@remit/backend 0.0.143 → 0.0.145

package/src/error.ts

@@ -1,123 +0,0 @@
-import { isPublicApiError } from "@remit/data-ports/errors";
-import { logger } from "@remit/logger-lambda";
-import type { APIGatewayProxyResult } from "aws-lambda";
-import { formatResponse } from "./response.js";
-
-/**
- * The `code` a refusal carries when it does not name its own. Every error body
- * the API emits is flat `{ code, message }` (issue #371), and `code` is the
- * only field a client may branch on — a message is a sentence for a person and
- * is free to change.
- *
- * A 5xx always answers `internal_error`, whatever the throw site said: a coded
- * 5xx is a mistake at the throw site, not a contract, and a fixed token cannot
- * carry anything about the failure out of the process.
- */
-export const INTERNAL_ERROR_CODE = "internal_error";
-
-/**
- * The one sentence any 5xx answers with. A thrown message is written for a log
- * line, not for a stranger — it names hosts, queries and ids — so it is
- * replaced rather than trusted. The real message is already on the error log
- * beside the correlation id the response carries.
- */
-export const INTERNAL_ERROR_MESSAGE = "Internal server error";
-
-const CODE_BY_STATUS: Record<number, string> = {
-	400: "invalid_request",
-	401: "unauthorized",
-	403: "forbidden",
-	404: "not_found",
-	409: "conflict",
-	412: "precondition_failed",
-	413: "payload_too_large",
-	422: "unprocessable_entity",
-};
-
-export const defaultErrorCode = (statusCode: number): string => {
-	if (statusCode >= 500) return INTERNAL_ERROR_CODE;
-	return CODE_BY_STATUS[statusCode] ?? "request_refused";
-};
-
-export const handleError = async (
-	error: unknown,
-): Promise<APIGatewayProxyResult> => {
-	if (error instanceof Error) {
-		if ("statusCode" in error) {
-			logger.error(
-				{
-					error: error.message,
-					statusCode: error.statusCode,
-					stack: error.stack,
-				},
-				"Error with statusCode",
-			);
-			// An error that opted in names its own code and details, and only below
-			// 500: the status bound keeps a coded 5xx from reaching a client rather
-			// than trusting every future thrower to leave `publicApiError` alone.
-			// Everything else takes the status class's code, so no response goes out
-			// without one. A 5xx keeps neither the thrower's code nor its message —
-			// one status, one code, one sentence, whatever failed.
-			const statusCode =
-				typeof error.statusCode === "number" ? error.statusCode : 500;
-			if (statusCode >= 500) {
-				return formatResponse(
-					{ code: INTERNAL_ERROR_CODE, message: INTERNAL_ERROR_MESSAGE },
-					statusCode,
-				);
-			}
-			const publicApiError =
-				"publicApiError" in error && isPublicApiError(error.publicApiError)
-					? error.publicApiError
-					: undefined;
-			return formatResponse(
-				{
-					code: defaultErrorCode(statusCode),
-					message: error.message,
-					...publicApiError,
-				},
-				statusCode,
-			);
-		}
-
-		if (error.name === "ElectroError") {
-			// DynamoDB client/infrastructure errors should be 500
-			// These contain "aws-error" in the message or reference URL
-			const isInfrastructureError =
-				error.message.includes("aws-error") ||
-				error.message.includes("DynamoDB client");
-
-			const statusCode = isInfrastructureError ? 500 : 400;
-			const logMessage = isInfrastructureError
-				? "DynamoDB infrastructure error"
-				: "ElectroError";
-
-			logger.error({ error: error.message, stack: error.stack }, logMessage);
-
-			// Don't expose internal details for infrastructure errors
-			const responseMessage = isInfrastructureError
-				? "Database temporarily unavailable"
-				: error.message;
-
-			return formatResponse(
