@remit/backend 0.0.101 → 0.0.103

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.101",
+  "version": "0.0.103",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",

package/src/derive/enrichThreadRows.test.ts

@@ -8,6 +8,8 @@ import type {
 	ThreadMessageItem,
 } from "@remit/data-ports";
 import { deriveAddressId } from "@remit/data-ports/id";
+import { hasAbandonedDelete } from "@remit/data-ports/message-settlement";
+import { MessageStatus, MessageSyncStatus } from "@remit/domain-enums";
 import { type EnrichClient, enrichThreadRows } from "./enrichThreadRows.js";
 
 const threadRow = (
@@ -250,3 +252,80 @@ describe("enrichThreadRows — muted", () => {
 		assert.equal(result?.muted, false);
 	});
 });
+
+describe("enrichThreadRows — the mutation pair", () => {
+	const withMessage = (message: Partial<MessageItem>): EnrichClient => ({
+		message: {
+			get: async () =>
+				[{ messageId: "msg-1", ...message }] as unknown as MessageItem[],
+		},
+		address: { getAddress: async () => [] },
+		messageLabel: { listByMessageIds: async () => [] },
+		label: { listByAccountConfig: async () => [] },
+	});
+
+	const project = async (message: Partial<MessageItem>) => {
+		const [result] = await enrichThreadRows(
+			[threadRow("tm-1", "msg-1")],
+			withMessage(message),
+			"acc-1",
+		);
+		return result;
+	};
+
+	test("projects the pair an abandoned delete leaves behind", async () => {
+		const result = await project({
+			status: MessageStatus.active,
+			syncStatus: MessageSyncStatus.failed,
+		});
+		assert.equal(result?.status, MessageStatus.active);
+		assert.equal(result?.syncStatus, MessageSyncStatus.failed);
+		assert.equal(
+			hasAbandonedDelete({
+				status: result?.status,
+				syncStatus: result?.syncStatus,
+			}),
+			true,
+		);
+	});
+
+	test("projects a move mid-retry without calling it a give-up", async () => {
+		const result = await project({
+			status: MessageStatus.moving,
+			syncStatus: MessageSyncStatus.failed,
+		});
+		assert.equal(result?.status, MessageStatus.moving);
+		assert.equal(result?.syncStatus, MessageSyncStatus.failed);
+		assert.equal(
+			hasAbandonedDelete({
+				status: result?.status,
+				syncStatus: result?.syncStatus,
+			}),
+			false,
+		);
+	});
+
+	test("projects an ordinary inbound row", async () => {
+		const result = await project({
+			status: MessageStatus.active,
+			syncStatus: MessageSyncStatus.pending,
+		});
+		assert.equal(result?.status, MessageStatus.active);
+		assert.equal(result?.syncStatus, MessageSyncStatus.pending);
+	});
+
+	test("a row whose Message row is missing claims no mutation", async () => {
+		const [result] = await enrichThreadRows(
+			[threadRow("tm-1", "msg-1")],
+			buildClient([], []),
+			"acc-1",
+		);
+		assert.equal(
+			hasAbandonedDelete({
+				status: result?.status,
+				syncStatus: result?.syncStatus,
+			}),
+			false,
+		);
+	});
+});

package/src/derive/enrichThreadRows.ts

@@ -7,7 +7,12 @@ import type {
 	ThreadMessageItem,
 } from "@remit/data-ports";
 import { deriveAddressId } from "@remit/data-ports/id";
-import { SenderTrust, StarColor } from "@remit/domain-enums";
+import {
+	MessageStatus,
+	MessageSyncStatus,
+	SenderTrust,
+	StarColor,
+} from "@remit/domain-enums";
 import { deriveAutoMoved } from "./autoMoved.js";
 import { deriveMuted } from "./deriveMuted.js";
 import { deriveSenderTrust } from "./senderTrust.js";
@@ -56,6 +61,8 @@ const toResponse = (item: ThreadMessageItem): ThreadMessageResponse => ({
 	updatedAt: item.updatedAt,
 	senderTrust: SenderTrust.Unknown,
 	muted: false,
+	status: MessageStatus.active,
+	syncStatus: MessageSyncStatus.pending,
 });
 
