@remit/backend 0.0.103 → 0.0.104

package/dev-server/oauth-callback-route.test.ts

@@ -0,0 +1,66 @@
+/**
+ * The OAuth callback through the dev-server's own app — the process a
+ * self-host container runs.
+ *
+ * One hop further than the handler test: the app object imported from
+ * `server.ts`, so what is asserted is the header express actually writes onto
+ * the socket for Microsoft's returning browser. The handler answering 302 is
+ * not the same claim as the browser being sent anywhere, and the difference
+ * between the two was a blank page.
+ *
+ * The identity tier is left unmounted — this app serves the route either way,
+ * and the callback's exemption from the session gate is pinned where that gate
+ * runs, in `src/handlers/account-oauth-callback.test.ts`.
+ */
+
+import assert from "node:assert/strict";
+import type { Server } from "node:http";
+import { after, before, describe, it } from "node:test";
+import {
+	_resetForTest,
+	type RemitClient,
+	setClient,
+} from "../src/service/data-client.js";
+
+const WEB_ORIGIN = "https://mail.example.com";
+
+let server: Server;
+let port: number;
+
+before(async () => {
+	// Microsoft's redirect carries no session, so the callback answers before it
+	// reads anything: no store is touched on this path.
+	setClient({} as unknown as RemitClient);
+
+	process.env.BETTER_AUTH_SECRET = "a-signing-secret-of-at-least-32-characters";
+	process.env.CORS_ALLOWED_ORIGINS = WEB_ORIGIN;
+	process.env.SERVER_PORT = "0";
+
+	const imported = await import("./server.js");
+	server = imported.listener;
+	if (!server.listening) {
+		await new Promise<void>((resolve) => server.once("listening", resolve));
+	}
+	const address = server.address();
+	port = typeof address === "object" && address ? address.port : 0;
+});
+
+after(async () => {
+	await new Promise<void>((resolve) => server.close(() => resolve()));
+	_resetForTest();
+});
+
+describe("GET /accounts/oauth/microsoft/callback through the dev-server's own app", () => {
+	it("answers the browser with somewhere to go", async () => {
+		const response = await fetch(
+			`http://127.0.0.1:${port}/accounts/oauth/microsoft/callback?error=access_denied`,
+			{ redirect: "manual" },
+		);
+
+		assert.equal(response.status, 302);
+		assert.equal(
+			response.headers.get("location"),
+			`${WEB_ORIGIN}/settings/accounts?oauthError=access_denied`,
+		);
+	});
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.103",
+  "version": "0.0.104",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",

