imapkit 4.3.1 → 5.0.0

package/dist/esm/load-plugins.js

@@ -47,12 +47,17 @@ function resolvePlugin(name) {
  * @param {Object} server IMAPServer instance
  * @param {Array|String|Function} plugins List of plugins to load
  */
-function loadPlugins(server, plugins) {
+function loadPlugins(server, plugins, exclude) {
     const loaded = new Set();
+    // plugins a quirk preset leaves out (no-move), they are not loaded even when listed
+    const excluded = new Set((exclude || []).map(name => resolvePlugin(name)).flatMap(name => (name ? [builtinPlugins[name]] : [])));
     const load = (entry) => {
         let plugin = entry;
         if (typeof plugin === 'string') {
             const name = resolvePlugin(plugin);
+            if (!name && plugin.toUpperCase() === 'XTOYBIRD') {
+                throw new Error('XTOYBIRD was removed in 5.0.0, use the control API (server.control.snapshot(), server.control.addUser() ...) instead, see the README');
+            }
             if (!name) {
                 throw new Error('Unknown plugin "' + plugin + '". Available plugins: ' + listPlugins().join(', '));
             }
@@ -61,7 +66,7 @@ function loadPlugins(server, plugins) {
         if (typeof plugin !== 'function') {
             throw new TypeError('Invalid plugin, expecting a plugin name or a function');
         }
-        if (loaded.has(plugin)) {
+        if (loaded.has(plugin) || excluded.has(plugin)) {
             return;
         }
         loaded.add(plugin);

