domma-cms 0.55.1 → 0.69.3

package/plugins/_lib/mail/readRoutes.js

@@ -0,0 +1,680 @@
+/**
+ * The read-only mail surface, shared by every edition.
+ *
+ * `mail-reader` (free) is exactly these routes and nothing else. `email-pro`
+ * registers them too and adds writing, sending and a synchronised store on
+ * top - forking them instead would mean every IMAP quirk, every sanitiser
+ * decision and every ownership check being fixed twice.
+ *
+ * Routes are relative, so they mount under whichever plugin registers them;
+ * `pluginName` is needed only for the body URL and the log tags.
+ *
+ * ## Access control
+ *
+ * Every route resolves the mailbox through `accounts.getAccount(userId,
+ * accountId)`, which takes the owner's id as well as the account's. There is
+ * no lookup by account id alone, so one user's mailbox cannot be reached with
+ * another user's token, and an id that is not the caller's answers 404 rather
+ * than 403 - a wrong id and someone else's id should be indistinguishable.
+ *
+ * ## Read-only
+ *
+ * Nothing here writes to a mailbox. Mailboxes open with EXAMINE and fetches
+ * use BODY.PEEK[], so reading never sets \Seen. `email-pro` must take its own
+ * writable handle rather than relax this one: the free reader depends on it.
+ *
+ * @module _lib/mail/readRoutes
+ */
+import {simpleParser} from 'mailparser';
+
+import {listUsers} from '../../../server/services/users.js';
+import * as accounts from './accounts.js';
+import * as bodyTokens from './bodyTokens.js';
+import {buildDiagnostics} from './diagnostics.js';
+import {ENVELOPE_QUERY, hasAttachment, parseHeaderBlock} from './envelope.js';
+import {describeError} from './imapPool.js';
+import {resolveSubscriptions} from './folders.js';
+import {readPriority} from './priority.js';
+import {listAttachments, renderBody} from './render.js';
+import {readUnsubscribe} from './unsubscribe.js';
+import {MailKeyError} from './secretbox.js';
+
+/**
+ * Flatten an envelope address list into something the browser can render.
+ *
+ * @param   {Array<{name?: string, address?: string}>} list
+ * @returns {{name: string, address: string}[]}
+ */
+function addresses(list) {
+    return (list ?? []).map(entry => ({
+        name: entry.name ?? '',
+        address: entry.address ?? ''
+    }));
+}
+
+export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginName, cachedList = null, diagnostics = null}) {
+    const {authenticate} = auth;
+
+    // A deleted user's stored mailbox passwords must not outlive their
+    // account. The hook is the fast path; the sweep below is what catches a
+    // user deleted while this plugin happened to be disabled.
+    hooks?.on?.('user:deleted', async ({id} = {}) => {
+        if (!id) return;
+        try {
+            pool.releaseUser(id);
+            const removed = await accounts.deleteAccountsForUser(id);
+            if (removed) {
+                fastify.log.info(`[${pluginName}] removed ${removed} stored mailbox(es) for deleted user ${id}`);
+            }
+        } catch (err) {
+            fastify.log.error({err}, `[${pluginName}] failed to clean up mailboxes for a deleted user`);
+        }
+    });
+
+    // Fire-and-forget: a slow or failing sweep must never delay boot, and
+    // there is nothing a user can do about it if it does fail.
+    (async () => {
+        try {
+            const removed = await accounts.pruneOrphans(new Set((await listUsers()).map(u => u.id)));
+            if (removed) {
+                fastify.log.info(`[${pluginName}] pruned ${removed} stored mailbox(es) with no matching user`);
+            }
+        } catch (err) {
+            fastify.log.warn({err}, `[${pluginName}] orphan mailbox sweep failed`);
+        }
+    })();
+
+    /**
+     * Resolve the caller's user id.
+     *
+     * @param   {object} request
+     * @returns {string|null}
+     */
+    function userId(request) {
+        return request.user?.id ?? request.user?.sub ?? null;
+    }
+
+    /**
+     * Load the mailbox named by ?account= and open its stored password.
