@remit/backend 0.0.144 → 0.0.145

package/dist/src/handlers/system-update.js

@@ -2,15 +2,11 @@ import { randomUUID } from "node:crypto";
 import { readFileSync, renameSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { ConflictError, HTTPError } from "@remit/data-ports/errors";
-import { getSubFromEvent } from "../auth.js";
 import { defaultErrorCode } from "../error.js";
 class TargetVersionMismatchError extends HTTPError {
     name = "TargetVersionMismatchError";
     statusCode = 422;
 }
-const DEFAULT_CONTROL_DIR = "/data/control";
-const controlDir = () => process.env.REMIT_UPDATE_CONTROL_DIR ?? DEFAULT_CONTROL_DIR;
-const manifestUrl = () => process.env.REMIT_UPDATE_MANIFEST_URL;
 /**
  * The running version is a fact the updater owns: it reads the tag from `.env`
  * and writes it into `state.json`, which is the only honest source across an
@@ -33,24 +29,23 @@ const refuse = (statusCode, message) => ({
     body: { code: defaultErrorCode(statusCode), message },
 });
 const notFound = () => refuse(404, "Not found");
-const unauthorized = () => refuse(401, "Unauthorized");
 /**
  * The self-update seam is off unless a manifest URL is configured (RFC 037 D8),
  * which the hosted deployment leaves unset. Both endpoints answer 404 in that
  * case. Where it is on, any authenticated caller may use it — the account list
  * is the trust boundary of a self-hosted instance.
  */
-const guardManifestConfigured = () => manifestUrl() ? null : notFound();
+const guardManifestConfigured = (config) => config.selfUpdate === "Enabled" ? null : notFound();
 /**
  * Read `state.json` off the control volume. A missing file is an instance that
  * has never checked or updated (RFC 037 D8), not an error, so it reads as
  * `null`; the caller renders the disabled/empty resource. Any other read or
  * parse failure propagates.
  */
-const readState = () => {
+const readState = (controlDir) => {
     let raw;
     try {
-        raw = readFileSync(join(controlDir(), "state.json"), "utf8");
+        raw = readFileSync(join(controlDir, "state.json"), "utf8");
     }
     catch (error) {
         if (error.code === "ENOENT")
@@ -78,8 +73,7 @@ const checkedVersion = (state) => state?.check.status === "ok" ? state.check.lat
  * so the backend never writes one. The temp file sits in the same directory as
  * the target for the rename to be atomic on one filesystem.
  */
-const writeRequest = (request) => {
-    const dir = controlDir();
+const writeRequest = (dir, request) => {
     const tmp = join(dir, `.request.json.${request.runId}.tmp`);
     writeFileSync(tmp, JSON.stringify(request), { mode: 0o644 });
     renameSync(tmp, join(dir, "request.json"));
@@ -91,8 +85,7 @@ const writeRequest = (request) => {
  * request.json it is written atomically and carries no authority: its presence
  * is the whole message, so it is empty.
  */
-const writeCheckRequest = () => {
-    const dir = controlDir();
+const writeCheckRequest = (dir) => {
     const tmp = join(dir, `.check-request.json.tmp`);
     writeFileSync(tmp, JSON.stringify({}), { mode: 0o644 });
     renameSync(tmp, join(dir, "check-request.json"));
@@ -123,13 +116,10 @@ const requestedResource = (state, runId, targetVersion, requestedAt) => {
     };
 };
 export const SystemOperations = {
-    SystemOperations_getSystemUpdate: async (context, ...args) => {
-        const offSurface = guardManifestConfigured();
+    SystemOperations_getSystemUpdate: async (context, ctx) => {
+        const offSurface = guardManifestConfigured(ctx.config);
         if (offSurface)
             return offSurface;
-        const event = args[0];
-        if (!getSubFromEvent(event))
-            return unauthorized();
         // A refresh asks for a fresh answer, and only the updater can fetch one, so
         // the request goes on the control seam for its watch loop to pick up (#599).
         // The answer is the stored state as it stands, `lastCheckedAt` included: the
@@ -137,19 +127,16 @@ export const SystemOperations = {
         // response never has to claim a verdict the updater has not reached.
         const { refresh } = context.request.query;
         if (refresh === true)
-            writeCheckRequest();
-        return readState() ?? emptyResource();
+            writeCheckRequest(ctx.config.updateControlDir);
+        return readState(ctx.config.updateControlDir) ?? emptyResource();
     },
-    SystemOperations_applySystemUpdate: async (context, ...args) => {
-        const offSurface = guardManifestConfigured();
+    SystemOperations_applySystemUpdate: async (context, ctx) => {
+        const offSurface = guardManifestConfigured(ctx.config);
         if (offSurface)
             return offSurface;
-        const event = args[0];
-        const sub = getSubFromEvent(event);
-        if (!sub)
-            return unauthorized();
+        const sub = ctx.identity.sub;
         const { targetVersion } = context.request.requestBody;
-        const state = readState();
+        const state = readState(ctx.config.updateControlDir);
         if (isRunInFlight(state?.run)) {
             throw new ConflictError("An update is already in progress.");
         }
@@ -158,7 +145,7 @@ export const SystemOperations = {
         }
         const runId = randomUUID();
         const requestedAt = new Date().toISOString();
-        writeRequest({
+        writeRequest(ctx.config.updateControlDir, {
             runId,
             targetVersion,
             requestedAt,

