@rapidmx/mapi-plugin 1.0.0-beta.3

package/dist/lib/BaseMapiEmsmdbRoute.js

@@ -0,0 +1,297 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { ApiError, ObjectDecorators } from "@rapidrest/core";
+import { ApiErrorMessages, ApiErrors, RepoUtils, RouteDecorators, } from "@rapidrest/service-core";
+import { BufferReader, BufferWriter } from "./codec/BufferCursor.js";
+import { decodeRopBuffer, encodeRopBuffer } from "./codec/RopBuffer.js";
+import { MapiSessionManager } from "./MapiSessionManager.js";
+import { dispatchRops } from "./RopDispatcher.js";
+import { ScanPipeline } from "@rapidmx/restapi/scan";
+import { RecoverableRepoUtils, resolveCallerMailboxUid } from "@rapidmx/restapi";
+const { Init, Inject, Logger } = ObjectDecorators;
+const { Auth, Post, Request, Response, User: AuthUser } = RouteDecorators;
+/** The well-known MAPI HRESULT `MAPI_E_LOGON_FAILED`, reused here to signal "no such session - reconnect"
+ * via `X-ResponseCode`/`ErrorCode`. Not a claim of exact `[MS-OXCRPC]` return-value-table parity for this
+ * specific condition - a real client only needs a non-zero code to know to re-`Connect`, not a precise one. */
+const ERROR_SESSION_NOT_FOUND = 0x80040111;
+function firstHeader(req, name) {
+    const value = req.headers[name];
+    return Array.isArray(value) ? value[0] : value;
+}
+/**
+ * Abstract base for the single fixed EMSMDB endpoint (`POST /mapi/emsmdb` by `[MS-OXCMAPIHTTP]` convention,
+ * though the concrete path is left to the consuming application to mount via `@Route(...)` - see
+ * `BaseEasRoute.ts` for the identical undecorated-base-class pattern this follows). Like EAS, MAPI/HTTP
+ * multiplexes several request types against one URL - here via the `X-RequestType` **header**
+ * (`Connect`/`Execute`/`Disconnect`/`NotificationWait`) rather than a query parameter - so there is exactly
+ * one `@Post()` method, not one per request type.
+ *
+ * **Auth**: `@Auth(["jwt"])` - unchanged from every other route in this app. Real, modern Exchange Server's
+ * own MAPI virtual directory genuinely supports `OAuth` as a configured `IISAuthenticationMethods` value
+ * alongside `NTLM`/`Negotiate`, so Bearer-token auth on this exact endpoint is real current Exchange
+ * behavior, not a deviation this library invents - see the architecture plan's "Auth" section.
+ *
+ * **Connect/Disconnect are complete**: `Connect` establishes a real `MapiSessionContext` (via
+ * `MapiSessionManager`) and sets the two spec-fixed session cookies (`MapiContext`/`MapiSequence`);
+ * `Disconnect` releases the session. **`Execute` dispatches real ROPs** (starting with `RopLogon`/`RopRelease`
+ * - build-order step 4) via `RopDispatcher`, using whichever `RopHandler`s `ropHandlerClasses` registers;
+ * an unrecognized `RopId` simply stops processing (see `RopDispatcher`'s own doc comment for why), the same
+ * "real, functional, no commands implemented yet" stance `BaseEasRoute`'s own skeleton step took for its
+ * empty `commandHandlerClasses` before `ProvisionCommand` landed - here scoped per-ROP instead of per-request.
+ *
+ * **Always non-chunked**: every response here uses `Content-Length` (via `res.status(200).send(buffer)`),
+ * never `Transfer-Encoding: chunked` - both are equally spec-valid per `[MS-OXCMAPIHTTP]`'s own "Common
+ * Response Format", and skipping the `PROCESSING`/`PENDING`/`DONE` keep-alive meta-tag streaming matches
+ * every other route in this library's own response idiom. See the architecture plan's "Protocol facts"
+ * section for the full reasoning and its documented limitation.
+ *
+ * `mailboxClass`/`folderClass` are supplied by the Mongo/SQL concrete subclasses, following the exact
+ * one-line-per-backend pattern used throughout this library's other routes/jobs. `folderRepo` is built once
+ * here (not per-handler, unlike EAS's per-command repo pattern) and threaded through `RopContext` to every
+ * `RopHandler` - see `RopHandler.ts`'s own doc comment for why.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export class BaseMapiEmsmdbRoute {
+    constructor() {
+        /** ROP handler classes to instantiate (one each) in `@Init`, keyed by their own `ropId`. Empty until a
+         * concrete `RopHandler` lands - every ROP is then simply left unprocessed (see `RopDispatcher`'s own doc
+         * comment), the correct, honest behavior for a transport skeleton with no ROPs implemented yet. */
+        this.ropHandlerClasses = [];
+        this.ropHandlers = new Map();
+    }
+    async init() {
+        this.mailboxRepo = await this._objectFactory.newInstance(RepoUtils, {
+            name: this.mailboxClass.name,
+            args: [this.mailboxClass],
+        });
+        this.folderRepo = await this._objectFactory.newInstance(RecoverableRepoUtils, {
+            name: this.folderClass.name,
+            args: [this.folderClass],
+        });
+        this.messageRepo = await this._objectFactory.newInstance(RecoverableRepoUtils, {
+            name: this.messageClass.name,
+            args: [this.messageClass],
+        });
+        this.calendarEventRepo = await this._objectFactory.newInstance(RecoverableRepoUtils, {
+            name: this.calendarEventClass.name,
+            args: [this.calendarEventClass],
+        });
+        this.contactRepo = await this._objectFactory.newInstance(RecoverableRepoUtils, {
+            name: this.contactClass.name,
+            args: [this.contactClass],
+        });
+        this.taskRepo = await this._objectFactory.newInstance(RecoverableRepoUtils, {
+            name: this.taskClass.name,
+            args: [this.taskClass],
+        });
+        // Label extends plain BaseEntity, not RecoverableBaseEntity (see restapi's own model doc comment) - no
+        // soft-delete support to preserve, so a plain RepoUtils is correct here, matching mailboxRepo's own
+        // choice for the identical reason.
