@remit/backend 0.0.82 → 0.0.84

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.82",
+  "version": "0.0.84",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",

package/src/handlers/organize.test.ts

@@ -1,10 +1,27 @@
 import assert from "node:assert/strict";
-import { describe, it } from "node:test";
+import { afterEach, describe, it, mock } from "node:test";
+import type { SendMessageCommand } from "@aws-sdk/client-sqs";
 import type { OrganizeInput } from "@remit/api-openapi-types";
+import type {
+	CreateOrganizeJobRequestInput,
+	IAccountRepository,
+	IOrganizeJobRequestRepository,
+	OrganizeJobRequestItem,
+} from "@remit/data-ports";
 import { BadRequestError } from "@remit/data-ports/errors";
 import { FilterMatchOperator } from "@remit/domain-enums";
+import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
+import type { Context } from "openapi-backend";
+import { deriveAccountConfigId } from "../auth.js";
 import { handleError } from "../error.js";
-import { predicateFromInput } from "./organize.js";
+import { formatResponse } from "../response.js";
+import {
+	_resetForTest,
+	type RemitClient,
+	setClient,
+} from "../service/data-client.js";
+import { sqsClient } from "../service/sqs.js";
+import { OrganizeOperations, predicateFromInput } from "./organize.js";
 
 const input = (over: Partial<OrganizeInput> = {}): OrganizeInput => ({
 	matchOperator: FilterMatchOperator.And,
@@ -61,3 +78,111 @@ describe("previewOrganize rejected-rule response (reader #457)", () => {
 		assert.match(JSON.parse(response.body).message, /HasWords/);
 	});
 });
+
+const SUB = "cognito-sub-995";
+const ACCOUNT_CONFIG_ID = deriveAccountConfigId(SUB);
+const ACCOUNT_ID = "acc-995";
+
+const createdRows: CreateOrganizeJobRequestInput[] = [];
+const enqueued: SendMessageCommand[] = [];
+
+const installClient = (): void => {
+	createdRows.length = 0;
+	setClient({
+		account: {
+			get: async () => ({
+				accountId: ACCOUNT_ID,
+				accountConfigId: ACCOUNT_CONFIG_ID,
+			}),
+		} as unknown as IAccountRepository,
+		organizeJobRequest: {
+			create: async (input: CreateOrganizeJobRequestInput) => {
+				createdRows.push(input);
+				return {
+					...input,
+					organizeJobId: `job-${createdRows.length}`,
+					state: "Pending",
+				} as unknown as OrganizeJobRequestItem;
+			},
+		} as unknown as IOrganizeJobRequestRepository,
+	} as unknown as RemitClient);
+};
+
+const authorizedEvent = (): APIGatewayProxyEvent =>
+	({
+		body: null,
+		requestContext: { authorizer: { claims: { sub: SUB } } },
+	}) as unknown as APIGatewayProxyEvent;
+
+const createJob = OrganizeOperations.OrganizeOperations_createOrganizeJob as (
+	context: Context,
+	event: APIGatewayProxyEvent,
+) => Promise<Record<string, unknown>>;
+
+/** The response the browser receives, error funnel included. */
+const postOrganize = async (
+	body: OrganizeInput,
+): Promise<APIGatewayProxyResult> => {
+	const context = {
+		request: { params: { accountId: ACCOUNT_ID }, requestBody: body },
+	} as unknown as Context;
+	return createJob(context, authorizedEvent()).then(
+		(response) => formatResponse(response),
+		(error: unknown) => handleError(error),
+	);
+};
+
+// A rule the matcher can never honour — a body-content clause with no anchor to
+// widen from — is refused on the request instead of accepted with a 202 for a
+// job the worker can only fail (reader #463, #995). The contract now declares
+// the 400, so the proof is the response the client gets plus the absence of the
+// two side effects a 202 promises: a job row and a queued message.
+describe("createOrganizeJob rejected-rule refusal (reader #995)", () => {
+	afterEach(() => {
+		mock.restoreAll();
+		_resetForTest();
+	});
+
+	const withStubbedQueue = (): void => {
+		process.env.SQS_QUEUE_URL_ACCOUNT_FANOUT =
+			"http://localhost:9324/queue/account-fanout-test";
+		enqueued.length = 0;
+		mock.method(sqsClient, "send", async (command: SendMessageCommand) => {
+			enqueued.push(command);
+			return {};
+		});
+		installClient();
+	};
+
+	it("refuses an anchorless body-content clause with a 400 and creates nothing", async () => {
+		withStubbedQueue();
+
+		const response = await postOrganize(
+			input({ literalClauses: [{ field: "HasWords", value: "invoice" }] }),
+		);
+
+		assert.equal(response.statusCode, 400);
+		assert.match(JSON.parse(response.body).message, /HasWords/);
+		assert.deepEqual(createdRows, []);
+		assert.deepEqual(enqueued, []);
+	});
+
+	it("accepts the same clause when an anchor gives the widen something to run on", async () => {
+		withStubbedQueue();
+
+		const response = await postOrganize(
+			input({
+				anchorMessageId: "msg-anchor",
+				literalClauses: [{ field: "HasWords", value: "invoice" }],
+			}),
+		);
+
+		assert.equal(response.statusCode, 202);
+		assert.equal(createdRows.length, 1);
+		assert.equal(enqueued.length, 1);
+		assert.match(
+			String(enqueued[0]?.input.MessageBody),
+			new RegExp(String(JSON.parse(response.body).organizeJobId)),
+		);
+	});
+});

