@remit/backend 0.0.102 → 0.0.104

package/dev-server/oauth-callback-route.test.ts

@@ -0,0 +1,66 @@
+/**
+ * The OAuth callback through the dev-server's own app — the process a
+ * self-host container runs.
+ *
+ * One hop further than the handler test: the app object imported from
+ * `server.ts`, so what is asserted is the header express actually writes onto
+ * the socket for Microsoft's returning browser. The handler answering 302 is
+ * not the same claim as the browser being sent anywhere, and the difference
+ * between the two was a blank page.
+ *
+ * The identity tier is left unmounted — this app serves the route either way,
+ * and the callback's exemption from the session gate is pinned where that gate
+ * runs, in `src/handlers/account-oauth-callback.test.ts`.
+ */
+
+import assert from "node:assert/strict";
+import type { Server } from "node:http";
+import { after, before, describe, it } from "node:test";
+import {
+	_resetForTest,
+	type RemitClient,
+	setClient,
+} from "../src/service/data-client.js";
+
+const WEB_ORIGIN = "https://mail.example.com";
+
+let server: Server;
+let port: number;
+
+before(async () => {
+	// Microsoft's redirect carries no session, so the callback answers before it
+	// reads anything: no store is touched on this path.
+	setClient({} as unknown as RemitClient);
+
+	process.env.BETTER_AUTH_SECRET = "a-signing-secret-of-at-least-32-characters";
+	process.env.CORS_ALLOWED_ORIGINS = WEB_ORIGIN;
+	process.env.SERVER_PORT = "0";
+
+	const imported = await import("./server.js");
+	server = imported.listener;
+	if (!server.listening) {
+		await new Promise<void>((resolve) => server.once("listening", resolve));
+	}
+	const address = server.address();
+	port = typeof address === "object" && address ? address.port : 0;
+});
+
+after(async () => {
+	await new Promise<void>((resolve) => server.close(() => resolve()));
+	_resetForTest();
+});
+
+describe("GET /accounts/oauth/microsoft/callback through the dev-server's own app", () => {
+	it("answers the browser with somewhere to go", async () => {
+		const response = await fetch(
+			`http://127.0.0.1:${port}/accounts/oauth/microsoft/callback?error=access_denied`,
+			{ redirect: "manual" },
+		);
+
+		assert.equal(response.status, 302);
+		assert.equal(
+			response.headers.get("location"),
+			`${WEB_ORIGIN}/settings/accounts?oauthError=access_denied`,
+		);
+	});
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.102",
+  "version": "0.0.104",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",

package/src/derive/enrichThreadRows.test.ts

@@ -8,6 +8,8 @@ import type {
 	ThreadMessageItem,
 } from "@remit/data-ports";
 import { deriveAddressId } from "@remit/data-ports/id";
+import { hasAbandonedDelete } from "@remit/data-ports/message-settlement";
+import { MessageStatus, MessageSyncStatus } from "@remit/domain-enums";
 import { type EnrichClient, enrichThreadRows } from "./enrichThreadRows.js";
 
