@remit/imap-worker 0.0.90 → 0.0.92

package/src/with-oauth-lifecycle-deps.sqlite.test.ts

@@ -1,269 +0,0 @@
-/**
- * What the account row holds after the lifecycle has written to it.
- *
- * The deps builder is the half that talks to the store, so it is tested against
- * the real repository over the shipped SQLite schema rather than a stand-in
- * that would only agree with itself: whether a stored reason survives, and
- * whether one that no longer applies is gone, is decided by the repository's
- * update semantics, where an absent field means "leave it alone".
- */
-
-import assert from "node:assert/strict";
-import { after, before, describe, it } from "node:test";
-import type { AccountItem } from "@remit/data-ports";
-import { AccountAuthType, ConnectionState } from "@remit/domain-enums";
-import {
-	type AccountRepo,
-	createSqliteRepositories,
-} from "@remit/drizzle-service";
-import { createShippedSqliteDb } from "@remit/drizzle-service/test-sqlite";
-import { noopLogger } from "@remit/logger";
-import { RefreshTokenError } from "@remit/mail-oauth-service";
-import { MailConnectionError } from "@remit/mailbox-service/types";
-import type { SecretsService } from "@remit/secrets-service";
-import {
-	type OAuthLifecycleDeps,
-	withOAuthLifecycle,
-} from "./with-oauth-lifecycle.js";
-import { buildLifecycleDeps } from "./with-oauth-lifecycle-deps.js";
-
-const secrets = {
-	decrypt: async () => "decrypted",
-	encrypt: async () => ({}) as never,
-} as unknown as SecretsService;
-
-/**
- * The real deps, with only credential resolution stubbed — minting a token is
- * a call to Microsoft and not what these tests are about. `updateConnectionState`
- * is the one under test and stays exactly as the handlers build it.
- */
-const deps = (): OAuthLifecycleDeps => ({
-	...buildLifecycleDeps(secrets, repo),
-	resolveCredentials: async () => ({
-		status: "resolved",
-		credentials: { kind: "accessToken", accessToken: "access-token" },
-	}),
-});
-
-const STALE_SYNC_ERROR = "Mailbox does not exist: [NONEXISTENT]";
-const REFUSAL =
-	"IMAP authentication failed: LOGIN failed. User is authenticated but not connected.";
-
-let repo: AccountRepo;
-let close: () => void;
-
-const account = async (): Promise<AccountItem> =>
-	repo.create({
-		accountConfigId: "cfg-1",
-		username: "matthijs@example.com",
-		email: "matthijs@example.com",
-		authType: AccountAuthType.OauthMicrosoft,
-		oauthRefreshTokenHash: "encrypted-refresh-token",
-		imapHost: "outlook.office365.com",
-		imapPort: 993,
-		imapTls: true,
-		imapStartTls: false,
-		isActive: true,
-		connectionState: ConnectionState.Authenticated,
-	});
-
-before(() => {
-	const db = createShippedSqliteDb();
-	close = db.close;
-	repo = createSqliteRepositories({
-		app: db.db,
-		mail: db.db,
-		search: db.db,
-	}).account;
-});
-
-after(() => {
-	close();
-});
-
-describe("the reason an account card reads back", () => {
-	it("keeps the refusal the mail server gave", async () => {
-		const created = await account();
-
-		await withOAuthLifecycle(deps(), created, noopLogger, async () => {
-			throw new MailConnectionError("auth", REFUSAL);
-		});
-
-		const stored = await repo.get(created.accountId);
-		assert.equal(stored.connectionState, ConnectionState.ReauthRequired);
-		assert.equal(stored.lastError, REFUSAL);
-	});
-
-	it("drops a reason the account has moved on from", async () => {
-		const created = await account();
-		// What a failed sync leaves behind (sync-mailboxes.ts): a folder that went
-		// away, nothing to do with signing in.
-		await repo.update(created.accountId, { lastError: STALE_SYNC_ERROR });
-
-		// Hours later the refresh token is revoked. Re-authenticating is now the
-		// whole story, and the mailbox that went missing is not it.
-		await withOAuthLifecycle(
-			deps(),
-			await repo.get(created.accountId),
-			noopLogger,
-			async () => {
-				throw new RefreshTokenError({
-					kind: "reauth-required",
-					code: "invalid_grant",
-				});
-			},
-		);
-
-		const stored = await repo.get(created.accountId);
-		assert.equal(stored.connectionState, ConnectionState.ReauthRequired);
