@remit/backend 0.0.17 → 0.0.19

package/dev-server/relational-health.test.ts

@@ -0,0 +1,91 @@
+import assert from "node:assert/strict";
+import { chmodSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, it } from "node:test";
+import Database from "better-sqlite3";
+import { checkRelationalStore } from "./relational-health.js";
+
+describe("checkRelationalStore", () => {
+	const ORIGINAL_DATA_BACKEND = process.env.DATA_BACKEND;
+	const ORIGINAL_SQLITE_DB_PATH = process.env.SQLITE_DB_PATH;
+	let dir: string | undefined;
+
+	afterEach(() => {
+		if (ORIGINAL_DATA_BACKEND === undefined) delete process.env.DATA_BACKEND;
+		else process.env.DATA_BACKEND = ORIGINAL_DATA_BACKEND;
+		if (ORIGINAL_SQLITE_DB_PATH === undefined) {
+			delete process.env.SQLITE_DB_PATH;
+		} else {
+			process.env.SQLITE_DB_PATH = ORIGINAL_SQLITE_DB_PATH;
+		}
+		if (dir) {
+			rmSync(dir, { recursive: true, force: true });
+			dir = undefined;
+		}
+	});
+
+	it("is true without touching disk on the AWS/DynamoDB path", async () => {
+		delete process.env.DATA_BACKEND;
+		delete process.env.SQLITE_DB_PATH;
+		assert.equal(await checkRelationalStore(), true);
+
+		process.env.DATA_BACKEND = "dynamodb";
+		assert.equal(await checkRelationalStore(), true);
+	});
+
+	it("is true when the SQLite file is reachable", async () => {
+		dir = mkdtempSync(join(tmpdir(), "remit-health-"));
+		const dbPath = join(dir, "remit.db");
+		new Database(dbPath).close();
+
+		process.env.DATA_BACKEND = "sqlite";
+		process.env.SQLITE_DB_PATH = dbPath;
+
+		assert.equal(await checkRelationalStore(), true);
+	});
+
+	it("is false when SQLITE_DB_PATH points at a directory that does not exist", async () => {
+		process.env.DATA_BACKEND = "sqlite";
+		process.env.SQLITE_DB_PATH = "/nonexistent/remit.db";
+
+		assert.equal(await checkRelationalStore(), false);
+	});
+
+	it("is false when the SQLite file exists but is unreadable", async () => {
+		dir = mkdtempSync(join(tmpdir(), "remit-health-"));
+		const dbPath = join(dir, "remit.db");
+		new Database(dbPath).close();
+		chmodSync(dbPath, 0o000);
+
+		process.env.DATA_BACKEND = "sqlite";
+		process.env.SQLITE_DB_PATH = dbPath;
+
+		assert.equal(await checkRelationalStore(), false);
+	});
+
+	it("is false when the file is readable but no longer writable", async () => {
+		dir = mkdtempSync(join(tmpdir(), "remit-health-"));
+		const dbPath = join(dir, "remit.db");
+		new Database(dbPath).close();
+
+		process.env.DATA_BACKEND = "sqlite";
+		process.env.SQLITE_DB_PATH = dbPath;
+		assert.equal(await checkRelationalStore(), true);
+
+		// Readable, not writable: the read-only SELECT ping still opens and
+		// succeeds, so without `access(W_OK)` this reports healthy on a store the
+		// backend can no longer write to. This is the case the writability check
+		// exists to catch — dropping `access()` from pingSqlite fails this test.
+		chmodSync(dbPath, 0o400);
+		assert.equal(await checkRelationalStore(), false);
+	});
+
+	it("is false when Postgres connection fails", async () => {
+		process.env.DATA_BACKEND = "postgres";
+		process.env.PG_CONNECTION_URL =
+			"postgresql://remit:remit@127.0.0.1:1/nonexistent";
+
+		assert.equal(await checkRelationalStore(), false);
+	});
+});

