imapkit 4.0.2 → 4.1.0

package/{lib → dist/esm}/plugins/acl.js

@@ -1,13 +1,10 @@
-'use strict';
-
-const { states } = require('../command-states');
-const { normalizeSystemFlag, checkSystemFlags } = require('../commands/handlers/flags');
-const builtinStoreHandlers = require('../commands/handlers/store');
-const { getListExtensions } = require('../list-extensions');
-const { beginSelect } = require('../commands/select');
-const { getPendingTarget } = require('../commands/append');
-const { isAstring } = require('../arguments');
-
+import { states } from '../command-states.js';
+import { normalizeSystemFlag, checkSystemFlags } from '../commands/handlers/flags.js';
+import builtinStoreHandlers from '../commands/handlers/store.js';
+import { getListExtensions } from '../list-extensions.js';
+import { beginSelect } from '../commands/select.js';
+import { getPendingTarget } from '../commands/append.js';
+import { isAstring } from '../arguments.js';
 /**
  * @help Adds ACL [RFC4314] capability with RIGHTS=texk
  * @help The owner (server option "aclOwner", default "testuser")
@@ -26,7 +23,6 @@ const { isAstring } = require('../arguments');
  *
  * Users other than the owner can only do what their rights allow (RFC 4314 section 4).
  */
-
 // RFC 4314 section 2.1, in the order they are listed in responses
 const RIGHTS = 'lrswipkxtea';
 const ALL_RIGHTS = new Set(RIGHTS);
@@ -41,7 +37,6 @@ const FLAG_RIGHTS = ['s', 'w', 't'];
 // RFC 4314 section 4: MYRIGHTS needs any of these
 const ANY_RIGHTS = ['l', 'r', 'i', 'k', 'x', 'a'];
 const STORE_ITEMS = ['FLAGS', '+FLAGS', '-FLAGS', 'FLAGS.SILENT', '+FLAGS.SILENT', '-FLAGS.SILENT'];
-
 /**
  * Formats an astring for a response. The compiler sends an ATOM value that is not a valid atom as a
  * quoted string or a literal, only a leading "\\" (allowed for flags) and NIL have to be kept away from it
@@ -55,7 +50,6 @@ function astring(value) {
     // an atom NIL would read back as NIL, not as an identifier
     return value && value.charAt(0) !== '\\' && !/^NIL$/i.test(value) ? { type: 'ATOM', value } : value;
 }
-
 /**
  * Creates an error that is answered with BAD
  *
@@ -67,7 +61,6 @@ function badInput(message) {
     err.imapResponse = 'BAD';
     return err;
 }
-
 /**
  * Parses a rights string, the virtual "c" and "d" rights are expanded (RFC 4314 section 2.1.1)
  *
@@ -80,17 +73,19 @@ function parseRights(value) {
     for (const chr of value) {
         if (ALL_RIGHTS.has(chr)) {
             rights.add(chr);
-        } else if (Object.hasOwn(VIRTUAL_RIGHTS, chr)) {
-            VIRTUAL_RIGHTS[chr].split('').forEach(right => rights.add(right));
-        } else if (/^[A-Z]$/.test(chr)) {
+        }
+        else if (Object.hasOwn(VIRTUAL_RIGHTS, chr)) {
+            VIRTUAL_RIGHTS[chr].split('').forEach((right) => rights.add(right));
+        }
+        else if (/^[A-Z]$/.test(chr)) {
             throw badInput('Uppercase rights are not allowed');
-        } else {
+        }
+        else {
             throw badInput('The ' + (/^[\x21-\x7e]$/.test(chr) ? chr + ' ' : '') + 'right is not supported');
         }
     }
     return rights;
 }
-
 /**
  * Builds the attributes of an ACL, LISTRIGHTS or MYRIGHTS response. The mailbox name is a MAILBOX
  * attribute, so each session gets it in the form it uses (modified UTF-7, or UTF-8 after ENABLE
@@ -101,9 +96,8 @@ function parseRights(value) {
  * @return {Array} Response attributes
  */
 function mailboxResponse(mailbox, values) {
-    return [{ type: 'MAILBOX', value: mailbox.path }].concat(values.map(astring));
+    return [{ type: 'MAILBOX', value: mailbox.path }].concat(values.map(value => astring(value)));
 }
-
 /**
  * Formats rights for ACL and MYRIGHTS responses. "c" and "d" are added when any of their
  * member rights is set (RFC 4314 section 2.1.1)
@@ -116,13 +110,12 @@ function formatRights(rights) {
         .filter(right => rights.has(right))
         .join('');
     Object.keys(VIRTUAL_RIGHTS).forEach(virtual => {
-        if (VIRTUAL_RIGHTS[virtual].split('').some(right => rights.has(right))) {
+        if (VIRTUAL_RIGHTS[virtual].split('').some((right) => rights.has(right))) {
             result += virtual;
         }
     });
     return result;
 }
-
 /**
  * Checks an identifier argument. RFC 4314 section 3 asks for SASLprep, which is not implemented,
  * but an identifier that SASLprep would refuse (control characters, invalid UTF-8) or that is
@@ -145,16 +138,12 @@ function identifierError(identifier) {
     }
     return false;
 }
-
-module.exports = function (server) {
+export default function aclPlugin(server) {
     server.registerCapability('ACL');
     // RFC 4314 section 5.1.1: the rights not defined in RFC 2086, MUST include "t", "e", "x" and "k"
     server.registerCapability('RIGHTS=texk');
-
     const owner = typeof server.options.aclOwner === 'string' ? server.options.aclOwner : 'testuser';
-
-    const isOwner = connection => connection.username === owner;
-
+    const isOwner = (connection) => connection.username === owner;
     /**
      * Returns the ACL of a mailbox as a Map of identifier to a Set of rights. The ACL from the
      * storage (an object of identifier to rights string) is converted on first use
@@ -162,14 +151,15 @@ module.exports = function (server) {