+        this.labelRepo = await this._objectFactory.newInstance(RepoUtils, {
+            name: this.labelClass.name,
+            args: [this.labelClass],
+        });
+        this.sessionManager = await this._objectFactory.newInstance(MapiSessionManager);
+        for (const HandlerClass of this.ropHandlerClasses) {
+            const handler = await this._objectFactory.newInstance(HandlerClass);
+            this.ropHandlers.set(handler.ropId, handler);
+        }
+    }
+    async dispatch(req, res, user) {
+        if (!this.mailboxRepo ||
+            !this.folderRepo ||
+            !this.messageRepo ||
+            !this.calendarEventRepo ||
+            !this.contactRepo ||
+            !this.taskRepo ||
+            !this.labelRepo ||
+            !this.sessionManager ||
+            !this.blobStore ||
+            !this.scanPipeline ||
+            !this.mailTransport) {
+            throw new ApiError(ApiErrors.INTERNAL_ERROR, 500, ApiErrorMessages.INTERNAL_ERROR);
+        }
+        if (!user) {
+            throw new ApiError(ApiErrors.AUTH_PERMISSION_FAILURE, 403, ApiErrorMessages.AUTH_PERMISSION_FAILURE);
+        }
+        const requestType = firstHeader(req, "x-requesttype");
+        const clientInfo = firstHeader(req, "x-clientinfo") ?? "";
+        const requestId = firstHeader(req, "x-requestid") ?? "";
+        res.setHeader("Content-Type", "application/mapi-http")
+            .setHeader("X-RequestType", requestType ?? "")
+            .setHeader("X-RequestId", requestId)
+            .setHeader("X-ResponseCode", "0")
+            .setHeader("X-ClientInfo", clientInfo)
+            .setHeader("X-ServerApplication", "RapidREST-Mail");
+        switch (requestType) {
+            case "Connect":
+                await this.handleConnect(req, res, user);
+                return;
+            case "Execute":
+                await this.handleExecute(req, res);
+                return;
+            case "Disconnect":
+                await this.handleDisconnect(req, res);
+                return;
+            case "NotificationWait":
+                // Real, spec-defined request type, deliberately deferred - no push-notification support in
+                // this pass (see the architecture plan's ROP scope table). Distinct from an unrecognized
+                // X-RequestType value (400 below), the same distinction BaseEasRoute draws between 501
+                // ("recognized but deferred") and 400 ("malformed request").
+                res.status(501).send();
+                return;
+            default:
+                throw new ApiError(ApiErrors.INVALID_REQUEST, 400, ApiErrorMessages.INVALID_REQUEST);
+        }
+    }
+    /**
+     * `Connect` establishes a new Session Context - never trusts the request body's own `UserDn` field for
+     * mailbox identity (the same "never a client-supplied mailbox, always resolved from the authenticated
+     * JWT" principle `BaseEasRoute`/`BaseSearchRoute` already apply via `resolveCallerMailboxUid`) - so the
+     * request body is never decoded at all here.
+     */
+    async handleConnect(req, res, user) {
+        const mailboxUid = await resolveCallerMailboxUid(this.mailboxRepo, user);
+        if (!mailboxUid) {
+            throw new ApiError(ApiErrors.NOT_FOUND, 404, ApiErrorMessages.NOT_FOUND);
+        }
+        const mailbox = await this.mailboxRepo.findOne(mailboxUid, { ignoreACL: true });
+        const session = await this.sessionManager.create(mailboxUid, user.uid);
+        res.appendHeader("Set-Cookie", `MapiContext=${session.uid}`);
+        res.appendHeader("Set-Cookie", `MapiSequence=0`);
+        const body = new BufferWriter();
+        body.writeUInt32LE(0); // StatusCode
+        body.writeUInt32LE(0); // ErrorCode
+        body.writeUInt32LE(60000); // PollsMax (ms) - pragmatic constant, not a tuned server policy value
+        body.writeUInt32LE(3); // RetryCount - pragmatic constant
+        body.writeUInt32LE(5000); // RetryDelay (ms) - pragmatic constant
+        // DnPrefix: this library addresses mailboxes by UID/SMTP-address, never real X.500 DNs, so this is a
+        // fixed, unused placeholder rather than a real DN prefix a client could build recipients from.
