@remit/backend 0.0.143 → 0.0.144

package/dist/src/service/trigger-sync.js

@@ -0,0 +1,39 @@
+import { randomUUID } from "node:crypto";
+import { SendMessageCommand } from "@aws-sdk/client-sqs";
+const isFifoQueue = (queueUrl) => queueUrl.endsWith(".fifo");
+/**
+ * Build the scheduler's own dedup namespace, bucketed by tick interval so
+ * consecutive ticks each get a fresh id (never colliding with each other)
+ * while still deduping a genuine double-invocation of the same tick (e.g. a
+ * retried Lambda) — see `dedupId` above.
+ */
+export const buildScheduledSyncDedupId = (accountId, now, bucketMs) => {
+    const bucket = Math.floor(now / bucketMs);
+    return `SYNC_MAILBOXES:scheduled:${accountId}:${bucket}`;
+};
+export const buildSyncMailboxesCommand = (input) => {
+    const { queueUrl, accountId, dedupId, explicitRequest } = input;
+    const event = {
+        type: "SYNC_MAILBOXES",
+        eventId: randomUUID(),
+        timestamp: Date.now(),
+        accountId,
+        ...(explicitRequest && { explicitRequest }),
+    };
+    const useFifo = isFifoQueue(queueUrl);
+    return new SendMessageCommand({
+        QueueUrl: queueUrl,
+        MessageBody: JSON.stringify(event),
+        ...(useFifo && {
+            MessageGroupId: accountId,
+            MessageDeduplicationId: dedupId ?? event.eventId,
+        }),
+    });
+};
+export const triggerAccountSync = async (input) => {
+    const command = buildSyncMailboxesCommand(input);
+    await input.sqsClient.send(command);
+    const body = command.input.MessageBody ?? "{}";
+    const parsed = JSON.parse(body);
+    return { eventId: parsed.eventId };
+};