      * @param {Object} mailbox Mailbox object
      * @return {Map}
      */
-    const getAcl = mailbox => {
+    const getAcl = (mailbox) => {
         if (!(mailbox.acl instanceof Map)) {
             const acl = new Map();
             const source = mailbox.acl && typeof mailbox.acl === 'object' ? mailbox.acl : {};
             Object.keys(source).forEach(identifier => {
                 try {
                     acl.set(identifier, parseRights(String(source[identifier])));
-                } catch (err) {
+                }
+                catch (err) {
                     // not a client error, so this is answered with NO [SERVERBUG]
                     throw new Error('Invalid ACL in storage for ' + mailbox.path + ': ' + err.message, { cause: err });
                 }
@@ -178,7 +168,6 @@ module.exports = function (server) {
         }
         return mailbox.acl;
     };
-
     /**
      * Returns the rights a user has on a mailbox. The owner has all rights, other users get the
      * union of the rights of their own identifier and "anyone", minus the negative rights of
@@ -197,14 +186,12 @@ module.exports = function (server) {
         acl = acl || getAcl(mailbox);
         const identifiers = ['anyone'].concat(typeof username === 'string' && username ? username : []);
         const rights = new Set();
-        identifiers.forEach(identifier => (acl.get(identifier) || []).forEach(right => rights.add(right)));
-        identifiers.forEach(identifier => (acl.get('-' + identifier) || []).forEach(right => rights.delete(right)));
+        identifiers.forEach(identifier => (acl.get(identifier) || []).forEach((right) => rights.add(right)));
+        identifiers.forEach(identifier => (acl.get('-' + identifier) || []).forEach((right) => rights.delete(right)));
         return rights;
     };
-
     // for plugins that report only what a user may see (e.g. NOTIFY)
     server.acl = { getRights, isOwner };
-
     // Tells plugins that the ACL of a mailbox changed, with an `acl` event `(mailbox, previousAcl)`
     const changeAcl = (mailbox, change) => {
         const acl = getAcl(mailbox);
@@ -212,7 +199,6 @@ module.exports = function (server) {
         change(acl);
         server.emit('acl', mailbox, previous);
     };
-
     // CATENATE (RFC 4469 section 5): reading a message through an IMAP URL needs the "r" right, a
     // mailbox without "l" is reported like one that does not exist (RFC 4314 section 6)
     server.urlAccessChecks.push((connection, mailbox) => {
@@ -222,20 +208,17 @@ module.exports = function (server) {
         }
         return false;
     });
-
     // MULTISEARCH (RFC 7377 section 2.2): searching needs "r", and "l" for a mailbox that the client did not name.
     // Other mailboxes are left out without an error
     server.searchAccessChecks.push((connection, mailbox, named) => {
         const rights = getRights(connection, mailbox);
         return rights.has('r') && (named || rights.has('l'));
     });
-
     // Rights on the selected mailbox are taken when it is selected (RFC 4314 section 5.1.1 allows caching
     // them), so the FLAGS and PERMANENTFLAGS a session got stay correct until the next SELECT
-    const getSelectedRights = connection => connection.aclRights || ALL_RIGHTS;
-
+    const getSelectedRights = (connection) => connection.aclRights || ALL_RIGHTS;
     // RFC 4314 section 4: "t" for \Deleted, "s" for \Seen and "w" for all other flags
-    const flagRight = flag => {
+    const flagRight = (flag) => {
         flag = normalizeSystemFlag(flag);
         if (flag === '\\Deleted') {
             return 't';
@@ -245,24 +228,19 @@ module.exports = function (server) {
         }
         return 'w';
     };
-
-    const flagValue = flag => (typeof flag === 'string' ? flag : String((flag && flag.value) || ''));
-
+    // flags are strings or parsed atoms
+    const flagValue = (flag) => (typeof flag === 'string' ? flag : String((flag && flag.value) || ''));
     const canSetFlag = (rights, flag) => rights.has(flagRight(flagValue(flag)));
-
     const mailboxArgument = (parsed, position) => {
         const attr = (parsed.attributes || [])[position];
         return isAstring(attr) ? attr.value : false;
     };
-
     // the mailbox named by an argument, false if there is no such mailbox or the argument is invalid
     const argumentMailbox = (parsed, position) => {
         const name = mailboxArgument(parsed, position);
         return (name !== false && server.getMailbox(name)) || false;
     };
-
     const sendNoPerm = (connection, parsed, data, description) => connection.sendStatus(parsed, data, 'NO', 'Permission denied', 'NOPERM', description);
-
     /**
      * Refuses a command for lack of rights. Without the "l" right the user gets the same error
      * as for a mailbox that does not exist, so the existence of the mailbox is not disclosed
@@ -271,20 +249,21 @@ module.exports = function (server) {
     const sendDenied = (connection, parsed, data, rights, description, notFound) => {
         if (rights.has('l')) {
             sendNoPerm(connection, parsed, data, description);
-        } else if (notFound === 'TRYCREATE') {
+        }
+        else if (notFound === 'TRYCREATE') {
             connection.sendStatus(parsed, data, 'NO', 'Target mailbox does not exist', 'TRYCREATE', description);
