emailengine-app 2.63.4 → 2.65.0

package/views/partials/oauth_form.hbs

@@ -1,3 +1,77 @@
+{{#if activeOutlook}}
+<div class="card border-left-info shadow mb-4">
+    <div class="card-body">
+        <div class="row no-gutters align-items-center">
+            <div class="col mr-2">
+                <strong>Delegated</strong> access means EmailEngine acts on behalf of a signed-in user. Each
+                mailbox owner must complete an interactive OAuth2 login. Use this when users manage their own
+                accounts or when you have access to the mailbox credentials.
+                {{#if providerData.tutorialUrl}}
+                Read about setting up {{providerData.comment}} OAuth2 project from <a
+                    href="{{providerData.tutorialUrl}}" target="_blank" rel="noopener noreferrer"
+                    referrerpolicy="no-referrer">here</a>.
+                {{/if}}
+            </div>
+            <div class="col-auto">
+                <i class="fas fa-info-circle fa-2x text-gray-300"></i>
+            </div>
+        </div>
+    </div>
+</div>
+{{/if}}
+
+{{#if activeGmailService}}
+<div class="card border-left-info shadow mb-4">
+    <div class="card-body">
+        <div class="row no-gutters align-items-center">
+            <div class="col mr-2">
+                <strong>Service accounts</strong> allow EmailEngine to access Gmail mailboxes using a Google Cloud
+                service key, with no interactive user login required. The service account must have domain-wide
+                delegation enabled in Google Workspace. Use this for automated integrations where you cannot
+                perform interactive logins.
+                Accounts using service access can only be added via the
+                <a href="/admin/swagger#/Account/postV1Account">REST API</a>,
+                not through the hosted authentication form.
+                {{#if providerData.tutorialUrl}}
+                Read about setting up {{providerData.comment}} from <a
+                    href="{{providerData.tutorialUrl}}" target="_blank" rel="noopener noreferrer"
+                    referrerpolicy="no-referrer">here</a>.
+                {{/if}}
+            </div>
+            <div class="col-auto">
+                <i class="fas fa-info-circle fa-2x text-gray-300"></i>
+            </div>
+        </div>
+    </div>
+</div>
+{{/if}}
+
+{{#if activeOutlookService}}
+<div class="card border-left-info shadow mb-4">
+    <div class="card-body">
+        <div class="row no-gutters align-items-center">
+            <div class="col mr-2">
+                <strong>Application</strong> access means EmailEngine authenticates as the app itself using
+                client credentials, with no interactive user login required. The Entra app registration must have
+                <strong>application permissions</strong> (not delegated) with admin consent. Use this for
+                service integrations, shared mailboxes, or when you cannot perform interactive logins.
+                Accounts using application access can only be added via the
+                <a href="/admin/swagger#/Account/postV1Account">REST API</a>,
+                not through the hosted authentication form.
+                {{#if providerData.tutorialUrl}}
+                Read about setting up {{providerData.comment}} from <a
+                    href="{{providerData.tutorialUrl}}" target="_blank" rel="noopener noreferrer"
+                    referrerpolicy="no-referrer">here</a>.
+                {{/if}}
+            </div>
+            <div class="col-auto">
+                <i class="fas fa-info-circle fa-2x text-gray-300"></i>
+            </div>
+        </div>
+    </div>
+</div>
+{{/if}}
+
 <div class="card mb-4">
 
     <div class="card-body">
@@ -42,7 +116,7 @@
             <small class="form-text text-muted">Optional application description or a comment.</small>
         </div>
 
-        {{#unless activeGmailService}}
+        {{#unless activeGmailService}}{{#unless activeOutlookService}}
         <div class="form-group">
 
             <label for="title">
@@ -63,7 +137,7 @@
             <small class="form-text text-muted">Optional display title next to the application button on the account
                 type selection page.</small>
         </div>
-        {{/unless}}
+        {{/unless}}{{/unless}}
 
 
         {{#if activeGmail}}
@@ -82,7 +156,7 @@
         </div>
         {{/if}}
 
-        {{#unless activeGmailService}}
+        {{#unless activeGmailService}}{{#unless activeOutlookService}}
         <div class="form-group form-check">
 
