@remit/mailbox-service 0.0.39 → 0.0.41

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/mailbox-service",
-  "version": "0.0.39",
+  "version": "0.0.41",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",

package/src/body-sync-placement-flags.test.ts

@@ -69,7 +69,7 @@ const MAILBOXES = {
 };
 
 const buildHarness = (
-	message: { messageId: string; mailboxId: string },
+	message: { messageId: string; mailboxId: string; movedByRemit?: boolean },
 	flags: AddressItem["flags"],
 ): Harness => {
 	const moves: MoveCall[] = [];
@@ -79,11 +79,7 @@ const buildHarness = (
 	}> = [];
 
 	const messageService = {
-		get: async () => ({
-			messageId: message.messageId,
-			mailboxId: message.mailboxId,
-			uid: 1,
-		}),
+		get: async () => ({ ...message, uid: 1 }),
 		update: async (messageId: string, input: UpdateMessageInput) => {
 			messageUpdates.push({ messageId, input });
 		},
@@ -300,3 +296,56 @@ describe("Address.flags.autoArchive drives placement (issue #300)", () => {
 		]);
 	});
 });
+
+/**
+ * Issue #398: not every `leave` verdict means "nothing confident to say".
+ * `already-moved-by-remit` is the guard against re-deciding a settled
+ * placement, and mail sitting in Junk gets a `leave` because the demote branch
+ * only fires outside Junk. Auto-archive is a filing preference relative to the
+ * Inbox and must yield to both, so these drive `BodySyncService` end-to-end and
+ * assert on the absence of a move.
+ */
+describe("autoArchive respects a leave verdict that decided something (issue #398)", () => {
+	it("leaves a blocked autoArchive sender's message in Junk", async () => {
+		const harness = buildHarness(
+			{ messageId: "m-1", mailboxId: MAILBOXES.junk.mailboxId },
+			{
+				blocked: { value: true, setAt: 1_000 },
+				autoArchive: { value: true, setAt: 1_000 },
+			},
+		);
+
+		await readBody(harness.service, "Junk");
+
+		assert.deepEqual(harness.moves, []);
+	});
+
+	it("leaves an autoArchive sender's provider-junked message in Junk", async () => {
+		const harness = buildHarness(
+			{ messageId: "m-1", mailboxId: MAILBOXES.junk.mailboxId },
+			{ autoArchive: { value: true, setAt: 1_000 } },
+		);
+
+		// Provider-spam + dmarc-pass from an untrusted sender is an unsure
+		// `leave`: too weak to rescue, and auto-archive is not a second chance
+		// at leaving Junk.
+		await readBody(harness.service, "Junk", SPAM_FLAGGED_DMARC_PASS_EML);
+
+		assert.deepEqual(harness.moves, []);
+	});
+
+	it("leaves a message Remit already placed alone on a re-entrant pass", async () => {
+		const harness = buildHarness(
+			{
+				messageId: "m-1",
+				mailboxId: MAILBOXES.inbox.mailboxId,
+				movedByRemit: true,
+			},
+			{ autoArchive: { value: true, setAt: 1_000 } },
+		);
+
+		await readBody(harness.service);
+
+		assert.deepEqual(harness.moves, []);
+	});
+});

package/src/body-sync.ts

@@ -48,6 +48,7 @@ import {
 import {
 	classifyPlacement,
 	type FolderPlacement,
+	type PlacementVerdict,
 	resolveBlockedVsTrust,
 } from "./heuristics/classifyPlacement.js";
 import type { PlacementMoveService } from "./placement-move.js";
@@ -199,6 +200,26 @@ const hasDecidedCategory = (
 const hasDecidedPlacement = (placementDecidedAt: number | undefined): boolean =>
 	placementDecidedAt !== undefined;
 
