@remit/backend 0.0.152 → 0.0.153

package/dist/src/config/msoauth.d.ts

@@ -1,12 +1,23 @@
-import type { OAuthProviderConfig } from "@remit/mail-oauth-service";
+import { type MailOAuthService, type OAuthProviderConfig } from "@remit/mail-oauth-service";
 export interface MsOAuthCredentials {
     clientId: string;
     clientSecret: string;
 }
+/** Where a connected Outlook account's mail server is reached instead of Microsoft's. */
+export interface MailServerOverride {
+    host: string;
+    port: number;
+    tls: boolean;
+    startTls: boolean;
+}
+export interface MsOAuthOverrides extends Partial<Pick<OAuthProviderConfig, "tokenEndpoint">> {
+    imapServer?: MailServerOverride;
+    smtpServer?: MailServerOverride;
+}
 export interface MsOAuthEnabled {
     mode: "Enabled";
     redirectUri: string;
-    overrides: Partial<Pick<OAuthProviderConfig, "tokenEndpoint">>;
+    overrides: MsOAuthOverrides;
     credentials: () => Promise<MsOAuthCredentials>;
 }
 export type MsOAuthConfig = {
@@ -17,3 +28,10 @@ export interface LoadedMsOAuth {
     credentials: MsOAuthCredentials;
 }
 export declare const loadMsOAuth: (config: MsOAuthConfig) => Promise<LoadedMsOAuth>;
+export type MicrosoftTokenService = Pick<MailOAuthService, "getAccessToken">;
+/**
+ * The access-token minting a connected Outlook account syncs and sends with.
+ * The app's credentials load on the first token asked for, and once loaded the
+ * service keeps its token cache for every account after it.
+ */
+export declare const microsoftTokenService: (msOAuth: MsOAuthConfig) => MicrosoftTokenService;

package/dist/src/config/msoauth.js

@@ -1,6 +1,29 @@
+import { createMailOAuthService, microsoftProviderConfig, } from "@remit/mail-oauth-service";
 export const loadMsOAuth = async (config) => {
     if (config.mode === "Disabled") {
         throw new Error("No Microsoft OAuth credentials are configured on this instance: set MSOAUTH_CLIENT_ID and MSOAUTH_CLIENT_SECRET, or MSOAUTH_SECRET_ARN");
     }
     return { config, credentials: await config.credentials() };
 };
+/**
+ * The access-token minting a connected Outlook account syncs and sends with.
+ * The app's credentials load on the first token asked for, and once loaded the
+ * service keeps its token cache for every account after it.
+ */
+export const microsoftTokenService = (msOAuth) => {
+    let service;
+    const load = () => loadMsOAuth(msOAuth).then(({ config, credentials }) => createMailOAuthService(microsoftProviderConfig({
+        clientId: credentials.clientId,
+        clientSecret: credentials.clientSecret,
+        overrides: config.overrides,
+    })));
+    return {
+        getAccessToken: (cacheKey, refreshToken) => {
+            service ??= load().catch((error) => {
+                service = undefined;
+                throw error;
+            });
+            return service.then((loaded) => loaded.getAccessToken(cacheKey, refreshToken));
+        },
+    };
+};