package/dist/src/handlers/thread.js

@@ -1,9 +1,7 @@
 import { NotFoundError } from "@remit/data-ports/errors";
 import { isValidMessageId } from "@remit/data-ports/id";
-import { getAccountConfigIdFromEvent } from "../auth.js";
 import { enrichThreadRows, } from "../derive/enrichThreadRows.js";
 import { filterByOffRowCriteria, hasOffRowCriteria, } from "../derive/filterThreadCriteria.js";
-import { getClient } from "../service/data-client.js";
 const DEFAULT_THREADS_PAGE_SIZE = 50;
 // Project to fields used by ListThreadsResponse — keep in sync with handler mapping.
 // Includes ThreadMessage table key fields (accountConfigId, threadMessageId) and
@@ -183,12 +181,11 @@ export const dedupeThreadMessages = (rows) => {
     });
 };
 export const ThreadOperations = {
-    ThreadOperations_listThreads: async (context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
+    ThreadOperations_listThreads: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
         const { mailboxId } = context.request.params;
         const { continuationToken, order } = context.request.query;
-        const client = await getClient();
+        const client = ctx.client;
         const result = await client.threadMessage.listByMailbox(accountConfigId, mailboxId, buildListThreadsOptions({ continuationToken, order }));
         const items = await enrichThreadRows(result.items, client, accountConfigId);
         return {
@@ -196,12 +193,11 @@ export const ThreadOperations = {
             continuationToken: result.continuationToken,
         };
     },
-    ThreadOperations_searchThreads: async (context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
+    ThreadOperations_searchThreads: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
         const { mailboxId } = context.request.params;
         const raw = context.request.query;
-        return executeThreadSearch(await getClient(), accountConfigId, mailboxId, {
+        return executeThreadSearch(ctx.client, accountConfigId, mailboxId, {
             ...raw,
             senderTrust: toArray(raw.senderTrust),
             category: toArray(raw.category),
@@ -209,12 +205,11 @@ export const ThreadOperations = {
     },
 };
 export const ThreadDetailOperations = {
-    ThreadDetailOperations_listThreadMessages: async (context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
+    ThreadDetailOperations_listThreadMessages: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
         const { threadId } = context.request.params;
         const { order } = context.request.query;
-        const client = await getClient();
+        const client = ctx.client;
         const result = await client.threadMessage.listByThread(threadId, accountConfigId, buildListThreadMessagesOptions({ order }));
         // Defense-in-depth: the query is already scoped to accountConfigId; assert
         // no foreign row slips into the response. `read`-class → 404, no existence

