emailengine-app 2.64.0 → 2.65.0

package/.github/workflows/test.yml

@@ -80,3 +80,7 @@ jobs:
                   GMAIL_SENDONLY_CLIENT_SECRET: ${{ secrets.GMAIL_SENDONLY_CLIENT_SECRET }}
                   GMAIL_SENDONLY_ACCOUNT_EMAIL: ${{ secrets.GMAIL_SENDONLY_ACCOUNT_EMAIL }}
                   GMAIL_SENDONLY_ACCOUNT_REFRESH: ${{ secrets.GMAIL_SENDONLY_ACCOUNT_REFRESH }}
+                  OUTLOOK_SERVICE_CLIENT_ID: ${{ secrets.OUTLOOK_SERVICE_CLIENT_ID }}
+                  OUTLOOK_SERVICE_TENANT_ID: ${{ secrets.OUTLOOK_SERVICE_TENANT_ID }}
+                  OUTLOOK_SERVICE_CLIENT_SECRET: ${{ secrets.OUTLOOK_SERVICE_CLIENT_SECRET }}
+                  OUTLOOK_SERVICE_ACCOUNT_EMAIL: ${{ secrets.OUTLOOK_SERVICE_ACCOUNT_EMAIL }}

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [2.65.0](https://github.com/postalsys/emailengine/compare/v2.64.0...v2.65.0) (2026-03-23)
+
+
+### Features
+
+* add Outlook Service (client_credentials) provider for app-only Microsoft 365 access ([#587](https://github.com/postalsys/emailengine/issues/587)) ([5f906cd](https://github.com/postalsys/emailengine/commit/5f906cd540564afe2dc2024b4e17c2d5d9483ed2))
+
+
+### Bug Fixes
+
+* fix export TTL expiration, cancellation cleanup, and expose truncated field ([019c05c](https://github.com/postalsys/emailengine/commit/019c05c941842ae28668711e8f5c2e8a85d3b84b))
+* include failed jobs in /v1/outbox response ([b393676](https://github.com/postalsys/emailengine/commit/b393676f2f877046d27b06d518a03dd256d5b7d9))
+* switch pkg targets from node22 to node24 to fix Windows builds ([12522a7](https://github.com/postalsys/emailengine/commit/12522a7b92d72684af49cd70c1c6d4bcafe1d4af))
+
 ## [2.64.0](https://github.com/postalsys/emailengine/compare/v2.63.4...v2.64.0) (2026-03-16)
 
 

package/copy-static-files.sh

@@ -24,7 +24,7 @@ cp node_modules/ace-builds/src-min/ext-searchbox.js static/js/ace/ext-searchbox.
 
 cp node_modules/\@postalsys/ee-client/index.js static/js/ee-client.js
 
-wget https://developers.google.com/static/search/apis/ipranges/special-crawlers.json -O data/google-crawlers.json
+wget https://developers.google.com/static/crawling/ipranges/special-crawlers.json -O data/google-crawlers.json
 node -e 'console.log("Google crawlers updated: "+require("./data/google-crawlers.json").creationTime);'
 
 # brew install gh

package/data/google-crawlers.json

@@ -1,5 +1,5 @@
 {
-    "creationTime": "2026-03-13T15:46:23.000000",
+    "creationTime": "2026-03-20T15:46:03.000000",
     "prefixes": [
         {
             "ipv6Prefix": "2001:4860:4801:2008::/64"

package/lib/account.js

@@ -18,7 +18,7 @@ const { MessageChannel } = require('worker_threads');
 const { MessagePortReadable } = require('./message-port-stream');
 const { deepStrictEqual, strictEqual } = require('assert');
 const { encrypt, decrypt } = require('./encrypt');
-const { oauth2Apps, LEGACY_KEYS } = require('./oauth2-apps');
+const { oauth2Apps, LEGACY_KEYS, isApiBasedApp } = require('./oauth2-apps');
 const settings = require('./settings');
 const redisScanDelete = require('./redis-scan-delete');
 const { customAlphabet } = require('nanoid');
@@ -175,7 +175,7 @@ class Account {
                 oauthApps.set(accountData.oauth2.provider, app || null);
                 if (app) {
                     accountData.type = app.provider;
-                    if (app.baseScopes === 'api') {
+                    if (isApiBasedApp(app)) {
                         accountData.isApi = true;
                     }
 
