@remit/smtp-worker 0.0.23 → 0.0.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/smtp-worker",
-  "version": "0.0.23",
+  "version": "0.0.25",
   "type": "module",
   "main": "dist/index.js",
   "exports": {

package/src/handlers/send-message-core.ts

@@ -15,6 +15,7 @@ import {
 	SmtpConnectionError,
 	type sendMail,
 } from "@remit/smtp-service";
+import { attemptBudget } from "@remit/sqs-client/attempt-budget";
 import type { SendMessageEvent } from "../events.js";
 import { writeEngagementCounters } from "./engagement-counters.js";
 import {
@@ -63,6 +64,13 @@ export interface SendMessageDeps {
 		id: string,
 		status: OutboxMessageItem["status"],
 	) => Promise<unknown>;
+	/** Write the patch only while the row still holds `expected` (compare-and-set). */
+	updateOutboxIfStatus: (
+		accountConfigId: string,
+		id: string,
+		expected: OutboxMessageItem["status"],
+		patch: UpdateOutboxMessageInput,
+	) => Promise<unknown>;
 	markOutboxSent: (
 		accountConfigId: string,
 		id: string,
@@ -95,6 +103,14 @@ export interface SendMessageDeps {
 const UNFILED_NOT_QUEUED =
 	"Sent, but not filed: the copy for the Sent folder could not be queued.";
 
+/**
+ * Every re-auth branch settles the row with this, because the row is the only
+ * place the user learns the send stopped: `blocked` shows its reason and offers
+ * no Retry, and a retry cannot succeed until the account is reconnected.
+ */
+const REAUTH_REQUIRED =
+	"This account needs to be reconnected before it can send. Open Settings → Accounts and choose Reconnect, then send this message again.";
+
 const UNFILED_CONNECTION_LOST =
 	"The connection to the outgoing server dropped during the send, so this message may already have been delivered. Check with the recipient before sending it again.";
 
@@ -133,24 +149,9 @@ const SENDABLE_STATUSES: ReadonlySet<OutboxMessageItem["status"]> = new Set([
 	OutboxMessageStatus.sending,
 ]);
 
-/**
- * Fallback when `SEND_MESSAGE_MAX_ATTEMPTS` is unset (local dev, unit tests).
- * Matches `remit-smtp`'s `maxReceiveCount` (`deploy/vps/queues.json`), same
- * pattern as `MESSAGE_MOVE_MAX_ATTEMPTS` / `FLAG_PUSH_MAX_ATTEMPTS` in
- * imap-worker.
- */
-const DEFAULT_SEND_MESSAGE_MAX_ATTEMPTS = 3;
-
 export const getSendMessageMaxAttempts = (
 	processEnv: NodeJS.ProcessEnv = process.env,
-): number => {
-	const raw = processEnv.SEND_MESSAGE_MAX_ATTEMPTS;
-	if (!raw) return DEFAULT_SEND_MESSAGE_MAX_ATTEMPTS;
-	const parsed = Number.parseInt(raw, 10);
-	return Number.isFinite(parsed) && parsed > 0
-		? parsed
-		: DEFAULT_SEND_MESSAGE_MAX_ATTEMPTS;
-};
+): number => attemptBudget("SEND_MESSAGE_MAX_ATTEMPTS", 3, processEnv);
 
 export const SEND_MESSAGE_MAX_ATTEMPTS = getSendMessageMaxAttempts();
 