-				{ code: defaultErrorCode(statusCode), message: responseMessage },
-				statusCode,
-			);
-		}
-
-		logger.error(
-			{ error: error.message, name: error.name, stack: error.stack },
-			"Unhandled Error",
-		);
-		return formatResponse(
-			{ code: INTERNAL_ERROR_CODE, message: INTERNAL_ERROR_MESSAGE },
-			500,
-		);
-	}
-
-	logger.error({ error: JSON.stringify(error) }, "Unknown error type");
-	return formatResponse(
-		{ code: INTERNAL_ERROR_CODE, message: INTERNAL_ERROR_MESSAGE },
-		500,
-	);
-};

package/src/handlers/account-guards.test.ts

@@ -1,67 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import { AccountAuthType } from "@remit/domain-enums";
-import type { APIGatewayProxyResult } from "aws-lambda";
-import { handleError } from "../error.js";
-import {
-	assertNotOAuthCreate,
-	assertPasswordProvided,
-} from "./account-guards.js";
-
-const refusalOf = (guard: () => void): Promise<APIGatewayProxyResult> => {
-	let thrown: unknown;
-	assert.throws(guard, (error: unknown) => {
-		thrown = error;
-		return true;
-	});
-	return handleError(thrown);
-};
-
-// Both guards used to throw `{ status: 400 }`, and the emitter reads
-// `statusCode`. The status never matched, so a create the API meant to refuse
-// as malformed answered 500 with "Internal server error" — telling the caller
-// the server broke rather than what to change (issue #371).
-describe("the create-account guards", () => {
-	it("refuses an OAuth create as a 400 the caller can act on", async () => {
-		const response = await refusalOf(() =>
-			assertNotOAuthCreate(AccountAuthType.OauthMicrosoft),
-		);
-
-		assert.equal(response.statusCode, 400);
-		const body = JSON.parse(response.body) as {
-			code: string;
-			message: string;
-		};
-		assert.equal(body.code, "invalid_request");
-		assert.match(body.message, /OAuth connect flow/);
-	});
-
-	it("refuses a password create with no password as a 400", async () => {
-		const response = await refusalOf(() =>
-			assertPasswordProvided(AccountAuthType.Password, undefined),
-		);
-
-		assert.equal(response.statusCode, 400);
-		const body = JSON.parse(response.body) as {
-			code: string;
-			message: string;
-		};
-		assert.equal(body.code, "invalid_request");
-		assert.match(body.message, /password is required/);
-	});
-
-	it("refuses a create that omits authType and password alike", async () => {
-		const response = await refusalOf(() =>
-			assertPasswordProvided(undefined, undefined),
-		);
-
-		assert.equal(response.statusCode, 400);
-	});
-
-	it("lets a password create with a password through", () => {
-		assert.doesNotThrow(() =>
-			assertPasswordProvided(AccountAuthType.Password, "hunter2"),
-		);
-		assert.doesNotThrow(() => assertNotOAuthCreate(AccountAuthType.Password));
-	});
-});

package/src/handlers/account-guards.ts

@@ -1,169 +0,0 @@
-import type {
-	AccountResponse,
-	AccountService as AccountServiceName,
-	FolderAppointment,
-} from "@remit/api-openapi-types";
-import type { AccountItem } from "@remit/data-ports";
-import { BadRequestError, ConflictError } from "@remit/data-ports/errors";
-import { AccountAuthType, AccountService } from "@remit/domain-enums";
-import {
-	microsoftServicesGranted,
-	orderServices,
-} from "@remit/mail-oauth-service";
-import type { AccountOverrides } from "./account-overrides.js";
-import type { AccountSignature } from "./account-signature.js";
-
-/**
- * Natural key identifying "the same mailbox in the same place" within an
- * account config. IMAP host and login username are both case-insensitive, so we
- * fold to lowercase before comparing. Used as the explicit server-side
- * uniqueness key now that message identity is account-scoped (entropy per
- * onboard) and no longer incidentally dedups duplicate onboards (#633/#635).
