@remit/backend 0.0.1

package/src/derive/contentSignature.test.ts

@@ -0,0 +1,153 @@
+import assert from "node:assert/strict";
+import { afterEach, describe, it } from "node:test";
+import {
+	createContentSigner,
+	getContentSigner,
+	verifyContentSignature,
+} from "./contentSignature.js";
+
+const SECRET = "test-master-secret-at-least-32-chars-long";
+const PATH_A = "accounts/cfg-alice/acc-alice/messages/msg-1/parts/1.2";
+const PATH_B = "accounts/cfg-bob/acc-bob/messages/msg-9/parts/1.2";
+
+const nowSeconds = () => Math.floor(Date.now() / 1000);
+
+describe("content signature: sign + verify round trip", () => {
+	it("a freshly signed URL verifies", () => {
+		const { exp, sig } = createContentSigner(SECRET)(PATH_A);
+		const result = verifyContentSignature(
+			PATH_A,
+			String(exp),
+			sig,
+			SECRET,
+			nowSeconds(),
+		);
+		assert.deepEqual(result, { valid: true });
+	});
+
+	it("rejects a signature minted for a different account's path (cross-account IDOR defense)", () => {
+		const { exp, sig } = createContentSigner(SECRET)(PATH_A);
+		// Present account A's signature against account B's path.
+		const result = verifyContentSignature(
+			PATH_B,
+			String(exp),
+			sig,
+			SECRET,
+			nowSeconds(),
+		);
+		assert.deepEqual(result, { valid: false, reason: "bad-signature" });
+	});
+
+	it("rejects a tampered signature", () => {
+		const { exp, sig } = createContentSigner(SECRET)(PATH_A);
+		const tampered = `${sig.slice(0, -1)}${sig.endsWith("A") ? "B" : "A"}`;
+		const result = verifyContentSignature(
+			PATH_A,
+			String(exp),
+			tampered,
+			SECRET,
+			nowSeconds(),
+		);
+		assert.equal(result.valid, false);
+	});
+
+	it("rejects a valid signature verified with the wrong secret", () => {
+		const { exp, sig } = createContentSigner(SECRET)(PATH_A);
+		const result = verifyContentSignature(
+			PATH_A,
+			String(exp),
+			sig,
+			"a-different-master-secret-also-32-chars",
+			nowSeconds(),
+		);
+		assert.deepEqual(result, { valid: false, reason: "bad-signature" });
+	});
+
+	it("rejects an expired signature", () => {
+		// Negative TTL mints a signature whose expiry is already in the past.
+		const { exp, sig } = createContentSigner(SECRET, -20)(PATH_A);
+		assert.ok(exp < nowSeconds());
+		const result = verifyContentSignature(
+			PATH_A,
+			String(exp),
+			sig,
+			SECRET,
+			nowSeconds(),
+		);
+		assert.deepEqual(result, { valid: false, reason: "expired" });
+	});
+
+	it("reports missing exp/sig distinctly from a bad signature", () => {
+		assert.deepEqual(
+			verifyContentSignature(
+				PATH_A,
+				undefined,
+				undefined,
+				SECRET,
+				nowSeconds(),
+			),
+			{ valid: false, reason: "missing" },
+		);
+	});
+
+	it("rejects a non-integer exp as malformed", () => {
+		const { sig } = createContentSigner(SECRET)(PATH_A);
+		assert.deepEqual(
+			verifyContentSignature(PATH_A, "not-a-number", sig, SECRET, nowSeconds()),
+			{ valid: false, reason: "malformed" },
+		);
+	});
+});
+
+describe("getContentSigner", () => {
+	const ORIGINAL_BACKEND = process.env.DATA_BACKEND;
+	const ORIGINAL_SECRET = process.env.BETTER_AUTH_SECRET;
+
+	afterEach(() => {
+		if (ORIGINAL_BACKEND === undefined) delete process.env.DATA_BACKEND;
+		else process.env.DATA_BACKEND = ORIGINAL_BACKEND;
