@remit/backend 0.0.101 → 0.0.102

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.101",
+  "version": "0.0.102",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",

package/src/handlers/account.ts

@@ -105,14 +105,6 @@ const testOAuthConnection = async (
 	account: IAccountRepository,
 	secrets: SecretsService,
 ): Promise<TestConnectionResponse> => {
-	if (!existingAccount.oauthRefreshTokenHash) {
-		return {
-			imapSuccess: false,
-			imapError: "oauth_not_configured",
-			smtpSuccess: undefined,
-		};
-	}
-
 	const tokenService = createMailOAuthService(
 		microsoftProviderConfig({
 			clientId: process.env.MSOAUTH_CLIENT_ID ?? "",
@@ -123,9 +115,9 @@ const testOAuthConnection = async (
 		}),
 	);
 
-	let credentials: Awaited<ReturnType<typeof resolveConnectionCredentials>>;
+	let resolution: Awaited<ReturnType<typeof resolveConnectionCredentials>>;
 	try {
-		credentials = await resolveConnectionCredentials(existingAccount, {
+		resolution = await resolveConnectionCredentials(existingAccount, {
 			secrets,
 			tokenService,
 			persistRotatedToken: async (id, encryptedHash, updatedAt) => {
@@ -149,6 +141,15 @@ const testOAuthConnection = async (
 		throw err;
 	}
 
+	if (resolution.status === "missing") {
+		return {
+			imapSuccess: false,
+			imapError: "oauth_not_configured",
+			smtpSuccess: undefined,
+		};
+	}
+	const credentials = resolution.credentials;
+
 	const result: TestConnectionResponse = {
 		imapSuccess: false,
 		smtpSuccess: undefined,

package/src/handlers/config.test.ts

@@ -1,8 +1,18 @@
 import assert from "node:assert/strict";
 import { describe, it } from "node:test";
 import type { SendMessageCommand, SQSClient } from "@aws-sdk/client-sqs";
+import { AccountAuthType } from "@remit/domain-enums";
 import { triggerConfigLoadSyncs } from "./config.js";
 
+/**
+ * The credential a password account stores. Its content is never read here —
+ * only its presence decides whether a sync is worth enqueuing.
+ */
+const withPassword = (accountId: string) => ({
+	accountId,
+	passwordHash: '{"ciphertext":"x"}',
+});
+
 const QUEUE_URL = "http://localhost:9324/000000000000/remit-dev-mailboxes";
 
 interface LogCall {
@@ -44,17 +54,60 @@ describe("triggerConfigLoadSyncs", () => {
 		const sent: SendMessageCommand[] = [];
 		const { logger, info, error } = createLoggerSpy();
 
-		await triggerConfigLoadSyncs("config-1", ["acc-a", "acc-b"], {
-			sqsClient: okSqsClient(sent),
-			queueUrl: QUEUE_URL,
-			logger,
-		});
+		await triggerConfigLoadSyncs(
+			"config-1",
+			[withPassword("acc-a"), withPassword("acc-b")],
+			{
+				sqsClient: okSqsClient(sent),
+				queueUrl: QUEUE_URL,
+				logger,
+			},
+		);
 
 		assert.equal(sent.length, 2);
 		assert.equal(info.length, 2);
 		assert.equal(error.length, 0);
 	});
 
+	it("skips an account that stores no credential (issue #1120)", async () => {
+		const sent: SendMessageCommand[] = [];
+		const { logger, error } = createLoggerSpy();
+
+		await triggerConfigLoadSyncs(
+			"config-1",
+			[
+				{ accountId: "imported-no-password" },
+				withPassword("acc-with-password"),
+			],
+			{ sqsClient: okSqsClient(sent), queueUrl: QUEUE_URL, logger },
+		);
+
+		assert.equal(sent.length, 1);
+		assert.equal(error.length, 0);
+		const body = JSON.parse(String(sent[0]?.input.MessageBody)) as {
+			accountId: string;
+		};
+		assert.equal(body.accountId, "acc-with-password");
+	});
+
+	it("skips an OAuth account that stores no refresh token", async () => {
+		const sent: SendMessageCommand[] = [];
+		const { logger } = createLoggerSpy();
+
+		await triggerConfigLoadSyncs(
+			"config-1",
+			[
+				{
+					accountId: "oauth-unconnected",
+					authType: AccountAuthType.OauthMicrosoft,
+				},
+			],
+			{ sqsClient: okSqsClient(sent), queueUrl: QUEUE_URL, logger },
+		);
+
+		assert.equal(sent.length, 0);
+	});
+
 	it("does NOT reject when the SQS enqueue fails (read stays resilient)", async () => {
 		const econnrefused = Object.assign(new Error(""), {
 			name: "AggregateError",
@@ -63,7 +116,7 @@ describe("triggerConfigLoadSyncs", () => {
 		const { logger } = createLoggerSpy();
 
 		await assert.doesNotReject(
-			triggerConfigLoadSyncs("config-1", ["acc-a"], {
+			triggerConfigLoadSyncs("config-1", [withPassword("acc-a")], {
 				sqsClient: failingSqsClient(econnrefused),
 				queueUrl: QUEUE_URL,
 				logger,
@@ -78,7 +131,7 @@ describe("triggerConfigLoadSyncs", () => {
 		});
 		const { logger, error } = createLoggerSpy();
 
