@remit/mailbox-service 0.0.111 → 0.0.113

package/src/outbox-attachment-content.test.ts

@@ -1,153 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import type { OutboxAttachmentItem } from "@remit/data-ports";
-import { createMockStorageService } from "@remit/storage-service";
-import {
-	loadOutboxAttachmentContents,
-	OutboxAttachmentUnavailableError,
-} from "./outbox-attachment-content.js";
-
-const OWNER = {
-	accountConfigId: "cfg-1",
-	accountId: "acc-1",
-	outboxMessageId: "ob-1",
-};
-const NOW = 1_000;
-
-const row = (
-	outboxAttachmentId: string,
-	overrides: Partial<OutboxAttachmentItem> = {},
-): OutboxAttachmentItem => ({
-	outboxAttachmentId,
-	outboxMessageId: OWNER.outboxMessageId,
-	accountId: OWNER.accountId,
-	accountConfigId: OWNER.accountConfigId,
-	filename: `${outboxAttachmentId}.txt`,
-	contentType: "text/plain",
-	sizeBytes: 5,
-	state: "Stored",
-	storageKey: `key/${outboxAttachmentId}`,
-	reservationExpiresAt: 0,
-	createdAt: 0,
-	updatedAt: 0,
-	...overrides,
-});
-
-const setup = async (rows: OutboxAttachmentItem[], stored: string[]) => {
-	const storage = createMockStorageService();
-	for (const outboxAttachmentId of stored) {
-		await storage.storeOutboxAttachment({
-			...OWNER,
-			outboxAttachmentId,
-			content: Buffer.from(`bytes of ${outboxAttachmentId}`),
-		});
-	}
-	return {
-		attachments: { listByOutboxMessage: async () => rows },
-		storage,
-	};
-};
-
-describe("loadOutboxAttachmentContents", () => {
-	it("returns every stored file with its bytes, in the order it was attached", async () => {
-		const deps = await setup(
-			[row("second", { createdAt: 20 }), row("first", { createdAt: 10 })],
-			["first", "second"],
-		);
-
-		const contents = await loadOutboxAttachmentContents(deps, OWNER, NOW);
-
-		assert.deepEqual(
-			contents.map((item) => [
-				item.filename,
-				item.contentType,
-				item.content.toString(),
-			]),
-			[
-				["first.txt", "text/plain", "bytes of first"],
-				["second.txt", "text/plain", "bytes of second"],
-			],
-		);
-	});
-
-	it("gives each file the content-id its reservation handed out", async () => {
-		const deps = await setup([row("shot")], ["shot"]);
-
-		const [content] = await loadOutboxAttachmentContents(deps, OWNER, NOW);
-
-		assert.equal(content.cid, "shot@remit");
-	});
-
-	it("leaves out a reservation that lapsed without its bytes", async () => {
-		const deps = await setup(
-			[
-				row("kept"),
-				row("lapsed", { state: "Pending", reservationExpiresAt: NOW - 1 }),
-			],
-			["kept"],
-		);
-
-		const contents = await loadOutboxAttachmentContents(deps, OWNER, NOW);
-
-		assert.deepEqual(
-			contents.map((item) => item.filename),
-			["kept.txt"],
-		);
-	});
-
-	it("refuses to build a message while an upload is still open", async () => {
-		const deps = await setup(
-			[row("open", { state: "Pending", reservationExpiresAt: NOW + 60 })],
-			[],
-		);
-
-		await assert.rejects(
-			() => loadOutboxAttachmentContents(deps, OWNER, NOW),
-			(error: unknown) => {
-				assert.ok(error instanceof OutboxAttachmentUnavailableError);
-				assert.equal(error.filename, "open.txt");
-				assert.match(error.message, /never finished uploading/);
-				return true;
-			},
-		);
-	});
-
-	it("refuses to build a message whose stored file has no bytes behind it", async () => {
-		const deps = await setup([row("gone")], []);
-
-		await assert.rejects(
-			() => loadOutboxAttachmentContents(deps, OWNER, NOW),
-			(error: unknown) => {
-				assert.ok(error instanceof OutboxAttachmentUnavailableError);
-				assert.equal(
-					error.message,
-					'"gone.txt" could not be read: nothing is stored at key/gone',
-				);
-				return true;
-			},
-		);
-	});
-
-	it("names the file when storage itself fails", async () => {
-		const deps = {
-			attachments: { listByOutboxMessage: async () => [row("payroll")] },
-			storage: {
-				retrieveOutboxAttachment: async (): Promise<Buffer | null> => {
-					throw new Error("S3 is down");
-				},
-			},
-		};
-
-		await assert.rejects(
-			() => loadOutboxAttachmentContents(deps, OWNER, NOW),
-			(error: unknown) => {
-				assert.ok(error instanceof OutboxAttachmentUnavailableError);
-				assert.equal(
-					error.message,
-					'"payroll.txt" could not be read: storage failed (S3 is down)',
-				);
-				return true;
-			},
-		);
-	});
-});

