@remit/backend 0.0.146 → 0.0.148

package/dist/src/api.js

@@ -1,4 +1,5 @@
 import spec from "@remit/api-openapi-spec/openapi.json" with { type: "json" };
+import { requestValidators } from "@remit/api-openapi-spec/request-validators";
 import { redactCalendarFeedPath } from "@remit/calendar-service";
 import { logger } from "@remit/logger";
 import { OpenAPIBackend, } from "openapi-backend";
@@ -16,7 +17,24 @@ if (!isDocument(spec)) {
 }
 // Typed as a Document so importers do not see the JSON literal type.
 export const OpenAPISpec = spec;
-const api = new OpenAPIBackend({
+// ajv compiles a validator with `new Function`, which a Cloudflare Worker
+// refuses, so every init hands the router the validators codegen compiled ahead
+// of time. A host may call init again; in quick mode it builds the validator
+// before its first await, so the validators land before any request does.
+class PrecompiledOpenAPIBackend extends OpenAPIBackend {
+    init() {
+        const initialized = super.init();
+        for (const { operationId } of this.router.getOperations()) {
+            if (!operationId || !Object.hasOwn(requestValidators, operationId)) {
+                throw new Error(`No precompiled request validator for ${operationId}; run npm run codegen`);
+            }
+            this.validator.requestValidators[operationId] =
+                requestValidators[operationId];
+        }
+        return initialized;
+    }
+}
+const api = new PrecompiledOpenAPIBackend({
     definition: OpenAPISpec,
     quick: true,
     // Coerce query/path params to their schema types. API Gateway delivers every

package/dist/src/error.js

@@ -1,4 +1,4 @@
-import { isPublicApiError } from "@remit/data-ports/errors";
+import { HostRefusedError, isPublicApiError } from "@remit/data-ports/errors";
 import { logger } from "@remit/logger";
 import { formatResponse } from "./response.js";
 /**
@@ -35,6 +35,15 @@ export const defaultErrorCode = (statusCode) => {
     return CODE_BY_STATUS[statusCode] ?? "request_refused";
 };
 export const handleError = async (error) => {
+    if (error instanceof HostRefusedError) {
+        logger.error({
+            error: error.message,
+            errorKind: "quota",
+            statusCode: error.statusCode,
+            stack: error.stack,
+        }, "Host refused the request");
+        return formatResponse({ code: "request_refused", message: error.message }, error.statusCode);
+    }
     if (error instanceof Error) {
         if ("statusCode" in error) {
             logger.error({

package/dist/src/handlers/account-oauth.js

@@ -1,4 +1,5 @@
 import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { ensureAccountConfig } from "@remit/data-ports/account-config";
 import { AccountAuthType, AccountService, ConnectionState, } from "@remit/domain-enums";
 import { logger } from "@remit/logger";
 import { createMailOAuthService, microsoftProviderConfig, microsoftServicesGranted, orderServices, RefreshTokenError, } from "@remit/mail-oauth-service";
@@ -8,7 +9,6 @@ import { safeJsonParse } from "../json.js";
 import { rawApiResponse } from "../response.js";
 import { triggerAccountSyncSafe } from "./account.js";
 import { findActiveDuplicateMailbox } from "./account-guards.js";
-import { ensureAccountConfig } from "./ensure-account-config.js";
 const OUTLOOK_IMAP_HOST = "outlook.office365.com";
 const ACCOUNT_SERVICES = Object.values(AccountService);
 const isServiceList = (value) => Array.isArray(value) &&

