@remit/backend 0.0.143 → 0.0.145

package/src/log-redaction.test.ts

@@ -1,144 +0,0 @@
-/**
- * Issue #1065: what a request is allowed to leave behind in the log.
- *
- * A calendar feed's token is in its path and is the whole credential, so the
- * path is a secret; a validation failure is logged at error level and the
- * request it carries holds the caller's Authorization header. Both are asserted
- * against captured stdout rather than by reading the call sites, because the
- * leak was a field bound two frames away from the handler that logged it.
- */
-
-import assert from "node:assert/strict";
-import { after, before, describe, it } from "node:test";
-import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
-import { captureStdout, restoreStdout } from "./stdout-capture-fixture.js";
-
-process.env.LOG_LEVEL = "trace";
-
-const { mintCalendarFeedToken } = await import("@remit/calendar-service");
-const { _resetForTest, setClient } = await import("./service/data-client.js");
-const { createCalendarSqliteClient } = await import(
-	"./handlers/calendar-sqlite-fixture.js"
-);
-
-let handler: (
-	event: APIGatewayProxyEvent,
-	context: unknown,
-) => Promise<APIGatewayProxyResult>;
-let cleanup: () => void;
-
-const send = (
-	event: Partial<APIGatewayProxyEvent> & { httpMethod: string; path: string },
-): Promise<APIGatewayProxyResult> =>
-	handler(
-		{
-			headers: {},
-			queryStringParameters: null,
-			body: null,
-			requestContext: {},
-			...event,
-		} as unknown as APIGatewayProxyEvent,
-		{ awsRequestId: "log-redaction", functionName: "test" },
-	);
-
-before(async () => {
-	_resetForTest();
-	process.env.DATA_BACKEND = "sqlite";
-	const fixture = await createCalendarSqliteClient();
-	cleanup = fixture.cleanup;
-	setClient(fixture.client);
-	({ handler } = (await import("./index.js")) as unknown as {
-		handler: typeof handler;
-	});
-});
-
-after(() => {
-	_resetForTest();
-	restoreStdout();
-	cleanup();
-});
-
-describe("what a request leaves in the log", () => {
-	it("never writes the feed token a subscriber polls with", async () => {
-		const { token } = mintCalendarFeedToken();
-
-		const { result: response, logged } = await captureStdout(() =>
-			send({ httpMethod: "GET", path: `/feeds/calendar/${token}.ics` }),
-		);
-
-		assert.equal(
-			response.statusCode,
-			404,
-			"an unknown token, but still routed",
-		);
-		assert.ok(logged.length > 0, "the request has to have logged something");
-		assert.equal(
-			logged.includes(token),
-			false,
-			"the token in the path is the credential, so the path cannot be a log field",
-		);
-		assert.ok(
-			logged.includes("/feeds/calendar/<redacted>.ics"),
-			"which route was served is what an operator reads the log for",
-		);
-	});
-
-	it("never writes the address a calendar subscribes to", async () => {
-		const secret = "private-7c0ffee5eed";
-		const { result: response, logged } = await captureStdout(() =>
-			send({
-				httpMethod: "POST",
-				path: "/calendars",
-				headers: { "Content-Type": "application/json" },
-				body: JSON.stringify({
-					urlSegment: "harbour",
-					displayName: "Harbour",
-					subscriptionUrl: `http://127.0.0.1:9/calendar/ical/${secret}/basic.ics`,
-				}),
-				requestContext: {
-					authorizer: { claims: { sub: "log-redaction-subscriber" } },
-				} as unknown as APIGatewayProxyEvent["requestContext"],
-			}),
-		);
-
-		assert.equal(response.statusCode, 400, response.body);
-		assert.match(response.body, /subscription_unreachable/);
-		assert.equal(response.body.includes(secret), false);
-		assert.ok(logged.length > 0, "the request has to have logged something");
-		assert.equal(
-			logged.includes(secret),
-			false,
-			"for a Google secret address the URL is the whole credential",
-		);
-	});
-
-	it("never writes the credentials a failing request arrived with", async () => {
-		// A session is already established, so the bearer is never verified and the
-		// request reaches validation — where the whole parsed request, headers and
-		// all, used to be logged. The delete refuses because it declares
-		// `calendarId` as a required query parameter and none was sent.
-		const { result: response, logged } = await captureStdout(() =>
-			send({
-				httpMethod: "DELETE",
-				path: "/calendar-events/8f14e45f-ceea-467a-9c9e-9c9e9c9e9c9e",
-				headers: {
-					Authorization: "Bearer x",
-					Cookie: "session=secret-cookie-value",
-				},
-				requestContext: {
-					authorizer: { claims: { sub: "log-redaction-sub" } },
-				} as unknown as APIGatewayProxyEvent["requestContext"],
-			}),
-		);
-
-		assert.equal(response.statusCode, 400, response.body);
-		assert.ok(logged.includes("Validation failed"));
-		assert.equal(logged.includes("Bearer x"), false);
-		assert.equal(logged.includes("secret-cookie-value"), false);
-		assert.equal(
-			logged.includes("parsedRequest"),
-			false,
-			"the request that failed is not a field; its errors are",
-		);
-	});
-});

