@remit/web-client 0.0.325 → 0.0.326

package/src/lib/request-breadcrumbs.test.ts

@@ -1,162 +0,0 @@
-import assert from "node:assert/strict";
-import { beforeEach, describe, it } from "node:test";
-import {
-	__resetRequestBreadcrumbs,
-	getFailingRequest,
-	getRecentRequests,
-	recordRequest,
-	requestPath,
-} from "./request-breadcrumbs";
-
-const response = (
-	status: number,
-	headers: Record<string, string> = {},
-): Response => new Response(null, { status, headers });
-
-beforeEach(() => {
-	__resetRequestBreadcrumbs();
-});
-
-describe("requestPath — redaction boundary", () => {
-	it("keeps the pathname and drops the query string", () => {
-		assert.equal(requestPath("/api/search?q=secret+query+text"), "/api/search");
-	});
-
-	it("drops the query on an absolute URL too", () => {
-		assert.equal(
-			requestPath("https://app.example.com/api/messages?q=private"),
-			"/api/messages",
-		);
-	});
-
-	it("drops a hash fragment", () => {
-		assert.equal(requestPath("/api/thing#section"), "/api/thing");
-	});
-
-	it("keeps opaque path ids (already public in the URL section)", () => {
-		assert.equal(
-			requestPath("/api/messages/abc-123-def"),
-			"/api/messages/abc-123-def",
-		);
-	});
-
-	it("accepts a URL instance", () => {
-		assert.equal(
-			requestPath(new URL("https://app.example.com/api/x?q=1")),
-			"/api/x",
-		);
-	});
-
-	it("accepts a Request instance", () => {
-		assert.equal(
-			requestPath(new Request("https://app.example.com/api/y?token=abc")),
-			"/api/y",
-		);
-	});
-});
-
-describe("recordRequest", () => {
-	it("captures metadata only — never the query or the body", () => {
-		recordRequest({
-			input: "/api/search?q=confidential",
-			init: { method: "POST", body: JSON.stringify({ subject: "secret" }) },
-			response: response(200),
-			durationMs: 12.6,
-		});
-		const [entry] = getRecentRequests();
-		assert.equal(entry.method, "POST");
-		assert.equal(entry.path, "/api/search");
-		assert.equal(entry.status, 200);
-		assert.equal(entry.durationMs, 13);
-		// The breadcrumb shape has no body/query field; assert nothing leaked in.
-		const serialized = JSON.stringify(entry);
-		assert.ok(
-			!serialized.includes("confidential"),
-			"query text must not be captured",
-		);
-		assert.ok(
-			!serialized.includes("secret"),
-			"request body must not be captured",
-		);
-	});
-
-	it("defaults the method to GET", () => {
-		recordRequest({
-			input: "/api/thing",
-			response: response(204),
-			durationMs: 1,
-		});
-		assert.equal(getRecentRequests()[0].method, "GET");
-	});
-
-	it("reads the method from a Request instance", () => {
-		recordRequest({
-			input: new Request("https://app.example.com/api/z", { method: "delete" }),
-			response: response(200),
-			durationMs: 1,
-		});
-		assert.equal(getRecentRequests()[0].method, "DELETE");
-	});
-
-	it("records status 0 and no correlation id for a transport failure", () => {
-		recordRequest({ input: "/api/thing", durationMs: 5000 });
-		const [entry] = getRecentRequests();
-		assert.equal(entry.status, 0);
-		assert.equal(entry.correlationId, undefined);
-	});
-
-	it("reads the correlation id from the first present header", () => {
-		recordRequest({
-			input: "/api/a",
-			response: response(200, { "x-request-id": "req-42" }),
-			durationMs: 1,
-		});
-		assert.equal(getRecentRequests()[0].correlationId, "req-42");
-	});
-
-	it("keeps only the last ten requests", () => {
-		for (let i = 0; i < 14; i++) {
-			recordRequest({
-				input: `/api/n/${i}`,
-				response: response(200),
-				durationMs: 1,
-			});
-		}
-		const entries = getRecentRequests();
-		assert.equal(entries.length, 10);
-		assert.equal(entries[0].path, "/api/n/4");
-		assert.equal(entries[9].path, "/api/n/13");
-	});
-});
-
-describe("getFailingRequest", () => {
-	it("returns the most recent HTTP error", () => {
-		recordRequest({ input: "/api/ok", response: response(200), durationMs: 1 });
-		recordRequest({
-			input: "/api/bad",
-			response: response(500),
-			durationMs: 1,
-		});
-		recordRequest({
-			input: "/api/ok2",
-			response: response(200),
-			durationMs: 1,
-		});
-		assert.equal(getFailingRequest()?.path, "/api/bad");
-	});
-
-	it("treats a transport failure as failing", () => {
-		recordRequest({ input: "/api/gone", durationMs: 100 });
-		assert.equal(getFailingRequest()?.status, 0);
-	});
-
-	it("returns undefined when every request succeeded", () => {
-		recordRequest({ input: "/api/ok", response: response(200), durationMs: 1 });
-		recordRequest({
-			input: "/api/ok2",
-			response: response(304),
-			durationMs: 1,
-		});
-		assert.equal(getFailingRequest(), undefined);
-	});
-});