package/dist/src/handlers/unified-threads.js

@@ -1,9 +1,7 @@
 import { isVirtualCopyMailbox } from "@remit/data-ports/virtual-copy";
 import { MailboxSpecialUse } from "@remit/domain-enums";
 import pMap from "p-map";
-import { getAccountConfigIdFromEvent } from "../auth.js";
 import { enrichThreadRows, } from "../derive/enrichThreadRows.js";
-import { getClient } from "../service/data-client.js";
 import { groupAccountOverrides, groupMailboxOverrides, } from "./account-overrides.js";
 const DEFAULT_UNIFIED_THREADS_PAGE_SIZE = 50;
 const MAILBOX_LIST_CONCURRENCY = 5;
@@ -374,9 +372,8 @@ const toBoolean = (value) => {
     return undefined;
 };
 export const UnifiedThreadOperations = {
-    UnifiedThreadOperations_listAllThreads: async (context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
+    UnifiedThreadOperations_listAllThreads: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
         const { continuationToken, order, limit, starred, query, from, subject, accountId, mailboxId, category, unread, attachments, muted, count, results, } = context.request.query;
         // Whitespace-only text is not a search: it would widen the scope to every
         // folder while matching nothing in particular. The two field parameters
@@ -384,7 +381,7 @@ export const UnifiedThreadOperations = {
         const searchText = query?.trim();
         const fromText = from?.trim();
         const subjectText = subject?.trim();
-        return executeUnifiedThreadListing(await getClient(), accountConfigId, {
+        return executeUnifiedThreadListing(ctx.client, accountConfigId, {
             continuationToken,
             order,
             limit,

package/dist/src/index.d.ts

@@ -1,2 +1,5 @@
-export { api, handleApiEvent, OpenAPISpec } from "./api.js";
+export { OpenAPISpec } from "./api.js";
+export { configFromEnv } from "./config/from-env.js";
+export { createApiEventHandler } from "./lambda.js";
+export declare const handleApiEvent: import("./lambda.js").ApiEventHandler;
 export declare const handler: (event: import("aws-lambda").APIGatewayProxyEvent, context: import("aws-lambda").Context) => Promise<import("aws-lambda").APIGatewayProxyResult>;

package/dist/src/index.js

@@ -1,9 +1,25 @@
 import { inspect } from "node:util";
 import { logger } from "@remit/logger";
 import { installNodeLogger, withTelemetry } from "@remit/logger-lambda/node";
-import { handleApiEvent } from "./api.js";
+import { assertLocalBypassNotInDeployedEnv, localIdentityFromEnv, } from "./auth.js";
+import { configFromEnv } from "./config/from-env.js";
+import { handlers, publicHandlers } from "./handlers/index.js";
+import { createApiEventHandler } from "./lambda.js";
+import { serveApi } from "./serve.js";
+import { getClient } from "./service/data-client.js";
 installNodeLogger();
-export { api, handleApiEvent, OpenAPISpec } from "./api.js";
+// Boot-time refusal: the local auth-bypass overrides must never be set in a
+// deployed environment, so a leaked env var fails the process at startup
+// rather than silently opening authentication at runtime.
+assertLocalBypassNotInDeployedEnv(process.env);
+export { OpenAPISpec } from "./api.js";
+export { configFromEnv } from "./config/from-env.js";
+export { createApiEventHandler } from "./lambda.js";
+export const handleApiEvent = createApiEventHandler(serveApi({ handlers, publicHandlers }), {
+    config: configFromEnv(process.env),
+    localIdentity: localIdentityFromEnv(process.env),
+    client: getClient,
+});
 /**
  * Last-resort net for a leaked background rejection.
  *

package/dist/src/jwt-auth.d.ts

@@ -1,18 +1,15 @@
 import { type JwtVerifier } from "@remit/auth-service/verifier";
-import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
+import type { APIGatewayProxyEvent } from "aws-lambda";
+import type { HandlerIdentity } from "./types.js";
 /** Test-only override for the memoized verifier. Pass null to reset. */
 export declare const _setVerifierForTest: (v: JwtVerifier | null) => void;
 /**
- * Authenticate a self-host request from a better-auth RS256 JWT.
+ * The caller of a self-host request, from a better-auth RS256 JWT.
  *
- * On a valid token the verified `sub` is injected into the event's authorizer
- * claims, exactly where the Cognito authorizer puts it, so every downstream
- * handler reads identity through the unchanged `auth.ts` path. Returns a 401
- * response (not null) when a token is present but fails verification, or when no
- * token is supplied and no local test bypass is configured. Returns null to let
- * the request proceed.
- *
- * When the edge tier (APISIX) has already verified and injected claims, this is
- * a no-op — the backend trusts pre-populated claims and re-verifies otherwise.
+ * Claims the edge tier (APISIX) already verified and injected are trusted as
+ * they stand. Otherwise a bearer token is verified here; a token that fails
+ * verification is an anonymous caller, so the operation table answers 401. With
+ * no token the local bypass, when one is configured, is the caller. Only an
+ * operation that needs a caller resolves this, so a public route never does.
  */
-export declare const authenticateSelfHostRequest: (event: APIGatewayProxyEvent) => Promise<APIGatewayProxyResult | null>;
+export declare const identityFromSelfHostRequest: (event: APIGatewayProxyEvent, localIdentity: HandlerIdentity) => Promise<HandlerIdentity>;

