@remit/backend 0.0.144 → 0.0.146

package/dist/src/api.d.ts

@@ -1,7 +1,5 @@
-import type { APIGatewayProxyEvent, APIGatewayProxyResult, Context } from "aws-lambda";
 import { type Document, OpenAPIBackend } from "openapi-backend";
 export declare const OpenAPISpec: Document;
 declare const api: OpenAPIBackend;
 export { setLogger } from "@remit/logger";
 export { api };
-export declare const handleApiEvent: (event: APIGatewayProxyEvent, context: Context) => Promise<APIGatewayProxyResult>;

package/dist/src/api.js

@@ -1,19 +1,9 @@
 import spec from "@remit/api-openapi-spec/openapi.json" with { type: "json" };
 import { redactCalendarFeedPath } from "@remit/calendar-service";
-import { logger, withLogContext } from "@remit/logger";
+import { logger } from "@remit/logger";
 import { OpenAPIBackend, } from "openapi-backend";
-import { assertLocalBypassNotInDeployedEnv } from "./auth.js";
-import { usesBetterAuthJwt } from "./data-backend.js";
-import { defaultErrorCode, handleError } from "./error.js";
-import { handlers } from "./handlers/index.js";
-import { authenticateSelfHostRequest } from "./jwt-auth.js";
-import { normalizeRequest } from "./request.js";
-import { runWithRequestContext } from "./request-context.js";
-import { formatResponse, postResponseHandler } from "./response.js";
-// Boot-time refusal: the local auth-bypass overrides must never be set in a
-// deployed environment. Runs on module load so a leaked env var fails the
-// process at startup rather than silently opening authentication at runtime.
-assertLocalBypassNotInDeployedEnv();
+import { defaultErrorCode } from "./error.js";
+import { postResponseHandler } from "./response.js";
 const isDocument = (value) => typeof value === "object" &&
     value !== null &&
     "openapi" in value &&
@@ -55,10 +45,10 @@ const validationDetails = (errors) => (errors ?? []).map((error) => ({
 // holds the caller's headers and cookies — an Authorization bearer among them,
 // and for a calendar feed the token in the path is itself the credential
 // (issue #1065). The path is redacted the same way the request scope redacts it.
-api.register("validationFail", (c, req) => {
+api.register("validationFail", (c) => {
     logger.error({
         errors: c.validation.errors,
-        path: redactCalendarFeedPath(req.path),
+        path: redactCalendarFeedPath(c.request.path),
         operation: c.operation?.operationId,
     }, "Validation failed");
     return {
@@ -74,71 +64,10 @@ api.register("notFound", () => ({
     statusCode: 404,
     body: { code: defaultErrorCode(404), message: "Not found" },
 }));
-api.register("notImplemented", async (c) => {
-    const { status, mock } = api.mockResponseForOperation(c.operation.operationId);
-    return formatResponse(mock, status);
-});
-api.register(handlers);
+api.register("notImplemented", () => ({
+    statusCode: 501,
+    body: { code: defaultErrorCode(501), message: "Not implemented" },
+}));
 api.init();
 export { setLogger } from "@remit/logger";
 export { api };
-const readOriginHeader = (headers) => {
-    if (!headers)
-        return undefined;
-    for (const [key, value] of Object.entries(headers)) {
-        if (key.toLowerCase() === "origin" && typeof value === "string") {
-            return value;
-        }
-    }
-    return undefined;
-};
-// A scope, not `logger.setBindings`: this process serves requests concurrently,
-// and bindings on the shared logger belong to whichever request wrote them last,
-// so a line gets attributed to the wrong request. The scope follows the request
-// through its own async continuations and nothing else. It nests inside the one
-// `withTelemetry` opens, which is where `requestId` comes from.
-export const handleApiEvent = async (event, context) => {
-    // A calendar feed carries its credential in the path, so the raw path is a
-    // secret and cannot be a log field (issue #1065). Redacted once, here, where
-    // every line inside the request picks it up from the scope.
-    const path = redactCalendarFeedPath(event.path);
-    return withLogContext({
-        path,
-        method: event.httpMethod,
-    }, async () => {
-        logger.debug({ method: event.httpMethod, path }, "Request received");
-        const origin = readOriginHeader(event.headers);
-        const startedAt = Date.now();
-        // Capture the correlation id here: it is seeded by
-        // runWithRequestContext below (from context.awsRequestId), but that
-        // AsyncLocalStorage scope does not reliably survive the
-        // openapi-backend handleRequest call chain, so we read it from
-        // `context.awsRequestId` directly rather than via
-        // getRequestCorrelationId at log time.
-        const correlationId = context.awsRequestId;
-        const result = await runWithRequestContext({ origin, correlationId }, async () => {
-            if (usesBetterAuthJwt()) {
-                const denied = await authenticateSelfHostRequest(event);
-                if (denied)
-                    return denied;
-            }
-            return api
-                .handleRequest(normalizeRequest(event), event, context)
-                .catch(handleError);
-        });
-        // One structured access line per request: method, path, status, and
-        // duration. The correlation id is inlined as a top-level field so a bug
-        // report quoting the id can grep logs by it directly, and emitted at
-        // info so it is on by default in production (the debug "Request
-        // received" above already filters out under normal log levels).
-        // biome-ignore lint/plugin/no-logger-info: one access line per request is an audit-grade signal (issue #1054)
-        logger.info({
-            method: event.httpMethod,
-            path,
-            statusCode: result.statusCode,
-            durationMs: Date.now() - startedAt,
-            correlationId,
-        }, "Request completed");
-        return result;
-    });
-};

