@remit/drizzle-service 0.0.44 → 0.0.46

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/drizzle-service",
-  "version": "0.0.44",
+  "version": "0.0.46",
   "description": "Drizzle ORM service over SQLite",
   "type": "module",
   "main": "src/index.ts",

package/src/repair/address-display-name.sqlite.test.ts

@@ -0,0 +1,280 @@
+/**
+ * The repair against the shape a deployment actually runs: the committed
+ * `CREATE TABLE` blocks, not a schema pushed from the drizzle table objects.
+ *
+ * What this has to hold, on a live database with no second copy of the data:
+ * every name the harvest guard would keep survives, a name that says something
+ * besides the address keeps that something, no row is removed, and a second run
+ * writes nothing.
+ */
+
+import assert from "node:assert/strict";
+import { after, before, describe, test } from "node:test";
+import { storedDisplayName } from "@remit/data-ports/display-name";
+import Database from "better-sqlite3";
+import { shippedTableDdl } from "../test-shipped-sqlite-schema.js";
+import {
+	type DisplayNameRepairClient,
+	EMBEDDED_ADDRESS_LIKE,
+	sweepDisplayNames,
+} from "./address-display-name.js";
+
+const SPOOF = "aramirez@secresaludguaviare.gov.co";
+
+const clientOver = (sqlite: Database.Database): DisplayNameRepairClient => ({
+	all: async (sql, params) => sqlite.prepare(sql).all(...params),
+	run: async (sql, params) => sqlite.prepare(sql).run(...params).changes,
+});
+
+const seed = (sqlite: Database.Database): void => {
+	sqlite.exec(shippedTableDdl("0000_happy_roland_deschain", "address"));
+	sqlite.exec(
+		shippedTableDdl("0000_happy_roland_deschain", "envelope_address"),
+	);
+	sqlite.exec(shippedTableDdl("0000_happy_roland_deschain", "thread_message"));
+
+	const address = sqlite.prepare(
+		`INSERT INTO address (
+			address_id, account_config_id, display_name, local_part, domain,
+			normalized_email, normalized_compound, flags, inbound_count,
+			outbound_count, reply_count, last_inbound_at, last_outbound_at,
+			last_reply_at, created_at, updated_at
+		) VALUES (?, 'cfg-1', ?, 'x', 'y', ?, ?, '{}', 0, 0, 0, 0, NULL, 0, 0, 0)`,
+	);
+	const addressRow = (id: string, name: string | null, email: string): void => {
+		address.run(
+			id,
+			name,
+			email,
+			`${(name ?? "").toLowerCase()} ${email}`.trim(),
+		);
+	};
+
+	addressRow("spoof", "matthijs@ischen.nl", SPOOF);
+	addressRow("embedded", "Matthijs <matthijs@ischen.nl>", SPOOF);
+	addressRow("tabbed", "Support\tmatthijs@ischen.nl", SPOOF);
+	addressRow("parenthesised", "Support (support@acme.com)", "noreply@acme.com");
+	addressRow("comma", "matthijs@ischen.nl, team", SPOOF);
+	addressRow("semicolon", "Team; matthijs@ischen.nl", SPOOF);
+	addressRow("self", "ing@ing-nl-mailing.nl", "ing@ing-nl-mailing.nl");
+	addressRow("self-cased", "Matthijs@Ischen.nl", "matthijs@ischen.nl");
+	addressRow("self-diacritic", "Özcan@example.com", "özcan@example.com");
+	addressRow("self-in-name", "Özcan <Özcan@example.com>", "özcan@example.com");
+	addressRow("human", "Matthijs van Henten", "matthijs@ischen.nl");
+	addressRow("absent", null, "quiet@example.com");
+	addressRow("blank", "", "blank@example.com");
+
+	const envelope = sqlite.prepare(
+		`INSERT INTO envelope_address (
