@remit/backend 0.0.126 → 0.0.128

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.126",
+  "version": "0.0.128",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",

package/src/handlers/account-guards.ts

@@ -6,6 +6,10 @@ import type {
 import type { AccountItem } from "@remit/data-ports";
 import { BadRequestError, ConflictError } from "@remit/data-ports/errors";
 import { AccountAuthType, AccountService } from "@remit/domain-enums";
+import {
+	microsoftServicesGranted,
+	orderServices,
+} from "@remit/mail-oauth-service";
 import type { AccountOverrides } from "./account-overrides.js";
 import type { AccountSignature } from "./account-signature.js";
 
@@ -85,23 +89,17 @@ export const assertPasswordProvided = (
 	}
 };
 
-const MICROSOFT_GRANT_SERVICES: readonly AccountServiceName[] = [
-	AccountService.Mail,
-];
-
 export const resolveSyncedServices = (
-	authType: string,
+	account: Pick<AccountItem, "authType" | "grantedScopes">,
 	requested: readonly AccountServiceName[],
 ): AccountServiceName[] => {
-	const services = Object.values(AccountService).filter((service) =>
-		requested.includes(service),
-	);
+	const services = orderServices(requested);
 	if (services.length === 0) {
 		throw new BadRequestError(
 			"syncedServices must name at least one service. To stop syncing an account entirely, delete it with DELETE /accounts/{accountId}.",
 		);
 	}
-	if (authType !== AccountAuthType.OauthMicrosoft) {
+	if (account.authType !== AccountAuthType.OauthMicrosoft) {
 		if (services.some((service) => service !== AccountService.Mail)) {
 			throw new BadRequestError(
 				`A password account syncs mail only, so syncedServices must be ["${AccountService.Mail}"].`,
@@ -109,12 +107,11 @@ export const resolveSyncedServices = (
 		}
 		return services;
 	}
-	const uncovered = services.filter(
-		(service) => !MICROSOFT_GRANT_SERVICES.includes(service),
-	);
+	const granted = microsoftServicesGranted(account.grantedScopes);
+	const uncovered = services.filter((service) => !granted.includes(service));
 	if (uncovered.length > 0) {
 		throw new BadRequestError(
-			`This account's Microsoft consent does not cover ${uncovered.join(", ")}. Grant it through POST /accounts/oauth/microsoft/start.`,
+			`This account's granted scopes lack ${uncovered.join(", ")}. Consent to them through POST /accounts/oauth/microsoft/start with services ${JSON.stringify(services)}, then sign in to Microsoft again.`,
 		);
 	}
 	return services;
@@ -140,6 +137,7 @@ export const toAccountResponse = (
 	email: account.email,
 	authType: account.authType ?? AccountAuthType.Password,
 	syncedServices: account.syncedServices,
+	grantedScopes: account.grantedScopes,
 	imapHost: account.imapHost,
 	imapPort: account.imapPort,
 	imapTls: account.imapTls,

package/src/handlers/account-oauth-callback.test.ts

@@ -14,6 +14,7 @@ import { randomUUID } from "node:crypto";
 import { createServer, type Server } from "node:http";
 import type { AddressInfo } from "node:net";
 import { after, before, describe, it } from "node:test";
+import { AccountService } from "@remit/domain-enums";
 import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
 import {
 	_resetForTest,
@@ -51,6 +52,8 @@ const startTokenEndpoint = async (): Promise<string> => {
 				access_token: "access-token",
 				refresh_token: "refresh-token",
 				id_token: jwt({ preferred_username: "matthijs@example.com" }),
+				scope:
+					"https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send",
 				expires_in: 3600,
 			}),
 		);
@@ -117,7 +120,12 @@ describe("the Microsoft OAuth callback", () => {
 	it("sends the consenting browser on to the connected account", async () => {
 		const accountConfigId = randomUUID();
 		const state = await signState(
-			{ accountConfigId, nonce: "nonce", timestamp: Date.now() },
+			{
+				accountConfigId,
+				nonce: "nonce",
+				timestamp: Date.now(),
+				services: [AccountService.Mail],
+			},
 			CLIENT_SECRET,
 		);
 

