@remit/backend 0.0.143 → 0.0.145

package/src/index.test.ts

@@ -1,83 +0,0 @@
-/**
- * Issue #1054: the backend must log one structured access line per request
- * (method, path, status, duration, correlation id) at a level that is on in
- * production. The access log lives in `rawHandler` in `src/index.ts`, wrapping
- * the authenticated request path — so a 401 denial from edge-auth also gets an
- * access line (once it flows through `formatResponse` with the correlation id).
- *
- * The 401 response shape (correlation id header + CORS on the denial) is tested
- * directly in `jwt-auth.test.ts` via `runWithRequestContext`; this file tests
- * that the handler emits the access log line on every request by spying on the
- * logger's info method.
- */
-import assert from "node:assert/strict";
-import { describe, it, mock } from "node:test";
-import { logger } from "@remit/logger-lambda";
-import type { APIGatewayProxyEvent, Context } from "aws-lambda";
-import { handler } from "./index.js";
-
-const buildEvent = (
-	overrides: Partial<APIGatewayProxyEvent> = {},
-): APIGatewayProxyEvent =>
-	({
-		path: "/api/test",
-		httpMethod: "GET",
-		pathParameters: {},
-		queryStringParameters: {},
-		headers: {},
-		requestContext: {},
-		...overrides,
-	}) as unknown as APIGatewayProxyEvent;
-
-const buildContext = (correlationId = "ctx-test-1"): Context =>
-	({
-		awsRequestId: correlationId,
-		functionName: "test-function",
-		getRemainingTimeInMillis: () => 30000,
-	}) as unknown as Context;
-
-describe("issue #1054: per-request access log", () => {
-	it('emits one "Request completed" line at info level with method, path, status, duration and correlation id', async () => {
-		delete process.env.LOCAL_ACCOUNT_CONFIG_ID;
-
-		// Spy on logger.info — the real logger passes (fields, message) in
-		// pino order, so the spy captures the structured fields and message.
-		const infoSpy = mock.method(logger, "info");
-
-		try {
-			await handler(
-				buildEvent({ path: "/api/__nonexistent_for_test__" }),
-				buildContext("ctx-access-log"),
-			).catch(() => {
-				// 404s are expected; we only care about the log line.
-			});
-
-			// `logger.info` is overloaded ((obj, msg?) and (msg, obj?)), so the
-			// mock types `call.arguments` by a single overload. Read the
-			// arguments positionally through an unknown[] view instead.
-			const accessCalls = infoSpy.mock.calls.filter((call) => {
-				// pino calls logger.info(fields, message)
-				const args = call.arguments as unknown[];
-				return args[1] === "Request completed";
-			});
-
-			assert.ok(accessCalls.length >= 1, "expected an access log line");
-			const fields = (accessCalls[0].arguments as unknown[])[0] as Record<
-				string,
-				unknown
-			>;
-
-			// infoSpy was called on logger.info, so the level is "info" by
-			// construction — pino's adapter routes .info() calls to the info
-			// level. No separate level field needed.
-
-			assert.equal(fields.method, "GET");
-			assert.equal(fields.path, "/api/__nonexistent_for_test__");
-			assert.equal(fields.correlationId, "ctx-access-log");
-			assert.equal(typeof fields.statusCode, "number");
-			assert.equal(typeof fields.durationMs, "number");
-		} finally {
-			infoSpy.mock.restore();
-		}
-	});
-});

package/src/index.ts

@@ -1,228 +0,0 @@
-import { existsSync, readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { inspect } from "node:util";
-import { redactCalendarFeedPath } from "@remit/calendar-service";
-import { logger, withLogContext, withTelemetry } from "@remit/logger-lambda";
-import type { APIGatewayProxyEvent, Context } from "aws-lambda";
-import {
-	type Document,
-	OpenAPIBackend,
-	type Context as OpenAPIContext,
-	type Request,
-} from "openapi-backend";
-import { assertLocalBypassNotInDeployedEnv } from "./auth.js";
-import { usesBetterAuthJwt } from "./data-backend.js";
-import { defaultErrorCode, handleError } from "./error.js";
-import { handlers } from "./handlers/index.js";
-import { authenticateSelfHostRequest } from "./jwt-auth.js";
-import { normalizeRequest } from "./request.js";
-import { runWithRequestContext } from "./request-context.js";
-import { formatResponse, postResponseHandler } from "./response.js";
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-
-// Boot-time refusal: the local auth-bypass overrides must never be set in a
-// deployed environment. Runs on module load so a leaked env var fails the
-// process at startup rather than silently opening authentication at runtime.
