@remit/drizzle-service 0.0.47 → 0.0.49

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/drizzle-service",
-  "version": "0.0.47",
+  "version": "0.0.49",
   "description": "Drizzle ORM service over SQLite",
   "type": "module",
   "main": "src/index.ts",

package/src/repair/address-display-name.sqlite.test.ts

@@ -1,13 +1,3 @@
-/**
- * The repair against the shape a deployment actually runs: the committed
- * `CREATE TABLE` blocks, not a schema pushed from the drizzle table objects.
- *
- * What this has to hold, on a live database with no second copy of the data:
- * every name the harvest guard would keep survives, a name that says something
- * besides the address keeps that something, no row is removed, and a second run
- * writes nothing.
- */
-
 import assert from "node:assert/strict";
 import { after, before, describe, test } from "node:test";
 import { storedDisplayName } from "@remit/data-ports/display-name";
@@ -232,11 +222,6 @@ describe("rewriting display names that claim another address", () => {
 	});
 });
 
-/**
- * The SQL in this repair narrows; it never decides. That only holds if no name
- * the rule rewrites can slip past the narrowing — the case where a planted name
- * would survive the sweep unseen.
- */
 describe("the SQL narrowing is a superset of the rule", () => {
 	test("selects every name the rule rewrites", () => {
 		const sqlite = new Database(":memory:");

package/src/repair/address-display-name.ts

@@ -1,29 +1,5 @@
 import { storedDisplayName } from "@remit/data-ports/display-name";
 
-/**
- * Rewriting the display names a spoofing sender already planted (issue #826).
- *
- * The harvest guard only decides what is stored from now on. Every name already
- * written stays live, and none of the three write paths repairs one on a
- * re-sync: `upsertAddress` refuses to overwrite a name with an empty one,
- * `upsertEnvelopeAddress` is `onConflictDoNothing`, and a ThreadMessage is
- * created once. On the instance that was hit there were 150 email-shaped
- * display names in `address` alone, 30 of them naming a different address.
- *
- * The decision is `storedDisplayName` and nothing else. Expressing it a second
- * time in SQL is what makes this dangerous: SQLite's `lower()` folds ASCII
- * where JS folds all of Unicode, and its `trim()` and a literal space in a GLOB
- * know only U+0020, so a SQL twin rewrites `Özcan@example.com` on
- * `özcan@example.com` and `foo\tbar@baz.com` on anything — names the guard
- * keeps, destroyed on a database holding the only copy. SQL narrows the scan
- * and never decides.
- *
- * This is a repair rather than a migration because a migration is SQL, and SQL
- * is exactly what must not hold the rule. It is convergent: a name the guard
- * would keep is never rewritten twice, so re-running it, or resuming it after a
- * crash part-way through, writes only what is left to write.
- */
-
 export interface DisplayNameRepairClient {
 	all(sql: string, params: readonly unknown[]): Promise<unknown[]>;
 	run(sql: string, params: readonly unknown[]): Promise<number>;
@@ -31,53 +7,39 @@ export interface DisplayNameRepairClient {
 
 export type DisplayNameRepairMode = "check" | "repair";
 
-/**
- * The scan narrows to names that could carry an address at all: everything
- * `storedDisplayName` rewrites contains `x@y.zz`, so a row this misses cannot
- * be claiming anything. It is a filter, never the decision — the pairing is
- * pinned by a test that runs both halves over the same strings.
- */
 export const EMBEDDED_ADDRESS_LIKE = "%_@_%.__%";
 
 interface RepairSite {
 	readonly table: string;
-	readonly key: string;
-	readonly name: string;
-	readonly email: string;
-	/** The compound the search path reads, where the table keeps one. */
-	readonly compound?: string;
-	/** What the write path stores for an absent name on this table. */
-	readonly absent: "" | null;
+	readonly keyColumn: string;
+	readonly nameColumn: string;
+	readonly emailColumn: string;
+	readonly searchCompoundColumn?: string;
+	readonly storedWhenNameIsAbsent: "" | null;
 }
 
