@remit/backend 0.0.142 → 0.0.144

package/src/derive/filterThreadCriteria.test.ts

@@ -1,126 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import type { ThreadMessageResponse } from "@remit/api-openapi-types";
-import {
-	MessageCategory,
-	MessageMutation,
-	MessageStatus,
-	MessageSyncStatus,
-	SenderTrust,
-	StarColor,
-} from "@remit/domain-enums";
-import {
-	filterByOffRowCriteria,
-	hasOffRowCriteria,
-} from "./filterThreadCriteria.js";
-
-const row = (
-	overrides: Partial<ThreadMessageResponse>,
-): ThreadMessageResponse => ({
-	threadMessageId: "tm",
-	threadId: "t",
-	messageId: "m",
-	accountConfigId: "acc",
-	mailboxId: "mb",
-	subject: "s",
-	fromEmail: "a@example.com",
-	fromName: "A",
-	sentDate: 0,
-	isRead: false,
-	hasAttachment: false,
-	hasStars: false,
-	star: StarColor.None,
-	isDeleted: false,
-	snippet: "",
-	category: MessageCategory.uncategorized,
-	createdAt: 0,
-	updatedAt: 0,
-	senderTrust: SenderTrust.Unknown,
-	muted: false,
-	status: MessageStatus.active,
-	syncStatus: MessageSyncStatus.pending,
-	abandonedMutation: MessageMutation.none,
-	...overrides,
-});
-
-describe("hasOffRowCriteria", () => {
-	it("is false for an empty criteria object", () => {
-		assert.equal(hasOffRowCriteria({}), false);
-	});
-
-	it("is false for empty arrays", () => {
-		assert.equal(hasOffRowCriteria({ senderTrust: [] }), false);
-	});
-
-	it("is true when any criterion is set", () => {
-		assert.equal(hasOffRowCriteria({ senderTrust: [SenderTrust.Vip] }), true);
-		assert.equal(hasOffRowCriteria({ dkimMismatch: false }), true);
-	});
-});
-
-describe("filterByOffRowCriteria", () => {
-	it("returns rows untouched when no criteria are active", () => {
-		const rows = [row({}), row({})];
-		assert.equal(filterByOffRowCriteria(rows, {}).length, 2);
-	});
-
-	it("filters by senderTrust any-of", () => {
-		const rows = [
-			row({ senderTrust: SenderTrust.Vip }),
-			row({ senderTrust: SenderTrust.Wellknown }),
-			row({ senderTrust: SenderTrust.Unknown }),
-		];
-		const result = filterByOffRowCriteria(rows, {
-			senderTrust: [SenderTrust.Vip, SenderTrust.Wellknown],
-		});
-		assert.equal(result.length, 2);
-		assert.ok(result.every((r) => r.senderTrust !== SenderTrust.Unknown));
-	});
-
-	it("leaves category alone — it is a SQL predicate, not an off-row criterion", () => {
-		const rows = [
-			row({ category: MessageCategory.newsletter }),
-			row({ category: MessageCategory.personal }),
-		];
-		assert.equal(filterByOffRowCriteria(rows, {}).length, 2);
-	});
-
-	it("filters by dkimMismatch and never matches rows lacking an authenticity signal", () => {
-		const rows = [
-			row({ authenticity: { fromDomain: "x", dkimMismatch: false } }),
-			row({ authenticity: { fromDomain: "y", dkimMismatch: true } }),
-			row({ authenticity: undefined }),
-		];
-		const aligned = filterByOffRowCriteria(rows, { dkimMismatch: false });
-		assert.equal(aligned.length, 1);
-		assert.equal(aligned[0].authenticity?.dkimMismatch, false);
-
-		const mismatched = filterByOffRowCriteria(rows, { dkimMismatch: true });
-		assert.equal(mismatched.length, 1);
-		assert.equal(mismatched[0].authenticity?.dkimMismatch, true);
-	});
-
-	it("ANDs criteria together (Rescue shape: trust set + dkim aligned)", () => {
-		const rows = [
-			row({
-				senderTrust: SenderTrust.Vip,
-				authenticity: { fromDomain: "x", dkimMismatch: false },
-			}),
-			row({
-				senderTrust: SenderTrust.Vip,
-				authenticity: { fromDomain: "y", dkimMismatch: true },
-			}),
-			row({
-				senderTrust: SenderTrust.Unknown,
-				authenticity: { fromDomain: "z", dkimMismatch: false },
-			}),
-		];
-		const result = filterByOffRowCriteria(rows, {
-			senderTrust: [SenderTrust.Vip, SenderTrust.Wellknown],
-			dkimMismatch: false,
-		});
-		assert.equal(result.length, 1);
-		assert.equal(result[0].senderTrust, SenderTrust.Vip);
-		assert.equal(result[0].authenticity?.dkimMismatch, false);
-	});
-});

