@remit/account-worker 0.0.34 → 0.0.35

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/account-worker",
-  "version": "0.0.34",
+  "version": "0.0.35",
   "type": "module",
   "main": "dist/index.js",
   "exports": {
@@ -37,6 +37,7 @@
     "dev": "node --import tsx src/poller.ts"
   },
   "dependencies": {
+    "@remit/auth-service": "*",
     "@remit/logger": "*",
     "@remit/data-ports": "*",
     "@remit/logger-lambda": "*",
@@ -47,6 +48,7 @@
     "@remit/electrodb-entities": "*",
     "@aws-sdk/client-sqs": "^3.1090.0",
     "archiver": "^8.0.0",
+    "drizzle-orm": "^0.45.2",
     "electrodb": "^3.9.1",
     "expect-env": "^1.0.1",
     "@types/archiver": "^8.0.0",
@@ -54,6 +56,7 @@
   },
   "devDependencies": {
     "@aws-sdk/core": "*",
+    "better-sqlite3": "^12.11.1",
     "esbuild": "^0.28.1"
   },
   "license": "MIT",

package/src/compose-relational.auth.test.ts

@@ -0,0 +1,150 @@
+import assert from "node:assert/strict";
+import { mkdtemp } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { before, describe, it } from "node:test";
+import { fileURLToPath } from "node:url";
+import { type Auth, createAuth } from "@remit/auth-service";
+import { auth_session, auth_user } from "@remit/auth-service/schema";
+import { noopLogger } from "@remit/logger";
+import Database from "better-sqlite3";
+import { drizzle } from "drizzle-orm/better-sqlite3";
+import { migrate } from "drizzle-orm/better-sqlite3/migrator";
+import { integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+import { buildRelationalDeletionCapabilities } from "./compose-relational.js";
+
+const ORIGIN = "https://reader.remit.test";
+const PASSWORD = "correct horse battery staple";
+
+const MIGRATIONS = new URL(
+	"../../../deploy/vps/migrations-sqlite/",
+	import.meta.url,
+);
+
+const mcpDeviceCode = sqliteTable("mcp_device_code", {
+	id: text("id").primaryKey(),
+	deviceCode: text("device_code").notNull(),
+	userCode: text("user_code").notNull(),
+	userId: text("user_id"),
+	expiresAt: integer("expires_at", { mode: "timestamp_ms" }).notNull(),
+	status: text("status").notNull(),
+});
+
+interface SignedUp {
+	userId: string;
+	cookie: string;
+}
+
+const signUp = async (auth: Auth, email: string): Promise<SignedUp> => {
+	const response = await auth.api.signUpEmail({
+		body: { email, password: PASSWORD, name: email },
+		asResponse: true,
+	});
+	assert.equal(response.status, 200);
+	const { user } = (await response.json()) as { user: { id: string } };
+	const cookie = response.headers
+		.getSetCookie()
+		.map((value) => value.split(";")[0])
+		.join("; ");
+	return { userId: user.id, cookie };
+};
+
+const tokenStatus = async (auth: Auth, cookie: string): Promise<number> =>
+	(
+		await auth.handler(
+			new Request(`${ORIGIN}/api/auth/token`, { headers: { cookie } }),
+		)
+	).status;
+
+describe("relational deletion capabilities — login user erase", () => {
+	let filename: string;
+	let auth: Auth;
+	let erased: SignedUp;
+	let kept: SignedUp;
+
+	const rowsOf = (): {
+		users: string[];
+		sessionUsers: string[];
+		deviceCodeUsers: (string | null)[];
+	} => {
+		const sqlite = new Database(filename, { readonly: true });
+		const db = drizzle(sqlite);
+		const users = db
+			.select({ id: auth_user.id })
+			.from(auth_user)
+			.all()
+			.map((row) => row.id);
+		const sessionUsers = db
+			.select({ userId: auth_session.userId })
+			.from(auth_session)
+			.all()
+			.map((row) => row.userId);
+		const deviceCodeUsers = db
+			.select({ userId: mcpDeviceCode.userId })
+			.from(mcpDeviceCode)
+			.all()
+			.map((row) => row.userId);
+		sqlite.close();
+		return { users, sessionUsers, deviceCodeUsers };
+	};
+
+	before(async () => {
+		const dir = await mkdtemp(join(tmpdir(), "remit-relational-auth-"));
+		filename = join(dir, "app.db");
+		process.env.SQLITE_APP_DB_PATH = filename;
+		process.env.SQLITE_MAIL_DB_PATH = join(dir, "mail.db");
+		process.env.SQLITE_SEARCH_DB_PATH = join(dir, "search.db");
+
+		const migrating = new Database(filename);
+		migrating.pragma("journal_mode = WAL");
+		migrating.pragma("foreign_keys = ON");
+		for (const set of ["app", "mcp"]) {
+			migrate(drizzle(migrating), {
+				migrationsFolder: fileURLToPath(new URL(set, MIGRATIONS)),
+				migrationsTable: `__drizzle_migrations_${set}`,
+			});
+		}
+		migrating.close();
+
+		auth = await createAuth({
+			connectionString: filename,
+			secret: "relational-auth-secret-0123456789abcdef",
+			baseURL: ORIGIN,
+			selfSignUpEnabled: true,
+		});
+		erased = await signUp(auth, "erased@remit.test");
+		kept = await signUp(auth, "kept@remit.test");
+
+		const seeding = new Database(filename);
+		drizzle(seeding)
+			.insert(mcpDeviceCode)
+			.values(
+				[erased, kept].map(({ userId }) => ({
+					id: userId,
+					deviceCode: `device-${userId}`,
+					userCode: `user-${userId}`,
+					userId,
+					expiresAt: new Date(Date.now() + 600_000),
+					status: "approved",
+				})),
+			)
+			.run();
+		seeding.close();
+	});
+
+	it("deletes the user, its sessions and device codes, and refuses the old session cookie", async () => {
+		assert.equal(await tokenStatus(auth, erased.cookie), 200);
+
+		await buildRelationalDeletionCapabilities().signOut(
+			erased.userId,
+			noopLogger,
+		);
+
+		const { users, sessionUsers, deviceCodeUsers } = rowsOf();
+		assert.deepEqual(users, [kept.userId]);
+		assert.deepEqual(sessionUsers, [kept.userId]);
+		assert.deepEqual(deviceCodeUsers, [kept.userId]);
+		assert.equal(await tokenStatus(auth, erased.cookie), 401);
+		assert.equal(await tokenStatus(auth, kept.cookie), 200);
+	});
+});