-/**
- * Every column an attacker-chosen name lands in. `address.display_name` is the
- * one autocomplete reads; `envelope_address.display_name` is the From line the
- * message header renders; `thread_message.from_name` is the sender label in the
- * message list and the text the search index tokenizes.
- */
 const SITES: readonly RepairSite[] = [
 	{
 		table: "address",
-		key: "address_id",
-		name: "display_name",
-		email: "normalized_email",
-		compound: "normalized_compound",
-		absent: "",
+		keyColumn: "address_id",
+		nameColumn: "display_name",
+		emailColumn: "normalized_email",
+		searchCompoundColumn: "normalized_compound",
+		storedWhenNameIsAbsent: "",
 	},
 	{
 		table: "envelope_address",
-		key: "envelope_address_id",
-		name: "display_name",
-		email: "normalized_email",
-		absent: "",
+		keyColumn: "envelope_address_id",
+		nameColumn: "display_name",
+		emailColumn: "normalized_email",
+		storedWhenNameIsAbsent: "",
 	},
 	{
 		table: "thread_message",
-		key: "thread_message_id",
-		name: "from_name",
-		email: "from_email",
-		absent: null,
+		keyColumn: "thread_message_id",
+		nameColumn: "from_name",
+		emailColumn: "from_email",
+		storedWhenNameIsAbsent: null,
 	},
 ];
 
@@ -110,44 +72,37 @@ const candidates = async (
 	site: RepairSite,
 ): Promise<CandidateRow[]> => {
 	const rows = await client.all(
-		`SELECT ${site.key} AS id, ${site.name} AS name, ${site.email} AS email
+		`SELECT ${site.keyColumn} AS id, ${site.nameColumn} AS name, ${site.emailColumn} AS email
 		 FROM ${site.table}
-		 WHERE ${site.name} LIKE ?`,
+		 WHERE ${site.nameColumn} LIKE ?`,
 		[EMBEDDED_ADDRESS_LIKE],
 	);
 	return rows.filter(isCandidateRow);
 };
 
-/**
- * One row at a time, because each row keeps a different remainder. The set is
- * what a spoofing sender planted, not the table.
- */
 const rewrite = async (
 	client: DisplayNameRepairClient,
 	site: RepairSite,
 	row: CandidateRow,
 	stored: string,
 ): Promise<number> => {
-	const columns = [`${site.name} = ?`];
-	const params: unknown[] = [stored === "" ? site.absent : stored];
+	const columns = [`${site.nameColumn} = ?`];
+	const params: unknown[] = [
+		stored === "" ? site.storedWhenNameIsAbsent : stored,
+	];
 
-	if (site.compound) {
-		columns.push(`${site.compound} = ?`);
+	if (site.searchCompoundColumn) {
+		columns.push(`${site.searchCompoundColumn} = ?`);
 		params.push(`${stored.toLowerCase()} ${row.email ?? ""}`.trim());
 	}
 	params.push(row.id);
 
 	return client.run(
-		`UPDATE ${site.table} SET ${columns.join(", ")} WHERE ${site.key} = ?`,
+		`UPDATE ${site.table} SET ${columns.join(", ")} WHERE ${site.keyColumn} = ?`,
 		params,
 	);
 };
 
-/**
- * `check` writes nothing, so it can be pointed at a live instance; `repair`
- * runs the same scan and rewrites what it finds. One code path, so the report
- * can never describe a decision the repair does not make.
- */
 export const sweepDisplayNames = async (
 	client: DisplayNameRepairClient,
 	mode: DisplayNameRepairMode,

