@remit/account-worker 0.0.33 → 0.0.35

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/account-worker",
-  "version": "0.0.33",
+  "version": "0.0.35",
   "type": "module",
   "main": "dist/index.js",
   "exports": {
@@ -37,6 +37,7 @@
     "dev": "node --import tsx src/poller.ts"
   },
   "dependencies": {
+    "@remit/auth-service": "*",
     "@remit/logger": "*",
     "@remit/data-ports": "*",
     "@remit/logger-lambda": "*",
@@ -47,6 +48,7 @@
     "@remit/electrodb-entities": "*",
     "@aws-sdk/client-sqs": "^3.1090.0",
     "archiver": "^8.0.0",
+    "drizzle-orm": "^0.45.2",
     "electrodb": "^3.9.1",
     "expect-env": "^1.0.1",
     "@types/archiver": "^8.0.0",
@@ -54,6 +56,7 @@
   },
   "devDependencies": {
     "@aws-sdk/core": "*",
+    "better-sqlite3": "^12.11.1",
     "esbuild": "^0.28.1"
   },
   "license": "MIT",

package/src/cascade.ts

@@ -46,7 +46,30 @@ export interface CascadeServices {
 	messageLabelService: IMessageLabelRepository;
 }
 
-export const cascadeServicesOf = (client: RemitClient): CascadeServices => ({
+export type CascadeRepositories = Pick<
+	RemitClient,
+	| "accountConfig"
+	| "account"
+	| "address"
+	| "mailbox"
+	| "message"
+	| "messageFlag"
+	| "envelope"
+	| "outboxMessage"
+	| "threadMessage"
+	| "mailboxLock"
+	| "placementMove"
+	| "flagPush"
+	| "accountExportRequest"
+	| "accountSetting"
+	| "filter"
+	| "label"
+	| "messageLabel"
+>;
+
+export const cascadeServicesOf = (
+	client: CascadeRepositories,
+): CascadeServices => ({
 	accountConfigService: client.accountConfig,
 	accountService: client.account,
 	addressService: client.address,

