@remit/mailbox-service 0.0.102 → 0.0.103

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/mailbox-service",
-  "version": "0.0.102",
+  "version": "0.0.103",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",

package/src/body-sync-auto-read-writeonce.test.ts

@@ -160,7 +160,7 @@ describe("unsubscribed auto-mark-read is decided once (issue #499)", () => {
 			"m-1",
 			"acc-1",
 			"cfg-1",
-			"INBOX",
+			{ fullPath: "INBOX", placement: "inbox" },
 			async () => bodyConnection(),
 		);
 
@@ -181,7 +181,7 @@ describe("unsubscribed auto-mark-read is decided once (issue #499)", () => {
 			"m-1",
 			"acc-1",
 			"cfg-1",
-			"INBOX",
+			{ fullPath: "INBOX", placement: "inbox" },
 			async () => bodyConnection(),
 		);
 
@@ -204,7 +204,7 @@ describe("unsubscribed auto-mark-read is decided once (issue #499)", () => {
 			["m-1"],
 			"acc-1",
 			"cfg-1",
-			"INBOX",
+			{ fullPath: "INBOX", placement: "inbox" },
 			async () => bodyConnection(),
 			true,
 		);

package/src/body-sync-calendar-suggestion.test.ts

@@ -346,7 +346,7 @@ const readBody = async (
 		messageId,
 		"acc-1",
 		"cfg-1",
-		"INBOX",
+		{ fullPath: "INBOX", placement: "inbox" },
 		async () => connection,
 	);
 };

package/src/body-sync-category-denormalize.test.ts

@@ -195,7 +195,7 @@ const syncBatch = (harness: Harness) =>
 		["m-1"],
 		"acc-1",
 		"cfg-1",
-		"INBOX",
+		{ fullPath: "INBOX", placement: "inbox" },
 		async () =>
 			({
 				openBox: async () => {},
@@ -212,7 +212,7 @@ const syncFromImap = (harness: Harness) =>
 		"m-1",
 		"acc-1",
 		"cfg-1",
-		"INBOX",
+		{ fullPath: "INBOX", placement: "inbox" },
 		async () =>
 			({
 				openBox: async () => {},

package/src/body-sync-category-override.test.ts

@@ -199,7 +199,7 @@ describe("Address.flags.category overrides classification at sync time (issue #2
 			"m-1",
 			"acc-1",
 			"cfg-1",
-			"INBOX",
+			{ fullPath: "INBOX", placement: "inbox" },
 			async () => connection,
 		);
 
@@ -229,7 +229,7 @@ describe("Address.flags.category overrides classification at sync time (issue #2
 			"m-1",
 			"acc-1",
 			"cfg-1",
-			"INBOX",
+			{ fullPath: "INBOX", placement: "inbox" },
 			async () => connection,
 		);
 
@@ -251,7 +251,7 @@ describe("Address.flags.category overrides classification at sync time (issue #2
 			"m-1",
 			"acc-1",
 			"cfg-1",
-			"INBOX",
+			{ fullPath: "INBOX", placement: "inbox" },
 			async () => connection,
 		);
 
@@ -276,7 +276,7 @@ describe("Address.flags.category overrides classification at sync time (issue #2
 			"m-1",
 			"acc-1",
 			"cfg-1",
-			"INBOX",
+			{ fullPath: "INBOX", placement: "inbox" },
 			async () => connection,
 		);
 
@@ -296,7 +296,7 @@ describe("Address.flags.category overrides classification at sync time (issue #2
 			["m-1"],
 			"acc-1",
 			"cfg-1",
-			"INBOX",
+			{ fullPath: "INBOX", placement: "inbox" },
 			async () =>
 				({
 					openBox: async () => {},
@@ -336,7 +336,7 @@ describe("Address.flags.category overrides classification at sync time (issue #2
 			["m-1"],
 			"acc-1",
 			"cfg-1",
-			"INBOX",
+			{ fullPath: "INBOX", placement: "inbox" },
 			async () => {
 				throw new Error("an examined message must not be fetched again");
 			},
@@ -376,7 +376,7 @@ describe("Address.flags.category overrides classification at sync time (issue #2
 				"m-1",
 				"acc-1",
 				"cfg-1",
-				"INBOX",
+				{ fullPath: "INBOX", placement: "inbox" },
 				async () => connection,
 			);
 
@@ -413,7 +413,7 @@ describe("Address.flags.category overrides classification at sync time (issue #2
 				["m-1"],
 				"acc-1",
 				"cfg-1",
-				"INBOX",
+				{ fullPath: "INBOX", placement: "inbox" },
 				async () => connection,
 				true,
 			);
@@ -492,7 +492,7 @@ describe("Address.flags.category overrides classification at sync time (issue #2
 				"m-1",
 				"acc-1",
 				"cfg-1",
-				"INBOX",
+				{ fullPath: "INBOX", placement: "inbox" },
 				async () => connection,
 			),
 			/ProvisionedThroughputExceededException/,

package/src/body-sync-category-writeonce.test.ts

@@ -150,7 +150,7 @@ describe("Message.category survives a re-entrant classification pass", () => {
 			"m-1",
 			"acc-1",
 			"cfg-1",
-			"INBOX",
+			{ fullPath: "INBOX", placement: "inbox" },
 			async () => connection,
 		);
 
