@remit/backend 0.0.133 → 0.0.135

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.133",
+  "version": "0.0.135",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",

package/src/derive/contentUrl.test.ts

@@ -4,7 +4,11 @@ import {
 	createContentSigner,
 	verifyContentSignature,
 } from "./contentSignature.js";
-import { buildContentUrl, getContentDeliveryDomain } from "./contentUrl.js";
+import {
+	buildContentUrl,
+	buildStorageContentUrl,
+	getContentDeliveryDomain,
+} from "./contentUrl.js";
 
 describe("buildContentUrl", () => {
 	it("produces the /content/accounts/{cfg}/{acc}/messages/{msg}/parts/{part} layout the Lambda@Edge expects", () => {
@@ -64,6 +68,18 @@ describe("buildContentUrl", () => {
 		);
 	});
 
+	it("addresses an outbox attachment by its storage key", () => {
+		const url = buildStorageContentUrl({
+			domain: "https://cdn.test",
+			storageKey: "accounts/cfg/acc/outbox/ob-1/attachments/att-1",
+		});
+
+		assert.equal(
+			url,
+			"https://cdn.test/content/accounts/cfg/acc/outbox/ob-1/attachments/att-1",
+		);
+	});
+
 	it("leaves the URL unsigned when no signer is provided (AWS/Lambda@Edge path)", () => {
 		const url = buildContentUrl({
 			domain: "https://abc123.cloudfront.net",

package/src/derive/contentUrl.ts

@@ -26,9 +26,16 @@ export interface BuildContentUrlInput {
 	sign?: ContentSigner;
 }
 
-export const buildContentUrl = (input: BuildContentUrlInput): string => {
-	const { domain, accountConfigId, accountId, messageId, partPath, sign } =
-		input;
+export interface BuildStorageContentUrlInput {
+	domain: string;
+	storageKey: string;
+	sign?: ContentSigner;
+}
+
+export const buildStorageContentUrl = (
+	input: BuildStorageContentUrlInput,
+): string => {
+	const { domain, storageKey, sign } = input;
 	const normalizedDomain = domain.replace(/\/+$/, "");
 	const base = normalizedDomain.startsWith("http")
 		? normalizedDomain
@@ -36,17 +43,26 @@ export const buildContentUrl = (input: BuildContentUrlInput): string => {
 	// The signed message is the decoded, account-scoped storage path — the same
 	// value the `/content` route recomputes from `req.path`. Keep it in lockstep
 	// with the verifier's `req.path.replace(/^\/content\//, "")`.
-	const relativePath = `accounts/${accountConfigId}/${accountId}/messages/${messageId}/parts/${partPath}`;
-	const safePart = partPath
+	const safeKey = storageKey
 		.split("/")
 		.map((segment) => encodeURIComponent(segment))
 		.join("/");
-	const url = `${base}/content/accounts/${accountConfigId}/${accountId}/messages/${messageId}/parts/${safePart}`;
+	const url = `${base}/content/${safeKey}`;
 	if (!sign) return url;
-	const { exp, sig } = sign(relativePath);
+	const { exp, sig } = sign(storageKey);
 	return `${url}?exp=${exp}&sig=${encodeURIComponent(sig)}`;
 };
 
+export const buildContentUrl = (input: BuildContentUrlInput): string => {
+	const { domain, accountConfigId, accountId, messageId, partPath, sign } =
+		input;
+	return buildStorageContentUrl({
+		domain,
+		storageKey: `accounts/${accountConfigId}/${accountId}/messages/${messageId}/parts/${partPath}`,
+		sign,
+	});
+};
+
 /**
  * Read the CloudFront distribution domain from the environment. The CDK
  * wires `CONTENT_DELIVERY_DOMAIN` onto the API Lambda from the

