@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/files-provider-s3/s3-provider.ts

@@ -1,4 +1,8 @@
-import type { FileStorageProvider, SignedUrlOptions } from "@cosmicdrift/kumiko-framework/files";
+import {
+  assertSafeStorageKey,
+  type FileStorageProvider,
+  type SignedUrlOptions,
+} from "@cosmicdrift/kumiko-framework/files";
 
 // =============================================================================
 // Operator-Pflicht-Setup (Multipart-Upload-Cleanup)
@@ -72,10 +76,12 @@ export function createS3Provider(config: S3ProviderConfig): FileStorageProvider
 
   return {
     async write(key, data, mimeType): Promise<void> {
+      assertSafeStorageKey(key);
       await client.write(key, data, mimeType !== undefined ? { type: mimeType } : undefined);
     },
 
     async writeStream(key, source, options): Promise<void> {
+      assertSafeStorageKey(key);
       // Echtes multipart-streaming via Bun's S3-Writer — partSize steuert die
       // Part-Boundary intern (AWS/R2 verlangen non-final Parts >= 5 MiB,
       // sonst EntityTooSmall beim CompleteMultipartUpload). Manuelles flush()
@@ -96,10 +102,12 @@ export function createS3Provider(config: S3ProviderConfig): FileStorageProvider
     },
 
     async read(key): Promise<Uint8Array> {
+      assertSafeStorageKey(key);
       return new Uint8Array(await client.file(key).arrayBuffer());
     },
 
     readStream(key): AsyncIterable<Uint8Array> {
+      assertSafeStorageKey(key);
       // Lazy: erst beim ersten chunk-pull wird der GET-Request abgesetzt.
       // Existiert der Key nicht, faellt der Error genau dort (nicht beim
       // readStream-Aufruf) — gleiches Lazy-Verhalten wie inmemory + local.
@@ -113,10 +121,12 @@ export function createS3Provider(config: S3ProviderConfig): FileStorageProvider
     },
 
     async delete(key): Promise<void> {
+      assertSafeStorageKey(key);
       await client.delete(key);
     },
 
     async exists(key): Promise<boolean> {
+      assertSafeStorageKey(key);
       return client.exists(key);
     },
 
@@ -125,6 +135,7 @@ export function createS3Provider(config: S3ProviderConfig): FileStorageProvider
       expiresInSeconds: number,
       options?: SignedUrlOptions,
     ): Promise<string> {
+      assertSafeStorageKey(key);
       // contentDisposition wird von Bun als response-content-disposition
       // Query-Param signiert (Response-Override fuer den GET-Download) —
       // der Browser sieht den Original-Dateinamen statt des UUID-Keys.

package/src/folders/__tests__/folders.integration.test.ts

@@ -331,6 +331,7 @@ describe("folders-user-data — tenantScopedDelete hooks", () => {
     await seedOneFolderWithAssignment();
     const ctx = {
       db: stack.db,
+      registry: stack.registry,
       tenantId: admin.tenantId,
       userId: admin.id,
       tenantModel: "multi-user" as const,
@@ -345,6 +346,7 @@ describe("folders-user-data — tenantScopedDelete hooks", () => {
     await seedOneFolderWithAssignment();
     const ctx = {
       db: stack.db,
+      registry: stack.registry,
       tenantId: admin.tenantId,
       userId: admin.id,
       tenantModel: "single-user" as const,
@@ -359,6 +361,7 @@ describe("folders-user-data — tenantScopedDelete hooks", () => {
     await seedOneFolderWithAssignment();
     const ctx = {
       db: stack.db,
+      registry: stack.registry,
       tenantId: admin.tenantId,
       userId: admin.id,
       tenantModel: "single-user" as const,

package/src/folders/web/__tests__/folder-manager.test.tsx

@@ -149,11 +149,28 @@ describe("FolderManager filing mode", () => {
     );
   });
 