+			envelope_address_id, message_id, address_id, display_name,
+			normalized_email, address_role, address_order, created_at, updated_at
+		) VALUES (?, 'msg-1', 'addr-1', ?, ?, 'From', 0, 0, 0)`,
+	);
+	envelope.run("env-spoof", "matthijs@ischen.nl", SPOOF);
+	envelope.run("env-self", "Özcan@example.com", "özcan@example.com");
+	envelope.run("env-human", "Matthijs van Henten", "matthijs@ischen.nl");
+
+	const thread = sqlite.prepare(
+		`INSERT INTO thread_message (
+			thread_message_id, thread_id, message_id, account_config_id, mailbox_id,
+			uid, reference_order, from_email, from_name, subject, internal_date,
+			sent_date, is_read, has_attachment, has_stars, is_deleted,
+			created_at, updated_at
+		) VALUES (?, 'thr-1', 'msg-1', 'cfg-1', 'mbx-1', 1, 0, ?, ?, 's', 0, 0, 0, 0, 0, 0, 0, 0)`,
+	);
+	thread.run("thr-spoof", SPOOF, "matthijs@ischen.nl");
+	thread.run("thr-named", SPOOF, "Support <matthijs@ischen.nl>");
+	thread.run("thr-unparseable", null, "matthijs@ischen.nl");
+	thread.run("thr-human", SPOOF, "Alejandro Ramirez");
+};
+
+describe("rewriting display names that claim another address", () => {
+	let sqlite: Database.Database;
+	let client: DisplayNameRepairClient;
+
+	before(() => {
+		sqlite = new Database(":memory:");
+		seed(sqlite);
+		client = clientOver(sqlite);
+	});
+
+	after(() => {
+		sqlite.close();
+	});
+
+	const nameOf = (id: string): string | null =>
+		(
+			sqlite
+				.prepare("SELECT display_name AS n FROM address WHERE address_id = ?")
+				.get(id) as { n: string | null }
+		).n;
+
+	test("check writes nothing and counts what repair would rewrite", async () => {
+		const report = await sweepDisplayNames(client, "check");
+
+		assert.equal(report.claiming, 10);
+		assert.deepEqual(
+			report.sites.map((site) => [site.table, site.claiming, site.rewritten]),
+			[
+				["address", 6, 0],
+				["envelope_address", 1, 0],
+				["thread_message", 3, 0],
+			],
+		);
+		assert.equal(nameOf("spoof"), "matthijs@ischen.nl");
+	});
+
+	test("repair rewrites exactly those rows", async () => {
+		const report = await sweepDisplayNames(client, "repair");
+
+		assert.deepEqual(
+			report.sites.map((site) => [site.table, site.rewritten]),
+			[
+				["address", 6],
+				["envelope_address", 1],
+				["thread_message", 3],
+			],
+		);
+	});
+
+	test("empties a name that is nothing but another address", () => {
+		assert.equal(nameOf("spoof"), "");
+	});
+
+	test("keeps the text a name carries besides the address", () => {
+		const kept: ReadonlyArray<readonly [string, string]> = [
+			["embedded", "Matthijs"],
+			["tabbed", "Support"],
+			["parenthesised", "Support"],
+			["comma", "team"],
+			["semicolon", "Team"],
+		];
+		for (const [id, remainder] of kept) {
+			assert.equal(nameOf(id), remainder, id);
+		}
+	});
+
+	test("rebuilds the search compound the way the app writes it", () => {
+		const rows = sqlite
+			.prepare(
+				"SELECT address_id AS id, normalized_compound AS c FROM address WHERE address_id IN ('spoof', 'embedded') ORDER BY address_id",
+			)
+			.all() as Array<{ id: string; c: string }>;
+		assert.deepEqual(
+			rows.map((row) => [row.id, row.c]),
+			[
+				["embedded", `matthijs ${SPOOF}`],
+				["spoof", SPOOF],
+			],
+		);
+	});
+
+	test("keeps every name the harvest guard keeps", () => {