-		assert.equal(
-			stored.lastError,
-			undefined,
-			"a stale sync error beside a Reconnect button reads as the reason for it",
-		);
-	});
-
-	it("stores a chatty refusal at a length a card can hold", async () => {
-		const created = await account();
-
-		await withOAuthLifecycle(deps(), created, noopLogger, async () => {
-			throw new MailConnectionError("auth", "x".repeat(4000));
-		});
-
-		const stored = await repo.get(created.accountId);
-		assert.equal(stored.lastError?.length, 500);
-	});
-});
-
-describe("which failures stop the work, and what the account row says after", () => {
-	const passwordAccount = (passwordHash?: string): Promise<AccountItem> =>
-		repo.create({
-			accountConfigId: "cfg-1",
-			username: "person@example.com",
-			email: "person@example.com",
-			authType: AccountAuthType.Password,
-			passwordHash,
-			imapHost: "imap.example.com",
-			imapPort: 993,
-			imapTls: true,
-			imapStartTls: false,
-			isActive: true,
-			connectionState: ConnectionState.Authenticated,
-		});
-
-	it("runs nothing for an account that has to sign in again", async () => {
-		const created = await account();
-		await repo.update(created.accountId, {
-			connectionState: ConnectionState.ReauthRequired,
-		});
-		let worked = false;
-
-		await withOAuthLifecycle(
-			deps(),
-			await repo.get(created.accountId),
-			noopLogger,
-			async () => {
-				worked = true;
-			},
-		);
-
-		assert.equal(worked, false);
-	});
-
-	// Issue #1120: a password account with nothing stored can only fail, and a
-	// failing batch item fences the account's FIFO group.
-	it("acks a password account that stores no password and says the credential is missing", async () => {
-		const created = await passwordAccount();
-		let worked = false;
-
-		await withOAuthLifecycle(
-			buildLifecycleDeps(secrets, repo),
-			created,
-			noopLogger,
-			async () => {
-				worked = true;
-			},
-		);
-
-		assert.equal(worked, false);
-		assert.equal(
-			(await repo.get(created.accountId)).connectionState,
-			ConnectionState.CredentialsMissing,
-		);
-	});
-
-	it("acks an OAuth account that holds no refresh token and asks for a sign-in", async () => {
-		const created = await repo.create({
-			accountConfigId: "cfg-1",
-			username: "matthijs@example.com",
-			email: "matthijs@example.com",
-			authType: AccountAuthType.OauthMicrosoft,
-			imapHost: "outlook.office365.com",
-			imapPort: 993,
-			imapTls: true,
-			imapStartTls: false,
-			isActive: true,
-			connectionState: ConnectionState.Authenticated,
-		});
-
-		await withOAuthLifecycle(
-			buildLifecycleDeps(secrets, repo),
-			created,
-			noopLogger,
-			async () => {},
-		);
-
-		assert.equal(
-			(await repo.get(created.accountId)).connectionState,
-			ConnectionState.ReauthRequired,
-		);
-	});
-
-	// A password that stopped working is the user's to fix in settings; the
-	// state flip is reserved for OAuth, where a sign-in is the fix.
-	for (const [name, error] of [
-		["a refused password", new MailConnectionError("auth", "auth failed")],
-		["a network failure", new MailConnectionError("network", "timeout")],
-		["any other error", new Error("boom")],
-	] as const) {
-		it(`redelivers ${name} on a password account and leaves its state alone`, async () => {
-			const created = await passwordAccount('{"ciphertext":"x"}');
-
-			await assert.rejects(
-				withOAuthLifecycle(deps(), created, noopLogger, async () => {
-					throw error;
-				}),
-				error,
-			);
-
-			assert.equal(
-				(await repo.get(created.accountId)).connectionState,
-				ConnectionState.Authenticated,
-			);
-		});
-	}
-
-	it("redelivers a transient token failure and leaves the state alone", async () => {
-		const created = await account();
-
-		await assert.rejects(
-			withOAuthLifecycle(
-				{
-					...deps(),
-					resolveCredentials: async () => {
-						throw new RefreshTokenError({ kind: "transient", code: "503" });
-					},
-				},
-				created,
-				noopLogger,
-				async () => {},
-			),
-			/transient/,
-		);
-
-		assert.equal(
-			(await repo.get(created.accountId)).connectionState,
-			ConnectionState.Authenticated,
-		);
-	});
-});