package/dev-server/relational-health.ts

@@ -0,0 +1,57 @@
+import { access, constants } from "node:fs/promises";
+import { isSelfHostSqlBackend } from "../src/data-backend.js";
+
+// The SELECT ping opens a read-only connection, so it keeps succeeding on a
+// file that can still be read but no longer written — permissions revoked to
+// read-only, or the volume remounted read-only under the process. The backend
+// must write (better-auth persists sessions to this same file, RFC 036 D3), so
+// a readable-but-unwritable store has to report unhealthy. `access(R_OK|W_OK)`
+// checks both bits in one fresh syscall; the read-only query never covers
+// writability. The query after it still exercises the SQL engine itself.
+const pingSqlite = async (): Promise<void> => {
+	const path = process.env.SQLITE_DB_PATH ?? "";
+	await access(path, constants.R_OK | constants.W_OK);
+
+	const { default: Database } = await import("better-sqlite3");
+	const db = new Database(path, { readonly: true });
+	try {
+		db.prepare("SELECT 1").get();
+	} finally {
+		db.close();
+	}
+};
+
+const pingPostgres = async (): Promise<void> => {
+	const { Client } = await import("pg");
+	const client = new Client({
+		connectionString: process.env.PG_CONNECTION_URL,
+		connectionTimeoutMillis: 3000,
+	});
+	await client.connect();
+	try {
+		await client.query("SELECT 1");
+	} finally {
+		await client.end();
+	}
+};
+
+/**
+ * A trivial read against whichever relational store DATA_BACKEND selects — the
+ * dependency `/health` must actually exercise (RFC 037 D5, R9) so a backend that
+ * booted with an unusable database reports unhealthy instead of a bare 200. The
+ * AWS/DynamoDB path has no relational store and is never checked.
+ */
+export const checkRelationalStore = async (): Promise<boolean> => {
+	if (!isSelfHostSqlBackend()) return true;
+
+	try {
+		if (process.env.DATA_BACKEND === "sqlite") {
+			await pingSqlite();
+		} else {
+			await pingPostgres();
+		}
+		return true;
+	} catch {
+		return false;
+	}
+};

package/dev-server/server.ts

@@ -16,6 +16,7 @@ import { serveContent } from "./content-handler.js";
 import { resolveContentPath } from "./content-path.js";
 import { parseAllowedOrigins, resolveAllowOrigin } from "./cors.js";
 import { createLambdaContext, createLambdaEvent } from "./lambda-helpers.js";
+import { checkRelationalStore } from "./relational-health.js";
 
 const app = express();
 
@@ -123,7 +124,12 @@ app.use((req: Request, res: Response, next: NextFunction) => {
 
 app.get("/.well-known/appspecific/com.chrome.devtools.json", () => ({}));
 
-app.get("/health", (_req: Request, res: Response) => {
+app.get("/health", async (_req: Request, res: Response) => {
+	const relationalStoreReachable = await checkRelationalStore();
+	if (!relationalStoreReachable) {
+		res.status(503).json({ status: "unhealthy" });
+		return;
+	}
 	res.json({
 		status: "ok",
 		timestamp: new Date().toISOString(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.17",
+  "version": "0.0.19",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",
@@ -45,8 +45,10 @@
     "@aws-sdk/core": "*",
     "@remit/electrodb-entities": "*",
     "@remit/search-index-worker": "*",
+    "@types/better-sqlite3": "^7.6.13",
     "@types/express": "^5.0.3",
     "@types/swagger-ui-express": "^4.1.8",
+    "better-sqlite3": "^12.11.1",
     "electrodb": "*",
     "esbuild": "^0.27.7",
     "express": "^5.1.0",
@@ -70,11 +72,15 @@
     "@remit/sqs-client": "*",
     "@aws-sdk/client-secrets-manager": "*",
     "@aws-sdk/client-sqs": "*",
+    "better-sqlite3": "^12.11.1",
     "drizzle-orm": "^0.45.2",
     "expect-env": "*",
     "openapi-backend": "*",
     "p-map": "*",
-    "@types/aws-lambda": "*"
+    "pg": "^8.0.0",
+    "@types/aws-lambda": "*",
+    "@types/better-sqlite3": "^7.6.13",
+    "@types/pg": "^8.0.0"
   },
   "publishConfig": {
     "access": "public"

