@remit/backend 0.0.95 → 0.0.97

package/src/jwt-auth.ts

@@ -4,6 +4,7 @@ import {
 	type JwtVerifier,
 	resolveVerifierConfig,
 } from "@remit/auth-service/verifier";
+import { readCalendarFeedToken } from "@remit/calendar-service";
 import { logger } from "@remit/logger-lambda";
 import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
 
@@ -56,24 +57,39 @@ const hasLocalBypass = (): boolean =>
 	Boolean(process.env.LOCAL_ACCOUNT_CONFIG_ID);
 
 /**
- * The one route that runs without a token.
+ * The routes that run without a token.
  *
  * Microsoft redirects the browser here after consent, so the request carries no
  * Authorization header and no session to derive one from. The handler takes its
  * identity from the HMAC-signed `state` parameter and validates it there; that
  * signature is the gate, not a JWT.
  *
- * Hardcoded and single-entry, matching the edge exemption in
- * packages/apisix/src/route-table.ts. `@useAuth(NoAuth)` in the spec does not
- * open a path here — a future public route is added by hand.
+ * A calendar feed carries its credential in the path for the same reason: a
+ * subscribed client polls a URL and has no session to present, so the token is
+ * the gate and the handler compares it against a stored hash.
+ *
+ * Hardcoded, matching the edge exemption in packages/apisix/src/route-table.ts.
+ * `@useAuth(NoAuth)` in the spec does not open a path here — a future public
+ * route is added by hand.
  */
-const PUBLIC_ROUTE = {
-	method: "GET",
-	path: "/accounts/oauth/microsoft/callback",
-};
+const PUBLIC_ROUTES: readonly {
+	method: string;
+	matches: (path: string) => boolean;
+}[] = [
+	{
+		method: "GET",
+		matches: (path) => path === "/accounts/oauth/microsoft/callback",
+	},
+	{
+		method: "GET",
+		matches: (path) => readCalendarFeedToken(path) !== null,
+	},
+];
 
 const isPublicRoute = (event: APIGatewayProxyEvent): boolean =>
-	event.httpMethod === PUBLIC_ROUTE.method && event.path === PUBLIC_ROUTE.path;
+	PUBLIC_ROUTES.some(
+		(route) => route.method === event.httpMethod && route.matches(event.path),
+	);
 
 /**
  * Authenticate a self-host request from a better-auth RS256 JWT.

