@remit/mailbox-service 0.0.72 → 0.0.73

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/mailbox-service",
-  "version": "0.0.72",
+  "version": "0.0.73",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",

package/src/message-delete-no-trash.test.ts

@@ -13,6 +13,7 @@ import {
 	MessageMoveService,
 	NoTrashMailboxError,
 	StaleTrashAppointmentError,
+	UnconfirmedTrashMailboxError,
 } from "./message-move.js";
 
 const ACCOUNT = "acc-1";
@@ -200,14 +201,34 @@ describe("delete only expunges when it was asked to", () => {
 		);
 	});
 
-	it("expunges a message already inside a Trash that resolves by name", async () => {
-		// D4a: the rows were selected and the dialog named the consequence, so
-		// consent is per message. Empty Trash has no such consent and refuses.
-		const { service, events } = buildWorld(
+	it("refuses to expunge a message already inside a Trash that only resolves by name", async () => {
+		// #876: a message already sitting in the guessed folder used to fall
+		// straight through to an expunge, on the same name guess Empty Trash
+		// refuses to act on. Deleting it is exactly as unrecoverable, so it
+		// demands the same confirmed evidence — nobody, neither the user nor the
+		// server, ever said this folder is Trash.
+		const { service, patches, events, message } = buildWorld(
 			{ kind: "proposed", mailbox: { mailboxId: TRASH, fullPath: "Trash" } },
 			TRASH,
 		);
 
+		await assert.rejects(
+			() => service.deleteMessages(ACCOUNT_CONFIG, [MESSAGE_ID], ACCOUNT),
+			(error: unknown) =>
+				error instanceof UnconfirmedTrashMailboxError &&
+				error.statusCode === 409 &&
+				error.publicApiError?.details?.reason === "unconfirmed" &&
+				error.publicApiError?.details?.accountId === ACCOUNT,
+		);
+
+		assert.deepEqual(events, []);
+		assert.deepEqual(patches, []);
+		assert.equal(message.mailboxId, TRASH);
+	});
+
+	it("expunges a message already inside a confirmed Trash", async () => {
+		const { service, events } = buildWorld(flaggedTrash, TRASH);
+
 		await service.deleteMessages(ACCOUNT_CONFIG, [MESSAGE_ID], ACCOUNT);
 
 		assert.deepEqual(

package/src/message-move.ts

@@ -162,7 +162,8 @@ export class StaleTrashAppointmentError extends FolderRoleUnresolvedError {
 
 /**
  * A folder resolves as Trash by its name alone. Enough to move mail into,
- * never enough to expunge — so only the Empty Trash path raises it.
+ * never enough to expunge — raised by Empty Trash and by a delete that would
+ * expunge a message already sitting in that folder.
  */
 export class UnconfirmedTrashMailboxError extends FolderRoleUnresolvedError {
 	name = "UnconfirmedTrashMailboxError";
@@ -307,12 +308,13 @@ export class MessageMoveService {
 		const wantsPermanentDelete =
 			options.permanent === true || options.toTrash === false;
 
-		const trashGate = wantsPermanentDelete
+		const trashResolution = wantsPermanentDelete
 			? null
-			: trashMailboxAt(
-					await this.mailboxSpecialUseService.resolveTrashRole(accountId),
-					"resolved",
-				);
+			: await this.mailboxSpecialUseService.resolveTrashRole(accountId);
+
+		const trashGate = trashResolution
+			? trashMailboxAt(trashResolution, "resolved")
+			: null;
 
 		if (trashGate && !trashGate.allowed) {
 			this.log.error(
@@ -324,6 +326,34 @@ export class MessageMoveService {
 
 		const trashMailbox = trashGate ? trashGate.mailbox : null;
 
+		// A message already sitting in the folder resolved as Trash deletes by
+		// expunging it, not by moving it — the same unrecoverable act Empty
+		// Trash performs, so it demands the same confirmed evidence. The name
+		// guess ("resolved") is enough to file mail into; it is never enough to
+		// destroy mail that is already there. Checked once, before any local
+		// write, so a batch that touches such a message is refused whole rather
+		// than partially expunged.
+		if (!wantsPermanentDelete && trashResolution && trashMailbox) {
+			const deletesInPlace = messages.some(
+				(message) => message.mailboxId === trashMailbox.mailboxId,
+			);
+
+			if (deletesInPlace) {
+				const confirmedTrashGate = trashMailboxAt(trashResolution, "confirmed");
+				if (!confirmedTrashGate.allowed) {
+					this.log.error(
+						{
+							accountId,
+							messageCount: messages.length,
+							reason: confirmedTrashGate.reason,
+						},
+						"Refused to delete: this account's Trash is not confirmed",
+					);
+					throw trashRefusal(confirmedTrashGate.reason, accountId);
+				}
+			}
+		}
+
 		// Group messages by operation type
 		const moveToTrashMessages: Array<{
 			messageId: string;