package/dist/src/types.d.ts

@@ -0,0 +1,49 @@
+import type { Context } from "openapi-backend";
+type MatchPrefix<Prefix extends string, S extends string> = S extends `${Prefix}${infer _}` ? S : never;
+export type OperationIds = "MeOperations_deleteMe" | "MeOperations_listVipSuggestions" | "MeOperations_createExport" | "MeOperations_getExport" | "MeOperations_listQuarantine" | "ConfigOperations_getConfig" | "ConfigOperations_exportConfig" | "ConfigOperations_importConfig" | "SystemOperations_getSystemUpdate" | "SystemOperations_applySystemUpdate" | "AccountOperations_createAccount" | "AccountOperations_testConnection" | "AccountDetailOperations_updateAccount" | "AccountDetailOperations_deleteAccount" | "MicrosoftOAuthOperations_microsoftOAuthStart" | "MicrosoftOAuthOperations_microsoftOAuthCallback" | "MailboxOperations_listMailboxes" | "MailboxOperations_createMailbox" | "MailboxDetailOperations_getMailbox" | "MailboxDetailOperations_renameMailbox" | "MailboxDetailOperations_deleteMailbox" | "FolderRoleOperations_appointFolderRole" | "FilterOperations_listFilters" | "FilterOperations_createFilter" | "FilterDetailOperations_getFilter" | "FilterDetailOperations_updateFilter" | "FilterDetailOperations_deleteFilter" | "LabelOperations_listLabels" | "LabelOperations_createLabel" | "LabelDetailOperations_getLabel" | "LabelDetailOperations_updateLabel" | "LabelDetailOperations_deleteLabel" | "OrganizeOperations_createOrganizeJob" | "OrganizeOperations_previewOrganize" | "OrganizeJobDetailOperations_getOrganizeJob" | "SyncOperations_triggerSync" | "SyncOperations_getSyncStatus" | "ThreadDetailOperations_listThreadMessages" | "UnifiedThreadOperations_listAllThreads" | "ThreadOperations_listThreads" | "ThreadOperations_searchThreads" | "MessageOperations_describeMessage" | "MessageOperations_getRawMessage" | "MessageOperations_updateMessageFlags" | "MessageBulkOperations_deleteMessages" | "MessageBulkOperations_moveMessages" | "MessageBulkOperations_updateFlags" | "MessageBulkOperations_copyMessages" | "MessageBulkOperations_updateMessageLabels" | "MessageBulkOperations_reportSpam" | "MessageBulkOperations_notSpam" | "CalendarOperations_listCalendars" | "CalendarOperations_createCalendar" | "CalendarDetailOperations_getCalendar" | "CalendarDetailOperations_updateCalendar" | "CalendarDetailOperations_deleteCalendar" | "CalendarDetailOperations_getCalendarFeed" | "CalendarDetailOperations_putCalendarFeed" | "CalendarDetailOperations_revokeCalendarFeed" | "CalendarFeedOperations_getCalendarFeedIcal" | "CalendarEventOperations_listCalendarEvents" | "CalendarEventOperations_createCalendarEvent" | "CalendarEventDetailOperations_getCalendarEvent" | "CalendarEventDetailOperations_updateCalendarEvent" | "CalendarEventDetailOperations_deleteCalendarEvent" | "CalendarFreeBusyOperations_listCalendarFreeBusy" | "TrashOperations_emptyTrash" | "OutboxOperations_createOutboxMessage" | "OutboxOperations_listOutboxMessages" | "OutboxDetailOperations_getOutboxMessage" | "OutboxDetailOperations_updateOutboxMessage" | "OutboxDetailOperations_deleteOutboxMessage" | "OutboxDetailOperations_sendOutboxMessage" | "OutboxDetailOperations_mintOutboxAttachment" | "OutboxAttachmentOperations_completeOutboxAttachment" | "AddressOperations_searchAddresses" | "AddressDetailOperations_updateAddress" | "CalendarSuggestionOperations_listCalendarSuggestions" | "MessageCalendarSuggestionOperations_listMessageCalendarSuggestions" | "CalendarSuggestionActionOperations_acceptCalendarSuggestion" | "CalendarSuggestionActionOperations_declineCalendarSuggestion" | "CalendarSuggestionActionOperations_dismissCalendarSuggestion" | "CalendarSuggestionActionOperations_reopenCalendarSuggestion";
+export type MeOperationIds = MatchPrefix<"MeOperations_", OperationIds>;
+export type ConfigOperationIds = MatchPrefix<"ConfigOperations_", OperationIds>;
