imapflow 2.2.6 → 2.2.8

package/dist/esm/commands/delete.js

@@ -17,7 +17,8 @@ export default async function deleteMailbox(connection, path) {
     // IMAP servers reject DELETE on the currently selected mailbox (RFC 3501 6.3.4).
     let selected = getSelectedMailbox(connection);
     if (selected && selected.path === path) {
-        await connection.run('CLOSE');
+        // UNSELECT where possible, CLOSE would expunge messages flagged \Deleted
+        await connection.run('CLOSE', { unselect: true });
     }
     let response;
     try {

package/dist/esm/commands/enable.js

@@ -46,6 +46,12 @@ export default async function enable(connection, extensionList) {
         // extensions enabled by this command (RFC 5161), so a replace would drop
         // grants from an earlier ENABLE call
         connection.enabled = new Set([...connection.enabled, ...enabled]);
+        if (connection.enabled.has('QRESYNC')) {
+            // ENABLE QRESYNC is a CONDSTORE enabling command (RFC 7162 3.2.3), whether or not the
+            // server lists CONDSTORE in its ENABLED answer. Apache James advertises only QRESYNC
+            // and leaves a lone ENABLE CONDSTORE unanswered, which the RFC allows.
+            connection.enabled.add('CONDSTORE');
+        }
         response.next();
         return connection.enabled;
     }

package/dist/esm/commands/esearch-parser.js

@@ -69,9 +69,15 @@ export function parseEsearchResponse(attrs) {
                 const items = Array.isArray(listToken) ? listToken : null;
                 if (!items || items.length < 2)
                     break;
+                const range = items[0]?.value;
+                if (typeof range !== 'string')
+                    break;
+                // RFC 9394 partial-results is a sequence-set or NIL, the latter when the requested
+                // range lies past the end of the results. NIL is reported as an empty set.
+                const messages = items[1]?.value;
                 result.partial = {
-                    range: items[0].value,
-                    messages: items[1].value
+                    range,
+                    messages: typeof messages === 'string' ? messages : ''
                 };
                 break;
             }

package/dist/esm/commands/fetch.js

@@ -25,11 +25,20 @@ export default async function fetch(connection, range, query, options) {
     // Every pass returns or throws: the last throttled attempt throws instead of retrying.
     const maxRetries = 4;
     const baseDelay = 1000; // Start with 1 second delay
+    // The highest UID (sequence number for a plain FETCH) handed to the streaming consumer. A
+    // retried FETCH answers with every message again, so a retry skips up to it: servers answer
+    // in ascending order, which keeps this to one comparison per row rather than a set of every
+    // row delivered. The consumer was otherwise given the rows before the throttle twice.
+    let maxDelivered = 0;
     for (let retryCount = 0;; retryCount++) {
         let messages = {
             count: 0,
             list: []
         };
+        // The first error the onUntaggedFetch consumer reported through next(err). Errors thrown
+        // by untagged handlers are only logged by the connection, so it is kept here and fails
+        // the command once the FETCH completes; later messages are no longer handed to the consumer.
+        let consumerError = null;
         let response;
         try {
             /* c8 ignore next */ // range is guaranteed truthy by the early-return guard above, so the '*' fallback is unreachable
@@ -53,13 +62,30 @@ export default async function fetch(connection, range, query, options) {
                 };
                 queryStructure.push(bodyPeek);
             };
-            // IMAP fetch macros (ALL, FAST, FULL) and standard data items map directly to IMAP atoms
-            ['all', 'fast', 'full', 'uid', 'flags', 'bodyStructure', 'envelope', 'internalDate'].forEach(key => {
-                if (query[key]) {
+            // The ALL, FAST and FULL macros may only be sent on their own, never in a list with other
