@blamejs/blamejs-shop 0.4.30 → 0.4.32

package/lib/vendor/blamejs/test/layer-0-primitives/mail-server-jmap.test.js

@@ -149,6 +149,111 @@ async function testNoActorRefused() {
     rv.type === "urn:ietf:params:jmap:error:forbidden");
 }
 
+// ---- Cross-tenant accountId gate (RFC 8620 §3.6.1 accountNotFound) ----
+//
+// accountsFor(actor) is the authorization source; a method call / blob op
+// that names an accountId outside the actor's enumerated set is rejected
+// with `accountNotFound` BEFORE the operator handler runs, so a tenant
+// can't read/write another tenant's account.
+
+async function testDispatchForeignAccountRefused() {
+  var reached = false;
+  var jmap = b.mail.server.jmap.create({
+    mailStore: { appendMessage: function () {} },
+    // Actor A is enumerated for A1 only.
+    accountsFor: async function () { return { primaryAccounts: { core: "A1" }, accounts: { A1: { name: "tenant-a" } } }; },
+    methods: {
+      "Mailbox/get": async function () { reached = true; return { list: [] }; },
+    },
+  });
+  // Tenant A references tenant B's accountId (B9).
+  var rv = await jmap.dispatch({ id: "actor-a", tenantId: "tenant-a" }, {
+    using:       [],
+    methodCalls: [["Mailbox/get", { accountId: "B9" }, "c0"]],
+  });
+  check("foreign accountId → accountNotFound",
+    rv.methodResponses[0][0] === "error" &&
+    rv.methodResponses[0][1].type === "urn:ietf:params:jmap:error:accountNotFound");
+  check("foreign accountId → method handler NOT reached", reached === false);
+  check("response echoes clientId on the gate error",
+    rv.methodResponses[0][2] === "c0");
+}
+
+async function testDispatchOwnAccountAllowed() {
+  var reached = false;
+  var jmap = b.mail.server.jmap.create({
+    mailStore: { appendMessage: function () {} },
+    accountsFor: async function () { return { primaryAccounts: { core: "A1" }, accounts: { A1: { name: "tenant-a" } } }; },
+    methods: {
+      "Mailbox/get": async function (actor, args) { reached = true; return { accountId: args.accountId, list: [] }; },
+    },
+  });
+  var rv = await jmap.dispatch({ id: "actor-a" }, {
+    using:       [],
+    methodCalls: [["Mailbox/get", { accountId: "A1" }, "c0"]],
+  });
+  check("own accountId → handler reached", reached === true);
+  check("own accountId → no error", rv.methodResponses[0][0] === "Mailbox/get");
+}
+
+async function testDispatchAccountAgnosticMethodAllowed() {
+  // A call with no accountId (account-agnostic) passes the gate unchanged.
+  var reached = false;
+  var jmap = b.mail.server.jmap.create({
+    mailStore: { appendMessage: function () {} },
+    accountsFor: async function () { return { primaryAccounts: {}, accounts: {} }; },
+    methods: {
+      "Core/echo": async function (actor, args) { reached = true; return { hi: args.hi }; },
+    },
+  });
+  var rv = await jmap.dispatch({ id: "actor-a" }, {
+    using:       [],
+    methodCalls: [["Core/echo", { hi: 7 }, "c0"]],
+  });
+  check("account-agnostic method → handler reached", reached === true);
+  check("account-agnostic method → result returned", rv.methodResponses[0][1].hi === 7);
+}
+
+async function testUploadForeignAccountRefused() {
+  var backendHit = false;
+  var jmap = b.mail.server.jmap.create({
+    mailStore: {
+      appendMessage: function () {},
+      uploadBlob: function () { backendHit = true; return Promise.resolve({ blobId: "x" }); },
+    },
+    accountsFor: async function () { return { accounts: { A1: { name: "tenant-a" } } }; },
+    methods: {},
+  });
+  // Upload targeting tenant B's accountId (B9).
+  var mr = _makeUploadReqRes("/jmap/upload/B9", "text/plain", [Buffer.from("hi")]);
+  jmap.uploadHandler(mr.req, mr.res);
+  await new Promise(function (r) { setImmediate(function () { setImmediate(r); }); });
+  await new Promise(function (r) { setImmediate(r); });
+  check("upload foreign accountId → 404",            mr.res._status() === 404);
+  check("upload foreign accountId → accountNotFound", /jmap:error:accountNotFound/.test(mr.res._buf()));
+  check("upload foreign accountId → backend NOT hit", backendHit === false);
+}
+
+async function testDownloadForeignAccountRefused() {
+  var backendHit = false;
+  var jmap = b.mail.server.jmap.create({
+    mailStore: {
+      appendMessage: function () {},
+      downloadBlob: function () { backendHit = true; return Promise.resolve({ bytes: Buffer.from("x"), type: "text/plain" }); },
+    },
+    accountsFor: async function () { return { accounts: { A1: { name: "tenant-a" } } }; },
+    methods: {},
+  });
+  // Download targeting tenant B's accountId (B9).
+  var mr = _makeUploadReqRes("/jmap/download/B9/blob_42/note.txt", null, []);
+  jmap.downloadHandler(mr.req, mr.res);
+  await new Promise(function (r) { setImmediate(function () { setImmediate(r); }); });
+  await new Promise(function (r) { setImmediate(r); });
+  check("download foreign accountId → 404",            mr.res._status() === 404);
+  check("download foreign accountId → accountNotFound", /jmap:error:accountNotFound/.test(mr.res._buf()));
+  check("download foreign accountId → backend NOT hit", backendHit === false);
+}
+
 // ---- v0.11.29 — JMAP Push (EventSource SSE per RFC 8620 §7.3) ----
 