+		const kept: ReadonlyArray<readonly [string, string | null]> = [
+			["self", "ing@ing-nl-mailing.nl"],
+			["self-cased", "Matthijs@Ischen.nl"],
+			["self-diacritic", "Özcan@example.com"],
+			["self-in-name", "Özcan <Özcan@example.com>"],
+			["human", "Matthijs van Henten"],
+			["absent", null],
+			["blank", ""],
+		];
+		for (const [id, name] of kept) {
+			assert.equal(nameOf(id), name, id);
+		}
+	});
+
+	test("clears the From line the message header renders", () => {
+		const rows = sqlite
+			.prepare(
+				"SELECT envelope_address_id AS id, display_name AS n FROM envelope_address ORDER BY envelope_address_id",
+			)
+			.all() as Array<{ id: string; n: string | null }>;
+		assert.deepEqual(rows, [
+			{ id: "env-human", n: "Matthijs van Henten" },
+			{ id: "env-self", n: "Özcan@example.com" },
+			{ id: "env-spoof", n: "" },
+		]);
+	});
+
+	test("clears the sender label in the message list", () => {
+		const rows = sqlite
+			.prepare(
+				"SELECT thread_message_id AS id, from_name AS n FROM thread_message ORDER BY thread_message_id",
+			)
+			.all() as Array<{ id: string; n: string | null }>;
+		assert.deepEqual(rows, [
+			{ id: "thr-human", n: "Alejandro Ramirez" },
+			{ id: "thr-named", n: "Support" },
+			{ id: "thr-spoof", n: null },
+			{ id: "thr-unparseable", n: null },
+		]);
+	});
+
+	test("removes no row", () => {
+		for (const [table, count] of [
+			["address", 13],
+			["envelope_address", 3],
+			["thread_message", 4],
+		] as const) {
+			const row = sqlite
+				.prepare(`SELECT count(*) AS n FROM ${table}`)
+				.get() as {
+				n: number;
+			};
+			assert.equal(row.n, count, table);
+		}
+	});
+
+	test("a second run writes nothing", async () => {
+		const report = await sweepDisplayNames(client, "repair");
+		assert.equal(report.claiming, 0);
+	});
+});
+
+/**
+ * The SQL in this repair narrows; it never decides. That only holds if no name
+ * the rule rewrites can slip past the narrowing — the case where a planted name
+ * would survive the sweep unseen.
+ */
+describe("the SQL narrowing is a superset of the rule", () => {
+	test("selects every name the rule rewrites", () => {
+		const sqlite = new Database(":memory:");
+		sqlite.exec("CREATE TABLE probe (name text)");
+		const insert = sqlite.prepare("INSERT INTO probe VALUES (?)");
+		const names = [
+			"matthijs@ischen.nl",
+			"Matthijs <matthijs@ischen.nl>",
+			"Support (support@acme.com)",
+			"Support\tmatthijs@ischen.nl",
+			"Support matthijs@ischen.nl",
+			"Support​matthijs@ischen.nl",
+			"prvs=0068b51f37=matthijs@ischen.nl",
+			'"matthijs@ischen.nl"',
+			"matthijs@ischen.nl, team",
+			"Team; matthijs@ischen.nl",
+			"Özcan@example.com",
+			"MATTHIJS@ISCHEN.NL",
+			"matthijs@mail.ischen.nl",
+			"Matthijs van Henten",
+			"me @ home",
+			"a@b.c",
+			"",
+		];
+		for (const name of names) insert.run(name);
+
+		const selected = new Set(
+			(
+				sqlite
+					.prepare("SELECT name FROM probe WHERE name LIKE ?")
+					.all(EMBEDDED_ADDRESS_LIKE) as Array<{ name: string }>
+			).map((row) => row.name),
+		);
+		sqlite.close();
+
+		for (const name of names) {
+			if (storedDisplayName(name, "nobody@example.org") === name) continue;
+			assert.equal(selected.has(name), true, name);
+		}
+	});
+});