+		if (ORIGINAL_SECRET === undefined) delete process.env.BETTER_AUTH_SECRET;
+		else process.env.BETTER_AUTH_SECRET = ORIGINAL_SECRET;
+	});
+
+	it("returns undefined outside Postgres mode (AWS keeps unsigned URLs)", () => {
+		delete process.env.DATA_BACKEND;
+		assert.equal(getContentSigner(), undefined);
+	});
+
+	it("returns a working signer in Postgres mode", () => {
+		process.env.DATA_BACKEND = "postgres";
+		process.env.BETTER_AUTH_SECRET = SECRET;
+		const signer = getContentSigner();
+		assert.ok(signer);
+		const { exp, sig } = signer(PATH_A);
+		assert.deepEqual(
+			verifyContentSignature(PATH_A, String(exp), sig, SECRET, nowSeconds()),
+			{ valid: true },
+		);
+	});
+
+	it("throws in Postgres mode when the master secret is missing (fail loud)", () => {
+		process.env.DATA_BACKEND = "postgres";
+		delete process.env.BETTER_AUTH_SECRET;
+		assert.throws(() => getContentSigner(), /BETTER_AUTH_SECRET/);
+	});
+
+	it("returns a working signer in SQLite mode", () => {
+		process.env.DATA_BACKEND = "sqlite";
+		process.env.BETTER_AUTH_SECRET = SECRET;
+		const signer = getContentSigner();
+		assert.ok(signer);
+		const { exp, sig } = signer(PATH_A);
+		assert.deepEqual(
+			verifyContentSignature(PATH_A, String(exp), sig, SECRET, nowSeconds()),
+			{ valid: true },
+		);
+	});
+
+	it("throws in SQLite mode when the master secret is missing (fail loud)", () => {
+		process.env.DATA_BACKEND = "sqlite";
+		delete process.env.BETTER_AUTH_SECRET;
+		assert.throws(() => getContentSigner(), /BETTER_AUTH_SECRET/);
+	});
+});

package/src/derive/contentSignature.ts

@@ -0,0 +1,139 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { usesBetterAuthJwt } from "../data-backend.js";
+
+/**
+ * Signed-URL scheme for `/content/*` on the Postgres stack.
+ *
+ * On AWS the same bytes are guarded by CloudFront + a Lambda@Edge JWT verifier.
+ * The Postgres stack serves `/content/*` straight from the backend container,
+ * and a bearer token cannot ride along on an `<img src>` / `<a href>` content
+ * load rendered inside email HTML. So the backend signs each content URL when
+ * it hands the SPA a `BodyPartResponse.contentUrl`, and the `/content` route
+ * verifies the signature instead of a bearer.
+ *
+ * The signature covers the account-scoped storage path (`accounts/{cfg}/{acc}/
+ * messages/{msg}/parts/{part}`) plus an expiry. Because the path — including
+ * both account ids — is part of the signed message, a signature minted for
+ * account A's content cannot be replayed against account B's path (the
+ * recomputed HMAC won't match). The backend only ever mints signatures for the
+ * authenticated caller's own accountConfigId, so a caller can never obtain a
+ * valid signature for another account. This is the presigned-URL capability
+ * model the export flow already uses: possession of the URL grants access until
+ * it expires, bounded by a short TTL.
+ */
+
+const KEY_DERIVATION_LABEL = "remit-content-url-signing-v1";
+
+/**
+ * Default validity window for a signed content URL. Long enough to cover a
+ * viewing session (react-query caches describeMessage for 30 min and inline
+ * images may load late), short enough to bound the replay window if a URL
+ * leaks.
