@remit/backend 0.0.54 → 0.0.56

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.54",
+  "version": "0.0.56",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",

package/src/handlers/outbox.test.ts

@@ -0,0 +1,294 @@
+/**
+ * Issue #604: composing a reply, sending it, and then letting one more autosave
+ * land 500'd the browser with "Internal server error" two seconds after a send
+ * that had actually succeeded.
+ *
+ * A PATCH against an entry that is no longer a draft is a foreseeable race, not
+ * a fault: the draft editor debounces its writes, so the last one can be in
+ * flight while the send flips the status. The designed answer is 409 — the
+ * entry is immutable now, and saying so truthfully is what lets a client stop.
+ *
+ * Driven through the real handlers, the real OutboxQueueService and the real
+ * error funnel, so what is asserted is the status code the browser receives.
+ * Only the queue and the store are stood in for.
+ */
+
+import assert from "node:assert/strict";
+import { afterEach, describe, it } from "node:test";
+import type { SQSClient } from "@aws-sdk/client-sqs";
+import type {
+	CreateOutboxMessageInput,
+	IAccountRepository,
+	IOutboxMessageRepository,
+	OutboxMessageItem,
+	UpdateOutboxMessageInput,
+} from "@remit/data-ports";
+import { NotFoundError } from "@remit/data-ports/errors";
+import { OutboxMessageStatus } from "@remit/domain-enums";
+import { OutboxQueueService } from "@remit/mailbox-service";
+import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
+import type { Context } from "openapi-backend";
+import { deriveAccountConfigId } from "../auth.js";
+import { handleError } from "../error.js";
+import { formatResponse } from "../response.js";
+import {
+	_resetForTest,
+	type RemitClient,
+	setClient,
+} from "../service/data-client.js";
+import { OutboxDetailOperations, OutboxOperations } from "./outbox.js";
+
+const SUB = "cognito-sub-604";
+const ACCOUNT_CONFIG_ID = deriveAccountConfigId(SUB);
+const ACCOUNT_ID = "acc-604";
+const ACCOUNT_EMAIL = "sender@example.com";
+
+const createInMemoryOutboxRepository = (): IOutboxMessageRepository => {
+	const rows = new Map<string, OutboxMessageItem>();
+	let sequence = 0;
+
+	const mustGet = (outboxMessageId: string): OutboxMessageItem => {
+		const row = rows.get(outboxMessageId);
+		if (!row) throw new NotFoundError(`No outbox message ${outboxMessageId}`);
+		return row;
+	};
+
+	const repository = {
+		create: async (
+			input: CreateOutboxMessageInput,
+		): Promise<OutboxMessageItem> => {
+			sequence += 1;
+			const now = Date.now();
+			const row: OutboxMessageItem = {
+				...input,
+				ccAddresses: input.ccAddresses ?? [],
+				bccAddresses: input.bccAddresses ?? [],
+				references: input.references ?? [],
+				outboxMessageId: `outbox-${sequence}`,
+				createdAt: now,
+				updatedAt: now,
+			};
+			rows.set(row.outboxMessageId, row);
+			return row;
+		},
+		get: async (
+			_accountConfigId: string,
+			outboxMessageId: string | string[],
+		) =>
+			Array.isArray(outboxMessageId)
+				? outboxMessageId.map(mustGet)
+				: mustGet(outboxMessageId),
+		update: async (
+			_accountConfigId: string,
+			outboxMessageId: string,
+			input: UpdateOutboxMessageInput,
+		): Promise<OutboxMessageItem> => {
+			const row = {
+				...mustGet(outboxMessageId),
+				...input,
+				updatedAt: Date.now(),
+			};
+			rows.set(outboxMessageId, row);
+			return row;
+		},
+		updateStatus: async (
+			accountConfigId: string,
+			outboxMessageId: string,
+			status: OutboxMessageItem["status"],
+		) => repository.update(accountConfigId, outboxMessageId, { status }),
+		markSent: async (
+			accountConfigId: string,
+			outboxMessageId: string,
+			fields: { sentAt: number; smtpMessageId?: string },
+		) =>
+			repository.update(accountConfigId, outboxMessageId, {
+				...fields,
+				status: OutboxMessageStatus.sent,
+			}),
+		delete: async (_accountConfigId: string, outboxMessageId: string) => {
+			rows.delete(outboxMessageId);
+		},
+		deleteMany: async (
+			_accountConfigId: string,
+			outboxMessageIds: string[],
+		) => {
+			for (const id of outboxMessageIds) rows.delete(id);
+		},
+		listByAccount: async () => ({
+			items: [...rows.values()],
+			continuationToken: null,
+		}),
+		listQueued: async () =>
+			[...rows.values()].filter(
+				(row) => row.status === OutboxMessageStatus.queued,
+			),
+	} as unknown as IOutboxMessageRepository;
+
+	return repository;
+};
+
+const acceptingSqsClient = (): SQSClient =>
+	({ send: async () => ({}) }) as unknown as SQSClient;
+
+const accountRepository = {
+	get: async () => ({
+		accountId: ACCOUNT_ID,