 /**
@@ -102,8 +109,13 @@ export const planBatchFetch = (rows: ThreadMessageItem[]): BatchPlan => {
 /**
  * Enrich a page of ThreadMessage rows with `senderTrust` and `muted` (both
  * derived from the From Address's flags map), `authenticity`, `autoMoved` and
- * `spamReport` (all projected straight from the Message row — no ThreadMessage
- * column of their own, see `deriveAutoMoved`).
+ * `spamReport`, and the `status`/`syncStatus` pair an IMAP mutation leaves
+ * behind (all projected straight from the Message row — no ThreadMessage
+ * column of their own, see `deriveAutoMoved`). `toResponse` seeds that pair
+ * with the ordinary inbound values, which the projection then overwrites; a
+ * ThreadMessage row whose Message row is missing from the batch is broken in a
+ * way this read path cannot report, and claiming a mutation it has no evidence
+ * of would be worse.
  *
  * `category` is not enriched: it is denormalized onto the ThreadMessage row
  * (shared with `Message.category`'s write-once value, see body-sync.ts) and
@@ -174,6 +186,12 @@ export const enrichThreadRows = async (
 	const spamReportByMessageId = new Map(
 		messages.map((m) => [m.messageId, m.spamReport]),
 	);
+	const settlementByMessageId = new Map(
+		messages.map((m) => [
+			m.messageId,
+			{ status: m.status, syncStatus: m.syncStatus },
+		]),
+	);
 	const trustByAddressId = new Map(
 		addresses.map((a) => [a.addressId, deriveSenderTrust(a.flags)]),
 	);
@@ -194,8 +212,10 @@ export const enrichThreadRows = async (
 			? (mutedByAddressId.get(addressId) ?? false)
 			: false;
 		const labels = labelsByMessageId.get(row.messageId);
+		const settlement = settlementByMessageId.get(row.messageId);
 		return {
 			...base,
+			...(settlement ?? {}),
 			...(authenticity !== undefined ? { authenticity } : {}),
 			...(autoMoved !== undefined ? { autoMoved } : {}),
 			...(labels !== undefined ? { labels } : {}),

package/src/derive/filterThreadCriteria.test.ts

@@ -1,7 +1,13 @@
 import assert from "node:assert/strict";
 import { describe, it } from "node:test";
 import type { ThreadMessageResponse } from "@remit/api-openapi-types";
-import { MessageCategory, SenderTrust, StarColor } from "@remit/domain-enums";
+import {
+	MessageCategory,
+	MessageStatus,
+	MessageSyncStatus,
+	SenderTrust,
+	StarColor,
+} from "@remit/domain-enums";
 import {
 	filterByOffRowCriteria,
 	hasOffRowCriteria,
@@ -30,6 +36,8 @@ const row = (
 	updatedAt: 0,
 	senderTrust: SenderTrust.Unknown,
 	muted: false,
+	status: MessageStatus.active,
+	syncStatus: MessageSyncStatus.pending,
 	...overrides,
 });
 

package/src/handlers/account.ts

@@ -105,14 +105,6 @@ const testOAuthConnection = async (
 	account: IAccountRepository,
 	secrets: SecretsService,
 ): Promise<TestConnectionResponse> => {
-	if (!existingAccount.oauthRefreshTokenHash) {
-		return {
-			imapSuccess: false,
-			imapError: "oauth_not_configured",
-			smtpSuccess: undefined,
-		};
-	}
-
 	const tokenService = createMailOAuthService(
 		microsoftProviderConfig({
 			clientId: process.env.MSOAUTH_CLIENT_ID ?? "",
@@ -123,9 +115,9 @@ const testOAuthConnection = async (
 		}),
 	);
 
-	let credentials: Awaited<ReturnType<typeof resolveConnectionCredentials>>;
+	let resolution: Awaited<ReturnType<typeof resolveConnectionCredentials>>;
 	try {
-		credentials = await resolveConnectionCredentials(existingAccount, {
+		resolution = await resolveConnectionCredentials(existingAccount, {
 			secrets,
 			tokenService,
 			persistRotatedToken: async (id, encryptedHash, updatedAt) => {
@@ -149,6 +141,15 @@ const testOAuthConnection = async (
 		throw err;
 	}
 
+	if (resolution.status === "missing") {
+		return {
+			imapSuccess: false,
+			imapError: "oauth_not_configured",
+			smtpSuccess: undefined,
+		};
+	}
+	const credentials = resolution.credentials;
+
 	const result: TestConnectionResponse = {
 		imapSuccess: false,
 		smtpSuccess: undefined,

package/src/handlers/config.test.ts

@@ -1,8 +1,18 @@
 import assert from "node:assert/strict";
 import { describe, it } from "node:test";
 import type { SendMessageCommand, SQSClient } from "@aws-sdk/client-sqs";
+import { AccountAuthType } from "@remit/domain-enums";
 import { triggerConfigLoadSyncs } from "./config.js";
 