@@ -188,7 +188,7 @@ describe("Message.category survives a re-entrant classification pass", () => {
 			["m-1"],
 			"acc-1",
 			"cfg-1",
-			"INBOX",
+			{ fullPath: "INBOX", placement: "inbox" },
 			async () => connection,
 			true,
 		);
@@ -220,7 +220,7 @@ describe("Message.category survives a re-entrant classification pass", () => {
 			"m-1",
 			"acc-1",
 			"cfg-1",
-			"INBOX",
+			{ fullPath: "INBOX", placement: "inbox" },
 			async () => connection,
 		);
 

package/src/body-sync-filter.test.ts

@@ -181,7 +181,7 @@ const readBody = async (service: BodySyncService, mailboxPath = "INBOX") => {
 		"m-1",
 		"acc-1",
 		"cfg-1",
-		mailboxPath,
+		{ fullPath: mailboxPath, placement: "other" },
 		async () => connection,
 	);
 };

package/src/body-sync-placement-flags.test.ts

@@ -161,7 +161,7 @@ const readBody = async (
 		"m-1",
 		"acc-1",
 		"cfg-1",
-		mailboxPath,
+		{ fullPath: mailboxPath, placement: "other" },
 		async () => connection,
 	);
 };

package/src/body-sync-placement-writeonce.test.ts

@@ -187,7 +187,7 @@ describe("placement survives a re-entrant computePlacement pass (issue #383)", (
 			"m-1",
 			"acc-1",
 			"cfg-1",
-			"INBOX",
+			{ fullPath: "INBOX", placement: "inbox" },
 			async () => connection,
 		);
 
@@ -233,7 +233,7 @@ describe("placement survives a re-entrant computePlacement pass (issue #383)", (
 			["m-1"],
 			"acc-1",
 			"cfg-1",
-			"INBOX",
+			{ fullPath: "INBOX", placement: "inbox" },
 			async () => connection,
 			true,
 		);
@@ -268,7 +268,7 @@ describe("placement survives a re-entrant computePlacement pass (issue #383)", (
 			"m-1",
 			"acc-1",
 			"cfg-1",
-			"INBOX",
+			{ fullPath: "INBOX", placement: "inbox" },
 			async () => connection,
 		);
 
@@ -309,7 +309,7 @@ describe("placement survives a re-entrant computePlacement pass (issue #383)", (
 			"m-1",
 			"acc-1",
 			"cfg-1",
-			"INBOX",
+			{ fullPath: "INBOX", placement: "inbox" },
 			async () => connection,
 		);
 

package/src/body-sync-quarantine.test.ts

@@ -162,8 +162,12 @@ const connection = () =>
 	}) as unknown as IImapConnection;
 
 const sync = (service: BodySyncService) =>
-	service.syncBodies(["m-1"], "acc-1", "cfg-1", "INBOX", async () =>
-		connection(),
+	service.syncBodies(
+		["m-1"],
+		"acc-1",
+		"cfg-1",
+		{ fullPath: "INBOX", placement: "inbox" },
+		async () => connection(),
 	);
 
 const parseRefusal = () =>
@@ -258,7 +262,7 @@ describe("body sync skips what is already quarantined", () => {
 			["m-1"],
 			"acc-1",
 			"cfg-1",
-			"INBOX",
+			{ fullPath: "INBOX", placement: "inbox" },
 			async () => {
 				throw new Error("a quarantined message must not be fetched again");
 			},

package/src/body-sync-resync.test.ts

@@ -275,7 +275,7 @@ describe("issue #1011: forced re-store does not re-fire standing rules", () => {
 			["m-1"],
 			"acc-1",
 			"cfg-1",
-			"INBOX",
+			{ fullPath: "INBOX", placement: "inbox" },
 			async () => connection,
 			true,
 		);
@@ -330,7 +330,7 @@ describe("issue #1011: forced re-store does not re-fire standing rules", () => {
 			["m-1"],
 			"acc-1",
 			"cfg-1",
-			"INBOX",
+			{ fullPath: "INBOX", placement: "inbox" },
 			async () => connection,
 			true,
 		);
@@ -374,7 +374,7 @@ describe("issue #1011: forced re-store does not re-fire standing rules", () => {
 			"m-1",
 			"acc-1",
 			"cfg-1",
-			"INBOX",
+			{ fullPath: "INBOX", placement: "inbox" },
 			async () => noSuchKeyConn(DEMOTE_EML),
 		);
 
@@ -415,7 +415,7 @@ describe("issue #1011: forced re-store does not re-fire standing rules", () => {
 			"m-1",
 			"acc-1",
 			"cfg-1",
-			"INBOX",
+			{ fullPath: "INBOX", placement: "inbox" },
 			async () => noSuchKeyConn(INVITATION_EML),
 		);
 