package/src/handlers/owner-guard.test.ts

@@ -0,0 +1,89 @@
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { after, afterEach, before, describe, it } from "node:test";
+import { fileURLToPath } from "node:url";
+import { createInstanceOwnerStore } from "@remit/auth-service";
+import type { APIGatewayProxyEvent } from "aws-lambda";
+import Database from "better-sqlite3";
+import { requireInstanceOwner } from "./owner-guard.js";
+
+const tmpRoot = join(
+	fileURLToPath(new URL(".", import.meta.url)),
+	"..",
+	"..",
+	".tmp",
+	"owner-guard",
+);
+
+const readMigrationSql = (relativePath: string): string =>
+	readFileSync(fileURLToPath(new URL(relativePath, import.meta.url)), "utf8");
+
+const authMigrationSql = readMigrationSql(
+	"../../../../deploy/vps/migrations-sqlite/auth/0000_rainy_iron_monger.sql",
+);
+const metaMigrationSql = readMigrationSql(
+	"../../../../deploy/vps/migrations-sqlite/meta/0000_demonic_lilith.sql",
+);
+
+let dbPath: string;
+
+before(() => {
+	mkdirSync(tmpRoot, { recursive: true });
+	dbPath = join(mkdtempSync(join(tmpRoot, "db-")), "app.db");
+	const sqlite = new Database(dbPath);
+	for (const sql of [authMigrationSql, metaMigrationSql]) {
+		for (const statement of sql.split("--> statement-breakpoint")) {
+			sqlite.exec(statement);
+		}
+	}
+	sqlite
+		.prepare(
+			"INSERT INTO auth_user (id, name, email, email_verified, created_at, updated_at) VALUES (?, ?, ?, 0, ?, ?)",
+		)
+		.run("the-owner", "the-owner", "the-owner@example.com", 1000, 1000);
+	sqlite.close();
+	process.env.DATA_BACKEND = "sqlite";
+	process.env.SQLITE_DB_PATH = dbPath;
+});
+
+after(() => {
+	rmSync(tmpRoot, { recursive: true, force: true });
+});
+
+afterEach(() => {
+	delete process.env.REMIT_OWNER_EMAIL;
+});
+
+const buildEvent = (sub?: string): APIGatewayProxyEvent =>
+	({
+		headers: {},
+		requestContext: sub ? { authorizer: { claims: { sub } } } : {},
+	}) as unknown as APIGatewayProxyEvent;
+
+describe("requireInstanceOwner", () => {
+	it("rejects a request with no authenticated caller", async () => {
+		const result = await requireInstanceOwner(buildEvent());
+
+		assert.equal(result?.statusCode, 403);
+	});
+
+	it("rejects a caller who has not claimed ownership", async () => {
+		const result = await requireInstanceOwner(buildEvent("not-the-owner"));
+
+		assert.equal(result?.statusCode, 403);
+	});
+
+	it("lets the instance owner through", async () => {
+		const store = await createInstanceOwnerStore({
+			provider: "sqlite",
+			connectionString: dbPath,
+		});
+		await store.claimIfUnclaimed("the-owner");
+		await store.close();
+
+		const result = await requireInstanceOwner(buildEvent("the-owner"));
+
+		assert.equal(result, null);
+	});
+});

package/src/handlers/owner-guard.ts

@@ -0,0 +1,25 @@
+import { isInstanceOwner } from "@remit/auth-service";
+import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
+import { getSubFromEvent } from "../auth.js";
+
+const forbidden = (message: string): APIGatewayProxyResult => ({
+	statusCode: 403,
+	headers: { "Content-Type": "application/json" },
+	body: JSON.stringify({ message }),
+});
+
+/**
+ * Gate a request to the standalone instance owner (RFC 037 D8) — the first
+ * account to register, or whoever `REMIT_OWNER_EMAIL` names. Returns `null` to
+ * let the request proceed, or a 403 `APIGatewayProxyResult` otherwise. Callers
+ * wire this in ahead of the handler; it does not run the handler itself.
+ */
+export const requireInstanceOwner = async (
+	event: APIGatewayProxyEvent,
+): Promise<APIGatewayProxyResult | null> => {
+	const sub = getSubFromEvent(event);
+	if (!sub) return forbidden("Instance owner required");
+	if (!(await isInstanceOwner(sub)))
+		return forbidden("Instance owner required");
+	return null;
+};