@remit/backend 0.0.134 → 0.0.136

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.134",
+  "version": "0.0.136",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",

package/src/derive/contentUrl.test.ts

@@ -4,7 +4,11 @@ import {
 	createContentSigner,
 	verifyContentSignature,
 } from "./contentSignature.js";
-import { buildContentUrl, getContentDeliveryDomain } from "./contentUrl.js";
+import {
+	buildContentUrl,
+	buildStorageContentUrl,
+	getContentDeliveryDomain,
+} from "./contentUrl.js";
 
 describe("buildContentUrl", () => {
 	it("produces the /content/accounts/{cfg}/{acc}/messages/{msg}/parts/{part} layout the Lambda@Edge expects", () => {
@@ -64,6 +68,18 @@ describe("buildContentUrl", () => {
 		);
 	});
 
+	it("addresses an outbox attachment by its storage key", () => {
+		const url = buildStorageContentUrl({
+			domain: "https://cdn.test",
+			storageKey: "accounts/cfg/acc/outbox/ob-1/attachments/att-1",
+		});
+
+		assert.equal(
+			url,
+			"https://cdn.test/content/accounts/cfg/acc/outbox/ob-1/attachments/att-1",
+		);
+	});
+
 	it("leaves the URL unsigned when no signer is provided (AWS/Lambda@Edge path)", () => {
 		const url = buildContentUrl({
 			domain: "https://abc123.cloudfront.net",

package/src/derive/contentUrl.ts

@@ -26,9 +26,16 @@ export interface BuildContentUrlInput {
 	sign?: ContentSigner;
 }
 
-export const buildContentUrl = (input: BuildContentUrlInput): string => {
-	const { domain, accountConfigId, accountId, messageId, partPath, sign } =
-		input;
+export interface BuildStorageContentUrlInput {
+	domain: string;
+	storageKey: string;
+	sign?: ContentSigner;
+}
+
+export const buildStorageContentUrl = (
+	input: BuildStorageContentUrlInput,
+): string => {
+	const { domain, storageKey, sign } = input;
 	const normalizedDomain = domain.replace(/\/+$/, "");
 	const base = normalizedDomain.startsWith("http")
 		? normalizedDomain
@@ -36,17 +43,26 @@ export const buildContentUrl = (input: BuildContentUrlInput): string => {
 	// The signed message is the decoded, account-scoped storage path — the same
 	// value the `/content` route recomputes from `req.path`. Keep it in lockstep
 	// with the verifier's `req.path.replace(/^\/content\//, "")`.
-	const relativePath = `accounts/${accountConfigId}/${accountId}/messages/${messageId}/parts/${partPath}`;
-	const safePart = partPath
+	const safeKey = storageKey
 		.split("/")
 		.map((segment) => encodeURIComponent(segment))
 		.join("/");
-	const url = `${base}/content/accounts/${accountConfigId}/${accountId}/messages/${messageId}/parts/${safePart}`;
+	const url = `${base}/content/${safeKey}`;
 	if (!sign) return url;
-	const { exp, sig } = sign(relativePath);
+	const { exp, sig } = sign(storageKey);
 	return `${url}?exp=${exp}&sig=${encodeURIComponent(sig)}`;
 };
 
+export const buildContentUrl = (input: BuildContentUrlInput): string => {
+	const { domain, accountConfigId, accountId, messageId, partPath, sign } =
+		input;
+	return buildStorageContentUrl({
+		domain,
+		storageKey: `accounts/${accountConfigId}/${accountId}/messages/${messageId}/parts/${partPath}`,
+		sign,
+	});
+};
+
 /**
  * Read the CloudFront distribution domain from the environment. The CDK
  * wires `CONTENT_DELIVERY_DOMAIN` onto the API Lambda from the