+     *
+     * Returns null after replying, so handlers can `if (!ctx) return;`.
+     *
+     * @param   {object} request
+     * @param   {object} reply
+     * @returns {Promise<{uid: string, account: object, connection: object, poolKey: string}|null>}
+     */
+    async function context(request, reply) {
+        const uid = userId(request);
+        if (!uid) {
+            reply.code(401).send({error: 'Authentication required.'});
+            return null;
+        }
+
+        const requested = request.query.account ? String(request.query.account) : null;
+        const owned = await accounts.listAccounts(uid);
+
+        if (!owned.length) {
+            reply.code(404).send({error: 'No mailbox is set up yet.', needsSetup: true});
+            return null;
+        }
+
+        // No ?account= means "the first one" - the reader opens on a mailbox
+        // rather than asking which before it has shown anything.
+        const account = requested ? owned.find(a => a.id === requested) : owned[0];
+        if (!account) {
+            reply.code(404).send({error: 'That mailbox does not exist.'});
+            return null;
+        }
+
+        try {
+            return {
+                uid,
+                account,
+                connection: accounts.toConnection(account),
+                // Keyed per account, not per user: one user may hold several
+                // mailboxes and each needs its own connection.
+                poolKey: `${uid}:${account.id}`
+            };
+        } catch (err) {
+            if (err instanceof MailKeyError) {
+                reply.code(409).send({error: err.message, needsPassword: true, accountId: account.id});
+                return null;
+            }
+            throw err;
+        }
+    }
+
+    /**
+     * Run an IMAP operation, turning transport failures into tidy 502s.
+     *
+     * @param   {object} reply
+     * @param   {() => Promise<any>} fn
+     * @returns {Promise<any>}
+     */
+    async function imap(reply, fn) {
+        try {
+            return await fn();
+        } catch (err) {
+            fastify.log.error({err}, `[${pluginName}] IMAP operation failed`);
+            reply.code(502).send({error: describeError(err)});
+            return null;
+        }
+    }
+
+    // -------------------------------------------------------------------------
+    // Accounts
+    // -------------------------------------------------------------------------
+
+    /** GET /accounts - every mailbox this user owns, without passwords. */
+    fastify.get('/accounts', {preHandler: [authenticate]}, async (request, reply) => {
+        const uid = userId(request);
+        if (!uid) return reply.code(401).send({error: 'Authentication required.'});
+        return {accounts: (await accounts.listAccounts(uid)).map(accounts.toPublic)};
+    });
+
+    /** POST /accounts - add a mailbox. */
+    fastify.post('/accounts', {preHandler: [authenticate]}, async (request, reply) => {
+        const uid = userId(request);
+        if (!uid) return reply.code(401).send({error: 'Authentication required.'});
+
+        const result = accounts.validate(request.body ?? {}, null);
+        if (!result.ok) return reply.code(400).send({error: result.error});
+
+        const saved = await accounts.saveAccount(uid, null, result.value);
+        return {account: accounts.toPublic(saved)};
+    });
+
+    /** PUT /accounts/:id - update one. A blank password keeps the stored one. */
+    fastify.put('/accounts/:id', {preHandler: [authenticate]}, async (request, reply) => {
+        const uid = userId(request);
+        if (!uid) return reply.code(401).send({error: 'Authentication required.'});
+
+        const existing = await accounts.getAccount(uid, request.params.id);
+        if (!existing) return reply.code(404).send({error: 'That mailbox does not exist.'});
+
+        const result = accounts.validate(request.body ?? {}, existing);
+        if (!result.ok) return reply.code(400).send({error: result.error});
+
+        const saved = await accounts.saveAccount(uid, request.params.id, result.value);
+        // The pooled connection was opened with the old details.