@@ -569,7 +569,7 @@ describe("issue #1011: forced re-store does not re-fire standing rules", () => {
 			["m-stored", "m-new"],
 			"acc-1",
 			"cfg-1",
-			"INBOX",
+			{ fullPath: "INBOX", placement: "inbox" },
 			async () => connection,
 			true,
 		);

package/src/body-sync-unclassifiable-once.test.ts

@@ -167,8 +167,12 @@ const imapConnection = () =>
 	}) as unknown as IImapConnection;
 
 const syncPass = (harness: Harness) =>
-	harness.service.syncBodies(["m-1"], "acc-1", "cfg-1", "INBOX", async () =>
-		imapConnection(),
+	harness.service.syncBodies(
+		["m-1"],
+		"acc-1",
+		"cfg-1",
+		{ fullPath: "INBOX", placement: "inbox" },
+		async () => imapConnection(),
 	);
 
 describe("a body the classifier declined to categorize is examined once", () => {

package/src/body-sync-unsubscribed-auto-read.test.ts

@@ -129,7 +129,7 @@ const readBody = async (
 		"m-1",
 		"acc-1",
 		"cfg-1",
-		"INBOX",
+		{ fullPath: "INBOX", placement: "inbox" },
 		async () => connection,
 	);
 };

package/src/body-sync.ts

@@ -51,6 +51,7 @@ import {
 	FilterPipeline,
 } from "./filters/pipeline.js";
 import type { FlagQueueService } from "./flag-queue.js";
+import { placementOf, resolveFolderRoleMailboxes } from "./folder-placement.js";
 import {
 	classifyPlacement,
 	type FolderPlacement,
@@ -239,6 +240,11 @@ export interface StoreBodyPartContentsResult {
 
 export type ConnectionGetter = () => Promise<IImapConnection>;
 
+export interface BodySyncFolder {
+	fullPath: string;
+	placement: FolderPlacement;
+}
+
 export interface PlacementConfig {
 	mailboxSpecialUseService: IMailboxSpecialUseRepository;
 	/**
@@ -332,7 +338,7 @@ export class BodySyncService {
 	 * @param messageIds - The message IDs to sync bodies for
 	 * @param accountId - The account ID (for storage path)
 	 * @param accountConfigId - The account config ID (for thread updates)
-	 * @param mailboxPath - The IMAP mailbox path
+	 * @param folder - The IMAP mailbox path and its folder placement
 	 * @param getConnection - Function to get a (lazy) IMAP connection
 	 * @param force - Bypass the "already stored" skip guard and re-fetch every
 	 * message in this batch even though `bodyStorageKey` is already set. Set
@@ -345,13 +351,17 @@ export class BodySyncService {
 		messageIds: string[],
 		accountId: string,
 		accountConfigId: string,
-		mailboxPath: string,
+		folder: BodySyncFolder,
 		getConnection: ConnectionGetter,
 		force = false,
 	): Promise<SyncBodiesResult> {
 		const syncedMessageIds: string[] = [];
 		let skippedCount = 0;
-		const location = { accountId, accountConfigId, mailboxPath };
+		const location = {
+			accountId,
+			accountConfigId,
+			mailboxPath: folder.fullPath,
+		};
 
 		// Resolve every message up front so we can issue ONE ranged FETCH for the
 		// whole batch (the desktop-client pattern) instead of a SELECT + download
@@ -420,7 +430,7 @@ export class BodySyncService {
 		const connection = await getConnection();
 		// Single SELECT for the whole batch. openBox is idempotent, so a warm
 		// connection already on this mailbox skips the SELECT entirely.
-		await connection.openBox(mailboxPath);
+		await connection.openBox(folder.fullPath);
 
 		let connectionLost = false;
 		try {
@@ -440,6 +450,7 @@ export class BodySyncService {
 						accountId,
 						accountConfigId,
 						source,
+						folder.placement,
 						reStoredMessageIds.has(messageId),
 					);
 				} catch (error) {
@@ -628,6 +639,7 @@ export class BodySyncService {
 		accountId: string,
 		accountConfigId: string,
 		source: Readable,
+		placement: FolderPlacement,
 		isReStore: boolean,
 	): Promise<void> {
 		const toStorage = new PassThrough();
@@ -672,6 +684,7 @@ export class BodySyncService {
 			{
 				uri: ref.uri,
 			},
+			placement,
 			isReStore,
 		);
 	}
@@ -704,6 +717,7 @@ export class BodySyncService {
 		accountConfigId: string,
 		body: Buffer,
 		bodyRef: { uri: string },
+		placement: FolderPlacement,
 		/**
 		 * Whether this call is a re-store of an already-classified message
 		 * rather than a first store. The two re-entrant paths (`force: true`
@@ -767,7 +781,11 @@ export class BodySyncService {
 		// `flags.category` override when one applies (issue #299). The derived
 		// fields are folded into the single Message update below — they are NOT
 		// written here.
-		const classification = await this.classifyMessage(accountConfigId, parsed);
+		const classification = await this.classifyMessage(
+			accountConfigId,
+			parsed,
+			placement,
+		);
 
