@remit/backend 0.0.83 → 0.0.85

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.83",
+  "version": "0.0.85",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",

package/src/config/msoauth.test.ts

@@ -0,0 +1,48 @@
+import assert from "node:assert/strict";
+import { afterEach, describe, it } from "node:test";
+import { getMsOAuthConfig } from "./msoauth.js";
+
+const MSOAUTH_KEYS = [
+	"MSOAUTH_AUTHORITY",
+	"MSOAUTH_REDIRECT_URI",
+	"MSOAUTH_SECRET_ARN",
+	"MSOAUTH_CLIENT_ID",
+	"MSOAUTH_CLIENT_SECRET",
+	"MSOAUTH_TOKEN_ENDPOINT",
+] as const;
+
+describe("getMsOAuthConfig", () => {
+	const original = new Map(
+		MSOAUTH_KEYS.map((key) => [key, process.env[key]] as const),
+	);
+
+	afterEach(() => {
+		for (const [key, value] of original) {
+			if (value === undefined) delete process.env[key];
+			else process.env[key] = value;
+		}
+	});
+
+	it("resolves on a self-host deployment, where no authority is wired", () => {
+		for (const key of MSOAUTH_KEYS) delete process.env[key];
+		process.env.MSOAUTH_REDIRECT_URI =
+			"https://mail.example.com/api/accounts/oauth/microsoft/callback";
+		process.env.MSOAUTH_CLIENT_ID = "client-id";
+		process.env.MSOAUTH_CLIENT_SECRET = "client-secret";
+
+		assert.deepEqual(getMsOAuthConfig(), {
+			secretArn: undefined,
+			redirectUri:
+				"https://mail.example.com/api/accounts/oauth/microsoft/callback",
+			clientId: "client-id",
+			clientSecret: "client-secret",
+			tokenEndpoint: undefined,
+		});
+	});
+
+	it("names PUBLIC_ORIGIN when the redirect URI is missing", () => {
+		for (const key of MSOAUTH_KEYS) delete process.env[key];
+
+		assert.throws(getMsOAuthConfig, /MSOAUTH_REDIRECT_URI.*PUBLIC_ORIGIN/s);
+	});
+});

package/src/config/msoauth.ts

@@ -1,28 +1,25 @@
 /**
  * Typed reads for Microsoft OAuth (Entra) environment variables.
  *
- * In production these are wired by CDK (see infra/stacks/dev/stacks/):
- *   - `MSOAUTH_SECRET_ARN`  — Secrets Manager ARN; Lambda calls GetSecretValue
- *     at runtime to retrieve `{"clientId":"…","clientSecret":"…"}`.
- *   - `MSOAUTH_AUTHORITY`   — OIDC authority base URL (baked in at deploy time).
- *   - `MSOAUTH_REDIRECT_URI`— OAuth callback URI (baked in at deploy time).
+ * `MSOAUTH_REDIRECT_URI` is derived from `PUBLIC_ORIGIN` by the compose file
+ * (deploy/vps/docker-compose.sqlite.yml) and must match the redirect URI
+ * registered on the Entra app registration.
  *
- * For local development, set `MSOAUTH_CLIENT_ID` and `MSOAUTH_CLIENT_SECRET`
- * directly in `localhost-dev-aws.env` to bypass Secrets Manager.
+ * Credentials come either from `MSOAUTH_CLIENT_ID` / `MSOAUTH_CLIENT_SECRET`
+ * in the deploy env file, or from Secrets Manager via `MSOAUTH_SECRET_ARN`.
  *
- * See doc/oauth-microsoft.md for the Azure portal setup runbook.
+ * The Microsoft authorization and token endpoints are fixed in
+ * `@remit/mail-oauth-service`; no authority URL is read from the environment.
  */
 
 export interface MsOAuthConfig {
-	/** Secrets Manager ARN — present in deployed Lambda environments. */
+	/** Secrets Manager ARN — an alternative to the client id/secret pair. */
 	readonly secretArn: string | undefined;
-	/** OIDC authority, e.g. `https://login.microsoftonline.com/common`. */
-	readonly authority: string;
 	/** OAuth redirect URI registered in the Entra app. */
 	readonly redirectUri: string;
-	/** Client ID — used for local dev (bypasses Secrets Manager). */
+	/** Client ID — set directly to bypass Secrets Manager. */
 	readonly clientId: string | undefined;
-	/** Client secret — used for local dev (bypasses Secrets Manager). */
+	/** Client secret — set directly to bypass Secrets Manager. */
 	readonly clientSecret: string | undefined;
 	/** Token endpoint override — used for local stubbing (bypasses default OIDC discovery). */
 	readonly tokenEndpoint: string | undefined;
@@ -30,28 +27,19 @@ export interface MsOAuthConfig {
 
