fix: harden auth and investment synchronization

Resolve A01-A10 and C01-C07 from the backend audit.
Preserve auth failures, forced candle reconciliation and forecast freshness.
Validate MOEX responses and nested HTTP errors; remove unused legacy paths.

Verified: 209 unit tests, 262 SQLite e2e tests on Linux, OpenAPI and durability.
Record the remaining macOS native SQLite abort in the audit.

src/integrations/tbank/tbank-access.service.spec.ts

@@ -1,162 +0,0 @@
-import {
-  BadRequestException,
-  ConflictException,
-  NotFoundException,
-  ServiceUnavailableException,
-} from '@nestjs/common';
-
-jest.mock('../../prisma/prisma.service', () => ({
-  PrismaService: class PrismaService {},
-}));
-
-import type { TbankAccountContext } from './tbank-access.service';
-import { TbankAccessService } from './tbank-access.service';
-import { TbankTokenService } from './tbank-token.service';
-
-describe('TbankAccessService', () => {
-  const prisma = { tbankConnection: { findUnique: jest.fn() } };
-  const token = {
-    decrypt: jest.fn(),
-    translateInvalidToken: jest.fn((operation: () => Promise<unknown>) =>
-      new TbankTokenService({
-        getOrThrow: () => 'MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=',
-      } as never).translateInvalidToken(operation),
-    ),
-  };
-  const tbank = { getOpenAccounts: jest.fn() };
-  const service = new TbankAccessService(
-    prisma as never,
-    token as never,
-    tbank as never,
-  );
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    prisma.tbankConnection.findUnique.mockResolvedValue({
-      encryptedToken: 'encrypted',
-    });
-    token.decrypt.mockReturnValue('plain-token');
-    tbank.getOpenAccounts.mockResolvedValue([
-      {
-        id: 'account',
-        type: 'ACCOUNT_TYPE_TINKOFF',
-        name: ' Основной ',
-        openedDate: { seconds: '1723507200' },
-      },
-      { id: 'debit', type: 'ACCOUNT_TYPE_DEBIT', name: 'Debit' },
-    ]);
-  });
-
-  it('lists supported accounts through the saved decrypted token', async () => {
-    await expect(service.listSupportedAccounts('user')).resolves.toEqual([
-      {
-        id: 'account',
-        type: 'BROKERAGE',
-        name: 'Основной',
-        openedOn: '2024-08-13',
-      },
-    ]);
-
-    expect(prisma.tbankConnection.findUnique).toHaveBeenCalledWith({
-      where: { userId: 'user' },
-    });
-    expect(token.decrypt).toHaveBeenCalledWith('encrypted');
-    expect(tbank.getOpenAccounts).toHaveBeenCalledWith('plain-token');
-  });
-
-  it('rejects missing connections before calling T-Bank', async () => {
-    prisma.tbankConnection.findUnique.mockResolvedValue(null);
-
-    await expect(service.listSupportedAccounts('user')).rejects.toEqual(
-      expect.any(ConflictException),
-    );
-    expect(tbank.getOpenAccounts).not.toHaveBeenCalled();
-  });
-
-  it('resolves the persisted connection generation without an upstream account call', async () => {
