domma-cms 1.6.37 → 1.6.39

package/plugins/_lib/mail/accounts.js

@@ -35,7 +35,44 @@ import {normaliseUndoSeconds} from '../admin/mail/scheduling.js';
 import {normaliseVacation} from '../admin/mail/vacation.js';
 import {normaliseTemplates} from '../admin/mail/templates.js';
 import {sanitiseSignature} from './render.js';
-import {open, seal} from './secretbox.js';
+import {MailKeyError, open, seal} from './secretbox.js';
+
+/**
+ * A mailbox signed in with Microsoft or Google whose sign-in no longer works.
+ *
+ * A MailKeyError on purpose: every caller that already turns "the stored
+ * password cannot be opened" into a 409 and a settings prompt does the same
+ * here, with nothing to learn. `statusCode` makes a route that lets it escape
+ * answer 409 with the sentence rather than a 500.
+ */
+export class OAuthReconnectError extends MailKeyError {
+    constructor(message = 'This mailbox\'s sign-in has expired or was withdrawn. Reconnect it under Mail Settings > Mailboxes.') {
+        super(message);
+        this.name = 'OAuthReconnectError';
+        this.needsReconnect = true;
+        this.statusCode = 409;
+    }
+}
+
+/**
+ * Is this mailbox signed in with a provider (OAuth2) rather than a password?
+ *
+ * @param   {object|null} account
+ * @returns {boolean}
+ */
+export function isOAuth(account) {
+    return account?.auth === 'oauth' && !!account.oauth;
+}
+
+/**
+ * Does this mailbox need its owner to sign in again?
+ *
+ * @param   {object|null} account
+ * @returns {boolean}
+ */
+export function needsReconnect(account) {
+    return isOAuth(account) && account.oauth.status !== 'ok';
+}
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
@@ -132,11 +169,36 @@ async function readAll() {
  */
 async function writeAll(accounts) {
     await fs.mkdir(path.dirname(STORE_FILE), {recursive: true});
-    const tmp = STORE_FILE + '.tmp';
+    // A name of its own per write: two writers sharing one `.tmp` could rename
+    // each other's half-written file into place.
+    const tmp = `${STORE_FILE}.${process.pid}.${randomUUID()}.tmp`;
     await fs.writeFile(tmp, JSON.stringify(accounts, null, 2) + '\n', {encoding: 'utf8', mode: 0o600});
     await fs.rename(tmp, STORE_FILE);
 }
 
+/** The tail of the one queue every read-modify-write of the store waits in. */
+let storeQueue = Promise.resolve();
+
+/**
+ * Run a read-modify-write of the store with nothing else writing meanwhile.
+ *
+ * Every exported function that reads the store and writes it back goes
+ * through here. Without it a token renewal and, say, a rules save that
+ * overlap each write back the copy they read, and one of them is lost -
+ * the renewal's rotated refresh token included, which is a lost sign-in.
+ * Single process (as the pool is); never nest - a locked function must not
+ * call another one.
+ *
+ * @template T
+ * @param   {() => Promise<T>} fn
+ * @returns {Promise<T>}
+ */
+function withStoreLock(fn) {
+    const run = storeQueue.then(fn);
+    storeQueue = run.catch(() => {});
+    return run;
+}
+
 /**
  * Strip everything the browser must never see.
  *
@@ -145,9 +207,13 @@ async function writeAll(accounts) {
  */
 export function toPublic(account) {
     if (!account) return null;
-    const {passwordSealed, userId, smtp, ...rest} = account;
+    const {passwordSealed, userId, smtp, oauth, ...rest} = account;
     return {
         ...rest,
+        // Rebuilt field by field for the same reason as `smtp` below: the
+        // sealed client secret and tokens must never reach a browser.
+        ...(oauth ? {oauth: oauthToPublic(oauth)} : {}),
+        auth: isOAuth(account) ? 'oauth' : 'password',
         // Pulled out and rebuilt rather than spread through: `smtp` carries a
         // sealed password of its own, and a top-level destructure does not
         // reach it. Spreading the record verbatim shipped that ciphertext to
@@ -157,6 +223,178 @@ export function toPublic(account) {
     };
 }
 
