@remit/backend 0.0.144 → 0.0.146

package/dist/src/handlers/account-oauth.js

@@ -1,15 +1,11 @@
 import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
-import { inspect } from "node:util";
-import { GetSecretValueCommand, SecretsManagerClient, } from "@aws-sdk/client-secrets-manager";
 import { AccountAuthType, AccountService, ConnectionState, } from "@remit/domain-enums";
 import { logger } from "@remit/logger";
 import { createMailOAuthService, microsoftProviderConfig, microsoftServicesGranted, orderServices, RefreshTokenError, } from "@remit/mail-oauth-service";
 import { serializeEncryptedPayload } from "@remit/secrets-service";
-import { getAccountConfigIdFromEvent } from "../auth.js";
-import { getMsOAuthConfig } from "../config/msoauth.js";
+import { loadMsOAuth } from "../config/msoauth.js";
 import { safeJsonParse } from "../json.js";
 import { rawApiResponse } from "../response.js";
-import { getClient } from "../service/data-client.js";
 import { triggerAccountSyncSafe } from "./account.js";
 import { findActiveDuplicateMailbox } from "./account-guards.js";
 import { ensureAccountConfig } from "./ensure-account-config.js";
@@ -74,49 +70,8 @@ export async function parseJwtClaims(token) {
         return null;
     return safeJsonParse(Buffer.from(parts[1], "base64url").toString("utf8")).catch(() => null);
 }
-let smClient = null;
-function getSecretsManagerClient() {
-    if (!smClient)
-        smClient = new SecretsManagerClient({});
-    return smClient;
-}
-function credentialFailure(name, message) {
-    const error = new Error(message);
-    error.name = name;
-    return error;
-}
-async function getMsOAuthCredentials() {
-    const config = getMsOAuthConfig();
-    // Local dev: use env vars directly
-    if (config.clientId && config.clientSecret) {
-        return { clientId: config.clientId, clientSecret: config.clientSecret };
-    }
-    // Production: fetch from Secrets Manager
-    if (!config.secretArn) {
-        throw credentialFailure("MicrosoftOAuthNotConfigured", "No Microsoft OAuth credentials are configured on this instance: set MSOAUTH_CLIENT_ID and MSOAUTH_CLIENT_SECRET, or MSOAUTH_SECRET_ARN");
-    }
-    const sm = getSecretsManagerClient();
-    const result = await sm.send(new GetSecretValueCommand({ SecretId: config.secretArn }));
-    if (!result.SecretString) {
-        throw credentialFailure("MicrosoftOAuthSecretEmpty", "The Microsoft OAuth secret named by MSOAUTH_SECRET_ARN holds no SecretString");
-    }
-    const parsed = await safeJsonParse(result.SecretString).catch(() => null);
-    if (!parsed) {
-        throw credentialFailure("MicrosoftOAuthSecretUnparseable", "The Microsoft OAuth secret named by MSOAUTH_SECRET_ARN does not hold a JSON object");
-    }
-    const absent = ["clientId", "clientSecret"].filter((field) => !parsed[field]);
-    if (absent.length > 0) {
-        throw credentialFailure("MicrosoftOAuthSecretIncomplete", `The Microsoft OAuth secret named by MSOAUTH_SECRET_ARN is missing ${absent.join(" and ")}`);
-    }
-    return parsed;
-}
 // ─── Web origin helper ───────────────────────────────────────────────────────
-export function getWebOrigin() {
-    const raw = process.env.CORS_ALLOWED_ORIGINS ?? "";
-    const origins = raw
-        .split(",")
-        .map((o) => o.trim())
-        .filter(Boolean);
+export function getWebOrigin(origins) {
     // Prefer the first HTTPS origin (production frontend)
     const httpsOrigin = origins.find((o) => o.startsWith("https://"));
     return httpsOrigin ?? origins[0] ?? "https://localhost:3000";
@@ -140,7 +95,7 @@ const redeemEachService = async (serviceFor, initialToken, services, accountConf
                 reason: "scope_redemption_failed",
                 accountConfigId,
                 service,
-                error: inspect(err),
+                error: err,
             }, "MS OAuth callback: the consent did not cover a requested service");
             return err instanceof RefreshTokenError &&
                 err.error.kind === "transient"
@@ -157,22 +112,207 @@ const redeemEachService = async (serviceFor, initialToken, services, accountConf
     return { kind: "granted", refreshToken: token, grantedScopes };
 };
 // ─── Handlers ────────────────────────────────────────────────────────────────
+export const microsoftOAuthCallback = async (context, ctx) => {
+    const webOrigin = getWebOrigin(ctx.config.corsAllowedOrigins);
+    const qs = context.request.query;
+    // Marked raw so the response formatter forwards the Location header
+    // instead of serializing this object as a JSON body. Microsoft's browser
+    // redirect lands here, so a dropped Location is a blank page.