package/src/derive/filterThreadCriteria.ts

@@ -1,51 +0,0 @@
-import type {
-	SenderTrust,
-	ThreadMessageResponse,
-} from "@remit/api-openapi-types";
-
-/**
- * Off-row search criteria — fields that live on the underlying Message/Address,
- * not on the ThreadMessage row. They are resolved by enriching the windowed
- * rows (see enrichThreadRows) and filtering in app code, because no index or
- * FilterExpression can serve them.
- *
- * `senderTrust` derives from AddressItem.flags and `dkimMismatch` from
- * MessageItem.authenticity. `category` is not one of these: it is denormalized
- * onto the ThreadMessage row and filtered in SQL, inside the window.
- */
-export interface OffRowCriteria {
-	senderTrust?: SenderTrust[];
-	dkimMismatch?: boolean;
-}
-
-export const hasOffRowCriteria = (criteria: OffRowCriteria): boolean =>
-	Boolean(criteria.senderTrust?.length) || criteria.dkimMismatch !== undefined;
-
-/**
- * Filter enriched rows by the off-row criteria. Each active criterion is an
- * any-of set (AND across criteria, OR within a set). A row with no
- * `authenticity` signal never matches a `dkimMismatch` filter (absence means no
- * signal, not a verdict).
- */
-export const filterByOffRowCriteria = (
-	rows: ThreadMessageResponse[],
-	criteria: OffRowCriteria,
-): ThreadMessageResponse[] => {
-	if (!hasOffRowCriteria(criteria)) return rows;
-
-	const trustSet = criteria.senderTrust?.length
-		? new Set(criteria.senderTrust)
-		: undefined;
-	const { dkimMismatch } = criteria;
-
-	return rows.filter((row) => {
-		if (trustSet && !trustSet.has(row.senderTrust)) return false;
-		if (
-			dkimMismatch !== undefined &&
-			row.authenticity?.dkimMismatch !== dkimMismatch
-		) {
-			return false;
-		}
-		return true;
-	});
-};