+ */
+export const CONTENT_URL_TTL_SECONDS = 3600;
+
+/**
+ * Derive a purpose-specific signing subkey from the master secret. Domain
+ * separation via a fixed label keeps the content-signing key distinct from the
+ * raw better-auth secret, so a compromise of one signing space does not reveal
+ * the other. Reusing `BETTER_AUTH_SECRET` as the master means no new secret has
+ * to be provisioned on the Postgres stack — it is already required there.
+ */
+const deriveSigningKey = (masterSecret: string): Buffer =>
+	createHmac("sha256", masterSecret).update(KEY_DERIVATION_LABEL).digest();
+
+const canonicalMessage = (relativePath: string, exp: number): string =>
+	`${relativePath}\n${exp}`;
+
+const computeSignature = (
+	key: Buffer,
+	relativePath: string,
+	exp: number,
+): string =>
+	createHmac("sha256", key)
+		.update(canonicalMessage(relativePath, exp))
+		.digest("base64url");
+
+export interface ContentSignature {
+	exp: number;
+	sig: string;
+}
+
+/**
+ * A function that signs a decoded, account-scoped storage path and returns the
+ * `exp`/`sig` query params to append to its content URL.
+ */
+export type ContentSigner = (relativePath: string) => ContentSignature;
+
+export const createContentSigner = (
+	masterSecret: string,
+	ttlSeconds: number = CONTENT_URL_TTL_SECONDS,
+): ContentSigner => {
+	const key = deriveSigningKey(masterSecret);
+	return (relativePath) => {
+		const exp = Math.floor(Date.now() / 1000) + ttlSeconds;
+		return { exp, sig: computeSignature(key, relativePath, exp) };
+	};
+};
+
+/**
+ * Build the content-URL signer for the current environment, or `undefined` when
+ * signing does not apply. Signing is enforced on the self-host SQL backends
+ * (postgres and sqlite), which serve `/content/*` straight from the backend
+ * container; on AWS the Lambda@Edge JWT verifier guards `/content/*` and the URL
+ * stays unsigned so CloudFront/S3 behaviour is unchanged. Throws on those
+ * backends when the master secret is missing, so a misconfigured deploy fails
+ * loud rather than shipping unsigned (unauthenticated) content URLs.
+ */
+export const getContentSigner = (): ContentSigner | undefined => {
+	if (!usesBetterAuthJwt()) return undefined;
+	const secret = process.env.BETTER_AUTH_SECRET;
+	if (!secret || secret.length === 0) {
+		throw new Error(
+			"a self-host SQL backend (postgres/sqlite) requires BETTER_AUTH_SECRET to sign content URLs",
+		);
+	}
+	return createContentSigner(secret);
+};
+
+export type ContentSignatureFailure =
+	| "missing"
+	| "malformed"
+	| "expired"
+	| "bad-signature";
+
+export type ContentSignatureResult =
+	| { valid: true }
+	| { valid: false; reason: ContentSignatureFailure };
+
+/**
+ * Verify a signed content request. Recomputes the HMAC over the requested path
+ * and the supplied expiry and constant-time compares it against the presented
+ * signature. Pure so the decision can be unit-tested without a live server.
