@remit/backend 0.0.30 → 0.0.32

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.30",
+  "version": "0.0.32",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",

package/src/handlers/system-update.test.ts

@@ -9,9 +9,7 @@ import {
 import { join } from "node:path";
 import { after, afterEach, before, beforeEach, describe, it } from "node:test";
 import { fileURLToPath } from "node:url";
-import { createInstanceOwnerStore } from "@remit/auth-service";
 import type { APIGatewayProxyEvent } from "aws-lambda";
-import Database from "better-sqlite3";
 import type { Context } from "openapi-backend";
 import { SystemOperations } from "./system-update.js";
 
@@ -23,20 +21,9 @@ const tmpRoot = join(
 	"system-update",
 );
 
-const readMigrationSql = (relativePath: string): string =>
-	readFileSync(fileURLToPath(new URL(relativePath, import.meta.url)), "utf8");
-
-const authMigrationSql = readMigrationSql(
-	"../../../../deploy/vps/migrations-sqlite/auth/0000_rainy_iron_monger.sql",
-);
-const metaMigrationSql = readMigrationSql(
-	"../../../../deploy/vps/migrations-sqlite/meta/0000_demonic_lilith.sql",
-);
-
-const OWNER = "the-owner";
+const USER = "any-signed-in-user";
 const MANIFEST_URL = "https://updates.example.com/stable.json";
 
-let dbPath: string;
 let controlDir: string;
 
 const okState = {
@@ -57,29 +44,8 @@ const writeState = (state: unknown): void => {
 	writeFileSync(join(controlDir, "state.json"), JSON.stringify(state));
 };
 
-before(async () => {
+before(() => {
 	mkdirSync(tmpRoot, { recursive: true });
-	dbPath = join(mkdtempSync(join(tmpRoot, "db-")), "app.db");
-	const sqlite = new Database(dbPath);
-	for (const sql of [authMigrationSql, metaMigrationSql]) {
-		for (const statement of sql.split("--> statement-breakpoint")) {
-			sqlite.exec(statement);
-		}
-	}
-	sqlite
-		.prepare(
-			"INSERT INTO auth_user (id, name, email, email_verified, created_at, updated_at) VALUES (?, ?, ?, 0, ?, ?)",
-		)
-		.run(OWNER, OWNER, "owner@example.com", 1000, 1000);
-	sqlite.close();
-	process.env.DATA_BACKEND = "sqlite";
-	process.env.SQLITE_DB_PATH = dbPath;
-	const store = await createInstanceOwnerStore({
-		provider: "sqlite",
-		connectionString: dbPath,
-	});
-	await store.claimIfUnclaimed(OWNER);
-	await store.close();
 });
 
 after(() => {
@@ -135,30 +101,43 @@ describe("GET /system/update", () => {
 	it("returns 404 when no manifest URL is configured", async () => {
 		delete process.env.REMIT_UPDATE_MANIFEST_URL;
 
-		const result = await getUpdate(buildEvent(OWNER));
+		const result = await getUpdate(buildEvent(USER));
 
 		assert.ok(hasStatus(result, 404));
 	});
 
-	it("returns 403 for a non-owner", async () => {
-		const result = await getUpdate(buildEvent("someone-else"));
+	it("returns 401 when the caller is not authenticated", async () => {
+		writeState(okState);
 
-		assert.ok(hasStatus(result, 403));
+		const result = await getUpdate(buildEvent());
+
+		assert.ok(hasStatus(result, 401));
+	});
+
+	it("returns 200 for any authenticated caller", async () => {
+		writeState(okState);
+
+		const result = await getUpdate(buildEvent("another-signed-in-user"));
+
+		assert.deepEqual(result, okState);
 	});
 
 	it("returns 200 with the state file verbatim", async () => {
 		writeState(okState);
 
-		const result = await getUpdate(buildEvent(OWNER));
+		const result = await getUpdate(buildEvent(USER));
 
 		assert.deepEqual(result, okState);
 	});
 
-	it("returns a disabled, empty resource when no state file exists", async () => {
-		const result = await getUpdate(buildEvent(OWNER));
+	it("reports an unknown version, not its own process env, when no state file exists", async () => {
+		// The updater owns the running version and writes it into state.json; with
+		// no state file the backend has nothing authoritative, so it says unknown
+		// rather than surfacing REMIT_TAG, which drifts from the real running tag.
+		const result = await getUpdate(buildEvent(USER));
 
 		assert.deepEqual(result, {
-			currentVersion: "v1.4.1",
+			currentVersion: "unknown",
 			check: { status: "disabled" },
 			run: null,
 		});
@@ -186,7 +165,7 @@ describe("GET /system/update", () => {
 			run,
 		});
 