package/src/handlers/calendar-suggestion.test.ts

@@ -597,3 +597,74 @@ describe("POST /calendar-suggestions/{suggestionId}/dismiss", () => {
 		);
 	});
 });
+
+describe("POST /calendar-suggestions/{suggestionId}/accept with corrections", () => {
+	test("answers not-found for a calendar on another account, before writing anything", async () => {
+		const stranger = anAccount();
+		const strangersCalendar = await client.calendarCollection.create({
+			accountConfigId: stranger.accountConfigId,
+			urlSegment: "default",
+			displayName: "Calendar",
+		});
+		const { accountConfigId, event } = anAccount();
+		const card = await putSuggestion(accountConfigId, "msg-edited-cross");
+
+		await assert.rejects(
+			() =>
+				acceptSuggestion(
+					contextOf({
+						params: { suggestionId: card.suggestionId },
+						requestBody: {
+							calendarId: strangersCalendar.calendarId,
+							event: { summary: "Quarterly review, moved" },
+						},
+					}),
+					event,
+				),
+			(error: unknown) => (error as { statusCode?: number }).statusCode === 404,
+		);
+
+		assert.deepEqual(
+			await client.calendarObject.listByCalendar(strangersCalendar.calendarId),
+			[],
+		);
+		const untouched = await client.calendarSuggestion.get(
+			accountConfigId,
+			card.suggestionId,
+		);
+		assert.equal(untouched.state, CalendarSuggestionState.Pending);
+	});
+
+	test("refuses a card the reader already declined", async () => {
+		const { accountConfigId, event } = anAccount();
+		const calendar = await client.calendarCollection.create({
+			accountConfigId,
+			urlSegment: "default",
+			displayName: "Calendar",
+		});
+		const card = await putSuggestion(accountConfigId, "msg-edited-declined");
+		await client.calendarSuggestion.settle(accountConfigId, card.suggestionId, {
+			state: CalendarSuggestionState.Declined,
+			acceptedCalendarObjectId: "",
+		});
+
+		await assert.rejects(
+			() =>
+				acceptSuggestion(
+					contextOf({
+						params: { suggestionId: card.suggestionId },
+						requestBody: {
+							calendarId: calendar.calendarId,
+							event: { summary: "Quarterly review, moved" },
+						},
+					}),
+					event,
+				),
+			(error: unknown) => (error as { statusCode?: number }).statusCode === 400,
+		);
+		assert.deepEqual(
+			await client.calendarObject.listByCalendar(calendar.calendarId),
+			[],
+		);
+	});
+});

package/src/handlers/calendar-suggestion.ts

@@ -1,8 +1,12 @@
 import type {
 	CalendarInviteAnswer as CalendarInviteAnswerValue,
 	CalendarSuggestionResponse,
+	UpdateCalendarEventInput,
 } from "@remit/api-openapi-types";
-import { acceptCalendarSuggestion } from "@remit/calendar-service";
+import {
+	acceptCalendarSuggestion,
+	correctCalendarSuggestion,
+} from "@remit/calendar-service";
 import {
 	type CalendarSuggestionItem,
 	type ICalendarSuggestionRepository,
@@ -30,6 +34,7 @@ import type {
 	MessageCalendarSuggestionOperationIds,
 	OperationHandler,
 } from "../types.js";
+import { pickEventUpdate } from "./calendar-event.js";
 
 /**
  * The raw invitation bytes stay on the server. A client renders the projected
@@ -255,10 +260,25 @@ export const CalendarSuggestionActionOperations: Record<
 			);
 		}
 
+		const { event: corrections } = context.request.requestBody as {
+			event?: UpdateCalendarEventInput;
+		};
+		const corrected =
+			corrections === undefined
+				? { ok: true as const, value: suggestion }
+				: await correctCalendarSuggestion(
+						suggestion,
+						pickEventUpdate(corrections),
+						collection.timezone,
+					);
+		if (!corrected.ok) {
+			throw new BadRequestError(corrected.error.message);
+		}
+
 		const accepted = await acceptCalendarSuggestion(client.calendarUnitOfWork, {
 			accountConfigId,
 			calendarId,
-			suggestion,
+			suggestion: corrected.value,
 			attendee: await accountEmailForMessage(client, suggestion.messageId),
 			answer,
 		});

package/src/handlers/outbox-attachment.test.ts

@@ -53,6 +53,8 @@ import {
 	mintOutboxAttachment,
 } from "./outbox-attachment.js";
 
+process.env.CONTENT_DELIVERY_DOMAIN = "https://content.test";
+
 const SUB = "cognito-sub-679";
 const ACCOUNT_CONFIG_ID = deriveAccountConfigId(SUB);
 const OTHER_ACCOUNT_CONFIG_ID = deriveAccountConfigId("cognito-sub-stranger");

package/src/handlers/outbox-attachment.ts

@@ -4,14 +4,21 @@ import type {
 	OutboxAttachmentRejection,
 	OutboxAttachmentResponse,
 } from "@remit/api-openapi-types";
+import type { OutboxAttachmentItem } from "@remit/data-ports";
 import { OutboxAttachmentRejectionReason } from "@remit/domain-enums";
 import type {
 	OutboxAttachmentRejectionDetail,
 	OutboxAttachmentRejectionReasonValue,
 } from "@remit/mailbox-service";
+import { outboxAttachmentContentId } from "@remit/mailbox-service/outbox-attachment-content";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import type { Context } from "openapi-backend";
 import { getAccountConfigIdFromEvent } from "../auth.js";
+import { getContentSigner } from "../derive/contentSignature.js";
+import {
+	buildStorageContentUrl,
+	getContentDeliveryDomain,
+} from "../derive/contentUrl.js";
 import { getClient } from "../service/data-client.js";
 