package/src/derive/senderTrust.test.ts

@@ -1,67 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import type { AddressFlags } from "@remit/api-openapi-types";
-import { deriveSenderTrust } from "./senderTrust.js";
-
-// AddressFlagBase requires setAt; deriveSenderTrust only reads `value`, so the
-// timestamp value is irrelevant to these assertions.
-const SET_AT = 1_700_000_000_000;
-
-describe("deriveSenderTrust", () => {
-	it("returns 'unknown' when flags is undefined", () => {
-		assert.equal(deriveSenderTrust(undefined), "unknown");
-	});
-
-	it("returns 'unknown' for an empty flags object", () => {
-		assert.equal(deriveSenderTrust({}), "unknown");
-	});
-
-	it("returns 'unknown' when wellknown.value is false", () => {
-		const flags: AddressFlags = { wellknown: { value: false, setAt: SET_AT } };
-		assert.equal(deriveSenderTrust(flags), "unknown");
-	});
-
-	it("returns 'wellknown' when wellknown.value is true", () => {
-		const flags: AddressFlags = { wellknown: { value: true, setAt: SET_AT } };
-		assert.equal(deriveSenderTrust(flags), "wellknown");
-	});
-
-	it("returns 'vip' when vip.value is true", () => {
-		const flags: AddressFlags = { vip: { value: true, setAt: SET_AT } };
-		assert.equal(deriveSenderTrust(flags), "vip");
-	});
-
-	it("returns 'unknown' when vip.value is false", () => {
-		const flags: AddressFlags = { vip: { value: false, setAt: SET_AT } };
-		assert.equal(deriveSenderTrust(flags), "unknown");
-	});
-
-	it("vip wins over wellknown when both are true", () => {
-		const flags: AddressFlags = {
-			vip: { value: true, setAt: SET_AT },
-			wellknown: { value: true, setAt: SET_AT },
-		};
-		assert.equal(deriveSenderTrust(flags), "vip");
-	});
-
-	it("falls back to wellknown when vip is false but wellknown is true", () => {
-		const flags: AddressFlags = {
-			vip: { value: false, setAt: SET_AT },
-			wellknown: { value: true, setAt: SET_AT },
-		};
-		assert.equal(deriveSenderTrust(flags), "wellknown");
-	});
-
-	it("ignores trusted flag (orthogonal axis)", () => {
-		const flags: AddressFlags = { trusted: { value: true, setAt: SET_AT } };
-		assert.equal(deriveSenderTrust(flags), "unknown");
-	});
-
-	it("ignores trusted even when wellknown is also set", () => {
-		const flags: AddressFlags = {
-			trusted: { value: true, setAt: SET_AT },
-			wellknown: { value: true, setAt: SET_AT },
-		};
-		assert.equal(deriveSenderTrust(flags), "wellknown");
-	});
-});