package/src/outbox-attachment-content.ts

@@ -1,104 +0,0 @@
-import type { IOutboxAttachmentRepository } from "@remit/data-ports";
-import { holdsRoom } from "@remit/data-ports";
-import type { StorageService } from "@remit/storage-service";
-
-export interface OutboxAttachmentContent {
-	filename: string;
-	contentType: string;
-	content: Buffer;
-	cid: string;
-}
-
-export const outboxAttachmentContentId = (outboxAttachmentId: string): string =>
-	`${outboxAttachmentId}@remit`;
-
-/**
- * A file on a message that cannot be put into it. Carries the file's name so
- * whoever settles the message can tell the sender which file to fix.
- */
-export class OutboxAttachmentUnavailableError extends Error {
-	constructor(
-		readonly filename: string,
-		readonly detail: string,
-		options?: { cause: unknown },
-	) {
-		super(`"${filename}" could not be read: ${detail}`, options);
-		this.name = "OutboxAttachmentUnavailableError";
-	}
-}
-
-const describeCause = (error: unknown): string =>
-	error instanceof Error ? error.message : String(error);
-
-export interface OutboxAttachmentContentDeps {
-	attachments: Pick<IOutboxAttachmentRepository, "listByOutboxMessage">;
-	storage: Pick<StorageService, "retrieveOutboxAttachment">;
-}
-
-export interface OutboxAttachmentOwner {
-	accountConfigId: string;
-	accountId: string;
-	outboxMessageId: string;
-}
-
-/**
- * Every file a message goes out with, bytes included, in the order they were
- * attached. The send op refuses a draft with an upload still open, so a live
- * `Pending` row here, or a `Stored` row with nothing behind it, is a message
- * that cannot be built as the sender saw it — and sending it without the file
- * would be worse than not sending it.
- */
-export const loadOutboxAttachmentContents = async (
-	deps: OutboxAttachmentContentDeps,
-	owner: OutboxAttachmentOwner,
-	nowSeconds: number,
-): Promise<OutboxAttachmentContent[]> => {
-	const held = await deps.attachments.listByOutboxMessage(
-		owner.accountConfigId,
-		owner.outboxMessageId,
-	);
-	const live = held
-		.filter((item) => holdsRoom(item, nowSeconds))
-		.sort((a, b) => a.createdAt - b.createdAt);
-
-	const unfinished = live.find((item) => item.state !== "Stored");
-	if (unfinished) {
-		throw new OutboxAttachmentUnavailableError(
-			unfinished.filename,
-			`attachment ${unfinished.outboxAttachmentId} never finished uploading`,
-		);
-	}
-
-	return Promise.all(
-		live.map(async (item) => {
-			const content = await Promise.resolve()
-				.then(() =>
-					deps.storage.retrieveOutboxAttachment(
-						owner.accountConfigId,
-						owner.accountId,
-						owner.outboxMessageId,
-						item.outboxAttachmentId,
-					),
-				)
-				.catch((error: unknown) => {
-					throw new OutboxAttachmentUnavailableError(
-						item.filename,
-						`storage failed (${describeCause(error)})`,
-						{ cause: error },
-					);
-				});
-			if (content === null) {
-				throw new OutboxAttachmentUnavailableError(
-					item.filename,
-					`nothing is stored at ${item.storageKey}`,
-				);
-			}
-			return {
-				filename: item.filename,
-				contentType: item.contentType,
-				content,
-				cid: outboxAttachmentContentId(item.outboxAttachmentId),
-			};
-		}),
-	);
-};