+/**
+ * The credential a password account stores. Its content is never read here —
+ * only its presence decides whether a sync is worth enqueuing.
+ */
+const withPassword = (accountId: string) => ({
+	accountId,
+	passwordHash: '{"ciphertext":"x"}',
+});
+
 const QUEUE_URL = "http://localhost:9324/000000000000/remit-dev-mailboxes";
 
 interface LogCall {
@@ -44,17 +54,60 @@ describe("triggerConfigLoadSyncs", () => {
 		const sent: SendMessageCommand[] = [];
 		const { logger, info, error } = createLoggerSpy();
 
-		await triggerConfigLoadSyncs("config-1", ["acc-a", "acc-b"], {
-			sqsClient: okSqsClient(sent),
-			queueUrl: QUEUE_URL,
-			logger,
-		});
+		await triggerConfigLoadSyncs(
+			"config-1",
+			[withPassword("acc-a"), withPassword("acc-b")],
+			{
+				sqsClient: okSqsClient(sent),
+				queueUrl: QUEUE_URL,
+				logger,
+			},
+		);
 
 		assert.equal(sent.length, 2);
 		assert.equal(info.length, 2);
 		assert.equal(error.length, 0);
 	});
 
+	it("skips an account that stores no credential (issue #1120)", async () => {
+		const sent: SendMessageCommand[] = [];
+		const { logger, error } = createLoggerSpy();
+
+		await triggerConfigLoadSyncs(
+			"config-1",
+			[
+				{ accountId: "imported-no-password" },
+				withPassword("acc-with-password"),
+			],
+			{ sqsClient: okSqsClient(sent), queueUrl: QUEUE_URL, logger },
+		);
+
+		assert.equal(sent.length, 1);
+		assert.equal(error.length, 0);
+		const body = JSON.parse(String(sent[0]?.input.MessageBody)) as {
+			accountId: string;
+		};
+		assert.equal(body.accountId, "acc-with-password");
+	});
+
+	it("skips an OAuth account that stores no refresh token", async () => {
+		const sent: SendMessageCommand[] = [];
+		const { logger } = createLoggerSpy();
+
+		await triggerConfigLoadSyncs(
+			"config-1",
+			[
+				{
+					accountId: "oauth-unconnected",
+					authType: AccountAuthType.OauthMicrosoft,
+				},
+			],
+			{ sqsClient: okSqsClient(sent), queueUrl: QUEUE_URL, logger },
+		);
+
+		assert.equal(sent.length, 0);
+	});
+
 	it("does NOT reject when the SQS enqueue fails (read stays resilient)", async () => {
 		const econnrefused = Object.assign(new Error(""), {
 			name: "AggregateError",
@@ -63,7 +116,7 @@ describe("triggerConfigLoadSyncs", () => {
 		const { logger } = createLoggerSpy();
 
 		await assert.doesNotReject(
-			triggerConfigLoadSyncs("config-1", ["acc-a"], {
+			triggerConfigLoadSyncs("config-1", [withPassword("acc-a")], {
 				sqsClient: failingSqsClient(econnrefused),
 				queueUrl: QUEUE_URL,
 				logger,
@@ -78,7 +131,7 @@ describe("triggerConfigLoadSyncs", () => {
 		});
 		const { logger, error } = createLoggerSpy();
 
-		await triggerConfigLoadSyncs("config-1", ["acc-a"], {
+		await triggerConfigLoadSyncs("config-1", [withPassword("acc-a")], {
 			sqsClient: failingSqsClient(econnrefused),
 			queueUrl: QUEUE_URL,
 			logger,
@@ -109,11 +162,15 @@ describe("triggerConfigLoadSyncs", () => {
 		} as unknown as SQSClient;
 		const { logger, info, error } = createLoggerSpy();
 
