Consolidate edge functions

.deepsource.toml

@@ -9,7 +9,9 @@ exclude_patterns = [
   "frontend/public",
   "backend/logs",
   "backend/coverage",
-  "backend/.nyc_output"
+  "backend/.nyc_output",
+  "supabase/functions/.env.dev",
+  "supabase/functions/.env.example"
 ]
 
 [[analyzers]]

.rate-limiting-deferred.md

@@ -0,0 +1,25 @@
+# Rate Limiting — Deferred to Follow-up
+
+Rate limiting on enrich + export-contacts endpoints was deferred because:
+
+1. **Redis dependency**: `_shared/rate-limiter.ts` requires `REDIS_URL` env var. If Redis isn't configured, every request would throw on `getRedisClient()`.
+2. **No new code constraint**: The "no new code, no new logic" directive from the user means we can't add new middleware configuration patterns or fallbacks.
+3. **Existing rate limiter exists but is unused**: `_shared/rate-limiter.ts` already provides `withRateLimit()` — it just isn't wired in.
+
+## Follow-up Tasks
+
+1. Verify REDIS_URL is configured in Supabase Edge Function settings (dashboard or CLI)
+2. Wire `withRateLimit()` into enrich `/person` (weight 1 per request)
+3. Wire `withRateLimit()` into enrich `/person/bulk` (weight = contact count)
+4. Wire `withRateLimit()` into export-contacts `/:type` (weight 1 per request)
+5. Add graceful fallback when Redis is unavailable
+6. Test rate limit triggers at quota thresholds
+
+## Risk
+
+Without rate limiting, an authenticated user could:
+- Trigger unlimited enrichment API calls (credit-burning)
+- Generate unlimited export jobs (Google API quota)
+- Exhaust edge function concurrency
+
+This is a known regression from the backend (which had per-endpoint `rateLimit({windowMs: 15*60*1000, max: 100})` middleware).

backend/src/app.ts

@@ -17,8 +17,6 @@ import notFound from './middleware/notFound';
 import initializeSentry from './middleware/sentry';
 import initializeAuthRoutes from './routes/auth.routes';
 import initializeContactsRoutes from './routes/contacts.routes';
-import initializeEnrichmentRoutes from './routes/enrichment.routes';
-import initializeImapRoutes from './routes/imap.routes';
 import initializeMiningRoutes from './routes/mining.routes';
 import initializeSmtpSendersRoutes from './routes/smtp-senders.routes';
 import initializeStreamRouter from './routes/stream.routes';
@@ -65,7 +63,6 @@ export default function initializeApp(
   );
 
   app.use('/api/auth', initializeAuthRoutes());
-  app.use('/api/imap', initializeImapRoutes(authResolver, miningSourceService));
   app.use('/api/imap', initializeStreamRouter(miningEngine, authResolver));
   app.use(
     '/api/imap',
@@ -81,7 +78,6 @@ export default function initializeApp(
     '/api',
     initializeContactsRoutes(contacts, authResolver, miningSourceService)
   );
-  app.use('/api/enrich', initializeEnrichmentRoutes(authResolver));
   app.use(
     '/api',
     initializeSmtpSendersRoutes(smtpSenders, authResolver, miningSources)