package/dist/src/jwt-auth.js

@@ -1,8 +1,6 @@
 import { createJwtVerifier, extractBearerToken, resolveVerifierConfig, } from "@remit/auth-service/verifier";
-import { readCalendarFeedToken } from "@remit/calendar-service";
 import { logger } from "@remit/logger";
-import { defaultErrorCode } from "./error.js";
-import { formatResponse } from "./response.js";
+import { getIdentityFromEvent, userFromClaims } from "./auth.js";
 let verifier = null;
 const getVerifier = () => {
     if (!verifier)
@@ -20,78 +18,28 @@ const readHeader = (headers, name) => {
     }
     return undefined;
 };
-const unauthorized = (message) => formatResponse({ code: defaultErrorCode(401), message }, 401);
-const injectClaims = (event, sub, email) => {
-    event.requestContext = {
-        ...event.requestContext,
-        authorizer: {
-            ...event.requestContext?.authorizer,
-            claims: {
-                sub,
-                email: email ?? "",
-            },
-        },
-    };
-};
-const hasLocalBypass = () => Boolean(process.env.LOCAL_ACCOUNT_CONFIG_ID);
-/**
- * The routes that run without a token.
- *
- * Microsoft redirects the browser here after consent, so the request carries no
- * Authorization header and no session to derive one from. The handler takes its
- * identity from the HMAC-signed `state` parameter and validates it there; that
- * signature is the gate, not a JWT.
- *
- * A calendar feed carries its credential in the path for the same reason: a
- * subscribed client polls a URL and has no session to present, so the token is
- * the gate and the handler compares it against a stored hash.
- *
- * Hardcoded, matching the edge exemption in packages/apisix/src/route-table.ts.
- * `@useAuth(NoAuth)` in the spec does not open a path here — a future public
- * route is added by hand.
- */
-const PUBLIC_ROUTES = [
-    {
-        method: "GET",
-        matches: (path) => path === "/accounts/oauth/microsoft/callback",
-    },
-    {
-        method: "GET",
-        matches: (path) => readCalendarFeedToken(path) !== null,
-    },
-];
-const isPublicRoute = (event) => PUBLIC_ROUTES.some((route) => route.method === event.httpMethod && route.matches(event.path));
 /**
- * Authenticate a self-host request from a better-auth RS256 JWT.
+ * The caller of a self-host request, from a better-auth RS256 JWT.
  *
- * On a valid token the verified `sub` is injected into the event's authorizer
- * claims, exactly where the Cognito authorizer puts it, so every downstream
- * handler reads identity through the unchanged `auth.ts` path. Returns a 401
- * response (not null) when a token is present but fails verification, or when no
- * token is supplied and no local test bypass is configured. Returns null to let
- * the request proceed.
- *
- * When the edge tier (APISIX) has already verified and injected claims, this is
- * a no-op — the backend trusts pre-populated claims and re-verifies otherwise.
+ * Claims the edge tier (APISIX) already verified and injected are trusted as
+ * they stand. Otherwise a bearer token is verified here; a token that fails
+ * verification is an anonymous caller, so the operation table answers 401. With
+ * no token the local bypass, when one is configured, is the caller. Only an
+ * operation that needs a caller resolves this, so a public route never does.
  */
-export const authenticateSelfHostRequest = async (event) => {
-    if (isPublicRoute(event))
-        return null;
+export const identityFromSelfHostRequest = async (event, localIdentity) => {
     const existingSub = event.requestContext?.authorizer?.claims?.sub;
-    if (typeof existingSub === "string" && existingSub.length > 0)
-        return null;
-    const token = extractBearerToken(readHeader(event.headers, "authorization"));
-    if (token) {
-        const claims = await getVerifier()(token).catch((err) => {
-            logger.warn({ err: err instanceof Error ? err.message : String(err) }, "better-auth JWT verification failed");
-            return null;
-        });
-        if (!claims)
-            return unauthorized("Invalid or expired token");
-        injectClaims(event, claims.sub, claims.email);
-        return null;
+    if (typeof existingSub === "string" && existingSub.length > 0) {
+        return getIdentityFromEvent(event, localIdentity);
     }
-    if (hasLocalBypass())
+    const token = extractBearerToken(readHeader(event.headers, "authorization"));
+    if (!token)
+        return localIdentity;
+    const claims = await getVerifier()(token).catch((err) => {
+        logger.warn({ err: err instanceof Error ? err.message : String(err) }, "better-auth JWT verification failed");
         return null;
-    return unauthorized("Authentication required");
+    });
+    if (!claims)
+        return { kind: "anonymous" };
+    return userFromClaims(claims.sub, claims.email);
 };