package/dist/src/auth.d.ts

@@ -1,4 +1,5 @@
 import type { APIGatewayProxyEvent } from "aws-lambda";
+import type { HandlerIdentity } from "./types.js";
 /**
  * The LOCAL_ACCOUNT_CONFIG_ID / LOCAL_COGNITO_SUB overrides bypass authentication
  * for local dev and fixtures: with them set, an unauthenticated request is served
@@ -6,25 +7,18 @@ import type { APIGatewayProxyEvent } from "aws-lambda";
  * start (throw at module load) if either is present outside a local NODE_ENV — the
  * same `development`/`test` signal the data layer already uses to decide local vs
  * deployed. Fail loud rather than silently ignore, so a leaked env var is caught at
- * boot, not exploited at runtime.
+ * boot, not exploited at runtime. In a local NODE_ENV the bypass is read here
+ * once, so a bypass set without LOCAL_EMAIL also fails at boot.
  */
-export declare const assertLocalBypassNotInDeployedEnv: (env?: NodeJS.ProcessEnv) => void;
+export declare const assertLocalBypassNotInDeployedEnv: (env: NodeJS.ProcessEnv) => void;
+export declare const userFromClaims: (sub: string, email: string | undefined) => HandlerIdentity;
+export declare const localIdentityFromEnv: (env: NodeJS.ProcessEnv) => HandlerIdentity;
 /**
- * Return the Cognito `sub` for the current request, preferring the JWT claim
- * and falling back to `LOCAL_COGNITO_SUB` for local development. Returns
- * `undefined` when neither is available (e.g. seeded fixtures that only set
- * `LOCAL_ACCOUNT_CONFIG_ID`).
+ * The caller of an API Gateway event. Production reads the Cognito `sub` and
+ * `email` claims (verified by the authorizer, or by `jwt-auth.ts` on
+ * self-host) and derives the accountConfigId via UUIDv5. Local development
+ * honours `LOCAL_ACCOUNT_CONFIG_ID` (a pinned seeded config) and
+ * `LOCAL_COGNITO_SUB` (a pinned sub, derived like production), read once at
+ * boot into `localIdentity`.
  */
-export declare const getSubFromEvent: (event: APIGatewayProxyEvent) => string | undefined;
-/**
- * Extract the caller's accountConfigId from an API Gateway event.
- *
- * Production: reads the Cognito `sub` claim (verified by the API Gateway
- * Cognito authorizer) and derives the accountConfigId via UUIDv5.
- *
- * Local development: honours two environment overrides so the dev server and
- * playwright fixtures can run without a real Cognito token:
- *   - `LOCAL_ACCOUNT_CONFIG_ID` — pin a specific seeded accountConfigId
- *   - `LOCAL_COGNITO_SUB` — pin a Cognito `sub` value; derived like production
- */
-export declare const getAccountConfigIdFromEvent: (event: APIGatewayProxyEvent) => string;
+export declare const getIdentityFromEvent: (event: APIGatewayProxyEvent, localIdentity: HandlerIdentity) => HandlerIdentity;