package/dist/esm/plugins/acl.js

@@ -5,6 +5,7 @@ import { getListExtensions } from '../list-extensions.js';
 import { beginSelect } from '../commands/select.js';
 import { getPendingTarget } from '../commands/append.js';
 import { isAstring } from '../arguments.js';
+import { storeError } from '../store-operations.js';
 /**
  * @help Adds ACL [RFC4314] capability with RIGHTS=texk
  * @help The owner (server option "aclOwner", default "testuser")
@@ -199,6 +200,33 @@ export default function aclPlugin(server) {
         change(acl);
         server.emit('acl', mailbox, previous);
     };
+    /**
+     * Changes the rights of an identifier like SETACL (RFC 4314 section 3.1): "+" adds, "-" removes, no mode
+     * replaces. An identifier without rights is removed from the ACL
+     *
+     * @param {Object} mailbox Mailbox
+     * @param {String} identifier Identifier
+     * @param {String} mode "+", "-" or ""
+     * @param {Set} rights Parsed rights
+     */
+    const applyRights = (mailbox, identifier, mode, rights) => {
+        changeAcl(mailbox, acl => {
+            const current = new Set(acl.get(identifier) || []);
+            if (mode === '+') {
+                rights.forEach(right => current.add(right));
+            }
+            else if (mode === '-') {
+                rights.forEach(right => current.delete(right));
+            }
+            const updated = mode ? current : rights;
+            if (updated.size) {
+                acl.set(identifier, updated);
+            }
+            else {
+                acl.delete(identifier);
+            }
+        });
+    };
     // CATENATE (RFC 4469 section 5): reading a message through an IMAP URL needs the "r" right, a
     // mailbox without "l" is reported like one that does not exist (RFC 4314 section 6)
     server.urlAccessChecks.push((connection, mailbox) => {
@@ -354,22 +382,7 @@ export default function aclPlugin(server) {
         if (!checkAclCommand(connection, parsed, data, mailbox, hasAdmin) || refuseOwnerIdentifier(connection, parsed, data)) {
             return;
         }
-        changeAcl(mailbox, acl => {
-            const current = new Set(acl.get(identifier) || []);
-            if (mode === '+') {
-                rights.forEach(right => current.add(right));
-            }
-            else if (mode === '-') {
-                rights.forEach(right => current.delete(right));
-            }
-            const updated = mode ? current : rights;
-            if (updated.size) {
-                acl.set(identifier, updated);
-            }
-            else {
-                acl.delete(identifier);
-            }
-        });
+        applyRights(mailbox, identifier, mode, rights);
         connection.sendStatus(parsed, data, 'OK', 'Setacl complete');
     }), Object.assign({ astringArguments: [1, 2] }, aclOptions));
     // RFC 4314 section 3.2
@@ -467,7 +480,7 @@ export default function aclPlugin(server) {
                 }
                 flags = [].concat(flags);
                 // invalid flags are still refused with BAD, even if the user could not set them anyway
-                flags.forEach((flag) => checkSystemFlags(connection, normalizeSystemFlag(flagValue(flag))));
+                flags.forEach((flag) => checkSystemFlags(connection.server, normalizeSystemFlag(flagValue(flag))));
                 let allowed = flags.filter((flag) => canSetFlag(rights, flag));
                 if (item.charAt(0) !== '+' && item.charAt(0) !== '-') {
                     // replacing the flags keeps the ones the user can not change
@@ -562,7 +575,7 @@ export default function aclPlugin(server) {
         const flags = parsed.attributes[1];
         if (Array.isArray(flags) && flags.every((flag) => flag && flag.type === 'ATOM')) {
             try {
-                flags.forEach((flag) => checkSystemFlags(connection, normalizeSystemFlag(flag.value)));
+                flags.forEach((flag) => checkSystemFlags(connection.server, normalizeSystemFlag(flag.value)));
                 // the server MUST NOT fail APPEND for flags the user can not set
                 parsed.attributes[1] = flags.filter((flag) => canSetFlag(rights, flag));
             }
@@ -734,7 +747,7 @@ export default function aclPlugin(server) {
         }
         const flags = [].concat(args[args.length - 1] || []);
         try {
-            flags.forEach(flag => checkSystemFlags(connection, normalizeSystemFlag(flagValue(flag))));
+            flags.forEach(flag => checkSystemFlags(connection.server, normalizeSystemFlag(flagValue(flag))));
         }
         catch {
             // invalid flags are refused with BAD by the STORE handler
@@ -833,38 +846,92 @@ export default function aclPlugin(server) {
             });
         }
     });
-    // The DELETE command MUST delete the ACL of the mailbox (RFC 4314 section 4), this matters when a
-    // \Noselect placeholder stays for the children of the mailbox
-    // DELETE and CREATE are core commands, so the handlers exist
-    const prevDelete = server.getCommandHandler('DELETE');
