@remit/backend 0.0.147 → 0.0.149

package/dist/src/error.js

@@ -1,4 +1,4 @@
-import { isPublicApiError } from "@remit/data-ports/errors";
+import { HostRefusedError, isPublicApiError } from "@remit/data-ports/errors";
 import { logger } from "@remit/logger";
 import { formatResponse } from "./response.js";
 /**
@@ -35,6 +35,15 @@ export const defaultErrorCode = (statusCode) => {
     return CODE_BY_STATUS[statusCode] ?? "request_refused";
 };
 export const handleError = async (error) => {
+    if (error instanceof HostRefusedError) {
+        logger.error({
+            error: error.message,
+            errorKind: "quota",
+            statusCode: error.statusCode,
+            stack: error.stack,
+        }, "Host refused the request");
+        return formatResponse({ code: "request_refused", message: error.message }, error.statusCode);
+    }
     if (error instanceof Error) {
         if ("statusCode" in error) {
             logger.error({

package/dist/src/handlers/account-oauth.js

@@ -1,4 +1,5 @@
 import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { ensureAccountConfig } from "@remit/data-ports/account-config";
 import { AccountAuthType, AccountService, ConnectionState, } from "@remit/domain-enums";
 import { logger } from "@remit/logger";
 import { createMailOAuthService, microsoftProviderConfig, microsoftServicesGranted, orderServices, RefreshTokenError, } from "@remit/mail-oauth-service";
@@ -8,7 +9,6 @@ import { safeJsonParse } from "../json.js";
 import { rawApiResponse } from "../response.js";
 import { triggerAccountSyncSafe } from "./account.js";
 import { findActiveDuplicateMailbox } from "./account-guards.js";
-import { ensureAccountConfig } from "./ensure-account-config.js";
 const OUTLOOK_IMAP_HOST = "outlook.office365.com";
 const ACCOUNT_SERVICES = Object.values(AccountService);
 const isServiceList = (value) => Array.isArray(value) &&