-  test("the in-tree new-folder row opens a draft; submitting (Enter) creates a root folder", async () => {
+  test("deleting a folder in filing mode refetches AND tells the host to reassign", async () => {
+    folderRows = [{ id: "f1", name: "A", parentId: null, version: 1 }];
+    const onReassigned = mock(() => {});
+    render(
+      <Wrapper>
+        <FolderManager filing={filingWith(onReassigned)} />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByTestId("folder-delete-f1"));
+    fireEvent.click(await screen.findByTestId("folder-manager-delete-dialog-confirm"));
+    await waitFor(() =>
+      expect(dispatchSpy).toHaveBeenCalledWith(FoldersHandlers.deleteFolder, { id: "f1" }),
+    );
+    await waitFor(() => expect(onReassigned).toHaveBeenCalled());
+  });
+
+  test("the in-tree new-folder row opens a draft; submitting (Enter) creates a root folder and reassigns", async () => {
     folderRows = [];
+    const onReassigned = mock(() => {});
     render(
       <Wrapper>
-        <FolderManager />
+        <FolderManager filing={filingWith(onReassigned)} />
       </Wrapper>,
     );
     fireEvent.click(screen.getByTestId("folder-manager-new-root"));
@@ -164,6 +181,30 @@ describe("FolderManager filing mode", () => {
     await waitFor(() =>
       expect(dispatchSpy).toHaveBeenCalledWith(FoldersHandlers.createFolder, { name: "Inbox" }),
     );
+    await waitFor(() => expect(onReassigned).toHaveBeenCalled());
+  });
+
+  test("renaming a folder dispatches update-folder and reassigns", async () => {
+    folderRows = [{ id: "f1", name: "A", parentId: null, version: 1 }];
+    const onReassigned = mock(() => {});
+    render(
+      <Wrapper>
+        <FolderManager filing={filingWith(onReassigned)} />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByTestId("folder-rename-f1"));
+    fireEvent.change(document.getElementById("folder-manager-draft") as HTMLInputElement, {
+      target: { value: "Renamed" },
+    });
+    fireEvent.submit(screen.getByTestId("folder-manager-draft"));
+    await waitFor(() =>
+      expect(dispatchSpy).toHaveBeenCalledWith(FoldersHandlers.updateFolder, {
+        id: "f1",
+        version: 1,
+        changes: { name: "Renamed" },
+      }),
+    );
+    await waitFor(() => expect(onReassigned).toHaveBeenCalled());
   });
 
   test("a mixed-type tree files each leaf under its own entityType (per-leaf override + fallback)", async () => {

package/src/folders/web/__tests__/tree.test.ts

@@ -55,4 +55,12 @@ describe("folderPath", () => {
   test("unknown id → empty string", () => {
     expect(folderPath(rows, "nope")).toBe("");
   });
+
+  // 658/4: a parentId cycle must terminate at the row-count cap, not loop
+  // forever or run one iteration past it.
+  test("a parentId cycle terminates instead of looping forever", () => {
+    const cyclic = [f("x", "X", "y"), f("y", "Y", "x")];
+    expect(() => folderPath(cyclic, "x")).not.toThrow();
+    expect(folderPath(cyclic, "x").split(" / ")).toHaveLength(cyclic.length);
+  });
 });

package/src/folders/web/folder-manager.tsx

@@ -47,9 +47,7 @@ export type FolderLeaf = {
   readonly label: string;
   readonly trailing?: ReactNode;
   readonly onOpen?: () => void;
-  // Overrides filing.entityType for this leaf — lets one filing tree hold leaves
-  // of mixed entity types (e.g. credits + Bausparverträge), each filed/cleared
-  // under its own type. Omit for single-type trees.
+  // Overrides filing.entityType (mixed-entity-type trees); omit for single-type trees.
   readonly entityType?: string;
 };
 
@@ -183,6 +181,7 @@ export function FolderManager({
       if (await write()) {
         setPending(null);
         await catalog.refetch();
+        await filing?.onReassigned();
       }
     } finally {
       setBusy(false);

package/src/folders/web/i18n.ts

@@ -18,7 +18,6 @@ export const defaultTranslations: TranslationsByLocale = {
     "folders.section.working": "Speichert…",
 
     "folders.manager.loading": "Lädt…",
-    "folders.manager.empty": "Noch keine Ordner.",
     "folders.manager.newRoot": "Neuer Ordner",
     "folders.manager.add": "Anlegen",
     "folders.manager.addChild": "Unterordner",
@@ -44,7 +43,6 @@ export const defaultTranslations: TranslationsByLocale = {
     "folders.section.working": "Saving…",
 
