@remit/mailbox-service 0.0.91 → 0.0.93

package/src/message-sync.ts

@@ -30,7 +30,6 @@ import {
 	MailboxCursorState,
 	MessageKeywordFlag,
 	MessageStatus,
-	MessageSyncStatus,
 	MessageSystemFlag,
 	StarColor,
 } from "@remit/domain-enums";
@@ -149,22 +148,22 @@ export const addressSightingIn = (
  * reconciles rather than waits (imap-mutations R2): it never blocks on a
  * mutation, it re-reads the row on the next sighting after the move settles.
  *
- * In flight is read off `status`, never off `syncStatus` (#1096). Every
+ * In flight is `status`, and `status` alone (#1096, imap-mutations R3). Every
  * outbound mutation writes `moving` or `deleting` and only settling returns the
- * row to `active`, while an ordinary inbound row stays `pending` for its whole
- * life because nothing on the sync path promotes it — so demanding `synced`
- * here meant ordinary mail never re-pointed at all. `failed` is still refused:
- * a mutation that gave up leaves it set on a row put back to `active`, and
- * nothing routine settles that row afterwards.
+ * row to `active`, so `active` is precisely the set nothing is coming for —
+ * whatever `syncStatus` says about how the row got there. A row put back by
+ * `abandonDelete` carries `abandoned`, and it needs this repair more than any
+ * other row does: nothing routine settles it, and reader shares its mailboxes,
+ * so refusing it left a message whose delete was refused unable to follow a
+ * move the user then made in another client.
  */
 export const repointsOnSighting = (
 	mailbox: MailboxItem,
-	message: Pick<MessageItem, "mailboxId" | "status" | "syncStatus">,
+	message: Pick<MessageItem, "mailboxId" | "status">,
 ): boolean => {
 	if (message.mailboxId === mailbox.mailboxId) return false;
 	if (isVirtualCopyMailbox(mailbox)) return false;
-	if (message.status !== MessageStatus.active) return false;
-	return message.syncStatus !== MessageSyncStatus.failed;
+	return message.status === MessageStatus.active;
 };
 
 /**

package/src/placement-move-terminal.test.ts

@@ -1,9 +1,15 @@
 import assert from "node:assert/strict";
 import { describe, it } from "node:test";
 import type {
-	IMessageRepository,
-	IThreadMessageRepository,
+	MessageItem,
+	PlacementPredicate,
+	PlacementTransitionInput,
 } from "@remit/data-ports";
+import {
+	MessageMutation,
+	MessageStatus,
+	MessageSyncStatus,
+} from "@remit/domain-enums";
 import type { PlacementMoveLogger } from "./placement-move.js";
 import {
 	type ResolveExhaustedPlacementMoveDeps,
@@ -16,20 +22,89 @@ interface LogEntry {
 	msg: string;
 }
 
