@remit/mailbox-service 0.0.112 → 0.0.113

package/src/credentials.test.ts

@@ -1,181 +0,0 @@
-/**
- * Unit tests for MailCredentials union and MailConnectionError.
- *
- * Covers:
- * 1. Auth object construction — imapflow auth shape for each credential kind
- * 2. Exhaustiveness — TypeScript catches missing cases via `never`
- * 3. Token-leak assertion — accessToken never in serialized error
- * 4. Error classification — createImapFlowConnectionFromAccount wires password
- */
-
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import { inspect } from "node:util";
-import { MailConnectionError, type MailCredentials } from "./types.js";
-
-// ---------------------------------------------------------------------------
-// Helper: build the same imapflow auth object that imapflow-connection.ts uses
-// (extracted here so the test doesn't import the whole class)
-// ---------------------------------------------------------------------------
-
-type ImapAuth =
-	| { user: string; pass: string }
-	| { user: string; accessToken: string };
-
-const buildImapAuth = (
-	user: string,
-	credentials: MailCredentials,
-): ImapAuth => {
-	if (credentials.kind === "password") {
-		return { user, pass: credentials.password };
-	}
-	if (credentials.kind === "accessToken") {
-		return { user, accessToken: credentials.accessToken };
-	}
-	// Exhaustiveness check — TypeScript will error here if a new union member
-	// is added without updating this function.
-	const _exhaustive: never = credentials;
-	throw new Error(`Unknown credential kind: ${JSON.stringify(_exhaustive)}`);
-};
-
-// ---------------------------------------------------------------------------
-// Helper: build the same nodemailer auth object that smtp-client.ts uses
-// ---------------------------------------------------------------------------
-
-type SmtpAuth =
-	| { user: string; pass: string }
-	| { type: "OAuth2"; user: string; accessToken: string };
-
-const buildSmtpAuth = (
-	user: string,
-	credentials: MailCredentials,
-): SmtpAuth => {
-	if (credentials.kind === "password") {
-		return { user, pass: credentials.password };
-	}
-	if (credentials.kind === "accessToken") {
-		return {
-			type: "OAuth2" as const,
-			user,
-			accessToken: credentials.accessToken,
-		};
-	}
-	// Exhaustiveness check
-	const _exhaustive: never = credentials;
-	throw new Error(`Unknown credential kind: ${JSON.stringify(_exhaustive)}`);
-};
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-describe("MailCredentials — imapflow auth shape", () => {
-	it("password kind → { user, pass }", () => {
-		const creds: MailCredentials = { kind: "password", password: "s3cr3t" };
-		const auth = buildImapAuth("alice@example.com", creds);
-
-		assert.deepEqual(auth, { user: "alice@example.com", pass: "s3cr3t" });
-		assert.ok(
-			!("accessToken" in auth),
-			"no accessToken field for password auth",
-		);
-	});
-
-	it("accessToken kind → { user, accessToken }", () => {
-		const token = "ya29.super-secret-token";
-		const creds: MailCredentials = { kind: "accessToken", accessToken: token };
-		const auth = buildImapAuth("alice@example.com", creds);
-
-		assert.deepEqual(auth, {
-			user: "alice@example.com",
-			accessToken: token,
-		});
-		assert.ok(!("pass" in auth), "no pass field for accessToken auth");
-	});
-});
-
-describe("MailCredentials — nodemailer auth shape", () => {
-	it("password kind → { user, pass }", () => {
-		const creds: MailCredentials = { kind: "password", password: "s3cr3t" };
-		const auth = buildSmtpAuth("alice@example.com", creds);
-
-		assert.deepEqual(auth, { user: "alice@example.com", pass: "s3cr3t" });
-		assert.ok(!("type" in auth), "no OAuth2 type field for password auth");
-	});
-
-	it("accessToken kind → { type: 'OAuth2', user, accessToken }", () => {
-		const token = "ya29.super-secret-token";
-		const creds: MailCredentials = { kind: "accessToken", accessToken: token };
-		const auth = buildSmtpAuth("alice@example.com", creds);
-
-		assert.deepEqual(auth, {
-			type: "OAuth2",
-			user: "alice@example.com",
-			accessToken: token,
-		});
-		assert.ok(!("pass" in auth), "no pass field for OAuth2 auth");
-	});
-});
-
-describe("MailConnectionError", () => {
-	it("stores kind='auth'", () => {
-		const err = new MailConnectionError("auth", "IMAP authentication failed");
-		assert.equal(err.kind, "auth");
-		assert.equal(err.name, "MailConnectionError");
-		assert.equal(err.message, "IMAP authentication failed");
-	});
-
-	it("stores kind='network'", () => {
-		const err = new MailConnectionError(
-			"network",
-			"IMAP connection failed: ECONNREFUSED",
-		);
-		assert.equal(err.kind, "network");
-	});
-
-	it("token-leak: accessToken must NOT appear in inspected MailConnectionError", () => {
-		const secretToken = "ya29.A0ARrdaM_very_secret_access_token_12345";
-
-		// Simulate what connection code does: auth fails for an OAuth account.