-		await triggerConfigLoadSyncs("config-1", ["acc-a"], {
+		await triggerConfigLoadSyncs("config-1", [withPassword("acc-a")], {
 			sqsClient: failingSqsClient(econnrefused),
 			queueUrl: QUEUE_URL,
 			logger,
@@ -109,11 +162,15 @@ describe("triggerConfigLoadSyncs", () => {
 		} as unknown as SQSClient;
 		const { logger, info, error } = createLoggerSpy();
 
-		await triggerConfigLoadSyncs("config-1", ["acc-a", "acc-b"], {
-			sqsClient,
-			queueUrl: QUEUE_URL,
-			logger,
-		});
+		await triggerConfigLoadSyncs(
+			"config-1",
+			[withPassword("acc-a"), withPassword("acc-b")],
+			{
+				sqsClient,
+				queueUrl: QUEUE_URL,
+				logger,
+			},
+		);
 
 		assert.equal(error.length, 1);
 		assert.equal(info.length, 1);
@@ -127,7 +184,7 @@ describe("triggerConfigLoadSyncs", () => {
 		});
 		const { logger, error } = createLoggerSpy();
 
-		await triggerConfigLoadSyncs("config-1", ["acc-a"], {
+		await triggerConfigLoadSyncs("config-1", [withPassword("acc-a")], {
 			sqsClient: failingSqsClient(sdkError),
 			queueUrl: QUEUE_URL,
 			logger,
@@ -161,11 +218,15 @@ describe("triggerConfigLoadSyncs", () => {
 		let readResolved = false;
 		try {
 			// Fire-and-forget exactly as the getConfig handler does.
-			void triggerConfigLoadSyncs("config-1", ["acc-a", "acc-b"], {
-				sqsClient: failingSqsClient(econnrefused),
-				queueUrl: QUEUE_URL,
-				logger,
-			});
+			void triggerConfigLoadSyncs(
+				"config-1",
+				[withPassword("acc-a"), withPassword("acc-b")],
+				{
+					sqsClient: failingSqsClient(econnrefused),
+					queueUrl: QUEUE_URL,
+					logger,
+				},
+			);
 
 			// A concurrent "read" sharing the event loop, like /mailboxes or /outbox.
 			await new Promise((resolve) => setImmediate(resolve)).then(() => {

package/src/handlers/config.ts

@@ -14,6 +14,10 @@ import type { AccountConfigItem, MailboxItem } from "@remit/data-ports";
 import { ConfigNotEmptyError, NotFoundError } from "@remit/data-ports/errors";
 import type { CanonicalMailboxRoleValue } from "@remit/data-ports/folder-role";
 import { logger } from "@remit/logger-lambda";
+import {
+	hasStoredCredential,
+	type StoredCredentialFields,
+} from "@remit/mailbox-service/account-credentials";
 import {
 	EMBEDDING_PROVIDER_OFF,
 	readEmbeddingProviderFromEnv,
@@ -77,14 +81,20 @@ const defaultConfigSyncTriggerDeps = (): ConfigSyncTriggerDeps => ({
  * Each failure is logged as a distinct structured error carrying the SDK error
  * name/code on dedicated fields plus a stable `alert: "sync_trigger_failed"`
  * discriminator a CloudWatch metric filter / alarm can key off.
+ *
+ * An account storing no credential is not enqueued at all (issue #1120): the
+ * import wizard lands accounts without a password by design, and the client
+ * polls this read while the user is still typing one. The guard is the stored
+ * credential rather than `connectionState`, which stays `credentials_missing`
+ * until a connect succeeds — see `hasStoredCredential`.
  */
 export const triggerConfigLoadSyncs = async (
 	accountConfigId: string,
-	accountIds: ReadonlyArray<string>,
+	accounts: ReadonlyArray<{ accountId: string } & StoredCredentialFields>,
 	deps: ConfigSyncTriggerDeps = defaultConfigSyncTriggerDeps(),
 ): Promise<void> => {
 	await Promise.all(
-		accountIds.map((accountId) =>
+		accounts.filter(hasStoredCredential).map(({ accountId }) =>
 			fireAndForget(
 				async () => {
 					const { eventId } = await triggerAccountSync({
@@ -224,10 +234,7 @@ export const ConfigOperations: Record<
 		// triggerConfigLoadSyncs swallows nothing — it logs each failure loudly
 		// with an alertable structured field — but it also never rejects, so the
 		// `void` here cannot leak an unhandled rejection into a later request.
-		void triggerConfigLoadSyncs(
-			accountConfigId,
-			activeAccounts.map((acc) => acc.accountId),
-		);
+		void triggerConfigLoadSyncs(accountConfigId, activeAccounts);
 