 function _makeMockReqRes(url) {
@@ -366,7 +471,7 @@ async function testUploadHandlerHappyPath() {
         return Promise.resolve({ blobId: "blob_42", type: type, size: bytes.length });
       },
     },
-    accountsFor: async function () { return {}; },
+    accountsFor: async function () { return { accounts: { A1: { name: "x" } } }; },
     methods: {},
   });
   var body = Buffer.from("Hello, blob world.");
@@ -450,7 +555,7 @@ async function testDownloadHandlerHappyPath() {
         return Promise.resolve({ bytes: Buffer.from("hello blob"), type: "text/plain" });
       },
     },
-    accountsFor: async function () { return {}; },
+    accountsFor: async function () { return { accounts: { A1: { name: "x" } } }; },
     methods: {},
   });
   var mr = _makeUploadReqRes("/jmap/download/A1/blob_42/note.txt", null, []);
@@ -498,7 +603,13 @@ async function testJmapIdAcceptsFullLength() {
       uploadBlob: function () { return Promise.resolve({ blobId: "B" }); },
       downloadBlob: function () { return Promise.resolve({ bytes: Buffer.from("x"), type: "text/plain" }); },
     },
-    accountsFor: async function () { return {}; },
+    // The full-length accountId is enumerated for the actor so the gate
+    // permits it; this test exercises the JMAP Id length cap, not authz.
+    accountsFor: async function () {
+      var id = "A".repeat(200);                                                                       // allow:raw-byte-literal — 200 chars, under RFC 8620 §1.2 255 cap
+      var accts = {}; accts[id] = { name: "x" };
+      return { accounts: accts };
+    },
     methods: {},
   });
   var longId = "A".repeat(200);                                                                       // allow:raw-byte-literal — 200 chars, under RFC 8620 §1.2 255 cap
@@ -524,13 +635,15 @@ async function testDownloadHandlerNotFound() {
       appendMessage: function () {},
       downloadBlob: function () { return Promise.resolve(null); },
     },
-    accountsFor: async function () { return {}; },
+    accountsFor: async function () { return { accounts: { A1: { name: "x" } } }; },
     methods: {},
   });
   var mr = _makeUploadReqRes("/jmap/download/A1/missing/note.txt", null, []);
   jmap.downloadHandler(mr.req, mr.res);
   await new Promise(function (r) { setImmediate(function () { setImmediate(r); }); });
   check("download missing → 404",                  mr.res._status() === 404);
+  check("download missing → blob-not-found (not account gate)",
+        /Blob not found/.test(mr.res._buf()));
 }
 
 function testDownloadHandlerRefusesUnauth() {
@@ -597,6 +710,12 @@ async function run() {
   await testUnknownMethod();
   await testMethodThrewMaskedAsServerFail();
   await testNoActorRefused();
+  // Cross-tenant accountId gate (RFC 8620 §3.6.1 accountNotFound)
+  await testDispatchForeignAccountRefused();
+  await testDispatchOwnAccountAllowed();
+  await testDispatchAccountAgnosticMethodAllowed();
+  await testUploadForeignAccountRefused();
+  await testDownloadForeignAccountRefused();
   // v0.11.29 — JMAP Push (EventSource SSE per RFC 8620 §7.3)
   testEventSourceHandlerExists();
   testEventSourceRefusesUnauthenticated();

