@remit/drizzle-service 0.0.64 → 0.0.66

package/src/repair/junk-only-address.ts

@@ -1,8 +1,4 @@
-import {
-	JUNK_FOLDER_NAMES,
-	TRASH_FOLDER_NAMES,
-} from "@remit/data-ports/mailbox-role";
-import { MailboxSpecialUse } from "@remit/domain-enums";
+import type { JunkRoleMailboxes } from "@remit/data-ports/folder-role";
 
 export interface JunkOnlyRepairClient {
 	all(sql: string, params: readonly unknown[]): Promise<unknown[]>;
@@ -19,6 +15,12 @@ export interface JunkOnlyReport {
 	readonly restored: number;
 }
 
+/** A statement or fragment with the values its `?` placeholders take, in order. */
+export interface BoundSql {
+	readonly sql: string;
+	readonly params: readonly unknown[];
+}
+
 export const JUNK_ONLY_FLAG = "junkOnly";
 
 const STORED_FLAGS = "coalesce(nullif(address.flags, ''), '{}')";
@@ -26,41 +28,23 @@ const STORED_FLAGS = "coalesce(nullif(address.flags, ''), '{}')";
 const flagIsSet = (name: string): string =>
 	`coalesce(json_extract(${STORED_FLAGS}, '$.${name}.value'), 0) = 1`;
 
-const quoted = (names: readonly string[]): string =>
-	names.map((name) => `'${name}'`).join(", ");
-
-const MAILBOX_LEAF = `lower(substr(
-		mailbox.full_path,
-		length(rtrim(
-			mailbox.full_path,
-			replace(mailbox.full_path, mailbox.hierarchy_delimiter, '')
-		)) + 1
-	))`;
-
-const mailboxCarriesRole = (
-	specialUse: string,
-	names: readonly string[],
-): string => `(
-	exists (
-		SELECT 1 FROM mailbox_special_use_entry entry
-		WHERE entry.mailbox_id = message.mailbox_id
-		  AND entry.special_use = '${specialUse}'
-	)
-	OR exists (
-		SELECT 1 FROM mailbox
-		WHERE mailbox.mailbox_id = message.mailbox_id
-		  AND (
-			mailbox.special_use LIKE '%"${specialUse}"%'
-			OR ${MAILBOX_LEAF} IN (${quoted(names)})
-		  )
-	)
-)`;
+const EMPTY: BoundSql = { sql: "", params: [] };
 
-const IN_JUNK = mailboxCarriesRole(MailboxSpecialUse.Junk, JUNK_FOLDER_NAMES);
-const IN_TRASH = mailboxCarriesRole(
-	MailboxSpecialUse.Trash,
-	TRASH_FOLDER_NAMES,
-);
+const MATCHES_NOTHING: BoundSql = { sql: "0 = 1", params: [] };
+
+/**
+ * Whether the message sits in one of these mailboxes. An empty list is
+ * false — no mailbox holds the role, so no message is in one. That reading is
+ * right for Trash and wrong for Junk, which is why an unresolvable Junk folder
+ * is handled before this is ever reached.
+ */
+const inMailboxes = (mailboxIds: readonly string[]): BoundSql =>
+	mailboxIds.length === 0
+		? { sql: "(0 = 1)", params: [] }
+		: {
+				sql: `(message.mailbox_id IN (${mailboxIds.map(() => "?").join(", ")}))`,
+				params: mailboxIds,
+			};
 
 const sightingWhere = (extra: string): string => `exists (
 	SELECT 1 FROM envelope_address
@@ -68,47 +52,95 @@ const sightingWhere = (extra: string): string => `exists (
 	WHERE envelope_address.address_id = address.address_id${extra}
 )`;
 
-const SIGHTING_IN_JUNK = sightingWhere(` AND ${IN_JUNK}`);
-const SIGHTING_IN_LIVE_MAIL = sightingWhere(
-	` AND NOT ${IN_JUNK} AND NOT ${IN_TRASH}`,
-);
-
-export const ACCOUNT_HAS_CORRESPONDED = `(
+const ACCOUNT_HAS_CORRESPONDED = `(
 	address.outbound_count > 0
 	OR address.reply_count > 0
 	OR ${flagIsSet("vip")}
 	OR ${flagIsSet("trusted")}
 )`;
 
