@remit/mailbox-service 0.0.84 → 0.0.85

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/mailbox-service",
-  "version": "0.0.84",
+  "version": "0.0.85",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",
@@ -13,6 +13,10 @@
       "types": "./src/body-sync-queue.ts",
       "default": "./src/body-sync-queue.ts"
     },
+    "./imapflow-connection": {
+      "types": "./src/imapflow-connection.ts",
+      "default": "./src/imapflow-connection.ts"
+    },
     "./account-credentials": {
       "types": "./src/account-credentials.ts",
       "default": "./src/account-credentials.ts"

package/src/imapflow-connect-retry.test.ts

@@ -105,4 +105,30 @@ describe("ImapFlowConnection.connect() retry policy", () => {
 		assert.equal(attempt.mock.callCount(), 1);
 		assert.equal(sleep.mock.callCount(), 0);
 	});
+
+	it("carries the server's own refusal, which is not always a re-auth", async () => {
+		const connection = new ImapFlowConnection(baseConfig);
+		const priv = connection as unknown as WithPrivates;
+
+		// imapflow's shape for a tagged NO: the message is its own, the server's
+		// words are on `responseText`. Signing in again fixes nothing here — the
+		// tenant has IMAP switched off — so the text has to reach the user.
+		mock.method(priv, "attemptConnect", async () => {
+			throw Object.assign(new Error("Command failed"), {
+				authenticationFailed: true,
+				responseText:
+					"LOGIN failed. User is authenticated but not connected. SmtpClientAuthentication is disabled for the Tenant.",
+			});
+		});
+
+		await assert.rejects(
+			() => connection.connect(),
+			(error: unknown) => {
+				assert.ok(error instanceof MailConnectionError);
+				assert.equal(error.kind, "auth");
+				assert.match(error.message, /SmtpClientAuthentication is disabled/);
+				return true;
+			},
+		);
+	});
 });

package/src/imapflow-connection.ts

@@ -1391,6 +1391,20 @@ const buildImapAuth = (
 	throw new Error(`Unknown credential kind: ${JSON.stringify(_exhaustive)}`);
 };
 
+/**
+ * The server's own words for the failure: the text of the tagged NO/BAD, which
+ * imapflow hangs off the error as `responseText`. It is the server's side of
+ * the exchange only — never the command we sent, so no credential can ride out
+ * on it. "SmtpClientAuthentication is disabled" and "User is authenticated but
+ * not connected" arrive this way, and neither is fixed by re-authenticating, so
+ * dropping the text leaves the account card telling the user to do the one
+ * thing that cannot help.
+ */
+const serverResponseText = (error: Error): string => {
+	const text = (error as { responseText?: unknown }).responseText;
+	return typeof text === "string" ? text.trim() : "";
+};
+
 /**
  * Classify a raw IMAP error into a MailConnectionError, or return null if
  * the error is not recognisable (let it bubble as-is).
@@ -1416,7 +1430,13 @@ const classifyImapError = (
 		msg.includes("AUTHENTICATE") ||
 		(error as { authenticationFailed?: boolean }).authenticationFailed === true
 	) {
-		return new MailConnectionError("auth", "IMAP authentication failed");
+		const serverText = serverResponseText(error);
+		return new MailConnectionError(
+			"auth",
+			serverText
+				? `IMAP authentication failed: ${serverText}`
+				: "IMAP authentication failed",
+		);
 	}
 
 	// Network-level failures — NEVER include the original message as it may