+        pool.release(`${uid}:${request.params.id}`);
+        return {account: accounts.toPublic(saved)};
+    });
+
+    /** DELETE /accounts/:id - forget a mailbox and its password. */
+    fastify.delete('/accounts/:id', {preHandler: [authenticate]}, async (request, reply) => {
+        const uid = userId(request);
+        if (!uid) return reply.code(401).send({error: 'Authentication required.'});
+
+        pool.release(`${uid}:${request.params.id}`);
+        const deleted = await accounts.deleteAccount(uid, request.params.id);
+        if (!deleted) return reply.code(404).send({error: 'That mailbox does not exist.'});
+        return {deleted: true};
+    });
+
+    /**
+     * POST /accounts/test - try details without saving them.
+     *
+     * Accepts a body so a mailbox can be tested before it is saved. When the
+     * password field is blank and `id` names an existing mailbox, the stored
+     * password is used - otherwise editing a hostname would mean retyping it.
+     */
+    fastify.post('/accounts/test', {preHandler: [authenticate]}, async (request, reply) => {
+        const uid = userId(request);
+        if (!uid) return reply.code(401).send({error: 'Authentication required.'});
+
+        const body = request.body ?? {};
+        const existing = body.id ? await accounts.getAccount(uid, body.id) : null;
+        if (body.id && !existing) return reply.code(404).send({error: 'That mailbox does not exist.'});
+
+        const result = accounts.validate(body, existing);
+        if (!result.ok) return reply.code(400).send({error: result.error});
+
+        let pass = result.value.password;
+        if (!pass) {
+            try {
+                pass = accounts.toConnection(existing).auth.pass;
+            } catch (err) {
+                if (err instanceof MailKeyError) return reply.code(409).send({error: err.message});
+                throw err;
+            }
+        }
+
+        return pool.test({
+            host: result.value.host,
+            port: result.value.port,
+            secure: result.value.secure,
+            auth: {user: result.value.username, pass}
+        });
+    });
+
+    // -------------------------------------------------------------------------
+    // Reading
+    // -------------------------------------------------------------------------
+
+    /** GET /folders - the mailbox tree, flattened. */
+    fastify.get('/folders', {preHandler: [authenticate]}, async (request, reply) => {
+        const ctx = await context(request, reply);
+        if (!ctx) return;
+
+        return imap(reply, async () => {
+            const list = await pool.withClient(ctx.poolKey, ctx.connection, client => client.list());
+            // `subscribed !== false` was wrong: imapflow reports an
+            // unsubscribed mailbox as `undefined`, so every hidden folder read
+            // as visible. See resolveSubscriptions for why it is not simply
+            // `=== true` either.
+            const visible = resolveSubscriptions(list);
+            const folders = list
+                .filter(box => !box.flags?.has('\\Noselect'))
+                .map(box => ({
+                    path: box.path,
+                    name: box.name,
+                    delimiter: box.delimiter,
+                    specialUse: box.specialUse ?? null,
+                    subscribed: visible.get(box.path) !== false
+                }));
+
+            // Unread counts are opt-in. STATUS is a round trip per folder and
+            // a real mailbox here has over a hundred of them, so asking for
+            // them is a choice the caller makes rather than a cost every
+            // folder listing pays.
+            if (request.query.counts === '1') {
+                await withUnreadCounts(ctx, folders);
+            }
+
+            return {accountId: ctx.account.id, folders};
+        });
+    });
+
+    /**
+     * Fill in each folder's unread count.
+     *
+     * STATUS asks without selecting, so it does not disturb the open mailbox
+     * and cannot mark anything read. Run with a small concurrency: a hundred
+     * simultaneous commands on one connection is not faster, and on several
+     * connections it is how a server starts refusing them.
+     *
+     * A folder that refuses STATUS is left without a count rather than
+     * failing the listing - some servers will not report on some folders, and
+     * a missing badge is better than an empty folder pane.