 const threadRow = (
@@ -250,3 +252,80 @@ describe("enrichThreadRows — muted", () => {
 		assert.equal(result?.muted, false);
 	});
 });
+
+describe("enrichThreadRows — the mutation pair", () => {
+	const withMessage = (message: Partial<MessageItem>): EnrichClient => ({
+		message: {
+			get: async () =>
+				[{ messageId: "msg-1", ...message }] as unknown as MessageItem[],
+		},
+		address: { getAddress: async () => [] },
+		messageLabel: { listByMessageIds: async () => [] },
+		label: { listByAccountConfig: async () => [] },
+	});
+
+	const project = async (message: Partial<MessageItem>) => {
+		const [result] = await enrichThreadRows(
+			[threadRow("tm-1", "msg-1")],
+			withMessage(message),
+			"acc-1",
+		);
+		return result;
+	};
+
+	test("projects the pair an abandoned delete leaves behind", async () => {
+		const result = await project({
+			status: MessageStatus.active,
+			syncStatus: MessageSyncStatus.failed,
+		});
+		assert.equal(result?.status, MessageStatus.active);
+		assert.equal(result?.syncStatus, MessageSyncStatus.failed);
+		assert.equal(
+			hasAbandonedDelete({
+				status: result?.status,
+				syncStatus: result?.syncStatus,
+			}),
+			true,
+		);
+	});
+
+	test("projects a move mid-retry without calling it a give-up", async () => {
+		const result = await project({
+			status: MessageStatus.moving,
+			syncStatus: MessageSyncStatus.failed,
+		});
+		assert.equal(result?.status, MessageStatus.moving);
+		assert.equal(result?.syncStatus, MessageSyncStatus.failed);
+		assert.equal(
+			hasAbandonedDelete({
+				status: result?.status,
+				syncStatus: result?.syncStatus,
+			}),
+			false,
+		);
+	});
+
+	test("projects an ordinary inbound row", async () => {
+		const result = await project({
+			status: MessageStatus.active,
+			syncStatus: MessageSyncStatus.pending,
+		});
+		assert.equal(result?.status, MessageStatus.active);
+		assert.equal(result?.syncStatus, MessageSyncStatus.pending);
+	});
+
+	test("a row whose Message row is missing claims no mutation", async () => {
+		const [result] = await enrichThreadRows(
+			[threadRow("tm-1", "msg-1")],
+			buildClient([], []),
+			"acc-1",
+		);
+		assert.equal(
+			hasAbandonedDelete({
+				status: result?.status,
+				syncStatus: result?.syncStatus,
+			}),
+			false,
+		);
+	});
+});

package/src/derive/enrichThreadRows.ts

@@ -7,7 +7,12 @@ import type {
 	ThreadMessageItem,
 } from "@remit/data-ports";
 import { deriveAddressId } from "@remit/data-ports/id";
-import { SenderTrust, StarColor } from "@remit/domain-enums";
+import {
+	MessageStatus,
+	MessageSyncStatus,
+	SenderTrust,
+	StarColor,
+} from "@remit/domain-enums";
 import { deriveAutoMoved } from "./autoMoved.js";
 import { deriveMuted } from "./deriveMuted.js";
 import { deriveSenderTrust } from "./senderTrust.js";
@@ -56,6 +61,8 @@ const toResponse = (item: ThreadMessageItem): ThreadMessageResponse => ({
 	updatedAt: item.updatedAt,
 	senderTrust: SenderTrust.Unknown,
 	muted: false,
+	status: MessageStatus.active,
+	syncStatus: MessageSyncStatus.pending,
 });
 
 /**
@@ -102,8 +109,13 @@ export const planBatchFetch = (rows: ThreadMessageItem[]): BatchPlan => {
 /**
  * Enrich a page of ThreadMessage rows with `senderTrust` and `muted` (both
  * derived from the From Address's flags map), `authenticity`, `autoMoved` and
- * `spamReport` (all projected straight from the Message row — no ThreadMessage
- * column of their own, see `deriveAutoMoved`).
+ * `spamReport`, and the `status`/`syncStatus` pair an IMAP mutation leaves
+ * behind (all projected straight from the Message row — no ThreadMessage
+ * column of their own, see `deriveAutoMoved`). `toResponse` seeds that pair
+ * with the ordinary inbound values, which the projection then overwrites; a
+ * ThreadMessage row whose Message row is missing from the batch is broken in a
+ * way this read path cannot report, and claiming a mutation it has no evidence
+ * of would be worse.
  *
  * `category` is not enriched: it is denormalized onto the ThreadMessage row
  * (shared with `Message.category`'s write-once value, see body-sync.ts) and
@@ -174,6 +186,12 @@ export const enrichThreadRows = async (
 	const spamReportByMessageId = new Map(
 		messages.map((m) => [m.messageId, m.spamReport]),
 	);
+	const settlementByMessageId = new Map(
+		messages.map((m) => [
+			m.messageId,
+			{ status: m.status, syncStatus: m.syncStatus },
+		]),
+	);
 	const trustByAddressId = new Map(
 		addresses.map((a) => [a.addressId, deriveSenderTrust(a.flags)]),
 	);
@@ -194,8 +212,10 @@ export const enrichThreadRows = async (
 			? (mutedByAddressId.get(addressId) ?? false)
 			: false;
 		const labels = labelsByMessageId.get(row.messageId);
+		const settlement = settlementByMessageId.get(row.messageId);
 		return {
 			...base,
+			...(settlement ?? {}),
 			...(authenticity !== undefined ? { authenticity } : {}),
 			...(autoMoved !== undefined ? { autoMoved } : {}),
 			...(labels !== undefined ? { labels } : {}),