+ */
+export const verifyContentSignature = (
+	relativePath: string,
+	expRaw: string | undefined,
+	sig: string | undefined,
+	masterSecret: string,
+	nowSeconds: number,
+): ContentSignatureResult => {
+	if (!expRaw || !sig) return { valid: false, reason: "missing" };
+
+	const exp = Number(expRaw);
+	if (!Number.isInteger(exp) || exp <= 0) {
+		return { valid: false, reason: "malformed" };
+	}
+	if (exp < nowSeconds) return { valid: false, reason: "expired" };
+
+	const key = deriveSigningKey(masterSecret);
+	const expected = Buffer.from(computeSignature(key, relativePath, exp));
+	const presented = Buffer.from(sig);
+	if (expected.length !== presented.length) {
+		return { valid: false, reason: "bad-signature" };
+	}
+	if (!timingSafeEqual(expected, presented)) {
+		return { valid: false, reason: "bad-signature" };
+	}
+	return { valid: true };
+};

package/src/derive/contentUrl.test.ts

@@ -0,0 +1,156 @@
+import assert from "node:assert/strict";
+import { afterEach, beforeEach, describe, it } from "node:test";
+import {
+	createContentSigner,
+	verifyContentSignature,
+} from "./contentSignature.js";
+import { buildContentUrl, getContentDeliveryDomain } from "./contentUrl.js";
+
+describe("buildContentUrl", () => {
+	it("produces the /content/accounts/{cfg}/{acc}/messages/{msg}/parts/{part} layout the Lambda@Edge expects", () => {
+		const url = buildContentUrl({
+			domain: "https://abc123.cloudfront.net",
+			accountConfigId: "cfg-alice",
+			accountId: "acc-alice",
+			messageId: "msg-1",
+			partPath: "1.2",
+		});
+
+		assert.equal(
+			url,
+			"https://abc123.cloudfront.net/content/accounts/cfg-alice/acc-alice/messages/msg-1/parts/1.2",
+		);
+	});
+
+	it("prepends https:// when the domain is given as a bare hostname", () => {
+		const url = buildContentUrl({
+			domain: "abc123.cloudfront.net",
+			accountConfigId: "cfg-alice",
+			accountId: "acc-alice",
+			messageId: "msg-1",
+			partPath: "1",
+		});
+
+		assert.equal(url.startsWith("https://abc123.cloudfront.net/"), true);
+	});
+
+	it("strips a trailing slash on the domain so the path doesn't double up", () => {
+		const url = buildContentUrl({
+			domain: "https://abc123.cloudfront.net/",
+			accountConfigId: "cfg-alice",
+			accountId: "acc-alice",
+			messageId: "msg-1",
+			partPath: "1",
+		});
+
+		assert.equal(
+			url,
+			"https://abc123.cloudfront.net/content/accounts/cfg-alice/acc-alice/messages/msg-1/parts/1",
+		);
+	});
+
+	it("encodes each segment of partPath defensively (forward-slash kept as separator)", () => {
+		const url = buildContentUrl({
+			domain: "https://cdn.test",
+			accountConfigId: "cfg",
+			accountId: "acc",
+			messageId: "msg",
+			partPath: "1/strange path/3",
+		});
+
+		assert.equal(
+			url,
+			"https://cdn.test/content/accounts/cfg/acc/messages/msg/parts/1/strange%20path/3",
+		);
+	});
+
+	it("leaves the URL unsigned when no signer is provided (AWS/Lambda@Edge path)", () => {
+		const url = buildContentUrl({
+			domain: "https://abc123.cloudfront.net",
+			accountConfigId: "cfg-alice",
+			accountId: "acc-alice",
+			messageId: "msg-1",
+			partPath: "1",
+		});
+		assert.equal(url.includes("?"), false);
+	});
+
+	it("appends an exp/sig signature over the decoded storage path when a signer is provided", () => {
+		const secret = "test-master-secret-at-least-32-chars-long";
+		const url = buildContentUrl({
+			domain: "https://api.example.test",
+			accountConfigId: "cfg-alice",
+			accountId: "acc-alice",
+			messageId: "msg-1",
+			partPath: "1.2",
+			sign: createContentSigner(secret),
+		});
+
+		const parsed = new URL(url);
+		const exp = parsed.searchParams.get("exp");
+		const sig = parsed.searchParams.get("sig");
+		assert.ok(exp);
+		assert.ok(sig);
+		// The signature must verify against the same decoded storage path the
+		// `/content` route recomputes from `req.path`.
