@remit/backend 0.0.143 → 0.0.145

package/dev-server/content-handler.test.ts

@@ -1,105 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import { gzipSync } from "node:zlib";
-import {
-	parseContentStorageKey,
-	type ServeContentDeps,
-	serveContent,
-} from "./content-handler.js";
-
-const PART_KEY = "accounts/cfg-1/acc-1/messages/msg-1/parts/1.2";
-
-const baseDeps = (
-	over: Partial<ServeContentDeps> = {},
-): { deps: ServeContentDeps; cues: Array<Record<string, unknown>> } => {
-	const cues: Array<Record<string, unknown>> = [];
-	const deps: ServeContentDeps = {
-		readObject: async () => null,
-		lookupMessage: async () => ({ mailboxId: "mbx-1", uid: 42 }),
-		requestBodySync: async (input) => {
-			cues.push(input);
-		},
-		...over,
-	};
-	return { deps, cues };
-};
-
-describe("parseContentStorageKey", () => {
-	it("extracts account + message ids from a part key", () => {
-		assert.deepEqual(parseContentStorageKey(PART_KEY), {
-			accountConfigId: "cfg-1",
-			accountId: "acc-1",
-			messageId: "msg-1",
-		});
-	});
-
-	it("returns null for a non-matching key", () => {
-		assert.equal(parseContentStorageKey("nope/whatever"), null);
-	});
-});
-
-describe("serveContent", () => {
-	it("returns 200 with decompressed bytes when the object is present", async () => {
-		const { deps, cues } = baseDeps({
-			readObject: async () => gzipSync(Buffer.from("hello body")),
-		});
-
-		const result = await serveContent(deps, {
-			fullPath: "/x/parts/1.2",
-			storageKey: PART_KEY,
-		});
-
-		assert.equal(result.status, 200);
-		assert.equal(result.headers["content-type"], "application/octet-stream");
-		assert.equal(result.body.toString(), "hello body");
-		assert.equal(cues.length, 0);
-	});
-
-	it("returns 202 + Retry-After and re-arms the cue when the object is missing", async () => {
-		const { deps, cues } = baseDeps({ readObject: async () => null });
-
-		const result = await serveContent(deps, {
-			fullPath: "/x/parts/1.2",
-			storageKey: PART_KEY,
-		});
-
-		assert.equal(result.status, 202);
-		assert.equal(result.headers["Retry-After"], "1");
-		assert.equal(cues.length, 1, "cue re-armed exactly once");
-		assert.deepEqual(cues[0], {
-			accountId: "acc-1",
-			mailboxId: "mbx-1",
-			messageId: "msg-1",
-			uid: 42,
-		});
-	});
-
-	it("still answers 202 (no cue) when the message row is gone", async () => {
-		const { deps, cues } = baseDeps({
-			readObject: async () => null,
-			lookupMessage: async () => null,
-		});
-
-		const result = await serveContent(deps, {
-			fullPath: "/x/parts/1.2",
-			storageKey: PART_KEY,
-		});
-
-		assert.equal(result.status, 202);
-		assert.equal(cues.length, 0);
-	});
-
-	it("propagates a non-missing read error so the route 500s", async () => {
-		const { deps } = baseDeps({
-			readObject: async () => {
-				throw new Error("EACCES");
-			},
-		});
-
-		await assert.rejects(
-			() =>
-				serveContent(deps, { fullPath: "/x/parts/1.2", storageKey: PART_KEY }),
-			/EACCES/,
-		);
-	});
-});