-		const result = (await getUpdate(buildEvent(OWNER))) as {
+		const result = (await getUpdate(buildEvent(USER))) as {
 			check: { status: string };
 			run: unknown;
 		};
@@ -203,7 +182,7 @@ describe("GET /system/update", () => {
 			run: null,
 		});
 
-		const result = (await getUpdate(buildEvent(OWNER))) as {
+		const result = (await getUpdate(buildEvent(USER))) as {
 			currentSchemaVersion?: number;
 			check: { schemaVersion?: number };
 		};
@@ -215,7 +194,7 @@ describe("GET /system/update", () => {
 	it("omits both schema-version fields when the state file predates them", async () => {
 		writeState(okState);
 
-		const result = (await getUpdate(buildEvent(OWNER))) as {
+		const result = (await getUpdate(buildEvent(USER))) as {
 			currentSchemaVersion?: number;
 			check: { schemaVersion?: number };
 		};
@@ -232,7 +211,7 @@ describe("GET /system/update", () => {
 			run: null,
 		});
 
-		const result = (await getUpdate(buildEvent(OWNER))) as {
+		const result = (await getUpdate(buildEvent(USER))) as {
 			currentSchemaVersion?: number;
 			check: { schemaVersion?: number };
 		};
@@ -248,7 +227,7 @@ describe("GET /system/update", () => {
 			run: null,
 		});
 
-		const result = (await getUpdate(buildEvent(OWNER))) as {
+		const result = (await getUpdate(buildEvent(USER))) as {
 			currentSchemaVersion?: number;
 			check: { schemaVersion?: number };
 		};
@@ -262,17 +241,34 @@ describe("POST /system/update", () => {
 	it("returns 404 when no manifest URL is configured", async () => {
 		delete process.env.REMIT_UPDATE_MANIFEST_URL;
 
-		const result = await applyUpdate("v1.5.0", buildEvent(OWNER));
+		const result = await applyUpdate("v1.5.0", buildEvent(USER));
 
 		assert.ok(hasStatus(result, 404));
 	});
 
-	it("returns 403 for a non-owner", async () => {
+	it("returns 401 without writing request.json when the caller is not authenticated", async () => {
+		writeState(okState);
+
+		const result = await applyUpdate("v1.5.0", buildEvent());
+
+		assert.ok(hasStatus(result, 401));
+		assert.throws(() => readFileSync(join(controlDir, "request.json"), "utf8"));
+	});
+
+	it("returns 202 for any authenticated caller and records that identity", async () => {
 		writeState(okState);
 
-		const result = await applyUpdate("v1.5.0", buildEvent("someone-else"));
+		const result = (await applyUpdate(
+			"v1.5.0",
+			buildEvent("another-signed-in-user"),
+		)) as { statusCode: number };
+
+		assert.equal(result.statusCode, 202);
 
-		assert.ok(hasStatus(result, 403));
+		const request = JSON.parse(
+			readFileSync(join(controlDir, "request.json"), "utf8"),
+		);
+		assert.equal(request.requestedBy, "another-signed-in-user");
 	});
 
 	it("returns 409 when a run is already in flight", async () => {
@@ -291,7 +287,7 @@ describe("POST /system/update", () => {
 			},
 		});
 
-		await assert.rejects(applyUpdate("v1.5.0", buildEvent(OWNER)), {
+		await assert.rejects(applyUpdate("v1.5.0", buildEvent(USER)), {
 			statusCode: 409,
 		});
 	});
@@ -299,13 +295,13 @@ describe("POST /system/update", () => {
 	it("returns 422 when the target is not the checked version", async () => {
 		writeState(okState);
 
-		await assert.rejects(applyUpdate("v9.9.9", buildEvent(OWNER)), {
+		await assert.rejects(applyUpdate("v9.9.9", buildEvent(USER)), {
 			statusCode: 422,
 		});
 	});
 
 	it("returns 422 when no check has ever succeeded", async () => {
-		await assert.rejects(applyUpdate("v1.5.0", buildEvent(OWNER)), {
+		await assert.rejects(applyUpdate("v1.5.0", buildEvent(USER)), {
 			statusCode: 422,
 		});
 	});
@@ -313,7 +309,7 @@ describe("POST /system/update", () => {
 	it("returns 202 with a run block carrying a fresh runId", async () => {
 		writeState(okState);
 
-		const result = (await applyUpdate("v1.5.0", buildEvent(OWNER))) as {
+		const result = (await applyUpdate("v1.5.0", buildEvent(USER))) as {
 			statusCode: number;
 			body: { run: { runId: string; targetVersion: string; outcome: null } };
 		};
@@ -327,7 +323,7 @@ describe("POST /system/update", () => {
 	it("writes request.json with exactly the four seam fields and nothing else", async () => {
 		writeState(okState);
 
