@zaclinley/dsh-mailharbor 0.14.0 → 0.15.0

package/lib/index.js

@@ -712,7 +712,12 @@ var DEFAULTS = {
   render: { listLimit: 40 },
   projects: { root: join2(homedir2(), "work", "projects") },
   oauth: {
-    google: { clientId: "", redirectPort: 8765, scopes: ["https://mail.google.com/"] },
+    google: {
+      clientId: "",
+      clientSecret: "",
+      redirectPort: 8765,
+      scopes: ["https://mail.google.com/"]
+    },
     microsoft: {
       clientId: "",
       scopes: [
@@ -856,6 +861,7 @@ function loadConfig() {
     oauth: {
       google: {
         clientId: stringOr(googleRaw.clientId, DEFAULTS.oauth.google.clientId),
+        clientSecret: stringOr(googleRaw.clientSecret, DEFAULTS.oauth.google.clientSecret),
         redirectPort: intOr(googleRaw.redirectPort, DEFAULTS.oauth.google.redirectPort, 1024, 65535),
         scopes: Array.isArray(googleRaw.scopes) ? googleRaw.scopes.filter((item) => typeof item === "string") : DEFAULTS.oauth.google.scopes
       },
@@ -901,7 +907,7 @@ function buildAccount(input, existing) {
       username: input.username,
       imap: input.imap,
       smtp: input.smtp,
-      auth: { type: "password" },
+      auth: input.auth ?? { type: "password" },
       caldav: null,
       enabled: true,
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -1012,6 +1018,26 @@ async function openPath(path) {
   }
   await run("xdg-open", [path]);
 }
+async function openExternal(url) {
+  try {
+    const require2 = createRequire(import.meta.url);
+    const electron = require2("electron");
+    if (electron.shell !== void 0) {
+      await electron.shell.openExternal(url);
+      return;
+    }
+  } catch {
+  }
+  if (process.platform === "darwin") {
+    await run("open", [url]);
+    return;
+  }
+  if (process.platform === "win32") {
+    await run("cmd", ["/c", "start", "", url]);
+    return;
+  }
+  await run("xdg-open", [url]);
+}
 
 // src/host/api.ts
 import { existsSync as existsSync6, rmSync } from "node:fs";
@@ -1052,6 +1078,134 @@ async function draftMime(account, draft) {
   return Buffer.from(info.message);
 }
 
+// src/host/api.ts
+import { createHash as createHash3, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+
+// src/host/oauth.ts
+var TOKEN_ENDPOINTS = {
+  google: "https://oauth2.googleapis.com/token",
+  microsoft: "https://login.microsoftonline.com/common/oauth2/v2.0/token"
+};
+var DEVICE_ENDPOINTS = {
+  google: "https://oauth2.googleapis.com/device/code",
+  microsoft: "https://login.microsoftonline.com/common/oauth2/v2.0/devicecode"
+};
+function form(values) {
+  return new URLSearchParams(values).toString();
+}
+function tokensFrom(payload, previousRefresh = "") {
+  const accessToken = typeof payload.access_token === "string" ? payload.access_token : "";
+  if (accessToken === "") throw new Error("OAuth \u54CD\u5E94\u7F3A\u5C11 access_token");
+  const refreshToken = typeof payload.refresh_token === "string" && payload.refresh_token !== "" ? payload.refresh_token : previousRefresh;
+  const expiresIn = Number(payload.expires_in ?? 3600);
+  return {
+    accessToken,
+    refreshToken,
+    expiresAt: Date.now() + Math.max(60, expiresIn) * 1e3,
+    ...typeof payload.scope === "string" ? { scope: payload.scope } : {},
+    ...typeof payload.token_type === "string" ? { tokenType: payload.token_type } : {}
+  };
+}
+async function refreshTokens(app, refreshToken) {
+  if (refreshToken === "") throw new Error("OAuth \u5237\u65B0\u4EE4\u724C\u4E3A\u7A7A");
+  const body = {
+    grant_type: "refresh_token",
+    client_id: app.clientId,
+    refresh_token: refreshToken
+  };
+  if (app.provider === "google") body.client_secret = app.clientSecret;
+  const response = await fetch(TOKEN_ENDPOINTS[app.provider], {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: form(body)
+  });
+  const payload = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    const reason = typeof payload.error_description === "string" ? payload.error_description : typeof payload.error === "string" ? payload.error : `HTTP ${String(response.status)}`;
+    throw new Error(`OAuth \u5237\u65B0\u5931\u8D25\uFF1A${reason}`);
+  }
+  return tokensFrom(payload, refreshToken);