-const buildLogger = (): {
-	log: PlacementMoveLogger;
+interface Transition {
+	messageId: string;
+	expected: PlacementPredicate;
+	next: PlacementTransitionInput;
+}
+
+interface Recorder {
+	deps: ResolveExhaustedPlacementMoveDeps;
 	infos: LogEntry[];
 	errors: LogEntry[];
-} => {
+	markerDeletes: string[];
+	deletedMessages: string[];
+	deletedThreadMessages: Array<{
+		accountConfigId: string;
+		threadMessageId: string;
+	}>;
+	transitions: Transition[];
+	threadUpdates: string[];
+}
+
+const buildRecorder = (
+	threadMessages: Array<{ accountConfigId: string; threadMessageId: string }>,
+	transitionWins = true,
+): Recorder => {
 	const infos: LogEntry[] = [];
 	const errors: LogEntry[] = [];
-	return {
-		log: {
-			info: (obj, msg) => infos.push({ obj, msg }),
-			error: (obj, msg) => errors.push({ obj, msg }),
+	const markerDeletes: string[] = [];
+	const deletedMessages: string[] = [];
+	const deletedThreadMessages: Array<{
+		accountConfigId: string;
+		threadMessageId: string;
+	}> = [];
+	const transitions: Transition[] = [];
+	const threadUpdates: string[] = [];
+
+	const log: PlacementMoveLogger = {
+		info: (obj, msg) => infos.push({ obj, msg }),
+		error: (obj, msg) => errors.push({ obj, msg }),
+	};
+
+	const deps: ResolveExhaustedPlacementMoveDeps = {
+		markerService: {
+			delete: async (id: string) => {
+				markerDeletes.push(id);
+			},
+		},
+		messageService: {
+			delete: async (id: string) => {
+				deletedMessages.push(id);
+			},
+			transitionPlacement: async (
+				messageId: string,
+				expected: PlacementPredicate,
+				next: PlacementTransitionInput,
+			) => {
+				transitions.push({ messageId, expected, next });
+				return transitionWins ? ({ messageId } as MessageItem) : undefined;
+			},
+		},
+		threadMessageService: {
+			findAllByMessageId: async () => threadMessages as never,
+			deleteMany: async (
+				keys: Array<{ accountConfigId: string; threadMessageId: string }>,
+			) => {
+				deletedThreadMessages.push(...keys);
+			},
+			update: async (_accountConfigId: string, threadMessageId: string) => {
+				threadUpdates.push(threadMessageId);
+				return undefined as never;
+			},
 		},
+		log,
+	};
+
+	return {
+		deps,
 		infos,
 		errors,
+		markerDeletes,
+		deletedMessages,
+		deletedThreadMessages,
+		transitions,
+		threadUpdates,
 	};
 };
 
@@ -52,181 +127,171 @@ const buildConnection = (
 
 describe("resolveExhaustedPlacementMoveFailure — the two terminal outcomes (mirrors #1270 for placement moves)", () => {
 	it("RECONCILED (expected): the message is gone from its pending-move source — marker dropped, stale row reconciled, no alarm", async () => {
-		const deletedMessages: string[] = [];
-		const deletedThreadMessages: Array<{
-			accountConfigId: string;
-			threadMessageId: string;
-		}> = [];
-		const markerDeletes: string[] = [];
-		const { log, infos, errors } = buildLogger();
-
-		const deps: ResolveExhaustedPlacementMoveDeps = {
-			markerService: {
-				delete: async (id: string) => {
-					markerDeletes.push(id);
-				},
-			},
-			messageService: {
-				delete: async (id: string) => {
-					deletedMessages.push(id);
-				},
-			} as unknown as Pick<IMessageRepository, "delete">,
-			threadMessageService: {
-				findAllByMessageId: async (
-					accountConfigId: string,
-					messageId: string,
-				) => [{ accountConfigId, threadMessageId: `tm-${messageId}` }],
-				deleteMany: async (
-					keys: Array<{ accountConfigId: string; threadMessageId: string }>,
-				) => {
-					deletedThreadMessages.push(...keys);
-				},
-			} as unknown as Pick<
-				IThreadMessageRepository,
-				"findAllByMessageId" | "deleteMany"
-			>,
-			log,
-		};
+		const rec = buildRecorder([
+			{ accountConfigId: "cfg-1", threadMessageId: "tm-msg-gone" },
+		]);
 
-		const result = await resolveExhaustedPlacementMoveFailure(deps, {
+		const result = await resolveExhaustedPlacementMoveFailure(rec.deps, {
 			accountId: "acc-1",
 			accountConfigId: "cfg-1",
 			messageId: "msg-gone",
 			uid: 101,
+			sourceMailboxId: "mbx-junk",
 			sourceMailboxPath: "Junk",
 			getConnection: async () => buildConnection(new Set()),
 		});
 
 		assert.equal(result.outcome, "reconciled");
-		assert.deepEqual(markerDeletes, ["msg-gone"]);
-		assert.deepEqual(deletedMessages, ["msg-gone"]);
-		assert.deepEqual(deletedThreadMessages, [
+		assert.deepEqual(rec.markerDeletes, ["msg-gone"]);
+		assert.deepEqual(rec.deletedMessages, ["msg-gone"]);
+		assert.deepEqual(rec.deletedThreadMessages, [
 			{ accountConfigId: "cfg-1", threadMessageId: "tm-msg-gone" },
 		]);
-		assert.equal(errors.length, 0, "no alarm for the expected/routine outcome");
+		assert.equal(
+			rec.errors.length,
+			0,
+			"no alarm for the expected/routine outcome",
+		);
 		assert.ok(
-			infos.some((e) => e.obj.metric === "placement_move_stale_row_reconciled"),
+			rec.infos.some(
+				(e) => e.obj.metric === "placement_move_stale_row_reconciled",
+			),
 		);
 	});
 
