emailengine-app 1.14.8 → 2.61.0

package/lib/account.js

@@ -3,56 +3,372 @@
 const logger = require('./logger');
 const Boom = require('@hapi/boom');
 const msgpack = require('msgpack5')();
-const { normalizePath, formatAccountListingResponse } = require('./tools');
+const {
+    normalizePath,
+    formatAccountListingResponse,
+    unpackUIDRangeForSearch,
+    mergeObjects,
+    download,
+    resolveCredentials,
+    isEmail,
+    resolveDelegatedAccount
+} = require('./tools');
 const crypto = require('crypto');
 const { MessageChannel } = require('worker_threads');
 const { MessagePortReadable } = require('./message-port-stream');
 const { deepStrictEqual, strictEqual } = require('assert');
 const { encrypt, decrypt } = require('./encrypt');
-const { OAuth2Client } = require('google-auth-library');
+const { oauth2Apps, LEGACY_KEYS } = require('./oauth2-apps');
+const settings = require('./settings');
+const redisScanDelete = require('./redis-scan-delete');
+const { customAlphabet } = require('nanoid');
+const Lock = require('ioredfour');
+const nanoid = customAlphabet('0123456789abcdefghijklmnopqrstuvwxyz', 16);
+const { REDIS_PREFIX, ACCOUNT_DELETED_NOTIFY, MAILBOX_HASH } = require('./consts');
+const { mimeHtml } = require('@postalsys/email-text-tools');
+const { GMAIL_API_SCOPES } = require('./oauth/gmail');
+const { OUTLOOK_API_SCOPES } = require('./oauth/outlook');
 
 class Account {
     constructor(options) {
         this.redis = options.redis;
         this.account = options.account || false;
 
+        this.documentsQueue = options.documentsQueue || false;
+
         this.secret = options.secret;
 
+        this.timeout = options.timeout ? Number(options.timeout) : 0;
+
+        this.esClient = options.esClient;
+
         this.call = options.call; // async method to request data from parent
 
         this.logger = options.logger || logger;
     }
 
-    async listAccounts(state, page, limit) {
+    getLock() {
+        if (!this.lock) {
+            this.lock = new Lock({
+                redis: this.redis,
+                namespace: 'ee'
+            });
+        }
+        return this.lock;
+    }
+
+    /**
+     * Checks OAuth2 scopes to determine account capabilities
+     *
+     * @param {string} provider - OAuth2 provider name (e.g., 'gmail', 'outlook')
+     * @param {Array<string>} scopes - Array of OAuth2 scope strings
+     * @returns {{hasSendScope: boolean, hasReadScope: boolean}} Object indicating send and read capabilities
+     *
+     * @example
+     * // Gmail send-only account
+     * checkAccountScopes('gmail', ['https://www.googleapis.com/auth/gmail.send'])
+     * // Returns: { hasSendScope: true, hasReadScope: false }
+     *
+     * @example
+     * // Gmail full access account
+     * checkAccountScopes('gmail', ['https://www.googleapis.com/auth/gmail.modify'])
+     * // Returns: { hasSendScope: false, hasReadScope: true }
+     *
+     * @example
+     * // Outlook send-only account (global cloud)
+     * checkAccountScopes('outlook', ['https://graph.microsoft.com/Mail.Send', 'offline_access'])
+     * // Returns: { hasSendScope: true, hasReadScope: false }
+     *
+     * @example
+     * // Outlook full access account (GCC-High cloud)
+     * checkAccountScopes('outlook', ['https://graph.microsoft.us/Mail.ReadWrite', 'https://graph.microsoft.us/Mail.Send'])
+     * // Returns: { hasSendScope: true, hasReadScope: true }
+     *
+     * @example
+     * // Outlook send-only account (DoD cloud)
+     * checkAccountScopes('outlook', ['https://dod-graph.microsoft.us/Mail.Send', 'offline_access'])
+     * // Returns: { hasSendScope: true, hasReadScope: false }
+     */
+    checkAccountScopes(provider, scopes) {
+        if (!scopes || !Array.isArray(scopes)) {
+            return { hasSendScope: false, hasReadScope: false };
+        }
+
+        if (provider === 'gmail') {
+            const hasSendScope = scopes.some(s => s.includes(GMAIL_API_SCOPES.send));
+            const hasReadScope = scopes.some(
+                s =>
+                    s.includes(GMAIL_API_SCOPES.modify) ||
+                    s.includes(GMAIL_API_SCOPES.readonly) ||
+                    s.includes(GMAIL_API_SCOPES.labels) ||
+                    s.includes('mail.google.com')
+            );
+            return { hasSendScope, hasReadScope };
+        }
+
+        if (provider === 'outlook') {
+            // Known Microsoft Graph API endpoints across different cloud environments
+            const msGraphDomains = [
+                'graph.microsoft.com', // Global cloud
+                'graph.microsoft.us', // GCC-High cloud
+                'dod-graph.microsoft.us', // DoD cloud
+                'microsoftgraph.chinacloudapi.cn' // China cloud
+            ];
+
+            // Normalize scopes by extracting the scope name from the full URL
+            // Supports multiple MS Graph endpoints (global, GCC-High, DoD, China)
+            // Examples:
+            //   https://graph.microsoft.com/Mail.Send -> Mail.Send
+            //   https://graph.microsoft.us/Mail.ReadWrite -> Mail.ReadWrite
+            //   https://dod-graph.microsoft.us/Mail.Send -> Mail.Send
+            //   https://microsoftgraph.chinacloudapi.cn/Mail.Send -> Mail.Send
+            //   offline_access -> offline_access (passed through)
+            const normalizedScopes = scopes.map(s => {
+                // Handle plain scope names (e.g., offline_access, openid)
+                // These are not URLs and should be passed through as-is
+                if (!s.includes('://')) {
+                    return s;
+                }
+
+                // Try to parse as URL to validate it's a Microsoft Graph endpoint
+                try {
+                    const url = new URL(s);
+
+                    // Validate protocol - must be https
+                    if (url.protocol !== 'https:') {
+                        this.logger.warn({
+                            msg: 'Invalid protocol in MS Graph scope URL, expected https',
+                            scope: s,
+                            protocol: url.protocol
+                        });
+                        return s; // Return as-is for non-https URLs
+                    }
+
+                    // Check if this is a recognized MS Graph domain
+                    if (msGraphDomains.includes(url.hostname)) {
+                        // Extract scope name from path only (ignoring query params and fragments)
+                        // Examples:
+                        //   /Mail.Send -> Mail.Send
+                        //   /Mail.Send?foo=bar -> Mail.Send
+                        //   /Mail.Send#section -> Mail.Send
+                        //   /Mail.Send/ -> Mail.Send (removes trailing slash)
+                        const scopeName = url.pathname.substring(1).replace(/\/$/, '');
+                        if (scopeName) {
+                            return scopeName;
+                        }
+                        this.logger.warn({
+                            msg: 'MS Graph scope URL has no scope name in path',
+                            scope: s
+                        });
+                    }
+                } catch (err) {
+                    // Invalid URL format
+                    this.logger.warn({
+                        msg: 'Failed to parse MS Graph scope URL',
+                        scope: s,
+                        err: err.message
+                    });
+                }
+                // Return as-is if not a recognized Graph URL or parsing failed
+                return s;
+            });
+
+            const hasSendScope = normalizedScopes.some(s => s === OUTLOOK_API_SCOPES.send);
+            const hasReadScope = normalizedScopes.some(s => s === OUTLOOK_API_SCOPES.read || s === OUTLOOK_API_SCOPES.readWrite);
+            return { hasSendScope, hasReadScope };
+        }
+
+        return { hasSendScope: false, hasReadScope: false };
+    }
+
+    /**
+     * Determines if an account is configured for send-only mode
+     *
+     * This method handles ALL types of send-only accounts:
+     * 1. OAuth2 API accounts (Gmail/Outlook) with only send scopes
+     * 2. Traditional SMTP-only accounts (IMAP disabled or missing)
+     * 3. Delegated accounts (checks the parent account)
+     *
+     * @param {Object} accountData - Account configuration object
+     * @param {Object} [app] - OAuth2 app configuration object (optional, for OAuth2 accounts)
+     * @returns {boolean} True if account is send-only (can send but not read)
+     *
+     * @example
+     * // Send-only Gmail API account (has gmail.send scope only)
+     * isSendOnlyAccount(accountData, { provider: 'gmail' })
+     * // Returns: true
+     *
+     * @example
+     * // Send-only Outlook Graph API account (has Mail.Send scope only)
+     * isSendOnlyAccount(accountData, { provider: 'outlook' })
+     * // Returns: true
+     *
+     * @example
+     * // SMTP-only account (IMAP disabled)
+     * isSendOnlyAccount({ smtp: {...}, imap: { disabled: true } })
+     * // Returns: true
+     *
+     * @example
+     * // SMTP-only account (no IMAP configured)
+     * isSendOnlyAccount({ smtp: {...} })
+     * // Returns: true
+     *
+     * @example
+     * // Full access IMAP account
+     * isSendOnlyAccount({ smtp: {...}, imap: { host: 'imap.example.com' } })
+     * // Returns: false
+     */
+    /**
+     * Checks if an OAuth2 account has send-only scope configuration
+     * @private
+     * @param {Object} accountData - Account configuration object
+     * @param {string} provider - OAuth2 provider ('gmail' or 'outlook')
+     * @returns {boolean} True if account has send scope but not read scope
+     */
+    _hasOAuth2SendOnlyScopes(accountData, provider) {
+        const scopes = accountData.oauth2?.accessToken?.scope || accountData.oauth2?.scope || [];
+        const { hasSendScope, hasReadScope } = this.checkAccountScopes(provider, scopes);
+        return hasSendScope && !hasReadScope;
+    }
+
+    isSendOnlyAccount(accountData, app) {
+        // Check OAuth2 API accounts (Gmail, Outlook Graph API)
+        if (app && ['gmail', 'outlook'].includes(app.provider)) {
+            return this._hasOAuth2SendOnlyScopes(accountData, app.provider);
+        }
+
+        // Check traditional SMTP-only accounts
+        // An account is send-only if:
+        // - IMAP is explicitly disabled, OR
+        // - IMAP is not configured (missing or empty)
+        if (accountData.imap) {
+            // IMAP exists - check if it's disabled
+            return !!accountData.imap.disabled;
+        }
+
+        // No IMAP configuration at all
+        // Check if this is an OAuth2 account without an app parameter
+        // (delegated accounts or OAuth2 accounts where app lookup failed)
+        if (accountData.oauth2 && !app) {
+            // For OAuth2 without app info, we can't determine scope-based send-only
+            // Default to false (assume full access) unless IMAP is explicitly disabled
+            return false;
+        }
+
+        // No IMAP, no OAuth2 - this is a traditional SMTP-only account
+        // Return true only if SMTP is configured (otherwise it's an invalid config)
+        return !!accountData.smtp;
+    }
+
+    async listAccounts(state, query, page, limit) {
         limit = Number(limit) || 20;
         page = Math.max(Number(page) || 0, 0);
         let skip = page * limit;
 