+    const redirect = (url) => rawApiResponse({
+        statusCode: 302,
+        headers: { Location: url },
+        body: "",
+    });
+    // If Microsoft returned an error, pass it through to the frontend
+    if (qs.error) {
+        const errorCode = encodeURIComponent(qs.error);
+        return redirect(`${webOrigin}/settings/accounts?oauthError=${errorCode}`);
+    }
+    const code = qs.code;
+    const state = qs.state;
+    if (!code || !state) {
+        return redirect(`${webOrigin}/settings/accounts?oauthError=missing_params`);
+    }
+    const loaded = await loadMsOAuth(ctx.config.msOAuth).catch((err) => {
+        logger.error({
+            alert: "oauth_callback_failed",
+            reason: "config_error",
+            errorName: err?.name,
+            errorCode: err?.Code ?? err?.code,
+            error: err,
+        }, "MS OAuth callback: failed to load OAuth config");
+        return null;
+    });
+    if (loaded === null)
+        return redirect(`${webOrigin}/settings/accounts?oauthError=config_error`);
+    const { config, credentials } = loaded;
+    // Verify the HMAC-signed state
+    // A bad/expired/forged state is a security-relevant signal (CSRF
+    // attempt, clock skew, or a stale callback) — must not be swallowed
+    // silently. Warn so it's observable; still redirect the user cleanly.
+    const statePayload = await verifyState(state, credentials.clientSecret).catch((err) => {
+        logger.warn({
+            alert: "oauth_callback_failed",
+            reason: "invalid_state",
+            errorName: err?.name,
+            error: err,
+        }, "MS OAuth callback: state verification failed");
+        return null;
+    });
+    if (statePayload === null)
+        return redirect(`${webOrigin}/settings/accounts?oauthError=invalid_state`);
+    const { accountConfigId } = statePayload;
+    const [firstService] = orderServices(statePayload.services);
+    const serviceFor = (service) => createMailOAuthService(microsoftProviderConfig({
+        clientId: credentials.clientId,
+        clientSecret: credentials.clientSecret,
+        services: [service],
+        overrides: config.overrides,
+    }));
+    // Exchange the authorization code for tokens
+    const tokenSet = await serviceFor(firstService)
+        .exchangeCode(code, config.redirectUri)
+        .catch((err) => {
+        logger.error({ accountConfigId, error: err }, "MS OAuth code exchange failed");
+        return null;
+    });
+    if (tokenSet === null)
+        return redirect(`${webOrigin}/settings/accounts?oauthError=exchange_failed`);
+    if (!tokenSet.refreshToken) {
+        logger.error({ accountConfigId }, "MS OAuth token exchange returned no refresh_token");
+        return redirect(`${webOrigin}/settings/accounts?oauthError=exchange_failed`);
+    }
+    // Extract the user's email from the ID token returned alongside the access
+    // token when openid+email scopes are requested.
+    //
+    // We prefer the ID token (idToken) because Outlook resource access tokens
+    // (IMAP.AccessAsUser.All, SMTP.Send) are opaque/non-JWT and cannot be
+    // decoded. The ID token is a standard OIDC token that always contains
+    // identity claims (preferred_username / email).
+    //
+    // Falls back to parsing the access token only in test/dev environments where
+    // idToken may not be present (e.g. custom token endpoints that don't issue
+    // OIDC tokens).