package/src/log-redaction.test.ts

@@ -0,0 +1,148 @@
+/**
+ * Issue #1065: what a request is allowed to leave behind in the log.
+ *
+ * A calendar feed's token is in its path and is the whole credential, so the
+ * path is a secret; a validation failure is logged at error level and the
+ * request it carries holds the caller's Authorization header. Both are asserted
+ * against captured stdout rather than by reading the call sites, because the
+ * leak was a field bound two frames away from the handler that logged it.
+ */
+
+import assert from "node:assert/strict";
+import { after, before, describe, it } from "node:test";
+import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
+
+// pino writes to `process.stdout` only when its `write` has been replaced, so
+// the hook goes in before the logger is imported — which every import below
+// does transitively. Writes pass through whenever nothing is capturing, so the
+// test runner's own output still reaches the terminal.
+const originalWrite = process.stdout.write.bind(process.stdout);
+const written: string[] = [];
+let capturing = false;
+
+process.stdout.write = ((
+	chunk: string | Uint8Array,
+	...rest: unknown[]
+): boolean => {
+	if (capturing && typeof chunk === "string") {
+		written.push(chunk);
+		return true;
+	}
+	return (originalWrite as (...args: unknown[]) => boolean)(chunk, ...rest);
+}) as typeof process.stdout.write;
+
+process.env.LOG_LEVEL = "trace";
+
+const { calendarFeedPath, mintCalendarFeedToken } = await import(
+	"@remit/calendar-service"
+);
+const { _resetForTest, setClient } = await import("./service/data-client.js");
+const { createCalendarSqliteClient } = await import(
+	"./handlers/calendar-sqlite-fixture.js"
+);
+
+let handler: (
+	event: APIGatewayProxyEvent,
+	context: unknown,
+) => Promise<APIGatewayProxyResult>;
+let cleanup: () => void;
+
+const capture = async (
+	run: () => Promise<APIGatewayProxyResult>,
+): Promise<{ response: APIGatewayProxyResult; logged: string }> => {
+	written.length = 0;
+	capturing = true;
+	try {
+		const response = await run();
+		return { response, logged: written.join("") };
+	} finally {
+		capturing = false;
+	}
+};
+
+const send = (
+	event: Partial<APIGatewayProxyEvent> & { httpMethod: string; path: string },
+): Promise<APIGatewayProxyResult> =>
+	handler(
+		{
+			headers: {},
+			queryStringParameters: null,
+			body: null,
+			requestContext: {},
+			...event,
+		} as unknown as APIGatewayProxyEvent,
+		{ awsRequestId: "log-redaction", functionName: "test" },
+	);
+
+before(async () => {
+	_resetForTest();
+	process.env.DATA_BACKEND = "sqlite";
+	const fixture = await createCalendarSqliteClient();
+	cleanup = fixture.cleanup;
+	setClient(fixture.client);
+	({ handler } = (await import("./index.js")) as unknown as {
+		handler: typeof handler;
+	});
+});
+
+after(() => {
+	_resetForTest();
+	process.stdout.write = originalWrite as typeof process.stdout.write;
+	cleanup();
+});
+
+describe("what a request leaves in the log", () => {
+	it("never writes the feed token a subscriber polls with", async () => {
+		const { token } = mintCalendarFeedToken();
+
+		const { response, logged } = await capture(() =>
+			send({ httpMethod: "GET", path: calendarFeedPath(token) }),
+		);
+
+		assert.equal(
+			response.statusCode,
+			404,
+			"an unknown token, but still routed",
+		);
+		assert.ok(logged.length > 0, "the request has to have logged something");
+		assert.equal(
+			logged.includes(token),
+			false,
+			"the token in the path is the credential, so the path cannot be a log field",
+		);
+		assert.ok(
+			logged.includes("/feeds/calendar/<redacted>.ics"),
+			"which route was served is what an operator reads the log for",
+		);
+	});
+
+	it("never writes the credentials a failing request arrived with", async () => {
+		// A session is already established, so the bearer is never verified and the
+		// request reaches validation — where the whole parsed request, headers and
+		// all, used to be logged. The delete refuses because it declares
+		// `calendarId` as a required query parameter and none was sent.
+		const { response, logged } = await capture(() =>
+			send({
+				httpMethod: "DELETE",
+				path: "/calendar-events/8f14e45f-ceea-467a-9c9e-9c9e9c9e9c9e",
+				headers: {
+					Authorization: "Bearer x",
+					Cookie: "session=secret-cookie-value",
+				},
+				requestContext: {
+					authorizer: { claims: { sub: "log-redaction-sub" } },
+				} as unknown as APIGatewayProxyEvent["requestContext"],
+			}),
+		);
+
+		assert.equal(response.statusCode, 400, response.body);
+		assert.ok(logged.includes("Validation failed"));
+		assert.equal(logged.includes("Bearer x"), false);
+		assert.equal(logged.includes("secret-cookie-value"), false);
+		assert.equal(
+			logged.includes("parsedRequest"),
+			false,
+			"the request that failed is not a field; its errors are",
+		);
+	});
+});

package/src/response.ts

@@ -7,23 +7,50 @@ import {
 	resolveAllowedOrigin,
 } from "./request-context.js";
 
-export const formatResponse = (
-	body: Record<string, unknown>,
-	statusCode = 200,
-): APIGatewayProxyResult => {
-	if (body.statusCode && typeof body.statusCode === "number") {
-		statusCode = body.statusCode;
-	}
-
-	if ("body" in body && body.body && typeof body.body === "object") {
-		body = body.body as Record<string, unknown>;
-	}
+const RAW_API_RESPONSE: unique symbol = Symbol("remit.rawApiResponse");
+
+/**
+ * A response whose bytes are not JSON — an iCalendar feed, and whatever later
+ * joins it.
+ *
+ * Every other handler returns a plain object and lets this module decide the
+ * status, the content type and the serialization. That is the right default and
+ * stays the default; a handler that has to own its own media type says so with
+ * `rawApiResponse` rather than by returning a shape this one has to guess at.
+ * The CORS and correlation headers are still added here, so a raw response is
+ * not a way around them.
+ */
+export interface RawApiResponse {
+	statusCode: number;
+	headers: Record<string, string>;
+	body: string;
+}
+
+type MarkedRawApiResponse = RawApiResponse & {
+	readonly [RAW_API_RESPONSE]: true;
+};
 