-assertLocalBypassNotInDeployedEnv();
-
-/**
- * Last-resort net for a leaked background rejection.
- *
- * Every fire-and-forget side effect is meant to be contained at its source (see
- * service/fire-and-forget.ts), so reaching here is a bug — an uncontained
- * `void promise` somewhere. The API process (dev-server / warm Lambda container)
- * shares one event loop across requests, so without this handler such a leak
- * would surface as a spurious 500 on whatever request was in flight. We log it
- * LOUDLY with a distinct alert so it is observable, and deliberately do NOT exit
- * — a stray background rejection must never take the API down or fail a request.
- * (The worker process intentionally has no such net: there each message is its
- * own invocation and a rejection should crash it.)
- */
-const unhandledRejectionRegistered = Symbol.for(
-	"remit.backend.unhandledRejectionNet",
-);
-const globalProcess = process as unknown as Record<symbol, boolean>;
-if (!globalProcess[unhandledRejectionRegistered]) {
-	globalProcess[unhandledRejectionRegistered] = true;
-	process.on("unhandledRejection", (reason: unknown) => {
-		logger.error(
-			{
-				alert: "unhandled_rejection",
-				errorName: (reason as { name?: string })?.name,
-				errorCode:
-					(reason as { Code?: string })?.Code ??
-					(reason as { code?: string })?.code,
-				error: inspect(reason),
-			},
-			"Unhandled promise rejection leaked into the API event loop (contained, request not failed)",
-		);
-	});
-}
-
-const loadOpenAPISpec = (): Document => {
-	// Bundled Lambda: infra's NodeJSArmFunction copies openapi.json into the
-	// bundle root next to the entrypoint via its `extraFiles` prop.
-	const bundledPath = join(__dirname, "openapi.json");
-	if (existsSync(bundledPath)) {
-		return JSON.parse(readFileSync(bundledPath, "utf-8"));
-	}
-
-	// Dev (tsx / dev-server): read straight from the repo build tree.
-	const devPath = join(__dirname, "../../../build/remit-openapi3/openapi.json");
-	return JSON.parse(readFileSync(devPath, "utf-8"));
-};
-
-const OpenAPISpec = loadOpenAPISpec();
-
-const api = new OpenAPIBackend({
-	definition: OpenAPISpec,
-	quick: true,
-	// Coerce query/path params to their schema types. API Gateway delivers every
-	// query param as a string; handlers cast them to number/boolean (e.g. `limit`,
-	// `hasAttachment`) and forward them downstream. Without coercion a string
-	// `limit` reaches ElectroDB's `.go({ limit })` and DynamoDB rejects the
-	// numeric Limit field ("STRING_VALUE cannot be converted to Integer"), 500ing
-	// /addresses/search and /search/semantic.
-	coerceTypes: true,
-});
-
-api.register("postResponseHandler", postResponseHandler);
-
-/**
- * The validator's findings, narrowed to the three fields `RequestValidationDetail`
- * declares. Copied field by field rather than passed through: an AJV error also
- * carries `params`, and under `verbose` the rejected `data` itself — which for a
- * refused request body is whatever the caller sent, a password among the
- * possibilities. Naming the fields is what keeps that off the wire.
- */
-const validationDetails = (
-	errors: OpenAPIContext["validation"]["errors"],
-): Array<{ path: string; rule: string; message: string }> =>
-	(errors ?? []).map((error) => ({
-		path: error.instancePath,
-		rule: error.keyword,
-		message: error.message ?? "refused",
-	}));
-
-// The errors and the operation, and nothing that came off the wire. A request
-// that fails validation is logged at error level, and the request it carries
-// holds the caller's headers and cookies — an Authorization bearer among them,
-// and for a calendar feed the token in the path is itself the credential
-// (issue #1065). The path is redacted the same way the request scope redacts it.
