@remit/backend 0.0.142 → 0.0.144

package/src/config/msoauth.ts

@@ -1,48 +0,0 @@
-/**
- * Typed reads for Microsoft OAuth (Entra) environment variables.
- *
- * `MSOAUTH_REDIRECT_URI` is derived from `PUBLIC_ORIGIN` by the compose file
- * (deploy/vps/docker-compose.sqlite.yml) and must match the redirect URI
- * registered on the Entra app registration.
- *
- * Credentials come either from `MSOAUTH_CLIENT_ID` / `MSOAUTH_CLIENT_SECRET`
- * in the deploy env file, or from Secrets Manager via `MSOAUTH_SECRET_ARN`.
- *
- * The Microsoft authorization and token endpoints are fixed in
- * `@remit/mail-oauth-service`; no authority URL is read from the environment.
- */
-
-export interface MsOAuthConfig {
-	/** Secrets Manager ARN — an alternative to the client id/secret pair. */
-	readonly secretArn: string | undefined;
-	/** OAuth redirect URI registered in the Entra app. */
-	readonly redirectUri: string;
-	/** Client ID — set directly to bypass Secrets Manager. */
-	readonly clientId: string | undefined;
-	/** Client secret — set directly to bypass Secrets Manager. */
-	readonly clientSecret: string | undefined;
-	/** Token endpoint override — used for local stubbing (bypasses default OIDC discovery). */
-	readonly tokenEndpoint: string | undefined;
-}
-
-/**
- * Read Microsoft OAuth configuration from the environment.
- * Throws when `MSOAUTH_REDIRECT_URI` is absent.
- */
-export const getMsOAuthConfig = (): MsOAuthConfig => {
-	const redirectUri = process.env.MSOAUTH_REDIRECT_URI;
-
-	if (!redirectUri) {
-		throw new Error(
-			"MSOAUTH_REDIRECT_URI is not set. It is derived from PUBLIC_ORIGIN — set PUBLIC_ORIGIN in the deploy env file (deploy/vps/.env) and restart, or set MSOAUTH_REDIRECT_URI directly.",
-		);
-	}
-
-	return {
-		secretArn: process.env.MSOAUTH_SECRET_ARN,
-		redirectUri,
-		clientId: process.env.MSOAUTH_CLIENT_ID,
-		clientSecret: process.env.MSOAUTH_CLIENT_SECRET,
-		tokenEndpoint: process.env.MSOAUTH_TOKEN_ENDPOINT,
-	};
-};

package/src/data-backend.test.ts

@@ -1,23 +0,0 @@
-import assert from "node:assert/strict";
-import { afterEach, describe, it } from "node:test";
-import { usesBetterAuthJwt } from "./data-backend.js";
-
-describe("usesBetterAuthJwt", () => {
-	const ORIGINAL = process.env.DATA_BACKEND;
-	afterEach(() => {
-		if (ORIGINAL === undefined) delete process.env.DATA_BACKEND;
-		else process.env.DATA_BACKEND = ORIGINAL;
-	});
-
-	it("is true for the self-host SQL backend", () => {
-		process.env.DATA_BACKEND = "sqlite";
-		assert.equal(usesBetterAuthJwt(), true);
-	});
-
-	it("is false for the AWS DynamoDB path and when unset", () => {
-		process.env.DATA_BACKEND = "dynamodb";
-		assert.equal(usesBetterAuthJwt(), false);
-		delete process.env.DATA_BACKEND;
-		assert.equal(usesBetterAuthJwt(), false);
-	});
-});

