From 903b0f4985947d4668b8a347b702574d7474c8cf Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 25 Sep 2026 16:33:06 -0400
Subject: [PATCH] fix(portal): address review feedback

---
 src/shared/shared/side_effects.py |  3 ++-
 tests/shared/test_blocks.py       | 23 +++++++++++++++++++++++
 tests/shared/test_portal_ops.py   |  1 +
 3 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/src/shared/shared/side_effects.py b/src/shared/shared/side_effects.py
index 6576d3d..8f5fd51 100644
--- a/src/shared/shared/side_effects.py
+++ b/src/shared/shared/side_effects.py
@@ -15,6 +15,7 @@ from shared.blocks import (
     build_holiday_added_blocks,
     build_pickup_request_blocks,
     build_shift_change_message,
+    _mrkdwn_text,
     build_swap_request_blocks,
     build_week_schedule,
 )
@@ -278,7 +279,7 @@ def dm_swap_request(
         return False
     text = f"{requester_name} wants to swap you the {date_str} shift"
     if note:
-        text += f"\nNote: {note}"
+        text += f"\nNote: {_mrkdwn_text(note)}"
     return slack_call(
         "chat.postMessage",
         token,
diff --git a/tests/shared/test_blocks.py b/tests/shared/test_blocks.py
index 01bc392..70274b2 100644
--- a/tests/shared/test_blocks.py
+++ b/tests/shared/test_blocks.py
@@ -268,6 +268,29 @@ class TestBuildSwapRequestBlocks:
         assert ids == ["swap_accept_2026-06-03", "swap_decline_2026-06-03"]
 
 
+def test_dm_swap_fallback_escapes_the_note(monkeypatch):
+    from shared import side_effects as effects
+
+    captured = {}
+
+    def fake_slack_call(_method, _token, **kwargs):
+        captured.update(kwargs)
+        return True
+
+    monkeypatch.setattr(effects, "slack_call", fake_slack_call)
+    assert effects.dm_swap_request(
+        "tok",
+        "U_REQ",
+        "U_TGT",
+        "2026-06-03",
+        "night",
+        "Alice",
+        note="ping <@U_ADMIN>",
+    )
+    assert "Note: ping &lt;@U_ADMIN&gt;" in captured["text"]
+    assert "<@U_ADMIN>" not in captured["text"]
+
+
 class TestBuildSwapResolvedBlocks:
     def test_renders_text_no_buttons(self):
         blocks = build_swap_resolved_blocks("All done.")
diff --git a/tests/shared/test_portal_ops.py b/tests/shared/test_portal_ops.py
index 6f3f803..3eda8f2 100644
--- a/tests/shared/test_portal_ops.py
+++ b/tests/shared/test_portal_ops.py
@@ -133,6 +133,7 @@ def test_swap_rejects_non_string_note(schedule, seed, quiet_slack):
         with pytest.raises(ActionError) as err:
             swap(schedule, employee, "2026-06-12", "115", "night", note=12)
     assert err.value.code == "INVALID_NOTE"
+    assert schedule.get_swap("2026-06-12", "night") is None
 
 
 def test_late_pickup_creates_request(schedule, seed, quiet_slack):