ugly-app 0.1.783 → 0.1.784

package/src/server/adminAllowlist.test.ts

@@ -0,0 +1,29 @@
+import { describe, it, expect, afterEach } from 'vitest';
+import { isDefaultAdmin } from './adminAllowlist.js';
+
+const prev = process.env['ADMIN_USER_IDS'];
+afterEach(() => {
+  if (prev === undefined) delete process.env['ADMIN_USER_IDS'];
+  else process.env['ADMIN_USER_IDS'] = prev;
+});
+
+describe('isDefaultAdmin', () => {
+  it('admits the maintain-bot user', () => {
+    delete process.env['ADMIN_USER_IDS'];
+    expect(isDefaultAdmin('bot1', 'bot1')).toBe(true);
+    expect(isDefaultAdmin('other', 'bot1')).toBe(false);
+  });
+
+  it('admits users in the ADMIN_USER_IDS allowlist', () => {
+    process.env['ADMIN_USER_IDS'] = 'owner1, owner2';
+    expect(isDefaultAdmin('owner2', 'bot1')).toBe(true);
+    expect(isDefaultAdmin('owner1', '')).toBe(true);
+    expect(isDefaultAdmin('nobody', 'bot1')).toBe(false);
+  });
+
+  it('denies everyone when both are unset/empty', () => {
+    delete process.env['ADMIN_USER_IDS'];
+    expect(isDefaultAdmin('anyone', '')).toBe(false);
+    expect(isDefaultAdmin('', '')).toBe(false);
+  });
+});

package/src/server/adminAllowlist.ts

@@ -0,0 +1,20 @@
+/**
+ * Default admin gate for admin-only framework requests when the app supplies no
+ * `isAdminFn`. A user is admin when they are the maintain-bot user
+ * (`MAINTAIN_BOT_USER_ID`) OR listed in the `ADMIN_USER_IDS` env allowlist
+ * (comma-separated stable userIds). The allowlist lets a project grant its owner
+ * admin — e.g. so the owner can resolve feedback from the CLI — without shipping
+ * a custom `isAdminFn`. Never allow-all: with both unset, everyone is denied.
+ */
+export function envAdminUserIds(): string[] {
+  return (process.env['ADMIN_USER_IDS'] ?? '')
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean);
+}
+
+export function isDefaultAdmin(userId: string, maintainBotUserId: string): boolean {
+  if (!userId) return false;
+  if (maintainBotUserId && userId === maintainBotUserId) return true;
+  return envAdminUserIds().includes(userId);
+}

package/src/server/feedbackNotify.test.ts

@@ -0,0 +1,61 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+vi.mock('./userEmailLookup.js', () => ({ resolveUserEmail: vi.fn() }));
+vi.mock('./Email.js', () => ({ emailSend: vi.fn() }));
+
+import { notifyFeedbackResolved } from './feedbackNotify.js';
+import { resolveUserEmail } from './userEmailLookup.js';
+import { emailSend } from './Email.js';
+
+const mockResolve = vi.mocked(resolveUserEmail);
+const mockSend = vi.mocked(emailSend);
+
+describe('notifyFeedbackResolved', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('returns false and sends nothing for an anonymous report (no userId)', async () => {
+    const sent = await notifyFeedbackResolved(
+      { userId: null, message: null, type: null },
+      'resolved',
+      'x',
+    );
+    expect(sent).toBe(false);
+    expect(mockSend).not.toHaveBeenCalled();
+  });
+
+  it('returns false when the address cannot be resolved', async () => {
+    mockResolve.mockResolvedValue(null);
+    const sent = await notifyFeedbackResolved(
+      { userId: 'u', message: 'm', type: 'bug' },
+      'resolved',
+      'x',
+    );
+    expect(sent).toBe(false);
+    expect(mockSend).not.toHaveBeenCalled();
+  });
+
+  it('sends to the resolved address and returns true', async () => {
+    mockResolve.mockResolvedValue('a@b.co');
+    mockSend.mockResolvedValue(undefined);
+    const sent = await notifyFeedbackResolved(
+      { userId: 'u', message: 'm', type: 'bug' },
+      'resolved',
+      'fixed',
+    );
+    expect(sent).toBe(true);
+    expect(mockSend).toHaveBeenCalledWith(expect.objectContaining({ to: 'a@b.co' }));
+  });
+
+  it('is best-effort: returns false when emailSend throws', async () => {
+    mockResolve.mockResolvedValue('a@b.co');
+    mockSend.mockRejectedValue(new Error('no EMAIL binding'));
+    const sent = await notifyFeedbackResolved(
+      { userId: 'u', message: 'm', type: 'bug' },
+      'declined',
+      'no',
+    );
+    expect(sent).toBe(false);
+  });
+});