package/src/compose-relational.auth.test.ts

@@ -0,0 +1,150 @@
+import assert from "node:assert/strict";
+import { mkdtemp } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { before, describe, it } from "node:test";
+import { fileURLToPath } from "node:url";
+import { type Auth, createAuth } from "@remit/auth-service";
+import { auth_session, auth_user } from "@remit/auth-service/schema";
+import { noopLogger } from "@remit/logger";
+import Database from "better-sqlite3";
+import { drizzle } from "drizzle-orm/better-sqlite3";
+import { migrate } from "drizzle-orm/better-sqlite3/migrator";
+import { integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+import { buildRelationalDeletionCapabilities } from "./compose-relational.js";
+
+const ORIGIN = "https://reader.remit.test";
+const PASSWORD = "correct horse battery staple";
+
+const MIGRATIONS = new URL(
+	"../../../deploy/vps/migrations-sqlite/",
+	import.meta.url,
+);
+
+const mcpDeviceCode = sqliteTable("mcp_device_code", {
+	id: text("id").primaryKey(),
+	deviceCode: text("device_code").notNull(),
+	userCode: text("user_code").notNull(),
+	userId: text("user_id"),
+	expiresAt: integer("expires_at", { mode: "timestamp_ms" }).notNull(),
+	status: text("status").notNull(),
+});
+
+interface SignedUp {
+	userId: string;
+	cookie: string;
+}
+
+const signUp = async (auth: Auth, email: string): Promise<SignedUp> => {
+	const response = await auth.api.signUpEmail({
+		body: { email, password: PASSWORD, name: email },
+		asResponse: true,
+	});
+	assert.equal(response.status, 200);
+	const { user } = (await response.json()) as { user: { id: string } };
+	const cookie = response.headers
+		.getSetCookie()
+		.map((value) => value.split(";")[0])
+		.join("; ");
+	return { userId: user.id, cookie };
+};
+
+const tokenStatus = async (auth: Auth, cookie: string): Promise<number> =>
+	(
+		await auth.handler(
+			new Request(`${ORIGIN}/api/auth/token`, { headers: { cookie } }),
+		)
+	).status;
+
+describe("relational deletion capabilities — login user erase", () => {
+	let filename: string;
+	let auth: Auth;
+	let erased: SignedUp;
+	let kept: SignedUp;
+
+	const rowsOf = (): {
+		users: string[];
+		sessionUsers: string[];
+		deviceCodeUsers: (string | null)[];
+	} => {
+		const sqlite = new Database(filename, { readonly: true });
+		const db = drizzle(sqlite);
+		const users = db
+			.select({ id: auth_user.id })
+			.from(auth_user)
+			.all()
+			.map((row) => row.id);
+		const sessionUsers = db
+			.select({ userId: auth_session.userId })
+			.from(auth_session)
+			.all()
+			.map((row) => row.userId);
+		const deviceCodeUsers = db
+			.select({ userId: mcpDeviceCode.userId })
+			.from(mcpDeviceCode)
+			.all()
+			.map((row) => row.userId);
+		sqlite.close();
+		return { users, sessionUsers, deviceCodeUsers };
+	};
+
+	before(async () => {
+		const dir = await mkdtemp(join(tmpdir(), "remit-relational-auth-"));
+		filename = join(dir, "app.db");
+		process.env.SQLITE_APP_DB_PATH = filename;
+		process.env.SQLITE_MAIL_DB_PATH = join(dir, "mail.db");
+		process.env.SQLITE_SEARCH_DB_PATH = join(dir, "search.db");
+
+		const migrating = new Database(filename);
+		migrating.pragma("journal_mode = WAL");
+		migrating.pragma("foreign_keys = ON");
+		for (const set of ["app", "mcp"]) {
+			migrate(drizzle(migrating), {
+				migrationsFolder: fileURLToPath(new URL(set, MIGRATIONS)),
+				migrationsTable: `__drizzle_migrations_${set}`,
+			});
+		}
+		migrating.close();
+
+		auth = await createAuth({
+			connectionString: filename,
+			secret: "relational-auth-secret-0123456789abcdef",
+			baseURL: ORIGIN,
+			selfSignUpEnabled: true,
+		});
+		erased = await signUp(auth, "erased@remit.test");
+		kept = await signUp(auth, "kept@remit.test");
+
+		const seeding = new Database(filename);
+		drizzle(seeding)
+			.insert(mcpDeviceCode)
+			.values(
+				[erased, kept].map(({ userId }) => ({
+					id: userId,
+					deviceCode: `device-${userId}`,
+					userCode: `user-${userId}`,
+					userId,
+					expiresAt: new Date(Date.now() + 600_000),
+					status: "approved",
+				})),
+			)
+			.run();
+		seeding.close();
+	});
+
+	it("deletes the user, its sessions and device codes, and refuses the old session cookie", async () => {
+		assert.equal(await tokenStatus(auth, erased.cookie), 200);
+
+		await buildRelationalDeletionCapabilities().signOut(
+			erased.userId,
+			noopLogger,
+		);
+
+		const { users, sessionUsers, deviceCodeUsers } = rowsOf();
+		assert.deepEqual(users, [kept.userId]);
+		assert.deepEqual(sessionUsers, [kept.userId]);
+		assert.deepEqual(deviceCodeUsers, [kept.userId]);
+		assert.equal(await tokenStatus(auth, erased.cookie), 401);
+		assert.equal(await tokenStatus(auth, kept.cookie), 200);
+	});
+});

package/src/compose-relational.ts

@@ -1,67 +1,48 @@
-import { rm } from "node:fs/promises";
-import { join } from "node:path";
+import { auth_user } from "@remit/auth-service/schema";
 import {
-	type CascadeDeleter,
-	createSqliteCascadeDeleter,
+	BETTER_SQLITE3_LIMITS,
+	openSqliteDatabases,
+	runDrizzleAccountConfigErase,
+	runDrizzleCascadeDelete,
+	type SqliteStores,
 	sqliteDatabasePathsFromEnv,
+	syncStores,
 } from "@remit/drizzle-service";
 import type { Logger } from "@remit/logger";
+import { createFilesystemStorageService } from "@remit/storage-service/filesystem";
+import { eq } from "drizzle-orm";
 import type { DeletionCapabilities } from "./deletion-capabilities.js";
 
