@remit/backend 0.0.142 → 0.0.144

package/src/handlers/account-guards.ts

@@ -1,169 +0,0 @@
-import type {
-	AccountResponse,
-	AccountService as AccountServiceName,
-	FolderAppointment,
-} from "@remit/api-openapi-types";
-import type { AccountItem } from "@remit/data-ports";
-import { BadRequestError, ConflictError } from "@remit/data-ports/errors";
-import { AccountAuthType, AccountService } from "@remit/domain-enums";
-import {
-	microsoftServicesGranted,
-	orderServices,
-} from "@remit/mail-oauth-service";
-import type { AccountOverrides } from "./account-overrides.js";
-import type { AccountSignature } from "./account-signature.js";
-
-/**
- * Natural key identifying "the same mailbox in the same place" within an
- * account config. IMAP host and login username are both case-insensitive, so we
- * fold to lowercase before comparing. Used as the explicit server-side
- * uniqueness key now that message identity is account-scoped (entropy per
- * onboard) and no longer incidentally dedups duplicate onboards (#633/#635).
- */
-export interface MailboxNaturalKey {
-	imapHost: string;
-	username: string;
-}
-
-const mailboxKeyOf = (key: MailboxNaturalKey): string =>
-	`${key.imapHost.toLowerCase()}\u0000${key.username.toLowerCase()}`;
-
-/**
- * Find an existing ACTIVE (non-deleted) account that occupies the same
- * mailbox-in-the-same-place as `key`. Soft-deleted accounts are ignored so a
- * re-onboard after delete still succeeds.
- *
- * Callers pass the accounts already scoped to one account config (the natural
- * key's accountConfigId component), so this only matches on host + username.
- */
-export const findActiveDuplicateMailbox = (
-	existing: AccountItem[],
-	key: MailboxNaturalKey,
-): AccountItem | undefined => {
-	const target = mailboxKeyOf(key);
-	return existing.find(
-		(account) =>
-			!account.deletedAt &&
-			mailboxKeyOf({
-				imapHost: account.imapHost,
-				username: account.username,
-			}) === target,
-	);
-};
-
-/**
- * Reject the create when an active account already onboards the same mailbox in
- * the same place. Surfaces as a typed 409 ConflictError so the web-client can
- * show a "already added" message instead of silently creating a duplicate.
- */
-export const assertNoDuplicateMailbox = (
-	existing: AccountItem[],
-	key: MailboxNaturalKey,
-): void => {
-	const duplicate = findActiveDuplicateMailbox(existing, key);
-	if (!duplicate) return;
-	throw new ConflictError(
-		`An account for ${key.username} on ${key.imapHost} already exists`,
-	);
-};
-
-/** Rejects OAuth accounts that must go through the dedicated connect flow. */
-export const assertNotOAuthCreate = (authType: string | undefined): void => {
-	if (authType === AccountAuthType.OauthMicrosoft) {
-		throw new BadRequestError(
-			"OAuth accounts must be created via the OAuth connect flow (POST /accounts/oauth/microsoft/start)",
-		);
-	}
-};
-
-/** Rejects password-auth account creation when no password is supplied. */
-export const assertPasswordProvided = (
-	authType: string | undefined,
-	password: string | undefined,
-): void => {
-	const isPasswordAuth = authType === AccountAuthType.Password || !authType;
-	if (isPasswordAuth && !password) {
-		throw new BadRequestError(
-			"password is required when authType is 'password' (or when authType is omitted)",
-		);
-	}
-};
-
-export const resolveSyncedServices = (
-	account: Pick<AccountItem, "authType" | "grantedScopes">,
-	requested: readonly AccountServiceName[],
-): AccountServiceName[] => {
-	const services = orderServices(requested);
-	if (services.length === 0) {
-		throw new BadRequestError(
-			"syncedServices must name at least one service. To stop syncing an account entirely, delete it with DELETE /accounts/{accountId}.",
-		);
-	}
-	if (account.authType !== AccountAuthType.OauthMicrosoft) {
-		if (services.some((service) => service !== AccountService.Mail)) {
-			throw new BadRequestError(
-				`A password account syncs mail only, so syncedServices must be ["${AccountService.Mail}"].`,
-			);
-		}
-		return services;
-	}
-	const granted = microsoftServicesGranted(account.grantedScopes);
-	const uncovered = services.filter((service) => !granted.includes(service));
-	if (uncovered.length > 0) {
-		throw new BadRequestError(
-			`This account's granted scopes lack ${uncovered.join(", ")}. Consent to them through POST /accounts/oauth/microsoft/start with services ${JSON.stringify(services)}, then sign in to Microsoft again.`,
-		);
-	}
-	return services;
-};
-
-// SECURITY: passwordHash, oauthRefreshTokenHash, and smtpPasswordHash are
-// intentionally omitted — never expose token material in API responses.
