@remit/imap-worker 0.0.72 → 0.0.74

package/src/handlers/sync-messages.ts

@@ -13,12 +13,13 @@ import type {
 	IThreadMessageRepository,
 	IUnitOfWork,
 } from "@remit/data-ports";
+import { isNotFoundError } from "@remit/data-ports/errors";
 import { SyncPhase } from "@remit/domain-enums";
 import { type Logger, recordImapFailure } from "@remit/logger-lambda";
 import { RefreshTokenError } from "@remit/mail-oauth-service";
 import {
 	createManagedConnectionFactory,
-	isMailboxNotOnServer,
+	isMailboxMutationInFlight,
 	MailConnectionError,
 	type MailCredentials,
 	MessageSyncService,
@@ -33,7 +34,6 @@ import type {
 	SyncMessageBodyEvent,
 	SyncMessagesEvent,
 } from "../events.js";
-import { isNotFoundError } from "../is-not-found.js";
 import { withOAuthLifecycle } from "../with-oauth-lifecycle.js";
 import { buildLifecycleDeps } from "../with-oauth-lifecycle-deps.js";
 import { workerVersion } from "../worker-version.js";
@@ -133,17 +133,23 @@ export const syncMessages = async (
 		return;
 	}
 
-	// A SYNC_MESSAGES trigger can address a folder the server does not hold: the
-	// fan-out enqueues one for a folder whose own create has not landed yet, and
-	// a `hasMore` next-batch or a periodic tick outlives a folder the user
-	// deleted. Such an event can never succeed on retry, and the account's
-	// per-group FIFO ordering lets that one poison message stall the
-	// whole account's message pipeline for the full visibility window (issue
-	// #287, #339). A folder the server does not hold — not yet created, or being
-	// deleted — is an expected terminal outcome, not an infra failure: ack the
-	// event with a WARN.
+	// A SYNC_MESSAGES trigger can address a folder a mutation still owns: the
+	// fan-out enqueues one for a folder whose own create has not landed yet, a
+	// `hasMore` next-batch or a periodic tick outlives a folder the user
+	// deleted, and a rename in flight leaves the folder on the server but under
+	// the worker that is moving it. Such an event can never succeed on retry,
+	// and the account's per-group FIFO ordering lets that one poison message
+	// stall the whole account's message pipeline for the full visibility window
+	// (issue #287, #339). A folder with a create, rename or delete outstanding
+	// is an expected terminal outcome, not an infra failure: ack the event with
+	// a WARN. The rename case is conservative rather than necessary — syncing it
+	// would be safe — and keeps the guard a single expression (D12).
 	if (
-		await isMailboxNotOnServer(mailboxService, event.accountId, event.mailboxId)
+		await isMailboxMutationInFlight(
+			mailboxService,
+			event.accountId,
+			event.mailboxId,
+		)
 	) {
 		log.warn(
 			{
@@ -152,7 +158,7 @@ export const syncMessages = async (
 				eventId: event.eventId,
 				event: event.type,
 			},
-			"Skipping SYNC_MESSAGES: the server does not hold this folder",
+			"Skipping SYNC_MESSAGES: a folder mutation is in flight",
 		);
 		return;
 	}
@@ -214,7 +220,7 @@ export const syncMessages = async (
 						// never become the failure that is reported. A read that cannot answer
 						// leaves the round on the loud path below, with the real error and the
 						// state write that goes with it intact.
-						const folderIsGone = await isMailboxNotOnServer(
+						const folderIsGone = await isMailboxMutationInFlight(
 							mailboxService,
 							event.accountId,
 							event.mailboxId,