package/dist/src/lambda.d.ts

@@ -0,0 +1,13 @@
+import type { APIGatewayProxyEvent, APIGatewayProxyResult, Context } from "aws-lambda";
+import type { ApiConfig } from "./config/api-config.js";
+import type { ServedApi } from "./serve.js";
+import type { RemitClient } from "./service/data-client.js";
+import type { QueueName } from "./service/queues.js";
+import type { HandlerIdentity } from "./types.js";
+export interface ApiEventHandlerOptions<K extends QueueName> {
+    config: ApiConfig;
+    localIdentity: HandlerIdentity;
+    client: () => Promise<RemitClient<K>>;
+}
+export type ApiEventHandler = (event: APIGatewayProxyEvent, context: Context) => Promise<APIGatewayProxyResult>;
+export declare const createApiEventHandler: <K extends QueueName>(served: ServedApi<K>, { config, localIdentity, client }: ApiEventHandlerOptions<NoInfer<K>>) => ApiEventHandler;

package/dist/src/lambda.js

@@ -0,0 +1,33 @@
+import { getIdentityFromEvent } from "./auth.js";
+import { identityFromSelfHostRequest } from "./jwt-auth.js";
+import { normalizeRequest } from "./request.js";
+const queryOf = (event) => {
+    if (event.multiValueQueryStringParameters) {
+        return event.multiValueQueryStringParameters;
+    }
+    return Object.fromEntries(Object.entries(event.queryStringParameters ?? {}).map(([key, value]) => [
+        key,
+        value === undefined ? undefined : [value],
+    ]));
+};
+const headersOf = (event) => ({
+    ...event.headers,
+    ...Object.fromEntries(Object.entries(event.multiValueHeaders ?? {}).map(([name, values]) => [
+        name,
+        values?.join(", "),
+    ])),
+});
+const normalizeApiGatewayEvent = (event) => normalizeRequest({
+    method: event.httpMethod,
+    path: event.path,
+    query: queryOf(event),
+    headers: headersOf(event),
+    body: event.body,
+});
+export const createApiEventHandler = (served, { config, localIdentity, client }) => (event, context) => served.dispatch(normalizeApiGatewayEvent(event), {
+    config,
+    client,
+    identity: async () => config.auth.mode === "BetterAuthJwt"
+        ? identityFromSelfHostRequest(event, localIdentity)
+        : getIdentityFromEvent(event, localIdentity),
+}, context.awsRequestId);

package/dist/src/request.d.ts

@@ -1,3 +1,9 @@
-import type { APIGatewayProxyEvent } from "aws-lambda";
 import type { Request } from "openapi-backend";
-export declare const normalizeRequest: (event: APIGatewayProxyEvent) => Request;
+export interface HostRequest {
+    method: string;
+    path: string;
+    query: Readonly<Record<string, readonly string[] | undefined>> | null;
+    headers: Readonly<Record<string, string | undefined>> | null;
+    body: string | null;
+}
+export declare const normalizeRequest: (request: HostRequest) => Request;

