@bobfrankston/rmfmail 1.2.187 → 1.2.190

package/packages/mailx-store/db.ts

@@ -1759,8 +1759,12 @@ export class MailxDB {
      *  During the additive migration we ALSO have to handle the legacy
      *  case where the row's folder_id matches but no message_folders row
      *  was migrated for it (race during initial population, etc.) — we
-     *  fall back to the messages.folder_id check to clean up consistently. */
-    dropFolderMembership(accountId: string, folderId: number, uid: number, folderPath?: string): boolean {
+     *  fall back to the messages.folder_id check to clean up consistently.
+     *
+     *  `reason`/`source` override the audit text — deleteMessage routes user
+     *  deletes through here, and "reconcile: server missing this UID" would
+     *  be a lie in that audit trail. */
+    dropFolderMembership(accountId: string, folderId: number, uid: number, folderPath?: string, reason?: string, source?: string): boolean {
         // First find the messages row this membership pointed at.
         const mf = this.db.prepare(
             "SELECT message_row_id FROM message_folders WHERE folder_id = ? AND uid = ?"
@@ -1809,8 +1813,8 @@ export class MailxDB {
             this.audit({
                 kind: "delete-membership",
                 accountId, folderId, uid,
-                reason: `reconcile dropped folder membership; ${remaining.cnt} other location(s) remain`,
-                source: `dropFolderMembership (${folderPath || ""})`,
+                reason: reason || `reconcile dropped folder membership; ${remaining.cnt} other location(s) remain`,
+                source: source || `dropFolderMembership (${folderPath || ""})`,
             });
             return true;
         }
@@ -1827,8 +1831,8 @@ export class MailxDB {
                 accountId, folderId, uid,
                 messageId: env.message_id || undefined,
                 subject: env.subject || undefined,
-                reason: "reconcile: server missing this UID after grace, no other folder memberships",
-                source: `dropFolderMembership (${folderPath || ""})`,
+                reason: reason || "reconcile: server missing this UID after grace, no other folder memberships",
+                source: source || `dropFolderMembership (${folderPath || ""})`,
             });
             console.log(`  [reconcile-delete] ${accountId} ${folderPath || folderId}/${uid} msgid=${env.message_id || "?"} (no other memberships) — body ${env.body_path || "(none)"}`);
         }
@@ -2505,13 +2509,19 @@ export class MailxDB {
      *  hitting the message in `_Spam` (correct) and hitting nothing
      *  because the legacy messages.folder_id still points at INBOX. */
     getMessageByUid(accountId: string, uid: number, folderId?: number): MessageEnvelope {
+        // Alias mf.folder_id over m.folder_id too — the envelope must carry
+        // the identity of the membership that MATCHED, not the legacy primary
+        // location, or a caller doing delete/move/flag with the returned
+        // folderId operates on a different folder than the one it looked up
+        // (the two drift: local moves keep the original uid, re-binds update
+        // one table but not the other).
         const sql = folderId != null
-            ? `SELECT m.*, mf.uid AS uid
+            ? `SELECT m.*, mf.uid AS uid, mf.folder_id AS folder_id
                FROM messages m
                JOIN message_folders mf ON mf.message_row_id = m.id
                WHERE m.account_id = ? AND mf.uid = ? AND mf.folder_id = ?
                LIMIT 1`
-            : `SELECT m.*, mf.uid AS uid
+            : `SELECT m.*, mf.uid AS uid, mf.folder_id AS folder_id
                FROM messages m
                JOIN message_folders mf ON mf.message_row_id = m.id
                WHERE m.account_id = ? AND mf.uid = ?