package/src/with-oauth-lifecycle-deps.ts

@@ -1,71 +0,0 @@
-/**
- * with-oauth-lifecycle-deps.ts
- *
- * Shared construction of the deps passed to withOAuthLifecycle by every IMAP
- * handler. Centralizes the lazy OAuth token service, secrets, refresh-token
- * rotation persistence, and the connectionState writer so handlers don't each
- * re-declare the same boilerplate.
- */
-
-import type { IAccountRepository } from "@remit/data-ports";
-import {
-	createMailOAuthService,
-	microsoftProviderConfig,
-} from "@remit/mail-oauth-service";
-import type { SecretsService } from "@remit/secrets-service";
-import type {
-	ConnectionStateValue,
-	OAuthLifecycleDeps,
-} from "./with-oauth-lifecycle.js";
-
-// Lazy OAuth service: created on first OAuth account.
-// Uses MSOAUTH_* env vars which are only present in deployed Lambdas.
-let _tokenService: ReturnType<typeof createMailOAuthService> | undefined;
-const getTokenService = (): ReturnType<typeof createMailOAuthService> => {
-	if (!_tokenService) {
-		_tokenService = createMailOAuthService(
-			microsoftProviderConfig({
-				clientId: process.env.MSOAUTH_CLIENT_ID ?? "",
-				clientSecret: process.env.MSOAUTH_CLIENT_SECRET ?? "",
-				overrides: process.env.MSOAUTH_TOKEN_ENDPOINT
-					? { tokenEndpoint: process.env.MSOAUTH_TOKEN_ENDPOINT }
-					: undefined,
-			}),
-		);
-	}
-	return _tokenService;
-};
-
-/**
- * Build the OAuthLifecycleDeps for a handler. `secrets` and `accountService`
- * are the long-lived singletons already constructed at module scope in each
- * handler.
- */
-export const buildLifecycleDeps = (
-	secrets: SecretsService,
-	accountService: IAccountRepository,
-): OAuthLifecycleDeps => ({
-	secrets,
-	tokenService: getTokenService(),
-	persistRotatedToken: async (accountId, encryptedHash, updatedAt) => {
-		await accountService.update(accountId, {
-			oauthRefreshTokenHash: encryptedHash,
-			oauthTokenUpdatedAt: updatedAt,
-		});
-	},
-	// A state flip with no reason of its own removes the stored one. Left in
-	// place it would describe a failure the account has moved on from — the
-	// mailbox a sync could not find, still on the card beside a Reconnect
-	// button, after the token was revoked hours later.
-	updateConnectionState: async (
-		accountId: string,
-		state: ConnectionStateValue,
-		lastError?: string,
-	) => {
-		await accountService.update(
-			accountId,
-			{ connectionState: state, lastError },
-			lastError === undefined ? ["lastError"] : undefined,
-		);
-	},
-});