-		await triggerConfigLoadSyncs("config-1", ["acc-a", "acc-b"], {
-			sqsClient,
-			queueUrl: QUEUE_URL,
-			logger,
-		});
+		await triggerConfigLoadSyncs(
+			"config-1",
+			[withPassword("acc-a"), withPassword("acc-b")],
+			{
+				sqsClient,
+				queueUrl: QUEUE_URL,
+				logger,
+			},
+		);
 
 		assert.equal(error.length, 1);
 		assert.equal(info.length, 1);
@@ -127,7 +184,7 @@ describe("triggerConfigLoadSyncs", () => {
 		});
 		const { logger, error } = createLoggerSpy();
 
-		await triggerConfigLoadSyncs("config-1", ["acc-a"], {
+		await triggerConfigLoadSyncs("config-1", [withPassword("acc-a")], {
 			sqsClient: failingSqsClient(sdkError),
 			queueUrl: QUEUE_URL,
 			logger,
@@ -161,11 +218,15 @@ describe("triggerConfigLoadSyncs", () => {
 		let readResolved = false;
 		try {
 			// Fire-and-forget exactly as the getConfig handler does.
-			void triggerConfigLoadSyncs("config-1", ["acc-a", "acc-b"], {
-				sqsClient: failingSqsClient(econnrefused),
-				queueUrl: QUEUE_URL,
-				logger,
-			});
+			void triggerConfigLoadSyncs(
+				"config-1",
+				[withPassword("acc-a"), withPassword("acc-b")],
+				{
+					sqsClient: failingSqsClient(econnrefused),
+					queueUrl: QUEUE_URL,
+					logger,
+				},
+			);
 
 			// A concurrent "read" sharing the event loop, like /mailboxes or /outbox.
 			await new Promise((resolve) => setImmediate(resolve)).then(() => {

package/src/handlers/config.ts

@@ -14,6 +14,10 @@ import type { AccountConfigItem, MailboxItem } from "@remit/data-ports";
 import { ConfigNotEmptyError, NotFoundError } from "@remit/data-ports/errors";
 import type { CanonicalMailboxRoleValue } from "@remit/data-ports/folder-role";
 import { logger } from "@remit/logger-lambda";
+import {
+	hasStoredCredential,
+	type StoredCredentialFields,
+} from "@remit/mailbox-service/account-credentials";
 import {
 	EMBEDDING_PROVIDER_OFF,
 	readEmbeddingProviderFromEnv,
@@ -77,14 +81,20 @@ const defaultConfigSyncTriggerDeps = (): ConfigSyncTriggerDeps => ({
  * Each failure is logged as a distinct structured error carrying the SDK error
  * name/code on dedicated fields plus a stable `alert: "sync_trigger_failed"`
  * discriminator a CloudWatch metric filter / alarm can key off.
+ *
+ * An account storing no credential is not enqueued at all (issue #1120): the
+ * import wizard lands accounts without a password by design, and the client
+ * polls this read while the user is still typing one. The guard is the stored
+ * credential rather than `connectionState`, which stays `credentials_missing`
+ * until a connect succeeds — see `hasStoredCredential`.
  */
 export const triggerConfigLoadSyncs = async (
 	accountConfigId: string,
-	accountIds: ReadonlyArray<string>,
+	accounts: ReadonlyArray<{ accountId: string } & StoredCredentialFields>,
 	deps: ConfigSyncTriggerDeps = defaultConfigSyncTriggerDeps(),
 ): Promise<void> => {
 	await Promise.all(
-		accountIds.map((accountId) =>
+		accounts.filter(hasStoredCredential).map(({ accountId }) =>
 			fireAndForget(
 				async () => {
 					const { eventId } = await triggerAccountSync({
@@ -224,10 +234,7 @@ export const ConfigOperations: Record<
 		// triggerConfigLoadSyncs swallows nothing — it logs each failure loudly
 		// with an alertable structured field — but it also never rejects, so the
 		// `void` here cannot leak an unhandled rejection into a later request.
-		void triggerConfigLoadSyncs(
-			accountConfigId,
-			activeAccounts.map((acc) => acc.accountId),
-		);
+		void triggerConfigLoadSyncs(accountConfigId, activeAccounts);
 
 		// An import that named folders IMAP had not produced yet rides the config
 		// read rather than a route of its own, so nothing has to poll for it.