@@ -203,7 +203,7 @@ class Account {
                                 app = await oauth2Apps.get(delegatedAccountData.oauth2.provider);
                             }
                             oauthApps.set(delegatedAccountData.oauth2.provider, app || null);
-                            if (app && app.baseScopes === 'api') {
+                            if (isApiBasedApp(app)) {
                                 accountData.isApi = true;
                             }
                         }
@@ -686,7 +686,7 @@ class Account {
         if (accountData.oauth2 && accountData.oauth2.provider) {
             let app = await oauth2Apps.get(accountData.oauth2.provider);
             if (app) {
-                if (app.baseScopes === 'api') {
+                if (isApiBasedApp(app)) {
                     accountData.isApi = true;
                 }
 
@@ -709,7 +709,7 @@ class Account {
                         let app = await oauth2Apps.get(delegatedAccountData.oauth2.provider);
                         if (app) {
                             accountData._app = app;
-                            if (app.baseScopes === 'api') {
+                            if (isApiBasedApp(app)) {
                                 accountData.isApi = true;
                             }
                         }
@@ -2580,7 +2580,7 @@ class Account {
                     let delegatedAccountData = this.unserializeAccountData(delegatedAccountRow);
                     if (delegatedAccountData?.oauth2?.provider) {
                         let app = await oauth2Apps.get(delegatedAccountData.oauth2.provider);
-                        return app?.baseScopes === 'api';
+                        return isApiBasedApp(app);
                     } else {
                         return false;
                     }
@@ -2593,7 +2593,7 @@ class Account {
 
         if (accountData.oauth2?.provider) {
             let app = await oauth2Apps.get(accountData.oauth2.provider);
-            return app?.baseScopes === 'api';
+            return isApiBasedApp(app);
         }
         return false;
     }

package/lib/api-routes/account-routes.js

@@ -4,7 +4,7 @@ const crypto = require('crypto');
 const { redis } = require('../db');
 const { Account } = require('../account');
 const getSecret = require('../get-secret');
-const { oauth2Apps } = require('../oauth2-apps');
+const { oauth2Apps, SERVICE_ACCOUNT_PROVIDERS } = require('../oauth2-apps');
 const Boom = require('@hapi/boom');
 const Joi = require('joi');
 const { failAction } = require('../tools');
@@ -67,6 +67,12 @@ async function init(args) {
                     // redirect to OAuth2 consent screen
 
                     const oAuth2Client = await oauth2Apps.getClient(request.payload.oauth2.provider);
+
+                    // Service providers use client_credentials - no interactive authorization
+                    if (SERVICE_ACCOUNT_PROVIDERS.has(oAuth2Client.provider)) {
+                        throw Boom.badRequest('Application-only OAuth providers do not support interactive authorization');
+                    }
+
                     const nonce = crypto.randomBytes(NONCE_BYTES).toString('base64url');
 
                     const accountData = request.payload;

package/lib/email-client/outlook/graph-api.js

@@ -94,7 +94,7 @@ async function request(context, url, method, payload, options = {}) {
         // Track successful API request
         metricsMeta({ account: context.account }, context.logger, 'oauth2ApiRequest', 'inc', {
             status: 'success',
-            provider: 'outlook',
+            provider: context.oAuth2Client?.provider || 'outlook',
             statusCode: '200'
         });
     } catch (err) {
@@ -102,7 +102,7 @@ async function request(context, url, method, payload, options = {}) {
         const statusCode = String(err.oauthRequest?.status || 0);
         metricsMeta({ account: context.account }, context.logger, 'oauth2ApiRequest', 'inc', {
             status: 'failure',
-            provider: 'outlook',
+            provider: context.oAuth2Client?.provider || 'outlook',
             statusCode
         });
 

package/lib/email-client/outlook-client.js

@@ -215,18 +215,24 @@ class OutlookClient extends BaseClient {
         await this.setStateVal();
 
         await this.getAccount();
-        await this.prepareDelegatedAccount();
         await this.getClient(true);
+        await this.prepareDelegatedAccount();
 
         let accountData = await this.accountObject.loadAccountData();
 