package/dev-server/content-handler.ts

@@ -1,79 +0,0 @@
-import { gunzipSync } from "node:zlib";
-import { parseContentStorageKey } from "@remit/storage-service";
-
-// Re-exported for existing same-package consumers (server.ts,
-// content-handler.test.ts). The key-shape parser itself lives in
-// `@remit/storage-service` next to the `build*Key` functions it
-// inverts, so non-backend consumers (e.g. the content-selfheal worker) can
-// depend on it without pulling in the rest of `@remit/backend`.
-export { parseContentStorageKey };
-
-export interface ContentResult {
-	status: number;
-	headers: Record<string, string>;
-	body: string | Buffer;
-}
-
-export interface ServeContentDeps {
-	/**
-	 * Reads the stored bytes, or returns null when the object is genuinely
-	 * missing (ENOENT / NoSuchKey). Any other read error must throw so the route
-	 * 500s — a permission/infra failure is never masked as a missing body.
-	 */
-	readObject(fullPath: string): Promise<Buffer | null>;
-	/** Resolves the message's mailbox + uid so the cue can issue one FETCH. */
-	lookupMessage(
-		messageId: string,
-	): Promise<{ mailboxId: string; uid: number } | null>;
-	requestBodySync(input: {
-		accountId: string;
-		mailboxId: string;
-		messageId: string;
-		uid?: number;
-	}): Promise<void>;
-}
-
-/**
- * Local stand-in for the CloudFront `/content/*` behavior. Body-fetch outcomes:
- *
- * - Object present → 200 with the (decompressed) bytes.
- * - Object missing → 202 + `Retry-After: 1`, and re-arm the SYNC_MESSAGE_BODY
- *   cue for that message so a retry succeeds once the worker stores the body.
- * - Any other read failure throws, so the route 500s loudly.
- */
-export const serveContent = async (
-	deps: ServeContentDeps,
-	args: { fullPath: string; storageKey: string },
-): Promise<ContentResult> => {
-	const raw = await deps.readObject(args.fullPath);
-
-	if (raw) {
-		// The filesystem/S3 backends gzip every part; decompress here since there
-		// is no CloudFront to auto-decode locally.
-		const buffer = raw[0] === 0x1f && raw[1] === 0x8b ? gunzipSync(raw) : raw;
-		return {
-			status: 200,
-			headers: { "content-type": "application/octet-stream" },
-			body: buffer,
-		};
-	}
-
-	const ids = parseContentStorageKey(args.storageKey);
-	if (ids) {
-		const message = await deps.lookupMessage(ids.messageId);
-		if (message) {
-			await deps.requestBodySync({
-				accountId: ids.accountId,
-				mailboxId: message.mailboxId,
-				messageId: ids.messageId,
-				uid: message.uid,
-			});
-		}
-	}
-
-	return {
-		status: 202,
-		headers: { "Retry-After": "1" },
-		body: "body not yet synced",
-	};
-};

package/dev-server/content-path.test.ts

@@ -1,37 +0,0 @@
-import assert from "node:assert/strict";
-import { sep } from "node:path";
-import { describe, it } from "node:test";
-import { resolveContentPath } from "./content-path.js";
-
-describe("resolveContentPath — dev-server /content/* path safety (#310 review P1)", () => {
-	const ROOT = "/x/storage";
-
-	it("returns the absolute path for a normal nested storage key", () => {
-		assert.equal(
-			resolveContentPath(ROOT, "accounts/cfg/acc/messages/m/parts/1"),
-			"/x/storage/accounts/cfg/acc/messages/m/parts/1",
-		);
-	});
-
-	it("rejects a sibling-prefix escape (`startsWith` was the original bug)", () => {
-		// `/x/storage-evil/y` shares the prefix `/x/storage` with the root,
-		// so the naive `fullPath.startsWith(ROOT)` check would pass it.
-		assert.equal(resolveContentPath(ROOT, `..${sep}storage-evil${sep}y`), null);
-	});
-
-	it("rejects parent-directory traversal via `..`", () => {
-		assert.equal(resolveContentPath(ROOT, `..${sep}etc${sep}passwd`), null);
-		assert.equal(
-			resolveContentPath(ROOT, `accounts${sep}..${sep}..${sep}etc`),
-			null,
-		);
-	});
-
-	it("rejects an absolute key that resolves outside the root", () => {
-		assert.equal(resolveContentPath(ROOT, "/etc/passwd"), null);
-	});
-
-	it("rejects an empty key (would expose the root listing)", () => {
-		assert.equal(resolveContentPath(ROOT, ""), null);
-	});
-});