+/**
+ * The sign-in facts the admin may see.
+ *
+ * @param   {object} oauth
+ * @returns {object}
+ */
+function oauthToPublic(oauth) {
+    return {
+        provider: oauth.provider,
+        clientId: oauth.clientId,
+        tenant: oauth.tenant ?? null,
+        status: oauth.status ?? 'reconnect',
+        error: oauth.error ?? null,
+        connectedAt: oauth.connectedAt ?? null,
+        refreshedAt: oauth.refreshedAt ?? null,
+        hasClientSecret: typeof oauth.clientSecretSealed === 'string' && oauth.clientSecretSealed.length > 0
+    };
+}
+
+/**
+ * Create a mailbox signed in with a provider, or move an existing one onto
+ * the sign-in (Reconnect, or "switch from a password").
+ *
+ * The IMAP and SMTP servers are the provider's own - the token works nowhere
+ * else - so they are written here rather than typed. A stored password is
+ * dropped: keeping it would leave a credential nobody uses in the file.
+ *
+ * @param   {string} userId
+ * @param   {string|null} accountId
+ * @param   {{label: string, username: string, provider: string, clientId: string, tenant: string|null,
+ *            clientSecret: string, refreshToken: string, accessToken: string, expiresAt: number,
+ *            scope: string, imap: object, smtp: object}} f
+ * @returns {Promise<object|null>} the stored record, or null if not theirs
+ */
+export async function saveOAuthAccount(userId, accountId, f) {
+    return withStoreLock(async () => {
+        const all = await readAll();
+        const now = new Date().toISOString();
+        const previous = accountId ? all.find(a => a.id === accountId && a.userId === userId) : null;
+        const oauth = {
+            // A new sign-in is a new generation: a renewal that started under the
+            // old one must not write its tokens over this (see updateOAuth).
+            gen: (Number(previous?.oauth?.gen) || 0) + 1,
+            provider: f.provider,
+            clientId: f.clientId,
+            tenant: f.tenant ?? null,
+            clientSecretSealed: seal(f.clientSecret),
+            refreshTokenSealed: seal(f.refreshToken),
+            accessTokenSealed: seal(f.accessToken),
+            expiresAt: f.expiresAt,
+            scope: f.scope ?? '',
+            status: 'ok',
+            error: null,
+            connectedAt: now,
+            refreshedAt: now
+        };
+        const fields = {
+            auth: 'oauth',
+            host: f.imap.host,
+            port: f.imap.port,
+            secure: f.imap.secure,
+            username: f.username,
+            oauth
+        };
+
+        if (accountId) {
+            const index = all.findIndex(a => a.id === accountId && a.userId === userId);
+            if (index === -1) return null;
+            const {passwordSealed, ...existing} = all[index];
+            const keepSmtp = existing.smtp ?? {};
+            all[index] = {
+                ...existing,
+                ...fields,
+                label: f.label || existing.label,
+                smtp: {
+                    ...keepSmtp,
+                    host: f.smtp.host, port: f.smtp.port, secure: f.smtp.secure,
+                    username: f.username, passwordSealed: null,
+                    from: keepSmtp.from || f.username,
+                    sentFolder: keepSmtp.sentFolder ?? null
+                },
+                updatedAt: now
+            };
+            await writeAll(all);
+            return all[index];
+        }
+
+        const record = {
+            id: randomUUID(),
+            userId,
+            label: f.label || f.username,
+            ...fields,
+            smtp: {host: f.smtp.host, port: f.smtp.port, secure: f.smtp.secure, username: f.username,
+                passwordSealed: null, from: f.username, sentFolder: null},
+            createdAt: now,
+            updatedAt: now
+        };
+        all.push(record);
+        await writeAll(all);
+        return record;
+    });
+}
+
+/**
+ * Change part of a mailbox's stored sign-in: a renewed token, a rotated
+ * refresh token, "needs reconnecting", or a disconnect.
+ *
+ * Does NOT touch `updatedAt`: that stamp means "the person changed the
+ * settings", and the free reader's unread badge keys its failure back-off on
+ * it - an hourly token renewal would otherwise reset the back-off every hour.
+ *
+ * `expectGen`: apply only if the stored sign-in is still that generation.
+ * `requireOk`: apply only if it is still working. `bumpGen`: this patch IS a
+ * new state (Disconnect) that older in-flight work must not overwrite.
+ * Returns null when the patch was dropped (or the mailbox is gone).
+ *
+ * @param   {string} userId
+ * @param   {string} accountId
+ * @param   {object} patch
+ * @param   {{expectGen?: number, requireOk?: boolean, bumpGen?: boolean}} [options]
+ * @returns {Promise<object|null>}
+ */
+export async function updateOAuth(userId, accountId, patch, {expectGen, requireOk = false, bumpGen = false} = {}) {
+    return withStoreLock(async () => {
+        const all = await readAll();
+        const index = all.findIndex(a => a.id === accountId && a.userId === userId);
+        if (index === -1 || !all[index].oauth) return null;
+        const current = all[index].oauth;
+        // The sign-in this patch was worked out against is no longer the stored
+        // one (a Reconnect or Disconnect happened meanwhile): drop it rather than
+        // undo the newer state.
+        if (expectGen !== undefined && (Number(current.gen) || 0) !== expectGen) return null;
+        // A renewal only ever lands on a working sign-in, never revives a dead one.
+        if (requireOk && current.status !== 'ok') return null;
+        const next = {...current, ...patch};
+        if (bumpGen) next.gen = (Number(current.gen) || 0) + 1;
+        all[index] = {...all[index], oauth: next};
+        await writeAll(all);
+        return all[index];
+    });
+}
+
+/**
+ * The renewal hook a connection carries. Imported lazily: oauth.js imports
+ * this module, and a static import back would be a cycle.
+ *
+ * @param   {object} account
+ * @returns {(force: boolean) => Promise<{accessToken: string, expiresAt: number}>}
+ */
+function refresher(account) {
+    return async (force = false) => (await import('./oauth.js')).refresherFor(account)(force);
+}
+
+/**
+ * The stored access token for a signed-in mailbox, or throw when the sign-in
+ * is dead. An expired token is still handed out: the pool renews it before
+ * use, and nodemailer through its provisionCallback.
+ *
+ * @param   {object} account
+ * @returns {{accessToken: string, expiresAt: number}}
+ */
+function storedAccess(account) {
+    if (needsReconnect(account)) throw new OAuthReconnectError(account.oauth.error || undefined);
+    let accessToken = '';
+    try {
+        accessToken = account.oauth.accessTokenSealed ? open(account.oauth.accessTokenSealed) : '';
+    } catch {
+        // Unreadable (the key moved): treat as expired, the refresh decides.
+    }
+    return {accessToken, expiresAt: accessToken ? Number(account.oauth.expiresAt) || 0 : 0};
+}
+
 /**
  * Store the outgoing server for a mailbox.
  *
@@ -172,28 +410,30 @@ export function toPublic(account) {
  * @returns {Promise<object|null>}
  */
 export async function setSmtp(userId, accountId, smtp) {
-    const all = await readAll();
-    const index = all.findIndex(a => a.id === accountId && a.userId === userId);
-    if (index === -1) return null;
+    return withStoreLock(async () => {
+        const all = await readAll();
+        const index = all.findIndex(a => a.id === accountId && a.userId === userId);
+        if (index === -1) return null;
 
