@remit/backend 0.0.129 → 0.0.131

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.129",
+  "version": "0.0.131",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",

package/src/handlers/account-oauth-consent.test.ts

@@ -251,7 +251,7 @@ describe("the Microsoft consent for the services an account syncs", () => {
 
 		assert.equal(
 			location,
-			`${WEB_ORIGIN}/settings/accounts?oauthError=scope_not_granted`,
+			`${WEB_ORIGIN}/settings/accounts?oauthError=scope_not_granted&oauthEmail=person%40example.com&missingServices=Calendar`,
 		);
 		assert.deepEqual(
 			await client.account.listAllByAccountConfig(deriveAccountConfigId(sub)),

package/src/handlers/account-oauth.ts

@@ -236,7 +236,24 @@ export function getWebOrigin(): string {
 
 type ScopeRedemption =
 	| { kind: "granted"; refreshToken: string; grantedScopes: string[] }
-	| { kind: "refused"; reason: "exchange_failed" | "scope_not_granted" };
+	| { kind: "refused"; reason: "exchange_failed" }
+	| {
+			kind: "refused";
+			reason: "scope_not_granted";
+			service: AccountServiceName;
+	  };
+
+const scopeRefusalUrl = (
+	webOrigin: string,
+	email: string,
+	missingServices: readonly AccountServiceName[],
+): string => {
+	const url = new URL(`${webOrigin}/settings/accounts`);
+	url.searchParams.set("oauthError", "scope_not_granted");
+	url.searchParams.set("oauthEmail", email);
+	url.searchParams.set("missingServices", missingServices.join(","));
+	return url.toString();
+};
 
 const redeemEachService = async (
 	serviceFor: (service: AccountServiceName) => MailOAuthService,
@@ -265,8 +282,10 @@ const redeemEachService = async (
 					? ("exchange_failed" as const)
 					: ("scope_not_granted" as const);
 			});
-		if (typeof redeemed === "string")
+		if (redeemed === "exchange_failed")
 			return { kind: "refused", reason: redeemed };
+		if (redeemed === "scope_not_granted")
+			return { kind: "refused", reason: redeemed, service };
 		grantedScopes.push(...redeemed.grantedScopes);
 		token = redeemed.refreshToken ?? token;
 	}
@@ -512,6 +531,11 @@ export const MicrosoftOAuthOperations: Record<
 			services.filter((service) => service !== firstService),
 			accountConfigId,
 		);
+		if (
+			redemption.kind === "refused" &&
+			redemption.reason === "scope_not_granted"
+		)
+			return redirect(scopeRefusalUrl(webOrigin, email, [redemption.service]));
 		if (redemption.kind === "refused")
 			return redirect(
 				`${webOrigin}/settings/accounts?oauthError=${redemption.reason}`,
@@ -535,9 +559,7 @@ export const MicrosoftOAuthOperations: Record<
 				},
 				"MS OAuth callback: granted scopes lack a requested service",
 			);
-			return redirect(
-				`${webOrigin}/settings/accounts?oauthError=scope_not_granted`,
-			);
+			return redirect(scopeRefusalUrl(webOrigin, email, missingServices));
 		}
 
 		// Ensure the account config row exists for this user

package/src/handlers/calendar-event.test.ts

@@ -36,6 +36,8 @@ const listEvents =
 	CalendarEventOperations.CalendarEventOperations_listCalendarEvents as Handler;
 const createEvent =
 	CalendarEventOperations.CalendarEventOperations_createCalendarEvent as Handler;
+const getEvent =
+	CalendarEventDetailOperations.CalendarEventDetailOperations_getCalendarEvent as Handler;
 const updateEvent =
 	CalendarEventDetailOperations.CalendarEventDetailOperations_updateCalendarEvent as Handler;
 const deleteEvent =
@@ -264,6 +266,118 @@ describe("GET /calendar-events", () => {
 	});
 });
 
