Outlook Gatekeeper (OAuth)

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_160":161,"_162":163},"routes/_app.x.$handle.$name",{"_99":98,"_32":45,"_108":89,"_27":109,"_13":14,"_110":-5,"_11":111,"_112":113,"_114":115,"_116":117,"_118":119,"_20":-5,"_120":-5,"_121":-5,"_122":25,"_123":124,"_125":58,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":25},"version",61,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","82aef5c0-7a1e-11f1-af67-1607ee4eb77e","name","fileType","http","content","import { Hono } from \"npm:hono\";\nimport { getCookie, setCookie, deleteCookie } from \"npm:hono/cookie\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nconst app = new Hono();\n// --- CONFIGURATION ---\nconst getEnv = (name) => Deno.env.get(name);\nconst TENANT_ID = getEnv(\"MICROSOFT_TENANT_ID\") || \"common\";\nconst CLIENT_ID = getEnv(\"MICROSOFT_CLIENT_ID\");\nconst CLIENT_SECRET = getEnv(\"MICROSOFT_CLIENT_SECRET\");\nconst OPENAI_API_KEY = getEnv(\"OPENAI_API_KEY\");\nconst OPENAI_MODEL = getEnv(\"OPENAI_MODEL\") || \"gpt-5.4-nano\";\nconst NYC_TIME_ZONE = \"America/New_York\";\nconst SYNC_DAYS_BACK = 7;\nconst SYNC_DAYS_FORWARD = 7;\nconst CLEANUP_DAYS_BACK = 365;\nconst CLEANUP_DAYS_FORWARD = 365;\nconst SESSION_COOKIE = \"gatekeeper_session\";\nconst OAUTH_STATE_COOKIE = \"gatekeeper_oauth_state\";\nconst SESSION_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;\nconst ALLOWED_EMAILS = (getEnv(\"ALLOWED_EMAILS\") || \"perry.raskin@coverdash.com\")\n .split(\",\")\n .map((email) => email.trim().toLowerCase())\n .filter(Boolean);\n// --- DATABASE SETUP ---\n// We call these on every request to ensure the tables are always ready in the right DB context.\nasync function ensureTables() {\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS gatekeeper_auth (\n id TEXT PRIMARY KEY,\n access_token TEXT,\n refresh_token TEXT,\n expires_at INTEGER,\n user_email TEXT\n )\n `);\n await sqlite.execute(\"DELETE FROM gatekeeper_auth WHERE id = 'session'\");\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS gatekeeper_audit (\n id TEXT PRIMARY KEY,\n subject TEXT,\n decision TEXT,\n reasoning TEXT,\n timestamp DATETIME DEFAULT CURRENT_TIMESTAMP\n )\n `);\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS gatekeeper_rules (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n pattern TEXT UNIQUE,\n type TEXT DEFAULT 'mute'\n )\n `);\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS gatekeeper_settings (\n key TEXT PRIMARY KEY,\n value TEXT\n )\n `);\n await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO gatekeeper_settings (key, value) VALUES (?, ?)\",\n args: [\"schedule_enabled\", \"false\"],\n });\n await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO gatekeeper_settings (key, value) VALUES (?, ?)\",\n args: [\"schedule_interval_minutes\", \"60\"],\n });\n await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO gatekeeper_settings (key, value) VALUES (?, ?)\",\n args: [\"last_scheduled_sync_at\", \"\"],\n });\n await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO gatekeeper_settings (key, value) VALUES (?, ?)\",\n args: [\"last_scheduled_sync_summary\", \"Not run yet\"],\n });\n}\n// --- DISPLAY HELPERS ---\nfunction escapeHtml(value) {\n return String(value ?? \"\")\n .replaceAll(\"&\", \"&\")\n .replaceAll(\"<\", \"<\")\n .replaceAll(\">\", \">\")\n .replaceAll('\"', \""\")\n .replaceAll(\"'\", \"'\");\n}\nfunction formatNycEventTime(value) {\n const raw = String(value ?? \"\");\n if (!raw)\n return \"Unknown\";\n const hasExplicitZone = /(?:Z|[+-]\\d{2}:?\\d{2})$/i.test(raw);\n if (!hasExplicitZone) {\n const match = raw.match(/^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2})/);\n if (match) {\n const [, year, month, day, hour, minute] = match;\n const hourNumber = Number(hour);\n const hour12 = hourNumber % 12 || 12;\n const period = hourNumber >= 12 ? \"PM\" : \"AM\";\n return `${Number(month)}/${Number(day)}/${year}, ${hour12}:${minute} ${period} ET`;\n }\n }\n const date = new Date(raw);\n if (Number.isNaN(date.getTime()))\n return escapeHtml(raw);\n return new Intl.DateTimeFormat(\"en-US\", {\n timeZone: NYC_TIME_ZONE,\n year: \"numeric\",\n month: \"numeric\",\n day: \"numeric\",\n hour: \"numeric\",\n minute: \"2-digit\",\n timeZoneName: \"short\",\n }).format(date);\n}\nfunction displayDecision(value) {\n const decision = String(value ?? \"\").toLowerCase();\n if (decision === \"noise\" || decision === \"muted\") {\n return { className: \"decision-muted\", label: \"Alerts off\" };\n }\n return { className: \"decision-kept\", label: \"Kept\" };\n}\nfunction displayReason(value) {\n const reason = String(value ?? \"\");\n if (reason === \"Actionable by default\")\n return \"No alert rule matched; left unchanged\";\n if (reason === \"User manual rule match\")\n return \"Matched a rule; turned alerts off\";\n const oldCategoryTitleWrite = \"added \" + \"Muted category and \" + \"subject prefix\";\n return reason\n .replaceAll(oldCategoryTitleWrite, \"turned alerts off\")\n .replaceAll(\"should be muted\", \"should have alerts turned off\")\n || \"No reason recorded\";\n}\nfunction getResponseText(data) {\n if (typeof data.output_text === \"string\")\n return data.output_text;\n const parts = data.output?.flatMap((item) => item.content ?? []) ?? [];\n return parts.map((part) => part.text ?? \"\").join(\"\").trim();\n}\nfunction firstJsonObject(text) {\n const start = text.indexOf(\"{\");\n const end = text.lastIndexOf(\"}\");\n if (start === -1 || end === -1 || end <= start)\n return null;\n return text.slice(start, end + 1);\n}\nfunction classifyByRules(event, patterns) {\n const subject = event.subject || \"No Subject\";\n const matchingPattern = patterns.find((p) => subject.toLowerCase().includes(p));\n if (matchingPattern) {\n return {\n decision: \"muted\",\n reasoning: `Matched manual rule \"${matchingPattern}\"; turned alerts off`,\n };\n }\n if (String(event.showAs || \"\").toLowerCase() === \"oof\") {\n return {\n decision: \"muted\",\n reasoning: \"Outlook marks this event as out of office; turned alerts off\",\n };\n }\n return null;\n}\nasync function classifyWithAi(event) {\n if (!OPENAI_API_KEY)\n return null;\n const eventForModel = {\n subject: event.subject || \"No Subject\",\n start: event.start,\n end: event.end,\n isAllDay: Boolean(event.isAllDay),\n showAs: event.showAs || \"\",\n categories: event.categories || [],\n location: event.location?.displayName || \"\",\n organizer: event.organizer?.emailAddress?.name || event.organizer?.emailAddress?.address || \"\",\n bodyPreview: event.bodyPreview || \"\",\n };\n try {\n const res = await fetch(\"https://api.openai.com/v1/responses\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${OPENAI_API_KEY}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n model: OPENAI_MODEL,\n input: [\n {\n role: \"developer\",\n content: \"Classify one Outlook calendar event for an alert-suppression tool. Return only compact JSON with keys mute:boolean, category:string, reason:string. Set mute true for clear personal availability blockers whose reminders should be disabled: OOO/out of office/PTO/vacation/sick, doctor/dentist/medical/therapy appointments, personal errands, family/school appointments, lunch/breaks, commute/travel buffers, focus/no-meeting/block/hold time. Keep work meetings: client/vendor/internal meetings, planning, demos, interviews, standups, 1:1s, syncs, working sessions. If unsure, keep. Do not infer from attendee names alone.\",\n },\n {\n role: \"user\",\n content: JSON.stringify(eventForModel),\n },\n ],\n max_output_tokens: 120,\n store: false,\n }),\n });\n if (!res.ok) {\n console.error(\"OpenAI classification failed:\", await res.text());\n return null;\n }\n const data = await res.json();\n const jsonText = firstJsonObject(getResponseText(data));\n if (!jsonText)\n return null;\n const parsed = JSON.parse(jsonText);\n if (parsed?.mute === true) {\n return {\n decision: \"muted\",\n reasoning: `AI classified as ${parsed.category || \"personal blocker\"}: ${parsed.reason || \"calendar event should have alerts turned off\"}`,\n };\n }\n return {\n decision: \"kept\",\n reasoning: `AI kept event: ${parsed?.reason || \"not a personal availability blocker\"}`,\n };\n }\n catch (err) {\n console.error(\"AI classification error:\", err);\n return null;\n }\n}\nasync function classifyEvent(event, patterns) {\n const ruleClassification = classifyByRules(event, patterns);\n if (ruleClassification)\n return ruleClassification;\n const aiClassification = await classifyWithAi(event);\n if (aiClassification)\n return aiClassification;\n return {\n decision: \"kept\",\n reasoning: OPENAI_API_KEY\n ? \"No manual rule matched and AI classifier was unavailable; left unchanged\"\n : \"No manual rule matched and AI classifier is not configured; left unchanged\",\n };\n}\n// --- OAUTH HELPERS ---\nfunction newToken() {\n return crypto.randomUUID();\n}\nfunction isAllowedEmail(email) {\n return ALLOWED_EMAILS.length === 0 || ALLOWED_EMAILS.includes(String(email || \"\").toLowerCase());\n}\nfunction setSessionCookie(c, sessionId) {\n setCookie(c, SESSION_COOKIE, sessionId, {\n path: \"/\",\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n maxAge: SESSION_MAX_AGE_SECONDS,\n });\n}\nfunction clearSessionCookie(c) {\n deleteCookie(c, SESSION_COOKIE, { path: \"/\" });\n}\nfunction setOAuthStateCookie(c, state) {\n setCookie(c, OAUTH_STATE_COOKIE, state, {\n path: \"/\",\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n maxAge: 600,\n });\n}\nfunction clearOAuthStateCookie(c) {\n deleteCookie(c, OAUTH_STATE_COOKIE, { path: \"/\" });\n}\nfunction getRedirectUri(c) {\n const url = new URL(c.req.url);\n return `${url.origin}/callback`;\n}\nasync function refreshAccessToken(refreshToken) {\n console.log(\"Refreshing access token...