package/src/lib/request-breadcrumbs.ts

@@ -1,138 +0,0 @@
-/**
- * A constant-size ring of the last few API calls, captured at the one fetch
- * choke point (`taggedFetch` in network-error.ts). It gives a bug report the
- * request context that a minified stack cannot: which endpoints were hit, in
- * what order, and what they returned — plus the correlation id that ties a
- * failing request to its server-side log line.
- *
- * PRIVACY — the issue tracker is public, so a breadcrumb is METADATA ONLY.
- * Capture records the request method, the URL PATHNAME, the HTTP status, the
- * duration, and a correlation id. It never records a request or response body,
- * and never the query string — a search's `?q=` carries the user's query text,
- * a message fetch's params can carry a subject. `requestPath` strips the query
- * and hash precisely so none of that can reach the report even when the fetch
- * layer has the full URL in hand. Opaque path ids (a message id in the path)
- * are acceptable: they already appear in the report's URL section.
- *
- * Capture is cheap by construction — a fixed-size array of small records, no
- * serialization until a report is assembled.
- */
-
-export interface RequestBreadcrumb {
-	method: string;
-	/** URL pathname only — never the query string or hash (see file header). */
-	path: string;
-	/** HTTP status, or 0 when the request never reached a server (transport failure). */
-	status: number;
-	durationMs: number;
-	/** Server correlation id from a response header, when the response carried one. */
-	correlationId?: string;
-	timestamp: string;
-}
-
-const MAX_ENTRIES = 10;
-
-const ring: RequestBreadcrumb[] = [];
-
-/**
- * Response headers that carry a request/trace correlation id, in preference
- * order. `Headers.get` is case-insensitive, so the lowercase form matches
- * whatever casing the server sent.
- */
-const CORRELATION_HEADERS = [
-	"x-correlation-id",
-	"x-request-id",
-	"x-amzn-requestid",
-	"x-amzn-trace-id",
-	"apigw-requestid",
-	"x-trace-id",
-] as const;
-
-/**
- * The pathname of a request, with the query string and hash discarded. This is
- * the redaction boundary: it is the only thing that reads the request URL, and
- * it deliberately keeps nothing but the path so no query text can leak into a
- * breadcrumb.
- */
-export function requestPath(input: RequestInfo | URL): string {
-	const raw =
-		typeof input === "string"
-			? input
-			: input instanceof URL
-				? input.href
-				: input.url;
-	try {
-		return new URL(raw, window.location.origin).pathname;
-	} catch {
-		// A non-URL input (rare) still must not leak a query — cut at the first
-		// `?` or `#` and return what precedes it.
-		return raw.split(/[?#]/)[0];
-	}
-}
-
-function requestMethod(input: RequestInfo | URL, init?: RequestInit): string {
-	if (init?.method) return init.method.toUpperCase();
-	if (typeof input !== "string" && !(input instanceof URL) && input.method) {
-		return input.method.toUpperCase();
-	}
-	return "GET";
-}
-
-function correlationIdFrom(response: Response): string | undefined {
-	for (const header of CORRELATION_HEADERS) {
-		const value = response.headers.get(header);
-		if (value) return value;
-	}
-	return undefined;
-}
-
-function push(entry: RequestBreadcrumb): void {
-	ring.push(entry);
-	if (ring.length > MAX_ENTRIES) ring.shift();
-}
-
-/**
- * Record the outcome of one fetch. Called from `taggedFetch` for both a
- * completed response and a transport failure (no response, status 0). Only the
- * metadata listed in `RequestBreadcrumb` is read — never `init.body` or the
- * response body.
- */
-export function recordRequest(args: {
-	input: RequestInfo | URL;
-	init?: RequestInit;
-	response?: Response;
-	durationMs: number;
-}): void {
-	const { input, init, response, durationMs } = args;
-	push({
-		method: requestMethod(input, init),
-		path: requestPath(input),
-		status: response?.status ?? 0,
-		durationMs: Math.round(durationMs),
-		correlationId: response ? correlationIdFrom(response) : undefined,
-		timestamp: new Date().toISOString(),
-	});
-}
-
-/** The captured breadcrumbs, oldest first. A copy — callers cannot mutate the ring. */
-export function getRecentRequests(): readonly RequestBreadcrumb[] {
-	return ring.slice();
-}
-
-/**
- * The most recent request that failed — a transport failure (status 0) or an
- * HTTP error (>= 400). This is the request a report should call out explicitly,
- * so nobody has to decode a minified stack to learn what broke.
- */
-export function getFailingRequest(): RequestBreadcrumb | undefined {
-	for (let i = ring.length - 1; i >= 0; i--) {
-		const entry = ring[i];
-		if (entry.status === 0 || entry.status >= 400) return entry;
-	}
-	return undefined;
-}
-
-/** Test-only: clear the ring. */
-export function __resetRequestBreadcrumbs(): void {
-	ring.length = 0;
-}