+describe("GET /calendar-events?calendarObjectId", () => {
+	it("lists the occurrences of that one resource, across the caller's calendars", async () => {
+		const { event } = anAccount();
+		const defaultId = await defaultCalendarId(event);
+		const work = (await createCalendar(
+			contextOf({ requestBody: { urlSegment: "work", displayName: "Work" } }),
+			event,
+		)) as unknown as { calendarId: string };
+		const series = await seedEvent(event, {
+			calendarId: work.calendarId,
+			summary: "Stand-up",
+			start: "2026-09-07T09:00:00Z",
+			end: "2026-09-07T09:15:00Z",
+			recurrenceRule: "FREQ=WEEKLY;COUNT=3",
+		});
+		await seedEvent(event, {
+			calendarId: defaultId,
+			summary: "Dentist",
+			start: "2026-09-08T09:00:00Z",
+			end: "2026-09-08T10:00:00Z",
+		});
+
+		const listed = (await listEvents(
+			contextOf({
+				query: { ...WINDOW, calendarObjectId: series.calendarObjectId },
+			}),
+			event,
+		)) as unknown as { items: Instance[] };
+
+		assert.deepEqual(
+			listed.items.map((instance) => [
+				instance.calendarId,
+				instance.start.slice(0, 10),
+			]),
+			[
+				[work.calendarId, "2026-09-07"],
+				[work.calendarId, "2026-09-14"],
+				[work.calendarId, "2026-09-21"],
+			],
+		);
+	});
+
+	it("lists nothing for a resource on another account", async () => {
+		const stranger = anAccount();
+		const theirs = await seedEvent(stranger.event, {
+			calendarId: await defaultCalendarId(stranger.event),
+			summary: "Private",
+			start: "2026-09-07T09:00:00Z",
+			end: "2026-09-07T10:00:00Z",
+		});
+		const { event } = anAccount();
+
+		const listed = (await listEvents(
+			contextOf({
+				query: { ...WINDOW, calendarObjectId: theirs.calendarObjectId },
+			}),
+			event,
+		)) as unknown as { items: Instance[] };
+
+		assert.deepEqual(listed.items, []);
+	});
+});
+
+describe("GET /calendar-events/{calendarObjectId} without a calendar", () => {
+	it("finds the resource among the caller's calendars", async () => {
+		const { event } = anAccount();
+		await defaultCalendarId(event);
+		const work = (await createCalendar(
+			contextOf({ requestBody: { urlSegment: "work", displayName: "Work" } }),
+			event,
+		)) as unknown as { calendarId: string };
+		const seeded = await seedEvent(event, {
+			calendarId: work.calendarId,
+			summary: "Stand-up",
+			start: "2026-09-07T09:00:00Z",
+			end: "2026-09-07T09:15:00Z",
+		});
+
+		const found = (await getEvent(
+			contextOf({
+				params: { calendarObjectId: seeded.calendarObjectId },
+				query: {},
+			}),
+			event,
+		)) as unknown as { calendarId: string; dtStart: string };
+
+		assert.equal(found.calendarId, work.calendarId);
+		assert.match(found.dtStart, /^2026-09-07/);
+	});
+
+	it("answers not-found for a resource on another account", async () => {
+		const stranger = anAccount();
+		const theirs = await seedEvent(stranger.event, {
+			calendarId: await defaultCalendarId(stranger.event),
+			summary: "Private",
+			start: "2026-09-07T09:00:00Z",
+			end: "2026-09-07T10:00:00Z",
+		});
+		const { event } = anAccount();
+
+		const found = await getEvent(
+			contextOf({
+				params: { calendarObjectId: theirs.calendarObjectId },
+				query: {},
+			}),
+			event,
+		);
+
+		assert.equal(found.statusCode, 404);
+	});
+});
+
 describe("POST /calendar-events", () => {
 	it("refuses a recurrence rule it cannot read and writes nothing", async () => {
 		const { event } = anAccount();

package/src/handlers/calendar-event.ts

@@ -15,6 +15,7 @@ import {
 	deleteCalendarObject,
 	listBusySpans,
 	listCalendarInstances,
+	listObjectInstances,
 	OFFSET_BEARING,
 	parseCalendar,
 	projectCalendar,
@@ -490,6 +491,22 @@ export const deleteCalendarEventFor = async (
 	);
 };
 
+/** The collection holding a resource, found among the ones given. */
+const locateResource = async (
+	deps: CalendarDeps,
+	collections: CalendarCollectionItem[],
+	calendarObjectId: string,
+): Promise<ResolvedResource | undefined> => {
+	for (const collection of collections) {
+		const object = await deps.calendarObject.find(
+			collection.calendarId,
+			calendarObjectId,
+		);
+		if (object) return { collection, object };
+	}
+	return undefined;
+};
+
 const readCalendarIds = (value: unknown): string[] => {
 	if (typeof value === "string") return value === "" ? [] : [value];
 	if (Array.isArray(value)) return value.filter((id) => typeof id === "string");
@@ -545,6 +562,7 @@ export const CalendarEventOperations: Record<
 			from?: string;
 			to?: string;
 			calendarId?: string | string[];
+			calendarObjectId?: string;
 		};
 		const window = readWindow(query.from, query.to);
 		if (!window.ok) return badRequest(window.error);
@@ -557,6 +575,22 @@ export const CalendarEventOperations: Record<
 		);
 		if (!collections.ok) return answerRefusal(collections.error);
 
+		if (query.calendarObjectId) {
+			const located = await locateResource(
+				deps,
+				collections.value,
+				query.calendarObjectId,
+			);
+			if (!located) return { items: [] };
+			const own = await listObjectInstances(
+				deps,
+				located.collection,
+				located.object,
+				window.value,
+			);
+			return { items: own.map(toInstanceResponse) };
+		}
+
 		const instances = await listCalendarInstances(
 			deps,
 			collections.value,
@@ -594,6 +628,20 @@ export const CalendarEventDetailOperations: Record<
 		if (!request.ok) return badRequest(request.error);
 		const deps = calendarEventDepsOf(calendarDepsOf(await getClient()));
 
+		if (request.value.calendarId === "") {
+			const located = await locateResource(
+				deps,
+				await listCalendarsFor(deps, accountConfigId),
+				request.value.calendarObjectId,
+			);
+			if (!located) {
+				return notFound(
+					`no event ${request.value.calendarObjectId} on this account`,
+				);
+			}
+			return toEventResponse(located.object);
+		}
+
 		const resolved = await resolveResource(
 			deps,
 			accountConfigId,