 /**
  * Read Microsoft OAuth configuration from the environment.
- * Throws when mandatory values (`MSOAUTH_AUTHORITY`, `MSOAUTH_REDIRECT_URI`)
- * are absent — both are always present in deployed Lambdas and should be set
- * in `localhost-dev-aws.env` for local development.
+ * Throws when `MSOAUTH_REDIRECT_URI` is absent.
  */
 export const getMsOAuthConfig = (): MsOAuthConfig => {
-	const authority = process.env.MSOAUTH_AUTHORITY;
 	const redirectUri = process.env.MSOAUTH_REDIRECT_URI;
 
-	if (!authority) {
-		throw new Error(
-			"MSOAUTH_AUTHORITY is not set. Wire via CDK (infra/stacks/dev/stacks/remit-api-stack.ts) or set in localhost-dev-aws.env.",
-		);
-	}
 	if (!redirectUri) {
 		throw new Error(
-			"MSOAUTH_REDIRECT_URI is not set. Wire via CDK (infra/stacks/dev/stacks/remit-api-stack.ts) or set in localhost-dev-aws.env.",
+			"MSOAUTH_REDIRECT_URI is not set. It is derived from PUBLIC_ORIGIN — set PUBLIC_ORIGIN in the deploy env file (deploy/vps/.env) and restart, or set MSOAUTH_REDIRECT_URI directly.",
 		);
 	}
 
 	return {
 		secretArn: process.env.MSOAUTH_SECRET_ARN,
-		authority,
 		redirectUri,
 		clientId: process.env.MSOAUTH_CLIENT_ID,
 		clientSecret: process.env.MSOAUTH_CLIENT_SECRET,

package/src/handlers/organize.test.ts

@@ -1,10 +1,27 @@
 import assert from "node:assert/strict";
-import { describe, it } from "node:test";
+import { afterEach, describe, it, mock } from "node:test";
+import type { SendMessageCommand } from "@aws-sdk/client-sqs";
 import type { OrganizeInput } from "@remit/api-openapi-types";
+import type {
+	CreateOrganizeJobRequestInput,
+	IAccountRepository,
+	IOrganizeJobRequestRepository,
+	OrganizeJobRequestItem,
+} from "@remit/data-ports";
 import { BadRequestError } from "@remit/data-ports/errors";
 import { FilterMatchOperator } from "@remit/domain-enums";
+import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
+import type { Context } from "openapi-backend";
+import { deriveAccountConfigId } from "../auth.js";
 import { handleError } from "../error.js";
-import { predicateFromInput } from "./organize.js";
+import { formatResponse } from "../response.js";
+import {
+	_resetForTest,
+	type RemitClient,
+	setClient,
+} from "../service/data-client.js";
+import { sqsClient } from "../service/sqs.js";
+import { OrganizeOperations, predicateFromInput } from "./organize.js";
 