+/**
+ * Issue #398: `flags.autoArchive` is a filing preference relative to the Inbox.
+ * A `leave` verdict reaches it for two unrelated reasons and only one of them
+ * means "nothing confident to say":
+ *
+ * - `already-moved-by-remit` is {@link classifyPlacement}'s guard against
+ *   re-deciding a settled placement, and auto-archive is a re-decision. The
+ *   re-entrant paths `hasDecidedPlacement` names reach it on messages Remit
+ *   itself placed, or that a user moved back afterwards.
+ * - A message already in Junk gets an unsure `leave` whatever the sender's
+ *   `blocked` flag says, since the demote branch only fires outside Junk.
+ *   Moving mail out of Junk is a rescue, which this file reserves for a
+ *   confident signal plus sender trust.
+ */
+const autoArchiveApplies = (
+	verdict: PlacementVerdict,
+	placement: FolderPlacement,
+): boolean =>
+	placement !== "junk" && !verdict.reasons.includes("already-moved-by-remit");
+
 export const toParsedBody = (parsed: ParsedMail): ParsedBody => ({
 	text: parsed.text ?? null,
 	html: typeof parsed.html === "string" ? parsed.html : null,
@@ -1459,12 +1480,14 @@ export class BodySyncService {
 		// junk/inbox verdict computed above. Still marked decided (issue #383):
 		// "leave" is itself a verdict, not "not yet evaluated".
 		if (verdict.action === "leave") {
-			const outcome = await this.resolveAutoArchive(
-				mailboxSpecialUseService,
-				message,
-				accountId,
-				signals.autoArchive,
-			);
+			const outcome = autoArchiveApplies(verdict, placement)
+				? await this.resolveAutoArchive(
+						mailboxSpecialUseService,
+						message,
+						accountId,
+						signals.autoArchive,
+					)
+				: {};
 			return { ...outcome, placementDecidedAt: Date.now() };
 		}
 
@@ -1526,7 +1549,8 @@ export class BodySyncService {
 	 * straight to Archive, skipping Inbox. Only reached from
 	 * {@link computePlacement} when {@link classifyPlacement} had no confident
 	 * junk/inbox verdict of its own — `blocked`/DKIM/DMARC always take priority
-	 * over this filing preference.
+	 * over this filing preference — and only for the `leave` verdicts
+	 * {@link autoArchiveApplies} admits.
 	 *
 	 * No {@link MessagePlacementVerdict} is recorded: `PlacementAction` (the
 	 * audit enum) has only `MoveToInbox`/`MoveToJunk` — issue #300 is scoped to

package/src/mailbox-management.test.ts

@@ -99,7 +99,7 @@ const boxStatus = (path: string): ImapBoxStatus => ({
 const recordingRepo = () => {
 	const updates: Array<{ mailboxId: string; patch: Record<string, unknown> }> =
 		[];
-	const repo = {
+	const repo: Pick<IMailboxRepository, "update" | "findByPathPrefix"> = {
 		update: async (
 			_accountId: string,
 			mailboxId: string,
@@ -108,8 +108,9 @@ const recordingRepo = () => {
 			updates.push({ mailboxId, patch });
 			return {} as never;
 		},
-	} as unknown as IMailboxRepository;
-	return { repo, updates };
+		findByPathPrefix: async () => [],
+	};
+	return { repo: repo as IMailboxRepository, updates };
 };
 
 const stubConnection = (

package/src/mailbox-management.ts

@@ -1,5 +1,6 @@
 import type { IMailboxRepository } from "@remit/data-ports";
 import { MailboxSyncStatus } from "@remit/domain-enums";
+import { isNotFoundError } from "./mailbox-presence.js";
 import type { IImapConnection } from "./types.js";
 
 /**
@@ -220,9 +221,66 @@ export class MailboxManagementService {
 			syncStatus: MailboxSyncStatus.synced,
 		});
 
