@remit/backend 0.0.143 → 0.0.145

package/dist/src/service/trigger-sync.d.ts

@@ -0,0 +1,57 @@
+import type { FifoQueueMessage, FifoQueueProducer } from "@remit/data-ports";
+export interface SyncMailboxesEvent {
+    type: "SYNC_MAILBOXES";
+    eventId: string;
+    timestamp: number;
+    accountId: string;
+    explicitRequest?: boolean;
+}
+interface TriggerAccountSyncInput {
+    queue: FifoQueueProducer<SyncMailboxesEvent>;
+    accountId: string;
+    /**
+     * Set by POST /sync, whose callers ask for a sync of one named account: the
+     * refresh control, pull-to-refresh, and the web client's automatic poll
+     * (`useStaleAccountSync`) — a timer, not a person. It travels on the event
+     * and makes the worker's fan-out sync every mailbox even if one just ran.
+     *
+     * Everything else triggers a sync as a side effect of doing something else
+     * (config load, OAuth connect, account create, the scheduled tick), leaves
+     * this unset, and takes the freshness gate — see `mailboxNeedsSync` in
+     * imap-worker's sync-mailboxes handler.
+     *
+     * How often a timer may do that is bounded on the client, by the poll's own
+     * floor (`MIN_POLL_INTERVAL_MS` in the client hook, 30s) rather than by the
+     * gate: `mailboxPollIntervalSeconds` can lengthen the interval, never
+     * shorten it past that.
+     */
+    explicitRequest?: boolean;
+    /**
+     * Override the queue deduplication id. Defaults to the event's own
+     * id, so the queue suppresses a re-send of one event and nothing else —
+     * every manual call site (POST /sync, OAuth connect, config load,
+     * pull-to-refresh, the client's online-poll) always enqueues. A shared,
+     * time-bucketed id instead turned SQS's 5-minute window into a rate limiter
+     * and silently discarded a sync the user asked for whenever one had run
+     * recently (issue #37). What a trigger costs is bounded in the worker's
+     * fan-out (`mailboxNeedsSync`), by skipping mailboxes not worth
+     * re-enumerating — never by dropping the trigger.
+     *
+     * The scheduled-sync tick (#1247) passes `buildScheduledSyncDedupId()`,
+     * which is bucketed by the tick's own cadence: there it collapses a
+     * re-invocation of a single tick, never two ticks or a manual trigger.
+     */
+    dedupId?: string;
+}
+/**
+ * Build the scheduler's own dedup namespace, bucketed by tick interval so
+ * consecutive ticks each get a fresh id (never colliding with each other)
+ * while still deduping a genuine double-invocation of the same tick (e.g. a
+ * retried Lambda) — see `dedupId` above.
+ */
+export declare const buildScheduledSyncDedupId: (accountId: string, now: number, bucketMs: number) => string;
+export declare const buildSyncMailboxesMessage: (input: Omit<TriggerAccountSyncInput, "queue">) => FifoQueueMessage<SyncMailboxesEvent>;
+export declare const triggerAccountSync: (input: TriggerAccountSyncInput) => Promise<{
+    eventId: string;
+}>;
+export {};

package/dist/src/service/trigger-sync.js

@@ -0,0 +1,31 @@
+import { randomUUID } from "node:crypto";
+/**
+ * Build the scheduler's own dedup namespace, bucketed by tick interval so
+ * consecutive ticks each get a fresh id (never colliding with each other)
+ * while still deduping a genuine double-invocation of the same tick (e.g. a
+ * retried Lambda) — see `dedupId` above.
+ */
+export const buildScheduledSyncDedupId = (accountId, now, bucketMs) => {
+    const bucket = Math.floor(now / bucketMs);
+    return `SYNC_MAILBOXES:scheduled:${accountId}:${bucket}`;
+};
+export const buildSyncMailboxesMessage = (input) => {
+    const { accountId, dedupId, explicitRequest } = input;
+    const event = {
+        type: "SYNC_MAILBOXES",
+        eventId: randomUUID(),
+        timestamp: Date.now(),
+        accountId,
+        ...(explicitRequest && { explicitRequest }),
+    };
+    return {
+        body: event,
+        groupId: accountId,
+        deduplicationId: dedupId ?? event.eventId,
+    };
+};
+export const triggerAccountSync = async (input) => {
+    const message = buildSyncMailboxesMessage(input);
+    await input.queue.send(message);
+    return { eventId: message.body.eventId };
+};

