@remit/backend 0.0.130 → 0.0.132

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.130",
+  "version": "0.0.132",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",

package/src/handlers/account-oauth-consent.test.ts

@@ -251,7 +251,7 @@ describe("the Microsoft consent for the services an account syncs", () => {
 
 		assert.equal(
 			location,
-			`${WEB_ORIGIN}/settings/accounts?oauthError=scope_not_granted`,
+			`${WEB_ORIGIN}/settings/accounts?oauthError=scope_not_granted&oauthEmail=person%40example.com&missingServices=Calendar`,
 		);
 		assert.deepEqual(
 			await client.account.listAllByAccountConfig(deriveAccountConfigId(sub)),

package/src/handlers/account-oauth.ts

@@ -236,7 +236,24 @@ export function getWebOrigin(): string {
 
 type ScopeRedemption =
 	| { kind: "granted"; refreshToken: string; grantedScopes: string[] }
-	| { kind: "refused"; reason: "exchange_failed" | "scope_not_granted" };
+	| { kind: "refused"; reason: "exchange_failed" }
+	| {
+			kind: "refused";
+			reason: "scope_not_granted";
+			service: AccountServiceName;
+	  };
+
+const scopeRefusalUrl = (
+	webOrigin: string,
+	email: string,
+	missingServices: readonly AccountServiceName[],
+): string => {
+	const url = new URL(`${webOrigin}/settings/accounts`);
+	url.searchParams.set("oauthError", "scope_not_granted");
+	url.searchParams.set("oauthEmail", email);
+	url.searchParams.set("missingServices", missingServices.join(","));
+	return url.toString();
+};
 
 const redeemEachService = async (
 	serviceFor: (service: AccountServiceName) => MailOAuthService,
@@ -265,8 +282,10 @@ const redeemEachService = async (
 					? ("exchange_failed" as const)
 					: ("scope_not_granted" as const);
 			});
-		if (typeof redeemed === "string")
+		if (redeemed === "exchange_failed")
 			return { kind: "refused", reason: redeemed };
+		if (redeemed === "scope_not_granted")
+			return { kind: "refused", reason: redeemed, service };
 		grantedScopes.push(...redeemed.grantedScopes);
 		token = redeemed.refreshToken ?? token;
 	}
@@ -512,6 +531,11 @@ export const MicrosoftOAuthOperations: Record<
 			services.filter((service) => service !== firstService),
 			accountConfigId,
 		);
+		if (
+			redemption.kind === "refused" &&
+			redemption.reason === "scope_not_granted"
+		)
+			return redirect(scopeRefusalUrl(webOrigin, email, [redemption.service]));
 		if (redemption.kind === "refused")
 			return redirect(
 				`${webOrigin}/settings/accounts?oauthError=${redemption.reason}`,
@@ -535,9 +559,7 @@ export const MicrosoftOAuthOperations: Record<
 				},
 				"MS OAuth callback: granted scopes lack a requested service",
 			);
-			return redirect(
-				`${webOrigin}/settings/accounts?oauthError=scope_not_granted`,
-			);
+			return redirect(scopeRefusalUrl(webOrigin, email, missingServices));
 		}
 
 		// Ensure the account config row exists for this user

package/src/handlers/calendar-event.ts

@@ -46,6 +46,7 @@ import {
 	type CalendarOutcome,
 	calendarDepsOf,
 	findCalendarFor,
+	findWritableCalendarFor,
 	listCalendarsFor,
 	notFound,
 	preconditionFailed,
@@ -348,7 +349,7 @@ export const createCalendarEventFor = async (
 	accountConfigId: string,
 	input: CreateCalendarEventInput,
 ): Promise<CalendarOutcome<CalendarObjectItem>> => {
-	const collection = await findCalendarFor(
+	const collection = await findWritableCalendarFor(
 		deps,
 		accountConfigId,
 		input.calendarId,
@@ -388,12 +389,12 @@ const resolveResource = async (
 	deps: CalendarEventDeps,
 	accountConfigId: string,
 	request: Pick<ScopedRequest, "calendarId" | "calendarObjectId">,
+	intent: "read" | "write",
 ): Promise<CalendarOutcome<ResolvedResource>> => {
-	const collection = await findCalendarFor(
-		deps,
-		accountConfigId,
-		request.calendarId,
-	);
+	const collection =
+		intent === "write"
+			? await findWritableCalendarFor(deps, accountConfigId, request.calendarId)
+			: await findCalendarFor(deps, accountConfigId, request.calendarId);
 	if (!collection.ok) return collection;
 
 	const object = await deps.calendarObject.find(
@@ -415,7 +416,12 @@ export const updateCalendarEventFor = async (
 	request: ScopedRequest,
 	patch: Partial<CalendarEventFields>,
 ): Promise<CalendarOutcome<CalendarObjectItem | null>> => {
-	const resolved = await resolveResource(deps, accountConfigId, request);
+	const resolved = await resolveResource(
+		deps,
+		accountConfigId,
+		request,
+		"write",
+	);
 	if (!resolved.ok) return resolved;
 	const { collection, object } = resolved.value;
 