-// Display name, mute flag, and signatures live in per-account AccountSetting
-// rows (RFC 032); the caller resolves them and passes them in. Absent means the
-// override is unset. `folderAppointments` (RFC 032 exclusive-folder-appointment,
-// #976) is resolved the same way — persisted rows merged with server-proposed
-// defaults for any unfilled role — via `resolveFolderAppointments`.
-export const toAccountResponse = (
-	account: AccountItem,
-	signature: AccountSignature = {},
-	overrides: AccountOverrides = {},
-	folderAppointments: FolderAppointment[] = [],
-): AccountResponse => ({
-	accountId: account.accountId,
-	accountConfigId: account.accountConfigId,
-	displayName: overrides.displayName,
-	username: account.username,
-	email: account.email,
-	authType: account.authType ?? AccountAuthType.Password,
-	syncedServices: account.syncedServices,
-	grantedScopes: account.grantedScopes,
-	imapHost: account.imapHost,
-	imapPort: account.imapPort,
-	imapTls: account.imapTls,
-	imapStartTls: account.imapStartTls,
-	// RFC 032 Tier 2: SMTP config is total. ElectroDB `default` applies on write
-	// only, so rows written before this change still lack these attributes —
-	// coalesce to the schema defaults on read so the response is always complete.
-	smtpEnabled: account.smtpEnabled ?? false,
-	smtpHost: account.smtpHost ?? "",
-	smtpPort: account.smtpPort ?? 587,
-	smtpTls: account.smtpTls ?? false,
-	smtpStartTls: account.smtpStartTls ?? true,
-	smtpUsername: account.smtpUsername ?? "",
-	signaturePlainText: signature.plainText,
-	signatureHtml: signature.html,
-	composeLanguages: overrides.composeLanguages,
-	isActive: account.isActive,
-	connectionState: account.connectionState,
-	lastConnectedAt: account.lastConnectedAt,
-	lastSyncAt: account.lastSyncAt,
-	lastError: account.lastError,
-	syncPhase: account.syncPhase,
-	mailboxCountTotal: account.mailboxCountTotal,
-	mailboxCountSynced: account.mailboxCountSynced,
-	muted: overrides.muted,
-	createdAt: account.createdAt,
-	updatedAt: account.updatedAt,
-	folderAppointments,
-});

package/src/handlers/account-oauth-callback.test.ts

@@ -1,155 +0,0 @@
-/**
- * The browser Microsoft sends back, and where it ends up.
- *
- * The callback answers a redirect, so the whole response is its Location
- * header: an answer that arrives without it is a blank page with the account
- * either connected or not and no way to tell. Driven through the real OpenAPI
- * document and the self-host request path, so what is asserted is what a
- * self-hosted deployment writes onto the wire — the header included, which a
- * handler returning a bare `{statusCode, headers}` shape lost on the way out.