package/dist/src/types.d.ts

@@ -0,0 +1,72 @@
+import type { Context } from "openapi-backend";
+import type { ApiConfig } from "./config/api-config.js";
+import type { RemitClient } from "./service/create-remit-client.js";
+import type { QueueName } from "./service/queues.js";
+type MatchPrefix<Prefix extends string, S extends string> = S extends `${Prefix}${infer _}` ? S : never;
+export type OperationIds = "MeOperations_deleteMe" | "MeOperations_listVipSuggestions" | "MeOperations_createExport" | "MeOperations_getExport" | "MeOperations_listQuarantine" | "ConfigOperations_getConfig" | "ConfigOperations_exportConfig" | "ConfigOperations_importConfig" | "SystemOperations_getSystemUpdate" | "SystemOperations_applySystemUpdate" | "AccountOperations_createAccount" | "AccountOperations_testConnection" | "AccountDetailOperations_updateAccount" | "AccountDetailOperations_deleteAccount" | "MicrosoftOAuthOperations_microsoftOAuthStart" | "MicrosoftOAuthOperations_microsoftOAuthCallback" | "MailboxOperations_listMailboxes" | "MailboxOperations_createMailbox" | "MailboxDetailOperations_getMailbox" | "MailboxDetailOperations_renameMailbox" | "MailboxDetailOperations_deleteMailbox" | "FolderRoleOperations_appointFolderRole" | "FilterOperations_listFilters" | "FilterOperations_createFilter" | "FilterDetailOperations_getFilter" | "FilterDetailOperations_updateFilter" | "FilterDetailOperations_deleteFilter" | "LabelOperations_listLabels" | "LabelOperations_createLabel" | "LabelDetailOperations_getLabel" | "LabelDetailOperations_updateLabel" | "LabelDetailOperations_deleteLabel" | "OrganizeOperations_createOrganizeJob" | "OrganizeOperations_previewOrganize" | "OrganizeJobDetailOperations_getOrganizeJob" | "SyncOperations_triggerSync" | "SyncOperations_getSyncStatus" | "ThreadDetailOperations_listThreadMessages" | "UnifiedThreadOperations_listAllThreads" | "ThreadOperations_listThreads" | "ThreadOperations_searchThreads" | "MessageOperations_describeMessage" | "MessageOperations_getRawMessage" | "MessageOperations_updateMessageFlags" | "MessageBulkOperations_deleteMessages" | "MessageBulkOperations_moveMessages" | "MessageBulkOperations_updateFlags" | "MessageBulkOperations_copyMessages" | "MessageBulkOperations_updateMessageLabels" | "MessageBulkOperations_reportSpam" | "MessageBulkOperations_notSpam" | "CalendarOperations_listCalendars" | "CalendarOperations_createCalendar" | "CalendarDetailOperations_getCalendar" | "CalendarDetailOperations_updateCalendar" | "CalendarDetailOperations_deleteCalendar" | "CalendarDetailOperations_getCalendarFeed" | "CalendarDetailOperations_putCalendarFeed" | "CalendarDetailOperations_revokeCalendarFeed" | "CalendarFeedOperations_getCalendarFeedIcal" | "CalendarEventOperations_listCalendarEvents" | "CalendarEventOperations_createCalendarEvent" | "CalendarEventDetailOperations_getCalendarEvent" | "CalendarEventDetailOperations_updateCalendarEvent" | "CalendarEventDetailOperations_deleteCalendarEvent" | "CalendarFreeBusyOperations_listCalendarFreeBusy" | "TrashOperations_emptyTrash" | "OutboxOperations_createOutboxMessage" | "OutboxOperations_listOutboxMessages" | "OutboxDetailOperations_getOutboxMessage" | "OutboxDetailOperations_updateOutboxMessage" | "OutboxDetailOperations_deleteOutboxMessage" | "OutboxDetailOperations_sendOutboxMessage" | "OutboxDetailOperations_mintOutboxAttachment" | "OutboxAttachmentOperations_completeOutboxAttachment" | "AddressOperations_searchAddresses" | "AddressDetailOperations_updateAddress" | "CalendarSuggestionOperations_listCalendarSuggestions" | "MessageCalendarSuggestionOperations_listMessageCalendarSuggestions" | "CalendarSuggestionActionOperations_acceptCalendarSuggestion" | "CalendarSuggestionActionOperations_declineCalendarSuggestion" | "CalendarSuggestionActionOperations_dismissCalendarSuggestion" | "CalendarSuggestionActionOperations_reopenCalendarSuggestion";
+export type MeOperationIds = MatchPrefix<"MeOperations_", OperationIds>;
+export type ConfigOperationIds = MatchPrefix<"ConfigOperations_", OperationIds>;
+export type SystemOperationIds = MatchPrefix<"SystemOperations_", OperationIds>;
+export type AccountOperationIds = MatchPrefix<"AccountOperations_", OperationIds>;
+export type AccountDetailOperationIds = MatchPrefix<"AccountDetailOperations_", OperationIds>;
+export type MailboxOperationIds = MatchPrefix<"MailboxOperations_", OperationIds>;
