Skip to content

fix: enforce contact book ownership - #341

Merged
KMKoushik merged 1 commit into
mainfrom
fix/contact-book-contact-ownership
Jan 17, 2026
Merged

fix: enforce contact book ownership#341
KMKoushik merged 1 commit into
mainfrom
fix/contact-book-contact-ownership

Conversation

@KMKoushik

@KMKoushikKMKoushik commented Jan 17, 2026

Copy link
Copy Markdown
Member

Summary

  • scope contact updates/deletes to the requested contact book in public API
  • enforce contact ownership for TRPC contact mutations
  • return consistent 404s when contacts are outside the book

Verification

  • not run (not requested)

Summary by cubic

Enforces contact book ownership for update/delete across TRPC and the Public API. Blocks cross-book access and returns consistent 404s when a contact is outside the requested book.

  • Bug Fixes
    • TRPC update/delete now check contactBook.id and throw NOT_FOUND when contact isn’t in the book.
    • Public API update/delete verify book ownership and return UnsendApiError NOT_FOUND.
    • Service layer adds get/update/delete helpers scoped to a contact book to centralize checks.

Written for commit 2049909. Summary will update on new commits.

Summary by CodeRabbit

Release Notes

  • Improvements
    • Enhanced error handling and validation for contact operations. Contact updates and deletions now include proper existence checks and return clearer error messages when contacts are not found.

✏️ Tip: You can customize this high-level summary in your review settings.

@vercel

vercelBot commented Jan 17, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentReviewUpdated (UTC)
unsend-marketingReadyReadyPreview, CommentJan 17, 2026 7:04am

@coderabbitai

coderabbitaiBot commented Jan 17, 2026

Copy link
Copy Markdown
Contributor

Walkthrough

This pull request refactors contact management operations to enforce contact book context throughout the service layer. The changes introduce new service functions (getContactInContactBook, updateContactInContactBook, deleteContactInContactBook) that require both contact ID and contact book ID as parameters, replacing the previous context-agnostic equivalents. The TRPC mutations now extract contactBook from context and pass its ID to these operations. Public API handlers are updated to retrieve the contact book and use the new service functions. Error handling is added to return NOT_FOUND errors when operations fail to find the target contact.

Possibly related PRs

  • fix: contact update mutation #265: Modifies the contact update mutation in the same contacts router file to refactor how contactBookId is sourced and used in the update operation.

Suggested labels

hacktoberfest-accepted

🚥 Pre-merge checks | ✅ 2 | ❌ 1
❌ Failed checks (1 warning)
Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title 'fix: enforce contact book ownership' directly aligns with the PR's main objective of scoping contact operations to specific contact books and enforcing ownership verification.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying usesend with Cloudflare Pages Cloudflare Pages

Latest commit:2049909
Status: ✅ Deploy successful!
Preview URL:https://c46dad15.usesend.pages.dev
Branch Preview URL:https://fix-contact-book-contact-own.usesend.pages.dev

View logs

@cubic-dev-aicubic-dev-aiBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 4 files

@KMKoushik
KMKoushik merged commit f40a311 into mainJan 17, 2026
7 checks passed
@KMKoushik
KMKoushik deleted the fix/contact-book-contact-ownership branch January 17, 2026 07:08
@coderabbitaicoderabbitaiBot mentioned this pull request Jan 17, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@KMKoushik
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
fix: enforce contact book ownership by KMKoushik · Pull Request #341 · usesend/useSend · GitHub
Skip to content

fix: enforce contact book ownership - #341

Merged
KMKoushik merged 1 commit into
mainfrom
fix/contact-book-contact-ownership
Jan 17, 2026
Merged

fix: enforce contact book ownership#341
KMKoushik merged 1 commit into
mainfrom
fix/contact-book-contact-ownership

Conversation

@KMKoushik

@KMKoushikKMKoushik commented Jan 17, 2026

Copy link
Copy Markdown
Member

Summary

  • scope contact updates/deletes to the requested contact book in public API
  • enforce contact ownership for TRPC contact mutations
  • return consistent 404s when contacts are outside the book

Verification

  • not run (not requested)

Summary by cubic

Enforces contact book ownership for update/delete across TRPC and the Public API. Blocks cross-book access and returns consistent 404s when a contact is outside the requested book.

