@remit/backend 0.0.1

package/src/handlers/account.ts

@@ -0,0 +1,524 @@
+import { SendMessageCommand } from "@aws-sdk/client-sqs";
+import type {
+	AccountResponse,
+	CreateAccountInput,
+	DeleteAccountResponse,
+	TestConnectionInput,
+	TestConnectionResponse,
+	UpdateAccountInput,
+} from "@remit/api-openapi-types";
+import type { AccountItem, IAccountRepository } from "@remit/data-ports";
+import { AccountAuthType, ConnectionState } from "@remit/domain-enums";
+import { logger } from "@remit/logger-lambda";
+import {
+	createMailOAuthService,
+	microsoftProviderConfig,
+	RefreshTokenError,
+} from "@remit/mail-oauth-service";
+import {
+	resolveConnectionCredentials,
+	testImapConnection,
+	testSmtpConnection,
+} from "@remit/mailbox-service";
+import {
+	deserializeEncryptedPayload,
+	type SecretsService,
+	serializeEncryptedPayload,
+} from "@remit/secrets-service";
+import type { APIGatewayProxyEvent } from "aws-lambda";
+import { env } from "expect-env";
+import type { Context } from "openapi-backend";
+import { getAccountConfigIdFromEvent } from "../auth.js";
+import { getClient } from "../service/dynamodb.js";
+import { fireAndForget } from "../service/fire-and-forget.js";
+import { sqsClient } from "../service/sqs.js";
+import { triggerAccountSync } from "../service/trigger-sync.js";
+import type {
+	AccountDetailOperationIds,
+	AccountOperationIds,
+	OperationHandler,
+} from "../types.js";
+import {
+	assertNoDuplicateMailbox,
+	assertNotOAuthCreate,
+	assertPasswordProvided,
+	toAccountResponse,
+} from "./account-guards.js";
+import {
+	loadAccountOverrides,
+	upsertAccountDisplayName,
+	writeAccountMuted,
+} from "./account-overrides.js";
+import { assertAccountOwnership } from "./account-ownership.js";
+import {
+	loadSignatureForAccount,
+	upsertAccountSignature,
+} from "./account-signature.js";
+import { ensureAccountConfig } from "./ensure-account-config.js";
+import { resolveAccountFolderAppointments } from "./folder-role-appointments.js";
+
+export { assertNotOAuthCreate, assertPasswordProvided, toAccountResponse };
+
+export const triggerAccountSyncSafe = async (
+	accountId: string,
+): Promise<void> => {
+	const queueUrl = env.SQS_QUEUE_URL;
+	// Best-effort: account creation must still return 200 even if the sync
+	// enqueue fails. fireAndForget catches and logs every rejection loudly with
+	// the alertable structured fields and never rejects, so a failure here (SQS
+	// unreachable in smoke/e2e, an IAM/SQS misconfig in prod) cannot leak an
+	// unhandled rejection onto an unrelated in-flight request.
+	await fireAndForget(
+		async () => {
+			const { eventId } = await triggerAccountSync({
+				sqsClient,
+				queueUrl,
+				accountId,
+			});
+			// biome-ignore lint/plugin/no-logger-info: sync-triggered-for-new-account is an audit-grade signal
+			logger.info({ accountId, eventId }, "Sync triggered for new account");
+		},
+		{
+			source: "account_create",
+			message: "Failed to enqueue SYNC_MAILBOXES for new account (best-effort)",
+			ids: { accountId },
+		},
+	);
+};
+
+/**
+ * Test connectivity for an OAuth (Microsoft) account.
+ *
+ * Mints an access token from the stored refresh token via
+ * resolveConnectionCredentials (the single authType branch), then runs the
+ * IMAP — and, when configured, SMTP — connection tests with those credentials.
+ *
+ * A revoked / expired refresh token surfaces as RefreshTokenError; the
+ * reauth-required case is mapped to the distinct `reauth_required` error code
+ * so the UI can route the user into the OAuth re-auth flow.