\");\n const res = await fetch(`https://login.microsoftonline.com/${TENANT_ID}/oauth2/v2.0/token`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n client_id: CLIENT_ID,\n client_secret: CLIENT_SECRET,\n grant_type: \"refresh_token\",\n refresh_token: refreshToken,\n }),\n });\n if (!res.ok) {\n const error = await res.text();\n console.error(\"Token refresh failed:\", error);\n throw new Error(`Failed to refresh token: ${error}`);\n }\n return await res.json();\n}\nasync function getStoredAuth(c) {\n const sessionId = getCookie(c, SESSION_COOKIE);\n if (!sessionId)\n return null;\n const res = await sqlite.execute({\n sql: \"SELECT * FROM gatekeeper_auth WHERE id = ? LIMIT 1\",\n args: [sessionId],\n });\n if (!res.rows || res.rows.length === 0)\n return null;\n const row = res.rows[0];\n const auth = {\n id: (Array.isArray(row) ? row[0] : row.id),\n access_token: (Array.isArray(row) ? row[1] : row.access_token),\n refresh_token: (Array.isArray(row) ? row[2] : row.refresh_token),\n expires_at: (Array.isArray(row) ? row[3] : row.expires_at),\n user_email: (Array.isArray(row) ? row[4] : row.user_email),\n };\n if (!isAllowedEmail(auth.user_email))\n return null;\n return auth;\n}\nasync function getValidToken(c) {\n const auth = await getStoredAuth(c);\n if (!auth) {\n console.warn(\"No auth session found in request cookies.\");\n return null;\n }\n if (Date.now() < auth.expires_at) {\n return auth.access_token;\n }\n if (auth.refresh_token) {\n const fresh = await refreshAccessToken(auth.refresh_token);\n const expiresAt = Date.now() + fresh.expires_in * 1000;\n await sqlite.execute({\n sql: \"UPDATE gatekeeper_auth SET access_token = ?, expires_at = ? WHERE id = ?\",\n args: [fresh.access_token, expiresAt, auth.id],\n });\n return fresh.access_token;\n }\n return null;\n}\nfunction isOwnEvent(event, auth) {\n const organizerAddress = String(event.organizer?.emailAddress?.address || \"\").toLowerCase();\n const userEmail = String(auth?.user_email || \"\").toLowerCase();\n return event.isOrganizer === true || Boolean(organizerAddress && userEmail && organizerAddress === userEmail);\n}\nfunction removeMutedPrefix(subject) {\n return String(subject || \"\").replace(/^(?:\\[Muted\\]\\s*)+/i, \"\").trim();\n}\nconst SCHEDULE_OPTIONS = [\n { minutes: 15, label: \"Every 15 minutes\" },\n { minutes: 30, label: \"Every 30 minutes\" },\n { minutes: 60, label: \"Hourly\" },\n { minutes: 120, label: \"Every 2 hours\" },\n { minutes: 360, label: \"Every 6 hours\" },\n { minutes: 1440, label: \"Daily\" },\n];\nfunction normalizeScheduleMinutes(value) {\n const numeric = Number(value);\n return SCHEDULE_OPTIONS.some((option) => option.minutes === numeric) ? numeric : 60;\n}\nfunction scheduleLabel(minutes) {\n return SCHEDULE_OPTIONS.find((option) => option.minutes === minutes)?.label || \"Hourly\";\n}\nfunction rowToAuth(row) {\n return {\n id: (Array.isArray(row) ? row[0] : row.id),\n access_token: (Array.isArray(row) ? row[1] : row.access_token),\n refresh_token: (Array.isArray(row) ? row[2] : row.refresh_token),\n expires_at: Number(Array.isArray(row) ? row[3] : row.expires_at),\n user_email: (Array.isArray(row) ? row[4] : row.user_email),\n };\n}\nasync function getSetting(key, fallback = \"\") {\n const res = await sqlite.execute({\n sql: \"SELECT value FROM gatekeeper_settings WHERE key = ? LIMIT 1\",\n args: [key],\n });\n if (!res.rows || res.rows.length === 0)\n return fallback;\n const row = res.rows[0];\n return String(Array.isArray(row) ? row[0] : row.value ?? fallback);\n}\nasync function setSetting(key, value) {\n await sqlite.execute({\n sql: `\n INSERT INTO gatekeeper_settings (key, value) VALUES (?, ?)\n ON CONFLICT(key) DO UPDATE SET value = excluded.value`,\n args: [key, String(value)],\n });\n}\nasync function getScheduleSettings() {\n const enabled = (await getSetting(\"schedule_enabled\", \"false\")) === \"true\";\n const intervalMinutes = normalizeScheduleMinutes(await getSetting(\"schedule_interval_minutes\", \"60\"));\n const lastRunAt = await getSetting(\"last_scheduled_sync_at\", \"\");\n const lastSummary = await getSetting(\"last_scheduled_sync_summary\", \"Not run yet\");\n return { enabled, intervalMinutes, lastRunAt, lastSummary };\n}\nfunction formatNycDateTime(value) {\n if (!value)\n return \"Not run yet\";\n const date = new Date(value);\n if (Number.isNaN(date.getTime()))\n return String(value);\n return new Intl.DateTimeFormat(\"en-US\", {\n month: \"numeric\",\n day: \"numeric\",\n year: \"numeric\",\n hour: \"numeric\",\n minute: \"2-digit\",\n timeZone: NYC_TIME_ZONE,\n timeZoneName: \"short\",\n }).format(date);\n}\nfunction nextScheduledRunText(schedule) {\n if (!schedule.enabled)\n return \"Automatic sync is off\";\n if (!schedule.lastRunAt)\n return \"Due on the next scheduler wake\";\n const next = new Date(new Date(schedule.lastRunAt).getTime() + schedule.intervalMinutes * 60 * 1000);\n if (Number.isNaN(next.getTime()))\n return \"Due on the next scheduler wake\";\n return formatNycDateTime(next.toISOString());\n}\nasync function getLatestAuth() {\n const res = await sqlite.execute(\"SELECT * FROM gatekeeper_auth ORDER BY expires_at DESC LIMIT 1\");\n if (!res.rows || res.rows.length === 0)\n return null;\n const auth = rowToAuth(res.rows[0]);\n return isAllowedEmail(auth.user_email) ? auth : null;\n}\nasync function getValidTokenForAuth(auth) {\n if (!auth)\n return null;\n if (Date.now() < auth.expires_at)\n return auth.access_token;\n if (!auth.refresh_token)\n return null;\n const fresh = await refreshAccessToken(auth.refresh_token);\n const expiresAt = Date.now() + fresh.expires_in * 1000;\n await sqlite.execute({\n sql: \"UPDATE gatekeeper_auth SET access_token = ?, expires_at = ? WHERE id = ?\",\n args: [fresh.access_token, expiresAt, auth.id],\n });\n return fresh.access_token;\n}\nasync function syncCalendarEvents(auth, token) {\n const now = new Date();\n const startRange = new Date(now.getTime() - SYNC_DAYS_BACK * 24 * 60 * 60 * 1000);\n const endRange = new Date(now.getTime() + SYNC_DAYS_FORWARD * 24 * 60 * 60 * 1000);\n const calendarUrl = new URL(\"https://graph.microsoft.com/v1.0/me/calendarView\");\n calendarUrl.searchParams.set(\"startDateTime\", startRange.toISOString());\n calendarUrl.searchParams.set(\"endDateTime\", endRange.toISOString());\n calendarUrl.searchParams.set(\"$orderby\", \"start/dateTime\");\n calendarUrl.searchParams.set(\"$top\", \"100\");\n const eventsRes = await fetch(calendarUrl, {\n headers: {\n Authorization: `Bearer ${token}`,\n Prefer: `outlook.timezone=\"${NYC_TIME_ZONE}\"`,\n },\n });\n if (!eventsRes.ok) {\n const errorText = await eventsRes.text();\n throw new Error(`Graph API Error: ${errorText}`);\n }\n const eventsData = await eventsRes.json();\n const events = eventsData.value || [];\n const rulesRes = await sqlite.execute(\"SELECT * FROM gatekeeper_rules\");\n const patterns = rulesRes.rows.map((r) => String(Array.isArray(r) ? r[1] : r.pattern).toLowerCase());\n let skippedOwn = 0;\n let skippedAlreadyMuted = 0;\n let processed = 0;\n let muted = 0;\n let kept = 0;\n for (const event of events) {\n const subject = event.subject || \"No Subject\";\n const eventTime = event.start?.dateTime || new Date().toISOString();\n if (isOwnEvent(event, auth)) {\n skippedOwn += 1;\n console.log(`Skipping own event without changes: \"${subject}\"`);\n continue;\n }\n if (event.isReminderOn === false) {\n skippedAlreadyMuted += 1;\n continue;\n }\n const { decision, reasoning } = await classifyEvent(event, patterns);\n processed += 1;\n if (decision === \"muted\")\n muted += 1;\n else\n kept += 1;\n console.log(`Syncing event: \"${subject}\" | Result: ${decision} | ${reasoning}`);\n await sqlite.execute({\n sql: `\n INSERT INTO gatekeeper_audit (id, subject, decision, reasoning, timestamp)\n VALUES (?, ?, ?, ?, ?)\n ON CONFLICT(id) DO UPDATE SET\n subject = excluded.subject,\n decision = excluded.decision,\n reasoning = excluded.reasoning,\n timestamp = excluded.timestamp`,\n args: [event.id, subject, decision, reasoning, eventTime],\n });\n if (decision === \"muted\") {\n await fetch(`https://graph.microsoft.com/v1.0/me/events/${event.id}`, {\n method: \"PATCH\",\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n isReminderOn: false,\n }),\n });\n }\n }\n return { ok: true, total: events.length, processed, muted, kept, skippedOwn, skippedAlreadyMuted };\n}\nexport async function scheduledSyncTick(interval = {}) {\n await ensureTables();\n const schedule = await getScheduleSettings();\n if (!schedule.enabled) {\n return { ok: true, skipped: \"schedule disabled\" };\n }\n const now = Date.now();\n const lastRunTime = schedule.lastRunAt ? new Date(schedule.lastRunAt).getTime() : 0;\n if (lastRunTime && now - lastRunTime < schedule.intervalMinutes * 60 * 1000) {\n return { ok: true, skipped: \"not due\", nextRunAt: nextScheduledRunText(schedule) };\n }\n const auth = await getLatestAuth();\n if (!auth) {\n await setSetting(\"last_scheduled_sync_summary\", \"No authenticated Microsoft session available\");\n return { ok: false, skipped: \"no auth\" };\n }\n const token = await getValidTokenForAuth(auth);\n if (!token) {\n await setSetting(\"last_scheduled_sync_summary\", \"Microsoft token unavailable; log in again\");\n return { ok: false, skipped: \"no token\" };\n }\n const result = await syncCalendarEvents(auth, token);\n const finishedAt = new Date().toISOString();\n await setSetting(\"last_scheduled_sync_at\", finishedAt);\n await setSetting(\"last_scheduled_sync_summary\", `Reviewed ${result.total}; alerts off ${result.muted}; kept ${result.kept}; skipped own ${result.skippedOwn}`);\n return { ...result, scheduled: true, finishedAt, intervalLastRunAt: interval?.lastRunAt?.toISOString?.() || \"\" };\n}\n// --- UI COMPONENTS ---\nconst Layout = (content, authenticated = false) => `\n \n \n \n Outlook Gatekeeper (OAuth)\n \n \n \n \n \n