-    server.setCommandHandler('DELETE', (connection, parsed, data, callback) => {
-        const mailbox = argumentMailbox(parsed, 0);
-        prevDelete(connection, parsed, data, () => {
-            const placeholder = argumentMailbox(parsed, 0);
-            if (placeholder && placeholder !== mailbox) {
+    server.on('mailbox', (event) => {
+        if (event.type === 'delete') {
+            // DELETE MUST delete the ACL of the mailbox (RFC 4314 section 4), this matters when a \Noselect
+            // placeholder stays for the children of the mailbox
+            const placeholder = server.getMailbox(event.path);
+            if (placeholder && placeholder !== event.mailbox) {
                 delete placeholder.acl;
             }
-            callback();
-        });
-    });
-    // A new mailbox inherits the ACL of its parent (RFC 4314 section 4, CREATE SHOULD)
-    const prevCreate = server.getCommandHandler('CREATE');
-    server.setCommandHandler('CREATE', (connection, parsed, data, callback) => {
-        const existing = new Set(Object.keys(server.folderCache));
-        prevCreate(connection, parsed, data, () => {
-            Object.keys(server.folderCache)
-                .filter(path => !existing.has(path))
-                .sort((a, b) => a.length - b.length)
-                .forEach(path => {
+        }
+        else if (event.type === 'create') {
+            // A new mailbox inherits the ACL of its parent (RFC 4314 section 4, CREATE SHOULD)
+            (event.created || []).forEach((path) => {
                 const parent = getParent(path);
                 const mailbox = server.folderCache[path];
-                if (parent && parent !== mailbox) {
+                if (parent && mailbox && parent !== mailbox) {
                     const acl = new Map();
                     getAcl(parent).forEach((rights, identifier) => acl.set(identifier, new Set(rights)));
                     mailbox.acl = acl;
                 }
             });
-            callback();
+        }
+    });
+    // Control API (README "Control API"): ACLs as objects of identifier to rights, like the storage option
+    const aclObject = (mailbox) => {
+        const result = {};
+        getAcl(mailbox).forEach((rights, identifier) => {
+            result[identifier] = formatRights(rights);
         });
+        return result;
+    };
+    const controlMailbox = (path) => server.control.requireMailbox(path);
+    // the snapshot keeps ACLs in the form of the storage option, the parsed ACL is a Map
+    server.control.snapshotHandlers.push((mailbox, copy) => {
+        if (mailbox.acl instanceof Map) {
+            copy.acl = aclObject(mailbox);
+        }
     });
+    const getAclOperation = (path) => aclObject(controlMailbox(path));
+    // rights replace the rights of the identifier, "+rights" adds and "-rights" removes like SETACL (RFC 4314
+    // section 3.1), empty rights remove the identifier
+    const setAclOperation = (path, identifier, rights) => {
+        const mailbox = controlMailbox(path);
+        if (typeof identifier !== 'string' || !identifier || typeof rights !== 'string') {
+            throw storeError('setAcl expects an identifier and a rights string', 'INVALID');
+        }
+        const mode = /^[+-]/.test(rights) ? rights.charAt(0) : '';
+        let parsed;
+        try {
+            parsed = parseRights(rights.substr(mode.length));
+        }
+        catch (err) {
+            throw storeError(err.message, 'INVALID');
+        }
+        applyRights(mailbox, identifier, mode, parsed);
+        return aclObject(mailbox);
+    };
+    const deleteAclOperation = (path, identifier) => {
+        const mailbox = controlMailbox(path);
+        if (typeof identifier !== 'string' || !getAcl(mailbox).has(identifier)) {
+            throw storeError('No ACL entry for ' + JSON.stringify(identifier), 'NONEXISTENT');
+        }
+        changeAcl(mailbox, acl => acl.delete(identifier));
+        return aclObject(mailbox);
+    };
+    server.control.register('getAcl', getAclOperation, [
+        {
+            method: 'GET',
+            path: '/v1/mailboxes/{path}/acl',
+            summary: 'The ACL of a mailbox (ACL plugin)',
+            handler: ({ params }) => server.control.getAcl(params.path)
+        }
+    ]);
+    server.control.register('setAcl', setAclOperation, [
+        {
+            method: 'PUT',
+            path: '/v1/mailboxes/{path}/acl/{identifier}',
+            summary: 'Sets the rights of an identifier ({ rights }, "+" or "-" in front adds or removes, ACL plugin)',
+            handler: ({ params, body }) => server.control.setAcl(params.path, params.identifier, body.rights)
+        }
+    ]);
+    server.control.register('deleteAcl', deleteAclOperation, [
+        {
+            method: 'DELETE',
+            path: '/v1/mailboxes/{path}/acl/{identifier}',
+            summary: 'Removes an identifier from the ACL (ACL plugin)',
+            handler: ({ params }) => server.control.deleteAcl(params.path, params.identifier)
+        }
+    ]);
 }