- */
-
-import assert from "node:assert/strict";
-import { randomUUID } from "node:crypto";
-import { createServer, type Server } from "node:http";
-import type { AddressInfo } from "node:net";
-import { after, before, describe, it } from "node:test";
-import { AccountService } from "@remit/domain-enums";
-import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
-import {
-	_resetForTest,
-	type RemitClient,
-	setClient,
-} from "../service/data-client.js";
-import { signState } from "./account-oauth.js";
-import { createCalendarSqliteClient } from "./calendar-sqlite-fixture.js";
-
-const CLIENT_SECRET = "callback-test-client-secret";
-const WEB_ORIGIN = "https://mail.example.com";
-const CALLBACK_PATH = "/accounts/oauth/microsoft/callback";
-
-let handler: (
-	event: APIGatewayProxyEvent,
-	context: unknown,
-) => Promise<APIGatewayProxyResult>;
-let client: RemitClient;
-let cleanup: () => void;
-let tokenEndpoint: Server;
-
-const jwt = (claims: Record<string, unknown>): string =>
-	[
-		Buffer.from(JSON.stringify({ alg: "RS256" })).toString("base64url"),
-		Buffer.from(JSON.stringify(claims), "utf8").toString("base64url"),
-		"signature-not-checked-here",
-	].join(".");
-
-/** Microsoft's token endpoint, close enough for the one call the callback makes. */
-const startTokenEndpoint = async (): Promise<string> => {
-	tokenEndpoint = createServer((_request, response) => {
-		response.writeHead(200, { "Content-Type": "application/json" });
-		response.end(
-			JSON.stringify({
-				access_token: "access-token",
-				refresh_token: "refresh-token",
-				id_token: jwt({ preferred_username: "matthijs@example.com" }),
-				scope:
-					"https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send",
-				expires_in: 3600,
-			}),
-		);
-	});
-	await new Promise<void>((resolve) => tokenEndpoint.listen(0, resolve));
-	const { port } = tokenEndpoint.address() as AddressInfo;
-	return `http://127.0.0.1:${port}/token`;
-};
-
-const callback = (
-	query: Record<string, string>,
-): Promise<APIGatewayProxyResult> =>
-	handler(
-		{
-			httpMethod: "GET",
-			path: CALLBACK_PATH,
-			headers: {},
-			queryStringParameters: query,
-			body: null,
-			requestContext: {},
-		} as unknown as APIGatewayProxyEvent,
-		{ awsRequestId: `req-${randomUUID()}`, functionName: "test" },
-	);
-
-const headerOf = (
-	response: APIGatewayProxyResult,
-	name: string,
-): string | undefined => {
-	for (const [key, value] of Object.entries(response.headers ?? {})) {
-		if (key.toLowerCase() === name) return String(value);
-	}
-	return undefined;
-};
-
-before(async () => {
-	_resetForTest();
-	process.env.DATA_BACKEND = "sqlite";
-	process.env.CORS_ALLOWED_ORIGINS = WEB_ORIGIN;
-	process.env.MSOAUTH_REDIRECT_URI = `${WEB_ORIGIN}${CALLBACK_PATH}`;
-	process.env.MSOAUTH_CLIENT_ID = "callback-test-client-id";
-	process.env.MSOAUTH_CLIENT_SECRET = CLIENT_SECRET;
-	process.env.MSOAUTH_TOKEN_ENDPOINT = await startTokenEndpoint();
-	// The self-host key that encrypts the stored refresh token.
-	process.env.FAKE_KMS_DATAKEY = "0".repeat(64);
-	// Static credentials so the best-effort sync enqueue fails against the local
-	// queue instead of walking the instance-metadata chain for a minute.
-	process.env.AWS_REGION = "eu-west-1";
-	process.env.AWS_ACCESS_KEY_ID = "test";
-	process.env.AWS_SECRET_ACCESS_KEY = "test";
-	({ client, cleanup } = await createCalendarSqliteClient());
-	setClient(client);
-	({ handler } = (await import("../index.js")) as unknown as {
-		handler: typeof handler;
-	});
-});
-
-after(async () => {
-	_resetForTest();
-	cleanup();
-	await new Promise<void>((resolve) => tokenEndpoint.close(() => resolve()));
-});
-
-describe("the Microsoft OAuth callback", () => {
-	it("sends the consenting browser on to the connected account", async () => {
-		const accountConfigId = randomUUID();
-		const state = await signState(
-			{
-				accountConfigId,
-				nonce: "nonce",
-				timestamp: Date.now(),
-				services: [AccountService.Mail],