-    const existing = all[index].smtp ?? {};
-    all[index] = {
-        ...all[index],
-        smtp: {
-            host: smtp.host,
-            port: smtp.port,
-            secure: smtp.secure,
-            username: smtp.username,
-            passwordSealed: smtp.password
-                ? seal(smtp.password)
-                : (existing.passwordSealed ?? null),
-            from: smtp.from,
-            sentFolder: smtp.sentFolder ?? null
-        },
-        updatedAt: new Date().toISOString()
-    };
-    await writeAll(all);
-    return all[index];
+        const existing = all[index].smtp ?? {};
+        all[index] = {
+            ...all[index],
+            smtp: {
+                host: smtp.host,
+                port: smtp.port,
+                secure: smtp.secure,
+                username: smtp.username,
+                passwordSealed: smtp.password
+                    ? seal(smtp.password)
+                    : (existing.passwordSealed ?? null),
+                from: smtp.from,
+                sentFolder: smtp.sentFolder ?? null
+            },
+            updatedAt: new Date().toISOString()
+        };
+        await writeAll(all);
+        return all[index];
+    });
 }
 
 /**
@@ -214,9 +454,33 @@ export function toSmtpConnection(account, identityId = null) {
     const smtp = account?.smtp;
     if (!smtp?.host) return null;
 
-    const pass = smtp.passwordSealed
-        ? open(smtp.passwordSealed)
-        : open(account.passwordSealed);
+    let auth;
+    if (isOAuth(account)) {
+        const {accessToken, expiresAt} = storedAccess(account);
+        const renew = refresher(account);
+        auth = {
+            type: 'OAuth2',
+            user: smtp.username || account.username,
+            accessToken,
+            // 0 = unknown: nodemailer then asks provisionCallback straight away.
+            ...(expiresAt ? {expires: expiresAt - 60_000} : {}),
+            // nodemailer calls this when the token has expired (renew=false)
+            // and once more after a refused AUTH XOAUTH2 (renew=true) - which
+            // is exactly "refresh on an auth failure, once".
+            provisionCallback: (user, renewNow, callback) => {
+                // Both branches guarded, and a final catch: a throw inside
+                // nodemailer's callback must never become an unhandled rejection.
+                renew(Boolean(renewNow))
+                    .then(r => callback(null, r.accessToken, r.expiresAt), err => callback(err))
+                    .catch(() => {});
+            }
+        };
+    } else {
+        const pass = smtp.passwordSealed
+            ? open(smtp.passwordSealed)
+            : open(account.passwordSealed);
+        auth = {user: smtp.username || account.username, pass};
+    }
 