- */
-export interface MailboxNaturalKey {
-	imapHost: string;
-	username: string;
-}
-
-const mailboxKeyOf = (key: MailboxNaturalKey): string =>
-	`${key.imapHost.toLowerCase()}\u0000${key.username.toLowerCase()}`;
-
-/**
- * Find an existing ACTIVE (non-deleted) account that occupies the same
- * mailbox-in-the-same-place as `key`. Soft-deleted accounts are ignored so a
- * re-onboard after delete still succeeds.
- *
- * Callers pass the accounts already scoped to one account config (the natural
- * key's accountConfigId component), so this only matches on host + username.
- */
-export const findActiveDuplicateMailbox = (
-	existing: AccountItem[],
-	key: MailboxNaturalKey,
-): AccountItem | undefined => {
-	const target = mailboxKeyOf(key);
-	return existing.find(
-		(account) =>
-			!account.deletedAt &&
-			mailboxKeyOf({
-				imapHost: account.imapHost,
-				username: account.username,
-			}) === target,
-	);
-};
-
-/**
- * Reject the create when an active account already onboards the same mailbox in
- * the same place. Surfaces as a typed 409 ConflictError so the web-client can
- * show a "already added" message instead of silently creating a duplicate.
- */
-export const assertNoDuplicateMailbox = (
-	existing: AccountItem[],
-	key: MailboxNaturalKey,
-): void => {
-	const duplicate = findActiveDuplicateMailbox(existing, key);
-	if (!duplicate) return;
-	throw new ConflictError(
-		`An account for ${key.username} on ${key.imapHost} already exists`,
-	);
-};
-
-/** Rejects OAuth accounts that must go through the dedicated connect flow. */
-export const assertNotOAuthCreate = (authType: string | undefined): void => {
-	if (authType === AccountAuthType.OauthMicrosoft) {
-		throw new BadRequestError(
-			"OAuth accounts must be created via the OAuth connect flow (POST /accounts/oauth/microsoft/start)",
-		);
-	}
-};
-
-/** Rejects password-auth account creation when no password is supplied. */
-export const assertPasswordProvided = (
-	authType: string | undefined,
-	password: string | undefined,
-): void => {
-	const isPasswordAuth = authType === AccountAuthType.Password || !authType;
-	if (isPasswordAuth && !password) {
-		throw new BadRequestError(
-			"password is required when authType is 'password' (or when authType is omitted)",
-		);
-	}
-};
-
-export const resolveSyncedServices = (
-	account: Pick<AccountItem, "authType" | "grantedScopes">,
-	requested: readonly AccountServiceName[],
-): AccountServiceName[] => {
-	const services = orderServices(requested);
-	if (services.length === 0) {
-		throw new BadRequestError(
-			"syncedServices must name at least one service. To stop syncing an account entirely, delete it with DELETE /accounts/{accountId}.",
-		);
-	}
-	if (account.authType !== AccountAuthType.OauthMicrosoft) {
-		if (services.some((service) => service !== AccountService.Mail)) {
-			throw new BadRequestError(
-				`A password account syncs mail only, so syncedServices must be ["${AccountService.Mail}"].`,
-			);
-		}
-		return services;
-	}
-	const granted = microsoftServicesGranted(account.grantedScopes);
-	const uncovered = services.filter((service) => !granted.includes(service));
-	if (uncovered.length > 0) {
-		throw new BadRequestError(
-			`This account's granted scopes lack ${uncovered.join(", ")}. Consent to them through POST /accounts/oauth/microsoft/start with services ${JSON.stringify(services)}, then sign in to Microsoft again.`,
-		);
-	}
-	return services;
-};
-
-// SECURITY: passwordHash, oauthRefreshTokenHash, and smtpPasswordHash are
-// intentionally omitted — never expose token material in API responses.
-// Display name, mute flag, and signatures live in per-account AccountSetting
-// rows (RFC 032); the caller resolves them and passes them in. Absent means the
-// override is unset. `folderAppointments` (RFC 032 exclusive-folder-appointment,
-// #976) is resolved the same way — persisted rows merged with server-proposed
-// defaults for any unfilled role — via `resolveFolderAppointments`.