+		// The server rename is done and the row records it. The settle is repair
+		// work on top of that, so nothing it hits — the listing included — may reach
+		// the caller's failure path, which rolls the row back to a path the server
+		// no longer has and hands it to the reconcile sweep to reap.
+		await this.settleRenamedSubtree(accountId, newPath, connection).catch(
+			(error: unknown) => {
+				this.log.error(
+					{ mailboxId, newPath, error },
+					"Renamed subtree left pending",
+				);
+			},
+		);
+
 		return { success: true };
 	};
 
+	/**
+	 * IMAP RENAME moves the whole subtree in one command, so the descendants the
+	 * local rename marked pending are on the server the moment the parent's is.
+	 * Nothing else settles them: the reconcile sweep treats pending as in-flight
+	 * and leaves it alone, and a descendant left pending is read as off-server, so
+	 * its sync events are terminally acked and its mail never arrives.
+	 *
+	 * A descendant is settled only where the server's own listing holds its path.
+	 * A local path the server has not materialized is still in flight behind
+	 * another queued operation, and stripping its pending marker would expose the
+	 * row to the reconcile sweep.
+	 */
+	private settleRenamedSubtree = async (
+		accountId: string,
+		newPath: string,
+		connection: IImapConnection,
+	): Promise<void> => {
+		const listed = await connection.listMailboxes();
+		const onServer = new Set(listed.map((mailbox) => mailbox.fullPath));
+		const delimiter =
+			listed.find((mailbox) => mailbox.fullPath === newPath)?.delimiter ??
+			listed[0]?.delimiter ??
+			"/";
+
+		const descendants = await this.mailboxService.findByPathPrefix(
+			accountId,
+			newPath,
+			delimiter,
+		);
+
+		for (const descendant of descendants) {
+			if (descendant.syncStatus !== MailboxSyncStatus.pending) continue;
+			if (!onServer.has(descendant.fullPath)) continue;
+			await this.mailboxService
+				.update(accountId, descendant.mailboxId, {
+					syncStatus: MailboxSyncStatus.synced,
+				})
+				.catch((error: unknown) => {
+					if (isNotFoundError(error)) return;
+					throw error;
+				});
+		}
+	};
+
 	/**
 	 * Sync a DELETE operation to IMAP.
 	 * Called by worker after dequeuing MAILBOX_DELETE event.

package/src/mailbox-presence.ts

@@ -1,7 +1,7 @@
 import type { IMailboxRepository, MailboxItem } from "@remit/data-ports";
 import { MailboxSyncStatus } from "@remit/domain-enums";
 
-const isNotFoundError = (error: unknown): boolean =>
+export const isNotFoundError = (error: unknown): boolean =>
 	error instanceof Error && error.name === "NotFoundError";
 
