imapkit 5.0.0 → 5.1.0

package/dist/cjs/server.js

@@ -59,6 +59,7 @@ const quirks_js_1 = require("./quirks.js");
 const storage_schema_js_1 = require("./storage-schema.js");
 const rest_js_1 = require("./rest.js");
 const bundledCert = __importStar(require("./cert.js"));
+const memory_socket_js_1 = require("./memory-socket.js");
 const script_js_1 = require("./script.js");
 // longest command line (not counting literals) accepted from a client
 const MAX_LINE_LENGTH = 1024 * 1024;
@@ -105,6 +106,36 @@ function getResponseTag(line) {
 function stateError(command, state) {
     return command + ' is not allowed in the ' + state + ' state';
 }
+/**
+ * Checks if a queued notification changes message sequence numbers by removing messages: an EXPUNGE response, or the
+ * EXISTS that follows the EXPUNGE responses of another session (it carries the snapshot of the old message list)
+ *
+ * @param {Object} notification Queued notification
+ * @return {Boolean} true if the notification must wait while EXPUNGE responses are not allowed
+ */
+function isPendingExpunge(notification) {
+    return !!notification.mailboxCopy || (0, arguments_js_1.isAtom)(notification.attributes && notification.attributes[1], 'EXPUNGE');
+}
+/**
+ * Checks if a notification is an untagged EXISTS response
+ *
+ * @param {Object} [notification] Notification to send
+ * @return {Boolean} true for an EXISTS response
+ */
+function isExists(notification) {
+    return !!notification && !notification.command && (0, arguments_js_1.isAtom)(notification.attributes && notification.attributes[1], 'EXISTS');
+}
+/**
+ * Answers AUTHENTICATE with a mechanism no plugin supports: NO, not a syntax error (RFC 3501 section 6.2.2). It runs
+ * through the command queue, so the state check comes first (AUTHENTICATE is only valid in the Not Authenticated
+ * state, RFC 3501 section 6.2)
+ */
+// usesSequenceNumbers() of each running command
+const sequenceNumberUse = new WeakMap();
+const unsupportedMechanism = (connection, parsed, data, callback) => {
+    connection.sendStatus(parsed, data, 'NO', 'Unsupported authentication mechanism', false, 'UNKNOWN COMMAND');
+    callback();
+};
 /**
  * Creates a new IMAP server, call `listen()` on it to start accepting connections
  *
@@ -204,7 +235,7 @@ class IMAPServer extends node_stream_1.Stream {
         // plugins register their control operations
         this.control = new control_js_1.Control(this);
         // a quirk preset can leave plugins out (no-move, no-uidplus)
-        (0, load_plugins_js_1.default)(this, this.options.plugins, [...quirks.removePlugins]);
+        (0, load_plugins_js_1.default)(this, this.options.plugins, quirks.removePlugins);
         if (this.options.storage) {
             // a typo in a fixture fails here with the path of the problem
             (0, storage_schema_js_1.validateStorage)(this.options.storage);
@@ -333,6 +364,8 @@ class IMAPServer extends node_stream_1.Stream {
             this.smtpServer = null;
         }
         if (this.restServer) {
+            // event streams never end on their own, a graceful shutdown would wait for them forever
+            this.restServer.endStreams?.();
             this.restServer.close();
             // keep-alive connections would hold the server open
             if (force) {
@@ -368,6 +401,21 @@ class IMAPServer extends node_stream_1.Stream {
             handler(connection);
         });
     }
+    /**
+     * Opens a connection to the server in memory, without a network socket (no `listen()` needed). This is how the
+     * server runs in a browser, see the README "Run in a browser"
+     *
+     * @param {Object} [options] `{ secure }`: false makes the connection a plaintext one, where STARTTLS turns on the
+     *   encryption (nothing is encrypted, the session only counts as encrypted). By default the connection counts as
+     *   one over TLS
+     * @return {MemorySocket} the client end, write commands to it and read the responses from its `data` events
+     */
+    connect(options) {
+        const [serverSocket, clientSocket] = (0, memory_socket_js_1.createSocketPair)();
+        serverSocket.encrypted = clientSocket.encrypted = !options || options.secure !== false;
+        this.createClient(serverSocket);
+        return clientSocket;
+    }
     registerCapability(keyword, handler) {
         this.capabilities[keyword] =
             handler ||
@@ -511,8 +559,7 @@ class IMAPServer extends node_stream_1.Stream {
         let seen = 0;
         let unseen = 0;
         // flags stay defined in the mailbox once a message had them, see rememberFlags
-        const permanentFlags = [].concat(mailbox.permanentFlags || []);
-        (mailbox.knownFlags || []).forEach(flag => this.ensureFlag(permanentFlags, flag));
+        const permanentFlags = this.permanentFlagList(mailbox);
         let recent = 0;
         // \Recent sets of the sessions that have this mailbox selected
         const recentSets = [];
@@ -558,20 +605,8 @@ class IMAPServer extends node_stream_1.Stream {