+            // items (RFC 3501 section 9), and UID is always in the list, so they are expanded into
+            // the items they stand for. FULL is expanded to BODYSTRUCTURE rather than the
+            // non-extensible BODY, as documented for the full option.
+            let full = !!query.full;
+            let all = !!query.all || full;
+            let fast = !!query.fast || all;
+            let items = {
+                flags: query.flags || fast,
+                internalDate: query.internalDate || fast,
+                size: query.size || fast,
+                envelope: query.envelope || all,
+                bodyStructure: query.bodyStructure || full
+            };
+            // standard data items map directly to IMAP atoms
+            if (query.uid) {
+                queryStructure.push({ type: 'ATOM', value: 'UID' });
+            }
+            ['flags', 'bodyStructure', 'envelope', 'internalDate'].forEach(key => {
+                if (items[key]) {
                     queryStructure.push({ type: 'ATOM', value: key.toUpperCase() });
                 }
             });
-            if (query.size) {
+            if (items.size) {
                 queryStructure.push({ type: 'ATOM', value: 'RFC822.SIZE' });
             }
             // Fetch full message source, optionally with byte range (start/maxLength)
@@ -179,18 +205,32 @@ export default async function fetch(connection, range, query, options) {
                     // (useful for large result sets). Otherwise, collect all into messages.list.
                     FETCH: async (untagged) => {
                         messages.count++;
-                        let formatted = await formatMessageResponse(untagged, mailbox, connection.idHashAlgorithm);
+                        if (consumerError) {
+                            return;
+                        }
+                        let formatted = await formatMessageResponse(untagged, mailbox, connection.idHashAlgorithm, connection);
                         if (typeof options.onUntaggedFetch === 'function') {
-                            await new Promise((resolve, reject) => {
-                                options.onUntaggedFetch(formatted, err => {
-                                    if (err) {
-                                        reject(err);
-                                    }
-                                    else {
-                                        resolve();
-                                    }
+                            /* c8 ignore next */ // a UID FETCH row without its UID is a non-compliant server, so the seq fallback is not exercised
+                            let key = options.uid ? formatted.uid || formatted.seq : formatted.seq;
+                            if (retryCount && key <= maxDelivered) {
+                                return;
+                            }
+                            maxDelivered = Math.max(maxDelivered, key);
+                            try {
+                                await new Promise((resolve, reject) => {
+                                    options.onUntaggedFetch(formatted, err => {
+                                        if (err) {
+                                            reject(err);
+                                        }
+                                        else {
+                                            resolve();
+                                        }
+                                    });
                                 });
-                            });
+                            }
+                            catch (err) {
+                                consumerError = err;
+                            }
                         }
                         else {
                             messages.list.push(formatted);
@@ -199,6 +239,9 @@ export default async function fetch(connection, range, query, options) {
                 }
             });
             response.next();
+            if (consumerError) {
+                throw consumerError;
+            }
             return messages;
         }
         catch (err) {

