fix: omit the base path prefix when it resolves to the root

A caller passing basePath '/' produced //api/email/..., which a browser reads as a protocol-relative URL rather than a path. Strip the slashes first and only add a prefix when something is left.

.changeset/fix-cid-attachment-url.md

@@ -7,4 +7,5 @@ Fix the URL that `replaceCidReferences` rewrites inline (CID) attachments to. It
 built `/email/:id/attachment/:file`, which matches no route: the attachment is
 served from `/api/email/:id/attachment/:file`, under the configured base path.
 The URL is now root-relative and includes both parts, so it resolves at the root
-and under a subpath such as `/mail`.
+and under a subpath such as `/mail`. A base path that resolves to the root (`/`)
+adds no prefix, so it can no longer produce a protocol-relative `//api/email/...`.

packages/smtp/src/__tests__/sanitize.test.ts

@@ -122,6 +122,20 @@ describe('replaceCidReferences', () => {
     }
   })
 
+  it('should treat basePath "/" as no prefix', () => {
+    const html = '<img src="cid:image123">'
+    const attachments = [{ contentId: 'image123', generatedFileName: 'abc.png' }]
+    const result = replaceCidReferences(html, 'email1', attachments, undefined, '/')
+    expect(result).toContain('src="/api/email/email1/attachment/abc.png"')
+  })
+
+  it('should combine baseUrl and basePath', () => {
+    const html = '<img src="cid:image123">'
+    const attachments = [{ contentId: 'image123', generatedFileName: 'abc.png' }]
+    const result = replaceCidReferences(html, 'email1', attachments, 'example.com', '/mail')
+    expect(result).toContain('src="//example.com/mail/api/email/email1/attachment/abc.png"')
+  })
+
   it('should replace multiple cid references', () => {
     const html = '<img src="cid:img1"><img src="cid:img2">'
     const attachments = [

packages/smtp/src/sanitize.ts

@@ -94,7 +94,8 @@ function buildAttachmentUrl(
   basePath?: string
 ): string {
   const base = baseUrl ? `//${baseUrl}` : ''
-  const prefix = basePath ? `/${basePath.replace(/^\/|\/$/g, '')}` : ''
+  const segments = basePath ? basePath.replace(/^\/+|\/+$/g, '') : ''
+  const prefix = segments ? `/${segments}` : ''
   return `${base}${prefix}/api/email/${emailId}/attachment/${encodeURIComponent(filename)}`
 }