+ *
+ * MSOAUTH_* env vars are only present in deployed Lambdas; fall back to "".
+ */
+const testOAuthConnection = async (
+	existingAccount: AccountItem,
+	account: IAccountRepository,
+	secrets: SecretsService,
+): Promise<TestConnectionResponse> => {
+	if (!existingAccount.oauthRefreshTokenHash) {
+		return {
+			imapSuccess: false,
+			imapError: "oauth_not_configured",
+			smtpSuccess: undefined,
+		};
+	}
+
+	const tokenService = createMailOAuthService(
+		microsoftProviderConfig({
+			clientId: process.env.MSOAUTH_CLIENT_ID ?? "",
+			clientSecret: process.env.MSOAUTH_CLIENT_SECRET ?? "",
+			overrides: process.env.MSOAUTH_TOKEN_ENDPOINT
+				? { tokenEndpoint: process.env.MSOAUTH_TOKEN_ENDPOINT }
+				: undefined,
+		}),
+	);
+
+	let credentials: Awaited<ReturnType<typeof resolveConnectionCredentials>>;
+	try {
+		credentials = await resolveConnectionCredentials(existingAccount, {
+			secrets,
+			tokenService,
+			persistRotatedToken: async (id, encryptedHash, updatedAt) => {
+				await account.update(id, {
+					oauthRefreshTokenHash: encryptedHash,
+					oauthTokenUpdatedAt: updatedAt,
+				});
+			},
+		});
+	} catch (err) {
+		if (
+			err instanceof RefreshTokenError &&
+			err.error.kind === "reauth-required"
+		) {
+			return {
+				imapSuccess: false,
+				imapError: "reauth_required",
+				smtpSuccess: undefined,
+			};
+		}
+		throw err;
+	}
+
+	const result: TestConnectionResponse = {
+		imapSuccess: false,
+		smtpSuccess: undefined,
+	};
+
+	const imapResult = await testImapConnection({
+		host: existingAccount.imapHost,
+		port: existingAccount.imapPort,
+		secure: existingAccount.imapTls,
+		user: existingAccount.username,
+		credentials,
+	});
+	result.imapSuccess = imapResult.success;
+	if (!imapResult.success) {
+		result.imapError = imapResult.error;
+	}
+
+	// OAuth accounts share the same access token for IMAP and SMTP.
+	if (existingAccount.smtpEnabled) {
+		const smtpResult = await testSmtpConnection({
+			host: existingAccount.smtpHost ?? "",
+			port: existingAccount.smtpPort ?? 587,
+			secure: existingAccount.smtpTls ?? false,
+			user: existingAccount.smtpUsername || existingAccount.username,
+			credentials,
+		});
+		result.smtpSuccess = smtpResult.success;
+		if (!smtpResult.success) {
+			result.smtpError = smtpResult.error;
+		}
+	}
+
+	return result;
+};
+
+export const AccountOperations: Record<
+	AccountOperationIds,
+	OperationHandler<AccountOperationIds>
+> = {
+	AccountOperations_createAccount: async (
+		_context: Context,
+		...args: unknown[]
+	): Promise<AccountResponse> => {
+		const event = args[0] as APIGatewayProxyEvent;
+		const accountConfigId = getAccountConfigIdFromEvent(event);
+		const input = JSON.parse(event.body ?? "{}") as CreateAccountInput;
+
+		// OAuth accounts must be created via the dedicated connect flow
+		assertNotOAuthCreate(input.authType);
+
+		// Password accounts require a non-empty password
+		assertPasswordProvided(input.authType, input.password);
+
+		const { account, accountConfig, accountSetting, mailbox, secrets } =
+			await getClient();
+
+		await ensureAccountConfig(accountConfig, accountConfigId);
+
+		// Reject re-onboarding the same mailbox-in-the-same-place. Message
+		// identity is account-scoped (#633), so duplicate onboards are no longer
+		// incidentally deduped — this is the explicit replacement (#635).
