@remit/backend 0.0.143 → 0.0.145

package/src/auth.ts

@@ -1,92 +0,0 @@
-import { base36uuidv5, REMIT_NAMESPACE } from "@remit/data-ports/id";
-import type { APIGatewayProxyEvent } from "aws-lambda";
-
-const LOCAL_BYPASS_VARS = [
-	"LOCAL_ACCOUNT_CONFIG_ID",
-	"LOCAL_COGNITO_SUB",
-] as const;
-
-const isLocalEnv = (env: NodeJS.ProcessEnv): boolean =>
-	env.NODE_ENV === "development" || env.NODE_ENV === "test";
-
-/**
- * The LOCAL_ACCOUNT_CONFIG_ID / LOCAL_COGNITO_SUB overrides bypass authentication
- * for local dev and fixtures: with them set, an unauthenticated request is served
- * as the pinned account. They must never reach a deployed environment. Refuse to
- * start (throw at module load) if either is present outside a local NODE_ENV — the
- * same `development`/`test` signal the data layer already uses to decide local vs
- * deployed. Fail loud rather than silently ignore, so a leaked env var is caught at
- * boot, not exploited at runtime.
- */
-export const assertLocalBypassNotInDeployedEnv = (
-	env: NodeJS.ProcessEnv = process.env,
-): void => {
-	if (isLocalEnv(env)) return;
-	const leaked = LOCAL_BYPASS_VARS.filter((name) => {
-		const value = env[name];
-		return typeof value === "string" && value.length > 0;
-	});
-	if (leaked.length === 0) return;
-	throw new Error(
-		`Refusing to start: local auth bypass ${leaked.join(", ")} is set while NODE_ENV=${env.NODE_ENV ?? "(unset)"}. These overrides bypass authentication and must never be present in a deployed environment.`,
-	);
-};
-
-/**
- * Derive a deterministic accountConfigId from a Cognito subject (`sub`) claim.
- * One Cognito user maps to exactly one account config.
- */
-export const deriveAccountConfigId = (sub: string): string =>
-	base36uuidv5(`account:${sub}`, REMIT_NAMESPACE);
-
-const getSubFromClaims = (event: APIGatewayProxyEvent): string | undefined => {
-	const claims = event.requestContext?.authorizer?.claims;
-	if (!claims) return undefined;
-	const sub = claims.sub;
-	if (typeof sub === "string" && sub.length > 0) return sub;
-	return undefined;
-};
-
-/**
- * Return the Cognito `sub` for the current request, preferring the JWT claim
- * and falling back to `LOCAL_COGNITO_SUB` for local development. Returns
- * `undefined` when neither is available (e.g. seeded fixtures that only set
- * `LOCAL_ACCOUNT_CONFIG_ID`).
- */
-export const getSubFromEvent = (
-	event: APIGatewayProxyEvent,
-): string | undefined => {
-	const sub = getSubFromClaims(event);
-	if (sub) return sub;
-	const localSub = process.env.LOCAL_COGNITO_SUB;
-	if (localSub && localSub.length > 0) return localSub;
-	return undefined;
-};
-
-/**
- * Extract the caller's accountConfigId from an API Gateway event.
- *
- * Production: reads the Cognito `sub` claim (verified by the API Gateway
- * Cognito authorizer) and derives the accountConfigId via UUIDv5.
- *
- * Local development: honours two environment overrides so the dev server and
- * playwright fixtures can run without a real Cognito token:
- *   - `LOCAL_ACCOUNT_CONFIG_ID` — pin a specific seeded accountConfigId
- *   - `LOCAL_COGNITO_SUB` — pin a Cognito `sub` value; derived like production
- */
-export const getAccountConfigIdFromEvent = (
-	event: APIGatewayProxyEvent,
-): string => {
-	const sub = getSubFromClaims(event);
-	if (sub) return deriveAccountConfigId(sub);
-
-	const localAccountConfigId = process.env.LOCAL_ACCOUNT_CONFIG_ID;
-	if (localAccountConfigId) return localAccountConfigId;
-
-	const localSub = process.env.LOCAL_COGNITO_SUB;
-	if (localSub) return deriveAccountConfigId(localSub);
-
-	throw new Error(
-		"Missing accountConfigId: no Cognito `sub` claim on the request, and neither LOCAL_ACCOUNT_CONFIG_ID nor LOCAL_COGNITO_SUB env var is set",
-	);
-};