package/src/repair/address-display-name.ts

@@ -0,0 +1,200 @@
+import { storedDisplayName } from "@remit/data-ports/display-name";
+
+/**
+ * Rewriting the display names a spoofing sender already planted (issue #826).
+ *
+ * The harvest guard only decides what is stored from now on. Every name already
+ * written stays live, and none of the three write paths repairs one on a
+ * re-sync: `upsertAddress` refuses to overwrite a name with an empty one,
+ * `upsertEnvelopeAddress` is `onConflictDoNothing`, and a ThreadMessage is
+ * created once. On the instance that was hit there were 150 email-shaped
+ * display names in `address` alone, 30 of them naming a different address.
+ *
+ * The decision is `storedDisplayName` and nothing else. Expressing it a second
+ * time in SQL is what makes this dangerous: SQLite's `lower()` folds ASCII
+ * where JS folds all of Unicode, and its `trim()` and a literal space in a GLOB
+ * know only U+0020, so a SQL twin rewrites `Özcan@example.com` on
+ * `özcan@example.com` and `foo\tbar@baz.com` on anything — names the guard
+ * keeps, destroyed on a database holding the only copy. SQL narrows the scan
+ * and never decides.
+ *
+ * This is a repair rather than a migration because a migration is SQL, and SQL
+ * is exactly what must not hold the rule. It is convergent: a name the guard
+ * would keep is never rewritten twice, so re-running it, or resuming it after a
+ * crash part-way through, writes only what is left to write.
+ */
+
+export interface DisplayNameRepairClient {
+	all(sql: string, params: readonly unknown[]): Promise<unknown[]>;
+	run(sql: string, params: readonly unknown[]): Promise<number>;
+}
+
+export type DisplayNameRepairMode = "check" | "repair";
+
+/**
+ * The scan narrows to names that could carry an address at all: everything
+ * `storedDisplayName` rewrites contains `x@y.zz`, so a row this misses cannot
+ * be claiming anything. It is a filter, never the decision — the pairing is
+ * pinned by a test that runs both halves over the same strings.
+ */
+export const EMBEDDED_ADDRESS_LIKE = "%_@_%.__%";
+
+interface RepairSite {
+	readonly table: string;
+	readonly key: string;
+	readonly name: string;
+	readonly email: string;
+	/** The compound the search path reads, where the table keeps one. */
+	readonly compound?: string;
+	/** What the write path stores for an absent name on this table. */
+	readonly absent: "" | null;
+}
+
+/**
+ * Every column an attacker-chosen name lands in. `address.display_name` is the
+ * one autocomplete reads; `envelope_address.display_name` is the From line the
+ * message header renders; `thread_message.from_name` is the sender label in the
+ * message list and the text the search index tokenizes.
+ */
+const SITES: readonly RepairSite[] = [
+	{
+		table: "address",
+		key: "address_id",
+		name: "display_name",
+		email: "normalized_email",
+		compound: "normalized_compound",
+		absent: "",
+	},
+	{
+		table: "envelope_address",
+		key: "envelope_address_id",
+		name: "display_name",
+		email: "normalized_email",
+		absent: "",
+	},
+	{
+		table: "thread_message",
+		key: "thread_message_id",
+		name: "from_name",
+		email: "from_email",
+		absent: null,
+	},
+];
+
+export interface SiteResult {
+	readonly table: string;
+	readonly scanned: number;
+	readonly claiming: number;
+	readonly rewritten: number;
+}
+
+export interface DisplayNameReport {
+	readonly mode: DisplayNameRepairMode;
+	readonly sites: readonly SiteResult[];
+	readonly claiming: number;
+}
+
+interface CandidateRow {
+	id: string;
+	name: string | null;
+	email: string | null;
+}
+
+const isCandidateRow = (row: unknown): row is CandidateRow =>
+	typeof row === "object" &&
+	row !== null &&
+	typeof (row as { id: unknown }).id === "string";
+
+const candidates = async (
+	client: DisplayNameRepairClient,
+	site: RepairSite,
+): Promise<CandidateRow[]> => {
+	const rows = await client.all(
+		`SELECT ${site.key} AS id, ${site.name} AS name, ${site.email} AS email
+		 FROM ${site.table}
+		 WHERE ${site.name} LIKE ?`,
+		[EMBEDDED_ADDRESS_LIKE],
+	);
+	return rows.filter(isCandidateRow);
+};
+
+/**
+ * One row at a time, because each row keeps a different remainder. The set is
+ * what a spoofing sender planted, not the table.
+ */
+const rewrite = async (
+	client: DisplayNameRepairClient,
+	site: RepairSite,
+	row: CandidateRow,
+	stored: string,
+): Promise<number> => {
+	const columns = [`${site.name} = ?`];
+	const params: unknown[] = [stored === "" ? site.absent : stored];
+
+	if (site.compound) {
+		columns.push(`${site.compound} = ?`);
+		params.push(`${stored.toLowerCase()} ${row.email ?? ""}`.trim());
+	}
+	params.push(row.id);
+
+	return client.run(
+		`UPDATE ${site.table} SET ${columns.join(", ")} WHERE ${site.key} = ?`,
+		params,
+	);
+};
+
+/**
+ * `check` writes nothing, so it can be pointed at a live instance; `repair`
+ * runs the same scan and rewrites what it finds. One code path, so the report
+ * can never describe a decision the repair does not make.
+ */
+export const sweepDisplayNames = async (
+	client: DisplayNameRepairClient,
+	mode: DisplayNameRepairMode,
+): Promise<DisplayNameReport> => {
+	const sites: SiteResult[] = [];
+
+	for (const site of SITES) {
+		const rows = await candidates(client, site);
+		let claiming = 0;
+		let rewritten = 0;
+
+		for (const row of rows) {
+			const name = row.name ?? "";
+			const stored = storedDisplayName(name, row.email ?? undefined);
+			if (stored === name) continue;
+			claiming += 1;
+			if (mode === "repair") {
+				rewritten += await rewrite(client, site, row, stored);
+			}
+		}
+
+		sites.push({
+			table: site.table,
+			scanned: rows.length,
+			claiming,
+			rewritten,
+		});
+	}
+
+	return {
+		mode,
+		sites,
+		claiming: sites.reduce((sum, site) => sum + site.claiming, 0),
+	};
+};
+
+export const formatDisplayNameReport = (
+	report: DisplayNameReport,
+): string[] => {
+	if (report.claiming === 0) {
+		return ["no display name claims another address"];
+	}
+	return report.sites
+		.filter((site) => site.claiming > 0)
+		.map(
+			(site) =>
+				`${site.table}: ${site.claiming} of ${site.scanned} scanned name(s) claim another address` +
+				(report.mode === "repair" ? `, ${site.rewritten} rewritten` : ""),
+		);
+};