-export const toAccountResponse = (
-	account: AccountItem,
-	signature: AccountSignature = {},
-	overrides: AccountOverrides = {},
-	folderAppointments: FolderAppointment[] = [],
-): AccountResponse => ({
-	accountId: account.accountId,
-	accountConfigId: account.accountConfigId,
-	displayName: overrides.displayName,
-	username: account.username,
-	email: account.email,
-	authType: account.authType ?? AccountAuthType.Password,
-	syncedServices: account.syncedServices,
-	grantedScopes: account.grantedScopes,
-	imapHost: account.imapHost,
-	imapPort: account.imapPort,
-	imapTls: account.imapTls,
-	imapStartTls: account.imapStartTls,
-	// RFC 032 Tier 2: SMTP config is total. ElectroDB `default` applies on write
-	// only, so rows written before this change still lack these attributes —
-	// coalesce to the schema defaults on read so the response is always complete.
-	smtpEnabled: account.smtpEnabled ?? false,
-	smtpHost: account.smtpHost ?? "",
-	smtpPort: account.smtpPort ?? 587,
-	smtpTls: account.smtpTls ?? false,
-	smtpStartTls: account.smtpStartTls ?? true,
-	smtpUsername: account.smtpUsername ?? "",
-	signaturePlainText: signature.plainText,
-	signatureHtml: signature.html,
-	composeLanguages: overrides.composeLanguages,
-	isActive: account.isActive,
-	connectionState: account.connectionState,
-	lastConnectedAt: account.lastConnectedAt,
-	lastSyncAt: account.lastSyncAt,
-	lastError: account.lastError,
-	syncPhase: account.syncPhase,
-	mailboxCountTotal: account.mailboxCountTotal,
-	mailboxCountSynced: account.mailboxCountSynced,
-	muted: overrides.muted,
-	createdAt: account.createdAt,
-	updatedAt: account.updatedAt,
-	folderAppointments,
-});

package/src/handlers/account-oauth-callback.test.ts

@@ -1,155 +0,0 @@
-/**
- * The browser Microsoft sends back, and where it ends up.
- *
- * The callback answers a redirect, so the whole response is its Location
- * header: an answer that arrives without it is a blank page with the account
- * either connected or not and no way to tell. Driven through the real OpenAPI
- * document and the self-host request path, so what is asserted is what a
- * self-hosted deployment writes onto the wire — the header included, which a
- * handler returning a bare `{statusCode, headers}` shape lost on the way out.
- */
-
-import assert from "node:assert/strict";
-import { randomUUID } from "node:crypto";
-import { createServer, type Server } from "node:http";
-import type { AddressInfo } from "node:net";
-import { after, before, describe, it } from "node:test";
-import { AccountService } from "@remit/domain-enums";
-import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
-import {
-	_resetForTest,
-	type RemitClient,
-	setClient,
-} from "../service/data-client.js";
-import { signState } from "./account-oauth.js";
-import { createCalendarSqliteClient } from "./calendar-sqlite-fixture.js";
-
-const CLIENT_SECRET = "callback-test-client-secret";
-const WEB_ORIGIN = "https://mail.example.com";
-const CALLBACK_PATH = "/accounts/oauth/microsoft/callback";
-
-let handler: (
-	event: APIGatewayProxyEvent,
-	context: unknown,
-) => Promise<APIGatewayProxyResult>;
-let client: RemitClient;
-let cleanup: () => void;
-let tokenEndpoint: Server;
-
-const jwt = (claims: Record<string, unknown>): string =>
-	[
-		Buffer.from(JSON.stringify({ alg: "RS256" })).toString("base64url"),
-		Buffer.from(JSON.stringify(claims), "utf8").toString("base64url"),
-		"signature-not-checked-here",
-	].join(".");
-
-/** Microsoft's token endpoint, close enough for the one call the callback makes. */
-const startTokenEndpoint = async (): Promise<string> => {