package/src/handlers/organize.ts

@@ -17,6 +17,7 @@ import {
 	matchOrganize,
 	ORGANIZE_MATCH_LIMIT,
 	type OrganizePredicate,
+	organizePredicateRejection,
 } from "../service/organize.js";
 import { sqsClient } from "../service/sqs.js";
 import type {
@@ -107,6 +108,12 @@ export const OrganizeOperations: Record<
 		await assertAccount(client, accountId, accountConfigId, "act");
 
 		const predicate = predicateFromInput(input);
+
+		// A rule the matcher can never honour is answered here, not with a 202
+		// the worker has to fail later (reader #463).
+		const rejection = organizePredicateRejection(predicate);
+		if (rejection) throw new BadRequestError(rejection.message);
+
 		const ttl = Math.floor(Date.now() / 1000) + ORGANIZE_JOB_TTL_SECONDS;
 
 		const job = await client.organizeJobRequest.create({

package/src/jwt-auth.test.ts

@@ -72,6 +72,35 @@ test("no token and no bypass returns 401", async () => {
 	assert.equal(result?.statusCode, 401);
 });
 
+test("a tokenless GET to the Microsoft OAuth callback is admitted", async () => {
+	const event = buildEvent({
+		httpMethod: "GET",
+		path: "/accounts/oauth/microsoft/callback",
+	});
+
+	const result = await authenticateSelfHostRequest(event);
+
+	assert.equal(result, null);
+	assert.equal(event.requestContext.authorizer, undefined);
+});
+
+test("the callback exemption covers that path and method only", async () => {
+	const neighbour = buildEvent({
+		httpMethod: "GET",
+		path: "/accounts/oauth/microsoft/start",
+	});
+	const otherMethod = buildEvent({
+		httpMethod: "POST",
+		path: "/accounts/oauth/microsoft/callback",
+	});
+
+	assert.equal((await authenticateSelfHostRequest(neighbour))?.statusCode, 401);
+	assert.equal(
+		(await authenticateSelfHostRequest(otherMethod))?.statusCode,
+		401,
+	);
+});
+
 test("pre-injected claims (edge tier) short-circuit verification", async () => {
 	_setVerifierForTest(async () => {
 		throw new Error("verifier must not be called");

package/src/jwt-auth.ts

@@ -55,6 +55,26 @@ const injectClaims = (
 const hasLocalBypass = (): boolean =>
 	Boolean(process.env.LOCAL_ACCOUNT_CONFIG_ID);
 
+/**
+ * The one route that runs without a token.
+ *
+ * Microsoft redirects the browser here after consent, so the request carries no
+ * Authorization header and no session to derive one from. The handler takes its
+ * identity from the HMAC-signed `state` parameter and validates it there; that
+ * signature is the gate, not a JWT.
+ *
+ * Hardcoded and single-entry, matching the edge exemption in
+ * packages/apisix/src/route-table.ts. `@useAuth(NoAuth)` in the spec does not
+ * open a path here — a future public route is added by hand.
+ */
+const PUBLIC_ROUTE = {
+	method: "GET",
+	path: "/accounts/oauth/microsoft/callback",
+};
+
+const isPublicRoute = (event: APIGatewayProxyEvent): boolean =>
+	event.httpMethod === PUBLIC_ROUTE.method && event.path === PUBLIC_ROUTE.path;
+
 /**
  * Authenticate a self-host request from a better-auth RS256 JWT.
  *
@@ -71,6 +91,8 @@ const hasLocalBypass = (): boolean =>
 export const authenticateSelfHostRequest = async (
 	event: APIGatewayProxyEvent,
 ): Promise<APIGatewayProxyResult | null> => {
+	if (isPublicRoute(event)) return null;
+
 	const existingSub = event.requestContext?.authorizer?.claims?.sub;
 	if (typeof existingSub === "string" && existingSub.length > 0) return null;
 

package/src/service/organize.ts

@@ -370,6 +370,19 @@ const bodyContentRejection = (
 			}
 		: null;
 
+/**
+ * The refusal a predicate carries on its own, decidable without reading the
+ * corpus: an anchorless predicate can only ever take the vector-free literal
+ * path, so a body-content clause on it is refused up front. `createOrganizeJob`
+ * runs this before enqueueing and {@link matchOrganize} runs it on the
+ * anchorless arm, so preview, the worker and the request boundary all refuse the
+ * same rule (reader #463).
+ */
+export const organizePredicateRejection = (
+	predicate: OrganizePredicate,
+): OrganizeRejection | null =>
+	hasAnchor(predicate) ? null : bodyContentRejection(predicate.literalClauses);
+
 /**
  * The literal-only arm: scan a bounded, vector-free slice of the corpus and keep
  * the messages whose literal clauses match. Used both for a purely-literal
@@ -434,7 +447,7 @@ export const matchOrganize = async (
 	}
 
 	if (!anchored) {
-		const rejection = bodyContentRejection(clauses);
+		const rejection = organizePredicateRejection(predicate);
 		if (rejection) return { rejected: rejection };
 		const messageIds = await matchLiteral(
 			deps,