  • Bug Fixes
    • TRPC update/delete now check contactBook.id and throw NOT_FOUND when contact isn’t in the book.
    • Public API update/delete verify book ownership and return UnsendApiError NOT_FOUND.
    • Service layer adds get/update/delete helpers scoped to a contact book to centralize checks.

Written for commit 2049909. Summary will update on new commits.

Summary by CodeRabbit

Release Notes

  • Improvements
    • Enhanced error handling and validation for contact operations. Contact updates and deletions now include proper existence checks and return clearer error messages when contacts are not found.

✏️ Tip: You can customize this high-level summary in your review settings.

@vercel

vercelBot commented Jan 17, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentReviewUpdated (UTC)
unsend-marketingReadyReadyPreview, CommentJan 17, 2026 7:04am

@coderabbitai

coderabbitaiBot commented Jan 17, 2026

Copy link
Copy Markdown
Contributor

Walkthrough

This pull request refactors contact management operations to enforce contact book context throughout the service layer. The changes introduce new service functions (getContactInContactBook, updateContactInContactBook, deleteContactInContactBook) that require both contact ID and contact book ID as parameters, replacing the previous context-agnostic equivalents. The TRPC mutations now extract contactBook from context and pass its ID to these operations. Public API handlers are updated to retrieve the contact book and use the new service functions. Error handling is added to return NOT_FOUND errors when operations fail to find the target contact.

Possibly related PRs

  • fix: contact update mutation #265: Modifies the contact update mutation in the same contacts router file to refactor how contactBookId is sourced and used in the update operation.

Suggested labels

hacktoberfest-accepted

🚥 Pre-merge checks | ✅ 2 | ❌ 1
❌ Failed checks (1 warning)
Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title 'fix: enforce contact book ownership' directly aligns with the PR's main objective of scoping contact operations to specific contact books and enforcing ownership verification.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying usesend with Cloudflare Pages Cloudflare Pages

Latest commit:2049909
Status: ✅ Deploy successful!
Preview URL:https://c46dad15.usesend.pages.dev
Branch Preview URL:https://fix-contact-book-contact-own.usesend.pages.dev

View logs

@cubic-dev-aicubic-dev-aiBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 4 files

@KMKoushik
KMKoushik merged commit f40a311 into mainJan 17, 2026
7 checks passed
@KMKoushik
KMKoushik deleted the fix/contact-book-contact-ownership branch January 17, 2026 07:08
@coderabbitaicoderabbitaiBot mentioned this pull request Jan 17, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@KMKoushik
, 'i'); if (__m === '*' || __re.test(location.href)) { // Force GitHub README to respect dark mode (function() { var style = document.createElement('style'); style.textContent = ' .markdown-body { color-scheme: dark light; } .markdown-body pre { background: #161b22 !important; } .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; } .markdown-body table th, .markdown-body table td { border-color: #30363d !important; } .markdown-body img { background: #0d1117; } .markdown-body blockquote { border-left-color: #8b949e; } .markdown-body hr { border-color: #30363d; } '; document.head.appendChild(style); })(); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' fix: enforce contact book ownership by KMKoushik · Pull Request #341 · usesend/useSend · GitHub
Skip to content

fix: enforce contact book ownership - #341

Merged
KMKoushik merged 1 commit into
mainfrom
fix/contact-book-contact-ownership
Jan 17, 2026
Merged

fix: enforce contact book ownership#341
KMKoushik merged 1 commit into
mainfrom
fix/contact-book-contact-ownership

Conversation

@KMKoushik

@KMKoushikKMKoushik commented Jan 17, 2026

Copy link
Copy Markdown
Member

Summary

  • scope contact updates/deletes to the requested contact book in public API
  • enforce contact ownership for TRPC contact mutations
  • return consistent 404s when contacts are outside the book

Verification

  • not run (not requested)

Summary by cubic

Enforces contact book ownership for update/delete across TRPC and the Public API. Blocks cross-book access and returns consistent 404s when a contact is outside the requested book.