-	it("BROKEN: the message still exists at the source — marker LEFT PENDING (never dropped), alarm logged, never re-thrown", async () => {
-		const deletedMessages: string[] = [];
-		const markerDeletes: string[] = [];
-		const { log, errors } = buildLogger();
-
-		const deps: ResolveExhaustedPlacementMoveDeps = {
-			markerService: {
-				delete: async (id: string) => {
-					markerDeletes.push(id);
-				},
-			},
-			messageService: {
-				delete: async (id: string) => {
-					deletedMessages.push(id);
-				},
-			} as unknown as Pick<IMessageRepository, "delete">,
-			threadMessageService: {
-				findAllByMessageId: async () => [],
-				deleteMany: async () => {},
-			} as unknown as Pick<
-				IThreadMessageRepository,
-				"findAllByMessageId" | "deleteMany"
-			>,
-			log,
-		};
+	it("BROKEN: the message is still at the source — the row goes back to the source pair rather than being left `moving` forever", async () => {
+		const rec = buildRecorder([
+			{ accountConfigId: "cfg-1", threadMessageId: "tm-msg-broken" },
+		]);
 
-		const result = await resolveExhaustedPlacementMoveFailure(deps, {
+		const result = await resolveExhaustedPlacementMoveFailure(rec.deps, {
 			accountId: "acc-1",
 			accountConfigId: "cfg-1",
 			messageId: "msg-broken",
 			uid: 202,
+			sourceMailboxId: "mbx-inbox",
 			sourceMailboxPath: "INBOX",
 			getConnection: async () => buildConnection(new Set([202])),
 		});
 
 		assert.equal(result.outcome, "broken");
-		// The marker is the lock that stops a resync from correcting the message
-		// back to its server location (rule 3) — dropping it here would remove
-		// that protection while the move is still unresolved.
-		assert.deepEqual(markerDeletes, []);
-		assert.deepEqual(deletedMessages, []);
+		assert.deepEqual(rec.transitions, [
+			{
+				messageId: "msg-broken",
+				expected: {
+					status: [MessageStatus.moving, MessageStatus.deleting],
+				},
+				next: {
+					mailboxId: "mbx-inbox",
+					uid: 202,
+					status: MessageStatus.active,
+					syncStatus: MessageSyncStatus.synced,
+					// Remit's own classification filing, not something the user asked
+					// for, so no per-message give-up marker — the alert is the surface.
+					abandonedMutation: MessageMutation.none,
+				},
+			},
+		]);
+		assert.deepEqual(rec.threadUpdates, ["tm-msg-broken"]);
+		// The marker predicted a move that has now been given up on; leaving it
+		// would keep a folder-count prediction nothing will ever settle.
+		assert.deepEqual(rec.markerDeletes, ["msg-broken"]);
+		assert.deepEqual(rec.deletedMessages, []);
 		assert.ok(
-			errors.some((e) => e.obj.alert === "placement_move_failed"),
-			"expected an alert-shaped log for the broken case",
+			rec.errors.some((e) => e.obj.alert === "placement_move_failed"),
+			"the operator signal is the alert, not a stuck row",
 		);
 	});
 