package/lib/vendor/blamejs/test/layer-0-primitives/mail-server-mx.test.js

@@ -135,12 +135,17 @@ async function _sendCommand(socket, line) {
         var last = lines[lines.length - 1];
         if (/^\d{3} /.test(last)) {
           socket.removeListener("data", onData);
+          socket.removeListener("error", onError);
           resolve(buf);
         }
       }
     }
+    // Detach on settle — a long transaction issues a dozen commands on
+    // one socket, and never-fired once("error") handlers accumulate
+    // past the MaxListeners warning threshold.
+    function onError(e) { socket.removeListener("data", onData); reject(e); }
     socket.on("data", onData);
-    socket.once("error", reject);
+    socket.once("error", onError);
     socket.write(line + "\r\n");
   });
 }
@@ -152,11 +157,13 @@ async function _readGreeting(socket) {
       buf += chunk.toString("utf8");
       if (buf.indexOf("\r\n") !== -1) {
         socket.removeListener("data", onData);
+        socket.removeListener("error", onError);
         resolve(buf);
       }
     }
+    function onError(e) { socket.removeListener("data", onData); reject(e); }
     socket.on("data", onData);
-    socket.once("error", reject);
+    socket.once("error", onError);
   });
 }
 
@@ -426,6 +433,203 @@ async function testGateOverStartTls() {
   } finally { await srv.close({ timeoutMs: 1000 }); }                                 // allow:raw-time-literal — test-only short drain
 }
 