package/dev-server/content-path.ts

@@ -1,27 +0,0 @@
-import { relative, resolve, sep } from "node:path";
-
-/**
- * Resolve a `/content/*` URL path to an absolute filesystem path under the
- * storage root, or return null if the resolved path would escape the root.
- *
- * The naive `fullPath.startsWith(STORAGE_BASE)` check fails on a sibling
- * directory whose name is a prefix of the base — e.g. `/x/storage` and
- * `/x/storage-evil` — so we use `path.relative` and reject any result that
- * starts with `..` or is itself absolute (#310 review P1). Empty keys are
- * also rejected so the root directory is never served.
- */
-export const resolveContentPath = (
-	storageBase: string,
-	storageKey: string,
-): string | null => {
-	const fullPath = resolve(storageBase, storageKey);
-	const rel = relative(storageBase, fullPath);
-	if (rel === "" || rel.startsWith("..") || rel.includes(`..${sep}`)) {
-		return null;
-	}
-	if (resolve(rel) === rel) {
-		// `rel` is absolute → escaped the root via an absolute storageKey.
-		return null;
-	}
-	return fullPath;
-};

package/dev-server/cors.test.ts

@@ -1,48 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import { parseAllowedOrigins, resolveAllowOrigin } from "./cors.js";
-
-describe("parseAllowedOrigins", () => {
-	it("splits, trims, and drops empties", () => {
-		assert.deepEqual(
-			parseAllowedOrigins("https://a.example, https://b.example ,"),
-			["https://a.example", "https://b.example"],
-		);
-	});
-
-	it("returns an empty list for undefined or blank", () => {
-		assert.deepEqual(parseAllowedOrigins(undefined), []);
-		assert.deepEqual(parseAllowedOrigins("  "), []);
-	});
-});
-
-describe("resolveAllowOrigin", () => {
-	it("returns '*' when the allowlist contains a wildcard", () => {
-		assert.equal(resolveAllowOrigin("https://any.example", ["*"]), "*");
-		assert.equal(resolveAllowOrigin(undefined, ["*"]), "*");
-	});
-
-	it("reflects an allowlisted origin", () => {
-		assert.equal(
-			resolveAllowOrigin("https://app.example", [
-				"https://app.example",
-				"https://other.example",
-			]),
-			"https://app.example",
-		);
-	});
-
-	it("returns undefined for an origin outside the allowlist", () => {
-		assert.equal(
-			resolveAllowOrigin("https://evil.example", ["https://app.example"]),
-			undefined,
-		);
-	});
-
-	it("returns undefined when no origin is presented and no wildcard", () => {
-		assert.equal(
-			resolveAllowOrigin(undefined, ["https://app.example"]),
-			undefined,
-		);
-	});
-});

package/dev-server/cors.ts

@@ -1,25 +0,0 @@
-export const parseAllowedOrigins = (raw: string | undefined): string[] =>
-	(raw ?? "")
-		.split(",")
-		.map((origin) => origin.trim())
-		.filter((origin) => origin.length > 0);
-
-/**
- * Resolve the `Access-Control-Allow-Origin` value for a request against the
- * configured allowlist.
- *
- * - a `*` entry allows any origin (browsers reject `*` with credentials, so this
- *   stays safe for a bearer-token API);
- * - otherwise the request `Origin` is reflected only when it is in the allowlist;
- * - an origin outside the allowlist yields `undefined` — no CORS header is sent.
- */
-export const resolveAllowOrigin = (
-	requestOrigin: string | undefined,
-	allowedOrigins: string[],
-): string | undefined => {
-	if (allowedOrigins.includes("*")) return "*";
-	if (requestOrigin && allowedOrigins.includes(requestOrigin)) {
-		return requestOrigin;
-	}
-	return undefined;
-};