package/src/handlers/account-oauth-consent.test.ts

@@ -0,0 +1,336 @@
+import assert from "node:assert/strict";
+import { randomUUID } from "node:crypto";
+import { createServer, type Server } from "node:http";
+import type { AddressInfo } from "node:net";
+import { after, before, beforeEach, describe, it } from "node:test";
+import type {
+	AccountResponse,
+	AccountService as AccountServiceName,
+} from "@remit/api-openapi-types";
+import { AccountService } from "@remit/domain-enums";
+import { MICROSOFT_SERVICE_SCOPES } from "@remit/mail-oauth-service";
+import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
+import { deriveAccountConfigId } from "../auth.js";
+import {
+	_resetForTest,
+	type RemitClient,
+	setClient,
+} from "../service/data-client.js";
+import { createCalendarSqliteClient } from "./calendar-sqlite-fixture.js";
+
+const CLIENT_SECRET = "consent-test-client-secret";
+const WEB_ORIGIN = "https://mail.example.com";
+const GRAPH = "https://graph.microsoft.com/";
+const MAIL_SCOPES = [...MICROSOFT_SERVICE_SCOPES[AccountService.Mail]];
+const CALENDAR_SCOPES = [...MICROSOFT_SERVICE_SCOPES[AccountService.Calendar]];
+
+let handler: (
+	event: APIGatewayProxyEvent,
+	context: unknown,
+) => Promise<APIGatewayProxyResult>;
+let client: RemitClient;
+let cleanup: () => void;
+let tokenEndpoint: Server;
+let withheld: Set<string>;
+let redemptions: string[][];
+
+const jwt = (claims: Record<string, unknown>): string =>
+	[
+		Buffer.from(JSON.stringify({ alg: "RS256" })).toString("base64url"),
+		Buffer.from(JSON.stringify(claims), "utf8").toString("base64url"),
+		"signature-not-checked-here",
+	].join(".");
+
+const readBody = async (request: AsyncIterable<Buffer>): Promise<string> => {
+	const chunks: Buffer[] = [];
+	for await (const chunk of request) chunks.push(chunk);
+	return Buffer.concat(chunks).toString("utf8");
+};
+
+const startTokenEndpoint = async (): Promise<string> => {
+	tokenEndpoint = createServer(async (request, response) => {
+		const form = new URLSearchParams(await readBody(request));
+		const requested = (form.get("scope") ?? "").split(" ").filter(Boolean);
+		redemptions.push(requested);
+		const granted = requested.filter((scope) => !withheld.has(scope));
+		const resourceScopes = granted.filter((scope) => scope.includes("://"));
+		if (resourceScopes.length === 0) {
+			response.writeHead(400, { "Content-Type": "application/json" });
+			response.end(
+				JSON.stringify({ error: "invalid_grant", error_codes: [65001] }),
+			);
+			return;
+		}
+		response.writeHead(200, { "Content-Type": "application/json" });
+		response.end(
+			JSON.stringify({
+				access_token: "access-token",
+				refresh_token: `refresh-token-${redemptions.length}`,
+				id_token: jwt({ preferred_username: "person@example.com" }),
+				expires_in: 3600,
+				scope: granted
+					.map((scope) =>
+						scope.startsWith(GRAPH) ? scope.slice(GRAPH.length) : scope,
+					)
+					.join(" "),
+			}),
+		);
+	});
+	await new Promise<void>((resolve) => tokenEndpoint.listen(0, resolve));
+	const { port } = tokenEndpoint.address() as AddressInfo;
+	return `http://127.0.0.1:${port}/token`;
+};
+
+const headerOf = (
+	response: APIGatewayProxyResult,
+	name: string,
+): string | undefined => {
+	for (const [key, value] of Object.entries(response.headers ?? {})) {
+		if (key.toLowerCase() === name) return String(value);
+	}
+	return undefined;
+};
+
+const request = (
+	sub: string,
+	httpMethod: string,
+	path: string,
+	body: unknown,
+	queryStringParameters: Record<string, string> | null = null,
+): Promise<APIGatewayProxyResult> =>
+	handler(
+		{
+			httpMethod,