  • Bug Fixes
    • TRPC update/delete now check contactBook.id and throw NOT_FOUND when contact isn’t in the book.
    • Public API update/delete verify book ownership and return UnsendApiError NOT_FOUND.
    • Service layer adds get/update/delete helpers scoped to a contact book to centralize checks.

Written for commit 2049909. Summary will update on new commits.

Summary by CodeRabbit

Release Notes

  • Improvements
    • Enhanced error handling and validation for contact operations. Contact updates and deletions now include proper existence checks and return clearer error messages when contacts are not found.

✏️ Tip: You can customize this high-level summary in your review settings.

@vercel

vercelBot commented Jan 17, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentReviewUpdated (UTC)
unsend-marketingReadyReadyPreview, CommentJan 17, 2026 7:04am

@coderabbitai

coderabbitaiBot commented Jan 17, 2026

Copy link
Copy Markdown
Contributor

Walkthrough

This pull request refactors contact management operations to enforce contact book context throughout the service layer. The changes introduce new service functions (getContactInContactBook, updateContactInContactBook, deleteContactInContactBook) that require both contact ID and contact book ID as parameters, replacing the previous context-agnostic equivalents. The TRPC mutations now extract contactBook from context and pass its ID to these operations. Public API handlers are updated to retrieve the contact book and use the new service functions. Error handling is added to return NOT_FOUND errors when operations fail to find the target contact.

Possibly related PRs

  • fix: contact update mutation #265: Modifies the contact update mutation in the same contacts router file to refactor how contactBookId is sourced and used in the update operation.

Suggested labels

hacktoberfest-accepted

🚥 Pre-merge checks | ✅ 2 | ❌ 1
❌ Failed checks (1 warning)
Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title 'fix: enforce contact book ownership' directly aligns with the PR's main objective of scoping contact operations to specific contact books and enforcing ownership verification.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying usesend with Cloudflare Pages Cloudflare Pages

Latest commit:2049909
Status: ✅ Deploy successful!
Preview URL:https://c46dad15.usesend.pages.dev
Branch Preview URL:https://fix-contact-book-contact-own.usesend.pages.dev

View logs

@cubic-dev-aicubic-dev-aiBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 4 files

@KMKoushik
KMKoushik merged commit f40a311 into mainJan 17, 2026
7 checks passed
@KMKoushik
KMKoushik deleted the fix/contact-book-contact-ownership branch January 17, 2026 07:08
@coderabbitaicoderabbitaiBot mentioned this pull request Jan 17, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@KMKoushik
, 'i'); if (__m === '*' || __re.test(location.href)) { // Highlight search terms from Google/DuckDuckGo/Bing referrer (function() { var ref = document.referrer; var terms = []; if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) { var url = new URL(ref); var q = url.searchParams.get('q') || url.searchParams.get('p'); if (q) { terms = q.split(/\s+/).filter(function(t) { return t.length > 2; }); } } if (terms.length === 0) return; var style = document.createElement('style'); style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }'; document.head.appendChild(style); function highlight(node) { if (node.nodeType === 3) { // text node var text = node.textContent; var found = false; terms.forEach(function(term) { var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' fix: enforce contact book ownership by KMKoushik · Pull Request #341 · usesend/useSend · GitHub
Skip to content

fix: enforce contact book ownership - #341

Merged
KMKoushik merged 1 commit into
mainfrom
fix/contact-book-contact-ownership
Jan 17, 2026
Merged

fix: enforce contact book ownership#341
KMKoushik merged 1 commit into
mainfrom
fix/contact-book-contact-ownership