 		// Decide the placement move from the in-memory classification before the
 		// write, so its `movedByRemit` flag and audit verdict join the same
@@ -984,7 +1002,7 @@ export class BodySyncService {
 	 * @param messageId - The message ID to fetch
 	 * @param accountId - The account ID (for storage path)
 	 * @param accountConfigId - The account config ID (for thread updates)
-	 * @param mailboxPath - The IMAP mailbox path
+	 * @param folder - The IMAP mailbox path and its folder placement
 	 * @param getConnection - Function to get a (lazy) IMAP connection
 	 * @returns Parsed text and HTML content
 	 */
@@ -992,7 +1010,7 @@ export class BodySyncService {
 		messageId: string,
 		accountId: string,
 		accountConfigId: string,
-		mailboxPath: string,
+		folder: BodySyncFolder,
 		getConnection: ConnectionGetter,
 	): Promise<FetchBodyResult> {
 		const message = await this.messageService.get(messageId);
@@ -1030,14 +1048,18 @@ export class BodySyncService {
 				needsStore = true;
 				body = await this.fetchFromImap(
 					message.uid,
-					mailboxPath,
+					folder.fullPath,
 					getConnection,
 				);
 			}
 		} else {
 			// Fetch from IMAP and store
 			needsStore = true;
-			body = await this.fetchFromImap(message.uid, mailboxPath, getConnection);
+			body = await this.fetchFromImap(
+				message.uid,
+				folder.fullPath,
+				getConnection,
+			);
 		}
 
 		let parsed: ParsedMail;
@@ -1062,6 +1084,7 @@ export class BodySyncService {
 				accountConfigId,
 				body,
 				{ uri: ref.uri },
+				folder.placement,
 				message.bodyStorageKey != null,
 			);
 		} else {
@@ -1097,8 +1120,14 @@ export class BodySyncService {
 	private async classifyMessage(
 		accountConfigId: string,
 		parsed: ParsedMail,
+		placement: FolderPlacement,
 	): Promise<UpdateMessageInput & { category: ThreadMessageCategory }> {
-		return classifyParsedMessage(this.addressService, accountConfigId, parsed);
+		return classifyParsedMessage(
+			this.addressService,
+			accountConfigId,
+			parsed,
+			placement,
+		);
 	}
 
 	private async incrementInboundCount(
@@ -1458,17 +1487,12 @@ export class BodySyncService {
 		// true)`) skip the decision steps entirely, so only the pass that first
 		// stores a body ever reaches this method.
 
-		const junkMailbox =
-			await mailboxSpecialUseService.findJunkMailbox(accountId);
-		const inboxMailbox =
-			await mailboxSpecialUseService.findInboxMailbox(accountId);
-
-		const placement: FolderPlacement =
-			junkMailbox && message.mailboxId === junkMailbox.mailboxId
-				? "junk"
-				: inboxMailbox && message.mailboxId === inboxMailbox.mailboxId
-					? "inbox"
-					: "other";
+		const roleMailboxes = await resolveFolderRoleMailboxes(
+			mailboxSpecialUseService,
+			accountId,
+		);
+		const { junkMailbox, inboxMailbox } = roleMailboxes;
+		const placement = placementOf(message.mailboxId, roleMailboxes);
 
 		const fromEmail = extractPrimaryFromEmail(parsed);
 		const signals = fromEmail

package/src/classification-backfill.test.ts

@@ -13,8 +13,10 @@ import assert from "node:assert/strict";
 import { describe, it } from "node:test";
 import type {
 	AccountConfigItem,
+	AccountItem,
 	AddressItem,
 	IAccountConfigRepository,
+	IAccountRepository,
 	IAddressRepository,
 	IMessageRepository,
 	IThreadMessageRepository,
@@ -25,8 +27,10 @@ import type {
 	UpdateThreadMessageInput,
 } from "@remit/data-ports";
 import { NotFoundError } from "@remit/data-ports/errors";
+import { DisplayNameCorrespondence } from "@remit/domain-enums";
 import type { StorageService } from "@remit/storage-service";
 import { backfillClassifications } from "./classification-backfill.js";
+import type { FolderPlacementLookup } from "./folder-placement.js";
 
 const PLAIN_EML = Buffer.from(
 	[
@@ -52,6 +56,20 @@ const LIST_EML = Buffer.from(
 	].join("\r\n"),
 );
 