-// Mirrors `@remit/storage-service`'s filesystem-backend default: bodies
-// live under `STORAGE_LOCAL_PATH` (`.remit/storage` when unset). The cascade
-// deletes the same `accounts/{accountConfigId}/…` key prefixes the S3 backend
-// would, translated to a recursive directory removal.
-const storageBasePath = (): string =>
-	process.env.STORAGE_LOCAL_PATH ?? ".remit/storage";
-
-/**
- * Recursively remove every stored object under a key prefix. Replay-safe:
- * `force: true` swallows a missing directory (ENOENT), matching the S3 backend's
- * "delete on missing keys is a 200" idempotency.
- */
 const deleteStoragePrefix = async (
 	keyPrefix: string,
 	log: Logger,
 ): Promise<void> => {
-	const target = join(storageBasePath(), keyPrefix);
-	await rm(target, { recursive: true, force: true });
-	log.info({ keyPrefix, target }, "Filesystem storage prefix cleanup complete");
+	await createFilesystemStorageService(
+		process.env.STORAGE_LOCAL_PATH ?? ".remit/storage",
+	).deletePrefix(keyPrefix);
+	log.info({ keyPrefix }, "Storage prefix cleanup complete");
 };
 
-// The Drizzle cascade deleter is opened once, on first use, and reused: it
-// opens the app, mail and search databases (the native binding loads there,
-// hence async). Built lazily so the fanout worker — which signs out but never
-// cascade-deletes — does not open a database handle it will not use.
-let deleterPromise: Promise<CascadeDeleter> | undefined;
+// The app, mail and search databases are opened once, on first use, and
+// shared by every delete (the native binding loads there, hence async). Built
+// lazily so a worker that never deletes does not open a database handle.
+let storesPromise: Promise<SqliteStores> | undefined;
 
-const getDeleter = (): Promise<CascadeDeleter> => {
-	if (!deleterPromise)
-		deleterPromise = createSqliteCascadeDeleter(sqliteDatabasePathsFromEnv());
-	return deleterPromise;
+const getStores = (): Promise<SqliteStores> => {
+	storesPromise ??= openSqliteDatabases(sqliteDatabasePathsFromEnv()).then(
+		(databases) => syncStores(databases, BETTER_SQLITE3_LIMITS),
+	);
+	return storesPromise;
 };
 
-/**
- * The self-host stack's deletion capabilities (RFC 035/036).
- *
- * - `signOut`: no-op. Deleting the AccountConfig row severs the session's
- *   account→data resolution, and there is no federated session store to sign
- *   out of; better-auth session rows are owned by the auth service, outside this
- *   worker's data seam.
- * - `invalidateContent`: no-op. Caddy proxies `/content/*` straight to the
- *   backend with no response cache (`deploy/vps/caddy/routes.caddy`), so there
- *   is nothing to invalidate.
- * - `deleteStoragePrefix`: recursive filesystem removal.
- * - `cascadeDelete`: the Drizzle cascade over SQLite.
- */
 export const buildRelationalDeletionCapabilities =
 	(): DeletionCapabilities => ({
 		assertReady: async () => {},
 		signOut: async (userId, log) => {
-			log.info(
-				{ userId },
-				"Sign-out is a no-op on the relational backend; AccountConfig removal severs session data access",
-			);
+			await (await getStores()).app.db
+				.delete(auth_user)
+				.where(eq(auth_user.id, userId));
+			log.info({ userId }, "Auth user erased");
 		},
 		invalidateContent: async (contentPrefix, log) => {
 			log.info(
@@ -71,8 +52,8 @@ export const buildRelationalDeletionCapabilities =
 		},
 		deleteStoragePrefix: (keyPrefix, log) =>
 			deleteStoragePrefix(keyPrefix, log),
-		cascadeDelete: async (entities, log) => {
-			const deleter = await getDeleter();
-			await deleter(entities, log);
-		},
+		cascadeDelete: async (entities, log) =>
+			runDrizzleCascadeDelete(await getStores(), entities, log),
+		eraseAccountConfig: async (accountConfigId, log) =>
+			runDrizzleAccountConfigErase(await getStores(), accountConfigId, log),
 	});

package/src/deletion-port.ts

@@ -1,25 +1,6 @@
 import type { Logger } from "@remit/logger";
 import type { CascadeEntity } from "./cascade.js";
 