-        } else {
+        }
+        else {
             connection.sendStatus(parsed, data, 'NO', 'Mailbox does not exist', 'NONEXISTENT', description);
         }
     };
-
     /**
      * Finds the nearest existing parent of a mailbox name (RFC 4314 section 4, CREATE)
      *
      * @param {String} path Mailbox path
      * @return {Object|Boolean} parent mailbox or false if there is none
      */
-    const getParent = path => {
+    const getParent = (path) => {
         for (let parent = server.getParentPath(path); parent; parent = server.getParentPath(parent)) {
             const mailbox = server.getMailbox(parent);
             if (mailbox) {
@@ -293,7 +272,6 @@ module.exports = function (server) {
         }
         return false;
     };
-
     // Checks for the ACL commands, true if the command can go ahead
     const checkAclCommand = (connection, parsed, data, mailbox, isAllowed) => {
         if (!mailbox) {
@@ -302,14 +280,12 @@ module.exports = function (server) {
         }
         const rights = getRights(connection, mailbox);
         if (!isAllowed(rights)) {
-            sendDenied(connection, parsed, data, rights, false);
+            sendDenied(connection, parsed, data, rights);
             return false;
         }
         return true;
     };
-
-    const hasAdmin = rights => rights.has('a');
-
+    const hasAdmin = (rights) => rights.has('a');
     /**
      * Validates the arguments of an ACL command: `count` astrings, the first one a mailbox name and
      * the second one (if any) an identifier
@@ -335,7 +311,6 @@ module.exports = function (server) {
         }
         return true;
     };
-
     // RFC 4314 section 2: an implementation MAY force rights to always be granted to an identifier
     const refuseOwnerIdentifier = (connection, parsed, data) => {
         const identifier = parsed.attributes[1].value;
@@ -345,28 +320,17 @@ module.exports = function (server) {
         connection.sendStatus(parsed, data, 'NO', 'Rights of the mailbox owner can not be changed', 'CANNOT');
         return true;
     };
-
     const aclCommand = (count, handler) => (connection, parsed, data, callback) => {
         if (checkArguments(connection, parsed, data, count)) {
             handler(connection, parsed, data, server.getMailbox(parsed.attributes[0].value));
         }
         callback();
     };
-
     const aclOptions = { states: states.AUTHENTICATED, mailboxArguments: [0] };
     // RFC 4314 section 7: identifier and mod-rights are astrings
     const identifierOptions = Object.assign({ astringArguments: [1] }, aclOptions);
-
     // RFC 4314 section 3.8: myrights-data = "MYRIGHTS" SP mailbox SP rights
-    const sendMyRights = (connection, mailbox, parsed, data) =>
-        connection.send(
-            { tag: '*', command: 'MYRIGHTS', attributes: mailboxResponse(mailbox, [formatRights(getRights(connection, mailbox))]) },
-            'MYRIGHTS',
-            parsed,
-            data,
-            mailbox
-        );
-
+    const sendMyRights = (connection, mailbox, parsed, data) => connection.send({ tag: '*', command: 'MYRIGHTS', attributes: mailboxResponse(mailbox, [formatRights(getRights(connection, mailbox))]) }, 'MYRIGHTS', parsed, data, mailbox);
     // RFC 8440 section 3: the MYRIGHTS return option of an extended LIST. The registry is shared with
     // LIST-EXTENDED, which accepts the option only when it is loaded, in any load order
     const listExtensions = getListExtensions(server);
@@ -380,107 +344,81 @@ module.exports = function (server) {
             }
         }
     };
-
     // RFC 4314 section 3.1
-    server.setCommandHandler(
-        'SETACL',
-        aclCommand(3, (connection, parsed, data, mailbox) => {
-            const identifier = parsed.attributes[1].value;
-            const modification = parsed.attributes[2].value;
-            const mode = /^[+-]/.test(modification) ? modification.charAt(0) : '';
-
-            // an unrecognized right MUST cause BAD, before anything else is checked
-            const rights = parseRights(modification.substr(mode.length));
-
-            if (!checkAclCommand(connection, parsed, data, mailbox, hasAdmin) || refuseOwnerIdentifier(connection, parsed, data)) {
-                return;
-            }
-
-            changeAcl(mailbox, acl => {
-                const current = new Set(acl.get(identifier) || []);
-                if (mode === '+') {
-                    rights.forEach(right => current.add(right));
-                } else if (mode === '-') {
-                    rights.forEach(right => current.delete(right));
-                }
-                const updated = mode ? current : rights;
-                if (updated.size) {
-                    acl.set(identifier, updated);
-                } else {
-                    acl.delete(identifier);
-                }
-            });
-            connection.sendStatus(parsed, data, 'OK', 'Setacl complete');
-        }),
-        Object.assign({ astringArguments: [1, 2] }, aclOptions)
-    );
-
-    // RFC 4314 section 3.2
-    server.setCommandHandler(
-        'DELETEACL',
-        aclCommand(2, (connection, parsed, data, mailbox) => {
-            if (!checkAclCommand(connection, parsed, data, mailbox, hasAdmin) || refuseOwnerIdentifier(connection, parsed, data)) {