package/src/handlers/restore-source-placement.ts

@@ -1,135 +0,0 @@
-import type {
-	IMessageRepository,
-	IThreadMessageRepository,
-	MessageItem,
-	ThreadMessageItem,
-} from "@remit/data-ports";
-import { MessageStatus } from "@remit/domain-enums";
-import { isNotFoundError } from "../is-not-found.js";
-import { buildThreadMessageMoveRevert } from "./thread-message-rows.js";
-
-export interface RestoreSourcePlacementDeps {
-	messageService: Pick<IMessageRepository, "updateForMove">;
-	threadMessageService: Pick<
-		IThreadMessageRepository,
-		"findAllByMessageId" | "update"
-	>;
-}
-
-export interface RestoreSourcePlacementInput {
-	accountConfigId: string;
-	messageId: string;
-	sourceMailboxId: string;
-	uid: number;
-	/**
-	 * What the row records about the mutation that will now never happen.
-	 * `synced` where the row is a faithful projection of the source again — the
-	 * server never received the command, or has just said the message is still
-	 * there. `failed` where the product refused an operation the user asked for,
-	 * which is a failure the row has to carry.
-	 */
-	syncStatus: MessageItem["syncStatus"];
-	/**
-	 * The listing rows, where the caller has already read them to pick this
-	 * outcome. Omitted, they are read here.
-	 */
-	threadMessages?: ThreadMessageItem[];
-}
-
-/**
- * Put a row back on the pre-mutation source pair and hand its listing rows back
- * with it.
- *
- * `status: moving` has to be cleared here or the row is stuck: a give-up that
- * writes `syncStatus: failed` and returns leaves the row naming the destination
- * with the source's uid — the pair `bindsForeignUid` calls a lie and
- * `MessagePlacementUnsettledError` refuses to act on. Nothing routine repairs it
- * (sync does not touch `status`, and the cursor rebuild's `updateUid` runs only
- * on a UIDVALIDITY change), so the message is undeletable and unmovable for good
- * (issue #1005).
- *
- * `updateForMove`, not `updateUid`: both write the same settled pair, but
- * `updateUid` also appends a `message.moved` outbox row so the search index can
- * refresh the mailbox it stores per message. Nothing here moved. The optimistic
- * `updateForMove` that pointed the row at the destination never enqueued one
- * either, so the index still holds the source and a revert has nothing to
- * correct — the re-index would be a forced pass over an unchanged document.
- *
- * The caller must have evidence, not an inference: this writes a placement, and
- * a placement written on a guess binds live mail to a uid that names somebody
- * else's message. Two kinds of caller qualify, and nothing else does.
- *
- * A terminal resolver reaches here from {@link isMessageGoneFromOpenMailbox}
- * answering that the message is STILL at `sourceMailboxId`/`uid`, which makes
- * this the server's own answer rather than a revert on ambiguity (what PR #652
- * was pulled for).
- *
- * A paused-cursor caller reaches here from a `MailboxCursorPausedError` the
- * openBox guard threw before the outbound command was issued (issue #1203), and
- * restores the pre-mutation pair off its own event. On a FIRST delivery that is
- * not an inference but an undo: the command provably never left, so the row is
- * put back exactly as it was found. A redelivery cannot claim that — the
- * earlier attempt's tagged OK can be lost with the connection — so it asks
- * `probePausedPlacement` which folder holds the message and only reaches here
- * once the answer rules the destination out. Either way the source mailbox is
- * by definition awaiting a cursor rebuild, which matches its rows by Message-ID
- * and adjudicates the uid: handing the row back is what puts it in the set the
- * rebuild walks, since a row still naming the destination is in neither
- * folder's.
- *
- * A row another path deleted while the probe was in flight has nothing left to
- * restore, and a thread row whose composites have moved on is being rewritten
- * by that other path anyway. Both surface as `NotFoundError` — ElectroDB wraps
- * the conditional-check miss as one — and both are settled states here, not
- * faults. Throwing on them would escape the caller's `.catch()` and cost the
- * record its ack and its resync, which is the contract the terminal resolvers
- * state: never re-thrown.
- */
-export const restoreSourcePlacement = async (
-	deps: RestoreSourcePlacementDeps,
-	input: RestoreSourcePlacementInput,
-): Promise<void> => {
-	const { accountConfigId, messageId, sourceMailboxId, uid, syncStatus } =
-		input;
-
-	const skipNotFound = (error: unknown): void => {
-		if (isNotFoundError(error)) return;
-		throw error;
-	};
-
-	const messageRestored = await deps.messageService
-		.updateForMove(messageId, {
-			mailboxId: sourceMailboxId,
-			uid,
-			status: MessageStatus.active,
-			syncStatus,
-		})
-		.then(() => true)
-		.catch((error: unknown) => {
-			skipNotFound(error);
-			return false;
-		});
-	if (!messageRestored) return;
-
-	const threadMessages =
-		input.threadMessages ??
-		(await deps.threadMessageService.findAllByMessageId(
-			accountConfigId,
-			messageId,
-		));
-	for (const threadMessage of threadMessages) {
-		const args = buildThreadMessageMoveRevert(
-			threadMessage,
-			uid,
-			sourceMailboxId,
-		);
-		await deps.threadMessageService
-			.update(
-				threadMessage.accountConfigId,
-				threadMessage.threadMessageId,
-				args.set,
-				{ composites: args.composites },
-			)
-			.catch(skipNotFound);
-	}
-};