 // Every error body the API emits carries a `code` (issue #371). A refusal here
@@ -24,6 +31,23 @@ const TOO_LARGE: ReadonlySet<OutboxAttachmentRejectionReasonValue> = new Set([
 	OutboxAttachmentRejectionReason.TooManyAttachments,
 ]);
 
+export const toOutboxAttachmentResponse = (
+	item: OutboxAttachmentItem,
+): OutboxAttachmentResponse => ({
+	outboxAttachmentId: item.outboxAttachmentId,
+	outboxMessageId: item.outboxMessageId,
+	filename: item.filename,
+	contentType: item.contentType,
+	sizeBytes: item.sizeBytes,
+	state: item.state,
+	contentId: outboxAttachmentContentId(item.outboxAttachmentId),
+	contentUrl: buildStorageContentUrl({
+		domain: getContentDeliveryDomain(),
+		storageKey: item.storageKey,
+		sign: getContentSigner(),
+	}),
+});
+
 interface RejectionResponse {
 	statusCode: number;
 	body: OutboxAttachmentRejection;
@@ -98,5 +122,5 @@ export const completeOutboxAttachment = async (
 
 	if (result.outcome === "Rejected") return refuse(result.rejection);
 
-	return result.attachment;
+	return toOutboxAttachmentResponse(result.attachment);
 };

package/src/handlers/outbox.test.ts

@@ -50,6 +50,9 @@ import {
 } from "../service/data-client.js";
 import { OutboxDetailOperations, OutboxOperations } from "./outbox.js";
 
+const CONTENT_DOMAIN = "https://content.test";
+process.env.CONTENT_DELIVERY_DOMAIN = CONTENT_DOMAIN;
+
 const SUB = "cognito-sub-604";
 const ACCOUNT_CONFIG_ID = deriveAccountConfigId(SUB);
 const ACCOUNT_ID = "acc-604";
@@ -616,6 +619,31 @@ describe("attachmentIds on a draft update (#679)", () => {
 		assert.equal(attachmentRows.size, 2);
 	});
 
+	it("names each file by its content-id and where its bytes are read from", async () => {
+		installClient();
+		const { outboxMessageId, ids } = await seed();
+
+		const response = await patch(outboxMessageId, { subject: "still typing" });
+
+		const body = JSON.parse(response.body) as {
+			attachments: {
+				outboxAttachmentId: string;
+				contentId: string;
+				contentUrl: string;
+			}[];
+		};
+		const [first] = body.attachments.filter(
+			(item) => item.outboxAttachmentId === ids[0],
+		);
+		assert.equal(first.contentId, `${ids[0]}@remit`);
+		assert.ok(
+			first.contentUrl.startsWith(
+				`${CONTENT_DOMAIN}/content/${attachmentRows.get(ids[0])?.storageKey}`,
+			),
+			first.contentUrl,
+		);
+	});
+
 	it("present and empty removes every file", async () => {
 		installClient();
 		const { outboxMessageId } = await seed();

package/src/handlers/outbox.ts

@@ -21,24 +21,14 @@ import type {
 import {
 	completeOutboxAttachment,
 	mintOutboxAttachment,
+	toOutboxAttachmentResponse,
 } from "./outbox-attachment.js";
 
-const toAttachmentResponse = (
-	item: OutboxAttachmentItem,
-): OutboxMessageResponse["attachments"][number] => ({
-	outboxAttachmentId: item.outboxAttachmentId,
-	outboxMessageId: item.outboxMessageId,
-	filename: item.filename,
-	contentType: item.contentType,
-	sizeBytes: item.sizeBytes,
-	state: item.state,
-});
-
 const toOutboxMessageResponse = (
 	item: OutboxMessageItem,
 	attachments: OutboxAttachmentItem[] = [],
 ): OutboxMessageResponse => ({
-	attachments: attachments.map(toAttachmentResponse),
+	attachments: attachments.map(toOutboxAttachmentResponse),
 	outboxMessageId: item.outboxMessageId,
 	accountId: item.accountId,
 	fromAddress: item.fromAddress,