         // Check if send-only mode
-        // Note: Scopes are checked at initialization and after account updates. If scopes change
-        // during token refresh (rare - typically requires re-authorization), the account must be
-        // reinitialized to detect the change. Consider checking scopes periodically if dynamic
-        // scope changes become common.
+        // For outlookService (client_credentials), app permissions are configured in Entra.
+        // The .default scope doesn't enumerate individual permissions, so assume full access.
+        // For delegated accounts, scopes are checked at initialization and after account updates.
         const scopes = accountData.oauth2?.accessToken?.scope || accountData.oauth2?.scope || [];
-        const { hasSendScope, hasReadScope } = checkAccountScopes('outlook', scopes, this.logger);
+        let hasSendScope, hasReadScope;
+        if (this.oAuth2Client?.useClientCredentials) {
+            hasSendScope = true;
+            hasReadScope = true;
+        } else {
+            ({ hasSendScope, hasReadScope } = checkAccountScopes('outlook', scopes, this.logger));
+        }
+
         const isSendOnly = hasSendScope && !hasReadScope;
 
         this.logger.debug({
@@ -270,7 +276,12 @@ class OutlookClient extends BaseClient {
         }
 
         // Update username if it has changed (e.g., after email address change)
-        if (profileRes.userPrincipalName && accountData.oauth2.auth?.user !== profileRes.userPrincipalName && !accountData.oauth2.auth?.delegatedUser) {
+        if (
+            profileRes.userPrincipalName &&
+            accountData.oauth2.auth?.user !== profileRes.userPrincipalName &&
+            !accountData.oauth2.auth?.delegatedUser &&
+            !this.oAuth2Client?.useClientCredentials
+        ) {
             updates.oauth2 = {
                 partial: true,
                 auth: Object.assign(accountData.oauth2.auth || {}, {
@@ -2776,6 +2787,20 @@ class OutlookClient extends BaseClient {
 
         let accountData = await this.accountObject.loadAccountData();
 
+        // For outlookService (client_credentials), always use /users/{email} path
+        if (this.oAuth2Client?.useClientCredentials) {
+            let email = accountData.oauth2?.auth?.delegatedUser || accountData.oauth2?.auth?.user;
+            if (email) {
+                this.oauth2UserPath = `users/${encodeURIComponent(email)}`;
+            } else {
+                let err = new Error('Application credentials require a target user email address');
+                err.code = 'MissingTargetUser';
+                err.authenticationFailed = true;
+                throw err;
+            }
+            return;
+        }
+
         if (accountData?.oauth2?.auth?.delegatedUser && accountData?.oauth2?.auth?.delegatedAccount) {
             await this.getDelegatedAccount(accountData);
             if (this.delegatedAccountObject) {
@@ -2805,13 +2830,21 @@ class OutlookClient extends BaseClient {
 
             // Track successful token refresh (only if token was actually refreshed, not cached)
             if (!tokenData.cached) {
-                metricsMeta({ account: this.account }, this.logger, 'oauth2TokenRefresh', 'inc', { status: 'success', provider: 'outlook', statusCode: '200' });
+                metricsMeta({ account: this.account }, this.logger, 'oauth2TokenRefresh', 'inc', {
+                    status: 'success',
+                    provider: this.oAuth2Client?.provider || 'outlook',
+                    statusCode: '200'
+                });
             }
         } catch (E) {
             if (E.code === 'ETokenRefresh') {
                 // Track failed token refresh
                 const statusCode = String(E.statusCode || 0);
-                metricsMeta({ account: this.account }, this.logger, 'oauth2TokenRefresh', 'inc', { status: 'failure', provider: 'outlook', statusCode });
+                metricsMeta({ account: this.account }, this.logger, 'oauth2TokenRefresh', 'inc', {
+                    status: 'failure',
+                    provider: this.oAuth2Client?.provider || 'outlook',
+                    statusCode
+                });
 
                 // treat as authentication failure
                 this.state = 'authenticationError';
@@ -2854,8 +2887,8 @@ class OutlookClient extends BaseClient {
      */
     async prepare() {
         await this.getAccount();
-        await this.prepareDelegatedAccount();
         await this.getClient();
+        await this.prepareDelegatedAccount();
     }
 
     /**

package/lib/export.js

@@ -242,6 +242,7 @@ class Export {
             },
             created: toIsoDate(data.created),
             expiresAt: toIsoDate(data.expiresAt),
+            truncated: data.truncated === '1' || undefined,
             error: data.error || null
         };
 
@@ -322,6 +323,15 @@ class Export {
         }
     }
 
+    static async startProcessing(account, exportId) {
+        const exportKey = getExportKey(account, exportId);
+        const maxAge = await getExportMaxAge();
+        const ttl = Math.ceil(maxAge / 1000);
+        const newExpiresAt = Date.now() + maxAge;
+
+        await redis.multi().hmset(exportKey, { status: 'processing', phase: 'indexing', expiresAt: newExpiresAt }).expire(exportKey, ttl).exec();
+    }
+
     static async queueMessage(account, exportId, messageInfo) {
         const queueKey = getExportQueueKey(account, exportId);
         const exportKey = getExportKey(account, exportId);
@@ -415,6 +425,13 @@ class Export {
         logger.error({ msg: 'Export failed', account, exportId, error });
     }
 