package/src/compose-relational.ts

@@ -1,5 +1,4 @@
-import { rm } from "node:fs/promises";
-import { join } from "node:path";
+import { auth_user } from "@remit/auth-service/schema";
 import {
 	BETTER_SQLITE3_LIMITS,
 	openSqliteDatabases,
@@ -10,33 +9,23 @@ import {
 	syncStores,
 } from "@remit/drizzle-service";
 import type { Logger } from "@remit/logger";
+import { createFilesystemStorageService } from "@remit/storage-service/filesystem";
+import { eq } from "drizzle-orm";
 import type { DeletionCapabilities } from "./deletion-capabilities.js";
 
-// Mirrors `@remit/storage-service`'s filesystem-backend default: bodies
-// live under `STORAGE_LOCAL_PATH` (`.remit/storage` when unset). The cascade
-// deletes the same `accounts/{accountConfigId}/…` key prefixes the S3 backend
-// would, translated to a recursive directory removal.
-const storageBasePath = (): string =>
-	process.env.STORAGE_LOCAL_PATH ?? ".remit/storage";
-
-/**
- * Recursively remove every stored object under a key prefix. Replay-safe:
- * `force: true` swallows a missing directory (ENOENT), matching the S3 backend's
- * "delete on missing keys is a 200" idempotency.
- */
 const deleteStoragePrefix = async (
 	keyPrefix: string,
 	log: Logger,
 ): Promise<void> => {
-	const target = join(storageBasePath(), keyPrefix);
-	await rm(target, { recursive: true, force: true });
-	log.info({ keyPrefix, target }, "Filesystem storage prefix cleanup complete");
+	await createFilesystemStorageService(
+		process.env.STORAGE_LOCAL_PATH ?? ".remit/storage",
+	).deletePrefix(keyPrefix);
+	log.info({ keyPrefix }, "Storage prefix cleanup complete");
 };
 