package/dist/esm/plugins/condstore.js

@@ -75,6 +75,13 @@ export default function condstorePlugin(server) {
     server.on('expunge', mailbox => {
         bumpModseq(mailbox);
     });
+    // Flags changed outside of STORE (the control API, see changeFlags() in store-operations.ts): every changed
+    // message gets a new mod-sequence (RFC 7162 section 3.1.1), before the sessions are told
+    server.on('flags', (mailbox, messages) => {
+        messages.forEach(message => {
+            message.MODSEQ = bumpModseq(mailbox);
+        });
+    });
     // RFC 7162 section 3.2.11: SELECT or EXAMINE closes the selected mailbox, a CONDSTORE server marks
     // where the responses for the new mailbox start
     server.closedChecks.push(() => true);

package/dist/esm/plugins/index.js

@@ -53,7 +53,6 @@ import unselectPlugin from './unselect.js';
 import utf8AcceptPlugin from './utf8-accept.js';
 import xGmExt1Plugin from './x-gm-ext-1.js';
 import xoauth2Plugin from './xoauth2.js';
-import xtoybirdPlugin from './xtoybird.js';
 export const plugins = {
     acl: aclPlugin,
     appendlimit: appendlimitPlugin,
@@ -108,6 +107,5 @@ export const plugins = {
     unselect: unselectPlugin,
     'utf8-accept': utf8AcceptPlugin,
     'x-gm-ext-1': xGmExt1Plugin,
-    xoauth2: xoauth2Plugin,
-    xtoybird: xtoybirdPlugin
+    xoauth2: xoauth2Plugin
 };

