emailengine-app 2.61.2 → 2.61.4

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [2.61.4](https://github.com/postalsys/emailengine/compare/v2.61.3...v2.61.4) (2026-01-14)
+
+
+### Bug Fixes
+
+* handle delegation errors in loadAccountData, isApiClient, and UI listing ([c306618](https://github.com/postalsys/emailengine/commit/c306618a37428bbf088ed1289bf832e778f14b9c))
+* show Failed status for accounts with IMAP disabled due to auth errors ([e6b687d](https://github.com/postalsys/emailengine/commit/e6b687d458cfd080795f7176f862109e2c299fff))
+
+## [2.61.3](https://github.com/postalsys/emailengine/compare/v2.61.2...v2.61.3) (2026-01-14)
+
+
+### Bug Fixes
+
+* prevent 500 error when listing accounts with invalid delegation config ([8651bcc](https://github.com/postalsys/emailengine/commit/8651bcc3c18cd54ee5309b3392915773c355e6c4))
+* update gettext script to include refactored UI route files ([5b2e4a5](https://github.com/postalsys/emailengine/commit/5b2e4a55771f192fb14d030b5e5d08ba860c90ab))
+
 ## [2.61.2](https://github.com/postalsys/emailengine/compare/v2.61.1...v2.61.2) (2026-01-12)
 
 

package/data/google-crawlers.json

@@ -1,5 +1,5 @@
 {
-    "creationTime": "2026-01-09T15:45:52.000000",
+    "creationTime": "2026-01-13T15:46:00.000000",
     "prefixes": [
         {
             "ipv6Prefix": "2001:4860:4801:2008::/64"

package/lib/account.js

@@ -187,23 +187,34 @@ class Account {
                 }
             } else if (accountData.oauth2 && accountData.oauth2.auth && accountData.oauth2.auth.delegatedAccount) {
                 accountData.type = 'delegated';
-                let delegatedAccount = await resolveDelegatedAccount(this.redis, accountData.account);
-                if (delegatedAccount) {
-                    accountData.delegatedAccount = delegatedAccount;
-                    let delegatedAccountRow = await this.redis.hgetall(`${REDIS_PREFIX}iad:${delegatedAccount}`);
-                    let delegatedAccountData = this.unserializeAccountData(delegatedAccountRow);
-                    if (delegatedAccountData.oauth2 && delegatedAccountData.oauth2.provider) {
-                        let app;
-                        if (oauthApps.has(delegatedAccountData.oauth2.provider)) {
-                            app = oauthApps.get(delegatedAccountData.oauth2.provider);
-                        } else {
-                            app = await oauth2Apps.get(delegatedAccountData.oauth2.provider);
-                        }
-                        oauthApps.set(delegatedAccountData.oauth2.provider, app || null);
-                        if (app && app.baseScopes === 'api') {
-                            accountData.isApi = true;
+                try {
+                    let delegatedAccount = await resolveDelegatedAccount(this.redis, accountData.account);
+                    if (delegatedAccount) {
+                        accountData.delegatedAccount = delegatedAccount;
+                        let delegatedAccountRow = await this.redis.hgetall(`${REDIS_PREFIX}iad:${delegatedAccount}`);
+                        let delegatedAccountData = this.unserializeAccountData(delegatedAccountRow);
+                        if (delegatedAccountData.oauth2 && delegatedAccountData.oauth2.provider) {
+                            let app;
+                            if (oauthApps.has(delegatedAccountData.oauth2.provider)) {
+                                app = oauthApps.get(delegatedAccountData.oauth2.provider);
+                            } else {
+                                app = await oauth2Apps.get(delegatedAccountData.oauth2.provider);
+                            }
+                            oauthApps.set(delegatedAccountData.oauth2.provider, app || null);
+                            if (app && app.baseScopes === 'api') {
+                                accountData.isApi = true;
+                            }
                         }
                     }
+                } catch (err) {
+                    this.logger.warn({
+                        msg: 'Failed to resolve delegated account',
+                        account: accountData.account,
+                        delegatedAccount: accountData.oauth2.auth.delegatedAccount,
+                        err
+                    });
+                    accountData.type = 'invalid';
+                    accountData.delegationError = err.message;
                 }
             } else if (accountData.imap && !accountData.imap.disabled) {
                 accountData.type = 'imap';
@@ -240,7 +251,9 @@ class Account {
 
                 syncTime: accountData.sync,
 
-                lastError: formatLastError(accountData)
+                lastError: formatLastError(accountData),
+
+                delegationError: accountData.delegationError || undefined
             }))
         };
 