\n \n ${content}\n

\n \n \n \n`;\n// --- ROUTES ---\napp.get(\"/\", async (c) => {\n await ensureTables();\n const auth = await getStoredAuth(c);\n const error = c.req.query(\"error\");\n const cleanup = c.req.query(\"cleanup\");\n if (!auth) {\n return c.html(Layout(`\n

\n \n

\n `, false));\n }\n const auditRes = await sqlite.execute(\"SELECT * FROM gatekeeper_audit ORDER BY timestamp DESC LIMIT 20\");\n const auditRows = auditRes.rows.map((row) => ({\n id: Array.isArray(row) ? row[0] : row.id,\n subject: Array.isArray(row) ? row[1] : row.subject,\n decision: Array.isArray(row) ? row[2] : row.decision,\n reasoning: Array.isArray(row) ? row[3] : row.reasoning,\n timestamp: Array.isArray(row) ? row[4] : row.timestamp,\n }));\n const rulesRes = await sqlite.execute(\"SELECT * FROM gatekeeper_rules\");\n const rulesRows = rulesRes.rows.map((row) => ({\n id: Array.isArray(row) ? row[0] : row.id,\n pattern: Array.isArray(row) ? row[1] : row.pattern,\n type: Array.isArray(row) ? row[2] : row.type,\n }));\n const aiStatus = OPENAI_API_KEY\n ? `AI classifier enabled with ${escapeHtml(OPENAI_MODEL)}.`\n : \"AI classifier is not configured yet. Manual rules and Outlook out-of-office status still work.\";\n const mutedCount = auditRows.filter((row) => [\"noise\", \"muted\"].includes(String(row.decision || \"\").toLowerCase())).length;\n const keptCount = auditRows.filter((row) => displayDecision(row.decision).label === \"Kept\").length;\n const latestEventTime = auditRows[0]?.timestamp ? formatNycEventTime(auditRows[0].timestamp) : \"None\";\n const cleanupMessage = cleanup ? cleanup.split(\"|\").map((part) => escapeHtml(part)).join(\" \") : \"\";\n const content = `\n ${error ? `` : \"\"}\n ${cleanupMessage ? `` : \"\"}\n ${OPENAI_API_KEY ? \"\" : ``}\n\n

${escapeHtml(auth.user_email || \"Authenticated\")}

Calendar Sync Log

Review what Gatekeeper kept, where it turned alerts off, and why. Times are shown in New York time.

\n \n \n ${OPENAI_API_KEY ? \"AI\" : \"Manual\"} classifier\n \n \n \n NYC time\n \n \n

${auditRows.length}Logged events

${mutedCount}Alerts off

${keptCount}Kept

${rulesRows.length}Rules

\n \n \n \n \n \n ${auditRows.length ? auditRows.map((row) => {\n const decision = displayDecision(row.decision);\n return `\n \n \n \n \n \n `;\n }).join(\"\") : \"\"}\n \n

Event Time	Subject	Result	Why
${formatNycEventTime(row.timestamp)}	${escapeHtml(row.subject \|\| \"No Subject\")}	${decision.label}	${escapeHtml(displayReason(row.reasoning))}
No events processed yet.

\n ${auditRows.length ? auditRows.map((row) => {\n const decision = displayDecision(row.decision);\n return `\n

\n ${formatNycEventTime(row.timestamp)}\n ${decision.label}\n

${escapeHtml(row.subject || \"No Subject\")}

${escapeHtml(displayReason(row.reasoning))}

`;\n }).join(\"\") : `

No events processed yet.

`}\n

\n\n

Alert Rules

Personal blockers stay quiet.

Manual phrases run before AI. Current classifier: ${aiStatus}

Latest logged event: ${escapeHtml(latestEventTime)}

Add rule

Use short phrases for cases where reminders should be disabled.