Conversation

@KMKoushik

@KMKoushikKMKoushik commented Jan 17, 2026

Copy link
Copy Markdown
Member

Summary

  • scope contact updates/deletes to the requested contact book in public API
  • enforce contact ownership for TRPC contact mutations
  • return consistent 404s when contacts are outside the book

Verification

  • not run (not requested)

Summary by cubic

Enforces contact book ownership for update/delete across TRPC and the Public API. Blocks cross-book access and returns consistent 404s when a contact is outside the requested book.

  • Bug Fixes
    • TRPC update/delete now check contactBook.id and throw NOT_FOUND when contact isn’t in the book.
    • Public API update/delete verify book ownership and return UnsendApiError NOT_FOUND.
    • Service layer adds get/update/delete helpers scoped to a contact book to centralize checks.

Written for commit 2049909. Summary will update on new commits.

Summary by CodeRabbit

Release Notes

  • Improvements
    • Enhanced error handling and validation for contact operations. Contact updates and deletions now include proper existence checks and return clearer error messages when contacts are not found.

✏️ Tip: You can customize this high-level summary in your review settings.

@vercel

vercelBot commented Jan 17, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentReviewUpdated (UTC)
unsend-marketingReadyReadyPreview, CommentJan 17, 2026 7:04am

@coderabbitai

coderabbitaiBot commented Jan 17, 2026

Copy link
Copy Markdown
Contributor

Walkthrough

This pull request refactors contact management operations to enforce contact book context throughout the service layer. The changes introduce new service functions (getContactInContactBook, updateContactInContactBook, deleteContactInContactBook) that require both contact ID and contact book ID as parameters, replacing the previous context-agnostic equivalents. The TRPC mutations now extract contactBook from context and pass its ID to these operations. Public API handlers are updated to retrieve the contact book and use the new service functions. Error handling is added to return NOT_FOUND errors when operations fail to find the target contact.

Possibly related PRs

  • fix: contact update mutation #265: Modifies the contact update mutation in the same contacts router file to refactor how contactBookId is sourced and used in the update operation.

Suggested labels

hacktoberfest-accepted

🚥 Pre-merge checks | ✅ 2 | ❌ 1
❌ Failed checks (1 warning)
Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title 'fix: enforce contact book ownership' directly aligns with the PR's main objective of scoping contact operations to specific contact books and enforcing ownership verification.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying usesend with Cloudflare Pages Cloudflare Pages

Latest commit:2049909
Status: ✅ Deploy successful!
Preview URL:https://c46dad15.usesend.pages.dev
Branch Preview URL:https://fix-contact-book-contact-own.usesend.pages.dev

View logs

@cubic-dev-aicubic-dev-aiBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 4 files

@KMKoushik
KMKoushik merged commit f40a311 into mainJan 17, 2026
7 checks passed
@KMKoushik
KMKoushik deleted the fix/contact-book-contact-ownership branch January 17, 2026 07:08
@coderabbitaicoderabbitaiBot mentioned this pull request Jan 17, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@KMKoushik
, 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ' fix: enforce contact book ownership by KMKoushik · Pull Request #341 · usesend/useSend · GitHub
Skip to content

fix: enforce contact book ownership - #341

Merged
KMKoushik merged 1 commit into
mainfrom
fix/contact-book-contact-ownership
Jan 17, 2026
Merged

fix: enforce contact book ownership#341
KMKoushik merged 1 commit into
mainfrom
fix/contact-book-contact-ownership

Conversation

@KMKoushik

@KMKoushikKMKoushik commented Jan 17, 2026

Copy link
Copy Markdown
Member

Summary

  • scope contact updates/deletes to the requested contact book in public API
  • enforce contact ownership for TRPC contact mutations
  • return consistent 404s when contacts are outside the book

Verification

  • not run (not requested)

Summary by cubic

Enforces contact book ownership for update/delete across TRPC and the Public API. Blocks cross-book access and returns consistent 404s when a contact is outside the requested book.