package/src/handlers/calendar-suggestion.test.ts

@@ -10,6 +10,7 @@ import type {
 	SettleCalendarSuggestionInput,
 } from "@remit/data-ports";
 import {
+	CalendarInviteAnswer,
 	CalendarInviteMethod,
 	CalendarSuggestionSource,
 	CalendarSuggestionState,
@@ -354,6 +355,7 @@ const INVITATION = [
 const putSuggestion = (
 	accountConfigId: string,
 	messageId: string,
+	method: CalendarSuggestionItem["method"] = CalendarInviteMethod.Request,
 ): Promise<CalendarSuggestionItem> =>
 	client.calendarSuggestion.put({
 		accountConfigId,
@@ -361,7 +363,7 @@ const putSuggestion = (
 		bodyPartId: "part-1",
 		icalUid: "invite@example.test",
 		sequence: 0,
-		method: CalendarInviteMethod.Request,
+		method,
 		source: CalendarSuggestionSource.IcalendarPart,
 		summary: "Quarterly review",
 		dtStart: "2026-09-01T10:00:00+02:00",
@@ -506,6 +508,45 @@ describe("POST /calendar-suggestions/{suggestionId}/accept", () => {
 		assert.equal(untouched.state, CalendarSuggestionState.Pending);
 		assert.equal(untouched.acceptedCalendarObjectId, "");
 	});
+
+	test("refuses a maybe to a cancellation, before writing anything", async () => {
+		const { accountConfigId, event } = anAccount();
+		const calendar = await client.calendarCollection.create({
+			accountConfigId,
+			urlSegment: "default",
+			displayName: "Calendar",
+		});
+		const card = await putSuggestion(
+			accountConfigId,
+			"msg-cancel-maybe",
+			CalendarInviteMethod.Cancel,
+		);
+
+		await assert.rejects(
+			() =>
+				acceptSuggestion(
+					contextOf({
+						params: { suggestionId: card.suggestionId },
+						requestBody: {
+							calendarId: calendar.calendarId,
+							answer: CalendarInviteAnswer.Tentative,
+						},
+					}),
+					event,
+				),
+			(error: unknown) => (error as { statusCode?: number }).statusCode === 400,
+		);
+
+		assert.deepEqual(
+			await client.calendarObject.listByCalendar(calendar.calendarId),
+			[],
+		);
+		const untouched = await client.calendarSuggestion.get(
+			accountConfigId,
+			card.suggestionId,
+		);
+		assert.equal(untouched.state, CalendarSuggestionState.Pending);
+	});
 });
 
 describe("POST /calendar-suggestions/{suggestionId}/dismiss", () => {

package/src/handlers/calendar-suggestion.ts

@@ -1,4 +1,7 @@
-import type { CalendarSuggestionResponse } from "@remit/api-openapi-types";
+import type {
+	CalendarInviteAnswer as CalendarInviteAnswerValue,
+	CalendarSuggestionResponse,
+} from "@remit/api-openapi-types";
 import { acceptCalendarSuggestion } from "@remit/calendar-service";
 import {
 	type CalendarSuggestionItem,
@@ -9,6 +12,8 @@ import {
 } from "@remit/data-ports";
 import { BadRequestError } from "@remit/data-ports/errors";
 import {
+	CalendarInviteAnswer,
+	CalendarInviteMethod,
 	CalendarSource,
 	CalendarSuggestionState,
 	FilterClauseField,
@@ -211,8 +216,10 @@ export const CalendarSuggestionActionOperations: Record<
 		const { suggestionId } = context.request.params as {
 			suggestionId: string;
 		};
-		const { calendarId } = context.request.requestBody as {
+		const { calendarId, answer = CalendarInviteAnswer.Accepted } = context
+			.request.requestBody as {
 			calendarId: string;
+			answer?: CalendarInviteAnswerValue;
 		};
 
 		const client = await getClient();
@@ -220,7 +227,20 @@ export const CalendarSuggestionActionOperations: Record<
 			accountConfigId,
 			suggestionId,
 		);
-		assertSettleable(suggestion, CalendarSuggestionState.Accepted);
+		if (
+			answer === CalendarInviteAnswer.Tentative &&
+			suggestion.method === CalendarInviteMethod.Cancel
+		) {
+			throw new BadRequestError(
+				"This is a cancellation, so there is nothing to answer maybe to.",
+			);
+		}
+		assertSettleable(
+			suggestion,
+			answer === CalendarInviteAnswer.Tentative
+				? CalendarSuggestionState.Tentative
+				: CalendarSuggestionState.Accepted,
+		);
 
 		// Reads the collection through the caller's own account config, so a
 		// calendarId naming somebody else's collection is a 404 before anything
@@ -240,6 +260,7 @@ export const CalendarSuggestionActionOperations: Record<
 			calendarId,
 			suggestion,
 			attendee: await accountEmailForMessage(client, suggestion.messageId),
+			answer,
 		});
 		if (!accepted.ok) {
 			throw new BadRequestError(accepted.error.message);

package/src/handlers/outbox-attachment.test.ts

@@ -53,6 +53,8 @@ import {
 	mintOutboxAttachment,
 } from "./outbox-attachment.js";
 