package/src/handlers/account-oauth-callback.test.ts

@@ -0,0 +1,147 @@
+/**
+ * The browser Microsoft sends back, and where it ends up.
+ *
+ * The callback answers a redirect, so the whole response is its Location
+ * header: an answer that arrives without it is a blank page with the account
+ * either connected or not and no way to tell. Driven through the real OpenAPI
+ * document and the self-host request path, so what is asserted is what a
+ * self-hosted deployment writes onto the wire — the header included, which a
+ * handler returning a bare `{statusCode, headers}` shape lost on the way out.
+ */
+
+import assert from "node:assert/strict";
+import { randomUUID } from "node:crypto";
+import { createServer, type Server } from "node:http";
+import type { AddressInfo } from "node:net";
+import { after, before, describe, it } from "node:test";
+import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
+import {
+	_resetForTest,
+	type RemitClient,
+	setClient,
+} from "../service/data-client.js";
+import { signState } from "./account-oauth.js";
+import { createCalendarSqliteClient } from "./calendar-sqlite-fixture.js";
+
+const CLIENT_SECRET = "callback-test-client-secret";
+const WEB_ORIGIN = "https://mail.example.com";
+const CALLBACK_PATH = "/accounts/oauth/microsoft/callback";
+
+let handler: (
+	event: APIGatewayProxyEvent,
+	context: unknown,
+) => Promise<APIGatewayProxyResult>;
+let client: RemitClient;
+let cleanup: () => void;
+let tokenEndpoint: Server;
+
+const jwt = (claims: Record<string, unknown>): string =>
+	[
+		Buffer.from(JSON.stringify({ alg: "RS256" })).toString("base64url"),
+		Buffer.from(JSON.stringify(claims), "utf8").toString("base64url"),
+		"signature-not-checked-here",
+	].join(".");
+
+/** Microsoft's token endpoint, close enough for the one call the callback makes. */
+const startTokenEndpoint = async (): Promise<string> => {
+	tokenEndpoint = createServer((_request, response) => {
+		response.writeHead(200, { "Content-Type": "application/json" });
+		response.end(
+			JSON.stringify({
+				access_token: "access-token",
+				refresh_token: "refresh-token",
+				id_token: jwt({ preferred_username: "matthijs@example.com" }),
+				expires_in: 3600,
+			}),
+		);
+	});
+	await new Promise<void>((resolve) => tokenEndpoint.listen(0, resolve));
+	const { port } = tokenEndpoint.address() as AddressInfo;
+	return `http://127.0.0.1:${port}/token`;
+};
+
+const callback = (
+	query: Record<string, string>,
+): Promise<APIGatewayProxyResult> =>
+	handler(
+		{
+			httpMethod: "GET",
+			path: CALLBACK_PATH,
+			headers: {},
+			queryStringParameters: query,
+			body: null,
+			requestContext: {},
+		} as unknown as APIGatewayProxyEvent,
+		{ awsRequestId: `req-${randomUUID()}`, functionName: "test" },
+	);
+
+const headerOf = (
+	response: APIGatewayProxyResult,
+	name: string,
+): string | undefined => {
+	for (const [key, value] of Object.entries(response.headers ?? {})) {
+		if (key.toLowerCase() === name) return String(value);
+	}
+	return undefined;
+};
+
+before(async () => {
+	_resetForTest();
+	process.env.DATA_BACKEND = "sqlite";
+	process.env.CORS_ALLOWED_ORIGINS = WEB_ORIGIN;
+	process.env.MSOAUTH_REDIRECT_URI = `${WEB_ORIGIN}${CALLBACK_PATH}`;
+	process.env.MSOAUTH_CLIENT_ID = "callback-test-client-id";
+	process.env.MSOAUTH_CLIENT_SECRET = CLIENT_SECRET;
+	process.env.MSOAUTH_TOKEN_ENDPOINT = await startTokenEndpoint();
+	// The self-host key that encrypts the stored refresh token.
+	process.env.FAKE_KMS_DATAKEY = "0".repeat(64);
+	// Static credentials so the best-effort sync enqueue fails against the local
+	// queue instead of walking the instance-metadata chain for a minute.
+	process.env.AWS_REGION = "eu-west-1";
+	process.env.AWS_ACCESS_KEY_ID = "test";
+	process.env.AWS_SECRET_ACCESS_KEY = "test";
+	({ client, cleanup } = await createCalendarSqliteClient());
+	setClient(client);
+	({ handler } = (await import("../index.js")) as unknown as {
+		handler: typeof handler;
+	});
+});
+
+after(async () => {
+	_resetForTest();
+	cleanup();
+	await new Promise<void>((resolve) => tokenEndpoint.close(() => resolve()));
+});
+
+describe("the Microsoft OAuth callback", () => {
+	it("sends the consenting browser on to the connected account", async () => {
+		const accountConfigId = randomUUID();
+		const state = await signState(
+			{ accountConfigId, nonce: "nonce", timestamp: Date.now() },
+			CLIENT_SECRET,
+		);
+
+		const response = await callback({ code: "auth-code", state });
+
+		assert.equal(response.statusCode, 302, response.body);
+		const location = headerOf(response, "location");
+		assert.ok(location, "a redirect without a Location header is a blank page");
+		const [connected] =
+			await client.account.listAllByAccountConfig(accountConfigId);
+		assert.ok(connected, "the callback stored the account it redirects to");
+		assert.equal(
+			location,
+			`${WEB_ORIGIN}/settings/accounts?connected=${encodeURIComponent(connected.accountId)}`,
+		);
+	});
+
+	it("sends a refused consent back with the reason Microsoft gave", async () => {
+		const response = await callback({ error: "access_denied" });
+
+		assert.equal(response.statusCode, 302, response.body);
+		assert.equal(
+			headerOf(response, "location"),
+			`${WEB_ORIGIN}/settings/accounts?oauthError=access_denied`,
+		);
+	});
+});

package/src/handlers/account-oauth.ts

@@ -16,6 +16,7 @@ import type { Context } from "openapi-backend";
 import { getAccountConfigIdFromEvent } from "../auth.js";
 import { getMsOAuthConfig } from "../config/msoauth.js";
 import { safeJsonParse } from "../json.js";
+import { rawApiResponse } from "../response.js";
 import { getClient } from "../service/data-client.js";
 import type { MicrosoftOAuthOperationIds, OperationHandler } from "../types.js";
 import { triggerAccountSyncSafe } from "./account.js";
@@ -228,11 +229,15 @@ export const MicrosoftOAuthOperations: Record<
 		const webOrigin = getWebOrigin();
 		const qs = event.queryStringParameters ?? {};
 