+		const relativePath = parsed.pathname.replace(/^\/content\//, "");
+		const result = verifyContentSignature(
+			relativePath,
+			exp,
+			sig,
+			secret,
+			Math.floor(Date.now() / 1000),
+		);
+		assert.deepEqual(result, { valid: true });
+	});
+
+	it("nests accountConfigId before accountId so the Lambda@Edge prefix check matches", () => {
+		const url = buildContentUrl({
+			domain: "https://cdn.test",
+			accountConfigId: "CFG",
+			accountId: "ACC",
+			messageId: "MSG",
+			partPath: "1",
+		});
+
+		const segments = new URL(url).pathname.split("/");
+		// ["", "content", "accounts", "CFG", "ACC", "messages", "MSG", "parts", "1"]
+		assert.equal(segments[1], "content");
+		assert.equal(segments[2], "accounts");
+		assert.equal(segments[3], "CFG");
+		assert.equal(segments[4], "ACC");
+	});
+});
+
+describe("getContentDeliveryDomain", () => {
+	const ORIGINAL = process.env.CONTENT_DELIVERY_DOMAIN;
+
+	beforeEach(() => {
+		delete process.env.CONTENT_DELIVERY_DOMAIN;
+	});
+
+	afterEach(() => {
+		if (ORIGINAL === undefined) delete process.env.CONTENT_DELIVERY_DOMAIN;
+		else process.env.CONTENT_DELIVERY_DOMAIN = ORIGINAL;
+	});
+
+	it("throws when CONTENT_DELIVERY_DOMAIN is unset (fail loud over silent placeholder, #299)", () => {
+		assert.throws(
+			() => getContentDeliveryDomain(),
+			/CONTENT_DELIVERY_DOMAIN is not set/,
+		);
+	});
+
+	it("throws when CONTENT_DELIVERY_DOMAIN is empty", () => {
+		process.env.CONTENT_DELIVERY_DOMAIN = "";
+		assert.throws(
+			() => getContentDeliveryDomain(),
+			/CONTENT_DELIVERY_DOMAIN is not set/,
+		);
+	});
+
+	it("returns the env var value when set", () => {
+		process.env.CONTENT_DELIVERY_DOMAIN = "https://abc.cloudfront.net";
+		assert.equal(getContentDeliveryDomain(), "https://abc.cloudfront.net");
+	});
+});

package/src/derive/contentUrl.ts

@@ -0,0 +1,70 @@
+/**
+ * Build the public CloudFront URL that fetches a single body part for a
+ * message. The path layout is what the Lambda@Edge JWT verifier expects
+ * (PR 1 of #224): `/content/accounts/{accountConfigId}/{accountId}/messages/
+ * {messageId}/parts/{partPath}`.
+ *
+ * The function is intentionally pure — domain comes from configuration so
+ * tests can pin the output without env vars. `partPath` is passed through
+ * `encodeURIComponent` because IMAP section paths are dot-separated digits
+ * (e.g. `1`, `1.2`, `2.1.3`) but a defensive encode keeps the builder safe
+ * if the path ever carries unexpected characters.
+ */
+import type { ContentSigner } from "./contentSignature.js";
+
+export interface BuildContentUrlInput {
+	domain: string;
+	accountConfigId: string;
+	accountId: string;
+	messageId: string;
+	partPath: string;
+	/**
+	 * When present (Postgres stack), append an `exp`/`sig` signature scoped to
+	 * this account's storage path. Absent on AWS, where Lambda@Edge guards the
+	 * URL and the path stays unsigned. See `contentSignature.ts`.
+	 */
+	sign?: ContentSigner;
+}
+
+export const buildContentUrl = (input: BuildContentUrlInput): string => {
+	const { domain, accountConfigId, accountId, messageId, partPath, sign } =
+		input;
+	const normalizedDomain = domain.replace(/\/+$/, "");
+	const base = normalizedDomain.startsWith("http")
+		? normalizedDomain
+		: `https://${normalizedDomain}`;
+	// The signed message is the decoded, account-scoped storage path — the same
+	// value the `/content` route recomputes from `req.path`. Keep it in lockstep
+	// with the verifier's `req.path.replace(/^\/content\//, "")`.