\n \n

${escapeHtml(row.pattern)}remove
No manual rules

\n `;\n return c.html(Layout(content, true));\n});\napp.get(\"/login\", (c) => {\n if (!CLIENT_ID)\n return c.text(\"Missing MICROSOFT_CLIENT_ID env var\");\n const state = newToken();\n setOAuthStateCookie(c, state);\n const url = new URL(`https://login.microsoftonline.com/${TENANT_ID}/oauth2/v2.0/authorize`);\n url.searchParams.set(\"client_id\", CLIENT_ID);\n url.searchParams.set(\"response_type\", \"code\");\n url.searchParams.set(\"redirect_uri\", getRedirectUri(c));\n url.searchParams.set(\"response_mode\", \"query\");\n url.searchParams.set(\"scope\", \"offline_access Calendars.ReadWrite User.Read\");\n url.searchParams.set(\"state\", state);\n return c.redirect(url.toString());\n});\napp.get(\"/callback\", async (c) => {\n await ensureTables();\n const code = c.req.query(\"code\");\n const state = c.req.query(\"state\");\n const expectedState = getCookie(c, OAUTH_STATE_COOKIE);\n if (!code)\n return c.redirect(\"/?error=Authorization+code+missing\");\n if (!state || !expectedState || state !== expectedState) {\n clearOAuthStateCookie(c);\n return c.redirect(\"/?error=OAuth+state+check+failed\");\n }\n try {\n const res = await fetch(`https://login.microsoftonline.com/${TENANT_ID}/oauth2/v2.0/token`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n client_id: CLIENT_ID,\n client_secret: CLIENT_SECRET,\n code,\n redirect_uri: getRedirectUri(c),\n grant_type: \"authorization_code\",\n }),\n });\n const data = await res.json();\n if (data.error) {\n console.error(\"Token exchange failed:\", data.error_description);\n return c.redirect(`/?error=${encodeURIComponent(data.error_description)}`);\n }\n const meRes = await fetch(\"https://graph.microsoft.com/v1.0/me\", {\n headers: { Authorization: `Bearer ${data.access_token}` },\n });\n const me = await meRes.json();\n const userEmail = me.mail || me.userPrincipalName || me.displayName || \"Authenticated User\";\n if (!isAllowedEmail(userEmail)) {\n clearOAuthStateCookie(c);\n clearSessionCookie(c);\n return c.redirect(\"/?error=This+Microsoft+account+is+not+allowed\");\n }\n const sessionId = newToken();\n const expiresAt = Date.now() + data.expires_in * 1000;\n await sqlite.execute({\n sql: \"INSERT OR REPLACE INTO gatekeeper_auth (id, access_token, refresh_token, expires_at, user_email) VALUES (?, ?, ?, ?, ?)\",\n args: [sessionId, data.access_token, data.refresh_token, expiresAt, userEmail],\n });\n clearOAuthStateCookie(c);\n setSessionCookie(c, sessionId);\n return c.redirect(\"/\");\n }\n catch (err) {\n console.error(\"Callback error:\", err);\n return c.redirect(`/?error=${encodeURIComponent(String(err))}`);\n }\n});\napp.get(\"/run\", async (c) => {\n await ensureTables();\n const wantsJson = c.req.query(\"format\") === \"json\" || (c.req.header(\"accept\") || \"\").includes(\"application/json\");\n try {\n const auth = await getStoredAuth(c);\n if (!auth)\n return wantsJson ? c.json({ ok: false, error: \"Login required\" }, 401) : c.redirect(\"/login\");\n const token = await getValidToken(c);\n if (!token)\n return wantsJson ? c.json({ ok: false, error: \"Login required\" }, 401) : c.redirect(\"/login\");\n const now = new Date();\n const startRange = new Date(now.getTime() - SYNC_DAYS_BACK * 24 * 60 * 60 * 1000);\n const endRange = new Date(now.getTime() + SYNC_DAYS_FORWARD * 24 * 60 * 60 * 1000);\n const calendarUrl = new URL(\"https://graph.microsoft.com/v1.0/me/calendarView\");\n calendarUrl.searchParams.set(\"startDateTime\", startRange.toISOString());\n calendarUrl.searchParams.set(\"endDateTime\", endRange.toISOString());\n calendarUrl.searchParams.set(\"$orderby\", \"start/dateTime\");\n calendarUrl.searchParams.set(\"$top\", \"100\");\n const eventsRes = await fetch(calendarUrl, {\n headers: {\n Authorization: `Bearer ${token}`,\n Prefer: `outlook.timezone=\"${NYC_TIME_ZONE}\"`,\n },\n });\n if (!eventsRes.ok) {\n const errorText = await eventsRes.text();\n if (wantsJson)\n return c.json({ ok: false, error: `Graph API Error: ${errorText}` }, 502);\n return c.redirect(`/?error=Graph+API+Error:+${encodeURIComponent(errorText)}`);\n }\n const eventsData = await eventsRes.json();\n const events = eventsData.value || [];\n const rulesRes = await sqlite.execute(\"SELECT * FROM gatekeeper_rules\");\n const patterns = rulesRes.rows.map((r) => String(Array.isArray(r) ? r[1] : r.pattern).toLowerCase());\n let skippedOwn = 0;\n let skippedAlreadyMuted = 0;\n let processed = 0;\n let muted = 0;\n let kept = 0;\n for (const event of events) {\n const subject = event.subject || \"No Subject\";\n const eventTime = event.start?.dateTime || new Date().toISOString();\n if (isOwnEvent(event, auth)) {\n skippedOwn += 1;\n console.log(`Skipping own event without changes: \"${subject}\"`);\n continue;\n }\n if (event.isReminderOn === false) {\n skippedAlreadyMuted += 1;\n continue;\n }\n const { decision, reasoning } = await classifyEvent(event, patterns);\n processed += 1;\n if (decision === \"muted\") muted += 1;\n else kept += 1;\n console.log(`Syncing event: \"${subject}\" | Result: ${decision} | ${reasoning}`);\n await sqlite.execute({\n sql: `\n INSERT INTO gatekeeper_audit (id, subject, decision, reasoning, timestamp)\n VALUES (?, ?, ?, ?, ?)\n ON CONFLICT(id) DO UPDATE SET\n subject = excluded.subject,\n decision = excluded.decision,\n reasoning = excluded.reasoning,\n timestamp = excluded.timestamp`,\n args: [event.id, subject, decision, reasoning, eventTime],\n });\n if (decision === \"muted\") {\n await fetch(`https://graph.microsoft.com/v1.0/me/events/${event.id}`, {\n method: \"PATCH\",\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n isReminderOn: false,\n }),\n });\n }\n }\n if (wantsJson) {\n return c.json({ ok: true, total: events.length, processed, muted, kept, skippedOwn, skippedAlreadyMuted });\n }\n return c.redirect(\"/\");\n }\n catch (err) {\n console.error(\"Sync run error:\", err);\n if (wantsJson)\n return c.json({ ok: false, error: String(err) }, 500);\n return c.redirect(`/?error=${encodeURIComponent(String(err))}`);\n }\n});\napp.post(\"/cleanup-muted-prefix\", async (c) => {\n await ensureTables();\n try {\n const auth = await getStoredAuth(c);\n if (!auth)\n return c.redirect(\"/login\");\n const token = await getValidToken(c);\n if (!token)\n return c.redirect(\"/login\");\n const now = new Date();\n const startRange = new Date(now.getTime() - CLEANUP_DAYS_BACK * 24 * 60 * 60 * 1000);\n const endRange = new Date(now.getTime() + CLEANUP_DAYS_FORWARD * 24 * 60 * 60 * 1000);\n const calendarUrl = new URL(\"https://graph.microsoft.com/v1.0/me/calendarView\");\n calendarUrl.searchParams.set(\"startDateTime\", startRange.toISOString());\n calendarUrl.searchParams.set(\"endDateTime\", endRange.toISOString());\n calendarUrl.searchParams.set(\"$select\", \"id,subject,isOrganizer,organizer,start\");\n calendarUrl.searchParams.set(\"$orderby\", \"start/dateTime\");\n calendarUrl.searchParams.set(\"$top\", \"100\");\n let nextUrl = calendarUrl.toString();\n let scanned = 0;\n let matched = 0;\n let repaired = 0;\n let skippedOwn = 0;\n let failed = 0;\n const seenIds = new Set();\n while (nextUrl) {\n const eventsRes = await fetch(nextUrl, {\n headers: {\n Authorization: `Bearer ${token}`,\n Prefer: `outlook.timezone=\"${NYC_TIME_ZONE}\"`,\n },\n });\n if (!eventsRes.ok) {\n const errorText = await eventsRes.text();\n throw new Error(`Graph API Error: ${errorText}`);\n }\n const eventsData = await eventsRes.json();\n for (const event of eventsData.value || []) {\n if (seenIds.has(event.id))\n continue;\n seenIds.add(event.id);\n scanned += 1;\n const subject = event.subject || \"\";\n const cleanedSubject = removeMutedPrefix(subject);\n if (!subject || cleanedSubject === subject)\n continue;\n matched += 1;\n if (isOwnEvent(event, auth)) {\n skippedOwn += 1;\n continue;\n }\n const patchRes = await fetch(`https://graph.microsoft.com/v1.0/me/events/${event.id}`, {\n method: \"PATCH\",\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ subject: cleanedSubject }),\n });\n if (patchRes.ok) {\n repaired += 1;\n }\n else {\n failed += 1;\n console.error(\"Failed to repair renamed event:\", subject, await patchRes.text());\n }\n }\n nextUrl = eventsData[\"@odata.nextLink\"] || \"\";\n }\n const parts = [\n `Repaired ${repaired} renamed attendee-copy event${repaired === 1 ? \"\" : \"s\"}.