package/dist/esm/plugins/metadata.js

@@ -1,3 +1,4 @@
+import { storeError } from '../store-operations.js';
 import { states } from '../command-states.js';
 import { isNumber } from '../numbers.js';
 import { isAstring } from '../arguments.js';
@@ -308,6 +309,60 @@ function setup(server, mailboxes) {
         return callback();
     }, { states: states.AUTHENTICATED });
     // RFC 5464 section 4.3: setmetadata = "SETMETADATA" SP mailbox SP entry-values
+    /**
+     * Stores the changes of SETMETADATA (or of the control API) when all of them pass the checks, and tells the
+     * sessions that used ENABLE METADATA about the changed entries. The session that made the change
+     * (`server.activeConnection`) is not told, and without one (the control API) the read-only server entries can
+     * be set too
+     *
+     * @param {Object} holder Mailbox object or state.server
+     * @param {Map} changes Lower case entry name to the new value, null removes the entry
+     * @return {Object|null} `{ text, code }` when a change fails, nothing is changed then
+     */
+    const storeChanges = (holder, changes) => {
+        const origin = server.activeConnection;
+        const entries = getEntries(holder);
+        const computed = getComputedEntries(holder);
+        // changes go to a copy that replaces the entries once every check passed
+        const next = Object.assign(Object.create(null), entries);
+        const changed = [];
+        for (const [name, value] of changes) {
+            if ((!holder.path && origin && READ_ONLY_SERVER_ENTRIES.has(name)) || name in computed) {
+                return { text: 'The ' + name + ' entry is read-only', code: 'CANNOT' };
+            }
+            if (!state.allowPrivate && name.startsWith('/private/')) {
+                return { text: 'Private annotations are not supported', code: ['METADATA', 'NOPRIVATE'] };
+            }
+            if (value !== null && value.length > state.maxSize) {
+                return { text: 'Value of ' + name + ' is too large', code: ['METADATA', 'MAXSIZE', state.maxSize] };
+            }
+            if ((entries[name] ?? null) !== value) {
+                changed.push(name);
+            }
+            if (value === null) {
+                delete next[name];
+            }
+            else {
+                next[name] = value;
+            }
+        }
+        // only adding entries can fail, even when the storage already holds more than the limit
+        const count = Object.keys(next).length;
+        if (count > state.maxEntries && count > Object.keys(entries).length) {
+            return { text: 'Too many annotations', code: ['METADATA', 'TOOMANY'] };
+        }
+        setEntries(holder, next);
+        if (changed.length) {
+            // RFC 5464 section 4.4.2: unsolicited responses only list the entry names. Section 4.1:
+            // only sessions that used ENABLE METADATA (or METADATA-SERVER) get them
+            server.notify({
+                tag: '*',
+                command: 'METADATA',
+                attributes: [mailboxAttribute(holder.path)].concat(changed.map(name => ({ type: 'ATOM', value: name })))
+            }, false, origin, isMetadataEnabled);
+        }
+        return null;
+    };
     server.setCommandHandler('SETMETADATA', (connection, parsed, data, callback) => {
         const attrs = parsed.attributes || [];
         if (attrs.length !== 2 || !isAstring(attrs[0]) || !Array.isArray(attrs[1])) {
@@ -343,77 +398,105 @@ function setup(server, mailboxes) {
         if (!holder) {
             return callback();
         }
-        const entries = getEntries(holder);
-        const computed = getComputedEntries(holder);
-        const fail = (text, code) => {
+        const failure = storeChanges(holder, changes);
+        if (failure) {
             // RFC 5464 section 4.3: when one entry fails, no entry is changed
-            connection.sendStatus(parsed, data, 'NO', text, code);
+            connection.sendStatus(parsed, data, 'NO', failure.text, failure.code);
             return callback();
-        };
-        // changes go to a copy that replaces the entries once every check passed
-        const next = Object.assign(Object.create(null), entries);
-        const changed = [];
-        for (const [name, value] of changes) {
-            if ((!holder.path && READ_ONLY_SERVER_ENTRIES.has(name)) || name in computed) {
-                return fail('The ' + name + ' entry is read-only', 'CANNOT');
-            }
-            if (!state.allowPrivate && name.startsWith('/private/')) {
-                return fail('Private annotations are not supported', ['METADATA', 'NOPRIVATE']);
-            }
-            if (value !== null && value.length > state.maxSize) {
-                return fail('Value of ' + name + ' is too large', ['METADATA', 'MAXSIZE', state.maxSize]);
-            }
-            if ((entries[name] ?? null) !== value) {
-                changed.push(name);
-            }
-            if (value === null) {
-                delete next[name];
-            }
-            else {
-                next[name] = value;
-            }
-        }
-        // only adding entries can fail, even when the storage already holds more than the limit
-        const count = Object.keys(next).length;
-        if (count > state.maxEntries && count > Object.keys(entries).length) {
-            return fail('Too many annotations', ['METADATA', 'TOOMANY']);
-        }
-        setEntries(holder, next);
-        if (changed.length) {
-            // RFC 5464 section 4.4.2: unsolicited responses only list the entry names. Section 4.1:
-            // only sessions that used ENABLE METADATA (or METADATA-SERVER) get them
-            server.notify({
-                tag: '*',
-                command: 'METADATA',