package/src/error.test.ts

@@ -1,201 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import type { ApiError, FolderRoleConflict } from "@remit/api-openapi-types";
-import {
-	BadRequestError,
-	ClientError,
-	ConflictError,
-	FolderRoleUnresolvedError,
-	ForbiddenError,
-	NotFoundError,
-	UnhandledError,
-	UnrecoverableBodyError,
-} from "@remit/data-ports/errors";
-import { NO_TRASH_FOLDER_REASON } from "@remit/data-ports/folder-role";
-import { CanonicalMailboxRole } from "@remit/domain-enums";
-import { NoTrashMailboxError } from "@remit/mailbox-service";
-import { handleError } from "./error.js";
-
-const parseBody = (body: string): Record<string, unknown> =>
-	JSON.parse(body) as Record<string, unknown>;
-
-// One shape for every error the API answers with (issue #371): flat, always a
-// `code`, always a `message`. A status class that reaches a client without a
-// code leaves it branching on prose.
-describe("the wire shape of a refusal, per status class", () => {
-	const cases: ReadonlyArray<[string, Error, number, string]> = [
-		[
-			"400",
-			new BadRequestError("confirmEmail is required"),
-			400,
-			"invalid_request",
-		],
-		["401", new ClientError("Session expired"), 401, "unauthorized"],
-		["403", new ForbiddenError("Not your account"), 403, "forbidden"],
-		["404", new NotFoundError("Mailbox not found: mb-1"), 404, "not_found"],
-		[
-			"409",
-			new ConflictError("An update is already in progress."),
-			409,
-			"conflict",
-		],
-		[
-			"422",
-			new UnrecoverableBodyError("This message's body could not be read."),
-			422,
-			"unprocessable_entity",
-		],
-	];
-
-	for (const [name, error, statusCode, code] of cases) {
-		it(`answers ${name} with a flat code and message`, async () => {
-			const response = await handleError(error);
-
-			assert.equal(response.statusCode, statusCode);
-			assert.deepEqual(parseBody(response.body), {
-				code,
-				message: error.message,
-			});
-		});
-	}
-
-	// A 5xx is the one class whose message is not the thrower's. Those sentences
-	// are written for a log line and name hosts, queries and ids; the correlation
-	// id on the response is how the real one is found.
-	it("answers 500 with one code and one sentence, never the thrower's", async () => {
-		const response = await handleError(
-			new UnhandledError(
-				"pg://reader@db-3.internal:5432 timed out on SELECT * FROM message",
-			),
-		);
-
-		assert.equal(response.statusCode, 500);
-		assert.deepEqual(parseBody(response.body), {
-			code: "internal_error",
-			message: "Internal server error",
-		});
-	});
-
-	it("types every one of those bodies as the declared ApiError", async () => {
-		const response = await handleError(new NotFoundError("Gone"));
-		const body: ApiError = JSON.parse(response.body);
-
-		assert.equal(body.code, "not_found");
-		assert.equal(body.message, "Gone");
-	});
-});
-
-describe("handleError coded refusals", () => {
-	it("puts the code and every detail of a folder-role 409 on the wire", async () => {
-		const response = await handleError(
-			new FolderRoleUnresolvedError(
-				"The folder you chose for Trash is gone.",
-				CanonicalMailboxRole.Trash,
-				"stale",
-				"account-7",
-			),
-		);
-
-		assert.equal(response.statusCode, 409);
-		assert.deepEqual(parseBody(response.body), {
-			message: "The folder you chose for Trash is gone.",
-			code: "folder_role_unresolved",
-			details: { role: "Trash", reason: "stale", accountId: "account-7" },
-		});
-	});
-
-	it("carries NoTrashMailboxError as the Trash role with reason none", async () => {
-		const response = await handleError(new NoTrashMailboxError("account-7"));
-
-		assert.equal(response.statusCode, 409);
-		assert.deepEqual(parseBody(response.body), {
-			message: NO_TRASH_FOLDER_REASON,
-			code: "folder_role_unresolved",
-			details: { role: "Trash", reason: "none", accountId: "account-7" },
-		});
-	});
-
-	it("keeps an unhandled 500 to a code and a message — no stack, no cause, no details", async () => {
-		const response = await handleError(
-			new UnhandledError("Something went wrong", new Error("connection reset")),
-		);
-
-		assert.equal(response.statusCode, 500);
-		assert.deepEqual(parseBody(response.body), {
-			code: "internal_error",
-			message: "Internal server error",
-		});
-	});
-
-	it("replaces a code a 5xx should never have carried, and drops its details", async () => {
-		const error = new UnhandledError("Something went wrong");
-		error.publicApiError = {
-			code: "folder_role_unresolved",
-			details: { role: "Trash", reason: "none", accountId: "account-7" },
-		};
-
-		const response = await handleError(error);
-
-		assert.equal(response.statusCode, 500);
-		assert.deepEqual(parseBody(response.body), {
-			code: "internal_error",
-			message: "Internal server error",
-		});
-	});
-
-	it("keeps an infrastructure failure to the generic message and code", async () => {
-		const error = Object.assign(
-			new Error("aws-error: ProvisionedThroughputExceeded on remit-main"),
-			{ name: "ElectroError" },
-		);
-
-		const response = await handleError(error);
-
-		assert.equal(response.statusCode, 500);
-		assert.deepEqual(parseBody(response.body), {
-			code: "internal_error",
-			message: "Database temporarily unavailable",
-		});
-	});
-
-	it("answers a malformed query as a 400 with the query's own message", async () => {
-		const error = Object.assign(new Error("Invalid attribute: sentDate"), {
-			name: "ElectroError",
-		});
-
-		const response = await handleError(error);
-
-		assert.equal(response.statusCode, 400);
-		assert.deepEqual(parseBody(response.body), {
-			code: "invalid_request",
-			message: "Invalid attribute: sentDate",
-		});
-	});
-
-	// The contract and the emitter cannot drift apart: this asserts the response
-	// `handleError` actually builds against the generated model. Nesting the body
-	// under `error` again would leave `code` off `keyof FolderRoleConflict` and
-	// fail to compile here, long before a client reads a 409 it cannot parse.
-	it("matches the generated FolderRoleConflict model field for field", async () => {
-		const response = await handleError(
-			new FolderRoleUnresolvedError(
-				"Nobody has confirmed a Trash folder.",
-				CanonicalMailboxRole.Trash,
-				"unconfirmed",
-				"account-7",
-			),
-		);
-		const body: Omit<FolderRoleConflict, "statusCode"> = JSON.parse(
-			response.body,
-		);
-		const declaredFields: ReadonlyArray<keyof typeof body> = [
-			"code",
-			"details",
-			"message",
-		];
-
-		assert.equal(response.statusCode, 409);
-		assert.deepEqual(Object.keys(body).sort(), [...declaredFields].sort());
-		assert.equal(body.code, "folder_role_unresolved");
-	});
-});