`,\n `Scanned ${scanned} events; found ${matched}.`,\n skippedOwn ? `Skipped ${skippedOwn} organizer-owned event${skippedOwn === 1 ? \"\" : \"s\"} to avoid sending attendee updates.` : \"No organizer-owned renamed events found.\",\n failed ? `${failed} repair${failed === 1 ? \"\" : \"s\"} failed; check logs.` : \"\",\n ].filter(Boolean);\n return c.redirect(`/?cleanup=${encodeURIComponent(parts.join(\"|\"))}`);\n }\n catch (err) {\n console.error(\"Cleanup renamed titles error:\", err);\n return c.redirect(`/?error=${encodeURIComponent(String(err))}`);\n }\n});\napp.get(\"/logout\", async (c) => {\n const sessionId = getCookie(c, SESSION_COOKIE);\n if (sessionId) {\n await sqlite.execute({\n sql: \"DELETE FROM gatekeeper_auth WHERE id = ?\",\n args: [sessionId],\n });\n }\n clearSessionCookie(c);\n clearOAuthStateCookie(c);\n return c.redirect(\"/\");\n});\napp.post(\"/rules\", async (c) => {\n const auth = await getStoredAuth(c);\n if (!auth)\n return c.redirect(\"/login\");\n const { pattern } = await c.req.parseBody();\n await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO gatekeeper_rules (pattern) VALUES (?)\",\n args: [pattern],\n });\n return c.redirect(\"/\");\n});\napp.get(\"/rules/delete/:id\", async (c) => {\n const auth = await getStoredAuth(c);\n if (!auth)\n return c.redirect(\"/login\");\n await sqlite.execute({\n sql: \"DELETE FROM gatekeeper_rules WHERE id = ?\",\n args: [c.req.param(\"id\")],\n });\n return c.redirect(\"/\");\n});\napp.onError((err) => Promise.reject(err));\nexport default app.fetch;\n","import { Hono } from \"npm:hono\";\nimport { getCookie, setCookie, deleteCookie } from \"npm:hono/cookie\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nconst app = new Hono();\n// --- CONFIGURATION ---\nconst getEnv = (name) => Deno.env.get(name);\nconst TENANT_ID = getEnv(\"MICROSOFT_TENANT_ID\") || \"common\";\nconst CLIENT_ID = getEnv(\"MICROSOFT_CLIENT_ID\");\nconst CLIENT_SECRET = getEnv(\"MICROSOFT_CLIENT_SECRET\");\nconst OPENAI_API_KEY = getEnv(\"OPENAI_API_KEY\");\nconst OPENAI_MODEL = getEnv(\"OPENAI_MODEL\") || \"gpt-5.4-nano\";\nconst NYC_TIME_ZONE = \"America/New_York\";\nconst SYNC_DAYS_BACK = 7;\nconst SYNC_DAYS_FORWARD = 7;\nconst CLEANUP_DAYS_BACK = 365;\nconst CLEANUP_DAYS_FORWARD = 365;\nconst SESSION_COOKIE = \"gatekeeper_session\";\nconst OAUTH_STATE_COOKIE = \"gatekeeper_oauth_state\";\nconst SESSION_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;\nconst ALLOWED_EMAILS = (getEnv(\"ALLOWED_EMAILS\") || \"perry.raskin@coverdash.com\")\n .split(\",\")\n .map((email) => email.trim().toLowerCase())\n .filter(Boolean);\n// --- DATABASE SETUP ---\n// We call these on every request to ensure the tables are always ready in the right DB context.\nasync function ensureTables() {\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS gatekeeper_auth (\n id TEXT PRIMARY KEY,\n access_token TEXT,\n refresh_token TEXT,\n expires_at INTEGER,\n user_email TEXT\n )\n `);\n await sqlite.execute(\"DELETE FROM gatekeeper_auth WHERE id = 'session'\");\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS gatekeeper_audit (\n id TEXT PRIMARY KEY,\n subject TEXT,\n decision TEXT,\n reasoning TEXT,\n timestamp DATETIME DEFAULT CURRENT_TIMESTAMP\n )\n `);\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS gatekeeper_rules (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n pattern TEXT UNIQUE,\n type TEXT DEFAULT 'mute'\n )\n `);\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS gatekeeper_settings (\n key TEXT PRIMARY KEY,\n value TEXT\n )\n `);\n await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO gatekeeper_settings (key, value) VALUES (?, ?)\",\n args: [\"schedule_enabled\", \"false\"],\n });\n await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO gatekeeper_settings (key, value) VALUES (?, ?)\",\n args: [\"schedule_interval_minutes\", \"60\"],\n });\n await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO gatekeeper_settings (key, value) VALUES (?, ?)\",\n args: [\"last_scheduled_sync_at\", \"\"],\n });\n await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO gatekeeper_settings (key, value) VALUES (?, ?)\",\n args: [\"last_scheduled_sync_summary\", \"Not run yet\"],\n });\n}\n// --- DISPLAY HELPERS ---\nfunction escapeHtml(value) {\n return String(value ?? \"\")\n .replaceAll(\"&\", \"&\")\n .replaceAll(\"<\", \"<\")\n .replaceAll(\">\", \">\")\n .replaceAll('\"', \""\")\n .replaceAll(\"'\", \"'\");\n}\nfunction formatNycEventTime(value) {\n const raw = String(value ?? \"\");\n if (!raw)\n return \"Unknown\";\n const hasExplicitZone = /(?:Z|[+-]\\d{2}:?\\d{2})$/i.test(raw);\n if (!hasExplicitZone) {\n const match = raw.match(/^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2})/);\n if (match) {\n const [, year, month, day, hour, minute] = match;\n const hourNumber = Number(hour);\n const hour12 = hourNumber % 12 || 12;\n const period = hourNumber >= 12 ? \"PM\" : \"AM\";\n return `${Number(month)}/${Number(day)}/${year}, ${hour12}:${minute} ${period} ET`;\n }\n }\n const date = new Date(raw);\n if (Number.isNaN(date.getTime()))\n return escapeHtml(raw);\n return new Intl.DateTimeFormat(\"en-US\", {\n timeZone: NYC_TIME_ZONE,\n year: \"numeric\",\n month: \"numeric\",\n day: \"numeric\",\n hour: \"numeric\",\n minute: \"2-digit\",\n timeZoneName: \"short\",\n }).format(date);\n}\nfunction displayDecision(value) {\n const decision = String(value ?? \"\").toLowerCase();\n if (decision === \"noise\" || decision === \"muted\") {\n return { className: \"decision-muted\", label: \"Alerts off\" };\n }\n return { className: \"decision-kept\", label: \"Kept\" };\n}\nfunction displayReason(value) {\n const reason = String(value ?? \"\");\n if (reason === \"Actionable by default\")\n return \"No alert rule matched; left unchanged\";\n if (reason === \"User manual rule match\")\n return \"Matched a rule; turned alerts off\";\n const oldCategoryTitleWrite = \"added \" + \"Muted category and \" + \"subject prefix\";\n return reason\n .replaceAll(oldCategoryTitleWrite, \"turned alerts off\")\n .replaceAll(\"should be muted\", \"should have alerts turned off\")\n || \"No reason recorded\";\n}\nfunction getResponseText(data) {\n