package/src/derive/filterThreadCriteria.test.ts

@@ -1,7 +1,13 @@
 import assert from "node:assert/strict";
 import { describe, it } from "node:test";
 import type { ThreadMessageResponse } from "@remit/api-openapi-types";
-import { MessageCategory, SenderTrust, StarColor } from "@remit/domain-enums";
+import {
+	MessageCategory,
+	MessageStatus,
+	MessageSyncStatus,
+	SenderTrust,
+	StarColor,
+} from "@remit/domain-enums";
 import {
 	filterByOffRowCriteria,
 	hasOffRowCriteria,
@@ -30,6 +36,8 @@ const row = (
 	updatedAt: 0,
 	senderTrust: SenderTrust.Unknown,
 	muted: false,
+	status: MessageStatus.active,
+	syncStatus: MessageSyncStatus.pending,
 	...overrides,
 });
 

package/src/handlers/account-oauth-callback.test.ts

@@ -0,0 +1,147 @@
+/**
+ * The browser Microsoft sends back, and where it ends up.
+ *
+ * The callback answers a redirect, so the whole response is its Location
+ * header: an answer that arrives without it is a blank page with the account
+ * either connected or not and no way to tell. Driven through the real OpenAPI
+ * document and the self-host request path, so what is asserted is what a
+ * self-hosted deployment writes onto the wire — the header included, which a
+ * handler returning a bare `{statusCode, headers}` shape lost on the way out.
+ */
+
+import assert from "node:assert/strict";
+import { randomUUID } from "node:crypto";
+import { createServer, type Server } from "node:http";
+import type { AddressInfo } from "node:net";
+import { after, before, describe, it } from "node:test";
+import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
+import {
+	_resetForTest,
+	type RemitClient,
+	setClient,
+} from "../service/data-client.js";
+import { signState } from "./account-oauth.js";
+import { createCalendarSqliteClient } from "./calendar-sqlite-fixture.js";
+
+const CLIENT_SECRET = "callback-test-client-secret";
+const WEB_ORIGIN = "https://mail.example.com";
+const CALLBACK_PATH = "/accounts/oauth/microsoft/callback";
+
+let handler: (
+	event: APIGatewayProxyEvent,
+	context: unknown,
+) => Promise<APIGatewayProxyResult>;
+let client: RemitClient;
+let cleanup: () => void;
+let tokenEndpoint: Server;
+
+const jwt = (claims: Record<string, unknown>): string =>
+	[
+		Buffer.from(JSON.stringify({ alg: "RS256" })).toString("base64url"),
+		Buffer.from(JSON.stringify(claims), "utf8").toString("base64url"),
+		"signature-not-checked-here",
+	].join(".");
+
+/** Microsoft's token endpoint, close enough for the one call the callback makes. */
+const startTokenEndpoint = async (): Promise<string> => {
+	tokenEndpoint = createServer((_request, response) => {
+		response.writeHead(200, { "Content-Type": "application/json" });
+		response.end(
+			JSON.stringify({
+				access_token: "access-token",
+				refresh_token: "refresh-token",
+				id_token: jwt({ preferred_username: "matthijs@example.com" }),
+				expires_in: 3600,
+			}),
+		);
+	});
+	await new Promise<void>((resolve) => tokenEndpoint.listen(0, resolve));