-                return;
+    server.setCommandHandler('SETACL', aclCommand(3, (connection, parsed, data, mailbox) => {
+        const identifier = parsed.attributes[1].value;
+        const modification = parsed.attributes[2].value;
+        const mode = /^[+-]/.test(modification) ? modification.charAt(0) : '';
+        // an unrecognized right MUST cause BAD, before anything else is checked
+        const rights = parseRights(modification.substr(mode.length));
+        if (!checkAclCommand(connection, parsed, data, mailbox, hasAdmin) || refuseOwnerIdentifier(connection, parsed, data)) {
+            return;
+        }
+        changeAcl(mailbox, acl => {
+            const current = new Set(acl.get(identifier) || []);
+            if (mode === '+') {
+                rights.forEach(right => current.add(right));
             }
-            changeAcl(mailbox, acl => acl.delete(parsed.attributes[1].value));
-            connection.sendStatus(parsed, data, 'OK', 'Deleteacl complete');
-        }),
-        identifierOptions
-    );
-
-    // RFC 4314 sections 3.3 and 3.6
-    server.setCommandHandler(
-        'GETACL',
-        aclCommand(1, (connection, parsed, data, mailbox) => {
-            if (!checkAclCommand(connection, parsed, data, mailbox, hasAdmin)) {
-                return;
+            else if (mode === '-') {
+                rights.forEach(right => current.delete(right));
             }
-            const attributes = [owner, formatRights(ALL_RIGHTS)];
-            getAcl(mailbox).forEach((rights, identifier) => {
-                attributes.push(identifier, formatRights(rights));
-            });
-            connection.send({ tag: '*', command: 'ACL', attributes: mailboxResponse(mailbox, attributes) }, 'ACL', parsed, data, mailbox);
-            connection.sendStatus(parsed, data, 'OK', 'Getacl complete');
-        }),
-        aclOptions
-    );
-
-    // RFC 4314 sections 3.4 and 3.7
-    server.setCommandHandler(
-        'LISTRIGHTS',
-        aclCommand(2, (connection, parsed, data, mailbox) => {
-            if (!checkAclCommand(connection, parsed, data, mailbox, hasAdmin)) {
-                return;
+            const updated = mode ? current : rights;
+            if (updated.size) {
+                acl.set(identifier, updated);
             }
-            // the identifier is sent back in the same form as the client used
-            const identifier = parsed.attributes[1].value;
-            let attributes;
-            if (identifier === owner) {
-                // the owner always has every right, nothing is optional
-                attributes = [identifier, formatRights(ALL_RIGHTS)];
-            } else {
-                // nothing is granted always, every right can be granted on its own, including the virtual ones
-                attributes = [identifier, ''].concat(RIGHTS.split(''), Object.keys(VIRTUAL_RIGHTS));
+            else {
+                acl.delete(identifier);
             }
-            connection.send({ tag: '*', command: 'LISTRIGHTS', attributes: mailboxResponse(mailbox, attributes) }, 'LISTRIGHTS', parsed, data, mailbox);
-            connection.sendStatus(parsed, data, 'OK', 'Listrights complete');
-        }),
-        identifierOptions
-    );
-
+        });
+        connection.sendStatus(parsed, data, 'OK', 'Setacl complete');
+    }), Object.assign({ astringArguments: [1, 2] }, aclOptions));
+    // RFC 4314 section 3.2
+    server.setCommandHandler('DELETEACL', aclCommand(2, (connection, parsed, data, mailbox) => {
+        if (!checkAclCommand(connection, parsed, data, mailbox, hasAdmin) || refuseOwnerIdentifier(connection, parsed, data)) {
+            return;
+        }
+        changeAcl(mailbox, acl => acl.delete(parsed.attributes[1].value));
+        connection.sendStatus(parsed, data, 'OK', 'Deleteacl complete');
+    }), identifierOptions);
+    // RFC 4314 sections 3.3 and 3.6
+    server.setCommandHandler('GETACL', aclCommand(1, (connection, parsed, data, mailbox) => {
+        if (!checkAclCommand(connection, parsed, data, mailbox, hasAdmin)) {
+            return;
+        }
+        const attributes = [owner, formatRights(ALL_RIGHTS)];
+        getAcl(mailbox).forEach((rights, identifier) => {
+            attributes.push(identifier, formatRights(rights));
+        });
+        connection.send({ tag: '*', command: 'ACL', attributes: mailboxResponse(mailbox, attributes) }, 'ACL', parsed, data, mailbox);
+        connection.sendStatus(parsed, data, 'OK', 'Getacl complete');
+    }), aclOptions);
+    // RFC 4314 sections 3.4 and 3.7
+    server.setCommandHandler('LISTRIGHTS', aclCommand(2, (connection, parsed, data, mailbox) => {
+        if (!checkAclCommand(connection, parsed, data, mailbox, hasAdmin)) {
+            return;
+        }
+        // the identifier is sent back in the same form as the client used
+        const identifier = parsed.attributes[1].value;
+        let attributes;
+        if (identifier === owner) {
+            // the owner always has every right, nothing is optional
+            attributes = [identifier, formatRights(ALL_RIGHTS)];
+        }
+        else {
+            // nothing is granted always, every right can be granted on its own, including the virtual ones