-export const WITHHOLDABLE = `NOT ${flagIsSet(JUNK_ONLY_FLAG)}
+/**
+ * No account in scope has a Junk folder, so nothing is known about any
+ * sighting: the mark cannot be earned. Silence is not the same as "every
+ * message is live mail" — read that way, one move would restore every address
+ * the sweep had withheld.
+ */
+const withholdable = (roles: JunkRoleMailboxes): BoundSql => {
+	if (roles.junkMailboxIds.length === 0) return MATCHES_NOTHING;
+	const inJunk = inMailboxes(roles.junkMailboxIds);
+	const inTrash = inMailboxes(roles.trashMailboxIds);
+	return {
+		sql: `NOT ${flagIsSet(JUNK_ONLY_FLAG)}
 	AND NOT ${ACCOUNT_HAS_CORRESPONDED}
-	AND ${SIGHTING_IN_JUNK}
-	AND NOT ${SIGHTING_IN_LIVE_MAIL}`;
+	AND ${sightingWhere(` AND ${inJunk.sql}`)}
+	AND NOT ${sightingWhere(` AND NOT ${inJunk.sql} AND NOT ${inTrash.sql}`)}`,
+		params: [...inJunk.params, ...inJunk.params, ...inTrash.params],
+	};
+};
 
-export const RESTORABLE = `${flagIsSet(JUNK_ONLY_FLAG)}
-	AND (${ACCOUNT_HAS_CORRESPONDED} OR ${SIGHTING_IN_LIVE_MAIL})`;
+/**
+ * The same silence lifts no mark either — "stands on live mail" is
+ * unanswerable without knowing which folder is Junk. Standing the account
+ * gave the address itself still lifts it: that evidence needs no folder.
+ */
+const restorable = (roles: JunkRoleMailboxes): BoundSql => {
+	if (roles.junkMailboxIds.length === 0) {
+		return {
+			sql: `${flagIsSet(JUNK_ONLY_FLAG)}
+	AND ${ACCOUNT_HAS_CORRESPONDED}`,
+			params: [],
+		};
+	}
+	const inJunk = inMailboxes(roles.junkMailboxIds);
+	const inTrash = inMailboxes(roles.trashMailboxIds);
+	return {
+		sql: `${flagIsSet(JUNK_ONLY_FLAG)}
+	AND (${ACCOUNT_HAS_CORRESPONDED}
+		OR ${sightingWhere(` AND NOT ${inJunk.sql} AND NOT ${inTrash.sql}`)})`,
+		params: [...inJunk.params, ...inTrash.params],
+	};
+};
 
-export const withholdSql = (scope = ""): string =>
-	`UPDATE address
+export const withholdSql = (
+	roles: JunkRoleMailboxes,
+	now: number,
+	setBy: string,
+	scope: BoundSql = EMPTY,
+): BoundSql => {
+	const predicate = withholdable(roles);
+	return {
+		sql: `UPDATE address
 	 SET flags = json_set(${STORED_FLAGS}, '$.${JUNK_ONLY_FLAG}',
 		   json_object('value', json('true'), 'setAt', CAST(? AS INTEGER), 'setBy', ?)),
 		 updated_at = ?
-	 WHERE ${WITHHOLDABLE}${scope}`;
+	 WHERE ${predicate.sql}${scope.sql}`,
+		params: [now, setBy, now, ...predicate.params, ...scope.params],
+	};
+};
 
-export const restoreSql = (scope = ""): string =>
-	`UPDATE address
+export const restoreSql = (
+	roles: JunkRoleMailboxes,
+	now: number,
+	scope: BoundSql = EMPTY,
+): BoundSql => {
+	const predicate = restorable(roles);
+	return {
+		sql: `UPDATE address
 	 SET flags = json_remove(${STORED_FLAGS}, '$.${JUNK_ONLY_FLAG}'), updated_at = ?
-	 WHERE ${RESTORABLE}${scope}`;
+	 WHERE ${predicate.sql}${scope.sql}`,
+		params: [now, ...predicate.params, ...scope.params],
+	};
+};
 
 const REPAIR_SET_BY = "junk-only-repair";
 
