@remit/backend 0.0.151 → 0.0.152

package/dist/src/handlers/account-oauth.d.ts

@@ -1,20 +1,17 @@
-import type { AccountService as AccountServiceName } from "@remit/api-openapi-types";
 import type { Context } from "openapi-backend";
 import type { HandlerContext, PublicOperationHandler } from "../types.js";
-export interface OAuthState {
-    accountConfigId: string;
-    nonce: string;
-    timestamp: number;
-    services: AccountServiceName[];
-}
-export declare const STATE_TTL_MS: number;
-export declare function signState(payload: OAuthState, clientSecret: string): Promise<string>;
-export declare function verifyState(state: string, clientSecret: string): Promise<OAuthState>;
 export declare function parseJwtClaims(token: string): Promise<Record<string, unknown> | null>;
 export declare function getWebOrigin(origins: readonly string[]): string;
 export declare const microsoftOAuthCallback: PublicOperationHandler<"sync">;
+export interface SignInNotConfigured {
+    statusCode: 501;
+    body: {
+        code: "not_configured";
+        message: string;
+    };
+}
 export declare const MicrosoftOAuthOperations: {
     MicrosoftOAuthOperations_microsoftOAuthStart: (context: Context, ctx: HandlerContext) => Promise<{
         authorizationUrl: string;
-    }>;
+    } | SignInNotConfigured>;
 };

package/dist/src/handlers/account-oauth.js

@@ -1,4 +1,4 @@
-import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { randomBytes } from "node:crypto";
 import { ensureAccountConfig } from "@remit/data-ports/account-config";
 import { AccountAuthType, AccountService, ConnectionState, } from "@remit/domain-enums";
 import { logger } from "@remit/logger";
@@ -6,63 +6,11 @@ import { createMailOAuthService, microsoftProviderConfig, microsoftServicesGrant
 import { serializeEncryptedPayload } from "@remit/secrets-service";
 import { loadMsOAuth } from "../config/msoauth.js";
 import { safeJsonParse } from "../json.js";
+import { signState, verifyState } from "../oauth-state.js";
 import { rawApiResponse } from "../response.js";
 import { triggerAccountSyncSafe } from "./account.js";
 import { findActiveDuplicateMailbox } from "./account-guards.js";
 const OUTLOOK_IMAP_HOST = "outlook.office365.com";
-const ACCOUNT_SERVICES = Object.values(AccountService);
-const isServiceList = (value) => Array.isArray(value) &&
-    value.length > 0 &&
-    value.every((service) => typeof service === "string" && ACCOUNT_SERVICES.includes(service));
-export const STATE_TTL_MS = 10 * 60 * 1000; // 10 minutes
-/**
- * Derive a signing key from the client secret, namespaced to avoid reuse.
- * The key is HMAC-SHA256("oauth-state-signing:" + clientSecret).
- */
-function deriveSigningKey(clientSecret) {
-    return createHmac("sha256", `oauth-state-signing:${clientSecret}`)
-        .update("")
-        .digest();
-}
-function base64urlEncode(buf) {
-    return buf.toString("base64url");
-}
-function base64urlDecode(str) {
-    return Buffer.from(str, "base64url");
-}
-export async function signState(payload, clientSecret) {
-    const key = deriveSigningKey(clientSecret);
-    const payloadBuf = Buffer.from(JSON.stringify(payload), "utf8");
-    const payloadEncoded = base64urlEncode(payloadBuf);
-    const sig = createHmac("sha256", key).update(payloadEncoded).digest();
-    const sigEncoded = base64urlEncode(sig);
-    return `${payloadEncoded}.${sigEncoded}`;
-}
-export async function verifyState(state, clientSecret) {
-    const dotIndex = state.lastIndexOf(".");
-    if (dotIndex < 0)
-        throw new Error("Malformed state: missing dot separator");
-    const payloadEncoded = state.slice(0, dotIndex);
-    const sigEncoded = state.slice(dotIndex + 1);
-    const key = deriveSigningKey(clientSecret);
-    const expectedSig = createHmac("sha256", key).update(payloadEncoded).digest();
-    const actualSig = base64urlDecode(sigEncoded);
-    if (actualSig.length !== expectedSig.length ||
-        !timingSafeEqual(actualSig, expectedSig)) {
-        throw new Error("State signature verification failed");
-    }
-    const payload = JSON.parse(base64urlDecode(payloadEncoded).toString("utf8"));
-    if (Date.now() - payload.timestamp > STATE_TTL_MS) {
-        throw new Error("State has expired");
-    }
-    if (payload.services === undefined) {
-        return { ...payload, services: [AccountService.Mail] };
-    }
-    if (!isServiceList(payload.services)) {
-        throw new Error("State names no requested services");
-    }
-    return payload;
-}
 // ─── JWT claims parsing ──────────────────────────────────────────────────────
 export async function parseJwtClaims(token) {
     const parts = token.split(".");
@@ -301,8 +249,22 @@ export const microsoftOAuthCallback = async (context, ctx) => {
     }
     return redirect(`${webOrigin}/settings/accounts?connected=${encodeURIComponent(accountId)}`);
 };
+/**
+ * An instance with no Microsoft app answers the start of a sign-in with a
+ * refusal the onboarding wizard can show, rather than the 500 the config load
+ * would otherwise throw.
+ */
+const signInNotConfigured = () => ({
+    statusCode: 501,
+    body: {
+        code: "not_configured",
+        message: "Microsoft sign-in is not configured on this instance; connect the account with an app password instead.",
+    },
+});
 export const MicrosoftOAuthOperations = {
     MicrosoftOAuthOperations_microsoftOAuthStart: async (context, ctx) => {
+        if (ctx.config.msOAuth.mode === "Disabled")
+            return signInNotConfigured();
         const accountConfigId = ctx.identity.accountConfigId;
         const input = context.request.requestBody;
         const email = typeof input.email === "string" ? input.email : undefined;