+            attributes = [identifier, ''].concat(RIGHTS.split(''), Object.keys(VIRTUAL_RIGHTS));
+        }
+        connection.send({ tag: '*', command: 'LISTRIGHTS', attributes: mailboxResponse(mailbox, attributes) }, 'LISTRIGHTS', parsed, data, mailbox);
+        connection.sendStatus(parsed, data, 'OK', 'Listrights complete');
+    }), identifierOptions);
     // RFC 4314 sections 3.5 and 3.8
-    server.setCommandHandler(
-        'MYRIGHTS',
-        aclCommand(1, (connection, parsed, data, mailbox) => {
-            if (!checkAclCommand(connection, parsed, data, mailbox, rights => ANY_RIGHTS.some(right => rights.has(right)))) {
-                return;
-            }
-            sendMyRights(connection, mailbox, parsed, data);
-            connection.sendStatus(parsed, data, 'OK', 'Myrights complete');
-        }),
-        aclOptions
-    );
-
+    server.setCommandHandler('MYRIGHTS', aclCommand(1, (connection, parsed, data, mailbox) => {
+        if (!checkAclCommand(connection, parsed, data, mailbox, (rights) => ANY_RIGHTS.some(right => rights.has(right)))) {
+            return;
+        }
+        sendMyRights(connection, mailbox, parsed, data);
+        connection.sendStatus(parsed, data, 'OK', 'Myrights complete');
+    }), aclOptions);
     // Enforcement (RFC 4314 section 4). Commands are wrapped once every plugin is loaded, so that
     // the commands of every plugin (MOVE, UID EXPUNGE, ...) are covered whatever the load order is
     const wrappers = {};
@@ -499,7 +437,6 @@ module.exports = function (server) {
                 });
             }
         });
-
         // Return options of an extended LIST (LIST-STATUS, LIST-MYRIGHTS) add responses for the listed
         // mailboxes, so they skip the mailboxes that are not listed for the user. STATUS also needs "r"
         // (RFC 5819 section 2: the STATUS response MUST NOT be returned if the mailbox can not be selected)
@@ -520,7 +457,6 @@ module.exports = function (server) {
                 }
             };
         });
-
         // RFC 4314 section 4: STORE changes only the flags the user has rights for
         STORE_ITEMS.forEach(item => {
             const prevHandler = server.storeHandlers[item] || builtinStoreHandlers[item];
@@ -531,8 +467,8 @@ module.exports = function (server) {
                 }
                 flags = [].concat(flags);
                 // invalid flags are still refused with BAD, even if the user could not set them anyway
-                flags.forEach(flag => checkSystemFlags(connection, normalizeSystemFlag(flagValue(flag))));
-                let allowed = flags.filter(flag => canSetFlag(rights, flag));
+                flags.forEach((flag) => checkSystemFlags(connection, normalizeSystemFlag(flagValue(flag))));
+                let allowed = flags.filter((flag) => canSetFlag(rights, flag));
                 if (item.charAt(0) !== '+' && item.charAt(0) !== '-') {
                     // replacing the flags keeps the ones the user can not change
                     allowed = message.flags.filter(flag => !canSetFlag(rights, flag)).concat(allowed);
@@ -541,9 +477,7 @@ module.exports = function (server) {
             };
         });
     };
-
     server.once('pluginsLoaded', wrapCommands);
-
     const selectWrapper = (prevHandler, connection, parsed, data, callback) => {
         const mailbox = argumentMailbox(parsed, 0);
         if (!mailbox) {
@@ -567,31 +501,25 @@ module.exports = function (server) {
     };
     wrappers.SELECT = selectWrapper;
     wrappers.EXAMINE = selectWrapper;
-
     // Checks that the user has a right on the mailbox named by an argument. Unknown mailboxes and
     // invalid arguments are left to the command handler
     const hasMailboxRight = (right, position, notFound) => (connection, parsed, data) => {
         const mailbox = argumentMailbox(parsed, position);
         const rights = mailbox && getRights(connection, mailbox);
         if (rights && !rights.has(right)) {
-            sendDenied(connection, parsed, data, rights, false, notFound);
+            sendDenied(connection, parsed, data, rights, undefined, notFound);
             return false;
         }
         return true;
     };
-
     const requireRight = (right, position, notFound) => {
         const check = hasMailboxRight(right, position, notFound);
-        return (prevHandler, connection, parsed, data, callback) =>
-            check(connection, parsed, data) ? prevHandler(connection, parsed, data, callback) : callback();
+        return (prevHandler, connection, parsed, data, callback) => check(connection, parsed, data) ? prevHandler(connection, parsed, data, callback) : callback();
     };
-
     wrappers.STATUS = requireRight('r', 0);
     // SUBSCRIBE checks that the mailbox exists, so it needs "l". UNSUBSCRIBE needs no rights
     wrappers.SUBSCRIBE = requireRight('l', 0);
-
     wrappers.DELETE = requireRight('x', 0);
-
     // CREATE needs "k" on the nearest existing parent, a mailbox at the top level can not be created
     const checkCreateRight = (connection, parsed, data, path) => {
         const parent = getParent(path);
@@ -601,7 +529,6 @@ module.exports = function (server) {
         }
         return true;
     };
-
     wrappers.CREATE = (prevHandler, connection, parsed, data, callback) => {