+export type MailboxDetailOperationIds = MatchPrefix<"MailboxDetailOperations_", OperationIds>;
+export type FolderRoleOperationIds = MatchPrefix<"FolderRoleOperations_", OperationIds>;
+export type FilterOperationIds = MatchPrefix<"FilterOperations_", OperationIds>;
+export type FilterDetailOperationIds = MatchPrefix<"FilterDetailOperations_", OperationIds>;
+export type LabelOperationIds = MatchPrefix<"LabelOperations_", OperationIds>;
+export type LabelDetailOperationIds = MatchPrefix<"LabelDetailOperations_", OperationIds>;
+export type OrganizeOperationIds = MatchPrefix<"OrganizeOperations_", OperationIds>;
+export type OrganizeJobDetailOperationIds = MatchPrefix<"OrganizeJobDetailOperations_", OperationIds>;
+export type SyncOperationIds = MatchPrefix<"SyncOperations_", OperationIds>;
+export type ThreadDetailOperationIds = MatchPrefix<"ThreadDetailOperations_", OperationIds>;
+export type UnifiedThreadOperationIds = MatchPrefix<"UnifiedThreadOperations_", OperationIds>;
+export type ThreadOperationIds = MatchPrefix<"ThreadOperations_", OperationIds>;
+export type MessageOperationIds = MatchPrefix<"MessageOperations_", OperationIds>;
+export type MessageBulkOperationIds = MatchPrefix<"MessageBulkOperations_", OperationIds>;
+export type CalendarOperationIds = MatchPrefix<"CalendarOperations_", OperationIds>;
+export type CalendarDetailOperationIds = MatchPrefix<"CalendarDetailOperations_", OperationIds>;
+/**
+ * The feed sub-resource of `/calendars/{calendarId}`, handled beside the
+ * collection itself rather than inside it: minting a credential and serving one
+ * calendar's settings are different jobs on the same path.
+ */
+export type CalendarFeedDetailOperationIds = "CalendarDetailOperations_getCalendarFeed" | "CalendarDetailOperations_putCalendarFeed" | "CalendarDetailOperations_revokeCalendarFeed";
+export type CalendarCollectionDetailOperationIds = Exclude<CalendarDetailOperationIds, CalendarFeedDetailOperationIds>;
+export type CalendarFeedOperationIds = MatchPrefix<"CalendarFeedOperations_", OperationIds>;
+export type CalendarEventOperationIds = MatchPrefix<"CalendarEventOperations_", OperationIds>;
+export type CalendarEventDetailOperationIds = MatchPrefix<"CalendarEventDetailOperations_", OperationIds>;
+export type CalendarFreeBusyOperationIds = MatchPrefix<"CalendarFreeBusyOperations_", OperationIds>;
+export type TrashOperationIds = MatchPrefix<"TrashOperations_", OperationIds>;
+export type OutboxOperationIds = MatchPrefix<"OutboxOperations_", OperationIds>;
+export type OutboxDetailOperationIds = MatchPrefix<"OutboxDetailOperations_", OperationIds>;
+export type OutboxAttachmentOperationIds = MatchPrefix<"OutboxAttachmentOperations_", OperationIds>;
+export type AddressOperationIds = MatchPrefix<"AddressOperations_", OperationIds>;
+export type AddressDetailOperationIds = MatchPrefix<"AddressDetailOperations_", OperationIds>;
+export type MicrosoftOAuthOperationIds = MatchPrefix<"MicrosoftOAuthOperations_", OperationIds>;
+export type CalendarSuggestionOperationIds = MatchPrefix<"CalendarSuggestionOperations_", OperationIds>;
+export type MessageCalendarSuggestionOperationIds = MatchPrefix<"MessageCalendarSuggestionOperations_", OperationIds>;
+export type CalendarSuggestionActionOperationIds = MatchPrefix<"CalendarSuggestionActionOperations_", OperationIds>;
+type HandlerResponse = Record<string, any>;
+export interface UserIdentity {
+    kind: "user";
+    accountConfigId: string;
+    sub: string;
+    email: string;
+}
+export type HandlerIdentity = {
+    kind: "anonymous";
+} | UserIdentity;
+export interface HandlerContext<K extends QueueName = never> {
+    client: RemitClient<K>;
+    identity: UserIdentity;
+    config: ApiConfig;
+}
+export interface PublicHandlerContext<K extends QueueName = never> {
+    client: RemitClient<K>;
+    config: ApiConfig;
+}
+export type PublicOperationIds = "MicrosoftOAuthOperations_microsoftOAuthCallback" | "CalendarFeedOperations_getCalendarFeedIcal";
+export type OperationHandler<_T extends OperationIds = OperationIds, K extends QueueName = never> = (context: Context, ctx: HandlerContext<K>) => Promise<HandlerResponse>;
+export type PublicOperationHandler<K extends QueueName = never> = (context: Context, ctx: PublicHandlerContext<K>) => Promise<HandlerResponse>;
+export {};