@@ -3114,22 +3124,39 @@ export class MailxDB {
      *  Reason is propagated into the audit_log so the DB carries an
      *  authoritative trail of every removal. */
     deleteMessage(accountId: string, folderId: number | null, uid: number, reason?: string, source?: string): void {
-        // Get message_id + subject before deleting so the audit row carries
-        // enough context to identify what was removed.
-        const msg = folderId != null
-            ? this.db.prepare(
-                "SELECT folder_id, message_id, subject FROM messages WHERE account_id = ? AND folder_id = ? AND uid = ?"
-              ).get(accountId, folderId, uid) as any
-            : this.db.prepare(
-                "SELECT folder_id, message_id, subject FROM messages WHERE account_id = ? AND uid = ?"
-              ).get(accountId, uid) as any;
-        const r = folderId != null
-            ? this.db.prepare(
-                "DELETE FROM messages WHERE account_id = ? AND folder_id = ? AND uid = ?"
-              ).run(accountId, folderId, uid)
-            : this.db.prepare(
-                "DELETE FROM messages WHERE account_id = ? AND uid = ?"
-              ).run(accountId, uid);
+        if (folderId != null) {
+            // Resolve through message_folders — the SAME identity that
+            // getMessageByUid and every list query use. The legacy
+            // messages.folder_id/uid columns can drift from the membership
+            // rows (local moves keep the original uid, server re-binds update
+            // one table but not the other), and a delete keyed only on the
+            // legacy columns silently matches ZERO rows on a drifted message:
+            // the membership keeps it visible in the UI and it becomes
+            // undeletable forever (Eleanor 2026-07-29: ElkinWs uid 125482 in
+            // Trash "refuses to delete" — every attempt no-op'd here while
+            // the sync action reported success). dropFolderMembership drops
+            // the membership, orphan-cleans the messages row, and falls back
+            // to the legacy columns for pre-migration rows.
+            const cleaned = this.dropFolderMembership(
+                accountId, folderId, uid, undefined,
+                reason || "deleteMessage (no reason)",
+                source || "db.deleteMessage",
+            );
+            if (!cleaned) {
+                // A delete that deletes nothing is the "refuses to delete"
+                // symptom — never let it pass silently.
+                console.error(`  [delete-miss] ${accountId} folder=${folderId} uid=${uid}: no membership or legacy row matched — nothing deleted (source=${source || "db.deleteMessage"})`);
+            }
+            this.recalcFolderCounts(folderId);
+            return;
+        }
+        // No folderId (legacy callers): fall back to the messages-table key.
+        const msg = this.db.prepare(
+            "SELECT id, folder_id, message_id, subject FROM messages WHERE account_id = ? AND uid = ?"
+        ).get(accountId, uid) as any;
+        const r = this.db.prepare(
+            "DELETE FROM messages WHERE account_id = ? AND uid = ?"
+        ).run(accountId, uid);
         if ((r as any).changes && msg) {
             this.audit({
                 kind: "delete-msg",
@@ -3141,6 +3168,8 @@ export class MailxDB {
                 reason: reason || "deleteMessage (no reason)",
                 source: source || "db.deleteMessage",
             });
+        } else if (!(r as any).changes) {
+            console.error(`  [delete-miss] ${accountId} uid=${uid} (no folderId): no messages row matched — nothing deleted (source=${source || "db.deleteMessage"})`);
         }
         // Refresh folder counts
         if (msg) this.recalcFolderCounts(msg.folder_id);