+	const { port } = tokenEndpoint.address() as AddressInfo;
+	return `http://127.0.0.1:${port}/token`;
+};
+
+const callback = (
+	query: Record<string, string>,
+): Promise<APIGatewayProxyResult> =>
+	handler(
+		{
+			httpMethod: "GET",
+			path: CALLBACK_PATH,
+			headers: {},
+			queryStringParameters: query,
+			body: null,
+			requestContext: {},
+		} as unknown as APIGatewayProxyEvent,
+		{ awsRequestId: `req-${randomUUID()}`, functionName: "test" },
+	);
+
+const headerOf = (
+	response: APIGatewayProxyResult,
+	name: string,
+): string | undefined => {
+	for (const [key, value] of Object.entries(response.headers ?? {})) {
+		if (key.toLowerCase() === name) return String(value);
+	}
+	return undefined;
+};
+
+before(async () => {
+	_resetForTest();
+	process.env.DATA_BACKEND = "sqlite";
+	process.env.CORS_ALLOWED_ORIGINS = WEB_ORIGIN;
+	process.env.MSOAUTH_REDIRECT_URI = `${WEB_ORIGIN}${CALLBACK_PATH}`;
+	process.env.MSOAUTH_CLIENT_ID = "callback-test-client-id";
+	process.env.MSOAUTH_CLIENT_SECRET = CLIENT_SECRET;
+	process.env.MSOAUTH_TOKEN_ENDPOINT = await startTokenEndpoint();
+	// The self-host key that encrypts the stored refresh token.
+	process.env.FAKE_KMS_DATAKEY = "0".repeat(64);
+	// Static credentials so the best-effort sync enqueue fails against the local
+	// queue instead of walking the instance-metadata chain for a minute.
+	process.env.AWS_REGION = "eu-west-1";
+	process.env.AWS_ACCESS_KEY_ID = "test";
+	process.env.AWS_SECRET_ACCESS_KEY = "test";
+	({ client, cleanup } = await createCalendarSqliteClient());
+	setClient(client);
+	({ handler } = (await import("../index.js")) as unknown as {
+		handler: typeof handler;
+	});
+});
+
+after(async () => {
+	_resetForTest();
+	cleanup();
+	await new Promise<void>((resolve) => tokenEndpoint.close(() => resolve()));
+});
+
+describe("the Microsoft OAuth callback", () => {
+	it("sends the consenting browser on to the connected account", async () => {
+		const accountConfigId = randomUUID();
+		const state = await signState(
+			{ accountConfigId, nonce: "nonce", timestamp: Date.now() },
+			CLIENT_SECRET,
+		);
+
+		const response = await callback({ code: "auth-code", state });
+
+		assert.equal(response.statusCode, 302, response.body);
+		const location = headerOf(response, "location");
+		assert.ok(location, "a redirect without a Location header is a blank page");
+		const [connected] =
+			await client.account.listAllByAccountConfig(accountConfigId);
+		assert.ok(connected, "the callback stored the account it redirects to");
+		assert.equal(
+			location,
+			`${WEB_ORIGIN}/settings/accounts?connected=${encodeURIComponent(connected.accountId)}`,
+		);
+	});
+
+	it("sends a refused consent back with the reason Microsoft gave", async () => {
+		const response = await callback({ error: "access_denied" });
+
+		assert.equal(response.statusCode, 302, response.body);
+		assert.equal(
+			headerOf(response, "location"),
+			`${WEB_ORIGIN}/settings/accounts?oauthError=access_denied`,
+		);
+	});
+});