+		const existingAccounts =
+			await account.listAllByAccountConfig(accountConfigId);
+		assertNoDuplicateMailbox(existingAccounts, {
+			imapHost: input.imapHost,
+			username: input.username ?? input.email,
+		});
+
+		// biome-ignore lint/style/noNonNullAssertion: guard above ensures password is set for password-auth accounts
+		const passwordPayload = await secrets.encrypt(input.password!);
+		const passwordHash = JSON.stringify(
+			serializeEncryptedPayload(passwordPayload),
+		);
+
+		let smtpPasswordHash: string | undefined;
+		if (input.smtpPassword) {
+			const smtpPayload = await secrets.encrypt(input.smtpPassword);
+			smtpPasswordHash = JSON.stringify(serializeEncryptedPayload(smtpPayload));
+		}
+
+		const newAccount = await account.create({
+			accountConfigId,
+			email: input.email,
+			username: input.username ?? input.email,
+			authType: AccountAuthType.Password,
+			passwordHash,
+			imapHost: input.imapHost,
+			imapPort: input.imapPort,
+			imapTls: input.imapTls,
+			imapStartTls: input.imapStartTls,
+			// RFC 032 Tier 2: smtpEnabled is the explicit send-capability marker.
+			// Honour an explicit flag from the client; otherwise enable sending when
+			// an SMTP host was supplied (the prior implicit behaviour).
+			smtpEnabled: input.smtpEnabled ?? Boolean(input.smtpHost),
+			smtpHost: input.smtpHost,
+			smtpPort: input.smtpPort,
+			smtpTls: input.smtpTls,
+			smtpStartTls: input.smtpStartTls,
+			smtpUsername: input.smtpUsername,
+			smtpPasswordHash,
+			isActive: true,
+			connectionState: ConnectionState.NotAuthenticated,
+		});
+
+		// Display name lives in a per-account AccountSetting row (RFC 032), not on
+		// the entity. Persist it when supplied so the response and later reads
+		// surface it unchanged.
+		if (input.displayName !== undefined) {
+			await upsertAccountDisplayName(
+				accountSetting,
+				accountConfigId,
+				newAccount.accountId,
+				input.displayName,
+			);
+		}
+
+		await triggerAccountSyncSafe(newAccount.accountId);
+
+		const [overrides, folderAppointments] = await Promise.all([
+			loadAccountOverrides(
+				accountSetting,
+				accountConfigId,
+				newAccount.accountId,
+			),
+			resolveAccountFolderAppointments(
+				{ mailbox, accountSetting },
+				accountConfigId,
+				newAccount.accountId,
+			),
+		]);
+		return toAccountResponse(newAccount, {}, overrides, folderAppointments);
+	},
+
+	AccountOperations_testConnection: async (
+		_context: Context,
+		...args: unknown[]
+	): Promise<TestConnectionResponse> => {
+		const event = args[0] as APIGatewayProxyEvent;
+		const accountConfigId = getAccountConfigIdFromEvent(event);
+		const input = JSON.parse(event.body ?? "{}") as TestConnectionInput;
+
+		const { account, secrets } = await getClient();
+
+		// Resolve password - use provided password or decrypt stored password
+		let imapPassword = input.password;
+		let smtpPassword = input.smtpPassword;
+
+		if (!imapPassword && input.accountId) {
+			const existingAccount = await account.get(input.accountId);
+			assertAccountOwnership(existingAccount, accountConfigId, "read");
+
+			const authType = existingAccount.authType ?? "password";
+			if (authType === "oauthMicrosoft") {
+				return testOAuthConnection(existingAccount, account, secrets);
+			}
+
+			if (existingAccount.passwordHash) {
+				const payload = deserializeEncryptedPayload(