-        let result = await this.redis.sListAccounts('ia:accounts', state || '*', skip, limit);
+        const runIndex = await this.call({
+            cmd: 'runIndex'
+        });
+
+        let result = await this.redis.sListAccounts(`${REDIS_PREFIX}ia:accounts`, state || '*', skip, limit, `${REDIS_PREFIX}`, query);
+
+        let accounts = result[2].map(formatAccountListingResponse).map(this.unserializeAccountData.bind(this));
+        let oauthApps = new Map();
+
+        for (let accountData of accounts) {
+            if (accountData.oauth2 && accountData.oauth2.provider) {
+                let app;
+                if (oauthApps.has(accountData.oauth2.provider)) {
+                    app = oauthApps.get(accountData.oauth2.provider);
+                } else {
+                    app = await oauth2Apps.get(accountData.oauth2.provider);
+                }
+                oauthApps.set(accountData.oauth2.provider, app || null);
+                if (app) {
+                    accountData.type = app.provider;
+                    if (app.baseScopes === 'api') {
+                        accountData.isApi = true;
+                    }
+
+                    // Check if this is a send-only OAuth2 API account (Gmail or Outlook, regardless of baseScopes setting)
+                    if (this.isSendOnlyAccount(accountData, app)) {
+                        accountData.isApi = true;
+                        accountData.sendOnly = true;
+                    }
+                } else {
+                    accountData.type = 'oauth2';
+                }
+            } else if (accountData.oauth2 && accountData.oauth2.auth && accountData.oauth2.auth.delegatedAccount) {
+                accountData.type = 'delegated';
+                let delegatedAccount = await resolveDelegatedAccount(this.redis, accountData.account);
+                if (delegatedAccount) {
+                    accountData.delegatedAccount = delegatedAccount;
+                    let delegatedAccountRow = await this.redis.hgetall(`${REDIS_PREFIX}iad:${delegatedAccount}`);
+                    let delegatedAccountData = this.unserializeAccountData(delegatedAccountRow);
+                    if (delegatedAccountData.oauth2 && delegatedAccountData.oauth2.provider) {
+                        let app;
+                        if (oauthApps.has(delegatedAccountData.oauth2.provider)) {
+                            app = oauthApps.get(delegatedAccountData.oauth2.provider);
+                        } else {
+                            app = await oauth2Apps.get(delegatedAccountData.oauth2.provider);
+                        }
+                        oauthApps.set(delegatedAccountData.oauth2.provider, app || null);
+                        if (app && app.baseScopes === 'api') {
+                            accountData.isApi = true;
+                        }
+                    }
+                }
+            } else if (accountData.imap && !accountData.imap.disabled) {
+                accountData.type = 'imap';
+            } else {
+                // Default to 'sending' type for accounts without IMAP
+                // Use unified detection to determine if truly send-only
+                accountData.type = 'sending';
+                accountData.sendOnly = this.isSendOnlyAccount(accountData);
+            }
+        }
 
         let list = {
             total: result[0],
             pages: Math.ceil(result[0] / limit),
             page,
-            accounts: result[2]
-                .map(formatAccountListingResponse)
-                .map(this.unserializeAccountData.bind(this))
-                .map(entry => ({
-                    account: entry.account,
-                    name: entry.name,
-                    state: entry.state,
-                    syncTime: entry.sync,
-                    lastError: entry.state === 'connected' ? null : entry.lastErrorState
-                }))
+            query: query || false,
+            state: state || '*',
+            accounts: accounts.map(accountData => ({
+                account: accountData.account,
+                name: accountData.name,
+                email: accountData.email,
+                type: accountData.type,
+                app:
+                    accountData.oauth2 && accountData.oauth2.provider && accountData.oauth2.provider !== accountData.type
+                        ? accountData.oauth2.provider
+                        : undefined,
+                state:
+                    !runIndex || runIndex <= accountData.runIndex || ['init', 'unset'].includes(accountData.state) || accountData.isApi
+                        ? accountData.state
+                        : 'init',
+
+                webhooks: accountData.webhooks || undefined,
+                proxy: accountData.proxy || undefined,
+                smtpEhloName: accountData.smtpEhloName || undefined,
+
+                counters: accountData.counters,
+
+                syncTime: accountData.sync,
+
+                lastError:
+                    accountData.state === 'connected' || !accountData.lastErrorState || !Object.keys(accountData.lastErrorState).length
+                        ? null
+                        : accountData.lastErrorState
+            }))
         };
 
         return list;
     }
 
     async getMailboxInfo(path) {
-        let redisKey = BigInt('0x' + crypto.createHash('sha1').update(normalizePath(path)).digest('hex')).toString(36);
+        let redisKey = BigInt('0x' + crypto.createHash(MAILBOX_HASH).update(normalizePath(path)).digest('hex')).toString(36);
 
-        let data = await this.redis.hgetall(`iam:${this.account}:h:${redisKey}`);
+        let data = await this.redis.hgetall(`${REDIS_PREFIX}iam:${this.account}:h:${redisKey}`);
         if (!data || !Object.keys(data).length) {
             return {};
         }
@@ -70,49 +386,175 @@ class Account {
     }
 
     getAccountKey() {
-        return `iad:${this.account}`;
+        return `${REDIS_PREFIX}iad:${this.account}`;
     }
 
     getMailboxListKey() {
-        return `ial:${this.account}`;
+        return `${REDIS_PREFIX}ial:${this.account}`;
+    }
+
+    getMailboxHashKey() {
+        return `${REDIS_PREFIX}iah:${this.account}`;
+    }
+
+    getLogKey() {
+        // this format ensures that the key is deleted when user is removed
+        return `${REDIS_PREFIX}iam:${this.account}:g`;
+    }
+
+    getExternalQueueKey() {
+        return `${REDIS_PREFIX}iap:${this.account}`;
     }
 
     unserializeAccountData(accountData) {
-        let result = {};
+        const result = {};
+
+        const counters = {};
 
         Object.keys(accountData).forEach(key => {
+            if (key.startsWith('_')) {
+                return; //ignore
+            }
+
+            let countMatch = key.match(/^stats:count:([^:]+):([^:]+)/);
+            if (countMatch) {
+                const [, type, counter] = countMatch;
+                if (!counters[type]) {
+                    counters[type] = {};
+                }
+
+                if (!counters[type][counter]) {
+                    counters[type][counter] = 0;
+                }
+
+                counters[type][counter] = Number(accountData[key]);
+                return;
+            }
+
             switch (key) {
                 case 'notifyFrom':
+                case 'syncFrom':
+                case 'lastWatch':
                     // Date object
                     if (accountData[key]) {
-                        let date = new Date(accountData[key]);
-                        if (date.toString() !== 'Invalid Date') {
-                            result[key] = date;
+                        if (accountData[key] === 'null') {
+                            result[key] = null;
+                        } else {
+                            let date = new Date(accountData[key]);
+                            if (date.toString() !== 'Invalid Date') {
+                                result[key] = date;
+                            }
                         }
                     }
                     break;
 
+                // boolean values
                 case 'copy':
-                    result[key] = accountData[key] === 'true' ? true : false;
+                case 'logs':
+                    if (accountData[key] && accountData[key] !== 'null') {
+                        result[key] = accountData[key] === 'true' ? true : false;
+                    }
+                    break;
+
+                case 'path':
+                    if (!accountData[key] || !accountData[key].length) {
+                        break;
+                    }
+                    if (accountData[key].length > 1 && (/^"|"$/.test(accountData[key]) || /^\[|\]$/.test(accountData[key]))) {
+                        // seems like JSON array or string
+                        try {
+                            let value = JSON.parse(accountData[key]);
+                            if (value === null) {
+                                break;
+                            }
+                            result[key] = value;
+                        } catch (err) {
+                            this.logger.error({ msg: 'Failed to parse input from Redis', key, value: accountData[key], err });
+                        }
+                    } else {
+                        // regular string
+                        result[key] = accountData[key];
+                    }
+                    break;
+
+                // generic JSON values
+                case 'webhooksCustomHeaders':
+                case 'subconnections':
+                case 'watchResponse':
+                case 'watchFailure':
+                    try {
+                        let value = JSON.parse(accountData[key]);
+                        if (value === null) {
+                            break;
+                        }
+                        result[key] = value;
+                    } catch (err) {
+                        this.logger.error({ msg: 'Failed to parse input from Redis', key, value: accountData[key], err });
+                    }
+                    break;
+
+                case 'outlookSubscription':
+                    try {
+                        let value = JSON.parse(accountData[key]);
+                        if (value === null) {
+                            break;
+                        }
+
+                        if (value.expirationDateTime) {
+                            let expirationDateTime = new Date(value.expirationDateTime);
+                            if (expirationDateTime.toString() === 'Invalid Date') {
+                                expirationDateTime = null;
+                            }
+                            value.expirationDateTime = expirationDateTime;
+                        }
+
+                        result[key] = value;
+                    } catch (err) {
+                        this.logger.error({ msg: 'Failed to parse input from Redis', key, value: accountData[key], err });
+                    }
                     break;
 
                 case 'imap':
                 case 'smtp':
+                case 'imapServerInfo':
+                case 'smtpServerEhlo':
                 case 'oauth2':
                 case 'lastErrorState':
+                case 'syncError':
+                case 'smtpStatus':
+                case 'webhookErrorFlag':
                     try {
-                        result[key] = JSON.parse(accountData[key]);
-                        if (result[key].expires) {
-                            let date = new Date(result[key].expires);
-                            if (date.toString() !== 'Invalid Date') {
-                                result[key].expires = date;
+                        let value = JSON.parse(accountData[key]);
+                        if (value === null) {
+                            break;
+                        }
+                        result[key] = value;
+                        for (let subKey of ['created', 'expires', 'generated']) {
+                            if (result[key][subKey]) {
+                                let dateVal = /^[0-9]+$/.test(result[key][subKey]) ? Number(result[key][subKey]) : result[key][subKey];
+                                let date = new Date(dateVal);
+                                if (date.toString() !== 'Invalid Date') {
+                                    result[key][subKey] = date;
+                                }
+                            }
+                        }
+                        for (let subKey of Object.keys(result[key])) {
+                            if (result[key][subKey] === null) {
+                                delete result[key][subKey];
                             }
                         }
                     } catch (err) {
-                        this.logger.error({ msg: 'Failed to parse input from Redis', key, err });
+                        this.logger.error({ msg: 'Failed to parse input from Redis', key, value: accountData[key], err });
                     }
                     break;
 
+                // number values
+                case 'connections':
+                case 'listRegistry':
+                case 'runIndex':
+                    result[key] = Number(accountData[key]) || 0;
+                    break;
+
                 default:
                     result[key] = accountData[key];
                     break;
@@ -149,6 +591,17 @@ class Account {
             result.path = '*';
         }
 
+        if (typeof result.account === 'undefined') {
+            result.account = null;
+        }
+
+        // falls back to oauth2 username as the email address if email address is not set
+        if (!result.email && result?.oauth2?.auth?.user && isEmail(result?.oauth2?.auth?.user)) {
+            result.email = result.oauth2.auth.user;
+        }
+
+        result.counters = counters;
+
         return result;
     }
 
@@ -156,14 +609,91 @@ class Account {
         let result = {};
 