package/dist/src/handlers/account-oauth.js

@@ -6,11 +6,22 @@ import { createMailOAuthService, microsoftProviderConfig, microsoftServicesGrant
 import { serializeEncryptedPayload } from "@remit/secrets-service";
 import { loadMsOAuth } from "../config/msoauth.js";
 import { safeJsonParse } from "../json.js";
-import { signState, verifyState } from "../oauth-state.js";
+import { ACCOUNT_SETTINGS_ROUTE, oauthRefusalUrl, signState, verifyState, } from "../oauth-state.js";
 import { rawApiResponse } from "../response.js";
 import { triggerAccountSyncSafe } from "./account.js";
 import { findActiveDuplicateMailbox } from "./account-guards.js";
-const OUTLOOK_IMAP_HOST = "outlook.office365.com";
+const OUTLOOK_IMAP = {
+    host: "outlook.office365.com",
+    port: 993,
+    tls: true,
+    startTls: false,
+};
+const OUTLOOK_SMTP = {
+    host: "smtp.office365.com",
+    port: 587,
+    tls: false,
+    startTls: true,
+};
 // ─── JWT claims parsing ──────────────────────────────────────────────────────
 export async function parseJwtClaims(token) {
     const parts = token.split(".");
@@ -25,7 +36,7 @@ export function getWebOrigin(origins) {
     return httpsOrigin ?? origins[0] ?? "https://localhost:3000";
 }
 const scopeRefusalUrl = (webOrigin, email, missingServices) => {
-    const url = new URL(`${webOrigin}/settings/accounts`);
+    const url = new URL(`${webOrigin}${ACCOUNT_SETTINGS_ROUTE}`);
     url.searchParams.set("oauthError", "scope_not_granted");
     url.searchParams.set("oauthEmail", email);
     url.searchParams.set("missingServices", missingServices.join(","));
@@ -73,13 +84,12 @@ export const microsoftOAuthCallback = async (context, ctx) => {
     });
     // If Microsoft returned an error, pass it through to the frontend
     if (qs.error) {
-        const errorCode = encodeURIComponent(qs.error);
-        return redirect(`${webOrigin}/settings/accounts?oauthError=${errorCode}`);
+        return redirect(oauthRefusalUrl(webOrigin, qs.error));
     }
     const code = qs.code;
     const state = qs.state;
     if (!code || !state) {
-        return redirect(`${webOrigin}/settings/accounts?oauthError=missing_params`);
+        return redirect(oauthRefusalUrl(webOrigin, "missing_params"));
     }
     const loaded = await loadMsOAuth(ctx.config.msOAuth).catch((err) => {
         logger.error({
@@ -92,7 +102,7 @@ export const microsoftOAuthCallback = async (context, ctx) => {
         return null;
     });
     if (loaded === null)
-        return redirect(`${webOrigin}/settings/accounts?oauthError=config_error`);
+        return redirect(oauthRefusalUrl(webOrigin, "config_error"));
     const { config, credentials } = loaded;
     // Verify the HMAC-signed state
     // A bad/expired/forged state is a security-relevant signal (CSRF
@@ -108,7 +118,7 @@ export const microsoftOAuthCallback = async (context, ctx) => {
         return null;
     });
     if (statePayload === null)
-        return redirect(`${webOrigin}/settings/accounts?oauthError=invalid_state`);
+        return redirect(oauthRefusalUrl(webOrigin, "invalid_state"));
     const { accountConfigId } = statePayload;
     const [firstService] = orderServices(statePayload.services);
     const serviceFor = (service) => createMailOAuthService(microsoftProviderConfig({
@@ -125,10 +135,10 @@ export const microsoftOAuthCallback = async (context, ctx) => {
         return null;
     });
     if (tokenSet === null)
-        return redirect(`${webOrigin}/settings/accounts?oauthError=exchange_failed`);
+        return redirect(oauthRefusalUrl(webOrigin, "exchange_failed"));
     if (!tokenSet.refreshToken) {
         logger.error({ accountConfigId }, "MS OAuth token exchange returned no refresh_token");
-        return redirect(`${webOrigin}/settings/accounts?oauthError=exchange_failed`);
+        return redirect(oauthRefusalUrl(webOrigin, "exchange_failed"));
     }
     // Extract the user's email from the ID token returned alongside the access
     // token when openid+email scopes are requested.
@@ -160,7 +170,7 @@ export const microsoftOAuthCallback = async (context, ctx) => {
         : undefined;
     if (!email) {
         logger.error({ accountConfigId }, "MS OAuth: could not extract email from token claims");
-        return redirect(`${webOrigin}/settings/accounts?oauthError=missing_email`);
+        return redirect(oauthRefusalUrl(webOrigin, "missing_email"));
     }
     const { account, accountConfig, secrets } = ctx.client;
     // Reconnect when an active OAuth account already onboards this mailbox.
@@ -168,8 +178,10 @@ export const microsoftOAuthCallback = async (context, ctx) => {
     // the existing account (token refresh) rather than rejecting, because a
     // re-auth is the expected, idempotent path for OAuth.
     const existingAccounts = (await account.listAllByAccountConfig(accountConfigId)).filter((a) => a.authType === AccountAuthType.OauthMicrosoft);
+    const imapServer = config.overrides.imapServer ?? OUTLOOK_IMAP;
+    const smtpServer = config.overrides.smtpServer ?? OUTLOOK_SMTP;
     const existing = findActiveDuplicateMailbox(existingAccounts, {
-        imapHost: OUTLOOK_IMAP_HOST,
+        imapHost: imapServer.host,
         username: email,
     });
     const services = orderServices([
@@ -181,7 +193,7 @@ export const microsoftOAuthCallback = async (context, ctx) => {
         redemption.reason === "scope_not_granted")
         return redirect(scopeRefusalUrl(webOrigin, email, [redemption.service]));
     if (redemption.kind === "refused")
-        return redirect(`${webOrigin}/settings/accounts?oauthError=${redemption.reason}`);
+        return redirect(oauthRefusalUrl(webOrigin, redemption.reason));
     const grantedScopes = [
         ...new Set([...tokenSet.grantedScopes, ...redemption.grantedScopes]),
     ];
@@ -228,15 +240,15 @@ export const microsoftOAuthCallback = async (context, ctx) => {
             grantedScopes,
             oauthRefreshTokenHash,
             oauthTokenUpdatedAt,
-            imapHost: OUTLOOK_IMAP_HOST,
-            imapPort: 993,
-            imapTls: true,
-            imapStartTls: false,
+            imapHost: imapServer.host,
+            imapPort: imapServer.port,
+            imapTls: imapServer.tls,
+            imapStartTls: imapServer.startTls,
             smtpEnabled: true,
-            smtpHost: "smtp.office365.com",
-            smtpPort: 587,
-            smtpTls: false,
-            smtpStartTls: true,
+            smtpHost: smtpServer.host,
+            smtpPort: smtpServer.port,
+            smtpTls: smtpServer.tls,
+            smtpStartTls: smtpServer.startTls,
             isActive: true,
             connectionState: ConnectionState.NotAuthenticated,
         });
@@ -247,7 +259,7 @@ export const microsoftOAuthCallback = async (context, ctx) => {
     if (services.includes(AccountService.Mail)) {
         await triggerAccountSyncSafe(ctx.client, accountId);
     }
-    return redirect(`${webOrigin}/settings/accounts?connected=${encodeURIComponent(accountId)}`);
+    return redirect(`${webOrigin}${ACCOUNT_SETTINGS_ROUTE}?connected=${encodeURIComponent(accountId)}`);
 };
 /**
  * An instance with no Microsoft app answers the start of a sign-in with a