 const countWhere = async (
 	client: JunkOnlyRepairClient,
-	predicate: string,
+	predicate: BoundSql,
 ): Promise<number> => {
 	const [row] = (await client.all(
-		`SELECT count(*) AS row_count FROM address WHERE ${predicate}`,
-		[],
+		`SELECT count(*) AS row_count FROM address WHERE ${predicate.sql}`,
+		predicate.params,
 	)) as { row_count: number }[];
 	return row?.row_count ?? 0;
 };
@@ -116,23 +148,39 @@ const countWhere = async (
 export const sweepJunkOnlyAddresses = async (
 	client: JunkOnlyRepairClient,
 	mode: JunkOnlyRepairMode,
+	roles: JunkRoleMailboxes,
 	now: number = Date.now(),
 ): Promise<JunkOnlyReport> => {
-	const withholdable = await countWhere(client, WITHHOLDABLE);
-	const restorable = await countWhere(client, RESTORABLE);
+	const withholdableCount = await countWhere(client, withholdable(roles));
+	const restorableCount = await countWhere(client, restorable(roles));
 
 	if (mode === "check") {
-		return { mode, withholdable, withheld: 0, restorable, restored: 0 };
+		return {
+			mode,
+			withholdable: withholdableCount,
+			withheld: 0,
+			restorable: restorableCount,
+			restored: 0,
+		};
 	}
 
+	const withhold = withholdSql(roles, now, REPAIR_SET_BY);
 	const withheld =
-		withholdable === 0
+		withholdableCount === 0
 			? 0
-			: await client.run(withholdSql(), [now, REPAIR_SET_BY, now]);
-
-	const restored = restorable === 0 ? 0 : await client.run(restoreSql(), [now]);
-
-	return { mode, withholdable, withheld, restorable, restored };
+			: await client.run(withhold.sql, withhold.params);
+
+	const restore = restoreSql(roles, now);
+	const restored =
+		restorableCount === 0 ? 0 : await client.run(restore.sql, restore.params);
+
+	return {
+		mode,
+		withholdable: withholdableCount,
+		withheld,
+		restorable: restorableCount,
+		restored,
+	};
 };
 