 // The app, mail and search databases are opened once, on first use, and
-// shared by both deletes (the native binding loads there, hence async). Built
-// lazily so the fanout worker — which signs out but never deletes rows — does
-// not open a database handle it will not use.
+// shared by every delete (the native binding loads there, hence async). Built
+// lazily so a worker that never deletes does not open a database handle.
 let storesPromise: Promise<SqliteStores> | undefined;
 
 const getStores = (): Promise<SqliteStores> => {
@@ -46,28 +35,14 @@ const getStores = (): Promise<SqliteStores> => {
 	return storesPromise;
 };
 
-/**
- * The self-host stack's deletion capabilities (RFC 035/036).
- *
- * - `signOut`: no-op. Deleting the AccountConfig row severs the session's
- *   account→data resolution, and there is no federated session store to sign
- *   out of; better-auth session rows are owned by the auth service, outside this
- *   worker's data seam.
- * - `invalidateContent`: no-op. Caddy proxies `/content/*` straight to the
- *   backend with no response cache (`deploy/vps/caddy/routes.caddy`), so there
- *   is nothing to invalidate.
- * - `deleteStoragePrefix`: recursive filesystem removal.
- * - `cascadeDelete`: the Drizzle cascade over SQLite.
- * - `eraseAccountConfig`: one keyed delete per table over SQLite.
- */
 export const buildRelationalDeletionCapabilities =
 	(): DeletionCapabilities => ({
 		assertReady: async () => {},
 		signOut: async (userId, log) => {
-			log.info(
-				{ userId },
-				"Sign-out is a no-op on the relational backend; AccountConfig removal severs session data access",
-			);
+			await (await getStores()).app.db
+				.delete(auth_user)
+				.where(eq(auth_user.id, userId));
+			log.info({ userId }, "Auth user erased");
 		},
 		invalidateContent: async (contentPrefix, log) => {
 			log.info(

package/src/deletion-port.ts

@@ -1,25 +1,6 @@
 import type { Logger } from "@remit/logger";
 import type { CascadeEntity } from "./cascade.js";
 
-/**
- * The four steps of the deletion cascade that vary by deployment. Everything
- * else — enumerating the AccountConfig's rows, the FIFO purge orchestration, the
- * queue sends — is backend-neutral and lives in the handlers unchanged.
- *
- * Two composition roots build this:
- *
- * - The DynamoDB composition (AWS custody stack): Cognito global sign-out,
- *   CloudFront invalidation, raw-S3 prefix delete, DynamoDB `BatchWriteItem`
- *   cascade. Byte-for-byte the pre-split behavior. It imports the AWS SDK /
- *   ElectroDB graph and lives outside this shared, open-core module; it is
- *   injected here through `setDeletionCapabilities` so that graph never reaches
- *   the relational tree.
- * - `compose-relational.ts` (self-host stack, RFC 035/036): no-op sign-out
- *   (deleting the AccountConfig severs the session's data resolution; there is
- *   no CDN to sign out of), no-op invalidation (Caddy proxies `/content/*`
- *   straight to the backend with no cache), filesystem prefix delete, and the
- *   Drizzle cascade over SQLite.
- */
 export interface DeletionCapabilities {
 	/**
 	 * Validate every precondition the destructive steps depend on, BEFORE any row
@@ -29,10 +10,6 @@ export interface DeletionCapabilities {
 	 * Relational is a no-op — its steps carry no such deploy-time configuration.
 	 */
 	assertReady(log: Logger): Promise<void>;
-	/**
-	 * Invalidate the deleted user's active auth sessions. AWS: Cognito
-	 * `AdminUserGlobalSignOut`. Relational: no-op.
-	 */
 	signOut(userId: string, log: Logger): Promise<void>;
 	/**
 	 * Purge any CDN/edge cache under a tenant/account content prefix