+    const tokenToParse = tokenSet.idToken ?? tokenSet.accessToken;
+    const claims = await parseJwtClaims(tokenToParse);
+    if (!claims) {
+        // A non-JWT or unparseable token. The empty-email guard below turns
+        // this into a user-facing missing_email redirect; log here so the parse
+        // failure itself is observable (e.g. an unexpected token shape).
+        logger.warn({
+            alert: "oauth_callback_failed",
+            reason: "jwt_parse_failed",
+            accountConfigId,
+        }, "MS OAuth callback: failed to parse identity token claims");
+    }
+    const email = claims
+        ? (claims.preferred_username ??
+            claims.email ??
+            claims.upn)
+        : undefined;
+    if (!email) {
+        logger.error({ accountConfigId }, "MS OAuth: could not extract email from token claims");
+        return redirect(`${webOrigin}/settings/accounts?oauthError=missing_email`);
+    }
+    const { account, accountConfig, secrets } = ctx.client;
+    // Reconnect when an active OAuth account already onboards this mailbox.
+    // Same natural key as the IMAP create guard (#635); the OAuth flow returns
+    // the existing account (token refresh) rather than rejecting, because a
+    // re-auth is the expected, idempotent path for OAuth.
+    const existingAccounts = (await account.listAllByAccountConfig(accountConfigId)).filter((a) => a.authType === AccountAuthType.OauthMicrosoft);
+    const existing = findActiveDuplicateMailbox(existingAccounts, {
+        imapHost: OUTLOOK_IMAP_HOST,
+        username: email,
+    });
+    const services = orderServices([
+        ...statePayload.services,
+        ...(existing?.syncedServices ?? []),
+    ]);
+    const redemption = await redeemEachService(serviceFor, tokenSet.refreshToken, services.filter((service) => service !== firstService), accountConfigId);
+    if (redemption.kind === "refused" &&
+        redemption.reason === "scope_not_granted")
+        return redirect(scopeRefusalUrl(webOrigin, email, [redemption.service]));
+    if (redemption.kind === "refused")
+        return redirect(`${webOrigin}/settings/accounts?oauthError=${redemption.reason}`);
+    const grantedScopes = [
+        ...new Set([...tokenSet.grantedScopes, ...redemption.grantedScopes]),
+    ];
+    const grantedServices = microsoftServicesGranted(grantedScopes);
+    const missingServices = services.filter((service) => !grantedServices.includes(service));
+    if (missingServices.length > 0) {
+        logger.warn({
+            alert: "oauth_callback_failed",
+            reason: "scope_not_granted",
+            accountConfigId,
+            missingServices,
+            grantedScopes,
+        }, "MS OAuth callback: granted scopes lack a requested service");
+        return redirect(scopeRefusalUrl(webOrigin, email, missingServices));
+    }
+    // Ensure the account config row exists for this user
+    await ensureAccountConfig(accountConfig, accountConfigId);
+    // Encrypt the refresh token
+    const tokenPayload = await secrets.encrypt(redemption.refreshToken);
+    const oauthRefreshTokenHash = JSON.stringify(serializeEncryptedPayload(tokenPayload));
+    const oauthTokenUpdatedAt = Date.now();
+    let accountId;
+    if (existing) {
+        // Reconnect: update the stored token and clear any reauth_required state
+        const updated = await account.update(existing.accountId, {
+            oauthRefreshTokenHash,
+            oauthTokenUpdatedAt,
+            syncedServices: services,
+            grantedScopes,
+            connectionState: ConnectionState.NotAuthenticated,
+        }, ["lastError"]);
+        accountId = updated.accountId;
+        // biome-ignore lint/plugin/no-logger-info: OAuth reconnect is an audit-grade signal
+        logger.info({ accountConfigId, accountId }, "MS OAuth reconnect: refresh token updated");
+    }
+    else {
+        // First connect: create a new account
+        const newAccount = await account.create({
+            accountConfigId,
+            email,
+            username: email,
+            authType: AccountAuthType.OauthMicrosoft,
+            syncedServices: services,
+            grantedScopes,