     "folders.manager.loading": "Loading…",
-    "folders.manager.empty": "No folders yet.",
     "folders.manager.newRoot": "New folder",
     "folders.manager.add": "Create",
     "folders.manager.addChild": "Subfolder",

package/src/folders/web/tree.ts

@@ -31,6 +31,15 @@ export function buildFolderTree(rows: readonly FolderRow[]): readonly FolderNode
     if (siblings) siblings.push(row);
     else byParent.set(key, [row]);
   }
+  // visited guards against a parent cycle recursing forever (658/4) —
+  // currently impossible (no reparent feature yet), but cheap insurance for
+  // when one lands; a cyclic node's subtree just stops re-descending.
+  // No cycle guard needed (658/4, verified not just asserted): build() only
+  // descends via byParent[parentId] starting from roots (parentId === null
+  // or dangling) — a row in a cycle has a non-null, existing parentId by
+  // definition, so it can never be a root, and each row contributes exactly
+  // one parentId edge, so nothing outside a cycle points into it either. A
+  // pure a<->b cycle is structurally unreachable from build(null).
   const build = (parentId: string | null, depth: number): readonly FolderNode[] =>
     (byParent.get(parentId) ?? [])
       .slice()
@@ -41,12 +50,14 @@ export function buildFolderTree(rows: readonly FolderRow[]): readonly FolderNode
 
 // "Immobilie Berlin / Person Müller" for a folder id, walking parentId up.
 // Empty string if the id is unknown. The row-count cap stops a (currently
-// impossible — no reparent yet) parent cycle from spinning forever.
+// impossible — no reparent yet) parent cycle from spinning forever — `< `,
+// not `<=` (658/4): a cycle of exactly rows.length nodes must stop AT the
+// cap, not run one iteration past it.
 export function folderPath(rows: readonly FolderRow[], id: string, separator = " / "): string {
   const byId = new Map(rows.map((r) => [r.id, r]));
   const names: string[] = [];
   let current = byId.get(id);
-  for (let i = 0; current !== undefined && i <= rows.length; i += 1) {
+  for (let i = 0; current !== undefined && i < rows.length; i += 1) {
     names.unshift(current.name);
     current = current.parentId !== null ? byId.get(current.parentId) : undefined;
   }

package/src/folders-user-data/__tests__/hooks.integration.test.ts

@@ -57,6 +57,7 @@ describe("folderAssignmentExportHook", () => {
 
     const snippet = await folderAssignmentExportHook({
       db: stack.db,
+      registry: stack.registry,
       tenantId: admin.tenantId,
       userId: admin.id,
     });

package/src/folders-user-data/index.ts

@@ -16,10 +16,10 @@ export const foldersUserDataFeature = defineFeature("folders-user-data", (r) =>
   r.describe(
     "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `folders` feature's `folder` + `folder-assignment` entities. Mounts the EXT_USER_DATA export + delete hooks so a tenant's folder tree and its entity-to-folder assignments are included in the user-data export bundle and erased on a tenant-scoped forget (single-user tenants only; multi-user + anonymize are no-ops since folder rows carry no per-user PII). Kept separate from `folders` so folder consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `folders`.",
   );
-  // user-data-rights ist die harte Abhängigkeit (EXT_USER_DATA-Host). `folders` ist
-  // OPTIONAL: ist es toggleable(default=false) gemountet (z.B. per-Tenant via Tier),
-  // würde ein hartes r.requires eine „effectively disabled"-Boot-Warnung werfen,
-  // obwohl die folder-Entities existieren und die Hooks korrekt greifen.
+  // user-data-rights is the hard dependency (EXT_USER_DATA host). `folders` is
+  // OPTIONAL: if it's mounted toggleable(default=false) (e.g. per-tenant via
+  // tier), a hard r.requires would throw an "effectively disabled" boot
+  // warning even though the folder entities exist and the hooks work fine.
   r.requires("user-data-rights");
   r.optionalRequires("folders");
   r.useExtension(EXT_USER_DATA, "folder", {