package/dist/src/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,100 +1,127 @@
 {
-  "name": "@remit/backend",
-  "version": "0.0.143",
-  "description": "Remit Mail Inspector API backend",
-  "license": "MIT",
-  "author": "",
-  "type": "module",
-  "main": "src/index.ts",
-  "exports": {
-    ".": {
-      "types": "./src/index.ts",
-      "default": "./src/index.ts"
-    },
-    "./client": {
-      "types": "./src/service/data-client.ts",
-      "default": "./src/service/data-client.ts"
-    },
-    "./create-remit-client": {
-      "types": "./src/service/create-remit-client.ts",
-      "default": "./src/service/create-remit-client.ts"
-    },
-    "./folder-role-appointments": {
-      "types": "./src/handlers/folder-role-appointments.ts",
-      "default": "./src/handlers/folder-role-appointments.ts"
-    },
-    "./folder-role-labels": {
-      "types": "./src/handlers/folder-role-labels.ts",
-      "default": "./src/handlers/folder-role-labels.ts"
-    },
-    "./organize": {
-      "types": "./src/service/organize.ts",
-      "default": "./src/service/organize.ts"
-    },
-    "./sender-category": {
-      "types": "./src/service/sender-category.ts",
-      "default": "./src/service/sender-category.ts"
-    },
-    "./trigger-sync": {
-      "types": "./src/service/trigger-sync.ts",
-      "default": "./src/service/trigger-sync.ts"
-    },
-    "./content-handler": {
-      "types": "./dev-server/content-handler.ts",
-      "default": "./dev-server/content-handler.ts"
-    }
-  },
-  "scripts": {
-    "test:typecheck": "tsgo --noEmit",
-    "test:run": "node $NODE_TEST_FLAGS --env-file .env.test --import tsx --experimental-test-coverage --test-coverage-include='src/**' --test-coverage-exclude='src/**/*.test.ts' --test-coverage-exclude='src/**/*.test.tsx' --test-coverage-lines=76 --test 'src/**/*.test.ts' 'dev-server/**/*.test.ts'",
-    "test": "npm run test:typecheck && npm run test:run",
-    "bundle": "esbuild 'src/index.ts' --sourcemap --bundle --platform=node --outfile=dist/index.js",
-    "dev": "node --env-file .env.test --watch --import tsx dev-server/server.ts",
-    "dev:remote": "node --env-file ../../.env.dev --watch --import tsx dev-server/server.ts",
-    "serve": "node --import tsx dev-server/server.ts"
-  },
-  "devDependencies": {
-    "@remit/apisix": "*",
-    "@types/better-sqlite3": "^7.6.13",
-    "@types/express": "^5.0.3",
-    "@types/swagger-ui-express": "^4.1.8",
-    "better-sqlite3": "^12.11.1",
-    "esbuild": "^0.28.1",
-    "express": "^5.1.0",
-    "swagger-ui-express": "^5.0.1",
-    "tsx": "*"
-  },
-  "dependencies": {
-    "@remit/config-format": "*",
-    "@remit/config-transfer": "*",
-    "@remit/calendar-service": "*",
-    "@remit/data-ports": "*",
-    "@remit/domain-enums": "*",
-    "@remit/api-openapi-types": "*",
-    "@remit/logger-lambda": "*",
-    "@remit/mail-oauth-service": "*",
-    "@remit/secrets-service": "*",
-    "@remit/mailbox-service": "*",
-    "@remit/search-service": "*",
-    "@remit/storage-service": "*",
-    "@remit/auth-service": "*",
-    "@remit/drizzle-service": "*",
-    "@remit/sqs-client": "*",
-    "@aws-sdk/client-secrets-manager": "*",
-    "@aws-sdk/client-sqs": "*",
-    "better-sqlite3": "^12.11.1",
-    "expect-env": "*",
-    "openapi-backend": "*",
-    "p-map": "*",
-    "@types/aws-lambda": "*",
-    "@types/better-sqlite3": "^7.6.13"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/remit-mail/reader.git",
-    "directory": "packages/backend"
-  }
+	"name": "@remit/backend",
+	"version": "0.0.145",
+	"description": "Remit Mail Inspector API backend",
+	"license": "MIT",
+	"author": "",
+	"type": "module",
+	"main": "dist/src/index.js",
+	"exports": {
+		".": {
+			"types": "./dist/src/index.d.ts",
+			"default": "./dist/src/index.js"
+		},
+		"./api": {
+			"types": "./dist/src/api.d.ts",
+			"default": "./dist/src/api.js"