package/src/openapi-spec.test.ts

@@ -1,118 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import { OpenAPISpec } from "./index.js";
-
-type Parameter = {
-	name: string;
-	in: string;
-	explode?: boolean;
-};
-
-const queryParameters = (): Array<{
-	operationId: string;
-	param: Parameter;
-}> => {
-	const found: Array<{ operationId: string; param: Parameter }> = [];
-	for (const item of Object.values(OpenAPISpec.paths ?? {})) {
-		for (const operation of Object.values(item ?? {})) {
-			const { operationId, parameters } = operation as {
-				operationId?: string;
-				parameters?: Parameter[];
-			};
-			if (!operationId || !parameters) continue;
-			for (const param of parameters) {
-				if (param.in === "query") found.push({ operationId, param });
-			}
-		}
-	}
-	return found;
-};
-
-type Schema = {
-	$ref?: string;
-	type?: string;
-	required?: string[];
-	properties?: Record<string, unknown>;
-};
-
-const resolve = (schema: Schema | undefined): Schema | undefined => {
-	if (!schema?.$ref) return schema;
-	const name = schema.$ref.replace("#/components/schemas/", "");
-	return (OpenAPISpec.components?.schemas?.[name] ?? undefined) as
-		| Schema
-		| undefined;
-};
-
-const errorBodySchemas = (): Array<{
-	operationId: string;
-	status: string;
-	schema: Schema | undefined;
-}> => {
-	const found: Array<{
-		operationId: string;
-		status: string;
-		schema: Schema | undefined;
-	}> = [];
-	for (const item of Object.values(OpenAPISpec.paths ?? {})) {
-		for (const operation of Object.values(item ?? {})) {
-			const { operationId, responses } = operation as {
-				operationId?: string;
-				responses?: Record<
-					string,
-					{ content?: Record<string, { schema?: Schema }> }
-				>;
-			};
-			if (!operationId || !responses) continue;
-			for (const [status, response] of Object.entries(responses)) {
-				if (Number(status) < 400) continue;
-				const schema = response.content?.["application/json"]?.schema;
-				if (!schema) continue;
-				found.push({ operationId, status, schema: resolve(schema) });
-			}
-		}
-	}
-	return found;
-};
-
-// Issue #371: one error shape for the whole API. Every JSON refusal body is
-// flat — `code` and `message` at the top level, no `error` envelope — and
-// `code` is required, because it is the only field a client may branch on.
-describe("the declared shape of an error response", () => {
-	it("is a flat object carrying a required code and message", () => {
-		const offenders = errorBodySchemas()
-			.filter(({ schema }) => {
-				const required = schema?.required ?? [];
-				return (
-					schema?.type !== "object" ||
-					!required.includes("code") ||
-					!required.includes("message")
-				);
-			})
-			.map(({ operationId, status }) => `${operationId}.${status}`);
-
-		assert.deepEqual(offenders, []);
-	});
-
-	it("never wraps the body in an envelope property", () => {
-		const offenders = errorBodySchemas()
-			.filter(({ schema }) => schema?.properties?.error !== undefined)
-			.map(({ operationId, status }) => `${operationId}.${status}`);
-
-		assert.deepEqual(offenders, []);
-	});
-});
-
-describe("the built OpenAPI spec", () => {
-	it("declares every query parameter exploded", () => {
-		// openapi-backend splits a non-exploded query value on commas before it
-		// validates, so `?refresh=true` arrives at the validator as `["true"]` and
-		// is refused as "must be boolean" — the handler never runs. Exploded is the
-		// wire-identical form for a scalar, so every `@query` in main.tsp carries
-		// `#{ explode: true }`.
-		const offenders = queryParameters()
-			.filter(({ param }) => param.explode === false)
-			.map(({ operationId, param }) => `${operationId}.${param.name}`);
-
-		assert.deepEqual(offenders, []);
-	});
-});