package/src/lib/rescue-candidates.test.ts

@@ -1,94 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, test } from "node:test";
-import type { RemitImapThreadMessageResponse } from "@remit/api-http-client/types.gen.ts";
-import {
-	isRescueCandidate,
-	rescueCandidateReason,
-} from "./rescue-candidates.js";
-
-function thread(
-	overrides: Partial<RemitImapThreadMessageResponse> &
-		Pick<RemitImapThreadMessageResponse, "messageId" | "senderTrust">,
-): RemitImapThreadMessageResponse {
-	return {
-		threadMessageId: `tm-${overrides.messageId}`,
-		threadId: `t-${overrides.messageId}`,
-		accountConfigId: "acc",
-		mailboxId: "mb-junk",
-		sentDate: 1_000_000,
-		isRead: false,
-		hasAttachment: false,
-		hasStars: false,
-		isDeleted: false,
-		createdAt: 1_000_000,
-		updatedAt: 1_000_000,
-		fromName: "Anna de Vries",
-		fromEmail: "anna@studio-noord.nl",
-		subject: "Re: invoice",
-		snippet: "Final files attached.",
-		...overrides,
-	} as RemitImapThreadMessageResponse;
-}
-
-describe("rescueCandidateReason", () => {
-	test("VIP senders read as someone you know", () => {
-		assert.equal(rescueCandidateReason("vip"), "A sender you know");
-	});
-
-	test("well-known senders read as previously emailed", () => {
-		assert.equal(
-			rescueCandidateReason("wellknown"),
-			"You've emailed them before",
-		);
-	});
-
-	test("anything else falls back to passed authentication", () => {
-		assert.equal(rescueCandidateReason("unknown"), "Passed authentication");
-	});
-
-	test("never leaks authentication jargon", () => {
-		for (const trust of ["vip", "wellknown", "unknown"] as const) {
-			assert.doesNotMatch(rescueCandidateReason(trust), /DKIM|SPF|DMARC/i);
-		}
-	});
-});
-
-describe("isRescueCandidate (telemetry predicate)", () => {
-	test("includes verified senders with no DKIM mismatch", () => {
-		assert.equal(
-			isRescueCandidate(thread({ messageId: "m1", senderTrust: "wellknown" })),
-			true,
-		);
-		assert.equal(
-			isRescueCandidate(thread({ messageId: "m2", senderTrust: "vip" })),
-			true,
-		);
-	});
-
-	test("excludes unknown senders", () => {
-		assert.equal(
-			isRescueCandidate(thread({ messageId: "m3", senderTrust: "unknown" })),
-			false,
-		);
-	});
-
-	test("excludes a verified sender that failed DKIM alignment", () => {
-		assert.equal(
-			isRescueCandidate(
-				thread({
-					messageId: "m4",
-					senderTrust: "vip",
-					authenticity: { fromDomain: "x.nl", dkimMismatch: true },
-				}),
-			),
-			false,
-		);
-	});
-
-	test("keeps a verified sender when authenticity is absent", () => {
-		assert.equal(
-			isRescueCandidate(thread({ messageId: "m5", senderTrust: "wellknown" })),
-			true,
-		);
-	});
-});

