@remit/sqs-client 0.0.1 → 0.0.3

package/package.json

@@ -1,40 +1,40 @@
 {
-	"name": "@remit/sqs-client",
-	"version": "0.0.1",
-	"type": "module",
-	"main": "src/index.ts",
-	"types": "src/index.ts",
-	"exports": {
-		".": {
-			"types": "./src/index.ts",
-			"default": "./src/index.ts"
-		},
-		"./poller": {
-			"types": "./src/poller.ts",
-			"default": "./src/poller.ts"
-		},
-		"./producer": {
-			"types": "./src/producer.ts",
-			"default": "./src/producer.ts"
-		}
-	},
-	"scripts": {
-		"test:typecheck": "tsgo --noEmit",
-		"test:run": "node --env-file=../../localhost-test-unit.env --test 'src/**/*.test.ts'",
-		"test": "npm run test:typecheck && npm run test:run"
-	},
-	"devDependencies": {
-		"@aws-sdk/client-sqs": "*",
-		"@aws-sdk/core": "*",
-		"@types/aws-lambda": "*"
-	},
-	"license": "MIT",
-	"publishConfig": {
-		"access": "public"
-	},
-	"repository": {
-		"type": "git",
-		"url": "git+https://github.com/remit-mail/remit.git",
-		"directory": "packages/sqs-client"
-	}
+  "name": "@remit/sqs-client",
+  "version": "0.0.3",
+  "type": "module",
+  "main": "src/index.ts",
+  "types": "src/index.ts",
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "default": "./src/index.ts"
+    },
+    "./poller": {
+      "types": "./src/poller.ts",
+      "default": "./src/poller.ts"
+    },
+    "./producer": {
+      "types": "./src/producer.ts",
+      "default": "./src/producer.ts"
+    }
+  },
+  "scripts": {
+    "test:typecheck": "tsgo --noEmit",
+    "test:run": "node --env-file=../../localhost-test-unit.env --test 'src/**/*.test.ts'",
+    "test": "npm run test:typecheck && npm run test:run"
+  },
+  "devDependencies": {
+    "@aws-sdk/client-sqs": "*",
+    "@aws-sdk/core": "*",
+    "@types/aws-lambda": "*"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/remit-mail/reader.git",
+    "directory": "packages/sqs-client"
+  }
 }