package/dist/src/handlers/account.js

@@ -1,8 +1,10 @@
+import { ensureAccountConfig } from "@remit/data-ports/account-config";
 import { AccountAuthType, AccountService, ConnectionState, } from "@remit/domain-enums";
 import { logger } from "@remit/logger";
 import { createMailOAuthService, microsoftProviderConfig, RefreshTokenError, } from "@remit/mail-oauth-service";
-import { ownedAccount, resolveConnectionCredentials, testImapConnection, testSmtpConnection, } from "@remit/mailbox-service";
+import { ownedAccount, resolveConnectionCredentials, testImapConnection, } from "@remit/mailbox-service";
 import { deserializeEncryptedPayload, serializeEncryptedPayload, } from "@remit/secrets-service";
+import { verifySmtpConnection } from "@remit/smtp-service";
 import { loadMsOAuth } from "../config/msoauth.js";
 import { deleteAccount } from "../service/account-deletion.js";
 import { fireAndForget } from "../service/fire-and-forget.js";
@@ -11,7 +13,6 @@ import { triggerAccountSync } from "../service/trigger-sync.js";
 import { assertNoDuplicateMailbox, assertNotOAuthCreate, assertPasswordProvided, resolveSyncedServices, toAccountResponse, } from "./account-guards.js";
 import { loadAccountOverrides, upsertAccountDisplayName, writeAccountComposeLanguages, writeAccountMuted, } from "./account-overrides.js";
 import { loadSignatureForAccount, upsertAccountSignature, } from "./account-signature.js";
-import { ensureAccountConfig } from "./ensure-account-config.js";
 import { resolveAccountFolderAppointments } from "./folder-role-appointments.js";
 export { assertNotOAuthCreate, assertPasswordProvided, toAccountResponse };
 export const triggerAccountSyncSafe = async (client, accountId) => {
@@ -44,7 +45,7 @@ export const triggerAccountSyncSafe = async (client, accountId) => {
  * reauth-required case is mapped to the distinct `reauth_required` error code
  * so the UI can route the user into the OAuth re-auth flow.
  */
-const testOAuthConnection = async (msOAuth, existingAccount, account, secrets) => {
+const testOAuthConnection = async (msOAuth, existingAccount, account, secrets, mailTransports) => {
     const { config, credentials: app } = await loadMsOAuth(msOAuth);
     const tokenService = createMailOAuthService(microsoftProviderConfig({
         clientId: app.clientId,
@@ -93,19 +94,20 @@ const testOAuthConnection = async (msOAuth, existingAccount, account, secrets) =
         secure: existingAccount.imapTls,
         user: existingAccount.username,
         credentials,
-    });
+    }, mailTransports.imap(existingAccount.imapHost, existingAccount.imapTls));
     result.imapSuccess = imapResult.success;
     if (!imapResult.success) {
         result.imapError = imapResult.error;
     }
     // OAuth accounts share the same access token for IMAP and SMTP.
     if (existingAccount.smtpEnabled) {
-        const smtpResult = await testSmtpConnection({
+        const smtpResult = await verifySmtpConnection({
             host: existingAccount.smtpHost ?? "",
             port: existingAccount.smtpPort ?? 587,
             secure: existingAccount.smtpTls ?? false,
             user: existingAccount.smtpUsername || existingAccount.username,
             credentials,
+            getSocket: mailTransports.smtp,
         });
         result.smtpSuccess = smtpResult.success;
         if (!smtpResult.success) {
@@ -181,7 +183,7 @@ export const AccountOperations = {
     AccountOperations_testConnection: async (context, ctx) => {
         const accountConfigId = ctx.identity.accountConfigId;
         const input = context.request.requestBody;
-        const { account, secrets } = ctx.client;
+        const { account, secrets, mailTransports } = ctx.client;
         // Resolve password - use provided password or decrypt stored password
         let imapPassword = input.password;
         let smtpPassword = input.smtpPassword;
@@ -190,7 +192,7 @@ export const AccountOperations = {
             unwrap(ownedAccount(existingAccount, accountConfigId, "read"));
             const authType = existingAccount.authType ?? "password";
             if (authType === "oauthMicrosoft") {
-                return testOAuthConnection(ctx.config.msOAuth, existingAccount, account, secrets);
+                return testOAuthConnection(ctx.config.msOAuth, existingAccount, account, secrets, mailTransports);
             }
             if (existingAccount.passwordHash) {
                 const payload = deserializeEncryptedPayload(JSON.parse(existingAccount.passwordHash));
@@ -218,17 +220,16 @@ export const AccountOperations = {
             host: input.imapHost,
             port: input.imapPort,
             secure: input.imapTls,
-            startTls: input.imapStartTls,
             user: input.username,
             credentials: { kind: "password", password: imapPassword },
-        });
+        }, mailTransports.imap(input.imapHost, input.imapTls));
         result.imapSuccess = imapResult.success;
         if (!imapResult.success) {
             result.imapError = imapResult.error;
         }
         // Test SMTP connection if configured
         if (input.smtpHost) {
-            const smtpResult = await testSmtpConnection({
+            const smtpResult = await verifySmtpConnection({
                 host: input.smtpHost,
                 port: input.smtpPort ?? 587,
                 secure: input.smtpTls ?? false,
@@ -237,6 +238,7 @@ export const AccountOperations = {
                     kind: "password",
                     password: smtpPassword ?? imapPassword,
                 },
+                getSocket: mailTransports.smtp,
             });
             result.smtpSuccess = smtpResult.success;
             if (!smtpResult.success) {