-    const context = await service.withConnection('user', (value) => value);
-
-    expect(context).toEqual({
-      token: 'plain-token',
-      generation: expect.any(String) as string,
-    });
-    expect(tbank.getOpenAccounts).not.toHaveBeenCalled();
-  });
-
-  it('translates invalid tokens and preserves unavailable upstream errors', async () => {
-    tbank.getOpenAccounts.mockRejectedValueOnce(
-      new Error('INVALID_TBANK_TOKEN'),
-    );
-    await expect(service.listSupportedAccounts('user')).rejects.toEqual(
-      expect.any(BadRequestException),
-    );
-
-    const unavailable = new ServiceUnavailableException({
-      code: 'TBANK_UNAVAILABLE',
-    });
-    tbank.getOpenAccounts.mockRejectedValueOnce(unavailable);
-    await expect(service.listSupportedAccounts('user')).rejects.toBe(
-      unavailable,
-    );
-  });
-
-  it('wraps account-scoped handlers with resolved account access', async () => {
-    const handler = jest.fn((context: TbankAccountContext) =>
-      Promise.resolve({
-        resolvedToken: context.token,
-        generation: context.generation,
-        accountId: context.account.id,
-      }),
-    );
-
-    await expect(
-      service.withAccount('user', 'account', handler),
-    ).resolves.toEqual({
-      resolvedToken: 'plain-token',
-      generation: expect.any(String) as string,
-      accountId: 'account',
-    });
-  });
-
-  it('derives a stable opaque generation from each persisted encrypted payload', async () => {
-    const generation = () =>
-      service.withAccount('user', 'account', ({ generation: value }) =>
-        Promise.resolve(value),
-      );
-    prisma.tbankConnection.findUnique
-      .mockResolvedValueOnce({ encryptedToken: 'encrypted:first-nonce' })
-      .mockResolvedValueOnce({ encryptedToken: 'encrypted:first-nonce' })
-      .mockResolvedValueOnce({ encryptedToken: 'encrypted:second-nonce' });
-
-    const first = await generation();
-    const sameRecord = await generation();
-    const replaced = await generation();
-
-    expect(sameRecord).toBe(first);
-    expect(replaced).not.toBe(first);
-    expect(first).not.toContain('plain-token');
-    expect(first).not.toContain('encrypted:first-nonce');
-  });
-
-  it('rejects inaccessible accounts before running the handler', async () => {
-    const handler = jest.fn();
-
-    await expect(
-      service.withAccount('user', 'missing', handler),
-    ).rejects.toEqual(expect.any(NotFoundException));
-    expect(handler).not.toHaveBeenCalled();
-  });
-
-  it('translates invalid-token handler failures and preserves unrelated handler failures', async () => {
-    await expect(
-      service.withAccount('user', 'account', () =>
-        Promise.reject(new Error('INVALID_TBANK_TOKEN')),
-      ),
-    ).rejects.toEqual(expect.any(BadRequestException));
-
-    const failure = new Error('source failed');
-    await expect(
-      service.withAccount('user', 'account', () => Promise.reject(failure)),
-    ).rejects.toBe(failure);
-  });
-});