 export const formatJunkOnlyReport = (report: JunkOnlyReport): string[] => {

package/src/repos/config-import-atomicity.sqlite.test.ts

@@ -0,0 +1,255 @@
+import assert from "node:assert/strict";
+import { after, before, describe, test } from "node:test";
+import {
+	type ConfigImportRepositories,
+	importConfig,
+} from "@remit/config-transfer";
+import type { Db } from "../db.js";
+import {
+	accountConfigTable,
+	accountSettingTable,
+	accountTable,
+	addressTable,
+	configImportTable,
+	filterAnchorTable,
+	filterTable,
+	labelTable,
+	mailboxTable,
+} from "../schema.js";
+import { createSqliteTestDb } from "../test-db-sqlite.js";
+import { runInTransaction, serializeSqliteWrites } from "../tx.js";
+import { FilterRepo } from "./filter.js";
+import { FilterAnchorRepo } from "./filter-anchor.js";
+import { AccountRepo } from "./i4-account.js";
+import { AccountConfigRepo } from "./i4-account-config.js";
+import { AccountSettingRepo } from "./i4-account-setting.js";
+import { AddressRepo } from "./i4-address.js";
+import { ConfigImportRepo } from "./i4-config-import.js";
+import { MailboxRepo } from "./i4-mailbox.js";
+import { LabelRepo } from "./label.js";
+
+// The import claims to be atomic, and the unit tests prove that claim against a
+// fake that rolls back because it was written to. This one puts the claim on the
+// real thing: the repos the backend composes, over better-sqlite3, inside the
+// real `runInTransaction` savepoint. A filter write is made to fail after the
+// account, the label and the configuration row have already been inserted — the
+// exact shape of a half-applied import — and nothing may survive it.
+
+// Every table the import touches, and only those: `pushSchema` creates exactly
+// what this object names.
+const IMPORT_SCHEMA = {
+	accountConfig: accountConfigTable,
+	account: accountTable,
+	accountSetting: accountSettingTable,
+	address: addressTable,
+	configImport: configImportTable,
+	filter: filterTable,
+	filterAnchor: filterAnchorTable,
+	label: labelTable,
+	mailbox: mailboxTable,
+};
+
+type ImportSchema = typeof IMPORT_SCHEMA;
+
+const CONFIG_ID = "0d9c8b7a6e5f4d3cb2a10f9e8";
+const ACCOUNT_ID = "6f4c2c309a2c4a7f9f9f1f2c3";
+const USER_ID = "7c1f0a2e-3b4d-4c5e-8f90-a1b2c3d4e5f6";
+const MESSAGE_ID = "c4b3a2918f7e6d5c4b3a29187";
+
+const document = () => ({
+	kind: "reader.config",
+	schemaVersion: 1,
+	generator: {
+		app: "reader",
+		version: "v0.1.0",
+		exportedAt: "2026-08-27T09:15:00+02:00",
+	},
+	provenance: { accountConfigId: CONFIG_ID, instance: "reader.ischen.nl" },
+	accountConfig: { name: "Matthijs" },
+	accounts: [
+		{
+			accountId: ACCOUNT_ID,
+			email: "matthijs@ischen.nl",
+			username: "matthijs@ischen.nl",
+			authType: "password",
+			credentials: { required: "password" },
+			isActive: true,
+			imap: { host: "imap.ischen.nl", port: 993, tls: true, startTls: false },
+			smtp: {
+				enabled: true,
+				host: "smtp.ischen.nl",
+				port: 587,
+				tls: false,
+				startTls: true,
+				username: "",
+			},
+			displayName: "Matthijs",
+			muted: null,
+			composeLanguages: ["nl"],
+			signature: { plainText: "Matthijs", html: "<p>Matthijs</p>" },
+			folderRoles: [],
+			folderOverrides: [],
+			pinnedFolders: ["INBOX"],
+		},
+	],
+	labels: [{ name: "Facturen", color: "Default" }],
+	filters: [
+		{
+			name: "Invoices",
+			scope: "Standing",
+			expiresAt: null,
+			matchOperator: "And",
+			literalClauses: [{ field: "From", value: "billing@example.com" }],
+			actionLabelName: "Facturen",
+			actionFolder: null,
+			anchor: {
+				sourceText: "the release note this filter was drawn from",
+				embeddingId: "amazon.titan-embed-text-v2:0@1024",
+				sourceMessageId: MESSAGE_ID,
+			},
+		},
+	],
+	addressFlags: [],
+});
+
+describe("a config import is atomic over the real sqlite savepoint", () => {
+	let db: Db<ImportSchema>;
+	let close: () => Promise<void>;
+	let repositories: ConfigImportRepositories;
+
+	before(async () => {
+		const created = await createSqliteTestDb<ImportSchema>(IMPORT_SCHEMA);
+		close = created.close;
+		db = serializeSqliteWrites(created.db);
+
+		// `as never` is how every repo test hands over a pushed test schema: the
+		// repos declare the widened `Db<Record<string, unknown>>`.
+		repositories = {
+			accountConfig: new AccountConfigRepo(db as never),
+			account: new AccountRepo(db as never),
+			accountSetting: new AccountSettingRepo(db as never),
+			mailbox: new MailboxRepo(db as never),
+			label: new LabelRepo(db as never),
+			filter: new FilterRepo(db as never),
+			filterAnchor: new FilterAnchorRepo(db as never),
+			address: new AddressRepo(db as never),
+			configImport: new ConfigImportRepo(db as never),
+		};
+	});
+
+	after(async () => {
+		await close();
+	});
+
+	test("a filter write that fails rolls back the account, the label and the configuration row", async () => {
+		// Delegating rather than spreading: the repos are class instances, and a
+		// spread would copy no prototype method at all.
+		const refusingFilters: ConfigImportRepositories["filter"] = {
+			listByAccountConfig: (...args) =>
+				repositories.filter.listByAccountConfig(...args),
+			update: (...args) => repositories.filter.update(...args),
+			create: () => Promise.reject(new Error("filter write refused")),
+		};
+
+		const outcome = await importConfig(
+			{
+				repositories: { ...repositories, filter: refusingFilters },
+				appointFolderRole: () => {
+					throw new Error("this document names no folder roles");
+				},
+				transaction: (run) => runInTransaction(db, () => run()),
+				embedAnchor: async () => ({
+					embedding: [0.11, 0.22, 0.33],
+					embeddingId: "amazon.titan-embed-text-v2:0@1024",
+				}),
+			},
+			{
+				accountConfigId: CONFIG_ID,
+				userId: USER_ID,
+				document: document(),
+				mode: "apply",
+				onExisting: "abort",
+			},
+		);
+
+		assert.equal(outcome.outcome, "report");
+		if (outcome.outcome !== "report") throw new Error("unreachable");
+		assert.equal(outcome.report.applied, false);
+		assert.equal(outcome.report.errors[0]?.code, "import_write_failed");
+		assert.match(
+			outcome.report.errors[0]?.message ?? "",
+			/Nothing was written/,
+		);
+
+		// The store itself, read back through the same repos. Accounts and labels
+		// are written before filters, so a savepoint that did not roll back would
+		// leave both here.
+		assert.deepEqual(
+			await repositories.account.listAllByAccountConfig(CONFIG_ID),
+			[],
+		);
+		assert.deepEqual(
+			await repositories.label.listByAccountConfig(CONFIG_ID),
+			[],
+		);
+		assert.deepEqual(
+			await repositories.filter.listByAccountConfig(CONFIG_ID),
+			[],
+		);
+		assert.deepEqual(
+			await repositories.configImport.listByAccountConfig(CONFIG_ID),
+			[],
+		);
+		await assert.rejects(() => repositories.accountConfig.get(CONFIG_ID));
+	});
+
+	test("the same document applies whole once the write succeeds", async () => {
+		const outcome = await importConfig(
+			{
+				repositories,
+				appointFolderRole: () => {
+					throw new Error("this document names no folder roles");
+				},
+				transaction: (run) => runInTransaction(db, () => run()),
+				embedAnchor: async () => ({
+					embedding: [0.11, 0.22, 0.33],
+					embeddingId: "amazon.titan-embed-text-v2:0@1024",
+				}),
+			},
+			{
+				accountConfigId: CONFIG_ID,
+				userId: USER_ID,
+				document: document(),
+				mode: "apply",
+				onExisting: "abort",
+			},
+		);
+
+		assert.equal(outcome.outcome, "report");
+		if (outcome.outcome !== "report") throw new Error("unreachable");
+		assert.equal(outcome.report.applied, true);
+		assert.equal(outcome.report.errors.length, 0);
+
+		const accounts =
+			await repositories.account.listAllByAccountConfig(CONFIG_ID);
+		assert.equal(accounts.length, 1);
+		assert.equal(accounts[0]?.accountId, ACCOUNT_ID);
+		assert.equal(accounts[0]?.isActive, false);
+		assert.equal(
+			(await repositories.label.listByAccountConfig(CONFIG_ID)).length,
+			1,
+		);
+		assert.equal(
+			(await repositories.filter.listByAccountConfig(CONFIG_ID)).length,
+			1,
+		);
+		assert.equal(
+			(await repositories.configImport.listByAccountConfig(CONFIG_ID)).length,
+			1,
+		);
+		assert.equal(
+			(await repositories.accountConfig.get(CONFIG_ID)).name,
+			"Matthijs",
+		);
+	});
+});