package/src/inbound-mail-foundation/__tests__/account-state.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, test } from "bun:test";
+import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
+import type { MailAccountEventPayload } from "../events";
+import { loadCurrentMailAccountPayload } from "../handlers/account-state";
+
+function ctxWithEvents(
+  payloads: readonly MailAccountEventPayload[],
+): Pick<HandlerContext, "loadAggregate"> {
+  return {
+    loadAggregate: async () =>
+      payloads.map((payload) => ({
+        // @cast-boundary test fixture — only `payload` is read by the function under test
+        payload,
+      })) as unknown as Awaited<ReturnType<HandlerContext["loadAggregate"]>>,
+  };
+}
+
+describe("loadCurrentMailAccountPayload", () => {
+  test("returns undefined when the aggregate has no events", async () => {
+    const ctx = ctxWithEvents([]);
+    expect(await loadCurrentMailAccountPayload(ctx, "acc-1")).toBeUndefined();
+  });
+
+  test("returns the payload of the LAST event — full-snapshot semantics", async () => {
+    const first = { status: "active" } as unknown as MailAccountEventPayload;
+    const last = { status: "degraded" } as unknown as MailAccountEventPayload;
+    const ctx = ctxWithEvents([first, last]);
+    expect(await loadCurrentMailAccountPayload(ctx, "acc-1")).toBe(last);
+  });
+});