src/integrations/tbank/tbank-access.service.ts

@@ -5,24 +5,11 @@ import {
   Injectable,
   NotFoundException,
 } from '@nestjs/common';
-import { createHash, randomUUID } from 'node:crypto';
+import { randomUUID } from 'node:crypto';
 import { PrismaService } from '../../prisma/prisma.service';
-import {
-  SupportedTbankAccount,
-  accessibleTbankAccount,
-  supportedTbankAccounts,
-} from './tbank-account.policy';
+import { supportedTbankAccounts } from './tbank-account.policy';
 import { TbankTokenService } from './tbank-token.service';
-import { TbankAccount, TbankClient } from './tbank.client';
-
-export type TbankConnectionContext = {
-  token: string;
-  generation: string;
-};
-
-export type TbankAccountContext = TbankConnectionContext & {
-  account: TbankAccount;
-};
+import type { TbankAccount } from './tbank.client';
 
 export type TbankSyncAttempt = {
   userId: string;
@@ -36,7 +23,6 @@ export class TbankAccessService {
   constructor(
     private readonly prisma: PrismaService,
     private readonly tokens: TbankTokenService,
-    private readonly tbank: TbankClient,
   ) {}
 
   async reserveMembership(
@@ -251,81 +237,4 @@ export class TbankAccessService {
       throw new NotFoundException();
     return connection;
   }
-
-  async listSupportedAccounts(
-    userId: string,
-  ): Promise<SupportedTbankAccount[]> {
-    return this.withSupportedAccounts(userId, ({ accounts }) => accounts);
-  }
-
-  async withSupportedAccounts<T>(
-    userId: string,
-    handler: (context: {
-      token: string;
-      generation: string;
-      accounts: SupportedTbankAccount[];
-    }) => Promise<T> | T,
-  ): Promise<T> {
-    return this.withConnection(userId, async ({ token, generation }) =>
-      handler({
-        token,
-        generation,
-        accounts: supportedTbankAccounts(
-          await this.tbank.getOpenAccounts(token),
-        ),
-      }),
-    );
-  }
-
-  async withConnection<T>(
-    userId: string,
-    handler: (context: TbankConnectionContext) => Promise<T> | T,
-  ): Promise<T> {
-    const connection = await this.connection(userId);
-    return this.tokens.translateInvalidToken(async () => handler(connection));
-  }
-
-  async withAccount<T>(
-    userId: string,
-    accountId: string,
-    handler: (context: TbankAccountContext) => Promise<T>,
-  ): Promise<T> {
-    return this.withConnection(userId, (connection) =>
-      this.withAccountForConnection(connection, accountId, handler),
-    );
-  }
-
-  async withAccountForConnection<T>(
-    connection: TbankConnectionContext,
-    accountId: string,
-    handler: (context: TbankAccountContext) => Promise<T>,
-  ): Promise<T> {
-    const { token, generation } = connection;
-    return this.tokens.translateInvalidToken(async () => {
-      const account = accessibleTbankAccount(
-        await this.tbank.getOpenAccounts(token),
-        accountId,
-      );
-      if (!account) throw new NotFoundException();
-      return handler({ token, generation, account });
-    });
-  }
-
-  private async connection(
-    userId: string,
-  ): Promise<{ token: string; generation: string }> {
-    const connection = await this.prisma.tbankConnection.findUnique({
-      where: { userId },
-    });
-    if (!connection)
-      throw new ConflictException({ code: 'TBANK_NOT_CONNECTED' });
-    if (connection.invalidToken)
-      throw new BadRequestException({ code: 'INVALID_TBANK_TOKEN' });
-    return {
-      token: this.tokens.decrypt(connection.encryptedToken),
-      generation: createHash('sha256')
-        .update(connection.encryptedToken)
-        .digest('base64url'),
-    };
-  }
 }

src/integrations/tbank/tbank-account.policy.spec.ts

@@ -1,7 +1,4 @@
-import {
-  accessibleTbankAccount,
-  supportedTbankAccounts,
-} from './tbank-account.policy';
+import { supportedTbankAccounts } from './tbank-account.policy';
 
 describe('tbank-account-policy', () => {
   it('normalizes supported account types and fallback names', () => {
@@ -45,26 +42,4 @@ describe('tbank-account-policy', () => {
       },
     ]);
   });
-
-  it('matches account-scoped access only for supported account types', () => {
-    expect(
-      accessibleTbankAccount(
-        [
-          { id: 'account', type: 'ACCOUNT_TYPE_DEBIT', name: 'Debit' },
-          { id: 'other', type: 'ACCOUNT_TYPE_TINKOFF', name: 'Other' },
-        ],
-        'account',
-      ),
-    ).toBeNull();
-    expect(
-      accessibleTbankAccount(
-        [{ id: 'account', type: 'ACCOUNT_TYPE_TINKOFF', name: 'Brokerage' }],
-        'account',
-      ),
-    ).toEqual({
-      id: 'account',
-      type: 'ACCOUNT_TYPE_TINKOFF',
-      name: 'Brokerage',
-    });
-  });
 });

src/integrations/tbank/tbank-account.policy.ts

@@ -39,17 +39,6 @@ export function supportedTbankAccounts(
   });
 }
 
-export function accessibleTbankAccount(
-  accounts: TbankAccount[],
-  accountId: string,
-): TbankAccount | null {
-  return (
-    accounts.find(
-      (account) => account.id === accountId && account.type in accountTypes,
-    ) ?? null
-  );
-}
-
 function openedOn(seconds: string | number | undefined): string | null {
   if (seconds === undefined) return null;
   const date = new Date(Number(seconds) * MILLISECONDS_PER_SECOND);

src/integrations/tbank/tbank.api.ts

@@ -2,13 +2,14 @@
 export { InstrumentMetadataService } from './instrument-metadata.service';
 export {
   TbankAccessService,
-  type TbankConnectionContext,
+  type TbankSyncAttempt,
 } from './tbank-access.service';
 export {
   type TbankBond,
   type TbankCandle,
   type TbankCoupon,
   type TbankFundamentals,
+  type TbankLastPrice,
   type TbankShare,
 } from './tbank-market.types';
 export { TbankTokenService } from './tbank-token.service';