package/src/repos/i4-account-setting.ts

@@ -5,7 +5,7 @@ import type {
 	IAccountSettingRepository,
 	UpsertAccountSettingInput,
 } from "@remit/data-ports";
-import { eq } from "drizzle-orm";
+import { and, eq, inArray } from "drizzle-orm";
 import type { Db } from "../db.js";
 import { accountSettingTable } from "../schema/i4-account-setting.js";
 
@@ -48,6 +48,28 @@ export class AccountSettingRepo implements IAccountSettingRepository {
 		return row ? rowToAccountSetting(row) : null;
 	}
 
+	/**
+	 * The named settings of several configs in one read, for callers that would
+	 * otherwise `get` once per account. Missing rows are simply absent from the
+	 * result rather than an error.
+	 */
+	async getMany(
+		accountConfigIds: readonly string[],
+		names: readonly string[],
+	): Promise<AccountSettingItem[]> {
+		if (accountConfigIds.length === 0 || names.length === 0) return [];
+		const rows = await this.db
+			.select()
+			.from(accountSettingTable)
+			.where(
+				and(
+					inArray(accountSettingTable.accountConfigId, [...accountConfigIds]),
+					inArray(accountSettingTable.name, [...names]),
+				),
+			);
+		return rows.map(rowToAccountSetting);
+	}
+
 	async listByAccountConfig(
 		accountConfigId: string,
 	): Promise<AccountSettingItem[]> {