package/dist/esm/commands/id.js

@@ -1,4 +1,4 @@
-import { formatDateTime } from '../tools.js';
+import { formatDateTime, isUnsafeKey } from '../tools.js';
 /**
  * Sends ID info to the server and updates server info data based on the response.
  *
@@ -40,7 +40,14 @@ export default async function id(connection, clientInfo) {
                             key = val.value;
                         }
                         else if (typeof key === 'string' && typeof val.value === 'string') {
-                            map[key.toLowerCase().trim()] = val.value;
+                            // The server picks the keys of this object, which the caller reads
+                            // back as serverInfo: a prototype-chain name is skipped as it is for
+                            // every other server-named key, so it can neither be shadowed nor
+                            // written through
+                            let name = key.toLowerCase().trim();
+                            if (!isUnsafeKey(name)) {
+                                map[name] = val.value;
+                            }
                         }
                     });
                 }

package/dist/esm/commands/idle.js

@@ -1,4 +1,4 @@
-import { guardedPromise, hasCapability, logConnectionError, restampConnectionError, unrefTimer, clearTimer, getSelectedMailbox } from '../tools.js';
+import { guardedPromise, hasCapability, isServerRefusal, logConnectionError, restampConnectionError, unrefTimer, clearTimer, getSelectedMailbox } from '../tools.js';
 const NOOP_INTERVAL = 2 * 60 * 1000;
 /**
  * Marks the connection as idling on behalf of one session and returns a release function.
@@ -57,8 +57,11 @@ async function runIdle(connection) {
                     path: connection.mailbox && connection.mailbox.path,
                     cid: connection.id
                 });
-                connection.write('DONE');
+                // Marked before the write: write() closes the connection when the transport is
+                // already gone, and close() breaks IDLE through this very function, which
+                // would otherwise write DONE again from inside itself
                 doneSent = true;
+                connection.write('DONE');
                 releaseIdling();
                 if (connection.preCheck === ownPreCheck) {
                     connection.preCheck = false; // unset itself
@@ -124,7 +127,10 @@ async function runIdle(connection) {
         // A tagged NO or BAD only means the server refused IDLE; the connection is still usable,
         // so the waiters are released by the finally block below and their own commands run.
         // Anything else (close, lost socket, parser failure) fails the waiters too.
-        let refusedByServer = ['NO', 'BAD'].includes(err.responseStatus);
+        let refusedByServer = isServerRefusal(err);
+        if (refusedByServer) {
+            connection.skipIdle = true;
+        }
         if (preCheckWaitQueue.length && !refusedByServer) {
             // One error for the whole queue: every waiter failed at the same site, for the same
             // reason. Built inside the guard so a teardown with nothing queued - the common case -
@@ -310,7 +316,7 @@ export default async function idle(connection, maxIdleTime) {
     // If server supports IDLE (RFC 2177, folded into base IMAP4rev2), use it for
     // real-time push notifications. Otherwise, fall back to periodic polling with
     // NOOP/STATUS/SELECT.
-    if (hasCapability(connection, 'IDLE')) {
+    if (hasCapability(connection, 'IDLE') && !connection.skipIdle) {
         let idleTimer;
         let stillIdling = false;
         // IDLE loop: runs IDLE, and if maxIdleTime is reached, breaks and restarts to keep the
@@ -334,13 +340,17 @@ export default async function idle(connection, maxIdleTime) {
             }
             let resp = await runIdle(connection);
             clearTimeout(idleTimer);
-            if (!stillIdling) {
+            // A restart only makes sense with nothing queued behind the break (a CLOSE, say; run()
+            // re-arms auto-IDLE once that command is done) and the mailbox still selected on a
+            // usable connection
+            const canRestart = stillIdling && !connection.requestQueue.length && !!getSelectedMailbox(connection) && connection.usable;
+            if (!canRestart) {
                 return resp;
             }
             stillIdling = false;
         }
     }
-    // Fallback for servers without IDLE support: poll at regular intervals using
+    // Fallback for servers without IDLE support, or that refused it: poll at regular intervals using
     // NOOP (default), STATUS, or SELECT depending on missingIdleCommand config.
     return runPollingFallback(connection, maxIdleTime);
 }

package/dist/esm/commands/list.js

@@ -375,6 +375,15 @@ export default async function list(connection, reference, mailbox, options) {
         // Subscribed-only mailboxes that weren't in LIST are intentionally ignored
         // (they may be phantom entries from old subscriptions to deleted mailboxes).
         let runLsub = async () => {
+            // LIST has completed, so its entries are indexed once instead of searched per LSUB
+            // response, which was quadratic in the folder count. The first entry for a path wins,
+            // as with the linear search it replaces
+            let entriesByPath = new Map();
+            for (let entry of entries) {
+                if (!entriesByPath.has(entry.path)) {
+                    entriesByPath.set(entry.path, entry);
+                }
+            }
             let response = await connection.exec('LSUB', [encodePath(connection, normalizedReference), encodePath(connection, normalizedMailbox)], {
                 untagged: {
                     LSUB: async (untagged) => {
@@ -400,7 +409,7 @@ export default async function list(connection, reference, mailbox, options) {
                         entry.parent = entry.delimiter ? entry.path.split(entry.delimiter) : [entry.path];
                         entry.name = entry.parent.pop();
                         // Merge LSUB data into existing LIST entry if found
-                        let existing = entries.find(existing => existing.path === entry.path);
+                        let existing = entriesByPath.get(entry.path);
                         if (existing) {
                             existing.subscribed = true;
                             // Merge any additional flags from LSUB into the LIST entry

package/dist/esm/commands/login.js

@@ -1,4 +1,4 @@
-import { getStatusCode, getErrorText } from '../tools.js';
+import { getStatusCode, getErrorText, isServerRefusal } from '../tools.js';
 /**
  * Authenticates user using the IMAP LOGIN command.
  *
@@ -30,7 +30,11 @@ export default async function login(connection, username, password) {
         if (errorCode) {
             err.serverResponseCode = errorCode;
         }
-        err.authenticationFailed = true;
+        // Only a tagged NO/BAD is the server refusing the credentials; a lost connection or a
+        // timeout during LOGIN says nothing about them, and a caller may retry it
+        if (isServerRefusal(err)) {
+            err.authenticationFailed = true;
+        }
         err.response = await getErrorText(err.response);
         throw err;
     }