package/dist/src/auth.js

@@ -11,11 +11,14 @@ const isLocalEnv = (env) => env.NODE_ENV === "development" || env.NODE_ENV === "
  * start (throw at module load) if either is present outside a local NODE_ENV — the
  * same `development`/`test` signal the data layer already uses to decide local vs
  * deployed. Fail loud rather than silently ignore, so a leaked env var is caught at
- * boot, not exploited at runtime.
+ * boot, not exploited at runtime. In a local NODE_ENV the bypass is read here
+ * once, so a bypass set without LOCAL_EMAIL also fails at boot.
  */
-export const assertLocalBypassNotInDeployedEnv = (env = process.env) => {
-    if (isLocalEnv(env))
+export const assertLocalBypassNotInDeployedEnv = (env) => {
+    if (isLocalEnv(env)) {
+        localIdentityFromEnv(env);
         return;
+    }
     const leaked = LOCAL_BYPASS_VARS.filter((name) => {
         const value = env[name];
         return typeof value === "string" && value.length > 0;
@@ -24,50 +27,55 @@ export const assertLocalBypassNotInDeployedEnv = (env = process.env) => {
         return;
     throw new Error(`Refusing to start: local auth bypass ${leaked.join(", ")} is set while NODE_ENV=${env.NODE_ENV ?? "(unset)"}. These overrides bypass authentication and must never be present in a deployed environment.`);
 };
-const getSubFromClaims = (event) => {
-    const claims = event.requestContext?.authorizer?.claims;
-    if (!claims)
-        return undefined;
-    const sub = claims.sub;
-    if (typeof sub === "string" && sub.length > 0)
-        return sub;
+const readClaim = (event, name) => {
+    const value = event.requestContext?.authorizer?.claims?.[name];
+    if (typeof value === "string" && value.length > 0)
+        return value;
     return undefined;
 };
-/**
- * Return the Cognito `sub` for the current request, preferring the JWT claim
- * and falling back to `LOCAL_COGNITO_SUB` for local development. Returns
- * `undefined` when neither is available (e.g. seeded fixtures that only set
- * `LOCAL_ACCOUNT_CONFIG_ID`).
- */
-export const getSubFromEvent = (event) => {
-    const sub = getSubFromClaims(event);
-    if (sub)
-        return sub;
-    const localSub = process.env.LOCAL_COGNITO_SUB;
-    if (localSub && localSub.length > 0)
-        return localSub;
+const ANONYMOUS = { kind: "anonymous" };
+export const userFromClaims = (sub, email) => {
+    if (!email)
+        return ANONYMOUS;
+    return {
+        kind: "user",
+        accountConfigId: deriveAccountConfigId(sub),
+        sub,
+        email,
+    };
+};
+const pinnedLocalUser = (env) => {
