@remit/backend 0.0.88 → 0.0.89

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.88",
+  "version": "0.0.89",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",
@@ -52,6 +52,8 @@
     "tsx": "*"
   },
   "dependencies": {
+    "@remit/config-format": "*",
+    "@remit/config-transfer": "*",
     "@remit/data-ports": "*",
     "@remit/domain-enums": "*",
     "@remit/api-openapi-types": "*",

package/scripts/config-save.ts

@@ -0,0 +1,128 @@
+import { readConfigForExport } from "@remit/config-transfer";
+import { env } from "expect-env";
+// Reached by module path rather than through either package's entry point, the
+// same way the migrate entrypoint reaches its repairs: this file is bundled by
+// esbuild, and a barrel import would drag every repository and the native
+// driver behind it into a script that reads one table.
+import { auth_user } from "../../auth-service/src/schema/auth-schema-sqlite.js";
+import { createSqliteDatabase } from "../../drizzle-service/src/sqlite-client.js";
+import { deriveAccountConfigId } from "../src/auth.js";
+import { getClient } from "../src/service/data-client.js";
+import { exportIdentity } from "../src/service/export-identity.js";
+
+/**
+ * `remit config save` (issue #1021). Writes one configuration out as a
+ * versioned JSON document on stdout, over the same reader the export endpoint
+ * uses. Ships as an alternate entrypoint in the backend image — "the backend
+ * image with a command", the shape `migrate.mjs` and `backfill-list-id.mjs`
+ * already use — because the operator runs it before a migration drops the
+ * database, with no browser and no session to authenticate.
+ *
+ * The document goes to stdout and never to a path inside the container: the
+ * wrapper redirects it to a host file, so the file lands where the operator can
+ * see it and with their ownership, rather than root-owned inside a volume.
+ */
+
+const USAGE = `Usage: node config-save.mjs [--user <email>]
+
+Writes the configuration as a versioned JSON document to stdout. Contains no
+credential: each account records which one it will need back instead.
+
+  --user <email>  Which sign-in to export. Optional on an instance that holds
+                  exactly one configuration.
+`;
+
+interface Options {
+	user: string | undefined;
+}
+
+const parseArguments = (argv: readonly string[]): Options => {
+	const options: Options = { user: undefined };
+	for (let index = 0; index < argv.length; index += 1) {
+		const argument = argv[index];
+		if (argument === "--user") {
+			const value = argv[index + 1];
+			if (value === undefined || value.startsWith("--")) {
+				throw new Error("--user needs an email address");
+			}
+			options.user = value;
+			index += 1;
+			continue;
+		}
+		throw new Error(`unknown option '${argument}'`);
+	}
+	return options;
+};
+
+/**
+ * The configuration behind a sign-in. Identity lives in better-auth's own
+ * tables in the same database file, and the configuration id derives from the
+ * user id, so the email on the sign-in screen is the one thing an operator can
+ * be expected to know.
+ */
+const accountConfigIdForUser = async (email: string): Promise<string> => {
+	const { db, close } = await createSqliteDatabase(
+		{ auth_user },
+		{ filename: env.SQLITE_DB_PATH },
+	);
+	try {
+		const users = await db
+			.select({ id: auth_user.id, email: auth_user.email })
+			.from(auth_user);
+		// Matched in JS rather than in the query: an address is
+		// case-insensitive on the part that matters, and which collation the
+		// column happens to carry is not something an operator should have to
+		// know before their own email matches.
+		const wanted = email.toLowerCase();
+		const user = users.find((row) => row.email.toLowerCase() === wanted);
+		if (!user) throw new Error(`no user signs in as ${email}`);
+		return deriveAccountConfigId(user.id);
+	} finally {
+		await close();
+	}
+};
+
+const soleAccountConfigId = async (
+	listAll: () => Promise<Array<{ accountConfigId: string }>>,
+): Promise<string> => {
+	const configs = await listAll();
+	const only = configs[0];
+	if (!only) throw new Error("this instance holds no configuration to export");
+	if (configs.length > 1) {
+		throw new Error(
+			`this instance holds ${configs.length} configurations — name one with --user <email>`,
+		);
+	}
+	return only.accountConfigId;
+};
+
+const run = async (): Promise<void> => {
+	const argv = process.argv.slice(2);
+	if (argv.includes("--help") || argv.includes("-h")) {
+		process.stdout.write(USAGE);
+		return;
+	}
+
+	const options = parseArguments(argv);
+	const client = await getClient();
+	const accountConfigId = options.user
+		? await accountConfigIdForUser(options.user)
+		: await soleAccountConfigId(() => client.accountConfig.listAll());
+
+	const document = await readConfigForExport(
+		client,
+		accountConfigId,
+		exportIdentity(),
+	);
+	process.stdout.write(`${JSON.stringify(document, null, "\t")}\n`);
+};
+
+// No `process.exit` on the way out: the document is written to stdout, and
+// stdout is a pipe under `compose run`, so exiting drops whatever write is
+// still pending. Setting the code and letting the process end delivers it.
+await run().catch((error: unknown) => {
+	process.stderr.write(
+		`config save: ${error instanceof Error ? error.message : String(error)}\n`,
+	);
+	process.exitCode = 1;
+});