+			path,
+			headers: { "content-type": "application/json" },
+			queryStringParameters,
+			body: body === null ? null : JSON.stringify(body),
+			requestContext: { authorizer: { claims: { sub } } },
+		} as unknown as APIGatewayProxyEvent,
+		{ awsRequestId: `req-${randomUUID()}`, functionName: "test" },
+	);
+
+const startConsent = async (
+	sub: string,
+	services: AccountServiceName[] | undefined,
+): Promise<URL> => {
+	const response = await request(
+		sub,
+		"POST",
+		"/accounts/oauth/microsoft/start",
+		{
+			email: "person@example.com",
+			services,
+		},
+	);
+	assert.equal(response.statusCode, 200, response.body);
+	return new URL(
+		(JSON.parse(response.body) as { authorizationUrl: string })
+			.authorizationUrl,
+	);
+};
+
+const consent = async (
+	sub: string,
+	services: AccountServiceName[] | undefined,
+): Promise<string> => {
+	const authorizationUrl = await startConsent(sub, services);
+	const state = authorizationUrl.searchParams.get("state");
+	assert.ok(state, "the authorization URL carries the signed state");
+	const response = await request(
+		sub,
+		"GET",
+		"/accounts/oauth/microsoft/callback",
+		null,
+		{ code: "auth-code", state },
+	);
+	assert.equal(response.statusCode, 302, response.body);
+	const location = headerOf(response, "location");
+	assert.ok(location, "the callback answers with a Location");
+	return location;
+};
+
+const onlyAccount = async (sub: string) => {
+	const accounts = await client.account.listAllByAccountConfig(
+		deriveAccountConfigId(sub),
+	);
+	assert.equal(accounts.length, 1, "the consent wrote exactly one account");
+	return accounts[0];
+};
+
+const patchServices = (
+	sub: string,
+	accountId: string,
+	syncedServices: AccountServiceName[],
+): Promise<APIGatewayProxyResult> =>
+	request(sub, "PATCH", `/accounts/${accountId}`, { syncedServices });
+
+before(async () => {
+	_resetForTest();
+	process.env.DATA_BACKEND = "sqlite";
+	process.env.CORS_ALLOWED_ORIGINS = WEB_ORIGIN;
+	process.env.MSOAUTH_REDIRECT_URI = `${WEB_ORIGIN}/accounts/oauth/microsoft/callback`;
+	process.env.MSOAUTH_CLIENT_ID = "consent-test-client-id";
+	process.env.MSOAUTH_CLIENT_SECRET = CLIENT_SECRET;
+	process.env.MSOAUTH_TOKEN_ENDPOINT = await startTokenEndpoint();
+	process.env.FAKE_KMS_DATAKEY = "0".repeat(64);
+	process.env.AWS_REGION = "eu-west-1";
+	process.env.AWS_ACCESS_KEY_ID = "test";
+	process.env.AWS_SECRET_ACCESS_KEY = "test";
+	({ client, cleanup } = await createCalendarSqliteClient());
+	setClient(client);
+	({ handler } = (await import("../index.js")) as unknown as {
+		handler: typeof handler;
+	});
+});
+
+beforeEach(() => {
+	withheld = new Set();
+	redemptions = [];
+});
+
+after(async () => {
+	_resetForTest();
+	cleanup();
+	await new Promise<void>((resolve) => tokenEndpoint.close(() => resolve()));
+});
+
+describe("the Microsoft consent for the services an account syncs", () => {
+	it("asks for the calendar scope only when the start names Calendar", async () => {
+		const sub = randomUUID();
+
+		const mailOnly = (
+			await startConsent(sub, [AccountService.Mail])
+		).searchParams
+			.get("scope")
+			?.split(" ");
+		const calendarOnly = (
+			await startConsent(sub, [AccountService.Calendar])
+		).searchParams
+			.get("scope")
+			?.split(" ");
+
+		assert.ok(mailOnly);
+		assert.ok(calendarOnly);
+		assert.deepEqual(
+			mailOnly.filter((scope) => scope.includes("://")),
+			MAIL_SCOPES,
+		);
+		assert.deepEqual(
+			calendarOnly.filter((scope) => scope.includes("://")),
+			CALENDAR_SCOPES,
+		);
+		assert.ok(calendarOnly.includes("offline_access"));
+	});
+