+		},
+		"./serve": {
+			"types": "./dist/src/serve.d.ts",
+			"default": "./dist/src/serve.js"
+		},
+		"./client": {
+			"types": "./dist/src/service/data-client.d.ts",
+			"default": "./dist/src/service/data-client.js"
+		},
+		"./create-remit-client": {
+			"types": "./dist/src/service/create-remit-client.d.ts",
+			"default": "./dist/src/service/create-remit-client.js"
+		},
+		"./shared-deps": {
+			"types": "./dist/src/service/shared-deps.d.ts",
+			"default": "./dist/src/service/shared-deps.js"
+		},
+		"./compose-sqlite": {
+			"types": "./dist/src/service/compose-sqlite.d.ts",
+			"default": "./dist/src/service/compose-sqlite.js"
+		},
+		"./folder-role-appointments": {
+			"types": "./dist/src/handlers/folder-role-appointments.d.ts",
+			"default": "./dist/src/handlers/folder-role-appointments.js"
+		},
+		"./folder-role-labels": {
+			"types": "./dist/src/handlers/folder-role-labels.d.ts",
+			"default": "./dist/src/handlers/folder-role-labels.js"
+		},
+		"./organize": {
+			"types": "./dist/src/service/organize.d.ts",
+			"default": "./dist/src/service/organize.js"
+		},
+		"./sender-category": {
+			"types": "./dist/src/service/sender-category.d.ts",
+			"default": "./dist/src/service/sender-category.js"
+		},
+		"./account-deletion": {
+			"types": "./dist/src/service/account-deletion.d.ts",
+			"default": "./dist/src/service/account-deletion.js"
+		},
+		"./trigger-sync": {
+			"types": "./dist/src/service/trigger-sync.d.ts",
+			"default": "./dist/src/service/trigger-sync.js"
+		},
+		"./content-handler": {
+			"types": "./dist/dev-server/content-handler.d.ts",
+			"default": "./dist/dev-server/content-handler.js"
+		}
+	},
+	"scripts": {
+		"prepack": "node ../../npm-scripts/pack-dist.mjs prepack",
+		"postpack": "node ../../npm-scripts/pack-dist.mjs postpack",
+		"test:typecheck": "tsgo --noEmit",
+		"test:run": "node $NODE_TEST_FLAGS --env-file .env.test --import tsx --experimental-test-coverage --test-coverage-include='src/**' --test-coverage-exclude='src/**/*.test.ts' --test-coverage-exclude='src/**/*.test.tsx' --test-coverage-lines=76 --test 'src/**/*.test.ts' 'dev-server/**/*.test.ts'",
+		"test": "npm run test:typecheck && npm run test:run",
+		"bundle": "esbuild 'src/index.ts' --sourcemap --bundle --platform=node --outfile=dist/index.js",
+		"dev": "node --env-file .env.test --watch --import tsx dev-server/server.ts",
+		"dev:remote": "node --env-file ../../.env.dev --watch --import tsx dev-server/server.ts",
+		"serve": "node --import tsx dev-server/server.ts"
+	},
+	"devDependencies": {
+		"@remit/apisix": "*",
+		"@types/better-sqlite3": "^7.6.13",
+		"@types/express": "^5.0.3",
+		"@types/swagger-ui-express": "^4.1.8",
+		"better-sqlite3": "^12.11.1",
+		"esbuild": "^0.28.1",
+		"express": "^5.1.0",
+		"swagger-ui-express": "^5.0.1",
+		"tsx": "*"
+	},
+	"dependencies": {
+		"@remit/config-format": "*",
+		"@remit/config-transfer": "*",
+		"@remit/calendar-service": "*",
+		"@remit/data-ports": "*",
+		"@remit/domain-enums": "*",
+		"@remit/api-openapi-types": "*",
+		"@remit/logger-lambda": "*",
+		"@remit/mail-oauth-service": "*",
+		"@remit/secrets-service": "*",
+		"@remit/mailbox-service": "*",
+		"@remit/storage-service": "*",
+		"@remit/auth-service": "*",
+		"@remit/drizzle-service": "*",
+		"@remit/sqs-client": "*",
+		"@aws-sdk/client-secrets-manager": "^3.1090.0",
+		"better-sqlite3": "^12.11.1",
+		"expect-env": "^1.0.1",
+		"openapi-backend": "^5.18.0",
+		"p-map": "^2.1.0",
+		"@types/aws-lambda": "^8.10.162",
+		"@types/better-sqlite3": "^7.6.13",
+		"@remit/logger": "*",
+		"@remit/api-openapi-spec": "*",
+		"zod": "^3.25.0"
+	},
+	"publishConfig": {
+		"access": "public"
+	},
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/remit-mail/reader.git",
+		"directory": "packages/backend"
+	},
+	"types": "dist/src/index.d.ts",
+	"files": [
+		"dist"
+	]
 }