+					JSON.parse(existingAccount.passwordHash),
+				);
+				imapPassword = await secrets.decrypt(payload);
+			}
+
+			// Also get SMTP password if needed and available
+			if (!smtpPassword && existingAccount.smtpPasswordHash) {
+				const smtpPayload = deserializeEncryptedPayload(
+					JSON.parse(existingAccount.smtpPasswordHash),
+				);
+				smtpPassword = await secrets.decrypt(smtpPayload);
+			}
+		}
+
+		if (!imapPassword) {
+			return {
+				imapSuccess: false,
+				imapError: "Password required",
+				smtpSuccess: undefined,
+			};
+		}
+
+		const result: TestConnectionResponse = {
+			imapSuccess: false,
+			smtpSuccess: undefined,
+		};
+
+		// Test IMAP connection
+		const imapResult = await testImapConnection({
+			host: input.imapHost,
+			port: input.imapPort,
+			secure: input.imapTls,
+			startTls: input.imapStartTls,
+			user: input.username,
+			credentials: { kind: "password", password: imapPassword },
+		});
+
+		result.imapSuccess = imapResult.success;
+		if (!imapResult.success) {
+			result.imapError = imapResult.error;
+		}
+
+		// Test SMTP connection if configured
+		if (input.smtpHost) {
+			const smtpResult = await testSmtpConnection({
+				host: input.smtpHost,
+				port: input.smtpPort ?? 587,
+				secure: input.smtpTls ?? false,
+				user: input.smtpUsername ?? input.username,
+				credentials: {
+					kind: "password",
+					password: smtpPassword ?? imapPassword,
+				},
+			});
+
+			result.smtpSuccess = smtpResult.success;
+			if (!smtpResult.success) {
+				result.smtpError = smtpResult.error;
+			}
+		}
+
+		return result;
+	},
+};
+
+export const AccountDetailOperations: Record<
+	AccountDetailOperationIds,
+	OperationHandler<AccountDetailOperationIds>
+> = {
+	AccountDetailOperations_updateAccount: async (
+		context: Context,
+		...args: unknown[]
+	): Promise<AccountResponse> => {
+		const event = args[0] as APIGatewayProxyEvent;
+		const accountConfigId = getAccountConfigIdFromEvent(event);
+		const { accountId } = context.request.params as { accountId: string };
+		const input = JSON.parse(event.body ?? "{}") as UpdateAccountInput;
+
+		const { account, accountSetting, mailbox, secrets } = await getClient();
+
+		const existing = await account.get(accountId);
+		assertAccountOwnership(existing, accountConfigId, "act");
+
+		const updates: Record<string, unknown> = {};
+
+		// Handle password updates
+		if (input.password) {
+			const payload = await secrets.encrypt(input.password);
+			updates.passwordHash = JSON.stringify(serializeEncryptedPayload(payload));
+		}
+		if (input.smtpPassword) {
+			const payload = await secrets.encrypt(input.smtpPassword);
+			updates.smtpPasswordHash = JSON.stringify(
+				serializeEncryptedPayload(payload),
+			);
+		}
+
+		// Copy non-password fields
+		const fields = [
+			"imapHost",
+			"imapPort",
+			"imapTls",
+			"imapStartTls",
+			"smtpEnabled",
+			"smtpHost",
+			"smtpPort",
+			"smtpTls",
+			"smtpStartTls",
+			"smtpUsername",
+			"isActive",
+		] as const;
+
+		for (const field of fields) {
+			if (input[field] !== undefined) {
+				updates[field] = input[field];
+			}
+		}
+
+		// RFC 032 Tier 2: keep the explicit send-capability marker in sync. When a
+		// caller changes the SMTP host without passing smtpEnabled, derive it from
+		// host presence so the marker can't drift from the config.
