@teamscala/service-boot 0.23.398 → 0.23.400

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.398",
+  "version": "0.23.400",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",

package/src/fn-routers/public-assessment-router.test.ts

@@ -25,6 +25,13 @@ interface CapturedEmail {
 let capturedEmail: CapturedEmail | null = null;
 let emailResolve: ((email: CapturedEmail) => void) | null = null;
 let capturedEvent: { kind: string; payload: Record<string, unknown> } | null = null;
+/** Mutable so one test can stub a brand row with a relative logo path. */
+let brandRowStub: {
+	companyName: string | null;
+	primaryColor: string;
+	accentColor: string | null;
+	logo: { light: string | null; dark: string | null; brand: string | null };
+} | null = null;
 
 const noopLogger = {
 	info: () => {},
@@ -53,7 +60,7 @@ mock.module("@teamscala/email/templates/lookup", () => ({
 	lookupTemplate: async () => ({
 		subject: "Your Authority Index — {{totalScore}}/100 ({{bandLabel}})",
 		bodyHtml:
-			"<h1>{{totalScore}}/100 — {{bandLabel}}</h1><h2>{{reportTitle}}</h2><p>{{tagline}}</p>{{narrativeHtml}}{{pillarNotesHtml}}{{priorityActionsHtml}}{{roadmapHtml}}{{strategicFocusHtml}}{{opportunitiesHtml}}{{twelveMonthTargetHtml}}",
+			"{{brandLogoHtml}}<h1>{{totalScore}}/100 — {{bandLabel}}</h1><h2>{{reportTitle}}</h2><p>{{tagline}}</p>{{narrativeHtml}}{{pillarNotesHtml}}{{priorityActionsHtml}}{{roadmapHtml}}{{strategicFocusHtml}}{{opportunitiesHtml}}{{twelveMonthTargetHtml}}",
 		bodyText:
 			"{{totalScore}}/100 — {{bandLabel}}\n{{reportTitle}}\n{{tagline}}\n{{narrativeText}}",
 	}),
@@ -69,20 +76,24 @@ mock.module("@teamscala/encryption/crypto/secret-config", () => ({
 }));
 
 mock.module("@teamscala/resolver-engine/data-resolvers/fetch-org-brand", () => ({
-	fetchOrgBrand: async () => null,
+	fetchOrgBrand: async () => brandRowStub,
 }));
 
 mock.module("@teamscala/email/identity/resolve-email-sender", () => ({
-	resolveEmailSender: async () => ({
+	resolveEmailSender: async (
+		_organisationId: string | null | undefined,
+		opts?: { brand?: Record<string, unknown> },
+	) => ({
 		from: "Test <test@example.com>",
 		replyTo: undefined,
 		isOrgIdentity: false,
-		brand: {
-			orgName: "TestCo",
-			primaryColor: "#123456",
-			accentColor: "#abcdef",
-			logoUrl: null,
-		},
+		brand:
+			opts?.brand ?? {
+				orgName: "TestCo",
+				primaryColor: "#123456",
+				accentColor: "#abcdef",
+				logoUrl: null,
+			},
 	}),
 }));
 
@@ -204,7 +215,7 @@ type SubmitHandler = (opts: {
 	context: { prisma: unknown; headers: Headers };
 }) => Promise<Record<string, unknown>>;
 
-async function submitWith45() {
+async function submitWith45(headers = new Headers()) {
 	// The raw handler under ~orpc only reads { input, context }; the other
 	// ProcedureHandlerOptions fields are middleware plumbing this procedure
 	// (no middlewares) never touches, so the narrowed call shape is cast.
@@ -216,13 +227,14 @@ async function submitWith45() {
 			email: "alex@example.com",
 			answers: answersForScore45(),
 		},
-		context: { prisma: makeFakePrisma(), headers: new Headers() },
+		context: { prisma: makeFakePrisma(), headers },
 	});
 }
 
 beforeEach(() => {
 	capturedEmail = null;
 	capturedEvent = null;
+	brandRowStub = null;
 });
 
 describe("publicAssessment.submit — email band single-sourced from stage_bands", () => {
@@ -274,4 +286,48 @@ describe("publicAssessment.submit — email band single-sourced from stage_bands
 		expect(capturedEvent?.kind).toBe("assessment.authority.completed");
 		expect(capturedEvent?.payload.band).toBe("experimenting");
 	});
+
+	test("a relative brand logo renders as an absolute img src from the serving host", async () => {
+		brandRowStub = {
+			companyName: "GMG APAC",
+			primaryColor: "#FF4500",
+			accentColor: null,
+			logo: {
+				light: "/api/assets/5b742740/logos/launcha.png",
+				dark: null,
+				brand: null,
+			},
+		};
+		const emailPromise = new Promise<CapturedEmail>((resolve) => {
+			emailResolve = resolve;
+		});
+		await submitWith45(
+			new Headers({ "x-forwarded-host": "quiz.scala.business" }),
+		);
+		const email = await emailPromise;
+
+		expect(email.html).toContain(
+			'<img src="https://quiz.scala.business/api/assets/5b742740/logos/launcha.png"',
+		);
+	});
+
+	test("a relative logo with no host header stays absent rather than emitting a broken src", async () => {
+		brandRowStub = {
+			companyName: "GMG APAC",
+			primaryColor: "#FF4500",
+			accentColor: null,
+			logo: {
+				light: "/api/assets/5b742740/logos/launcha.png",
+				dark: null,
+				brand: null,
+			},
+		};
+		const emailPromise = new Promise<CapturedEmail>((resolve) => {
+			emailResolve = resolve;
+		});
+		await submitWith45();
+		const email = await emailPromise;
+
+		expect(email.html).not.toMatch(/<img/i);
+	});
 });