package/src/request-context.test.ts

@@ -1,61 +0,0 @@
-import assert from "node:assert/strict";
-import { afterEach, describe, it } from "node:test";
-import {
-	getRequestOrigin,
-	resolveAllowedOrigin,
-	runWithRequestContext,
-} from "./request-context.js";
-
-describe("request-context", () => {
-	const originalEnv = process.env.CORS_ALLOWED_ORIGINS;
-
-	afterEach(() => {
-		if (originalEnv === undefined) {
-			process.env.CORS_ALLOWED_ORIGINS = undefined;
-			process.env.CORS_ALLOWED_ORIGINS = "";
-			delete process.env.CORS_ALLOWED_ORIGINS;
-		} else {
-			process.env.CORS_ALLOWED_ORIGINS = originalEnv;
-		}
-	});
-
-	it("stores and retrieves the request origin", () => {
-		runWithRequestContext({ origin: "https://example.com" }, () => {
-			assert.equal(getRequestOrigin(), "https://example.com");
-		});
-	});
-
-	it("returns undefined when no origin is set", () => {
-		runWithRequestContext({}, () => {
-			assert.equal(getRequestOrigin(), undefined);
-		});
-	});
-
-	it("returns star when no allow-list is configured", () => {
-		delete process.env.CORS_ALLOWED_ORIGINS;
-		assert.equal(resolveAllowedOrigin("https://any.com"), "*");
-	});
-
-	it("reflects the request origin when it is allow-listed", () => {
-		process.env.CORS_ALLOWED_ORIGINS =
-			"https://app.example.com,http://localhost:5173";
-		assert.equal(
-			resolveAllowedOrigin("http://localhost:5173"),
-			"http://localhost:5173",
-		);
-	});
-
-	it("falls back to the first allowed origin when the request origin is not allow-listed", () => {
-		process.env.CORS_ALLOWED_ORIGINS =
-			"https://app.example.com,http://localhost:5173";
-		assert.equal(
-			resolveAllowedOrigin("https://evil.example.com"),
-			"https://app.example.com",
-		);
-	});
-
-	it("falls back to the first allowed origin when no request origin is provided", () => {
-		process.env.CORS_ALLOWED_ORIGINS = "https://app.example.com";
-		assert.equal(resolveAllowedOrigin(undefined), "https://app.example.com");
-	});
-});

package/src/request-context.ts

@@ -1,33 +0,0 @@
-import { AsyncLocalStorage } from "node:async_hooks";
-
-interface RequestContext {
-	origin?: string;
-	correlationId?: string;
-}
-
-const storage = new AsyncLocalStorage<RequestContext>();
-
-export const runWithRequestContext = <T>(ctx: RequestContext, fn: () => T): T =>
-	storage.run(ctx, fn);
-
-export const getRequestOrigin = (): string | undefined =>
-	storage.getStore()?.origin;
-
-export const getRequestCorrelationId = (): string | undefined =>
-	storage.getStore()?.correlationId;
-
-const parseAllowedOrigins = (): readonly string[] => {
-	const raw = process.env.CORS_ALLOWED_ORIGINS;
-	if (!raw) return [];
-	return raw
-		.split(",")
-		.map((s) => s.trim())
-		.filter((s) => s.length > 0);
-};
-
-export const resolveAllowedOrigin = (origin: string | undefined): string => {
-	const allowed = parseAllowedOrigins();
-	if (allowed.length === 0) return "*";
-	if (origin && allowed.includes(origin)) return origin;
-	return allowed[0];
-};