         Object.keys(accountData).forEach(key => {
+            if (key.startsWith('_')) {
+                // ignore
+                return;
+            }
             switch (key) {
                 case 'notifyFrom':
+                case 'syncFrom':
+                case 'lastWatch':
                     // Date object
                     if (accountData[key] === 'now') {
                         result[key] = new Date().toISOString();
-                    } else if (accountData[key] && typeof accountData[key] === 'object' && accountData[key].toString() !== 'Invalid Date') {
+                    } else if (
+                        accountData[key] &&
+                        typeof accountData[key] === 'object' &&
+                        typeof accountData[key].toISOString === 'function' &&
+                        accountData[key].toString() !== 'Invalid Date'
+                    ) {
                         result[key] = accountData[key].toISOString();
+                    } else if (typeof accountData[key] === 'string') {
+                        let date = new Date(accountData[key]);
+                        if (date.toString() !== 'Invalid Date') {
+                            result[key] = date.toISOString();
+                        }
+                    } else if (accountData[key] === null) {
+                        result[key] = 'null';
+                    }
+                    break;
+
+                case 'path':
+                    if (
+                        accountData[key] === null ||
+                        accountData[key] === '*' ||
+                        (Array.isArray(accountData[key]) && (accountData[key].length === 0 || (accountData[key].length === 1 && accountData[key][0] === '*')))
+                    ) {
+                        result[key] = '';
+                    } else {
+                        try {
+                            result[key] = JSON.stringify(accountData[key]);
+                        } catch (err) {
+                            this.logger.error({ msg: 'Failed to stringify input for Redis', key, err });
+                        }
+                    }
+                    break;
+
+                // generic JSON values
+                case 'subconnections':
+                case 'webhooksCustomHeaders':
+                case 'watchResponse':
+                case 'watchFailure':
+                    try {
+                        let value = JSON.stringify(accountData[key]);
+
+                        result[key] = value;
+                    } catch (err) {
+                        this.logger.error({ msg: 'Failed to stringify input for Redis', key, err });
+                    }
+
+                    break;
+
+                case 'outlookSubscription':
+                    try {
+                        let objValue = Object.assign({}, accountData[key]);
+
+                        if (['number', 'string'].includes(typeof objValue.expirationDateTime)) {
+                            objValue.expirationDateTime = new Date(objValue.expirationDateTime);
+                        }
+
+                        if (
+                            objValue.expirationDateTime &&
+                            typeof objValue.expirationDateTime === 'object' &&
+                            typeof objValue.expirationDateTime.toISOString === 'function' &&
+                            objValue.expirationDateTime.toString() !== 'Invalid Date'
+                        ) {
+                            objValue.expirationDateTime = objValue.expirationDateTime.toISOString();
+                        } else if (objValue.expirationDateTime) {
+                            objValue.expirationDateTime = null;
+                        }
+
+                        let value = JSON.stringify(objValue);
+
+                        result[key] = value;
+                    } catch (err) {
+                        this.logger.error({ msg: 'Failed to stringify input for Redis', key, err });
                     }
+
                     break;
 
                 case 'imap':
@@ -192,12 +722,14 @@ class Account {
                             }
                         }
 
-                        if (
-                            accountData[key].expires &&
-                            typeof accountData[key].expires === 'object' &&
-                            accountData[key].expires.toString() !== 'Invalid Date'
-                        ) {
-                            connectData.expires = accountData[key].expires.toISOString();
+                        for (let subKey of ['created', 'expires', 'generated']) {
+                            if (
+                                accountData[key][subKey] &&
+                                typeof accountData[key][subKey] === 'object' &&
+                                accountData[key][subKey].toString() !== 'Invalid Date'
+                            ) {
+                                connectData[subKey] = accountData[key][subKey].toISOString();
+                            }
                         }
 
                         result[key] = JSON.stringify(connectData);
@@ -206,8 +738,28 @@ class Account {
                     }
                     break;
 
+                case 'webhooks':
+                    if (typeof accountData[key] !== 'undefined' && accountData[key] !== null && typeof accountData[key].toString === 'function') {
+                        result[key] = accountData[key].toString();
+                        if (!result[key]) {
+                            // clear potential error flag
+                            result.webhookErrorFlag = '{}';
+                        }
+                    }
+                    break;
+
+                // boolean values
+                case 'copy':
+                case 'logs':
+                    if (typeof accountData[key] === 'boolean') {
+                        result[key] = accountData[key].toString();
+                    } else if (accountData[key] === null) {
+                        result[key] = '';
+                    }
+                    break;
+
                 default:
-                    if (accountData[key] !== undefined && typeof accountData[key].toString === 'function') {
+                    if (typeof accountData[key] !== 'undefined' && accountData[key] !== null && typeof accountData[key].toString === 'function') {
                         result[key] = accountData[key].toString();
                     }
                     break;
@@ -217,7 +769,7 @@ class Account {
         return result;
     }
 
-    async loadAccountData(account, requireValid) {
+    async loadAccountData(account, requireValid, runIndex) {
         if (!this.account || (account && account !== this.account)) {
             let message = 'Invalid account ID';
             let error = Boom.boomify(new Error(message), { statusCode: 400 });
@@ -233,23 +785,76 @@ class Account {
         }
 
         let accountData = this.unserializeAccountData(result);
-        if (requireValid && accountData.state !== 'connected') {
+
+        if (accountData.oauth2 && accountData.oauth2.provider) {
+            let app = await oauth2Apps.get(accountData.oauth2.provider);
+            if (app) {
+                if (app.baseScopes === 'api') {
+                    accountData.isApi = true;
+                }
+
+                // Check if this is a send-only OAuth2 API account (Gmail or Outlook, regardless of baseScopes setting)
+                if (this.isSendOnlyAccount(accountData, app)) {
+                    accountData.isApi = true;
+                    accountData.sendOnly = true;
+                }
+
+                accountData._app = app;
+            }
+        } else if (accountData.oauth2 && accountData.oauth2.auth && accountData.oauth2.auth.delegatedAccount) {
+            let delegatedAccount = await resolveDelegatedAccount(this.redis, accountData.account);
+            if (delegatedAccount) {
+                accountData.delegatedAccount = delegatedAccount;
+                let delegatedAccountRow = await this.redis.hgetall(`${REDIS_PREFIX}iad:${delegatedAccount}`);
+                let delegatedAccountData = this.unserializeAccountData(delegatedAccountRow);
+                if (delegatedAccountData.oauth2 && delegatedAccountData.oauth2.provider) {
+                    let app = await oauth2Apps.get(delegatedAccountData.oauth2.provider);
+                    if (app) {
+                        accountData._app = app;
+                        if (app.baseScopes === 'api') {
+                            accountData.isApi = true;
+                        }
+                    }
+                }
+            }
+        }
+
+        accountData.state =
+            !runIndex || runIndex <= accountData.runIndex || ['init', 'unset'].includes(accountData.state) || accountData.isApi ? accountData.state : 'init';
+
+        if (requireValid && !['connected', 'connecting', 'syncing'].includes(accountData.state)) {
             let err;
             switch (accountData.state) {
                 case 'init':
                     err = new Error('Requested account is not yet initialized');
+                    err.code = 'NotYetConnected';
                     break;
+                /*
+                // Check disabled for the following states - allow commands to go through.
+                // A secondary IMAP connection is opened if possible.
+                */
+                /*
                 case 'connecting':
+                case 'syncing':
                     err = new Error('Requested account is not yet connected');
+                    err.code = 'NotYetConnected';
                     break;
+                */
                 case 'authenticationError':
                     err = new Error('Requested account can not be authenticated');
+                    err.code = 'AuthenticationFails';
                     break;
                 case 'connectError':
                     err = new Error('Can not establish server connection for requested account');
+                    err.code = 'ConnectionError';
+                    break;
+                case 'unset':
+                    err = new Error('Syncing is disabled for the requested account');
+                    err.code = 'NotSyncing';
                     break;
                 default:
                     err = new Error('Requested account currently not available');
+                    err.code = 'NoAvailable';
                     break;
             }
 
@@ -257,6 +862,9 @@ class Account {
             if (accountData.state) {
                 error.output.payload.state = accountData.state;
             }
+            if (err.code) {
+                error.output.payload.code = err.code;
+            }
             throw error;
         }
 
@@ -266,32 +874,161 @@ class Account {
     async update(accountData) {
         let oldAccountData = await this.loadAccountData(accountData.account);
 
-        let result = await this.redis.hmset(this.getAccountKey(), this.serializeAccountData(accountData));
+        if (accountData.oauth2?.provider) {
+            // check if this OAuth2 provider exists
+            let oauth2App = await oauth2Apps.get(accountData.oauth2.provider);
+            if (!oauth2App) {
+                let message = 'Invalid or missing OAuth2 provider';
+                let error = Boom.boomify(new Error(message), { statusCode: 400 });
+                throw error;
+            }
+        }
+
+        let removeProvider;
+        let addProvider;
+
+        if (accountData.oauth2?.provider) {
+            addProvider = accountData.oauth2.provider;
+            if (oldAccountData.oauth2?.provider && oldAccountData.oauth2.provider !== accountData.oauth2.provider) {
+                removeProvider = oldAccountData.oauth2.provider;
+            }
+        }
+
+        for (let subKey of ['imap', 'smtp', 'oauth2']) {
+            if (!accountData[subKey] || typeof accountData[subKey] !== 'object') {
+                continue;
+            }
+            let partial = accountData[subKey].partial;
+            delete accountData[subKey].partial;
+            if (!partial) {
+                continue;
+            }
+
+            // merge old and new values
+            if (!oldAccountData[subKey]) {
+                // nothing to merge
+                continue;
+            }
+
+            mergeObjects(accountData[subKey], oldAccountData[subKey]);
+        }
+
+        let pipeline = this.redis.multi().hmset(this.getAccountKey(), this.serializeAccountData(accountData));
+
+        if (addProvider && !LEGACY_KEYS.includes(addProvider)) {
+            pipeline = pipeline.sadd(`${REDIS_PREFIX}oapp:a:${addProvider}`, this.account);
+            if (accountData._oldOAuth2User && accountData._oldOAuth2User.toLowerCase() !== accountData.oauth2.auth?.user?.toLowerCase()) {
+                pipeline = pipeline.hdel(`${REDIS_PREFIX}oapp:h:${addProvider}`, accountData._oldOAuth2User.toLowerCase());
+            }
+            if (accountData.oauth2?.auth?.user) {
+                // check if already exists
+                let existingAppBinding = await this.redis.hget(
+                    `${REDIS_PREFIX}oapp:h:${accountData.oauth2.provider}`,
+                    accountData.oauth2.auth?.user?.toLowerCase()
+                );
+                if (existingAppBinding && existingAppBinding !== this.account) {
+                    let existingAccount;
+                    try {
+                        existingAccount = await this.loadAccountData(existingAppBinding);
+                    } catch (err) {
+                        // account not found
+                    }
+
+                    if (existingAccount?.oauth2?.auth?.user === accountData.oauth2.auth?.user) {
+                        let message = 'Another account for the same OAuth2 user already exists';
+                        let error = Boom.boomify(new Error(message), { statusCode: 400 });
+                        error.output.payload.code = 'AccountAlreadyExists';
+                        error.output.payload.existingAccount = existingAppBinding;
+                        throw error;
+                    }
+                }
+                pipeline = pipeline.hset(`${REDIS_PREFIX}oapp:h:${addProvider}`, accountData.oauth2?.auth?.user?.toLowerCase(), this.account);
+            }
+        }
+
+        if (removeProvider) {
+            pipeline = pipeline.srem(`${REDIS_PREFIX}oapp:a:${removeProvider}`, this.account);
+            if (oldAccountData.oauth2?.auth?.user) {
+                pipeline = pipeline.hdel(`${REDIS_PREFIX}oapp:h:${removeProvider}`, oldAccountData.oauth2?.auth?.user?.toLowerCase());
+            }
+        }
+
+        let [[err, result]] = await pipeline.exec();
+        if (err) {
+            throw err;
+        }
+
         if (!result || result !== 'OK') {
             let message = 'Something went wrong';
             let error = Boom.boomify(new Error(message), { statusCode: 500 });
             throw error;
         }
 
-        if ('imap' in accountData) {
-            // if partial update, then skip check
+        let reconnectRequested = false;
+
+        if ('imap' in accountData && !reconnectRequested) {
             try {
                 deepStrictEqual(oldAccountData.imap, accountData.imap);
-                strictEqual(oldAccountData.path || '*', accountData.path || '*');
             } catch (err) {
                 // changes detected!
-                this.logger.info({ msg: 'IMAP configuration changed for account', account: this.account });
-                await this.call({ cmd: 'update', account: this.account });
+                reconnectRequested = true;
             }
         }
 
