@remit/backend 0.0.82 → 0.0.83

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.82",
+  "version": "0.0.83",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",

package/src/jwt-auth.test.ts

@@ -72,6 +72,35 @@ test("no token and no bypass returns 401", async () => {
 	assert.equal(result?.statusCode, 401);
 });
 
+test("a tokenless GET to the Microsoft OAuth callback is admitted", async () => {
+	const event = buildEvent({
+		httpMethod: "GET",
+		path: "/accounts/oauth/microsoft/callback",
+	});
+
+	const result = await authenticateSelfHostRequest(event);
+
+	assert.equal(result, null);
+	assert.equal(event.requestContext.authorizer, undefined);
+});
+
+test("the callback exemption covers that path and method only", async () => {
+	const neighbour = buildEvent({
+		httpMethod: "GET",
+		path: "/accounts/oauth/microsoft/start",
+	});
+	const otherMethod = buildEvent({
+		httpMethod: "POST",
+		path: "/accounts/oauth/microsoft/callback",
+	});
+
+	assert.equal((await authenticateSelfHostRequest(neighbour))?.statusCode, 401);
+	assert.equal(
+		(await authenticateSelfHostRequest(otherMethod))?.statusCode,
+		401,
+	);
+});
+
 test("pre-injected claims (edge tier) short-circuit verification", async () => {
 	_setVerifierForTest(async () => {
 		throw new Error("verifier must not be called");

package/src/jwt-auth.ts

@@ -55,6 +55,26 @@ const injectClaims = (
 const hasLocalBypass = (): boolean =>
 	Boolean(process.env.LOCAL_ACCOUNT_CONFIG_ID);
 
+/**
+ * The one route that runs without a token.
+ *
+ * Microsoft redirects the browser here after consent, so the request carries no
+ * Authorization header and no session to derive one from. The handler takes its
+ * identity from the HMAC-signed `state` parameter and validates it there; that
+ * signature is the gate, not a JWT.
+ *
+ * Hardcoded and single-entry, matching the edge exemption in
+ * packages/apisix/src/route-table.ts. `@useAuth(NoAuth)` in the spec does not
+ * open a path here — a future public route is added by hand.
+ */
+const PUBLIC_ROUTE = {
+	method: "GET",
+	path: "/accounts/oauth/microsoft/callback",
+};
+
+const isPublicRoute = (event: APIGatewayProxyEvent): boolean =>
+	event.httpMethod === PUBLIC_ROUTE.method && event.path === PUBLIC_ROUTE.path;
+
 /**
  * Authenticate a self-host request from a better-auth RS256 JWT.
  *
@@ -71,6 +91,8 @@ const hasLocalBypass = (): boolean =>
 export const authenticateSelfHostRequest = async (
 	event: APIGatewayProxyEvent,
 ): Promise<APIGatewayProxyResult | null> => {
+	if (isPublicRoute(event)) return null;
+
 	const existingSub = event.requestContext?.authorizer?.claims?.sub;
 	if (typeof existingSub === "string" && existingSub.length > 0) return null;