+    const localAccountConfigId = env.LOCAL_ACCOUNT_CONFIG_ID;
+    if (localAccountConfigId) {
+        return { accountConfigId: localAccountConfigId, sub: localAccountConfigId };
+    }
+    const localSub = env.LOCAL_COGNITO_SUB;
+    if (localSub) {
+        return { accountConfigId: deriveAccountConfigId(localSub), sub: localSub };
+    }
     return undefined;
 };
+export const localIdentityFromEnv = (env) => {
+    const pinned = pinnedLocalUser(env);
+    if (!pinned)
+        return ANONYMOUS;
+    const email = env.LOCAL_EMAIL;
+    if (!email) {
+        throw new Error("Refusing to start: the local auth bypass (LOCAL_ACCOUNT_CONFIG_ID or LOCAL_COGNITO_SUB) is set without LOCAL_EMAIL. The bypass serves a signed-in user, and every user carries an email; set LOCAL_EMAIL to the address that user signs in with.");
+    }
+    return { kind: "user", ...pinned, email };
+};
 /**
- * Extract the caller's accountConfigId from an API Gateway event.
- *
- * Production: reads the Cognito `sub` claim (verified by the API Gateway
- * Cognito authorizer) and derives the accountConfigId via UUIDv5.
- *
- * Local development: honours two environment overrides so the dev server and
- * playwright fixtures can run without a real Cognito token:
- *   - `LOCAL_ACCOUNT_CONFIG_ID` — pin a specific seeded accountConfigId
- *   - `LOCAL_COGNITO_SUB` — pin a Cognito `sub` value; derived like production
+ * The caller of an API Gateway event. Production reads the Cognito `sub` and
+ * `email` claims (verified by the authorizer, or by `jwt-auth.ts` on
+ * self-host) and derives the accountConfigId via UUIDv5. Local development
+ * honours `LOCAL_ACCOUNT_CONFIG_ID` (a pinned seeded config) and
+ * `LOCAL_COGNITO_SUB` (a pinned sub, derived like production), read once at
+ * boot into `localIdentity`.
  */
-export const getAccountConfigIdFromEvent = (event) => {
-    const sub = getSubFromClaims(event);
-    if (sub)
-        return deriveAccountConfigId(sub);
-    const localAccountConfigId = process.env.LOCAL_ACCOUNT_CONFIG_ID;
-    if (localAccountConfigId)
-        return localAccountConfigId;
-    const localSub = process.env.LOCAL_COGNITO_SUB;
-    if (localSub)
-        return deriveAccountConfigId(localSub);
-    throw new Error("Missing accountConfigId: no Cognito `sub` claim on the request, and neither LOCAL_ACCOUNT_CONFIG_ID nor LOCAL_COGNITO_SUB env var is set");
+export const getIdentityFromEvent = (event, localIdentity) => {
+    const sub = readClaim(event, "sub");
+    if (!sub)
+        return localIdentity;
+    return userFromClaims(sub, readClaim(event, "email"));
 };