+        if ('path' in accountData && !reconnectRequested) {
+            try {
+                strictEqual(JSON.stringify(oldAccountData.path || '*'), JSON.stringify(accountData.path || '*'));
+            } catch (err) {
+                // changes detected!
+                reconnectRequested = true;
+            }
+        }
+
+        if ('subconnections' in accountData && !reconnectRequested) {
+            try {
+                deepStrictEqual(oldAccountData.subconnections, accountData.subconnections);
+            } catch (err) {
+                // changes detected!
+                reconnectRequested = true;
+            }
+        }
+
+        if (reconnectRequested) {
+            // changes detected!
+            this.logger.info({ msg: 'IMAP configuration changed for account', account: this.account });
+            await this.call({
+                cmd: 'update',
+                account: this.account,
+                timeout: this.timeout
+            });
+        }
+
         return {
             account: this.account
         };
     }
 
+    async genId() {
+        let id;
+        let retries = 0;
+        while (retries++ < 20) {
+            id = nanoid();
+            let alreadyExists = await this.redis.hexists(`${REDIS_PREFIX}iad:${id}`, 'account');
+            if (alreadyExists) {
+                id = false;
+            } else {
+                break;
+            }
+        }
+        return id;
+    }
+
     async create(accountData) {
         this.account = accountData.account;
+        if (this.account === null) {
+            // auogenerate ID
+            this.account = accountData.account = await this.genId();
+        }
 
         if (!this.account) {
             let message = 'Invalid account ID';
@@ -299,13 +1036,64 @@ class Account {
             throw error;
         }
 
-        let result = await this.redis
+        let oauth2App;
+        if (accountData.oauth2 && accountData.oauth2.provider) {
+            // check if this OAuth2 provider exists
+            oauth2App = await oauth2Apps.get(accountData.oauth2.provider);
+            if (!oauth2App) {
+                let message = 'Invalid or missing OAuth2 provider';
+                let error = Boom.boomify(new Error(message), { statusCode: 400 });
+                throw error;
+            }
+        }
+
+        if (!accountData.imapIndexer && (accountData.imap || (oauth2App && (!oauth2App.baseScopes || oauth2App.baseScopes === 'imap')))) {
+            accountData.imapIndexer = (await settings.get('imapIndexer')) || 'full';
+        }
+
+        const runIndex = await this.call({
+            cmd: 'runIndex'
+        });
+
+        let pipeline = this.redis
             .multi()
             .hgetall(this.getAccountKey())
             .hmset(this.getAccountKey(), this.serializeAccountData(accountData))
             .hsetnx(this.getAccountKey(), 'state', 'init')
-            .sadd('ia:accounts', this.account)
-            .exec();
+            .hsetnx(this.getAccountKey(), 'runIndex', runIndex.toString())
+            .hsetnx(this.getAccountKey(), `state:count:connected`, '0')
+            .sadd(`${REDIS_PREFIX}ia:accounts`, this.account);
+
+        if (accountData.oauth2 && accountData.oauth2.provider) {
+            pipeline = pipeline.sadd(`${REDIS_PREFIX}oapp:a:${accountData.oauth2.provider}`, this.account);
+            if (accountData.oauth2.auth?.user) {
+                // check if already exists
+                let existingAppBinding = await this.redis.hget(
+                    `${REDIS_PREFIX}oapp:h:${accountData.oauth2.provider}`,
+                    accountData.oauth2.auth?.user?.toLowerCase()
+                );
+                if (existingAppBinding && existingAppBinding !== this.account) {
+                    let existingAccount;
+                    try {
+                        existingAccount = await this.loadAccountData(existingAppBinding);
+                    } catch (err) {
+                        // account not found
+                    }
+
+                    if (existingAccount?.oauth2?.auth?.user === accountData.oauth2.auth?.user) {
+                        let message = 'Another account for the same OAuth2 user already exists';
+                        let error = Boom.boomify(new Error(message), { statusCode: 400 });
+                        error.output.payload.code = 'AccountAlreadyExists';
+                        error.output.payload.existingAccount = existingAppBinding;
+                        throw error;
+                    }
+                }
+
+                pipeline = pipeline.hset(`${REDIS_PREFIX}oapp:h:${accountData.oauth2.provider}`, accountData.oauth2.auth?.user?.toLowerCase(), this.account);
+            }
+        }
+
+        let result = await pipeline.exec();
 
         if (!result || !result[1] || result[1][0] || result[1][1] !== 'OK') {
             let message = 'Something went wrong';
@@ -317,38 +1105,75 @@ class Account {
         if (result[0][1] && result[0][1].account) {
             // existing user
             state = 'existing';
-            await this.call({ cmd: 'update', account: this.account });
+
+            try {
+                let oldAccountData = this.unserializeAccountData(result[0][1]);
+                if (oldAccountData?.oauth2?.provider && oldAccountData?.oauth2?.auth?.user && oldAccountData.oauth2.provider !== accountData.oauth2?.provider) {
+                    // remove previous entry if provider was updated
+                    await this.redis.hdel(`${REDIS_PREFIX}oapp:h:${oldAccountData.oauth2.provider}`, oldAccountData.oauth2.auth?.user?.toLowerCase());
+                }
+            } catch (err) {
+                // ignore
+            }
+
+            await this.call({
+                cmd: 'update',
+                account: this.account,
+                timeout: this.timeout
+            });
         } else {
             state = 'new';
-            await this.call({ cmd: 'new', account: this.account });
+            await this.call({
+                cmd: 'new',
+                account: this.account,
+                timeout: this.timeout
+            });
         }
 
         return { account: this.account, state };
     }
 
     async delete() {
-        await this.loadAccountData(this.account);
+        let accountData = await this.loadAccountData(this.account);
+
+        const dateKeyTdy = new Date().toISOString().substring(0, 10).replace(/-/g, '');
+        const dateKeyYdy = new Date(Date.now() - 24 * 3600 * 1000).toISOString().substring(0, 10).replace(/-/g, '');
+
+        const tombstoneTdy = `${REDIS_PREFIX}tomb:${this.account}:${dateKeyTdy}`;
+        const tombstoneYdy = `${REDIS_PREFIX}tomb:${this.account}:${dateKeyYdy}`;
 
-        let result = await this.redis
+        let pipeline = this.redis
             .multi()
             .del(this.getAccountKey())
-            .keys(`iam:${this.account}:*`)
-            .srem('ia:accounts', this.account)
-            .del(`ial:${this.account}`) // mailbox list
-            .del(`iah:${this.account}`) // mailbox list for ID references
-            .del(`iar:b:${this.account}`) // bounce list
-            .del(`iaq:${this.account}`) // delayed message queue
-            .exec();
-
-        if (result && result[1] && result[1][1] && result[1][1].length) {
-            // delete all mailbox specific keys
-            let run = await this.redis.multi();
-            for (let key of result[1][1]) {
-                run = run.del(key);
+            .srem(`${REDIS_PREFIX}ia:accounts`, this.account)
+            .del(this.getMailboxListKey()) // mailbox list
+            .del(this.getMailboxHashKey()) // mailbox list for ID references
+            .del(`${REDIS_PREFIX}iar:b:${this.account}`) // bounce list
+            .del(`${REDIS_PREFIX}iar:s:${this.account}`) // seen messages list
+            .del(`${REDIS_PREFIX}iaq:${this.account}`) // delayed message queue
+            .del(`${REDIS_PREFIX}iat:${this.account}`) // access tokens
+            .del(`${REDIS_PREFIX}iac:${this.account}`) // cache hash
+            .del(`${REDIS_PREFIX}iap:${this.account}`) // external event notification queue
+
+            .del(tombstoneTdy)
+            .del(tombstoneYdy)
+
+            .del(`${REDIS_PREFIX}tpl:${this.account}:i`) // stored templates index
+            .del(`${REDIS_PREFIX}tpl:${this.account}:c`); // stored templates index
+
+        if (accountData.oauth2?.provider) {
+            pipeline = pipeline.srem(`${REDIS_PREFIX}oapp:a:${accountData.oauth2.provider}`, this.account);
+            if (accountData.oauth2?.auth?.user) {
+                pipeline = pipeline.hdel(`${REDIS_PREFIX}oapp:h:${accountData.oauth2.provider}`, accountData.oauth2.auth?.user?.toLowerCase());
             }
-            await run.exec();
         }
 
+        let result = await pipeline.exec();
+
+        // scan and delete keys
+        // should we wait though? might take a lot of time
+        await redisScanDelete(this.redis, this.logger, `${REDIS_PREFIX}iam:${this.account}:*`);
+
         if (!result || !result[0] || !result[0][1]) {
             return {
                 account: this.account,
@@ -356,7 +1181,35 @@ class Account {
             };
         }
 
-        await this.call({ cmd: 'delete', account: this.account });
+        try {
+            let queueKeep = (await settings.get('queueKeep')) || true;
+            let serviceUrl = (await settings.get('serviceUrl')) || null;
+
+            let payload = {
+                serviceUrl,
+                account: this.account,
+                date: new Date().toISOString(),
+                event: ACCOUNT_DELETED_NOTIFY
+            };
+
+            await this.documentsQueue.add(ACCOUNT_DELETED_NOTIFY, payload, {
+                removeOnComplete: queueKeep,
+                removeOnFail: queueKeep,
+                attempts: 10,
+                backoff: {
+                    type: 'exponential',
+                    delay: 5000
+                }
+            });
+        } catch (err) {
+            this.logger.error({ msg: 'Failed to add entry to documents queue', err });
+        }
+
+        await this.call({
+            cmd: 'delete',
+            account: this.account,
+            timeout: this.timeout
+        });
 
         return {
             account: this.account,
@@ -370,7 +1223,16 @@ class Account {
         const { port1, port2 } = new MessageChannel();
         const stream = new MessagePortReadable(port1);
 
-        let streamCreated = await this.call({ cmd: 'getRawMessage', account: this.account, message, port: port2 }, [port2]);
+        let streamCreated = await this.call(
+            {
+                cmd: 'getRawMessage',
+                account: this.account,
+                message,
+                timeout: this.timeout,
+                port: port2
+            },
+            [port2]
+        );
 
         if (streamCreated && streamCreated.headers) {
             stream.headers = streamCreated.headers;
@@ -385,8 +1247,17 @@ class Account {
         const { port1, port2 } = new MessageChannel();
         const stream = new MessagePortReadable(port1);
 
-        let streamCreated = await this.call({ cmd: 'getAttachment', account: this.account, attachment, port: port2 }, [port2]);
-
+        let streamCreated = await this.call(
+            {
+                cmd: 'getAttachment',
+                account: this.account,
+                attachment,
+                timeout: this.timeout,
+                port: port2
+            },
+            [port2]
+        );
+
         if (streamCreated && streamCreated.headers) {
             stream.headers = streamCreated.headers;
         }
@@ -394,169 +1265,1522 @@ class Account {
         return stream;
     }
 
-    async getMailboxListing() {
-        await this.loadAccountData(this.account, true);
+    async getMailboxListing(query) {
+        let accountData = await this.loadAccountData(this.account, false);
 