package/src/inbound-mail-foundation/__tests__/connect-routes.integration.test.ts

@@ -0,0 +1,307 @@
+// Connect-routes integration — mounts createInboundMailConnectRoutes on a
+// Hono app wired to a real setupTestStack dispatcher + secrets context.
+// Exercises OAuth connect redirect, HMAC state, callback account create,
+// and error paths (401/400/404/502) — not mock-only existence checks.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  defineFeature,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import { createEnvMasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createMutableMasterKeyProvider,
+  type MutableMasterKeyProvider,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { Hono } from "hono";
+import {
+  createComplianceProfilesFeature,
+  tenantComplianceProfileEntity,
+} from "../../compliance-profiles";
+import { createConfigFeature } from "../../config";
+import { inboundProviderInMemoryFeature } from "../../inbound-provider-inmemory";
+import { createSecretsContext, createSecretsFeature, tenantSecretsTable } from "../../secrets";
+import { createTenantFeature } from "../../tenant/feature";
+import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
+import {
+  createInboundMailConnectRoutes,
+  INBOUND_MAIL_PROVIDER_EXTENSION,
+  type InboundMailProviderPlugin,
+  inboundCredentialSecretKey,
+  inboundMailFoundationFeature,
+  mailAccountsProjectionTable,
+  type OAuthTokenSet,
+  seenMessageEntity,
+  syncCursorEntity,
+} from "../index";
+
+const OAUTH_PROVIDER_KEY = "oauth-test";
+const STATE_SECRET = "inbound-mail-connect-test-state-secret-32b";
+const CALLBACK_URL = "http://localhost/inbound-mail/oauth/callback";
+
+const oauthTestPlugin: InboundMailProviderPlugin = {
+  verify: async () => {},
+  fetch: async () => ({ messages: [], nextCursor: { offset: 0 }, hasMore: false }),
+  oauth: {
+    scopes: { receive: ["mail.read"] },
+    buildAuthorizeUrl: async (_ctx, p) =>
+      `https://oauth.test/authorize?state=${encodeURIComponent(p.state)}&redirect_uri=${encodeURIComponent(p.redirectUri)}`,
+    exchangeCode: async (_ctx, p): Promise<OAuthTokenSet> => {
+      if (p.code === "fail-exchange") {
+        throw new Error("token endpoint unavailable");
+      }
+      if (p.code === "no-refresh") {
+        return {
+          accessToken: "access-only",
+          expiresAt: "2099-01-01T00:00:00Z",
+          scopesGranted: ["mail.read"],
+        };
+      }
+      return {
+        accessToken: "access-token",
+        refreshToken: "refresh-token-abc",
+        expiresAt: "2099-01-01T00:00:00Z",
+        scopesGranted: ["mail.read"],
+      };
+    },
+    refreshAccessToken: async () => {
+      throw new Error("not used in connect-routes tests");
+    },
+  },
+};
+
+const oauthTestProviderFeature = defineFeature("inbound-provider-oauth-test", (r) => {
+  r.requires("inbound-mail-foundation");
+  r.useExtension(INBOUND_MAIL_PROVIDER_EXTENSION, OAUTH_PROVIDER_KEY, oauthTestPlugin);
+});
+
+let stack: TestStack;
+let db: DbConnection;
+let secrets: ReturnType<typeof createSecretsContext>;
+let providerRef: MutableMasterKeyProvider;
+let routes: ReturnType<typeof createInboundMailConnectRoutes>;
+
+beforeAll(async () => {
+  const initialKp = createEnvMasterKeyProvider({
+    env: {
+      KUMIKO_SECRETS_MASTER_KEY_V1: randomBytes(32).toString("base64"),
+      KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "1",
+    },
+  });
+  providerRef = createMutableMasterKeyProvider(initialKp);
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createTenantFeature(),
+      createSecretsFeature(),
+      createComplianceProfilesFeature(),
+      createTenantLifecycleFeature(),
+      inboundMailFoundationFeature,
+      inboundProviderInMemoryFeature,
+      oauthTestProviderFeature,
+    ],
+    masterKeyProvider: providerRef,
+    extraContext: ({ db: stackDb }) => ({
+      secrets: createSecretsContext({ db: stackDb, masterKeyProvider: providerRef }),
+    }),
+  });
+  db = stack.db;
+  secrets = createSecretsContext({ db, masterKeyProvider: providerRef });
+
+  await createEventsTable(db);
+  await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
+  await unsafeCreateEntityTable(db, syncCursorEntity);
+  await unsafeCreateEntityTable(db, seenMessageEntity);
+  await unsafePushTables(db, { tenant_secrets: tenantSecretsTable });
+  configurePiiSubjectKms(new InMemoryKmsAdapter());
+
+  routes = createInboundMailConnectRoutes({
+    providerCtx: { registry: stack.registry, secrets },
+    dispatchWrite: ({ handlerQn, payload, tenantId }) =>
+      stack.dispatcher.write(
+        handlerQn,
+        payload,
+        createSystemUser(tenantId as TenantId, [ROLES.SystemAdmin]),
+      ),
+    secrets,
+    stateSecret: STATE_SECRET,
+    callbackUrl: CALLBACK_URL,
+  });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+  resetPiiSubjectKmsForTests();
+});
+
+function adminFor(tenantNumber: number) {
+  return createTestUser({
+    id: tenantNumber,
+    tenantId: testTenantId(tenantNumber),
+    roles: ["TenantAdmin", "SystemAdmin"],
+  });
+}
+
+function buildApp(opts: { user?: { id: string; tenantId: string } | null } = {}) {
+  const app = new Hono<{ Variables: { user?: { id: string; tenantId: string } } }>();
+  if (opts.user !== null) {
+    const user = opts.user ?? adminFor(4201);
+    app.use("*", async (c, next) => {
+      c.set("user", { id: user.id, tenantId: user.tenantId });
+      await next();
+    });
+  }
+  app.get("/api/inbound-mail/connect", routes.connect);
