@remit/imap-worker 0.0.67 → 0.0.69

package/src/handlers/message-move-terminal.test.ts

@@ -4,7 +4,10 @@ import type {
 	IMessageRepository,
 	IThreadMessageRepository,
 } from "@remit/data-ports";
-import type { IImapConnection } from "@remit/mailbox-service";
+import {
+	type IImapConnection,
+	placementBindingOf,
+} from "@remit/mailbox-service";
 import {
 	type MessageMoveTerminalLogger,
 	type ResolveExhaustedMessageMoveDeps,
@@ -60,21 +63,33 @@ interface MessageRow {
 	originalUid: number;
 }
 
+interface ThreadRow {
+	accountConfigId: string;
+	threadMessageId: string;
+	mailboxId: string;
+	uid: number;
+	isDeleted: boolean;
+}
+
 /**
  * The move's pending state IS the Message row, so these fakes hold real rows
- * and the assertions read the rows back — a resolver that reverted the
- * optimistic move (PR #652's defect) would show up here as a changed row, not
- * as an uncalled mock.
+ * and the assertions read the rows back — a resolver that settled the row on
+ * anything but the server's own answer shows up here as a changed row, not as
+ * an uncalled mock. `updateForMove` writes what the repository writes: whatever
+ * fields the caller set, and nothing it left out.
  */
 const buildRepositories = (row: MessageRow) => {
 	const messages = new Map<string, MessageRow>([[row.messageId, row]]);
-	const threadMessages = new Map<
-		string,
-		{ accountConfigId: string; threadMessageId: string }
-	>([
+	const threadMessages = new Map<string, ThreadRow>([
 		[
 			`tm-${row.messageId}`,
-			{ accountConfigId: "cfg-1", threadMessageId: `tm-${row.messageId}` },
+			{
+				accountConfigId: "cfg-1",
+				threadMessageId: `tm-${row.messageId}`,
+				mailboxId: row.mailboxId,
+				uid: row.uid,
+				isDeleted: false,
+			},
 		],
 	]);
 
@@ -89,7 +104,11 @@ const buildRepositories = (row: MessageRow) => {
 				const current = messages.get(messageId);
 				if (current) messages.set(messageId, { ...current, ...input });
 			},
-		} as unknown as Pick<IMessageRepository, "delete">,
+			updateForMove: async (messageId: string, set: Partial<MessageRow>) => {
+				const current = messages.get(messageId);
+				if (current) messages.set(messageId, { ...current, ...set });
+			},
+		} as unknown as Pick<IMessageRepository, "delete" | "updateForMove">,
 		threadMessageService: {
 			findAllByMessageId: async () => [...threadMessages.values()],
 			deleteMany: async (
@@ -97,9 +116,18 @@ const buildRepositories = (row: MessageRow) => {
 			) => {
 				for (const key of keys) threadMessages.delete(key.threadMessageId);
 			},
+			update: async (
+				_accountConfigId: string,
+				threadMessageId: string,
+				set: Partial<ThreadRow>,
+			) => {
+				const current = threadMessages.get(threadMessageId);
+				if (current)
+					threadMessages.set(threadMessageId, { ...current, ...set });
+			},
 		} as unknown as Pick<
 			IThreadMessageRepository,
-			"findAllByMessageId" | "deleteMany"
+			"findAllByMessageId" | "deleteMany" | "update"
 		>,
 	};
 };
@@ -118,6 +146,7 @@ const input = {
 	accountId: "acc-1",
 	accountConfigId: "cfg-1",
 	messageId: "msg-1",
+	sourceMailboxId: "mbx-inbox",
 	uid: 101,
 	sourceMailboxPath: "INBOX",
 };
@@ -150,7 +179,7 @@ describe("resolveExhaustedMessageMoveFailure — the two terminal outcomes (issu
 		);
 	});
 
-	it("BROKEN: the message is still at the source — the row is left EXACTLY as it stands, alarm logged, never re-thrown", async () => {
+	it("BROKEN: the message is still at the source — the row is put back on the pair the server confirmed, alarm logged, never re-thrown", async () => {
 		const repos = buildRepositories(pendingMoveRow());
 		const { log, errors } = buildLogger();
 		const deps: ResolveExhaustedMessageMoveDeps = {
@@ -165,15 +194,45 @@ describe("resolveExhaustedMessageMoveFailure — the two terminal outcomes (issu
 		});
 
 		assert.equal(result.outcome, "broken");
-		assert.deepEqual(
-			repos.messages.get("msg-1"),
-			pendingMoveRow(),
-			"a move that never reached the server is never reverted locally (PR #652)",
+		assert.equal(repos.messages.get("msg-1")?.mailboxId, "mbx-inbox");
+		assert.equal(repos.messages.get("msg-1")?.uid, 101);
+		assert.equal(
+			repos.threadMessages.get("tm-msg-1")?.mailboxId,
+			"mbx-inbox",
+			"the listing row follows the message back to the folder it never left",
 		);
-		assert.equal(repos.threadMessages.size, 1);
 		assert.ok(errors.some((e) => e.obj.alert === "message_move_failed"));
 	});
 