-        let result = [];
+        let mailboxListing;
+        if (await this.isApiClient(accountData)) {
+            mailboxListing = await this.listMailboxes(query);
+
+            if (mailboxListing && mailboxListing.error) {
+                let error = Boom.boomify(new Error(mailboxListing.error), { statusCode: mailboxListing.statusCode || 500 });
+                if (mailboxListing.code) {
+                    error.output.payload.code = mailboxListing.code;
+                }
+                throw error;
+            }
+
+            // just pass through, do nothing
+            return mailboxListing;
+        } else if (accountData.state === 'connected' || query.counters) {
+            // run LIST
+            mailboxListing = await this.listMailboxes(query);
+            if (mailboxListing && mailboxListing.error) {
+                let error = Boom.boomify(new Error(mailboxListing.error), { statusCode: mailboxListing.statusCode || 500 });
+                if (mailboxListing.code) {
+                    error.output.payload.code = mailboxListing.code;
+                }
+                throw error;
+            }
+        } else if (accountData.state === 'unset') {
+            // account has not been set up yet
+            let error = Boom.boomify(new Error('Syncing is disabled for the requested account'), { statusCode: 503 });
+            if (accountData.state) {
+                error.output.payload.state = accountData.state;
+            }
+            error.output.payload.code = 'NotSyncing';
+            throw error;
+        } else if (accountData.state === 'init' || !(await this.redis.exists(this.getMailboxListKey()))) {
+            // account has not been set up yet
+            let error = Boom.boomify(new Error('Requested account is not yet initialized'), { statusCode: 503 });
+            if (accountData.state) {
+                error.output.payload.state = accountData.state;
+            }
+            error.output.payload.code = 'NotYetConnected';
+            throw error;
+        }
+
+        let mailboxes = [];
         let storedListing = await this.redis.hgetallBuffer(this.getMailboxListKey());
 
         for (let path of Object.keys(storedListing || {})) {
             try {
                 let decoded = msgpack.decode(storedListing[path]);
-                if (decoded.delimiter && decoded.path.indexOf(decoded.delimiter) >= 0) {
+
+                if (decoded.path && decoded.delimiter && decoded.path.indexOf(decoded.delimiter) >= 0) {
                     decoded.parentPath = decoded.path.substr(0, decoded.path.lastIndexOf(decoded.delimiter));
                 }
-                delete decoded.delimiter;
-                result.push(Object.assign(decoded, await this.getMailboxInfo(path)));
+
+                let listedMailboxInfo;
+                if (mailboxListing) {
+                    listedMailboxInfo = mailboxListing.find(entry => entry.path === path);
+                    if (listedMailboxInfo && listedMailboxInfo.status) {
+                        delete listedMailboxInfo.status.path;
+                    }
+                }
+
+                mailboxes.push(
+                    Object.assign(
+                        decoded,
+                        await this.getMailboxInfo(path),
+                        listedMailboxInfo && listedMailboxInfo.status
+                            ? {
+                                  status: listedMailboxInfo.status
+                              }
+                            : {}
+                    )
+                );
             } catch (err) {
                 // should not happen
-                this.logger.error(err);
+                if (logger.notifyError) {
+                    logger.notifyError(err, event => {
+                        if (this.account) {
+                            event.setUser(this.account);
+                        }
+
+                        event.addMetadata('ee', {
+                            path,
+                            mailboxListing: typeof mailboxListing
+                        });
+                    });
+                }
+
+                let message = 'Failed to process stored mailbox listing';
+                this.logger.error({ msg: message, path, mailboxListing: typeof mailboxListing, account: this.account, err });
+                let error = Boom.boomify(new Error(message), { statusCode: 503 });
+                error.output.payload.code = err.code;
+                throw error;
             }
         }
 
-        return result;
+        return mailboxes;
     }
 
     async updateMessage(message, updates) {
         await this.loadAccountData(this.account, true);
 
-        return await this.call({ cmd: 'updateMessage', account: this.account, message, updates });
+        return await this.call({
+            cmd: 'updateMessage',
+            account: this.account,
+            message,
+            updates,
+            timeout: this.timeout
+        });
     }
 
-    async moveMessage(message, target) {
+    async updateMessages(path, search, updates) {
         await this.loadAccountData(this.account, true);
-        return await this.call({ cmd: 'moveMessage', account: this.account, message, target });
+
+        return await this.call({
+            cmd: 'updateMessages',
+            account: this.account,
+            path,
+            search,
+            updates,
+            timeout: this.timeout
+        });
+    }
+
+    async listMailboxes(query) {
+        let options = {};
+        if (query && query.counters) {
+            options.statusQuery = {
+                messages: true,
+                unseen: true
+            };
+        }
+        let x = await this.call({
+            cmd: 'listMailboxes',
+            account: this.account,
+            options,
+            timeout: this.timeout
+        });
+
+        return x;
+    }
+
+    async moveMessage(message, target, options) {
+        await this.loadAccountData(this.account, true);
+        return await this.call({
+            cmd: 'moveMessage',
+            account: this.account,
+            message,
+            target,
+            options,
+            timeout: this.timeout
+        });
+    }
+
+    async moveMessages(source, search, target) {
+        await this.loadAccountData(this.account, true);
+        return await this.call({
+            cmd: 'moveMessages',
+            account: this.account,
+            source,
+            search,
+            target,
+            timeout: this.timeout
+        });
     }
 
     async deleteMessage(message, force) {
         await this.loadAccountData(this.account, true);
 
-        return await this.call({ cmd: 'deleteMessage', account: this.account, message, force });
+        return await this.call({
+            cmd: 'deleteMessage',
+            account: this.account,
+            message,
+            force,
+            timeout: this.timeout
+        });
+    }
+
+    async deleteMessages(path, search, force) {
+        await this.loadAccountData(this.account, true);
+
+        return await this.call({
+            cmd: 'deleteMessages',
+            account: this.account,
+            path,
+            search,
+            force,
+            timeout: this.timeout
+        });
+    }
+
+    async getQuota() {
+        await this.loadAccountData(this.account, true);
+
+        return await this.call({
+            cmd: 'getQuota',
+            account: this.account,
+            timeout: this.timeout
+        });
     }
 
     async createMailbox(path) {
         await this.loadAccountData(this.account, true);
 
-        return await this.call({ cmd: 'createMailbox', account: this.account, path });
+        return await this.call({
+            cmd: 'createMailbox',
+            account: this.account,
+            path,
+            timeout: this.timeout
+        });
+    }
+
+    async modifyMailbox(path, newPath, subscribed) {
+        await this.loadAccountData(this.account, true);
+
+        return await this.call({
+            cmd: 'modifyMailbox',
+            account: this.account,
+            path,
+            newPath,
+            subscribed,
+            timeout: this.timeout
+        });
     }
 
     async deleteMailbox(path) {
         await this.loadAccountData(this.account, true);
 
-        return await this.call({ cmd: 'deleteMailbox', account: this.account, path });
+        return await this.call({
+            cmd: 'deleteMailbox',
+            account: this.account,
+            path,
+            timeout: this.timeout
+        });
     }
 
     async getText(text, options) {
+        if (options.documentStore && (await settings.get('documentStoreEnabled'))) {
+            await this.loadAccountData(this.account, false);
+
+            const { index, client } = this.esClient;
+
+            let buf = Buffer.from(text, 'base64url');
+            let message = buf.subarray(0, 8).toString('base64url');
+
+            let getResult = await client.get({
+                index,
+                id: `${this.account}:${message}`
+            });
+
+            this.logger.trace({
+                msg: 'Executed ES query',
+                query: { type: 'get', index, id: `${this.account}:${message}` },
+                results: getResult && getResult._source ? 1 : 0
+            });
+
+            if (!getResult || !getResult._source) {
+                let message = 'Requested message was not found';
+                let error = Boom.boomify(new Error(message), { statusCode: 404 });
+                throw error;
+            }
+
+            let messageData = getResult._source;
+            let response = {};
+
+            response.hasMore = false;
+            for (let textType of Object.keys(messageData.text || {})) {
+                if (['plain', 'html'].includes(textType) && (options.textType === '*' || options.textType === textType)) {
+                    if (options.maxBytes && messageData.text[textType].length > options.maxBytes) {
+                        response[textType] = messageData.text[textType].substring(0, options.maxBytes);
+                        response.hasMore = true;
+                    } else {
+                        response[textType] = messageData.text[textType];
+                    }
+                }
+            }
+
+            return response;
+        }
+
         await this.loadAccountData(this.account, true);
 
-        return await this.call({ cmd: 'getText', account: this.account, text, options });
+        return await this.call({
+            cmd: 'getText',
+            account: this.account,
+            text,
+            options,
+            timeout: this.timeout
+        });
     }
 
     async getMessage(message, options) {
+        if (options.webSafeHtml) {
+            options.textType = '*';
+            options.embedAttachedImages = true;
+            options.preProcessHtml = true;
+        }
+
+        if (options.documentStore && (await settings.get('documentStoreEnabled'))) {
+            await this.loadAccountData(this.account, false);
+
+            const { index, client } = this.esClient;
+
+            const reqOpts = {
+                index,
+                id: `${this.account}:${message}`,
+                _source_excludes: 'preview,seemsLikeNew,account,created,updateTime'
+            };
+
+            switch (options.textType) {
+                case '*':
+                    break;
+                case 'html':
+                    reqOpts._source_excludes += ',text.plain';
+                    break;
+                case 'plain':
+                    reqOpts._source_excludes += ',text.html,text._generatedHtml';
+                    break;
+                default:
+                    reqOpts._source_excludes += ',text.plain,text.html,text._generatedHtml';
+            }
+
+            let getResult = await client.get(reqOpts);
+
+            this.logger.trace({
+                msg: 'Executed ES query',
+                query: { type: 'get', index, id: `${this.account}:${message}` },
+                results: getResult && getResult._source ? 1 : 0
+            });
+
+            if (!getResult || !getResult._source) {
+                let message = 'Requested message was not found';
+                let error = Boom.boomify(new Error(message), { statusCode: 404 });
+                throw error;
+            }
+
+            let messageData = getResult._source;
+
+            // restore headers and text object as per the API response
+            let headersObj = {};
+            for (let { key, value } of messageData.headers) {
+                headersObj[key] = value;
+            }
+            messageData.headers = headersObj;
+
+            if (messageData.text && (messageData.text.html || messageData.text.plain)) {
+                messageData.text.hasMore = false;
+
+                for (let textType of Object.keys(messageData.text || {})) {
+                    if (['plain', 'html'].includes(textType) && options.maxBytes && messageData.text[textType].length > options.maxBytes) {
+                        messageData.text[textType] = messageData.text[textType].substring(0, options.maxBytes);
+                        messageData.text.hasMore = true;
+                    }
+                }
+            }
+
+            for (let key of ['unseen', 'flagged', 'answered', 'draft']) {
+                if (messageData[key] === false) {
+                    delete messageData[key];
+                }
+            }
+
+            if (options.preProcessHtml && messageData.text && (messageData.text.html || messageData.text.plain)) {
+                // If available, use the cached version
+                messageData.text.html =
+                    messageData.text._generatedHtml ||
+                    mimeHtml({
+                        html: messageData.text.html,
+                        text: messageData.text.plain
+                    });
+                messageData.text.webSafe = true;
+                messageData.text._cachedWebSafe = !!messageData.text._generatedHtml;
+            }
+
+            if (options.embedAttachedImages && messageData.text && messageData.text.html && messageData.attachments && messageData.attachments.length) {
+                let attachmentsToDownload = [];
+
+                // first pass, find attachments to inline
+                messageData.text.html.replace(/\bcid:([^"'\s>]+)/g, (fullMatch, cidMatch) => {
+                    let attachment = messageData.attachments.find(attachment => [`<${cidMatch}>`, cidMatch].includes(attachment.contentId));
+                    if (attachment && !attachment.content) {
+                        attachmentsToDownload.push(attachment);
+                    }
+                });
+
+                // download large inline attachments not stored in ES
+                for (let attachment of attachmentsToDownload) {
+                    try {
+                        let downloadStream = await this.getAttachment(attachment.id);
+                        if (downloadStream) {
+                            let content = await download(downloadStream);
+                            this.logger.trace({ msg: 'Fetched attachment content', account: this.account, attachment, size: content.length });
+                            attachment.content = content.toString('base64');
+                        }
+                    } catch (err) {
+                        this.logger.error({ msg: 'Failed to fetch attachment content', account: this.account, attachment, err });
+                    }
+                }
+
+                // second pass, replace placeholders with inline attachments
+                messageData.text.html = messageData.text.html.replace(/\bcid:([^"'\s>]+)/g, (fullMatch, cidMatch) => {
+                    let attachment = messageData.attachments.find(attachment => [`<${cidMatch}>`, cidMatch].includes(attachment.contentId));
+                    if (attachment && attachment.content) {
+                        return `data:${attachment.contentType || 'application/octet-stream'};base64,${attachment.content}`;
+                    }
+                    return fullMatch;
+                });
+            }
+
+            if (messageData.text && messageData.text._generatedHtml) {
+                // remove cached pre-processed HTML from output
+                delete messageData.text._generatedHtml;
+            }
+
+            // Add event file content if the attachment exists
+            if (messageData.calendarEvents) {
+                for (let calendarEvent of messageData.calendarEvents) {
+                    if (!calendarEvent.content && calendarEvent.attachment) {
+                        let attachment = messageData.attachments && messageData.attachments.find(attachment => attachment.id === calendarEvent.attachment);
+                        if (attachment && attachment.content) {
+                            calendarEvent.encoding = 'base64';
+                            calendarEvent.content = attachment.content;
+                        }
+                    }
+                }
+            }
+
+            if (messageData.attachments) {
+                for (let attachment of messageData.attachments) {
+                    delete attachment.content;
+                }
+            }
+
+            if (options.markAsSeen && (!messageData.flags || !messageData.flags.includes('\\Seen'))) {
+                // mark message as seen
+                messageData.flags.push('\\Seen');
+                // do not wait until the update is completed, return immediately
+                this.updateMessage(message, { flags: { add: ['\\Seen'] } }).catch(err => {
+                    this.logger.error({ msg: 'Failed to mark message as Seen', message, err });
+                });
+            }
+
+            if (messageData.specialUse && !messageData.messageSpecialUse) {
+                for (let specialUseTag of ['\\Junk', '\\Sent', '\\Trash', '\\Inbox', '\\Drafts']) {
+                    if (messageData.specialUse === specialUseTag || (messageData.labels && messageData.labels.includes(specialUseTag))) {
+                        messageData.messageSpecialUse = specialUseTag;
+                        break;
+                    }
+                }
+            }
+
+            return messageData;
+        }
+
         await this.loadAccountData(this.account, true);
 