package/dev-server/keep-alive.test.ts

@@ -1,24 +0,0 @@
-import assert from "node:assert/strict";
-import type { Server } from "node:http";
-import { after, before, it } from "node:test";
-import { UPSTREAM_KEEPALIVE_IDLE_TIMEOUT_SECONDS } from "@remit/apisix/route-table";
-
-let server: Server;
-
-before(async () => {
-	process.env.BETTER_AUTH_SECRET = "a-signing-secret-of-at-least-32-characters";
-	process.env.CORS_ALLOWED_ORIGINS = "https://mail.example.com";
-	process.env.SERVER_PORT = "0";
-	server = (await import("./server.js")).listener;
-});
-
-after(async () => {
-	await new Promise<void>((resolve) => server.close(() => resolve()));
-});
-
-it("keeps an idle socket open longer than the APISIX upstream pool does", () => {
-	assert.ok(
-		server.keepAliveTimeout > UPSTREAM_KEEPALIVE_IDLE_TIMEOUT_SECONDS * 1_000,
-		`backend keepAliveTimeout ${server.keepAliveTimeout}ms must exceed APISIX idle_timeout ${UPSTREAM_KEEPALIVE_IDLE_TIMEOUT_SECONDS}s`,
-	);
-});

package/dev-server/lambda-helpers.ts

@@ -1,69 +0,0 @@
-import type {
-	APIGatewayProxyEvent,
-	APIGatewayProxyEventPathParameters,
-	Context,
-} from "aws-lambda";
-import type { Request } from "express";
-
-export const createLambdaEvent = (req: Request): APIGatewayProxyEvent => ({
-	httpMethod: req.method,
-	path: req.path,
-	pathParameters: (req.params as APIGatewayProxyEventPathParameters) || null,
-	queryStringParameters: (req.query as { [name: string]: string }) || null,
-	headers: (req.headers as { [name: string]: string }) || {},
-	body: req.body ? JSON.stringify(req.body) : null,
-	isBase64Encoded: false,
-	requestContext: {
-		requestId: `local-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`,
-		stage: "local",
-		httpMethod: req.method,
-		path: req.path,
-		protocol: "HTTP/1.1",
-		requestTime: new Date().toISOString(),
-		requestTimeEpoch: Date.now(),
-		identity: {
-			sourceIp: req.ip || "127.0.0.1",
-			userAgent: req.get("User-Agent") || "local-test",
-			accessKey: null,
-			accountId: null,
-			apiKey: null,
-			apiKeyId: null,
-			caller: null,
-			cognitoAuthenticationProvider: null,
-			cognitoAuthenticationType: null,
-			cognitoIdentityId: null,
-			cognitoIdentityPoolId: null,
-			principalOrgId: null,
-			user: null,
-			userArn: null,
-			clientCert: null,
-		},
-		accountId: "123456789012",
-		apiId: "local",
-		domainName: "localhost",
-		domainPrefix: "local",
-		resourceId: "local",
-		resourcePath: req.path,
-		authorizer: undefined,
-	},
-	resource: req.path,
-	multiValueHeaders: {},
-	multiValueQueryStringParameters: null,
-	stageVariables: null,
-});
-
-export const createLambdaContext = (): Context => ({
-	callbackWaitsForEmptyEventLoop: false,
-	functionName: "remit-backend-local",
-	functionVersion: "$LATEST",
-	invokedFunctionArn:
-		"arn:aws:lambda:local:123456789012:function:remit-backend-local",
-	memoryLimitInMB: "128",
-	awsRequestId: `local-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`,
-	logGroupName: "/aws/lambda/remit-backend-local",
-	logStreamName: `${new Date().toISOString().split("T")[0]}/[$LATEST]${Math.random().toString(36).substr(2, 9)}`,
-	getRemainingTimeInMillis: () => 30000,
-	done: () => {},
-	fail: () => {},
-	succeed: () => {},
-});