+export type SystemOperationIds = MatchPrefix<"SystemOperations_", OperationIds>;
+export type AccountOperationIds = MatchPrefix<"AccountOperations_", OperationIds>;
+export type AccountDetailOperationIds = MatchPrefix<"AccountDetailOperations_", OperationIds>;
+export type MailboxOperationIds = MatchPrefix<"MailboxOperations_", OperationIds>;
+export type MailboxDetailOperationIds = MatchPrefix<"MailboxDetailOperations_", OperationIds>;
+export type FolderRoleOperationIds = MatchPrefix<"FolderRoleOperations_", OperationIds>;
+export type FilterOperationIds = MatchPrefix<"FilterOperations_", OperationIds>;
+export type FilterDetailOperationIds = MatchPrefix<"FilterDetailOperations_", OperationIds>;
+export type LabelOperationIds = MatchPrefix<"LabelOperations_", OperationIds>;
+export type LabelDetailOperationIds = MatchPrefix<"LabelDetailOperations_", OperationIds>;
+export type OrganizeOperationIds = MatchPrefix<"OrganizeOperations_", OperationIds>;
+export type OrganizeJobDetailOperationIds = MatchPrefix<"OrganizeJobDetailOperations_", OperationIds>;
+export type SyncOperationIds = MatchPrefix<"SyncOperations_", OperationIds>;
+export type ThreadDetailOperationIds = MatchPrefix<"ThreadDetailOperations_", OperationIds>;
+export type UnifiedThreadOperationIds = MatchPrefix<"UnifiedThreadOperations_", OperationIds>;
+export type ThreadOperationIds = MatchPrefix<"ThreadOperations_", OperationIds>;
+export type MessageOperationIds = MatchPrefix<"MessageOperations_", OperationIds>;
+export type MessageBulkOperationIds = MatchPrefix<"MessageBulkOperations_", OperationIds>;
+export type CalendarOperationIds = MatchPrefix<"CalendarOperations_", OperationIds>;
+export type CalendarDetailOperationIds = MatchPrefix<"CalendarDetailOperations_", OperationIds>;
+/**
+ * The feed sub-resource of `/calendars/{calendarId}`, handled beside the
+ * collection itself rather than inside it: minting a credential and serving one
+ * calendar's settings are different jobs on the same path.
+ */
+export type CalendarFeedDetailOperationIds = "CalendarDetailOperations_getCalendarFeed" | "CalendarDetailOperations_putCalendarFeed" | "CalendarDetailOperations_revokeCalendarFeed";
+export type CalendarCollectionDetailOperationIds = Exclude<CalendarDetailOperationIds, CalendarFeedDetailOperationIds>;
+export type CalendarFeedOperationIds = MatchPrefix<"CalendarFeedOperations_", OperationIds>;
+export type CalendarEventOperationIds = MatchPrefix<"CalendarEventOperations_", OperationIds>;
+export type CalendarEventDetailOperationIds = MatchPrefix<"CalendarEventDetailOperations_", OperationIds>;
+export type CalendarFreeBusyOperationIds = MatchPrefix<"CalendarFreeBusyOperations_", OperationIds>;
+export type TrashOperationIds = MatchPrefix<"TrashOperations_", OperationIds>;
+export type OutboxOperationIds = MatchPrefix<"OutboxOperations_", OperationIds>;
+export type OutboxDetailOperationIds = MatchPrefix<"OutboxDetailOperations_", OperationIds>;
+export type OutboxAttachmentOperationIds = MatchPrefix<"OutboxAttachmentOperations_", OperationIds>;
+export type AddressOperationIds = MatchPrefix<"AddressOperations_", OperationIds>;
+export type AddressDetailOperationIds = MatchPrefix<"AddressDetailOperations_", OperationIds>;
+export type MicrosoftOAuthOperationIds = MatchPrefix<"MicrosoftOAuthOperations_", OperationIds>;
+export type CalendarSuggestionOperationIds = MatchPrefix<"CalendarSuggestionOperations_", OperationIds>;
+export type MessageCalendarSuggestionOperationIds = MatchPrefix<"MessageCalendarSuggestionOperations_", OperationIds>;
+export type CalendarSuggestionActionOperationIds = MatchPrefix<"CalendarSuggestionActionOperations_", OperationIds>;
+type HandlerResponse = Record<string, any>;
+export type OperationHandler<_T extends OperationIds = OperationIds> = (context: Context) => Promise<HandlerResponse>;
+export {};