+    static async deleteFully(account, exportId) {
+        const exportKey = getExportKey(account, exportId);
+        const queueKey = getExportQueueKey(account, exportId);
+
+        await redis.multi().del(exportKey).del(queueKey).srem(ACTIVE_EXPORTS_KEY, `${account}:${exportId}`).exec();
+    }
+
     static async markInterruptedAsFailed() {
         const activeExports = await redis.smembers(ACTIVE_EXPORTS_KEY);
 

package/lib/imapproxy/imap-server.js

@@ -4,7 +4,7 @@ const { parentPort } = require('worker_threads');
 
 const config = require('@zone-eu/wild-config');
 const logger = require('../logger');
-const { oauth2Apps, oauth2ProviderData } = require('../oauth2-apps');
+const { oauth2Apps, oauth2ProviderData, isApiBasedApp } = require('../oauth2-apps');
 
 const { getDuration, getBoolean, resolveCredentials, hasEnvValue, readEnvValue, emitChangeEvent, loadTlsConfig } = require('../tools');
 const { matchIp, getLocalAddress } = require('../utils/network');
@@ -214,7 +214,7 @@ async function onAuth(auth, session) {
         throw respErr;
     }
 
-    if (accountData?._app?.baseScopes === 'api') {
+    if (isApiBasedApp(accountData?._app)) {
         let respErr = new Error('IMAP is not supported for API-based accounts');
         respErr.authenticationFailed = true;
         respErr.serverResponseCode = 'ACCOUNTDISABLED';

package/lib/oauth/outlook.js

@@ -174,7 +174,8 @@ class OutlookOauth {
         this.logRaw = opts.logRaw;
         this.logger = opts.logger;
 
-        this.provider = 'outlook';
+        this.useClientCredentials = !!opts.useClientCredentials;
+        this.provider = opts.provider || 'outlook';
 
         this.setFlag = opts.setFlag;
 
@@ -199,9 +200,18 @@ class OutlookOauth {
                 this.entraEndpoint = 'https://login.microsoftonline.com';
                 this.apiBase = 'https://graph.microsoft.com';
         }
+
+        // Client credentials use a single .default scope; override whatever was set above
+        if (this.useClientCredentials) {
+            this.scopes = [`${this.apiBase}/.default`];
+        }
     }
 
     generateAuthUrl(opts) {
+        if (this.useClientCredentials) {
+            throw new Error('Client credentials flow does not support interactive authorization');
+        }
+
         opts = opts || {};
 
         const url = new URL(`${this.entraEndpoint}/${this.authority}/oauth2/v2.0/authorize`);
@@ -335,6 +345,10 @@ class OutlookOauth {
     }
 
     async refreshToken(opts) {
+        if (this.useClientCredentials) {
+            return this.getClientCredentialsToken();
+        }
+
         opts = opts || {};
         if (!opts.refreshToken) {
             throw new Error('Refresh token not provided');
@@ -435,6 +449,90 @@ class OutlookOauth {
         return responseJson;
     }
 