-	logger.debug({ statusCode }, "response");
+export const rawApiResponse = (
+	response: RawApiResponse,
+): MarkedRawApiResponse =>
+	Object.assign(response, { [RAW_API_RESPONSE]: true as const });
 
+const isRawApiResponse = (
+	body: Record<string, unknown>,
+): body is MarkedRawApiResponse & Record<string, unknown> =>
+	RAW_API_RESPONSE in body;
+
+/**
+ * The headers every response carries whatever its body is: the CORS grant the
+ * browser needs, and the id the request's log lines are already tagged with.
+ * Returning that id is what makes a bug report's "correlation id" resolve to a
+ * server-side line; the browser can only read a non-safelisted header when it
+ * is exposed.
+ */
+const envelopeHeaders = (): Record<string, string> => {
 	const allowOrigin = resolveAllowedOrigin(getRequestOrigin());
 
-	const corsHeaders: Record<string, string> = {
+	const headers: Record<string, string> = {
 		"Access-Control-Allow-Origin": allowOrigin,
 		"Access-Control-Allow-Headers": "Authorization,Content-Type",
 		"Access-Control-Allow-Methods": "GET,POST,PUT,PATCH,DELETE,OPTIONS",
@@ -31,26 +58,46 @@ export const formatResponse = (
 	};
 
 	if (allowOrigin !== "*") {
-		corsHeaders["Access-Control-Allow-Credentials"] = "true";
+		headers["Access-Control-Allow-Credentials"] = "true";
 	}
 
-	// The id the request's log lines are already tagged with. Returning it is
-	// what makes a bug report's "correlation id" resolve to a server-side line;
-	// the browser can only read a non-safelisted header when it is exposed.
 	const correlationId = getRequestCorrelationId();
-	const correlationHeaders: Record<string, string> = correlationId
-		? {
-				"x-correlation-id": correlationId,
-				"Access-Control-Expose-Headers": "x-correlation-id",
-			}
-		: {};
+	if (correlationId) {
+		headers["x-correlation-id"] = correlationId;
+		headers["Access-Control-Expose-Headers"] = "x-correlation-id";
+	}
+
+	return headers;
+};
+
+export const formatResponse = (
+	body: Record<string, unknown>,
+	statusCode = 200,
+): APIGatewayProxyResult => {
+	if (body.statusCode && typeof body.statusCode === "number") {
+		statusCode = body.statusCode;
+	}
+
+	if (isRawApiResponse(body)) {
+		logger.debug({ statusCode: body.statusCode }, "response");
+		return {
+			statusCode: body.statusCode,
+			headers: { ...envelopeHeaders(), ...body.headers },
+			body: body.body,
+		};
+	}
+
+	if ("body" in body && body.body && typeof body.body === "object") {
+		body = body.body as Record<string, unknown>;
+	}
+
+	logger.debug({ statusCode }, "response");
 
 	return {
 		statusCode: statusCode,
 		headers: {
 			"Content-Type": "application/json",
-			...corsHeaders,
-			...correlationHeaders,
+			...envelopeHeaders(),
 		},
 		body: JSON.stringify(body),
 	};