 const input = (over: Partial<OrganizeInput> = {}): OrganizeInput => ({
 	matchOperator: FilterMatchOperator.And,
@@ -61,3 +78,111 @@ describe("previewOrganize rejected-rule response (reader #457)", () => {
 		assert.match(JSON.parse(response.body).message, /HasWords/);
 	});
 });
+
+const SUB = "cognito-sub-995";
+const ACCOUNT_CONFIG_ID = deriveAccountConfigId(SUB);
+const ACCOUNT_ID = "acc-995";
+
+const createdRows: CreateOrganizeJobRequestInput[] = [];
+const enqueued: SendMessageCommand[] = [];
+
+const installClient = (): void => {
+	createdRows.length = 0;
+	setClient({
+		account: {
+			get: async () => ({
+				accountId: ACCOUNT_ID,
+				accountConfigId: ACCOUNT_CONFIG_ID,
+			}),
+		} as unknown as IAccountRepository,
+		organizeJobRequest: {
+			create: async (input: CreateOrganizeJobRequestInput) => {
+				createdRows.push(input);
+				return {
+					...input,
+					organizeJobId: `job-${createdRows.length}`,
+					state: "Pending",
+				} as unknown as OrganizeJobRequestItem;
+			},
+		} as unknown as IOrganizeJobRequestRepository,
+	} as unknown as RemitClient);
+};
+
+const authorizedEvent = (): APIGatewayProxyEvent =>
+	({
+		body: null,
+		requestContext: { authorizer: { claims: { sub: SUB } } },
+	}) as unknown as APIGatewayProxyEvent;
+
+const createJob = OrganizeOperations.OrganizeOperations_createOrganizeJob as (
+	context: Context,
+	event: APIGatewayProxyEvent,
+) => Promise<Record<string, unknown>>;
+
+/** The response the browser receives, error funnel included. */
+const postOrganize = async (
+	body: OrganizeInput,
+): Promise<APIGatewayProxyResult> => {
+	const context = {
+		request: { params: { accountId: ACCOUNT_ID }, requestBody: body },
+	} as unknown as Context;
+	return createJob(context, authorizedEvent()).then(
+		(response) => formatResponse(response),
+		(error: unknown) => handleError(error),
+	);
+};
+
+// A rule the matcher can never honour — a body-content clause with no anchor to
+// widen from — is refused on the request instead of accepted with a 202 for a
+// job the worker can only fail (reader #463, #995). The contract now declares
+// the 400, so the proof is the response the client gets plus the absence of the
+// two side effects a 202 promises: a job row and a queued message.
+describe("createOrganizeJob rejected-rule refusal (reader #995)", () => {
+	afterEach(() => {
+		mock.restoreAll();
+		_resetForTest();
+	});
+
+	const withStubbedQueue = (): void => {
+		process.env.SQS_QUEUE_URL_ACCOUNT_FANOUT =
+			"http://localhost:9324/queue/account-fanout-test";
+		enqueued.length = 0;
+		mock.method(sqsClient, "send", async (command: SendMessageCommand) => {
+			enqueued.push(command);
+			return {};
+		});
+		installClient();
+	};
+
+	it("refuses an anchorless body-content clause with a 400 and creates nothing", async () => {
+		withStubbedQueue();
+
+		const response = await postOrganize(
+			input({ literalClauses: [{ field: "HasWords", value: "invoice" }] }),
+		);
+
+		assert.equal(response.statusCode, 400);
+		assert.match(JSON.parse(response.body).message, /HasWords/);
+		assert.deepEqual(createdRows, []);
+		assert.deepEqual(enqueued, []);
+	});
+
+	it("accepts the same clause when an anchor gives the widen something to run on", async () => {
+		withStubbedQueue();
+
+		const response = await postOrganize(
+			input({
+				anchorMessageId: "msg-anchor",
+				literalClauses: [{ field: "HasWords", value: "invoice" }],
+			}),
+		);
+
+		assert.equal(response.statusCode, 202);
+		assert.equal(createdRows.length, 1);
+		assert.equal(enqueued.length, 1);
+		assert.match(
+			String(enqueued[0]?.input.MessageBody),
+			new RegExp(String(JSON.parse(response.body).organizeJobId)),
+		);
+	});
+});

package/src/handlers/organize.ts

@@ -17,6 +17,7 @@ import {
 	matchOrganize,
 	ORGANIZE_MATCH_LIMIT,
 	type OrganizePredicate,
+	organizePredicateRejection,
 } from "../service/organize.js";
 import { sqsClient } from "../service/sqs.js";
 import type {
@@ -107,6 +108,12 @@ export const OrganizeOperations: Record<
 		await assertAccount(client, accountId, accountConfigId, "act");
 
 		const predicate = predicateFromInput(input);
+
+		// A rule the matcher can never honour is answered here, not with a 202
+		// the worker has to fail later (reader #463).
+		const rejection = organizePredicateRejection(predicate);
+		if (rejection) throw new BadRequestError(rejection.message);
+
 		const ttl = Math.floor(Date.now() / 1000) + ORGANIZE_JOB_TTL_SECONDS;
 
 		const job = await client.organizeJobRequest.create({

package/src/service/organize.ts

@@ -370,6 +370,19 @@ const bodyContentRejection = (
 			}
 		: null;
 
+/**
+ * The refusal a predicate carries on its own, decidable without reading the
+ * corpus: an anchorless predicate can only ever take the vector-free literal
+ * path, so a body-content clause on it is refused up front. `createOrganizeJob`
+ * runs this before enqueueing and {@link matchOrganize} runs it on the
+ * anchorless arm, so preview, the worker and the request boundary all refuse the
+ * same rule (reader #463).
+ */
+export const organizePredicateRejection = (
+	predicate: OrganizePredicate,
+): OrganizeRejection | null =>
+	hasAnchor(predicate) ? null : bodyContentRejection(predicate.literalClauses);
+
 /**
  * The literal-only arm: scan a bounded, vector-free slice of the corpus and keep
  * the messages whose literal clauses match. Used both for a purely-literal
@@ -434,7 +447,7 @@ export const matchOrganize = async (
 	}
 
 	if (!anchored) {
-		const rejection = bodyContentRejection(clauses);
+		const rejection = organizePredicateRejection(predicate);
 		if (rejection) return { rejected: rejection };
 		const messageIds = await matchLiteral(
 			deps,