+    async getClientCredentialsToken() {
+        const url = new URL(`${this.entraEndpoint}/${this.authority}/oauth2/v2.0/token`);
+
+        url.searchParams.set('client_id', this.clientId);
+        url.searchParams.set('client_secret', this.clientSecret);
+        url.searchParams.set('scope', this.scopes.join(' '));
+        url.searchParams.set('grant_type', 'client_credentials');
+
+        let requestUrl = url.origin + url.pathname;
+        let method = 'post';
+
+        const bodyString = url.searchParams.toString();
+        let res = await fetchCmd(requestUrl, {
+            method,
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                'User-Agent': `${packageData.name}/${packageData.version} (+${packageData.homepage})`
+            },
+            body: bodyString,
+            dispatcher: httpAgent.retry
+        });
+
+        let responseJson;
+        try {
+            responseJson = await res.json();
+        } catch (err) {
+            if (this.logger) {
+                this.logger.error({ msg: 'Failed to retrieve JSON', err });
+            }
+        }
+
+        if (this.logger) {
+            this.logger.info({
+                msg: 'OAuth2 authentication request',
+                action: 'oauth2Fetch',
+                fn: 'getClientCredentialsToken',
+                method,
+                url: requestUrl,
+                success: !!res.ok,
+                status: res.status,
+                request: formatFetchBody(url.searchParams, this.logRaw),
+                response: formatFetchResponse(responseJson, this.logRaw)
+            });
+        }
+
+        if (!res.ok) {
+            let err = new Error('Token request failed');
+            err.code = 'ETokenRefresh';
+
+            err.statusCode = res.status;
+            err.tokenRequest = {
+                url: requestUrl,
+                method,
+                authority: this.authority,
+                grant: 'client_credentials',
+                provider: this.provider,
+                status: res.status,
+                clientId: this.clientId,
+                scopes: this.scopes
+            };
+            try {
+                err.tokenRequest.response = responseJson || { error: 'Failed to parse response' };
+
+                if (EXPOSE_PARTIAL_SECRET_KEY_REGEX.test(err.tokenRequest.response?.error_description)) {
+                    err.tokenRequest.clientSecret = formatPartialSecretKey(this.clientSecret);
+                }
+
+                let flag = checkForFlags(err.tokenRequest.response);
+                if (flag) {
+                    await this.setFlag(flag);
+                }
+            } catch (e) {
+                // ignore
+            }
+            err.message = formatTokenError(this.provider, err.tokenRequest);
+            throw err;
+        }
+
+        // clear potential auth flag
+        await this.setFlag();
+
+        return responseJson;
+    }
+
     async request(accessToken, url, method, payload, options) {
         options = options || {};
 

package/lib/oauth2-apps.js

@@ -49,10 +49,14 @@ const PUBSUB_PERM_VIEW = 'Service client does not have permission to view Pub/Su
 const OAUTH_PROVIDERS = {
     gmail: 'Gmail',
     gmailService: 'Gmail Service Accounts',
-    outlook: 'Outlook',
+    outlook: 'Outlook (delegated)',
+    outlookService: 'Outlook (application)',
     mailRu: 'Mail.ru'
 };
 
+// Providers that use app-only credentials (no interactive user login)
+const SERVICE_ACCOUNT_PROVIDERS = new Set(['gmailService', 'outlookService']);
+
 const lock = new Lock({
     redis,
     namespace: 'ee'
@@ -100,6 +104,7 @@ function oauth2ProviderData(provider, selector) {
             };
             break;
 
+        case 'outlookService':
         case 'outlook':
             {
                 let imapHost = 'outlook.office365.com';
@@ -121,8 +126,12 @@ function oauth2ProviderData(provider, selector) {
                 }
 
                 providerData.icon = 'fab fa-microsoft';
-                providerData.tutorialUrl = 'https://emailengine.app/outlook-and-ms-365';
-                providerData.linkImage = '/static/providers/ms_light.svg';
+                if (provider === 'outlook') {
+                    providerData.tutorialUrl = 'https://emailengine.app/outlook-and-ms-365';
+                    providerData.linkImage = '/static/providers/ms_light.svg';
+                } else {
+                    providerData.tutorialUrl = 'https://learn.emailengine.app/docs/accounts/outlook-client-credentials';
+                }
                 providerData.imap = {
                     host: imapHost,
                     port: 993,
@@ -402,7 +411,7 @@ class OAuth2AppsHandler {
 
         response.apps.forEach(app => {
             app.includeInListing = !!app.enabled;
-            if (['gmailService'].includes(app.provider)) {
+            if (SERVICE_ACCOUNT_PROVIDERS.has(app.provider)) {
                 // service accounts are always enabled
                 app.enabled = true;
                 app.includeInListing = false;
@@ -493,7 +502,7 @@ class OAuth2AppsHandler {
                     extraScopes,
                     skipScopes,
 
-                    name: 'Outlook',
+                    name: 'Outlook (delegated)',
                     description: 'Legacy OAuth2 app',
 
                     meta: {
@@ -615,7 +624,7 @@ class OAuth2AppsHandler {
             // legacy
             let data = await this.getLegacyApp(id);
             data.includeInListing = !!data.enabled;
-            if (['gmailService'].includes(data.provider)) {
+            if (SERVICE_ACCOUNT_PROVIDERS.has(data.provider)) {
                 // service account are always enabled
                 data.enabled = true;
                 data.includeInListing = false;
@@ -645,7 +654,7 @@ class OAuth2AppsHandler {
         }
 
         data.includeInListing = !!data.enabled;
-        if (['gmailService'].includes(data.provider)) {
+        if (SERVICE_ACCOUNT_PROVIDERS.has(data.provider)) {
             // service account are always enabled
             data.enabled = true;
             data.includeInListing = false;
@@ -1466,7 +1475,7 @@ class OAuth2AppsHandler {
                 let scopes = formatExtraScopes(appData.extraScopes, appData.baseScopes, outlookScopes(cloud), appData.skipScopes);
 
                 if (!clientId || !clientSecret || !authority || !redirectUrl) {
-                    let error = Boom.boomify(new Error('OAuth2 credentials not set up for Outlook'), { statusCode: 400 });
+                    let error = Boom.boomify(new Error('OAuth2 credentials not set up for Outlook (delegated)'), { statusCode: 400 });
                     throw error;
                 }
 