@@ -183,6 +184,26 @@ export const sendMessage = async (
 		return;
 	}
 
+	// `send` queues a row before it emits, so an event that finds one at `draft`
+	// found a row the user pulled back into the composer after the emit. That is
+	// not a stalled send and it keeps its own state. Every other settle is
+	// conditional on the status the send was decided against, so a row that has
+	// moved on since is not overwritten either.
+	const settleBlockedOnReauth = async (
+		expected: OutboxMessageItem["status"] = outbox.status,
+	): Promise<void> => {
+		if (expected === OutboxMessageStatus.draft) return;
+		await deps.updateOutboxIfStatus(
+			accountConfigId,
+			outboxMessageId,
+			expected,
+			{
+				status: OutboxMessageStatus.blocked,
+				lastError: REAUTH_REQUIRED,
+			},
+		);
+	};
+
 	// Tombstone fence: drop events for deleted accounts (#228)
 	if (account.deletedAt) {
 		log.info(
@@ -195,9 +216,10 @@ export const sendMessage = async (
 	// Reauth fence: skip accounts that need re-authentication. No SMTP traffic
 	// until the user re-auths (mirrors the IMAP reauth/ACK contract, #472).
 	if (account.connectionState === "reauth_required") {
+		await settleBlockedOnReauth();
 		log.info(
 			{ accountId, connectionState: account.connectionState },
-			"Account requires reauth, dropping send event",
+			"Account requires reauth, blocking the message",
 		);
 		return;
 	}
@@ -233,6 +255,7 @@ export const sendMessage = async (
 					"OAuth token revoked; marking account reauth_required",
 				);
 				await deps.updateConnectionState(accountId, "reauth_required");
+				await settleBlockedOnReauth();
 				return; // ACK — do not retry
 			}
 			// transient or config: let-it-crash (SQS retry / DLQ)
@@ -249,6 +272,7 @@ export const sendMessage = async (
 				"SMTP auth rejected; marking account reauth_required",
 			);
 			await deps.updateConnectionState(accountId, "reauth_required");
+			await settleBlockedOnReauth();
 			return; // ACK — do not retry
 		}
 		throw err;
@@ -291,6 +315,7 @@ export const sendMessage = async (
 				"SMTP auth rejected during send; marking account reauth_required",
 			);
 			await deps.updateConnectionState(accountId, "reauth_required");
+			await settleBlockedOnReauth(OutboxMessageStatus.sending);
 			return; // ACK — do not retry
 		}
 		// A password account's auth failure and every network failure retry on

package/src/handlers/send-message.test.ts

@@ -85,6 +85,13 @@ interface Recorded {
 	sendCalls: number;
 	resolveCalls: number;
 	connectionStateUpdates: Array<{ accountId: string; state: string }>;
+	conditionalUpdates: Array<{
+		id: string;
+		expected: OutboxMessageItem["status"];
+		patch: UpdateOutboxMessageInput;
+	}>;
+	/** Ordered names of the writes the handler made, across every recorder. */
+	writeOrder: string[];
 	outboundIncrements: Array<{ addressId: string; now: number }>;
 	replyIncrements: Array<{ addressId: string; now: number }>;
 }
@@ -107,11 +114,14 @@ const buildDeps = (
 		sendCalls: 0,
 		resolveCalls: 0,
 		connectionStateUpdates: [],
+		conditionalUpdates: [],
+		writeOrder: [],
 		outboundIncrements: [],
 		replyIncrements: [],
 	};
 	const outbox = options.outbox ?? buildOutbox();
 	const account = options.account ?? buildAccount();
+	let currentStatus: OutboxMessageItem["status"] = outbox.status;
 	const deps: SendMessageDeps = {
 		getOutbox: async (accountConfigId, id) => {
 			assert.equal(accountConfigId, account.accountConfigId);
@@ -124,12 +134,26 @@ const buildDeps = (
 		},
 		updateOutbox: async (accountConfigId, id, patch) => {
 			assert.equal(accountConfigId, account.accountConfigId);
+			if (patch.status) currentStatus = patch.status;
+			recorded.writeOrder.push("outbox");
 			recorded.updates.push({ id, patch });
 		},
 		updateOutboxStatus: async (accountConfigId, id, status) => {
 			assert.equal(accountConfigId, account.accountConfigId);
+			currentStatus = status;
 			recorded.statuses.push({ id, status });
 		},
+		// Compare-and-set, as the port implements it: the write lands only while
+		// the row still holds `expected`, and answers null when it does not.
+		updateOutboxIfStatus: async (accountConfigId, id, expected, patch) => {
+			assert.equal(accountConfigId, account.accountConfigId);
+			recorded.conditionalUpdates.push({ id, expected, patch });
+			if (expected !== currentStatus) return null;
+			if (patch.status) currentStatus = patch.status;
+			recorded.writeOrder.push("outbox");
+			recorded.updates.push({ id, patch });
+			return {};
+		},
 		markOutboxSent: async (accountConfigId, id, fields) => {
 			assert.equal(accountConfigId, account.accountConfigId);
 			recorded.marked.push({ id, ...fields });
@@ -155,6 +179,7 @@ const buildDeps = (
 				};
 			}),
 		updateConnectionState: async (accountId, state) => {
+			recorded.writeOrder.push("connectionState");
 			recorded.connectionStateUpdates.push({ accountId, state });
 		},
 		send:
@@ -527,8 +552,20 @@ describe("sendMessage handler", () => {
 	});
 });
 