@@ -458,7 +464,12 @@ export const deleteCalendarEventFor = async (
 	accountConfigId: string,
 	request: ScopedRequest,
 ): Promise<CalendarOutcome<CalendarObjectItem | null>> => {
-	const resolved = await resolveResource(deps, accountConfigId, request);
+	const resolved = await resolveResource(
+		deps,
+		accountConfigId,
+		request,
+		"write",
+	);
 	if (!resolved.ok) return resolved;
 	const { collection, object } = resolved.value;
 
@@ -646,6 +657,7 @@ export const CalendarEventDetailOperations: Record<
 			deps,
 			accountConfigId,
 			request.value,
+			"read",
 		);
 		if (!resolved.ok) return answerRefusal(resolved.error);
 		return toEventResponse(resolved.value.object);

package/src/handlers/calendar-suggestion.ts

@@ -9,6 +9,7 @@ import {
 } from "@remit/data-ports";
 import { BadRequestError } from "@remit/data-ports/errors";
 import {
+	CalendarSource,
 	CalendarSuggestionState,
 	FilterClauseField,
 	FilterMatchOperator,
@@ -224,7 +225,15 @@ export const CalendarSuggestionActionOperations: Record<
 		// Reads the collection through the caller's own account config, so a
 		// calendarId naming somebody else's collection is a 404 before anything
 		// is written into it.
-		await client.calendarCollection.get(accountConfigId, calendarId);
+		const collection = await client.calendarCollection.get(
+			accountConfigId,
+			calendarId,
+		);
+		if (collection.source === CalendarSource.Subscribed) {
+			throw new BadRequestError(
+				`"${collection.displayName}" is subscribed to a feed and is read-only — accept the invitation into another calendar`,
+			);
+		}
 
 		const accepted = await acceptCalendarSuggestion(client.calendarUnitOfWork, {
 			accountConfigId,