-		await applyUpdate("v1.5.0", buildEvent(OWNER));
+		await applyUpdate("v1.5.0", buildEvent(USER));
 
 		const request = JSON.parse(
 			readFileSync(join(controlDir, "request.json"), "utf8"),
@@ -340,7 +336,7 @@ describe("POST /system/update", () => {
 			"targetVersion",
 		]);
 		assert.equal(request.targetVersion, "v1.5.0");
-		assert.equal(request.requestedBy, OWNER);
+		assert.equal(request.requestedBy, USER);
 		for (const forbidden of ["registry", "image", "digest"]) {
 			assert.ok(!(forbidden in request));
 		}

package/src/handlers/system-update.ts

@@ -10,7 +10,6 @@ import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
 import type { Context } from "openapi-backend";
 import { getSubFromEvent } from "../auth.js";
 import type { OperationHandler, SystemOperationIds } from "../types.js";
-import { requireInstanceOwner } from "./owner-guard.js";
 
 class TargetVersionMismatchError extends HTTPError {
 	name = "TargetVersionMismatchError";
@@ -25,7 +24,17 @@ const controlDir = (): string =>
 const manifestUrl = (): string | undefined =>
 	process.env.REMIT_UPDATE_MANIFEST_URL;
 
-const currentVersion = (): string => process.env.REMIT_TAG ?? "unknown";
+/**
+ * The running version is a fact the updater owns: it reads the tag from `.env`
+ * and writes it into `state.json`, which is the only honest source across an
+ * update that rewrites that tag underneath a long-lived backend process. When no
+ * state file exists yet the backend has nothing authoritative to report, so it
+ * reports the version as unknown rather than fabricating one from its own
+ * process environment — a value captured at container start that drifts from the
+ * real running tag the moment an update lands. The first updater check writes a
+ * real `currentVersion` within seconds of the stack coming up.
+ */
+const UNKNOWN_VERSION = "unknown";
 
 const notFound = (): APIGatewayProxyResult => ({
 	statusCode: 404,
@@ -33,11 +42,17 @@ const notFound = (): APIGatewayProxyResult => ({
 	body: JSON.stringify({ message: "Not found" }),
 });
 
+const unauthorized = (): APIGatewayProxyResult => ({
+	statusCode: 401,
+	headers: { "Content-Type": "application/json" },
+	body: JSON.stringify({ message: "Unauthorized" }),
+});
+
 /**
  * The self-update seam is off unless a manifest URL is configured (RFC 037 D8),
  * which the hosted deployment leaves unset. Both endpoints answer 404 in that
- * case — before the owner guard, so a probe cannot tell an off surface from a
- * forbidden one.
+ * case. Where it is on, any authenticated caller may use it — the account list
+ * is the trust boundary of a self-hosted instance.
  */
 const guardManifestConfigured = (): APIGatewayProxyResult | null =>
 	manifestUrl() ? null : notFound();
@@ -60,7 +75,7 @@ const readState = (): SystemUpdateResponse | null => {
 };
 
 const emptyResource = (): SystemUpdateResponse => ({
-	currentVersion: currentVersion(),
+	currentVersion: UNKNOWN_VERSION,
 	check: { status: "disabled" },
 	run: null,
 });
@@ -110,7 +125,7 @@ const requestedResource = (
 	targetVersion: string,
 	requestedAt: string,
 ): SystemUpdateResponse => {
-	const from = state?.currentVersion ?? currentVersion();
+	const from = state?.currentVersion ?? UNKNOWN_VERSION;
 	return {
 		currentVersion: from,
 		check: state?.check ?? { status: "disabled" },
@@ -140,8 +155,7 @@ export const SystemOperations: Record<
 		if (offSurface) return offSurface;
 
 		const event = args[0] as APIGatewayProxyEvent;
-		const forbidden = await requireInstanceOwner(event);
-		if (forbidden) return forbidden;
+		if (!getSubFromEvent(event)) return unauthorized();
 
 		return readState() ?? emptyResource();
 	},
@@ -154,8 +168,8 @@ export const SystemOperations: Record<
 		if (offSurface) return offSurface;
 
 		const event = args[0] as APIGatewayProxyEvent;
-		const forbidden = await requireInstanceOwner(event);
-		if (forbidden) return forbidden;
+		const sub = getSubFromEvent(event);
+		if (!sub) return unauthorized();
 
