@remit/backend 0.0.97 → 0.0.98

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.97",
+  "version": "0.0.98",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",

package/src/handlers/calendar-event.ts

@@ -15,6 +15,7 @@ import {
 	deleteCalendarObject,
 	listBusySpans,
 	listCalendarInstances,
+	OFFSET_BEARING,
 	parseCalendar,
 	projectCalendar,
 	putCalendarObject,
@@ -90,7 +91,12 @@ export const readWindow = (
 	}
 	const fromMs = Date.parse(from);
 	const toMs = Date.parse(to);
-	if (Number.isNaN(fromMs) || Number.isNaN(toMs)) {
+	if (
+		Number.isNaN(fromMs) ||
+		Number.isNaN(toMs) ||
+		!OFFSET_BEARING.test(from) ||
+		!OFFSET_BEARING.test(to)
+	) {
 		return refuseCalendar(
 			"InvalidWindow",
 			"`from` and `to` must be ISO 8601 date-times with a zone offset",

package/src/handlers/calendar.test.ts

@@ -308,6 +308,27 @@ describe("readWindow", () => {
 		);
 	});
 
+	it("refuses an end that carries no zone offset", () => {
+		const wallTime = readWindow("2026-01-01T00:00:00", "2026-01-08T00:00:00Z");
+		assert.ok(!wallTime.ok);
+		assert.equal(wallTime.error.code, "InvalidWindow");
+
+		const dateOnly = readWindow("2026-01-01T00:00:00Z", "2026-01-08");
+		assert.ok(!dateOnly.ok);
+		assert.equal(dateOnly.error.code, "InvalidWindow");
+	});
+
+	it("accepts either spelling of an offset", () => {
+		assert.equal(
+			readWindow("2026-01-01T00:00:00Z", "2026-01-08T00:00:00Z").ok,
+			true,
+		);
+		assert.equal(
+			readWindow("2026-01-01T00:00:00+02:00", "2026-01-08T00:00:00+02:00").ok,
+			true,
+		);
+	});
+
 	it("normalises both ends to UTC instants", () => {
 		const window = readWindow(
 			"2026-09-07T02:00:00+02:00",