package/dist/src/handlers/account.js

@@ -1,3 +1,4 @@
+import { ensureAccountConfig } from "@remit/data-ports/account-config";
 import { AccountAuthType, AccountService, ConnectionState, } from "@remit/domain-enums";
 import { logger } from "@remit/logger";
 import { createMailOAuthService, microsoftProviderConfig, RefreshTokenError, } from "@remit/mail-oauth-service";
@@ -11,7 +12,6 @@ import { triggerAccountSync } from "../service/trigger-sync.js";
 import { assertNoDuplicateMailbox, assertNotOAuthCreate, assertPasswordProvided, resolveSyncedServices, toAccountResponse, } from "./account-guards.js";
 import { loadAccountOverrides, upsertAccountDisplayName, writeAccountComposeLanguages, writeAccountMuted, } from "./account-overrides.js";
 import { loadSignatureForAccount, upsertAccountSignature, } from "./account-signature.js";
-import { ensureAccountConfig } from "./ensure-account-config.js";
 import { resolveAccountFolderAppointments } from "./folder-role-appointments.js";
 export { assertNotOAuthCreate, assertPasswordProvided, toAccountResponse };
 export const triggerAccountSyncSafe = async (client, accountId) => {

package/dist/src/handlers/config.js

@@ -65,12 +65,12 @@ const toAccountConfigResponse = (config) => ({
  * The POST account-creation flow will materialize the real row when the user
  * adds their first account.
  */
-const emptyConfigResponse = (accountConfigId, userId, commit) => {
+const emptyConfigResponse = (accountConfigId, commit) => {
     const now = Date.now();
     return {
         accountConfig: {
             accountConfigId,
-            userId,
+            userId: accountConfigId,
             state: "active",
             createdAt: now,
             updatedAt: now,
@@ -91,11 +91,11 @@ export const ConfigOperations = {
             throw err;
         });
         if (!description || description.accountConfig.length === 0) {
-            return emptyConfigResponse(accountConfigId, ctx.identity.sub, ctx.config.commit);
+            return emptyConfigResponse(accountConfigId, ctx.config.commit);
         }
         const accountConfig = description.accountConfig[0];
         if (!accountConfig) {
-            return emptyConfigResponse(accountConfigId, ctx.identity.sub, ctx.config.commit);
+            return emptyConfigResponse(accountConfigId, ctx.config.commit);
         }
         // Filter out deleted accounts (tombstone pattern)
         const activeAccounts = description.account.filter((acc) => acc.deletedAt === undefined);
@@ -151,7 +151,6 @@ export const ConfigOperations = {
             appointFolderRole: (configId, accountId, role, mailboxId, lastKnownPath) => writeFolderRoleAppointment(client.accountSetting, configId, accountId, role, mailboxId, lastKnownPath),
         }, {
             accountConfigId,
-            userId: ctx.identity.sub,
             document: body.document,
             mode: body.mode ?? "validate",
             onExisting: body.onExisting ?? "abort",

package/dist/src/service/create-remit-client.d.ts

@@ -1,12 +1,10 @@
 import type { IAccountConfigRepository, IAccountExportRequestRepository, IAccountRepository, IAccountSettingRepository, IAddressRepository, ICalendarCollectionRepository, ICalendarEventIndexRepository, ICalendarFeedTokenRepository, ICalendarObjectRepository, ICalendarStore, ICalendarSuggestionRepository, IConfigImportRepository, IEnvelopeRepository, IFilterRepository, ILabelRepository, IMailboxLockRepository, IMailboxRepository, IMailboxSpecialUseRepository, IMessageFlagPushRepository, IMessageFlagRepository, IMessageLabelRepository, IMessagePlacementMoveRepository, IMessageRepository, IOrganizeJobRequestRepository, IOutboxAttachmentRepository, IOutboxMessageRepository, IQuarantineRepository, ISenderSignerStandingRepository, ISyncWarningRepository, IThreadMessageRepository } from "@remit/data-ports";
-import { BodySyncQueueService, BodySyncService, type FilterConfig, FlagQueueService, type IImapConnection, MailboxQueueService, MessageMoveService, OutboxAttachmentService, OutboxQueueService, SpamReportService } from "@remit/mailbox-service";
+import { BodySyncQueueService, BodySyncService, type ConnectionScope, type FilterConfig, FlagQueueService, type ImapTransport, MailboxQueueService, MessageMoveService, OutboxAttachmentService, OutboxQueueService, SpamReportService } from "@remit/mailbox-service";
 import { type SecretsService } from "@remit/secrets-service";
 import type { StorageService } from "@remit/storage-service";
 import type { QueueName, RemitClientQueues } from "./queues.js";
-export interface ConnectionScope {
-    getConnection: () => Promise<IImapConnection>;
-    disconnect: () => Promise<void>;
-}
+export type { ConnectionScope };
+export type ConnectionScopeFactory = (accountService: IAccountRepository, secretsService: SecretsService) => (accountId: string) => Promise<ConnectionScope>;
 export interface RemitClientCore {
     accountConfig: IAccountConfigRepository;
     account: IAccountRepository;
@@ -95,11 +93,13 @@ export interface RemitClientRepositories {
 export interface RemitClientSharedDeps {
     storage: StorageService;
     secrets: SecretsService;
+    connectionScope: ConnectionScopeFactory;
     queues: RemitClientQueues;
 }
 export interface RemitClientDeps extends RemitClientSharedDeps {
     repositories: RemitClientRepositories;
 }
+export declare const passwordConnectionScope: (transport: ImapTransport) => ConnectionScopeFactory;
 export declare const buildReadPathFilterConfig: (repositories: Pick<RemitClientRepositories, "filter" | "messageLabel" | "mailbox" | "message" | "threadMessage" | "placementMove" | "address" | "mailboxSpecialUse">, queues: Pick<RemitClientQueues, "messageManagement">) => FilterConfig;
 export declare const createRemitCore: (deps: Omit<RemitClientDeps, "queues">) => RemitClientCore;
 export declare const composeSyncServices: (core: RemitClientCore, queues: Pick<RemitClientQueues, "sync">) => SyncQueueServices;