-	it("a dropped FETCH row is not absence: the message is still at the source — marker and local rows survive", async () => {
-		const deletedMessages: string[] = [];
-		const deletedThreadMessages: unknown[] = [];
-		const markerDeletes: string[] = [];
-		const { log, errors } = buildLogger();
-
-		const deps: ResolveExhaustedPlacementMoveDeps = {
-			markerService: {
-				delete: async (id: string) => {
-					markerDeletes.push(id);
-				},
-			},
-			messageService: {
-				delete: async (id: string) => {
-					deletedMessages.push(id);
-				},
-			} as unknown as Pick<IMessageRepository, "delete">,
-			threadMessageService: {
-				findAllByMessageId: async () => [
-					{ accountConfigId: "cfg-1", threadMessageId: "tm-msg-live" },
-				],
-				deleteMany: async (keys: unknown[]) => {
-					deletedThreadMessages.push(...keys);
-				},
-			} as unknown as Pick<
-				IThreadMessageRepository,
-				"findAllByMessageId" | "deleteMany"
-			>,
-			log,
+	// The marker is the operator's evidence that this move still owed IMAP a
+	// push. Dropping it first meant a restore that threw left the row stuck
+	// `moving` with nothing left to say why.
+	it("BROKEN: a restore that throws leaves the marker standing", async () => {
+		const rec = buildRecorder([
+			{ accountConfigId: "cfg-1", threadMessageId: "tm-msg-broken" },
+		]);
+		rec.deps.messageService.transitionPlacement = async () => {
+			throw new Error("ProvisionedThroughputExceeded");
 		};
 
-		const result = await resolveExhaustedPlacementMoveFailure(deps, {
+		await assert.rejects(
+			() =>
+				resolveExhaustedPlacementMoveFailure(rec.deps, {
+					accountId: "acc-1",
+					accountConfigId: "cfg-1",
+					messageId: "msg-broken",
+					uid: 202,
+					sourceMailboxId: "mbx-inbox",
+					sourceMailboxPath: "INBOX",
+					getConnection: async () => buildConnection(new Set([202])),
+				}),
+			/ProvisionedThroughputExceeded/,
+		);
+
+		assert.deepEqual(
+			rec.markerDeletes,
+			[],
+			"the record of the owed push outlives a failed restore",
+		);
+	});
+
+	it("BROKEN with another lane already settled: the restore loses its predicate and writes nothing", async () => {
+		const rec = buildRecorder(
+			[{ accountConfigId: "cfg-1", threadMessageId: "tm-msg-raced" }],
+			false,
+		);
+
+		const result = await resolveExhaustedPlacementMoveFailure(rec.deps, {
+			accountId: "acc-1",
+			accountConfigId: "cfg-1",
+			messageId: "msg-raced",
+			uid: 404,
+			sourceMailboxId: "mbx-inbox",
+			sourceMailboxPath: "INBOX",
+			getConnection: async () => buildConnection(new Set([404])),
+		});
+
+		assert.equal(result.outcome, "broken");
+		assert.equal(rec.transitions.length, 1);
+		assert.deepEqual(
+			rec.threadUpdates,
+			[],
+			"a lost predicate leaves the listing rows to whoever won",
+		);
+	});
+
+	it("a dropped FETCH row is not absence: the message is still at the source — local rows survive", async () => {
+		const rec = buildRecorder([
+			{ accountConfigId: "cfg-1", threadMessageId: "tm-msg-live" },
+		]);
+
+		const result = await resolveExhaustedPlacementMoveFailure(rec.deps, {
 			accountId: "acc-1",
 			accountConfigId: "cfg-1",
 			messageId: "msg-live",
 			uid: 303,
+			sourceMailboxId: "mbx-inbox",
 			sourceMailboxPath: "INBOX",
 			getConnection: async () =>
 				buildConnection(new Set([303]), new Set([303])),
 		});
 
 		assert.equal(result.outcome, "broken");
-		assert.deepEqual(markerDeletes, []);
-		assert.deepEqual(deletedMessages, []);
-		assert.deepEqual(deletedThreadMessages, []);
-		assert.ok(errors.some((e) => e.obj.alert === "placement_move_failed"));
+		assert.deepEqual(rec.deletedMessages, []);
+		assert.deepEqual(rec.deletedThreadMessages, []);
+		assert.ok(rec.errors.some((e) => e.obj.alert === "placement_move_failed"));
 	});
 