-/**
- * The four steps of the deletion cascade that vary by deployment. Everything
- * else — enumerating the AccountConfig's rows, the FIFO purge orchestration, the
- * queue sends — is backend-neutral and lives in the handlers unchanged.
- *
- * Two composition roots build this:
- *
- * - The DynamoDB composition (AWS custody stack): Cognito global sign-out,
- *   CloudFront invalidation, raw-S3 prefix delete, DynamoDB `BatchWriteItem`
- *   cascade. Byte-for-byte the pre-split behavior. It imports the AWS SDK /
- *   ElectroDB graph and lives outside this shared, open-core module; it is
- *   injected here through `setDeletionCapabilities` so that graph never reaches
- *   the relational tree.
- * - `compose-relational.ts` (self-host stack, RFC 035/036): no-op sign-out
- *   (deleting the AccountConfig severs the session's data resolution; there is
- *   no CDN to sign out of), no-op invalidation (Caddy proxies `/content/*`
- *   straight to the backend with no cache), filesystem prefix delete, and the
- *   Drizzle cascade over SQLite.
- */
 export interface DeletionCapabilities {
 	/**
 	 * Validate every precondition the destructive steps depend on, BEFORE any row
@@ -29,10 +10,6 @@ export interface DeletionCapabilities {
 	 * Relational is a no-op — its steps carry no such deploy-time configuration.
 	 */
 	assertReady(log: Logger): Promise<void>;
-	/**
-	 * Invalidate the deleted user's active auth sessions. AWS: Cognito
-	 * `AdminUserGlobalSignOut`. Relational: no-op.
-	 */
 	signOut(userId: string, log: Logger): Promise<void>;
 	/**
 	 * Purge any CDN/edge cache under a tenant/account content prefix
@@ -52,4 +29,9 @@ export interface DeletionCapabilities {
 	 * through its repository as the cascade-in-progress marker.
 	 */
 	cascadeDelete(entities: CascadeEntity[], log: Logger): Promise<void>;
+	/**
+	 * Remove every row an account config owns except the AccountConfig row,
+	 * which the caller deletes last. Relational: one keyed delete per table.
+	 */
+	eraseAccountConfig(accountConfigId: string, log: Logger): Promise<void>;
 }

package/src/handlers/account-delete.test.ts

@@ -0,0 +1,137 @@
+import assert from "node:assert/strict";
+import { mkdir, mkdtemp, stat, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { after, before, describe, it } from "node:test";
+import { recordingQueue } from "@remit/data-ports/recording-queue";
+import {
+	BETTER_SQLITE3_LIMITS,
+	composeSqliteRepositories,
+	messageObjectsInMemory,
+	openSqliteDatabases,
+	syncStores,
+} from "@remit/drizzle-service";
+import { createShippedSqliteFiles } from "@remit/drizzle-service/test-sqlite";
+import { noopLogger } from "@remit/logger";
+import { cascadeServicesOf } from "../cascade.js";
+import { buildRelationalDeletionCapabilities } from "../compose-relational.js";
+import type { AccountDeleteFinalizeEvent } from "../events.js";
+import {
+	finalizeAccountDelete,
+	processAccountDelete,
+} from "./account-delete.js";
+
+const exists = (path: string): Promise<boolean> =>
+	stat(path).then(
+		() => true,
+		() => false,
+	);
+
+const writeUnder = async (base: string, key: string): Promise<string> => {
+	const full = join(base, key);
+	await mkdir(dirname(full), { recursive: true });
+	await writeFile(full, "x");
+	return full;
+};
+
+describe("account delete on a host that runs the finalize step from its own queue", () => {
+	const previousStoragePath = process.env.STORAGE_LOCAL_PATH;
+	let directory: string;
+	let close: () => Promise<void>;
+	let repositories: ReturnType<typeof composeSqliteRepositories>;
+
+	before(async () => {
+		directory = await mkdtemp(join(tmpdir(), "remit-account-delete-"));
+		process.env.STORAGE_LOCAL_PATH = join(directory, "storage");
+		const databases = await openSqliteDatabases(
+			createShippedSqliteFiles(directory),
+		);
+		close = databases.close;
+		repositories = composeSqliteRepositories(
+			syncStores(databases, BETTER_SQLITE3_LIMITS),
+			messageObjectsInMemory(),
+		);
+	});
+
+	after(async () => {
+		await close();
+		if (previousStoragePath === undefined)
+			delete process.env.STORAGE_LOCAL_PATH;
+		else process.env.STORAGE_LOCAL_PATH = previousStoragePath;
+	});
+
+	it("signs out, queues the finalize step, and the finalize step erases the tenant", async () => {
+		const accountConfig = await repositories.accountConfig.create({
+			userId: "user000000000000000000001",
+		});
+		const { accountConfigId } = accountConfig;
+		await repositories.accountExportRequest.create({
+			accountConfigId,
+			userId: accountConfig.userId,
+			state: "Ready",
+		});
+		await repositories.label.create({ accountConfigId, name: "Receipts" });
+		const storage = process.env.STORAGE_LOCAL_PATH ?? "";
+		const stored = [
+			await writeUnder(storage, `accounts/${accountConfigId}/a/body.eml`),
+			await writeUnder(storage, `exports/${accountConfigId}/e/export.zip`),
+		];
+
+		const services = cascadeServicesOf(repositories);
+		const capabilities = buildRelationalDeletionCapabilities();
+		const queue = recordingQueue();
+		const signedOut: string[] = [];
+
+		await processAccountDelete(
+			{ type: "AccountDelete", accountConfigId, userId: "auth-user-1" },
+			noopLogger,
+			{
+				services,
+				signOut: async (userId) => {
+					signedOut.push(userId);
+				},
+				enqueueFinalize: (event) => queue.send({ body: event }),
+			},
+		);
+		assert.deepEqual(signedOut, ["auth-user-1"]);
+		const [queued] = queue.sent;
+		assert.deepEqual(queued?.body, {
+			type: "FinalizeAccountDelete",
+			accountConfigId,
+		});
+
+		const finalize: AccountDeleteFinalizeEvent = {
+			type: "FinalizeAccountDelete",
+			accountConfigId,
+		};
+		await finalizeAccountDelete(finalize, noopLogger, {
+			services,
+			capabilities,
+		});
+
+		assert.deepEqual(
+			await repositories.accountConfig.get([accountConfigId]),
+			[],
+		);
+		assert.deepEqual(
+			(
+				await repositories.accountExportRequest.listByAccountConfig(
+					accountConfigId,
+				)
+			).items,
+			[],
+		);
+		assert.deepEqual(
+			await repositories.label.listByAccountConfig(accountConfigId),
+			[],
+		);
+		for (const path of stored) {
+			assert.equal(await exists(path), false, `${path} must be deleted`);
+		}
+
+		await finalizeAccountDelete(finalize, noopLogger, {
+			services,
+			capabilities,
+		});
+	});
+});