package/src/handlers/account-oauth.ts

@@ -16,6 +16,7 @@ import type { Context } from "openapi-backend";
 import { getAccountConfigIdFromEvent } from "../auth.js";
 import { getMsOAuthConfig } from "../config/msoauth.js";
 import { safeJsonParse } from "../json.js";
+import { rawApiResponse } from "../response.js";
 import { getClient } from "../service/data-client.js";
 import type { MicrosoftOAuthOperationIds, OperationHandler } from "../types.js";
 import { triggerAccountSyncSafe } from "./account.js";
@@ -228,11 +229,15 @@ export const MicrosoftOAuthOperations: Record<
 		const webOrigin = getWebOrigin();
 		const qs = event.queryStringParameters ?? {};
 
-		const redirect = (url: string): APIGatewayProxyResult => ({
-			statusCode: 302,
-			headers: { Location: url },
-			body: "",
-		});
+		// Marked raw so the response formatter forwards the Location header
+		// instead of serializing this object as a JSON body. Microsoft's browser
+		// redirect lands here, so a dropped Location is a blank page.
+		const redirect = (url: string): APIGatewayProxyResult =>
+			rawApiResponse({
+				statusCode: 302,
+				headers: { Location: url },
+				body: "",
+			});
 
 		// If Microsoft returned an error, pass it through to the frontend
 		if (qs.error) {

package/src/handlers/calendar-sqlite-fixture.ts

@@ -1,50 +1,22 @@
-import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { applyShippedMigrations } from "@remit/drizzle-service/test-sqlite";
 import Database from "better-sqlite3";
 import { buildSqliteClient } from "../service/compose-sqlite.js";
 import type { RemitClient } from "../service/data-client.js";
 
 /**
- * A calendar handler test's store: the backend's own SQLite composition, over
- * the DDL a self-host deployment actually runs.
+ * A handler test's store: the backend's own SQLite composition, over the DDL a
+ * self-host deployment actually runs.
  *
- * The migrations are read rather than pushed from the drizzle table objects, so
- * a handler test exercises the shipped column shapes — the same reason
- * `test-shipped-sqlite-schema.ts` exists on the repository side. The client is
- * built by `compose-sqlite.ts`, which is the composition root a self-host
- * process boots, so nothing here is a second wiring of the calendar repos that
- * could drift from the one that ships.
- */
-const MIGRATIONS = new URL(
-	"../../../../deploy/vps/migrations-sqlite/entities/",
-	import.meta.url,
-);
-
-interface Journal {
-	entries: Array<{ idx: number; tag: string }>;
-}
-
-const applyEntityMigrations = (sqlite: Database.Database): void => {
-	const journal = JSON.parse(
-		readFileSync(new URL("meta/_journal.json", MIGRATIONS), "utf8"),
-	) as Journal;
-	const ordered = [...journal.entries].sort(
-		(left, right) => left.idx - right.idx,
-	);
-	for (const entry of ordered) {
-		const sql = readFileSync(new URL(`${entry.tag}.sql`, MIGRATIONS), "utf8");
-		for (const statement of sql.split("--> statement-breakpoint")) {
-			if (statement.trim() === "") continue;
-			sqlite.exec(statement);
-		}
-	}
-};
-
-/**
- * A migrated database and the client that reads it. One per test file: every
- * calendar row is scoped by account config, so a test that mints its own
- * account config sees only what it wrote.
+ * The migrations are applied rather than pushed from the drizzle table objects,
+ * so a handler test exercises the shipped column shapes. The client is built by
+ * `compose-sqlite.ts`, the composition root a self-host process boots, so
+ * nothing here is a second wiring that could drift from the one that ships.
+ *
+ * One per test file: every row is scoped by account config, so a test that
+ * mints its own account config sees only what it wrote.
  */
 export const createCalendarSqliteClient = async (): Promise<{
 	client: RemitClient;
@@ -53,7 +25,7 @@ export const createCalendarSqliteClient = async (): Promise<{
 	const directory = mkdtempSync(join(tmpdir(), "remit-calendar-handlers-"));
 	const path = join(directory, "remit.db");
 	const sqlite = new Database(path);
-	applyEntityMigrations(sqlite);
+	applyShippedMigrations(sqlite);
 	sqlite.close();
 
 	process.env.SQLITE_DB_PATH = path;

package/src/handlers/message.ts

@@ -454,6 +454,8 @@ export const MessageOperations: Record<
 			internalDate: message.internalDate,
 			messageIdHeader: message.messageIdHeader,
 			authenticity: message.authenticity,
+			status: message.status,
+			syncStatus: message.syncStatus,
 			...(autoMoved ? { autoMoved } : {}),
 			...(labels.length > 0 ? { labels } : {}),
 			...(message.spamReport ? { spamReport: message.spamReport } : {}),

package/src/response.ts

@@ -10,13 +10,14 @@ import {
 const RAW_API_RESPONSE: unique symbol = Symbol("remit.rawApiResponse");
 
 /**
- * A response whose bytes are not JSON — an iCalendar feed, and whatever later
- * joins it.
+ * A response the caller reads by something other than its JSON body — an
+ * iCalendar feed, an OAuth redirect's Location, and whatever later joins them.
  *
  * Every other handler returns a plain object and lets this module decide the
  * status, the content type and the serialization. That is the right default and
- * stays the default; a handler that has to own its own media type says so with
- * `rawApiResponse` rather than by returning a shape this one has to guess at.
+ * stays the default; a handler that has to own its own media type or headers
+ * says so with `rawApiResponse` rather than by returning a shape this one has
+ * to guess at.
  * The CORS and correlation headers are still added here, so a raw response is
  * not a way around them.
  */