@remit/drizzle-service 0.0.46 → 0.0.47

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/drizzle-service",
-  "version": "0.0.46",
+  "version": "0.0.47",
   "description": "Drizzle ORM service over SQLite",
   "type": "module",
   "main": "src/index.ts",

package/src/repair/stranded-sent-outbox.sqlite.test.ts

@@ -0,0 +1,117 @@
+/**
+ * The repair against the shape a deployment actually runs: the committed
+ * `CREATE TABLE` block, not a schema pushed from the drizzle table objects.
+ *
+ * What it has to hold on a live database: a message whose filing is still in
+ * flight is left alone, a stranded one becomes visible, no row is removed, and
+ * a second run writes nothing.
+ */
+
+import assert from "node:assert/strict";
+import { after, before, describe, test } from "node:test";
+import Database from "better-sqlite3";
+import { shippedTableDdl } from "../test-shipped-sqlite-schema.js";
+import {
+	STRANDED_AFTER_MILLIS,
+	type StrandedSentRepairClient,
+	sweepStrandedSentOutbox,
+} from "./stranded-sent-outbox.js";
+
+const clientOver = (sqlite: Database.Database): StrandedSentRepairClient => ({
+	all: async (sql, params) => sqlite.prepare(sql).all(...params),
+	run: async (sql, params) => sqlite.prepare(sql).run(...params).changes,
+});
+
+interface Row {
+	status: string;
+	last_error: string | null;
+}
+
+describe("outbox rows stranded at sent", () => {
+	let sqlite: Database.Database;
+
+	const insert = (
+		outboxMessageId: string,
+		status: string,
+		sentAt: number,
+	): void => {
+		sqlite
+			.prepare(
+				`INSERT INTO outbox_message (
+					outbox_message_id, account_id, account_config_id, from_address,
+					to_addresses, cc_addresses, bcc_addresses, "references",
+					message_id_value, status, sent_at, created_at, updated_at
+				) VALUES (?, 'acc', 'cfg', 'me@example.com', '["you@example.com"]',
+					'[]', '[]', '[]', 'mid@example.com', ?, ?, ?, ?)`,
+			)
+			.run(outboxMessageId, status, sentAt, sentAt, sentAt);
+	};
+
+	const read = (outboxMessageId: string): Row =>
+		sqlite
+			.prepare(
+				"SELECT status, last_error FROM outbox_message WHERE outbox_message_id = ?",
+			)
+			.get(outboxMessageId) as Row;
+
+	before(() => {
+		sqlite = new Database(":memory:");
+		sqlite.exec(
+			shippedTableDdl("0000_happy_roland_deschain", "outbox_message"),
+		);
+	});
+
+	after(() => {
+		sqlite.close();
+	});
+
+	test("makes a stranded sent message visible again", async () => {
+		const stranded = Date.now() - STRANDED_AFTER_MILLIS - 1000;
+		insert("stranded", "sent", stranded);
+
+		const report = await sweepStrandedSentOutbox(clientOver(sqlite), "repair");
+
+		assert.equal(report.stranded, 1);
+		assert.equal(report.settled, 1);
+		const row = read("stranded");
+		assert.equal(row.status, "unfiled");
+		assert.match(String(row.last_error), /not filed/);
+	});
+
+	test("a second run writes nothing", async () => {
+		const report = await sweepStrandedSentOutbox(clientOver(sqlite), "repair");
+
+		assert.equal(report.stranded, 0);
+		assert.equal(report.settled, 0);
+	});
+
+	test("leaves a filing that is still in flight alone", async () => {
+		insert("in-flight", "sent", Date.now());
+
+		const report = await sweepStrandedSentOutbox(clientOver(sqlite), "repair");
+
+		assert.equal(report.stranded, 0);
+		assert.equal(read("in-flight").status, "sent");
+	});
+
+	test("touches no other status", async () => {
+		const old = Date.now() - STRANDED_AFTER_MILLIS - 1000;
+		insert("a-draft", "draft", old);
+		insert("a-failure", "failed", old);
+
+		await sweepStrandedSentOutbox(clientOver(sqlite), "repair");
+
+		assert.equal(read("a-draft").status, "draft");
+		assert.equal(read("a-failure").status, "failed");
+	});
+
+	test("check mode reports what it would do and writes nothing", async () => {
+		insert("also-stranded", "sent", Date.now() - STRANDED_AFTER_MILLIS - 1000);
+
+		const report = await sweepStrandedSentOutbox(clientOver(sqlite), "check");
+
+		assert.equal(report.stranded, 1);
+		assert.equal(report.settled, 0);
+		assert.equal(read("also-stranded").status, "sent");
+	});
+});