     const identity = findIdentity(normaliseIdentityList(account), identityId);
     const mailboxAddress = smtp.from || account.username;
@@ -226,7 +490,7 @@ export function toSmtpConnection(account, identityId = null) {
             host: smtp.host,
             port: smtp.port,
             secure: smtp.secure !== false,
-            auth: {user: smtp.username || account.username, pass}
+            auth
         },
         // Still the bare address, as it always was. The display name travels
         // beside it rather than folded into it, because the two go to
@@ -302,23 +566,25 @@ export function identitiesToPublic(account) {
  * @returns {Promise<object|null>}
  */
 export async function setIdentities(userId, accountId, identities) {
-    const all = await readAll();
-    const index = all.findIndex(a => a.id === accountId && a.userId === userId);
-    if (index === -1) return null;
+    return withStoreLock(async () => {
+        const all = await readAll();
+        const index = all.findIndex(a => a.id === accountId && a.userId === userId);
+        if (index === -1) return null;
 
-    const cleaned = (Array.isArray(identities) ? identities : []).map(entry => ({
-        ...entry,
-        signatureHtml: sanitiseSignature(entry?.signatureHtml ?? '')
-    }));
+        const cleaned = (Array.isArray(identities) ? identities : []).map(entry => ({
+            ...entry,
+            signatureHtml: sanitiseSignature(entry?.signatureHtml ?? '')
+        }));
 
-    const {identity, ...rest} = all[index];
-    all[index] = {
-        ...rest,
-        identities: normaliseIdentityList({identities: cleaned}),
-        updatedAt: new Date().toISOString()
-    };
-    await writeAll(all);
-    return all[index];
+        const {identity, ...rest} = all[index];
+        all[index] = {
+            ...rest,
+            identities: normaliseIdentityList({identities: cleaned}),
+            updatedAt: new Date().toISOString()
+        };
+        await writeAll(all);
+        return all[index];
+    });
 }
 
 /**
@@ -343,22 +609,24 @@ export function templatesToPublic(account) {
  * @returns {Promise<object|null>}
  */
 export async function setTemplates(userId, accountId, templates) {
-    const all = await readAll();
-    const index = all.findIndex(a => a.id === accountId && a.userId === userId);
-    if (index === -1) return null;
-
-    const cleaned = (Array.isArray(templates) ? templates : []).map(entry => ({
-        ...entry,
-        bodyHtml: sanitiseSignature(entry?.bodyHtml ?? '')
-    }));
-
-    all[index] = {
-        ...all[index],
-        templates: normaliseTemplates({templates: cleaned}),
-        updatedAt: new Date().toISOString()
-    };
-    await writeAll(all);
-    return all[index];
+    return withStoreLock(async () => {
+        const all = await readAll();
+        const index = all.findIndex(a => a.id === accountId && a.userId === userId);
+        if (index === -1) return null;
+
+        const cleaned = (Array.isArray(templates) ? templates : []).map(entry => ({
+            ...entry,
+            bodyHtml: sanitiseSignature(entry?.bodyHtml ?? '')
+        }));
+
+        all[index] = {
+            ...all[index],
+            templates: normaliseTemplates({templates: cleaned}),
+            updatedAt: new Date().toISOString()
+        };
+        await writeAll(all);
+        return all[index];
+    });
 }
 
 /**
@@ -386,18 +654,20 @@ export function rulesToPublic(account) {
  * @returns {Promise<object|null>}
  */
 export async function setRules(userId, accountId, rules) {
-    const all = await readAll();
-    const index = all.findIndex(a => a.id === accountId && a.userId === userId);
-    if (index === -1) return null;
-
-    all[index] = {
-        ...all[index],
-        rules: normaliseRules({rules}),
-        rulesFrom: all[index].rulesFrom ?? new Date().toISOString(),
-        updatedAt: new Date().toISOString()
-    };
-    await writeAll(all);
-    return all[index];
+    return withStoreLock(async () => {
+        const all = await readAll();
+        const index = all.findIndex(a => a.id === accountId && a.userId === userId);
+        if (index === -1) return null;
+
+        all[index] = {
+            ...all[index],
+            rules: normaliseRules({rules}),
+            rulesFrom: all[index].rulesFrom ?? new Date().toISOString(),
+            updatedAt: new Date().toISOString()
+        };
+        await writeAll(all);
+        return all[index];
+    });
 }
 