package/dist/src/service/create-remit-client.js

@@ -1,38 +1,21 @@
 import { logger } from "@remit/logger";
-import { BodySyncQueueService, BodySyncService, createConnection, FlagPushService, FlagQueueService, fifoMailboxManagement, MailboxQueueService, MessageMoveService, OutboxAttachmentService, OutboxQueueService, PlacementMoveService, SpamReportService, SyncWarningService, } from "@remit/mailbox-service";
+import { BodySyncQueueService, BodySyncService, connectionScope, FlagPushService, FlagQueueService, fifoMailboxManagement, MailboxQueueService, MessageMoveService, OutboxAttachmentService, OutboxQueueService, PlacementMoveService, SpamReportService, SyncWarningService, } from "@remit/mailbox-service";
 import { buildFilterConfig } from "@remit/mailbox-service/filter-config";
 import { deserializeEncryptedPayload, } from "@remit/secrets-service";
-const buildConnectionScope = (accountService, secretsService) => async (accountId) => {
+export const passwordConnectionScope = (transport) => (accountService, secretsService) => async (accountId) => {
     const account = await accountService.get(accountId);
     if (!account.passwordHash) {
         throw new Error(`Account ${accountId} has no passwordHash — OAuth accounts cannot use this connection path`);
     }
     const password = await secretsService.decrypt(deserializeEncryptedPayload(JSON.parse(account.passwordHash)));
-    let connection = null;
-    let connectPromise = null;
-    const getConnection = async () => {
-        if (connectPromise) {
-            return connectPromise;
-        }
-        const conn = createConnection({
-            user: account.username,
-            credentials: { kind: "password", password },
-            host: account.imapHost,
-            port: account.imapPort,
-            tls: account.imapTls,
-        });
-        connection = conn;
-        connectPromise = conn.connect().then(() => conn);
-        return connectPromise;
-    };
-    const disconnect = async () => {
-        if (connection) {
-            await connection.disconnect();
-            connection = null;
-            connectPromise = null;
-        }
-    };
-    return { getConnection, disconnect };
+    return connectionScope({
+        user: account.username,
+        credentials: { kind: "password", password },
+        host: account.imapHost,
+        port: account.imapPort,
+        tls: account.imapTls,
+        transport,
+    });
 };
 // The read-path body backfill (describeMessage / getRawMessage →
 // fetchAndGetBody) materializes a body that was never sync-synced, and must run
@@ -62,7 +45,7 @@ export const buildReadPathFilterConfig = (repositories, queues) => {
     });
 };
 export const createRemitCore = (deps) => {
-    const { repositories, storage, secrets } = deps;
+    const { repositories, storage, secrets, connectionScope } = deps;
     return {
         accountConfig: repositories.accountConfig,
         account: repositories.account,
@@ -103,7 +86,7 @@ export const createRemitCore = (deps) => {
             outboxAttachmentService: repositories.outboxAttachment,
             storage,
         }),
-        createConnectionScope: buildConnectionScope(repositories.account, secrets),
+        createConnectionScope: connectionScope(repositories.account, secrets),
     };
 };
 export const composeSyncServices = (core, queues) => {