+	// Issue #1005: a give-up that never writes `status` leaves the row naming
+	// the destination with the source's uid — a pair `bindsForeignUid` refuses,
+	// which made the message undeletable and unmovable for good.
+	it("BROKEN: the settled row is no longer refused by the placement guard (#1005)", async () => {
+		const repos = buildRepositories(pendingMoveRow());
+		const { log } = buildLogger();
+		const deps: ResolveExhaustedMessageMoveDeps = {
+			messageService: repos.messageService,
+			threadMessageService: repos.threadMessageService,
+			log,
+		};
+
+		assert.equal(
+			placementBindingOf(pendingMoveRow() as never),
+			"abandoned",
+			"the row starts in the state the delete route refuses as unverified",
+		);
+
+		await resolveExhaustedMessageMoveFailure(deps, {
+			...input,
+			getConnection: async () => buildConnection(new Set([101])),
+		});
+
+		const settled = repos.messages.get("msg-1");
+		assert.ok(settled);
+		assert.equal(placementBindingOf(settled as never), "consistent");
+		assert.equal(settled.status, "active");
+	});
+
 	it("BROKEN: an empty FETCH the SEARCH contradicts never counts as gone", async () => {
 		const repos = buildRepositories(pendingMoveRow());
 		const { log } = buildLogger();
@@ -190,7 +249,93 @@ describe("resolveExhaustedMessageMoveFailure — the two terminal outcomes (issu
 		});
 
 		assert.equal(result.outcome, "broken");
-		assert.deepEqual(repos.messages.get("msg-1"), pendingMoveRow());
+		assert.equal(
+			repos.messages.get("msg-1")?.mailboxId,
+			"mbx-inbox",
+			"a message the SEARCH still lists is at the source, and the row says so",
+		);
+	});
+
+	// The resolver's contract is that it is never re-thrown, so the caller can
+	// ack the record and emit its resync. A row another path deleted while the
+	// probe was in flight has nothing left to restore, and the same NotFound
+	// wraps an ElectroDB composites miss on the listing row.
+	it("BROKEN: a row deleted underneath the probe settles instead of throwing", async () => {
+		const repos = buildRepositories(pendingMoveRow());
+		const notFound = Object.assign(new Error("Message not found: msg-1"), {
+			name: "NotFoundError",
+		});
+		const { log } = buildLogger();
+		const deps: ResolveExhaustedMessageMoveDeps = {
+			messageService: {
+				...repos.messageService,
+				updateForMove: async () => {
+					throw notFound;
+				},
+			} as unknown as ResolveExhaustedMessageMoveDeps["messageService"],
+			threadMessageService: repos.threadMessageService,
+			log,
+		};
+
+		const result = await resolveExhaustedMessageMoveFailure(deps, {
+			...input,
+			getConnection: async () => buildConnection(new Set([101])),
+		});
+
+		assert.equal(result.outcome, "broken");
+	});
+
+	it("BROKEN: a listing row whose composites moved on does not fail the settle", async () => {
+		const repos = buildRepositories(pendingMoveRow());
+		const { log } = buildLogger();
+		const deps: ResolveExhaustedMessageMoveDeps = {
+			messageService: repos.messageService,
+			threadMessageService: {
+				...repos.threadMessageService,
+				update: async () => {
+					throw Object.assign(new Error("Thread message not found"), {
+						name: "NotFoundError",
+					});
+				},
+			} as unknown as ResolveExhaustedMessageMoveDeps["threadMessageService"],
+			log,
+		};
+
+		const result = await resolveExhaustedMessageMoveFailure(deps, {
+			...input,
+			getConnection: async () => buildConnection(new Set([101])),
+		});
+
+		assert.equal(result.outcome, "broken");
+		assert.equal(
+			repos.messages.get("msg-1")?.mailboxId,
+			"mbx-inbox",
+			"the Message row still lands on the pair the server confirmed",
+		);
+	});
+
+	it("a repository fault that is not a missing row still propagates", async () => {
+		const repos = buildRepositories(pendingMoveRow());
+		const { log } = buildLogger();
+		const deps: ResolveExhaustedMessageMoveDeps = {
+			messageService: {
+				...repos.messageService,
+				updateForMove: async () => {
+					throw new Error("ProvisionedThroughputExceeded");
+				},
+			} as unknown as ResolveExhaustedMessageMoveDeps["messageService"],
+			threadMessageService: repos.threadMessageService,
+			log,
+		};
+
+		await assert.rejects(
+			() =>
+				resolveExhaustedMessageMoveFailure(deps, {
+					...input,
+					getConnection: async () => buildConnection(new Set([101])),
+				}),
+			/ProvisionedThroughputExceeded/,
+		);
 	});
 
 	it("an unreachable server reaches no verdict at all — the probe propagates and the row is untouched", async () => {