package/src/repos/i4-mailbox-special-use.sqlite.test.ts

@@ -0,0 +1,79 @@
+import assert from "node:assert/strict";
+import { randomUUID } from "node:crypto";
+import { after, before, describe, test } from "node:test";
+import { mailboxSpecialUseTable, mailboxTable } from "../schema.js";
+import { createSqliteTestDb } from "../test-db-sqlite.js";
+import { MailboxRepo } from "./i4-mailbox.js";
+import { MailboxSpecialUseRepo } from "./i4-mailbox-special-use.js";
+
+const makeMailboxInput = (accountId: string, fullPath: string) => ({
+	accountId,
+	namespaceType: "personal" as const,
+	namespacePrefix: "",
+	hierarchyDelimiter: "/",
+	fullPath,
+	uidValidity: 1,
+	uidNext: 1,
+	highestModseq: "0",
+	messageCount: 0,
+	unseenCount: 0,
+	deletedCount: 0,
+	totalSize: 0,
+	lastSyncUid: 0,
+	highWaterMarkUid: 0,
+	lastMessageSyncAt: Date.now(),
+});
+
+describe("MailboxSpecialUseRepo.findJunkMailbox (sqlite)", () => {
+	let close: () => Promise<void>;
+	let repo: MailboxSpecialUseRepo;
+	let mailboxes: MailboxRepo;
+
+	before(async () => {
+		const testDb = await createSqliteTestDb({
+			mailbox: mailboxTable,
+			mailboxSpecialUse: mailboxSpecialUseTable,
+		});
+		close = testDb.close;
+		repo = new MailboxSpecialUseRepo(testDb.db as never);
+		mailboxes = new MailboxRepo(testDb.db as never);
+	});
+
+	after(async () => {
+		await close();
+	});
+
+	test("resolves an INBOX-nested Junk folder that advertises \\Junk", async () => {
+		const accountId = randomUUID();
+		await mailboxes.create(makeMailboxInput(accountId, "INBOX"));
+		const spam = await mailboxes.create(
+			makeMailboxInput(accountId, "INBOX/Spam"),
+		);
+		await repo.create(spam.mailboxId, "Junk");
+
+		const found = await repo.findJunkMailbox(accountId);
+		assert.equal(found?.mailboxId, spam.mailboxId);
+	});
+
+	test("resolves an INBOX-nested Junk folder that advertises no special use", async () => {
+		// The name fallback used to compare the whole path against a list of
+		// bare names, so `INBOX/Spam` resolved to nothing on a server that
+		// advertises no \Junk.
+		const accountId = randomUUID();
+		await mailboxes.create(makeMailboxInput(accountId, "INBOX"));
+		const spam = await mailboxes.create(
+			makeMailboxInput(accountId, "INBOX/Spam"),
+		);
+
+		const found = await repo.findJunkMailbox(accountId);
+		assert.equal(found?.mailboxId, spam.mailboxId);
+	});
+
+	test("answers null when the account has no Junk folder at all", async () => {
+		const accountId = randomUUID();
+		await mailboxes.create(makeMailboxInput(accountId, "INBOX"));
+		await mailboxes.create(makeMailboxInput(accountId, "INBOX/Work"));
+
+		assert.equal(await repo.findJunkMailbox(accountId), null);
+	});
+});

package/src/repos/i4-mailbox-special-use.ts

@@ -3,6 +3,7 @@ import type {
 	MailboxSpecialUseItem,
 	MailboxSpecialUseValue,
 } from "@remit/data-ports";
+import { resolveMailboxByLeafName } from "@remit/data-ports/mailbox-name";
 import { eq } from "drizzle-orm";
 import type { Db } from "../db.js";
 import { randomId } from "../id.js";
@@ -10,6 +11,14 @@ import { mailboxSpecialUseTable, mailboxTable } from "../schema/i4-mailbox.js";
 
 type DB = Db<Record<string, unknown>>;
 
+const JUNK_FOLDER_NAMES = [
+	"junk",
+	"spam",
+	"junk e-mail",
+	"junk email",
+	"bulk mail",
+];
+
 function rowToSpecialUse(
 	row: typeof mailboxSpecialUseTable.$inferSelect,
 ): MailboxSpecialUseItem {
@@ -155,9 +164,7 @@ export class MailboxSpecialUseRepo implements IMailboxSpecialUseRepository {
 			.select()
 			.from(mailboxTable)
 			.where(eq(mailboxTable.accountId, accountId));
-
-		const names = ["junk", "spam", "bulk mail", "junk e-mail", "[gmail]/spam"];
-		const found = rows.find((r) => names.includes(r.fullPath.toLowerCase()));
+		const found = resolveMailboxByLeafName(rows, JUNK_FOLDER_NAMES);
 		return found
 			? { mailboxId: found.mailboxId, fullPath: found.fullPath }
 			: null;