+// DATA-phase SPF/DKIM/DMARC gate (opts.guardEnvelope → b.mail.inbound
+// .verify). Drives full SMTP transactions against a mocked DNS: the
+// policy-reject path answers 550 5.7.1 before the agent handoff, the
+// aligned path delivers with the verdict on the handoff ctx + the
+// RFC 8601 Authentication-Results header prepended, quarantine
+// delivers annotated, monitor mode never refuses, and DNS temperror
+// defers (451) or accepts per onTemperror.
+async function testGuardEnvelopeGate() {
+  var ctx;
+  try { ctx = await _makeTestTlsContext(); }
+  catch (_e) { check("guardEnvelope gate (skipped — test cert fixture unavailable)", true); return; }
+  var records = {
+    "external.com/TXT":         [["v=spf1 ip4:127.0.0.1 -all"]],
+    "_dmarc.external.com/TXT":  [["v=DMARC1; p=reject"]],
+    "spoof.example/TXT":        [["v=spf1 -all"]],
+    "_dmarc.spoof.example/TXT": [["v=DMARC1; p=reject"]],
+    "spoofq.example/TXT":        [["v=spf1 -all"]],
+    "_dmarc.spoofq.example/TXT": [["v=DMARC1; p=quarantine"]],
+  };
+  var dnsLookup = async function (host, type) {
+    if (records[host + "/" + type]) return records[host + "/" + type];
+    var err = new Error("ENOTFOUND"); err.code = "ENOTFOUND"; throw err;
+  };
+  async function _transact(socket, mailFrom, body) {
+    await _sendCommand(socket, "MAIL FROM:<" + mailFrom + ">");
+    await _sendCommand(socket, "RCPT TO:<alice@example.com>");
+    await _sendCommand(socket, "DATA");
+    return _sendCommand(socket, body + "\r\n.");
+  }
+
+  // Boot-time validation of the gate config.
+  var eBad = null;
+  try {
+    b.mail.server.mx.create({ tlsContext: ctx, guardEnvelope: "yes" });
+  } catch (e) { eBad = e; }
+  check("guardEnvelope: non-boolean/object config refused at boot", eBad !== null);
+  var eMode = null;
+  try {
+    b.mail.server.mx.create({ tlsContext: ctx, guardEnvelope: { mode: "loud" } });
+  } catch (e) { eMode = e; }
+  check("guardEnvelope: unknown mode refused at boot", eMode !== null);
+  // DKIM verifier ranges are mirrored at boot — a config the verifier
+  // would refuse per-message must fail startup, not break live SMTP.
+  var eSigs = null;
+  try {
+    b.mail.server.mx.create({ tlsContext: ctx, guardEnvelope: { maxSignatures: 100 } });
+  } catch (e) { eSigs = e; }
+  check("guardEnvelope: maxSignatures above the DKIM verifier ceiling refused at boot",
+        eSigs !== null && /bad-bound/.test(eSigs.code || ""));
+  var eSkew = null;
+  try {
+    b.mail.server.mx.create({ tlsContext: ctx,
+      guardEnvelope: { clockSkewMs: b.mail.dkim.DKIM_CLOCK_SKEW_MS_MAX + 1 } });
+  } catch (e) { eSkew = e; }
+  check("guardEnvelope: clockSkewMs above the DKIM verifier ceiling refused at boot",
+        eSkew !== null && /bad-bound/.test(eSkew.code || ""));
+
+  // ---- enforce mode ----
+  var handoffs = [];
+  var srv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    guardEnvelope: { mode: "enforce", dnsLookup: dnsLookup },
+    agent: { handoff: async function (h) { handoffs.push(h); return { messageId: "m" + handoffs.length }; } },
+  });
+  var info = await srv.listen({ port: 0, address: "127.0.0.1" });
+  try {
+    var sock = nodeNet.connect(info.port, "127.0.0.1");
+    await new Promise(function (r) { sock.once("connect", r); });
+    await _readGreeting(sock);
+    await _sendCommand(sock, "EHLO sender.example.com");
+
+    // Policy reject: SPF fail against p=reject → refused at the wire
+    // with the RFC 7372 multiple-authentication-checks-failed code.
+    var rej = await _transact(sock, "ceo@spoof.example",
+      "From: ceo@spoof.example\r\nSubject: urgent\r\n\r\npay this invoice\r\n");
+    check("guardEnvelope enforce: DMARC p=reject + SPF fail → 550 5.7.26 (RFC 7372)", /^550 5\.7\.26/.test(rej));
+    check("guardEnvelope enforce: refused message never reaches the agent", handoffs.length === 0);
+
+    // Multi-From spoofing shape → refused.
+    var multi = await _transact(sock, "s@external.com",
+      "From: s@external.com\r\nFrom: ceo@spoof.example\r\nSubject: x\r\n\r\nbody\r\n");
+    check("guardEnvelope enforce: duplicated From → 550 5.7.1 (RFC 7489 §6.6.1)",
+      /^550 5\.7\.1/.test(multi) && handoffs.length === 0);
+
+    // Aligned pass: delivered with verdict + A-R header. The message
+    // arrives with a FORGED Authentication-Results header claiming
+    // this receiver's authserv-id — RFC 8601 §5 requires it stripped
+    // before the computed one is prepended.
+    var ok = await _transact(sock, "s@external.com",
+      "Authentication-Results: example.com;\r\n  dkim=pass header.d=forged.example\r\n" +
+      "From: s@external.com\r\nSubject: hi\r\n\r\nhello\r\n");
+    check("guardEnvelope enforce: aligned SPF pass → 250 accepted", /^250 /.test(ok));
+    check("guardEnvelope: handoff carries the auth verdict",
+      handoffs.length === 1 && handoffs[0].auth &&
+      handoffs[0].auth.action === "accept" &&
+      handoffs[0].auth.spf.result === "pass" &&
+      handoffs[0].auth.dmarc.result === "pass" &&
+      handoffs[0].auth.quarantine === false);
+    var delivered = handoffs.length === 1 ? handoffs[0].body.toString("utf8") : "";
+    check("guardEnvelope: A-R header prepended with the localDomains authserv-id",
+      delivered.indexOf("Authentication-Results: example.com") === 0 &&
+      /spf=pass/.test(delivered) && /dmarc=pass/.test(delivered));