-		const redirect = (url: string): APIGatewayProxyResult => ({
-			statusCode: 302,
-			headers: { Location: url },
-			body: "",
-		});
+		// Marked raw so the response formatter forwards the Location header
+		// instead of serializing this object as a JSON body. Microsoft's browser
+		// redirect lands here, so a dropped Location is a blank page.
+		const redirect = (url: string): APIGatewayProxyResult =>
+			rawApiResponse({
+				statusCode: 302,
+				headers: { Location: url },
+				body: "",
+			});
 
 		// If Microsoft returned an error, pass it through to the frontend
 		if (qs.error) {

package/src/handlers/calendar-sqlite-fixture.ts

@@ -1,50 +1,22 @@
-import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { applyShippedMigrations } from "@remit/drizzle-service/test-sqlite";
 import Database from "better-sqlite3";
 import { buildSqliteClient } from "../service/compose-sqlite.js";
 import type { RemitClient } from "../service/data-client.js";
 
 /**
- * A calendar handler test's store: the backend's own SQLite composition, over
- * the DDL a self-host deployment actually runs.
+ * A handler test's store: the backend's own SQLite composition, over the DDL a
+ * self-host deployment actually runs.
  *
- * The migrations are read rather than pushed from the drizzle table objects, so
- * a handler test exercises the shipped column shapes — the same reason
- * `test-shipped-sqlite-schema.ts` exists on the repository side. The client is
- * built by `compose-sqlite.ts`, which is the composition root a self-host
- * process boots, so nothing here is a second wiring of the calendar repos that
- * could drift from the one that ships.
- */
-const MIGRATIONS = new URL(
-	"../../../../deploy/vps/migrations-sqlite/entities/",
-	import.meta.url,
-);
-
-interface Journal {
-	entries: Array<{ idx: number; tag: string }>;
-}
-
-const applyEntityMigrations = (sqlite: Database.Database): void => {
-	const journal = JSON.parse(
-		readFileSync(new URL("meta/_journal.json", MIGRATIONS), "utf8"),
-	) as Journal;
-	const ordered = [...journal.entries].sort(
-		(left, right) => left.idx - right.idx,
-	);
-	for (const entry of ordered) {
-		const sql = readFileSync(new URL(`${entry.tag}.sql`, MIGRATIONS), "utf8");
-		for (const statement of sql.split("--> statement-breakpoint")) {
-			if (statement.trim() === "") continue;
-			sqlite.exec(statement);
-		}
-	}
-};
-
-/**
- * A migrated database and the client that reads it. One per test file: every
- * calendar row is scoped by account config, so a test that mints its own
- * account config sees only what it wrote.
+ * The migrations are applied rather than pushed from the drizzle table objects,
+ * so a handler test exercises the shipped column shapes. The client is built by
+ * `compose-sqlite.ts`, the composition root a self-host process boots, so
+ * nothing here is a second wiring that could drift from the one that ships.
+ *
+ * One per test file: every row is scoped by account config, so a test that
+ * mints its own account config sees only what it wrote.
  */
 export const createCalendarSqliteClient = async (): Promise<{
 	client: RemitClient;
@@ -53,7 +25,7 @@ export const createCalendarSqliteClient = async (): Promise<{
 	const directory = mkdtempSync(join(tmpdir(), "remit-calendar-handlers-"));
 	const path = join(directory, "remit.db");
 	const sqlite = new Database(path);
-	applyEntityMigrations(sqlite);
+	applyShippedMigrations(sqlite);
 	sqlite.close();
 
 	process.env.SQLITE_DB_PATH = path;

package/src/response.ts

@@ -10,13 +10,14 @@ import {
 const RAW_API_RESPONSE: unique symbol = Symbol("remit.rawApiResponse");
 
 /**
- * A response whose bytes are not JSON — an iCalendar feed, and whatever later
- * joins it.
+ * A response the caller reads by something other than its JSON body — an
+ * iCalendar feed, an OAuth redirect's Location, and whatever later joins them.
  *
  * Every other handler returns a plain object and lets this module decide the
  * status, the content type and the serialization. That is the right default and
- * stays the default; a handler that has to own its own media type says so with
- * `rawApiResponse` rather than by returning a shape this one has to guess at.
+ * stays the default; a handler that has to own its own media type or headers
+ * says so with `rawApiResponse` rather than by returning a shape this one has
+ * to guess at.
  * The CORS and correlation headers are still added here, so a raw response is
  * not a way around them.
  */