-                attributes: [mailboxAttribute(holder.path)].concat(changed.map(name => ({ type: 'ATOM', value: name })))
-            }, false, connection, isMetadataEnabled);
         }
         connection.sendStatus(parsed, data, 'OK', 'SETMETADATA completed');
         return callback();
     }, 
     // RFC 5464 section 5: values can be literal8, with or without BINARY
     { states: states.AUTHENTICATED, mailboxArguments: [0], literal8: true });
-    server.outputHandlers.push((connection, response, description, parsed, data, extra) => {
-        if (response.command !== 'OK' || !parsed || !parsed.attributes) {
-            return;
-        }
-        if (description === 'RENAME' && extra && extra.path === 'INBOX') {
-            // RFC 5464 section 4.1: renaming INBOX copies its annotations, INBOX keeps them. Other
-            // mailboxes are moved as objects, so their annotations follow without any help
-            const target = connection.server.getMailbox(parsed.attributes[1].value);
-            if (target && target !== extra && extra.metadata) {
-                setEntries(target, Object.assign(Object.create(null), getEntries(extra)));
+    server.on('mailbox', (event) => {
+        if (event.type === 'rename' && event.oldPath === 'INBOX') {
+            // RFC 5464 section 4.1: renaming INBOX copies its annotations, INBOX keeps them. Other mailboxes are
+            // moved as objects, so their annotations follow without any help
+            const inbox = server.getMailbox('INBOX');
+            const target = server.getMailbox(event.path);
+            if (inbox && target && target !== inbox && inbox.metadata) {
+                setEntries(target, Object.assign(Object.create(null), getEntries(inbox)));
             }
         }
-        else if (description === 'DELETE') {
-            // RFC 5464 section 4.1: a mailbox created later with the same name must not inherit the
-            // annotations. A mailbox with children stays as a \Noselect placeholder
-            const placeholder = connection.server.getMailbox(parsed.attributes[0].value);
-            if (placeholder) {
+        else if (event.type === 'delete') {
+            // RFC 5464 section 4.1: a mailbox created later with the same name must not inherit the annotations.
+            // A mailbox with children stays as a \Noselect placeholder
+            const placeholder = server.getMailbox(event.path);
+            if (placeholder && placeholder !== event.mailbox) {
                 delete placeholder.metadata;
             }
         }
     });
+    // Control API (README "Control API"): the stored annotations of a mailbox, or of the server for "". Values are
+    // UTF-8 text, the protocol keeps them as octets
+    // control.reset() restores the server annotations of the options, the mailboxes come with their storage
+    server.on('reset', () => {
+        state.server = { path: '', metadata: options.metadata };
+    });
+    const controlHolder = (path) => {
+        if (path === '') {
+            return state.server;
+        }
+        if (!state.mailboxes) {
+            throw storeError('Mailbox annotations need the METADATA plugin, METADATA-SERVER has server annotations only', 'INVALID');
+        }
+        return server.control.requireMailbox(path);
+    };
+    const getMetadataOperation = (path) => {
+        const entries = getEntries(controlHolder(path));
+        const result = {};
+        Object.keys(entries).forEach(name => {
+            result[name] = Buffer.from(entries[name], 'binary').toString('utf-8');
+        });
+        return result;
+    };
+    const setMetadataOperation = (path, values) => {
+        const holder = controlHolder(path);
+        if (!values || typeof values !== 'object' || Array.isArray(values)) {
+            throw storeError('setMetadata expects an object of entry names and values (null removes an entry)', 'INVALID');
+        }
+        const changes = new Map();
+        Object.keys(values).forEach(name => {
+            const value = values[name];
+            const error = checkEntryName(name, true);
+            if (error) {
+                throw storeError(error, 'INVALID');
+            }
+            if (value !== null && typeof value !== 'string') {
+                throw storeError('Value of ' + name + ' must be a string or null', 'INVALID');
+            }
+            changes.set(name.toLowerCase(), value === null ? null : Buffer.from(value, 'utf-8').toString('binary'));
+        });
+        const failure = storeChanges(holder, changes);
+        if (failure) {
+            throw storeError(failure.text, typeof failure.code === 'string' ? failure.code : 'INVALID');
+        }
+        return getMetadataOperation(path);
+    };
+    server.control.register('getMetadata', getMetadataOperation, [
+        { method: 'GET', path: '/v1/metadata', summary: 'Server annotations (METADATA plugins)', handler: () => server.control.getMetadata('') },
+        {
+            method: 'GET',
+            path: '/v1/mailboxes/{path}/metadata',
+            summary: 'Mailbox annotations (METADATA plugin)',
+            handler: ({ params }) => server.control.getMetadata(params.path)
+        }
+    ]);
+    server.control.register('setMetadata', setMetadataOperation, [
+        {
+            method: 'PUT',
+            path: '/v1/metadata',
+            summary: 'Sets server annotations ({ "/shared/comment": "text" }, null removes one, METADATA plugins)',
+            handler: ({ body }) => server.control.setMetadata('', body)
+        },
+        {
+            method: 'PUT',
+            path: '/v1/mailboxes/{path}/metadata',
+            summary: 'Sets mailbox annotations (METADATA plugin)',
+            handler: ({ params, body }) => server.control.setMetadata(params.path, body)
+        }
+    ]);
 }
 export default function metadataPlugin(server) {
     setup(server, true);