+            oauthRefreshTokenHash,
+            oauthTokenUpdatedAt,
+            imapHost: OUTLOOK_IMAP_HOST,
+            imapPort: 993,
+            imapTls: true,
+            imapStartTls: false,
+            smtpEnabled: true,
+            smtpHost: "smtp.office365.com",
+            smtpPort: 587,
+            smtpTls: false,
+            smtpStartTls: true,
+            isActive: true,
+            connectionState: ConnectionState.NotAuthenticated,
+        });
+        accountId = newAccount.accountId;
+        // biome-ignore lint/plugin/no-logger-info: OAuth account creation is an audit-grade signal
+        logger.info({ accountConfigId, accountId }, "MS OAuth: new account created");
+    }
+    if (services.includes(AccountService.Mail)) {
+        await triggerAccountSyncSafe(ctx.client, accountId);
+    }
+    return redirect(`${webOrigin}/settings/accounts?connected=${encodeURIComponent(accountId)}`);
+};
 export const MicrosoftOAuthOperations = {
-    MicrosoftOAuthOperations_microsoftOAuthStart: async (_context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
-        const input = JSON.parse(event.body ?? "{}");
+    MicrosoftOAuthOperations_microsoftOAuthStart: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
+        const input = context.request.requestBody;
         const email = typeof input.email === "string" ? input.email : undefined;
         const services = orderServices(input.services ?? [AccountService.Mail]);
-        const config = getMsOAuthConfig();
-        const credentials = await getMsOAuthCredentials();
+        const { config, credentials } = await loadMsOAuth(ctx.config.msOAuth);
         const oauthService = createMailOAuthService(microsoftProviderConfig({
             clientId: credentials.clientId,
             clientSecret: credentials.clientSecret,
             services,
-            overrides: config.tokenEndpoint
-                ? { tokenEndpoint: config.tokenEndpoint }
-                : undefined,
+            overrides: config.overrides,
         }));
         const nonce = randomBytes(16).toString("hex");
         const statePayload = {
@@ -191,197 +331,4 @@ export const MicrosoftOAuthOperations = {
         logger.info({ accountConfigId, services }, "Microsoft OAuth start initiated");
         return { authorizationUrl };
     },
-    MicrosoftOAuthOperations_microsoftOAuthCallback: async (_context, ...args) => {
-        const event = args[0];
-        const webOrigin = getWebOrigin();
-        const qs = event.queryStringParameters ?? {};
-        // Marked raw so the response formatter forwards the Location header
-        // instead of serializing this object as a JSON body. Microsoft's browser
-        // redirect lands here, so a dropped Location is a blank page.
-        const redirect = (url) => rawApiResponse({
-            statusCode: 302,
-            headers: { Location: url },
-            body: "",
-        });
-        // If Microsoft returned an error, pass it through to the frontend
-        if (qs.error) {
-            const errorCode = encodeURIComponent(qs.error);
-            return redirect(`${webOrigin}/settings/accounts?oauthError=${errorCode}`);
-        }
-        const code = qs.code;
-        const state = qs.state;
-        if (!code || !state) {
-            return redirect(`${webOrigin}/settings/accounts?oauthError=missing_params`);
-        }
-        const credentials = await getMsOAuthCredentials().catch((err) => {
-            logger.error({
-                alert: "oauth_callback_failed",
-                reason: "config_error",
-                errorName: err?.name,
-                errorCode: err?.Code ??
-                    err?.code,
-                error: inspect(err),
-            }, "MS OAuth callback: failed to load OAuth config");
-            return null;
-        });
-        if (credentials === null)
-            return redirect(`${webOrigin}/settings/accounts?oauthError=config_error`);
-        // Verify the HMAC-signed state
-        // A bad/expired/forged state is a security-relevant signal (CSRF
-        // attempt, clock skew, or a stale callback) — must not be swallowed
-        // silently. Warn so it's observable; still redirect the user cleanly.