-	tokenEndpoint = createServer((_request, response) => {
-		response.writeHead(200, { "Content-Type": "application/json" });
-		response.end(
-			JSON.stringify({
-				access_token: "access-token",
-				refresh_token: "refresh-token",
-				id_token: jwt({ preferred_username: "matthijs@example.com" }),
-				scope:
-					"https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send",
-				expires_in: 3600,
-			}),
-		);
-	});
-	await new Promise<void>((resolve) => tokenEndpoint.listen(0, resolve));
-	const { port } = tokenEndpoint.address() as AddressInfo;
-	return `http://127.0.0.1:${port}/token`;
-};
-
-const callback = (
-	query: Record<string, string>,
-): Promise<APIGatewayProxyResult> =>
-	handler(
-		{
-			httpMethod: "GET",
-			path: CALLBACK_PATH,
-			headers: {},
-			queryStringParameters: query,
-			body: null,
-			requestContext: {},
-		} as unknown as APIGatewayProxyEvent,
-		{ awsRequestId: `req-${randomUUID()}`, functionName: "test" },
-	);
-
-const headerOf = (
-	response: APIGatewayProxyResult,
-	name: string,
-): string | undefined => {
-	for (const [key, value] of Object.entries(response.headers ?? {})) {
-		if (key.toLowerCase() === name) return String(value);
-	}
-	return undefined;
-};
-
-before(async () => {
-	_resetForTest();
-	process.env.DATA_BACKEND = "sqlite";
-	process.env.CORS_ALLOWED_ORIGINS = WEB_ORIGIN;
-	process.env.MSOAUTH_REDIRECT_URI = `${WEB_ORIGIN}${CALLBACK_PATH}`;
-	process.env.MSOAUTH_CLIENT_ID = "callback-test-client-id";
-	process.env.MSOAUTH_CLIENT_SECRET = CLIENT_SECRET;
-	process.env.MSOAUTH_TOKEN_ENDPOINT = await startTokenEndpoint();
-	// The self-host key that encrypts the stored refresh token.
-	process.env.FAKE_KMS_DATAKEY = "0".repeat(64);
-	// Static credentials so the best-effort sync enqueue fails against the local
-	// queue instead of walking the instance-metadata chain for a minute.
-	process.env.AWS_REGION = "eu-west-1";
-	process.env.AWS_ACCESS_KEY_ID = "test";
-	process.env.AWS_SECRET_ACCESS_KEY = "test";
-	({ client, cleanup } = await createCalendarSqliteClient());
-	setClient(client);
-	({ handler } = (await import("../index.js")) as unknown as {
-		handler: typeof handler;
-	});
-});
-
-after(async () => {
-	_resetForTest();
-	cleanup();
-	await new Promise<void>((resolve) => tokenEndpoint.close(() => resolve()));
-});
-
-describe("the Microsoft OAuth callback", () => {
-	it("sends the consenting browser on to the connected account", async () => {
-		const accountConfigId = randomUUID();
-		const state = await signState(
-			{
-				accountConfigId,
-				nonce: "nonce",
-				timestamp: Date.now(),
-				services: [AccountService.Mail],
-			},
-			CLIENT_SECRET,
-		);
-
-		const response = await callback({ code: "auth-code", state });
-
-		assert.equal(response.statusCode, 302, response.body);
-		const location = headerOf(response, "location");
-		assert.ok(location, "a redirect without a Location header is a blank page");
-		const [connected] =
-			await client.account.listAllByAccountConfig(accountConfigId);
-		assert.ok(connected, "the callback stored the account it redirects to");
-		assert.equal(
-			location,
-			`${WEB_ORIGIN}/settings/accounts?connected=${encodeURIComponent(connected.accountId)}`,
-		);
-	});
-
-	it("sends a refused consent back with the reason Microsoft gave", async () => {
-		const response = await callback({ error: "access_denied" });
-
-		assert.equal(response.statusCode, 302, response.body);
-		assert.equal(
-			headerOf(response, "location"),
-			`${WEB_ORIGIN}/settings/accounts?oauthError=access_denied`,
-		);
-	});
-});