package/src/handlers/message-move-terminal.ts

@@ -1,9 +1,15 @@
+import type {
+	IMessageRepository,
+	IThreadMessageRepository,
+} from "@remit/data-ports";
+import { MessageSyncStatus } from "@remit/domain-enums";
 import {
 	type IImapConnection,
 	isMessageGoneFromOpenMailbox,
 	reconcileStaleMessage,
 	type StaleMessageReconcileDeps,
 } from "@remit/mailbox-service";
+import { restoreSourcePlacement } from "./restore-source-placement.js";
 
 export interface MessageMoveTerminalLogger {
 	info(obj: Record<string, unknown>, msg: string): void;
@@ -12,6 +18,11 @@ export interface MessageMoveTerminalLogger {
 
 export interface ResolveExhaustedMessageMoveDeps
 	extends StaleMessageReconcileDeps {
+	messageService: Pick<IMessageRepository, "delete" | "updateForMove">;
+	threadMessageService: Pick<
+		IThreadMessageRepository,
+		"findAllByMessageId" | "deleteMany" | "update"
+	>;
 	log: MessageMoveTerminalLogger;
 }
 
@@ -19,6 +30,7 @@ export interface ResolveExhaustedMessageMoveInput {
 	accountId: string;
 	accountConfigId: string;
 	messageId: string;
+	sourceMailboxId: string;
 	uid: number;
 	sourceMailboxPath: string;
 	getConnection: () => Promise<IImapConnection>;
@@ -51,12 +63,21 @@ export interface ResolveExhaustedMessageMoveResult {
  *    server's own UID. Metric only, no alarm — routine.
  * 2. BROKEN — the message is still at the source, so the move never took
  *    effect, but it keeps failing: broken code or a broken account, not a
- *    transient blip. Local state is left exactly as it stands. Reverting the
- *    optimistic move here is what PR #652 was pulled for: the local row is the
- *    only record that this move is still owed, and a revert races a MOVE that
- *    may yet have landed. Logged with an `alert`-shaped entry for an operator
- *    alarm; never re-thrown (terminal — the caller acks either way, since
- *    retrying a permanently-broken move can never succeed).
+ *    transient blip. The row is put back where the server has just said the
+ *    message is, as `resolveExhaustedMessageDeleteFailure` does (#1098). Logged
+ *    with an `alert`-shaped entry for an operator alarm; never re-thrown
+ *    (terminal — the caller acks either way, since retrying a
+ *    permanently-broken move can never succeed).
+ *
+ *    Leaving the row `moving` is what this replaces. BROKEN is terminal, so
+ *    nothing was ever going to come back and settle it, and only `updateUid`
+ *    clears `moving` — the row kept a `mailboxId` naming the destination and a
+ *    `uid` belonging to the source, which `bindsForeignUid` refuses to act on,
+ *    leaving the message undeletable and unmovable for good (issue #1005).
+ *    Restoring the pair is not the revert-on-ambiguity PR #652 was pulled for:
+ *    the presence probe above has just answered, so this writes a placement the
+ *    server confirmed, and a MOVE that lands after all is re-projected by the
+ *    resync the caller runs.
  *
  * A server that cannot be reached at exhaustion time never reaches either
  * verdict: the probe throws and the record dead-letters with the row untouched.
@@ -66,9 +87,10 @@ export interface ResolveExhaustedMessageMoveResult {
  * message is not actually at the source: a message another client expunged
  * mid-session can answer an empty FETCH while the server still lists its UID
  * in SEARCH, until it is allowed to send the untagged EXPUNGE. That message
- * lands in BROKEN, and BROKEN is terminal — the row stays pending and the
- * alert stands until someone clears it. The reverse mistake discards the row
- * for live mail, so the cost is paid deliberately.
+ * lands in BROKEN, and BROKEN is terminal — the row is bound to a source the
+ * message has already left and the alert stands until someone clears it. The
+ * reverse mistake discards the row for live mail, so the cost is paid
+ * deliberately.
  */
 export const resolveExhaustedMessageMoveFailure = async (
 	deps: ResolveExhaustedMessageMoveDeps,
@@ -78,6 +100,7 @@ export const resolveExhaustedMessageMoveFailure = async (
 		accountId,
 		accountConfigId,
 		messageId,
+		sourceMailboxId,
 		uid,
 		sourceMailboxPath,
 		getConnection,
@@ -114,9 +137,22 @@ export const resolveExhaustedMessageMoveFailure = async (
 			accountConfigId,
 			messageId,
 			uid,
+			sourceMailboxId,
 			sourceMailboxPath,
 		},
-		"Message move could not be pushed to IMAP after retry exhaustion; message still exists at its source — local state left pending for operator investigation",
+		"Message move could not be pushed to IMAP after retry exhaustion; the message is still at its source — row moved back to the source folder",
 	);
+
+	await restoreSourcePlacement(deps, {
+		accountConfigId,
+		messageId,
+		sourceMailboxId,
+		uid,
+		// The probe above just confirmed the pair, so the row is a faithful
+		// projection of the source again. The move's own failure is the alert, not
+		// a `failed` left on a row nothing is still trying to move.
+		syncStatus: MessageSyncStatus.synced,
+	});
+
 	return { outcome: "broken" };
 };