-        const statePayload = await verifyState(state, credentials.clientSecret).catch((err) => {
-            logger.warn({
-                alert: "oauth_callback_failed",
-                reason: "invalid_state",
-                errorName: err?.name,
-                error: inspect(err),
-            }, "MS OAuth callback: state verification failed");
-            return null;
-        });
-        if (statePayload === null)
-            return redirect(`${webOrigin}/settings/accounts?oauthError=invalid_state`);
-        const { accountConfigId } = statePayload;
-        const [firstService] = orderServices(statePayload.services);
-        const config = getMsOAuthConfig();
-        const serviceFor = (service) => createMailOAuthService(microsoftProviderConfig({
-            clientId: credentials.clientId,
-            clientSecret: credentials.clientSecret,
-            services: [service],
-            overrides: config.tokenEndpoint
-                ? { tokenEndpoint: config.tokenEndpoint }
-                : undefined,
-        }));
-        // Exchange the authorization code for tokens
-        const tokenSet = await serviceFor(firstService)
-            .exchangeCode(code, config.redirectUri)
-            .catch((err) => {
-            logger.error({ accountConfigId, error: inspect(err) }, "MS OAuth code exchange failed");
-            return null;
-        });
-        if (tokenSet === null)
-            return redirect(`${webOrigin}/settings/accounts?oauthError=exchange_failed`);
-        if (!tokenSet.refreshToken) {
-            logger.error({ accountConfigId }, "MS OAuth token exchange returned no refresh_token");
-            return redirect(`${webOrigin}/settings/accounts?oauthError=exchange_failed`);
-        }
-        // Extract the user's email from the ID token returned alongside the access
-        // token when openid+email scopes are requested.
-        //
-        // We prefer the ID token (idToken) because Outlook resource access tokens
-        // (IMAP.AccessAsUser.All, SMTP.Send) are opaque/non-JWT and cannot be
-        // decoded. The ID token is a standard OIDC token that always contains
-        // identity claims (preferred_username / email).
-        //
-        // Falls back to parsing the access token only in test/dev environments where
-        // idToken may not be present (e.g. custom token endpoints that don't issue
-        // OIDC tokens).
-        const tokenToParse = tokenSet.idToken ?? tokenSet.accessToken;
-        const claims = await parseJwtClaims(tokenToParse);
-        if (!claims) {
-            // A non-JWT or unparseable token. The empty-email guard below turns
-            // this into a user-facing missing_email redirect; log here so the parse
-            // failure itself is observable (e.g. an unexpected token shape).
-            logger.warn({
-                alert: "oauth_callback_failed",
-                reason: "jwt_parse_failed",
-                accountConfigId,
-            }, "MS OAuth callback: failed to parse identity token claims");
-        }
-        const email = claims
-            ? (claims.preferred_username ??
-                claims.email ??
-                claims.upn)
-            : undefined;
-        if (!email) {
-            logger.error({ accountConfigId }, "MS OAuth: could not extract email from token claims");
-            return redirect(`${webOrigin}/settings/accounts?oauthError=missing_email`);
-        }
-        const { account, accountConfig, secrets } = await getClient();
-        // Reconnect when an active OAuth account already onboards this mailbox.
-        // Same natural key as the IMAP create guard (#635); the OAuth flow returns
-        // the existing account (token refresh) rather than rejecting, because a
-        // re-auth is the expected, idempotent path for OAuth.