package/.env.test

@@ -1,4 +0,0 @@
-SERVER_PORT=5433
-SQS_QUEUE_URL=http://localhost:9324/queue/remit-local
-NODE_ENV=development
-LOG_LEVEL=debug

package/dev-server/content-auth.test.ts

@@ -1,113 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import { createContentSigner } from "../src/derive/contentSignature.js";
-import { authorizeContentRequest } from "./content-auth.js";
-
-const SECRET = "test-master-secret-at-least-32-chars-long";
-const PATH = "accounts/cfg-alice/acc-alice/messages/msg-1/parts/1.2";
-const now = () => Math.floor(Date.now() / 1000);
-
-describe("authorizeContentRequest", () => {
-	it("is a no-op on the AWS path (unsigned URLs)", () => {
-		const result = authorizeContentRequest({
-			dataBackend: undefined,
-			secret: undefined,
-			relativePath: PATH,
-			exp: undefined,
-			sig: undefined,
-			nowSeconds: now(),
-		});
-		assert.deepEqual(result, { authorized: true });
-	});
-
-	it("authorizes a validly signed request on the self-host stack", () => {
-		const { exp, sig } = createContentSigner(SECRET)(PATH);
-		const result = authorizeContentRequest({
-			dataBackend: "sqlite",
-			secret: SECRET,
-			relativePath: PATH,
-			exp: String(exp),
-			sig,
-			nowSeconds: now(),
-		});
-		assert.deepEqual(result, { authorized: true });
-	});
-
-	it("returns 401 when the signature is absent", () => {
-		const result = authorizeContentRequest({
-			dataBackend: "sqlite",
-			secret: SECRET,
-			relativePath: PATH,
-			exp: undefined,
-			sig: undefined,
-			nowSeconds: now(),
-		});
-		assert.equal(result.authorized, false);
-		assert.equal(result.authorized === false && result.status, 401);
-	});
-
-	it("returns 403 for a signature minted for another account's path", () => {
-		const { exp, sig } = createContentSigner(SECRET)(PATH);
-		const result = authorizeContentRequest({
-			dataBackend: "sqlite",
-			secret: SECRET,
-			relativePath: "accounts/cfg-bob/acc-bob/messages/msg-9/parts/1.2",
-			exp: String(exp),
-			sig,
-			nowSeconds: now(),
-		});
-		assert.equal(result.authorized, false);
-		assert.equal(result.authorized === false && result.status, 403);
-	});
-
-	it("returns 403 for an expired signature", () => {
-		const { exp, sig } = createContentSigner(SECRET, -20)(PATH);
-		const result = authorizeContentRequest({
-			dataBackend: "sqlite",
-			secret: SECRET,
-			relativePath: PATH,
-			exp: String(exp),
-			sig,
-			nowSeconds: now(),
-		});
-		assert.equal(result.authorized, false);
-		assert.equal(result.authorized === false && result.status, 403);
-	});
-
-	it("fails closed with 500 when no signing secret is configured", () => {
-		const result = authorizeContentRequest({
-			dataBackend: "sqlite",
-			secret: undefined,
-			relativePath: PATH,