+     *
+     * @param   {object} ctx
+     * @param   {object[]} folders
+     * @returns {Promise<void>}
+     */
+    async function withUnreadCounts(ctx, folders) {
+        const queue = [...folders];
+        const worker = async () => {
+            while (queue.length) {
+                const folder = queue.shift();
+                try {
+                    const status = await pool.withClient(ctx.poolKey, ctx.connection,
+                        client => client.status(folder.path, {unseen: true, messages: true}));
+                    folder.unseen = status?.unseen ?? 0;
+                    folder.messages = status?.messages ?? 0;
+                } catch {
+                    folder.unseen = null;
+                }
+            }
+        };
+        // One connection, so the commands serialise anyway - this just avoids
+        // building a hundred pending promises.
+        await Promise.all([worker(), worker()]);
+    }
+
+    /**
+     * GET /messages - one page of envelopes, newest first.
+     *
+     * Paged by sequence number from the end of the mailbox rather than by
+     * search: it is one round trip, and "newest first" is what a reader wants.
+     */
+    fastify.get('/messages', {preHandler: [authenticate]}, async (request, reply) => {
+        const ctx = await context(request, reply);
+        if (!ctx) return;
+
+        const folder = String(request.query.folder || 'INBOX');
+        const page = Math.max(1, Number(request.query.page) || 1);
+        const limit = Math.min(
+            config.maxListLimit,
+            Math.max(1, Number(request.query.limit) || config.listLimit)
+        );
+
+        // The Pro edition mirrors chosen folders, and a mirrored folder is
+        // answered from the store - instant, and no connection needed. It
+        // returns null for anything not mirrored, which falls through to the
+        // wire exactly as the free edition always does.
+        if (cachedList) {
+            try {
+                const cached = await cachedList({
+                    account: ctx.account, userId: ctx.uid, folder, page, limit
+                });
+                if (cached) {
+                    return {...cached, page, limit, folder, accountId: ctx.account.id, source: 'cache'};
+                }
+            } catch (err) {
+                // A broken mirror must never make mail unreadable; fall back.
+                fastify.log.warn({err}, `[${pluginName}] cached list failed - falling back to IMAP`);
+            }
+        }
+
+        return imap(reply, () => pool.withMailbox(ctx.poolKey, ctx.connection, folder, async (client, mailbox) => {
+            const total = mailbox.exists;
+            if (!total) return {messages: [], total: 0, page, limit, folder, accountId: ctx.account.id};
+
+            const end = total - (page - 1) * limit;
+            if (end < 1) return {messages: [], total, page, limit, folder, accountId: ctx.account.id};
+            const start = Math.max(1, end - limit + 1);
+
+            const messages = [];
+            // The same query the mirror uses, so a folder listed live and one
+            // listed from the mirror produce identical rows - including the
+            // priority headers, which are not part of the envelope.
+            for await (const message of client.fetch(`${start}:${end}`, ENVELOPE_QUERY)) {
+                messages.push({
+                    uid: message.uid,
+                    seq: message.seq,
+                    subject: message.envelope?.subject ?? '',
+                    from: addresses(message.envelope?.from),
+                    to: addresses(message.envelope?.to),
+                    date: message.envelope?.date ?? null,
+                    size: message.size ?? 0,
+                    // The raw flag list, not just the booleans derived from it.
+                    // The list view keeps an observable of this per row, so
+                    // omitting it left every message on a non-mirrored folder
+                    // initialised with no flags - and therefore drawn unread,
+                    // whatever the server said.
+                    flags: [...(message.flags ?? [])],
+                    seen: message.flags?.has('\\Seen') ?? false,
+                    flagged: message.flags?.has('\\Flagged') ?? false,
+                    answered: message.flags?.has('\\Answered') ?? false,
+                    hasAttachment: hasAttachment(message.bodyStructure),
+                    priority: readPriority(parseHeaderBlock(message.headers))
+                });
+            }
+
+            // The server returns ascending sequence order regardless of range.
+            messages.reverse();
+            return {messages, total, page, limit, folder, accountId: ctx.account.id};
+        }));
+    });
+
+    /** GET /messages/:uid - one message, rendered for the reader pane. */
+    fastify.get('/messages/:uid', {preHandler: [authenticate]}, async (request, reply) => {
+        const ctx = await context(request, reply);
+        if (!ctx) return;
+
+        const folder = String(request.query.folder || 'INBOX');
+        const uid = Number(request.params.uid);
+        if (!Number.isInteger(uid) || uid < 1) {
+            return reply.code(400).send({error: 'Invalid message id.'});
+        }
+        // Three ways images may load, and only one of them is remembered.