  • Bug Fixes
    • TRPC update/delete now check contactBook.id and throw NOT_FOUND when contact isn’t in the book.
    • Public API update/delete verify book ownership and return UnsendApiError NOT_FOUND.
    • Service layer adds get/update/delete helpers scoped to a contact book to centralize checks.

Written for commit 2049909. Summary will update on new commits.

Summary by CodeRabbit

Release Notes

  • Improvements
    • Enhanced error handling and validation for contact operations. Contact updates and deletions now include proper existence checks and return clearer error messages when contacts are not found.

✏️ Tip: You can customize this high-level summary in your review settings.

@vercel

vercelBot commented Jan 17, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentReviewUpdated (UTC)
unsend-marketingReadyReadyPreview, CommentJan 17, 2026 7:04am

@coderabbitai

coderabbitaiBot commented Jan 17, 2026

Copy link
Copy Markdown
Contributor

Walkthrough

This pull request refactors contact management operations to enforce contact book context throughout the service layer. The changes introduce new service functions (getContactInContactBook, updateContactInContactBook, deleteContactInContactBook) that require both contact ID and contact book ID as parameters, replacing the previous context-agnostic equivalents. The TRPC mutations now extract contactBook from context and pass its ID to these operations. Public API handlers are updated to retrieve the contact book and use the new service functions. Error handling is added to return NOT_FOUND errors when operations fail to find the target contact.

Possibly related PRs

  • fix: contact update mutation #265: Modifies the contact update mutation in the same contacts router file to refactor how contactBookId is sourced and used in the update operation.

Suggested labels

hacktoberfest-accepted

🚥 Pre-merge checks | ✅ 2 | ❌ 1
❌ Failed checks (1 warning)
Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title 'fix: enforce contact book ownership' directly aligns with the PR's main objective of scoping contact operations to specific contact books and enforcing ownership verification.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying usesend with Cloudflare Pages Cloudflare Pages

Latest commit:2049909
Status: ✅ Deploy successful!
Preview URL:https://c46dad15.usesend.pages.dev
Branch Preview URL:https://fix-contact-book-contact-own.usesend.pages.dev

View logs

@cubic-dev-aicubic-dev-aiBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 4 files

@KMKoushik
KMKoushik merged commit f40a311 into mainJan 17, 2026
7 checks passed
@KMKoushik
KMKoushik deleted the fix/contact-book-contact-ownership branch January 17, 2026 07:08
@coderabbitaicoderabbitaiBot mentioned this pull request Jan 17, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@KMKoushik
, 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' fix: enforce contact book ownership by KMKoushik · Pull Request #341 · usesend/useSend · GitHub
Skip to content

fix: enforce contact book ownership - #341

Merged
KMKoushik merged 1 commit into
mainfrom
fix/contact-book-contact-ownership
Jan 17, 2026
Merged

fix: enforce contact book ownership#341
KMKoushik merged 1 commit into
mainfrom
fix/contact-book-contact-ownership

Conversation

@KMKoushik

@KMKoushikKMKoushik commented Jan 17, 2026

Copy link
Copy Markdown
Member

Summary

  • scope contact updates/deletes to the requested contact book in public API
  • enforce contact ownership for TRPC contact mutations
  • return consistent 404s when contacts are outside the book

Verification

  • not run (not requested)

Summary by cubic

Enforces contact book ownership for update/delete across TRPC and the Public API. Blocks cross-book access and returns consistent 404s when a contact is outside the requested book.

  • Bug Fixes
    • TRPC update/delete now check contactBook.id and throw NOT_FOUND when contact isn’t in the book.
    • Public API update/delete verify book ownership and return UnsendApiError NOT_FOUND.
    • Service layer adds get/update/delete helpers scoped to a contact book to centralize checks.