package/src/request-pipeline.test.ts

@@ -1,88 +0,0 @@
-/**
- * The two refusals no handler ever sees: a path the spec does not route, and a
- * request the spec refuses before routing. Both are answered by the framework,
- * and both used to leave the one shape the API promises (issue #371) — the
- * unmatched route with no body at all, the refused request with no `code` and
- * with the validator's raw findings beside it.
- */
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
-import { api } from "./index.js";
-import { normalizeRequest } from "./request.js";
-
-const SUB = "cognito-sub-pipeline";
-
-const send = async (
-	method: string,
-	path: string,
-	body?: string,
-): Promise<APIGatewayProxyResult> => {
-	const event = {
-		httpMethod: method,
-		path,
-		body: body ?? null,
-		queryStringParameters: null,
-		headers: body ? { "content-type": "application/json" } : {},
-		requestContext: { authorizer: { claims: { sub: SUB } } },
-	} as unknown as APIGatewayProxyEvent;
-
-	return (await api.handleRequest(
-		normalizeRequest(event),
-		event,
-		{} as never,
-	)) as APIGatewayProxyResult;
-};
-
-describe("a path the spec does not route", () => {
-	it("answers 404 with a body, not an empty one", async () => {
-		const response = await send("GET", "/no-such-resource");
-
-		assert.equal(response.statusCode, 404);
-		assert.deepEqual(JSON.parse(response.body), {
-			code: "not_found",
-			message: "Not found",
-		});
-	});
-});
-
-describe("a request the spec refuses before any handler runs", () => {
-	it("answers 400 with a code and the fields it refused", async () => {
-		const response = await send(
-			"POST",
-			"/calendars",
-			JSON.stringify({ displayName: 42 }),
-		);
-
-		assert.equal(response.statusCode, 400);
-		const body = JSON.parse(response.body) as {
-			code: string;
-			message: string;
-			errors: { path: string; rule: string; message: string }[];
-		};
-
-		assert.equal(body.code, "invalid_request");
-		assert.equal(body.message, "Invalid request");
-		assert.ok(body.errors.length > 0);
-		for (const detail of body.errors) {
-			assert.deepEqual(Object.keys(detail).sort(), ["message", "path", "rule"]);
-			assert.equal(typeof detail.path, "string");
-			assert.equal(typeof detail.rule, "string");
-			assert.equal(typeof detail.message, "string");
-		}
-	});
-
-	// An AJV error also carries `params`, and under `verbose` the rejected value
-	// itself. A refused create body is whatever the caller sent — a password
-	// among the possibilities — so nothing but the three named fields may travel.
-	it("never echoes the value it refused", async () => {
-		const response = await send(
-			"POST",
-			"/accounts",
-			JSON.stringify({ password: "hunter2", imapPort: "not-a-number" }),
-		);
-
-		assert.equal(response.statusCode, 400);
-		assert.ok(!response.body.includes("hunter2"));
-	});
-});

package/src/request.ts

@@ -1,10 +0,0 @@
-import type { APIGatewayProxyEvent } from "aws-lambda";
-import type { Request } from "openapi-backend";
-
-export const normalizeRequest = (event: APIGatewayProxyEvent): Request => ({
-	method: event.httpMethod,
-	path: event.path,
-	query: (event.queryStringParameters ?? {}) as Record<string, string>,
-	body: event.body,
-	headers: (event.headers ?? {}) as Record<string, string>,
-});