package/dist/src/service/shared-deps.d.ts

@@ -1,4 +1,4 @@
-import type { RemitClientSharedDeps } from "./create-remit-client.js";
+import { type RemitClientSharedDeps } from "./create-remit-client.js";
 import type { QueueName, RemitClientQueues } from "./queues.js";
 export type SqsQueueUrls = Record<QueueName, string>;
 export declare const sqsQueueUrlsFromEnv: () => SqsQueueUrls;

package/dist/src/service/shared-deps.js

@@ -1,8 +1,10 @@
+import { nodeTransport } from "@remit/mailbox-service/node-transport";
 import { createCachedDataKeyProvider, createSecretsService, } from "@remit/secrets-service";
 import { createKmsDataKeyProvider, FAKE_KMS_KEY_ID, } from "@remit/secrets-service/kms";
 import { createFifoQueueProducer, createStandardQueueProducer, } from "@remit/sqs-client/producer";
 import { createStorageService } from "@remit/storage-service/s3";
 import { env } from "expect-env";
+import { passwordConnectionScope, } from "./create-remit-client.js";
 export const sqsQueueUrlsFromEnv = () => ({
     sync: env.SQS_QUEUE_URL,
     accountFanout: env.SQS_QUEUE_URL_ACCOUNT_FANOUT,
@@ -22,5 +24,6 @@ export const sqsQueues = (urls) => ({
 export const buildSharedDeps = (queues) => ({
     storage: createStorageService(),
     secrets: createSecretsService(createCachedDataKeyProvider(createKmsDataKeyProvider(process.env.KMS_KEY_ID ?? FAKE_KMS_KEY_ID))),
+    connectionScope: passwordConnectionScope(nodeTransport()),
     queues,
 });

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@remit/backend",
-	"version": "0.0.146",
+	"version": "0.0.148",
 	"description": "Remit Mail Inspector API backend",
 	"license": "MIT",
 	"author": "",

package/dist/src/handlers/ensure-account-config.d.ts

@@ -1,9 +0,0 @@
-import type { IAccountConfigRepository } from "@remit/data-ports";
-/**
- * Ensure an AccountConfig row exists for the given id. A first-time caller
- * coming from Cognito will not yet have one; subsequent calls are idempotent.
- *
- * We attempt a read first to avoid relying on a race on `create()` — the
- * deterministic id (derived from Cognito `sub`) makes both paths safe.
- */
-export declare const ensureAccountConfig: (accountConfig: IAccountConfigRepository, accountConfigId: string) => Promise<void>;

package/dist/src/handlers/ensure-account-config.js

@@ -1,27 +0,0 @@
-import { ConflictError, NotFoundError } from "@remit/data-ports/errors";
-/**
- * Ensure an AccountConfig row exists for the given id. A first-time caller
- * coming from Cognito will not yet have one; subsequent calls are idempotent.
- *
- * We attempt a read first to avoid relying on a race on `create()` — the
- * deterministic id (derived from Cognito `sub`) makes both paths safe.
- */
-export const ensureAccountConfig = async (accountConfig, accountConfigId) => {
-    const existing = await accountConfig.get(accountConfigId).catch((err) => {
-        if (err instanceof NotFoundError)
-            return undefined;
-        throw err;
-    });
-    if (existing)
-        return;
-    await accountConfig
-        .create({
-        accountConfigId,
-        userId: accountConfigId,
-    })
-        .catch((err) => {
-        if (err instanceof ConflictError)
-            return;
-        throw err;
-    });
-};