package/dist/esm/plugins/objectid.js

@@ -95,6 +95,16 @@ export default function objectidPlugin(server) {
         }
         getMailboxId(mailbox);
     });
+    // Control API (README "Control API"): the object ids in getMailbox() and getMessage()
+    server.control.mailboxInfoHandlers.push((mailbox, info) => {
+        if (mailbox.flags.indexOf('\\Noselect') < 0) {
+            info.mailboxId = getMailboxId(mailbox);
+        }
+    });
+    server.control.messageInfoHandlers.push((message, info) => {
+        info.emailId = message.EMAILID;
+        info.threadId = message.THREADID;
+    });
     server.messageHandlers.push((server, message, mailbox) => {
         const owner = 'a message of mailbox ' + mailbox.path;
         if (message.EMAILID) {

package/dist/esm/plugins/quota.js

@@ -1,3 +1,4 @@
+import { storeError } from '../store-operations.js';
 import { states } from '../command-states.js';
 import { normalizeLineBreaks } from '../mimeparser.js';
 import { MAX_NUMBER64, isNumber } from '../numbers.js';
@@ -29,6 +30,8 @@ export default function quotaPlugin(server) {
         soft: !!config.soft,
         limits: {}
     };
+    // the limits of the quota option, control.reset() restores them
+    const initialLimits = {};
     RESOURCES.forEach(resource => {
         if (config[resource] === undefined || config[resource] === null) {
             return;
@@ -37,8 +40,13 @@ export default function quotaPlugin(server) {
         if (!Number.isSafeInteger(limit) || limit < 0) {
             throw new Error('Invalid quota limit for ' + resource + ': ' + JSON.stringify(config[resource]));
         }
-        root.limits[resource] = limit;
+        initialLimits[resource] = limit;
     });
+    const restoreLimits = () => {
+        root.limits = Object.assign({}, initialLimits);
+    };
+    restoreLimits();
+    server.on('reset', restoreLimits);
     // RFC 9208 sections 3.1.1 and 5: every supported resource is advertised, SETQUOTA needs QUOTASET
     server.registerCapability('QUOTA');
     RESOURCES.forEach(resource => server.registerCapability('QUOTA=RES-' + resource));
@@ -111,7 +119,7 @@ export default function quotaPlugin(server) {
         }
         const added = { MESSAGE: messages.length, bytes: totalSize(messages) };
         // RFC 8508 section 3.4: REPLACE counts only the net usage, the replaced message is removed
-        if (options.replaced && connection.selectedMailbox && inRoot(connection.selectedMailbox)) {
+        if (options.replaced && connection && connection.selectedMailbox && inRoot(connection.selectedMailbox)) {
             added.MESSAGE--;
             added.bytes -= totalSize([options.replaced]);
         }
@@ -236,4 +244,44 @@ export default function quotaPlugin(server) {
         }
     });
     server.statusHandlers['DELETED-STORAGE'] = (connection, mailbox) => totalSize(mailbox.messages.filter(message => message.flags.indexOf('\\Deleted') >= 0));
+    // Control API (README "Control API"): the quota root with its limits and usage, STORAGE in units of 1024 octets
+    const getQuotaOperation = () => {
+        const usage = getUsage();
+        return {
+            root: root.name,
+            limits: Object.assign({}, root.limits),
+            usage: { STORAGE: Math.ceil(usage.bytes / 1024), MESSAGE: usage.MESSAGE, MAILBOX: usage.MAILBOX }
+        };
+    };
+    // the new limits replace all earlier ones, like SETQUOTA (RFC 9208 section 4.1.3)
+    const setQuotaOperation = (limits) => {
+        if (!limits || typeof limits !== 'object' || Array.isArray(limits)) {
+            throw storeError('setQuota expects an object of resource limits, e.g. { STORAGE: 1024 }', 'INVALID');
+        }
+        const next = {};
+        Object.keys(limits).forEach(name => {
+            const resource = name.toUpperCase();
+            const value = limits[name];
+            if (RESOURCES.indexOf(resource) < 0) {
+                throw storeError('Unknown quota resource ' + name + ', expected ' + RESOURCES.join(', '), 'INVALID');
+            }
+            if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0) {
+                throw storeError('Limit of ' + resource + ' must be a non-negative integer', 'INVALID');
+            }
+            next[resource] = value;
+        });
+        root.limits = next;
+        return getQuotaOperation();
+    };
+    server.control.register('getQuota', getQuotaOperation, [
+        { method: 'GET', path: '/v1/quota', summary: 'Quota root, limits and usage (QUOTA plugin)', handler: () => server.control.getQuota() }
+    ]);
+    server.control.register('setQuota', setQuotaOperation, [
+        {
+            method: 'PUT',
+            path: '/v1/quota',
+            summary: 'Replaces the quota limits ({ STORAGE, MESSAGE, MAILBOX }, QUOTA plugin)',
+            handler: ({ body }) => server.control.setQuota(body)
+        }
+    ]);
 }