+        body.writeNullTerminatedString8("/");
+        body.writeNullTerminatedUtf16LE(mailbox?.displayName ?? "");
+        body.writeUInt32LE(0); // AuxiliaryBufferSize
+        res.status(200).send(body.toBuffer());
+    }
+    /**
+     * `Execute` decodes the outer envelope (`Flags`/`RopBufferSize`/`RopBuffer`/...) and the inner ROP buffer
+     * framing (`RopBuffer.ts`), dispatches every contained ROP via `RopDispatcher`, and re-encodes the
+     * collected responses - preserving the incoming `handleTable` unchanged (this pragmatic subset never
+     * allocates/frees table-wide handle slots at the framing level; individual `RopHandler`s manage their own
+     * entries within `session.handles` instead).
+     */
+    async handleExecute(req, res) {
+        const sessionId = req.cookies["MapiContext"];
+        const session = sessionId
+            ? await this.sessionManager.load(sessionId)
+            : undefined;
+        if (!session) {
+            res.setHeader("X-ResponseCode", String(ERROR_SESSION_NOT_FOUND));
+            const body = new BufferWriter();
+            body.writeUInt32LE(0); // StatusCode
+            body.writeUInt32LE(ERROR_SESSION_NOT_FOUND); // ErrorCode
+            body.writeUInt32LE(0); // Flags
+            body.writeUInt32LE(0); // RopBufferSize
+            body.writeUInt32LE(0); // AuxiliaryBufferSize
+            res.status(200).send(body.toBuffer());
+            return;
+        }
+        const requestReader = new BufferReader(req.rawBody ?? Buffer.alloc(0));
+        requestReader.readUInt32LE(); // Flags - unused by this pragmatic subset (no client ROP-response hints honored)
+        const ropBufferSize = requestReader.readUInt32LE();
+        const ropBufferBytes = requestReader.readBytes(ropBufferSize);
+        // MaxRopOut/AuxiliaryBufferSize/AuxiliaryBuffer intentionally left unread - no output-size capping or
+        // auxiliary-payload support in this pragmatic subset.
+        const { ropsList, handleTable } = decodeRopBuffer(ropBufferBytes);
+        const context = {
+            mailboxUid: session.mailboxUid,
+            userUid: session.userUid,
+            session,
+            mailboxRepo: this.mailboxRepo,
+            folderRepo: this.folderRepo,
+            messageRepo: this.messageRepo,
+            calendarEventRepo: this.calendarEventRepo,
+            contactRepo: this.contactRepo,
+            taskRepo: this.taskRepo,
+            labelRepo: this.labelRepo,
+            folderClass: this.folderClass,
+            messageClass: this.messageClass,
+            calendarEventClass: this.calendarEventClass,
+            contactClass: this.contactClass,
+            taskClass: this.taskClass,
+            labelClass: this.labelClass,
+            blobStore: this.blobStore,
+            scanPipeline: this.scanPipeline,
+            mailTransport: this.mailTransport,
+        };
+        const responseRopsList = await dispatchRops(ropsList, this.ropHandlers, context);
+        const responseRopBuffer = encodeRopBuffer({ ropsList: responseRopsList, handleTable });
+        await this.sessionManager.save(session);
+        const body = new BufferWriter();
+        body.writeUInt32LE(0); // StatusCode
+        body.writeUInt32LE(0); // ErrorCode
+        body.writeUInt32LE(0); // Flags
+        body.writeUInt32LE(responseRopBuffer.length);
+        body.writeBytes(responseRopBuffer);
+        body.writeUInt32LE(0); // AuxiliaryBufferSize
+        res.status(200).send(body.toBuffer());
+    }
+    async handleDisconnect(req, res) {
+        const sessionId = req.cookies["MapiContext"];
+        if (sessionId) {
+            await this.sessionManager.destroy(sessionId);
+        }
+        const body = new BufferWriter();
+        body.writeUInt32LE(0); // StatusCode
+        body.writeUInt32LE(0); // ErrorCode
+        body.writeUInt32LE(0); // AuxiliaryBufferSize
+        res.status(200).send(body.toBuffer());
+    }
+}
+__decorate([
+    Inject("BlobStore"),
+    __metadata("design:type", Object)
+], BaseMapiEmsmdbRoute.prototype, "blobStore", void 0);
+__decorate([
+    Inject(ScanPipeline),
+    __metadata("design:type", ScanPipeline)
+], BaseMapiEmsmdbRoute.prototype, "scanPipeline", void 0);
+__decorate([
+    Inject("MailTransport"),
+    __metadata("design:type", Object)
+], BaseMapiEmsmdbRoute.prototype, "mailTransport", void 0);
+__decorate([
+    Logger,
+    __metadata("design:type", Object)
+], BaseMapiEmsmdbRoute.prototype, "logger", void 0);
+__decorate([
+    Init,
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], BaseMapiEmsmdbRoute.prototype, "init", null);
+__decorate([
+    Auth(["jwt"]),
+    Post(),
+    __param(0, Request),
+    __param(1, Response),
+    __param(2, AuthUser),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Object]),
+    __metadata("design:returntype", Promise)
+], BaseMapiEmsmdbRoute.prototype, "dispatch", null);
+//# sourceMappingURL=BaseMapiEmsmdbRoute.js.map