package/src/config/msoauth.test.ts

@@ -1,48 +0,0 @@
-import assert from "node:assert/strict";
-import { afterEach, describe, it } from "node:test";
-import { getMsOAuthConfig } from "./msoauth.js";
-
-const MSOAUTH_KEYS = [
-	"MSOAUTH_AUTHORITY",
-	"MSOAUTH_REDIRECT_URI",
-	"MSOAUTH_SECRET_ARN",
-	"MSOAUTH_CLIENT_ID",
-	"MSOAUTH_CLIENT_SECRET",
-	"MSOAUTH_TOKEN_ENDPOINT",
-] as const;
-
-describe("getMsOAuthConfig", () => {
-	const original = new Map(
-		MSOAUTH_KEYS.map((key) => [key, process.env[key]] as const),
-	);
-
-	afterEach(() => {
-		for (const [key, value] of original) {
-			if (value === undefined) delete process.env[key];
-			else process.env[key] = value;
-		}
-	});
-
-	it("resolves on a self-host deployment, where no authority is wired", () => {
-		for (const key of MSOAUTH_KEYS) delete process.env[key];
-		process.env.MSOAUTH_REDIRECT_URI =
-			"https://mail.example.com/api/accounts/oauth/microsoft/callback";
-		process.env.MSOAUTH_CLIENT_ID = "client-id";
-		process.env.MSOAUTH_CLIENT_SECRET = "client-secret";
-
-		assert.deepEqual(getMsOAuthConfig(), {
-			secretArn: undefined,
-			redirectUri:
-				"https://mail.example.com/api/accounts/oauth/microsoft/callback",
-			clientId: "client-id",
-			clientSecret: "client-secret",
-			tokenEndpoint: undefined,
-		});
-	});
-
-	it("names PUBLIC_ORIGIN when the redirect URI is missing", () => {
-		for (const key of MSOAUTH_KEYS) delete process.env[key];
-
-		assert.throws(getMsOAuthConfig, /MSOAUTH_REDIRECT_URI.*PUBLIC_ORIGIN/s);
-	});
-});

package/src/config/msoauth.ts

@@ -1,48 +0,0 @@
-/**
- * Typed reads for Microsoft OAuth (Entra) environment variables.
- *
- * `MSOAUTH_REDIRECT_URI` is derived from `PUBLIC_ORIGIN` by the compose file
- * (deploy/vps/docker-compose.sqlite.yml) and must match the redirect URI
- * registered on the Entra app registration.
- *
- * Credentials come either from `MSOAUTH_CLIENT_ID` / `MSOAUTH_CLIENT_SECRET`
- * in the deploy env file, or from Secrets Manager via `MSOAUTH_SECRET_ARN`.
- *
- * The Microsoft authorization and token endpoints are fixed in
- * `@remit/mail-oauth-service`; no authority URL is read from the environment.
- */
-
-export interface MsOAuthConfig {
-	/** Secrets Manager ARN — an alternative to the client id/secret pair. */
-	readonly secretArn: string | undefined;
-	/** OAuth redirect URI registered in the Entra app. */
-	readonly redirectUri: string;
-	/** Client ID — set directly to bypass Secrets Manager. */
-	readonly clientId: string | undefined;
-	/** Client secret — set directly to bypass Secrets Manager. */
-	readonly clientSecret: string | undefined;
-	/** Token endpoint override — used for local stubbing (bypasses default OIDC discovery). */
-	readonly tokenEndpoint: string | undefined;
-}
-
-/**
- * Read Microsoft OAuth configuration from the environment.
- * Throws when `MSOAUTH_REDIRECT_URI` is absent.
- */
-export const getMsOAuthConfig = (): MsOAuthConfig => {
-	const redirectUri = process.env.MSOAUTH_REDIRECT_URI;
-
-	if (!redirectUri) {
-		throw new Error(
-			"MSOAUTH_REDIRECT_URI is not set. It is derived from PUBLIC_ORIGIN — set PUBLIC_ORIGIN in the deploy env file (deploy/vps/.env) and restart, or set MSOAUTH_REDIRECT_URI directly.",
-		);
-	}
-
-	return {
-		secretArn: process.env.MSOAUTH_SECRET_ARN,
-		redirectUri,
-		clientId: process.env.MSOAUTH_CLIENT_ID,
-		clientSecret: process.env.MSOAUTH_CLIENT_SECRET,
-		tokenEndpoint: process.env.MSOAUTH_TOKEN_ENDPOINT,
-	};
-};