+}
+function googleAuthUrl(app, state, challenge, redirectUri) {
+  const params = new URLSearchParams({
+    client_id: app.clientId,
+    redirect_uri: redirectUri,
+    response_type: "code",
+    scope: app.scopes.join(" "),
+    access_type: "offline",
+    prompt: "consent",
+    state,
+    code_challenge: challenge,
+    code_challenge_method: "S256"
+  });
+  return `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
+}
+async function exchangeGoogleCode(app, code, verifier, redirectUri) {
+  const response = await fetch(TOKEN_ENDPOINTS.google, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: form({
+      code,
+      client_id: app.clientId,
+      client_secret: app.clientSecret,
+      redirect_uri: redirectUri,
+      grant_type: "authorization_code",
+      code_verifier: verifier
+    })
+  });
+  const payload = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    throw new Error(
+      `OAuth \u6388\u6743\u5931\u8D25\uFF1A${typeof payload.error_description === "string" ? payload.error_description : `HTTP ${String(response.status)}`}`
+    );
+  }
+  return tokensFrom(payload);
+}
+async function startDeviceFlow(app) {
+  const body = {
+    client_id: app.clientId,
+    scope: app.scopes.join(" ")
+  };
+  if (app.provider === "microsoft") body.scope = [...app.scopes, "offline_access"].join(" ");
+  const response = await fetch(DEVICE_ENDPOINTS[app.provider], {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: form(body)
+  });
+  const payload = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    throw new Error(
+      `OAuth \u8BBE\u5907\u7801\u8BF7\u6C42\u5931\u8D25\uFF1A${typeof payload.error_description === "string" ? payload.error_description : `HTTP ${String(response.status)}`}`
+    );
+  }
+  return {
+    deviceCode: String(payload.device_code ?? ""),
+    userCode: String(payload.user_code ?? ""),
+    verificationUri: String(payload.verification_uri ?? payload.verification_url ?? ""),
+    interval: Math.max(2, Number(payload.interval ?? 5)),
+    expiresAt: Date.now() + Math.max(60, Number(payload.expires_in ?? 900)) * 1e3
+  };
+}
+async function pollDeviceFlow(app, deviceCode) {
+  const response = await fetch(TOKEN_ENDPOINTS[app.provider], {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: form({
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      client_id: app.clientId,
+      device_code: deviceCode
+    })
+  });
+  const payload = await response.json().catch(() => ({}));
+  if (response.ok) return { status: "ready", tokens: tokensFrom(payload) };
+  const error = String(payload.error ?? "");
+  if (error === "authorization_pending" || error === "slow_down") return { status: "pending" };
+  throw new Error(
+    `OAuth \u8BBE\u5907\u7801\u767B\u5F55\u5931\u8D25\uFF1A${typeof payload.error_description === "string" ? payload.error_description : error}`
+  );
+}
+
 // src/host/backup.ts
 init_address();
 import { createHash as createHash2 } from "node:crypto";
@@ -2793,7 +2947,7 @@ ${conversation.trim()}
 }
 
 // src/host/version.ts
-var VERSION = "0.14.0";
+var VERSION = "0.15.0";
 
 // src/host/api.ts
 init_smtp();
@@ -2844,6 +2998,7 @@ function createApiHandler(runtime) {
     }
   };
 }
+var pendingOAuth = /* @__PURE__ */ new Map();
 function buildRouter(runtime) {
   const router = new Router();
   router.get("/health", () => ({ ok: true, version: VERSION }));
@@ -3007,6 +3162,231 @@ function buildRouter(runtime) {
     }
     return { ok: true, count };
   });
+  router.get("/transfer/export", () => {
+    const config = runtime.current;
+    return {
+      format: "mailharbor-transfer",
+      version: 1,
+      exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      settings: {
+        signature: config.signature,
+        read: config.read,
+        render: config.render,
+        ai: {
+          enabled: config.ai.enabled,
+          provider: config.ai.provider,
+          model: config.ai.model,
+          summaryLength: config.ai.summaryLength
+        },
+        oauth: {
+          google: {
+            clientId: config.oauth.google.clientId,
+            redirectPort: config.oauth.google.redirectPort
+          },