-api.register("validationFail", (c: OpenAPIContext, req: Request) => {
-	logger.error(
-		{
-			errors: c.validation.errors,
-			path: redactCalendarFeedPath(req.path),
-			operation: c.operation?.operationId,
-		},
-		"Validation failed",
-	);
-	return {
-		statusCode: 400,
-		body: {
-			code: defaultErrorCode(400),
-			message: "Invalid request",
-			errors: validationDetails(c.validation.errors),
-		},
-	};
-});
-
-api.register("notFound", () => ({
-	statusCode: 404,
-	body: { code: defaultErrorCode(404), message: "Not found" },
-}));
-
-api.register("notImplemented", async (c: OpenAPIContext) => {
-	const { status, mock } = api.mockResponseForOperation(
-		c.operation.operationId as string,
-	);
-	return formatResponse(mock as Record<string, unknown>, status);
-});
-
-api.register(handlers);
-
-api.init();
-
-export { api, OpenAPISpec };
-
-const readOriginHeader = (
-	headers: APIGatewayProxyEvent["headers"],
-): string | undefined => {
-	if (!headers) return undefined;
-	for (const [key, value] of Object.entries(headers)) {
-		if (key.toLowerCase() === "origin" && typeof value === "string") {
-			return value;
-		}
-	}
-	return undefined;
-};
-
-// A scope, not `logger.setBindings`: this process serves requests concurrently,
-// and bindings on the shared logger belong to whichever request wrote them last,
-// so a line gets attributed to the wrong request. The scope follows the request
-// through its own async continuations and nothing else. It nests inside the one
-// `withTelemetry` opens, which is where `requestId` comes from.
-const rawHandler = async (event: APIGatewayProxyEvent, context: Context) => {
-	// A calendar feed carries its credential in the path, so the raw path is a
-	// secret and cannot be a log field (issue #1065). Redacted once, here, where
-	// every line inside the request picks it up from the scope.
-	const path = redactCalendarFeedPath(event.path);
-
-	return withLogContext(
-		{
-			path,
-			method: event.httpMethod,
-		},
-		async () => {
-			logger.debug({ method: event.httpMethod, path }, "Request received");
-
-			const origin = readOriginHeader(event.headers);
-			const startedAt = Date.now();
-			// Capture the correlation id here: it is seeded by
-			// runWithRequestContext below (from context.awsRequestId), but that
-			// AsyncLocalStorage scope does not reliably survive the
-			// openapi-backend handleRequest call chain, so we read it from
-			// `context.awsRequestId` directly rather than via
-			// getRequestCorrelationId at log time.
-			const correlationId = context.awsRequestId;
-
-			const result = await runWithRequestContext(
-				{ origin, correlationId },
-				async () => {
-					if (usesBetterAuthJwt()) {
-						const denied = await authenticateSelfHostRequest(event);
-						if (denied) return denied;
-					}
-
-					return api
-						.handleRequest(normalizeRequest(event), event, context)
-						.catch(handleError);
-				},
-			);
-
-			// One structured access line per request: method, path, status, and
-			// duration. The correlation id is inlined as a top-level field so a bug
-			// report quoting the id can grep logs by it directly, and emitted at
-			// info so it is on by default in production (the debug "Request
-			// received" above already filters out under normal log levels).
-			// biome-ignore lint/plugin/no-logger-info: one access line per request is an audit-grade signal (issue #1054)
-			logger.info(
-				{
-					method: event.httpMethod,
-					path,
-					statusCode: result.statusCode,
-					durationMs: Date.now() - startedAt,
-					correlationId,
-				},
-				"Request completed",
-			);
-
-			return result;
-		},
-	);
-};
-
-export const handler = withTelemetry(rawHandler);

package/src/jwt-auth.test.ts

@@ -1,152 +0,0 @@
-import assert from "node:assert/strict";
-import { afterEach, beforeEach, test } from "node:test";
-import type { APIGatewayProxyEvent } from "aws-lambda";
-import {
-	_setVerifierForTest,
-	authenticateSelfHostRequest,
-} from "./jwt-auth.js";
-import { runWithRequestContext } from "./request-context.js";
-
-const buildEvent = (
-	overrides: Partial<APIGatewayProxyEvent> = {},
-): APIGatewayProxyEvent =>
-	({