package/dist/src/config/api-config.d.ts

@@ -0,0 +1,20 @@
+import type { MsOAuthConfig } from "./msoauth.js";
+export type AuthConfig = {
+    mode: "BetterAuthJwt";
+    contentSigningSecret: string;
+} | {
+    mode: "GatewayAuthorizer";
+};
+export type ResponseValidation = "Log" | "Skip";
+export type SelfUpdate = "Enabled" | "Disabled";
+export interface ApiConfig {
+    auth: AuthConfig;
+    corsAllowedOrigins: readonly string[];
+    publicOrigin: string;
+    contentDeliveryDomain: string;
+    msOAuth: MsOAuthConfig;
+    selfUpdate: SelfUpdate;
+    updateControlDir: string;
+    commit: string;
+    responseValidation: ResponseValidation;
+}

package/dist/src/config/api-config.js

@@ -0,0 +1 @@
+export {};

package/dist/src/config/from-env.d.ts

@@ -0,0 +1,2 @@
+import type { ApiConfig } from "./api-config.js";
+export declare const configFromEnv: (env: NodeJS.ProcessEnv) => ApiConfig;

package/dist/src/config/from-env.js

@@ -0,0 +1,65 @@
+import { msOAuthCredentialsFromSecret } from "./msoauth-secrets-manager.js";
+const DEFAULT_UPDATE_CONTROL_DIR = "/data/control";
+const optional = (env, key) => env[key] || undefined;
+const required = (env, key, reason) => {
+    const value = optional(env, key);
+    if (!value)
+        throw new Error(`Refusing to start: ${key} is not set. ${reason}`);
+    return value;
+};
+const commaList = (raw) => (raw ?? "")
+    .split(",")
+    .map((origin) => origin.trim())
+    .filter((origin) => origin.length > 0);
+const authFromEnv = (env) => env.DATA_BACKEND === "sqlite"
+    ? {
+        mode: "BetterAuthJwt",
+        contentSigningSecret: required(env, "BETTER_AUTH_SECRET", "The self-host SQL backend signs content URLs with it."),
+    }
+    : { mode: "GatewayAuthorizer" };
+const contentDeliveryDomainFromEnv = (env, auth, publicOrigin) => {
+    if (auth.mode === "BetterAuthJwt") {
+        return optional(env, "CONTENT_DELIVERY_DOMAIN") ?? publicOrigin;
+    }
+    return required(env, "CONTENT_DELIVERY_DOMAIN", "BodyPartResponse.contentUrl is built from the CloudFront distribution domain (#299); wire it via the API Lambda env (see infra/bin/infra.ts).");
+};
+const msOAuthCredentialsFromEnv = (env) => {
+    const clientId = optional(env, "MSOAUTH_CLIENT_ID");
+    const clientSecret = optional(env, "MSOAUTH_CLIENT_SECRET");
+    if (clientId && clientSecret) {
+        return async () => ({ clientId, clientSecret });
+    }
+    const secretArn = optional(env, "MSOAUTH_SECRET_ARN");
+    if (secretArn)
+        return msOAuthCredentialsFromSecret(secretArn);
+    return undefined;
+};
+const msOAuthFromEnv = (env) => {
+    const credentials = msOAuthCredentialsFromEnv(env);
+    if (!credentials)
+        return { mode: "Disabled" };
+    const tokenEndpoint = optional(env, "MSOAUTH_TOKEN_ENDPOINT");
+    return {
+        mode: "Enabled",
+        redirectUri: required(env, "MSOAUTH_REDIRECT_URI", "It is derived from PUBLIC_ORIGIN — set PUBLIC_ORIGIN in the deploy env file (deploy/vps/.env) and restart, or set MSOAUTH_REDIRECT_URI directly."),
+        overrides: tokenEndpoint ? { tokenEndpoint } : {},
+        credentials,
+    };
+};
+export const configFromEnv = (env) => {
+    const publicOrigin = required(env, "PUBLIC_ORIGIN", "It is the origin the web client is served from.");
+    const auth = authFromEnv(env);
+    return {
+        auth,
+        corsAllowedOrigins: commaList(env.CORS_ALLOWED_ORIGINS),
+        publicOrigin,
+        contentDeliveryDomain: contentDeliveryDomainFromEnv(env, auth, publicOrigin),
+        msOAuth: msOAuthFromEnv(env),
+        selfUpdate: optional(env, "REMIT_UPDATE_MANIFEST_URL")
+            ? "Enabled"
+            : "Disabled",
+        updateControlDir: optional(env, "REMIT_UPDATE_CONTROL_DIR") ?? DEFAULT_UPDATE_CONTROL_DIR,
+        commit: optional(env, "REMIT_WORKER_SHA") ?? optional(env, "GITHUB_SHA") ?? "dev",
+        responseValidation: env.STAGE_NAME === "dev" ? "Log" : "Skip",
+    };
+};

package/dist/src/config/msoauth-secrets-manager.d.ts

@@ -0,0 +1,2 @@
+import type { MsOAuthCredentials } from "./msoauth.js";
+export declare const msOAuthCredentialsFromSecret: (secretArn: string) => () => Promise<MsOAuthCredentials>;