+const IMPERSONATION_EML = Buffer.from(
+	[
+		"From: InfoMedics <billing@serviceupdatebank.atlassian.net>",
+		"To: me@example.com",
+		"Subject: Openstaande factuur",
+		"DKIM-Signature: v=1; a=rsa-sha256; d=atlassian.net; s=sel; b=xxx",
+		"Content-Type: text/plain",
+		"",
+		"Betaal uw factuur",
+	].join("\r\n"),
+);
+
+const JUNK_MAILBOX_ID = "mb-junk";
+
 const row = (overrides: Partial<ThreadMessageItem>): ThreadMessageItem =>
 	({
 		threadMessageId: "tm-1",
@@ -97,6 +115,8 @@ const asAccount = (accountConfigId: string): AccountConfigItem =>
 
 interface Harness {
 	accountConfigService: Pick<IAccountConfigRepository, "listAll">;
+	accountService: Pick<IAccountRepository, "listAllByAccountConfig">;
+	mailboxSpecialUseService: FolderPlacementLookup;
 	addressService: Pick<IAddressRepository, "getAddress">;
 	threadMessageService: Pick<
 		IThreadMessageRepository,
@@ -134,6 +154,20 @@ const buildHarness = (options: {
 		listAll: async () => accounts,
 	};
 
+	const accountService: Pick<IAccountRepository, "listAllByAccountConfig"> = {
+		listAllByAccountConfig: async (accountConfigId: string) => [
+			{ accountId: `account-${accountConfigId}` } as unknown as AccountItem,
+		],
+	};
+
+	const mailboxSpecialUseService: FolderPlacementLookup = {
+		findJunkMailbox: async () => ({
+			mailboxId: JUNK_MAILBOX_ID,
+			fullPath: "Junk",
+		}),
+		findInboxMailbox: async () => ({ mailboxId: "mb-1", fullPath: "INBOX" }),
+	};
+
 	const addressService = {
 		getAddress: (async () => {
 			if (options.addressFlags === undefined)
@@ -203,6 +237,8 @@ const buildHarness = (options: {
 
 	return {
 		accountConfigService,
+		accountService,
+		mailboxSpecialUseService,
 		addressService,
 		threadMessageService,
 		messageService,
@@ -237,6 +273,42 @@ describe("backfillClassifications", () => {
 		);
 	});
 
+	it("compares the sender of a Junk row the provider rated clean, and not of an inbox row", async () => {
+		const harness = buildHarness({
+			rows: [
+				row({
+					threadMessageId: "tm-junk",
+					messageId: "m-junk",
+					mailboxId: JUNK_MAILBOX_ID,
+				}),
+				row({ threadMessageId: "tm-inbox", messageId: "m-inbox" }),
+			],
+			messages: [
+				message({
+					messageId: "m-junk",
+					mailboxId: JUNK_MAILBOX_ID,
+					bodyStorageKey: "s3://m-junk",
+				}),
+				message({ messageId: "m-inbox", bodyStorageKey: "s3://m-inbox" }),
+			],
+			retrieve: async () => IMPERSONATION_EML,
+		});
+
+		await backfillClassifications(harness);
+
+		const correspondence = new Map(
+			harness.messageUpdates.map((update) => [
+				update.messageId,
+				update.input.authenticity?.displayNameCorrespondence,
+			]),
+		);
+		assert.equal(
+			correspondence.get("m-junk"),
+			DisplayNameCorrespondence.Unrelated,
+		);
+		assert.equal(correspondence.get("m-inbox"), undefined);
+	});
+
 	it("denormalizes the classifier's answer onto the thread row", async () => {
 		const harness = buildHarness({
 			rows: [row({ threadMessageId: "tm-1", messageId: "m-1" })],

package/src/classification-backfill.ts

@@ -1,5 +1,6 @@
 import type {
 	IAccountConfigRepository,
+	IAccountRepository,
 	IAddressRepository,
 	IMessageRepository,
 	IThreadMessageRepository,
@@ -11,6 +12,11 @@ import { parseMessageBody } from "./body-parse.js";
 import { extractSnippet } from "./body-sync.js";
 import { classifyParsedMessage } from "./classify-message.js";
 import { extractListId } from "./filters/list-id.js";
+import {
+	type FolderPlacementLookup,
+	resolveAccountFolderPlacements,
+} from "./folder-placement.js";
+import type { FolderPlacement } from "./heuristics/classifyPlacement.js";
 import {
 	denormalizeMessageCategory,
 	hasDecidedCategory,
@@ -44,6 +50,8 @@ export interface ClassificationBackfillCheckpointStore {
 
 export interface ClassificationBackfillDeps {
 	accountConfigService: Pick<IAccountConfigRepository, "listAll">;
+	accountService: Pick<IAccountRepository, "listAllByAccountConfig">;
+	mailboxSpecialUseService: FolderPlacementLookup;
 	/** Reads the sender's `Address.flags.category` override (issue #299). */
 	addressService: Pick<IAddressRepository, "getAddress">;
 	threadMessageService: Pick<
@@ -116,6 +124,7 @@ const classifyAndApply = async (
 	accountConfigId: string,
 	row: ThreadMessageItem,
 	bodyStorageKey: string,
+	placement: FolderPlacement,
 ): Promise<void> => {
 	const body = await deps.storageService.retrieve(bodyStorageKey);
 	const parsed = await parseMessageBody(body);
@@ -123,6 +132,7 @@ const classifyAndApply = async (
 		deps.addressService,
 		accountConfigId,
 		parsed,
+		placement,
 	);
 