package/dev-server/log-output.test.ts

@@ -1,173 +0,0 @@
-import assert from "node:assert/strict";
-import { spawn } from "node:child_process";
-import { createServer } from "node:net";
-import { dirname, resolve } from "node:path";
-import { after, before, describe, it } from "node:test";
-import { fileURLToPath } from "node:url";
-
-// This file is the backend image's entrypoint, so what it writes IS the
-// container's log stream. deploy/vps/README.md ("Logs") promises one JSON object
-// per line, and a log-shipping pipeline written against that contract breaks on
-// the first line it cannot parse — which is why this runs the real server rather
-// than asserting against a mocked writer.
-//
-// Both streams are held to it. The container log driver merges stdout and
-// stderr into one log and `remit logs` shows both, so a raw line on stderr
-// breaks a Vector parser exactly like a raw line on stdout.
-
-const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-
-const freePort = (): Promise<number> =>
-	new Promise((resolveWith, reject) => {
-		const probe = createServer();
-		probe.on("error", reject);
-		probe.listen(0, "127.0.0.1", () => {
-			const address = probe.address();
-			if (address === null || typeof address === "string") {
-				probe.close();
-				reject(new Error("could not reserve a port"));
-				return;
-			}
-			probe.close(() => resolveWith(address.port));
-		});
-	});
-
-type Line = Record<string, unknown>;
-type Stream = "stdout" | "stderr";
-
-const captured: Record<Stream, string> = { stdout: "", stderr: "" };
-const listeners = new Set<() => void>();
-let port = 0;
-
-// The child's output reaches this process asynchronously, so a request that has
-// already been answered is not yet a line here. Wait for the line rather than
-// for a duration, and only once the stream ends on a newline, so no assertion
-// ever runs against half of one.
-const waitForStdout = (contains: string): Promise<void> =>
-	new Promise((resolveWith, reject) => {
-		const settled = () =>
-			captured.stdout.includes(contains) && captured.stdout.endsWith("\n");
-		if (settled()) {
-			resolveWith();
-			return;
-		}
-		const timer = setTimeout(() => {
-			stopWaiting();
-			reject(new Error(`stdout never carried ${contains}: ${captured.stdout}`));
-		}, 10_000);
-		const onData = () => {
-			if (!settled()) return;
-			stopWaiting();
-			resolveWith();
-		};
-		const stopWaiting = () => {
-			clearTimeout(timer);
-			listeners.delete(onData);
-		};
-		listeners.add(onData);
-	});
-
-const parsedLines = (stream: Stream): Line[] =>
-	captured[stream]
-		.split("\n")
-		.filter((line) => line.trim().length > 0)
-		.map((line, index) => {
-			try {
-				return JSON.parse(line) as Line;
-			} catch {
-				throw new assert.AssertionError({
-					message: `${stream} line ${index + 1} is not JSON, so a log pipeline drops it: ${line}`,
-				});
-			}
-		});
-
-describe("the backend entrypoint's log output", () => {
-	let server: ReturnType<typeof spawn>;
-
-	before(async () => {
-		port = await freePort();
-
-		server = spawn(
-			process.execPath,
-			["--import", "tsx", "dev-server/server.ts"],
-			{
-				cwd: packageRoot,
-				stdio: ["ignore", "pipe", "pipe", "ipc"],
-				env: {
-					...process.env,
-					SERVER_PORT: String(port),
-					LOG_LEVEL: "debug",
-					REMIT_SERVICE_NAME: "backend",
-					// tsx's own loader warnings are an artifact of running the
-					// TypeScript source; the image runs a bundle and never emits them.
-					NODE_NO_WARNINGS: "1",
-					NODE_OPTIONS: "",
-				},
-			},
-		);
-
-		for (const stream of ["stdout", "stderr"] as const) {
-			server[stream]?.setEncoding("utf8");
-			server[stream]?.on("data", (chunk: string) => {
-				captured[stream] += chunk;
-				for (const listener of [...listeners]) listener();
-			});
-		}
-
-		await new Promise<void>((resolveWith, reject) => {
-			server.on("message", (message) => {
-				if (message === "ready") resolveWith();
-			});
-			// Carry the child's stderr into the failure: a server that cannot boot
-			// otherwise reports only an exit code, and the reason is in that buffer.
-			server.on("exit", (code) =>
-				reject(
-					new Error(
-						`server exited before listening (code ${code})\n${captured.stderr}`,
-					),
-				),
-			);
-		});
-
-		// A request the router answers without touching a data backend, so the
-		// invocation's own lines — the ones withTelemetry writes around the
-		// handler — are captured by the time this suite reads them.
-		await fetch(`http://127.0.0.1:${port}/no-such-route`);
-		await waitForStdout("Request received");
-	});
-
-	after(() => {
-		server.kill("SIGKILL");
-	});
-
-	it("is JSON on every line of both streams", () => {
-		const lines = [...parsedLines("stdout"), ...parsedLines("stderr")];
-		assert.ok(lines.length > 0, "expected the server to have written a line");
-		for (const line of lines) {
-			assert.equal(typeof line.level, "string");
-			assert.equal(typeof line.time, "string");
-			assert.equal(line.service, "backend");
-			assert.equal(typeof line.msg, "string");
-		}
-	});
-
-	it("reports what it is listening on as fields, not a banner", () => {
-		const listening = parsedLines("stdout").find(
-			(line) => line.msg === "Backend listening",
-		);
-		assert.ok(listening, "expected a startup line");
-		assert.equal(listening.port, port);
-		assert.equal(listening.url, `http://localhost:${port}`);
-		assert.equal(listening.level, "info");
-	});
-
-	it("correlates the whole invocation under one requestId", () => {
-		const lines = parsedLines("stdout").filter(
-			(line) => line.msg === "Lambda invocation started" || line.path,
-		);
-		assert.ok(lines.length >= 2, "expected the invocation to have logged");
-		const requestIds = new Set(lines.map((line) => line.requestId));
-		assert.equal(requestIds.size, 1);
-		assert.equal([...requestIds][0] === undefined, false);
-	});
-});