package/src/outbox-attachment-filename.test.ts

@@ -1,132 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import {
-	FALLBACK_CONTENT_TYPE,
-	normalizeAttachmentContentType,
-	sanitizeAttachmentFilename,
-} from "./outbox-attachment-filename.js";
-
-describe("sanitizeAttachmentFilename", () => {
-	it("keeps an ordinary name, accents and spaces included", () => {
-		assert.equal(
-			sanitizeAttachmentFilename("Facture décembre 2026.pdf"),
-			"Facture décembre 2026.pdf",
-		);
-	});
-
-	it("keeps only the basename of a traversal attempt", () => {
-		assert.equal(sanitizeAttachmentFilename("../../../etc/passwd"), "passwd");
-	});
-
-	it("keeps only the basename of a windows path", () => {
-		assert.equal(
-			sanitizeAttachmentFilename("C:\\Users\\me\\Desktop\\report.xlsx"),
-			"report.xlsx",
-		);
-	});
-
-	it("strips the bidi override that disguises an extension", () => {
-		assert.equal(
-			sanitizeAttachmentFilename("invoice\u202Egnp.exe"),
-			"invoicegnp.exe",
-		);
-	});
-
-	it("strips control characters that would break a header", () => {
-		assert.equal(
-			sanitizeAttachmentFilename("report\r\nBcc: someone@example.com.pdf"),
-			"reportBcc: someone@example.com.pdf",
-		);
-	});
-
-	it("refuses a name that is nothing but separators and dots", () => {
-		assert.equal(sanitizeAttachmentFilename("../.."), null);
-		assert.equal(sanitizeAttachmentFilename("."), null);
-		assert.equal(sanitizeAttachmentFilename("   "), null);
-		assert.equal(sanitizeAttachmentFilename("\u202A\u202B"), null);
-	});
-
-	it("truncates an overlong name but keeps its extension", () => {
-		const sanitized = sanitizeAttachmentFilename(`${"a".repeat(500)}.pdf`);
-		assert.ok(sanitized !== null);
-		assert.ok(sanitized.length <= 200);
-		assert.ok(sanitized.endsWith(".pdf"));
-	});
-
-	it("never cuts an emoji in half when it truncates", () => {
-		const sanitized = sanitizeAttachmentFilename(
-			`${"a".repeat(195)}\u{1F600}x.pdf`,
-		);
-		assert.ok(sanitized !== null);
-		assert.equal(
-			[...sanitized].some((character) => {
-				const code = character.charCodeAt(0);
-				return code >= 0xd800 && code <= 0xdfff && character.length === 1;
-			}),
-			false,
-		);
-		assert.equal(Buffer.from(sanitized, "utf8").includes("\uFFFD"), false);
-		assert.ok(sanitized.endsWith(".pdf"));
-	});
-
-	it("truncates a name whose trailing dot-segment is not a plausible extension", () => {
-		const sanitized = sanitizeAttachmentFilename(
-			`${"a".repeat(300)}.${"b".repeat(300)}`,
-		);
-		assert.ok(sanitized !== null);
-		assert.equal(sanitized.length, 200);
-	});
-});
-
-describe("normalizeAttachmentContentType", () => {
-	it("lowercases a media type and drops its parameters", () => {
-		assert.equal(
-			normalizeAttachmentContentType("TEXT/Plain; charset=utf-8"),
-			"text/plain",
-		);
-	});
-
-	it("passes an archive through — the receiving server decides what it takes", () => {
-		assert.equal(
-			normalizeAttachmentContentType("application/zip"),
-			"application/zip",
-		);
-	});
-
-	it("falls back when the browser sent nothing", () => {
-		assert.equal(normalizeAttachmentContentType(""), FALLBACK_CONTENT_TYPE);
-	});
-
-	it("falls back on a token long enough to overflow the field it lands in", () => {
-		assert.equal(
-			normalizeAttachmentContentType(`application/${"x".repeat(300)}`),
-			FALLBACK_CONTENT_TYPE,
-		);
-	});
-
-	it("falls back on a value that is not a media type", () => {
-		assert.equal(
-			normalizeAttachmentContentType("text/html<script>"),
-			FALLBACK_CONTENT_TYPE,
-		);
-		assert.equal(
-			normalizeAttachmentContentType("not-a-media-type"),
-			FALLBACK_CONTENT_TYPE,
-		);
-	});
-});
-
-describe("a filename that hides its separators behind control characters", () => {
-	it("takes the basename after the newline, not before it", () => {
-		// `.` does not match a newline, so a basename strip that runs first stops
-		// at it and leaves every separator that follows.
-		assert.equal(
-			sanitizeAttachmentFilename("report\r\n/../../.bashrc"),
-			"bashrc",
-		);
-	});
-
-	it("leaves nothing usable when the whole name is separators and a newline", () => {
-		assert.equal(sanitizeAttachmentFilename("..\n/../x.png"), "x.png");
-	});
-});