+          microsoft: { clientId: config.oauth.microsoft.clientId }
+        }
+      },
+      accounts: config.accounts.map((account) => ({
+        email: account.email,
+        label: account.label,
+        username: account.username,
+        imap: account.imap,
+        smtp: account.smtp,
+        auth: account.auth,
+        enabled: account.enabled
+      }))
+    };
+  });
+  router.post("/transfer/import", async ({ body }) => {
+    const payload = await body();
+    if (payload.format !== "mailharbor-transfer" || !Array.isArray(payload.accounts)) {
+      throw new HttpError(400, "\u4E0D\u662F\u6709\u6548\u7684 MailHarbor \u914D\u7F6E\u6587\u4EF6");
+    }
+    const config = runtime.current;
+    const accounts = [...config.accounts];
+    let added = 0;
+    for (const raw of payload.accounts) {
+      const email = String(raw.email ?? "").trim();
+      if (email === "" || accounts.some((account) => account.email.toLowerCase() === email.toLowerCase()))
+        continue;
+      try {
+        const account = normalizeAccount(
+          {
+            email,
+            label: typeof raw.label === "string" ? raw.label : void 0,
+            username: typeof raw.username === "string" ? raw.username : void 0,
+            imap: asObject(raw.imap),
+            smtp: asObject(raw.smtp),
+            ...raw.auth !== void 0 ? { auth: raw.auth } : {}
+          },
+          accounts.length,
+          accounts.map((account2) => account2.id)
+        );
+        accounts.push(account);
+        added += 1;
+      } catch {
+      }
+    }
+    if (added > 0) saveAccounts(accounts, config.activeAccountId ?? accounts[0]?.id ?? null);
+    const settings = asObject(payload.settings);
+    const patch = {};
+    if (typeof settings.signature === "string") patch.signature = settings.signature.slice(0, 5e3);
+    const read = asObject(settings.read);
+    if (typeof read.markOnOpen === "boolean") patch.read = { markOnOpen: read.markOnOpen };
+    const render = asObject(settings.render);
+    if (typeof render.listLimit === "number") patch.render = { listLimit: render.listLimit };
+    const ai = asObject(settings.ai);
+    if (ai.summaryLength !== void 0) patch.ai = { summaryLength: ai.summaryLength };
+    if (Object.keys(patch).length > 0) saveSettings(patch);
+    const oauth = asObject(settings.oauth);
+    const google = asObject(oauth.google);
+    const microsoft = asObject(oauth.microsoft);
+    if (typeof google.clientId === "string" || typeof microsoft.clientId === "string") {
+      saveSettings({
+        oauth: {
+          google: {
+            clientId: typeof google.clientId === "string" ? google.clientId : config.oauth.google.clientId,
+            clientSecret: config.oauth.google.clientSecret,
+            redirectPort: typeof google.redirectPort === "number" ? google.redirectPort : config.oauth.google.redirectPort,
+            scopes: config.oauth.google.scopes
+          },
+          microsoft: {
+            clientId: typeof microsoft.clientId === "string" ? microsoft.clientId : config.oauth.microsoft.clientId,
+            scopes: config.oauth.microsoft.scopes
+          }
+        }
+      });
+    }
+    runtime.refresh();
+    return { ok: true, addedAccounts: added, state: appState(runtime) };
+  });
+  router.get("/oauth/status", ({ url }) => {
+    const { account } = accountFrom(runtime, url);
+    const tokens = runtime.oauthTokens(account);
+    let appConfigured = false;
+    try {
+      runtime.oauthApp(account);
+      appConfigured = true;
+    } catch {
+      appConfigured = false;
+    }
+    return {
+      authorized: tokens !== void 0,
+      expiresAt: tokens?.expiresAt ?? null,
+      provider: account.auth.type === "oauth2" ? account.auth.provider : null,
+      appConfigured
+    };
+  });
+  router.post("/oauth/start", async ({ body }) => {
+    const payload = await body();
+    const account = accountFromPayload(runtime, payload);
+    const app = runtime.oauthApp(account);
+    const state = randomBytes(16).toString("hex");
+    const expiresAt = Date.now() + 10 * 6e4;
+    if (app.provider === "microsoft") {
+      const device = await startDeviceFlow(app);