             <input type="checkbox" class="form-check-input {{#if errors.enabled}}is-invalid{{/if}}" id="enabled"
@@ -94,7 +168,7 @@
             <small class="form-text text-muted">If enabled, then this OAuth2 app is shown as an
                 account type option in the hosted authentication form.</small>
         </div>
-        {{/unless}}
+        {{/unless}}{{/unless}}
 
     </div>
 </div>
@@ -175,6 +249,66 @@
             {{/if}}
         </div>
 
+        {{else if activeOutlookService}}
+
+        <div class="form-group">
+
+            <label for="clientId">
+                Azure Application Id
+            </label>
+            <input type="text" class="form-control {{#if errors.clientId}}is-invalid{{/if}}" id="clientId"
+                name="clientId" value="{{values.clientId}}" placeholder="Enter application (client) ID&mldr;" required />
+            {{#if errors.clientId}}
+            <span class="invalid-feedback">{{errors.clientId}}</span>
+            {{/if}}
+            <small class="form-text text-muted">The Application (client) ID from your Entra app registration.</small>
+        </div>
+
+        <div class="form-group">
+
+            <label for="clientSecret">Client Secret</label>
+
+            <input type="text" class="form-control {{#if errors.clientSecret}}is-invalid{{/if}}" id="clientSecret"
+                name="clientSecret" value="{{values.clientSecret}}" {{#if hasClientSecret}}
+                placeholder="Client secret is set but not shown&mldr;" {{else}} placeholder="Enter client secret&mldr;"
+                {{/if}} {{#unless hasClientSecret}}required{{/unless}} />
+            {{#if errors.clientSecret}}
+            <span class="invalid-feedback">{{errors.clientSecret}}</span>
+            {{/if}}
+            <small class="form-text text-muted">Client secret value from Certificates &amp; secrets.</small>
+        </div>
+
+        <div class="form-group">
+            <label for="cloud">Azure cloud environment</label>
+            <select class="custom-select custom-select-sm {{#if errors.cloud}}is-invalid{{/if}}" id="cloud" name="cloud"
+                required>
+
+                {{#each azureClouds}}
+                <option value="{{id}}" {{#if selected}}selected{{/if}}>{{name}}{{#if
+                    description}} &mdash;
+                    {{description}}{{/if}}</option>
+                {{/each}}
+            </select>
+            {{#if errors.cloud}}
+            <span class="invalid-feedback">{{errors.cloud}}</span>
+            {{/if}}
+            <small class="form-text text-muted">Accounts hosted in different cloud environments use different OAuth2
+                endpoints.</small>
+        </div>
+
+        <div class="form-group">
+            <label for="authority">Directory (tenant) ID</label>
+
+            <input type="text" class="form-control {{#if errors.authority}}is-invalid{{/if}}" id="authority"
+                name="authority" value="{{values.authority}}"
+                placeholder="Enter tenant ID, eg. &quot;f8cdef31-a31e-4b4a-93e4-5f571e91255a&quot;" required />
+            {{#if errors.authority}}
+            <span class="invalid-feedback">{{errors.authority}}</span>
+            {{/if}}
+            <small class="form-text text-muted">The Directory (tenant) ID from your Entra app registration. Client
+                credentials flow requires a specific tenant ID.</small>
+        </div>
+
         {{else}}
 
         {{#if activeGmail}}
@@ -702,6 +836,47 @@
 
 {{/if}}
 
+{{#if activeOutlookService}}
+
+<div class="card mb-4">
+
+    <div class="card-header py-3">
+        <h6 class="m-0 font-weight-bold text-primary">Connection type</h6>
+    </div>
+
+    <div class="card-body">
+        <input type="hidden" name="baseScopes" value="api" />
+        <p><strong>MS Graph API</strong> &mdash; This app uses Microsoft Graph API with application permissions
+            (client credentials). Requires <code>Mail.ReadWrite</code>, <code>Mail.Send</code>, and
+            <code>User.Read.All</code> application permissions with admin consent in Entra.</p>
+    </div>
+
+    <div class="card-footer">
+
+        <p>Microsoft Graph delivers change notifications to EmailEngine at these two endpoints:</p>
+
+        <pre><code>{{mainServiceUrl}}/oauth/msg/lifecycle
+{{mainServiceUrl}}/oauth/msg/notification</code></pre>
+
+        <p>
+            Both endpoints must be publicly reachable for anonymous HTTPS
+            <strong>POST</strong> requests. When a notification arrives, EmailEngine
+            immediately forwards the event to your application through its own webhooks.
+        </p>
+
+        <p>
+            If your EmailEngine instance cannot be exposed directly, configure a public
+            proxy domain in <span class="text-muted code-link"><a href="/admin/swagger#/Settings/postV1Settings"
+                    target="_blank" rel="noopener noreferrer">notificationBaseUrl</a></span>. Microsoft Graph will then
+            post to <code>https://&lt;proxy-domain&gt;/oauth/msg/...</code> instead of
+            <code>{{mainServiceUrl}}</code>.
+        </p>
+
+    </div>
+</div>
+
+{{/if}}
+
 {{#if activeGmail}}
 <div class="card mb-4 {{#unless baseScopesApi}}d-none{{/unless}}" id="account-type-card-gmail">
     <div class="card-header py-3">