package/dist/src/config/msoauth-secrets-manager.js

@@ -0,0 +1,28 @@
+import { GetSecretValueCommand, SecretsManagerClient, } from "@aws-sdk/client-secrets-manager";
+import { z } from "zod";
+const MsOAuthSecret = z.object({
+    clientId: z.string().min(1),
+    clientSecret: z.string().min(1),
+});
+let client = null;
+const secretsManager = () => {
+    if (!client)
+        client = new SecretsManagerClient({});
+    return client;
+};
+const parseSecret = (raw) => {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+};
+export const msOAuthCredentialsFromSecret = (secretArn) => async () => {
+    const result = await secretsManager().send(new GetSecretValueCommand({ SecretId: secretArn }));
+    const parsed = MsOAuthSecret.safeParse(parseSecret(result.SecretString ?? ""));
+    if (!parsed.success) {
+        throw new Error("The Microsoft OAuth secret named by MSOAUTH_SECRET_ARN does not hold a JSON object with a non-empty clientId and clientSecret");
+    }
+    return parsed.data;
+};

package/dist/src/config/msoauth.d.ts

@@ -1,30 +1,19 @@
-/**
- * Typed reads for Microsoft OAuth (Entra) environment variables.
- *
- * `MSOAUTH_REDIRECT_URI` is derived from `PUBLIC_ORIGIN` by the compose file
- * (deploy/vps/docker-compose.sqlite.yml) and must match the redirect URI
- * registered on the Entra app registration.
- *
- * Credentials come either from `MSOAUTH_CLIENT_ID` / `MSOAUTH_CLIENT_SECRET`
- * in the deploy env file, or from Secrets Manager via `MSOAUTH_SECRET_ARN`.
- *
- * The Microsoft authorization and token endpoints are fixed in
- * `@remit/mail-oauth-service`; no authority URL is read from the environment.
- */
-export interface MsOAuthConfig {
-    /** Secrets Manager ARN — an alternative to the client id/secret pair. */
-    readonly secretArn: string | undefined;
-    /** OAuth redirect URI registered in the Entra app. */
-    readonly redirectUri: string;
-    /** Client ID — set directly to bypass Secrets Manager. */
-    readonly clientId: string | undefined;
-    /** Client secret — set directly to bypass Secrets Manager. */
-    readonly clientSecret: string | undefined;
-    /** Token endpoint override — used for local stubbing (bypasses default OIDC discovery). */
-    readonly tokenEndpoint: string | undefined;
+import type { OAuthProviderConfig } from "@remit/mail-oauth-service";
+export interface MsOAuthCredentials {
+    clientId: string;
+    clientSecret: string;
 }
-/**
- * Read Microsoft OAuth configuration from the environment.
- * Throws when `MSOAUTH_REDIRECT_URI` is absent.
- */
-export declare const getMsOAuthConfig: () => MsOAuthConfig;
+export interface MsOAuthEnabled {
+    mode: "Enabled";
+    redirectUri: string;
+    overrides: Partial<Pick<OAuthProviderConfig, "tokenEndpoint">>;
+    credentials: () => Promise<MsOAuthCredentials>;
+}
+export type MsOAuthConfig = {
+    mode: "Disabled";
+} | MsOAuthEnabled;
+export interface LoadedMsOAuth {
+    config: MsOAuthEnabled;
+    credentials: MsOAuthCredentials;
+}
+export declare const loadMsOAuth: (config: MsOAuthConfig) => Promise<LoadedMsOAuth>;