package/src/derive/autoMoved.test.ts

@@ -1,104 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import type { MessageItem } from "@remit/data-ports";
-import { PlacementAction, PlacementConfidence } from "@remit/domain-enums";
-import { deriveAutoMoved } from "./autoMoved.js";
-
-type AutoMovedInput = Pick<
-	MessageItem,
-	"movedByRemit" | "placementVerdict" | "filterMove"
->;
-
-const confidentVerdict = {
-	action: PlacementAction.MoveToInbox,
-	confidence: PlacementConfidence.Confident,
-	fromPlacement: "junk",
-	reasons: ["provider=spam", "dmarc=pass"],
-	dryRun: false,
-	decidedAt: 1_700_000_000_000,
-};
-
-const filterMove = {
-	filterId: "flt-1",
-	sourceMailboxId: "mb-inbox",
-	destinationMailboxId: "mb-travel",
-	decidedAt: 1_700_000_000_000,
-};
-
-describe("deriveAutoMoved", () => {
-	it("returns undefined when the message was not moved by Remit", () => {
-		const message: AutoMovedInput = {
-			movedByRemit: false,
-			placementVerdict: confidentVerdict,
-		};
-		assert.equal(deriveAutoMoved(message), undefined);
-	});
-
-	it("projects a standing-filter move to its mailbox ids and filter id", () => {
-		const message: AutoMovedInput = { movedByRemit: true, filterMove };
-		assert.deepEqual(deriveAutoMoved(message), {
-			fromMailboxId: "mb-inbox",
-			destinationMailboxId: "mb-travel",
-			filterId: "flt-1",
-		});
-	});
-
-	it("never leaks the classifier action/fromPlacement for a filter move", () => {
-		const result = deriveAutoMoved({ movedByRemit: true, filterMove });
-		assert.equal(result?.action, undefined);
-		assert.equal(result?.fromPlacement, undefined);
-	});
-
-	it("a filter move outranks a co-present placement verdict", () => {
-		// Both a filter move and a classifier verdict can be recorded; the filter's
-		// exclusive move is what ultimately placed the message (RFC 034 Dec. 3.1).
-		const message: AutoMovedInput = {
-			movedByRemit: true,
-			filterMove,
-			placementVerdict: confidentVerdict,
-		};
-		assert.deepEqual(deriveAutoMoved(message), {
-			fromMailboxId: "mb-inbox",
-			destinationMailboxId: "mb-travel",
-			filterId: "flt-1",
-		});
-	});
-
-	it("projects a confident classifier move to action + fromPlacement", () => {
-		const message: AutoMovedInput = {
-			movedByRemit: true,
-			placementVerdict: confidentVerdict,
-		};
-		assert.deepEqual(deriveAutoMoved(message), {
-			action: PlacementAction.MoveToInbox,
-			fromPlacement: "junk",
-		});
-	});
-
-	it("drops an unsure classifier verdict", () => {
-		const message: AutoMovedInput = {
-			movedByRemit: true,
-			placementVerdict: {
-				...confidentVerdict,
-				confidence: PlacementConfidence.Unsure,
-			},
-		};
-		assert.equal(deriveAutoMoved(message), undefined);
-	});
-
-	it("drops a dry-run classifier verdict", () => {
-		const message: AutoMovedInput = {
-			movedByRemit: true,
-			placementVerdict: { ...confidentVerdict, dryRun: true },
-		};
-		assert.equal(deriveAutoMoved(message), undefined);
-	});
-
-	it("does not crash on legacy verdict-less, filter-less moved data", () => {
-		// A message moved before either the verdict or the filter marker existed:
-		// movedByRemit is set but nothing is derivable. Must return undefined, not
-		// throw (issue #223 back-compat).
-		const message: AutoMovedInput = { movedByRemit: true };
-		assert.equal(deriveAutoMoved(message), undefined);
-	});
-});