package/dist/lib/BaseMapiEmsmdbRoute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseMapiEmsmdbRoute.js","sourceRoot":"","sources":["../../src/BaseMapiEmsmdbRoute.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAgB,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EACH,gBAAgB,EAChB,SAAS,EAIT,SAAS,EACT,eAAe,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAsB,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAmB,oBAAoB,EAAE,uBAAuB,EAAkB,MAAM,kBAAkB,CAAC;AAClH,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;AAClD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC;AAE1E;;+GAE+G;AAC/G,MAAM,uBAAuB,GAAG,UAAU,CAAC;AAE3C,SAAS,WAAW,CAAC,GAAgB,EAAE,IAAY;IAC/C,MAAM,KAAK,GAAkC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,OAAgB,mBAAmB;IAAzC;QASI;;2GAEmG;QACzF,sBAAiB,GAAU,EAAE,CAAC;QAavB,gBAAW,GAAG,IAAI,GAAG,EAAsB,CAAC;IA+NjE,CAAC;IAhNgB,AAAN,KAAK,CAAC,IAAI;QACb,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,SAAS,EAAE;YACjE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI;YAC5B,IAAI,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;SAC5B,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,oBAAoB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;YAC3B,IAAI,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,oBAAoB,EAAE;YAC5E,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI;YAC5B,IAAI,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;SAC5B,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,oBAAoB,EAAE;YAClF,IAAI,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI;YAClC,IAAI,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,oBAAoB,EAAE;YAC5E,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI;YAC5B,IAAI,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;SAC5B,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,oBAAoB,EAAE;YACzE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI;YACzB,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;SACzB,CAAC,CAAC;QACH,uGAAuG;QACvG,oGAAoG;QACpG,mCAAmC;QACnC,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,SAAS,EAAE;YAC/D,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAC1B,IAAI,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;QACjF,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAChD,MAAM,OAAO,GAAe,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;IAIY,AAAN,KAAK,CAAC,QAAQ,CACR,GAAgB,EACf,GAAiB,EACjB,IAAc;QAExB,IACI,CAAC,IAAI,CAAC,WAAW;YACjB,CAAC,IAAI,CAAC,UAAU;YAChB,CAAC,IAAI,CAAC,WAAW;YACjB,CAAC,IAAI,CAAC,iBAAiB;YACvB,CAAC,IAAI,CAAC,WAAW;YACjB,CAAC,IAAI,CAAC,QAAQ;YACd,CAAC,IAAI,CAAC,SAAS;YACf,CAAC,IAAI,CAAC,cAAc;YACpB,CAAC,IAAI,CAAC,SAAS;YACf,CAAC,IAAI,CAAC,YAAY;YAClB,CAAC,IAAI,CAAC,aAAa,EACrB,CAAC;YACC,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,uBAAuB,EAAE,GAAG,EAAE,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QACzG,CAAC;QAED,MAAM,WAAW,GAAuB,WAAW,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAC1E,MAAM,UAAU,GAAW,WAAW,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC;QAClE,MAAM,SAAS,GAAW,WAAW,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC;QAEhE,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,uBAAuB,CAAC;aACjD,SAAS,CAAC,eAAe,EAAE,WAAW,IAAI,EAAE,CAAC;aAC7C,SAAS,CAAC,aAAa,EAAE,SAAS,CAAC;aACnC,SAAS,CAAC,gBAAgB,EAAE,GAAG,CAAC;aAChC,SAAS,CAAC,cAAc,EAAE,UAAU,CAAC;aACrC,SAAS,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAC;QAExD,QAAQ,WAAW,EAAE,CAAC;YAClB,KAAK,SAAS;gBACV,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBACzC,OAAO;YACX,KAAK,SAAS;gBACV,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACnC,OAAO;YACX,KAAK,YAAY;gBACb,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACtC,OAAO;YACX,KAAK,kBAAkB;gBACnB,2FAA2F;gBAC3F,yFAAyF;gBACzF,uFAAuF;gBACvF,6DAA6D;gBAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACvB,OAAO;YACX;gBACI,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,gBAAgB,CAAC,eAAe,CAAC,CAAC;QAC7F,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,aAAa,CAAC,GAAgB,EAAE,GAAiB,EAAE,IAAa;QAC1E,MAAM,UAAU,GAAuB,MAAM,uBAAuB,CAAC,IAAI,CAAC,WAAY,EAAE,IAAI,CAAC,CAAC;QAC9F,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,OAAO,GAAkB,MAAM,IAAI,CAAC,WAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhG,MAAM,OAAO,GAAuB,MAAM,IAAI,CAAC,cAAe,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5F,GAAG,CAAC,YAAY,CAAC,YAAY,EAAE,eAAe,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,GAAG,CAAC,YAAY,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;QAEjD,MAAM,IAAI,GAAG,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa;QACpC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY;QACnC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,sEAAsE;QACjG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,kCAAkC;QACzD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,uCAAuC;QACjE,qGAAqG;QACrG,+FAA+F;QAC/F,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB;QAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,aAAa,CAAC,GAAgB,EAAE,GAAiB;QAC3D,MAAM,SAAS,GAAuB,