@remit/backend 0.0.95 → 0.0.97

package/src/handlers/calendar-feed.ts

@@ -0,0 +1,291 @@
+import type {
+	CalendarFeedResponse,
+	CalendarFeedStateResponse,
+} from "@remit/api-openapi-types";
+import {
+	buildCalendarFeed,
+	calendarFeedIsUnchanged,
+	calendarFeedIsUnmodifiedSince,
+	hashCalendarFeedToken,
+	isCalendarFeedToken,
+	mintCalendarFeedToken,
+	readCalendarFeedToken,
+} from "@remit/calendar-service";
+import type { CalendarFeedTokenItem } from "@remit/data-ports";
+import { NotFoundError } from "@remit/data-ports/errors";
+import type { APIGatewayProxyEvent } from "aws-lambda";
+import { getAccountConfigIdFromEvent } from "../auth.js";
+import { type RawApiResponse, rawApiResponse } from "../response.js";
+import { getClient } from "../service/data-client.js";
+import type {
+	CalendarDetailOperationIds,
+	CalendarFeedDetailOperationIds,
+	CalendarFeedOperationIds,
+	OperationHandler,
+} from "../types.js";
+import {
+	type CalendarDeps,
+	type CalendarOutcome,
+	calendarDepsOf,
+	findCalendarFor,
+	notFound,
+	refuseCalendar,
+} from "./calendar.js";
+
+const toFeedState = (
+	token: CalendarFeedTokenItem,
+): CalendarFeedStateResponse => ({
+	calendarId: token.calendarId,
+	createdAt: token.createdAt,
+	rotatedAt: token.rotatedAt,
+});
+
+/**
+ * Mints the calendar's feed address, or replaces the one it has.
+ *
+ * The plaintext exists here and nowhere else: the store keeps a digest, so this
+ * return value is the only chance anybody has to read the token. Ownership is
+ * settled before the mint — a calendar the caller does not hold is absent, not
+ * forbidden, which is the same answer `getCalendar` gives it.
+ */
+export const putCalendarFeedFor = async (
+	deps: CalendarDeps,
+	accountConfigId: string,
+	calendarId: string,
+): Promise<CalendarOutcome<CalendarFeedResponse>> => {
+	const calendar = await findCalendarFor(deps, accountConfigId, calendarId);
+	if (!calendar.ok) return calendar;
+
+	const secret = mintCalendarFeedToken();
+	const stored = await deps.calendarFeedToken.put({
+		accountConfigId,
+		calendarId,
+		tokenHash: secret.tokenHash,
+	});
+
+	return {
+		ok: true,
+		value: {
+			calendarId: stored.calendarId,
+			feedToken: secret.token,
+			createdAt: stored.createdAt,
+			rotatedAt: stored.rotatedAt,
+		},
+	};
+};
+
+/** Whether the calendar has a feed address, and how old it is. */
+export const findCalendarFeedFor = async (
+	deps: CalendarDeps,
+	accountConfigId: string,
+	calendarId: string,
+): Promise<CalendarOutcome<CalendarFeedStateResponse>> => {
+	const calendar = await findCalendarFor(deps, accountConfigId, calendarId);
+	if (!calendar.ok) return calendar;
+
+	const stored = await deps.calendarFeedToken.findByCalendar(
+		accountConfigId,
+		calendarId,
+	);
+	if (!stored) {
+		return refuseCalendar("NotFound", `no feed on calendar ${calendarId}`);
+	}
+	return { ok: true, value: toFeedState(stored) };
+};
+
+/**
+ * Revokes the calendar's feed address.
+ *
+ * A calendar with no feed is refused rather than answered 204: the caller asked
+ * for a subscription to stop working, and reporting success for one that was
+ * never there reads as confirmation that it has.
+ */
+export const revokeCalendarFeedFor = async (
+	deps: CalendarDeps,
+	accountConfigId: string,
+	calendarId: string,
+): Promise<CalendarOutcome<null>> => {
+	const calendar = await findCalendarFor(deps, accountConfigId, calendarId);
+	if (!calendar.ok) return calendar;
+
+	const stored = await deps.calendarFeedToken.findByCalendar(
+		accountConfigId,
+		calendarId,
+	);
+	if (!stored) {
+		return refuseCalendar("NotFound", `no feed on calendar ${calendarId}`);
+	}
+
+	await deps.calendarFeedToken.delete(accountConfigId, calendarId);
+	return { ok: true, value: null };
+};
+
+/**
+ * No feed answers to this address.
+ *
+ * One answer for an unknown token, a revoked one and a malformed one, with a
+ * body that says the same thing to all three: a caller probing addresses learns
+ * only whether the one it sent works, which is what it was going to find out
+ * anyway.
+ */
+const feedNotFound = (): RawApiResponse =>
+	rawApiResponse({
+		statusCode: 404,
+		headers: { "Content-Type": "text/plain; charset=utf-8" },
+		body: "no calendar feed at this address\n",
+	});
+
+/**
+ * Serves a calendar to whoever holds its secret address.
+ *
+ * The token is the whole credential, so a value that cannot be one is refused
+ * before anything is hashed, and the digest of what arrived is what the store is
+ * asked about — the plaintext is never compared against a stored one because
+ * none is stored.
+ *
+ * `Last-Modified` is the collection's own timestamp, not the newest event in
+ * it: an event deleted from a calendar leaves every survivor older than the
+ * change, and a validator that moves backwards tells a subscriber its cached
+ * copy is still good. The collection is stamped by the same sequence bump every