package/src/handlers/account-delete.test.ts

@@ -7,6 +7,7 @@ import { recordingQueue } from "@remit/data-ports/recording-queue";
 import {
 	BETTER_SQLITE3_LIMITS,
 	composeSqliteRepositories,
+	messageObjectsInMemory,
 	openSqliteDatabases,
 	syncStores,
 } from "@remit/drizzle-service";
@@ -48,6 +49,7 @@ describe("account delete on a host that runs the finalize step from its own queu
 		close = databases.close;
 		repositories = composeSqliteRepositories(
 			syncStores(databases, BETTER_SQLITE3_LIMITS),
+			messageObjectsInMemory(),
 		);
 	});
 
@@ -81,7 +83,7 @@ describe("account delete on a host that runs the finalize step from its own queu
 		const signedOut: string[] = [];
 
 		await processAccountDelete(
-			{ type: "AccountDelete", accountConfigId },
+			{ type: "AccountDelete", accountConfigId, userId: "auth-user-1" },
 			noopLogger,
 			{
 				services,
@@ -91,7 +93,7 @@ describe("account delete on a host that runs the finalize step from its own queu
 				enqueueFinalize: (event) => queue.send({ body: event }),
 			},
 		);
-		assert.deepEqual(signedOut, [accountConfig.userId]);
+		assert.deepEqual(signedOut, ["auth-user-1"]);
 		const [queued] = queue.sent;
 		assert.deepEqual(queued?.body, {
 			type: "FinalizeAccountDelete",

package/src/handlers/account-delete.ts

@@ -26,7 +26,7 @@ export const processAccountDelete = async (
 		return;
 	}
 
-	await signOut(accountConfig.userId, log);
+	await signOut(event.userId, log);
 	await enqueueFinalize({ type: "FinalizeAccountDelete", accountConfigId });
 	log.info({ accountConfigId }, "Enqueued finalize event");
 };

package/src/handlers/account-export.sqlite.test.ts

@@ -10,6 +10,7 @@ import {
 	BETTER_SQLITE3_LIMITS,
 	composeSqliteRepositories,
 	mailboxTable,
+	messageObjectsInMemory,
 	messageTable,
 	openSqliteDatabases,
 	syncStores,
@@ -169,6 +170,7 @@ describe("processAccountExport over SQLite repositories and filesystem storage",
 		close = databases.close;
 		repositories = composeSqliteRepositories(
 			syncStores(databases, BETTER_SQLITE3_LIMITS),
+			messageObjectsInMemory(),
 		);
 		storage = createFilesystemStorageService(join(directory, "storage"));
 	});

package/src/handlers/account-fanout.test.ts

@@ -14,6 +14,7 @@ const buildServices = (): CascadeServices =>
 const deleteEvent: AccountDeleteEvent = {
 	type: "AccountDelete",
 	accountConfigId: "cfg-1",
+	userId: "user-1",
 };
 
 describe("processAccountFanout on account delete", () => {

package/src/handlers/organize-job.test.ts

@@ -13,6 +13,7 @@ import {
 	BETTER_SQLITE3_LIMITS,
 	createSqliteRepositories,
 	type DrizzleThreadMessageRepository,
+	messageObjectsInMemory,
 } from "@remit/drizzle-service";
 import { createShippedSqliteDb } from "@remit/drizzle-service/test-sqlite";
 import { noopLogger } from "@remit/logger";
@@ -193,6 +194,7 @@ const world = async (filters: FilterItem[]): Promise<World> => {
 			search: store.db,
 		},
 		BETTER_SQLITE3_LIMITS,
+		messageObjectsInMemory(),
 	).threadMessage;
 	const { inbox, archive } = await seedThreads(threadMessage);
 	const updates: Update[] = [];