+    check("guardEnvelope: forged same-authserv-id A-R header stripped (RFC 8601 §5)",
+      delivered.indexOf("forged.example") === -1 &&
+      delivered.split("Authentication-Results: example.com").length === 2);
+    check("guardEnvelope: original message preserved after the A-R header",
+      delivered.indexOf("Subject: hi") !== -1 && delivered.indexOf("hello") !== -1);
+
+    // Quarantine policy: delivered, annotated for the downstream agent.
+    var q = await _transact(sock, "news@spoofq.example",
+      "From: news@spoofq.example\r\nSubject: promo\r\n\r\ndeal\r\n");
+    check("guardEnvelope enforce: p=quarantine → 250 delivered annotated",
+      /^250 /.test(q) && handoffs.length === 2 &&
+      handoffs[1].auth.quarantine === true &&
+      handoffs[1].auth.action === "quarantine");
+    sock.destroy();
+  } finally { await srv.close({ timeoutMs: 1000 }); }                                  // allow:raw-time-literal — test-only short drain
+
+  // ---- monitor mode: same spoof, never refused ----
+  var monHandoffs = [];
+  var monSrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    guardEnvelope: { mode: "monitor", dnsLookup: dnsLookup },
+    agent: { handoff: async function (h) { monHandoffs.push(h); return {}; } },
+  });
+  var monInfo = await monSrv.listen({ port: 0, address: "127.0.0.1" });
+  try {
+    var monSock = nodeNet.connect(monInfo.port, "127.0.0.1");
+    await new Promise(function (r) { monSock.once("connect", r); });
+    await _readGreeting(monSock);
+    await _sendCommand(monSock, "EHLO sender.example.com");
+    var monRej = await _transact(monSock, "ceo@spoof.example",
+      "From: ceo@spoof.example\r\nSubject: urgent\r\n\r\npay\r\n");
+    check("guardEnvelope monitor: policy-reject message still delivered",
+      /^250 /.test(monRej) && monHandoffs.length === 1 &&
+      monHandoffs[0].auth.action === "reject" &&
+      monHandoffs[0].auth.mode === "monitor");
+    monSock.destroy();
+  } finally { await monSrv.close({ timeoutMs: 1000 }); }                               // allow:raw-time-literal — test-only short drain
+
+  // ---- DNS temperror: defer (default) vs accept ----
+  var servfail = async function () { throw new Error("SERVFAIL"); };
+  var deferSrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    guardEnvelope: { mode: "enforce", dnsLookup: servfail },
+  });
+  var deferInfo = await deferSrv.listen({ port: 0, address: "127.0.0.1" });
+  try {
+    var dSock = nodeNet.connect(deferInfo.port, "127.0.0.1");
+    await new Promise(function (r) { dSock.once("connect", r); });
+    await _readGreeting(dSock);
+    await _sendCommand(dSock, "EHLO sender.example.com");
+    var deferred = await _transact(dSock, "s@external.com",
+      "From: s@external.com\r\nSubject: hi\r\n\r\nhello\r\n");
+    check("guardEnvelope: DNS temperror defers with 451 4.7.0 (sender retries)",
+      /^451 4\.7\.0/.test(deferred));
+    dSock.destroy();
+  } finally { await deferSrv.close({ timeoutMs: 1000 }); }                             // allow:raw-time-literal — test-only short drain
+
+  // ---- pipeline wall-clock timeout: a hanging resolver cannot pin
+  // the connection slot — the race defers on the temperror path ----
+  var hangForever = function () { return new Promise(function () {}); };
+  var timeoutSrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    guardEnvelope: { mode: "enforce", dnsLookup: hangForever, timeoutMs: 250 },        // allow:raw-time-literal — test-only short budget
+  });
+  var timeoutInfo = await timeoutSrv.listen({ port: 0, address: "127.0.0.1" });
+  try {
+    var tSock = nodeNet.connect(timeoutInfo.port, "127.0.0.1");
+    await new Promise(function (r) { tSock.once("connect", r); });
+    await _readGreeting(tSock);
+    await _sendCommand(tSock, "EHLO sender.example.com");
+    var timedOut = await _transact(tSock, "s@external.com",
+      "From: s@external.com\r\nSubject: hi\r\n\r\nhello\r\n");
+    check("guardEnvelope: hanging resolver hits timeoutMs → 451 4.7.0",
+      /^451 4\.7\.0/.test(timedOut));
+    tSock.destroy();
+  } finally { await timeoutSrv.close({ timeoutMs: 1000 }); }                           // allow:raw-time-literal — test-only short drain
+
+  var acceptSrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    guardEnvelope: { mode: "enforce", onTemperror: "accept", dnsLookup: servfail },
+  });
+  var acceptInfo = await acceptSrv.listen({ port: 0, address: "127.0.0.1" });
+  try {
+    var aSock = nodeNet.connect(acceptInfo.port, "127.0.0.1");
+    await new Promise(function (r) { aSock.once("connect", r); });
+    await _readGreeting(aSock);
+    await _sendCommand(aSock, "EHLO sender.example.com");
+    var accepted = await _transact(aSock, "s@external.com",
+      "From: s@external.com\r\nSubject: hi\r\n\r\nhello\r\n");
+    check("guardEnvelope: onTemperror accept admits when DNS is down",
+      /^250 /.test(accepted));
+    aSock.destroy();
+  } finally { await acceptSrv.close({ timeoutMs: 1000 }); }                            // allow:raw-time-literal — test-only short drain
+}
+
 async function run() {
   testSurface();
   testCreateRequiresTlsContext();
@@ -438,6 +642,7 @@ async function run() {
   await testStrictProfileRequiresStartTls();
   await testConnectionGates();
   await testGateOverStartTls();
+  await testGuardEnvelopeGate();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/mail-store.test.js