package/src/server/feedbackNotify.ts

@@ -0,0 +1,40 @@
+/**
+ * Notify a feedback reporter that their report was resolved/declined. Looks up
+ * the reporter's email by userId via ugly.bot (the identity provider) and sends
+ * the notice from the app's OWN domain via the framework email binding. This is
+ * "each app sends its own email" — ugly.bot is only the userId→email resolver.
+ *
+ * Best-effort: returns whether an email was actually sent; never throws, so a
+ * missing address, an anonymous report, or an email failure never blocks the
+ * resolve itself.
+ */
+import { emailSend } from './Email.js';
+import { renderFeedbackResolveEmail } from './feedbackResolveTemplate.js';
+import { resolveUserEmail } from './userEmailLookup.js';
+import type { ResolvedFeedbackRow } from './TelemetryStore.js';
+
+export async function notifyFeedbackResolved(
+  row: ResolvedFeedbackRow,
+  status: 'resolved' | 'declined',
+  resolution: string,
+): Promise<boolean> {
+  if (!row.userId) return false;
+  const to = await resolveUserEmail(row.userId);
+  if (!to) return false;
+  const { subject, html } = renderFeedbackResolveEmail({
+    status,
+    resolution,
+    originalMessage: row.message,
+    type: row.type,
+  });
+  try {
+    await emailSend({ to, subject, html });
+    return true;
+  } catch (e) {
+    console.error('[feedbackNotify] send failed', {
+      userId: row.userId,
+      error: e instanceof Error ? e.message : String(e),
+    });
+    return false;
+  }
+}

package/src/server/feedbackResolveTemplate.test.ts

@@ -0,0 +1,38 @@
+import { describe, it, expect } from 'vitest';
+import { renderFeedbackResolveEmail } from './feedbackResolveTemplate.js';
+
+describe('renderFeedbackResolveEmail', () => {
+  it('resolved: subject + includes resolution and original report text', () => {
+    const { subject, html } = renderFeedbackResolveEmail({
+      status: 'resolved',
+      resolution: 'Fixed in 0.2.0',
+      originalMessage: 'tokens wrong',
+      type: 'bug',
+    });
+    expect(subject).toMatch(/resolved/i);
+    expect(html).toContain('Fixed in 0.2.0');
+    expect(html).toContain('tokens wrong');
+  });
+
+  it('declined: subject reflects the status', () => {
+    const { subject } = renderFeedbackResolveEmail({
+      status: 'declined',
+      resolution: 'wontfix',
+      originalMessage: null,
+      type: null,
+    });
+    expect(subject).toMatch(/declined/i);
+  });
+
+  it('escapes HTML in user-supplied text', () => {
+    const { html } = renderFeedbackResolveEmail({
+      status: 'resolved',
+      resolution: '<script>x</script>',
+      originalMessage: 'a & b <c>',
+      type: 'bug',
+    });
+    expect(html).not.toContain('<script>');
+    expect(html).toContain('&lt;script&gt;');
+    expect(html).toContain('a &amp; b &lt;c&gt;');
+  });
+});

package/src/server/feedbackResolveTemplate.ts

@@ -0,0 +1,34 @@
+/**
+ * Transactional email a child app sends (from its own domain) to a user when
+ * their feedback report is resolved or declined. Kept intentionally minimal —
+ * the app owns branding; this is a plain, escaped notification.
+ */
+
+function esc(s: string): string {
+  return s
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;');
+}
+
+export function renderFeedbackResolveEmail(input: {
+  status: 'resolved' | 'declined';
+  resolution: string;
+  originalMessage: string | null;
+  type: string | null;
+}): { subject: string; html: string } {
+  const verb = input.status === 'resolved' ? 'resolved' : 'declined';
+  const subject = `Your feedback was ${verb}`;
+  const orig = input.originalMessage
+    ? `<p style="color:#666"><em>Your report${
+        input.type ? ` (${esc(input.type)})` : ''
+      }:</em><br>${esc(input.originalMessage)}</p>`
+    : '';
+  const html = `<div style="font-family:system-ui,-apple-system,sans-serif;max-width:520px;line-height:1.5">
+  <h2 style="margin:0 0 12px">Your feedback was ${verb}</h2>
+  ${orig}
+  <p>${esc(input.resolution)}</p>
+  <p style="color:#999;font-size:12px;margin-top:24px">You're receiving this because you filed feedback in the app.</p>
+</div>`;
+  return { subject, html };
+}