package/dist/src/handlers/config.js

@@ -65,12 +65,12 @@ const toAccountConfigResponse = (config) => ({
  * The POST account-creation flow will materialize the real row when the user
  * adds their first account.
  */
-const emptyConfigResponse = (accountConfigId, userId, commit) => {
+const emptyConfigResponse = (accountConfigId, commit) => {
     const now = Date.now();
     return {
         accountConfig: {
             accountConfigId,
-            userId,
+            userId: accountConfigId,
             state: "active",
             createdAt: now,
             updatedAt: now,
@@ -91,11 +91,11 @@ export const ConfigOperations = {
             throw err;
         });
         if (!description || description.accountConfig.length === 0) {
-            return emptyConfigResponse(accountConfigId, ctx.identity.sub, ctx.config.commit);
+            return emptyConfigResponse(accountConfigId, ctx.config.commit);
         }
         const accountConfig = description.accountConfig[0];
         if (!accountConfig) {
-            return emptyConfigResponse(accountConfigId, ctx.identity.sub, ctx.config.commit);
+            return emptyConfigResponse(accountConfigId, ctx.config.commit);
         }
         // Filter out deleted accounts (tombstone pattern)
         const activeAccounts = description.account.filter((acc) => acc.deletedAt === undefined);
@@ -151,7 +151,6 @@ export const ConfigOperations = {
             appointFolderRole: (configId, accountId, role, mailboxId, lastKnownPath) => writeFolderRoleAppointment(client.accountSetting, configId, accountId, role, mailboxId, lastKnownPath),
         }, {
             accountConfigId,
-            userId: ctx.identity.sub,
             document: body.document,
             mode: body.mode ?? "validate",
             onExisting: body.onExisting ?? "abort",

package/dist/src/service/create-remit-client.d.ts

@@ -1,11 +1,14 @@
 import type { IAccountConfigRepository, IAccountExportRequestRepository, IAccountRepository, IAccountSettingRepository, IAddressRepository, ICalendarCollectionRepository, ICalendarEventIndexRepository, ICalendarFeedTokenRepository, ICalendarObjectRepository, ICalendarStore, ICalendarSuggestionRepository, IConfigImportRepository, IEnvelopeRepository, IFilterRepository, ILabelRepository, IMailboxLockRepository, IMailboxRepository, IMailboxSpecialUseRepository, IMessageFlagPushRepository, IMessageFlagRepository, IMessageLabelRepository, IMessagePlacementMoveRepository, IMessageRepository, IOrganizeJobRequestRepository, IOutboxAttachmentRepository, IOutboxMessageRepository, IQuarantineRepository, ISenderSignerStandingRepository, ISyncWarningRepository, IThreadMessageRepository } from "@remit/data-ports";
-import { BodySyncQueueService, BodySyncService, type FilterConfig, FlagQueueService, type IImapConnection, MailboxQueueService, MessageMoveService, OutboxAttachmentService, OutboxQueueService, SpamReportService } from "@remit/mailbox-service";
+import { BodySyncQueueService, BodySyncService, type ConnectionScope, type FilterConfig, FlagQueueService, type ImapTransport, MailboxQueueService, MessageMoveService, OutboxAttachmentService, OutboxQueueService, SpamReportService } from "@remit/mailbox-service";
 import { type SecretsService } from "@remit/secrets-service";
+import type { SmtpGetSocket } from "@remit/smtp-service";
 import type { StorageService } from "@remit/storage-service";
 import type { QueueName, RemitClientQueues } from "./queues.js";
-export interface ConnectionScope {
-    getConnection: () => Promise<IImapConnection>;
-    disconnect: () => Promise<void>;
+export type { ConnectionScope };
+export type ConnectionScopeFactory = (accountService: IAccountRepository, secretsService: SecretsService) => (accountId: string) => Promise<ConnectionScope>;
+export interface MailTransports {
+    imap: (host: string, secure: boolean) => ImapTransport;
+    smtp: SmtpGetSocket;
 }
 export interface RemitClientCore {
     accountConfig: IAccountConfigRepository;
@@ -41,6 +44,7 @@ export interface RemitClientCore {
     flagPush: IMessageFlagPushRepository;
     outboxAttachment: OutboxAttachmentService;
     createConnectionScope: (accountId: string) => Promise<ConnectionScope>;
+    mailTransports: MailTransports;
 }
 export interface SyncQueueServices {
     flagQueue: FlagQueueService;
@@ -95,11 +99,14 @@ export interface RemitClientRepositories {
 export interface RemitClientSharedDeps {
     storage: StorageService;
     secrets: SecretsService;
+    connectionScope: ConnectionScopeFactory;
+    mailTransports: MailTransports;
     queues: RemitClientQueues;
 }
 export interface RemitClientDeps extends RemitClientSharedDeps {
     repositories: RemitClientRepositories;
 }
+export declare const passwordConnectionScope: (transport: ImapTransport) => ConnectionScopeFactory;
 export declare const buildReadPathFilterConfig: (repositories: Pick<RemitClientRepositories, "filter" | "messageLabel" | "mailbox" | "message" | "threadMessage" | "placementMove" | "address" | "mailboxSpecialUse">, queues: Pick<RemitClientQueues, "messageManagement">) => FilterConfig;
 export declare const createRemitCore: (deps: Omit<RemitClientDeps, "queues">) => RemitClientCore;
 export declare const composeSyncServices: (core: RemitClientCore, queues: Pick<RemitClientQueues, "sync">) => SyncQueueServices;