+ * write and every delete goes through, so it only ever moves forward.
+ *
+ * A row whose collection is gone is the same 404. It should not exist — a
+ * calendar's delete takes its token with it, in one transaction — and serving a
+ * blank calendar for one would be worse than saying nothing.
+ */
+export const serveCalendarFeed = async (
+	deps: CalendarDeps,
+	feedToken: string,
+	conditions: {
+		ifNoneMatch: string | undefined;
+		ifModifiedSince: string | undefined;
+	},
+): Promise<RawApiResponse> => {
+	if (!isCalendarFeedToken(feedToken)) return feedNotFound();
+
+	const stored = await deps.calendarFeedToken.findByTokenHash(
+		hashCalendarFeedToken(feedToken),
+	);
+	if (!stored) return feedNotFound();
+
+	const collection = await deps.calendarCollection
+		.get(stored.accountConfigId, stored.calendarId)
+		.catch((error: unknown) => {
+			if (error instanceof NotFoundError) return null;
+			throw error;
+		});
+	if (!collection) return feedNotFound();
+
+	const objects = await deps.calendarObject.listByCalendar(stored.calendarId);
+	const feed = buildCalendarFeed(collection, objects);
+	const etag = `"${feed.etag}"`;
+	const lastModified = new Date(collection.updatedAt).toUTCString();
+
+	// `If-None-Match` wins outright when both arrive (RFC 9110 13.2.2): the tag
+	// is exact where the date is truncated to the second, so honouring the date
+	// as well could only turn a 200 the tag asked for into a 304.
+	const unchanged =
+		conditions.ifNoneMatch === undefined
+			? calendarFeedIsUnmodifiedSince(
+					conditions.ifModifiedSince,
+					collection.updatedAt,
+				)
+			: calendarFeedIsUnchanged(conditions.ifNoneMatch, feed.etag);
+
+	if (unchanged) {
+		return rawApiResponse({
+			statusCode: 304,
+			headers: { ETag: etag, "Last-Modified": lastModified },
+			body: "",
+		});
+	}
+
+	return rawApiResponse({
+		statusCode: 200,
+		headers: {
+			"Content-Type": "text/calendar; charset=utf-8",
+			ETag: etag,
+			"Last-Modified": lastModified,
+		},
+		body: feed.icalData,
+	});
+};
+
+export const CalendarFeedDetailOperations: Record<
+	CalendarFeedDetailOperationIds,
+	OperationHandler<CalendarDetailOperationIds>
+> = {
+	CalendarDetailOperations_getCalendarFeed: async (
+		context,
+		...args: unknown[]
+	) => {
+		const event = args[0] as APIGatewayProxyEvent;
+		const accountConfigId = getAccountConfigIdFromEvent(event);
+		const { calendarId } = context.request.params as { calendarId: string };
+		const deps = calendarDepsOf(await getClient());
+
+		const found = await findCalendarFeedFor(deps, accountConfigId, calendarId);
+		if (!found.ok) return notFound(found.error.message);
+		return found.value;
+	},
+
+	CalendarDetailOperations_putCalendarFeed: async (
+		context,
+		...args: unknown[]
+	) => {
+		const event = args[0] as APIGatewayProxyEvent;
+		const accountConfigId = getAccountConfigIdFromEvent(event);
+		const { calendarId } = context.request.params as { calendarId: string };
+		const deps = calendarDepsOf(await getClient());
+
+		const minted = await putCalendarFeedFor(deps, accountConfigId, calendarId);
+		if (!minted.ok) return notFound(minted.error.message);
+		return minted.value;
+	},
+
+	CalendarDetailOperations_revokeCalendarFeed: async (
+		context,
+		...args: unknown[]
+	) => {
+		const event = args[0] as APIGatewayProxyEvent;
+		const accountConfigId = getAccountConfigIdFromEvent(event);
+		const { calendarId } = context.request.params as { calendarId: string };
+		const deps = calendarDepsOf(await getClient());
+
+		const revoked = await revokeCalendarFeedFor(
+			deps,
+			accountConfigId,
+			calendarId,
+		);
+		if (!revoked.ok) return notFound(revoked.error.message);
+		return { statusCode: 204 };
+	},
+};
+
+export const CalendarFeedOperations: Record<
+	CalendarFeedOperationIds,
+	OperationHandler<CalendarFeedOperationIds>
+> = {
+	CalendarFeedOperations_getCalendarFeedIcal: async (
+		context,
+		...args: unknown[]
+	) => {
+		// From the raw path, not from the router's captured parameter: the matcher
+		// substitutes the parameter into the literal path and leaves the dot of
+		// ".ics" as a regex dot, so /feeds/calendar/<token>Xics routes here too —
+		// and answering it would serve the feed at an address nobody was handed.
+		const event = args[0] as APIGatewayProxyEvent;
+		const feedToken = readCalendarFeedToken(event.path);
+		if (feedToken === null) return feedNotFound();
+
+		const ifNoneMatch = context.request.headers["if-none-match"];
+		const ifModifiedSince = context.request.headers["if-modified-since"];
+		const deps = calendarDepsOf(await getClient());
+
+		return serveCalendarFeed(deps, feedToken, {
+			ifNoneMatch: typeof ifNoneMatch === "string" ? ifNoneMatch : undefined,
+			ifModifiedSince:
+				typeof ifModifiedSince === "string" ? ifModifiedSince : undefined,
+		});
+	},
+};