package/src/handlers/account-delete.ts

@@ -0,0 +1,64 @@
+import type { Logger } from "@remit/logger";
+import type { CascadeServices } from "../cascade.js";
+import type { DeletionCapabilities } from "../deletion-port.js";
+import type {
+	AccountDeleteEvent,
+	AccountDeleteFinalizeEvent,
+} from "../events.js";
+
+export interface AccountDeleteDeps {
+	services: CascadeServices;
+	signOut: DeletionCapabilities["signOut"];
+	enqueueFinalize: (event: AccountDeleteFinalizeEvent) => Promise<void>;
+}
+
+export const processAccountDelete = async (
+	event: AccountDeleteEvent,
+	log: Logger,
+	{ services, signOut, enqueueFinalize }: AccountDeleteDeps,
+): Promise<void> => {
+	const { accountConfigId } = event;
+	const [accountConfig] = await services.accountConfigService.get([
+		accountConfigId,
+	]);
+	if (accountConfig === undefined) {
+		log.info({ accountConfigId }, "AccountConfig already erased — no-op");
+		return;
+	}
+
+	await signOut(event.userId, log);
+	await enqueueFinalize({ type: "FinalizeAccountDelete", accountConfigId });
+	log.info({ accountConfigId }, "Enqueued finalize event");
+};
+
+export interface AccountDeleteFinalizeDeps {
+	services: CascadeServices;
+	capabilities: DeletionCapabilities;
+}
+
+/**
+ * The AccountConfig row is deleted last: while it exists, a replay finds it
+ * and runs the whole erase again.
+ */
+export const finalizeAccountDelete = async (
+	event: AccountDeleteFinalizeEvent,
+	log: Logger,
+	{ services, capabilities }: AccountDeleteFinalizeDeps,
+): Promise<void> => {
+	const { accountConfigId } = event;
+	const [accountConfig] = await services.accountConfigService.get([
+		accountConfigId,
+	]);
+	if (accountConfig === undefined) {
+		log.info({ accountConfigId }, "Account erase already complete — no-op");
+		return;
+	}
+
+	await capabilities.assertReady(log);
+	await capabilities.invalidateContent(accountConfigId, log);
+	await capabilities.eraseAccountConfig(accountConfigId, log);
+	await capabilities.deleteStoragePrefix(`accounts/${accountConfigId}/`, log);
+	await capabilities.deleteStoragePrefix(`exports/${accountConfigId}/`, log);
+	await services.accountConfigService.delete(accountConfigId);
+	log.info({ accountConfigId }, "AccountConfig deleted; erase complete");
+};