package/dist/src/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,100 +1,115 @@
 {
-  "name": "@remit/backend",
-  "version": "0.0.143",
-  "description": "Remit Mail Inspector API backend",
-  "license": "MIT",
-  "author": "",
-  "type": "module",
-  "main": "src/index.ts",
-  "exports": {
-    ".": {
-      "types": "./src/index.ts",
-      "default": "./src/index.ts"
-    },
-    "./client": {
-      "types": "./src/service/data-client.ts",
-      "default": "./src/service/data-client.ts"
-    },
-    "./create-remit-client": {
-      "types": "./src/service/create-remit-client.ts",
-      "default": "./src/service/create-remit-client.ts"
-    },
-    "./folder-role-appointments": {
-      "types": "./src/handlers/folder-role-appointments.ts",
-      "default": "./src/handlers/folder-role-appointments.ts"
-    },
-    "./folder-role-labels": {
-      "types": "./src/handlers/folder-role-labels.ts",
-      "default": "./src/handlers/folder-role-labels.ts"
-    },
-    "./organize": {
-      "types": "./src/service/organize.ts",
-      "default": "./src/service/organize.ts"
-    },
-    "./sender-category": {
-      "types": "./src/service/sender-category.ts",
-      "default": "./src/service/sender-category.ts"
-    },
-    "./trigger-sync": {
-      "types": "./src/service/trigger-sync.ts",
-      "default": "./src/service/trigger-sync.ts"
-    },
-    "./content-handler": {
-      "types": "./dev-server/content-handler.ts",
-      "default": "./dev-server/content-handler.ts"
-    }
-  },
-  "scripts": {
-    "test:typecheck": "tsgo --noEmit",
-    "test:run": "node $NODE_TEST_FLAGS --env-file .env.test --import tsx --experimental-test-coverage --test-coverage-include='src/**' --test-coverage-exclude='src/**/*.test.ts' --test-coverage-exclude='src/**/*.test.tsx' --test-coverage-lines=76 --test 'src/**/*.test.ts' 'dev-server/**/*.test.ts'",
-    "test": "npm run test:typecheck && npm run test:run",
-    "bundle": "esbuild 'src/index.ts' --sourcemap --bundle --platform=node --outfile=dist/index.js",
-    "dev": "node --env-file .env.test --watch --import tsx dev-server/server.ts",
-    "dev:remote": "node --env-file ../../.env.dev --watch --import tsx dev-server/server.ts",
-    "serve": "node --import tsx dev-server/server.ts"
-  },
-  "devDependencies": {
-    "@remit/apisix": "*",
-    "@types/better-sqlite3": "^7.6.13",
-    "@types/express": "^5.0.3",
-    "@types/swagger-ui-express": "^4.1.8",
-    "better-sqlite3": "^12.11.1",
-    "esbuild": "^0.28.1",
-    "express": "^5.1.0",
-    "swagger-ui-express": "^5.0.1",
-    "tsx": "*"
-  },
-  "dependencies": {
-    "@remit/config-format": "*",
-    "@remit/config-transfer": "*",
-    "@remit/calendar-service": "*",
-    "@remit/data-ports": "*",
-    "@remit/domain-enums": "*",
-    "@remit/api-openapi-types": "*",
-    "@remit/logger-lambda": "*",
-    "@remit/mail-oauth-service": "*",
-    "@remit/secrets-service": "*",
-    "@remit/mailbox-service": "*",
-    "@remit/search-service": "*",
-    "@remit/storage-service": "*",
-    "@remit/auth-service": "*",
-    "@remit/drizzle-service": "*",
-    "@remit/sqs-client": "*",
-    "@aws-sdk/client-secrets-manager": "*",
-    "@aws-sdk/client-sqs": "*",
-    "better-sqlite3": "^12.11.1",
-    "expect-env": "*",
-    "openapi-backend": "*",
-    "p-map": "*",
-    "@types/aws-lambda": "*",
-    "@types/better-sqlite3": "^7.6.13"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/remit-mail/reader.git",
-    "directory": "packages/backend"
-  }
+	"name": "@remit/backend",
+	"version": "0.0.144",
+	"description": "Remit Mail Inspector API backend",
+	"license": "MIT",
+	"author": "",
+	"type": "module",
