setting, session and profile fix

backend/tests/test_email_helpers.py

@@ -1,8 +1,16 @@
+import base64
 from datetime import datetime, timezone
 
 from bson import ObjectId
 
-from app.routers.emails import decode_cursor, encode_cursor, summarize
+from app.routers.emails import (
+    decode_cursor,
+    decode_outbound_attachments,
+    encode_cursor,
+    sanitize_attachment_filename,
+    summarize,
+)
+from app.schemas import EmailAttachmentCreate
 
 
 def test_cursor_round_trip_preserves_sort_key():
@@ -56,3 +64,30 @@ def test_summary_uses_account_mailbox_read_state():
     assert result.is_read is False
     assert result.mailbox == "inbox"
     assert result.snippet == "A short preview"
+
+
+def test_sanitize_attachment_filename_strips_paths():
+    assert sanitize_attachment_filename("../../secret.pdf") == "secret.pdf"
+
+
+def test_decode_outbound_attachments_splits_inline_and_files():
+    pdf = EmailAttachmentCreate(
+        filename="invoice.pdf",
+        content_type="application/pdf",
+        content_base64=base64.b64encode(b"%PDF-1.4").decode(),
+        disposition="attachment",
+    )
+    image = EmailAttachmentCreate(
+        filename="logo.png",
+        content_type="image/png",
+        content_base64=base64.b64encode(b"PNG").decode(),
+        disposition="inline",
+        content_id="logo@agmail",
+    )
+
+    inline_parts, files, metadata = decode_outbound_attachments([pdf, image])
+
+    assert [part.filename for part in files] == ["invoice.pdf"]
+    assert [part.filename for part in inline_parts] == ["logo.png"]
+    assert metadata[0]["size"] == 8
+    assert metadata[1]["disposition"] == "inline"