create-safest-tools 0.4.1 → 0.4.2

package/template/src/index.ts

@@ -2595,7 +2595,10 @@ async function handleAdminAiQualitySample(
   const sample = await loadAiQualitySample(env.DB, sampleId);
   if (!sample) throw new ApiError(404, "quality_sample_not_found", "The quality sample does not exist.");
   await assertOperatorReportAccess(env.DB, session, String(sample.reportId));
-  const report = await loadReportDetail(env.DB, String(sample.reportId));
+  const report = await loadReportDetail(env.DB, String(sample.reportId), {
+    contactEncryptionKey: env.CREDENTIAL_ENCRYPTION_KEY,
+    includeReporterEmail: session.permissions.messageReporters,
+  });
   if (!report) throw new ApiError(404, "report_not_found", "The sampled report does not exist.");
   return json({ schema_version: "1", sample: projectOperatorFields(session, "quality_sample", sample), report: projectOperatorFields(session, "report", report) });
 }
@@ -2843,7 +2846,10 @@ async function handleAdminReportDetail(request: Request, env: Env, reportId: str
   if (request.method !== "GET") return methodNotAllowed(["GET"]);
   const session = await requireOperator(request, env, "readReports");
   await assertOperatorReportAccess(env.DB, session, reportId);
-  const report = await loadReportDetail(env.DB, reportId);
+  const report = await loadReportDetail(env.DB, reportId, {
+    contactEncryptionKey: env.CREDENTIAL_ENCRYPTION_KEY,
+    includeReporterEmail: session.permissions.messageReporters,
+  });
   if (!report) throw new ApiError(404, "report_not_found", "The report does not exist.");
   return json({ schema_version: "1", report: projectOperatorFields(session, "report", report) });
 }

package/template/src/report-workflow.ts

@@ -1,4 +1,5 @@
 import { AUDIT_GENESIS_HASH, canonicalJson, hashAuditEntry } from "./audit";
+import { decryptReportContact } from "./report-crypto";
 import { selectParticipantDelivery, type ParticipantDelivery } from "./report-email";
 import { ApiError } from "./report-http";
 import { analystAvatarColor } from "./report-presence";
@@ -160,7 +161,11 @@ export async function releaseReportClaim(db: D1Database, reportId: string, sessi
   ]);
 }
 
-export async function loadReportDetail(db: D1Database, reportId: string): Promise<Record<string, unknown> | null> {
+export async function loadReportDetail(
+  db: D1Database,
+  reportId: string,
+  options: { contactEncryptionKey?: string; includeReporterEmail?: boolean } = {},
+): Promise<Record<string, unknown> | null> {
   const report = await db.prepare(`
     SELECT r.id, r.public_reference AS reference, r.source, r.state, r.priority, r.reason_code AS reasonCode,
            r.locale, r.queue_id AS queueId, r.submitted_at AS submittedAt, r.received_at AS receivedAt,
@@ -172,7 +177,9 @@ export async function loadReportDetail(db: D1Database, reportId: string): Promis
            qv.management_mode AS queueManagementMode, qv.reviewer_instructions AS reviewerInstructions,
            t.target_type AS targetType, t.target_reference AS targetReference,
            t.owner_reference AS ownerReference, t.customer_url AS customerUrl,
-           p.reference AS reporterReference
+           p.reference AS reporterReference, p.contact_mode AS reporterContactMode,
+           p.contact_ciphertext AS reporterContactCiphertext,
+           p.reference_redacted_at AS reporterReferenceRedactedAt
     FROM reports r
     JOIN report_targets t ON t.report_id = r.id
     JOIN report_participants p ON p.report_id = r.id AND p.audience = 'reporter'
@@ -266,8 +273,35 @@ export async function loadReportDetail(db: D1Database, reportId: string): Promis
       value: parsedJson(row.valueJson, null),
     });
   }
+  let reporterEmail: string | null = null;
+  let reporterContactStatus: "available" | "not_provided" | "redacted" | "restricted" | "unavailable";
+  if (report.reporterReferenceRedactedAt) {
+    reporterContactStatus = "redacted";
+  } else if (!report.reporterContactCiphertext) {
+    reporterContactStatus = "not_provided";
+  } else if (!options.includeReporterEmail) {
+    reporterContactStatus = "restricted";
+  } else if (!options.contactEncryptionKey) {
+    reporterContactStatus = "unavailable";
+  } else {
+    try {
+      reporterEmail = (await decryptReportContact(
+        options.contactEncryptionKey,
+        String(report.reporterContactCiphertext),
+        reportId,
+        "reporter",
+      )).trim().toLowerCase();
+      reporterContactStatus = reporterEmail ? "available" : "unavailable";
+    } catch {
+      reporterContactStatus = "unavailable";
+    }
+  }
   return {
     ...report,
+    reporterEmail,
+    reporterContactStatus,
+    reporterContactCiphertext: undefined,
+    reporterReferenceRedactedAt: undefined,
     policyRules: (() => {
       try {
         const value: unknown = JSON.parse(String(report.policyRulesJson ?? "[]"));

package/template/worker-configuration.d.ts

@@ -1,19 +1,19 @@
 /* eslint-disable */
-// Generated by Wrangler by running `wrangler types --env-file=config/dev.vars.example --include-runtime=false --strict-vars=false` (hash: 2cca359aa7fa3dcf738a197c47478066)
+// Generated by Wrangler by running `wrangler types --env-file=config/dev.vars.example --include-runtime=false --strict-vars=false` (hash: 2d2c98e01480f3c1492835530279c5f1)
 interface __BaseEnv_Env {
 	PROFILE_MEDIA: R2Bucket;
 	WORKFLOW_ARTIFACTS: R2Bucket;
 	EVIDENCE_OBJECTS: R2Bucket;
 	EXPORTS: R2Bucket;
 	DB: D1Database;
+	AUTH_EMAIL: SendEmail;
+	REPORTER_EMAIL: SendEmail;
 	CONTROL_JOBS: Queue;
 	REPORT_JOBS: Queue;
 	DELIVERY_JOBS: Queue;
 	LOADER: WorkerLoader;
 	AI: Ai;
 	ASSETS: Fetcher;
-	AUTH_EMAIL: SendEmail;
-	REPORTER_EMAIL: SendEmail;
 	PUBLIC_BASE_URL: string;
 	ALLOWED_ORIGINS: string;
 	CONTEXT_TOKEN_TTL_SECONDS: string;