package/src/lib/rescue-candidates.ts

@@ -1,35 +0,0 @@
-import type {
-	RemitImapSenderTrust,
-	RemitImapThreadMessageResponse,
-} from "@remit/api-http-client/types.gen.ts";
-
-/**
- * Plain-language reason a message is safe to rescue, derived from the sender's
- * trust tier. Never DKIM/SPF jargon — the user only sees why we trust them.
- */
-export const rescueCandidateReason = (
-	senderTrust: RemitImapSenderTrust,
-): string => {
-	if (senderTrust === "vip") return "A sender you know";
-	if (senderTrust === "wellknown") return "You've emailed them before";
-	return "Passed authentication";
-};
-
-/**
- * Returns true when a thread's sender is VIP or well-known with no confirmed
- * DKIM mismatch. Used only for telemetry (wasRescuable) when marking a message
- * as junk — it records whether the user moved a message that was previously
- * eligible for rescue under the client-side rule.
- *
- * Note: the backend rescue query uses dkimMismatch=false which also excludes
- * senders with no authenticity signal (undefined), unlike this predicate which
- * treats absent authenticity as eligible. The backend is stricter by design.
- */
-export const isRescueCandidate = (
-	thread: RemitImapThreadMessageResponse,
-): boolean => {
-	if (thread.senderTrust !== "vip" && thread.senderTrust !== "wellknown") {
-		return false;
-	}
-	return thread.authenticity?.dkimMismatch !== true;
-};

package/src/lib/rescue-telemetry.ts

@@ -1,55 +0,0 @@
-import type { RemitImapSenderTrust } from "@remit/api-http-client/types.gen.ts";
-import type { Telemetry } from "@/lib/telemetry";
-
-/**
- * Rescue-from-Spam telemetry. Shapes the small, privacy-safe payloads (counts,
- * folder roles, booleans — never bodies or addresses) and emits them through the
- * shared `recordEvent` channel, matching the `domain.action` event-name
- * convention used across the client.
- */
-
-export function recordRescueCandidatesSurfaced(
-	telemetry: Telemetry,
-	count: number,
-): void {
-	telemetry.recordEvent("rescue.candidates_surfaced", { count: String(count) });
-}
-
-export function recordRescueFlowOpened(
-	telemetry: Telemetry,
-	count: number,
-): void {
-	telemetry.recordEvent("rescue.flow_opened", { count: String(count) });
-}
-
-export function recordRescueCommitted(
-	telemetry: Telemetry,
-	input: { selected: number; total: number; toInbox: boolean },
-): void {
-	telemetry.recordEvent("rescue.committed", {
-		selected: String(input.selected),
-		total: String(input.total),
-		destination: input.toInbox ? "inbox" : "other",
-	});
-}
-
-/**
- * The reverse signal: a message moved back into Junk. `wasRescuable` is the best
- * cheaply-available prior-rescue proxy — the sender is one we can verify, so the
- * user is overriding our trust. There is no per-message "was previously rescued"
- * flag in the client, so we do not claim one.
- */
-export function recordRescueSentToJunk(
-	telemetry: Telemetry,
-	input: {
-		count: number;
-		senderTrust: RemitImapSenderTrust;
-		wasRescuable: boolean;
-	},
-): void {
-	telemetry.recordEvent("rescue.sent_to_junk", {
-		count: String(input.count),
-		senderTrust: input.senderTrust,
-		wasRescuable: String(input.wasRescuable),
-	});
-}