 	// The same denormalized fields the body-store path writes (see
@@ -223,6 +233,13 @@ export const backfillClassifications = async (
 		const account = accounts[accountIndex];
 		let continuationToken: string | undefined =
 			accountIndex === startIndex ? startContinuationToken : undefined;
+		const mailAccounts = await deps.accountService.listAllByAccountConfig(
+			account.accountConfigId,
+		);
+		const placements = await resolveAccountFolderPlacements(
+			deps.mailboxSpecialUseService,
+			mailAccounts.map((mailAccount) => mailAccount.accountId),
+		);
 
 		do {
 			const page = await deps.threadMessageService.listByAccount(
@@ -297,6 +314,7 @@ export const backfillClassifications = async (
 						account.accountConfigId,
 						row,
 						message.bodyStorageKey,
+						placements.get(row.mailboxId) ?? "other",
 					).then(
 						() => null,
 						(error: unknown) => error,

package/src/classify-message.test.ts

@@ -13,6 +13,7 @@ import assert from "node:assert/strict";
 import { describe, it } from "node:test";
 import type { AddressItem, IAddressRepository } from "@remit/data-ports";
 import { NotFoundError } from "@remit/data-ports/errors";
+import { DisplayNameCorrespondence } from "@remit/domain-enums";
 import { parseMessageBody } from "./body-parse.js";
 import {
 	classifyParsedMessage,
@@ -43,6 +44,18 @@ const LIST_EML = Buffer.from(
 	].join("\r\n"),
 );
 
+const IMPERSONATION_EML = Buffer.from(
+	[
+		"From: InfoMedics <billing@serviceupdatebank.atlassian.net>",
+		"To: me@example.com",
+		"Subject: Openstaande factuur",
+		"DKIM-Signature: v=1; a=rsa-sha256; d=atlassian.net; s=sel; b=xxx",
+		"Content-Type: text/html",
+		"",
+		'<a href="https://betaal-vordering.example.org/pay">Betaal uw factuur</a>',
+	].join("\r\n"),
+);
+
 const addressService = (
 	behavior: (accountConfigId: string, addressId: string) => unknown,
 ): Pick<IAddressRepository, "getAddress"> => ({
@@ -68,6 +81,7 @@ describe("classifyParsedMessage", () => {
 			}),
 			"acc-1",
 			parsed,
+			"inbox",
 		);
 
 		assert.equal(classification.category, "newsletter");
@@ -81,6 +95,7 @@ describe("classifyParsedMessage", () => {
 			addressService(withFlags({ category: { value: "marketing", setAt: 1 } })),
 			"acc-1",
 			parsed,
+			"inbox",
 		);
 
 		// The header table alone would answer `personal`; the override wins
@@ -98,6 +113,7 @@ describe("classifyParsedMessage", () => {
 				}),
 				"acc-1",
 				parsed,
+				"inbox",
 			),
 			/throttled/,
 		);
@@ -124,6 +140,7 @@ describe("classifyParsedMessage", () => {
 			}),
 			"acc-1",
 			parsed,
+			"inbox",
 		);
 
 		assert.equal(reads, 0);
@@ -131,6 +148,48 @@ describe("classifyParsedMessage", () => {
 	});
 });
 
+describe("classifyParsedMessage sender mismatch", () => {
+	const noAddress = addressService(async () => {
+		throw new NotFoundError("no Address row");
+	});
+
+	it("compares the sender of mail in Junk the provider rated clean", async () => {
+		const parsed = await parseMessageBody(IMPERSONATION_EML);
+
+		const classification = await classifyParsedMessage(
+			noAddress,
+			"acc-1",
+			parsed,
+			"junk",
+		);
+
+		assert.equal(
+			classification.authenticity?.displayNameCorrespondence,
+			DisplayNameCorrespondence.Unrelated,
+		);
+		assert.deepEqual(classification.authenticity?.offDomainLinkDomains, [
+			"example.org",
+		]);
+	});
+
+	it("compares nothing for the same mail outside Junk without a provider verdict", async () => {
+		const parsed = await parseMessageBody(IMPERSONATION_EML);
+
+		const classification = await classifyParsedMessage(
+			noAddress,
+			"acc-1",
+			parsed,
+			"inbox",
+		);
+
+		assert.equal(
+			classification.authenticity?.displayNameCorrespondence,
+			undefined,
+		);
+		assert.equal(classification.authenticity?.offDomainLinkDomains, undefined);
+	});
+});
+
 describe("extractPrimaryFromEmail", () => {
 	it("reads the first From address", async () => {
 		const parsed = await parseMessageBody(PLAIN_EML);