package/views/partials/oauth_tabs.hbs

@@ -0,0 +1,8 @@
+<ul class="nav nav-pills mb-4">
+    <li class="nav-item">
+        <a class="nav-link {{#if activeApplications}}active{{/if}}" href="/admin/config/oauth">Applications</a>
+    </li>
+    <li class="nav-item">
+        <a class="nav-link {{#if activeSubscriptions}}active{{/if}}" href="/admin/config/oauth/subscriptions">Gmail Subscriptions</a>
+    </li>
+</ul>

package/views/partials/scope_info.hbs

@@ -119,6 +119,16 @@
 </div>
 {{/if}}
 
+{{#if activeOutlookService}}
+<div>Your Entra app registration <strong>must</strong> have the following <strong>application permissions</strong> (not
+    delegated) with admin consent:</div>
+<ul>
+    <li><code>"Mail.ReadWrite"</code></li>
+    <li><code>"Mail.Send"</code></li>
+    <li><code>"User.Read.All"</code></li>
+</ul>
+{{/if}}
+
 {{#if activeMailRu}}
 <div>Your OAuth2 project <strong>must</strong> have the following scopes enabled:</div>
 <ul>

package/workers/api.js

@@ -163,7 +163,8 @@ const {
     googleSubscriptionNameSchema,
     messageReferenceSchema,
     idempotencyKeySchema,
-    headerTimeoutSchema
+    headerTimeoutSchema,
+    pubSubErrorSchema
 } = require('../lib/schemas');
 
 const OAuth2ProviderSchema = Joi.string()
@@ -180,6 +181,21 @@ const AccountTypeSchema = Joi.string()
     .required()
     .label('AccountType');
 
+function flattenOAuthAppMeta(app) {
+    if (!app.meta) {
+        return;
+    }
+    let authFlag = app.meta.authFlag;
+    let pubSubFlag = app.meta.pubSubFlag;
+    delete app.meta;
+    if (authFlag && authFlag.message) {
+        app.lastError = { response: authFlag.message };
+    }
+    if (pubSubFlag && pubSubFlag.message) {
+        app.pubSubError = { message: pubSubFlag.message, description: pubSubFlag.description || null };
+    }
+}
+
 const SUPPORTED_LOCALES = locales.map(locale => locale.locale);
 
 const FLAG_SORT_ORDER = ['\\Inbox', '\\Flagged', '\\Sent', '\\Drafts', '\\All', '\\Archive', '\\Junk', '\\Trash'];
@@ -362,6 +378,7 @@ async function call(message, transferList) {
             err.statusCode = 504;
             err.code = 'Timeout';
             err.ttl = ttl;
+            callQueue.delete(mid);
             reject(err);
         }, ttl);
 
@@ -1557,11 +1574,12 @@ Include your token in requests using one of these methods:
             let checkKey = `${REDIS_PREFIX}test:${Date.now()}`;
             let expected = crypto.randomBytes(8).toString('hex');
             let res = await redis.multi().set(checkKey, expected).get(checkKey).del(checkKey).exec();
-            if (res[1] && res[1][1] === expected && res[2] && res[2][1] === 1) {
-                return { success: true };
+            if (!(res[1] && res[1][1] === expected && res[2] && res[2][1] === 1)) {
+                let error = Boom.boomify(new Error('Database check failed'), { statusCode: 500 });
+                throw error;
             }
-            let error = Boom.boomify(new Error('Database check failed'), { statusCode: 500 });
-            throw error;
+
+            return { success: true };
         },
         options: {
             description: 'Health check',
@@ -1570,6 +1588,99 @@ Include your token in requests using one of these methods:
         }
     });
 