package/src/repos/address-search-predicates.ts

@@ -8,10 +8,10 @@ import { addressTable } from "../schema/i4-address.js";
 const escapeLike = (term: string): string => term.replace(/[\\%_]/g, "\\$&");
 
 const SEARCH_COLUMNS = [
-	sql`lower(coalesce(${addressTable.displayName}, ''))`,
+	sql`${addressTable.normalizedEmail}`,
 	sql`${addressTable.localPart}`,
+	sql`lower(coalesce(${addressTable.displayName}, ''))`,
 	sql`${addressTable.domain}`,
-	sql`${addressTable.normalizedEmail}`,
 ] as const;
 
 /**
@@ -45,22 +45,27 @@ export const addressSearchMatch = (term: string): SQL => {
 };
 
 /**
- * Where the term hit, as one number: every match at the start of a column
- * outranks every match in the middle of one, and within each the display name
- * outranks the local part, the domain and the whole address. A mid-string match
- * still comes back — this only decides the order.
+ * Where the term hit, as one number, highest tier first. The address the term
+ * spells out ranks above every prefix of it: a display name is free text the
+ * sender picks, and a domain somebody else registered is a prefix away from the
+ * address the reader typed, so neither may take the suggestion slot from the
+ * address that matches whole. Below that, a match at the start of a column
+ * outranks one in the middle, and within each the whole address, the local part
+ * and the display name outrank the domain they share. A mid-string match still
+ * comes back — this only decides the order.
  */
 export const addressMatchRank = (term: string | undefined): SQL<number> => {
 	// Not the bare literal `0`: SQLite reads an integer literal in ORDER BY as a
 	// column index and rejects it as out of range.
 	if (!term) return sql<number>`cast(0 as integer)`;
 	const { leading, anywhere } = patterns(term);
-	const arms = [
+	const tiers = [
+		sql`${addressTable.normalizedEmail} = ${term.toLowerCase()}`,
 		...SEARCH_COLUMNS.map((column) => like(column, leading)),
 		...SEARCH_COLUMNS.map((column) => like(column, anywhere)),
-	].map(
-		(condition, index) =>
-			sql`when ${condition} then ${SEARCH_COLUMNS.length * 2 - index}`,
+	];
+	const arms = tiers.map(
+		(condition, index) => sql`when ${condition} then ${tiers.length - index}`,
 	);
 	return sql<number>`case ${sql.join(arms, sql` `)} else 0 end`;
 };

package/src/repos/i4-address.test.ts

@@ -417,6 +417,156 @@ describe("AddressRepo", () => {
 		]);
 	});
 