+process.env.CONTENT_DELIVERY_DOMAIN = "https://content.test";
+
 const SUB = "cognito-sub-679";
 const ACCOUNT_CONFIG_ID = deriveAccountConfigId(SUB);
 const OTHER_ACCOUNT_CONFIG_ID = deriveAccountConfigId("cognito-sub-stranger");

package/src/handlers/outbox-attachment.ts

@@ -4,14 +4,21 @@ import type {
 	OutboxAttachmentRejection,
 	OutboxAttachmentResponse,
 } from "@remit/api-openapi-types";
+import type { OutboxAttachmentItem } from "@remit/data-ports";
 import { OutboxAttachmentRejectionReason } from "@remit/domain-enums";
 import type {
 	OutboxAttachmentRejectionDetail,
 	OutboxAttachmentRejectionReasonValue,
 } from "@remit/mailbox-service";
+import { outboxAttachmentContentId } from "@remit/mailbox-service/outbox-attachment-content";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import type { Context } from "openapi-backend";
 import { getAccountConfigIdFromEvent } from "../auth.js";
+import { getContentSigner } from "../derive/contentSignature.js";
+import {
+	buildStorageContentUrl,
+	getContentDeliveryDomain,
+} from "../derive/contentUrl.js";
 import { getClient } from "../service/data-client.js";
 
 // Every error body the API emits carries a `code` (issue #371). A refusal here
@@ -24,6 +31,23 @@ const TOO_LARGE: ReadonlySet<OutboxAttachmentRejectionReasonValue> = new Set([
 	OutboxAttachmentRejectionReason.TooManyAttachments,
 ]);
 
+export const toOutboxAttachmentResponse = (
+	item: OutboxAttachmentItem,
+): OutboxAttachmentResponse => ({
+	outboxAttachmentId: item.outboxAttachmentId,
+	outboxMessageId: item.outboxMessageId,
+	filename: item.filename,
+	contentType: item.contentType,
+	sizeBytes: item.sizeBytes,
+	state: item.state,
+	contentId: outboxAttachmentContentId(item.outboxAttachmentId),
+	contentUrl: buildStorageContentUrl({
+		domain: getContentDeliveryDomain(),
+		storageKey: item.storageKey,
+		sign: getContentSigner(),
+	}),
+});
+
 interface RejectionResponse {
 	statusCode: number;
 	body: OutboxAttachmentRejection;
@@ -98,5 +122,5 @@ export const completeOutboxAttachment = async (
 
 	if (result.outcome === "Rejected") return refuse(result.rejection);
 
-	return result.attachment;
+	return toOutboxAttachmentResponse(result.attachment);
 };

package/src/handlers/outbox.test.ts

@@ -50,6 +50,9 @@ import {
 } from "../service/data-client.js";
 import { OutboxDetailOperations, OutboxOperations } from "./outbox.js";
 
+const CONTENT_DOMAIN = "https://content.test";
+process.env.CONTENT_DELIVERY_DOMAIN = CONTENT_DOMAIN;
+
 const SUB = "cognito-sub-604";
 const ACCOUNT_CONFIG_ID = deriveAccountConfigId(SUB);
 const ACCOUNT_ID = "acc-604";
@@ -616,6 +619,31 @@ describe("attachmentIds on a draft update (#679)", () => {
 		assert.equal(attachmentRows.size, 2);
 	});
 
+	it("names each file by its content-id and where its bytes are read from", async () => {
+		installClient();
+		const { outboxMessageId, ids } = await seed();
+
+		const response = await patch(outboxMessageId, { subject: "still typing" });
+
+		const body = JSON.parse(response.body) as {
+			attachments: {
+				outboxAttachmentId: string;
+				contentId: string;
+				contentUrl: string;
+			}[];
+		};
+		const [first] = body.attachments.filter(
+			(item) => item.outboxAttachmentId === ids[0],
+		);
+		assert.equal(first.contentId, `${ids[0]}@remit`);
+		assert.ok(
+			first.contentUrl.startsWith(
+				`${CONTENT_DOMAIN}/content/${attachmentRows.get(ids[0])?.storageKey}`,
+			),
+			first.contentUrl,
+		);
+	});
+
 	it("present and empty removes every file", async () => {
 		installClient();
 		const { outboxMessageId } = await seed();

package/src/handlers/outbox.ts

@@ -21,24 +21,14 @@ import type {
 import {
 	completeOutboxAttachment,
 	mintOutboxAttachment,
+	toOutboxAttachmentResponse,
 } from "./outbox-attachment.js";
 
-const toAttachmentResponse = (
-	item: OutboxAttachmentItem,
-): OutboxMessageResponse["attachments"][number] => ({
-	outboxAttachmentId: item.outboxAttachmentId,
-	outboxMessageId: item.outboxMessageId,
-	filename: item.filename,
-	contentType: item.contentType,
-	sizeBytes: item.sizeBytes,
-	state: item.state,
-});
-
 const toOutboxMessageResponse = (
 	item: OutboxMessageItem,
 	attachments: OutboxAttachmentItem[] = [],
 ): OutboxMessageResponse => ({
-	attachments: attachments.map(toAttachmentResponse),
+	attachments: attachments.map(toOutboxAttachmentResponse),
 	outboxMessageId: item.outboxMessageId,
 	accountId: item.accountId,
 	fromAddress: item.fromAddress,