 /**
@@ -434,23 +704,25 @@ export function undoSendSeconds(account) {
  * @returns {Promise<object|null>}
  */
 export async function setSendingOptions(userId, accountId, options) {
-    const all = await readAll();
-    const index = all.findIndex(a => a.id === accountId && a.userId === userId);
-    if (index === -1) return null;
-
-    const folders = Array.isArray(options?.ruleFolders)
-        ? [...new Set(options.ruleFolders.filter(f => typeof f === 'string' && f.trim()))]
-        : null;
-
-    all[index] = {
-        ...all[index],
-        undoSendSeconds: normaliseUndoSeconds(options?.undoSendSeconds),
-        snoozeFolder: String(options?.snoozeFolder ?? '').trim() || null,
-        ...(folders ? {ruleFolders: folders} : {}),
-        updatedAt: new Date().toISOString()
-    };
-    await writeAll(all);
-    return all[index];
+    return withStoreLock(async () => {
+        const all = await readAll();
+        const index = all.findIndex(a => a.id === accountId && a.userId === userId);
+        if (index === -1) return null;
+
+        const folders = Array.isArray(options?.ruleFolders)
+            ? [...new Set(options.ruleFolders.filter(f => typeof f === 'string' && f.trim()))]
+            : null;
+
+        all[index] = {
+            ...all[index],
+            undoSendSeconds: normaliseUndoSeconds(options?.undoSendSeconds),
+            snoozeFolder: String(options?.snoozeFolder ?? '').trim() || null,
+            ...(folders ? {ruleFolders: folders} : {}),
+            updatedAt: new Date().toISOString()
+        };
+        await writeAll(all);
+        return all[index];
+    });
 }
 
 /**
@@ -499,22 +771,24 @@ export function vacationToPublic(account) {
  * @returns {Promise<object|null>}
  */
 export async function setVacation(userId, accountId, vacation) {
-    const all = await readAll();
-    const index = all.findIndex(a => a.id === accountId && a.userId === userId);
-    if (index === -1) return null;
-
-    all[index] = {
-        ...all[index],
-        vacation: normaliseVacation({
-            vacation: {
-                ...vacation,
-                bodyHtml: sanitiseSignature(vacation?.bodyHtml ?? '')
-            }
-        }),
-        updatedAt: new Date().toISOString()
-    };
-    await writeAll(all);
-    return all[index];
+    return withStoreLock(async () => {
+        const all = await readAll();
+        const index = all.findIndex(a => a.id === accountId && a.userId === userId);
+        if (index === -1) return null;
+
+        all[index] = {
+            ...all[index],
+            vacation: normaliseVacation({
+                vacation: {
+                    ...vacation,
+                    bodyHtml: sanitiseSignature(vacation?.bodyHtml ?? '')
+                }
+            }),
+            updatedAt: new Date().toISOString()
+        };
+        await writeAll(all);
+        return all[index];
+    });
 }
 
 /** The folder snoozed mail waits in, for a mailbox that has not chosen one. */
@@ -545,25 +819,27 @@ export function snoozeFolder(account) {
  * @returns {Promise<object|null>}
  */
 export async function setIdentity(userId, accountId, identity) {
-    const all = await readAll();
-    const index = all.findIndex(a => a.id === accountId && a.userId === userId);
-    if (index === -1) return null;
-
-    all[index] = {
-        ...all[index],
-        // Sanitised HERE, not in the route that happens to be the only caller
-        // today. This markup is handed back to an editor that sets it as
-        // innerHTML and mailed to third parties, so the guarantee has to hold
-        // for the next caller too - an import, a fleet tool, a second route -
-        // none of which would think to reach for the sanitiser themselves.
-        identity: normaliseIdentity({
-            ...identity,
-            signatureHtml: sanitiseSignature(identity?.signatureHtml ?? '')
-        }),
-        updatedAt: new Date().toISOString()
-    };
-    await writeAll(all);
-    return all[index];
+    return withStoreLock(async () => {
+        const all = await readAll();
+        const index = all.findIndex(a => a.id === accountId && a.userId === userId);
+        if (index === -1) return null;
+
+        all[index] = {
+            ...all[index],
+            // Sanitised HERE, not in the route that happens to be the only caller
+            // today. This markup is handed back to an editor that sets it as
+            // innerHTML and mailed to third parties, so the guarantee has to hold
+            // for the next caller too - an import, a fleet tool, a second route -
+            // none of which would think to reach for the sanitiser themselves.
+            identity: normaliseIdentity({
+                ...identity,
+                signatureHtml: sanitiseSignature(identity?.signatureHtml ?? '')
+            }),
+            updatedAt: new Date().toISOString()
+        };
+        await writeAll(all);
+        return all[index];
+    });
 }
 