package/src/classify-message.ts

@@ -13,6 +13,7 @@ import {
 	extractHasListUnsubscribe,
 	extractProviderSpam,
 } from "./heuristics/classifyByHeaders.js";
+import type { FolderPlacement } from "./heuristics/classifyPlacement.js";
 import { extractSenderMismatch } from "./heuristics/senderMismatch.js";
 
 type ThreadMessageCategory = ThreadMessageItem["category"];
@@ -75,6 +76,7 @@ export const classifyParsedMessage = async (
 	addressService: Pick<IAddressRepository, "getAddress">,
 	accountConfigId: string,
 	parsed: ParsedMail,
+	placement: FolderPlacement,
 ): Promise<UpdateMessageInput & { category: ThreadMessageCategory }> => {
 	const headerCategory = classifyByHeaders(parsed);
 	const authenticity = extractAuthenticity(parsed);
@@ -86,13 +88,14 @@ export const classifyParsedMessage = async (
 	// identity the message claims — on a shared-tenant host the verified
 	// subdomain belongs to whoever signed up. These two comparisons say
 	// whether the claim holds, and run only over mail the provider already
-	// called spam.
+	// called spam or that sits in the Junk folder.
 	const senderMismatch =
 		authenticity === null
 			? {}
 			: extractSenderMismatch(parsed, {
 					fromDomain: authenticity.fromDomain,
-					spamClassified: providerSpam?.classified === true,
+					providerSpamClassified: providerSpam?.classified === true,
+					placement,
 					bulkSender: hasListUnsubscribe,
 				});
 

package/src/folder-placement.ts

@@ -0,0 +1,56 @@
+import type { IMailboxSpecialUseRepository } from "@remit/data-ports";
+import type { FolderPlacement } from "./heuristics/classifyPlacement.js";
+
+export type FolderPlacementLookup = Pick<
+	IMailboxSpecialUseRepository,
+	"findJunkMailbox" | "findInboxMailbox"
+>;
+
+type RoleMailbox = Awaited<
+	ReturnType<IMailboxSpecialUseRepository["findJunkMailbox"]>
+>;
+
+export interface FolderRoleMailboxes {
+	junkMailbox: RoleMailbox;
+	inboxMailbox: RoleMailbox;
+}
+
+export const resolveFolderRoleMailboxes = async (
+	lookup: FolderPlacementLookup,
+	accountId: string,
+): Promise<FolderRoleMailboxes> => ({
+	junkMailbox: await lookup.findJunkMailbox(accountId),
+	inboxMailbox: await lookup.findInboxMailbox(accountId),
+});
+
+export const placementOf = (
+	mailboxId: string,
+	{ junkMailbox, inboxMailbox }: FolderRoleMailboxes,
+): FolderPlacement => {
+	if (junkMailbox?.mailboxId === mailboxId) return "junk";
+	if (inboxMailbox?.mailboxId === mailboxId) return "inbox";
+	return "other";
+};
+
+export const resolveFolderPlacement = async (
+	lookup: FolderPlacementLookup,
+	accountId: string,
+	mailboxId: string,
+): Promise<FolderPlacement> =>
+	placementOf(mailboxId, await resolveFolderRoleMailboxes(lookup, accountId));
+
+export const resolveAccountFolderPlacements = async (
+	lookup: FolderPlacementLookup,
+	accountIds: readonly string[],
+): Promise<ReadonlyMap<string, FolderPlacement>> => {
+	const placements = new Map<string, FolderPlacement>();
+	for (const accountId of accountIds) {
+		const { junkMailbox, inboxMailbox } = await resolveFolderRoleMailboxes(
+			lookup,
+			accountId,
+		);
+		if (inboxMailbox) placements.set(inboxMailbox.mailboxId, "inbox");
+		if (junkMailbox) placements.set(junkMailbox.mailboxId, "junk");
+	}
+	return placements;
+};

package/src/heuristics/senderMismatch.test.ts

@@ -245,7 +245,8 @@ describe("extractSenderMismatch", () => {
 		assert.deepEqual(
 			extractSenderMismatch(parsed, {
 				fromDomain: "serviceupdatebank.atlassian.net",
-				spamClassified: true,
+				providerSpamClassified: true,
+				placement: "other",
 				bulkSender: false,
 			}),
 			{
@@ -255,18 +256,53 @@ describe("extractSenderMismatch", () => {
 		);
 	});
 
-	it("compares nothing when the provider did not call the message spam", async () => {
+	it("flags a message sitting in Junk that the provider rated clean", async () => {
 		const parsed = await parse(infoMedicsPhish);
 		assert.deepEqual(
 			extractSenderMismatch(parsed, {
 				fromDomain: "serviceupdatebank.atlassian.net",
-				spamClassified: false,
+				providerSpamClassified: false,
+				placement: "junk",
 				bulkSender: false,
 			}),
-			{},
+			{
+				displayNameCorrespondence: DisplayNameCorrespondence.Unrelated,
+				offDomainLinkDomains: ["example.org"],
+			},
 		);
 	});
 