package/src/handlers/config.ts

@@ -3,6 +3,8 @@ import type {
 	AccountConfigResponse,
 	ConfigDescriptionResponse,
 } from "@remit/api-openapi-types";
+import type { ReaderConfigDocument } from "@remit/config-format";
+import { readConfigForExport } from "@remit/config-transfer";
 import type { AccountConfigItem, MailboxItem } from "@remit/data-ports";
 import { NotFoundError } from "@remit/data-ports/errors";
 import { logger } from "@remit/logger-lambda";
@@ -11,6 +13,7 @@ import { env } from "expect-env";
 import type { Context } from "openapi-backend";
 import { getAccountConfigIdFromEvent, getSubFromEvent } from "../auth.js";
 import { getClient } from "../service/data-client.js";
+import { exportIdentity } from "../service/export-identity.js";
 import { fireAndForget } from "../service/fire-and-forget.js";
 import { sqsClient } from "../service/sqs.js";
 import { triggerAccountSync } from "../service/trigger-sync.js";
@@ -216,4 +219,19 @@ export const ConfigOperations: Record<
 			),
 		};
 	},
+
+	ConfigOperations_exportConfig: async (
+		_context: Context,
+		...args: unknown[]
+	): Promise<{ schemaVersion: number; document: ReaderConfigDocument }> => {
+		const event = args[0] as APIGatewayProxyEvent;
+		const accountConfigId = getAccountConfigIdFromEvent(event);
+		const client = await getClient();
+		const document = await readConfigForExport(
+			client,
+			accountConfigId,
+			exportIdentity(),
+		);
+		return { schemaVersion: document.schemaVersion, document };
+	},
 };

package/src/service/export-identity.ts

@@ -0,0 +1,39 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import type { ConfigExportIdentity } from "@remit/config-transfer";
+
+const DEFAULT_CONTROL_DIR = "/data/control";
+
+/**
+ * The version a file says it was written by. The updater owns this fact: it
+ * reads the tag from `.env` and writes it into `state.json`, which is the only
+ * honest source across an update that rewrites that tag underneath a
+ * long-lived process. With no state file there is nothing authoritative to
+ * stamp, and an export says so rather than inventing a version an importing
+ * reader would then trust.
+ */
+const runningVersion = (): string => {
+	const dir = process.env.REMIT_UPDATE_CONTROL_DIR ?? DEFAULT_CONTROL_DIR;
+	let raw: string;
+	try {
+		raw = readFileSync(join(dir, "state.json"), "utf8");
+	} catch {
+		return "unknown";
+	}
+	const state: unknown = JSON.parse(raw);
+	if (typeof state !== "object" || state === null) return "unknown";
+	const version = (state as { currentVersion?: unknown }).currentVersion;
+	return typeof version === "string" && version.length > 0
+		? version
+		: "unknown";
+};
+
+/** Who wrote a configuration file, and from where. Provenance only. */
+export const exportIdentity = (
+	now: Date = new Date(),
+): ConfigExportIdentity => ({
+	app: "reader",
+	version: runningVersion(),
+	exportedAt: now.toISOString(),
+	instance: process.env.PUBLIC_ORIGIN ?? "",
+});

package/src/types.ts

@@ -12,6 +12,7 @@ export type OperationIds =
 	| "MeOperations_getExport"
 	| "MeOperations_listQuarantine"
 	| "ConfigOperations_getConfig"
+	| "ConfigOperations_exportConfig"
 	| "SystemOperations_getSystemUpdate"
 	| "SystemOperations_applySystemUpdate"
 	| "AccountOperations_createAccount"