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACjE,MAAM,OAAO,GAAmC,SAAS;YACrD,CAAC,CAAC,MAAM,IAAI,CAAC,cAAe,CAAC,IAAI,CAAC,SAAS,CAAC;YAC5C,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;YACjE,MAAM,IAAI,GAAG,IAAI,YAAY,EAAE,CAAC;YAChC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa;YACpC,IAAI,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,CAAC,YAAY;YACzD,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ;YAC/B,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB;YACvC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACtC,OAAO;QACX,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,aAAa,CAAC,YAAY,EAAE,CAAC,CAAC,iFAAiF;QAC/G,MAAM,aAAa,GAAW,aAAa,CAAC,YAAY,EAAE,CAAC;QAC3D,MAAM,cAAc,GAAW,aAAa,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACtE,sGAAsG;QACtG,sDAAsD;QAEtD,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;QAClE,MAAM,OAAO,GAAe;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO;YACP,WAAW,EAAE,IAAI,CAAC,WAAY;YAC9B,UAAU,EAAE,IAAI,CAAC,UAAW;YAC5B,WAAW,EAAE,IAAI,CAAC,WAAY;YAC9B,iBAAiB,EAAE,IAAI,CAAC,iBAAkB;YAC1C,WAAW,EAAE,IAAI,CAAC,WAAY;YAC9B,QAAQ,EAAE,IAAI,CAAC,QAAS;YACxB,SAAS,EAAE,IAAI,CAAC,SAAU;YAC1B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAU;YAC1B,YAAY,EAAE,IAAI,CAAC,YAAa;YAChC,aAAa,EAAE,IAAI,CAAC,aAAc;SACrC,CAAC;QACF,MAAM,gBAAgB,GAAW,MAAM,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACzF,MAAM,iBAAiB,GAAW,eAAe,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC,CAAC;QAE/F,MAAM,IAAI,CAAC,cAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEzC,MAAM,IAAI,GAAG,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa;QACpC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY;QACnC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ;QAC/B,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QACnC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB;QAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,GAAgB,EAAE,GAAiB;QAC9D,MAAM,SAAS,GAAuB,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACjE,IAAI,SAAS,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,cAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa;QACpC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY;QACnC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB;QAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1C,CAAC;CACJ;AA5NW;IADP,MAAM,CAAC,WAAW,CAAC;;sDACU;AAGtB;IADP,MAAM,CAAC,YAAY,CAAC;8BACE,YAAY;yDAAC;AAG5B;IADP,MAAM,CAAC,eAAe,CAAC;;0DACI;AAGpB;IADP,MAAM;;mDACa;AAGP;IADZ,IAAI;;;;+CAsCJ;AAIY;IAFZ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IACb,IAAI,EAAE;IAEF,WAAA,OAAO,CAAA;IACP,WAAA,QAAQ,CAAA;IACR,WAAA,QAAQ,CAAA;;;;mDAoDZ"}

package/dist/lib/BaseMapiNspiRoute.js

@@ -0,0 +1,114 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { ApiError, ObjectDecorators } from "@rapidrest/core";
+import { ApiErrorMessages, ApiErrors, RepoUtils, RouteDecorators } from "@rapidrest/service-core";
+import { handleNspiBind, handleNspiUnbind } from "./nspi/NspiBindHandler.js";
+import { handleNspiGetMatches } from "./nspi/NspiGetMatchesHandler.js";
+import { resolveCallerMailboxUid } from "@rapidmx/restapi";
+const { Init } = ObjectDecorators;
+const { Auth, Post, Request, Response, User: AuthUser } = RouteDecorators;
+function firstHeader(req, name) {
+    const value = req.headers[name];
+    return Array.isArray(value) ? value[0] : value;
+}
+/**
+ * Abstract base for the single fixed NSPI endpoint (`POST /mapi/nspi` by `[MS-OXCMAPIHTTP]` convention, though
+ * the concrete path is left to the consuming application to mount via `@Route(...)`, the identical
+ * undecorated-base-class pattern `BaseMapiEmsmdbRoute`/`BaseEasRoute` already establish). Dispatches on the
+ * `X-RequestType` header, the same multiplexing mechanism EMSMDB uses - but unlike EMSMDB, there is no ROP
+ * buffer framing here: each `X-RequestType` value (`Bind`/`Unbind`/`GetMatches`) is its own flat, self-
+ * contained request/response body (`[MS-OXCMAPIHTTP]` §2.2.5), so this route dispatches directly to a small
+ * handler function per operation instead of decoding a multiplexed stream.
+ *
+ * **Pragmatic subset scope**: only `Bind`/`Unbind`/`GetMatches` are implemented - real NSPI's other dozen-plus
+ * request types (`QueryRows`, `ResolveNames`, `GetProps`, `ModProps`, ...) are genuine full address-book/
+ * directory-replication operations this deployment's own minimal GAL-lookup use case doesn't need; an
+ * unrecognized `X-RequestType` gets a `501`, the same "recognized-but-deferred vs malformed" distinction
+ * `BaseMapiEmsmdbRoute`'s own `NotificationWait` case already draws. See `NspiBindHandler.ts`'s own doc comment
+ * for why no real NSPI session state is created or tracked between calls.
+ *
+ * **Auth**: `@Auth(["jwt"])`, unchanged from every other route in this app - the same reasoning
+ * `BaseMapiEmsmdbRoute`'s own doc comment already gives for why Bearer-token auth on an address-book endpoint
+ * is real, current Exchange behavior, not a deviation this library invents.