@@ -291,6 +291,78 @@ async function testMoveMessages() {
   } finally { _teardown(fx); }
 }
 
+async function testSearch() {
+  var fx = await _setupStore("search");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    var m1 = store.appendMessage("INBOX",
+      _msg(["From: alice@example.com", "To: bob@example.com",
+            "Subject: Kubernetes deploy notes", "Message-Id: <s1@x>"],
+           "the kubernetes cluster is healthy"));
+    var m2 = store.appendMessage("INBOX",
+      _msg(["From: carol@example.com", "To: bob@example.com",
+            "Subject: Lunch plans", "Message-Id: <s2@x>"],
+           "want to grab lunch tomorrow"));
+
+    // Body/subject text MATCH (FTS5 IN-subquery via whereMatch).
+    var r1 = store.search("INBOX", { text: "kubernetes" });
+    check("search: text=kubernetes hits only m1",
+          r1.rows.length === 1 && r1.rows[0].objectid === m1.objectid && !!r1.matchExpr);
+
+    // Subject-only column MATCH.
+    var r2 = store.search("INBOX", { subject: "lunch" });
+    check("search: subject=lunch hits only m2",
+          r2.rows.length === 1 && r2.rows[0].objectid === m2.objectid);
+
+    // Address column MATCH (from/to share addr_toks).
+    var r3 = store.search("INBOX", { from: "alice@example.com" });
+    check("search: from=alice hits only m1",
+          r3.rows.length === 1 && r3.rows[0].objectid === m1.objectid);
+
+    // No surviving tokens → empty result set, not a fallback.
+    var r4 = store.search("INBOX", { text: "nonexistentterm" });
+    check("search: no-match returns zero rows", r4.rows.length === 0);
+
+    // No text-side filter → falls through to the modseq cursor.
+    var r5 = store.search("INBOX", {});
+    check("search: no-filter falls back to modseq cursor", r5.rows.length === 2);
+  } finally { _teardown(fx); }
+}
+
+async function testHardExpunge() {
+  var fx = await _setupStore("expunge");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    var m1 = store.appendMessage("INBOX",
+      _msg(["From: a@x", "Subject: keep", "Message-Id: <e1@x>"], "keep me"));
+    var m2 = store.appendMessage("INBOX",
+      _msg(["From: a@x", "Subject: drop", "Message-Id: <e2@x>"], "drop me"));
+    var q0 = store.quota("INBOX");
+    check("expunge-pre: 2 messages", q0.usedCount === 2);
+
+    // hardExpunge resolves the candidate set through json_each(?).
+    var ex = store.hardExpunge("INBOX", [m2.objectid]);
+    check("expunge: m2 deleted", ex.deleted.length === 1 && ex.deleted[0] === m2.objectid);
+    check("expunge: nothing refused", ex.refused.length === 0);
+
+    // Row + FTS row + quota all reflect the delete.
+    check("expunge: m2 fetch is null", store.fetchByObjectId("INBOX", m2.objectid) === null);
+    check("expunge: m1 still present", store.fetchByObjectId("INBOX", m1.objectid) !== null);
+    check("expunge: FTS no longer matches m2",
+          store.search("INBOX", { subject: "drop" }).rows.length === 0);
+    var q1 = store.quota("INBOX");
+    check("expunge: quota decremented to 1", q1.usedCount === 1);
+
+    // A legal-held message is refused, not deleted.
+    store.setLegalHold([m1.objectid], { hold: true });
+    var ex2 = store.hardExpunge("INBOX", [m1.objectid]);
+    check("expunge: legal-held refused",
+          ex2.deleted.length === 0 && ex2.refused.length === 1 &&
+          ex2.refused[0].reason === "legal-hold");
+    check("expunge: held m1 still present", store.fetchByObjectId("INBOX", m1.objectid) !== null);
+  } finally { _teardown(fx); }
+}
+
 async function testRefusesBadBackend() {
   var threw = null;
   try { b.mailStore.create({ backend: {} }); }
@@ -312,6 +384,8 @@ async function run() {
   await testRefusesBadInput();
   await testCustomFolder();
   await testMoveMessages();
+  await testSearch();
+  await testHardExpunge();
   await testRefusesBadBackend();
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/oauth-callback.test.js