+    server.route({
+        method: 'GET',
+        path: '/v1/pubsub/status',
+
+        async handler(request) {
+            try {
+                let response = await oauth2Apps.list(request.query.page, request.query.pageSize, { pubsub: true });
+
+                let apps = response.apps.map(app => {
+                    flattenOAuthAppMeta(app);
+                    return { id: app.id, name: app.name || null, lastError: app.lastError || null, pubSubError: app.pubSubError || null };
+                });
+
+                return {
+                    total: response.total,
+                    page: response.page,
+                    pages: response.pages,
+                    apps
+                };
+            } catch (err) {
+                request.logger.error({ msg: 'API request failed', err });
+                if (Boom.isBoom(err)) {
+                    throw err;
+                }
+                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
+                if (err.code) {
+                    error.output.payload.code = err.code;
+                }
+                throw error;
+            }
+        },
+
+        options: {
+            description: 'List Pub/Sub status',
+            notes: 'Lists Pub/Sub enabled OAuth2 applications and their subscription status',
+            tags: ['api', 'OAuth2 Applications'],
+
+            plugins: {},
+
+            auth: {
+                strategy: 'api-token',
+                mode: 'required'
+            },
+            cors: CORS_CONFIG,
+
+            validate: {
+                options: {
+                    stripUnknown: false,
+                    abortEarly: false,
+                    convert: true
+                },
+                failAction,
+
+                query: Joi.object({
+                    page: Joi.number()
+                        .integer()
+                        .min(0)
+                        .max(1024 * 1024)
+                        .default(0)
+                        .example(0)
+                        .description('Page number (zero indexed, so use 0 for first page)')
+                        .label('PageNumber'),
+                    pageSize: Joi.number().integer().min(1).max(1000).default(20).example(20).description('How many entries per page').label('PageSize')
+                }).label('PubSubStatusFilter')
+            },
+
+            response: {
+                schema: Joi.object({
+                    total: Joi.number().integer().example(120).description('How many matching entries').label('TotalNumber'),
+                    page: Joi.number().integer().example(0).description('Current page (0-based index)').label('PageNumber'),
+                    pages: Joi.number().integer().example(24).description('Total page count').label('PagesNumber'),
+
+                    apps: Joi.array()
+                        .items(
+                            Joi.object({
+                                id: Joi.string().max(256).required().example('AAABhaBPHscAAAAH').description('OAuth2 application ID'),
+                                name: Joi.string().allow(null).max(256).example('My Gmail App').description('Display name for the app'),
+                                lastError: Joi.object({
+                                    response: Joi.string().example('Enable the Cloud Pub/Sub API').description('Setup error message')
+                                })
+                                    .allow(null)
+                                    .description('Setup error from ensurePubsub, if any')
+                                    .label('PubSubSetupError'),
+                                pubSubError: pubSubErrorSchema.allow(null)
+                            }).label('PubSubAppStatus')
+                        )
+                        .label('PubSubAppStatusList')
+                }).label('PubSubStatusResponse'),
+                failAction: 'log'
+            }
+        }
+    });
+
     server.route({
         method: 'GET',
         path: '/redirect',
@@ -1936,6 +2047,10 @@ Include your token in requests using one of these methods:
 
             const outlookSubscription = accountData.outlookSubscription;
 
+            // Deduplicate lifecycle events within the same batch to prevent
+            // concurrent handlers racing (e.g., two subscriptionRemoved entries)
+            const seenLifecycleEvents = new Set();
+
             for (let entry of (request.payload && request.payload.value) || []) {
                 request.logger.debug({
                     msg: 'MS Graph subscription event',
@@ -1960,82 +2075,43 @@ Include your token in requests using one of these methods:
                     continue;
                 }
 