package/src/server/userEmailLookup.test.ts

@@ -0,0 +1,35 @@
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { resolveUserEmail } from './userEmailLookup.js';
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+const base = 'https://ugly.bot';
+
+describe('resolveUserEmail', () => {
+  it('returns the email ugly.bot resolves for the userId', async () => {
+    globalThis.fetch = vi
+      .fn()
+      .mockResolvedValue({ ok: true, json: async () => ({ email: 'a@b.co' }) }) as never;
+    expect(await resolveUserEmail('u1', { token: 't', baseUrl: base })).toBe('a@b.co');
+  });
+
+  it('returns null when the user has no email', async () => {
+    globalThis.fetch = vi
+      .fn()
+      .mockResolvedValue({ ok: true, json: async () => ({ email: null }) }) as never;
+    expect(await resolveUserEmail('u1', { token: 't', baseUrl: base })).toBeNull();
+  });
+
+  it('returns null on a non-ok response (best-effort)', async () => {
+    globalThis.fetch = vi
+      .fn()
+      .mockResolvedValue({ ok: false, json: async () => ({}) }) as never;
+    expect(await resolveUserEmail('u1', { token: 't', baseUrl: base })).toBeNull();
+  });
+
+  it('returns null without a token', async () => {
+    expect(await resolveUserEmail('u1', { token: '', baseUrl: base })).toBeNull();
+  });
+});

package/src/server/userEmailLookup.ts

@@ -0,0 +1,35 @@
+/**
+ * Resolve a user's email address by their stable userId via ugly.bot's identity
+ * service (`POST /v1/users/email`). ugly.bot owns identity + email, so this is
+ * the only reliable userId→email source in the default `uglybot` auth mode
+ * (the app's own `authIdentity` table is empty there). Used to notify a user
+ * about their OWN feedback — the app then sends the mail from its own domain.
+ *
+ * Best-effort: returns null on any failure or when the user has no email on
+ * record (phone-only / legacy accounts). Callers skip the email in that case.
+ */
+import { getUglyBotUrl } from '../shared/uglyBotUrl.js';
+
+export async function resolveUserEmail(
+  userId: string,
+  opts?: { token?: string; baseUrl?: string },
+): Promise<string | null> {
+  const token = opts?.token ?? process.env['UGLY_BOT_TOKEN'] ?? '';
+  if (!userId || !token) return null;
+  const base = opts?.baseUrl ?? getUglyBotUrl();
+  try {
+    const res = await fetch(`${base}/v1/users/email`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Authorization: `Bearer ${token}`,
+      },
+      body: JSON.stringify({ userId }),
+    });
+    if (!res.ok) return null;
+    const data = (await res.json()) as { email?: string | null };
+    return typeof data.email === 'string' && data.email.trim() ? data.email.trim() : null;
+  } catch {
+    return null;
+  }
+}

package/src/shared/FrameworkRequests.ts

@@ -213,6 +213,24 @@ export const frameworkRequests = defineRequests({
     }),
   }),
 
+  /**
+   * Admin-only: mark a feedback report resolved/declined and notify the reporter.
+   * Updates the `feedback_report` D1 row (status + resolution + resolved_at), then
+   * looks up the reporter's email by userId via ugly.bot and sends the notice from
+   * THIS app's own domain (email is best-effort — `emailed` reflects whether it
+   * sent). Called by the `feedback:resolve` CLI with the owner's token; gated by
+   * `resolvedIsAdmin` (MAINTAIN_BOT_USER_ID or the ADMIN_USER_IDS allowlist).
+   */
+  feedbackReportResolve: authReq({
+    input: z.object({
+      id: z.string().min(1),
+      status: z.enum(["resolved", "declined"]),
+      resolution: z.string().max(5000),
+    }),
+    output: z.object({ ok: z.boolean(), emailed: z.boolean() }),
+    rateLimit: { max: 120, window: 60 },
+  }),
+
   /**
    * Bot-submitted feedback. Wraps `recordFeedback` (which goes through
    * `db.captureFeedback`) so the bot-swarm skill's feedback bots can