package/src/response.test.ts

@@ -1,130 +0,0 @@
-import assert from "node:assert/strict";
-import { afterEach, beforeEach, describe, it } from "node:test";
-import type { Context as OpenAPIContext } from "openapi-backend";
-import { runWithRequestContext } from "./request-context.js";
-import { formatResponse, postResponseHandler } from "./response.js";
-
-type ValidateResponseFn = (
-	response: unknown,
-	operation: unknown,
-) => { valid: boolean; errors?: { instancePath?: string; message?: string }[] };
-
-const makeContext = (
-	response: Record<string, unknown>,
-	validateResponse: ValidateResponseFn,
-): OpenAPIContext => {
-	return {
-		api: { validateResponse },
-		response,
-		operation: { operationId: "testOp" },
-	} as unknown as OpenAPIContext;
-};
-
-describe("postResponseHandler validation gating", () => {
-	const originalStage = process.env.STAGE_NAME;
-
-	beforeEach(() => {
-		delete process.env.STAGE_NAME;
-	});
-
-	afterEach(() => {
-		if (originalStage === undefined) {
-			delete process.env.STAGE_NAME;
-		} else {
-			process.env.STAGE_NAME = originalStage;
-		}
-	});
-
-	it("runs validateResponse when STAGE_NAME is 'dev'", () => {
-		process.env.STAGE_NAME = "dev";
-		let called = false;
-		const validate: ValidateResponseFn = () => {
-			called = true;
-			return { valid: true };
-		};
-		const result = postResponseHandler(makeContext({ items: [] }, validate));
-		assert.equal(called, true);
-		assert.equal(result.statusCode, 200);
-	});
-
-	it("skips validateResponse when STAGE_NAME is 'prod'", () => {
-		process.env.STAGE_NAME = "prod";
-		let called = false;
-		const validate: ValidateResponseFn = () => {
-			called = true;
-			return { valid: true };
-		};
-		const result = postResponseHandler(makeContext({ items: [] }, validate));
-		assert.equal(called, false);
-		assert.equal(result.statusCode, 200);
-	});
-
-	it("skips validateResponse when STAGE_NAME is 'beta'", () => {
-		process.env.STAGE_NAME = "beta";
-		let called = false;
-		const validate: ValidateResponseFn = () => {
-			called = true;
-			return { valid: true };
-		};
-		postResponseHandler(makeContext({ items: [] }, validate));
-		assert.equal(called, false);
-	});
-
-	it("skips validateResponse when STAGE_NAME is unset", () => {
-		let called = false;
-		const validate: ValidateResponseFn = () => {
-			called = true;
-			return { valid: true };
-		};
-		postResponseHandler(makeContext({ items: [] }, validate));
-		assert.equal(called, false);
-	});
-
-	it("returns the formatted error response when statusCode is set, regardless of stage", () => {
-		process.env.STAGE_NAME = "dev";
-		let called = false;
-		const validate: ValidateResponseFn = () => {
-			called = true;
-			return { valid: true };
-		};
-		const result = postResponseHandler(
-			makeContext({ statusCode: 404, message: "Not Found" }, validate),
-		);
-		assert.equal(called, false);
-		assert.equal(result.statusCode, 404);
-	});
-
-	it("returns 200 with the response body when validation fails in dev", () => {
-		process.env.STAGE_NAME = "dev";
-		const validate: ValidateResponseFn = () => ({
-			valid: false,
-			errors: [{ instancePath: "/items/0/id", message: "must be string" }],
-		});
-		const result = postResponseHandler(
-			makeContext({ items: [{ id: 42 }] }, validate),
-		);
-		assert.equal(result.statusCode, 200);
-	});
-});
-
-// A bug report quotes the correlation id off the failing response. Without the
-// header it reads "(none)" and there is nothing to grep the server logs for.
-describe("the correlation id travels back on the response", () => {
-	it("carries the request's id, and exposes the header to the browser", () => {
-		const result = runWithRequestContext({ correlationId: "req-604" }, () =>
-			formatResponse({ message: "Conflict" }, 409),
-		);
-
-		assert.equal(result.headers?.["x-correlation-id"], "req-604");
-		assert.match(
-			String(result.headers?.["Access-Control-Expose-Headers"]),
-			/x-correlation-id/,
-		);
-	});
-
-	it("omits the header when the request carried no id", () => {
-		const result = formatResponse({ message: "Conflict" }, 409);
-
-		assert.equal(result.headers?.["x-correlation-id"], undefined);
-	});
-});