package/src/data-backend.test.ts

@@ -1,23 +0,0 @@
-import assert from "node:assert/strict";
-import { afterEach, describe, it } from "node:test";
-import { usesBetterAuthJwt } from "./data-backend.js";
-
-describe("usesBetterAuthJwt", () => {
-	const ORIGINAL = process.env.DATA_BACKEND;
-	afterEach(() => {
-		if (ORIGINAL === undefined) delete process.env.DATA_BACKEND;
-		else process.env.DATA_BACKEND = ORIGINAL;
-	});
-
-	it("is true for the self-host SQL backend", () => {
-		process.env.DATA_BACKEND = "sqlite";
-		assert.equal(usesBetterAuthJwt(), true);
-	});
-
-	it("is false for the AWS DynamoDB path and when unset", () => {
-		process.env.DATA_BACKEND = "dynamodb";
-		assert.equal(usesBetterAuthJwt(), false);
-		delete process.env.DATA_BACKEND;
-		assert.equal(usesBetterAuthJwt(), false);
-	});
-});

package/src/data-backend.ts

@@ -1,14 +0,0 @@
-/**
- * The self-host SQL backend (RFC 034/035/036), as opposed to the AWS DynamoDB
- * path.
- */
-export const isSelfHostSqlBackend = (): boolean =>
-	process.env.DATA_BACKEND === "sqlite";
-
-/**
- * The self-host SQL backend authenticates requests and signs content URLs with
- * a better-auth RS256 JWT verified at the edge and re-verified in-process, no
- * Cognito authorizer. DynamoDB is the AWS path (Cognito claims, Lambda@Edge
- * content guard) and is deliberately excluded.
- */
-export const usesBetterAuthJwt = (): boolean => isSelfHostSqlBackend();