+	it("creates a calendar-only account holding the calendar grant", async () => {
+		const sub = randomUUID();
+
+		const location = await consent(sub, [AccountService.Calendar]);
+
+		const account = await onlyAccount(sub);
+		assert.equal(
+			location,
+			`${WEB_ORIGIN}/settings/accounts?connected=${encodeURIComponent(account.accountId)}`,
+		);
+		assert.deepEqual(account.syncedServices, [AccountService.Calendar]);
+		assert.deepEqual(account.grantedScopes, CALENDAR_SCOPES);
+		assert.deepEqual(redemptions, [
+			[...CALENDAR_SCOPES, "offline_access", "openid", "email"],
+		]);
+	});
+
+	it("refuses a consent that comes back without the calendar scope and writes nothing", async () => {
+		const sub = randomUUID();
+		withheld = new Set(CALENDAR_SCOPES);
+
+		const location = await consent(sub, [
+			AccountService.Mail,
+			AccountService.Calendar,
+		]);
+
+		assert.equal(
+			location,
+			`${WEB_ORIGIN}/settings/accounts?oauthError=scope_not_granted`,
+		);
+		assert.deepEqual(
+			await client.account.listAllByAccountConfig(deriveAccountConfigId(sub)),
+			[],
+		);
+	});
+
+	it("keeps calendar when a mail and calendar account reconnects naming only its email", async () => {
+		const sub = randomUUID();
+		await consent(sub, [AccountService.Mail, AccountService.Calendar]);
+		const connected = await onlyAccount(sub);
+
+		redemptions = [];
+		const location = await consent(sub, undefined);
+
+		const reconnected = await onlyAccount(sub);
+		assert.equal(
+			location,
+			`${WEB_ORIGIN}/settings/accounts?connected=${encodeURIComponent(connected.accountId)}`,
+		);
+		assert.deepEqual(reconnected.syncedServices, [
+			AccountService.Mail,
+			AccountService.Calendar,
+		]);
+		assert.deepEqual(reconnected.grantedScopes, [
+			...MAIL_SCOPES,
+			...CALENDAR_SCOPES,
+		]);
+		assert.deepEqual(
+			redemptions.map((scopes) => scopes.filter((s) => s.includes("://"))),
+			[MAIL_SCOPES, CALENDAR_SCOPES],
+		);
+	});
+
+	it("adds calendar to a mail account through a second consent", async () => {
+		const sub = randomUUID();
+		await consent(sub, [AccountService.Mail]);
+		const mailAccount = await onlyAccount(sub);
+		assert.deepEqual(mailAccount.grantedScopes, MAIL_SCOPES);
+
+		const refused = await patchServices(sub, mailAccount.accountId, [
+			AccountService.Mail,
+			AccountService.Calendar,
+		]);
+		assert.equal(refused.statusCode, 400, refused.body);
+		const { message } = JSON.parse(refused.body) as { message: string };
+		assert.match(message, /granted scopes lack Calendar/);
+		assert.match(message, /POST \/accounts\/oauth\/microsoft\/start/);
+
+		redemptions = [];
+		await consent(sub, [AccountService.Mail, AccountService.Calendar]);
+
+		const reconnected = await onlyAccount(sub);
+		assert.equal(reconnected.accountId, mailAccount.accountId);
+		assert.deepEqual(reconnected.syncedServices, [
+			AccountService.Mail,
+			AccountService.Calendar,
+		]);
+		assert.deepEqual(reconnected.grantedScopes, [
+			...MAIL_SCOPES,
+			...CALENDAR_SCOPES,
+		]);
+		assert.deepEqual(
+			redemptions.map((scopes) => scopes.filter((s) => s.includes("://"))),
+			[MAIL_SCOPES, CALENDAR_SCOPES],
+		);
+
+		const mailAgain = await patchServices(sub, mailAccount.accountId, [
+			AccountService.Mail,
+		]);
+		assert.equal(mailAgain.statusCode, 200, mailAgain.body);
+		const both = await patchServices(sub, mailAccount.accountId, [
+			AccountService.Calendar,
+			AccountService.Mail,
+		]);
+		assert.equal(both.statusCode, 200, both.body);
+		assert.deepEqual(
+			(JSON.parse(both.body) as AccountResponse).syncedServices,
+			[AccountService.Mail, AccountService.Calendar],
+		);
+	});
+});