-		// The error message must NOT mention the token, only "auth failed".
-		const err = new MailConnectionError(
-			"auth",
-			"IMAP authentication failed",
-			// The cause should also never include the token
-		);
-
-		// util.inspect walks the full error including the cause chain, so this
-		// proves no token leaks through name/message/stack OR cause.
-		const serialized = inspect(err, { depth: null });
-
-		assert.ok(
-			!serialized.includes(secretToken),
-			`MailConnectionError must not contain the access token — got: ${serialized.slice(0, 200)}`,
-		);
-	});
-
-	it("token-leak: accessToken in cause does NOT bubble into error.message", () => {
-		// Even if the underlying library error somehow includes the token text,
-		// our MailConnectionError message must not re-echo it.
-		const secretToken = "ya29.A0ARrdaM_very_secret_access_token_CAUSE";
-		const underlyingError = new Error(`AUTH failed token=${secretToken}`);
-
-		const err = new MailConnectionError(
-			"auth",
-			"IMAP authentication failed",
-			underlyingError,
-		);
-
-		// The message itself must be token-free
-		assert.ok(
-			!err.message.includes(secretToken),
-			"error.message must not contain the access token",
-		);
-	});
-
-	it("is instanceof Error", () => {
-		const err = new MailConnectionError("auth", "test");
-		assert.ok(err instanceof Error);
-		assert.ok(err instanceof MailConnectionError);
-	});
-});

package/src/external-move.test.ts

@@ -1,262 +0,0 @@
-import assert from "node:assert/strict";
-import { afterEach, beforeEach, describe, it } from "node:test";
-import type { AccountItem, MailboxItem, MessageItem } from "@remit/data-ports";
-import { MessageStatus, MessageSyncStatus } from "@remit/domain-enums";
-import {
-	confirmDepartures,
-	placementKey,
-	sightingContestsPlacement,
-} from "./external-move.js";
-import { eml, FakeImapServer } from "./test-helpers/fake-imap.js";
-import {
-	openStore,
-	type Store,
-	seedAccount,
-	seedMailbox,
-	seedMessage,
-	silentLog,
-} from "./test-helpers/test-store.js";
-
-const mailboxAt = (fullPath: string): MailboxItem =>
-	({
-		mailboxId: `mbx-${fullPath}`,
-		fullPath,
-		uidValidity: 1,
-		hierarchyDelimiter: "/",
-	}) as MailboxItem;
-
-const INBOX = mailboxAt("INBOX");
-const JUNK = mailboxAt("INBOX/Rubbish");
-
-const storedIn = (
-	mailbox: MailboxItem,
-	overrides: Partial<MessageItem> = {},
-): MessageItem =>
-	({
-		messageId: "msg-1",
-		mailboxId: mailbox.mailboxId,
-		uid: 7,
-		status: MessageStatus.active,
-		syncStatus: MessageSyncStatus.pending,
-		...overrides,
-	}) as MessageItem;
-
-let store: Store;
-let imap: FakeImapServer;
-let account: AccountItem;
-let inbox: MailboxItem;
-let receipts: MailboxItem;
-let allMail: MailboxItem;
-
-beforeEach(async () => {
-	store = await openStore();
-	imap = new FakeImapServer();
-	account = await seedAccount(store);
-	inbox = await seedMailbox(store, account, "INBOX");
-	receipts = await seedMailbox(store, account, "Receipts");
-	allMail = await seedMailbox(store, account, "[Gmail]/All Mail", {
-		specialUse: "All",
-	});
-	for (const path of ["INBOX", "Receipts", "[Gmail]/All Mail"]) {
-		imap.addFolder(path);
-	}
-});
-
-afterEach(() => store.close());
-
-const rowsIn = async (mailbox: MailboxItem, count: number) => {
-	const ids: string[] = [];
-	for (let i = 0; i < count; i++) {
-		const uid = imap.deliver(mailbox.fullPath, eml({}));
-		ids.push(
-			(await seedMessage(store, account, mailbox, uid)).message.messageId,
-		);
-	}
-	return ids;
-};
-
-const probe = async (sightedIn: MailboxItem, messageIds: string[]) => {
-	const connection = imap.connection();
-	const before = imap.log.length;
-	const verdicts = await confirmDepartures(
-		{
-			connection,
-			mailboxService: store.mailbox,
-			messageService: store.message,
-			log: silentLog,
-		},
-		account.accountId,
-		sightedIn,
-		messageIds,
-	);
-	const asked = imap.log.slice(before);
-	return {
-		...verdicts,
-		opened: asked.filter((line) => /^(SELECT|EXAMINE) /.test(line)),
-		searched: asked.filter((line) => line.startsWith("SEARCH ")),
-	};
-};
-
-describe("whether a sighting in a second folder is a move", () => {
-	it("asks each source folder once, about the contested uids only", async () => {
-		const ids = await rowsIn(inbox, 3);
-		imap.expunge("INBOX", 2);
-
-		const observed = await probe(receipts, ids);