package/src/handlers/calendar.ts

@@ -13,6 +13,7 @@ import type {
 	CalendarCollectionItem,
 	ICalendarCollectionRepository,
 	ICalendarEventIndexRepository,
+	ICalendarFeedTokenRepository,
 	ICalendarObjectRepository,
 	ICalendarUnitOfWork,
 	UpdateCalendarCollectionInput,
@@ -24,6 +25,7 @@ import { getAccountConfigIdFromEvent } from "../auth.js";
 import type { RemitClient } from "../service/data-client.js";
 import { getClient } from "../service/data-client.js";
 import type {
+	CalendarCollectionDetailOperationIds,
 	CalendarDetailOperationIds,
 	CalendarOperationIds,
 	OperationHandler,
@@ -34,6 +36,7 @@ export interface CalendarDeps {
 	calendarCollection: ICalendarCollectionRepository;
 	calendarObject: ICalendarObjectRepository;
 	calendarEventIndex: ICalendarEventIndexRepository;
+	calendarFeedToken: ICalendarFeedTokenRepository;
 	calendarUnitOfWork: ICalendarUnitOfWork;
 }
 
@@ -78,6 +81,7 @@ export const calendarDepsOf = (client: RemitClient): CalendarDeps => ({
 	calendarCollection: client.calendarCollection,
 	calendarObject: client.calendarObject,
 	calendarEventIndex: client.calendarEventIndex,
+	calendarFeedToken: client.calendarFeedToken,
 	calendarUnitOfWork: client.calendarUnitOfWork,
 });
 
@@ -225,6 +229,7 @@ export const deleteCalendarFor = async (
 			);
 			await repos.calendarObject.delete(calendarId, object.calendarObjectId);
 		}
+		await repos.calendarFeedToken.delete(accountConfigId, calendarId);
 		await repos.calendarCollection.delete(accountConfigId, calendarId);
 	});
 	return { ok: true, value: null };
@@ -326,7 +331,7 @@ export const CalendarOperations: Record<
 };
 
 export const CalendarDetailOperations: Record<
-	CalendarDetailOperationIds,
+	CalendarCollectionDetailOperationIds,
 	OperationHandler<CalendarDetailOperationIds>
 > = {
 	CalendarDetailOperations_getCalendar: async (context, ...args: unknown[]) => {