package/src/handlers/account-oauth.test.ts

@@ -12,6 +12,7 @@ import { readFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { describe, it } from "node:test";
 import { fileURLToPath } from "node:url";
+import { AccountService } from "@remit/domain-enums";
 import {
 	getWebOrigin,
 	type OAuthState,
@@ -41,6 +42,7 @@ describe("HMAC state signing", () => {
 			accountConfigId: "acc-config-1",
 			nonce: "deadbeef",
 			timestamp: Date.now(),
+			services: [AccountService.Mail],
 		};
 
 		const state = await signState(payload, SECRET);
@@ -55,6 +57,7 @@ describe("HMAC state signing", () => {
 			accountConfigId: "acc-config-1",
 			nonce: "deadbeef",
 			timestamp: Date.now(),
+			services: [AccountService.Mail],
 		};
 
 		const state = await signState(payload, SECRET);
@@ -80,6 +83,7 @@ describe("HMAC state signing", () => {
 			accountConfigId: "acc-config-1",
 			nonce: "deadbeef",
 			timestamp: Date.now(),
+			services: [AccountService.Mail],
 		};
 
 		const state = await signState(payload, SECRET);
@@ -95,6 +99,7 @@ describe("HMAC state signing", () => {
 			accountConfigId: "acc-config-1",
 			nonce: "deadbeef",
 			timestamp: Date.now(),
+			services: [AccountService.Mail],
 		};
 
 		const state = await signState(payload, SECRET);
@@ -111,11 +116,61 @@ describe("HMAC state signing", () => {
 		);
 	});
 
+	it("reads a state signed before services existed as mail only", async () => {
+		const state = await signState(
+			{
+				accountConfigId: "acc-config-1",
+				nonce: "deadbeef",
+				timestamp: Date.now(),
+			} as OAuthState,
+			SECRET,
+		);
+
+		assert.deepEqual((await verifyState(state, SECRET)).services, [
+			AccountService.Mail,
+		]);
+	});
+
+	it("rejects a state that names no requested services", async () => {
+		const state = await signState(
+			{
+				accountConfigId: "acc-config-1",
+				nonce: "deadbeef",
+				timestamp: Date.now(),
+				services: [],
+			},
+			SECRET,
+		);
+
+		await assert.rejects(
+			() => verifyState(state, SECRET),
+			/State names no requested services/,
+		);
+	});
+
+	it("carries the requested services through the signed state", async () => {
+		const state = await signState(
+			{
+				accountConfigId: "acc-config-1",
+				nonce: "deadbeef",
+				timestamp: Date.now(),
+				services: [AccountService.Mail, AccountService.Calendar],
+			},
+			SECRET,
+		);
+
+		assert.deepEqual((await verifyState(state, SECRET)).services, [
+			AccountService.Mail,
+			AccountService.Calendar,
+		]);
+	});
+
 	it("rejects an expired state (timestamp > 10 minutes ago)", async () => {
 		const expired: OAuthState = {
 			accountConfigId: "acc-config-1",
 			nonce: "deadbeef",
 			timestamp: Date.now() - STATE_TTL_MS - 1000, // 1 second past expiry
+			services: [AccountService.Mail],
 		};
 
 		const state = await signState(expired, SECRET);
@@ -128,6 +183,7 @@ describe("HMAC state signing", () => {
 			accountConfigId: "acc-config-1",
 			nonce: "deadbeef",
 			timestamp: Date.now() - STATE_TTL_MS + 2000, // 2 seconds before expiry
+			services: [AccountService.Mail],
 		};
 
 		const state = await signState(almostExpired, SECRET);

package/src/handlers/account-oauth.ts

@@ -4,11 +4,23 @@ import {
 	GetSecretValueCommand,
 	SecretsManagerClient,
 } from "@aws-sdk/client-secrets-manager";
-import { AccountAuthType, ConnectionState } from "@remit/domain-enums";
+import type {
+	AccountService as AccountServiceName,
+	MicrosoftOAuthStartRequest,
+} from "@remit/api-openapi-types";
+import {
+	AccountAuthType,
+	AccountService,
+	ConnectionState,
+} from "@remit/domain-enums";
 import { logger } from "@remit/logger-lambda";
 import {
 	createMailOAuthService,
+	type MailOAuthService,
 	microsoftProviderConfig,
+	microsoftServicesGranted,
+	orderServices,
+	RefreshTokenError,
 } from "@remit/mail-oauth-service";
 import { serializeEncryptedPayload } from "@remit/secrets-service";
 import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
@@ -31,8 +43,19 @@ export interface OAuthState {
 	accountConfigId: string;
 	nonce: string;
 	timestamp: number;
+	services: AccountServiceName[];
 }
 
+const ACCOUNT_SERVICES: readonly string[] = Object.values(AccountService);
+
+const isServiceList = (value: unknown): value is AccountServiceName[] =>
+	Array.isArray(value) &&
+	value.length > 0 &&
+	value.every(
+		(service) =>
+			typeof service === "string" && ACCOUNT_SERVICES.includes(service),
+	);
+
 export const STATE_TTL_MS = 10 * 60 * 1000; // 10 minutes
 