package/src/producer.test.ts

@@ -1,28 +1,150 @@
 import assert from "node:assert/strict";
 import { describe, it } from "node:test";
-import { createQueueProducer } from "./producer.js";
+import type { SQSClient } from "@aws-sdk/client-sqs";
+import { AwsQueryProtocol } from "@aws-sdk/core/protocols";
+import { createQueueProducer, isLocalEndpoint } from "./producer.js";
+
+// The queue URL a self-hosted compose stack hands its workers: a plain
+// http:// URL addressing the queue container by name, never "localhost".
+const composeQueueUrl = "http://queue:9324/000000000000/mailboxes";
+const awsQueueUrl =
+	"https://sqs.eu-west-1.amazonaws.com/123456789012/remit-dev-mailboxes.fifo";
+
+const usesQueryProtocol = (client: SQSClient): boolean =>
+	client.config.protocol instanceof AwsQueryProtocol;
+
+const resolvedEndpoint = async (
+	client: SQSClient,
+): Promise<string | undefined> => {
+	const { endpoint } = client.config;
+	if (!endpoint) return undefined;
+	const resolved = await endpoint();
+	return `${resolved.protocol}//${resolved.hostname}:${resolved.port}`;
+};
+
+describe("isLocalEndpoint", () => {
+	it("treats a non-localhost http:// queue URL as local", () => {
+		assert.equal(isLocalEndpoint(composeQueueUrl), true);
+	});
+
+	it("treats http://localhost as local", () => {
+		assert.equal(
+			isLocalEndpoint("http://localhost:9324/000000000000/mailboxes"),
+			true,
+		);
+	});
+
+	it("treats https://localhost as local", () => {
+		assert.equal(
+			isLocalEndpoint("https://localhost:9324/000000000000/mailboxes"),
+			true,
+		);
+	});
+
+	it("treats a real SQS queue URL as remote", () => {
+		assert.equal(isLocalEndpoint(awsQueueUrl), false);
+	});
+
+	// A prefix match on "https://localhost" reads all of these as local. The
+	// host is localhost in none of them.
+	it("treats an https host that merely starts with localhost as remote", () => {
+		assert.equal(isLocalEndpoint("https://localhost.example.com/0/q"), false);
+		assert.equal(
+			isLocalEndpoint("https://localhost-queue.example.com/0/q"),
+			false,
+		);
+	});
+
+	it("treats an https URL with localhost in the userinfo as remote", () => {
+		assert.equal(isLocalEndpoint("https://localhost@example.com/0/q"), false);
+		assert.equal(
+			isLocalEndpoint("https://localhost:pass@example.com/0/q"),
+			false,
+		);
+	});
+
+	// The mirror image: a prefix match misses these, and they are local.
+	it("treats a loopback https URL carrying credentials as local", () => {
+		assert.equal(isLocalEndpoint("https://user:pass@localhost/0/q"), true);
+	});
+
+	it("ignores scheme case", () => {
+		assert.equal(isLocalEndpoint("HTTP://queue:9324/0/q"), true);
+		assert.equal(isLocalEndpoint("HtTpS://localhost:9324/0/q"), true);
+	});
+
+	it("treats loopback addresses over https as local", () => {
+		assert.equal(isLocalEndpoint("https://127.0.0.1:9324/0/q"), true);
+		assert.equal(isLocalEndpoint("https://[::1]:9324/0/q"), true);
+	});
+
+	it("treats any http URL as local regardless of host, port, or credentials", () => {
+		assert.equal(isLocalEndpoint("http://queue/0/q"), true);
+		assert.equal(isLocalEndpoint("http://user:pass@queue:9324/0/q"), true);
+		assert.equal(isLocalEndpoint("http://example.com/0/q"), true);
+	});
+
+	// Must not throw: several callers construct their client at module load, so
+	// a throw here would take the worker down at import.
+	it("treats an unparseable queue URL as remote without throwing", () => {
+		assert.equal(isLocalEndpoint(""), false);
+		assert.equal(isLocalEndpoint("not a url"), false);
+		assert.equal(isLocalEndpoint("queue:9324/0/q"), false);
+		assert.equal(isLocalEndpoint("//queue:9324/0/q"), false);
+	});
+});
 
 describe("createQueueProducer", () => {
-	it("returns a real SQSClient for a local queue URL", () => {
-		const client = createQueueProducer({
-			queueUrl: "http://localhost:4566/000000000000/test-queue",
-		});
-		assert.equal(typeof client.send, "function");
+	// Regression (self-host stack): a queue URL of http://queue:9324/... used to
+	// fall through to the AWS JSON protocol, so every send hit the local queue
+	// server with a body it cannot parse and mail never synced.
+	it("selects the query protocol for a non-localhost http:// queue URL", async () => {
+		const client = createQueueProducer({ queueUrl: composeQueueUrl });
+		assert.equal(usesQueryProtocol(client), true);
+		assert.equal(await resolvedEndpoint(client), "http://queue:9324");
 	});
 
-	it("returns a real SQSClient for a real AWS queue URL", () => {
+	it("selects the query protocol for a localhost queue URL", () => {
 		const client = createQueueProducer({
-			queueUrl:
-				"https://sqs.eu-west-1.amazonaws.com/123456789012/remit-dev-mailboxes.fifo",
+			queueUrl: "http://localhost:9324/000000000000/mailboxes",
 		});
-		assert.equal(typeof client.send, "function");
+		assert.equal(usesQueryProtocol(client), true);
 	});
 