package/dist/src/request.js

@@ -1,7 +1,17 @@
-export const normalizeRequest = (event) => ({
-    method: event.httpMethod,
-    path: event.path,
-    query: (event.queryStringParameters ?? {}),
-    body: event.body,
-    headers: (event.headers ?? {}),
+const definedHeaders = (map) => Object.fromEntries(Object.entries(map ?? {}).filter((entry) => entry[1] !== undefined));
+const collapsedQuery = (map) => {
+    const query = {};
+    for (const [key, values] of Object.entries(map ?? {})) {
+        if (!values || values.length === 0)
+            continue;
+        query[key] = values.length === 1 ? values[0] : [...values];
+    }
+    return query;
+};
+export const normalizeRequest = (request) => ({
+    method: request.method,
+    path: request.path,
+    query: collapsedQuery(request.query),
+    body: request.body === "" ? null : request.body,
+    headers: definedHeaders(request.headers),
 });

package/dist/src/response.d.ts

@@ -1,5 +1,6 @@
 import type { APIGatewayProxyResult } from "aws-lambda";
 import type { Context as OpenAPIContext } from "openapi-backend";
+import type { ApiConfig } from "./config/api-config.js";
 declare const RAW_API_RESPONSE: unique symbol;
 /**
  * A response the caller reads by something other than its JSON body — an
@@ -10,8 +11,8 @@ declare const RAW_API_RESPONSE: unique symbol;
  * stays the default; a handler that has to own its own media type or headers
  * says so with `rawApiResponse` rather than by returning a shape this one has
  * to guess at.
- * The CORS and correlation headers are still added here, so a raw response is
- * not a way around them.
+ * `dispatch` still adds the envelope headers, so a raw response is not a way
+ * around them.
  */
 export interface RawApiResponse {
     statusCode: number;
@@ -22,6 +23,22 @@ type MarkedRawApiResponse = RawApiResponse & {
     readonly [RAW_API_RESPONSE]: true;
 };
 export declare const rawApiResponse: (response: RawApiResponse) => MarkedRawApiResponse;
+/**
+ * The headers every response carries whatever its body is: the CORS grant the
+ * browser needs, and the id the request's log lines are already tagged with.
+ * Returning that id is what makes a bug report's "correlation id" resolve to a
+ * server-side line; the browser can only read a non-safelisted header when it
+ * is exposed.
+ */
+export interface EnvelopeInput {
+    origin: string | undefined;
+    allowedOrigins: readonly string[];
+    correlationId: string;
+}
+export declare const resolveAllowedOrigin: (origin: string | undefined, allowed: readonly string[]) => string;
+export declare const envelopeHeaders: ({ origin, allowedOrigins, correlationId, }: EnvelopeInput) => Record<string, string>;
 export declare const formatResponse: (body: Record<string, unknown>, statusCode?: number) => APIGatewayProxyResult;
-export declare const postResponseHandler: (context: OpenAPIContext) => APIGatewayProxyResult;
+export declare const postResponseHandler: (context: OpenAPIContext, scope: {
+    config: ApiConfig;
+}) => APIGatewayProxyResult;
 export {};