+		if (input.smtpEnabled === undefined && input.smtpHost !== undefined) {
+			updates.smtpEnabled = Boolean(input.smtpHost);
+		}
+
+		// Display name and the mute flag live in per-account AccountSetting rows
+		// (RFC 032), not on the account entity. Display name upserts when supplied;
+		// the mute flag follows the address-flag null→remove, object→set semantics
+		// (the client populates setAt).
+		if (input.displayName !== undefined) {
+			await upsertAccountDisplayName(
+				accountSetting,
+				accountConfigId,
+				accountId,
+				input.displayName,
+			);
+		}
+		if (Object.hasOwn(input, "muted")) {
+			if (input.muted !== undefined) {
+				await writeAccountMuted(
+					accountSetting,
+					accountConfigId,
+					accountId,
+					input.muted,
+				);
+			}
+		}
+
+		// Signatures live in per-account AccountSetting rows (RFC 032), not on the
+		// account entity. Persist each supplied part as a composite-named setting;
+		// an empty string is a valid stored value (preserves the prior "set ''
+		// stores ''" semantics — it does not delete the row).
+		if (
+			input.signaturePlainText !== undefined ||
+			input.signatureHtml !== undefined
+		) {
+			await upsertAccountSignature(accountSetting, accountConfigId, accountId, {
+				plainText: input.signaturePlainText,
+				html: input.signatureHtml,
+			});
+		}
+
+		const updated = await account.update(accountId, updates);
+
+		const [signature, overrides, folderAppointments] = await Promise.all([
+			loadSignatureForAccount(accountSetting, accountConfigId, accountId),
+			loadAccountOverrides(accountSetting, accountConfigId, accountId),
+			resolveAccountFolderAppointments(
+				{ mailbox, accountSetting },
+				accountConfigId,
+				accountId,
+			),
+		]);
+		return toAccountResponse(updated, signature, overrides, folderAppointments);
+	},
+
+	AccountDetailOperations_deleteAccount: async (
+		context: Context,
+		...args: unknown[]
+	): Promise<DeleteAccountResponse> => {
+		const event = args[0] as APIGatewayProxyEvent;
+		const accountConfigId = getAccountConfigIdFromEvent(event);
+		const { accountId } = context.request.params as { accountId: string };
+
+		const { account } = await getClient();
+
+		const existing = await account.get(accountId);
+		assertAccountOwnership(existing, accountConfigId, "act");
+
+		const deletedAt = Date.now();
+		await account.update(accountId, {
+			deletedAt,
+			isActive: false,
+		});
+
+		await sqsClient.send(
+			new SendMessageCommand({
+				QueueUrl: env.SQS_QUEUE_URL_ACCOUNT_FANOUT,
+				MessageBody: JSON.stringify({
+					type: "AccountDataPurge",
+					accountId,
+					accountConfigId,
+				}),
+			}),
+		);
+		// biome-ignore lint/plugin/no-logger-info: account data purge is an audit-grade signal
+		logger.info({ accountId, accountConfigId }, "Account data purge initiated");
+
+		return {
+			accountId,
+			deletedAt,
+			message:
+				"Account marked for deletion. Data cleanup will complete shortly.",
+		};
+	},
+};

package/src/handlers/address.ts

@@ -0,0 +1,136 @@
+import type {
+	AddressResponse,
+	UpdateAddressInput,
+} from "@remit/api-openapi-types";
+import type { AddressItem, FlagsMergePatch } from "@remit/data-ports";
+import { ForbiddenError } from "@remit/data-ports/errors";
+import type { APIGatewayProxyEvent } from "aws-lambda";
+import type { Context } from "openapi-backend";
+import { getAccountConfigIdFromEvent } from "../auth.js";
+import { getClient } from "../service/dynamodb.js";
+import type {