 /**

package/src/mailbox-rename-subtree.test.ts

@@ -0,0 +1,225 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import type { IMailboxRepository, MailboxItem } from "@remit/data-ports";
+import { MailboxSyncStatus } from "@remit/domain-enums";
+import { MailboxManagementService } from "./mailbox-management.js";
+import type { FlatMailboxInfo, IImapConnection } from "./types.js";
+
+const row = (
+	mailboxId: string,
+	fullPath: string,
+	syncStatus: MailboxItem["syncStatus"],
+): MailboxItem =>
+	({
+		mailboxId,
+		accountId: "acc-1",
+		fullPath,
+		hierarchyDelimiter: "/",
+		syncStatus,
+	}) as MailboxItem;
+
+const store = (rows: MailboxItem[], vanishAfterSweep: string[] = []) => {
+	const byId = new Map(rows.map((r) => [r.mailboxId, { ...r }]));
+
+	const repo: Pick<IMailboxRepository, "update" | "findByPathPrefix"> = {
+		update: async (_accountId, mailboxId, patch) => {
+			const existing = byId.get(mailboxId);
+			if (!existing) {
+				throw Object.assign(new Error(`Mailbox not found: ${mailboxId}`), {
+					name: "NotFoundError",
+				});
+			}
+			const next = { ...existing, ...patch } as MailboxItem;
+			byId.set(mailboxId, next);
+			return next;
+		},
+		findByPathPrefix: async (_accountId, pathPrefix, delimiter = "/") => {
+			const prefix = `${pathPrefix}${delimiter}`;
+			const found = [...byId.values()].filter((r) =>
+				r.fullPath.startsWith(prefix),
+			);
+			for (const mailboxId of vanishAfterSweep) byId.delete(mailboxId);
+			return found;
+		},
+	};
+
+	return {
+		repo: repo as IMailboxRepository,
+		statusOf: (mailboxId: string) => byId.get(mailboxId)?.syncStatus,
+	};
+};
+
+const connectionListing = (paths: string[]): IImapConnection =>
+	({
+		renameMailbox: async () => undefined,
+		listMailboxes: async (): Promise<FlatMailboxInfo[]> =>
+			paths.map((fullPath) => ({
+				fullPath,
+				name: fullPath.split("/").pop() ?? fullPath,
+				delimiter: "/",
+				attributes: [],
+				parentPath: null,
+			})),
+	}) as unknown as IImapConnection;
+
+const connectionWithoutListing = (): IImapConnection =>
+	({
+		renameMailbox: async () => undefined,
+		listMailboxes: async () => {
+			throw new Error("IMAP connection lost");
+		},
+	}) as unknown as IImapConnection;
+
+/**
+ * The local rename writes the new path across the whole subtree and marks every
+ * row pending, so a reconcile in that window cannot reap them (#290). These
+ * fixtures are that state at the moment the worker picks the event up: the
+ * parent and its descendants already carry their new paths.
+ */
+describe("MailboxManagementService.syncRename — subtree settle", () => {
+	it("settles every descendant the rename carried, not just the renamed row", async () => {
+		const { repo, statusOf } = store([
+			row("mbx-parent", "Projects", MailboxSyncStatus.pending),
+			row("mbx-child", "Projects/2026", MailboxSyncStatus.pending),
+			row("mbx-grandchild", "Projects/2026/Q1", MailboxSyncStatus.pending),
+		]);
+		const service = new MailboxManagementService(repo);
+
+		const result = await service.syncRename(
+			"acc-1",
+			"mbx-parent",
+			"Work",
+			"Projects",
+			async () =>
+				connectionListing(["Projects", "Projects/2026", "Projects/2026/Q1"]),
+		);
+
+		assert.equal(result.success, true);
+		assert.equal(statusOf("mbx-parent"), MailboxSyncStatus.synced);
+		assert.equal(statusOf("mbx-child"), MailboxSyncStatus.synced);
+		assert.equal(statusOf("mbx-grandchild"), MailboxSyncStatus.synced);
+	});
+
+	it("leaves a descendant behind a rename of its own pending", async () => {
+		// Two renames in one per-account FIFO group: `Projects` → `Work` moves the
+		// child row to `Work/2026`, then `Work/2026` → `Work/Archive` moves it
+		// again before the first RENAME is worked. When the first one lands the
+		// server holds `Work/2026`; `Work/Archive` exists only locally, and
+		// stripping its pending marker would let the reconcile sweep reap the row
+		// and rebuild it under a fresh mailboxId, dangling every filter bound to
+		// the old one.
+		const { repo, statusOf } = store([