+	test("listByAccountConfig never lets a display name outrank the address a term matches", async () => {
+		const accountConfigId = randomId();
+		// The 2021 spam row: its display name is the account's own address, its
+		// real address is somewhere else entirely.
+		const spoof = await repo.createAddress({
+			...makeAddressInput(
+				accountConfigId,
+				"aramirez@secresaludguaviare.gov.co",
+			),
+			displayName: "matthijs@ischen.nl",
+			normalizedCompound:
+				"matthijs@ischen.nl aramirez@secresaludguaviare.gov.co",
+			inboundCount: 500,
+		});
+		// The address typed, as a prefix of a domain somebody else registered,
+		// louder than the account's own correspondence with itself.
+		const lookalike = await repo.createAddress({
+			...makeAddressInput(accountConfigId, "matthijs@ischen.nl.evil.example"),
+			displayName: "matthijs@ischen.nl",
+			normalizedCompound: "matthijs@ischen.nl matthijs@ischen.nl.evil.example",
+			inboundCount: 900,
+		});
+		const own = await repo.createAddress({
+			...makeAddressInput(accountConfigId, "matthijs@ischen.nl"),
+			displayName: "Matthijs van Henten",
+			normalizedCompound: "matthijs van henten matthijs@ischen.nl",
+			inboundCount: 3,
+		});
+
+		const found = await repo.listByAccountConfig({
+			accountConfigId,
+			search: "matthijs@ischen.nl",
+		});
+		assert.deepEqual(
+			found.items.map((a) => a.normalizedEmail),
+			[own.normalizedEmail, lookalike.normalizedEmail, spoof.normalizedEmail],
+			"the address typed must lead every address that only prefixes or claims it",
+		);
+
+		const onlySuggestion = await repo.listByAccountConfig({
+			accountConfigId,
+			search: "matthijs@ischen.nl",
+			limit: 1,
+		});
+		assert.deepEqual(
+			onlySuggestion.items.map((a) => a.normalizedEmail),
+			[own.normalizedEmail],
+			"a single suggestion slot goes to the address that matches whole",
+		);
+
+		await repo.deleteManyAddresses(accountConfigId, [
+			spoof.addressId,
+			lookalike.addressId,
+			own.addressId,
+		]);
+	});
+
+	test("listByAccountConfig keeps a leading display-name match above a domain that only contains the term", async () => {
+		const accountConfigId = randomId();
+		const shop = await repo.createAddress({
+			...makeAddressInput(accountConfigId, "hello@other.test"),
+			displayName: "Corner Shop",
+			normalizedCompound: "corner shop hello@other.test",
+		});
+		const leadingDomain = await repo.createAddress({
+			...makeAddressInput(
+				accountConfigId,
+				"sales@cornerstone-analytics.example",
+			),
+			displayName: "Sales Team",
+			normalizedCompound: "sales team sales@cornerstone-analytics.example",
+			inboundCount: 200,
+		});
+		const middleDomain = await repo.createAddress({
+			...makeAddressInput(accountConfigId, "news@list-corner.example"),
+			displayName: "Loud List",
+			normalizedCompound: "loud list news@list-corner.example",
+			inboundCount: 500,
+		});
+
+		const found = await repo.listByAccountConfig({
+			accountConfigId,
+			search: "corner",
+		});
+		assert.deepEqual(
+			found.items.map((a) => a.addressId),
+			[shop.addressId, leadingDomain.addressId, middleDomain.addressId],
+			"the name a reader types stays the first suggestion",
+		);
+
+		await repo.deleteManyAddresses(accountConfigId, [
+			shop.addressId,
+			leadingDomain.addressId,
+			middleDomain.addressId,
+		]);
+	});
+
+	test("listByAccountConfig ranks an address match above a display-name match for the same term", async () => {
+		const accountConfigId = randomId();
+		const byAddress = await repo.createAddress({
+			...makeAddressInput(accountConfigId, "corner@shop.test"),
+			displayName: "Zed Ziegler",
+			normalizedCompound: "zed ziegler corner@shop.test",
+		});
+		const byName = await repo.createAddress({
+			...makeAddressInput(accountConfigId, "hello@other.test"),
+			displayName: "Corner Shop",
+			normalizedCompound: "corner shop hello@other.test",
+			inboundCount: 500,
+		});
+
+		const found = await repo.listByAccountConfig({
+			accountConfigId,
+			search: "corner",
+		});
+		assert.deepEqual(
+			found.items.map((a) => a.addressId),
+			[byAddress.addressId, byName.addressId],
+			"the address decides ahead of free text the sender wrote",
+		);
+
+		await repo.deleteManyAddresses(accountConfigId, [
+			byAddress.addressId,
+			byName.addressId,
+		]);
+	});
+
+	test("listByAccountConfig still resolves a display-name match no address matches", async () => {
+		const accountConfigId = randomId();
+		const created = await repo.createAddress({
+			...makeAddressInput(accountConfigId, "w.baker@kliniek.nl"),
+			displayName: "Wendy Baker",
+			normalizedCompound: "wendy baker w.baker@kliniek.nl",
+		});
+
+		for (const term of ["wendy", "baker", "wendy baker"]) {
+			const found = await repo.listByAccountConfig({
+				accountConfigId,
+				search: term,
+			});
+			assert.deepEqual(
+				found.items.map((a) => a.addressId),
+				[created.addressId],
+				`"${term}" must resolve the address by its display name`,
+			);
+		}
+
+		await repo.deleteManyAddresses(accountConfigId, [created.addressId]);
+	});
+
 	test("cross-tenant: a search never reaches another account's addresses", async () => {
 		const mine = randomId();
 		const theirs = randomId();