package/src/error.ts

@@ -1,123 +0,0 @@
-import { isPublicApiError } from "@remit/data-ports/errors";
-import { logger } from "@remit/logger-lambda";
-import type { APIGatewayProxyResult } from "aws-lambda";
-import { formatResponse } from "./response.js";
-
-/**
- * The `code` a refusal carries when it does not name its own. Every error body
- * the API emits is flat `{ code, message }` (issue #371), and `code` is the
- * only field a client may branch on — a message is a sentence for a person and
- * is free to change.
- *
- * A 5xx always answers `internal_error`, whatever the throw site said: a coded
- * 5xx is a mistake at the throw site, not a contract, and a fixed token cannot
- * carry anything about the failure out of the process.
- */
-export const INTERNAL_ERROR_CODE = "internal_error";
-
-/**
- * The one sentence any 5xx answers with. A thrown message is written for a log
- * line, not for a stranger — it names hosts, queries and ids — so it is
- * replaced rather than trusted. The real message is already on the error log
- * beside the correlation id the response carries.
- */
-export const INTERNAL_ERROR_MESSAGE = "Internal server error";
-
-const CODE_BY_STATUS: Record<number, string> = {
-	400: "invalid_request",
-	401: "unauthorized",
-	403: "forbidden",
-	404: "not_found",
-	409: "conflict",
-	412: "precondition_failed",
-	413: "payload_too_large",
-	422: "unprocessable_entity",
-};
-
-export const defaultErrorCode = (statusCode: number): string => {
-	if (statusCode >= 500) return INTERNAL_ERROR_CODE;
-	return CODE_BY_STATUS[statusCode] ?? "request_refused";
-};
-
-export const handleError = async (
-	error: unknown,
-): Promise<APIGatewayProxyResult> => {
-	if (error instanceof Error) {
-		if ("statusCode" in error) {
-			logger.error(
-				{
-					error: error.message,
-					statusCode: error.statusCode,
-					stack: error.stack,
-				},
-				"Error with statusCode",
-			);
-			// An error that opted in names its own code and details, and only below
-			// 500: the status bound keeps a coded 5xx from reaching a client rather
-			// than trusting every future thrower to leave `publicApiError` alone.
-			// Everything else takes the status class's code, so no response goes out
-			// without one. A 5xx keeps neither the thrower's code nor its message —
-			// one status, one code, one sentence, whatever failed.
-			const statusCode =
-				typeof error.statusCode === "number" ? error.statusCode : 500;
-			if (statusCode >= 500) {
-				return formatResponse(
-					{ code: INTERNAL_ERROR_CODE, message: INTERNAL_ERROR_MESSAGE },
-					statusCode,
-				);
-			}
-			const publicApiError =
-				"publicApiError" in error && isPublicApiError(error.publicApiError)
-					? error.publicApiError
-					: undefined;
-			return formatResponse(
-				{
-					code: defaultErrorCode(statusCode),
-					message: error.message,
-					...publicApiError,
-				},
-				statusCode,
-			);
-		}
-
-		if (error.name === "ElectroError") {
-			// DynamoDB client/infrastructure errors should be 500
-			// These contain "aws-error" in the message or reference URL
-			const isInfrastructureError =
-				error.message.includes("aws-error") ||
-				error.message.includes("DynamoDB client");
-
-			const statusCode = isInfrastructureError ? 500 : 400;
-			const logMessage = isInfrastructureError
-				? "DynamoDB infrastructure error"
-				: "ElectroError";
-
-			logger.error({ error: error.message, stack: error.stack }, logMessage);
-
-			// Don't expose internal details for infrastructure errors
-			const responseMessage = isInfrastructureError
-				? "Database temporarily unavailable"
-				: error.message;
-
-			return formatResponse(
-				{ code: defaultErrorCode(statusCode), message: responseMessage },
-				statusCode,
-			);
-		}
-
-		logger.error(
-			{ error: error.message, name: error.name, stack: error.stack },
-			"Unhandled Error",
-		);
-		return formatResponse(
-			{ code: INTERNAL_ERROR_CODE, message: INTERNAL_ERROR_MESSAGE },
-			500,
-		);
-	}
-
-	logger.error({ error: JSON.stringify(error) }, "Unknown error type");
-	return formatResponse(
-		{ code: INTERNAL_ERROR_CODE, message: INTERNAL_ERROR_MESSAGE },
-		500,
-	);
-};