package/src/handlers/calendar.test.ts

@@ -1,5 +1,6 @@
 import assert from "node:assert/strict";
 import { after, before, describe, it } from "node:test";
+import type { CalendarFeedFetcher } from "@remit/calendar-service";
 import type {
 	CalendarCollectionItem,
 	CalendarEventIndexItem,
@@ -862,3 +863,218 @@ describe("the calendar collection wrappers", () => {
 		);
 	});
 });
+
+const FEED_URL =
+	"https://calendar.example/calendar/ical/rota%40example.com/private-0ddba11/basic.ics";
+
+const feedOf = (...events: string[][]): string =>
+	`${[
+		"BEGIN:VCALENDAR",
+		"VERSION:2.0",
+		"PRODID:-//Example//Published Calendar//EN",
+		"METHOD:PUBLISH",
+		...events.flat(),
+		"END:VCALENDAR",
+	].join("\r\n")}\r\n`;
+
+const FERRY = [
+	"BEGIN:VEVENT",
+	"UID:ferry@calendar.example",
+	"DTSTAMP:20260901T000000Z",
+	"DTSTART:20260908T070000Z",
+	"DTEND:20260908T080000Z",
+	"RRULE:FREQ=DAILY;COUNT=3",
+	"SUMMARY:Ferry crossing",
+	"END:VEVENT",
+];
+
+const LOCKS = [
+	"BEGIN:VEVENT",
+	"UID:locks@calendar.example",
+	"DTSTAMP:20260901T000000Z",
+	"DTSTART;VALUE=DATE:20260910",
+	"DTEND;VALUE=DATE:20260911",
+	"SUMMARY:Locks closed",
+	"END:VEVENT",
+];
+
+const serving =
+	(body: string, status = 200): CalendarFeedFetcher =>
+	async () =>
+		new Response(body, { status });
+
+const subscribe = async (
+	account: CalendarAccount,
+	fetcher: CalendarFeedFetcher = serving(feedOf(FERRY, LOCKS)),
+) =>
+	createCalendarFor(
+		account.eventDeps(),
+		account.accountConfigId,
+		{
+			urlSegment: "harbour",
+			displayName: "Harbour",
+			subscriptionUrl: FEED_URL.replace("https:", "webcal:"),
+		},
+		fetcher,
+		1_000,
+	);
+
+describe("a subscribed calendar", () => {
+	it("is created with the feed's events already in it", async () => {
+		const account = anAccount();
+
+		const created = await subscribe(account);
+
+		assert.ok(created.ok, JSON.stringify(created));
+		assert.equal(created.value.source, CalendarSource.Subscribed);
+		assert.equal(created.value.subscriptionUrl, FEED_URL);
+		assert.equal(created.value.subscriptionEnabled, true);
+		assert.equal(created.value.subscriptionFetchedAt, 1_000);
+		assert.equal(created.value.subscriptionError, "");
+		const objects = await account.objects();
+		assert.deepEqual(objects.map((object) => object.summary).sort(), [
+			"Ferry crossing",
+			"Locks closed",
+		]);
+		const ferry = objects.find((object) => object.summary === "Ferry crossing");
+		assert.ok(ferry);
+		assert.equal((await account.occurrences(ferry)).length, 3);
+	});
+
+	it("is not created when the feed cannot be read, and says why without the address", async () => {
+		const account = anAccount();
+
+		const created = await subscribe(account, serving("nope", 401));
+
+		assert.ok(!created.ok);
+		assert.equal(created.error.code, "SubscriptionUnreachable");
+		assert.equal(
+			created.error.message,
+			"the calendar was not created: the feed answered HTTP 401",
+		);
+		assert.equal(created.error.message.includes("private-0ddba11"), false);
+		assert.deepEqual(await account.collections(), []);
+	});
+
+	it("refuses an address that is not a web address", async () => {
+		const account = anAccount();
+
+		const created = await createCalendarFor(
+			account.deps(),
+			account.accountConfigId,
+			{
+				urlSegment: "harbour",
+				displayName: "Harbour",
+				subscriptionUrl: "file:///etc/passwd",
+			},
+			serving(feedOf(FERRY)),
+		);
+
+		assert.ok(!created.ok);
+		assert.equal(created.error.code, "InvalidSubscriptionUrl");
+	});
+
+	it("refuses a new event, an edit and a delete", async () => {
+		const account = anAccount();
+		const created = await subscribe(account);
+		assert.ok(created.ok);
+		const deps = account.eventDeps();
+		const [ferry] = (await account.objects()).filter(
+			(object) => object.summary === "Ferry crossing",
+		);
+		assert.ok(ferry);
+		const request = {
+			calendarId: created.value.calendarId,
+			calendarObjectId: ferry.calendarObjectId,
+			scope: RecurrenceScope.All,
+			recurrenceId: "",
+			ifMatch: undefined,
+		};
+
+		const added = await createCalendarEventFor(deps, account.accountConfigId, {
+			calendarId: created.value.calendarId,
+			summary: "Smuggled in",
+			start: "2026-09-09T09:00:00Z",
+			end: "2026-09-09T10:00:00Z",
+		});
+		const edited = await updateCalendarEventFor(
+			deps,
+			account.accountConfigId,
+			request,
+			{ summary: "Renamed" },
+		);
+		const removed = await deleteCalendarEventFor(
+			deps,
+			account.accountConfigId,
+			request,
+		);
+
+		for (const outcome of [added, edited, removed]) {
+			assert.ok(!outcome.ok);
+			assert.equal(outcome.error.code, "ReadOnlyCalendar");
+		}
+		const stored = await account.object(
+			created.value.calendarId,
+			ferry.calendarObjectId,
+		);
+		assert.equal(stored?.etag, ferry.etag);
+		assert.equal((await account.objects()).length, 2);
+	});
+
+	it("turns its refresh off without removing a collection or an event", async () => {
+		const account = anAccount();
+		const created = await subscribe(account);
+		assert.ok(created.ok);
+		const held = await account.objects();
+
+		const paused = await updateCalendarFor(
+			account.deps(),
+			account.accountConfigId,
+			created.value.calendarId,
+			{ subscriptionEnabled: false },
+		);
+
+		assert.ok(paused.ok);
+		assert.equal(paused.value.subscriptionEnabled, false);
+		assert.equal(paused.value.source, CalendarSource.Subscribed);
+		assert.deepEqual(
+			(await account.objects()).map((object) => object.etag).sort(),
+			held.map((object) => object.etag).sort(),
+		);
+		const enabled = await client.calendarCollection.listEnabledSubscriptions();
+		assert.equal(
+			enabled.some(
+				(collection) => collection.calendarId === created.value.calendarId,
+			),
+			false,
+		);
+
+		const resumed = await updateCalendarFor(
+			account.deps(),
+			account.accountConfigId,
+			created.value.calendarId,
+			{ subscriptionEnabled: true },
+		);
+		assert.ok(resumed.ok);
+		assert.equal(resumed.value.subscriptionEnabled, true);
+	});
+
+	it("refuses to turn a refresh on for a calendar that has no feed", async () => {
+		const account = anAccount();
+		const [own] = await listCalendarsFor(
+			account.deps(),
+			account.accountConfigId,
+		);
+		assert.ok(own);
+
+		const updated = await updateCalendarFor(
+			account.deps(),
+			account.accountConfigId,
+			own.calendarId,
+			{ subscriptionEnabled: true },
+		);
+
+		assert.ok(!updated.ok);
+		assert.equal(updated.error.code, "NotSubscribed");
+	});
+});