package/src/handlers/index.ts

@@ -8,6 +8,10 @@ import {
 	CalendarEventOperations,
 	CalendarFreeBusyOperations,
 } from "./calendar-event.js";
+import {
+	CalendarFeedDetailOperations,
+	CalendarFeedOperations,
+} from "./calendar-feed.js";
 import {
 	CalendarSuggestionActionOperations,
 	CalendarSuggestionOperations,
@@ -55,6 +59,8 @@ export const handlers: Record<OperationIds, OperationHandler<any>> = {
 	...OrganizeJobDetailOperations,
 	...CalendarOperations,
 	...CalendarDetailOperations,
+	...CalendarFeedDetailOperations,
+	...CalendarFeedOperations,
 	...CalendarEventOperations,
 	...CalendarEventDetailOperations,
 	...CalendarFreeBusyOperations,

package/src/handlers/outbox-list.test.ts

@@ -0,0 +1,179 @@
+/**
+ * Issue #1013: the outbox listing took the head of the configured account list,
+ * so on an instance with two accounts the second account's drafts and failed
+ * sends were never on screen.
+ *
+ * The operation takes no account parameter and does not gain one — the fan-out
+ * is the handler's job. What is pinned here is that every account under the
+ * caller's config is asked for, and that the continuation token the handler
+ * hands back resumes the one merged ordering rather than one account's.
+ */
+
+import assert from "node:assert/strict";
+import { afterEach, describe, it } from "node:test";
+import type {
+	AccountItem,
+	IAccountRepository,
+	IOutboxMessageRepository,
+	OutboxMessageItem,
+	ResultList,
+} from "@remit/data-ports";
+import { APPENDED_UID_NONE } from "@remit/data-ports";
+import { OutboxMessageStatus } from "@remit/domain-enums";
+import type { APIGatewayProxyEvent } from "aws-lambda";
+import type { Context } from "openapi-backend";
+import { deriveAccountConfigId } from "../auth.js";
+import {
+	_resetForTest,
+	type RemitClient,
+	setClient,
+} from "../service/data-client.js";
+import { OutboxOperations } from "./outbox.js";
+
+const SUB = "cognito-sub-1013";
+const ACCOUNT_CONFIG_ID = deriveAccountConfigId(SUB);
+const FIRST_ACCOUNT = "acc-first";
+const SECOND_ACCOUNT = "acc-second";
+
+const outboxRow = (
+	outboxMessageId: string,
+	accountId: string,
+	createdAt: number,
+): OutboxMessageItem => ({
+	outboxMessageId,
+	accountId,
+	accountConfigId: ACCOUNT_CONFIG_ID,
+	fromAddress: `${accountId}@example.com`,
+	toAddresses: ["recipient@example.com"],
+	ccAddresses: [],
+	bccAddresses: [],
+	references: [],
+	messageIdValue: `<${outboxMessageId}@example.com>`,
+	status: OutboxMessageStatus.draft,
+	appendedUid: APPENDED_UID_NONE,
+	createdAt,
+	updatedAt: createdAt,
+});
+
+/**
+ * Four rows, the two accounts alternating in time, so a page of two can only
+ * hold rows from both and a listing that follows one account is visibly short.
+ */
+const rows: OutboxMessageItem[] = [
+	outboxRow("out-1", FIRST_ACCOUNT, 4000),
+	outboxRow("out-2", SECOND_ACCOUNT, 3000),
+	outboxRow("out-3", FIRST_ACCOUNT, 2000),
+	outboxRow("out-4", SECOND_ACCOUNT, 1000),
+];
+
+const askedFor: string[][] = [];
+
+/** The keyset the drizzle repository implements, over the fixture above. */
+const outboxRepository = {
+	listByAccounts: async (
+		accountIds: string[],
+		options?: { limit?: number; continuationToken?: string },
+	): Promise<ResultList<OutboxMessageItem>> => {
+		askedFor.push([...accountIds]);
+		const limit = options?.limit ?? 2;
+		const after = options?.continuationToken
+			? (JSON.parse(
+					Buffer.from(options.continuationToken, "base64url").toString("utf8"),
+				) as { createdAt: number })
+			: undefined;
+		const matching = rows
+			.filter((row) => accountIds.includes(row.accountId))
+			.filter((row) => after === undefined || row.createdAt < after.createdAt)
+			.sort((left, right) => right.createdAt - left.createdAt);
+		const items = matching.slice(0, limit);
+		const last = items[items.length - 1];
+		const hasMore = matching.length > limit;
+		return {
+			items,
+			continuationToken:
+				hasMore && last
+					? Buffer.from(JSON.stringify({ createdAt: last.createdAt })).toString(
+							"base64url",
+						)
+					: undefined,
+		};
+	},
+} as unknown as IOutboxMessageRepository;
+
+const accountRepository = {
+	listAllByAccountConfig: async (): Promise<AccountItem[]> =>
+		[FIRST_ACCOUNT, SECOND_ACCOUNT].map(
+			(accountId) =>
+				({
+					accountId,
+					accountConfigId: ACCOUNT_CONFIG_ID,
+					email: `${accountId}@example.com`,
+				}) as unknown as AccountItem,
+		),
+} as unknown as IAccountRepository;
+
+const installClient = (): void => {
+	askedFor.length = 0;
+	setClient({
+		account: accountRepository,
+		outboxMessage: outboxRepository,
+	} as unknown as RemitClient);
+};
+
+const authorizedEvent = (): APIGatewayProxyEvent =>
+	({
+		body: null,
+		requestContext: { authorizer: { claims: { sub: SUB } } },
+	}) as unknown as APIGatewayProxyEvent;
+
+const queryContext = (query: Record<string, string> = {}): Context =>
+	({ request: { query } }) as unknown as Context;
+
+type ListResult = {
+	items: { outboxMessageId: string; accountId: string }[];
+	continuationToken?: string;
+};
+
+const listOutbox = async (query?: Record<string, string>) =>
+	(await (
+		OutboxOperations.OutboxOperations_listOutboxMessages as unknown as (
+			context: Context,
+			event: APIGatewayProxyEvent,
+		) => Promise<ListResult>
+	)(queryContext(query), authorizedEvent())) as ListResult;
+
+afterEach(() => {
+	_resetForTest();
+});
+
+describe("the outbox of an instance with two accounts (#1013)", () => {
+	it("lists rows from every account, not just the first", async () => {
+		installClient();
+
+		const first = await listOutbox();
+
+		assert.deepEqual(askedFor, [[FIRST_ACCOUNT, SECOND_ACCOUNT]]);
+		assert.deepEqual(
+			[...new Set(first.items.map((item) => item.accountId))].sort(),
+			[FIRST_ACCOUNT, SECOND_ACCOUNT],
+		);
+	});
+
+	it("resumes the merged ordering on the second page", async () => {
+		installClient();
+
+		const first = await listOutbox();
+		assert.ok(first.continuationToken, "a second page is offered");
+
+		const second = await listOutbox({
+			continuationToken: first.continuationToken,
+		});
+
+		const seen = [...first.items, ...second.items].map(
+			(item) => item.outboxMessageId,
+		);
+		assert.deepEqual(seen, ["out-1", "out-2", "out-3", "out-4"]);
+		assert.equal(new Set(seen).size, 4, "no row on both pages");
+		assert.equal(second.continuationToken, undefined, "paging terminates");
+	});
+});