+        // The per-message override is deliberately not stored - it is a
+        // decision about one message. A sender the user has explicitly chosen
+        // to trust is stored, listed in settings and revocable, which is a
+        // different act from silently remembering a click.
+        const requestedNow = request.query.images === 'load';
+
+        return imap(reply, () => pool.withMailbox(ctx.poolKey, ctx.connection, folder, async (client) => {
+            const fetched = await client.fetchOne(uid, {source: true, flags: true}, {uid: true});
+            if (!fetched || !fetched.source) {
+                reply.code(404).send({error: 'That message is no longer in this folder.'});
+                return null;
+            }
+            if (fetched.source.length > config.maxMessageBytes) {
+                reply.code(413).send({error: 'That message is too large to display.'});
+                return null;
+            }
+
+            const parsed = await simpleParser(fetched.source);
+            const from = addresses(parsed.from?.value);
+            const senderTrusted = accounts.sendersImagesTrusted(ctx.account, from);
+            const allowRemoteImages = requestedNow || config.allowRemoteImages || senderTrusted;
+
+            const rendered = renderBody(parsed, {
+                allowRemoteImages,
+                inlineImageMaxBytes: config.inlineImageMaxBytes
+            });
+
+            return {
+                uid,
+                folder,
+                accountId: ctx.account.id,
+                senderTrusted,
+                // Offered only when remembering is switched on for this mailbox.
+                canTrustSender: ctx.account.rememberImageSenders !== false
+                    && !senderTrusted
+                    && !!from[0]?.address,
+                trustableSender: from[0]?.address ?? null,
+                subject: parsed.subject ?? '',
+                from,
+                to: addresses(parsed.to?.value),
+                cc: addresses(parsed.cc?.value),
+                // Carried so the expanded header can show them. Reply-To
+                // especially: a sender who sets it is asking for replies
+                // somewhere other than where the message came from, and until
+                // now the reader hid that entirely. Bcc only ever appears on a
+                // copy in Sent - a received message never carries one, which
+                // is the point of it.
+                replyTo: addresses(parsed.replyTo?.value),
+                bcc: addresses(parsed.bcc?.value),
+                date: parsed.date ?? null,
+                messageId: parsed.messageId ?? null,
+                // From the parsed message here rather than a header fetch:
+                // the whole source is already in hand at this point.
+                priority: readPriority(parsed.headers),
+                // A URL, not the markup: an iframe filled with srcdoc inherits
+                // the admin's CSP (img-src 'self' data: blob:), which silently
+                // blocks every remote image no matter what the reader asks for.
+                // Served from a route, the document carries its own policy.
+                bodyUrl: `/api/plugins/${pluginName}/body?token=${encodeURIComponent(bodyTokens.sign({
+                    userId: ctx.uid,
+                    accountId: ctx.account.id,
+                    folder,
+                    uid,
+                    images: allowRemoteImages
+                }))}`,
+                isHtml: rendered.isHtml,
+                blockedImages: rendered.blockedImages,
+                remoteImagesLoaded: allowRemoteImages,
+                // What this message offers by way of getting off the list it
+                // came from. Read in both editions, because knowing there is
+                // an unsubscribe link is reading; acting on it is a write and
+                // lives in the Pro edition.
+                unsubscribe: readUnsubscribe(parsed.headers),
+                attachments: listAttachments(parsed.attachments)
+            };
+        }));
+    });
+
+    /**
+     * GET /body - the rendered message, as its own document.
+     *
+     * Authorised by a short-lived signed token rather than a bearer header,
+     * because an `<iframe src>` cannot send one. The token names a single
+     * message for a single user and expires in minutes.