 /**
@@ -94,6 +117,14 @@ export async function verifyState(
 		throw new Error("State has expired");
 	}
 
+	if (payload.services === undefined) {
+		return { ...payload, services: [AccountService.Mail] };
+	}
+
+	if (!isServiceList(payload.services)) {
+		throw new Error("State names no requested services");
+	}
+
 	return payload;
 }
 
@@ -203,6 +234,45 @@ export function getWebOrigin(): string {
 	return httpsOrigin ?? origins[0] ?? "https://localhost:3000";
 }
 
+type ScopeRedemption =
+	| { kind: "granted"; refreshToken: string; grantedScopes: string[] }
+	| { kind: "refused"; reason: "exchange_failed" | "scope_not_granted" };
+
+const redeemEachService = async (
+	serviceFor: (service: AccountServiceName) => MailOAuthService,
+	initialToken: string,
+	services: readonly AccountServiceName[],
+	accountConfigId: string,
+): Promise<ScopeRedemption> => {
+	let token = initialToken;
+	const grantedScopes: string[] = [];
+	for (const service of services) {
+		const redeemed = await serviceFor(service)
+			.refresh(token)
+			.catch((err: unknown) => {
+				logger.warn(
+					{
+						alert: "oauth_callback_failed",
+						reason: "scope_redemption_failed",
+						accountConfigId,
+						service,
+						error: inspect(err),
+					},
+					"MS OAuth callback: the consent did not cover a requested service",
+				);
+				return err instanceof RefreshTokenError &&
+					err.error.kind === "transient"
+					? ("exchange_failed" as const)
+					: ("scope_not_granted" as const);
+			});
+		if (typeof redeemed === "string")
+			return { kind: "refused", reason: redeemed };
+		grantedScopes.push(...redeemed.grantedScopes);
+		token = redeemed.refreshToken ?? token;
+	}
+	return { kind: "granted", refreshToken: token, grantedScopes };
+};
+
 // ─── Handlers ────────────────────────────────────────────────────────────────
 
 export const MicrosoftOAuthOperations: Record<
@@ -216,8 +286,9 @@ export const MicrosoftOAuthOperations: Record<
 		const event = args[0] as APIGatewayProxyEvent;
 		const accountConfigId = getAccountConfigIdFromEvent(event);
 
-		const input = JSON.parse(event.body ?? "{}") as { email?: string };
+		const input = JSON.parse(event.body ?? "{}") as MicrosoftOAuthStartRequest;
 		const email = typeof input.email === "string" ? input.email : undefined;
+		const services = orderServices(input.services ?? [AccountService.Mail]);
 
 		const config = getMsOAuthConfig();
 		const credentials = await getMsOAuthCredentials();
@@ -226,6 +297,7 @@ export const MicrosoftOAuthOperations: Record<
 			microsoftProviderConfig({
 				clientId: credentials.clientId,
 				clientSecret: credentials.clientSecret,
+				services,
 				overrides: config.tokenEndpoint
 					? { tokenEndpoint: config.tokenEndpoint }
 					: undefined,
@@ -237,6 +309,7 @@ export const MicrosoftOAuthOperations: Record<
 			accountConfigId,
 			nonce,
 			timestamp: Date.now(),
+			services,
 		};
 
 		const state = await signState(statePayload, credentials.clientSecret);
@@ -248,7 +321,10 @@ export const MicrosoftOAuthOperations: Record<
 		});
 
 		// biome-ignore lint/plugin/no-logger-info: OAuth initiation is an audit-grade signal
-		logger.info({ accountConfigId }, "Microsoft OAuth start initiated");
+		logger.info(
+			{ accountConfigId, services },
+			"Microsoft OAuth start initiated",
+		);
 
 		return { authorizationUrl };
 	},
@@ -329,20 +405,23 @@ export const MicrosoftOAuthOperations: Record<
 			);
 
 		const { accountConfigId } = statePayload;
+		const [firstService] = orderServices(statePayload.services);
 
 		const config = getMsOAuthConfig();
-		const oauthService = createMailOAuthService(
-			microsoftProviderConfig({
-				clientId: credentials.clientId,
-				clientSecret: credentials.clientSecret,
-				overrides: config.tokenEndpoint
-					? { tokenEndpoint: config.tokenEndpoint }
-					: undefined,
-			}),
-		);
+		const serviceFor = (service: AccountServiceName): MailOAuthService =>
+			createMailOAuthService(
+				microsoftProviderConfig({
+					clientId: credentials.clientId,
+					clientSecret: credentials.clientSecret,
+					services: [service],
+					overrides: config.tokenEndpoint
+						? { tokenEndpoint: config.tokenEndpoint }
+						: undefined,
+				}),
+			);
 