@@ -684,20 +697,30 @@ class Account {
                 accountData._app = app;
             }
         } else if (accountData.oauth2 && accountData.oauth2.auth && accountData.oauth2.auth.delegatedAccount) {
-            let delegatedAccount = await resolveDelegatedAccount(this.redis, accountData.account);
-            if (delegatedAccount) {
-                accountData.delegatedAccount = delegatedAccount;
-                let delegatedAccountRow = await this.redis.hgetall(`${REDIS_PREFIX}iad:${delegatedAccount}`);
-                let delegatedAccountData = this.unserializeAccountData(delegatedAccountRow);
-                if (delegatedAccountData.oauth2 && delegatedAccountData.oauth2.provider) {
-                    let app = await oauth2Apps.get(delegatedAccountData.oauth2.provider);
-                    if (app) {
-                        accountData._app = app;
-                        if (app.baseScopes === 'api') {
-                            accountData.isApi = true;
+            try {
+                let delegatedAccount = await resolveDelegatedAccount(this.redis, accountData.account);
+                if (delegatedAccount) {
+                    accountData.delegatedAccount = delegatedAccount;
+                    let delegatedAccountRow = await this.redis.hgetall(`${REDIS_PREFIX}iad:${delegatedAccount}`);
+                    let delegatedAccountData = this.unserializeAccountData(delegatedAccountRow);
+                    if (delegatedAccountData.oauth2 && delegatedAccountData.oauth2.provider) {
+                        let app = await oauth2Apps.get(delegatedAccountData.oauth2.provider);
+                        if (app) {
+                            accountData._app = app;
+                            if (app.baseScopes === 'api') {
+                                accountData.isApi = true;
+                            }
                         }
                     }
                 }
+            } catch (err) {
+                this.logger.warn({
+                    msg: 'Failed to resolve delegated account',
+                    account: accountData.account,
+                    delegatedAccount: accountData.oauth2.auth.delegatedAccount,
+                    err
+                });
+                accountData.delegationError = err.message;
             }
         }
 
@@ -2532,17 +2555,22 @@ class Account {
 
     async isApiClient(accountData) {
         if (accountData.oauth2?.auth?.delegatedAccount) {
-            let delegatedAccount = await resolveDelegatedAccount(this.redis, accountData.account);
-            if (delegatedAccount) {
-                accountData.delegatedAccount = delegatedAccount;
-                let delegatedAccountRow = await this.redis.hgetall(`${REDIS_PREFIX}iad:${delegatedAccount}`);
-                let delegatedAccountData = this.unserializeAccountData(delegatedAccountRow);
-                if (delegatedAccountData?.oauth2?.provider) {
-                    let app = await oauth2Apps.get(delegatedAccountData.oauth2.provider);
-                    return app?.baseScopes === 'api';
-                } else {
-                    return false;
+            try {
+                let delegatedAccount = await resolveDelegatedAccount(this.redis, accountData.account);
+                if (delegatedAccount) {
+                    accountData.delegatedAccount = delegatedAccount;
+                    let delegatedAccountRow = await this.redis.hgetall(`${REDIS_PREFIX}iad:${delegatedAccount}`);
+                    let delegatedAccountData = this.unserializeAccountData(delegatedAccountRow);
+                    if (delegatedAccountData?.oauth2?.provider) {
+                        let app = await oauth2Apps.get(delegatedAccountData.oauth2.provider);
+                        return app?.baseScopes === 'api';
+                    } else {
+                        return false;
+                    }
                 }
+            } catch (err) {
+                // Invalid delegation config - treat as non-API client
+                return false;
             }
         }
 

package/lib/api-routes/account-routes.js

@@ -26,6 +26,17 @@ const {
 
 const { REDIS_PREFIX, MAX_FORM_TTL, NONCE_BYTES } = require('../consts');
 
+/**
+ * Validates that delegation fields are only used with OAuth2 accounts.
+ */
+function validateDelegationFields(payload) {
+    const auth = payload.oauth2?.auth;
+    const hasDelegation = auth?.delegatedUser || auth?.delegatedAccount;
+    if (hasDelegation && !payload.oauth2?.provider) {
+        throw Boom.badRequest('Delegation fields (delegatedUser, delegatedAccount) require oauth2.provider to be set');
+    }
+}
+
 async function init(args) {
     const {
         server,
@@ -110,6 +121,9 @@ async function init(args) {
                     };
                 }
 
+                // Validate delegation fields are only used with OAuth2 provider
+                validateDelegationFields(request.payload);
+
                 let result = await accountObject.create(request.payload);
                 return result;
             } catch (err) {
@@ -256,6 +270,9 @@ async function init(args) {
             });
 
             try {
+                // Validate delegation fields are only used with OAuth2 provider
+                validateDelegationFields(request.payload);
+
                 return await accountObject.update(request.payload);
             } catch (err) {
                 request.logger.error({ msg: 'API request failed', err });

package/lib/routes-ui.js

@@ -618,6 +618,15 @@ function formatAccountData(account, gt) {
             break;
     }
 