if (typeof data.output_text === \"string\")\n return data.output_text;\n const parts = data.output?.flatMap((item) => item.content ?? []) ?? [];\n return parts.map((part) => part.text ?? \"\").join(\"\").trim();\n}\nfunction firstJsonObject(text) {\n const start = text.indexOf(\"{\");\n const end = text.lastIndexOf(\"}\");\n if (start === -1 || end === -1 || end <= start)\n return null;\n return text.slice(start, end + 1);\n}\nfunction classifyByRules(event, patterns) {\n const subject = event.subject || \"No Subject\";\n const matchingPattern = patterns.find((p) => subject.toLowerCase().includes(p));\n if (matchingPattern) {\n return {\n decision: \"muted\",\n reasoning: `Matched manual rule \"${matchingPattern}\"; turned alerts off`,\n };\n }\n if (String(event.showAs || \"\").toLowerCase() === \"oof\") {\n return {\n decision: \"muted\",\n reasoning: \"Outlook marks this event as out of office; turned alerts off\",\n };\n }\n return null;\n}\nasync function classifyWithAi(event) {\n if (!OPENAI_API_KEY)\n return null;\n const eventForModel = {\n subject: event.subject || \"No Subject\",\n start: event.start,\n end: event.end,\n isAllDay: Boolean(event.isAllDay),\n showAs: event.showAs || \"\",\n categories: event.categories || [],\n location: event.location?.displayName || \"\",\n organizer: event.organizer?.emailAddress?.name || event.organizer?.emailAddress?.address || \"\",\n bodyPreview: event.bodyPreview || \"\",\n };\n try {\n const res = await fetch(\"https://api.openai.com/v1/responses\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${OPENAI_API_KEY}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n model: OPENAI_MODEL,\n input: [\n {\n role: \"developer\",\n content: \"Classify one Outlook calendar event for an alert-suppression tool. Return only compact JSON with keys mute:boolean, category:string, reason:string. Set mute true for clear personal availability blockers whose reminders should be disabled: OOO/out of office/PTO/vacation/sick, doctor/dentist/medical/therapy appointments, personal errands, family/school appointments, lunch/breaks, commute/travel buffers, focus/no-meeting/block/hold time. Keep work meetings: client/vendor/internal meetings, planning, demos, interviews, standups, 1:1s, syncs, working sessions. If unsure, keep. Do not infer from attendee names alone.\",\n },\n {\n role: \"user\",\n content: JSON.stringify(eventForModel),\n },\n ],\n max_output_tokens: 120,\n store: false,\n }),\n });\n if (!res.ok) {\n console.error(\"OpenAI classification failed:\", await res.text());\n return null;\n }\n const data = await res.json();\n const jsonText = firstJsonObject(getResponseText(data));\n if (!jsonText)\n return null;\n const parsed = JSON.parse(jsonText);\n if (parsed?.mute === true) {\n return {\n decision: \"muted\",\n reasoning: `AI classified as ${parsed.category || \"personal blocker\"}: ${parsed.reason || \"calendar event should have alerts turned off\"}`,\n };\n }\n return {\n decision: \"kept\",\n reasoning: `AI kept event: ${parsed?.reason || \"not a personal availability blocker\"}`,\n };\n }\n catch (err) {\n console.error(\"AI classification error:\", err);\n return null;\n }\n}\nasync function classifyEvent(event, patterns) {\n const ruleClassification = classifyByRules(event, patterns);\n if (ruleClassification)\n return ruleClassification;\n const aiClassification = await classifyWithAi(event);\n if (aiClassification)\n return aiClassification;\n return {\n decision: \"kept\",\n reasoning: OPENAI_API_KEY\n ? \"No manual rule matched and AI classifier was unavailable; left unchanged\"\n : \"No manual rule matched and AI classifier is not configured; left unchanged\",\n };\n}\n// --- OAUTH HELPERS ---\nfunction newToken() {\n return crypto.randomUUID();\n}\nfunction isAllowedEmail(email) {\n return ALLOWED_EMAILS.length === 0 || ALLOWED_EMAILS.includes(String(email || \"\").toLowerCase());\n}\nfunction setSessionCookie(c, sessionId) {\n setCookie(c, SESSION_COOKIE, sessionId, {\n path: \"/\",\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n maxAge: SESSION_MAX_AGE_SECONDS,\n });\n}\nfunction clearSessionCookie(c) {\n deleteCookie(c, SESSION_COOKIE, { path: \"/\" });\n}\nfunction setOAuthStateCookie(c, state) {\n setCookie(c, OAUTH_STATE_COOKIE, state, {\n path: \"/\",\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n maxAge: 600,\n });\n}\nfunction clearOAuthStateCookie(c) {\n deleteCookie(c, OAUTH_STATE_COOKIE, { path: \"/\" });\n}\nfunction getRedirectUri(c) {\n const url = new URL(c.req.url);\n return `${url.origin}/callback`;\n}\nasync function refreshAccessToken(refreshToken) {\n console.log(\"Refreshing access token...\");\n const res = await fetch(`https://login.microsoftonline.com/${TENANT_ID}/oauth2/v2.0/token`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n client_id: CLIENT_ID,\n client_secret: CLIENT_SECRET,\n grant_type: \"refresh_token\",\n refresh_token: refreshToken,\n }),\n });\n if (!res.ok) {\n const error = await res.text();\n console.error(\"Token refresh failed:\", error);\n throw new Error(`Failed to refresh token: ${error}`);\n }\n return await res.json();\n}\nasync function getStoredAuth(c) {\n const sessionId = getCookie(c, SESSION_COOKIE);\n if (!sessionId)\n return null;\n const res = await sqlite.execute({\n sql: \"SELECT * FROM gatekeeper_auth WHERE id = ? LIMIT 1\",\n args: [sessionId],\n });\n if (!res.rows || res.rows.length === 0)\n return null;\n const row = res.rows[0];\n const auth = {\n id: (Array.isArray(row) ? row[0] : row.id),\n access_token: (Array.isArray(row) ? row[1] : row.access_token),\n refresh_token: (Array.isArray(row) ? row[2] : row.refresh_token),\n expires_at: (Array.isArray(row) ? row[3] : row.expires_at),\n user_email: (Array.isArray(row) ? row[4] : row.user_email),\n };\n if (!isAllowedEmail(auth.user_email))\n return null;\n return auth;\n}\nasync function getValidToken(c) {\n const auth = await getStoredAuth(c);\n if (!auth) {\n console.warn(\"No auth session found in request cookies.\");\n return null;\n }\n if (Date.now() < auth.expires_at) {\n return auth.access_token;\n }\n if (auth.refresh_token) {\n const fresh = await refreshAccessToken(auth.refresh_token);\n const expiresAt = Date.now() + fresh.expires_in * 1000;\n await sqlite.execute({\n sql: \"UPDATE gatekeeper_auth SET access_token = ?, expires_at = ? WHERE id = ?