+      pendingOAuth.set(state, {
+        accountId: account.id,
+        provider: "microsoft",
+        status: "pending",
+        deviceCode: device.deviceCode,
+        interval: device.interval,
+        expiresAt
+      });
+      return {
+        state,
+        flow: "microsoft",
+        userCode: device.userCode,
+        verificationUri: device.verificationUri,
+        authUrl: device.verificationUri,
+        interval: device.interval
+      };
+    }
+    const verifier = randomBytes(32).toString("base64url");
+    const challenge = createHash3("sha256").update(verifier).digest("base64url");
+    const redirectUri = `http://127.0.0.1:${String(app.redirectPort)}/oauth/callback`;
+    const authUrl = googleAuthUrl(app, state, challenge, redirectUri);
+    const entry = {
+      accountId: account.id,
+      provider: "google",
+      status: "pending",
+      expiresAt
+    };
+    pendingOAuth.set(state, entry);
+    const server = createServer((request, response) => {
+      const target = new URL(request.url ?? "/", "http://127.0.0.1");
+      if (target.pathname !== "/oauth/callback") {
+        response.writeHead(404).end();
+        return;
+      }
+      const code = target.searchParams.get("code");
+      const error = target.searchParams.get("error");
+      void (async () => {
+        try {
+          if (error !== null) throw new Error(error);
+          if (code === null) throw new Error("\u7F3A\u5C11\u6388\u6743\u7801");
+          const tokens = await exchangeGoogleCode(app, code, verifier, redirectUri);
+          runtime.saveOAuthTokens(account, tokens);
+          entry.status = "ready";
+          response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+          response.end("<p>MailHarbor \u6388\u6743\u6210\u529F\uFF0C\u53EF\u4EE5\u5173\u95ED\u6B64\u9875\u9762\u3002</p>");
+        } catch (caught) {
+          entry.status = "error";
+          entry.message = caught instanceof Error ? caught.message : String(caught);
+          response.writeHead(500, { "content-type": "text/html; charset=utf-8" });
+          response.end(`<p>\u6388\u6743\u5931\u8D25\uFF1A${entry.message}</p>`);
+        } finally {
+          setTimeout(() => {
+            server.close();
+          }, 500);
+        }
+      })();
+    });
+    await new Promise((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(app.redirectPort, "127.0.0.1", () => resolve());
+    });
+    setTimeout(() => {
+      server.close();
+      if (entry.status === "pending") {
+        entry.status = "error";
+        entry.message = "\u6388\u6743\u8D85\u65F6\uFF0C\u8BF7\u91CD\u8BD5";
+      }
+    }, 10 * 6e4).unref();
+    await openExternal(authUrl).catch(() => void 0);
+    return { state, flow: "google", authUrl, expiresAt };
+  });
+  router.post("/oauth/poll", async ({ body }) => {
+    const payload = await body();
+    const state = String(payload.state ?? "");
+    const entry = pendingOAuth.get(state);
+    if (entry === void 0) throw new HttpError(404, "\u6388\u6743\u4F1A\u8BDD\u4E0D\u5B58\u5728\u6216\u5DF2\u8FC7\u671F");
+    if (Date.now() > entry.expiresAt) {
+      entry.status = "error";
+      entry.message = "\u6388\u6743\u8D85\u65F6\uFF0C\u8BF7\u91CD\u8BD5";
+    }
+    if (entry.status !== "pending") {
+      if (entry.status === "ready") pendingOAuth.delete(state);
+      return { status: entry.status, message: entry.message };
+    }
+    if (entry.provider === "microsoft" && entry.deviceCode !== void 0) {
+      const account = runtime.account(entry.accountId);
+      const result = await pollDeviceFlow(runtime.oauthApp(account), entry.deviceCode);
+      if (result.status === "ready") {
+        runtime.saveOAuthTokens(account, result.tokens);
+        pendingOAuth.delete(state);
+        return { status: "ready" };
+      }
+    }
+    return { status: "pending" };
+  });
+  router.post("/oauth/revoke", async ({ body }) => {
+    const payload = await body();
+    const account = accountFromPayload(runtime, payload);
+    runtime.credentials.forgetOAuth(account);
+    runtime.invalidate(account.id);
+    return { ok: true };
+  });
   router.get("/messages/thread", ({ url }) => {