+    // Check if IMAP was disabled due to errors - override state label to show error
+    if (account.imap && account.imap.disabled && account.lastErrorState) {
+        account.stateLabel = {
+            type: 'danger',
+            name: 'Failed',
+            error: account.lastErrorState.description || account.lastErrorState.response
+        };
+    }
+
     if (account.oauth2) {
         account.oauth2.scopes = []
             .concat(account.oauth2.scope || [])
@@ -4157,13 +4166,20 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
 
             for (let account of accounts.accounts) {
                 let accountObject = new Account({ redis, account: account.account });
-                account.data = await accountObject.loadAccountData(null, null, runIndex);
+                try {
+                    account.data = await accountObject.loadAccountData(null, null, runIndex);
 
-                if (account.data && account.data.oauth2 && account.data.oauth2.provider) {
-                    let oauth2App = await oauth2Apps.get(account.data.oauth2.provider);
-                    if (oauth2App) {
-                        account.data.oauth2.app = oauth2App;
+                    if (account.data && account.data.oauth2 && account.data.oauth2.provider) {
+                        let oauth2App = await oauth2Apps.get(account.data.oauth2.provider);
+                        if (oauth2App) {
+                            account.data.oauth2.app = oauth2App;
+                        }
                     }
+                } catch (err) {
+                    // Account has invalid config (e.g., broken delegation)
+                    account.data = {
+                        delegationError: err.message
+                    };
                 }
             }
 

package/lib/ui-routes/account-routes.js

@@ -159,6 +159,15 @@ function formatAccountData(account, gt) {
             break;
     }
 
+    // Check if IMAP was disabled due to errors - override state label to show error
+    if (account.imap && account.imap.disabled && account.lastErrorState) {
+        account.stateLabel = {
+            type: 'danger',
+            name: 'Failed',
+            error: account.lastErrorState.description || account.lastErrorState.response
+        };
+    }
+
     if (account.oauth2) {
         account.oauth2.scopes = []
             .concat(account.oauth2.scope || [])
@@ -725,7 +734,7 @@ function init(args) {
                         });
                     }
 
-                    await request.flash({ type: 'danger', message: request.app.gt.gettext(`Couldn't set up account. Try again.`) });
+                    await request.flash({ type: 'danger', message: request.app.gt.gettext("Couldn't set up account. Try again.") });
                     request.logger.error({ msg: 'Failed to process account', err });
 
                     return h
@@ -992,7 +1001,7 @@ function init(args) {
                         });
                     }
 
-                    await request.flash({ type: 'danger', message: request.app.gt.gettext(`Couldn't set up account. Try again.`) });
+                    await request.flash({ type: 'danger', message: request.app.gt.gettext("Couldn't set up account. Try again.") });
                     request.logger.error({ msg: 'Failed to process account', err });
 
                     return h

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "emailengine-app",
-    "version": "2.61.2",
+    "version": "2.61.4",
     "private": false,
     "productTitle": "EmailEngine",
     "description": "Email Sync Engine",
@@ -17,7 +17,7 @@
         "build-dist": "pkg --compress Brotli package.json && npm install && node winconf.js",
         "build-dist-fast": "pkg --debug package.json && npm install && node winconf.js",
         "licenses": "license-checker --excludePackages 'emailengine-app' --json | node list-generate.js > static/licenses.html",
-        "gettext": "find ./views -name \"*.hbs\" -print0 | xargs -0 xgettext-template -L Handlebars -o translations/messages.pot --force-po && jsxgettext lib/routes-ui.js workers/api.js lib/tools.js lib/autodetect-imap-settings.js -j -o translations/messages.pot",
+        "gettext": "find ./views -name \"*.hbs\" -print0 | xargs -0 xgettext-template -L Handlebars -o translations/messages.pot --force-po && jsxgettext lib/routes-ui.js workers/api.js lib/tools.js lib/autodetect-imap-settings.js lib/ui-routes/account-routes.js lib/ui-routes/admin-config-routes.js lib/ui-routes/admin-entities-routes.js -j -o translations/messages.pot",
         "prepare-docker": "echo \"EE_DOCKER_LEGACY=$EE_DOCKER_LEGACY\" >> system.env && cat system.env",
         "update": "rm -rf node_modules package-lock.json && ncu -u && npm install && ./copy-static-files.sh && npm run licenses && npm run gettext",
         "test-gmail-api": "node lib/email-client/gmail-client.js --dbs.redis=redis://127.0.0.1/11",