+ *
+ * `mailboxClass`/`contactClass` are supplied by the Mongo/SQL concrete subclasses. GAL search itself (see
+ * `NspiGetMatchesHandler.ts`) uses `RepoUtils`'s `regex(...)` operator, which compiles identically on both
+ * backends - no per-backend hook needed here.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export class BaseMapiNspiRoute {
+    async init() {
+        this.mailboxRepo = await this._objectFactory.newInstance(RepoUtils, {
+            name: this.mailboxClass.name,
+            args: [this.mailboxClass],
+        });
+        this.contactRepo = await this._objectFactory.newInstance(RepoUtils, {
+            name: this.contactClass.name,
+            args: [this.contactClass],
+        });
+    }
+    async dispatch(req, res, user) {
+        if (!this.mailboxRepo || !this.contactRepo) {
+            throw new ApiError(ApiErrors.INTERNAL_ERROR, 500, ApiErrorMessages.INTERNAL_ERROR);
+        }
+        if (!user) {
+            throw new ApiError(ApiErrors.AUTH_PERMISSION_FAILURE, 403, ApiErrorMessages.AUTH_PERMISSION_FAILURE);
+        }
+        const requestType = firstHeader(req, "x-requesttype");
+        res.setHeader("Content-Type", "application/mapi-http")
+            .setHeader("X-RequestType", requestType ?? "")
+            .setHeader("X-ResponseCode", "0")
+            .setHeader("X-ServerApplication", "RapidREST-Mail");
+        switch (requestType) {
+            case "Bind":
+                await handleNspiBind(res, user, this.mailboxRepo);
+                return;
+            case "Unbind":
+                handleNspiUnbind(res);
+                return;
+            case "GetMatches": {
+                const mailboxUid = await resolveCallerMailboxUid(this.mailboxRepo, user);
+                if (!mailboxUid) {
+                    throw new ApiError(ApiErrors.NOT_FOUND, 404, ApiErrorMessages.NOT_FOUND);
+                }
+                await handleNspiGetMatches(req, res, mailboxUid, this.contactRepo);
+                return;
+            }
+            default:
+                res.status(501).send();
+                return;
+        }
+    }
+}
+__decorate([
+    Init,
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], BaseMapiNspiRoute.prototype, "init", null);
+__decorate([
+    Auth(["jwt"]),
+    Post(),
+    __param(0, Request),
+    __param(1, Response),
+    __param(2, AuthUser),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Object]),
+    __metadata("design:returntype", Promise)
+], BaseMapiNspiRoute.prototype, "dispatch", null);
+//# sourceMappingURL=BaseMapiNspiRoute.js.map

package/dist/lib/BaseMapiNspiRoute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseMapiNspiRoute.js","sourceRoot":"","sources":["../../src/BaseMapiNspiRoute.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAgB,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAA4C,SAAS,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC5I,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAW,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AACpE,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC;AAClC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC;AAE1E,SAAS,WAAW,CAAC,GAAgB,EAAE,IAAY;IAC/C,MAAM,KAAK,GAAkC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAgB,iBAAiB;IAWtB,AAAN,KAAK,CAAC,IAAI;QACb,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,SAAS,EAAE;YACjE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI;YAC5B,IAAI,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;SAC5B,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,SAAS,EAAE;YACjE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI;YAC5B,IAAI,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;SAC5B,CAAC,CAAC;IACP,CAAC;IAIY,AAAN,KAAK,CAAC,QAAQ,CAAU,GAAgB,EAAY,GAAiB,EAAY,IAAc;QAClG,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACzC,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,uBAAuB,EAAE,GAAG,EAAE,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QACzG,CAAC;QAED,MAAM,WAAW,GAAuB,WAAW,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAC1E,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,uBAAuB,CAAC;aACjD,SAAS,CAAC,eAAe,EAAE,WAAW,IAAI,EAAE,CAAC;aAC7C,SAAS,CAAC,gBAAgB,EAAE,GAAG,CAAC;aAChC,SAAS,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAC;QAExD,QAAQ,WAAW,EAAE,CAAC;YAClB,KAAK,MAAM;gBACP,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBAClD,OAAO;YACX,KAAK,QAAQ;gBACT,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBACtB,OAAO;YACX,KAAK,YAAY,CAAC,CAAC,CAAC;gBAChB,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBACzE,IAAI,CAAC,UAAU,EAAE,CAAC;oBACd,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBAC7E,CAAC;gBACD,MAAM,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACnE,OAAO;YACX,CAAC;YACD;gBACI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACvB,OAAO;QACf,CAAC;IACL,CAAC;CACJ;AA/CgB;IADZ,IAAI;;;;6CAUJ;AAIY;IAFZ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IACb,IAAI,EAAE;IACgB,WAAA,OAAO,CAAA;IAAoB,WAAA,QAAQ,CAAA;IAAqB,WAAA,QAAQ,CAAA;;;;iDAiCtF"}

package/dist/lib/MapiSessionManager.js

@@ -0,0 +1,119 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { ObjectDecorators } from "@rapidrest/core";
+import { RedisCache, SimpleEntity } from "@rapidrest/service-core";
+const { Init } = ObjectDecorators;
+/** A pragmatic idle-session lifetime. The spec leaves session lifetime to server policy, not a fixed wire
+ * value - a real client re-establishes (`Connect`) transparently whenever its session context has expired. */
+const SESSION_TTL_SECONDS = 15 * 60;
+/**
+ * The MAPI/HTTP `Session Context` (`[MS-OXCMAPIHTTP]` §3.1.1.1): everything a `Connect`-established session
+ * needs across subsequent `Execute` requests. Never persisted to a real database - purely an ephemeral,
+ * TTL-bound cache entry (see `MapiSessionManager` below), so this deliberately extends `SimpleEntity` (just a
+ * `uid`) rather than this library's own `BaseEntity`, which would add ACL/soft-delete/optimistic-locking
+ * machinery this object has no use for.