      * @return {Boolean} Returns true if the date string is in IMAP date-time format
      */
     validateInternalDate(date) {
-        if (!date || typeof date !== 'string') {
-            return false;
-        }
-        // date-time from RFC 3501 section 9, month names are case-insensitive like all ABNF strings
-        const match = date.match(/^( \d|\d\d)-(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)-(\d{4}) (\d{2}):(\d{2}):(\d{2}) [-+](\d{2})(\d{2})$/i);
-        if (!match) {
-            return false;
-        }
-        // the values must also make a real date and time
-        return ((0, dates_js_1.isRealDate)(match[1], (0, dates_js_1.monthIndex)(match[2]), match[3]) &&
-            Number(match[4]) < 24 &&
-            Number(match[5]) < 60 &&
-            Number(match[6]) < 61 &&
-            Number(match[8]) < 60);
+        // date-time from RFC 3501 section 9
+        return (0, dates_js_1.isDateTime)(date);
     }
     /**
      * Converts a date object to a valid date-time string format
@@ -1002,6 +1037,32 @@ class IMAPServer extends node_stream_1.Stream {
         const knownFlags = (mailbox.knownFlags = mailbox.knownFlags || []);
         flags.forEach(flag => this.ensureFlag(knownFlags, flag));
     }
+    /**
+     * Checks if a flag can be stored on messages of a mailbox: any flag when the mailbox allows new keywords
+     * (PERMANENTFLAGS has `\*`), otherwise only a flag in the PERMANENTFLAGS list that getStatus() builds, the
+     * `permanentFlags` of the mailbox and every flag its messages had. RFC 3501 section 7.1 (RFC 9051 section 7.1):
+     * PERMANENTFLAGS "indicates which of the known flags the client can change permanently", STORE ignores the others
+     *
+     * @param {Object} mailbox Mailbox object
+     * @param {String} flag Normalized flag
+     * @return {Boolean} true if the flag is a permanent flag of the mailbox
+     */
+    isPermanentFlag(mailbox, flag) {
+        // the lists of permanentFlagList(), without building it: this runs for every flag STORE and APPEND set
+        return (mailbox.allowPermanentFlags || (mailbox.permanentFlags || []).indexOf(flag) >= 0 || (!!mailbox.knownFlags && mailbox.knownFlags.indexOf(flag) >= 0));
+    }
+    /**
+     * The flags of the PERMANENTFLAGS list (without `\*`): the `permanentFlags` of the mailbox and every flag its
+     * messages have or had (`knownFlags`, see rememberFlags)
+     *
+     * @param {Object} mailbox Mailbox object
+     * @return {Array} flags, a new list
+     */
+    permanentFlagList(mailbox) {
+        const list = [].concat(mailbox.permanentFlags || []);
+        (mailbox.knownFlags || []).forEach(flag => this.ensureFlag(list, flag));
+        return list;
+    }
     /**
      * The current time for dates the server sets itself (INTERNALDATE of a message without one, SAVEDATE). The `now`
      * option fixes it for repeatable tests: a Date, a timestamp, or a function that returns one
@@ -1073,9 +1134,10 @@ class IMAPServer extends node_stream_1.Stream {
      */
     appendMessage(path, flags, internaldate, raw, ignoreConnection, properties) {
         const mailbox = typeof path === 'string' ? this.getMailbox(path) : path;
-        // processMessage() below sets the UID
+        // processMessage() below sets the UID. Flags the mailbox can not store are left out (APPEND, COPY: the flags
+        // SHOULD be set, RFC 3501 sections 6.3.11 and 6.4.7), as STORE ignores them (RFC 3501 section 7.1, PERMANENTFLAGS)
         const message = Object.assign({}, properties, {
-            flags: flags,
+            flags: flags.filter(flag => this.isPermanentFlag(mailbox, flag)),
             internaldate: internaldate,
             raw: raw,
             recent: true
@@ -1261,49 +1323,48 @@ class IMAPServer extends node_stream_1.Stream {
         return flags;
     }
     matchFolders(referenceName, match, exportName, folders) {
-        let includeINBOX = false;
         const source = folders || this.folderCache;
         const toName = exportName || ((name) => name);
-        let reference = referenceName || '';
-        if (reference === '' && this.referenceNamespace !== false) {
-            reference = toName(this.referenceNamespace);
-            includeINBOX = true;
-        }
-        // the reference does not have to be a namespace, use the namespace it belongs to
-        let nsKey = false;
-        let nsName = '';
-        for (const key of Object.keys(this.storage)) {
-            const name = toName(key);
-            if (key !== 'INBOX' && reference.substr(0, name.length) === name && (nsKey === false || name.length > nsName.length)) {
-                nsKey = key;
-                nsName = name;
-            }
-        }
-        if (nsKey === false) {
-            return [];
-        }
-        const namespace = this.storage[nsKey];
-        const lookup = reference + match;
-        const result = [];
-        const pattern = '^' +