package/dist/esm/commands/logout.js

@@ -1,3 +1,7 @@
+import { clearTimer } from '../tools.js';
+// How long to wait for the server to answer LOGOUT before closing the socket anyway. Without a
+// bound of its own, an unanswered LOGOUT kept logout() pending until the socket timeout.
+const LOGOUT_TIMEOUT = 10 * 1000;
 /**
  * Logs out the user and closes the connection.
  *
@@ -16,6 +20,8 @@ export default async function logout(connection) {
         return false;
     }
     let response;
+    // close() rejects the pending LOGOUT with NoConnection, which counts as a completed logout
+    let timer = setTimeout(() => connection.close(), LOGOUT_TIMEOUT);
     try {
         response = await connection.exec('LOGOUT');
         return true;
@@ -33,6 +39,7 @@ export default async function logout(connection) {
         // Set state to LOGOUT before closing to prevent any further commands from
         // being queued. The socket is closed unconditionally in this finally block
         // regardless of whether the LOGOUT command succeeded or failed.
+        clearTimer(timer);
         connection.state = connection.states.LOGOUT;
         if (response && typeof response.next === 'function') {
             response.next();

package/dist/esm/commands/namespace.js

@@ -31,7 +31,8 @@ export default async function namespace(connection) {
     }
     let response;
     try {
-        let map = {};
+        // NIL personal namespaces and a missing NAMESPACE response leave the defaults in place
+        let map = { personal: [], other: false, shared: false };
         response = await connection.exec('NAMESPACE', false, {
             untagged: {
                 // The NAMESPACE response (RFC 2342) contains exactly three sections:
@@ -43,19 +44,22 @@ export default async function namespace(connection) {
                     if (!untagged.attributes || !untagged.attributes.length) {
                         return;
                     }
-                    map.personal = getNamsepaceInfo(untagged.attributes[0]);
+                    // NIL personal namespaces are legal (RFC 2342 section 5, e.g. after an anonymous login)
+                    map.personal = getNamsepaceInfo(untagged.attributes[0]) || [];
                     map.other = getNamsepaceInfo(untagged.attributes[1]);
                     map.shared = getNamsepaceInfo(untagged.attributes[2]);
                 }
             }
         });
+        // Release the response before touching the parsed data, so nothing below can leave the
+        // reader parked behind this command
+        response.next();
         connection.namespaces = map;
         // make sure that we have the first personal namespace always set
         if (!connection.namespaces.personal[0]) {
             connection.namespaces.personal[0] = { prefix: '', delimiter: '.' };
         }
         connection.namespaces.personal[0].prefix = connection.namespaces.personal[0].prefix || '';
-        response.next();
         connection.namespace = connection.namespaces.personal[0];
         return connection.namespace;
     }

package/dist/esm/commands/quota.js

@@ -11,7 +11,9 @@ export default async function quota(connection, path) {
         // nothing to do here
         return;
     }
-    if (!connection.capabilities.has('QUOTA')) {
+    // An RFC 9208 server advertises its QUOTA=RES-* resource types and does not have to list
+    // the bare RFC 2087 QUOTA token as well
+    if (!connection.capabilities.has('QUOTA') && ![...connection.capabilities.keys()].some(capability => capability.startsWith('QUOTA=RES-'))) {
         return false;
     }
     path = normalizePath(connection, path);

package/dist/esm/commands/rename.js

@@ -21,7 +21,8 @@ export default async function rename(connection, path, newPath) {
     // as IMAP servers will not rename an active mailbox.
     let selected = getSelectedMailbox(connection);
     if (selected && selected.path === path) {
-        await connection.run('CLOSE');
+        // UNSELECT where possible, CLOSE would expunge messages flagged \Deleted
+        await connection.run('CLOSE', { unselect: true });
     }
     let response;
     try {

package/dist/esm/commands/select.js

@@ -226,6 +226,11 @@ export default async function select(connection, pathInput, options) {
         if (!currentMailbox || currentMailbox.path !== path) {
             emitSafe(connection, 'mailboxOpen', connection.mailbox);
         }
+        else if (typeof map.exists === 'number' && map.exists !== currentMailbox.exists) {
+            // A re-SELECT of the open mailbox (the SELECT polling fallback) gets its EXISTS here
+            // instead of in the global handler, so it is reported the same way
+            emitSafe(connection, 'exists', { path, count: map.exists, prevCount: currentMailbox.exists });
+        }
         response.next();
         return map;
     }