package/dist/src/config/msoauth.js

@@ -1,30 +1,6 @@
-/**
- * Typed reads for Microsoft OAuth (Entra) environment variables.
- *
- * `MSOAUTH_REDIRECT_URI` is derived from `PUBLIC_ORIGIN` by the compose file
- * (deploy/vps/docker-compose.sqlite.yml) and must match the redirect URI
- * registered on the Entra app registration.
- *
- * Credentials come either from `MSOAUTH_CLIENT_ID` / `MSOAUTH_CLIENT_SECRET`
- * in the deploy env file, or from Secrets Manager via `MSOAUTH_SECRET_ARN`.
- *
- * The Microsoft authorization and token endpoints are fixed in
- * `@remit/mail-oauth-service`; no authority URL is read from the environment.
- */
-/**
- * Read Microsoft OAuth configuration from the environment.
- * Throws when `MSOAUTH_REDIRECT_URI` is absent.
- */
-export const getMsOAuthConfig = () => {
-    const redirectUri = process.env.MSOAUTH_REDIRECT_URI;
-    if (!redirectUri) {
-        throw new Error("MSOAUTH_REDIRECT_URI is not set. It is derived from PUBLIC_ORIGIN — set PUBLIC_ORIGIN in the deploy env file (deploy/vps/.env) and restart, or set MSOAUTH_REDIRECT_URI directly.");
+export const loadMsOAuth = async (config) => {
+    if (config.mode === "Disabled") {
+        throw new Error("No Microsoft OAuth credentials are configured on this instance: set MSOAUTH_CLIENT_ID and MSOAUTH_CLIENT_SECRET, or MSOAUTH_SECRET_ARN");
     }
-    return {
-        secretArn: process.env.MSOAUTH_SECRET_ARN,
-        redirectUri,
-        clientId: process.env.MSOAUTH_CLIENT_ID,
-        clientSecret: process.env.MSOAUTH_CLIENT_SECRET,
-        tokenEndpoint: process.env.MSOAUTH_TOKEN_ENDPOINT,
-    };
+    return { config, credentials: await config.credentials() };
 };

package/dist/src/derive/contentSignature.d.ts

@@ -1,4 +1,5 @@
 import { type SignedPathFailure } from "@remit/storage-service/signed-path";
+import type { ApiConfig } from "../config/api-config.js";
 /**
  * Default validity window for a signed content URL. Long enough to cover a
  * viewing session (react-query caches describeMessage for 30 min and inline
@@ -21,11 +22,9 @@ export declare const createContentSigner: (masterSecret: string, ttlSeconds?: nu
  * signing does not apply. Signing is enforced on the self-host SQL backend,
  * which serves `/content/*` straight from the backend container; on AWS the
  * Lambda@Edge JWT verifier guards `/content/*` and the URL stays unsigned so
- * CloudFront/S3 behaviour is unchanged. Throws on the self-host backend when the
- * master secret is missing, so a misconfigured deploy fails loud rather than
- * shipping unsigned (unauthenticated) content URLs.
+ * CloudFront/S3 behaviour is unchanged.
  */
-export declare const getContentSigner: () => ContentSigner | undefined;
+export declare const getContentSigner: (config: ApiConfig) => ContentSigner | undefined;
 export type ContentSignatureFailure = SignedPathFailure;
 export type ContentSignatureResult = {
     valid: true;

package/dist/src/derive/contentSignature.js

@@ -1,5 +1,4 @@
 import { signStoragePath, verifyStoragePath, } from "@remit/storage-service/signed-path";
-import { usesBetterAuthJwt } from "../data-backend.js";
 /**
  * Signed-URL scheme for `/content/*` on the self-host stack.
  *
@@ -48,19 +47,11 @@ export const createContentSigner = (masterSecret, ttlSeconds = CONTENT_URL_TTL_S
  * signing does not apply. Signing is enforced on the self-host SQL backend,
  * which serves `/content/*` straight from the backend container; on AWS the
  * Lambda@Edge JWT verifier guards `/content/*` and the URL stays unsigned so
- * CloudFront/S3 behaviour is unchanged. Throws on the self-host backend when the
- * master secret is missing, so a misconfigured deploy fails loud rather than
- * shipping unsigned (unauthenticated) content URLs.
+ * CloudFront/S3 behaviour is unchanged.
  */
-export const getContentSigner = () => {
-    if (!usesBetterAuthJwt())
-        return undefined;
-    const secret = process.env.BETTER_AUTH_SECRET;
-    if (!secret || secret.length === 0) {
-        throw new Error("the self-host SQL backend requires BETTER_AUTH_SECRET to sign content URLs");
-    }
-    return createContentSigner(secret);
-};
+export const getContentSigner = (config) => config.auth.mode === "BetterAuthJwt"
+    ? createContentSigner(config.auth.contentSigningSecret)
+    : undefined;
 /**
  * Verify a signed content request. Recomputes the HMAC over the requested path
  * and the supplied expiry and constant-time compares it against the presented