 /**
@@ -584,19 +860,21 @@ export async function setIdentity(userId, accountId, identity) {
  * @returns {Promise<object|null>}
  */
 export async function trustImageSender(userId, accountId, address) {
-    const clean = String(address ?? '').trim().toLowerCase();
-    if (!clean) return null;
+    return withStoreLock(async () => {
+        const clean = String(address ?? '').trim().toLowerCase();
+        if (!clean) return null;
 
-    const all = await readAll();
-    const index = all.findIndex(a => a.id === accountId && a.userId === userId);
-    if (index === -1) return null;
+        const all = await readAll();
+        const index = all.findIndex(a => a.id === accountId && a.userId === userId);
+        if (index === -1) return null;
 
-    const current = Array.isArray(all[index].imageSenders) ? all[index].imageSenders : [];
-    if (current.includes(clean)) return all[index];
+        const current = Array.isArray(all[index].imageSenders) ? all[index].imageSenders : [];
+        if (current.includes(clean)) return all[index];
 
-    all[index] = {...all[index], imageSenders: [...current, clean], updatedAt: new Date().toISOString()};
-    await writeAll(all);
-    return all[index];
+        all[index] = {...all[index], imageSenders: [...current, clean], updatedAt: new Date().toISOString()};
+        await writeAll(all);
+        return all[index];
+    });
 }
 
 /**
@@ -608,19 +886,21 @@ export async function trustImageSender(userId, accountId, address) {
  * @returns {Promise<object|null>}
  */
 export async function untrustImageSender(userId, accountId, address) {
-    const clean = String(address ?? '').trim().toLowerCase();
-    const all = await readAll();
-    const index = all.findIndex(a => a.id === accountId && a.userId === userId);
-    if (index === -1) return null;
-
-    const current = Array.isArray(all[index].imageSenders) ? all[index].imageSenders : [];
-    all[index] = {
-        ...all[index],
-        imageSenders: current.filter(a => a !== clean),
-        updatedAt: new Date().toISOString()
-    };
-    await writeAll(all);
-    return all[index];
+    return withStoreLock(async () => {
+        const clean = String(address ?? '').trim().toLowerCase();
+        const all = await readAll();
+        const index = all.findIndex(a => a.id === accountId && a.userId === userId);
+        if (index === -1) return null;
+
+        const current = Array.isArray(all[index].imageSenders) ? all[index].imageSenders : [];
+        all[index] = {
+            ...all[index],
+            imageSenders: current.filter(a => a !== clean),
+            updatedAt: new Date().toISOString()
+        };
+        await writeAll(all);
+        return all[index];
+    });
 }
 
 /**
@@ -636,13 +916,15 @@ export async function untrustImageSender(userId, accountId, address) {
  * @returns {Promise<object|null>}
  */
 export async function setRememberImageSenders(userId, accountId, enabled) {
-    const all = await readAll();
-    const index = all.findIndex(a => a.id === accountId && a.userId === userId);
-    if (index === -1) return null;
+    return withStoreLock(async () => {
+        const all = await readAll();
+        const index = all.findIndex(a => a.id === accountId && a.userId === userId);
+        if (index === -1) return null;
 
-    all[index] = {...all[index], rememberImageSenders: !!enabled, updatedAt: new Date().toISOString()};
-    await writeAll(all);
-    return all[index];
+        all[index] = {...all[index], rememberImageSenders: !!enabled, updatedAt: new Date().toISOString()};
+        await writeAll(all);
+        return all[index];
+    });
 }
 
 /**
@@ -681,17 +963,19 @@ export const POLL_INTERVALS = [3, 5, 10, 15];
  * @returns {Promise<{ok: true, account: object} | {ok: false, error: string}>}
  */
 export async function setPollInterval(userId, accountId, minutes) {
-    if (minutes !== null && !POLL_INTERVALS.includes(minutes)) {
-        return {ok: false, error: `Poll interval must be one of ${POLL_INTERVALS.join(', ')} minutes.`};
-    }
+    return withStoreLock(async () => {
+        if (minutes !== null && !POLL_INTERVALS.includes(minutes)) {
+            return {ok: false, error: `Poll interval must be one of ${POLL_INTERVALS.join(', ')} minutes.`};
+        }
 