package/src/handlers/thread-message-rows.ts

@@ -1,77 +0,0 @@
-import type { ThreadMessageItem } from "@remit/data-ports";
-
-/**
- * Build the `set` and `composites` payload for the ThreadMessage update on a
- * MESSAGE_DELETE move-to-trash.
- *
- * The CURRENT row state goes in `composites`; the NEW values go in `set`.
- * ElectroDB uses `composites` to run the conditional check on the existing row
- * AND to compute the previous sort-key values needed to recompute the new ones.
- * Passing the NEW values in `composites` makes the conditional check fail with
- * ConditionalCheckFailedException, which ElectroDB wraps as NotFoundError, and
- * the caller silently drops the update. Same root cause as PR #186 fixed for
- * `flag-queue.ts`.
- */
-export type ThreadMessageRowState = Pick<
-	ThreadMessageItem,
-	| "sentDate"
-	| "mailboxId"
-	| "isRead"
-	| "isDeleted"
-	| "hasStars"
-	| "hasAttachment"
->;
-
-const currentComposites = (threadMessage: ThreadMessageRowState) => ({
-	sentDate: threadMessage.sentDate,
-	mailboxId: threadMessage.mailboxId,
-	isRead: threadMessage.isRead,
-	isDeleted: threadMessage.isDeleted,
-	hasStars: threadMessage.hasStars,
-	hasAttachment: threadMessage.hasAttachment,
-});
-
-export const buildThreadMessageTrashUpdate = (
-	threadMessage: ThreadMessageRowState,
-	newUid: number,
-	destinationMailboxId: string,
-) => ({
-	set: {
-		uid: newUid,
-		mailboxId: destinationMailboxId,
-		isDeleted: true,
-	},
-	composites: currentComposites(threadMessage),
-});
-
-/**
- * The inverse payload: put the thread row back where the message still is on
- * the server. The delete was recorded optimistically, so a delete that gives up
- * with the message still at its source has to hand the row back rather than
- * leave it claiming Trash — an invisible `failed` on a row the user cannot see
- * is the shape of the incident this whole change is about.
- */
-export const buildThreadMessageMoveRevert = (
-	threadMessage: ThreadMessageRowState,
-	sourceUid: number,
-	sourceMailboxId: string,
-) => ({
-	set: {
-		uid: sourceUid,
-		mailboxId: sourceMailboxId,
-		isDeleted: false,
-	},
-	composites: currentComposites(threadMessage),
-});
-
-/**
- * Hand a row back after an abandoned expunge. The mail never left Trash, so
- * only the deletion mark reverts — the uid and mailbox on the row are still
- * where the server has it.
- */
-export const buildThreadMessageUndelete = (
-	threadMessage: ThreadMessageRowState,
-) => ({
-	set: { isDeleted: false },
-	composites: currentComposites(threadMessage),
-});

package/src/is-not-found.ts

@@ -1,17 +0,0 @@
-/**
- * A repository lookup or write for a row that no longer exists rejects with a
- * `NotFoundError` (name-matched, since the class crosses the data-ports adapter
- * boundary — see `@remit/data-ports/errors`).
- *
- * A worker event that references a deliberately-deleted mailbox is completed or
- * moot work, never a transient fault: every redelivery re-throws the same
- * `NotFoundError`, and because the sync queues carry `MessageGroupId=accountId`
- * that permanently-failing head message stalls the whole account's per-group
- * FIFO. Handlers use this predicate to resolve such an event terminally (ack
- * with a WARN) instead of retrying forever (issues #287, #289, #290).
- *
- * The guard is narrow on purpose: only a genuine not-found terminates. Real
- * IMAP/infra failures carry other errors and must still propagate to be retried.
- */
-export const isNotFoundError = (error: unknown): boolean =>
-	(error as { name?: string })?.name === "NotFoundError";