package/dist/esm/plugins/savedate.js

@@ -25,7 +25,7 @@ export default function savedatePlugin(server) {
             delete message.SAVEDATE;
             return;
         }
-        const savedate = server.normalizeDateTime(message.SAVEDATE || new Date());
+        const savedate = server.normalizeDateTime(message.SAVEDATE || server.now());
         if (!server.validateInternalDate(savedate)) {
             throw new Error('Invalid SAVEDATE value ' + JSON.stringify(savedate) + ' in mailbox ' + mailbox.path);
         }

package/dist/esm/plugins/special-use.d.ts

@@ -1,10 +1,2 @@
 import type { IMAPServer } from '../types.js';
-/**
- * @help Enables SPECIAL-USE [RFC6154] capability
- * @help Mailboxes need to have a "special-use"
- * @help property (String or Array) that will be used
- * @help as extra flag for LIST and LSUB responses.
- * @help With LIST-EXTENDED the SPECIAL-USE selection and
- * @help return options work with the other LIST options
- */
 export default function specialUsePlugin(server: IMAPServer): void;

package/dist/esm/plugins/special-use.js

@@ -1,4 +1,5 @@
 import { getListExtensions } from '../list-extensions.js';
+import { storeError } from '../store-operations.js';
 /**
  * @help Enables SPECIAL-USE [RFC6154] capability
  * @help Mailboxes need to have a "special-use"
@@ -7,6 +8,8 @@ import { getListExtensions } from '../list-extensions.js';
  * @help With LIST-EXTENDED the SPECIAL-USE selection and
  * @help return options work with the other LIST options
  */
+// RFC 6154 section 2 and RFC 8457 (\\Important)
+const SPECIAL_USES = new Set(['\\All', '\\Archive', '\\Drafts', '\\Flagged', '\\Junk', '\\Sent', '\\Trash', '\\Important']);
 export default function specialUsePlugin(server) {
     // Register capability
     server.registerCapability('SPECIAL-USE');
@@ -77,4 +80,24 @@ export default function specialUsePlugin(server) {
             }
         }
     });
+    // Control API (README "Control API"): the special-use attributes of a mailbox (RFC 6154 section 2)
+    server.control.mailboxInfoHandlers.push((mailbox, info) => {
+        info.specialUse = getSpecialUse(mailbox);
+    });
+    const setSpecialUseOperation = (path, uses) => {
+        const mailbox = server.control.requireMailbox(path, true);
+        if (!Array.isArray(uses) || uses.some(use => typeof use !== 'string' || !SPECIAL_USES.has(use))) {
+            throw storeError('Special-use attributes must be a list of ' + [...SPECIAL_USES].join(', '), 'INVALID');
+        }
+        mailbox['special-use'] = [...new Set(uses)];
+        return server.control.getMailbox(mailbox.path);
+    };
+    server.control.register('setSpecialUse', setSpecialUseOperation, [
+        {
+            method: 'PUT',
+            path: '/v1/mailboxes/{path}/special-use',
+            summary: 'Sets the special-use attributes of a mailbox ({ specialUse: ["\\Sent"] }, SPECIAL-USE plugin)',
+            handler: ({ params, body }) => server.control.setSpecialUse(params.path, body.specialUse)
+        }
+    ]);
 }