+	"main": "dist/src/index.js",
+	"exports": {
+		".": {
+			"types": "./dist/src/index.d.ts",
+			"default": "./dist/src/index.js"
+		},
+		"./api": {
+			"types": "./dist/src/api.d.ts",
+			"default": "./dist/src/api.js"
+		},
+		"./client": {
+			"types": "./dist/src/service/data-client.d.ts",
+			"default": "./dist/src/service/data-client.js"
+		},
+		"./create-remit-client": {
+			"types": "./dist/src/service/create-remit-client.d.ts",
+			"default": "./dist/src/service/create-remit-client.js"
+		},
+		"./folder-role-appointments": {
+			"types": "./dist/src/handlers/folder-role-appointments.d.ts",
+			"default": "./dist/src/handlers/folder-role-appointments.js"
+		},
+		"./folder-role-labels": {
+			"types": "./dist/src/handlers/folder-role-labels.d.ts",
+			"default": "./dist/src/handlers/folder-role-labels.js"
+		},
+		"./organize": {
+			"types": "./dist/src/service/organize.d.ts",
+			"default": "./dist/src/service/organize.js"
+		},
+		"./sender-category": {
+			"types": "./dist/src/service/sender-category.d.ts",
+			"default": "./dist/src/service/sender-category.js"
+		},
+		"./account-deletion": {
+			"types": "./dist/src/service/account-deletion.d.ts",
+			"default": "./dist/src/service/account-deletion.js"
+		},
+		"./trigger-sync": {
+			"types": "./dist/src/service/trigger-sync.d.ts",
+			"default": "./dist/src/service/trigger-sync.js"
+		},
+		"./content-handler": {
+			"types": "./dist/dev-server/content-handler.d.ts",
+			"default": "./dist/dev-server/content-handler.js"
+		}
+	},
+	"scripts": {
+		"prepack": "node ../../npm-scripts/pack-dist.mjs prepack",
+		"postpack": "node ../../npm-scripts/pack-dist.mjs postpack",
+		"test:typecheck": "tsgo --noEmit",
+		"test:run": "node $NODE_TEST_FLAGS --env-file .env.test --import tsx --experimental-test-coverage --test-coverage-include='src/**' --test-coverage-exclude='src/**/*.test.ts' --test-coverage-exclude='src/**/*.test.tsx' --test-coverage-lines=76 --test 'src/**/*.test.ts' 'dev-server/**/*.test.ts'",
+		"test": "npm run test:typecheck && npm run test:run",
+		"bundle": "esbuild 'src/index.ts' --sourcemap --bundle --platform=node --outfile=dist/index.js",
+		"dev": "node --env-file .env.test --watch --import tsx dev-server/server.ts",
+		"dev:remote": "node --env-file ../../.env.dev --watch --import tsx dev-server/server.ts",
+		"serve": "node --import tsx dev-server/server.ts"
+	},
+	"devDependencies": {
+		"@remit/apisix": "*",
+		"@types/better-sqlite3": "^7.6.13",
+		"@types/express": "^5.0.3",
+		"@types/swagger-ui-express": "^4.1.8",
+		"better-sqlite3": "^12.11.1",
+		"esbuild": "^0.28.1",
+		"express": "^5.1.0",
+		"swagger-ui-express": "^5.0.1",
+		"tsx": "*"
+	},
+	"dependencies": {
+		"@remit/config-format": "*",
+		"@remit/config-transfer": "*",
+		"@remit/calendar-service": "*",
+		"@remit/data-ports": "*",
+		"@remit/domain-enums": "*",
+		"@remit/api-openapi-types": "*",
+		"@remit/logger-lambda": "*",
+		"@remit/mail-oauth-service": "*",
+		"@remit/secrets-service": "*",
+		"@remit/mailbox-service": "*",
+		"@remit/storage-service": "*",
+		"@remit/auth-service": "*",
+		"@remit/drizzle-service": "*",
+		"@remit/sqs-client": "*",
+		"@aws-sdk/client-secrets-manager": "*",
+		"@aws-sdk/client-sqs": "*",
+		"better-sqlite3": "^12.11.1",
+		"expect-env": "*",
+		"openapi-backend": "*",
+		"p-map": "*",
+		"@types/aws-lambda": "*",
+		"@types/better-sqlite3": "^7.6.13",
+		"@remit/logger": "*",
+		"@remit/api-openapi-spec": "*"
+	},
+	"publishConfig": {
+		"access": "public"
+	},
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/remit-mail/reader.git",
+		"directory": "packages/backend"
+	},
+	"types": "dist/src/index.d.ts",
+	"files": [
+		"dist"
+	]
 }