package/dist/src/service/create-remit-client.js

@@ -1,38 +1,21 @@
 import { logger } from "@remit/logger";
-import { BodySyncQueueService, BodySyncService, createConnection, FlagPushService, FlagQueueService, fifoMailboxManagement, MailboxQueueService, MessageMoveService, OutboxAttachmentService, OutboxQueueService, PlacementMoveService, SpamReportService, SyncWarningService, } from "@remit/mailbox-service";
+import { BodySyncQueueService, BodySyncService, connectionScope, FlagPushService, FlagQueueService, fifoMailboxManagement, MailboxQueueService, MessageMoveService, OutboxAttachmentService, OutboxQueueService, PlacementMoveService, SpamReportService, SyncWarningService, } from "@remit/mailbox-service";
 import { buildFilterConfig } from "@remit/mailbox-service/filter-config";
 import { deserializeEncryptedPayload, } from "@remit/secrets-service";
-const buildConnectionScope = (accountService, secretsService) => async (accountId) => {
+export const passwordConnectionScope = (transport) => (accountService, secretsService) => async (accountId) => {
     const account = await accountService.get(accountId);
     if (!account.passwordHash) {
         throw new Error(`Account ${accountId} has no passwordHash — OAuth accounts cannot use this connection path`);
     }
     const password = await secretsService.decrypt(deserializeEncryptedPayload(JSON.parse(account.passwordHash)));
-    let connection = null;
-    let connectPromise = null;
-    const getConnection = async () => {
-        if (connectPromise) {
-            return connectPromise;
-        }
-        const conn = createConnection({
-            user: account.username,
-            credentials: { kind: "password", password },
-            host: account.imapHost,
-            port: account.imapPort,
-            tls: account.imapTls,
-        });
-        connection = conn;
-        connectPromise = conn.connect().then(() => conn);
-        return connectPromise;
-    };
-    const disconnect = async () => {
-        if (connection) {
-            await connection.disconnect();
-            connection = null;
-            connectPromise = null;
-        }
-    };
-    return { getConnection, disconnect };
+    return connectionScope({
+        user: account.username,
+        credentials: { kind: "password", password },
+        host: account.imapHost,
+        port: account.imapPort,
+        tls: account.imapTls,
+        transport,
+    });
 };
 // The read-path body backfill (describeMessage / getRawMessage →
 // fetchAndGetBody) materializes a body that was never sync-synced, and must run
@@ -62,7 +45,7 @@ export const buildReadPathFilterConfig = (repositories, queues) => {
     });
 };
 export const createRemitCore = (deps) => {
-    const { repositories, storage, secrets } = deps;
+    const { repositories, storage, secrets, connectionScope, mailTransports } = deps;
     return {
         accountConfig: repositories.accountConfig,
         account: repositories.account,
@@ -103,7 +86,8 @@ export const createRemitCore = (deps) => {
             outboxAttachmentService: repositories.outboxAttachment,
             storage,
         }),
-        createConnectionScope: buildConnectionScope(repositories.account, secrets),
+        createConnectionScope: connectionScope(repositories.account, secrets),
+        mailTransports,
     };
 };
 export const composeSyncServices = (core, queues) => {

package/dist/src/service/shared-deps.d.ts

@@ -1,4 +1,4 @@
-import type { RemitClientSharedDeps } from "./create-remit-client.js";
+import { type RemitClientSharedDeps } from "./create-remit-client.js";
 import type { QueueName, RemitClientQueues } from "./queues.js";
 export type SqsQueueUrls = Record<QueueName, string>;
 export declare const sqsQueueUrlsFromEnv: () => SqsQueueUrls;