package/src/derive/autoMoved.test.ts

@@ -1,104 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import type { MessageItem } from "@remit/data-ports";
-import { PlacementAction, PlacementConfidence } from "@remit/domain-enums";
-import { deriveAutoMoved } from "./autoMoved.js";
-
-type AutoMovedInput = Pick<
-	MessageItem,
-	"movedByRemit" | "placementVerdict" | "filterMove"
->;
-
-const confidentVerdict = {
-	action: PlacementAction.MoveToInbox,
-	confidence: PlacementConfidence.Confident,
-	fromPlacement: "junk",
-	reasons: ["provider=spam", "dmarc=pass"],
-	dryRun: false,
-	decidedAt: 1_700_000_000_000,
-};
-
-const filterMove = {
-	filterId: "flt-1",
-	sourceMailboxId: "mb-inbox",
-	destinationMailboxId: "mb-travel",
-	decidedAt: 1_700_000_000_000,
-};
-
-describe("deriveAutoMoved", () => {
-	it("returns undefined when the message was not moved by Remit", () => {
-		const message: AutoMovedInput = {
-			movedByRemit: false,
-			placementVerdict: confidentVerdict,
-		};
-		assert.equal(deriveAutoMoved(message), undefined);
-	});
-
-	it("projects a standing-filter move to its mailbox ids and filter id", () => {
-		const message: AutoMovedInput = { movedByRemit: true, filterMove };
-		assert.deepEqual(deriveAutoMoved(message), {
-			fromMailboxId: "mb-inbox",
-			destinationMailboxId: "mb-travel",
-			filterId: "flt-1",
-		});
-	});
-
-	it("never leaks the classifier action/fromPlacement for a filter move", () => {
-		const result = deriveAutoMoved({ movedByRemit: true, filterMove });
-		assert.equal(result?.action, undefined);
-		assert.equal(result?.fromPlacement, undefined);
-	});
-
-	it("a filter move outranks a co-present placement verdict", () => {
-		// Both a filter move and a classifier verdict can be recorded; the filter's
-		// exclusive move is what ultimately placed the message (RFC 034 Dec. 3.1).
-		const message: AutoMovedInput = {
-			movedByRemit: true,
-			filterMove,
-			placementVerdict: confidentVerdict,
-		};
-		assert.deepEqual(deriveAutoMoved(message), {
-			fromMailboxId: "mb-inbox",
-			destinationMailboxId: "mb-travel",
-			filterId: "flt-1",
-		});
-	});
-
-	it("projects a confident classifier move to action + fromPlacement", () => {
-		const message: AutoMovedInput = {
-			movedByRemit: true,
-			placementVerdict: confidentVerdict,
-		};
-		assert.deepEqual(deriveAutoMoved(message), {
-			action: PlacementAction.MoveToInbox,
-			fromPlacement: "junk",
-		});
-	});
-
-	it("drops an unsure classifier verdict", () => {
-		const message: AutoMovedInput = {
-			movedByRemit: true,
-			placementVerdict: {
-				...confidentVerdict,
-				confidence: PlacementConfidence.Unsure,
-			},
-		};
-		assert.equal(deriveAutoMoved(message), undefined);
-	});
-
-	it("drops a dry-run classifier verdict", () => {
-		const message: AutoMovedInput = {
-			movedByRemit: true,
-			placementVerdict: { ...confidentVerdict, dryRun: true },
-		};
-		assert.equal(deriveAutoMoved(message), undefined);
-	});
-
-	it("does not crash on legacy verdict-less, filter-less moved data", () => {
-		// A message moved before either the verdict or the filter marker existed:
-		// movedByRemit is set but nothing is derivable. Must return undefined, not
-		// throw (issue #223 back-compat).
-		const message: AutoMovedInput = { movedByRemit: true };
-		assert.equal(deriveAutoMoved(message), undefined);
-	});
-});