         const name = mailboxArgument(parsed, 0);
         if (name !== false && !checkCreateRight(connection, parsed, data, name)) {
@@ -609,7 +536,6 @@ module.exports = function (server) {
         }
         return prevHandler(connection, parsed, data, callback);
     };
-
     // RENAME needs "x" on the mailbox and "k" on the new parent
     const hasRenameRight = hasMailboxRight('x', 0);
     wrappers.RENAME = (prevHandler, connection, parsed, data, callback) => {
@@ -622,7 +548,6 @@ module.exports = function (server) {
         }
         return prevHandler(connection, parsed, data, callback);
     };
-
     // APPEND needs "i", and only the flags the user has rights for are stored
     wrappers.APPEND = (prevHandler, connection, parsed, data, callback) => {
         const mailbox = argumentMailbox(parsed, 0);
@@ -635,18 +560,18 @@ module.exports = function (server) {
             return callback();
         }
         const flags = parsed.attributes[1];
-        if (Array.isArray(flags) && flags.every(flag => flag && flag.type === 'ATOM')) {
+        if (Array.isArray(flags) && flags.every((flag) => flag && flag.type === 'ATOM')) {
             try {
-                flags.forEach(flag => checkSystemFlags(connection, normalizeSystemFlag(flag.value)));
+                flags.forEach((flag) => checkSystemFlags(connection, normalizeSystemFlag(flag.value)));
                 // the server MUST NOT fail APPEND for flags the user can not set
-                parsed.attributes[1] = flags.filter(flag => canSetFlag(rights, flag));
-            } catch {
+                parsed.attributes[1] = flags.filter((flag) => canSetFlag(rights, flag));
+            }
+            catch {
                 // invalid flags are refused with BAD by the APPEND handler
             }
         }
         return prevHandler(connection, parsed, data, callback);
     };
-
     // the refusal for a target mailbox without "i", see sendDenied
     const insertRefusal = (connection, mailbox) => {
         const rights = mailbox ? getRights(connection, mailbox) : false;
@@ -657,11 +582,10 @@ module.exports = function (server) {
             ? { command: 'NO', code: 'NOPERM', text: 'Permission denied' }
             : { command: 'NO', code: 'TRYCREATE', text: 'Target mailbox does not exist' };
     };
-
     // COPY and MOVE need "i" on the target, MOVE also needs what UID STORE \Deleted and UID EXPUNGE
     // need on the source, "t" and "e" (RFC 6851 section 4.2)
     const requireInsert = requireRight('i', 1, 'TRYCREATE');
-    const copyWrapper = isMove => (prevHandler, connection, parsed, data, callback) => {
+    const copyWrapper = (isMove) => (prevHandler, connection, parsed, data, callback) => {
         const command = parsed.command.toUpperCase();
         if (isMove && !connection.readOnly) {
             const rights = getSelectedRights(connection);
@@ -676,7 +600,6 @@ module.exports = function (server) {
     wrappers['UID COPY'] = copyWrapper(false);
     wrappers.MOVE = copyWrapper(true);
     wrappers['UID MOVE'] = copyWrapper(true);
-
     // RFC 8508 section 4.1: REPLACE needs the rights of UID STORE (\Deleted, "t") and UID EXPUNGE ("e") on the
     // selected mailbox, and of APPEND ("i") on the target. A read-only session is refused by the command handler
     const replaceRefusal = (connection, mailbox) => {
@@ -696,7 +619,6 @@ module.exports = function (server) {
     };
     wrappers.REPLACE = replaceWrapper;
     wrappers['UID REPLACE'] = replaceWrapper;
-
     // The message literal of APPEND and REPLACE is refused before it is sent when the user may not add messages to the
     // target, with the same answer as after the literal. A mailbox the user can not see ("l") is refused like a
     // missing one, which the core literal filter refuses before the literal too, so the transcripts do not tell
@@ -712,11 +634,10 @@ module.exports = function (server) {
         }
         return command === 'APPEND' ? insertRefusal(connection, mailbox) : replaceRefusal(connection, mailbox);
     });
-
     // RFC 5464 section 3.3: mailbox annotations need "l" and any of "r", "s", "w", "i" or "p". Server
     // annotations (the empty mailbox name) are not covered by mailbox ACLs
     const METADATA_RIGHTS = ['r', 's', 'w', 'i', 'p'];
-    const canUseMetadata = rights => rights.has('l') && METADATA_RIGHTS.some(right => rights.has(right));
+    const canUseMetadata = (rights) => rights.has('l') && METADATA_RIGHTS.some(right => rights.has(right));
     const metadataWrapper = (prevHandler, connection, parsed, data, callback) => {
         const args = parsed.attributes || [];
         // GETMETADATA takes its options before the mailbox name (RFC 5464 errata 2785)
@@ -725,7 +646,7 @@ module.exports = function (server) {
         if (mailbox && mailboxArgument(parsed, position) !== '') {
             const rights = getRights(connection, mailbox);
             if (!canUseMetadata(rights)) {
-                sendDenied(connection, parsed, data, rights, false);
+                sendDenied(connection, parsed, data, rights);
                 return callback();
             }
         }
@@ -733,7 +654,6 @@ module.exports = function (server) {
     };
     wrappers.GETMETADATA = metadataWrapper;
     wrappers.SETMETADATA = metadataWrapper;
