imapflow 1.6.0 → 1.6.1

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "1.6.0"
+    ".": "1.6.1"
 }

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.6.1](https://github.com/postalsys/imapflow/compare/v1.6.0...v1.6.1) (2026-07-27)
+
+
+### Bug Fixes
+
+* keep the authentication result on a verifyOnly connection ([8665c64](https://github.com/postalsys/imapflow/commit/8665c642f16988c630a779fa796c5801532ffd4a))
+
 ## [1.6.0](https://github.com/postalsys/imapflow/compare/v1.5.0...v1.6.0) (2026-07-27)
 
 

package/lib/imap-flow.js

@@ -2292,12 +2292,20 @@ class ImapFlow extends EventEmitter {
             // live server state. Cleared during the first close only, so repeated close() calls
             // stay idempotent and cannot emit an event twice.
             // `byeReason` is deliberately kept: it explains why the session ended.
+            //
+            // `authenticated` is kept for a verifyOnly connection, where it is the result rather
+            // than live state. That mode authenticates, optionally lists, and logs out before
+            // connect() resolves, so clearing it here left every caller reading `false` off a
+            // connection that had just authenticated successfully - there is no later moment at
+            // which the answer could be read, and such a client is never reconnected.
             let closedMailbox = false;
             if (!this.isClosed) {
                 closedMailbox = this.mailbox;
                 this.mailbox = false;
                 this.currentSelectCommand = false;
-                this.authenticated = false;
+                if (!this.options.verifyOnly) {
+                    this.authenticated = false;
+                }
                 this.preCheck = false;
             }
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "imapflow",
-    "version": "1.6.0",
+    "version": "1.6.1",
     "description": "IMAP Client for Node",
     "main": "lib/imap-flow.js",
     "types": "lib/imap-flow.d.ts",

package/test/imap-flow-server-test.js

@@ -615,6 +615,43 @@ module.exports['Server: verifyOnly connect lists mailboxes and logs out'] = asyn
     test.done();
 };
 
+module.exports['Server: verifyOnly keeps the authentication result after logging out'] = async test => {
+    // The whole point of verifyOnly is to report whether the credentials work. The mode logs out
+    // before connect() resolves, so if close() cleared `authenticated` the caller would read false
+    // off a connection that had just authenticated, with no later moment to read the real answer.
+    let server = createServer();
+    let port = await listen(server);
+    let client = makeClient(port, { verifyOnly: true, includeMailboxes: true });
+    client.on('error', () => {});
+
+    await client.connect();
+    test.ok(client.authenticated, 'authentication result survives the verifyOnly logout');
+
+    client.close();
+    test.ok(client.authenticated, 'and survives an explicit close as well');
+
+    server.close();
+    test.done();
+};
+
+module.exports['Server: an ordinary session clears the authentication state on close'] = async test => {
+    // The counterpart: for a session that is not verifyOnly, `authenticated` describes live state
+    // and must not survive the connection, or reconnect logic reads it as still signed in.
+    let server = createServer();
+    let port = await listen(server);
+    let client = makeClient(port);
+    client.on('error', () => {});
+
+    await client.connect();
+    test.ok(client.authenticated, 'authenticated while the session is up');
+
+    client.close();
+    test.equal(client.authenticated, false, 'cleared once the session ends');
+
+    server.close();
+    test.done();
+};
+
 module.exports['Server: ID is re-requested after login when first response is sparse'] = async test => {
     let idCalls = 0;
     let server = createServer({