-        let messageData = await this.call({ cmd: 'getMessage', account: this.account, message, options });
+        let messageData = await this.call({
+            cmd: 'getMessage',
+            account: this.account,
+            message,
+            options,
+            timeout: this.timeout
+        });
+
         if (!messageData) {
             let message = 'Requested message was not found';
             let error = Boom.boomify(new Error(message), { statusCode: 404 });
             throw error;
         }
+
         return messageData;
     }
 
     async listMessages(query) {
-        await this.loadAccountData(this.account, true);
+        if (query.documentStore && (await settings.get('documentStoreEnabled'))) {
+            await this.loadAccountData(this.account, false);
+
+            const { index, client } = this.esClient;
+
+            let inboxData = await this.redis.hgetBuffer(this.getMailboxListKey(), 'INBOX');
+            let delimiter;
+            if (inboxData) {
+                try {
+                    inboxData = msgpack.decode(inboxData);
+                    delimiter = inboxData.delimiter;
+                } catch (err) {
+                    delimiter = '/'; // hope for the best
+                    inboxData = false;
+                }
+            }
 
-        let path = normalizePath(query.path);
-        let encodedMailboxData = await this.redis.hgetBuffer(this.getMailboxListKey(), path);
-        if (!encodedMailboxData) {
-            let message = 'Mailbox record was not found';
-            let error = Boom.boomify(new Error(message), { statusCode: 404 });
-            error.output.payload.path = query.path;
-            throw error;
+            inboxData = inboxData || {
+                path: 'INBOX',
+                delimiter
+            };
+
+            inboxData.specialUse = inboxData.specialUse || '\\Inbox';
+
+            let path = normalizePath(query.path, delimiter);
+            let mailboxData = path === 'INBOX' ? inboxData : false;
+            if (!mailboxData) {
+                mailboxData = await this.redis.hgetBuffer(this.getMailboxListKey(), path);
+                if (mailboxData) {
+                    try {
+                        mailboxData = msgpack.decode(mailboxData);
+                    } catch (err) {
+                        mailboxData = false;
+                    }
+                }
+            }
+
+            let searchQuery = {
+                bool: {
+                    must: [
+                        {
+                            term: {
+                                account: this.account
+                            }
+                        }
+                    ]
+                }
+            };
+
+            searchQuery.bool.must.push({
+                bool: {
+                    should: [
+                        {
+                            term: {
+                                path
+                            }
+                        },
+                        {
+                            term: {
+                                labels: (mailboxData && mailboxData.specialUse) || path
+                            }
+                        }
+                    ],
+                    minimum_should_match: 1
+                }
+            });
+
+            let page = Number(query.page) || 0;
+            let pageSize = Math.abs(Number(query.pageSize) || 20);
+
+            if (page < 0) {
+                page = 0;
+            }
+
+            let searchResult = await client.search({
+                index,
+                size: pageSize,
+                from: pageSize * page,
+                query: searchQuery,
+                sort: { uid: 'desc' },
+                _source_excludes: 'headers,text.plain,text.html,text._generatedHtml,seemsLikeNew,attachments.content,summary,riskAssessment,updateTime'
+            });
+
+            this.logger.trace({
+                msg: 'Executed ES query',
+                query: { type: 'search', index, size: pageSize, from: pageSize * page, query: searchQuery, sort: { uid: 'desc' } },
+                results: searchResult.hits.total.value
+            });
+
+            let response = {
+                total: searchResult.hits.total.value,
+                page,
+                pages: Math.max(Math.ceil(searchResult.hits.total.value / pageSize), 1),
+                messages: searchResult.hits.hits.map(entry => {
+                    let messageData = entry._source;
+
+                    // normalize as per the API response
+
+                    for (let key of ['unseen', 'flagged', 'answered', 'draft']) {
+                        if (messageData[key] === false) {
+                            messageData[key] = undefined;
+                        }
+                    }
+
+                    for (let key of ['account', 'created', 'specialUse']) {
+                        if (messageData[key]) {
+                            messageData[key] = undefined;
+                        }
+                    }
+
+                    return messageData;
+                })
+            };
+
+            return response;
         }
 
-        // mailbox seems to exist, so call parent to resolve open connection
-        return await this.call(Object.assign({ cmd: 'listMessages', account: this.account }, query));
+        await this.loadAccountData(this.account, true);
+
+        return await this.call(
+            Object.assign(
+                {
+                    cmd: 'listMessages',
+                    account: this.account
+                },
+                query,
+                { timeout: this.timeout }
+            )
+        );
     }
 