\",\n args: [fresh.access_token, expiresAt, auth.id],\n });\n return fresh.access_token;\n }\n return null;\n}\nfunction isOwnEvent(event, auth) {\n const organizerAddress = String(event.organizer?.emailAddress?.address || \"\").toLowerCase();\n const userEmail = String(auth?.user_email || \"\").toLowerCase();\n return event.isOrganizer === true || Boolean(organizerAddress && userEmail && organizerAddress === userEmail);\n}\nfunction removeMutedPrefix(subject) {\n return String(subject || \"\").replace(/^(?:\\[Muted\\]\\s*)+/i, \"\").trim();\n}\nconst SCHEDULE_OPTIONS = [\n { minutes: 15, label: \"Every 15 minutes\" },\n { minutes: 30, label: \"Every 30 minutes\" },\n { minutes: 60, label: \"Hourly\" },\n { minutes: 120, label: \"Every 2 hours\" },\n { minutes: 360, label: \"Every 6 hours\" },\n { minutes: 1440, label: \"Daily\" },\n];\nfunction normalizeScheduleMinutes(value) {\n const numeric = Number(value);\n return SCHEDULE_OPTIONS.some((option) => option.minutes === numeric) ? numeric : 60;\n}\nfunction scheduleLabel(minutes) {\n return SCHEDULE_OPTIONS.find((option) => option.minutes === minutes)?.label || \"Hourly\";\n}\nfunction rowToAuth(row) {\n return {\n id: (Array.isArray(row) ? row[0] : row.id),\n access_token: (Array.isArray(row) ? row[1] : row.access_token),\n refresh_token: (Array.isArray(row) ? row[2] : row.refresh_token),\n expires_at: Number(Array.isArray(row) ? row[3] : row.expires_at),\n user_email: (Array.isArray(row) ? row[4] : row.user_email),\n };\n}\nasync function getSetting(key, fallback = \"\") {\n const res = await sqlite.execute({\n sql: \"SELECT value FROM gatekeeper_settings WHERE key = ? LIMIT 1\",\n args: [key],\n });\n if (!res.rows || res.rows.length === 0)\n return fallback;\n const row = res.rows[0];\n return String(Array.isArray(row) ? row[0] : row.value ?? fallback);\n}\nasync function setSetting(key, value) {\n await sqlite.execute({\n sql: `\n INSERT INTO gatekeeper_settings (key, value) VALUES (?, ?)\n ON CONFLICT(key) DO UPDATE SET value = excluded.value`,\n args: [key, String(value)],\n });\n}\nasync function getScheduleSettings() {\n const enabled = (await getSetting(\"schedule_enabled\", \"false\")) === \"true\";\n const intervalMinutes = normalizeScheduleMinutes(await getSetting(\"schedule_interval_minutes\", \"60\"));\n const lastRunAt = await getSetting(\"last_scheduled_sync_at\", \"\");\n const lastSummary = await getSetting(\"last_scheduled_sync_summary\", \"Not run yet\");\n return { enabled, intervalMinutes, lastRunAt, lastSummary };\n}\nfunction formatNycDateTime(value) {\n if (!value)\n return \"Not run yet\";\n const date = new Date(value);\n if (Number.isNaN(date.getTime()))\n return String(value);\n return new Intl.DateTimeFormat(\"en-US\", {\n month: \"numeric\",\n day: \"numeric\",\n year: \"numeric\",\n hour: \"numeric\",\n minute: \"2-digit\",\n timeZone: NYC_TIME_ZONE,\n timeZoneName: \"short\",\n }).format(date);\n}\nfunction nextScheduledRunText(schedule) {\n if (!schedule.enabled)\n return \"Automatic sync is off\";\n if (!schedule.lastRunAt)\n return \"Due on the next scheduler wake\";\n const next = new Date(new Date(schedule.lastRunAt).getTime() + schedule.intervalMinutes * 60 * 1000);\n if (Number.isNaN(next.getTime()))\n return \"Due on the next scheduler wake\";\n return formatNycDateTime(next.toISOString());\n}\nasync function getLatestAuth() {\n const res = await sqlite.execute(\"SELECT * FROM gatekeeper_auth ORDER BY expires_at DESC LIMIT 1\");\n if (!res.rows || res.rows.length === 0)\n return null;\n const auth = rowToAuth(res.rows[0]);\n return isAllowedEmail(auth.user_email) ? auth : null;\n}\nasync function getValidTokenForAuth(auth) {\n if (!auth)\n return null;\n if (Date.now() < auth.expires_at)\n return auth.access_token;\n if (!auth.refresh_token)\n return null;\n const fresh = await refreshAccessToken(auth.refresh_token);\n const expiresAt = Date.now() + fresh.expires_in * 1000;\n await sqlite.execute({\n sql: \"UPDATE gatekeeper_auth SET access_token = ?, expires_at = ? WHERE id = ?\",\n args: [fresh.access_token, expiresAt, auth.id],\n });\n return fresh.access_token;\n}\nasync function syncCalendarEvents(auth, token) {\n const now = new Date();\n const startRange = new Date(now.getTime() - SYNC_DAYS_BACK * 24 * 60 * 60 * 1000);\n const endRange = new Date(now.getTime() + SYNC_DAYS_FORWARD * 24 * 60 * 60 * 1000);\n const calendarUrl = new URL(\"https://graph.microsoft.com/v1.0/me/calendarView\");\n calendarUrl.searchParams.set(\"startDateTime\", startRange.toISOString());\n calendarUrl.searchParams.set(\"endDateTime\", endRange.toISOString());\n calendarUrl.searchParams.set(\"$orderby\", \"start/dateTime\");\n calendarUrl.searchParams.set(\"$top\", \"100\");\n const eventsRes = await fetch(calendarUrl, {\n headers: {\n Authorization: `Bearer ${token}`,\n Prefer: `outlook.timezone=\"${NYC_TIME_ZONE}\"`,\n },\n });\n if (!eventsRes.ok) {\n const errorText = await eventsRes.text();\n throw new Error(`Graph API Error: ${errorText}`);\n }\n const eventsData = await eventsRes.json();\n const events = eventsData.value || [];\n const rulesRes = await sqlite.execute(\"SELECT * FROM gatekeeper_rules\");\n const patterns = rulesRes.rows.map((r) => String(Array.isArray(r) ? r[1] : r.pattern).toLowerCase());\n let skippedOwn = 0;\n let skippedAlreadyMuted = 0;\n let processed = 0;\n let muted = 0;\n let kept = 0;\n for (const event of events) {\n const subject = event.subject || \"No Subject\";\n const eventTime = event.start?.dateTime || new Date().toISOString();\n if (isOwnEvent(event, auth)) {\n skippedOwn += 1;\n console.log(`Skipping own event without changes: \"${subject}\"`);\n continue;\n }\n if (event.isReminderOn === false) {\n skippedAlreadyMuted += 1;\n continue;\n }\n const { decision, reasoning } = await classifyEvent(event, patterns);\n processed += 1;\n if (decision === \"muted\")\n muted += 1;\n else\n kept += 1;\n console.log(`Syncing event: \"${subject}\" | Result: ${decision} | ${reasoning}`);\n await sqlite.execute({\n sql: `\n INSERT INTO gatekeeper_audit (id, subject, decision, reasoning, timestamp)\n VALUES (?, ?, ?, ?, ?)\n ON CONFLICT(id) DO UPDATE SET\n subject = excluded.subject,\n decision = excluded.decision,\n reasoning = excluded.reasoning,\n timestamp = excluded.timestamp`,\n args: [event.id, subject, decision, reasoning, eventTime],\n });\n if (decision === \"muted\") {\n await fetch(`https://graph.microsoft.com/v1.0/me/events/${event.id}`, {\n method: \"PATCH\",\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n isReminderOn: false,\n }),\n });\n }\n }\n return { ok: true, total: events.length, processed, muted, kept, skippedOwn, skippedAlreadyMuted };\n}\nexport async function scheduledSyncTick(interval = {}) {\n await ensureTables();\n const schedule = await getScheduleSettings();\n if (!schedule.enabled) {\n return { ok: true, skipped: \"schedule disabled\" };\n }\n const now = Date.now();\n const lastRunTime = schedule.lastRunAt ? new Date(schedule.lastRunAt).getTime() : 0;\n if (lastRunTime && now - lastRunTime < schedule.intervalMinutes * 60 * 1000) {\n return { ok: true, skipped: \"not due\", nextRunAt: nextScheduledRunText(schedule) };\n }\n const auth = await getLatestAuth();\n if (!auth) {\n await setSetting(\"last_scheduled_sync_summary\", \"No authenticated Microsoft session available\");\n return { ok: false, skipped: \"no auth\" };\n }\n const token = await getValidTokenForAuth(auth);\n if (!token) {\n await setSetting(\"last_scheduled_sync_summary\", \"Microsoft token unavailable; log in again\");\n return { ok: false, skipped: \"no token\" };\n }\n const result = await syncCalendarEvents(auth, token);\n const finishedAt = new Date().toISOString();\n await setSetting(\"last_scheduled_sync_at\", finishedAt);\n await setSetting(\"last_scheduled_sync_summary\", `Reviewed ${result.total}; alerts off ${result.muted}; kept ${result.kept}; skipped own ${result.skippedOwn}`);\n return { ...result, scheduled: true, finishedAt, intervalLastRunAt: interval?.lastRunAt?.toISOString?.() || \"\" };\n}\n// --- UI COMPONENTS ---\nconst Layout = (content, authenticated = false) => `\n \n \n \n Outlook Gatekeeper (OAuth)\n \n \n \n \n \n