+	AddressDetailOperationIds,
+	AddressOperationIds,
+	OperationHandler,
+} from "../types.js";
+
+export const toAddressResponse = (item: AddressItem): AddressResponse => ({
+	addressId: item.addressId,
+	accountConfigId: item.accountConfigId,
+	displayName: item.displayName,
+	localPart: item.localPart,
+	domain: item.domain,
+	normalizedEmail: item.normalizedEmail,
+	flags: item.flags ?? {},
+	inboundCount: item.inboundCount ?? 0,
+	outboundCount: item.outboundCount ?? 0,
+	replyCount: item.replyCount ?? 0,
+	lastInboundAt: item.lastInboundAt ?? 0,
+	lastReplyAt: item.lastReplyAt ?? 0,
+	createdAt: item.createdAt,
+	updatedAt: item.updatedAt,
+});
+
+const FLAG_KEYS = [
+	"trusted",
+	"blocked",
+	"muted",
+	"vip",
+	"category",
+	"autoArchive",
+	"unsubscribed",
+] as const;
+
+type FlagKey = (typeof FLAG_KEYS)[number];
+
+/**
+ * Translate the wire-format `UpdateAddressFlagsInput` into a service-level
+ * `FlagsMergePatch`. Only known flag keys are forwarded; unknown keys are
+ * silently dropped (a TypeSpec-only schema means unknown keys are a client
+ * bug, not a security risk). `null` becomes the explicit "remove" signal.
+ */
+export const buildFlagsPatch = (
+	input: UpdateAddressInput["flags"] | undefined,
+): FlagsMergePatch => {
+	if (!input) return {};
+	const patch = {} as Record<FlagKey, unknown>;
+	for (const key of FLAG_KEYS) {
+		if (!(key in input)) continue;
+		const value = (input as Record<FlagKey, unknown>)[key];
+		if (value === null) {
+			patch[key] = null;
+			continue;
+		}
+		if (value === undefined) continue;
+		patch[key] = value;
+	}
+	return patch as FlagsMergePatch;
+};
+
+export const AddressOperations: Record<
+	AddressOperationIds,
+	OperationHandler<AddressOperationIds>
+> = {
+	AddressOperations_searchAddresses: async (
+		context: Context,
+		...args: unknown[]
+	) => {
+		const event = args[0] as APIGatewayProxyEvent;
+		const accountConfigId = getAccountConfigIdFromEvent(event);
+		const { q, limit } = context.request.query as {
+			q: string;
+			limit?: number;
+		};
+
+		const client = await getClient();
+
+		const result = await client.address.listByAccountConfig({
+			accountConfigId,
+			normalizedCompound: q.toLowerCase(),
+			limit: limit ?? 10,
+		});
+
+		return {
+			items: result.items.map(toAddressResponse),
+			continuationToken: result.continuationToken,
+		};
+	},
+};
+
+export const AddressDetailOperations: Record<
+	AddressDetailOperationIds,
+	OperationHandler<AddressDetailOperationIds>
+> = {
+	AddressDetailOperations_updateAddress: async (
+		context: Context,
+		...args: unknown[]
+	) => {
+		const event = args[0] as APIGatewayProxyEvent;
+		const accountConfigId = getAccountConfigIdFromEvent(event);
+		const { addressId } = context.request.params as { addressId: string };
+		const body = (context.request.requestBody ?? {}) as UpdateAddressInput;
+
+		const client = await getClient();
+
+		// Authorize: address must belong to the caller's accountConfig
+		const existing = await client.address.getAddress(
+			accountConfigId,
+			addressId,
+		);
+		if (existing.accountConfigId !== accountConfigId) {
+			throw new ForbiddenError(`Address ${addressId} not in account config`);
+		}
+
+		const patch = buildFlagsPatch(body.flags);
+		if (Object.keys(patch).length === 0) {
+			return toAddressResponse(existing);
+		}
+
+		const updated = await client.address.mergeFlags(
+			accountConfigId,
+			addressId,
+			patch,
+		);
+		return toAddressResponse(updated);
+	},
+};