@@ -455,6 +455,9 @@ async function run() {
   // ---- RFC 9101 + RFC 9126 §3 — PAR with a signed request object ----
   await _testParRequestObject();
   await _testParPlainUnchanged();
+
+  // ---- OIDC Back-Channel Logout — bounded token + header parse ----
+  await _testBackchannelLogoutOversized();
 }
 
 // PAR carrying a signed request object: the form body MUST hold `request=`
@@ -481,6 +484,9 @@ async function _testParRequestObject() {
     });
     var rv = await oa.pushAuthorizationRequest({
       signedRequestObject: { key: kp.privateKey, kid: "c1" },
+      authorizationDetails: [
+        { type: "payment_initiation", actions: ["initiate"], locations: ["https://rs.example/pay"] },
+      ],
     });
     check("oauth.PAR+RO: returns a request_uri", rv.requestUri === "urn:ietf:params:oauth:request_uri:abc123");
     check("oauth.PAR+RO: flags requestObjectSent", rv.requestObjectSent === true);
@@ -506,9 +512,46 @@ async function _testParRequestObject() {
       parsed.params.redirect_uri === "https://rp.example/cb" && parsed.params.scope === "openid profile" &&
       parsed.params.code_challenge_method === "S256" && typeof parsed.params.code_challenge === "string");
     check("oauth.PAR+RO: request object aud is the AS issuer", parsed.claims.aud === issuer);
+    // RFC 9101/9396 — authorization_details travels as a JSON ARRAY claim,
+    // not a JSON string (a conforming AS rejects the string-valued claim).
+    check("oauth.PAR+RO: authorization_details is a native array claim",
+      Array.isArray(parsed.params.authorization_details) &&
+      parsed.params.authorization_details.length === 1 &&
+      parsed.params.authorization_details[0].type === "payment_initiation");
   } finally { server.close(); }
 }
 
+// RFC OIDC Back-Channel Logout — the pre-verify header parse + the token
+// split run on an attacker-reachable, not-yet-signature-checked token, so
+// the token must be length-bounded before either.
+async function _testBackchannelLogoutOversized() {
+  var oa = b.auth.oauth.create({
+    issuer:        "https://idp.example",
+    clientId:      "rp-bcl",
+    redirectUri:   "https://rp.example/cb",
+    isOidc:        true,
+    allowHttp:     true,
+    allowInternal: true,
+  });
+  // A logout_token far larger than the response-bytes cap must be refused
+  // BEFORE the split / base64url header decode.
+  var huge = "a".repeat(300000) + ".b.c";
+  var threw = null;
+  try { await oa.verifyBackchannelLogoutToken(huge); }
+  catch (e) { threw = e; }
+  check("oauth.backchannelLogout: oversized token refused before parse",
+    threw && threw.code === "auth-oauth/logout-token-too-large");
+
+  // A well-formed-shape but bogus header still parses through safeJson
+  // (size-bounded) and fails downstream, not with an unbounded-parse crash.
+  var bogusHeader = Buffer.from("{not json", "utf8").toString("base64url");
+  var threw2 = null;
+  try { await oa.verifyBackchannelLogoutToken(bogusHeader + ".payload.sig"); }
+  catch (e) { threw2 = e; }
+  check("oauth.backchannelLogout: malformed header refused (bounded parse)",
+    threw2 && threw2.code === "auth-oauth/bad-logout-header");
+}
+
 // PAR WITHOUT a signed request object: byte-for-byte the prior plain-form
 // behavior — authorization parameters are bare form params, no `request=`.
 async function _testParPlainUnchanged() {