 	it("never throws — both outcomes are terminal, the caller always acks", async () => {
-		const { log } = buildLogger();
-		const deps: ResolveExhaustedPlacementMoveDeps = {
-			markerService: { delete: async () => {} },
-			messageService: {
-				delete: async () => {},
-			} as unknown as Pick<IMessageRepository, "delete">,
-			threadMessageService: {
-				findAllByMessageId: async () => [],
-				deleteMany: async () => {},
-			} as unknown as Pick<
-				IThreadMessageRepository,
-				"findAllByMessageId" | "deleteMany"
-			>,
-			log,
-		};
+		const rec = buildRecorder([]);
 
 		await assert.doesNotReject(() =>
-			resolveExhaustedPlacementMoveFailure(deps, {
+			resolveExhaustedPlacementMoveFailure(rec.deps, {
 				accountId: "acc-1",
 				accountConfigId: "cfg-1",
 				messageId: "msg-x",
 				uid: 1,
+				sourceMailboxId: "mbx-inbox",
 				sourceMailboxPath: "INBOX",
 				getConnection: async () => buildConnection(new Set([1])),
 			}),

package/src/placement-move-terminal.ts

@@ -1,13 +1,21 @@
+import { MessageMutation, MessageSyncStatus } from "@remit/domain-enums";
 import { isMessageGoneFromOpenMailbox } from "./message-presence.js";
 import type { PlacementMoveLogger } from "./placement-move.js";
+import {
+	type RestoreSourcePlacementDeps,
+	restoreSourcePlacement,
+} from "./restore-source-placement.js";
 import {
 	reconcileStaleMessage,
 	type StaleMessageReconcileDeps,
 } from "./stale-message-reconcile.js";
 import type { IImapConnection } from "./types.js";
 
-export interface ResolveExhaustedPlacementMoveDeps
-	extends StaleMessageReconcileDeps {
+export interface ResolveExhaustedPlacementMoveDeps {
+	messageService: StaleMessageReconcileDeps["messageService"] &
+		RestoreSourcePlacementDeps["messageService"];
+	threadMessageService: StaleMessageReconcileDeps["threadMessageService"] &
+		RestoreSourcePlacementDeps["threadMessageService"];
 	markerService: { delete(messageId: string): Promise<void> };
 	log: PlacementMoveLogger;
 }
@@ -17,6 +25,7 @@ export interface ResolveExhaustedPlacementMoveInput {
 	accountConfigId: string;
 	messageId: string;
 	uid: number;
+	sourceMailboxId: string;
 	sourceMailboxPath: string;
 	getConnection: () => Promise<IImapConnection>;
 }
@@ -45,22 +54,26 @@ export interface ResolveExhaustedPlacementMoveResult {
  *    only, no alarm — routine.
  * 2. BROKEN — the message still exists at the source, but the move keeps
  *    failing. This indicates broken code or a broken account (issue #1271),
- *    not a transient blip. The marker is left in place (not cleared) so a
- *    later resync can never "correct" the message back to its server
- *    location out from under an operator's investigation — dropping it here
- *    would remove the very lock rule 3 depends on. Logged with an
- *    `alert`-shaped entry for an operator alarm; never re-thrown (terminal —
- *    the caller acks either way, since retrying a stale or permanently-broken
- *    move can never succeed).
+ *    not a transient blip. The row is put back on the source pair the server
+ *    has just confirmed, exactly as the move and delete resolvers do, and the
+ *    marker goes with it: an auto-file whose push gave up must not leave
+ *    `moving` plus the destination folder plus the source's uid standing
+ *    forever, because that pair refuses every later delete and move with a
+ *    409, blocks the sighting repair, and nothing else clears it. The failure
+ *    is an operator's to read, so it lives in the `alert`-shaped log entry and
+ *    the alarm on it — not in a row the user's own mail is stuck behind.
+ *    Never re-thrown (terminal — the caller acks either way, since retrying a
+ *    stale or permanently-broken move can never succeed).
  *
  * An operator reading `placement_move_failed` should know one case where the
  * message is not actually at the source: a message another client expunged
  * mid-session can answer an empty FETCH while the server still lists its UID
  * in SEARCH, until it is allowed to send the untagged EXPUNGE. That message
- * lands in BROKEN, and BROKEN is terminal — the marker stays pending and the
- * alert stands until someone clears it. The reverse mistake deletes live
- * mail, so the cost is paid deliberately: a stale alert is recoverable, a
- * deleted message is not.
+ * lands in BROKEN, and BROKEN is terminal — the alert stands until someone
+ * clears it, and the row goes back to a source the message may already have
+ * left. The reverse mistake deletes live mail, so the cost is paid
+ * deliberately: a stale alert over a row the next sync re-points is
+ * recoverable, a deleted message is not.
  */
 export const resolveExhaustedPlacementMoveFailure = async (
 	deps: ResolveExhaustedPlacementMoveDeps,
@@ -71,6 +84,7 @@ export const resolveExhaustedPlacementMoveFailure = async (
 		accountConfigId,
 		messageId,
 		uid,
+		sourceMailboxId,
 		sourceMailboxPath,
 		getConnection,
 	} = input;
@@ -100,6 +114,24 @@ export const resolveExhaustedPlacementMoveFailure = async (
 		return { outcome: "reconciled" };
 	}
 