-                switch (entry.lifecycleEvent) {
-                    case 'reauthorizationRequired': {
-                        // Microsoft is requesting reauthorization - force renewal immediately
-                        request.logger.info({
-                            msg: 'Received reauthorizationRequired lifecycle event',
-                            subscriptionId: outlookSubscription.id,
+                // Route recognized lifecycle events to the IMAP worker
+                // so the live client with its OAuth state handles them
+                if (entry.lifecycleEvent === 'reauthorizationRequired' || entry.lifecycleEvent === 'subscriptionRemoved') {
+                    const dedupeKey = `${entry.lifecycleEvent}:${entry.subscriptionId}`;
+                    if (seenLifecycleEvents.has(dedupeKey)) {
+                        request.logger.debug({
+                            msg: 'Skipping duplicate lifecycle event in batch',
+                            lifecycleEvent: entry.lifecycleEvent,
+                            subscriptionId: entry.subscriptionId,
                             account: request.query.account
                         });
-
-                        // Use the unified renewal method from OutlookClient
-                        // We need to create a client instance to call the renewal method
-                        const { OutlookClient } = require('../lib/email-client/outlook-client');
-                        const client = new OutlookClient(accountData, {
-                            redis,
-                            secret: await getSecret(),
-                            logger: request.logger
-                        });
-
-                        try {
-                            // Force renewal when we get reauthorizationRequired
-                            const renewalResult = await client.renewSubscription(true);
-
-                            if (renewalResult.success) {
-                                request.logger.info({
-                                    msg: 'Successfully renewed subscription from lifecycle event',
-                                    subscriptionId: outlookSubscription.id,
-                                    account: request.query.account,
-                                    newExpirationDateTime: renewalResult.expirationDateTime
-                                });
-                            } else {
-                                request.logger.error({
-                                    msg: 'Failed to renew subscription from lifecycle event',
-                                    subscriptionId: outlookSubscription.id,
-                                    account: request.query.account,
-                                    reason: renewalResult.reason,
-                                    error: renewalResult.error
-                                });
-                            }
-                        } catch (err) {
-                            request.logger.error({
-                                msg: 'Exception while renewing subscription from lifecycle event',
-                                subscriptionId: outlookSubscription.id,
-                                account: request.query.account,
-                                err
-                            });
-                        } finally {
-                            // Clean up client instance
-                            if (client && typeof client.close === 'function') {
-                                try {
-                                    await client.close();
-                                } catch (cleanupErr) {
-                                    request.logger.debug({
-                                        msg: 'Error closing client after lifecycle renewal',
-                                        account: request.query.account,
-                                        err: cleanupErr
-                                    });
-                                }
-                            }
-                        }
-
-                        break;
+                        continue;
                     }
+                    seenLifecycleEvents.add(dedupeKey);
 
-                    case 'subscriptionRemoved': {
-                        // subscription was removed, should we recreate it?
-                        await accountObject.update({
-                            outlookSubscription: {
-                                state: {
-                                    state: 'error',
-                                    error: `Subscription removed`,
-                                    time: Date.now()
-                                }
-                            }
+                    request.logger.info({
+                        msg: 'Received lifecycle event',
+                        lifecycleEvent: entry.lifecycleEvent,
+                        subscriptionId: outlookSubscription.id,
+                        account: request.query.account
+                    });
+
+                    // Fire-and-forget: return HTTP 202 immediately so Microsoft
+                    // does not time out the lifecycle webhook delivery
+                    call({
+                        cmd: 'subscriptionLifecycle',
+                        account: request.query.account,
+                        event: entry.lifecycleEvent,
+                        timeout: consts.OUTLOOK_SUBSCRIPTION_LOCK_TTL
+                    }).catch(err => {
+                        request.logger.error({
+                            msg: 'Failed to handle lifecycle event via worker',
+                            account: request.query.account,
+                            lifecycleEvent: entry.lifecycleEvent,
+                            err
                         });
-                        break;
-                    }
+                    });
                 }
             }
 
@@ -4876,13 +4952,7 @@ Include your token in requests using one of these methods:
                         delete app.app;
                     }
 
-                    if (app.meta) {
-                        let authFlag = app.meta.authFlag;
-                        delete app.meta;
-                        if (authFlag && authFlag.message) {
-                            app.lastError = { response: authFlag.message };
-                        }
-                    }
+                    flattenOAuthAppMeta(app);
                 }
 
                 return response;
@@ -5002,7 +5072,8 @@ Include your token in requests using one of these methods:
                                     .example('******')
                                     .description('PEM formatted service secret for 2-legged OAuth2 applications. Actual value is not revealed.'),
 
-                                lastError: lastErrorSchema.allow(null)
+                                lastError: lastErrorSchema.allow(null),
+                                pubSubError: pubSubErrorSchema.allow(null)
                             }).label('OAuth2ResponseItem')
                         )
                         .label('OAuth2Entries')
@@ -5035,13 +5106,7 @@ Include your token in requests using one of these methods:
                     delete app.app;
                 }
 