-	it("accepts an explicit endpoint override", () => {
+	it("leaves the default protocol and endpoint for a real AWS queue URL", async () => {
+		const client = createQueueProducer({ queueUrl: awsQueueUrl });
+		assert.equal(usesQueryProtocol(client), false);
+		assert.equal(await resolvedEndpoint(client), undefined);
+	});
+
+	it("does not throw when the queue URL is unparseable", async () => {
+		const client = createQueueProducer({ queueUrl: "not a url" });
+		assert.equal(usesQueryProtocol(client), false);
+		assert.equal(await resolvedEndpoint(client), undefined);
+	});
+
+	it("accepts an explicit endpoint override", async () => {
 		const client = createQueueProducer({
-			queueUrl: "http://localhost:4566/000000000000/test-queue",
+			queueUrl: composeQueueUrl,
 			endpoint: "http://custom-endpoint:1234",
 		});
-		assert.equal(typeof client.send, "function");
+		assert.equal(usesQueryProtocol(client), true);
+		assert.equal(await resolvedEndpoint(client), "http://custom-endpoint:1234");
+	});
+
+	it("uses localCredentials only for a local endpoint", async () => {
+		const local = createQueueProducer({
+			queueUrl: composeQueueUrl,
+			localCredentials: { accessKeyId: "local", secretAccessKey: "local" },
+			env: {},
+		});
+		assert.equal((await local.config.credentials()).accessKeyId, "local");
+
+		const remote = createQueueProducer({
+			queueUrl: awsQueueUrl,
+			localCredentials: { accessKeyId: "local", secretAccessKey: "local" },
+			env: { SQS_ACCESS_KEY_ID: "real", SQS_SECRET_ACCESS_KEY: "real" },
+		});
+		assert.equal((await remote.config.credentials()).accessKeyId, "real");
 	});
 });

package/src/producer.ts

@@ -1,15 +1,51 @@
 import { SQSClient } from "@aws-sdk/client-sqs";
 import { AwsQueryProtocol } from "@aws-sdk/core/protocols";
-import { resolveSqsCredentials } from "./index.js";
+import { resolveSqsCredentials, type SqsStaticCredentials } from "./index.js";
 
 export interface CreateQueueProducerOptions {
 	readonly queueUrl: string;
 	readonly endpoint?: string;
 	readonly env?: NodeJS.ProcessEnv;
+	/**
+	 * Credentials to use when the queue URL resolves to a local endpoint. A
+	 * local queue server ignores them, but the SDK still needs something to
+	 * sign with and a self-hosted stack has no credential chain to fall back on.
+	 */
+	readonly localCredentials?: SqsStaticCredentials;
 }
 
-const isLocalEndpoint = (queueUrl: string): boolean =>
-	queueUrl.startsWith("http://") || queueUrl.startsWith("https://localhost");
+const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]"]);
+
+/**
+ * Whether a queue URL addresses a local, SQS-compatible queue server
+ * (ElasticMQ, the queue sidecar) rather than real SQS.
+ *
+ * Any plain `http://` URL is local: real SQS and Scaleway M&Q are always
+ * HTTPS, and a self-hosted stack addresses its queue server by container name
+ * (`http://queue:9324/...`), not by `localhost`. Over HTTPS only a loopback
+ * host is local, which covers a local server behind TLS.
+ *
+ * The URL is parsed rather than prefix-matched. Prefix-matching the string
+ * gets the interesting cases wrong in both directions: it reads
+ * `https://localhost.example.com` and `https://localhost@example.com` as
+ * local (the host is neither), and misses `https://user:pass@localhost` and
+ * an uppercase `HTTP://` scheme (both of which are).
+ *
+ * A queue URL that does not parse is treated as remote. It cannot be sent to
+ * either way, and several callers build their client at module load — throwing
+ * here would take a worker down at import instead of surfacing the bad
+ * configuration at the send that actually uses it.
+ */
+export const isLocalEndpoint = (queueUrl: string): boolean => {
+	let url: URL;
+	try {
+		url = new URL(queueUrl);
+	} catch {
+		return false;
+	}
+	if (url.protocol === "http:") return true;
+	return url.protocol === "https:" && LOOPBACK_HOSTNAMES.has(url.hostname);
+};
 
 /**
  * Producer-side counterpart of `runQueuePoller`: the one place an
@@ -22,11 +58,12 @@ const isLocalEndpoint = (queueUrl: string): boolean =>
 export const createQueueProducer = (
 	options: CreateQueueProducerOptions,
 ): SQSClient => {
-	const { queueUrl, endpoint, env } = options;
+	const { queueUrl, endpoint, env, localCredentials } = options;
 	const local = isLocalEndpoint(queueUrl);
 	return new SQSClient({
 		endpoint: endpoint ?? (local ? new URL(queueUrl).origin : undefined),
 		...(local && { protocol: AwsQueryProtocol }),
-		credentials: resolveSqsCredentials(env),
+		credentials:
+			(local ? localCredentials : undefined) ?? resolveSqsCredentials(env),
 	});
 };