package/src/with-oauth-lifecycle.ts

@@ -1,158 +0,0 @@
-/**
- * with-oauth-lifecycle.ts
- *
- * Centralizes the OAuth reauth/ACK contract shared by every IMAP handler.
- *
- * The contract (see issue #472):
- *  - If the account already requires reauth, skip all IMAP traffic entirely.
- *  - Credential resolution AND the per-handler work both run inside one
- *    try/catch so that a revoked OAuth token is caught regardless of where it
- *    surfaces (token mint vs. first IMAP command).
- *  - An account storing no credential at all is terminal, not transient: the
- *    account is flipped to the state that describes it and the event is ACKed.
- *    Retrying instead fenced the account's FIFO group for the message's whole
- *    visibility timeout, blocking the sync that follows the credential the
- *    user was still typing (issue #1120).
- *  - On a terminal auth failure (RefreshTokenError reauth-required, or
- *    MailConnectionError auth), flip the account to reauth_required and return
- *    WITHOUT rethrowing — this ACKs the SQS message so it is not retried.
- *    An IMAP refusal is stored with it, because not every refusal a mail server
- *    hands back is one re-authenticating clears: "SmtpClientAuthentication is
- *    disabled" needs a tenant setting changed, and an account card that only
- *    ever says "Re-authentication required" sends the user around a loop.
- *  - On transient / config / network errors, rethrow so SQS retries with
- *    backoff (let-it-crash).
- *
- * Tokens must NEVER appear in logs — only accountId / errorKind / errorCode.
- */
-
-import type { AccountItem } from "@remit/data-ports";
-import { AccountAuthType, ConnectionState } from "@remit/domain-enums";
-import type { Logger } from "@remit/logger";
-import { RefreshTokenError } from "@remit/mail-oauth-service";
-import {
-	type AccountCredentialsDeps,
-	type ConnectionStateValue,
-	type CredentialResolution,
-	resolveConnectionCredentials,
-} from "@remit/mailbox-service/account-credentials";
-import {
-	MailConnectionError,
-	type MailCredentials,
-} from "@remit/mailbox-service/types";
-import { isAccountReauthRequired } from "./account-check.js";
-
-export type { ConnectionStateValue };
-
-export interface OAuthLifecycleDeps extends AccountCredentialsDeps {
-	/**
-	 * Persist the account's connectionState, and with it the sentence the
-	 * account card shows for the failure. `lastError` carries the server's own
-	 * words when the failure came with any; it is absent when nothing was said,
-	 * as for a credential that was never stored or a token simply revoked, and
-	 * the stored reason is then cleared rather than left to describe an older
-	 * failure the account has moved on from.
-	 */
-	updateConnectionState: (
-		accountId: string,
-		state: ConnectionStateValue,
-		lastError?: string,
-	) => Promise<void>;
-	/**
-	 * Resolve credentials for the account. Defaults to
-	 * resolveConnectionCredentials; overridable for testing. Kept as the ONLY
-	 * authType branch in the codebase (see account-credentials.ts).
-	 */
-	resolveCredentials?: (
-		account: AccountItem,
-		deps: AccountCredentialsDeps,
-	) => Promise<CredentialResolution>;
-}
-
-/**
- * Run `work` for an account under the shared OAuth reauth/ACK contract.
- *
- * `work` receives the resolved MailCredentials. Both credential resolution and
- * `work` run inside the same try/catch.
- */
-export const withOAuthLifecycle = async (
-	deps: OAuthLifecycleDeps,
-	account: AccountItem,
-	log: Logger,
-	work: (credentials: MailCredentials) => Promise<void>,
-): Promise<void> => {
-	// Skip all IMAP traffic for accounts that already require reauth.
-	if (isAccountReauthRequired(account, log)) {
-		return;
-	}
-
-	const resolve = deps.resolveCredentials ?? resolveConnectionCredentials;
-
-	try {
-		const resolution = await resolve(account, deps);
-		if (resolution.status === "missing") {
-			log.warn(
-				{
-					accountId: account.accountId,
-					reason: resolution.reason,
-					connectionState: resolution.terminalState,
-				},
-				"Account stores no credential; acking the event without IMAP traffic",
-			);
-			await deps.updateConnectionState(
-				account.accountId,
-				resolution.terminalState,
-			);
-			return; // ACK — no retry can produce a credential
-		}
-		await work(resolution.credentials);
-	} catch (err) {
-		// Terminal OAuth failure: token revoked / consent withdrawn.
-		if (err instanceof RefreshTokenError) {
-			if (err.error.kind === "reauth-required") {
-				log.warn(
-					{
-						accountId: account.accountId,
-						errorKind: err.error.kind,
-						errorCode: err.error.code,
-					},
-					"OAuth token revoked; marking account reauth_required",
-				);
-				await deps.updateConnectionState(
-					account.accountId,
-					ConnectionState.ReauthRequired,
-				);
-				return; // ACK — do not retry
-			}
-			// transient or config: let-it-crash (SQS retry / DLQ)
-			throw err;
-		}
-
-		// Terminal auth failure at the IMAP layer (bad credentials / expired token).
-		// Only OAuth accounts can recover via the re-auth flow; password accounts
-		// have no such path so we rethrow to preserve pre-PR batch-item-failure
-		// behaviour instead of permanently fencing the account.
-		if (err instanceof MailConnectionError && err.kind === "auth") {
-			if (account.authType !== AccountAuthType.OauthMicrosoft) {
-				throw err;
-			}
-			log.warn(
-				{
-					accountId: account.accountId,
-					errorKind: err.kind,
-					error: err.message,
-				},
-				"IMAP auth rejected; marking account reauth_required",
-			);
-			await deps.updateConnectionState(
-				account.accountId,
-				ConnectionState.ReauthRequired,
-				err.message,
-			);
-			return; // ACK — do not retry
-		}
-
-		// Transient / network / unexpected: rethrow so SQS retries with backoff.
-		throw err;
-	}
-};

package/tsconfig.json

@@ -1,8 +0,0 @@
-{
-	"extends": "../../tsconfig.json",
-	"compilerOptions": {
-		"outDir": "dist",
-		"rootDir": "src"
-	},
-	"include": ["src/**/*.ts"]
-}