-
-		assert.deepEqual(observed.opened, ["EXAMINE INBOX"]);
-		assert.equal(observed.searched.length, 1);
-		const [, uids] = /"UID","([\d,]+)"/.exec(observed.searched[0]) ?? [];
-		assert.deepEqual(uids?.split(",").sort(), ["1", "2", "3"]);
-		assert.deepEqual(
-			[...observed.departed],
-			[placementKey(ids[1], inbox.mailboxId, 2)],
-		);
-		assert.equal(observed.settled.size, 3);
-	});
-
-	it("asks nothing when no row is contested", async () => {
-		const ids = await rowsIn(inbox, 1);
-
-		const observed = await probe(inbox, ids);
-
-		assert.deepEqual(observed.opened, []);
-	});
-
-	it("frees a row whose source copies every message, without asking it", async () => {
-		const ids = await rowsIn(allMail, 1);
-
-		const observed = await probe(receipts, ids);
-
-		assert.deepEqual(observed.opened, []);
-		assert.deepEqual(
-			[...observed.departed],
-			[placementKey(ids[0], allMail.mailboxId, 1)],
-		);
-	});
-
-	it("leaves a source it cannot reach undecided rather than failing the round", async () => {
-		const ids = await rowsIn(inbox, 1);
-		imap.removeFolder("INBOX");
-
-		const observed = await probe(receipts, ids);
-
-		assert.equal(observed.departed.size, 0);
-		assert.equal(observed.settled.size, 0);
-	});
-
-	it("asks for a save only where the placement changes or is undecided", async () => {
-		const [held, gone] = await rowsIn(inbox, 2);
-		imap.expunge("INBOX", 2);
-
-		const decided = await probe(receipts, [held, gone]);
-		imap.removeFolder("INBOX");
-		const undecided = await probe(receipts, [held]);
-
-		assert.deepEqual([...decided.needsSave], [gone]);
-		assert.deepEqual([...undecided.needsSave], [held]);
-	});
-
-	it("refuses a source folder re-keyed under it", async () => {
-		const ids = await rowsIn(inbox, 1);
-		imap.expunge("INBOX", 1);
-		imap.renumber("INBOX", 99);
-
-		const observed = await probe(receipts, ids);
-
-		assert.equal(observed.departed.size, 0);
-		assert.equal(observed.settled.size, 0);
-	});
-});
-
-describe("sightingContestsPlacement", () => {
-	it("refuses a Gmail virtual folder the server never flagged", () => {
-		assert.equal(
-			sightingContestsPlacement(mailboxAt("[Gmail]/All Mail"), storedIn(INBOX)),
-			false,
-		);
-	});
-
-	it("accepts a folder the user named after a virtual one", () => {
-		assert.equal(
-			sightingContestsPlacement(mailboxAt("Starred ideas"), storedIn(INBOX)),
-			true,
-		);
-	});
-
-	it("accepts an ordinary inbound row the sync path left pending", () => {
-		assert.equal(
-			sightingContestsPlacement(
-				JUNK,
-				storedIn(INBOX, { syncStatus: MessageSyncStatus.pending }),
-			),
-			true,
-		);
-	});
-
-	it("accepts a row a settled mutation marked synced", () => {
-		assert.equal(
-			sightingContestsPlacement(
-				JUNK,
-				storedIn(INBOX, { syncStatus: MessageSyncStatus.synced }),
-			),
-			true,
-		);
-	});
-
-	/**
-	 * The row `abandonDelete` hands back: reader refused the delete, put the
-	 * message back where the server still has it, and nothing else is coming
-	 * for the row. Reader shares its mailboxes, so the user moving that same
-	 * message in another client is ordinary — and before R3 the sighting was
-	 * refused on `syncStatus` alone and the row never followed the move.
-	 */
-	it("accepts a row whose delete was abandoned, so a move made elsewhere still lands", () => {
-		assert.equal(
-			sightingContestsPlacement(
-				JUNK,
-				storedIn(INBOX, {
-					status: MessageStatus.active,
-					syncStatus: MessageSyncStatus.abandoned,
-				}),
-			),
-			true,
-		);
-	});
-
-	it("accepts a row left `failed` by a transient attempt that has since settled", () => {
-		assert.equal(
-			sightingContestsPlacement(
-				JUNK,
-				storedIn(INBOX, { syncStatus: MessageSyncStatus.failed }),
-			),
-			true,
-		);
-	});
-
-	it("refuses a row whose own move is still in flight", () => {
-		assert.equal(
-			sightingContestsPlacement(
-				JUNK,
-				storedIn(INBOX, {
-					status: MessageStatus.moving,
-					syncStatus: MessageSyncStatus.pending,
-				}),
-			),
-			false,
-		);
-	});
-
-	it("refuses a row whose own delete is still in flight", () => {
-		assert.equal(
-			sightingContestsPlacement(
-				JUNK,
-				storedIn(INBOX, {
-					status: MessageStatus.deleting,
-					syncStatus: MessageSyncStatus.pending,
-				}),
-			),
-			false,
-		);
-	});
-});