package/src/repair/stranded-sent-outbox.ts

@@ -0,0 +1,109 @@
+/**
+ * The repair for outbox rows stranded at `sent` (issue #824).
+ *
+ * A row holds `sent` only between SMTP accepting the message and the IMAP
+ * APPEND that files a copy in Sent, whose last act is to delete the row. Every
+ * way that APPEND could fail used to end in a silent return, so the row stayed
+ * at `sent` forever — and `sent` is the one non-draft status the Outbox list
+ * hides, on the assumption that the APPEND deletes it. The message was
+ * delivered, exists in no server folder, and appears in no view.
+ *
+ * The handler now settles those failures as `unfiled`. That reaches nothing
+ * already stranded: the events are long gone, and the rows are on instances
+ * that only an image update reaches. So the same settlement is applied here,
+ * once, at boot — the migrate one-shot is the only step every self-host
+ * instance runs before its app containers start (#281).
+ *
+ * The age bound is what separates a stranded row from an ordinary one. A
+ * message sent seconds before a restart has its APPEND event still queued, and
+ * that event settles the row itself once the workers come back; rewriting it
+ * here would take a filing that was about to succeed. An hour is far past any
+ * redrive budget, so a row older than that has no event coming.
+ *
+ * It is a status flip and an error string, on rows whose only other outcome is
+ * to stay invisible. Nothing is deleted and no message content is touched.
+ */
+
+/**
+ * The smallest surface this needs, so the module imports no schema and no
+ * driver and can be driven by the migrator's `better-sqlite3` handle or a test.
+ */
+export interface StrandedSentRepairClient {
+	all(sql: string, params: unknown[]): Promise<unknown[]>;
+	run(sql: string, params: unknown[]): Promise<number>;
+}
+
+export type StrandedSentRepairMode = "check" | "repair";
+
+export type StrandedSentReport = {
+	readonly mode: StrandedSentRepairMode;
+	readonly stranded: number;
+	readonly settled: number;
+};
+
+/**
+ * One hour. A row younger than this may still have its APPEND event in the
+ * queue, and that event settles the row correctly on its own.
+ */
+export const STRANDED_AFTER_MILLIS = 60 * 60 * 1000;
+
+const STRANDED_SENT_REASON =
+	"Sent, but not filed: filing a copy in the Sent folder never completed. The message was delivered.";
+
+const NOW_MILLIS = "CAST(unixepoch('subsec') * 1000 AS INTEGER)";
+
+const AGE = `coalesce(sent_at, updated_at) < ${NOW_MILLIS} - ?`;
+
+const COUNT_SQL = `SELECT count(*) AS row_count
+FROM outbox_message
+WHERE status = 'sent' AND ${AGE}`;
+
+const SETTLE_SQL = `UPDATE outbox_message
+SET status = 'unfiled', last_error = ?
+WHERE status = 'sent' AND ${AGE}`;
+
+const countStranded = async (
+	client: StrandedSentRepairClient,
+): Promise<number> => {
+	const [row] = (await client.all(COUNT_SQL, [STRANDED_AFTER_MILLIS])) as {
+		row_count: number;
+	}[];
+	return row?.row_count ?? 0;
+};
+
+/**
+ * The UPDATE runs only when the count found rows. SQLite takes its exclusive
+ * write lock the moment an UPDATE begins, before it can know the WHERE matches
+ * nothing, and a lock the migrator cannot get inside its `busy_timeout` fails
+ * the migration and holds every gated service down. Zero is the steady state.
+ */
+export const sweepStrandedSentOutbox = async (
+	client: StrandedSentRepairClient,
+	mode: StrandedSentRepairMode,
+): Promise<StrandedSentReport> => {
+	const stranded = await countStranded(client);
+	if (mode === "check" || stranded === 0) {
+		return { mode, stranded, settled: 0 };
+	}
+	const settled = await client.run(SETTLE_SQL, [
+		STRANDED_SENT_REASON,
+		STRANDED_AFTER_MILLIS,
+	]);
+	return { mode, stranded, settled };
+};
+
+export const formatStrandedSentReport = (
+	report: StrandedSentReport,
+): string[] => {
+	if (report.stranded === 0) {
+		return ["No sent message is stranded in the outbox"];
+	}
+	if (report.mode === "check") {
+		return [
+			`${report.stranded} sent message(s) stranded in the outbox, would be marked unfiled`,
+		];
+	}
+	return [
+		`${report.settled} of ${report.stranded} stranded sent message(s) marked unfiled`,
+	];
+};