@remit/backend 0.0.110 → 0.0.111

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.110",
+  "version": "0.0.111",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",

package/src/handlers/address.test.ts

@@ -1,6 +1,14 @@
 import assert from "node:assert/strict";
 import { afterEach, describe, it } from "node:test";
-import type { AddressItem, ResultList } from "@remit/data-ports";
+import type {
+	AddressResponse,
+	UpdateAddressInput,
+} from "@remit/api-openapi-types";
+import type {
+	AddressItem,
+	FlagsMergePatch,
+	ResultList,
+} from "@remit/data-ports";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import type { Context } from "openapi-backend";
 import { deriveAccountConfigId } from "../auth.js";
@@ -9,7 +17,7 @@ import {
 	type RemitClient,
 	setClient,
 } from "../service/data-client.js";
-import { AddressOperations } from "./address.js";
+import { AddressDetailOperations, AddressOperations } from "./address.js";
 
 const searchAddresses =
 	AddressOperations.AddressOperations_searchAddresses as unknown as (
@@ -17,6 +25,12 @@ const searchAddresses =
 		event: APIGatewayProxyEvent,
 	) => Promise<ResultList<AddressItem>>;
 
+const updateAddress =
+	AddressDetailOperations.AddressDetailOperations_updateAddress as unknown as (
+		context: Context,
+		event: APIGatewayProxyEvent,
+	) => Promise<AddressResponse>;
+
 const SUB = "cognito-sub-704";
 const ACCOUNT_CONFIG_ID = deriveAccountConfigId(SUB);
 
@@ -130,3 +144,102 @@ describe("AddressOperations_searchAddresses", () => {
 		assert.equal(seen[0].limit, 10);
 	});
 });
+
+const updateContextFor = (body: UpdateAddressInput): Context =>
+	({
+		request: { params: { addressId: "addr-1" }, requestBody: body },
+	}) as unknown as Context;
+
+/**
+ * Fake data client that applies the same merge semantics the repo does:
+ * a `null` in the patch deletes the key, anything else writes it.
+ */
+const clientHolding = (
+	stored: AddressItem,
+	seen: FlagsMergePatch[],
+): RemitClient =>
+	({
+		address: {
+			getAddress: async (): Promise<AddressItem> => stored,
+			mergeFlags: async (
+				_accountConfigId: string,
+				_addressId: string,
+				patch: FlagsMergePatch,
+			): Promise<AddressItem> => {
+				seen.push(patch);
+				const flags: Record<string, unknown> = { ...(stored.flags ?? {}) };
+				for (const [key, value] of Object.entries(patch)) {
+					if (value === undefined) continue;
+					if (value === null) delete flags[key];
+					else flags[key] = value;
+				}
+				return { ...stored, flags } as AddressItem;
+			},
+		},
+	}) as unknown as RemitClient;
+
+describe("AddressDetailOperations_updateAddress removing a flag (#615)", () => {
+	it("clears the category override, which has no false-equivalent value to send", async () => {
+		const seen: FlagsMergePatch[] = [];
+		setClient(
+			clientHolding(
+				address({
+					flags: { category: { value: "newsletter", setAt: 10 } },
+				}),
+				seen,
+			),
+		);
+
+		const response = await updateAddress(
+			updateContextFor({ clearFlags: ["category"] }),
+			eventFor(SUB),
+		);
+
+		assert.deepEqual(seen, [{ category: null }]);
+		assert.equal(response.flags.category, undefined);
+	});
+
+	it("clears a boolean flag by the same route, leaving the untouched ones alone", async () => {
+		const seen: FlagsMergePatch[] = [];
+		setClient(
+			clientHolding(
+				address({
+					flags: {
+						muted: { value: true, setAt: 10 },
+						vip: { value: true, setAt: 11 },
+					},
+				}),
+				seen,
+			),
+		);
+
+		const response = await updateAddress(
+			updateContextFor({ clearFlags: ["muted"] }),
+			eventFor(SUB),
+		);
+
+		assert.equal(response.flags.muted, undefined);
+		assert.deepEqual(response.flags.vip, { value: true, setAt: 11 });
+	});
+
+	it("removes a key named in both halves, because clearFlags is applied last", async () => {
+		const seen: FlagsMergePatch[] = [];
+		setClient(
+			clientHolding(
+				address({ flags: { muted: { value: true, setAt: 10 } } }),
+				seen,
+			),
+		);
+
+		const response = await updateAddress(
+			updateContextFor({
+				flags: { muted: { value: true, setAt: 20 } },
+				clearFlags: ["muted"],
+			}),
+			eventFor(SUB),
+		);
+
+		assert.deepEqual(seen, [{ muted: null }]);
+		assert.equal(response.flags.muted, undefined);
+	});
+});