Written for commit 2049909. Summary will update on new commits.

Summary by CodeRabbit

Release Notes

  • Improvements
    • Enhanced error handling and validation for contact operations. Contact updates and deletions now include proper existence checks and return clearer error messages when contacts are not found.

✏️ Tip: You can customize this high-level summary in your review settings.

@vercel

vercelBot commented Jan 17, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentReviewUpdated (UTC)
unsend-marketingReadyReadyPreview, CommentJan 17, 2026 7:04am

@coderabbitai

coderabbitaiBot commented Jan 17, 2026

Copy link
Copy Markdown
Contributor

Walkthrough

This pull request refactors contact management operations to enforce contact book context throughout the service layer. The changes introduce new service functions (getContactInContactBook, updateContactInContactBook, deleteContactInContactBook) that require both contact ID and contact book ID as parameters, replacing the previous context-agnostic equivalents. The TRPC mutations now extract contactBook from context and pass its ID to these operations. Public API handlers are updated to retrieve the contact book and use the new service functions. Error handling is added to return NOT_FOUND errors when operations fail to find the target contact.

Possibly related PRs

  • fix: contact update mutation #265: Modifies the contact update mutation in the same contacts router file to refactor how contactBookId is sourced and used in the update operation.

Suggested labels

hacktoberfest-accepted

🚥 Pre-merge checks | ✅ 2 | ❌ 1
❌ Failed checks (1 warning)
Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title 'fix: enforce contact book ownership' directly aligns with the PR's main objective of scoping contact operations to specific contact books and enforcing ownership verification.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying usesend with Cloudflare Pages Cloudflare Pages

Latest commit:2049909
Status: ✅ Deploy successful!
Preview URL:https://c46dad15.usesend.pages.dev
Branch Preview URL:https://fix-contact-book-contact-own.usesend.pages.dev

View logs

@cubic-dev-aicubic-dev-aiBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 4 files

@KMKoushik
KMKoushik merged commit f40a311 into mainJan 17, 2026
7 checks passed
@KMKoushik
KMKoushik deleted the fix/contact-book-contact-ownership branch January 17, 2026 07:08
@coderabbitaicoderabbitaiBot mentioned this pull request Jan 17, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@KMKoushik
, 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' fix: enforce contact book ownership by KMKoushik · Pull Request #341 · usesend/useSend · GitHub
Skip to content

fix: enforce contact book ownership - #341

Merged
KMKoushik merged 1 commit into
mainfrom
fix/contact-book-contact-ownership
Jan 17, 2026
Merged

fix: enforce contact book ownership#341
KMKoushik merged 1 commit into
mainfrom
fix/contact-book-contact-ownership

Conversation

@KMKoushik

@KMKoushikKMKoushik commented Jan 17, 2026

Copy link
Copy Markdown
Member

Summary

  • scope contact updates/deletes to the requested contact book in public API
  • enforce contact ownership for TRPC contact mutations
  • return consistent 404s when contacts are outside the book

Verification

  • not run (not requested)

Summary by cubic

Enforces contact book ownership for update/delete across TRPC and the Public API. Blocks cross-book access and returns consistent 404s when a contact is outside the requested book.

  • Bug Fixes
    • TRPC update/delete now check contactBook.id and throw NOT_FOUND when contact isn’t in the book.
    • Public API update/delete verify book ownership and return UnsendApiError NOT_FOUND.
    • Service layer adds get/update/delete helpers scoped to a contact book to centralize checks.

Written for commit 2049909. Summary will update on new commits.

Summary by CodeRabbit

Release Notes

  • Improvements
    • Enhanced error handling and validation for contact operations. Contact updates and deletions now include proper existence checks and return clearer error messages when contacts are not found.

✏️ Tip: You can customize this high-level summary in your review settings.