package/src/derive/contentSignature.test.ts

@@ -1,161 +0,0 @@
-import assert from "node:assert/strict";
-import { afterEach, describe, it } from "node:test";
-import {
-	CONTENT_URL_TTL_SECONDS,
-	createContentSigner,
-	getContentSigner,
-	verifyContentSignature,
-} from "./contentSignature.js";
-
-const SECRET = "test-master-secret-at-least-32-chars-long";
-const PATH_A = "accounts/cfg-alice/acc-alice/messages/msg-1/parts/1.2";
-const PATH_B = "accounts/cfg-bob/acc-bob/messages/msg-9/parts/1.2";
-
-const nowSeconds = () => Math.floor(Date.now() / 1000);
-
-describe("content signature: sign + verify round trip", () => {
-	it("a freshly signed URL verifies", () => {
-		const { exp, sig } = createContentSigner(SECRET)(PATH_A);
-		const result = verifyContentSignature(
-			PATH_A,
-			String(exp),
-			sig,
-			SECRET,
-			nowSeconds(),
-		);
-		assert.deepEqual(result, { valid: true });
-	});
-
-	it("rejects a signature minted for a different account's path (cross-account IDOR defense)", () => {
-		const { exp, sig } = createContentSigner(SECRET)(PATH_A);
-		// Present account A's signature against account B's path.
-		const result = verifyContentSignature(
-			PATH_B,
-			String(exp),
-			sig,
-			SECRET,
-			nowSeconds(),
-		);
-		assert.deepEqual(result, { valid: false, reason: "bad-signature" });
-	});
-
-	it("rejects a tampered signature", () => {
-		const { exp, sig } = createContentSigner(SECRET)(PATH_A);
-		const tampered = `${sig.slice(0, -1)}${sig.endsWith("A") ? "B" : "A"}`;
-		const result = verifyContentSignature(
-			PATH_A,
-			String(exp),
-			tampered,
-			SECRET,
-			nowSeconds(),
-		);
-		assert.equal(result.valid, false);
-	});
-
-	it("rejects a valid signature verified with the wrong secret", () => {
-		const { exp, sig } = createContentSigner(SECRET)(PATH_A);
-		const result = verifyContentSignature(
-			PATH_A,
-			String(exp),
-			sig,
-			"a-different-master-secret-also-32-chars",
-			nowSeconds(),
-		);
-		assert.deepEqual(result, { valid: false, reason: "bad-signature" });
-	});
-
-	it("rejects an expired signature", () => {
-		// Negative TTL mints a signature whose expiry is already in the past.
-		const { exp, sig } = createContentSigner(SECRET, -20)(PATH_A);
-		assert.ok(exp < nowSeconds());
-		const result = verifyContentSignature(
-			PATH_A,
-			String(exp),
-			sig,
-			SECRET,
-			nowSeconds(),
-		);
-		assert.deepEqual(result, { valid: false, reason: "expired" });
-	});
-
-	it("reports missing exp/sig distinctly from a bad signature", () => {
-		assert.deepEqual(
-			verifyContentSignature(
-				PATH_A,
-				undefined,
-				undefined,
-				SECRET,
-				nowSeconds(),
