fix(provider-microsoft): cast contentId on polymorphic attachment $select (fixes #59)

[stevenobiajulu]

Summary

Fix the regression introduced by #56 — getMessage() throws HTTP 400 on every Outlook message because contentId is rejected by $select against the polymorphic microsoft.graph.attachment base. Cast the field to microsoft.graph.fileAttachment/contentId and rebuild the broken tests on a tiny schema-validating mock.

Fixes #59.

What changed

Source (packages/provider-microsoft/src/email-graph-provider.ts)

• One-line fix: ATTACHMENT_SELECT now uses microsoft.graph.fileAttachment/contentId. No other source edits — the existing 400 fallback stays as defensive infra for unrelated 400s and now uses a valid select string.
• Doc-link comment block above the constant pointing at the Graph attachment and fileAttachment resource docs.

Tests (packages/provider-microsoft/src/email-graph-provider.test.ts)

• Added an inlined createSchemaValidatingClient helper that validates $select fragments against an explicit allow-list (base attachment props + approved type casts) and throws a Graph-realistic GraphApiError(400) for invalid fields. Narrow allow-list (not a regex) so typos like fileAttachment/notARealProp fail fast.
• Converted the three getMessage/getThread tests that hard-coded the broken URL (lines 99, 159/164, and 793 on main) to use the validating client. PR fix(provider-microsoft): populate attachments on getMessage (fixes #55) #56's bare-contentId string would now fail at unit-test time.
• grep -n 'isInline,contentId' email-graph-provider.test.ts returns zero hits.

Why this would have caught #56

PR #56's tests asserted the literal broken URL with vi.fn().mockResolvedValue(...). The mock returned whatever object the test handed it — no OData validation — so the wrong-string-as-spec passed. The new validating client checks every URL passed to .get() against the allow-list before delegating to the response queue, so the same regression now throws an unhandled GraphApiError 400 in unit tests.

Test plan

• npm run build
• npm run lint --workspaces --if-present
• npm run check:spec-coverage (186/186 scenarios)
• npm run test:run (538 tests pass across 4 workspaces)
• Live Graph smoke — GET /me/messages/{id}?$expand=attachments($select=…microsoft.graph.fileAttachment/contentId) returns HTTP 200 with contentId populated.
• Built-provider end-to-end — imported dist/email-graph-provider.js, ran getMessage() against a real Outlook message with attachments, confirmed attachments[0].contentId is a non-empty string.

Out of scope (follow-up)

• A CI-runnable contract test that sweeps every $select constructed by GraphEmailProvider through an extended schema validator.
• A live-Graph integration job in CI.

Refs

• https://learn.microsoft.com/en-us/graph/api/resources/attachment
• https://learn.microsoft.com/en-us/graph/api/resources/fileattachment
• https://learn.microsoft.com/en-us/graph/query-parameters#select-parameter

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!