-        const existingAccounts = (await account.listAllByAccountConfig(accountConfigId)).filter((a) => a.authType === AccountAuthType.OauthMicrosoft);
-        const existing = findActiveDuplicateMailbox(existingAccounts, {
-            imapHost: OUTLOOK_IMAP_HOST,
-            username: email,
-        });
-        const services = orderServices([
-            ...statePayload.services,
-            ...(existing?.syncedServices ?? []),
-        ]);
-        const redemption = await redeemEachService(serviceFor, tokenSet.refreshToken, services.filter((service) => service !== firstService), accountConfigId);
-        if (redemption.kind === "refused" &&
-            redemption.reason === "scope_not_granted")
-            return redirect(scopeRefusalUrl(webOrigin, email, [redemption.service]));
-        if (redemption.kind === "refused")
-            return redirect(`${webOrigin}/settings/accounts?oauthError=${redemption.reason}`);
-        const grantedScopes = [
-            ...new Set([...tokenSet.grantedScopes, ...redemption.grantedScopes]),
-        ];
-        const grantedServices = microsoftServicesGranted(grantedScopes);
-        const missingServices = services.filter((service) => !grantedServices.includes(service));
-        if (missingServices.length > 0) {
-            logger.warn({
-                alert: "oauth_callback_failed",
-                reason: "scope_not_granted",
-                accountConfigId,
-                missingServices,
-                grantedScopes,
-            }, "MS OAuth callback: granted scopes lack a requested service");
-            return redirect(scopeRefusalUrl(webOrigin, email, missingServices));
-        }
-        // Ensure the account config row exists for this user
-        await ensureAccountConfig(accountConfig, accountConfigId);
-        // Encrypt the refresh token
-        const tokenPayload = await secrets.encrypt(redemption.refreshToken);
-        const oauthRefreshTokenHash = JSON.stringify(serializeEncryptedPayload(tokenPayload));
-        const oauthTokenUpdatedAt = Date.now();
-        let accountId;
-        if (existing) {
-            // Reconnect: update the stored token and clear any reauth_required state
-            const updated = await account.update(existing.accountId, {
-                oauthRefreshTokenHash,
-                oauthTokenUpdatedAt,
-                syncedServices: services,
-                grantedScopes,
-                connectionState: ConnectionState.NotAuthenticated,
-            }, ["lastError"]);
-            accountId = updated.accountId;
-            // biome-ignore lint/plugin/no-logger-info: OAuth reconnect is an audit-grade signal
-            logger.info({ accountConfigId, accountId }, "MS OAuth reconnect: refresh token updated");
-        }
-        else {
-            // First connect: create a new account
-            const newAccount = await account.create({
-                accountConfigId,
-                email,
-                username: email,
-                authType: AccountAuthType.OauthMicrosoft,
-                syncedServices: services,
-                grantedScopes,
-                oauthRefreshTokenHash,
-                oauthTokenUpdatedAt,
-                imapHost: OUTLOOK_IMAP_HOST,
-                imapPort: 993,
-                imapTls: true,
-                imapStartTls: false,
-                smtpEnabled: true,
-                smtpHost: "smtp.office365.com",
-                smtpPort: 587,
-                smtpTls: false,
-                smtpStartTls: true,
-                isActive: true,
-                connectionState: ConnectionState.NotAuthenticated,
-            });
-            accountId = newAccount.accountId;
-            // biome-ignore lint/plugin/no-logger-info: OAuth account creation is an audit-grade signal
-            logger.info({ accountConfigId, accountId }, "MS OAuth: new account created");
-        }
-        if (services.includes(AccountService.Mail)) {
-            await triggerAccountSyncSafe(accountId);
-        }
-        return redirect(`${webOrigin}/settings/accounts?connected=${encodeURIComponent(accountId)}`);
-    },
 };

package/dist/src/handlers/account.d.ts

@@ -1,6 +1,15 @@
-import type { AccountDetailOperationIds, AccountOperationIds, OperationHandler } from "../types.js";