package/src/service/compose-sqlite.ts

@@ -6,6 +6,7 @@ import {
 	AddressRepo,
 	CalendarCollectionRepo,
 	CalendarEventIndexRepo,
+	CalendarFeedTokenRepo,
 	CalendarObjectRepo,
 	CalendarSuggestionRepo,
 	ConfigImportRepo,
@@ -86,6 +87,7 @@ export const buildSqliteClient = async (): Promise<RemitClient> => {
 		calendarCollection: new CalendarCollectionRepo(genericDb),
 		calendarObject: new CalendarObjectRepo(genericDb),
 		calendarEventIndex: new CalendarEventIndexRepo(genericDb),
+		calendarFeedToken: new CalendarFeedTokenRepo(genericDb),
 		calendarSuggestion: new CalendarSuggestionRepo(genericDb),
 		calendarUnitOfWork: new DrizzleCalendarUnitOfWork(genericDb),
 		unitOfWork: new DrizzleUnitOfWork(messageDataDb),

package/src/service/create-remit-client.ts

@@ -6,6 +6,7 @@ import type {
 	IAddressRepository,
 	ICalendarCollectionRepository,
 	ICalendarEventIndexRepository,
+	ICalendarFeedTokenRepository,
 	ICalendarObjectRepository,
 	ICalendarSuggestionRepository,
 	ICalendarUnitOfWork,
@@ -130,6 +131,7 @@ export interface RemitClient {
 	calendarCollection: ICalendarCollectionRepository;
 	calendarObject: ICalendarObjectRepository;
 	calendarEventIndex: ICalendarEventIndexRepository;
+	calendarFeedToken: ICalendarFeedTokenRepository;
 	calendarSuggestion: ICalendarSuggestionRepository;
 	calendarUnitOfWork: ICalendarUnitOfWork;
 
@@ -225,6 +227,7 @@ export interface RemitClientRepositories {
 	calendarCollection: ICalendarCollectionRepository;
 	calendarObject: ICalendarObjectRepository;
 	calendarEventIndex: ICalendarEventIndexRepository;
+	calendarFeedToken: ICalendarFeedTokenRepository;
 	calendarSuggestion: ICalendarSuggestionRepository;
 	calendarUnitOfWork: ICalendarUnitOfWork;
 	unitOfWork?: IUnitOfWork;
@@ -466,6 +469,7 @@ export const createRemitClient = (deps: RemitClientDeps): RemitClient => {
 		calendarCollection: repositories.calendarCollection,
 		calendarObject: repositories.calendarObject,
 		calendarEventIndex: repositories.calendarEventIndex,
+		calendarFeedToken: repositories.calendarFeedToken,
 		calendarSuggestion: repositories.calendarSuggestion,
 		calendarUnitOfWork: repositories.calendarUnitOfWork,
 		unitOfWork: repositories.unitOfWork,

package/src/types.ts

@@ -63,6 +63,10 @@ export type OperationIds =
 	| "CalendarDetailOperations_getCalendar"
 	| "CalendarDetailOperations_updateCalendar"
 	| "CalendarDetailOperations_deleteCalendar"
+	| "CalendarDetailOperations_getCalendarFeed"
+	| "CalendarDetailOperations_putCalendarFeed"
+	| "CalendarDetailOperations_revokeCalendarFeed"
+	| "CalendarFeedOperations_getCalendarFeedIcal"
 	| "CalendarEventOperations_listCalendarEvents"
 	| "CalendarEventOperations_createCalendarEvent"
 	| "CalendarEventDetailOperations_getCalendarEvent"
@@ -180,6 +184,26 @@ export type CalendarDetailOperationIds = MatchPrefix<
 	OperationIds
 >;
 
+/**
+ * The feed sub-resource of `/calendars/{calendarId}`, handled beside the
+ * collection itself rather than inside it: minting a credential and serving one
+ * calendar's settings are different jobs on the same path.
+ */
+export type CalendarFeedDetailOperationIds =
+	| "CalendarDetailOperations_getCalendarFeed"
+	| "CalendarDetailOperations_putCalendarFeed"
+	| "CalendarDetailOperations_revokeCalendarFeed";
+
+export type CalendarCollectionDetailOperationIds = Exclude<
+	CalendarDetailOperationIds,
+	CalendarFeedDetailOperationIds
+>;
+
+export type CalendarFeedOperationIds = MatchPrefix<
+	"CalendarFeedOperations_",
+	OperationIds
+>;
+
 export type CalendarEventOperationIds = MatchPrefix<
 	"CalendarEventOperations_",
 	OperationIds