     const { account } = accountFrom(runtime, url);
     const subject = url.searchParams.get("subject") ?? "";
@@ -3139,8 +3519,9 @@ function buildRouter(runtime) {
     const password = typeof input.password === "string" ? input.password : "";
     const config = runtime.current;
     const account = buildAccount(input, config.accounts);
-    if (password === "") throw new HttpError(400, "\u8BF7\u8F93\u5165\u5BC6\u7801\u6216\u5E94\u7528\u4E13\u7528\u5BC6\u7801");
-    if (input.connect !== false) {
+    const oauth = account.auth.type === "oauth2";
+    if (!oauth && password === "") throw new HttpError(400, "\u8BF7\u8F93\u5165\u5BC6\u7801\u6216\u5E94\u7528\u4E13\u7528\u5BC6\u7801");
+    if (!oauth && input.connect !== false) {
       const provider = await verifyImap(account, password);
       await provider.dispose();
       try {
@@ -3148,7 +3529,7 @@ function buildRouter(runtime) {
       } catch {
       }
     }
-    runtime.credentials.remember(account, password, input.remember !== false);
+    if (!oauth) runtime.credentials.remember(account, password, input.remember !== false);
     const accounts = [...config.accounts, account];
     saveAccounts(accounts, account.id);
     runtime.refresh();
@@ -3669,6 +4050,23 @@ function buildRouter(runtime) {
     if (payload.ai !== void 0) patch.ai = asObject(payload.ai);
     if (payload.read !== void 0) patch.read = asObject(payload.read);
     if (payload.render !== void 0) patch.render = asObject(payload.render);
+    if (payload.oauth !== void 0) {
+      const oauth = asObject(payload.oauth);
+      const google = asObject(oauth.google);
+      const microsoft = asObject(oauth.microsoft);
+      patch.oauth = {
+        google: {
+          clientId: typeof google.clientId === "string" ? google.clientId.trim() : runtime.current.oauth.google.clientId,
+          clientSecret: typeof google.clientSecret === "string" ? google.clientSecret.trim() : runtime.current.oauth.google.clientSecret,
+          redirectPort: typeof google.redirectPort === "number" ? google.redirectPort : runtime.current.oauth.google.redirectPort,
+          scopes: runtime.current.oauth.google.scopes
+        },
+        microsoft: {
+          clientId: typeof microsoft.clientId === "string" ? microsoft.clientId.trim() : runtime.current.oauth.microsoft.clientId,
+          scopes: runtime.current.oauth.microsoft.scopes
+        }
+      };
+    }
     if (payload.projects !== void 0) {
       const root = String(asObject(payload.projects).root ?? "").trim();
       if (root === "") throw new HttpError(400, "\u9879\u76EE\u76EE\u5F55\u4E0D\u80FD\u4E3A\u7A7A");
@@ -3817,7 +4215,8 @@ function settingsView(config) {
     },
     read: { markOnOpen: config.read.markOnOpen, pollSeconds: config.read.pollSeconds },
     render: { listLimit: config.render.listLimit },
-    projects: { root: config.projects.root }
+    projects: { root: config.projects.root },
+    oauth: config.oauth
   };
 }
 function taskView(task) {
@@ -4194,6 +4593,32 @@ var CredentialManager = class {
     this.session.delete(account.id);
     this.secrets.delete(account.keychainService, account.email);
   }
+  oauthService(account) {
+    return `${account.keychainService}:oauth`;
+  }
+  readOAuth(account) {
+    const raw = this.secrets.read(this.oauthService(account), account.email);
+    if (raw === void 0 || raw.trim() === "") return void 0;
+    try {
+      const parsed = JSON.parse(raw);
+      if (typeof parsed.accessToken !== "string" || typeof parsed.refreshToken !== "string") return void 0;
+      return {
+        accessToken: parsed.accessToken,
+        refreshToken: parsed.refreshToken,
+        expiresAt: Number(parsed.expiresAt ?? 0),
+        ...typeof parsed.scope === "string" ? { scope: parsed.scope } : {},
+        ...typeof parsed.tokenType === "string" ? { tokenType: parsed.tokenType } : {}
+      };
+    } catch {
+      return void 0;
+    }
+  }
+  writeOAuth(account, tokens) {
+    return this.secrets.write(this.oauthService(account), account.email, JSON.stringify(tokens));
+  }
+  forgetOAuth(account) {
+    this.secrets.delete(this.oauthService(account), account.email);
+  }