+	const relativePath = `accounts/${accountConfigId}/${accountId}/messages/${messageId}/parts/${partPath}`;
+	const safePart = partPath
+		.split("/")
+		.map((segment) => encodeURIComponent(segment))
+		.join("/");
+	const url = `${base}/content/accounts/${accountConfigId}/${accountId}/messages/${messageId}/parts/${safePart}`;
+	if (!sign) return url;
+	const { exp, sig } = sign(relativePath);
+	return `${url}?exp=${exp}&sig=${encodeURIComponent(sig)}`;
+};
+
+/**
+ * Read the CloudFront distribution domain from the environment. The CDK
+ * wires `CONTENT_DELIVERY_DOMAIN` onto the API Lambda from the
+ * ContentDelivery stack's published SSM parameter (`/{stage}/Remit/frontendUrl`).
+ *
+ * Throws when the env var is missing or empty. `BodyPartResponse.contentUrl`
+ * is required + URL-formatted in the API contract, so silently emitting a
+ * placeholder string would ship a contract lie to clients. Failing loud here
+ * surfaces the missing wire-up as a 500 the deploy team can act on (#299).
+ * Production synth hard-codes a syntactically-valid placeholder URL via
+ * `infra/bin/infra.ts` so this only fires when the env is actually unset.
+ */
+export const getContentDeliveryDomain = (): string => {
+	const value = process.env.CONTENT_DELIVERY_DOMAIN;
+	if (!value || value.length === 0) {
+		throw new Error(
+			"CONTENT_DELIVERY_DOMAIN is not set; BodyPartResponse.contentUrl cannot be built. Wire the CloudFront distribution domain via the API Lambda env (see infra/bin/infra.ts).",
+		);
+	}
+	return value;
+};

package/src/derive/enrichThreadRows.ts

@@ -0,0 +1,155 @@
+import type { ThreadMessageResponse } from "@remit/api-openapi-types";
+import type {
+	AddressItem,
+	MessageItem,
+	ThreadMessageItem,
+} from "@remit/data-ports";
+import { deriveAddressId } from "@remit/data-ports/id";
+import { MessageCategory, SenderTrust, StarColor } from "@remit/domain-enums";
+import { deriveAutoMoved } from "./autoMoved.js";
+import { deriveSenderTrust } from "./senderTrust.js";
+
+/**
+ * Subset of the ElectroDB client surface used for batch enrichment. Declared
+ * structurally so unit tests can pass an in-memory fake without standing up
+ * DynamoDB.
+ */
+export interface EnrichClient {
+	message: {
+		get(messageIds: string[]): Promise<MessageItem[]>;
+	};
+	address: {
+		getAddress(
+			accountConfigId: string,
+			addressIds: string[],
+		): Promise<AddressItem[]>;
+	};
+}
+
+const toResponse = (item: ThreadMessageItem): ThreadMessageResponse => ({
+	threadMessageId: item.threadMessageId,
+	threadId: item.threadId,
+	messageId: item.messageId,
+	accountConfigId: item.accountConfigId,
+	mailboxId: item.mailboxId,
+	fromEmail: item.fromEmail,
+	fromName: item.fromName,
+	subject: item.subject,
+	sentDate: item.sentDate,
+	isRead: item.isRead,
+	hasAttachment: item.hasAttachment,
+	star: item.star ?? StarColor.None,
+	hasStars: item.hasStars,
+	isDeleted: item.isDeleted,
+	snippet: item.snippet,
+	createdAt: item.createdAt,
+	updatedAt: item.updatedAt,
+	senderTrust: SenderTrust.Unknown,
+});
+
+/**
+ * Plan the unique batch-fetch keys for a page of ThreadMessage rows.
+ *
+ * Splitting this out keeps the dedup logic testable without DynamoDB and
+ * documents the contract: a page of N rows produces at most one BatchGet
+ * for messages and one for addresses, no matter how many rows share the
+ * same messageId / sender.