@vercel

vercelBot commented Jan 17, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentReviewUpdated (UTC)
unsend-marketingReadyReadyPreview, CommentJan 17, 2026 7:04am

@coderabbitai

coderabbitaiBot commented Jan 17, 2026

Copy link
Copy Markdown
Contributor

Walkthrough

This pull request refactors contact management operations to enforce contact book context throughout the service layer. The changes introduce new service functions (getContactInContactBook, updateContactInContactBook, deleteContactInContactBook) that require both contact ID and contact book ID as parameters, replacing the previous context-agnostic equivalents. The TRPC mutations now extract contactBook from context and pass its ID to these operations. Public API handlers are updated to retrieve the contact book and use the new service functions. Error handling is added to return NOT_FOUND errors when operations fail to find the target contact.

Possibly related PRs

  • fix: contact update mutation #265: Modifies the contact update mutation in the same contacts router file to refactor how contactBookId is sourced and used in the update operation.

Suggested labels

hacktoberfest-accepted

🚥 Pre-merge checks | ✅ 2 | ❌ 1
❌ Failed checks (1 warning)
Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title 'fix: enforce contact book ownership' directly aligns with the PR's main objective of scoping contact operations to specific contact books and enforcing ownership verification.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying usesend with Cloudflare Pages Cloudflare Pages

Latest commit:2049909
Status: ✅ Deploy successful!
Preview URL:https://c46dad15.usesend.pages.dev
Branch Preview URL:https://fix-contact-book-contact-own.usesend.pages.dev

View logs

@cubic-dev-aicubic-dev-aiBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 4 files

@KMKoushik
KMKoushik merged commit f40a311 into mainJan 17, 2026
7 checks passed
@KMKoushik
KMKoushik deleted the fix/contact-book-contact-ownership branch January 17, 2026 07:08
@coderabbitaicoderabbitaiBot mentioned this pull request Jan 17, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@KMKoushik
, 'i'); if (__m === '*' || __re.test(location.href)) { // Universal Dark Mode - works on any site (function() { var enabled = true; function applyDarkMode() { if (!enabled) return; // Create style element if it doesn't exist var style = document.getElementById('universal-dark-mode-style'); if (!style) { style = document.createElement('style'); style.id = 'universal-dark-mode-style'; document.head.appendChild(style); } // Dark mode CSS - inverts colors but preserves images/video style.textContent = ' /* Invert everything except media */ html { filter: invert(1) hue-rotate(180deg) !important; background: #1a1a2e !important; } /* Restore images, videos, iframes, canvas */ img, video, iframe, canvas, svg, picture, [style*="background-image"] { filter: invert(1) hue-rotate(180deg) !important; } /* Preserve specific elements that should not be inverted */ .no-dark-mode, .no-dark-mode *, [data-theme="light"], [data-theme="light"], .ace_editor, .ace_editor *, .CodeMirror, .CodeMirror *, .monaco-editor, .monaco-editor *, .markdown-body pre, .markdown-body pre *, .highlight, .highlight *, pre code, pre code * { filter: none !important; } /* Fix common UI elements */ .modal, .popup, .dropdown-menu, .tooltip, .popover { filter: invert(1) hue-rotate(180deg) !important; background: #2d2d44 !important; border-color: #444 !important; } /* Scrollbars */ ::-webkit-scrollbar { background: #1a1a2e !important; } ::-webkit-scrollbar-thumb { background: #444 !important; } ::-webkit-scrollbar-thumb:hover { background: #555 !important; } /* Selection */ ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; } ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; } '; } function removeDarkMode() { var style = document.getElementById('universal-dark-mode-style'); if (style) style.remove(); } // Toggle with Alt+Shift+D document.addEventListener('keydown', function(e) { if (e.altKey && e.shiftKey && e.key === 'D') { e.preventDefault(); enabled = !enabled; if (enabled) { applyDarkMode(); console.log('[Universal Dark Mode] Enabled'); } else { removeDarkMode(); console.log('[Universal Dark Mode] Disabled'); } } }); // Apply on load applyDarkMode(); // Re-apply on dynamic content var observer = new MutationObserver(function(mutations) { if (enabled && !document.getElementById('universal-dark-mode-style')) { applyDarkMode(); } }); observer.observe(document.head, { childList: true }); console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle'); })(); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })(); fix: enforce contact book ownership by KMKoushik · Pull Request #341 · usesend/useSend · GitHub
Skip to content