   /** Read an arbitrary secret (for example a CalDAV app password). */
   readSecret(service, account) {
     return this.secrets.read(service, account);
@@ -4984,16 +5409,69 @@ var MailHarborRuntime = class {
   paths(account) {
     return accountRuntime(account);
   }
+  /** OAuth app configuration for one account's provider. */
+  oauthApp(account) {
+    if (account.auth.type !== "oauth2") throw new Error("\u8FD9\u4E2A\u8D26\u53F7\u4E0D\u662F OAuth2 \u8D26\u53F7");
+    const provider = account.auth.provider;
+    const settings = this.current.oauth;
+    if (provider === "google") {
+      if (settings.google.clientId === "") throw new Error("\u8BF7\u5148\u5728\u8BBE\u7F6E\u91CC\u586B\u5199 Google OAuth Client ID");
+      return {
+        provider,
+        clientId: settings.google.clientId,
+        clientSecret: settings.google.clientSecret,
+        redirectPort: settings.google.redirectPort,
+        scopes: settings.google.scopes.length > 0 ? settings.google.scopes : ["https://mail.google.com/"]
+      };
+    }
+    if (settings.microsoft.clientId === "") throw new Error("\u8BF7\u5148\u5728\u8BBE\u7F6E\u91CC\u586B\u5199 Microsoft OAuth Client ID");
+    return {
+      provider,
+      clientId: settings.microsoft.clientId,
+      clientSecret: "",
+      redirectPort: 0,
+      scopes: settings.microsoft.scopes.length > 0 ? settings.microsoft.scopes : [
+        "offline_access",
+        "https://outlook.office.com/IMAP.AccessAsUser.All",
+        "https://outlook.office.com/SMTP.Send"
+      ]
+    };
+  }
+  oauthTokens(account) {
+    return this.credentials.readOAuth(account);
+  }
+  saveOAuthTokens(account, tokens) {
+    this.credentials.writeOAuth(account, tokens);
+    this.invalidate(account.id);
+  }
+  /** Refresh when the access token is close to expiring; safe to call often. */
+  async refreshOAuth(account) {
+    if (account.auth.type !== "oauth2") return void 0;
+    const tokens = this.credentials.readOAuth(account);
+    if (tokens === void 0) return void 0;
+    if (tokens.expiresAt - Date.now() > 10 * 6e4) return tokens;
+    const refreshed = await refreshTokens(this.oauthApp(account), tokens.refreshToken);
+    this.saveOAuthTokens(account, refreshed);
+    return refreshed;
+  }
   /** Credentials for an account, with a clear message when the user must log in. */
   credentialsFor(account) {
     if (account.auth.type === "oauth2") {
-      throw new Error("OAuth2 \u8D26\u53F7\u6682\u672A\u5728\u6B64\u7248\u672C\u542F\u7528\uFF0C\u8BF7\u4F7F\u7528\u5E94\u7528\u4E13\u7528\u5BC6\u7801\u767B\u5F55");
+      const tokens = this.credentials.readOAuth(account);
+      if (tokens === void 0) throw new Error("\u8BF7\u5148\u5B8C\u6210 OAuth \u6388\u6743");
+      if (tokens.expiresAt !== 0 && tokens.expiresAt <= Date.now()) {
+        throw new Error("OAuth \u767B\u5F55\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u6388\u6743");
+      }
+      return { user: account.username || account.email, accessToken: tokens.accessToken };
     }
     const resolved = this.credentials.resolve(account);
     if (resolved === void 0) throw new Error("\u8BF7\u5148\u767B\u5F55\u90AE\u7BB1\u8D26\u53F7");
     return { user: account.username || account.email, pass: resolved.password };
   }
   hasCredentials(account) {
+    if (account.auth.type === "oauth2") {
+      return this.credentials.readOAuth(account) !== void 0;
+    }
     return this.credentials.resolve(account) !== void 0;
   }
   imapSettings(account) {
@@ -5556,6 +6034,15 @@ function apply(ctx) {
   }
   const handler = createApiHandler(runtime);
   const disposers = [];
+  const refreshOAuth = () => {
+    for (const account of runtime.current.accounts) {
+      if (account.auth.type !== "oauth2" || !runtime.hasCredentials(account)) continue;
+      void runtime.refreshOAuth(account).catch(() => void 0);
+    }
+  };
+  refreshOAuth();
+  const oauthTimer = setInterval(refreshOAuth, 15 * 6e4);
+  disposers.push(() => clearInterval(oauthTimer));
   const start = () => {
     disposers.push(ctx.webServer.register({ kind: "prefix", path: ROUTE, handler }));
     if (ctx.tools !== void 0) disposers.push(...registerMailTools(ctx.tools, runtime));