-			},
-			CLIENT_SECRET,
-		);
-
-		const response = await callback({ code: "auth-code", state });
-
-		assert.equal(response.statusCode, 302, response.body);
-		const location = headerOf(response, "location");
-		assert.ok(location, "a redirect without a Location header is a blank page");
-		const [connected] =
-			await client.account.listAllByAccountConfig(accountConfigId);
-		assert.ok(connected, "the callback stored the account it redirects to");
-		assert.equal(
-			location,
-			`${WEB_ORIGIN}/settings/accounts?connected=${encodeURIComponent(connected.accountId)}`,
-		);
-	});
-
-	it("sends a refused consent back with the reason Microsoft gave", async () => {
-		const response = await callback({ error: "access_denied" });
-
-		assert.equal(response.statusCode, 302, response.body);
-		assert.equal(
-			headerOf(response, "location"),
-			`${WEB_ORIGIN}/settings/accounts?oauthError=access_denied`,
-		);
-	});
-});

package/src/handlers/account-oauth-consent.test.ts

@@ -1,336 +0,0 @@
-import assert from "node:assert/strict";
-import { randomUUID } from "node:crypto";
-import { createServer, type Server } from "node:http";
-import type { AddressInfo } from "node:net";
-import { after, before, beforeEach, describe, it } from "node:test";
-import type {
-	AccountResponse,
-	AccountService as AccountServiceName,
-} from "@remit/api-openapi-types";
-import { AccountService } from "@remit/domain-enums";
-import { MICROSOFT_SERVICE_SCOPES } from "@remit/mail-oauth-service";
-import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
-import { deriveAccountConfigId } from "../auth.js";
-import {
-	_resetForTest,
-	type RemitClient,
-	setClient,
-} from "../service/data-client.js";
-import { createCalendarSqliteClient } from "./calendar-sqlite-fixture.js";
-
-const CLIENT_SECRET = "consent-test-client-secret";
-const WEB_ORIGIN = "https://mail.example.com";
-const GRAPH = "https://graph.microsoft.com/";
-const MAIL_SCOPES = [...MICROSOFT_SERVICE_SCOPES[AccountService.Mail]];
-const CALENDAR_SCOPES = [...MICROSOFT_SERVICE_SCOPES[AccountService.Calendar]];
-
-let handler: (
-	event: APIGatewayProxyEvent,
-	context: unknown,
-) => Promise<APIGatewayProxyResult>;
-let client: RemitClient;
-let cleanup: () => void;
-let tokenEndpoint: Server;
-let withheld: Set<string>;
-let redemptions: string[][];
-
-const jwt = (claims: Record<string, unknown>): string =>
-	[
-		Buffer.from(JSON.stringify({ alg: "RS256" })).toString("base64url"),
-		Buffer.from(JSON.stringify(claims), "utf8").toString("base64url"),
-		"signature-not-checked-here",
-	].join(".");
-
-const readBody = async (request: AsyncIterable<Buffer>): Promise<string> => {
-	const chunks: Buffer[] = [];
-	for await (const chunk of request) chunks.push(chunk);
-	return Buffer.concat(chunks).toString("utf8");
-};
-
-const startTokenEndpoint = async (): Promise<string> => {
-	tokenEndpoint = createServer(async (request, response) => {
-		const form = new URLSearchParams(await readBody(request));
-		const requested = (form.get("scope") ?? "").split(" ").filter(Boolean);
-		redemptions.push(requested);
-		const granted = requested.filter((scope) => !withheld.has(scope));
-		const resourceScopes = granted.filter((scope) => scope.includes("://"));
-		if (resourceScopes.length === 0) {
-			response.writeHead(400, { "Content-Type": "application/json" });
-			response.end(
-				JSON.stringify({ error: "invalid_grant", error_codes: [65001] }),
-			);
-			return;
-		}
-		response.writeHead(200, { "Content-Type": "application/json" });
-		response.end(
-			JSON.stringify({
-				access_token: "access-token",
-				refresh_token: `refresh-token-${redemptions.length}`,
-				id_token: jwt({ preferred_username: "person@example.com" }),
-				expires_in: 3600,
-				scope: granted
-					.map((scope) =>
-						scope.startsWith(GRAPH) ? scope.slice(GRAPH.length) : scope,
-					)
-					.join(" "),
-			}),
-		);
-	});
-	await new Promise<void>((resolve) => tokenEndpoint.listen(0, resolve));