\n \n ${content}\n

\n \n

${escapeHtml(auth.user_email || \"Authenticated\")}

Calendar Sync Log

Review what Gatekeeper kept, where it turned alerts off, and why. Times are shown in New York time.

\n \n \n ${OPENAI_API_KEY ? \"AI\" : \"Manual\"} classifier\n \n \n \n NYC time\n \n \n

${auditRows.length}Logged events

${mutedCount}Alerts off

${keptCount}Kept

${rulesRows.length}Rules

\n \n \n \n \n \n ${auditRows.length ? auditRows.map((row) => {\n const decision = displayDecision(row.decision);\n return `\n \n \n \n \n \n `;\n }).join(\"\") : \"\"}\n \n

Event Time	Subject	Result	Why
${formatNycEventTime(row.timestamp)}	${escapeHtml(row.subject \|\| \"No Subject\")}	${decision.label}	${escapeHtml(displayReason(row.reasoning))}
No events processed yet.

\n ${auditRows.length ? auditRows.map((row) => {\n const decision = displayDecision(row.decision);\n return `\n

\n ${formatNycEventTime(row.timestamp)}\n ${decision.label}\n

${escapeHtml(row.subject || \"No Subject\")}

${escapeHtml(displayReason(row.reasoning))}

`;\n }).join(\"\") : `

No events processed yet.

`}\n

\n\n

Alert Rules

Personal blockers stay quiet.

Manual phrases run before AI. Current classifier: ${aiStatus}

Latest logged event: ${escapeHtml(latestEventTime)}

Add rule

Use short phrases for cases where reminders should be disabled.

\n \n

${escapeHtml(row.pattern)}remove
No manual rules

Gatekeeper is waiting.

Calendar Sync Log

${escapeHtml(row.subject || \"No Subject\")}

Personal blockers stay quiet.

Add rule

Gatekeeper is waiting.

Calendar Sync Log

${escapeHtml(row.subject || \"No Subject\")}

Personal blockers stay quiet.

Add rule

Diff · v61