-			exp: "123",
-			sig: "whatever",
-			nowSeconds: now(),
-		});
-		assert.equal(result.authorized, false);
-		assert.equal(result.authorized === false && result.status, 500);
-	});
-
-	it("enforces signatures on every self-host request", () => {
-		const { exp, sig } = createContentSigner(SECRET)(PATH);
-		const valid = authorizeContentRequest({
-			dataBackend: "sqlite",
-			secret: SECRET,
-			relativePath: PATH,
-			exp: String(exp),
-			sig,
-			nowSeconds: now(),
-		});
-		assert.deepEqual(valid, { authorized: true });
-
-		const unsigned = authorizeContentRequest({
-			dataBackend: "sqlite",
-			secret: SECRET,
-			relativePath: PATH,
-			exp: undefined,
-			sig: undefined,
-			nowSeconds: now(),
-		});
-		assert.equal(unsigned.authorized, false);
-		assert.equal(unsigned.authorized === false && unsigned.status, 401);
-	});
-});

package/dev-server/content-auth.ts

@@ -1,54 +0,0 @@
-import { verifyContentSignature } from "../src/derive/contentSignature.js";
-
-/**
- * Decide whether a `/content` request is authorized. Enforcement applies on the
- * self-host SQL backend (sqlite), where this server is the
- * deployed backend container and content URLs are signed. On AWS-local dev
- * (`DATA_BACKEND` unset) `/content` is served straight from the filesystem
- * stand-in for CloudFront and URLs are unsigned, so the check is a no-op.
- *
- * Pure so the decision can be unit-tested without a live server. `relativePath`
- * is the decoded storage path (`accounts/{cfg}/{acc}/messages/{msg}/parts/{part}`)
- * the signature was minted over — the caller strips the `/content/` prefix.
- */
-export interface AuthorizeContentInput {
-	dataBackend: string | undefined;
-	secret: string | undefined;
-	relativePath: string;
-	exp: string | undefined;
-	sig: string | undefined;
-	nowSeconds: number;
-}
-
-export const authorizeContentRequest = (
-	input: AuthorizeContentInput,
-):
-	| { authorized: true }
-	| { authorized: false; status: number; reason: string } => {
-	if (input.dataBackend !== "sqlite") {
-		return { authorized: true };
-	}
-
-	if (!input.secret || input.secret.length === 0) {
-		// A self-host SQL backend with no signing secret means every content URL
-		// is unsigned and unverifiable. Fail closed rather than serve mail bytes
-		// without auth.
-		return {
-			authorized: false,
-			status: 500,
-			reason: "content-signing-not-configured",
-		};
-	}
-
-	const result = verifyContentSignature(
-		input.relativePath,
-		input.exp,
-		input.sig,
-		input.secret,
-		input.nowSeconds,
-	);
-	if (result.valid) return { authorized: true };
-
-	const status = result.reason === "missing" ? 401 : 403;
-	return { authorized: false, status, reason: result.reason };
-};