fix: enforce contact book ownership - #341

Merged
KMKoushik merged 1 commit into
mainfrom
fix/contact-book-contact-ownership
Jan 17, 2026
Merged

fix: enforce contact book ownership#341
KMKoushik merged 1 commit into
mainfrom
fix/contact-book-contact-ownership

Conversation

@KMKoushik

@KMKoushikKMKoushik commented Jan 17, 2026

Copy link
Copy Markdown
Member

Summary

  • scope contact updates/deletes to the requested contact book in public API
  • enforce contact ownership for TRPC contact mutations
  • return consistent 404s when contacts are outside the book

Verification

  • not run (not requested)

Summary by cubic

Enforces contact book ownership for update/delete across TRPC and the Public API. Blocks cross-book access and returns consistent 404s when a contact is outside the requested book.

  • Bug Fixes
    • TRPC update/delete now check contactBook.id and throw NOT_FOUND when contact isn’t in the book.
    • Public API update/delete verify book ownership and return UnsendApiError NOT_FOUND.
    • Service layer adds get/update/delete helpers scoped to a contact book to centralize checks.

Written for commit 2049909. Summary will update on new commits.

Summary by CodeRabbit

Release Notes

  • Improvements
    • Enhanced error handling and validation for contact operations. Contact updates and deletions now include proper existence checks and return clearer error messages when contacts are not found.

✏️ Tip: You can customize this high-level summary in your review settings.

@vercel

vercelBot commented Jan 17, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentReviewUpdated (UTC)
unsend-marketingReadyReadyPreview, CommentJan 17, 2026 7:04am

@coderabbitai

coderabbitaiBot commented Jan 17, 2026

Copy link
Copy Markdown
Contributor

Walkthrough

This pull request refactors contact management operations to enforce contact book context throughout the service layer. The changes introduce new service functions (getContactInContactBook, updateContactInContactBook, deleteContactInContactBook) that require both contact ID and contact book ID as parameters, replacing the previous context-agnostic equivalents. The TRPC mutations now extract contactBook from context and pass its ID to these operations. Public API handlers are updated to retrieve the contact book and use the new service functions. Error handling is added to return NOT_FOUND errors when operations fail to find the target contact.

Possibly related PRs

  • fix: contact update mutation #265: Modifies the contact update mutation in the same contacts router file to refactor how contactBookId is sourced and used in the update operation.

Suggested labels

hacktoberfest-accepted

🚥 Pre-merge checks | ✅ 2 | ❌ 1
❌ Failed checks (1 warning)
Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title 'fix: enforce contact book ownership' directly aligns with the PR's main objective of scoping contact operations to specific contact books and enforcing ownership verification.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying usesend with Cloudflare Pages Cloudflare Pages

Latest commit:2049909
Status: ✅ Deploy successful!
Preview URL:https://c46dad15.usesend.pages.dev
Branch Preview URL:https://fix-contact-book-contact-own.usesend.pages.dev

View logs

@cubic-dev-aicubic-dev-aiBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 4 files

@KMKoushik
KMKoushik merged commit f40a311 into mainJan 17, 2026
7 checks passed
@KMKoushik
KMKoushik deleted the fix/contact-book-contact-ownership branch January 17, 2026 07:08
@coderabbitaicoderabbitaiBot mentioned this pull request Jan 17, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@KMKoushik