+	it("flags a provider-classified message outside Junk", async () => {
+		const parsed = await parse(infoMedicsPhish);
+		assert.deepEqual(
+			extractSenderMismatch(parsed, {
+				fromDomain: "serviceupdatebank.atlassian.net",
+				providerSpamClassified: true,
+				placement: "inbox",
+				bulkSender: false,
+			}),
+			{
+				displayNameCorrespondence: DisplayNameCorrespondence.Unrelated,
+				offDomainLinkDomains: ["example.org"],
+			},
+		);
+	});
+
+	for (const placement of ["inbox", "other"] as const) {
+		it(`compares nothing in ${placement} when the provider did not call the message spam`, async () => {
+			const parsed = await parse(infoMedicsPhish);
+			assert.deepEqual(
+				extractSenderMismatch(parsed, {
+					fromDomain: "serviceupdatebank.atlassian.net",
+					providerSpamClassified: false,
+					placement,
+					bulkSender: false,
+				}),
+				{},
+			);
+		});
+	}
+
 	it("flags a display name spelling the recipient's own address over a foreign domain", async () => {
 		const parsed = await parse([
 			"From: matthijs@ischen.nl <aramirez@secresaludguaviare.gov.co>",
@@ -279,7 +315,8 @@ describe("extractSenderMismatch", () => {
 		assert.equal(
 			extractSenderMismatch(parsed, {
 				fromDomain: "secresaludguaviare.gov.co",
-				spamClassified: true,
+				providerSpamClassified: true,
+				placement: "other",
 				bulkSender: false,
 			}).displayNameCorrespondence,
 			DisplayNameCorrespondence.ForeignAddress,
@@ -299,7 +336,8 @@ describe("extractSenderMismatch", () => {
 		]);
 		const signals = extractSenderMismatch(parsed, {
 			fromDomain: "mailer.esp.example",
-			spamClassified: true,
+			providerSpamClassified: true,
+			placement: "other",
 			bulkSender: true,
 		});
 		assert.equal(signals.displayNameCorrespondence, undefined);

package/src/heuristics/senderMismatch.ts

@@ -1,6 +1,7 @@
 import { DisplayNameCorrespondence } from "@remit/domain-enums";
 import type { ParsedMail } from "mailparser";
 import { getDomain, parse as parseHost } from "tldts";
+import type { FolderPlacement } from "./classifyPlacement.js";
 
 type CorrespondenceValue =
 	(typeof DisplayNameCorrespondence)[keyof typeof DisplayNameCorrespondence];
@@ -10,7 +11,8 @@ type CorrespondenceValue =
  * that belongs to nobody at the sending domain, and body links that leave it.
  *
  * Both are deliberately aggressive, and both are computed only for mail the
- * provider's own filter already called spam (see {@link extractSenderMismatch}).
+ * provider's own filter already called spam or that sits in the Junk folder
+ * (see {@link extractSenderMismatch}).
  * On a shared-tenant host — a free Atlassian, Salesforce or Zendesk instance —
  * the verified subdomain is chosen by whoever signed up, so a passing signature
  * proves the domain and nothing about the identity the message claims.
@@ -22,7 +24,8 @@ export interface SenderMismatchSignals {
 
 export interface SenderMismatchContext {
 	fromDomain: string;
-	spamClassified: boolean;
+	providerSpamClassified: boolean;
+	placement: FolderPlacement;
 	/**
 	 * List-Unsubscribe present. Bulk mail routinely shows a brand name over an
 	 * ESP's sending domain, so the display-name comparison says nothing there and
@@ -223,7 +226,8 @@ export const extractOffDomainLinkDomains = (
 };
 
 /**
- * Both signals, gated on the provider's own spam verdict.
+ * Both signals, gated on a spam verdict: the provider's own, or the message
+ * sitting in the Junk folder.
  *
  * The gate is what lets the checks be this aggressive: ordinary mail never
  * reaches them, so a brand name over an ESP domain or a newsletter full of
@@ -234,7 +238,9 @@ export const extractSenderMismatch = (
 	parsed: ParsedMail,
 	context: SenderMismatchContext,
 ): SenderMismatchSignals => {
-	if (!context.spamClassified) return {};
+	if (!context.providerSpamClassified && context.placement !== "junk") {
+		return {};
+	}
 
 	const offDomainLinkDomains = extractOffDomainLinkDomains(
 		parsed,

package/src/index.ts

@@ -25,6 +25,7 @@ export {
 	parseMessageBody,
 } from "./body-parse.js";
 export {
+	type BodySyncFolder,
 	type BodySyncLogger,
 	BodySyncService,
 	type ConnectionGetter,
@@ -125,6 +126,11 @@ export {
 	type UpdateFlagsInput,
 	type UpdateFlagsResult,
 } from "./flag-queue.js";
+export {
+	type FolderPlacementLookup,
+	resolveAccountFolderPlacements,
+	resolveFolderPlacement,
+} from "./folder-placement.js";
 export {
 	classifyByHeaders,
 	extractAuthenticity,