-
     // Unsolicited METADATA responses (RFC 5464 section 4.4.2) only go to sessions that could read the
     // annotations of the mailbox. Server annotations have an empty mailbox name
     server.notifyFilters.push((connection, notification) => {
@@ -746,7 +666,6 @@ module.exports = function (server) {
         const mailbox = typeof path === 'string' && path !== '' && server.getMailbox(path);
         return !mailbox || canUseMetadata(getRights(connection, mailbox));
     });
-
     // RFC 9208 section 6: GETQUOTA needs no rights. GETQUOTAROOT needs "r" for the MESSAGE and STORAGE
     // resources, which tell about the messages of the mailbox, only MAILBOX needs no right. Without "r"
     // (or for a mailbox that does not exist, so nothing is disclosed) the QUOTA responses only list MAILBOX
@@ -757,7 +676,6 @@ module.exports = function (server) {
         }
         return prevHandler(connection, parsed, data, callback);
     };
-
     // RFC 9208 section 6: SETQUOTA needs "a". The quota root is not a mailbox, so the user needs "a" on
     // every mailbox the quota root applies to (all personal mailboxes)
     wrappers.SETQUOTA = (prevHandler, connection, parsed, data, callback) => {
@@ -774,7 +692,6 @@ module.exports = function (server) {
         }
         return prevHandler(connection, parsed, data, callback);
     };
-
     // EXPUNGE needs "e". In a read-only session the command handler refuses it already
     const expungeWrapper = (prevHandler, connection, parsed, data, callback) => {
         if (!connection.readOnly && !getSelectedRights(connection).has('e')) {
@@ -785,13 +702,11 @@ module.exports = function (server) {
     };
     wrappers.EXPUNGE = expungeWrapper;
     wrappers['UID EXPUNGE'] = expungeWrapper;
-
     // UNAUTHENTICATE (RFC 8437): rights of the previous user must not stay with the session
-    server.resetHandlers.push(connection => {
+    server.resetHandlers.push((connection) => {
         connection.aclRights = null;
     });
-
-    server.connectionHandlers.push(connection => {
+    server.connectionHandlers.push((connection) => {
         // A FETCH that implies setting \Seen MUST NOT set it without "s", and without "e" CLOSE MUST
         // close the mailbox without expunging (RFC 4314 section 4)
         const canSetSeen = connection.canSetSeen;
@@ -799,7 +714,6 @@ module.exports = function (server) {
         connection.canSetSeen = () => canSetSeen.call(connection) && getSelectedRights(connection).has('s');
         connection.canExpunge = () => canExpunge.call(connection) && getSelectedRights(connection).has('e');
     });
-
     // STORE needs the right of at least one of the flags it changes, it SHOULD NOT fail otherwise.
     // The flags themselves are filtered by the store handlers
     const storeWrapper = (prevHandler, connection, parsed, data, callback) => {
@@ -821,14 +735,16 @@ module.exports = function (server) {
         const flags = [].concat(args[args.length - 1] || []);
         try {
             flags.forEach(flag => checkSystemFlags(connection, normalizeSystemFlag(flagValue(flag))));
-        } catch {
+        }
+        catch {
             // invalid flags are refused with BAD by the STORE handler
             return prevHandler(connection, parsed, data, callback);
         }
         let allowed;
         if (item.charAt(0) === '+' || item.charAt(0) === '-') {
             allowed = !flags.length || flags.some(flag => canSetFlag(rights, flag));
-        } else {
+        }
+        else {
             // replacing the flags changes every flag the user has rights for
             allowed = FLAG_RIGHTS.some(right => rights.has(right));
         }
@@ -840,28 +756,21 @@ module.exports = function (server) {
     };
     wrappers.STORE = storeWrapper;
     wrappers['UID STORE'] = storeWrapper;
-
     // Checks if an extended LIST command asks for the STATUS return option (RFC 5819)
-    const hasStatusReturnOption = parsed => {
+    const hasStatusReturnOption = (parsed) => {
         const args = (parsed && parsed.attributes) || [];
-        return args.some(
-            (arg, i) =>
-                arg &&
-                arg.type === 'ATOM' &&
-                /^RETURN$/i.test(arg.value) &&
-                Array.isArray(args[i + 1]) &&
-                args[i + 1].some(option => option && option.type === 'ATOM' && /^STATUS$/i.test(option.value))
-        );
+        return args.some((arg, i) => arg &&
+            arg.type === 'ATOM' &&
+            /^RETURN$/i.test(arg.value) &&
+            Array.isArray(args[i + 1]) &&
+            args[i + 1].some((option) => option && option.type === 'ATOM' && /^STATUS$/i.test(option.value)));
     };
-
     // Checks if any mailbox below a mailbox is visible to the user
-    const hasVisibleChildren = (connection, mailbox) => server.hasDescendant(mailbox.path, child => getRights(connection, child).has('l'));
-
+    const hasVisibleChildren = (connection, mailbox) => server.hasDescendant(mailbox.path, (child) => getRights(connection, child).has('l'));
     server.outputHandlers.push((connection, response, description, parsed, data, extra) => {
         if (isOwner(connection)) {
             return;
         }
-
         if ((description === 'LIST ITEM' || description === 'LSUB ITEM') && extra && extra.path) {