-    async buildContacts() {
+    async searchMessages(query, searchOpts) {
+        searchOpts = searchOpts || {};
+        if (query.documentStore && (await settings.get('documentStoreEnabled'))) {
+            if (!searchOpts.unified) {
+                await this.loadAccountData(this.account, false);
+            }
+
+            const { index, client } = this.esClient;
+
+            let searchQuery = {
+                bool: {
+                    must: []
+                }
+            };
+
+            if (this.account) {
+                searchQuery.bool.must.push({
+                    term: {
+                        account: this.account
+                    }
+                });
+            }
+
+            if (searchOpts.unified && query.accounts && query.accounts.length) {
+                searchQuery.bool.must.push({
+                    bool: {
+                        should: query.accounts.map(account => ({
+                            term: {
+                                account
+                            }
+                        })),
+                        minimum_should_match: 1
+                    }
+                });
+            }
+
+            if (query.path) {
+                let inboxData = await this.redis.hgetBuffer(this.getMailboxListKey(), 'INBOX');
+                let delimiter;
+
+                if (inboxData) {
+                    try {
+                        inboxData = msgpack.decode(inboxData);
+                        delimiter = inboxData.delimiter;
+                    } catch (err) {
+                        delimiter = '/'; // hope for the best
+                        inboxData = false;
+                    }
+                }
+
+                inboxData = inboxData || {
+                    path: 'INBOX',
+                    delimiter
+                };
+
+                inboxData.specialUse = inboxData.specialUse || '\\Inbox';
+
+                let path = normalizePath(query.path, delimiter);
+                let mailboxData = path === 'INBOX' ? inboxData : false;
+                if (!mailboxData) {
+                    mailboxData = await this.redis.hgetBuffer(this.getMailboxListKey(), path);
+                    if (mailboxData) {
+                        try {
+                            mailboxData = msgpack.decode(mailboxData);
+                        } catch (err) {
+                            mailboxData = false;
+                        }
+                    }
+                }
+
+                searchQuery.bool.must.push({
+                    bool: {
+                        should: [
+                            {
+                                term: {
+                                    path
+                                }
+                            },
+                            {
+                                term: {
+                                    labels: (mailboxData && mailboxData.specialUse) || path
+                                }
+                            }
+                        ],
+                        minimum_should_match: 1
+                    }
+                });
+            }
+
+            if (searchOpts.unified && query.paths && query.paths.length) {
+                searchQuery.bool.must.push({
+                    bool: {
+                        should: query.paths.flatMap(path => {
+                            let res = [
+                                {
+                                    term: {
+                                        path
+                                    }
+                                },
+                                {
+                                    term: {
+                                        labels: path
+                                    }
+                                },
+                                {
+                                    term: {
+                                        messageSpecialUse: path
+                                    }
+                                }
+                            ];
+
+                            if (/^inbox$/i.test(path)) {
+                                res.push({
+                                    term: {
+                                        messageSpecialUse: '\\Inbox'
+                                    }
+                                });
+                            }
+
+                            return res;
+                        }),
+                        minimum_should_match: 1
+                    }
+                });
+            }
+
+            for (let key of ['answered', 'deleted', 'draft', 'unseen', 'flagged']) {
+                if (typeof query.search[key] === 'boolean') {
+                    searchQuery.bool.must.push({
+                        term: {
+                            [key]: query.search[key]
+                        }
+                    });
+                }
+            }
+
+            if (typeof query.search.seen === 'boolean') {
+                searchQuery.bool.must.push({
+                    term: {
+                        unseen: !query.search.seen
+                    }
+                });
+            }
+
+            for (let key of ['from', 'to', 'cc', 'bcc']) {
+                if (query.search[key]) {
+                    searchQuery.bool.must.push({
+                        bool: {
+                            should: [
+                                {
+                                    match: {
+                                        [`${key}.name`]: {
+                                            query: query.search[key],
+                                            operator: 'and'
+                                        }
+                                    }
+                                },
+                                {
+                                    term: {
+                                        [`${key}.address`]: query.search[key]
+                                    }
+                                }
+                            ],
+                            minimum_should_match: 1
+                        }
+                    });
+                }
+            }
+
+            if (query.search.uid) {
+                let uidEntries = unpackUIDRangeForSearch(query.search.uid);
+                if (uidEntries && uidEntries.length) {
+                    let mustList = [];
+                    for (let entry of uidEntries) {
+                        if (typeof entry === 'number') {
+                            mustList.push({
+                                match: {
+                                    uid: {
+                                        query: entry,
+                                        operator: 'and'
+                                    }
+                                }
+                            });
+                        } else if (typeof entry === 'object') {
+                            mustList.push({
+                                range: {
+                                    uid: entry
+                                }
+                            });
+                        }
+                    }
+
+                    if (mustList.length) {
+                        searchQuery.bool.must.push({
+                            bool: {
+                                should: mustList,
+                                minimum_should_match: 1
+                            }
+                        });
+                    }
+                }
+            }
+
+            for (let key of ['emailId', 'threadId']) {
+                if (query.search[key]) {
+                    searchQuery.bool.must.push({
+                        term: {
+                            [key]: query.search[key]
+                        }
+                    });
+                }
+            }
+
+            if (query.search.subject) {
+                searchQuery.bool.must.push({
+                    match: {
+                        subject: {
+                            query: query.search.subject,
+                            operator: 'and'
+                        }
+                    }
+                });
+            }
+
+            if (query.search.body) {
+                searchQuery.bool.must.push({
+                    bool: {
+                        should: [
+                            {
+                                match: {
+                                    'text.plain': {
+                                        query: query.search.body,
+                                        operator: 'and'
+                                    }
+                                }
+                            },
+                            {
+                                match: {
+                                    'text.html': {
+                                        query: query.search.body,
+                                        operator: 'and'
+                                    }
+                                }
+                            }
+                        ],
+                        minimum_should_match: 1
+                    }
+                });
+            }
+
+            let dateMatch = {};
+
+            for (let key of ['before', 'sentBefore']) {
+                if (query.search[key]) {
+                    dateMatch.lte = query.search[key];
+                }
+            }
+
+            for (let key of ['since', 'sentSince']) {
+                if (query.search[key]) {
+                    dateMatch.gte = query.search[key];
+                }
+            }
+
+            if (Object.keys(dateMatch).length) {
+                searchQuery.bool.must.push({
+                    range: { date: dateMatch }
+                });
+            }
+
+            let sizeMatch = {};
+
+            if (query.search.larger) {
+                dateMatch.gte = query.search.larger;
+            }
+
+            if (query.search.smaller) {
+                dateMatch.lte = query.search.smaller;
+            }
+
+            if (Object.keys(sizeMatch).length) {
+                searchQuery.bool.must.push({
+                    range: { size: sizeMatch }
+                });
+            }
+
+            // headers, nested query
+            if (Object.keys(query.search.header || {}).length) {
+                Object.keys(query.search.header).forEach(header => {
+                    searchQuery.bool.must.push({
+                        nested: {
+                            path: 'headers',
+                            query: {
+                                bool: {
+                                    must: [
+                                        {
+                                            term: {
+                                                'headers.key': header.toLowerCase()
+                                            }
+                                        },
+                                        {
+                                            match: {
+                                                'headers.value': {
+                                                    query: (query.search.header[header] || '').toString(),
+                                                    operator: 'and'
+                                                }
+                                            }
+                                        }
+                                    ]
+                                }
+                            }
+                        }
+                    });
+                });
+            }
+
+            if (query.documentQuery) {
+                searchQuery.bool.must.push(query.documentQuery);
+            }
+
+            let page = Number(query.page) || 0;
+            let pageSize = Math.abs(Number(query.pageSize) || 20);
+
+            if (page < 0) {
+                page = 0;
+            }
+
+            let searchResult = await client.search({
+                index,
+                size: pageSize,
+                from: pageSize * page,
+                query: searchQuery,
+                sort: { [!searchOpts.unified ? 'uid' : 'date']: 'desc' },
+                _source_excludes: 'headers,text.plain,text.html,text._generatedHtml,seemsLikeNew,attachments.content,summary,riskAssessment,updateTime'
+            });
+
+            this.logger.trace({
+                msg: 'Executed ES query',
+                query: { type: 'search', index, size: pageSize, from: pageSize * page, query: searchQuery, sort: { uid: 'desc' } },
+                results: searchResult.hits.total.value
+            });
+
+            let response = {
+                total: searchResult.hits.total.value,
+                page,
+                pages: Math.max(Math.ceil(searchResult.hits.total.value / pageSize), 1)
+            };
+
+            if (query.exposeQuery) {
+                response.documentStoreQuery = query;
+            }
+
+            if (query.accounts) {
+                response.accounts = query.accounts;
+            }
+
+            if (query.paths) {
+                response.paths = query.paths;
+            }
+
+            response.messages = searchResult.hits.hits.map(entry => {
+                let messageData = entry._source;
+
+                // normalize as per the API response
+
+                for (let key of ['unseen', 'flagged', 'answered', 'draft']) {
+                    if (messageData[key] === false) {
+                        messageData[key] = undefined;
+                    }
+                }
+
+                for (let key of ['created', 'specialUse'].concat(!searchOpts.unified ? 'account' : [])) {
+                    if (messageData[key]) {
+                        messageData[key] = undefined;
+                    }
+                }
+
+                return messageData;
+            });
+
+            return response;
+        }
+
         await this.loadAccountData(this.account, true);
-        return await this.call({ cmd: 'buildContacts', account: this.account, timeout: 5 * 60 * 1000 });
+
+        return await this.call(
+            Object.assign(
+                {
+                    cmd: 'listMessages',
+                    account: this.account
+                },
+                query,
+                { timeout: this.timeout }
+            )
+        );
     }
 
     async uploadMessage(data) {
         await this.loadAccountData(this.account, true);
 
-        let messageData = await this.call({ cmd: 'uploadMessage', account: this.account, data });
+        let messageData = await this.call({
+            cmd: 'uploadMessage',
+            account: this.account,
+            data,
+            timeout: this.timeout
+        });
         return messageData;
     }
 
     async submitMessage(data) {
-        await this.loadAccountData(this.account, true);
+        await this.loadAccountData(this.account, false);
 
         let messageData = await this.call(
             {
                 cmd: 'submitMessage',
                 account: this.account,
-                data
+                data,
+                // extended wait period when sending emails
+                timeout: Math.max(this.timeout, 10 * 60 * 1000)
             }
             //typeof data.raw === 'object' ? [data.raw] : []
         );
+
         return messageData;
     }
 
-    async queueMessage(data) {
-        await this.loadAccountData(this.account, true);
+    async queueMessage(data, meta) {
+        await this.loadAccountData(this.account, false);
 
         let messageData = await this.call(
             {
                 cmd: 'queueMessage',
                 account: this.account,
-                data
+                data,
+                meta,
+                timeout: this.timeout
             }
             //typeof data.raw === 'object' ? [data.raw] : []
         );
         return messageData;
     }
 
-    async requestReconnect(data) {
+    async listSignatures(query) {
         await this.loadAccountData(this.account, true);
 
+        return await this.call(
+            Object.assign(
+                {
+                    cmd: 'listSignatures',
+                    account: this.account
+                },
+                query,
+                { timeout: this.timeout }
+            )
+        );
+    }
+
+    async requestReconnect(data) {
+        await this.loadAccountData(this.account, false);
+
         if (data.reconnect) {
-            await this.call({ cmd: 'update', account: this.account });
+            await this.call({
+                cmd: 'reconnect',
+                account: this.account,
+                timeout: this.timeout
+            });
+            return true;
+        }
+        return false;
+    }
+
+    async requestSync(data) {
+        await this.loadAccountData(this.account, true);
+
+        if (data.sync) {
+            await this.call({
+                cmd: 'sync',
+                account: this.account,
+                timeout: this.timeout
+            });
             return true;
         }
         return false;
     }
 
-    async renewAccessToken(oauthKeys) {
+    async flush(data) {
+        await this.loadAccountData(this.account);
+
+        if (!data.flush) {
+            return false;
+        }
+
+        // use a global lock to decrease Redis scanning operations
+        let lockKey = ['flush' /*, this.account*/].join(':');
+
+        let lock = this.getLock();
+        let flushLock;
+
+        try {
+            flushLock = await lock.acquireLock(lockKey, 30 * 60 * 1000);
+            if (!flushLock.success) {
+                this.logger.error({ msg: 'Failed to get lock', lockKey });
+
+                let error = Boom.boomify(new Error('One flush operation at a time allowed, try again later'), { statusCode: 429 });
+                error.output.payload.code = 'LockFail';
+                throw error;
+            }
+        } catch (err) {
+            this.logger.error({ msg: 'Failed to get lock', lockKey, err });
+            if (Boom.isBoom) {
+                throw err;
+            }
+            let error = Boom.boomify(new Error('Failed to get flush lock, try again later'), { statusCode: 500 });
+            if (err.code) {
+                error.output.payload.code = err.code || 'LockFail';
+            }
+            throw error;
+        }
+
+        try {
+            await this.call({
+                cmd: 'pause',
+                account: this.account,
+                timeout: this.timeout
+            });
+
+            let notifyFrom = data.notifyFrom && data.notifyFrom !== 'now' ? data.notifyFrom : new Date();
+            let imapIndexer = data.imapIndexer;
+
+            const dateKeyTdy = new Date().toISOString().substring(0, 10).replace(/-/g, '');
+            const dateKeyYdy = new Date(Date.now() - 24 * 3600 * 1000).toISOString().substring(0, 10).replace(/-/g, '');
+
+            const tombstoneTdy = `${REDIS_PREFIX}tomb:${this.account}:${dateKeyTdy}`;
+            const tombstoneYdy = `${REDIS_PREFIX}tomb:${this.account}:${dateKeyYdy}`;
+
+            try {
+                let pipeline = this.redis
+                    .multi()
+                    // start syncing new messages from current time
+                    .hset(this.getAccountKey(), 'notifyFrom', notifyFrom.toISOString())
+                    // mark connection count to 0 to trigger `accountInitialized` event
+                    .hset(this.getAccountKey(), `state:count:connected`, '0')
+                    .del(this.getMailboxListKey()) // mailbox list
+                    // Note: mailbox ID hash (iah:) and listRegistry are intentionally NOT deleted
+                    // to preserve message ID stability across reconnections. Message IDs depend on
+                    // the specific mailbox ID entries, so deleting them would invalidate existing IDs.
+                    .del(`${REDIS_PREFIX}iar:b:${this.account}`) // bounce list
+                    .del(`${REDIS_PREFIX}iar:s:${this.account}`) // seen messages list
+                    .del(tombstoneTdy)
+                    .del(tombstoneYdy);
+
+                if (imapIndexer) {
+                    pipeline = pipeline.hset(this.getAccountKey(), 'imapIndexer', imapIndexer);
+                }
+
+                if (data.syncFrom || data.syncFrom === null) {
+                    pipeline = pipeline.hset(this.getAccountKey(), 'syncFrom', data.syncFrom ? data.syncFrom.toISOString() : 'null');
+                }
+
+                await pipeline.exec();
+
+                // scan and delete keys
+                await redisScanDelete(this.redis, this.logger, `${REDIS_PREFIX}iam:${this.account}:*`);
+
+                if (await settings.get('documentStoreEnabled')) {
+                    // Flush ElasticSearch index for this account
+                    const { index, client } = this.esClient;
+                    if (!client) {
+                        return;
+                    }
+
+                    let deleteResult = {};
+                    let deletedCount = 0;
+
+                    let filterQuery = {
+                        match: {
+                            account: this.account
+                        }
+                    };
+
+                    for (let indexName of [index, `${index}.threads`, `${index}.embeddings`]) {
+                        try {
+                            deleteResult[indexName] = await client.deleteByQuery({
+                                index: indexName,
+                                query: filterQuery
+                            });
+                            deletedCount += deleteResult[indexName].deleted || 0;
+                        } catch (err) {
+                            logger.error({
+                                msg: 'Failed to delete account emails from index',
+                                action: 'flush',
+                                code: 'document_delete_account_error',
+                                index: indexName,
+                                request: filterQuery,
+                                err
+                            });
+                            if (indexName === index) {
+                                throw err;
+                            }
+                        }
+                    }
+
+                    logger.trace({
+                        msg: 'Deleted account emails from index',
+                        action: 'flush',
+                        code: 'document_delete_account',
+                        deletedCount,
+                        deleteResult
+                    });
+                }
+
+                return true;
+            } finally {
+                let finalize = async () => {
+                    // Wait a bit before resuming. Just to be sure all pending processes have been completed.
+                    await new Promise(r => setTimeout(r, 5 * 1000));
+                    await this.call({
+                        cmd: 'resume',
+                        account: this.account,
+                        timeout: this.timeout
+                    });
+                };
+                finalize().catch(err => {
+                    this.logger.error({ msg: 'Failed to finish flushing', account: this.account, err });
+                });
+            }
+        } finally {
+            await lock.releaseLock(flushLock);
+        }
+    }
+
+    async renewAccessToken(oauth2Opts) {
+        let lockKey = ['oauth', this.account].join(':');
+
         let accountData = await this.loadAccountData(this.account, false);
-        let oAuth2Client = new OAuth2Client(oauthKeys.clientId, oauthKeys.clientSecret, oauthKeys.redirectUrl);
-        oAuth2Client.setCredentials({
-            access_token: accountData.oauth2.accessToken,
-            refresh_token: accountData.oauth2.refreshToken,
-            scope: accountData.oauth2.scope || 'https://mail.google.com/',
-            token_type: accountData.oauth2.tokenType || 'Bearer',
-            expiry_date: accountData.oauth2.expires
-        });
+        if (accountData.oauth2?.expires > new Date(Date.now() + 30 * 1000)) {
+            return accountData;
+        }
 