+  app.get("/inbound-mail/oauth/callback", routes.callback);
+  return app;
+}
+
+describe("connect-routes — connect", () => {
+  test("401 without session user", async () => {
+    const app = buildApp({ user: null });
+    const res = await app.request(
+      `/api/inbound-mail/connect?provider=${OAUTH_PROVIDER_KEY}&scope=shared&mailbox=inbox@acme.test`,
+    );
+    expect(res.status).toBe(401);
+  });
+
+  test("400 when query params are incomplete", async () => {
+    const app = buildApp();
+    const res = await app.request(`/api/inbound-mail/connect?provider=${OAUTH_PROVIDER_KEY}`);
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { error: { code: string } };
+    expect(body.error.code).toBe("invalid_connect_request");
+  });
+
+  test("404 for unknown provider key", async () => {
+    const app = buildApp();
+    const res = await app.request(
+      "/api/inbound-mail/connect?provider=does-not-exist&scope=shared&mailbox=inbox@acme.test",
+    );
+    expect(res.status).toBe(404);
+  });
+
+  test("400 when provider has no oauth flow (inmemory)", async () => {
+    const app = buildApp();
+    const res = await app.request(
+      "/api/inbound-mail/connect?provider=inmemory&scope=shared&mailbox=inbox@acme.test",
+    );
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { error: { code: string } };
+    expect(body.error.code).toBe("provider_has_no_oauth_flow");
+  });
+
+  test("302 redirect to provider authorize URL with signed state", async () => {
+    const app = buildApp({ user: adminFor(4202) });
+    const res = await app.request(
+      `/api/inbound-mail/connect?provider=${OAUTH_PROVIDER_KEY}&scope=shared&mailbox=team@acme.test`,
+      { redirect: "manual" },
+    );
+    expect(res.status).toBe(302);
+    const location = res.headers.get("location");
+    expect(location).toBeTruthy();
+    const url = new URL(location!);
+    expect(url.origin + url.pathname).toBe("https://oauth.test/authorize");
+    expect(url.searchParams.get("redirect_uri")).toBe(CALLBACK_URL);
+    expect(url.searchParams.get("state")).toBeTruthy();
+  });
+});
+
+describe("connect-routes — oauth callback", () => {
+  test("400 when code/state missing", async () => {
+    const app = buildApp({ user: null });
+    const res = await app.request("/inbound-mail/oauth/callback");
+    expect(res.status).toBe(400);
+  });
+
+  test("400 on tampered state", async () => {
+    const app = buildApp({ user: null });
+    const res = await app.request("/inbound-mail/oauth/callback?code=ok&state=not.a.valid.state");
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { error: { code: string } };
+    expect(body.error.code).toBe("invalid_state");
+  });
+
+  test("happy path: creates mail account + stores refresh token secret", async () => {
+    const user = adminFor(4203);
+    const connectApp = buildApp({ user });
+    const connectRes = await connectApp.request(
+      `/api/inbound-mail/connect?provider=${OAUTH_PROVIDER_KEY}&scope=user&mailbox=owner@acme.test`,
+      { redirect: "manual" },
+    );
+    const state = new URL(connectRes.headers.get("location")!).searchParams.get("state");
+    expect(state).toBeTruthy();
+
+    const callbackApp = buildApp({ user: null });
+    const callbackRes = await callbackApp.request(
+      `/inbound-mail/oauth/callback?code=ok&state=${encodeURIComponent(state!)}`,
+    );
+    expect(callbackRes.status).toBe(200);
+    const body = (await callbackRes.json()) as { connected: boolean; accountId: string };
+    expect(body.connected).toBe(true);
+    expect(body.accountId).toBeTruthy();
+
+    const accounts = await selectMany(db, mailAccountsProjectionTable, { id: body.accountId });
+    expect(accounts).toHaveLength(1);
+    expect(accounts[0]?.["provider"]).toBe(OAUTH_PROVIDER_KEY);
+    expect(accounts[0]?.["ownerUserId"]).toBe(user.id);
+
+    const stored = await secrets.get(user.tenantId, inboundCredentialSecretKey(body.accountId));
+    expect(stored).toBeDefined();
+    expect(stored!.reveal()).toBe("refresh-token-abc");
+  });
+
+  test("502 when token exchange fails", async () => {
+    const user = adminFor(4204);
+    const connectApp = buildApp({ user });
+    const connectRes = await connectApp.request(
+      `/api/inbound-mail/connect?provider=${OAUTH_PROVIDER_KEY}&scope=shared&mailbox=fail@acme.test`,
+      { redirect: "manual" },
+    );
+    const state = new URL(connectRes.headers.get("location")!).searchParams.get("state");
+
+    const res = await buildApp({ user: null }).request(
+      `/inbound-mail/oauth/callback?code=fail-exchange&state=${encodeURIComponent(state!)}`,
+    );
+    expect(res.status).toBe(502);
+    const body = (await res.json()) as { error: { code: string } };
+    expect(body.error.code).toBe("token_exchange_failed");
+  });
+
+  test("502 when provider omits refresh token", async () => {
+    const user = adminFor(4205);
+    const connectApp = buildApp({ user });
+    const connectRes = await connectApp.request(
+      `/api/inbound-mail/connect?provider=${OAUTH_PROVIDER_KEY}&scope=shared&mailbox=norefresh@acme.test`,
+      { redirect: "manual" },
+    );
+    const state = new URL(connectRes.headers.get("location")!).searchParams.get("state");
+
+    const res = await buildApp({ user: null }).request(
+      `/inbound-mail/oauth/callback?code=no-refresh&state=${encodeURIComponent(state!)}`,
+    );
+    expect(res.status).toBe(502);
+    const body = (await res.json()) as { error: { code: string } };
+    expect(body.error.code).toBe("no_refresh_token");
+  });
+});