package/.env.test

@@ -1,4 +0,0 @@
-SERVER_PORT=5433
-SQS_QUEUE_URL=http://localhost:9324/queue/remit-local
-NODE_ENV=development
-LOG_LEVEL=debug

package/dev-server/content-auth.test.ts

@@ -1,113 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import { createContentSigner } from "../src/derive/contentSignature.js";
-import { authorizeContentRequest } from "./content-auth.js";
-
-const SECRET = "test-master-secret-at-least-32-chars-long";
-const PATH = "accounts/cfg-alice/acc-alice/messages/msg-1/parts/1.2";
-const now = () => Math.floor(Date.now() / 1000);
-
-describe("authorizeContentRequest", () => {
-	it("is a no-op on the AWS path (unsigned URLs)", () => {
-		const result = authorizeContentRequest({
-			dataBackend: undefined,
-			secret: undefined,
-			relativePath: PATH,
-			exp: undefined,
-			sig: undefined,
-			nowSeconds: now(),
-		});
-		assert.deepEqual(result, { authorized: true });
-	});
-
-	it("authorizes a validly signed request on the self-host stack", () => {
-		const { exp, sig } = createContentSigner(SECRET)(PATH);
-		const result = authorizeContentRequest({
-			dataBackend: "sqlite",
-			secret: SECRET,
-			relativePath: PATH,
-			exp: String(exp),
-			sig,
-			nowSeconds: now(),
-		});
-		assert.deepEqual(result, { authorized: true });
-	});
-
-	it("returns 401 when the signature is absent", () => {
-		const result = authorizeContentRequest({
-			dataBackend: "sqlite",
-			secret: SECRET,
-			relativePath: PATH,
-			exp: undefined,
-			sig: undefined,
-			nowSeconds: now(),
-		});
-		assert.equal(result.authorized, false);
-		assert.equal(result.authorized === false && result.status, 401);
-	});
-
-	it("returns 403 for a signature minted for another account's path", () => {
-		const { exp, sig } = createContentSigner(SECRET)(PATH);
-		const result = authorizeContentRequest({
-			dataBackend: "sqlite",
-			secret: SECRET,
-			relativePath: "accounts/cfg-bob/acc-bob/messages/msg-9/parts/1.2",
-			exp: String(exp),
-			sig,
-			nowSeconds: now(),
-		});
-		assert.equal(result.authorized, false);
-		assert.equal(result.authorized === false && result.status, 403);
-	});
-
-	it("returns 403 for an expired signature", () => {
-		const { exp, sig } = createContentSigner(SECRET, -20)(PATH);
-		const result = authorizeContentRequest({
-			dataBackend: "sqlite",
-			secret: SECRET,
-			relativePath: PATH,
-			exp: String(exp),
-			sig,
-			nowSeconds: now(),
-		});
-		assert.equal(result.authorized, false);
-		assert.equal(result.authorized === false && result.status, 403);
-	});
-
-	it("fails closed with 500 when no signing secret is configured", () => {
-		const result = authorizeContentRequest({
-			dataBackend: "sqlite",
-			secret: undefined,
-			relativePath: PATH,
-			exp: "123",
-			sig: "whatever",
-			nowSeconds: now(),
-		});
-		assert.equal(result.authorized, false);
-		assert.equal(result.authorized === false && result.status, 500);
-	});
-
-	it("enforces signatures on every self-host request", () => {
-		const { exp, sig } = createContentSigner(SECRET)(PATH);
-		const valid = authorizeContentRequest({
-			dataBackend: "sqlite",
-			secret: SECRET,
-			relativePath: PATH,
-			exp: String(exp),
-			sig,
-			nowSeconds: now(),
-		});
-		assert.deepEqual(valid, { authorized: true });
-
-		const unsigned = authorizeContentRequest({
-			dataBackend: "sqlite",
-			secret: SECRET,
-			relativePath: PATH,
-			exp: undefined,
-			sig: undefined,
-			nowSeconds: now(),
-		});
-		assert.equal(unsigned.authorized, false);
-		assert.equal(unsigned.authorized === false && unsigned.status, 401);
-	});
-});

package/dev-server/content-auth.ts

@@ -1,54 +0,0 @@
-import { verifyContentSignature } from "../src/derive/contentSignature.js";
-
-/**
- * Decide whether a `/content` request is authorized. Enforcement applies on the
- * self-host SQL backend (sqlite), where this server is the
- * deployed backend container and content URLs are signed. On AWS-local dev
- * (`DATA_BACKEND` unset) `/content` is served straight from the filesystem
- * stand-in for CloudFront and URLs are unsigned, so the check is a no-op.
- *
- * Pure so the decision can be unit-tested without a live server. `relativePath`
- * is the decoded storage path (`accounts/{cfg}/{acc}/messages/{msg}/parts/{part}`)
- * the signature was minted over — the caller strips the `/content/` prefix.
- */
-export interface AuthorizeContentInput {
-	dataBackend: string | undefined;
-	secret: string | undefined;
-	relativePath: string;
-	exp: string | undefined;
-	sig: string | undefined;
-	nowSeconds: number;
-}
-
-export const authorizeContentRequest = (
-	input: AuthorizeContentInput,
-):
-	| { authorized: true }
-	| { authorized: false; status: number; reason: string } => {
-	if (input.dataBackend !== "sqlite") {
-		return { authorized: true };
-	}
-
-	if (!input.secret || input.secret.length === 0) {
-		// A self-host SQL backend with no signing secret means every content URL
-		// is unsigned and unverifiable. Fail closed rather than serve mail bytes
-		// without auth.
-		return {
-			authorized: false,
-			status: 500,
-			reason: "content-signing-not-configured",
-		};
-	}
-
-	const result = verifyContentSignature(
-		input.relativePath,
-		input.exp,
-		input.sig,
-		input.secret,
-		input.nowSeconds,
-	);
-	if (result.valid) return { authorized: true };
-
-	const status = result.reason === "missing" ? 401 : 403;
-	return { authorized: false, status, reason: result.reason };
-};