package/src/derive/contentSignature.test.ts

@@ -1,161 +0,0 @@
-import assert from "node:assert/strict";
-import { afterEach, describe, it } from "node:test";
-import {
-	CONTENT_URL_TTL_SECONDS,
-	createContentSigner,
-	getContentSigner,
-	verifyContentSignature,
-} from "./contentSignature.js";
-
-const SECRET = "test-master-secret-at-least-32-chars-long";
-const PATH_A = "accounts/cfg-alice/acc-alice/messages/msg-1/parts/1.2";
-const PATH_B = "accounts/cfg-bob/acc-bob/messages/msg-9/parts/1.2";
-
-const nowSeconds = () => Math.floor(Date.now() / 1000);
-
-describe("content signature: sign + verify round trip", () => {
-	it("a freshly signed URL verifies", () => {
-		const { exp, sig } = createContentSigner(SECRET)(PATH_A);
-		const result = verifyContentSignature(
-			PATH_A,
-			String(exp),
-			sig,
-			SECRET,
-			nowSeconds(),
-		);
-		assert.deepEqual(result, { valid: true });
-	});
-
-	it("rejects a signature minted for a different account's path (cross-account IDOR defense)", () => {
-		const { exp, sig } = createContentSigner(SECRET)(PATH_A);
-		// Present account A's signature against account B's path.
-		const result = verifyContentSignature(
-			PATH_B,
-			String(exp),
-			sig,
-			SECRET,
-			nowSeconds(),
-		);
-		assert.deepEqual(result, { valid: false, reason: "bad-signature" });
-	});
-
-	it("rejects a tampered signature", () => {
-		const { exp, sig } = createContentSigner(SECRET)(PATH_A);
-		const tampered = `${sig.slice(0, -1)}${sig.endsWith("A") ? "B" : "A"}`;
-		const result = verifyContentSignature(
-			PATH_A,
-			String(exp),
-			tampered,
-			SECRET,
-			nowSeconds(),
-		);
-		assert.equal(result.valid, false);
-	});
-
-	it("rejects a valid signature verified with the wrong secret", () => {
-		const { exp, sig } = createContentSigner(SECRET)(PATH_A);
-		const result = verifyContentSignature(
-			PATH_A,
-			String(exp),
-			sig,
-			"a-different-master-secret-also-32-chars",
-			nowSeconds(),
-		);
-		assert.deepEqual(result, { valid: false, reason: "bad-signature" });
-	});
-
-	it("rejects an expired signature", () => {
-		// Negative TTL mints a signature whose expiry is already in the past.
-		const { exp, sig } = createContentSigner(SECRET, -20)(PATH_A);
-		assert.ok(exp < nowSeconds());
-		const result = verifyContentSignature(
-			PATH_A,
-			String(exp),
-			sig,
-			SECRET,
-			nowSeconds(),
-		);
-		assert.deepEqual(result, { valid: false, reason: "expired" });
-	});
-
-	it("reports missing exp/sig distinctly from a bad signature", () => {
-		assert.deepEqual(
-			verifyContentSignature(
-				PATH_A,
-				undefined,
-				undefined,
-				SECRET,
-				nowSeconds(),