package/src/handlers/calendar.ts

@@ -4,10 +4,14 @@ import type {
 	UpdateCalendarInput,
 } from "@remit/api-openapi-types";
 import {
+	type CalendarFeedFetcher,
 	DEFAULT_CALENDAR_URL_SEGMENT,
 	isResolvableZone,
 	provisionDefaultCalendar,
 	putCalendarObject,
+	readCalendarFeed,
+	readSubscriptionUrl,
+	writeCalendarFeed,
 } from "@remit/calendar-service";
 import type {
 	CalendarCollectionItem,
@@ -114,6 +118,11 @@ const toCalendarResponse = (
 	source: item.source,
 	timezone: item.timezone,
 	syncSequence: item.syncSequence,
+	subscriptionUrl: item.subscriptionUrl,
+	subscriptionEnabled: item.subscriptionEnabled,
+	subscriptionCheckedAt: item.subscriptionCheckedAt,
+	subscriptionFetchedAt: item.subscriptionFetchedAt,
+	subscriptionError: item.subscriptionError,
 	createdAt: item.createdAt,
 	updatedAt: item.updatedAt,
 });
@@ -159,6 +168,28 @@ export const findCalendarFor = async (
 	return { ok: true, value: found };
 };
 
+/**
+ * One of the caller's collections that a person may write events into. A
+ * subscribed collection holds what its feed holds: an edit made here would be
+ * overwritten by the next refresh, so it is refused rather than accepted and
+ * silently lost.
+ */
+export const findWritableCalendarFor = async (
+	deps: CalendarDeps,
+	accountConfigId: string,
+	calendarId: string,
+): Promise<CalendarOutcome<CalendarCollectionItem>> => {
+	const found = await findCalendarFor(deps, accountConfigId, calendarId);
+	if (!found.ok) return found;
+	if (found.value.source === CalendarSource.Subscribed) {
+		return refuseCalendar(
+			"ReadOnlyCalendar",
+			`"${found.value.displayName}" is subscribed to a feed and is read-only — change the event where the feed comes from`,
+		);
+	}
+	return found;
+};
+
 /**
  * A collection's timezone is what every floating time in it is read in, so a
  * name this server cannot resolve is not a cosmetic setting — it silently moves
@@ -179,10 +210,66 @@ export const readCollectionTimezone = (
 	return { ok: true, value: timezone };
 };
 