-	const { port } = tokenEndpoint.address() as AddressInfo;
-	return `http://127.0.0.1:${port}/token`;
-};
-
-const headerOf = (
-	response: APIGatewayProxyResult,
-	name: string,
-): string | undefined => {
-	for (const [key, value] of Object.entries(response.headers ?? {})) {
-		if (key.toLowerCase() === name) return String(value);
-	}
-	return undefined;
-};
-
-const request = (
-	sub: string,
-	httpMethod: string,
-	path: string,
-	body: unknown,
-	queryStringParameters: Record<string, string> | null = null,
-): Promise<APIGatewayProxyResult> =>
-	handler(
-		{
-			httpMethod,
-			path,
-			headers: { "content-type": "application/json" },
-			queryStringParameters,
-			body: body === null ? null : JSON.stringify(body),
-			requestContext: { authorizer: { claims: { sub } } },
-		} as unknown as APIGatewayProxyEvent,
-		{ awsRequestId: `req-${randomUUID()}`, functionName: "test" },
-	);
-
-const startConsent = async (
-	sub: string,
-	services: AccountServiceName[] | undefined,
-): Promise<URL> => {
-	const response = await request(
-		sub,
-		"POST",
-		"/accounts/oauth/microsoft/start",
-		{
-			email: "person@example.com",
-			services,
-		},
-	);
-	assert.equal(response.statusCode, 200, response.body);
-	return new URL(
-		(JSON.parse(response.body) as { authorizationUrl: string })
-			.authorizationUrl,
-	);
-};
-
-const consent = async (
-	sub: string,
-	services: AccountServiceName[] | undefined,
-): Promise<string> => {
-	const authorizationUrl = await startConsent(sub, services);
-	const state = authorizationUrl.searchParams.get("state");
-	assert.ok(state, "the authorization URL carries the signed state");
-	const response = await request(
-		sub,
-		"GET",
-		"/accounts/oauth/microsoft/callback",
-		null,
-		{ code: "auth-code", state },
-	);
-	assert.equal(response.statusCode, 302, response.body);
-	const location = headerOf(response, "location");
-	assert.ok(location, "the callback answers with a Location");
-	return location;
-};
-
-const onlyAccount = async (sub: string) => {
-	const accounts = await client.account.listAllByAccountConfig(
-		deriveAccountConfigId(sub),
-	);
-	assert.equal(accounts.length, 1, "the consent wrote exactly one account");
-	return accounts[0];
-};
-
-const patchServices = (
-	sub: string,
-	accountId: string,
-	syncedServices: AccountServiceName[],
-): Promise<APIGatewayProxyResult> =>
-	request(sub, "PATCH", `/accounts/${accountId}`, { syncedServices });
-
-before(async () => {
-	_resetForTest();
-	process.env.DATA_BACKEND = "sqlite";
-	process.env.CORS_ALLOWED_ORIGINS = WEB_ORIGIN;
-	process.env.MSOAUTH_REDIRECT_URI = `${WEB_ORIGIN}/accounts/oauth/microsoft/callback`;
-	process.env.MSOAUTH_CLIENT_ID = "consent-test-client-id";
-	process.env.MSOAUTH_CLIENT_SECRET = CLIENT_SECRET;
-	process.env.MSOAUTH_TOKEN_ENDPOINT = await startTokenEndpoint();
-	process.env.FAKE_KMS_DATAKEY = "0".repeat(64);
-	process.env.AWS_REGION = "eu-west-1";
-	process.env.AWS_ACCESS_KEY_ID = "test";
-	process.env.AWS_SECRET_ACCESS_KEY = "test";
-	({ client, cleanup } = await createCalendarSqliteClient());
-	setClient(client);
-	({ handler } = (await import("../index.js")) as unknown as {
-		handler: typeof handler;
-	});
-});
-
-beforeEach(() => {
-	withheld = new Set();
-	redemptions = [];
-});
-
-after(async () => {
-	_resetForTest();
-	cleanup();
-	await new Promise<void>((resolve) => tokenEndpoint.close(() => resolve()));
-});
-
-describe("the Microsoft consent for the services an account syncs", () => {
-	it("asks for the calendar scope only when the start names Calendar", async () => {
-		const sub = randomUUID();
-
-		const mailOnly = (
-			await startConsent(sub, [AccountService.Mail])
-		).searchParams
-			.get("scope")
-			?.split(" ");
-		const calendarOnly = (
-			await startConsent(sub, [AccountService.Calendar])
-		).searchParams
-			.get("scope")
-			?.split(" ");
-
-		assert.ok(mailOnly);
-		assert.ok(calendarOnly);