package/src/handlers/outbox.ts

@@ -128,15 +128,16 @@ export const OutboxOperations: Record<
 
 		const client = await getClient();
 
-		const accounts = await client.account.list(accountConfigId);
-		if (accounts.items.length === 0) {
+		const accounts =
+			await client.account.listAllByAccountConfig(accountConfigId);
+		if (accounts.length === 0) {
 			return { items: [], continuationToken: null };
 		}
 
-		const accountId = accounts.items[0].accountId;
-		const result = await client.outboxMessage.listByAccount(accountId, {
-			continuationToken,
-		});
+		const result = await client.outboxMessage.listByAccounts(
+			accounts.map((account) => account.accountId),
+			{ continuationToken },
+		);
 
 		return {
 			items: result.items.map((item) => toOutboxMessageResponse(item)),

package/src/handlers/unified-threads.ts

@@ -3,6 +3,7 @@ import type {
 	IAccountSettingRepository,
 	MailboxItem,
 } from "@remit/data-ports";
+import { isVirtualCopyMailbox } from "@remit/data-ports/virtual-copy";
 import { MailboxSpecialUse } from "@remit/domain-enums";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import type { Context } from "openapi-backend";
@@ -81,32 +82,6 @@ const SEARCH_EXCLUDED_SPECIAL_USE: readonly string[] = [
 	MailboxSpecialUse.Trash,
 ];
 