package/src/handlers/account-guards.test.ts

@@ -1,67 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import { AccountAuthType } from "@remit/domain-enums";
-import type { APIGatewayProxyResult } from "aws-lambda";
-import { handleError } from "../error.js";
-import {
-	assertNotOAuthCreate,
-	assertPasswordProvided,
-} from "./account-guards.js";
-
-const refusalOf = (guard: () => void): Promise<APIGatewayProxyResult> => {
-	let thrown: unknown;
-	assert.throws(guard, (error: unknown) => {
-		thrown = error;
-		return true;
-	});
-	return handleError(thrown);
-};
-
-// Both guards used to throw `{ status: 400 }`, and the emitter reads
-// `statusCode`. The status never matched, so a create the API meant to refuse
-// as malformed answered 500 with "Internal server error" — telling the caller
-// the server broke rather than what to change (issue #371).
-describe("the create-account guards", () => {
-	it("refuses an OAuth create as a 400 the caller can act on", async () => {
-		const response = await refusalOf(() =>
-			assertNotOAuthCreate(AccountAuthType.OauthMicrosoft),
-		);
-
-		assert.equal(response.statusCode, 400);
-		const body = JSON.parse(response.body) as {
-			code: string;
-			message: string;
-		};
-		assert.equal(body.code, "invalid_request");
-		assert.match(body.message, /OAuth connect flow/);
-	});
-
-	it("refuses a password create with no password as a 400", async () => {
-		const response = await refusalOf(() =>
-			assertPasswordProvided(AccountAuthType.Password, undefined),
-		);
-
-		assert.equal(response.statusCode, 400);
-		const body = JSON.parse(response.body) as {
-			code: string;
-			message: string;
-		};
-		assert.equal(body.code, "invalid_request");
-		assert.match(body.message, /password is required/);
-	});
-
-	it("refuses a create that omits authType and password alike", async () => {
-		const response = await refusalOf(() =>
-			assertPasswordProvided(undefined, undefined),
-		);
-
-		assert.equal(response.statusCode, 400);
-	});
-
-	it("lets a password create with a password through", () => {
-		assert.doesNotThrow(() =>
-			assertPasswordProvided(AccountAuthType.Password, "hunter2"),
-		);
-		assert.doesNotThrow(() => assertNotOAuthCreate(AccountAuthType.Password));
-	});
-});