+     *
+     * The CSP here is the point of the whole route: served as its own
+     * document, this policy applies instead of the admin's, so a message the
+     * reader has chosen to load images for can actually load them - while
+     * scripts, frames and everything else stay refused.
+     */
+    fastify.get('/body', {
+        // Helmet adds X-Frame-Options in an onSend hook, which runs after
+        // the handler - so removing it in there was too early and the
+        // browser kept warning, once per message, that it was ignoring the
+        // header in favour of the frame-ancestors this route already sets.
+        // Helmet writes onto the raw response rather than Fastify's header
+        // store, so reply.removeHeader() never sees it - it has to come off
+        // the raw response, and only for this route.
+        onSend: async (request, reply, payload) => {
+            reply.removeHeader('X-Frame-Options');
+            reply.raw.removeHeader?.('X-Frame-Options');
+            return payload;
+        }
+    }, async (request, reply) => {
+        const grant = bodyTokens.verify(String(request.query.token ?? ''));
+        if (!grant) {
+            return reply.code(403).type('text/plain').send('This message link has expired. Reopen the message.');
+        }
+
+        const account = await accounts.getAccount(grant.userId, grant.accountId);
+        if (!account) return reply.code(404).type('text/plain').send('That mailbox no longer exists.');
+
+        let connection;
+        try {
+            connection = accounts.toConnection(account);
+        } catch (err) {
+            if (err instanceof MailKeyError) return reply.code(409).type('text/plain').send(err.message);
+            throw err;
+        }
+
+        const poolKey = `${grant.userId}:${account.id}`;
+        try {
+            const document = await pool.withMailbox(poolKey, connection, grant.folder, async (client) => {
+                const fetched = await client.fetchOne(grant.uid, {source: true}, {uid: true});
+                if (!fetched || !fetched.source) return null;
+                if (fetched.source.length > config.maxMessageBytes) return null;
+
+                const parsed = await simpleParser(fetched.source);
+                return renderBody(parsed, {
+                    allowRemoteImages: grant.images,
+                    inlineImageMaxBytes: config.inlineImageMaxBytes
+                }).document;
+            });
+
+            if (!document) return reply.code(404).type('text/plain').send('That message is no longer available.');
+
+            return reply
+                .type('text/html; charset=utf-8')
+                .header('Content-Security-Policy',
+                    "default-src 'none'; " +
+                    (grant.images ? "img-src data: http: https:; " : "img-src data:; ") +
+                    "style-src 'unsafe-inline'; font-src data:; frame-ancestors 'self'")
+                .header('X-Content-Type-Options', 'nosniff')
+                .header('Referrer-Policy', 'no-referrer')
+                // Someone else's mail has no business in a cache.
+                .header('Cache-Control', 'no-store, no-cache, must-revalidate, private')
+                .send(document);
+        } catch (err) {
+            fastify.log.error({err}, `[${pluginName}] failed to render a message body`);
+            return reply.code(502).type('text/plain').send(describeError(err));
+        }
+    });
+
+    /**
+     * GET /diagnostics - what this build is, and what it is configured with.
+     *
+     * Exists so a bug report can start from evidence. No secrets: hostnames
+     * and usernames identify a mailbox, the key SOURCE is reported without the
+     * key, and no password appears sealed or otherwise.
+     */
+    fastify.get('/diagnostics', {preHandler: [authenticate]}, async (request, reply) => {
+        const uid = userId(request);
+        if (!uid) return reply.code(401).send({error: 'Authentication required.'});
+        return buildDiagnostics({pluginName, userId: uid, config, extra: diagnostics});
+    });
+
+    /**
+     * GET /image-senders - the senders whose images always load.
+     */
+    fastify.get('/image-senders', {preHandler: [authenticate]}, async (request, reply) => {
+        const ctx = await context(request, reply);
+        if (!ctx) return;
+        return {
+            accountId: ctx.account.id,
+            remember: ctx.account.rememberImageSenders !== false,
+            senders: Array.isArray(ctx.account.imageSenders) ? ctx.account.imageSenders : []
+        };
+    });
+
+    /**
+     * POST /image-senders - trust a sender's images from now on.