-		headers: {},
-		requestContext: {},
-		...overrides,
-	}) as APIGatewayProxyEvent;
-
-let savedBypass: string | undefined;
-
-beforeEach(() => {
-	savedBypass = process.env.LOCAL_ACCOUNT_CONFIG_ID;
-	delete process.env.LOCAL_ACCOUNT_CONFIG_ID;
-});
-
-afterEach(() => {
-	_setVerifierForTest(null);
-	if (savedBypass === undefined) delete process.env.LOCAL_ACCOUNT_CONFIG_ID;
-	else process.env.LOCAL_ACCOUNT_CONFIG_ID = savedBypass;
-});
-
-test("valid token injects verified sub into authorizer claims", async () => {
-	_setVerifierForTest(async () => ({ sub: "user-abc", email: "a@b.com" }));
-	const event = buildEvent({
-		headers: { Authorization: "Bearer good.token.here" },
-	});
-
-	const result = await authenticateSelfHostRequest(event);
-
-	assert.equal(result, null);
-	assert.equal(event.requestContext.authorizer?.claims?.sub, "user-abc");
-	assert.equal(event.requestContext.authorizer?.claims?.email, "a@b.com");
-});
-
-test("invalid token returns 401 with correlation id and CORS headers", async () => {
-	_setVerifierForTest(async () => {
-		throw new Error("bad signature");
-	});
-	const event = buildEvent({
-		headers: { authorization: "Bearer bad.token" },
-	});
-
-	const result = await runWithRequestContext(
-		{ correlationId: "req-invalid-token" },
-		async () => authenticateSelfHostRequest(event),
-	);
-
-	assert.equal(result?.statusCode, 401);
-	assert.equal(
-		result?.headers?.["x-correlation-id"],
-		"req-invalid-token",
-		"edge-auth 401 must carry the correlation id",
-	);
-	assert.equal(
-		result?.headers?.["Access-Control-Allow-Origin"],
-		"*",
-		"edge-auth 401 must carry CORS headers",
-	);
-	assert.equal(
-		result?.body,
-		JSON.stringify({
-			code: "unauthorized",
-			message: "Invalid or expired token",
-		}),
-	);
-	assert.equal(event.requestContext.authorizer, undefined);
-});
-
-test("no token with a local bypass configured is allowed", async () => {
-	process.env.LOCAL_ACCOUNT_CONFIG_ID = "some-config-id";
-	const event = buildEvent();
-
-	const result = await authenticateSelfHostRequest(event);
-
-	assert.equal(result, null);
-});
-
-test("no token and no bypass returns 401 with correlation id", async () => {
-	const event = buildEvent();
-
-	const result = await runWithRequestContext(
-		{ correlationId: "req-no-token" },
-		async () => authenticateSelfHostRequest(event),
-	);
-
-	assert.equal(result?.statusCode, 401);
-	assert.equal(
-		result?.headers?.["x-correlation-id"],
-		"req-no-token",
-		"edge-auth 401 must carry the correlation id",
-	);
-	assert.equal(
-		result?.headers?.["Access-Control-Allow-Origin"],
-		"*",
-		"edge-auth 401 must carry CORS headers",
-	);
-});
-
-test("a tokenless GET to the Microsoft OAuth callback is admitted", async () => {
-	const event = buildEvent({
-		httpMethod: "GET",
-		path: "/accounts/oauth/microsoft/callback",
-	});
-
-	const result = await authenticateSelfHostRequest(event);
-
-	assert.equal(result, null);
-	assert.equal(event.requestContext.authorizer, undefined);
-});
-
-test("the callback exemption covers that path and method only", async () => {
-	const neighbour = buildEvent({
-		httpMethod: "GET",
-		path: "/accounts/oauth/microsoft/start",
-	});
-	const otherMethod = buildEvent({
-		httpMethod: "POST",
-		path: "/accounts/oauth/microsoft/callback",
-	});
-
-	assert.equal((await authenticateSelfHostRequest(neighbour))?.statusCode, 401);
-	assert.equal(
-		(await authenticateSelfHostRequest(otherMethod))?.statusCode,
-		401,
-	);
-});
-
-test("pre-injected claims (edge tier) short-circuit verification", async () => {
-	_setVerifierForTest(async () => {
-		throw new Error("verifier must not be called");
-	});
-	const event = buildEvent({
-		requestContext: {
-			authorizer: { claims: { sub: "edge-user" } },
-		} as unknown as APIGatewayProxyEvent["requestContext"],
-	});
-
-	const result = await authenticateSelfHostRequest(event);
-
-	assert.equal(result, null);
-	assert.equal(event.requestContext.authorizer?.claims?.sub, "edge-user");
-});

package/src/jwt-auth.ts

@@ -1,132 +0,0 @@
-import {
-	createJwtVerifier,
-	extractBearerToken,
-	type JwtVerifier,
-	resolveVerifierConfig,
-} from "@remit/auth-service/verifier";
