@remit/backend 0.0.84 → 0.0.85

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.84",
+  "version": "0.0.85",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",

package/src/config/msoauth.test.ts

@@ -0,0 +1,48 @@
+import assert from "node:assert/strict";
+import { afterEach, describe, it } from "node:test";
+import { getMsOAuthConfig } from "./msoauth.js";
+
+const MSOAUTH_KEYS = [
+	"MSOAUTH_AUTHORITY",
+	"MSOAUTH_REDIRECT_URI",
+	"MSOAUTH_SECRET_ARN",
+	"MSOAUTH_CLIENT_ID",
+	"MSOAUTH_CLIENT_SECRET",
+	"MSOAUTH_TOKEN_ENDPOINT",
+] as const;
+
+describe("getMsOAuthConfig", () => {
+	const original = new Map(
+		MSOAUTH_KEYS.map((key) => [key, process.env[key]] as const),
+	);
+
+	afterEach(() => {
+		for (const [key, value] of original) {
+			if (value === undefined) delete process.env[key];
+			else process.env[key] = value;
+		}
+	});
+
+	it("resolves on a self-host deployment, where no authority is wired", () => {
+		for (const key of MSOAUTH_KEYS) delete process.env[key];
+		process.env.MSOAUTH_REDIRECT_URI =
+			"https://mail.example.com/api/accounts/oauth/microsoft/callback";
+		process.env.MSOAUTH_CLIENT_ID = "client-id";
+		process.env.MSOAUTH_CLIENT_SECRET = "client-secret";
+
+		assert.deepEqual(getMsOAuthConfig(), {
+			secretArn: undefined,
+			redirectUri:
+				"https://mail.example.com/api/accounts/oauth/microsoft/callback",
+			clientId: "client-id",
+			clientSecret: "client-secret",
+			tokenEndpoint: undefined,
+		});
+	});
+
+	it("names PUBLIC_ORIGIN when the redirect URI is missing", () => {
+		for (const key of MSOAUTH_KEYS) delete process.env[key];
+
+		assert.throws(getMsOAuthConfig, /MSOAUTH_REDIRECT_URI.*PUBLIC_ORIGIN/s);
+	});
+});

package/src/config/msoauth.ts

@@ -1,28 +1,25 @@
 /**
  * Typed reads for Microsoft OAuth (Entra) environment variables.
  *
- * In production these are wired by CDK (see infra/stacks/dev/stacks/):
- *   - `MSOAUTH_SECRET_ARN`  — Secrets Manager ARN; Lambda calls GetSecretValue
- *     at runtime to retrieve `{"clientId":"…","clientSecret":"…"}`.
- *   - `MSOAUTH_AUTHORITY`   — OIDC authority base URL (baked in at deploy time).
- *   - `MSOAUTH_REDIRECT_URI`— OAuth callback URI (baked in at deploy time).
+ * `MSOAUTH_REDIRECT_URI` is derived from `PUBLIC_ORIGIN` by the compose file
+ * (deploy/vps/docker-compose.sqlite.yml) and must match the redirect URI
+ * registered on the Entra app registration.
  *
- * For local development, set `MSOAUTH_CLIENT_ID` and `MSOAUTH_CLIENT_SECRET`
- * directly in `localhost-dev-aws.env` to bypass Secrets Manager.
+ * Credentials come either from `MSOAUTH_CLIENT_ID` / `MSOAUTH_CLIENT_SECRET`
+ * in the deploy env file, or from Secrets Manager via `MSOAUTH_SECRET_ARN`.
  *
- * See doc/oauth-microsoft.md for the Azure portal setup runbook.
+ * The Microsoft authorization and token endpoints are fixed in
+ * `@remit/mail-oauth-service`; no authority URL is read from the environment.
  */
 
 export interface MsOAuthConfig {
-	/** Secrets Manager ARN — present in deployed Lambda environments. */
+	/** Secrets Manager ARN — an alternative to the client id/secret pair. */
 	readonly secretArn: string | undefined;
-	/** OIDC authority, e.g. `https://login.microsoftonline.com/common`. */
-	readonly authority: string;
 	/** OAuth redirect URI registered in the Entra app. */
 	readonly redirectUri: string;
-	/** Client ID — used for local dev (bypasses Secrets Manager). */
+	/** Client ID — set directly to bypass Secrets Manager. */
 	readonly clientId: string | undefined;
-	/** Client secret — used for local dev (bypasses Secrets Manager). */
+	/** Client secret — set directly to bypass Secrets Manager. */
 	readonly clientSecret: string | undefined;
 	/** Token endpoint override — used for local stubbing (bypasses default OIDC discovery). */
 	readonly tokenEndpoint: string | undefined;
@@ -30,28 +27,19 @@ export interface MsOAuthConfig {
 
 /**
  * Read Microsoft OAuth configuration from the environment.
- * Throws when mandatory values (`MSOAUTH_AUTHORITY`, `MSOAUTH_REDIRECT_URI`)
- * are absent — both are always present in deployed Lambdas and should be set
- * in `localhost-dev-aws.env` for local development.
+ * Throws when `MSOAUTH_REDIRECT_URI` is absent.
  */
 export const getMsOAuthConfig = (): MsOAuthConfig => {
-	const authority = process.env.MSOAUTH_AUTHORITY;
 	const redirectUri = process.env.MSOAUTH_REDIRECT_URI;
 
-	if (!authority) {
-		throw new Error(
-			"MSOAUTH_AUTHORITY is not set. Wire via CDK (infra/stacks/dev/stacks/remit-api-stack.ts) or set in localhost-dev-aws.env.",
-		);
-	}
 	if (!redirectUri) {
 		throw new Error(
-			"MSOAUTH_REDIRECT_URI is not set. Wire via CDK (infra/stacks/dev/stacks/remit-api-stack.ts) or set in localhost-dev-aws.env.",
+			"MSOAUTH_REDIRECT_URI is not set. It is derived from PUBLIC_ORIGIN — set PUBLIC_ORIGIN in the deploy env file (deploy/vps/.env) and restart, or set MSOAUTH_REDIRECT_URI directly.",
 		);
 	}
 
 	return {
 		secretArn: process.env.MSOAUTH_SECRET_ARN,
-		authority,
 		redirectUri,
 		clientId: process.env.MSOAUTH_CLIENT_ID,
 		clientSecret: process.env.MSOAUTH_CLIENT_SECRET,