 		// An import that named folders IMAP had not produced yet rides the config
 		// read rather than a route of its own, so nothing has to poll for it.

package/src/service/trigger-sync.test.ts

@@ -20,7 +20,6 @@ const parseBody = (cmd: SendMessageCommand): Record<string, unknown> => {
 describe("buildSyncMailboxesCommand", () => {
 	it("sets MessageGroupId to accountId for FIFO queues", () => {
 		const cmd = buildSyncMailboxesCommand({
-			sqsClient: {} as SQSClient,
 			queueUrl: FIFO_QUEUE_URL,
 			accountId: "account-abc",
 		});
@@ -30,7 +29,6 @@ describe("buildSyncMailboxesCommand", () => {
 
 	it("defaults MessageDeduplicationId to the event's own id for FIFO queues", () => {
 		const cmd = buildSyncMailboxesCommand({
-			sqsClient: {} as SQSClient,
 			queueUrl: FIFO_QUEUE_URL,
 			accountId: "account-abc",
 		});
@@ -44,12 +42,10 @@ describe("buildSyncMailboxesCommand", () => {
 	// must each reach the queue.
 	it("gives two triggers for one account distinct dedup ids", () => {
 		const first = buildSyncMailboxesCommand({
-			sqsClient: {} as SQSClient,
 			queueUrl: FIFO_QUEUE_URL,
 			accountId: "account-abc",
 		});
 		const second = buildSyncMailboxesCommand({
-			sqsClient: {} as SQSClient,
 			queueUrl: FIFO_QUEUE_URL,
 			accountId: "account-abc",
 		});
@@ -65,7 +61,6 @@ describe("buildSyncMailboxesCommand", () => {
 	// skips the ones that were just enumerated.
 	it("marks an explicitly-requested trigger on the event", () => {
 		const cmd = buildSyncMailboxesCommand({
-			sqsClient: {} as SQSClient,
 			queueUrl: FIFO_QUEUE_URL,
 			accountId: "account-abc",
 			explicitRequest: true,
@@ -76,7 +71,6 @@ describe("buildSyncMailboxesCommand", () => {
 
 	it("leaves a side-effect trigger unmarked", () => {
 		const cmd = buildSyncMailboxesCommand({
-			sqsClient: {} as SQSClient,
 			queueUrl: FIFO_QUEUE_URL,
 			accountId: "account-abc",
 		});
@@ -86,7 +80,6 @@ describe("buildSyncMailboxesCommand", () => {
 
 	it("does not set FIFO params for standard queues", () => {
 		const cmd = buildSyncMailboxesCommand({
-			sqsClient: {} as SQSClient,
 			queueUrl: STANDARD_QUEUE_URL,
 			accountId: "account-abc",
 		});
@@ -97,7 +90,6 @@ describe("buildSyncMailboxesCommand", () => {
 
 	it("builds a SYNC_MAILBOXES event body with accountId and eventId", () => {
 		const cmd = buildSyncMailboxesCommand({
-			sqsClient: {} as SQSClient,
 			queueUrl: FIFO_QUEUE_URL,
 			accountId: "account-abc",
 		});
@@ -111,7 +103,6 @@ describe("buildSyncMailboxesCommand", () => {
 
 	it("targets the configured queue url", () => {
 		const cmd = buildSyncMailboxesCommand({
-			sqsClient: {} as SQSClient,
 			queueUrl: FIFO_QUEUE_URL,
 			accountId: "account-abc",
 		});
@@ -121,7 +112,6 @@ describe("buildSyncMailboxesCommand", () => {
 
 	it("uses the caller-supplied dedupId instead of the manual default", () => {
 		const cmd = buildSyncMailboxesCommand({
-			sqsClient: {} as SQSClient,
 			queueUrl: FIFO_QUEUE_URL,
 			accountId: "account-abc",
 			dedupId: "SYNC_MAILBOXES:scheduled:account-abc:12345",

package/src/service/trigger-sync.ts

@@ -66,7 +66,7 @@ export const buildScheduledSyncDedupId = (
 };
 
 export const buildSyncMailboxesCommand = (
-	input: TriggerAccountSyncInput,
+	input: Omit<TriggerAccountSyncInput, "sqsClient">,
 ): SendMessageCommand => {
 	const { queueUrl, accountId, dedupId, explicitRequest } = input;
 	const event: SyncMailboxesEvent = {