-    const all = await readAll();
-    const index = all.findIndex(a => a.id === accountId && a.userId === userId);
-    if (index === -1) return {ok: false, error: 'That mailbox does not exist.'};
+        const all = await readAll();
+        const index = all.findIndex(a => a.id === accountId && a.userId === userId);
+        if (index === -1) return {ok: false, error: 'That mailbox does not exist.'};
 
-    all[index] = {...all[index], pollIntervalMinutes: minutes, updatedAt: new Date().toISOString()};
-    await writeAll(all);
-    return {ok: true, account: all[index]};
+        all[index] = {...all[index], pollIntervalMinutes: minutes, updatedAt: new Date().toISOString()};
+        await writeAll(all);
+        return {ok: true, account: all[index]};
+    });
 }
 
 /**
@@ -719,17 +1003,19 @@ export async function listAllAccounts() {
  * @returns {Promise<object|null>} the stored record, or null if not theirs
  */
 export async function setSyncFolders(userId, accountId, folders) {
-    const all = await readAll();
-    const index = all.findIndex(a => a.id === accountId && a.userId === userId);
-    if (index === -1) return null;
+    return withStoreLock(async () => {
+        const all = await readAll();
+        const index = all.findIndex(a => a.id === accountId && a.userId === userId);
+        if (index === -1) return null;
 
-    const value = folders === null
-        ? null
-        : [...new Set(folders.filter(f => typeof f === 'string' && f.trim()))];
+        const value = folders === null
+            ? null
+            : [...new Set(folders.filter(f => typeof f === 'string' && f.trim()))];
 
-    all[index] = {...all[index], syncFolders: value, updatedAt: new Date().toISOString()};
-    await writeAll(all);
-    return all[index];
+        all[index] = {...all[index], syncFolders: value, updatedAt: new Date().toISOString()};
+        await writeAll(all);
+        return all[index];
+    });
 }
 
 /**
@@ -747,6 +1033,15 @@ export function validate(input, existing) {
     const secure = input.secure !== false;
     const password = typeof input.password === 'string' ? input.password : '';
 
+    // A signed-in mailbox keeps its provider's servers and address: only the
+    // name is the person's to change here. A sign-in is changed by Reconnect.
+    if (isOAuth(existing)) {
+        return {ok: true, value: {
+            label: label || existing.label, host: existing.host, port: existing.port,
+            secure: existing.secure, username: existing.username, password: '', oauth: true
+        }};
+    }
+
     if (!host) return {ok: false, error: 'A mail server hostname is required.'};
     if (!username) return {ok: false, error: 'A username is required.'};
     if (!Number.isInteger(port) || port < 1 || port > 65535) {
@@ -798,18 +1093,20 @@ export async function listAccounts(userId) {
  * @returns {Promise<object|null>} the stored record, or null if not theirs
  */
 export async function setDefaultAccount(userId, accountId, isDefault) {
-    const all = await readAll();
-    const index = all.findIndex(a => a.id === accountId && a.userId === userId);
-    if (index === -1) return null;
-
-    const now = new Date().toISOString();
-    for (let i = 0; i < all.length; i++) {
-        if (all[i].userId !== userId) continue;
-        const want = i === index ? !!isDefault : (isDefault ? false : all[i].isDefault === true);
-        if ((all[i].isDefault === true) !== want) all[i] = {...all[i], isDefault: want, updatedAt: now};
-    }
-    await writeAll(all);
-    return all[index];
+    return withStoreLock(async () => {
+        const all = await readAll();
+        const index = all.findIndex(a => a.id === accountId && a.userId === userId);
+        if (index === -1) return null;
+
+        const now = new Date().toISOString();
+        for (let i = 0; i < all.length; i++) {
+            if (all[i].userId !== userId) continue;
+            const want = i === index ? !!isDefault : (isDefault ? false : all[i].isDefault === true);
+            if ((all[i].isDefault === true) !== want) all[i] = {...all[i], isDefault: want, updatedAt: now};
+        }
+        await writeAll(all);
+        return all[index];
+    });
 }
 