+ *
+ * `addressId` is derived deterministically from `(accountConfigId, fromEmail)`
+ * via `deriveAddressId`, mirroring the write path in
+ * `body-sync.ts`. Rows without a `fromEmail` (rare; sentinel/system rows)
+ * contribute no addressId and fall back to `senderTrust: "unknown"`.
+ */
+export interface BatchPlan {
+	messageIds: string[];
+	addressIds: string[];
+	addressIdByRow: Map<string, string>;
+}
+
+export const planBatchFetch = (rows: ThreadMessageItem[]): BatchPlan => {
+	const messageIds = new Set<string>();
+	const addressIds = new Set<string>();
+	const addressIdByRow = new Map<string, string>();
+
+	for (const row of rows) {
+		messageIds.add(row.messageId);
+
+		if (!row.fromEmail) continue;
+
+		const addressId = deriveAddressId(row.accountConfigId, row.fromEmail);
+		addressIds.add(addressId);
+		addressIdByRow.set(row.threadMessageId, addressId);
+	}
+
+	return {
+		messageIds: [...messageIds],
+		addressIds: [...addressIds],
+		addressIdByRow,
+	};
+};
+
+/**
+ * Enrich a page of ThreadMessage rows with `category` (from the underlying
+ * Message), `senderTrust` (derived from the From Address's flags map) and
+ * `autoMoved` (projected from the Message's internal placement verdict, see
+ * `deriveAutoMoved`).
+ *
+ * Two BatchGetItem calls per page, regardless of page size — see
+ * `planBatchFetch` for the dedup contract.
+ *
+ * Missing rows fall back gracefully: `category` is omitted only when the
+ * underlying Message row is absent (clients treat as `personal`); a present
+ * Message with no stored category coalesces to `uncategorized` (RFC 032 Tier 2).
+ * `senderTrust` defaults to `"unknown"`. `autoMoved` is omitted whenever the
+ * move isn't a real, in-effect auto-move (or the Message row is absent).
+ */
+export const enrichThreadRows = async (
+	rows: ThreadMessageItem[],
+	client: EnrichClient,
+	accountConfigId: string,
+): Promise<ThreadMessageResponse[]> => {
+	if (rows.length === 0) return [];
+
+	const plan = planBatchFetch(rows);
+
+	const [messages, addresses] = await Promise.all([
+		plan.messageIds.length ? client.message.get(plan.messageIds) : [],
+		plan.addressIds.length
+			? client.address.getAddress(accountConfigId, plan.addressIds)
+			: [],
+	]);
+
+	const categoryByMessageId = new Map(
+		messages.map((m) => [
+			m.messageId,
+			m.category ?? MessageCategory.uncategorized,
+		]),
+	);
+	const authenticityByMessageId = new Map(
+		messages.map((m) => [m.messageId, m.authenticity]),
+	);
+	const autoMovedByMessageId = new Map(
+		messages.map((m) => [m.messageId, deriveAutoMoved(m)]),
+	);
+	const trustByAddressId = new Map(
+		addresses.map((a) => [a.addressId, deriveSenderTrust(a.flags)]),
+	);
+
+	return rows.map((row) => {
+		const base = toResponse(row);
+		const category = categoryByMessageId.get(row.messageId);
+		const authenticity = authenticityByMessageId.get(row.messageId);
+		const autoMoved = autoMovedByMessageId.get(row.messageId);
+		const addressId = plan.addressIdByRow.get(row.threadMessageId);
+		const senderTrust = addressId
+			? (trustByAddressId.get(addressId) ?? SenderTrust.Unknown)
+			: SenderTrust.Unknown;
+		return {
+			...base,
+			...(category !== undefined ? { category } : {}),
+			...(authenticity !== undefined ? { authenticity } : {}),
+			...(autoMoved !== undefined ? { autoMoved } : {}),
+			senderTrust,
+		};
+	});
+};