package/src/fn-routers/public-assessment-router.ts

@@ -107,6 +107,14 @@ async function sendAuthorityReportEmail(opts: {
 	ctaUrl?: string;
 	organisationId?: string | null;
 	prisma: any;
+	/**
+	 * Absolute origin (e.g. "https://quiz.scala.business") of the service that
+	 * received the submit — the origin that serves /api/assets. Mail clients
+	 * cannot resolve a relative src, so an org logo stored as a relative path
+	 * only renders when this is provided. Null → a relative logo stays absent
+	 * (previous behaviour) rather than emitting a broken src.
+	 */
+	publicBaseUrl?: string | null;
 }): Promise<void> {
 	const log = getAppLogger();
 	const rawSecret = await loadRegistryConfig(
@@ -130,13 +138,23 @@ async function sendAuthorityReportEmail(opts: {
 					opts.organisationId,
 				).catch(() => null)
 			: null;
+	// Brand assets are stored as service-relative paths ("/api/assets/…") —
+	// the same origin that served the submit request serves them, so the email
+	// derives the absolute URL from that origin at resolve time instead of the
+	// profile row being mutated per consumer. Already-absolute logos pass through.
+	const absolutizeAssetUrl = (url: string | null): string | null => {
+		if (!url) return null;
+		if (/^https?:\/\//.test(url)) return url;
+		if (url.startsWith("/") && opts.publicBaseUrl) return `${opts.publicBaseUrl}${url}`;
+		return null;
+	};
 	const sender = await resolveEmailSender(opts.organisationId ?? null, {
 		brand: brandRow
 			? {
 					orgName: brandRow.companyName ?? "",
 					primaryColor: brandRow.primaryColor,
 					accentColor: brandRow.accentColor ?? null,
-					logoUrl: brandRow.logo.light ?? null,
+					logoUrl: absolutizeAssetUrl(brandRow.logo.light),
 				}
 			: undefined,
 	});
@@ -172,7 +190,7 @@ async function sendAuthorityReportEmail(opts: {
 	const b = opts.stageBand;
 	const sectionHtml = (heading: string, inner: string) =>
 		inner
-			? `<h3 style="margin:24px 0 8px;font-size:15px;font-weight:700;color:${primary}">${heading}</h3>${inner}`
+			? `<h3 style="margin:24px 0 8px;font-size:16px;font-weight:700;color:${primary}">${heading}</h3>${inner}`
 			: "";
 	const paraHtml = (text?: string) =>
 		text ? `<p style="margin:0 0 12px;color:${muted}">${text}</p>` : "";
@@ -187,14 +205,14 @@ async function sendAuthorityReportEmail(opts: {
 			? b.priorityActions
 					.map(
 						(a) =>
-							`<p style="margin:0 0 10px"><strong style="color:${primary}">${a.title}</strong><br><span style="color:${muted}">${a.description ?? ""}</span></p>`,
+							`<p style="margin:0 0 10px"><strong style="font-size:14px;color:${primary}">${a.title}</strong><br><span style="color:${muted}">${a.description ?? ""}</span></p>`,
 					)
 					.join("")
 			: "";
 	const roadmapHtml = orderRoadmap(b?.roadmap)
 		.map(
 			(phase) =>
-				`<p style="margin:0 0 10px"><strong style="color:${primary}">${phase.focus ?? ""}</strong><br><span style="color:${muted}">${(phase.actions ?? []).join(" · ")}</span></p>`,
+				`<p style="margin:0 0 10px"><strong style="font-size:14px;color:${primary}">${phase.focus ?? ""}</strong><br><span style="color:${muted}">${(phase.actions ?? []).join(" · ")}</span></p>`,
 		)
 		.join("");
 	const notes = b?.pillarNotes ?? {};
@@ -202,7 +220,7 @@ async function sendAuthorityReportEmail(opts: {
 		? Object.entries(notes)
 				.map(
 					([k, v]) =>
-						`<p style="margin:0 0 8px;color:${muted}"><strong style="color:${primary};text-transform:capitalize">${k}</strong> — ${v}</p>`,
+						`<p style="margin:0 0 8px;color:${muted}"><strong style="font-size:14px;color:${primary};text-transform:capitalize">${k}</strong> — ${v}</p>`,
 				)
 				.join("")
 		: "";
@@ -505,6 +523,15 @@ export const publicAssessmentRouter = {
 			const ctaUrl =
 				(typeof assessment.cta_url === "string" && assessment.cta_url) ||
 				undefined;
+			// The serving origin for brand asset paths. Behind Railway/Cloudflare the
+			// proxy host is authoritative, hence x-forwarded-host first. A
+			// non-DNS-safe value is dropped rather than passed into an email.
+			const hostHeader =
+				context.headers.get("x-forwarded-host") ?? context.headers.get("host");
+			const publicBaseUrl =
+				hostHeader && /^[A-Za-z0-9.-]+$/.test(hostHeader)
+					? `https://${hostHeader}`
+					: null;
 			if (band) {
 				void sendAuthorityReportEmail({
 					to: email,
@@ -519,6 +546,7 @@ export const publicAssessmentRouter = {
 					ctaUrl,
 					organisationId: orgId,
 					prisma,
+					publicBaseUrl,
 				}).catch((e) =>
 					log.error(
 						`[publicAssessment.submit] report email non-fatal: ${e instanceof Error ? e.message : String(e)}`,