+		accountConfigId: ACCOUNT_CONFIG_ID,
+		email: ACCOUNT_EMAIL,
+	}),
+} as unknown as IAccountRepository;
+
+const installClient = (): void => {
+	const outboxMessage = createInMemoryOutboxRepository();
+	setClient({
+		outboxMessage,
+		account: accountRepository,
+		outboxQueue: new OutboxQueueService({
+			outboxMessageService: outboxMessage,
+			accountService: accountRepository,
+			sqsSmtpQueueUrl: "http://localhost:9324/queue/outbox-test",
+			sqsClient: acceptingSqsClient(),
+		}),
+	} as unknown as RemitClient);
+};
+
+const authorizedEvent = (body?: unknown): APIGatewayProxyEvent =>
+	({
+		body: body === undefined ? null : JSON.stringify(body),
+		requestContext: { authorizer: { claims: { sub: SUB } } },
+	}) as unknown as APIGatewayProxyEvent;
+
+const requestContext = (request: {
+	params?: Record<string, string>;
+	requestBody?: unknown;
+}): Context => ({ request }) as unknown as Context;
+
+type Handler = (
+	context: Context,
+	event: APIGatewayProxyEvent,
+) => Promise<Record<string, unknown>>;
+
+const createDraft =
+	OutboxOperations.OutboxOperations_createOutboxMessage as Handler;
+const sendMessage =
+	OutboxDetailOperations.OutboxDetailOperations_sendOutboxMessage as Handler;
+const updateDraft =
+	OutboxDetailOperations.OutboxDetailOperations_updateOutboxMessage as Handler;
+const deleteDraft =
+	OutboxDetailOperations.OutboxDetailOperations_deleteOutboxMessage as Handler;
+
+type Outcome =
+	| { readonly ok: true; readonly body: Record<string, unknown> }
+	| { readonly ok: false; readonly error: unknown };
+
+/** The response the browser would receive, error funnel included. */
+const respond = async (
+	run: () => Promise<Record<string, unknown>>,
+): Promise<APIGatewayProxyResult> => {
+	const outcome: Outcome = await run().then(
+		(body) => ({ ok: true, body }) as const,
+		(error: unknown) => ({ ok: false, error }) as const,
+	);
+	if (!outcome.ok) return handleError(outcome.error);
+	return formatResponse(outcome.body);
+};
+
+const sentOutboxMessageId = async (): Promise<string> => {
+	const draft = await createDraft(
+		requestContext({}),
+		authorizedEvent({
+			accountId: ACCOUNT_ID,
+			toAddresses: ["recipient@example.com"],
+			subject: "Re: the thing",
+			textBody: "on it",
+		}),
+	);
+	const outboxMessageId = draft.outboxMessageId;
+	assert.equal(typeof outboxMessageId, "string");
+
+	const sent = await sendMessage(
+		requestContext({ params: { outboxMessageId: String(outboxMessageId) } }),
+		authorizedEvent(),
+	);
+	assert.notEqual(sent.status, "draft");
+
+	return String(outboxMessageId);
+};
+
+afterEach(() => {
+	_resetForTest();
+});
+
+describe("an outbox entry that has left draft (#604)", () => {
+	it("answers a late autosave PATCH with 409, never a 500", async () => {
+		installClient();
+		const outboxMessageId = await sentOutboxMessageId();
+
+		const response = await respond(() =>
+			updateDraft(
+				requestContext({
+					params: { outboxMessageId },
+					requestBody: { subject: "Re: the thing", textBody: "on it!" },
+				}),
+				authorizedEvent(),
+			),
+		);
+
+		assert.equal(response.statusCode, 409);
+		const body = JSON.parse(response.body) as { message?: string };
+		assert.match(String(body.message), /can no longer be edited/);
+	});
+
+	it("refuses a second send with 409, never a 500", async () => {
+		installClient();
+		const outboxMessageId = await sentOutboxMessageId();
+
+		const response = await respond(() =>
+			sendMessage(
+				requestContext({ params: { outboxMessageId } }),
+				authorizedEvent(),
+			),
+		);
+
+		assert.equal(response.statusCode, 409);
+	});
+
+	it("refuses a discard with 409, never a 500", async () => {
+		installClient();
+		const outboxMessageId = await sentOutboxMessageId();
+
+		const response = await respond(() =>
+			deleteDraft(
+				requestContext({ params: { outboxMessageId } }),
+				authorizedEvent(),
+			),
+		);
+
+		assert.equal(response.statusCode, 409);
+	});
+
+	it("still accepts an autosave PATCH while the entry is a draft", async () => {
+		installClient();
+		const draft = await createDraft(
+			requestContext({}),
+			authorizedEvent({
+				accountId: ACCOUNT_ID,
+				toAddresses: ["recipient@example.com"],
+			}),
+		);
+
+		const response = await respond(() =>
+			updateDraft(
+				requestContext({
+					params: { outboxMessageId: String(draft.outboxMessageId) },
+					requestBody: { subject: "still editing" },
+				}),
+				authorizedEvent(),
+			),
+		);
+
+		assert.equal(response.statusCode, 200);
+		const body = JSON.parse(response.body) as { subject?: string };
+		assert.equal(body.subject, "still editing");
+	});
+});