package/src/handlers/message.ts

@@ -454,6 +454,8 @@ export const MessageOperations: Record<
 			internalDate: message.internalDate,
 			messageIdHeader: message.messageIdHeader,
 			authenticity: message.authenticity,
+			status: message.status,
+			syncStatus: message.syncStatus,
 			...(autoMoved ? { autoMoved } : {}),
 			...(labels.length > 0 ? { labels } : {}),
 			...(message.spamReport ? { spamReport: message.spamReport } : {}),

package/src/service/trigger-sync.test.ts

@@ -20,7 +20,6 @@ const parseBody = (cmd: SendMessageCommand): Record<string, unknown> => {
 describe("buildSyncMailboxesCommand", () => {
 	it("sets MessageGroupId to accountId for FIFO queues", () => {
 		const cmd = buildSyncMailboxesCommand({
-			sqsClient: {} as SQSClient,
 			queueUrl: FIFO_QUEUE_URL,
 			accountId: "account-abc",
 		});
@@ -30,7 +29,6 @@ describe("buildSyncMailboxesCommand", () => {
 
 	it("defaults MessageDeduplicationId to the event's own id for FIFO queues", () => {
 		const cmd = buildSyncMailboxesCommand({
-			sqsClient: {} as SQSClient,
 			queueUrl: FIFO_QUEUE_URL,
 			accountId: "account-abc",
 		});
@@ -44,12 +42,10 @@ describe("buildSyncMailboxesCommand", () => {
 	// must each reach the queue.
 	it("gives two triggers for one account distinct dedup ids", () => {
 		const first = buildSyncMailboxesCommand({
-			sqsClient: {} as SQSClient,
 			queueUrl: FIFO_QUEUE_URL,
 			accountId: "account-abc",
 		});
 		const second = buildSyncMailboxesCommand({
-			sqsClient: {} as SQSClient,
 			queueUrl: FIFO_QUEUE_URL,
 			accountId: "account-abc",
 		});
@@ -65,7 +61,6 @@ describe("buildSyncMailboxesCommand", () => {
 	// skips the ones that were just enumerated.
 	it("marks an explicitly-requested trigger on the event", () => {
 		const cmd = buildSyncMailboxesCommand({
-			sqsClient: {} as SQSClient,
 			queueUrl: FIFO_QUEUE_URL,
 			accountId: "account-abc",
 			explicitRequest: true,
@@ -76,7 +71,6 @@ describe("buildSyncMailboxesCommand", () => {
 
 	it("leaves a side-effect trigger unmarked", () => {
 		const cmd = buildSyncMailboxesCommand({
-			sqsClient: {} as SQSClient,
 			queueUrl: FIFO_QUEUE_URL,
 			accountId: "account-abc",
 		});
@@ -86,7 +80,6 @@ describe("buildSyncMailboxesCommand", () => {
 
 	it("does not set FIFO params for standard queues", () => {
 		const cmd = buildSyncMailboxesCommand({
-			sqsClient: {} as SQSClient,
 			queueUrl: STANDARD_QUEUE_URL,
 			accountId: "account-abc",
 		});
@@ -97,7 +90,6 @@ describe("buildSyncMailboxesCommand", () => {
 
 	it("builds a SYNC_MAILBOXES event body with accountId and eventId", () => {
 		const cmd = buildSyncMailboxesCommand({
-			sqsClient: {} as SQSClient,
 			queueUrl: FIFO_QUEUE_URL,
 			accountId: "account-abc",
 		});
@@ -111,7 +103,6 @@ describe("buildSyncMailboxesCommand", () => {
 
 	it("targets the configured queue url", () => {
 		const cmd = buildSyncMailboxesCommand({
-			sqsClient: {} as SQSClient,
 			queueUrl: FIFO_QUEUE_URL,
 			accountId: "account-abc",
 		});
@@ -121,7 +112,6 @@ describe("buildSyncMailboxesCommand", () => {
 
 	it("uses the caller-supplied dedupId instead of the manual default", () => {
 		const cmd = buildSyncMailboxesCommand({
-			sqsClient: {} as SQSClient,
 			queueUrl: FIFO_QUEUE_URL,
 			accountId: "account-abc",
 			dedupId: "SYNC_MAILBOXES:scheduled:account-abc:12345",

package/src/service/trigger-sync.ts

@@ -66,7 +66,7 @@ export const buildScheduledSyncDedupId = (
 };
 
 export const buildSyncMailboxesCommand = (
-	input: TriggerAccountSyncInput,
+	input: Omit<TriggerAccountSyncInput, "sqsClient">,
 ): SendMessageCommand => {
 	const { queueUrl, accountId, dedupId, explicitRequest } = input;
 	const event: SyncMailboxesEvent = {