package/dev-server/content-handler.test.ts

@@ -1,105 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import { gzipSync } from "node:zlib";
-import {
-	parseContentStorageKey,
-	type ServeContentDeps,
-	serveContent,
-} from "./content-handler.js";
-
-const PART_KEY = "accounts/cfg-1/acc-1/messages/msg-1/parts/1.2";
-
-const baseDeps = (
-	over: Partial<ServeContentDeps> = {},
-): { deps: ServeContentDeps; cues: Array<Record<string, unknown>> } => {
-	const cues: Array<Record<string, unknown>> = [];
-	const deps: ServeContentDeps = {
-		readObject: async () => null,
-		lookupMessage: async () => ({ mailboxId: "mbx-1", uid: 42 }),
-		requestBodySync: async (input) => {
-			cues.push(input);
-		},
-		...over,
-	};
-	return { deps, cues };
-};
-
-describe("parseContentStorageKey", () => {
-	it("extracts account + message ids from a part key", () => {
-		assert.deepEqual(parseContentStorageKey(PART_KEY), {
-			accountConfigId: "cfg-1",
-			accountId: "acc-1",
-			messageId: "msg-1",
-		});
-	});
-
-	it("returns null for a non-matching key", () => {
-		assert.equal(parseContentStorageKey("nope/whatever"), null);
-	});
-});
-
-describe("serveContent", () => {
-	it("returns 200 with decompressed bytes when the object is present", async () => {
-		const { deps, cues } = baseDeps({
-			readObject: async () => gzipSync(Buffer.from("hello body")),
-		});
-
-		const result = await serveContent(deps, {
-			fullPath: "/x/parts/1.2",
-			storageKey: PART_KEY,
-		});
-
-		assert.equal(result.status, 200);
-		assert.equal(result.headers["content-type"], "application/octet-stream");
-		assert.equal(result.body.toString(), "hello body");
-		assert.equal(cues.length, 0);
-	});
-
-	it("returns 202 + Retry-After and re-arms the cue when the object is missing", async () => {
-		const { deps, cues } = baseDeps({ readObject: async () => null });
-
-		const result = await serveContent(deps, {
-			fullPath: "/x/parts/1.2",
-			storageKey: PART_KEY,
-		});
-
-		assert.equal(result.status, 202);
-		assert.equal(result.headers["Retry-After"], "1");
-		assert.equal(cues.length, 1, "cue re-armed exactly once");
-		assert.deepEqual(cues[0], {
-			accountId: "acc-1",
-			mailboxId: "mbx-1",
-			messageId: "msg-1",
-			uid: 42,
-		});
-	});
-
-	it("still answers 202 (no cue) when the message row is gone", async () => {
-		const { deps, cues } = baseDeps({
-			readObject: async () => null,
-			lookupMessage: async () => null,
-		});
-
-		const result = await serveContent(deps, {
-			fullPath: "/x/parts/1.2",
-			storageKey: PART_KEY,
-		});
-
-		assert.equal(result.status, 202);
-		assert.equal(cues.length, 0);
-	});
-
-	it("propagates a non-missing read error so the route 500s", async () => {
-		const { deps } = baseDeps({
-			readObject: async () => {
-				throw new Error("EACCES");
-			},
-		});
-
-		await assert.rejects(
-			() =>
-				serveContent(deps, { fullPath: "/x/parts/1.2", storageKey: PART_KEY }),
-			/EACCES/,
-		);
-	});
-});