backend/src/controllers/contacts.controller.ts

@@ -1,275 +1,3 @@
-import { User } from '@supabase/supabase-js';
-import { NextFunction, Request, Response } from 'express';
-import { Contacts } from '../db/interfaces/Contacts';
-import { Contact, ExportService } from '../db/types';
-import Billing from '../utils/billing-plugin';
-import { ExportOptions, ExportType } from '../services/export/types';
-import ExportFactory from '../services/export';
-import {
-  MiningSources,
-  OAuthMiningSourceCredentials
-} from '../db/interfaces/MiningSources';
-
-async function validateRequest(
-  req: Request,
-  res: Response,
-  miningSourceService: MiningSources
-) {
-  const user = res.locals.user as User;
-  const partialExport = req.body.partialExport ?? false;
-  const updateEmptyFieldsOnly = req.body.updateEmptyFieldsOnly ?? false;
-  const exportType = (req.params.exportType ?? ExportType.CSV) as ExportType;
-
-  const localeFromHeader = req.headers['accept-language'];
-  const delimiterOption = req.query.delimiter?.toString();
-
-  const validExportType = Object.values(ExportType).includes(
-    exportType as ExportType
-  );
-
-  if (!validExportType) {
-    throw new Error(`Invalid export type: ${exportType}`);
-  }
-
-  let googleContactsOptions: ExportOptions['googleContactsOptions'] = {
-    userId: user.id,
-    accessToken: undefined,
-    refreshToken: undefined,
-    updateEmptyFieldsOnly
-  };
-
-  if (exportType === ExportType.GOOGLE_CONTACTS) {
-    const targetEmail = req.body.targetEmail || user.email;
-    const sources = await miningSourceService.getSourcesForUser(
-      user.id,
-      targetEmail as string
-    );
-    const oauthCredentials = sources?.find((e) => e.email === targetEmail)
-      ?.credentials as OAuthMiningSourceCredentials;
-
-    googleContactsOptions = {
-      ...googleContactsOptions,
-      accessToken: oauthCredentials?.accessToken,
-      refreshToken: oauthCredentials?.refreshToken
-    };
-  }
-
-  const {
-    ids,
-    exportAllContacts
-  }: { ids?: string[]; exportAllContacts: boolean } = req.body;
-
-  if (!exportAllContacts && (!Array.isArray(ids) || !ids.length)) {
-    return {
-      userId: user.id,
-      exportType,
-      contactsToExport: null,
-      partialExport,
-      exportOptions: {
-        locale: localeFromHeader,
-        delimiter: undefined,
-        googleContactsOptions
-      }
-    };
-  }
-
-  const contactsToExport = exportAllContacts ? undefined : ids;
-
-  return {
-    userId: user.id,
-    exportType,
-    contactsToExport,
-    partialExport,
-    exportOptions: {
-      locale: localeFromHeader,
-      delimiter: delimiterOption,
-      googleContactsOptions
-    }
-  };
-}
-
-async function respondWithContacts(
-  res: Response,
-  userId: string,
-  contacts: Contacts,
-  exportType: ExportType,
-  contactsToExport?: string[],
-  exportOption?: ExportOptions
-) {
-  const selectedContacts = await contacts.getContacts(userId, contactsToExport);
-
-  if (!selectedContacts.length) {
-    return res.sendStatus(204); // 204 No Content
-  }
-
-  try {
-    const { content, contentType } = await ExportFactory.get(exportType).export(
-      selectedContacts,
-      exportOption
-    );
-
-    return res.header('Content-Type', contentType).status(200).send(content);
-  } catch (err) {
-    if ((err as Error).message === 'Invalid credentials.') {
-      return res.sendStatus(401);
-    }
-    throw err;
-  }
-}
-
-async function verifyCredits(
-  userId: string,
-  contacts: Contacts,
-  contactsToExport?: string[]
-) {
-  const newContacts = await contacts.getNonExportedContacts(
-    userId,
-    contactsToExport
-  );
-  const previousExportedContacts = await contacts.getExportedContacts(
-    userId,
-    contactsToExport
-  );
-  const creditsInfo = await Billing!.validateCustomerCredits(
-    userId,
-    newContacts.length
-  );
-  const response = {
-    total: newContacts.length + previousExportedContacts.length,
-    available: Math.floor(creditsInfo.availableUnits),
-    availableAlready: previousExportedContacts.length
-  };
-  return {
-    newContacts,
-    previousExportedContacts,
-    creditsInfo,
-    response
-  };
-}
-
-async function registerAndDeductCredits(
-  userId: string,
-  exportType: ExportType,
-  availableUnits: number,
-  contacts: Contacts,
-  availableContacts: Contact[]
-) {
-  if (availableContacts.length) {
-    await contacts.registerExportedContacts(
-      availableContacts.map(({ id }) => id),
-      exportType as unknown as ExportService,
-      userId
-    );
-    await Billing!.deductCustomerCredits(userId, availableUnits);
-  }
-}
-
-async function respondWithConfirmedContacts(
-  res: Response,
-  userId: string,
-  exportType: ExportType,
-  contacts: Contacts,
-  newContacts: Contact[],
-  previousExportedContacts: Contact[],
-  availableUnits: number,
-  statusCode: number,
-  exportOptions?: ExportOptions
-) {
-  const availableContacts = newContacts.slice(0, availableUnits);
-  const selectedContacts = [...previousExportedContacts, ...availableContacts];
-
-  try {
-    const { content, contentType } = await ExportFactory.get(exportType).export(
-      selectedContacts,
-      exportOptions
-    );
-
-    await registerAndDeductCredits(
-      userId,
-      exportType,
-      availableUnits,
-      contacts,
-      selectedContacts
-    );
-
-    return res
-      .header('Content-Type', contentType)
-      .status(statusCode)
-      .send(content);
-  } catch (err) {
-    if ((err as Error).message === 'Invalid credentials.') {
-      return res.sendStatus(401);
-    }
-    throw err;
-  }
-}
-
-export default function initializeContactsController(
-  contacts: Contacts,
-  miningSources: MiningSources
-) {
-  return {
-    async exportContactsCSV(req: Request, res: Response, next: NextFunction) {
-      const {
-        userId,
-        contactsToExport,
-        partialExport,
-        exportType,
-        exportOptions
-      } = await validateRequest(req, res, miningSources);
-      if (contactsToExport === null) {
-        return res.status(400).json({
-          message: 'Parameter "ids" must be a non-empty list of person ids'
-        });
-      }
-
-      let statusCode = 200;
-      try {
-        if (!Billing) {
-          // No need to Verify Credits, Export.
-          return await respondWithContacts(
-            res,
-            userId,
-            contacts,
-            exportType,
-            contactsToExport,
-            exportOptions
-          );
-        }
-
-        const { newContacts, previousExportedContacts, creditsInfo, response } =
-          await verifyCredits(userId, contacts, contactsToExport);
-
-        if (
-          creditsInfo.hasDeficientCredits &&
-          !previousExportedContacts.length
-        ) {
-          return res.status(402).json(response);
-        }
-
-        if (creditsInfo.hasInsufficientCredits && newContacts.length) {
-          if (!partialExport) {
-            res.statusMessage = 'Confirm Partial Content';
-            return res.status(266).json(response); // 266 Confirm Partial Content
-          }
-          statusCode = 206; // 206 Partial Content
-        }
-
-        // Export confirmed contacts.
-        return await respondWithConfirmedContacts(
-          res,
-          userId,
-          exportType,
-          contacts,
-          newContacts,
-          previousExportedContacts,
-          creditsInfo.availableUnits,
-          statusCode,
-          exportOptions
-        );
-      } catch (error) {
-        return next(error);
-      }
-    }
-  };
+export default function initializeContactsController() {
+  return {};
 }