-import { readCalendarFeedToken } from "@remit/calendar-service";
-import { logger } from "@remit/logger-lambda";
-import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
-import { defaultErrorCode } from "./error.js";
-import { formatResponse } from "./response.js";
-
-let verifier: JwtVerifier | null = null;
-
-const getVerifier = (): JwtVerifier => {
-	if (!verifier) verifier = createJwtVerifier(resolveVerifierConfig());
-	return verifier;
-};
-
-/** Test-only override for the memoized verifier. Pass null to reset. */
-export const _setVerifierForTest = (v: JwtVerifier | null): void => {
-	verifier = v;
-};
-
-const readHeader = (
-	headers: APIGatewayProxyEvent["headers"],
-	name: string,
-): string | undefined => {
-	for (const [key, value] of Object.entries(headers ?? {})) {
-		if (key.toLowerCase() === name && typeof value === "string") return value;
-	}
-	return undefined;
-};
-
-const unauthorized = (message: string): APIGatewayProxyResult =>
-	formatResponse({ code: defaultErrorCode(401), message }, 401);
-
-const injectClaims = (
-	event: APIGatewayProxyEvent,
-	sub: string,
-	email: string | undefined,
-): void => {
-	event.requestContext = {
-		...event.requestContext,
-		authorizer: {
-			...event.requestContext?.authorizer,
-			claims: {
-				sub,
-				email: email ?? "",
-			},
-		},
-	};
-};
-
-const hasLocalBypass = (): boolean =>
-	Boolean(process.env.LOCAL_ACCOUNT_CONFIG_ID);
-
-/**
- * The routes that run without a token.
- *
- * Microsoft redirects the browser here after consent, so the request carries no
- * Authorization header and no session to derive one from. The handler takes its
- * identity from the HMAC-signed `state` parameter and validates it there; that
- * signature is the gate, not a JWT.
- *
- * A calendar feed carries its credential in the path for the same reason: a
- * subscribed client polls a URL and has no session to present, so the token is
- * the gate and the handler compares it against a stored hash.
- *
- * Hardcoded, matching the edge exemption in packages/apisix/src/route-table.ts.
- * `@useAuth(NoAuth)` in the spec does not open a path here — a future public
- * route is added by hand.
- */
-const PUBLIC_ROUTES: readonly {
-	method: string;
-	matches: (path: string) => boolean;
-}[] = [
-	{
-		method: "GET",
-		matches: (path) => path === "/accounts/oauth/microsoft/callback",
-	},
-	{
-		method: "GET",
-		matches: (path) => readCalendarFeedToken(path) !== null,
-	},
-];
-
-const isPublicRoute = (event: APIGatewayProxyEvent): boolean =>
-	PUBLIC_ROUTES.some(
-		(route) => route.method === event.httpMethod && route.matches(event.path),
-	);
-
-/**
- * Authenticate a self-host request from a better-auth RS256 JWT.
- *
- * On a valid token the verified `sub` is injected into the event's authorizer
- * claims, exactly where the Cognito authorizer puts it, so every downstream
- * handler reads identity through the unchanged `auth.ts` path. Returns a 401
- * response (not null) when a token is present but fails verification, or when no
- * token is supplied and no local test bypass is configured. Returns null to let
- * the request proceed.
- *
- * When the edge tier (APISIX) has already verified and injected claims, this is
- * a no-op — the backend trusts pre-populated claims and re-verifies otherwise.
- */
-export const authenticateSelfHostRequest = async (
-	event: APIGatewayProxyEvent,
-): Promise<APIGatewayProxyResult | null> => {
-	if (isPublicRoute(event)) return null;
-
-	const existingSub = event.requestContext?.authorizer?.claims?.sub;
-	if (typeof existingSub === "string" && existingSub.length > 0) return null;
-
-	const token = extractBearerToken(readHeader(event.headers, "authorization"));
-
-	if (token) {
-		const claims = await getVerifier()(token).catch((err: unknown) => {
-			logger.warn(
-				{ err: err instanceof Error ? err.message : String(err) },
-				"better-auth JWT verification failed",
-			);
-			return null;
-		});
-		if (!claims) return unauthorized("Invalid or expired token");
-		injectClaims(event, claims.sub, claims.email);
-		return null;
-	}
-
-	if (hasLocalBypass()) return null;
-
-	return unauthorized("Authentication required");
-};