+/**
+ * Creates a collection subscribed to a feed. The feed is read before anything
+ * is written, so an address that cannot be fetched leaves no empty calendar
+ * behind; its events then land through the one write path, in the same unit as
+ * the collection itself.
+ */
+const createSubscribedCalendarFor = async (
+	deps: CalendarDeps,
+	accountConfigId: string,
+	input: CreateCalendarInput & { subscriptionUrl: string },
+	collection: { urlSegment: string; timezone: string },
+	fetcher: CalendarFeedFetcher,
+	now: number,
+): Promise<CalendarOutcome<CalendarCollectionItem>> => {
+	const url = readSubscriptionUrl(input.subscriptionUrl);
+	if (!url.ok) return url;
+
+	const feed = await readCalendarFeed(url.value, fetcher);
+	if (!feed.ok) {
+		return refuseCalendar(
+			"SubscriptionUnreachable",
+			`the calendar was not created: ${feed.reason}`,
+		);
+	}
+
+	const created = await deps.calendarUnitOfWork.transaction(async (repos) => {
+		const made = await repos.calendarCollection.createExclusive({
+			accountConfigId,
+			urlSegment: collection.urlSegment,
+			displayName: input.displayName,
+			color: input.color,
+			timezone: collection.timezone,
+			source: CalendarSource.Subscribed,
+			subscriptionUrl: url.value,
+			subscriptionEnabled: true,
+		});
+		if (!made) return null;
+		await writeCalendarFeed(
+			deps.calendarUnitOfWork,
+			{ accountConfigId, calendarId: made.calendarId },
+			feed.value,
+			now,
+		);
+		return repos.calendarCollection.get(accountConfigId, made.calendarId);
+	});
+	if (!created) {
+		return refuseCalendar(
+			"UrlSegmentTaken",
+			`"${collection.urlSegment}" already addresses a calendar on this account — pick another`,
+		);
+	}
+	return { ok: true, value: created };
+};
+
 export const createCalendarFor = async (
 	deps: CalendarDeps,
 	accountConfigId: string,
 	input: CreateCalendarInput,
+	fetcher: CalendarFeedFetcher = fetch,
+	now: number = Date.now(),
 ): Promise<CalendarOutcome<CalendarCollectionItem>> => {
 	const urlSegment = normalizeCalendarUrlSegment(input.urlSegment);
 	if (urlSegment === "") {
@@ -195,6 +282,18 @@ export const createCalendarFor = async (
 	const timezone = readCollectionTimezone(input.timezone);
 	if (!timezone.ok) return timezone;
 
+	const { subscriptionUrl } = input;
+	if (subscriptionUrl !== undefined) {
+		return createSubscribedCalendarFor(
+			deps,
+			accountConfigId,
+			{ ...input, subscriptionUrl },
+			{ urlSegment, timezone: timezone.value },
+			fetcher,
+			now,
+		);
+	}
+
 	// The write decides, not a prior read: two creates of one segment arriving
 	// together would both find it free, and the loser would silently be handed
 	// the winner's calendar to write into.
@@ -264,6 +363,9 @@ export const pickCalendarUpdate = (
 	if (Object.hasOwn(body, "displayName")) patch.displayName = body.displayName;
 	if (Object.hasOwn(body, "color")) patch.color = body.color;
 	if (Object.hasOwn(body, "timezone")) patch.timezone = body.timezone;
+	if (Object.hasOwn(body, "subscriptionEnabled")) {
+		patch.subscriptionEnabled = body.subscriptionEnabled;
+	}
 	return patch;
 };
 
@@ -288,6 +390,15 @@ export const updateCalendarFor = async (
 	if (!current.ok) return current;
 
 	const patch = pickCalendarUpdate(body);
+	if (
+		patch.subscriptionEnabled !== undefined &&
+		current.value.source !== CalendarSource.Subscribed
+	) {
+		return refuseCalendar(
+			"NotSubscribed",
+			`"${current.value.displayName}" is not subscribed to a feed, so there is no refresh to turn on or off`,
+		);
+	}
 	if (patch.timezone !== undefined) {
 		const timezone = readCollectionTimezone(patch.timezone);
 		if (!timezone.ok) return timezone;

package/src/log-redaction.test.ts

@@ -83,6 +83,35 @@ describe("what a request leaves in the log", () => {
 		);
 	});
 
+	it("never writes the address a calendar subscribes to", async () => {
+		const secret = "private-7c0ffee5eed";
+		const { result: response, logged } = await captureStdout(() =>
+			send({
+				httpMethod: "POST",
+				path: "/calendars",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({
+					urlSegment: "harbour",
+					displayName: "Harbour",
+					subscriptionUrl: `http://127.0.0.1:9/calendar/ical/${secret}/basic.ics`,
+				}),
+				requestContext: {
+					authorizer: { claims: { sub: "log-redaction-subscriber" } },
+				} as unknown as APIGatewayProxyEvent["requestContext"],
+			}),
+		);
+
+		assert.equal(response.statusCode, 400, response.body);
+		assert.match(response.body, /subscription_unreachable/);
+		assert.equal(response.body.includes(secret), false);
+		assert.ok(logged.length > 0, "the request has to have logged something");
+		assert.equal(
+			logged.includes(secret),
+			false,
+			"for a Google secret address the URL is the whole credential",
+		);
+	});
+
 	it("never writes the credentials a failing request arrived with", async () => {
 		// A session is already established, so the bearer is never verified and the
 		// request reaches validation — where the whole parsed request, headers and