package/dist/src/handlers/index.d.ts

@@ -162,7 +162,7 @@ export declare const handlers: {
     MailboxOperations_createMailbox: (context: import("openapi-backend").Context<any, any, any, any, any, import("openapi-backend").Document>, ctx: import("../types.js").HandlerContext<"sync">) => Promise<import("@remit/api-openapi-types").Components.Schemas.MailboxResponse>;
     MicrosoftOAuthOperations_microsoftOAuthStart: (context: import("openapi-backend").Context, ctx: import("../types.js").HandlerContext) => Promise<{
         authorizationUrl: string;
-    }>;
+    } | import("./account-oauth.js").SignInNotConfigured>;
     AccountDetailOperations_updateAccount: (context: import("openapi-backend").Context, ctx: import("../types.js").HandlerContext) => Promise<import("@remit/api-openapi-types").AccountResponse>;
     AccountDetailOperations_deleteAccount: (context: import("openapi-backend").Context, ctx: import("../types.js").HandlerContext<"accountFanout">) => Promise<import("@remit/api-openapi-types").DeleteAccountResponse>;
     AccountOperations_createAccount: (context: import("openapi-backend").Context, ctx: import("../types.js").HandlerContext<"sync">) => Promise<import("@remit/api-openapi-types").AccountResponse>;

package/dist/src/oauth-state.d.ts

@@ -0,0 +1,10 @@
+import type { AccountService as AccountServiceName } from "@remit/api-openapi-types";
+export interface OAuthState {
+    accountConfigId: string;
+    nonce: string;
+    timestamp: number;
+    services: AccountServiceName[];
+}
+export declare const STATE_TTL_MS: number;
+export declare function signState(payload: OAuthState, clientSecret: string): Promise<string>;
+export declare function verifyState(state: string, clientSecret: string): Promise<OAuthState>;

package/dist/src/oauth-state.js

@@ -0,0 +1,55 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { AccountService } from "@remit/domain-enums";
+const ACCOUNT_SERVICES = Object.values(AccountService);
+const isServiceList = (value) => Array.isArray(value) &&
+    value.length > 0 &&
+    value.every((service) => typeof service === "string" && ACCOUNT_SERVICES.includes(service));
+export const STATE_TTL_MS = 10 * 60 * 1000; // 10 minutes
+/**
+ * Derive a signing key from the client secret, namespaced to avoid reuse.
+ * The key is HMAC-SHA256("oauth-state-signing:" + clientSecret).
+ */
+function deriveSigningKey(clientSecret) {
+    return createHmac("sha256", `oauth-state-signing:${clientSecret}`)
+        .update("")
+        .digest();
+}
+function base64urlEncode(buf) {
+    return buf.toString("base64url");
+}
+function base64urlDecode(str) {
+    return Buffer.from(str, "base64url");
+}
+export async function signState(payload, clientSecret) {
+    const key = deriveSigningKey(clientSecret);
+    const payloadBuf = Buffer.from(JSON.stringify(payload), "utf8");
+    const payloadEncoded = base64urlEncode(payloadBuf);
+    const sig = createHmac("sha256", key).update(payloadEncoded).digest();
+    const sigEncoded = base64urlEncode(sig);
+    return `${payloadEncoded}.${sigEncoded}`;
+}
+export async function verifyState(state, clientSecret) {
+    const dotIndex = state.lastIndexOf(".");
+    if (dotIndex < 0)
+        throw new Error("Malformed state: missing dot separator");
+    const payloadEncoded = state.slice(0, dotIndex);
+    const sigEncoded = state.slice(dotIndex + 1);
+    const key = deriveSigningKey(clientSecret);
+    const expectedSig = createHmac("sha256", key).update(payloadEncoded).digest();
+    const actualSig = base64urlDecode(sigEncoded);
+    if (actualSig.length !== expectedSig.length ||
+        !timingSafeEqual(actualSig, expectedSig)) {
+        throw new Error("State signature verification failed");
+    }
+    const payload = JSON.parse(base64urlDecode(payloadEncoded).toString("utf8"));
+    if (Date.now() - payload.timestamp > STATE_TTL_MS) {
+        throw new Error("State has expired");
+    }
+    if (payload.services === undefined) {
+        return { ...payload, services: [AccountService.Mail] };
+    }
+    if (!isServiceList(payload.services)) {
+        throw new Error("State names no requested services");
+    }
+    return payload;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@remit/backend",
-	"version": "0.0.151",
+	"version": "0.0.152",
 	"description": "Remit Mail Inspector API backend",
 	"license": "MIT",
 	"author": "",
@@ -63,6 +63,10 @@
 			"types": "./dist/src/service/trigger-sync.d.ts",
 			"default": "./dist/src/service/trigger-sync.js"
 		},
+		"./oauth-state": {
+			"types": "./dist/src/oauth-state.d.ts",
+			"default": "./dist/src/oauth-state.js"
+		},
 		"./content-handler": {
 			"types": "./dist/dev-server/content-handler.d.ts",
 			"default": "./dist/dev-server/content-handler.js"