 		// Exchange the authorization code for tokens
-		const tokenSet = await oauthService
+		const tokenSet = await serviceFor(firstService)
 			.exchangeCode(code, config.redirectUri)
 			.catch((err: unknown) => {
 				logger.error(
@@ -410,16 +489,6 @@ export const MicrosoftOAuthOperations: Record<
 
 		const { account, accountConfig, secrets } = await getClient();
 
-		// Ensure the account config row exists for this user
-		await ensureAccountConfig(accountConfig, accountConfigId);
-
-		// Encrypt the refresh token
-		const tokenPayload = await secrets.encrypt(tokenSet.refreshToken);
-		const oauthRefreshTokenHash = JSON.stringify(
-			serializeEncryptedPayload(tokenPayload),
-		);
-		const oauthTokenUpdatedAt = Date.now();
-
 		// Reconnect when an active OAuth account already onboards this mailbox.
 		// Same natural key as the IMAP create guard (#635); the OAuth flow returns
 		// the existing account (token refresh) rather than rejecting, because a
@@ -432,6 +501,55 @@ export const MicrosoftOAuthOperations: Record<
 			username: email,
 		});
 
+		const services = orderServices([
+			...statePayload.services,
+			...(existing?.syncedServices ?? []),
+		]);
+
+		const redemption = await redeemEachService(
+			serviceFor,
+			tokenSet.refreshToken,
+			services.filter((service) => service !== firstService),
+			accountConfigId,
+		);
+		if (redemption.kind === "refused")
+			return redirect(
+				`${webOrigin}/settings/accounts?oauthError=${redemption.reason}`,
+			);
+
+		const grantedScopes = [
+			...new Set([...tokenSet.grantedScopes, ...redemption.grantedScopes]),
+		];
+		const grantedServices = microsoftServicesGranted(grantedScopes);
+		const missingServices = services.filter(
+			(service) => !grantedServices.includes(service),
+		);
+		if (missingServices.length > 0) {
+			logger.warn(
+				{
+					alert: "oauth_callback_failed",
+					reason: "scope_not_granted",
+					accountConfigId,
+					missingServices,
+					grantedScopes,
+				},
+				"MS OAuth callback: granted scopes lack a requested service",
+			);
+			return redirect(
+				`${webOrigin}/settings/accounts?oauthError=scope_not_granted`,
+			);
+		}
+
+		// Ensure the account config row exists for this user
+		await ensureAccountConfig(accountConfig, accountConfigId);
+
+		// Encrypt the refresh token
+		const tokenPayload = await secrets.encrypt(redemption.refreshToken);
+		const oauthRefreshTokenHash = JSON.stringify(
+			serializeEncryptedPayload(tokenPayload),
+		);
+		const oauthTokenUpdatedAt = Date.now();
+
 		let accountId: string;
 
 		if (existing) {
@@ -441,6 +559,8 @@ export const MicrosoftOAuthOperations: Record<
 				{
 					oauthRefreshTokenHash,
 					oauthTokenUpdatedAt,
+					syncedServices: services,
+					grantedScopes,
 					connectionState: ConnectionState.NotAuthenticated,
 				},
 				["lastError"] as never,
@@ -458,6 +578,8 @@ export const MicrosoftOAuthOperations: Record<
 				email,
 				username: email,
 				authType: AccountAuthType.OauthMicrosoft,
+				syncedServices: services,
+				grantedScopes,
 				oauthRefreshTokenHash,
 				oauthTokenUpdatedAt,
 				imapHost: OUTLOOK_IMAP_HOST,
@@ -480,7 +602,9 @@ export const MicrosoftOAuthOperations: Record<
 			);
 		}
 