package/src/handlers/address.ts

@@ -4,6 +4,7 @@ import type {
 } from "@remit/api-openapi-types";
 import type { AddressItem, FlagsMergePatch } from "@remit/data-ports";
 import { ForbiddenError } from "@remit/data-ports/errors";
+import { AddressFlagKey } from "@remit/domain-enums";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import type { Context } from "openapi-backend";
 import { getAccountConfigIdFromEvent } from "../auth.js";
@@ -31,39 +32,43 @@ export const toAddressResponse = (item: AddressItem): AddressResponse => ({
 	updatedAt: item.updatedAt,
 });
 
-const FLAG_KEYS = [
-	"trusted",
-	"blocked",
-	"muted",
-	"vip",
-	"junkOnly",
-	"category",
-	"autoArchive",
-	"unsubscribed",
-] as const;
+type FlagKey = (typeof AddressFlagKey)[keyof typeof AddressFlagKey];
 
-type FlagKey = (typeof FLAG_KEYS)[number];
+const FLAG_KEYS = Object.values(AddressFlagKey) as readonly FlagKey[];
 
 /**
- * Translate the wire-format `UpdateAddressFlagsInput` into a service-level
+ * Translate the wire-format `UpdateAddressInput` into a service-level
  * `FlagsMergePatch`. Only known flag keys are forwarded; unknown keys are
  * silently dropped (a TypeSpec-only schema means unknown keys are a client
- * bug, not a security risk). `null` becomes the explicit "remove" signal.
+ * bug, not a security risk).
+ *
+ * `clearFlags` is the removal form for every flag whatever its value type, and
+ * is applied after `flags`, so a key named in both ends up removed. The `null`
+ * alternative on a flag key stays honoured for callers that can express it,
+ * but it is unreachable over OAS 3.0: TypeSpec emits a nullable `$ref` as
+ * `allOf`, and the request validator drops the `nullable` there.
  */
 export const buildFlagsPatch = (
-	input: UpdateAddressInput["flags"] | undefined,
+	input: UpdateAddressInput | undefined,
 ): FlagsMergePatch => {
 	if (!input) return {};
 	const patch = {} as Record<FlagKey, unknown>;
-	for (const key of FLAG_KEYS) {
-		if (!(key in input)) continue;
-		const value = (input as Record<FlagKey, unknown>)[key];
-		if (value === null) {
-			patch[key] = null;
-			continue;
+	const flags = input.flags;
+	if (flags) {
+		for (const key of FLAG_KEYS) {
+			if (!(key in flags)) continue;
+			const value = (flags as Record<FlagKey, unknown>)[key];
+			if (value === null) {
+				patch[key] = null;
+				continue;
+			}
+			if (value === undefined) continue;
+			patch[key] = value;
 		}
-		if (value === undefined) continue;
-		patch[key] = value;
+	}
+	for (const key of input.clearFlags ?? []) {
+		if (!FLAG_KEYS.includes(key)) continue;
+		patch[key] = null;
 	}
 	return patch as FlagsMergePatch;
 };
@@ -122,7 +127,7 @@ export const AddressDetailOperations: Record<
 			throw new ForbiddenError(`Address ${addressId} not in account config`);
 		}
 
-		const patch = buildFlagsPatch(body.flags);
+		const patch = buildFlagsPatch(body);
 		if (Object.keys(patch).length === 0) {
 			return toAddressResponse(existing);
 		}