package/dist/src/oauth-state.d.ts

@@ -8,3 +8,7 @@ export interface OAuthState {
 export declare const STATE_TTL_MS: number;
 export declare function signState(payload: OAuthState, clientSecret: string): Promise<string>;
 export declare function verifyState(state: string, clientSecret: string): Promise<OAuthState>;
+/** The web client's account settings, where every Microsoft sign-in lands. */
+export declare const ACCOUNT_SETTINGS_ROUTE = "/settings/accounts";
+/** Where a refused Microsoft sign-in sends the browser back to, carrying why. */
+export declare const oauthRefusalUrl: (webOrigin: string, oauthError: string) => string;

package/dist/src/oauth-state.js

@@ -53,3 +53,11 @@ export async function verifyState(state, clientSecret) {
     }
     return payload;
 }
+/** The web client's account settings, where every Microsoft sign-in lands. */
+export const ACCOUNT_SETTINGS_ROUTE = "/settings/accounts";
+/** Where a refused Microsoft sign-in sends the browser back to, carrying why. */
+export const oauthRefusalUrl = (webOrigin, oauthError) => {
+    const url = new URL(`${webOrigin}${ACCOUNT_SETTINGS_ROUTE}`);
+    url.searchParams.set("oauthError", oauthError);
+    return url.toString();
+};

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@remit/backend",
-	"version": "0.0.152",
+	"version": "0.0.153",
 	"description": "Remit Mail Inspector API backend",
 	"license": "MIT",
 	"author": "",
@@ -67,6 +67,10 @@
 			"types": "./dist/src/oauth-state.d.ts",
 			"default": "./dist/src/oauth-state.js"
 		},
+		"./msoauth": {
+			"types": "./dist/src/config/msoauth.d.ts",
+			"default": "./dist/src/config/msoauth.js"
+		},
 		"./content-handler": {
 			"types": "./dist/dev-server/content-handler.d.ts",
 			"default": "./dist/dev-server/content-handler.js"