+ *
+ * `createdAt` is a plain ISO-8601 string, not a `Date` - `RedisCache`'s Redis-backed path round-trips values
+ * through `JSON.stringify`/`JSON.parse`, which silently turns a `Date` into a string on the way out without
+ * reviving it back to a `Date` on the way in; storing it as a string from the start keeps the shape identical
+ * whether a session happens to be served from the in-memory or the Redis-backed path.
+ */
+export class MapiSessionContext extends SimpleEntity {
+    /** `mailboxUid`/`userUid` are always known at construction time (the only call site is
+     * `MapiSessionManager.create()`, which resolves both up front) - required here rather than optional with
+     * a same-value fallback, which would just be dead code no real caller ever takes the other branch of. */
+    constructor(other) {
+        super(other);
+        this.handles = {};
+        this.nextHandleIndex = 1;
+        this.createdAt = new Date().toISOString();
+        /** This session's FID assignments for the 13 `RopLogon` special folders, keyed by FID (decimal string),
+         * valued `"virtual:<name>"` or `"folder:<uid>"` - see `RopLogonHandler`'s own doc comment. Populated by
+         * `RopLogon`, read back by a later `RopOpenFolder`. */
+        this.folderIds = {};
+        /** The reverse of `folderIds` (target -> FID) plus a monotonic counter, maintained alongside it by
+         * `FolderTarget.assignOrGetFid`/`RopLogonHandler` so "does this target already have a FID" is an O(1)
+         * lookup instead of a linear scan of `folderIds` repeated once per table row - see `assignOrGetFid`'s own
+         * doc comment for why the scan this replaces was a genuine (not just theoretical) quadratic cost across a
+         * session's lifetime. Small and purely additive to session state (one more string-keyed map of numbers,
+         * the same order of magnitude as `folderIds` itself), unlike caching whole resolved rows would be. */
+        this.folderTargetIds = {};
+        this.nextFolderId = 1;
+        /** This session's MID assignments, keyed by MID (decimal string), valued `"message:<uid>"` - the message
+         * analog of `folderIds` above. Unlike `folderIds` (pre-populated by `RopLogon`), a MID only ever comes into
+         * existence lazily, the first time a `RopQueryRows` row exposes a message's `PidTagMid` column (see
+         * `MessageTarget.assignOrGetMid`), read back by a later `RopOpenMessage`. */
+        this.messageIds = {};
+        /** The reverse of `messageIds` (target -> MID) plus a monotonic counter - the message analog of
+         * `folderTargetIds`/`nextFolderId` above, for the identical O(1)-lookup reason. */
+        this.messageTargetIds = {};
+        this.nextMessageId = 1;
+        /** This session's `RopGetPropertyIdsFromNames` mapping table (`[MS-OXCPRPT]` §2.2.12), keyed by a JSON
+         * string encoding of the `{guid, kind, lid|name}` `PropertyName` the numeric ID was assigned to - see
+         * `NamedPropertyRegistry.ts`'s own doc comment for why a JSON string (rather than a delimiter-joined one)
+         * is the safest key shape here. A real client resolves every named property (almost every Calendar-specific
+         * one - `PidLidAppointmentStartWhole`, `PidLidBusyStatus`, `PidLidAppointmentRecur`, ...) through this table
+         * once per session before ever setting/reading it via `RopSetProperties`/`RopGetPropertiesSpecific`. */
+        this.namedProperties = {};
+        /** The reverse of `namedProperties` (numeric ID -> `PropertyName` JSON key) plus a monotonic counter -
+         * `NamedPropertyRegistry.ts`'s own doc comment covers why both the O(n) forward scan this replaces and the
+         * `Math.max(...spread)` id-allocation it used are real problems, not just theoretical ones, at real
+         * mailbox/session scale. */
+        this.namedPropertyIds = {};
+        this.nextNamedPropertyId = 0x8000;
+        this.mailboxUid = other.mailboxUid;
+        this.userUid = other.userUid;
+    }
+}
+/**
+ * Stores/loads `MapiSessionContext`s, keyed by the opaque session id that also becomes the `MapiContext`
+ * cookie value. Reuses `@rapidrest/service-core`'s existing generic `RedisCache<T>` (Redis-backed when a
+ * `cache` datastore is configured, transparent in-memory fallback otherwise) rather than either a bespoke
+ * Redis client (unlike `PingCommand`'s own throwaway pub/sub client - fine for ephemeral fan-out, not a good
+ * fit for stateful session data) or the framework's generic cookie/session middleware (built for a whole-app
+ * `req.session` object, not this protocol's specific handle-table shape). `RedisCache` needs no real
+ * persisted entity - only a class with a `.name` for its Redis key prefix - so a purely ephemeral,
+ * never-persisted class like `MapiSessionContext` is a perfectly valid `type` for it.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export class MapiSessionManager {