package/src/outbox-attachment-filename.ts

@@ -1,76 +0,0 @@
-/**
- * A filename arrives from a browser's `File.name` and reaches a
- * `Content-Disposition` header on a message a stranger opens. Nothing in the
- * middle re-derives it, and the storage key never contains it — the key is a
- * generated id — so this is the one place the value is made safe.
- */
-
-const PATH_SEPARATORS = /^.*[\\/]/;
-
-// C0/C1 controls and DEL, then the bidi and directional-isolate formatting
-// characters that let a name ending in "exe" render as if it ended in "png".
-const UNSAFE_CHARACTERS =
-	// biome-ignore lint/suspicious/noControlCharactersInRegex: stripping control characters is the point
-	/[\u0000-\u001F\u007F-\u009F\u200E\u200F\u202A-\u202E\u2066-\u2069]/g;
-
-const MAX_FILENAME_LENGTH = 200;
-
-// By code point, never by UTF-16 unit: cutting mid-surrogate leaves a lone half
-// that a Content-Disposition encoder can only render as U+FFFD.
-const truncateCodePoints = (value: string, limit: number): string =>
-	Array.from(value).slice(0, limit).join("");
-
-const truncateKeepingExtension = (filename: string): string => {
-	const codePoints = Array.from(filename);
-	if (codePoints.length <= MAX_FILENAME_LENGTH) return filename;
-
-	const dot = filename.lastIndexOf(".");
-	const extension = dot > 0 ? Array.from(filename.slice(dot)) : [];
-	if (extension.length === 0 || extension.length > 16) {
-		return truncateCodePoints(filename, MAX_FILENAME_LENGTH);
-	}
-	return (
-		truncateCodePoints(filename, MAX_FILENAME_LENGTH - extension.length) +
-		extension.join("")
-	);
-};
-
-/**
- * The filename to record, or null when nothing usable survives — a name made
- * only of separators, dots or control characters is refused rather than
- * replaced with something invented.
- */
-export const sanitizeAttachmentFilename = (raw: string): string | null => {
-	// Strip first, then take the basename. The other order is bypassable: `.`
-	// does not match a newline, so `PATH_SEPARATORS` stops at one and leaves
-	// every separator after it — "report\r\n/../../.bashrc" survives with its
-	// slashes intact.
-	const stripped = raw.replace(UNSAFE_CHARACTERS, "");
-	const basename = stripped.replace(PATH_SEPARATORS, "").trim();
-	const trimmed = basename.replace(/^\.+/, "").trim();
-
-	if (trimmed.length === 0) return null;
-
-	return truncateKeepingExtension(trimmed);
-};
-
-// RFC 9110 token characters, on both sides of the one slash.
-const MEDIA_TYPE = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+\/[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
-
-export const FALLBACK_CONTENT_TYPE = "application/octet-stream";
-
-// The longest registered media type is well under this. A token run past it is
-// a client inventing one, and it would overflow the response field it lands in.
-const MAX_CONTENT_TYPE_LENGTH = 127;
-
-/**
- * The media type to record. Parameters (`; charset=…`) are dropped and anything
- * that is not a bare type/subtype becomes the fallback: the value is recorded
- * for the outgoing MIME part, never trusted for rendering.
- */
-export const normalizeAttachmentContentType = (raw: string): string => {
-	const bare = raw.split(";")[0].trim().toLowerCase();
-	if (bare.length > MAX_CONTENT_TYPE_LENGTH) return FALLBACK_CONTENT_TYPE;
-	if (!MEDIA_TYPE.test(bare)) return FALLBACK_CONTENT_TYPE;
-	return bare;
-};