseAvatarDataUrl(params.dataUrl);
   if (!parsed.ok) return parsed;
 
+  const bytes = Buffer.from(stripImageMetadata(parsed.data.bytes));
+  const dataUrl = `data:${parsed.data.contentType};base64,${bytes.toString("base64")}`;
   const rows = await sql<{ avatar_hash: string }[]>`
     UPDATE auth.users
-    SET avatar_data_url = ${parsed.data.dataUrl},
-        avatar_hash = ${parsed.data.hash}
+    SET avatar_data_url = ${dataUrl},
+        avatar_hash = ${hashAvatar(dataUrl)}
     WHERE id = ${params.id}::uuid
     RETURNING avatar_hash
   `;