package/dist/src/response.js

@@ -1,17 +1,16 @@
 import { logger } from "@remit/logger";
-import { getRequestCorrelationId, getRequestOrigin, resolveAllowedOrigin, } from "./request-context.js";
 const RAW_API_RESPONSE = Symbol("remit.rawApiResponse");
 export const rawApiResponse = (response) => Object.assign(response, { [RAW_API_RESPONSE]: true });
 const isRawApiResponse = (body) => RAW_API_RESPONSE in body;
-/**
- * The headers every response carries whatever its body is: the CORS grant the
- * browser needs, and the id the request's log lines are already tagged with.
- * Returning that id is what makes a bug report's "correlation id" resolve to a
- * server-side line; the browser can only read a non-safelisted header when it
- * is exposed.
- */
-const envelopeHeaders = () => {
-    const allowOrigin = resolveAllowedOrigin(getRequestOrigin());
+export const resolveAllowedOrigin = (origin, allowed) => {
+    if (allowed.length === 0)
+        return "*";
+    if (origin && allowed.includes(origin))
+        return origin;
+    return allowed[0];
+};
+export const envelopeHeaders = ({ origin, allowedOrigins, correlationId, }) => {
+    const allowOrigin = resolveAllowedOrigin(origin, allowedOrigins);
     const headers = {
         "Access-Control-Allow-Origin": allowOrigin,
         "Access-Control-Allow-Headers": "Authorization,Content-Type",
@@ -21,11 +20,8 @@ const envelopeHeaders = () => {
     if (allowOrigin !== "*") {
         headers["Access-Control-Allow-Credentials"] = "true";
     }
-    const correlationId = getRequestCorrelationId();
-    if (correlationId) {
-        headers["x-correlation-id"] = correlationId;
-        headers["Access-Control-Expose-Headers"] = "x-correlation-id";
-    }
+    headers["x-correlation-id"] = correlationId;
+    headers["Access-Control-Expose-Headers"] = "x-correlation-id";
     return headers;
 };
 export const formatResponse = (body, statusCode = 200) => {
@@ -36,7 +32,7 @@ export const formatResponse = (body, statusCode = 200) => {
         logger.debug({ statusCode: body.statusCode }, "response");
         return {
             statusCode: body.statusCode,
-            headers: { ...envelopeHeaders(), ...body.headers },
+            headers: body.headers,
             body: body.body,
         };
     }
@@ -46,18 +42,15 @@ export const formatResponse = (body, statusCode = 200) => {
     logger.debug({ statusCode }, "response");
     return {
         statusCode: statusCode,
-        headers: {
-            "Content-Type": "application/json",
-            ...envelopeHeaders(),
-        },
+        headers: { "Content-Type": "application/json" },
         body: JSON.stringify(body),
     };
 };
-export const postResponseHandler = (context) => {
+export const postResponseHandler = (context, scope) => {
     const { api, response, operation } = context;
     if (response.statusCode)
         return formatResponse(response, response.statusCode);
-    if (process.env.STAGE_NAME !== "dev")
+    if (scope.config.responseValidation === "Skip")
         return formatResponse(response, 200);
     const { valid, errors } = api.validateResponse(response, operation);
     if (valid)

package/dist/src/serve.d.ts

@@ -0,0 +1,31 @@
+import type { APIGatewayProxyResult } from "aws-lambda";
+import type { Request as OpenAPIRequest } from "openapi-backend";
+import type { ApiConfig } from "./config/api-config.js";
+import type { RemitClient } from "./service/data-client.js";
+import type { QueueName } from "./service/queues.js";
+import type { HandlerIdentity, OperationHandler, OperationIds, PublicOperationHandler, PublicOperationIds } from "./types.js";
+export type { ApiConfig } from "./config/api-config.js";
+export type { HandlerContext, HandlerIdentity, PublicHandlerContext, UserIdentity, } from "./types.js";
+export interface RequestHost<K extends QueueName> {
+    config: ApiConfig;
+    client: () => Promise<RemitClient<K>>;
+    identity: () => Promise<HandlerIdentity>;
+}
+/**
+ * The operations a host serves, each typed by the queues it sends to. An
+ * operation the host leaves out answers 501.
+ */
+export interface ApiRegistry<K extends QueueName> {
+    handlers: Partial<Record<Exclude<OperationIds, PublicOperationIds>, OperationHandler<OperationIds, K>>>;
+    publicHandlers: Partial<Record<PublicOperationIds, PublicOperationHandler<K>>>;
+}
+export interface ServedApi<K extends QueueName> {
+    dispatch: (request: OpenAPIRequest, host: RequestHost<K>, correlationId: string) => Promise<APIGatewayProxyResult>;
+    handleFetch: (request: Request, host: RequestHost<K>, correlationId: string) => Promise<Response>;
+}
+/**
+ * Register a host's operations and return the two ways in: a normalised
+ * request, or a Fetch `Request`. Each request's host supplies the client, and
+ * the client's queues must cover every operation in the registry.
+ */
+export declare const serveApi: <K extends QueueName>(registry: ApiRegistry<NoInfer<K>>) => ServedApi<K>;