-			),
-			{ valid: false, reason: "missing" },
-		);
-	});
-
-	it("rejects a non-integer exp as malformed", () => {
-		const { sig } = createContentSigner(SECRET)(PATH_A);
-		assert.deepEqual(
-			verifyContentSignature(PATH_A, "not-a-number", sig, SECRET, nowSeconds()),
-			{ valid: false, reason: "malformed" },
-		);
-	});
-});
-
-describe("getContentSigner", () => {
-	const ORIGINAL_BACKEND = process.env.DATA_BACKEND;
-	const ORIGINAL_SECRET = process.env.BETTER_AUTH_SECRET;
-
-	afterEach(() => {
-		if (ORIGINAL_BACKEND === undefined) delete process.env.DATA_BACKEND;
-		else process.env.DATA_BACKEND = ORIGINAL_BACKEND;
-		if (ORIGINAL_SECRET === undefined) delete process.env.BETTER_AUTH_SECRET;
-		else process.env.BETTER_AUTH_SECRET = ORIGINAL_SECRET;
-	});
-
-	it("returns undefined on the AWS path (unsigned URLs)", () => {
-		delete process.env.DATA_BACKEND;
-		assert.equal(getContentSigner(), undefined);
-	});
-
-	it("returns a working signer in SQLite mode", () => {
-		process.env.DATA_BACKEND = "sqlite";
-		process.env.BETTER_AUTH_SECRET = SECRET;
-		const signer = getContentSigner();
-		assert.ok(signer);
-		const { exp, sig } = signer(PATH_A);
-		assert.deepEqual(
-			verifyContentSignature(PATH_A, String(exp), sig, SECRET, nowSeconds()),
-			{ valid: true },
-		);
-	});
-
-	it("throws in SQLite mode when the master secret is missing (fail loud)", () => {
-		process.env.DATA_BACKEND = "sqlite";
-		delete process.env.BETTER_AUTH_SECRET;
-		assert.throws(() => getContentSigner(), /BETTER_AUTH_SECRET/);
-	});
-});
-
-describe("the wire format is pinned, not merely self-consistent", () => {
-	/**
-	 * Every other test here round-trips through this module, so a change to the
-	 * canonical message or the key derivation passes them all while breaking every
-	 * `/content` URL already in a browser. This vector was computed once, by hand,
-	 * from the scheme as shipped: HMAC-SHA256 with a subkey derived from the
-	 * master secret under `remit-content-url-signing-v1`, over `path\nexp`,
-	 * base64url. If it fails, the format moved and in-flight URLs moved with it.
-	 */
-	it("still produces the signature it produced when the scheme shipped", () => {
-		const signer = createContentSigner(
-			"a-signing-secret-of-at-least-32-characters",
-		);
-		const originalNow = Date.now;
-		Date.now = () => 1_800_000_000_000 - CONTENT_URL_TTL_SECONDS * 1000;
-		try {
-			const { exp, sig } = signer("accounts/cfg1/acc1/messages/msg1/parts/1.2");
-			assert.equal(exp, 1_800_000_000);
-			assert.equal(sig, "eFKwOYf42a6DWwaZahIm7aVtWuqMOfhOAPoyxtpFybo");
-		} finally {
-			Date.now = originalNow;
-		}
-	});
-});