package/src/handlers/system-update.ts

@@ -115,9 +115,9 @@ const writeRequest = (request: {
 /**
  * The resource returned by the POST. The updater has not yet written the
  * authoritative run — it polls the seam — so this bootstraps the run block with
- * the id just requested and the first phase, giving the client a `runId` to
- * persist and poll (RFC 037 D9). The updater's own `state.json` supersedes it on
- * the next read.
+ * the id just requested and the first phase, giving the client a `runId` to poll
+ * for (RFC 037 D9). The updater's own `state.json` supersedes it on the next
+ * read.
  */
 const requestedResource = (
 	state: SystemUpdateResponse | null,

package/src/index.ts

@@ -160,15 +160,18 @@ const rawHandler = async (event: APIGatewayProxyEvent, context: Context) =>
 
 			const origin = readOriginHeader(event.headers);
 
-			if (usesBetterAuthJwt()) {
-				const denied = await authenticateSelfHostRequest(event);
-				if (denied) return denied;
-			}
-
-			return runWithRequestContext({ origin }, () =>
-				api
-					.handleRequest(normalizeRequest(event), event, context)
-					.catch(handleError),
+			return runWithRequestContext(
+				{ origin, correlationId: context.awsRequestId },
+				async () => {
+					if (usesBetterAuthJwt()) {
+						const denied = await authenticateSelfHostRequest(event);
+						if (denied) return denied;
+					}
+
+					return api
+						.handleRequest(normalizeRequest(event), event, context)
+						.catch(handleError);
+				},
 			);
 		},
 	);

package/src/request-context.ts

@@ -2,6 +2,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 
 interface RequestContext {
 	origin?: string;
+	correlationId?: string;
 }
 
 const storage = new AsyncLocalStorage<RequestContext>();
@@ -12,6 +13,9 @@ export const runWithRequestContext = <T>(ctx: RequestContext, fn: () => T): T =>
 export const getRequestOrigin = (): string | undefined =>
 	storage.getStore()?.origin;
 
+export const getRequestCorrelationId = (): string | undefined =>
+	storage.getStore()?.correlationId;
+
 const parseAllowedOrigins = (): readonly string[] => {
 	const raw = process.env.CORS_ALLOWED_ORIGINS;
 	if (!raw) return [];

package/src/response.test.ts

@@ -1,7 +1,8 @@
 import assert from "node:assert/strict";
 import { afterEach, beforeEach, describe, it } from "node:test";
 import type { Context as OpenAPIContext } from "openapi-backend";
-import { postResponseHandler } from "./response.js";
+import { runWithRequestContext } from "./request-context.js";
+import { formatResponse, postResponseHandler } from "./response.js";
 
 type ValidateResponseFn = (
 	response: unknown,
@@ -105,3 +106,25 @@ describe("postResponseHandler validation gating", () => {
 		assert.equal(result.statusCode, 200);
 	});
 });
+
+// A bug report quotes the correlation id off the failing response. Without the
+// header it reads "(none)" and there is nothing to grep the server logs for.
+describe("the correlation id travels back on the response", () => {
+	it("carries the request's id, and exposes the header to the browser", () => {
+		const result = runWithRequestContext({ correlationId: "req-604" }, () =>
+			formatResponse({ message: "Conflict" }, 409),
+		);
+
+		assert.equal(result.headers?.["x-correlation-id"], "req-604");
+		assert.match(
+			String(result.headers?.["Access-Control-Expose-Headers"]),
+			/x-correlation-id/,
+		);
+	});
+
+	it("omits the header when the request carried no id", () => {
+		const result = formatResponse({ message: "Conflict" }, 409);
+
+		assert.equal(result.headers?.["x-correlation-id"], undefined);
+	});
+});

package/src/response.ts

@@ -1,7 +1,11 @@
 import { logger } from "@remit/logger-lambda";
 import type { APIGatewayProxyResult } from "aws-lambda";
 import type { Context as OpenAPIContext } from "openapi-backend";
-import { getRequestOrigin, resolveAllowedOrigin } from "./request-context.js";
+import {
+	getRequestCorrelationId,
+	getRequestOrigin,
+	resolveAllowedOrigin,
+} from "./request-context.js";
 
 export const formatResponse = (
 	body: Record<string, unknown>,
@@ -30,11 +34,23 @@ export const formatResponse = (
 		corsHeaders["Access-Control-Allow-Credentials"] = "true";
 	}
 
+	// The id the request's log lines are already tagged with. Returning it is
+	// what makes a bug report's "correlation id" resolve to a server-side line;
+	// the browser can only read a non-safelisted header when it is exposed.
+	const correlationId = getRequestCorrelationId();
+	const correlationHeaders: Record<string, string> = correlationId
+		? {
+				"x-correlation-id": correlationId,
+				"Access-Control-Expose-Headers": "x-correlation-id",
+			}
+		: {};
+
 	return {
 		statusCode: statusCode,
 		headers: {
 			"Content-Type": "application/json",
 			...corsHeaders,
+			...correlationHeaders,
 		},
 		body: JSON.stringify(body),
 	};