-			),
-			{ valid: false, reason: "missing" },
-		);
-	});
-
-	it("rejects a non-integer exp as malformed", () => {
-		const { sig } = createContentSigner(SECRET)(PATH_A);
-		assert.deepEqual(
-			verifyContentSignature(PATH_A, "not-a-number", sig, SECRET, nowSeconds()),
-			{ valid: false, reason: "malformed" },
-		);
-	});
-});
-
-describe("getContentSigner", () => {
-	const ORIGINAL_BACKEND = process.env.DATA_BACKEND;
-	const ORIGINAL_SECRET = process.env.BETTER_AUTH_SECRET;
-
-	afterEach(() => {
-		if (ORIGINAL_BACKEND === undefined) delete process.env.DATA_BACKEND;
-		else process.env.DATA_BACKEND = ORIGINAL_BACKEND;
-		if (ORIGINAL_SECRET === undefined) delete process.env.BETTER_AUTH_SECRET;
-		else process.env.BETTER_AUTH_SECRET = ORIGINAL_SECRET;
-	});
-
-	it("returns undefined on the AWS path (unsigned URLs)", () => {
-		delete process.env.DATA_BACKEND;
-		assert.equal(getContentSigner(), undefined);
-	});
-
-	it("returns a working signer in SQLite mode", () => {
-		process.env.DATA_BACKEND = "sqlite";
-		process.env.BETTER_AUTH_SECRET = SECRET;
-		const signer = getContentSigner();
-		assert.ok(signer);
-		const { exp, sig } = signer(PATH_A);
-		assert.deepEqual(
-			verifyContentSignature(PATH_A, String(exp), sig, SECRET, nowSeconds()),
-			{ valid: true },
-		);
-	});
-
-	it("throws in SQLite mode when the master secret is missing (fail loud)", () => {
-		process.env.DATA_BACKEND = "sqlite";
-		delete process.env.BETTER_AUTH_SECRET;
-		assert.throws(() => getContentSigner(), /BETTER_AUTH_SECRET/);
-	});
-});
-
-describe("the wire format is pinned, not merely self-consistent", () => {
-	/**
-	 * Every other test here round-trips through this module, so a change to the
-	 * canonical message or the key derivation passes them all while breaking every
-	 * `/content` URL already in a browser. This vector was computed once, by hand,
-	 * from the scheme as shipped: HMAC-SHA256 with a subkey derived from the
-	 * master secret under `remit-content-url-signing-v1`, over `path\nexp`,
-	 * base64url. If it fails, the format moved and in-flight URLs moved with it.
-	 */
-	it("still produces the signature it produced when the scheme shipped", () => {
-		const signer = createContentSigner(
-			"a-signing-secret-of-at-least-32-characters",
-		);
-		const originalNow = Date.now;
-		Date.now = () => 1_800_000_000_000 - CONTENT_URL_TTL_SECONDS * 1000;
-		try {
-			const { exp, sig } = signer("accounts/cfg1/acc1/messages/msg1/parts/1.2");
-			assert.equal(exp, 1_800_000_000);
-			assert.equal(sig, "eFKwOYf42a6DWwaZahIm7aVtWuqMOfhOAPoyxtpFybo");
-		} finally {
-			Date.now = originalNow;
-		}
-	});
-});