-        let r = await oAuth2Client.refreshAccessTokenAsync();
-        if (!r || !r.credentials) {
-            throw new Error('Failed to renew access tokens');
+        let lock = this.getLock();
+        let renewLock;
+
+        try {
+            renewLock = await lock.waitAcquireLock(lockKey, 5 * 60 * 1000, 1 * 60 * 1000);
+            if (!renewLock.success) {
+                this.logger.error({ msg: 'Failed to get lock', lockKey });
+                throw new Error('Failed to get renewal lock');
+            }
+        } catch (err) {
+            this.logger.error({ msg: 'Failed to get lock', lockKey, err });
+            let error = Boom.boomify(new Error('Failed to get renewal lock'), { statusCode: 500 });
+            if (err.code) {
+                error.output.payload.code = err.code || 'LockFail';
+            }
+            throw error;
         }
 
-        this.logger.info({ msg: 'Renewed oauth tokens' });
+        try {
+            let accountData = await this.loadAccountData(this.account, false);
+
+            // check if the token was already renewed
+            if (
+                accountData.oauth2 &&
+                accountData.oauth2.accessToken &&
+                accountData.oauth2.expires &&
+                accountData.oauth2.expires > new Date(Date.now() + 30 * 1000)
+            ) {
+                this.logger.info({
+                    msg: 'OAuth2 access token renewed while locked',
+                    action: 'ensureAccessToken',
+                    error: null,
+                    user: accountData.oauth2.auth.user,
+                    expires: accountData.oauth2.expires,
+                    scopes: accountData.oauth2.scope,
+                    oauth2App: accountData.oauth2.provider
+                });
+                return accountData;
+            }
 
-        accountData.oauth2 = Object.assign(accountData.oauth2 || {}, {
-            accessToken: r.credentials.access_token,
-            expires: new Date(r.credentials.expiry_date).toISOString()
-        });
+            const oAuth2Client = await oauth2Apps.getClient(accountData.oauth2.provider, oauth2Opts);
+
+            let r = await oAuth2Client.refreshToken({
+                refreshToken: accountData.oauth2.refreshToken,
+                // user is needed if it's a service account
+                user: accountData.oauth2.auth.user
+            });
+
+            if (r.tokenRequest?.userFlag) {
+                await this.update({ account: accountData.account, oauth2: { partial: true, userFlag: r.tokenRequest?.userFlag } });
+            }
+
+            if (!r.access_token) {
+                throw new Error('Failed to renew token');
+            }
+
+            let now = new Date();
 
-        await this.update({ account: accountData.account, oauth2: accountData.oauth2 });
+            let updates = {
+                accessToken: r.access_token,
+                expires: new Date(now.getTime() + r.expires_in * 1000).toISOString(),
+                generated: now.toISOString()
+            };
+
+            if (r.refresh_token) {
+                updates.refreshToken = r.refresh_token;
+                updates.refreshTokenGenerated = now.toISOString();
+            }
+
+            if (r.scope) {
+                updates.scope = r.scope.split(/\s+/);
+            }
+
+            accountData.oauth2 = Object.assign(accountData.oauth2 || {}, updates);
+            delete accountData.oauth2.userFlag;
+
+            this.logger.info({
+                msg: 'Renewed OAuth2 access token',
+                action: 'ensureAccessToken',
+                error: null,
+                user: accountData.oauth2.auth.user,
+                expires: updates.expires,
+                scopes: updates.scope,
+                oauth2App: accountData.oauth2.provider
+            });
+
+            await this.update({ account: accountData.account, oauth2: accountData.oauth2 });
+
+            return accountData;
+        } catch (err) {
+            this.logger.info({
+                msg: 'Failed to renew OAuth2 access token',
+                action: 'ensureAccessToken',
+                error: err,
+                response: err.tokenRequest && err.tokenRequest.response,
+                flag: err.tokenRequest && err.tokenRequest.flag
+            });
+
+            if (err.tokenRequest?.userFlag) {
+                await this.update({ account: this.account, oauth2: { partial: true, userFlag: err.tokenRequest?.userFlag } });
+            }
 
+            throw err;
+        } finally {
+            await lock.releaseLock(renewLock);
+        }
+    }
+
+    async invalidateAccessToken() {
+        let accountData = await this.loadAccountData(this.account, false);
+        if (accountData.oauth2) {
+            accountData.oauth2.expires = new Date(Date.now() - 24 * 3600 * 1000).toISOString();
+            await this.update({ account: accountData.account, oauth2: accountData.oauth2 });
+            this.logger.info({ msg: 'Invalidated the OAuth2 access token', expires: accountData.oauth2.expires });
+        }
         return accountData;
     }
+
+    async getActiveAccessTokenData() {
+        // throws if account does not exist
+        let accountData = await this.loadAccountData(this.account);
+        if (!accountData.oauth2 || !accountData.oauth2.auth || !accountData.oauth2.auth.user || !accountData.oauth2.provider) {
+            let error = Boom.boomify(new Error('Not an OAuth2 account'), { statusCode: 403 });
+            error.output.payload.code = 'AccountNotOAuth2';
+            throw error;
+        }
+
+        if (accountData.oauth2.useAuthServer) {
+            // resolve credentials
+
+            let authData = await resolveCredentials(this.account, 'api');
+
+            return {
+                account: accountData.account,
+                user: authData.user,
+                accessToken: authData.accessToken,
+                provider: accountData.oauth2.auth.provider,
+                registeredScopes: accountData.oauth2.scope,
+                cached: false
+            };
+        }
+
+        let now = Date.now();
+        let accessToken;
+        let cached = false;
+
+        if (!accountData.oauth2.accessToken || !accountData.oauth2.expires || accountData.oauth2.expires < new Date(now + 30 * 1000)) {
+            // renew access token
+            try {
+                await this.renewAccessToken();
+                accountData = await this.loadAccountData(this.account);
+                accessToken = accountData.oauth2.accessToken;
+            } catch (err) {
+                let error = Boom.boomify(err, { statusCode: 403 });
+                error.output.payload.code = 'OauthRenewError';
+                error.output.payload.authenticationFailed = true;
+                if (err.tokenRequest) {
+                    error.output.payload.tokenRequest = err.tokenRequest;
+                }
+                throw error;
+            }
+        } else {
+            accessToken = accountData.oauth2.accessToken;
+            cached = true;
+        }
+
+        return {
+            account: accountData.account,
+            user: accountData.oauth2.auth.user,
+            accessToken,
+            provider: accountData.oauth2.auth.provider,
+            registeredScopes: accountData.oauth2.scope,
+            expires:
+                accountData.oauth2.expires && typeof accountData.oauth2.expires.toISOString === 'function'
+                    ? accountData.oauth2.expires.toISOString()
+                    : accountData.oauth2.expires,
+            cached
+        };
+    }
+
+    async isApiClient(accountData) {
+        if (accountData.oauth2?.auth?.delegatedAccount) {
+            let delegatedAccount = await resolveDelegatedAccount(this.redis, accountData.account);
+            if (delegatedAccount) {
+                accountData.delegatedAccount = delegatedAccount;
+                let delegatedAccountRow = await this.redis.hgetall(`${REDIS_PREFIX}iad:${delegatedAccount}`);
+                let delegatedAccountData = this.unserializeAccountData(delegatedAccountRow);
+                if (delegatedAccountData?.oauth2?.provider) {
+                    let app = await oauth2Apps.get(delegatedAccountData.oauth2.provider);
+                    return app?.baseScopes === 'api';
+                } else {
+                    return false;
+                }
+            }
+        }
+
+        if (accountData.oauth2?.provider) {
+            let app = await oauth2Apps.get(accountData.oauth2.provider);
+            return app?.baseScopes === 'api';
+        }
+        return false;
+    }
+
+    async oauth2Request(url, method, payload, options) {
+        let accountData = await this.loadAccountData(this.account);
+        if (!accountData.oauth2 || !accountData.oauth2.auth || !accountData.oauth2.auth.user || !accountData.oauth2.provider) {
+            let error = Boom.boomify(new Error('Not an OAuth2 account'), { statusCode: 403 });
+            error.output.payload.code = 'AccountNotOAuth2';
+            throw error;
+        }
+
+        let oAuth2Client = await oauth2Apps.getClient(accountData.oauth2.provider, {
+            logger: this.logger
+        });
+
+        const tokenData = await this.getActiveAccessTokenData();
+        if (!tokenData?.accessToken) {
+            let error = Boom.boomify(new Error('Can not provide access token'), { statusCode: 403 });
+            error.output.payload.code = 'MissingAccessToken';
+            throw error;
+        }
+
+        if (oAuth2Client.apiBase) {
+            let urlObj = new URL(url, oAuth2Client.apiBase);
+            url = urlObj.href;
+        }
+
+        return await oAuth2Client.request(tokenData?.accessToken, url, method, payload, options);
+    }
+
+    async pushQueueEvent(event) {
+        let evObj = {
+            t: new Date(),
+            e: event
+        };
+        try {
+            let res = await this.redis.lpush(this.getExternalQueueKey(), msgpack.encode(evObj));
+
+            this.logger.debug({
+                msg: 'MS Graph subscription event',
+                type: 'event',
+                event,
+                res
+            });
+        } catch (err) {
+            this.logger.error({ msg: 'Failed to insert event to account queue', event, err });
+        }
+
+        try {
+            await this.call({ cmd: 'externalNotify', accounts: [this.account] });
+        } catch (err) {
+            logger.error({ msg: 'Failed to notify about queue changes', err });
+        }
+    }
+
+    async pullQueueEvent() {
+        let event;
+        try {
+            let evBuf = await this.redis.rpopBuffer(this.getExternalQueueKey());
+            if (evBuf) {
+                let { t, e } = msgpack.decode(evBuf);
+                event = e;
+                this.logger.debug({ msg: 'Processing event from the account queue', event, queueTime: t, queueDelay: (Date.now() - t.getTime()) / 1000 });
+            }
+        } catch (err) {
+            this.logger.error({ msg: 'Failed to pull event from the account queue', err });
+        }
+
+        return event || null;
+    }
 }
 
 module.exports = { Account };