+     */
+    fastify.post('/image-senders', {preHandler: [authenticate]}, async (request, reply) => {
+        const ctx = await context(request, reply);
+        if (!ctx) return;
+
+        if (ctx.account.rememberImageSenders === false) {
+            return reply.code(409).send({error: 'Remembering senders is switched off for this mailbox.'});
+        }
+
+        const address = String(request.body?.address ?? '').trim();
+        if (!address) return reply.code(400).send({error: 'A sender address is required.'});
+
+        const saved = await accounts.trustImageSender(ctx.uid, ctx.account.id, address);
+        if (!saved) return reply.code(404).send({error: 'That mailbox does not exist.'});
+        return {senders: saved.imageSenders ?? []};
+    });
+
+    /**
+     * DELETE /image-senders - stop trusting one.
+     */
+    fastify.delete('/image-senders', {preHandler: [authenticate]}, async (request, reply) => {
+        const ctx = await context(request, reply);
+        if (!ctx) return;
+        const address = String(request.query.address ?? '').trim();
+        if (!address) return reply.code(400).send({error: 'A sender address is required.'});
+
+        const saved = await accounts.untrustImageSender(ctx.uid, ctx.account.id, address);
+        if (!saved) return reply.code(404).send({error: 'That mailbox does not exist.'});
+        return {senders: saved.imageSenders ?? []};
+    });
+
+    /**
+     * PUT /image-senders/remember - turn the whole feature on or off.
+     *
+     * Switching it off ignores the list without discarding it: turning it back
+     * on should not mean rebuilding something someone curated.
+     */
+    fastify.put('/image-senders/remember', {preHandler: [authenticate]}, async (request, reply) => {
+        const ctx = await context(request, reply);
+        if (!ctx) return;
+        const saved = await accounts.setRememberImageSenders(ctx.uid, ctx.account.id, request.body?.remember !== false);
+        if (!saved) return reply.code(404).send({error: 'That mailbox does not exist.'});
+        return {remember: saved.rememberImageSenders !== false, senders: saved.imageSenders ?? []};
+    });
+
+    /**
+     * GET /messages/:uid/attachments/:index - download one part.
+     *
+     * Re-fetches and re-parses the message rather than caching it. Phase 1
+     * keeps no message store at all, and correctness beats a second copy of
+     * someone's mail sitting in memory.
+     */
+    fastify.get('/messages/:uid/attachments/:index', {preHandler: [authenticate]}, async (request, reply) => {
+        const ctx = await context(request, reply);
+        if (!ctx) return;
+
+        const folder = String(request.query.folder || 'INBOX');
+        const uid = Number(request.params.uid);
+        const index = Number(request.params.index);
+        if (!Number.isInteger(uid) || !Number.isInteger(index) || index < 0) {
+            return reply.code(400).send({error: 'Invalid attachment reference.'});
+        }
+
+        return imap(reply, () => pool.withMailbox(ctx.poolKey, ctx.connection, folder, async (client) => {
+            const fetched = await client.fetchOne(uid, {source: true}, {uid: true});
+            if (!fetched || !fetched.source) {
+                reply.code(404).send({error: 'That message is no longer in this folder.'});
+                return null;
+            }
+
+            const parsed = await simpleParser(fetched.source);
+            const attachment = parsed.attachments?.[index];
+            if (!attachment) {
+                reply.code(404).send({error: 'That attachment is not on this message.'});
+                return null;
+            }
+
+            const filename = (attachment.filename || `attachment-${index + 1}`).replace(/["\\\r\n]/g, '_');
+            reply
+                .header('Content-Type', attachment.contentType || 'application/octet-stream')
+                // Always an attachment, never inline: nothing from a stranger's
+                // mail should render in the admin's own origin.
+                .header('Content-Disposition', `attachment; filename="${filename}"`)
+                .header('X-Content-Type-Options', 'nosniff');
+            return reply.send(attachment.content);
+        }));
+    });
+}