package/dist/src/derive/contentUrl.d.ts

@@ -31,16 +31,3 @@ export interface BuildStorageContentUrlInput {
 }
 export declare const buildStorageContentUrl: (input: BuildStorageContentUrlInput) => string;
 export declare const buildContentUrl: (input: BuildContentUrlInput) => string;
-/**
- * Read the CloudFront distribution domain from the environment. The CDK
- * wires `CONTENT_DELIVERY_DOMAIN` onto the API Lambda from the
- * ContentDelivery stack's published SSM parameter (`/{stage}/Remit/frontendUrl`).
- *
- * Throws when the env var is missing or empty. `BodyPartResponse.contentUrl`
- * is required + URL-formatted in the API contract, so silently emitting a
- * placeholder string would ship a contract lie to clients. Failing loud here
- * surfaces the missing wire-up as a 500 the deploy team can act on (#299).
- * Production synth hard-codes a syntactically-valid placeholder URL via
- * `infra/bin/infra.ts` so this only fires when the env is actually unset.
- */
-export declare const getContentDeliveryDomain: () => string;

package/dist/src/derive/contentUrl.js

@@ -25,22 +25,3 @@ export const buildContentUrl = (input) => {
         sign,
     });
 };
-/**
- * Read the CloudFront distribution domain from the environment. The CDK
- * wires `CONTENT_DELIVERY_DOMAIN` onto the API Lambda from the
- * ContentDelivery stack's published SSM parameter (`/{stage}/Remit/frontendUrl`).
- *
- * Throws when the env var is missing or empty. `BodyPartResponse.contentUrl`
- * is required + URL-formatted in the API contract, so silently emitting a
- * placeholder string would ship a contract lie to clients. Failing loud here
- * surfaces the missing wire-up as a 500 the deploy team can act on (#299).
- * Production synth hard-codes a syntactically-valid placeholder URL via
- * `infra/bin/infra.ts` so this only fires when the env is actually unset.
- */
-export const getContentDeliveryDomain = () => {
-    const value = process.env.CONTENT_DELIVERY_DOMAIN;
-    if (!value || value.length === 0) {
-        throw new Error("CONTENT_DELIVERY_DOMAIN is not set; BodyPartResponse.contentUrl cannot be built. Wire the CloudFront distribution domain via the API Lambda env (see infra/bin/infra.ts).");
-    }
-    return value;
-};

package/dist/src/handlers/account-oauth.d.ts

@@ -1,5 +1,6 @@
 import type { AccountService as AccountServiceName } from "@remit/api-openapi-types";
-import type { MicrosoftOAuthOperationIds, OperationHandler } from "../types.js";
+import type { Context } from "openapi-backend";
+import type { HandlerContext, PublicOperationHandler } from "../types.js";
 export interface OAuthState {
     accountConfigId: string;
     nonce: string;
@@ -10,5 +11,10 @@ export declare const STATE_TTL_MS: number;
 export declare function signState(payload: OAuthState, clientSecret: string): Promise<string>;
 export declare function verifyState(state: string, clientSecret: string): Promise<OAuthState>;
 export declare function parseJwtClaims(token: string): Promise<Record<string, unknown> | null>;
-export declare function getWebOrigin(): string;
-export declare const MicrosoftOAuthOperations: Record<MicrosoftOAuthOperationIds, OperationHandler<MicrosoftOAuthOperationIds>>;
+export declare function getWebOrigin(origins: readonly string[]): string;
+export declare const microsoftOAuthCallback: PublicOperationHandler<"sync">;
+export declare const MicrosoftOAuthOperations: {
+    MicrosoftOAuthOperations_microsoftOAuthStart: (context: Context, ctx: HandlerContext) => Promise<{
+        authorizationUrl: string;
+    }>;
+};