+			row("mbx-parent", "Work", MailboxSyncStatus.pending),
+			row("mbx-child", "Work/Archive", MailboxSyncStatus.pending),
+		]);
+		const service = new MailboxManagementService(repo);
+
+		await service.syncRename(
+			"acc-1",
+			"mbx-parent",
+			"Projects",
+			"Work",
+			async () => connectionListing(["Work", "Work/2026"]),
+		);
+
+		assert.equal(statusOf("mbx-parent"), MailboxSyncStatus.synced);
+		assert.equal(statusOf("mbx-child"), MailboxSyncStatus.pending);
+	});
+
+	it("leaves a descendant the user has asked to delete on its way out", async () => {
+		// A delete requested after the local rename wrote the subtree pending: the
+		// folder is still on the server, and settling it would undo the request.
+		const { repo, statusOf } = store([
+			row("mbx-parent", "Projects", MailboxSyncStatus.pending),
+			row("mbx-deleting", "Projects/Old", MailboxSyncStatus.deleting),
+			row("mbx-child", "Projects/2026", MailboxSyncStatus.pending),
+		]);
+		const service = new MailboxManagementService(repo);
+
+		await service.syncRename(
+			"acc-1",
+			"mbx-parent",
+			"Work",
+			"Projects",
+			async () =>
+				connectionListing(["Projects", "Projects/Old", "Projects/2026"]),
+		);
+
+		assert.equal(statusOf("mbx-deleting"), MailboxSyncStatus.deleting);
+		assert.equal(statusOf("mbx-child"), MailboxSyncStatus.synced);
+	});
+
+	it("settles inside the renamed subtree without reaching a lookalike sibling", async () => {
+		const { repo, statusOf } = store([
+			row("mbx-parent", "Projects", MailboxSyncStatus.pending),
+			row("mbx-child", "Projects/2026", MailboxSyncStatus.pending),
+			row("mbx-lookalike", "Projectsy/2026", MailboxSyncStatus.pending),
+		]);
+		const service = new MailboxManagementService(repo);
+
+		await service.syncRename(
+			"acc-1",
+			"mbx-parent",
+			"Work",
+			"Projects",
+			async () =>
+				connectionListing(["Projects", "Projects/2026", "Projectsy/2026"]),
+		);
+
+		assert.equal(statusOf("mbx-child"), MailboxSyncStatus.synced);
+		assert.equal(statusOf("mbx-lookalike"), MailboxSyncStatus.pending);
+	});
+
+	it("reports the rename as done when a descendant row vanishes mid-settle", async () => {
+		// The settle is repair work, not the mutation. A descendant deleted while
+		// it runs has nothing left to settle, and must not roll a completed server
+		// rename back to failed — the handler's catch treats any throw from here
+		// as an IMAP failure and restores the old path.
+		const { repo, statusOf } = store(
+			[
+				row("mbx-parent", "Projects", MailboxSyncStatus.pending),
+				row("mbx-gone", "Projects/Gone", MailboxSyncStatus.pending),
+				row("mbx-child", "Projects/2026", MailboxSyncStatus.pending),
+			],
+			["mbx-gone"],
+		);
+		const service = new MailboxManagementService(repo);
+
+		const result = await service.syncRename(
+			"acc-1",
+			"mbx-parent",
+			"Work",
+			"Projects",
+			async () =>
+				connectionListing(["Projects", "Projects/Gone", "Projects/2026"]),
+		);
+
+		assert.equal(result.success, true);
+		assert.equal(statusOf("mbx-child"), MailboxSyncStatus.synced);
+	});
+
+	it("reports the rename as done when the listing it settles against fails", async () => {
+		// The listing runs after the server rename has landed. Letting it fail the
+		// rename would send the caller down its IMAP-failure path, restoring a path
+		// the server no longer has and marking the row failed — which drops the
+		// pending marker that keeps the reconcile sweep from reaping it. A
+		// descendant left pending is the safe outcome.
+		const { repo, statusOf } = store([
+			row("mbx-parent", "Projects", MailboxSyncStatus.pending),
+			row("mbx-child", "Projects/2026", MailboxSyncStatus.pending),
+		]);
+		const service = new MailboxManagementService(repo);
+
+		const result = await service.syncRename(
+			"acc-1",
+			"mbx-parent",
+			"Work",
+			"Projects",
+			async () => connectionWithoutListing(),
+		);
+
+		assert.equal(result.success, true);
+		assert.equal(statusOf("mbx-parent"), MailboxSyncStatus.synced);
+		assert.equal(statusOf("mbx-child"), MailboxSyncStatus.pending);
+	});
+});