+/**
+ * The row is the only place the user learns a send stopped on re-auth, so every
+ * branch that abandons the send has to leave a `blocked` row naming the remedy
+ * (issue #1152).
+ */
+const assertBlockedOnReauth = (recorded: Recorded): void => {
+	const settled = recorded.updates.at(-1)?.patch;
+	assert.equal(settled?.status, "blocked");
+	assert.match(String(settled?.lastError), /reconnected/i);
+	assert.match(String(settled?.lastError), /Reconnect/);
+};
+
 describe("sendMessage OAuth reauth/ACK contract", () => {
-	it("skips send when account is reauth_required", async () => {
+	it("blocks the message when the account already needs reauth (issue #1152)", async () => {
 		const { deps, recorded } = buildDeps({
 			account: buildAccount({
 				smtpHost: "smtp.example.com",
@@ -546,7 +583,7 @@ describe("sendMessage OAuth reauth/ACK contract", () => {
 			0,
 			"must not flip connectionState",
 		);
-		assert.equal(recorded.updates.length, 0, "must not update outbox");
+		assertBlockedOnReauth(recorded);
 		assert.equal(recorded.statuses.length, 0, "must not change status");
 	});
 
@@ -569,6 +606,7 @@ describe("sendMessage OAuth reauth/ACK contract", () => {
 			accountId: "acc-1",
 			state: "reauth_required",
 		});
+		assertBlockedOnReauth(recorded);
 	});
 
 	it("account storing no credential: settles `blocked` and never retries (issue #1120)", async () => {
@@ -629,6 +667,7 @@ describe("sendMessage OAuth reauth/ACK contract", () => {
 			accountId: "acc-1",
 			state: "reauth_required",
 		});
+		assertBlockedOnReauth(recorded);
 	});
 
 	it("on SmtpConnectionError auth during credential resolution for password account: rethrows (no state flip)", async () => {
@@ -673,6 +712,7 @@ describe("sendMessage OAuth reauth/ACK contract", () => {
 			accountId: "acc-1",
 			state: "reauth_required",
 		});
+		assertBlockedOnReauth(recorded);
 	});
 
 	it("on SmtpConnectionError auth during send for password account: rethrows (no state flip)", async () => {
@@ -697,6 +737,53 @@ describe("sendMessage OAuth reauth/ACK contract", () => {
 			"must not flip connectionState for password account",
 		);
 	});
+
+	it("flips the connection state before it settles the row", async () => {
+		const { deps, recorded } = buildDeps({
+			resolveCredentials: async () => {
+				throw new RefreshTokenError({
+					kind: "reauth-required",
+					code: "invalid_grant",
+				});
+			},
+		});
+
+		await sendMessage(event, silentLogger, deps);
+
+		// A settle that throws after the flip is redelivered into the fence, which
+		// settles the row. The other order leaves the account unfenced, and the
+		// settled row is outside the send fence so no redelivery gets back here.
+		assert.deepEqual(recorded.writeOrder, ["connectionState", "outbox"]);
+	});
+
+	it("leaves a row the user pulled back into the composer alone", async () => {
+		const { deps, recorded } = buildDeps({
+			outbox: buildOutbox({ status: "draft" }),
+			account: buildAccount({ connectionState: "reauth_required" }),
+		});
+
+		await sendMessage(event, silentLogger, deps);
+
+		assert.equal(recorded.updates.length, 0, "must not overwrite the draft");
+		assert.equal(recorded.conditionalUpdates.length, 0, "must not even try");
+	});
+
+	it("settles a send-time rejection against `sending`, the status the row reached", async () => {
+		const { deps, recorded } = buildDeps({
+			account: buildAccount({ authType: AccountAuthType.OauthMicrosoft }),
+			send: async () => {
+				throw new SmtpConnectionError("auth", "535 authentication failed");
+			},
+		});
+
+		await sendMessage(event, silentLogger, deps);
+
+		assert.deepEqual(
+			recorded.conditionalUpdates.map((update) => update.expected),
+			["sending"],
+		);
+		assertBlockedOnReauth(recorded);
+	});
 });
 
 /**

package/src/handlers/send-message.ts

@@ -150,6 +150,13 @@ export const handleSendMessage = (
 					id,
 					status,
 				),
+			updateOutboxIfStatus: async (accountConfigId, id, expected, patch) =>
+				(await getPorts()).outboxMessage.updateIfStatus(
+					accountConfigId,
+					id,
+					expected,
+					patch,
+				),
 			markOutboxSent: async (accountConfigId, id, fields) =>
 				(await getPorts()).outboxMessage.markSent(accountConfigId, id, fields),
 			secrets,