-/**
- * Special-use folders that hold a second copy of mail already reachable through
- * the folder it actually lives in — Gmail's All Mail, Starred and Important.
- * Used to pick which duplicate to drop, never to decide what is searched.
- */
-const VIRTUAL_COPY_SPECIAL_USE: readonly string[] = [
-	MailboxSpecialUse.All,
-	MailboxSpecialUse.Flagged,
-	MailboxSpecialUse.Important,
-];
-
-/**
- * Well-known Gmail virtual paths, for servers that do not advertise the
- * special-use attribute. Whole path, never a prefix — a user's own
- * `Starred ideas` folder is real mail.
- */
-const VIRTUAL_COPY_FULL_PATHS: readonly string[] = [
-	"[gmail]/all mail",
-	"[gmail]/starred",
-	"[gmail]/important",
-];
-
-const isVirtualCopy = (mailbox: MailboxItem): boolean =>
-	mailbox.specialUse?.some((use) => VIRTUAL_COPY_SPECIAL_USE.includes(use)) ===
-		true || VIRTUAL_COPY_FULL_PATHS.includes(mailbox.fullPath.toLowerCase());
-
 const isExcludedFromSearch = (mailbox: MailboxItem): boolean =>
 	mailbox.specialUse?.some((use) =>
 		SEARCH_EXCLUDED_SPECIAL_USE.includes(use),
@@ -202,7 +177,7 @@ export const buildInboxMailboxMap = async (
 		if (!isExcludedFromSearch(mailbox)) {
 			searchMailboxIds.add(mailbox.mailboxId);
 		}
-		if (isVirtualCopy(mailbox)) {
+		if (isVirtualCopyMailbox(mailbox)) {
 			virtualCopyMailboxIds.add(mailbox.mailboxId);
 		}
 		if (mailbox.fullPath.toUpperCase() === "INBOX") {

package/src/index.ts

@@ -2,6 +2,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { inspect } from "node:util";
+import { redactCalendarFeedPath } from "@remit/calendar-service";
 import { logger, withLogContext, withTelemetry } from "@remit/logger-lambda";
 import type { APIGatewayProxyEvent, Context } from "aws-lambda";
 import {
@@ -89,19 +90,17 @@ const api = new OpenAPIBackend({
 
 api.register("postResponseHandler", postResponseHandler);
 
+// The errors and the operation, and nothing that came off the wire. A request
+// that fails validation is logged at error level, and the request it carries
+// holds the caller's headers and cookies — an Authorization bearer among them,
+// and for a calendar feed the token in the path is itself the credential
+// (issue #1065). The path is redacted the same way the request scope redacts it.
 api.register("validationFail", (c: OpenAPIContext, req: Request) => {
-	const operation = api.router.getOperation(c.operation?.operationId ?? "");
 	logger.error(
 		{
 			errors: c.validation.errors,
-			method: req.method,
-			path: req.path,
+			path: redactCalendarFeedPath(req.path),
 			operation: c.operation?.operationId,
-			operationParameters: operation?.parameters,
-			validationContext: {
-				parsedRequest: c.request,
-				validationTarget: c.validation,
-			},
 		},
 		"Validation failed",
 	);
@@ -146,17 +145,19 @@ const readOriginHeader = (
 // so a line gets attributed to the wrong request. The scope follows the request
 // through its own async continuations and nothing else. It nests inside the one
 // `withTelemetry` opens, which is where `requestId` comes from.
-const rawHandler = async (event: APIGatewayProxyEvent, context: Context) =>
-	withLogContext(
+const rawHandler = async (event: APIGatewayProxyEvent, context: Context) => {
+	// A calendar feed carries its credential in the path, so the raw path is a
+	// secret and cannot be a log field (issue #1065). Redacted once, here, where
+	// every line inside the request picks it up from the scope.
+	const path = redactCalendarFeedPath(event.path);
+
+	return withLogContext(
 		{
-			path: event.path,
+			path,
 			method: event.httpMethod,
 		},
 		async () => {
-			logger.debug(
-				{ method: event.httpMethod, path: event.path },
-				"Request received",
-			);
+			logger.debug({ method: event.httpMethod, path }, "Request received");
 
 			const origin = readOriginHeader(event.headers);
 
@@ -175,5 +176,6 @@ const rawHandler = async (event: APIGatewayProxyEvent, context: Context) =>
 			);
 		},
 	);
+};
 
 export const handler = withTelemetry(rawHandler);