package/dist/src/service/shared-deps.js

@@ -1,8 +1,11 @@
+import { nodeTransport } from "@remit/mailbox-service/node-transport";
 import { createCachedDataKeyProvider, createSecretsService, } from "@remit/secrets-service";
 import { createKmsDataKeyProvider, FAKE_KMS_KEY_ID, } from "@remit/secrets-service/kms";
+import { directSmtpSocket } from "@remit/smtp-service";
 import { createFifoQueueProducer, createStandardQueueProducer, } from "@remit/sqs-client/producer";
 import { createStorageService } from "@remit/storage-service/s3";
 import { env } from "expect-env";
+import { passwordConnectionScope, } from "./create-remit-client.js";
 export const sqsQueueUrlsFromEnv = () => ({
     sync: env.SQS_QUEUE_URL,
     accountFanout: env.SQS_QUEUE_URL_ACCOUNT_FANOUT,
@@ -19,8 +22,13 @@ export const sqsQueues = (urls) => ({
     }),
     body: createStandardQueueProducer({ queueUrl: urls.body }),
 });
-export const buildSharedDeps = (queues) => ({
-    storage: createStorageService(),
-    secrets: createSecretsService(createCachedDataKeyProvider(createKmsDataKeyProvider(process.env.KMS_KEY_ID ?? FAKE_KMS_KEY_ID))),
-    queues,
-});
+export const buildSharedDeps = (queues) => {
+    const imapTransport = nodeTransport();
+    return {
+        storage: createStorageService(),
+        secrets: createSecretsService(createCachedDataKeyProvider(createKmsDataKeyProvider(process.env.KMS_KEY_ID ?? FAKE_KMS_KEY_ID))),
+        connectionScope: passwordConnectionScope(imapTransport),
+        mailTransports: { imap: () => imapTransport, smtp: directSmtpSocket },
+        queues,
+    };
+};

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@remit/backend",
-	"version": "0.0.147",
+	"version": "0.0.149",
 	"description": "Remit Mail Inspector API backend",
 	"license": "MIT",
 	"author": "",
@@ -101,6 +101,7 @@
 		"@remit/mail-oauth-service": "*",
 		"@remit/secrets-service": "*",
 		"@remit/mailbox-service": "*",
+		"@remit/smtp-service": "*",
 		"@remit/storage-service": "*",
 		"@remit/auth-service": "*",
 		"@remit/drizzle-service": "*",

package/dist/src/handlers/ensure-account-config.d.ts

@@ -1,9 +0,0 @@
-import type { IAccountConfigRepository } from "@remit/data-ports";
-/**
- * Ensure an AccountConfig row exists for the given id. A first-time caller
- * coming from Cognito will not yet have one; subsequent calls are idempotent.
- *
- * We attempt a read first to avoid relying on a race on `create()` — the
- * deterministic id (derived from Cognito `sub`) makes both paths safe.
- */
-export declare const ensureAccountConfig: (accountConfig: IAccountConfigRepository, accountConfigId: string) => Promise<void>;

package/dist/src/handlers/ensure-account-config.js

@@ -1,27 +0,0 @@
-import { ConflictError, NotFoundError } from "@remit/data-ports/errors";
-/**
- * Ensure an AccountConfig row exists for the given id. A first-time caller
- * coming from Cognito will not yet have one; subsequent calls are idempotent.
- *
- * We attempt a read first to avoid relying on a race on `create()` — the
- * deterministic id (derived from Cognito `sub`) makes both paths safe.
- */
-export const ensureAccountConfig = async (accountConfig, accountConfigId) => {
-    const existing = await accountConfig.get(accountConfigId).catch((err) => {
-        if (err instanceof NotFoundError)
-            return undefined;
-        throw err;
-    });
-    if (existing)
-        return;
-    await accountConfig
-        .create({
-        accountConfigId,
-        userId: accountConfigId,
-    })
-        .catch((err) => {
-        if (err instanceof ConflictError)
-            return;
-        throw err;
-    });
-};