-		await triggerAccountSyncSafe(accountId);
+		if (services.includes(AccountService.Mail)) {
+			await triggerAccountSyncSafe(accountId);
+		}
 
 		return redirect(
 			`${webOrigin}/settings/accounts?connected=${encodeURIComponent(accountId)}`,

package/src/handlers/account-synced-services.test.ts

@@ -1,6 +1,9 @@
 import assert from "node:assert/strict";
 import { afterEach, beforeEach, describe, it } from "node:test";
-import type { AccountResponse } from "@remit/api-openapi-types";
+import type {
+	AccountResponse,
+	AccountService as AccountServiceName,
+} from "@remit/api-openapi-types";
 import type { AccountItem } from "@remit/data-ports";
 import {
 	AccountAuthType,
@@ -15,6 +18,7 @@ import {
 	MailboxRepo,
 } from "@remit/drizzle-service";
 import { createShippedSqliteDb } from "@remit/drizzle-service/test-sqlite";
+import { MICROSOFT_SERVICE_SCOPES } from "@remit/mail-oauth-service";
 import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
 import type { Context } from "openapi-backend";
 import { deriveAccountConfigId } from "../auth.js";
@@ -65,12 +69,21 @@ const bodyOf = <T>(response: APIGatewayProxyResult): T =>
 let accounts: AccountRepo;
 let close: () => void;
 
-const seedAccount = (authType: AccountItem["authType"]) =>
+const seedAccount = (
+	authType: AccountItem["authType"],
+	grantedServices: AccountServiceName[] = authType ===
+	AccountAuthType.OauthMicrosoft
+		? [AccountService.Mail]
+		: [],
+) =>
 	accounts.create({
 		accountConfigId: ACCOUNT_CONFIG_ID,
 		username: `${authType}@example.com`,
 		email: `${authType}@example.com`,
 		authType,
+		grantedScopes: grantedServices.flatMap(
+			(service) => MICROSOFT_SERVICE_SCOPES[service],
+		),
 		imapHost: "imap.example.com",
 		imapPort: 993,
 		imapTls: true,
@@ -175,6 +188,22 @@ describe("the services an account syncs", () => {
 		]);
 	});
 
+	it("accepts calendar once the granted scopes cover it", async () => {
+		const account = await seedAccount(AccountAuthType.OauthMicrosoft, [
+			AccountService.Mail,
+			AccountService.Calendar,
+		]);
+
+		const response = await patchServices(account.accountId, [
+			AccountService.Calendar,
+		]);
+
+		assert.equal(response.statusCode, 200);
+		assert.deepEqual(await readServices(account.accountId), [
+			AccountService.Calendar,
+		]);
+	});
+
 	it("refuses calendar the Microsoft consent never covered and names the consent route", async () => {
 		const account = await seedAccount(AccountAuthType.OauthMicrosoft);
 
@@ -183,10 +212,9 @@ describe("the services an account syncs", () => {
 		]);
 
 		assert.equal(response.statusCode, 400);
-		assert.match(
-			bodyOf<{ message: string }>(response).message,
-			/POST \/accounts\/oauth\/microsoft\/start/,
-		);
+		const { message } = bodyOf<{ message: string }>(response);
+		assert.match(message, /granted scopes lack Calendar/);
+		assert.match(message, /POST \/accounts\/oauth\/microsoft\/start/);
 		assert.deepEqual(await readServices(account.accountId), [
 			AccountService.Mail,
 		]);

package/src/handlers/account.ts

@@ -209,7 +209,7 @@ export const AccountOperations: Record<
 		assertPasswordProvided(input.authType, input.password);
 
 		const syncedServices = resolveSyncedServices(
-			AccountAuthType.Password,
+			{ authType: AccountAuthType.Password, grantedScopes: [] },
 			input.syncedServices ?? [AccountService.Mail],
 		);
 
@@ -418,7 +418,7 @@ export const AccountDetailOperations: Record<
 
 		if (input.syncedServices !== undefined) {
 			updates.syncedServices = resolveSyncedServices(
-				existing.authType,
+				existing,
 				input.syncedServices,
 			);
 		}

package/src/handlers/mailbox.ts

@@ -327,6 +327,7 @@ const toMailboxResponse = (
 	// client cannot tell a create in flight from a rename in flight, name the
 	// target of a failed rename, or offer the right retry.
 	pendingPath: mailbox.pendingPath,
+	syncFailureReason: mailbox.syncFailureReason,
 	muted: overrides.muted,
 	displayNameOverride: overrides.displayNameOverride,
 	createdAt: mailbox.createdAt,