package/dev-server/oauth-callback-route.test.ts

@@ -1,66 +0,0 @@
-/**
- * The OAuth callback through the dev-server's own app — the process a
- * self-host container runs.
- *
- * One hop further than the handler test: the app object imported from
- * `server.ts`, so what is asserted is the header express actually writes onto
- * the socket for Microsoft's returning browser. The handler answering 302 is
- * not the same claim as the browser being sent anywhere, and the difference
- * between the two was a blank page.
- *
- * The identity tier is left unmounted — this app serves the route either way,
- * and the callback's exemption from the session gate is pinned where that gate
- * runs, in `src/handlers/account-oauth-callback.test.ts`.
- */
-
-import assert from "node:assert/strict";
-import type { Server } from "node:http";
-import { after, before, describe, it } from "node:test";
-import {
-	_resetForTest,
-	type RemitClient,
-	setClient,
-} from "../src/service/data-client.js";
-
-const WEB_ORIGIN = "https://mail.example.com";
-
-let server: Server;
-let port: number;
-
-before(async () => {
-	// Microsoft's redirect carries no session, so the callback answers before it
-	// reads anything: no store is touched on this path.
-	setClient({} as unknown as RemitClient);
-
-	process.env.BETTER_AUTH_SECRET = "a-signing-secret-of-at-least-32-characters";
-	process.env.CORS_ALLOWED_ORIGINS = WEB_ORIGIN;
-	process.env.SERVER_PORT = "0";
-
-	const imported = await import("./server.js");
-	server = imported.listener;
-	if (!server.listening) {
-		await new Promise<void>((resolve) => server.once("listening", resolve));
-	}
-	const address = server.address();
-	port = typeof address === "object" && address ? address.port : 0;
-});
-
-after(async () => {
-	await new Promise<void>((resolve) => server.close(() => resolve()));
-	_resetForTest();
-});
-
-describe("GET /accounts/oauth/microsoft/callback through the dev-server's own app", () => {
-	it("answers the browser with somewhere to go", async () => {
-		const response = await fetch(
-			`http://127.0.0.1:${port}/accounts/oauth/microsoft/callback?error=access_denied`,
-			{ redirect: "manual" },
-		);
-
-		assert.equal(response.status, 302);
-		assert.equal(
-			response.headers.get("location"),
-			`${WEB_ORIGIN}/settings/accounts?oauthError=access_denied`,
-		);
-	});
-});