package/packages/mailx-store/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-store",
-  "version": "0.1.74",
+  "version": "0.1.76",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",

package/packages/mailx-store-web/android-bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"android-bootstrap.d.ts","sourceRoot":"","sources":["android-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAizCH,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAgOjD;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAIhD"}
+{"version":3,"file":"android-bootstrap.d.ts","sourceRoot":"","sources":["android-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAo0CH,wBAAgB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAc3C;AAoOD,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAIhD"}

package/packages/mailx-store-web/android-bootstrap.js

@@ -1020,59 +1020,78 @@ async function refreshAccessToken(refreshToken) {
 }
 // ── Token provider (browser OAuth, same as desktop) ──
 function createNativeTokenProvider(email) {
-    return async () => {
-        // Check cached token first
-        const cached = await getCachedToken(email);
-        if (cached?.access_token) {
-            const expiresAt = cached.expires_at || 0;
-            const bufferMs = 5 * 60 * 1000; // 5 min buffer
-            if (Date.now() < expiresAt - bufferMs) {
-                return cached.access_token;
+    return () => {
+        // C158: single-flight per email. Startup fires several concurrent
+        // token requests (GDrive reconcile, contacts sync, syncAll) — with
+        // no cached token each one launched its OWN browser-consent intent
+        // (three "Starting OAuth flow" in one boot, 2026-07-22 logit trail).
+        // Concurrent callers now share one resolution. Keyed on a window
+        // global, not a module local, because the double-init bug that
+        // exposed this also loads the module twice — two module instances
+        // must still share the guard.
+        const w = window;
+        const inflight = w.__rmfOAuthInflight ||= new Map();
+        const key = canonEmail(email);
+        const existing = inflight.get(key);
+        if (existing)
+            return existing;
+        const p = fetchTokenForEmail(email).finally(() => inflight.delete(key));
+        inflight.set(key, p);
+        return p;
+    };
+}
+async function fetchTokenForEmail(email) {
+    // Check cached token first
+    const cached = await getCachedToken(email);
+    if (cached?.access_token) {
+        const expiresAt = cached.expires_at || 0;
+        const bufferMs = 5 * 60 * 1000; // 5 min buffer
+        if (Date.now() < expiresAt - bufferMs) {
+            return cached.access_token;
+        }
+        // Try refresh
+        if (cached.refresh_token) {
+            try {
+                console.log(`[oauth] Refreshing token for ${email}`);
+                const refreshed = await refreshAccessToken(cached.refresh_token);
+                const token = {
+                    access_token: refreshed.access_token,
+                    refresh_token: cached.refresh_token,
+                    expires_at: Date.now() + refreshed.expires_in * 1000,
+                };
+                await setCachedToken(email, token);
+                return token.access_token;
             }
-            // Try refresh
-            if (cached.refresh_token) {
-                try {
-                    console.log(`[oauth] Refreshing token for ${email}`);
-                    const refreshed = await refreshAccessToken(cached.refresh_token);
-                    const token = {
-                        access_token: refreshed.access_token,
-                        refresh_token: cached.refresh_token,
-                        expires_at: Date.now() + refreshed.expires_in * 1000,
-                    };
-                    await setCachedToken(email, token);
-                    return token.access_token;
-                }
-                catch (e) {
-                    console.warn(`[oauth] Refresh failed: ${e.message}, starting new flow`);
-                }
+            catch (e) {
+                console.warn(`[oauth] Refresh failed: ${e.message}, starting new flow`);
             }
         }
-        // No valid token — start browser OAuth flow
-        const bridge = window._nativeBridge;
-        if (!bridge?.app?.startOAuth) {
-            throw new Error("No native OAuth bridge");
-        }
-        const authUrl = `${OAUTH_CLIENT.authUri}?` + new URLSearchParams({
-            client_id: OAUTH_CLIENT.clientId,
-            redirect_uri: OAUTH_CLIENT.redirectUri,
-            response_type: "code",
-            scope: OAUTH_SCOPES,
-            access_type: "offline",
-            prompt: "consent",
-            login_hint: email,
-        }).toString();
-        console.log(`[oauth] Starting browser consent for ${email}`);
-        const code = await bridge.app.startOAuth(authUrl);
-        const tokens = await exchangeCodeForTokens(code);
-        const token = {
-            access_token: tokens.access_token,
-            refresh_token: tokens.refresh_token,
-            expires_at: Date.now() + tokens.expires_in * 1000,
-        };
-        await setCachedToken(email, token);
-        console.log(`[oauth] Token obtained for ${email}`);
-        return token.access_token;
+    }
+    // No valid token — start browser OAuth flow
+    const bridge = window._nativeBridge;
+    if (!bridge?.app?.startOAuth) {
+        throw new Error("No native OAuth bridge");
+    }
+    const authUrl = `${OAUTH_CLIENT.authUri}?` + new URLSearchParams({
+        client_id: OAUTH_CLIENT.clientId,
+        redirect_uri: OAUTH_CLIENT.redirectUri,
+        response_type: "code",
+        scope: OAUTH_SCOPES,
+        access_type: "offline",
+        prompt: "consent",
+        login_hint: email,
+    }).toString();
+    console.log(`[oauth] Starting browser consent for ${email}`);
+    const code = await bridge.app.startOAuth(authUrl);
+    const tokens = await exchangeCodeForTokens(code);
+    const token = {
+        access_token: tokens.access_token,
+        refresh_token: tokens.refresh_token,
+        expires_at: Date.now() + tokens.expires_in * 1000,
     };
+    await setCachedToken(email, token);
+    console.log(`[oauth] Token obtained for ${email}`);
+    return token.access_token;
 }
 // ── GDrive folder lookup ──
 async function registerDeviceInGDrive(tokenProvider, folderId, accountIds) {
@@ -1318,7 +1337,22 @@ async function waitForNativeBridge(timeoutMs = 5000) {
         check();
     });
 }
-export async function initAndroid() {
+export function initAndroid() {
+    // C158: idempotency guard. The 2026-07-22 fold/unfold logit trail showed
+    // ONE WebView reload executing the boot module TWICE — duplicate "bridge
+    // installed", duplicate GDrive lookups, tripled OAuth launches. The
+    // guard lives on window (not a module local) so it holds even when the
+    // module itself is instantiated twice (bundle + package-path specifiers
+    // resolve to distinct module instances).
+    const w = window;
+    if (w.__rmfInitAndroid) {
+        console.warn("[android] initAndroid called again — duplicate suppressed (C158)");
+        vlog("C158: duplicate initAndroid call suppressed");
+        return w.__rmfInitAndroid;
+    }
+    return w.__rmfInitAndroid = initAndroidOnce();
+}
+async function initAndroidOnce() {
     console.log("[android] Initializing mailx (main-thread mode)...");
     // Main-thread path: async I/O (fetch, TCP bridge) doesn't block the UI,
     // and only sql.js is CPU-bound enough to maybe warrant a Worker later.