             // LIST and LSUB need "l", the mailbox is left out without it and never answered with NO
             if (!getRights(connection, extra).has('l')) {
@@ -873,20 +782,19 @@ module.exports = function (server) {
                 return;
             }
             response.attributes[0] = flags.slice();
-            const index = flags.findIndex(flag => flag && flag.value === '\\HasChildren');
+            const index = flags.findIndex((flag) => flag && flag.value === '\\HasChildren');
             if (index >= 0 && !hasVisibleChildren(connection, extra)) {
                 // children that the user can not see do not count (RFC 3348 section 4)
                 response.attributes[0][index] = { type: 'ATOM', value: '\\HasNoChildren' };
             }
             // RFC 5819 section 2: a mailbox that gets no STATUS response because it can not be selected
             // (no "r" right) MUST be listed with \Noselect
-            const isSelectable = !flags.some(flag => flag && /^\\(Noselect|NonExistent)$/i.test(flag.value));
+            const isSelectable = !flags.some((flag) => flag && /^\\(Noselect|NonExistent)$/i.test(flag.value));
             if (isSelectable && hasStatusReturnOption(parsed) && !getRights(connection, extra).has('r')) {
                 response.attributes[0].push({ type: 'ATOM', value: '\\Noselect' });
             }
             return;
         }
-
         if (description === 'QUOTA' && parsed && parsed.aclQuotaMailboxOnly && Array.isArray(response.attributes[1])) {
             // quota-resource = resource-name SP resource-usage SP resource-limit
             const list = response.attributes[1];
@@ -899,36 +807,35 @@ module.exports = function (server) {
             // quota-list needs at least one resource, so without a MAILBOX limit there is no QUOTA response
             if (filtered.length) {
                 response.attributes[1] = filtered;
-            } else {
+            }
+            else {
                 response.skipResponse = true;
             }
             return;
         }
-
         if (description === 'SELECT PERMANENTFLAGS') {
             // RFC 4314 section 5.1.1: PERMANENTFLAGS MUST reflect the rights of the user
             const section = response.attributes[0] && response.attributes[0].section;
             const rights = getSelectedRights(connection);
             if (section && Array.isArray(section[1])) {
-                section[1] = section[1].filter(flag => (flag.value === '\\*' ? rights.has('w') : canSetFlag(rights, flag)));
+                section[1] = section[1].filter((flag) => (flag.value === '\\*' ? rights.has('w') : canSetFlag(rights, flag)));
             }
             return;
         }
-
         if (extra && extra.targetUids && extra.mailbox && /^(UID )?(COPY|MOVE COPYUID)$/.test(description)) {
             // RFC 4314 section 4: the copies only keep the flags the user has rights for in the target
             const rights = getRights(connection, extra.mailbox);
             const uids = new Set(extra.targetUids);
-            extra.mailbox.messages.forEach(message => {
+            extra.mailbox.messages.forEach((message) => {
                 if (uids.has(message.uid)) {
-                    message.flags = message.flags.filter(flag => canSetFlag(rights, flag));
+                    message.flags = message.flags.filter((flag) => canSetFlag(rights, flag));
                 }
             });
         }
     });
-
     // The DELETE command MUST delete the ACL of the mailbox (RFC 4314 section 4), this matters when a
     // \Noselect placeholder stays for the children of the mailbox
+    // DELETE and CREATE are core commands, so the handlers exist
     const prevDelete = server.getCommandHandler('DELETE');
     server.setCommandHandler('DELETE', (connection, parsed, data, callback) => {
         const mailbox = argumentMailbox(parsed, 0);
@@ -940,7 +847,6 @@ module.exports = function (server) {
             callback();
         });
     });
-
     // A new mailbox inherits the ACL of its parent (RFC 4314 section 4, CREATE SHOULD)
     const prevCreate = server.getCommandHandler('CREATE');
     server.setCommandHandler('CREATE', (connection, parsed, data, callback) => {
@@ -950,15 +856,15 @@ module.exports = function (server) {
                 .filter(path => !existing.has(path))
                 .sort((a, b) => a.length - b.length)
                 .forEach(path => {
-                    const parent = getParent(path);
-                    const mailbox = server.folderCache[path];
-                    if (parent && parent !== mailbox) {
-                        const acl = new Map();
-                        getAcl(parent).forEach((rights, identifier) => acl.set(identifier, new Set(rights)));
-                        mailbox.acl = acl;
-                    }
-                });
+                const parent = getParent(path);
+                const mailbox = server.folderCache[path];
+                if (parent && parent !== mailbox) {
+                    const acl = new Map();
+                    getAcl(parent).forEach((rights, identifier) => acl.set(identifier, new Set(rights)));
+                    mailbox.acl = acl;
+                }
+            });
             callback();
         });
     });
-};
+}