package/src/derive/contentUrl.test.ts

@@ -1,172 +0,0 @@
-import assert from "node:assert/strict";
-import { afterEach, beforeEach, describe, it } from "node:test";
-import {
-	createContentSigner,
-	verifyContentSignature,
-} from "./contentSignature.js";
-import {
-	buildContentUrl,
-	buildStorageContentUrl,
-	getContentDeliveryDomain,
-} from "./contentUrl.js";
-
-describe("buildContentUrl", () => {
-	it("produces the /content/accounts/{cfg}/{acc}/messages/{msg}/parts/{part} layout the Lambda@Edge expects", () => {
-		const url = buildContentUrl({
-			domain: "https://abc123.cloudfront.net",
-			accountConfigId: "cfg-alice",
-			accountId: "acc-alice",
-			messageId: "msg-1",
-			partPath: "1.2",
-		});
-
-		assert.equal(
-			url,
-			"https://abc123.cloudfront.net/content/accounts/cfg-alice/acc-alice/messages/msg-1/parts/1.2",
-		);
-	});
-
-	it("prepends https:// when the domain is given as a bare hostname", () => {
-		const url = buildContentUrl({
-			domain: "abc123.cloudfront.net",
-			accountConfigId: "cfg-alice",
-			accountId: "acc-alice",
-			messageId: "msg-1",
-			partPath: "1",
-		});
-
-		assert.equal(url.startsWith("https://abc123.cloudfront.net/"), true);
-	});
-
-	it("strips a trailing slash on the domain so the path doesn't double up", () => {
-		const url = buildContentUrl({
-			domain: "https://abc123.cloudfront.net/",
-			accountConfigId: "cfg-alice",
-			accountId: "acc-alice",
-			messageId: "msg-1",
-			partPath: "1",
-		});
-
-		assert.equal(
-			url,
-			"https://abc123.cloudfront.net/content/accounts/cfg-alice/acc-alice/messages/msg-1/parts/1",
-		);
-	});
-
-	it("encodes each segment of partPath defensively (forward-slash kept as separator)", () => {
-		const url = buildContentUrl({
-			domain: "https://cdn.test",
-			accountConfigId: "cfg",
-			accountId: "acc",
-			messageId: "msg",
-			partPath: "1/strange path/3",
-		});
-
-		assert.equal(
-			url,
-			"https://cdn.test/content/accounts/cfg/acc/messages/msg/parts/1/strange%20path/3",
-		);
-	});
-
-	it("addresses an outbox attachment by its storage key", () => {
-		const url = buildStorageContentUrl({
-			domain: "https://cdn.test",
-			storageKey: "accounts/cfg/acc/outbox/ob-1/attachments/att-1",
-		});
-
-		assert.equal(
-			url,
-			"https://cdn.test/content/accounts/cfg/acc/outbox/ob-1/attachments/att-1",
-		);
-	});
-
-	it("leaves the URL unsigned when no signer is provided (AWS/Lambda@Edge path)", () => {
-		const url = buildContentUrl({
-			domain: "https://abc123.cloudfront.net",
-			accountConfigId: "cfg-alice",
-			accountId: "acc-alice",
-			messageId: "msg-1",
-			partPath: "1",
-		});
-		assert.equal(url.includes("?"), false);
-	});
-
-	it("appends an exp/sig signature over the decoded storage path when a signer is provided", () => {
-		const secret = "test-master-secret-at-least-32-chars-long";
-		const url = buildContentUrl({
-			domain: "https://api.example.test",
-			accountConfigId: "cfg-alice",
-			accountId: "acc-alice",
-			messageId: "msg-1",
-			partPath: "1.2",
-			sign: createContentSigner(secret),
-		});
-
-		const parsed = new URL(url);
-		const exp = parsed.searchParams.get("exp");
-		const sig = parsed.searchParams.get("sig");
-		assert.ok(exp);
-		assert.ok(sig);
-		// The signature must verify against the same decoded storage path the
-		// `/content` route recomputes from `req.path`.
-		const relativePath = parsed.pathname.replace(/^\/content\//, "");
-		const result = verifyContentSignature(
-			relativePath,
-			exp,
-			sig,
-			secret,
-			Math.floor(Date.now() / 1000),
-		);
-		assert.deepEqual(result, { valid: true });
-	});
-
-	it("nests accountConfigId before accountId so the Lambda@Edge prefix check matches", () => {
-		const url = buildContentUrl({
-			domain: "https://cdn.test",
-			accountConfigId: "CFG",
-			accountId: "ACC",
-			messageId: "MSG",
-			partPath: "1",
-		});
-
-		const segments = new URL(url).pathname.split("/");
-		// ["", "content", "accounts", "CFG", "ACC", "messages", "MSG", "parts", "1"]
-		assert.equal(segments[1], "content");
-		assert.equal(segments[2], "accounts");
-		assert.equal(segments[3], "CFG");
-		assert.equal(segments[4], "ACC");
-	});
-});
-
-describe("getContentDeliveryDomain", () => {
-	const ORIGINAL = process.env.CONTENT_DELIVERY_DOMAIN;
-
-	beforeEach(() => {
-		delete process.env.CONTENT_DELIVERY_DOMAIN;
-	});
-
-	afterEach(() => {
-		if (ORIGINAL === undefined) delete process.env.CONTENT_DELIVERY_DOMAIN;
-		else process.env.CONTENT_DELIVERY_DOMAIN = ORIGINAL;
-	});
-
-	it("throws when CONTENT_DELIVERY_DOMAIN is unset (fail loud over silent placeholder, #299)", () => {
-		assert.throws(
-			() => getContentDeliveryDomain(),
-			/CONTENT_DELIVERY_DOMAIN is not set/,
-		);
-	});
-
-	it("throws when CONTENT_DELIVERY_DOMAIN is empty", () => {
-		process.env.CONTENT_DELIVERY_DOMAIN = "";
-		assert.throws(
-			() => getContentDeliveryDomain(),
-			/CONTENT_DELIVERY_DOMAIN is not set/,
-		);
-	});
-
-	it("returns the env var value when set", () => {
-		process.env.CONTENT_DELIVERY_DOMAIN = "https://abc.cloudfront.net";
-		assert.equal(getContentDeliveryDomain(), "https://abc.cloudfront.net");
-	});
-});