package/src/lib/result-count.test.ts

@@ -1,97 +0,0 @@
-/**
- * The exact match count is opt-in because it is a second read over the whole
- * match set (#307). These pin who pays for it and what happens when the server
- * declines to answer.
- */
-
-import assert from "node:assert/strict";
-import { describe, test } from "node:test";
-import type { EscalationSearchQuery } from "@/hooks/useEscalatedActions";
-import {
-	type ResultCountRequestInput,
-	shouldRequestResultCount,
-	toResultCount,
-} from "./result-count.js";
-
-const request = (input: Partial<ResultCountRequestInput>): boolean =>
-	shouldRequestResultCount({
-		hasSearchQuery: true,
-		freeText: "",
-		residualTokenCount: 0,
-		...input,
-	});
-
-describe("shouldRequestResultCount", () => {
-	test("browsing a mailbox asks for no count", () => {
-		assert.equal(request({ hasSearchQuery: false }), false);
-	});
-
-	test("a free-text query is not counted while it is being typed", () => {
-		for (const freeText of ["k", "ku", " ku "]) {
-			assert.equal(
-				request({ freeText }),
-				false,
-				`"${freeText}" was counted per keystroke`,
-			);
-		}
-	});
-
-	test("a free-text query long enough for the index is counted", () => {
-		assert.equal(request({ freeText: "kub" }), true);
-	});
-
-	test("a query made only of filter tokens is counted straight away", () => {
-		assert.equal(request({}), true);
-	});
-
-	/**
-	 * `before:`/`after:`/`account:` reach the request as nothing, so the server
-	 * would count a wider set than the list shows — and `invoice before:2020`
-	 * sends criteria identical to `invoice`, which is also the previous search's
-	 * cache key.
-	 */
-	test("a term the request could not carry stops the count", () => {
-		assert.equal(
-			request({ freeText: "invoice", residualTokenCount: 1 }),
-			false,
-			"the count covered rows the list filters back out",
-		);
-		assert.equal(
-			request({ freeText: "invoice", residualTokenCount: 0 }),
-			true,
-			"the same search without the residual term must still be counted",
-		);
-	});
-});
-
-describe("toResultCount", () => {
-	test("the server's number is the whole match set", () => {
-		assert.deepEqual(toResultCount(1284), { kind: "exact", value: 1284 });
-	});
-
-	test("zero matches is a number, not an absent count", () => {
-		assert.deepEqual(toResultCount(0), { kind: "exact", value: 0 });
-	});
-
-	test("an absent count stays absent rather than becoming zero", () => {
-		assert.deepEqual(toResultCount(undefined), { kind: "unknown" });
-	});
-});
-
-/**
- * `searchThreads` withholds the count when the criteria carry an off-row term
- * (#305), and the escalated selection reads `count` as a required number to size
- * its run. Neither term can reach that predicate today; this fails the day one
- * is added, so the absent-count state gets designed rather than surfacing as a
- * run that refuses to start.
- */
-describe("the escalation predicate carries no off-row criterion", () => {
-	test("senderTrust and dkimMismatch are not part of it", () => {
-		type OffRow = Extract<
-			keyof EscalationSearchQuery,
-			"senderTrust" | "dkimMismatch"
-		>;
-		const offRow: [OffRow] extends [never] ? true : false = true;
-		assert.equal(offRow, true);
-	});
-});

package/src/lib/result-count.ts

@@ -1,57 +0,0 @@
-import type { ResultCount } from "@remit/ui";
-
-/**
- * Shortest free text a count is asked for. A one- or two-character prefix
- * matches most words in the search index, so counting one walks most of the
- * mailbox per typed character. The list itself still pages — only the count
- * waits.
- */
-export const MIN_COUNTED_QUERY_LENGTH = 3;
-
-export interface ResultCountRequestInput {
-	/** True while the list is answering a search rather than plain browsing. */
-	hasSearchQuery: boolean;
-	/** The literal text of the search, with its filter tokens already taken out. */
-	freeText: string;
-	/**
-	 * Tokens the request could not carry — `before:`, `after:`, `account:`, and
-	 * any second value for a parameter that takes one — applied over the rows
-	 * after they arrive.
-	 */
-	residualTokenCount: number;
-}
-
-/**
- * Whether the exact match count is worth one request against these criteria.
- *
- * Chip- and token-driven criteria are counted straight away: they change once
- * per click, and the predicate is one the index answers. Free text is counted
- * only once it is long enough to be indexed, which is what keeps a per-character
- * query from paying for a count it will throw away on the next keystroke.
- *
- * A residual token stops the count outright. The server never saw that term, so
- * it would count a wider set than the list shows — and two searches differing
- * only by one reach the request as the same criteria, so the answer would also
- * be the one the previous search left in the cache.
- */
-export const shouldRequestResultCount = ({
-	hasSearchQuery,
-	freeText,
-	residualTokenCount,
-}: ResultCountRequestInput): boolean => {
-	if (!hasSearchQuery) return false;
-	if (residualTokenCount > 0) return false;
-	const typed = freeText.trim();
-	return typed.length === 0 || typed.length >= MIN_COUNTED_QUERY_LENGTH;
-};
-
-/**
- * The server's answer, or no number.
- *
- * The only input is `ThreadSearchResponse.count`, which is the whole match set
- * or absent (#305) — never a page length. Absent stays absent: a count the
- * server declined to compute is not zero, and the surface renders nothing
- * rather than a figure it made up.
- */
-export const toResultCount = (count: number | undefined): ResultCount =>
-	count === undefined ? { kind: "unknown" } : { kind: "exact", value: count };