+import type { AccountResponse, DeleteAccountResponse, TestConnectionResponse } from "@remit/api-openapi-types";
+import type { Context } from "openapi-backend";
+import type { RemitClient } from "../service/data-client.js";
+import type { HandlerContext } from "../types.js";
 import { assertNotOAuthCreate, assertPasswordProvided, toAccountResponse } from "./account-guards.js";
 export { assertNotOAuthCreate, assertPasswordProvided, toAccountResponse };
-export declare const triggerAccountSyncSafe: (accountId: string) => Promise<void>;
-export declare const AccountOperations: Record<AccountOperationIds, OperationHandler<AccountOperationIds>>;
-export declare const AccountDetailOperations: Record<AccountDetailOperationIds, OperationHandler<AccountDetailOperationIds>>;
+export declare const triggerAccountSyncSafe: (client: RemitClient<"sync">, accountId: string) => Promise<void>;
+export declare const AccountOperations: {
+    AccountOperations_createAccount: (context: Context, ctx: HandlerContext<"sync">) => Promise<AccountResponse>;
+    AccountOperations_testConnection: (context: Context, ctx: HandlerContext) => Promise<TestConnectionResponse>;
+};
+export declare const AccountDetailOperations: {
+    AccountDetailOperations_updateAccount: (context: Context, ctx: HandlerContext) => Promise<AccountResponse>;
+    AccountDetailOperations_deleteAccount: (context: Context, ctx: HandlerContext<"accountFanout">) => Promise<DeleteAccountResponse>;
+};

package/dist/src/handlers/account.js

@@ -3,13 +3,10 @@ import { logger } from "@remit/logger";
 import { createMailOAuthService, microsoftProviderConfig, RefreshTokenError, } from "@remit/mail-oauth-service";
 import { ownedAccount, resolveConnectionCredentials, testImapConnection, testSmtpConnection, } from "@remit/mailbox-service";
 import { deserializeEncryptedPayload, serializeEncryptedPayload, } from "@remit/secrets-service";
-import { env } from "expect-env";
-import { getAccountConfigIdFromEvent } from "../auth.js";
+import { loadMsOAuth } from "../config/msoauth.js";
 import { deleteAccount } from "../service/account-deletion.js";
-import { getClient } from "../service/data-client.js";
 import { fireAndForget } from "../service/fire-and-forget.js";
 import { unwrap } from "../service/refusal.js";
-import { sqsClient } from "../service/sqs.js";
 import { triggerAccountSync } from "../service/trigger-sync.js";
 import { assertNoDuplicateMailbox, assertNotOAuthCreate, assertPasswordProvided, resolveSyncedServices, toAccountResponse, } from "./account-guards.js";
 import { loadAccountOverrides, upsertAccountDisplayName, writeAccountComposeLanguages, writeAccountMuted, } from "./account-overrides.js";
@@ -17,8 +14,7 @@ import { loadSignatureForAccount, upsertAccountSignature, } from "./account-sign
 import { ensureAccountConfig } from "./ensure-account-config.js";
 import { resolveAccountFolderAppointments } from "./folder-role-appointments.js";
 export { assertNotOAuthCreate, assertPasswordProvided, toAccountResponse };
-export const triggerAccountSyncSafe = async (accountId) => {
-    const queueUrl = env.SQS_QUEUE_URL;
+export const triggerAccountSyncSafe = async (client, accountId) => {
     // Best-effort: account creation must still return 200 even if the sync
     // enqueue fails. fireAndForget catches and logs every rejection loudly with
     // the alertable structured fields and never rejects, so a failure here (SQS
@@ -26,8 +22,7 @@ export const triggerAccountSyncSafe = async (accountId) => {
     // unhandled rejection onto an unrelated in-flight request.
     await fireAndForget(async () => {
         const { eventId } = await triggerAccountSync({
-            sqsClient,
-            queueUrl,
+            queue: client.queues.sync,
             accountId,
         });
         // biome-ignore lint/plugin/no-logger-info: sync-triggered-for-new-account is an audit-grade signal
@@ -48,16 +43,13 @@ export const triggerAccountSyncSafe = async (accountId) => {
  * A revoked / expired refresh token surfaces as RefreshTokenError; the
  * reauth-required case is mapped to the distinct `reauth_required` error code
  * so the UI can route the user into the OAuth re-auth flow.
- *
- * MSOAUTH_* env vars are only present in deployed Lambdas; fall back to "".