package/src/derive/contentUrl.ts

@@ -1,86 +0,0 @@
-/**
- * Build the public CloudFront URL that fetches a single body part for a
- * message. The path layout is what the Lambda@Edge JWT verifier expects
- * (PR 1 of #224): `/content/accounts/{accountConfigId}/{accountId}/messages/
- * {messageId}/parts/{partPath}`.
- *
- * The function is intentionally pure — domain comes from configuration so
- * tests can pin the output without env vars. `partPath` is passed through
- * `encodeURIComponent` because IMAP section paths are dot-separated digits
- * (e.g. `1`, `1.2`, `2.1.3`) but a defensive encode keeps the builder safe
- * if the path ever carries unexpected characters.
- */
-import type { ContentSigner } from "./contentSignature.js";
-
-export interface BuildContentUrlInput {
-	domain: string;
-	accountConfigId: string;
-	accountId: string;
-	messageId: string;
-	partPath: string;
-	/**
-	 * When present (self-host stack), append an `exp`/`sig` signature scoped to
-	 * this account's storage path. Absent on AWS, where Lambda@Edge guards the
-	 * URL and the path stays unsigned. See `contentSignature.ts`.
-	 */
-	sign?: ContentSigner;
-}
-
-export interface BuildStorageContentUrlInput {
-	domain: string;
-	storageKey: string;
-	sign?: ContentSigner;
-}
-
-export const buildStorageContentUrl = (
-	input: BuildStorageContentUrlInput,
-): string => {
-	const { domain, storageKey, sign } = input;
-	const normalizedDomain = domain.replace(/\/+$/, "");
-	const base = normalizedDomain.startsWith("http")
-		? normalizedDomain
-		: `https://${normalizedDomain}`;
-	// The signed message is the decoded, account-scoped storage path — the same
-	// value the `/content` route recomputes from `req.path`. Keep it in lockstep
-	// with the verifier's `req.path.replace(/^\/content\//, "")`.
-	const safeKey = storageKey
-		.split("/")
-		.map((segment) => encodeURIComponent(segment))
-		.join("/");
-	const url = `${base}/content/${safeKey}`;
-	if (!sign) return url;
-	const { exp, sig } = sign(storageKey);
-	return `${url}?exp=${exp}&sig=${encodeURIComponent(sig)}`;
-};
-
-export const buildContentUrl = (input: BuildContentUrlInput): string => {
-	const { domain, accountConfigId, accountId, messageId, partPath, sign } =
-		input;
-	return buildStorageContentUrl({
-		domain,
-		storageKey: `accounts/${accountConfigId}/${accountId}/messages/${messageId}/parts/${partPath}`,
-		sign,
-	});
-};
-
-/**
- * Read the CloudFront distribution domain from the environment. The CDK
- * wires `CONTENT_DELIVERY_DOMAIN` onto the API Lambda from the
- * ContentDelivery stack's published SSM parameter (`/{stage}/Remit/frontendUrl`).
- *
- * Throws when the env var is missing or empty. `BodyPartResponse.contentUrl`
- * is required + URL-formatted in the API contract, so silently emitting a
- * placeholder string would ship a contract lie to clients. Failing loud here
- * surfaces the missing wire-up as a 500 the deploy team can act on (#299).
- * Production synth hard-codes a syntactically-valid placeholder URL via
- * `infra/bin/infra.ts` so this only fires when the env is actually unset.
- */
-export const getContentDeliveryDomain = (): string => {
-	const value = process.env.CONTENT_DELIVERY_DOMAIN;
-	if (!value || value.length === 0) {
-		throw new Error(
-			"CONTENT_DELIVERY_DOMAIN is not set; BodyPartResponse.contentUrl cannot be built. Wire the CloudFront distribution domain via the API Lambda env (see infra/bin/infra.ts).",
-		);
-	}
-	return value;
-};

package/src/derive/deriveMuted.test.ts

@@ -1,34 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import type { AddressFlags } from "@remit/api-openapi-types";
-import { deriveMuted } from "./deriveMuted.js";
-
-const SET_AT = 1_700_000_000_000;
-
-describe("deriveMuted", () => {
-	it("returns false when flags is undefined", () => {
-		assert.equal(deriveMuted(undefined), false);
-	});
-
-	it("returns false for an empty flags object", () => {
-		assert.equal(deriveMuted({}), false);
-	});
-
-	it("returns false when muted.value is false", () => {
-		const flags: AddressFlags = { muted: { value: false, setAt: SET_AT } };
-		assert.equal(deriveMuted(flags), false);
-	});
-
-	it("returns true when muted.value is true", () => {
-		const flags: AddressFlags = { muted: { value: true, setAt: SET_AT } };
-		assert.equal(deriveMuted(flags), true);
-	});
-
-	it("ignores other flags (orthogonal axis)", () => {
-		const flags: AddressFlags = {
-			vip: { value: true, setAt: SET_AT },
-			wellknown: { value: true, setAt: SET_AT },
-		};
-		assert.equal(deriveMuted(flags), false);
-	});
-});