package/dist/esm/commands/status.js

@@ -1,4 +1,4 @@
-import { encodePath, normalizePath, buildStatusQueryAttributes, isRev2Active, isAuthenticatedState, emitSafe, getSelectedMailbox } from '../tools.js';
+import { encodePath, normalizePath, buildStatusQueryAttributes, isRev2Active, isAuthenticatedState, emitSafe, getSelectedMailbox, logConnectionError } from '../tools.js';
 import { parseStatusList } from './status-fields.js';
 // STATUS fields that also refresh the live mailbox state when the queried mailbox is the
 // currently selected one. Keyed by the output property name parseStatusList() reports.
@@ -89,7 +89,12 @@ export default async function status(connection, path, query) {
         // Not a deadlock, and only reachable when the server rejects the STATUS, but a polled
         // STATUS of a missing folder ends the poll early.
         if (err.responseStatus === 'NO') {
-            let folders = await connection.run('LIST', '', path, { listOnly: true });
+            // A failing probe (lost connection, throttling) answers nothing about the mailbox,
+            // so STATUS then fails the same way as any other failed STATUS
+            let folders = await connection.run('LIST', '', path, { listOnly: true }).catch((listErr) => {
+                logConnectionError(connection, 'Failed to check if the mailbox exists', listErr);
+                return false;
+            });
             if (folders && !folders.length) {
                 let error = new Error(`Mailbox doesn't exist: ${path}`);
                 error.code = 'NotFound';

package/dist/esm/commands/store.d.ts

@@ -16,4 +16,4 @@ export interface StoreCommandOptions extends StoreOptions {
  * @param options - Store options
  * @returns True on success, false on failure or if nothing to do
  */
-export default function store(connection: ImapFlow, range: string, flags: string | string[], options: StoreCommandOptions): Promise<boolean>;
+export default function store(connection: ImapFlow, range: string, flags: string | string[], options?: StoreCommandOptions | undefined): Promise<boolean>;

package/dist/esm/commands/store.js

@@ -1,4 +1,4 @@
-import { formatFlag, canUseFlag, reportCommandError, getSelectedMailbox } from '../tools.js';
+import { formatFlag, canUseFlag, encodePath, reportCommandError, getSelectedMailbox } from '../tools.js';
 /**
  * Updates flags or labels for messages in the selected mailbox.
  *
@@ -9,13 +9,12 @@ import { formatFlag, canUseFlag, reportCommandError, getSelectedMailbox } from '
  * @returns True on success, false on failure or if nothing to do
  */
 export default async function store(connection, range, flags, options) {
+    options = options || {};
     let mailbox = getSelectedMailbox(connection);
     if (!mailbox || !range || (options.useLabels && !connection.capabilities.has('X-GM-EXT-1'))) {
         // nothing to do here
         return false;
     }
-    /* c8 ignore next */ // options.useLabels is dereferenced in the guard above, so options is always defined here
-    options = options || {};
     // Build the IMAP STORE operation name. The format is:
     //   [+|-]FLAGS[.SILENT] or [+|-]X-GM-LABELS
     // Where: no prefix = replace all, + = add, - = remove
@@ -59,7 +58,10 @@ export default async function store(connection, range, flags, options) {
     const dropped = [];
     flags = (Array.isArray(flags) ? flags : [].concat(flags || []))
         .map(flag => {
-        let formatted = formatFlag(flag);
+        // Gmail labels other than the \-prefixed system labels are mailbox names: astrings in
+        // the form mailbox names take on the session (modified UTF-7 unless UTF-8 is enabled),
+        // not atoms like IMAP keywords
+        let formatted = options.useLabels && flag && flag.charAt(0) !== '\\' ? encodePath(connection, flag) : formatFlag(flag);
         if (!formatted || (!canUseFlag(flagSource, formatted) && operationName !== 'remove')) {
             dropped.push(flag);
             return false;
@@ -81,13 +83,10 @@ export default async function store(connection, range, flags, options) {
     if (!flags.length && !clearAll) {
         return false;
     }
-    let attributes = [
-        { type: 'SEQUENCE', value: range },
-        { type: 'ATOM', value: operation },
-        flags.map(flag => ({ type: 'ATOM', value: flag }))
-    ];
+    let attributes = [{ type: 'SEQUENCE', value: range }];
     // CONDSTORE (RFC 7162): UNCHANGEDSINCE modifier prevents updating messages whose
     // mod-sequence is higher than the specified value, avoiding overwriting concurrent changes.
+    // The store-modifiers list goes between the sequence set and the item name (section 3.1.3).
     if (options.unchangedSince && connection.enabled.has('CONDSTORE') && !mailbox.noModseq) {
         attributes.push([
             {
@@ -100,6 +99,7 @@ export default async function store(connection, range, flags, options) {
             }
         ]);
     }
+    attributes.push({ type: 'ATOM', value: operation }, flags.map(flag => ({ type: 'ATOM', value: flag })));
     let response;
     try {
         response = await connection.exec(options.uid ? 'UID STORE' : 'STORE', attributes);