 /**
@@ -836,42 +1133,49 @@ export async function getAccount(userId, accountId) {
  * @returns {Promise<object|null>} the stored record, or null if not theirs
  */
 export async function saveAccount(userId, accountId, fields) {
-    const all = await readAll();
-    const now = new Date().toISOString();
+    return withStoreLock(async () => {
+        const all = await readAll();
+        const now = new Date().toISOString();
+
+        if (accountId) {
+            const index = all.findIndex(a => a.id === accountId && a.userId === userId);
+            if (index === -1) return null;
+            const existing = all[index];
+            if (isOAuth(existing)) {
+                all[index] = {...existing, label: fields.label, updatedAt: now};
+                await writeAll(all);
+                return all[index];
+            }
+            all[index] = {
+                ...existing,
+                label: fields.label,
+                host: fields.host,
+                port: fields.port,
+                secure: fields.secure,
+                username: fields.username,
+                passwordSealed: fields.password ? seal(fields.password) : existing.passwordSealed,
+                updatedAt: now
+            };
+            await writeAll(all);
+            return all[index];
+        }
 
-    if (accountId) {
-        const index = all.findIndex(a => a.id === accountId && a.userId === userId);
-        if (index === -1) return null;
-        const existing = all[index];
-        all[index] = {
-            ...existing,
+        const record = {
+            id: randomUUID(),
+            userId,
             label: fields.label,
             host: fields.host,
             port: fields.port,
             secure: fields.secure,
             username: fields.username,
-            passwordSealed: fields.password ? seal(fields.password) : existing.passwordSealed,
+            passwordSealed: seal(fields.password),
+            createdAt: now,
             updatedAt: now
         };
+        all.push(record);
         await writeAll(all);
-        return all[index];
-    }
-
-    const record = {
-        id: randomUUID(),
-        userId,
-        label: fields.label,
-        host: fields.host,
-        port: fields.port,
-        secure: fields.secure,
-        username: fields.username,
-        passwordSealed: seal(fields.password),
-        createdAt: now,
-        updatedAt: now
-    };
-    all.push(record);
-    await writeAll(all);
-    return record;
+        return record;
+    });
 }
 
 /**
@@ -882,11 +1186,13 @@ export async function saveAccount(userId, accountId, fields) {
  * @returns {Promise<boolean>} true when something was removed
  */
 export async function deleteAccount(userId, accountId) {
-    const all = await readAll();
-    const next = all.filter(a => !(a.id === accountId && a.userId === userId));
-    if (next.length === all.length) return false;
-    await writeAll(next);
-    return true;
+    return withStoreLock(async () => {
+        const all = await readAll();
+        const next = all.filter(a => !(a.id === accountId && a.userId === userId));
+        if (next.length === all.length) return false;
+        await writeAll(next);
+        return true;
+    });
 }
 
 /**
@@ -899,11 +1205,13 @@ export async function deleteAccount(userId, accountId) {
  * @returns {Promise<number>} how many were removed
  */
 export async function deleteAccountsForUser(userId) {
-    const all = await readAll();
-    const next = all.filter(a => a.userId !== userId);
-    const removed = all.length - next.length;
-    if (removed) await writeAll(next);
-    return removed;
+    return withStoreLock(async () => {
+        const all = await readAll();
+        const next = all.filter(a => a.userId !== userId);
+        const removed = all.length - next.length;
+        if (removed) await writeAll(next);
+        return removed;
+    });
 }
 
 /**
@@ -919,12 +1227,14 @@ export async function deleteAccountsForUser(userId) {
  * @returns {Promise<number>} how many were removed
  */
 export async function pruneOrphans(existingUserIds) {
-    const live = existingUserIds instanceof Set ? existingUserIds : new Set(existingUserIds);
-    const all = await readAll();
-    const next = all.filter(a => live.has(a.userId));
-    const removed = all.length - next.length;
-    if (removed) await writeAll(next);
-    return removed;
+    return withStoreLock(async () => {
+        const live = existingUserIds instanceof Set ? existingUserIds : new Set(existingUserIds);
+        const all = await readAll();
+        const next = all.filter(a => live.has(a.userId));
+        const removed = all.length - next.length;
+        if (removed) await writeAll(next);
+        return removed;
+    });
 }
 
 /**
@@ -937,6 +1247,19 @@ export async function pruneOrphans(existingUserIds) {
  * @returns {{host: string, port: number, secure: boolean, auth: {user: string, pass: string}}}
  */
 export function toConnection(account) {
+    if (isOAuth(account)) {
+        const {accessToken, expiresAt} = storedAccess(account);
+        return {
+            host: account.host,
+            port: account.port,
+            secure: account.secure,
+            auth: {user: account.username, accessToken},
+            // Read by the pool (imapPool.js): renew under a minute before
+            // expiry, and once after a refused login. ImapFlow never sees them.
+            expiresAt,
+            refresh: refresher(account)
+        };
+    }
     return {
         host: account.host,
         port: account.port,