  */
-const testOAuthConnection = async (existingAccount, account, secrets) => {
+const testOAuthConnection = async (msOAuth, existingAccount, account, secrets) => {
+    const { config, credentials: app } = await loadMsOAuth(msOAuth);
     const tokenService = createMailOAuthService(microsoftProviderConfig({
-        clientId: process.env.MSOAUTH_CLIENT_ID ?? "",
-        clientSecret: process.env.MSOAUTH_CLIENT_SECRET ?? "",
-        overrides: process.env.MSOAUTH_TOKEN_ENDPOINT
-            ? { tokenEndpoint: process.env.MSOAUTH_TOKEN_ENDPOINT }
-            : undefined,
+        clientId: app.clientId,
+        clientSecret: app.clientSecret,
+        overrides: config.overrides,
     }));
     let resolution;
     try {
@@ -123,16 +115,15 @@ const testOAuthConnection = async (existingAccount, account, secrets) => {
     return result;
 };
 export const AccountOperations = {
-    AccountOperations_createAccount: async (_context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
-        const input = JSON.parse(event.body ?? "{}");
+    AccountOperations_createAccount: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
+        const input = context.request.requestBody;
         // OAuth accounts must be created via the dedicated connect flow
         assertNotOAuthCreate(input.authType);
         // Password accounts require a non-empty password
         assertPasswordProvided(input.authType, input.password);
         const syncedServices = resolveSyncedServices({ authType: AccountAuthType.Password, grantedScopes: [] }, input.syncedServices ?? [AccountService.Mail]);
-        const { account, accountConfig, accountSetting, mailbox, secrets } = await getClient();
+        const { account, accountConfig, accountSetting, mailbox, secrets } = ctx.client;
         await ensureAccountConfig(accountConfig, accountConfigId);
         // Reject re-onboarding the same mailbox-in-the-same-place. Message
         // identity is account-scoped (#633), so duplicate onboards are no longer
@@ -180,18 +171,17 @@ export const AccountOperations = {
         if (input.displayName !== undefined) {
             await upsertAccountDisplayName(accountSetting, accountConfigId, newAccount.accountId, input.displayName);
         }
-        await triggerAccountSyncSafe(newAccount.accountId);
+        await triggerAccountSyncSafe(ctx.client, newAccount.accountId);
         const [overrides, folderAppointments] = await Promise.all([
             loadAccountOverrides(accountSetting, accountConfigId, newAccount.accountId),
             resolveAccountFolderAppointments({ mailbox, accountSetting }, accountConfigId, newAccount.accountId),
         ]);
         return toAccountResponse(newAccount, {}, overrides, folderAppointments);
     },
-    AccountOperations_testConnection: async (_context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
-        const input = JSON.parse(event.body ?? "{}");
-        const { account, secrets } = await getClient();
+    AccountOperations_testConnection: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
+        const input = context.request.requestBody;
+        const { account, secrets } = ctx.client;
         // Resolve password - use provided password or decrypt stored password
         let imapPassword = input.password;
         let smtpPassword = input.smtpPassword;
@@ -200,7 +190,7 @@ export const AccountOperations = {
             unwrap(ownedAccount(existingAccount, accountConfigId, "read"));
             const authType = existingAccount.authType ?? "password";
             if (authType === "oauthMicrosoft") {
-                return testOAuthConnection(existingAccount, account, secrets);
+                return testOAuthConnection(ctx.config.msOAuth, existingAccount, account, secrets);
             }
             if (existingAccount.passwordHash) {
                 const payload = deserializeEncryptedPayload(JSON.parse(existingAccount.passwordHash));
@@ -260,12 +250,11 @@ const encryptedSecret = async (secrets, plaintext) => plaintext
     ? JSON.stringify(serializeEncryptedPayload(await secrets.encrypt(plaintext)))
     : undefined;
 export const AccountDetailOperations = {
-    AccountDetailOperations_updateAccount: async (context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
+    AccountDetailOperations_updateAccount: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
         const { accountId } = context.request.params;
-        const input = JSON.parse(event.body ?? "{}");
-        const { account, accountSetting, mailbox, secrets } = await getClient();
+        const input = context.request.requestBody;
+        const { account, accountSetting, mailbox, secrets } = ctx.client;
         const existing = await account.get(accountId);
         unwrap(ownedAccount(existing, accountConfigId, "act"));
         const entityFields = {
@@ -327,18 +316,16 @@ export const AccountDetailOperations = {
         ]);
         return toAccountResponse(updated, signature, overrides, folderAppointments);
     },
-    AccountDetailOperations_deleteAccount: async (context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
+    AccountDetailOperations_deleteAccount: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
         const { accountId } = context.request.params;
-        const { account } = await getClient();
+        const { account } = ctx.client;
         const existing = await account.get(accountId);
         unwrap(ownedAccount(existing, accountConfigId, "act"));
         const deletedAt = Date.now();
         await deleteAccount({
             account,
-            sqsClient,
-            accountFanoutQueueUrl: env.SQS_QUEUE_URL_ACCOUNT_FANOUT,
+            queue: ctx.client.queues.accountFanout,
             log: logger,
         }, existing, deletedAt);
         return {