-                if (app.meta) {
-                    let authFlag = app.meta.authFlag;
-                    delete app.meta;
-                    if (authFlag && authFlag.message) {
-                        app.lastError = { response: authFlag.message };
-                    }
-                }
+                flattenOAuthAppMeta(app);
 
                 return app;
             } catch (err) {
@@ -5145,7 +5210,8 @@ Include your token in requests using one of these methods:
                         .example(12)
                         .description('The number of accounts registered with this application. Not available for legacy apps.'),
 
-                    lastError: lastErrorSchema.allow(null)
+                    lastError: lastErrorSchema.allow(null),
+                    pubSubError: pubSubErrorSchema.allow(null)
                 }).label('ApplicationResponse'),
                 failAction: 'log'
             }
@@ -5160,8 +5226,9 @@ Include your token in requests using one of these methods:
             try {
                 let result = await oauth2Apps.create(request.payload);
 
-                if (result && result.pubsubUpdates && result.pubsubUpdates.pubSubSubscription) {
+                if (result && result.pubsubUpdates && Object.keys(result.pubsubUpdates).length > 0) {
                     await call({ cmd: 'googlePubSub', app: result.id });
+                    delete result.pubsubUpdates;
                 }
 
                 return result;
@@ -5220,8 +5287,9 @@ Include your token in requests using one of these methods:
             try {
                 let result = await oauth2Apps.update(request.params.app, request.payload);
 
-                if (result && result.pubsubUpdates && result.pubsubUpdates.pubSubSubscription) {
+                if (result && result.pubsubUpdates && Object.keys(result.pubsubUpdates).length > 0) {
                     await call({ cmd: 'googlePubSub', app: result.id });
+                    delete result.pubsubUpdates;
                 }
 
                 return result;
@@ -5369,7 +5437,15 @@ Include your token in requests using one of these methods:
 
         async handler(request) {
             try {
-                return await oauth2Apps.del(request.params.app);
+                let result = await oauth2Apps.del(request.params.app);
+
+                try {
+                    await call({ cmd: 'googlePubSubRemove', app: request.params.app });
+                } catch (err) {
+                    request.logger.error({ msg: 'Failed to notify workers about OAuth2 app deletion', err, app: request.params.app });
+                }
+
+                return result;
             } catch (err) {
                 request.logger.error({ msg: 'API request failed', err });
                 if (Boom.isBoom(err)) {
@@ -6942,11 +7018,13 @@ ${now}`,
         // Replace error with friendly HTML
         const error = response;
         const ctx = {
+            statusCode: error.output.statusCode,
             message:
                 error.output.statusCode === 404
                     ? request.app.gt.gettext('Requested page not found')
                     : (error.output && error.output.payload && error.output.payload.message) || request.app.gt.gettext('Something went wrong'),
-            details: error.output && error.output.payload && error.output.payload.details
+            details: error.output && error.output.payload && error.output.payload.details,
+            templateLocale: request.app.locale
         };
 
         if (error.output && error.output.payload) {

package/workers/documents.js

@@ -72,6 +72,7 @@ async function call(message, transferList) {
             err.statusCode = 504;
             err.code = 'Timeout';
             err.ttl = ttl;
+            callQueue.delete(mid);
             reject(err);
         }, ttl);
 

package/workers/export.js

@@ -755,7 +755,7 @@ const exportWorker = new Worker(
                 throw new Error('Export not found');
             }
 
-            await Export.update(account, exportId, { status: 'processing', phase: 'indexing' });
+            await Export.startProcessing(account, exportId);
             await indexMessages(job, exportData);
             await Export.update(account, exportId, { phase: 'exporting' });
 
@@ -788,7 +788,11 @@ const exportWorker = new Worker(
                 await fs.promises.unlink(exportData.filePath).catch(() => {});
             }
 
-            await Export.fail(account, exportId, err.message);
+            if (err.code === 'ExportCancelled') {
+                await Export.deleteFully(account, exportId);
+            } else {
+                await Export.fail(account, exportId, err.message);
+            }
 
             if (err.code !== 'AccountDeleted' && err.code !== 'AccountNotFound' && err.code !== 'ExportCancelled') {
                 await notify(account, EXPORT_FAILED_NOTIFY, {