package/src/derive/contentUrl.test.ts

@@ -1,172 +0,0 @@
-import assert from "node:assert/strict";
-import { afterEach, beforeEach, describe, it } from "node:test";
-import {
-	createContentSigner,
-	verifyContentSignature,
-} from "./contentSignature.js";
-import {
-	buildContentUrl,
-	buildStorageContentUrl,
-	getContentDeliveryDomain,
-} from "./contentUrl.js";
-
-describe("buildContentUrl", () => {
-	it("produces the /content/accounts/{cfg}/{acc}/messages/{msg}/parts/{part} layout the Lambda@Edge expects", () => {
-		const url = buildContentUrl({
-			domain: "https://abc123.cloudfront.net",
-			accountConfigId: "cfg-alice",
-			accountId: "acc-alice",
-			messageId: "msg-1",
-			partPath: "1.2",
-		});
-
-		assert.equal(
-			url,
-			"https://abc123.cloudfront.net/content/accounts/cfg-alice/acc-alice/messages/msg-1/parts/1.2",
-		);
-	});
-
-	it("prepends https:// when the domain is given as a bare hostname", () => {
-		const url = buildContentUrl({
-			domain: "abc123.cloudfront.net",
-			accountConfigId: "cfg-alice",
-			accountId: "acc-alice",
-			messageId: "msg-1",
-			partPath: "1",
-		});
-
-		assert.equal(url.startsWith("https://abc123.cloudfront.net/"), true);
-	});
-
-	it("strips a trailing slash on the domain so the path doesn't double up", () => {
-		const url = buildContentUrl({
-			domain: "https://abc123.cloudfront.net/",
-			accountConfigId: "cfg-alice",
-			accountId: "acc-alice",
-			messageId: "msg-1",
-			partPath: "1",
-		});
-
-		assert.equal(
-			url,
-			"https://abc123.cloudfront.net/content/accounts/cfg-alice/acc-alice/messages/msg-1/parts/1",
-		);
-	});
-
-	it("encodes each segment of partPath defensively (forward-slash kept as separator)", () => {
-		const url = buildContentUrl({
-			domain: "https://cdn.test",
-			accountConfigId: "cfg",
-			accountId: "acc",
-			messageId: "msg",
-			partPath: "1/strange path/3",
-		});
-
-		assert.equal(
-			url,
-			"https://cdn.test/content/accounts/cfg/acc/messages/msg/parts/1/strange%20path/3",
-		);
-	});
-
-	it("addresses an outbox attachment by its storage key", () => {
-		const url = buildStorageContentUrl({
-			domain: "https://cdn.test",
-			storageKey: "accounts/cfg/acc/outbox/ob-1/attachments/att-1",
-		});
-
-		assert.equal(
-			url,
-			"https://cdn.test/content/accounts/cfg/acc/outbox/ob-1/attachments/att-1",
-		);
-	});
-
-	it("leaves the URL unsigned when no signer is provided (AWS/Lambda@Edge path)", () => {
-		const url = buildContentUrl({
-			domain: "https://abc123.cloudfront.net",
-			accountConfigId: "cfg-alice",
-			accountId: "acc-alice",
-			messageId: "msg-1",
-			partPath: "1",
-		});
-		assert.equal(url.includes("?"), false);
-	});
-
-	it("appends an exp/sig signature over the decoded storage path when a signer is provided", () => {
-		const secret = "test-master-secret-at-least-32-chars-long";
-		const url = buildContentUrl({
-			domain: "https://api.example.test",
-			accountConfigId: "cfg-alice",
-			accountId: "acc-alice",
-			messageId: "msg-1",
-			partPath: "1.2",
-			sign: createContentSigner(secret),
-		});
-
-		const parsed = new URL(url);
-		const exp = parsed.searchParams.get("exp");
-		const sig = parsed.searchParams.get("sig");
-		assert.ok(exp);
-		assert.ok(sig);
-		// The signature must verify against the same decoded storage path the
-		// `/content` route recomputes from `req.path`.
-		const relativePath = parsed.pathname.replace(/^\/content\//, "");
-		const result = verifyContentSignature(
-			relativePath,
-			exp,
-			sig,
-			secret,
-			Math.floor(Date.now() / 1000),
-		);
-		assert.deepEqual(result, { valid: true });
-	});
-
-	it("nests accountConfigId before accountId so the Lambda@Edge prefix check matches", () => {
-		const url = buildContentUrl({
-			domain: "https://cdn.test",
-			accountConfigId: "CFG",
-			accountId: "ACC",
-			messageId: "MSG",
-			partPath: "1",
-		});
-
-		const segments = new URL(url).pathname.split("/");
-		// ["", "content", "accounts", "CFG", "ACC", "messages", "MSG", "parts", "1"]
-		assert.equal(segments[1], "content");
-		assert.equal(segments[2], "accounts");
-		assert.equal(segments[3], "CFG");
-		assert.equal(segments[4], "ACC");
-	});
-});
-
-describe("getContentDeliveryDomain", () => {
-	const ORIGINAL = process.env.CONTENT_DELIVERY_DOMAIN;
-
-	beforeEach(() => {
-		delete process.env.CONTENT_DELIVERY_DOMAIN;
-	});
-
-	afterEach(() => {
-		if (ORIGINAL === undefined) delete process.env.CONTENT_DELIVERY_DOMAIN;
-		else process.env.CONTENT_DELIVERY_DOMAIN = ORIGINAL;
-	});
-
-	it("throws when CONTENT_DELIVERY_DOMAIN is unset (fail loud over silent placeholder, #299)", () => {
-		assert.throws(
-			() => getContentDeliveryDomain(),
-			/CONTENT_DELIVERY_DOMAIN is not set/,
-		);
-	});
-
-	it("throws when CONTENT_DELIVERY_DOMAIN is empty", () => {
-		process.env.CONTENT_DELIVERY_DOMAIN = "";
-		assert.throws(
-			() => getContentDeliveryDomain(),
-			/CONTENT_DELIVERY_DOMAIN is not set/,
-		);
-	});
-
-	it("returns the env var value when set", () => {
-		process.env.CONTENT_DELIVERY_DOMAIN = "https://abc.cloudfront.net";
-		assert.equal(getContentDeliveryDomain(), "https://abc.cloudfront.net");
-	});
-});