-		assert.deepEqual(
-			mailOnly.filter((scope) => scope.includes("://")),
-			MAIL_SCOPES,
-		);
-		assert.deepEqual(
-			calendarOnly.filter((scope) => scope.includes("://")),
-			CALENDAR_SCOPES,
-		);
-		assert.ok(calendarOnly.includes("offline_access"));
-	});
-
-	it("creates a calendar-only account holding the calendar grant", async () => {
-		const sub = randomUUID();
-
-		const location = await consent(sub, [AccountService.Calendar]);
-
-		const account = await onlyAccount(sub);
-		assert.equal(
-			location,
-			`${WEB_ORIGIN}/settings/accounts?connected=${encodeURIComponent(account.accountId)}`,
-		);
-		assert.deepEqual(account.syncedServices, [AccountService.Calendar]);
-		assert.deepEqual(account.grantedScopes, CALENDAR_SCOPES);
-		assert.deepEqual(redemptions, [
-			[...CALENDAR_SCOPES, "offline_access", "openid", "email"],
-		]);
-	});
-
-	it("refuses a consent that comes back without the calendar scope and writes nothing", async () => {
-		const sub = randomUUID();
-		withheld = new Set(CALENDAR_SCOPES);
-
-		const location = await consent(sub, [
-			AccountService.Mail,
-			AccountService.Calendar,
-		]);
-
-		assert.equal(
-			location,
-			`${WEB_ORIGIN}/settings/accounts?oauthError=scope_not_granted&oauthEmail=person%40example.com&missingServices=Calendar`,
-		);
-		assert.deepEqual(
-			await client.account.listAllByAccountConfig(deriveAccountConfigId(sub)),
-			[],
-		);
-	});
-
-	it("keeps calendar when a mail and calendar account reconnects naming only its email", async () => {
-		const sub = randomUUID();
-		await consent(sub, [AccountService.Mail, AccountService.Calendar]);
-		const connected = await onlyAccount(sub);
-
-		redemptions = [];
-		const location = await consent(sub, undefined);
-
-		const reconnected = await onlyAccount(sub);
-		assert.equal(
-			location,
-			`${WEB_ORIGIN}/settings/accounts?connected=${encodeURIComponent(connected.accountId)}`,
-		);
-		assert.deepEqual(reconnected.syncedServices, [
-			AccountService.Mail,
-			AccountService.Calendar,
-		]);
-		assert.deepEqual(reconnected.grantedScopes, [
-			...MAIL_SCOPES,
-			...CALENDAR_SCOPES,
-		]);
-		assert.deepEqual(
-			redemptions.map((scopes) => scopes.filter((s) => s.includes("://"))),
-			[MAIL_SCOPES, CALENDAR_SCOPES],
-		);
-	});
-
-	it("adds calendar to a mail account through a second consent", async () => {
-		const sub = randomUUID();
-		await consent(sub, [AccountService.Mail]);
-		const mailAccount = await onlyAccount(sub);
-		assert.deepEqual(mailAccount.grantedScopes, MAIL_SCOPES);
-
-		const refused = await patchServices(sub, mailAccount.accountId, [
-			AccountService.Mail,
-			AccountService.Calendar,
-		]);
-		assert.equal(refused.statusCode, 400, refused.body);
-		const { message } = JSON.parse(refused.body) as { message: string };
-		assert.match(message, /granted scopes lack Calendar/);
-		assert.match(message, /POST \/accounts\/oauth\/microsoft\/start/);
-
-		redemptions = [];
-		await consent(sub, [AccountService.Mail, AccountService.Calendar]);
-
-		const reconnected = await onlyAccount(sub);
-		assert.equal(reconnected.accountId, mailAccount.accountId);
-		assert.deepEqual(reconnected.syncedServices, [
-			AccountService.Mail,
-			AccountService.Calendar,
-		]);
-		assert.deepEqual(reconnected.grantedScopes, [
-			...MAIL_SCOPES,
-			...CALENDAR_SCOPES,
-		]);
-		assert.deepEqual(
-			redemptions.map((scopes) => scopes.filter((s) => s.includes("://"))),
-			[MAIL_SCOPES, CALENDAR_SCOPES],
-		);
-
-		const mailAgain = await patchServices(sub, mailAccount.accountId, [
-			AccountService.Mail,
-		]);
-		assert.equal(mailAgain.statusCode, 200, mailAgain.body);
-		const both = await patchServices(sub, mailAccount.accountId, [
-			AccountService.Calendar,
-			AccountService.Mail,
-		]);
-		assert.equal(both.statusCode, 200, both.body);
-		assert.deepEqual(
-			(JSON.parse(both.body) as AccountResponse).syncedServices,
-			[AccountService.Mail, AccountService.Calendar],
-		);
-	});
-});