+	// The row first, the marker second. The marker is the operator's evidence
+	// that this move still owed IMAP a push; dropping it before the restore
+	// means a restore that throws leaves the row stuck `moving` with nothing
+	// left to say why.
+	await restoreSourcePlacement(deps, {
+		accountConfigId,
+		messageId,
+		sourceMailboxId,
+		uid,
+		// No give-up marker: this move is Remit's own classification filing, not
+		// something the user asked for, so a per-message "your move failed" would
+		// report a failure against an intent nobody formed. The alert below is the
+		// whole surface, and it is an operator's.
+		syncStatus: MessageSyncStatus.synced,
+		abandonedMutation: MessageMutation.none,
+	});
+	await deps.markerService.delete(messageId);
+
 	deps.log.error(
 		{
 			alert: "placement_move_failed",
@@ -107,9 +139,10 @@ export const resolveExhaustedPlacementMoveFailure = async (
 			accountConfigId,
 			messageId,
 			uid,
+			sourceMailboxId,
 			sourceMailboxPath,
 		},
-		"Placement move could not be pushed to IMAP after retry exhaustion; message still exists at its source — marker left pending for operator investigation",
+		"Placement move could not be pushed to IMAP after retry exhaustion; message still exists at its source — row restored to the source pair, marker dropped, alert left for operator investigation",
 	);
 	return { outcome: "broken" };
 };

package/src/placement-move-unsettled.test.ts

@@ -16,8 +16,9 @@ import type {
 	IThreadMessageRepository,
 	MessageItem,
 	MessagePlacementMoveItem,
+	PlacementPredicate,
+	PlacementTransitionInput,
 	PutMessagePlacementMoveInput,
-	UpdateMessageMoveInput,
 } from "@remit/data-ports";
 import { PlacementMoveService } from "./placement-move.js";
 import { noFolderRoles } from "./test-helpers/folder-roles.js";
@@ -60,11 +61,24 @@ const buildHarness = (): Harness => {
 
 	const messageService = {
 		get: async () => row,
-		updateForMove: async (
+		transitionPlacement: async (
 			_messageId: string,
-			input: UpdateMessageMoveInput,
+			expected: PlacementPredicate,
+			next: PlacementTransitionInput,
 		) => {
-			Object.assign(row, input);
+			if (expected.status !== undefined && expected.status !== row.status) {
+				return undefined;
+			}
+			if (expected.uid !== undefined && expected.uid !== row.uid) {
+				return undefined;
+			}
+			if (
+				expected.mailboxId !== undefined &&
+				expected.mailboxId !== row.mailboxId
+			) {
+				return undefined;
+			}
+			Object.assign(row, next);
 			return row;
 		},
 	} as unknown as IMessageRepository;