@@ -1497,6 +1506,41 @@ class OAuth2AppsHandler {
                 );
             }
 
+            case 'outlookService': {
+                let authority = appData.authority;
+                let clientId = appData.clientId;
+                let clientSecret = appData.clientSecret ? await this.decrypt(appData.clientSecret) : null;
+
+                let cloud = appData.cloud || 'global';
+
+                if (!clientId || !clientSecret || !authority) {
+                    let error = Boom.boomify(new Error('OAuth2 credentials not set up for Outlook (application)'), { statusCode: 400 });
+                    throw error;
+                }
+
+                // Client credentials use {apiBase}/.default scope; per-scope config is not applicable
+                return new OutlookOauth(
+                    Object.assign(
+                        {
+                            authority,
+                            clientId,
+                            clientSecret,
+                            cloud,
+                            provider: 'outlookService',
+                            useClientCredentials: true,
+                            setFlag: async flag => {
+                                try {
+                                    await this.setMeta(id, { authFlag: flag });
+                                } catch (err) {
+                                    logger.error({ msg: 'Failed to set OAuth flag', provider: 'outlookService', err });
+                                }
+                            }
+                        },
+                        extraOpts
+                    )
+                );
+            }
+
             case 'mailRu': {
                 let clientId = appData.clientId;
                 let clientSecret = appData.clientSecret ? await this.decrypt(appData.clientSecret) : null;
@@ -1586,14 +1630,14 @@ class OAuth2AppsHandler {
                 let { access_token: accessToken, expires_in: expiresIn } = await client.refreshToken({ isPrincipal });
                 let expires = new Date(now + expiresIn * 1000);
                 if (!accessToken) {
-                    recordTokenMetric('failure', 'gmailService', '0');
+                    recordTokenMetric('failure', appData.provider || 'unknown', '0');
                     return null;
                 }
 
                 logger.debug({ msg: 'Renewed access token for service account', app: appData.id, isPrincipal });
 
                 // Record successful token refresh
-                recordTokenMetric('success', 'gmailService', '200');
+                recordTokenMetric('success', appData.provider || 'unknown', '200');
 
                 await this.update(
                     appData.id,
@@ -1609,7 +1653,7 @@ class OAuth2AppsHandler {
         } catch (err) {
             // Record failed token refresh
             const statusCode = err.statusCode || err.tokenRequest?.status || 0;
-            recordTokenMetric('failure', 'gmailService', statusCode);
+            recordTokenMetric('failure', appData.provider || 'unknown', statusCode);
 
             logger.info({
                 msg: 'Failed to renew OAuth2 access token',
@@ -1627,10 +1671,20 @@ class OAuth2AppsHandler {
     }
 }
 
+/**
+ * Returns true if the given OAuth2 app uses API-based access (Graph API, Gmail API)
+ * rather than IMAP/SMTP. Service account providers always use API access.
+ */
+function isApiBasedApp(app) {
+    return app && (app.baseScopes === 'api' || SERVICE_ACCOUNT_PROVIDERS.has(app.provider));
+}
+
 module.exports = {
     oauth2Apps: new OAuth2AppsHandler({ redis }),
     OAUTH_PROVIDERS,
+    SERVICE_ACCOUNT_PROVIDERS,
     LEGACY_KEYS,
     oauth2ProviderData,
-    formatExtraScopes
+    formatExtraScopes,
+    isApiBasedApp
 };

package/lib/outbox.js

@@ -11,7 +11,7 @@ async function list(options) {
 
     let jobCounts = await submitQueue.getJobCounts();
 
-    let jobStates = ['delayed', 'paused', 'wait', 'active'];
+    let jobStates = ['delayed', 'paused', 'wait', 'active', 'failed'];
 
     let totalJobs = jobStates.map(state => Number(jobCounts[state]) || 0).reduce((previousValue, currentValue) => previousValue + currentValue);