@remit/backend 0.0.97 → 0.0.99

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.97",
+  "version": "0.0.99",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",

package/src/handlers/calendar-event.ts

@@ -15,6 +15,7 @@ import {
 	deleteCalendarObject,
 	listBusySpans,
 	listCalendarInstances,
+	OFFSET_BEARING,
 	parseCalendar,
 	projectCalendar,
 	putCalendarObject,
@@ -90,7 +91,12 @@ export const readWindow = (
 	}
 	const fromMs = Date.parse(from);
 	const toMs = Date.parse(to);
-	if (Number.isNaN(fromMs) || Number.isNaN(toMs)) {
+	if (
+		Number.isNaN(fromMs) ||
+		Number.isNaN(toMs) ||
+		!OFFSET_BEARING.test(from) ||
+		!OFFSET_BEARING.test(to)
+	) {
 		return refuseCalendar(
 			"InvalidWindow",
 			"`from` and `to` must be ISO 8601 date-times with a zone offset",

package/src/handlers/calendar.test.ts

@@ -308,6 +308,27 @@ describe("readWindow", () => {
 		);
 	});
 
+	it("refuses an end that carries no zone offset", () => {
+		const wallTime = readWindow("2026-01-01T00:00:00", "2026-01-08T00:00:00Z");
+		assert.ok(!wallTime.ok);
+		assert.equal(wallTime.error.code, "InvalidWindow");
+
+		const dateOnly = readWindow("2026-01-01T00:00:00Z", "2026-01-08");
+		assert.ok(!dateOnly.ok);
+		assert.equal(dateOnly.error.code, "InvalidWindow");
+	});
+
+	it("accepts either spelling of an offset", () => {
+		assert.equal(
+			readWindow("2026-01-01T00:00:00Z", "2026-01-08T00:00:00Z").ok,
+			true,
+		);
+		assert.equal(
+			readWindow("2026-01-01T00:00:00+02:00", "2026-01-08T00:00:00+02:00").ok,
+			true,
+		);
+	});
+
 	it("normalises both ends to UTC instants", () => {
 		const window = readWindow(
 			"2026-09-07T02:00:00+02:00",

package/src/log-redaction.test.ts

@@ -33,9 +33,7 @@ process.stdout.write = ((
 
 process.env.LOG_LEVEL = "trace";
 
-const { calendarFeedPath, mintCalendarFeedToken } = await import(
-	"@remit/calendar-service"
-);
+const { mintCalendarFeedToken } = await import("@remit/calendar-service");
 const { _resetForTest, setClient } = await import("./service/data-client.js");
 const { createCalendarSqliteClient } = await import(
 	"./handlers/calendar-sqlite-fixture.js"
@@ -96,7 +94,7 @@ describe("what a request leaves in the log", () => {
 		const { token } = mintCalendarFeedToken();
 
 		const { response, logged } = await capture(() =>
-			send({ httpMethod: "GET", path: calendarFeedPath(token) }),
+			send({ httpMethod: "GET", path: `/feeds/calendar/${token}.ics` }),
 		);
 
 		assert.equal(