 		const { targetVersion } = context.request.requestBody as {
 			targetVersion: string;
@@ -178,7 +192,7 @@ export const SystemOperations: Record<
 			runId,
 			targetVersion,
 			requestedAt,
-			requestedBy: getSubFromEvent(event) ?? "",
+			requestedBy: sub,
 		});
 
 		return {

package/src/handlers/owner-guard.test.ts

@@ -1,89 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdirSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { after, afterEach, before, describe, it } from "node:test";
-import { fileURLToPath } from "node:url";
-import { createInstanceOwnerStore } from "@remit/auth-service";
-import type { APIGatewayProxyEvent } from "aws-lambda";
-import Database from "better-sqlite3";
-import { requireInstanceOwner } from "./owner-guard.js";
-
-const tmpRoot = join(
-	fileURLToPath(new URL(".", import.meta.url)),
-	"..",
-	"..",
-	".tmp",
-	"owner-guard",
-);
-
-const readMigrationSql = (relativePath: string): string =>
-	readFileSync(fileURLToPath(new URL(relativePath, import.meta.url)), "utf8");
-
-const authMigrationSql = readMigrationSql(
-	"../../../../deploy/vps/migrations-sqlite/auth/0000_rainy_iron_monger.sql",
-);
-const metaMigrationSql = readMigrationSql(
-	"../../../../deploy/vps/migrations-sqlite/meta/0000_demonic_lilith.sql",
-);
-
-let dbPath: string;
-
-before(() => {
-	mkdirSync(tmpRoot, { recursive: true });
-	dbPath = join(mkdtempSync(join(tmpRoot, "db-")), "app.db");
-	const sqlite = new Database(dbPath);
-	for (const sql of [authMigrationSql, metaMigrationSql]) {
-		for (const statement of sql.split("--> statement-breakpoint")) {
-			sqlite.exec(statement);
-		}
-	}
-	sqlite
-		.prepare(
-			"INSERT INTO auth_user (id, name, email, email_verified, created_at, updated_at) VALUES (?, ?, ?, 0, ?, ?)",
-		)
-		.run("the-owner", "the-owner", "the-owner@example.com", 1000, 1000);
-	sqlite.close();
-	process.env.DATA_BACKEND = "sqlite";
-	process.env.SQLITE_DB_PATH = dbPath;
-});
-
-after(() => {
-	rmSync(tmpRoot, { recursive: true, force: true });
-});
-
-afterEach(() => {
-	delete process.env.REMIT_OWNER_EMAIL;
-});
-
-const buildEvent = (sub?: string): APIGatewayProxyEvent =>
-	({
-		headers: {},
-		requestContext: sub ? { authorizer: { claims: { sub } } } : {},
-	}) as unknown as APIGatewayProxyEvent;
-
-describe("requireInstanceOwner", () => {
-	it("rejects a request with no authenticated caller", async () => {
-		const result = await requireInstanceOwner(buildEvent());
-
-		assert.equal(result?.statusCode, 403);
-	});
-
-	it("rejects a caller who has not claimed ownership", async () => {
-		const result = await requireInstanceOwner(buildEvent("not-the-owner"));
-
-		assert.equal(result?.statusCode, 403);
-	});
-
-	it("lets the instance owner through", async () => {
-		const store = await createInstanceOwnerStore({
-			provider: "sqlite",
-			connectionString: dbPath,
-		});
-		await store.claimIfUnclaimed("the-owner");
-		await store.close();
-
-		const result = await requireInstanceOwner(buildEvent("the-owner"));
-
-		assert.equal(result, null);
-	});
-});

package/src/handlers/owner-guard.ts

@@ -1,25 +0,0 @@
-import { isInstanceOwner } from "@remit/auth-service";
-import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
-import { getSubFromEvent } from "../auth.js";
-
-const forbidden = (message: string): APIGatewayProxyResult => ({
-	statusCode: 403,
-	headers: { "Content-Type": "application/json" },
-	body: JSON.stringify({ message }),
-});
-
-/**
- * Gate a request to the standalone instance owner (RFC 037 D8) — the first
- * account to register, or whoever `REMIT_OWNER_EMAIL` names. Returns `null` to
- * let the request proceed, or a 403 `APIGatewayProxyResult` otherwise. Callers
- * wire this in ahead of the handler; it does not run the handler itself.
- */
-export const requireInstanceOwner = async (
-	event: APIGatewayProxyEvent,
-): Promise<APIGatewayProxyResult | null> => {
-	const sub = getSubFromEvent(event);
-	if (!sub) return forbidden("Instance owner required");
-	if (!(await isInstanceOwner(sub)))
-		return forbidden("Instance owner required");
-	return null;
-};