+    async init() {
+        this.cache = await this._objectFactory.newInstance(RedisCache, {
+            name: MapiSessionContext.name,
+            args: [MapiSessionContext],
+        });
+    }
+    async create(mailboxUid, userUid) {
+        const context = new MapiSessionContext({ mailboxUid, userUid });
+        await this.cache.save(context.uid, context, SESSION_TTL_SECONDS);
+        return context;
+    }
+    async load(sessionId) {
+        return this.cache.load(sessionId);
+    }
+    async save(context) {
+        await this.cache.save(context.uid, context, SESSION_TTL_SECONDS);
+    }
+    async destroy(sessionId) {
+        await this.cache.delete(sessionId);
+    }
+}
+__decorate([
+    Init,
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], MapiSessionManager.prototype, "init", null);
+//# sourceMappingURL=MapiSessionManager.js.map

package/dist/lib/MapiSessionManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MapiSessionManager.js","sourceRoot":"","sources":["../../src/MapiSessionManager.ts"],"names":[],"mappings":";;;;;;;;;AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAiB,UAAU,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAClF,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC;AAElC;8GAC8G;AAC9G,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,CAAC;AAgDpC;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,kBAAmB,SAAQ,YAAY;IA8ChD;;6GAEyG;IACzG,YAAmB,KAAsE;QACrF,KAAK,CAAC,KAAK,CAAC,CAAC;QA/CV,YAAO,GAAqC,EAAE,CAAC;QAC/C,oBAAe,GAAG,CAAC,CAAC;QACpB,cAAS,GAAW,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpD;;+DAEuD;QAChD,cAAS,GAA2B,EAAE,CAAC;QAE9C;;;;;8GAKsG;QAC/F,oBAAe,GAA2B,EAAE,CAAC;QAC7C,iBAAY,GAAG,CAAC,CAAC;QAExB;;;qFAG6E;QACtE,eAAU,GAA2B,EAAE,CAAC;QAE/C;2FACmF;QAC5E,qBAAgB,GAA2B,EAAE,CAAC;QAC9C,kBAAa,GAAG,CAAC,CAAC;QAEzB;;;;;gHAKwG;QACjG,oBAAe,GAA2B,EAAE,CAAC;QAEpD;;;oCAG4B;QACrB,qBAAgB,GAA2B,EAAE,CAAC;QAC9C,wBAAmB,GAAG,MAAM,CAAC;QAOhC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IACjC,CAAC;CACJ;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,kBAAkB;IAOd,AAAN,KAAK,CAAC,IAAI;QACb,IAAI,CAAC,KAAK,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,UAAU,EAAE;YAC5D,IAAI,EAAE,kBAAkB,CAAC,IAAI;YAC7B,IAAI,EAAE,CAAC,kBAAkB,CAAC;SAC7B,CAAC,CAAC;IACP,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,UAAkB,EAAE,OAAe;QACnD,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,KAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;QAClE,OAAO,OAAO,CAAC;IACnB,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,SAAiB;QAC/B,OAAO,IAAI,CAAC,KAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,OAA2B;QACzC,MAAM,IAAI,CAAC,KAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACtE,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,SAAiB;QAClC,MAAM,IAAI,CAAC,KAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;CACJ;AAxBgB;IADZ,IAAI;;;;8CAMJ"}

package/dist/lib/RopDispatcher.js

@@ -0,0 +1,34 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { BufferReader, BufferWriter } from "./codec/BufferCursor.js";
+/**
+ * Walks a decoded `RopBuffer`'s `ropsList` blob, dispatching each contained ROP - identified by its own
+ * leading `RopId` byte - to the matching registered handler in turn, collecting every response into one
+ * output buffer. Deliberately ROP-agnostic: it knows nothing about any specific ROP's own fields, only how to
+ * find the *next* one, via the handler's own advanced `reader` position once `handle()` returns - see
+ * `RopBuffer.ts`'s doc comment for why a fully generic split isn't possible for this wire format.
+ *
+ * An unrecognized `RopId` stops processing immediately: the bytes belonging to that ROP (and everything after
+ * it) can't be skipped without knowing that ROP's own layout, so there is no safe way to resync and continue.
+ * This is an inherent constraint of the wire format, not a design choice this library is choosing not to
+ * handle - a real client only ever sends ROPs the server has already told it (via its supported-command
+ * surface) that it understands.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export async function dispatchRops(ropsList, handlers, context) {
+    const reader = new BufferReader(ropsList);
+    const writer = new BufferWriter();
+    while (reader.hasMore()) {
+        const ropId = reader.readUInt8();
+        const handler = handlers.get(ropId);
+        if (!handler) {
+            break;
+        }
+        await handler.handle(reader, writer, context);
+    }
+    return writer.toBuffer();
+}
+//# sourceMappingURL=RopDispatcher.js.map

package/dist/lib/RopDispatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RopDispatcher.js","sourceRoot":"","sources":["../../src/RopDispatcher.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAGrE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAC9B,QAAgB,EAChB,QAAiC,EACjC,OAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM;QACV,CAAC;QACD,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC7B,CAAC"}