+        // RFC 3501 section 6.3.8 (RFC 9051 section 6.3.9): "An empty ("" string) reference name argument
+        // indicates that the mailbox name is interpreted as by SELECT", and without break out characters
+        // "the canonical form is normally the reference name appended with the mailbox name". The pattern
+        // matches full mailbox names, also in a personal namespace with a prefix such as "INBOX.". With the
+        // namespace convention "#" is a break out character "and must be treated as such" (RFC 3501 section 6.3.8,
+        // RFC 9051 section 6.3.9): a pattern that starts with it is a name of its own, the reference is ignored
+        const lookup = match.charAt(0) === '#' ? match : (referenceName || '') + match;
+        // "%" does not match the hierarchy delimiter, which is the one of the namespace a name belongs to
+        const toRegExp = (separator, flags = '') => new RegExp('^' +
             lookup
                 // escape regex symbols
                 .replace(/([\\^$+?!.():=[\]{}|,-])/g, '\\$1')
                 .replace(/[*]/g, '.*')
-                .replace(/[%]/g, '[^' + namespace.separator.replace(/([\\^$+*?!.():=[\]{}|,-])/g, '\\$1') + ']*') +
-            '$';
-        const query = new RegExp(pattern, '');
-        // INBOX is case-insensitive
-        if (includeINBOX && source.INBOX && ((reference ? reference + namespace.separator : '') + 'INBOX').match(new RegExp(pattern, 'i'))) {
+                .replace(/[%]/g, '[^' + separator.replace(/([\\^$+*?!.():=[\]{}|,-])/g, '\\$1') + ']*') +
+            '$', flags);
+        // RFC 3501 section 6.3.8 allows to "hide" otherwise accessible mailboxes from the wildcards: the
+        // mailboxes of namespaces other than the personal one are only matched when the pattern names
+        // the prefix of the namespace before any wildcard (LIST "" "user.%", LIST "#news." "*"). The pattern
+        // of every namespace that is matched, null for a hidden one
+        const fixedPrefix = lookup.replace(/[*%].*$/, '');
+        const queries = new Map();
+        Object.keys(this.storage).forEach(key => {
+            const name = toName(key);
+            const visible = key === this.referenceNamespace || fixedPrefix.substr(0, name.length) === name;
+            queries.set(key, visible ? toRegExp(this.storage[key].separator) : null);
+        });
+        const result = [];
+        // "The special name INBOX is included in the output from LIST, if [...] the uppercase string "INBOX"
+        // matches the interpreted reference and mailbox name arguments", INBOX is case-insensitive
+        if (source.INBOX && toRegExp((this.storage.INBOX && this.storage.INBOX.separator) || '/', 'i').test('INBOX')) {
             result.push(source.INBOX);
         }
         Object.keys(source).forEach(path => {
             const folder = source[path];
-            if (folder.namespace !== nsKey) {
+            const query = path !== 'INBOX' && folder.namespace !== false && folder.namespace !== 'INBOX' ? queries.get(folder.namespace) : null;
+            if (!query) {
                 return;
             }
             const name = toName(path);
-            if (name.match(query) && (folder.flags.indexOf('\\NonExistent') < 0 || name === match)) {
+            if (query.test(name) && (folder.flags.indexOf('\\NonExistent') < 0 || name === lookup)) {
                 result.push(folder);
             }
         });
@@ -1393,7 +1454,8 @@ class IMAPConnection {
         this._outputQueue = null;
         this._outputTimer = null;
         this._deferredOutput = null;
-        this.secureConnection = !!this.options.secureConnection;
+        // a TLS socket is encrypted, and so can be an in-memory connection of server.connect()
+        this.secureConnection = !!this.options.secureConnection || socket.encrypted === true;
         this._remainder = '';
         this._command = '';
         this._literalRemaining = 0;
@@ -1411,7 +1473,7 @@ class IMAPConnection {
         this.messageGlobal = false;
         this._commandQueue = [];
         this._processing = false;
-        if (this.options.debug) {
+        if (this.options.debug && typeof this.socket.pipe === 'function') {
             this.socket.pipe(process.stdout);
         }
         this.socket.on('data', this.receive.bind(this));
@@ -1650,7 +1712,8 @@ class IMAPConnection {
                 this.watchQuiet(quiet);
             }
         }, Math.max(0, next - (Date.now() - last)));
-        this._quietTimer.unref();
+        // browsers have no unref
+        this._quietTimer.unref?.();
     }
     /**
      * Handles data from the socket, through the transport layer if there is one
@@ -2161,7 +2224,7 @@ class IMAPConnection {
      * @return {Boolean} true if an EXPUNGE response is pending
      */
     hasPendingExpunge() {
-        return this.notificationQueue.some(notification => notification.attributes && (notification.attributes[1] || {}).value === 'EXPUNGE');
+        return this.notificationQueue.some(isPendingExpunge);
     }
     /**
      * Tells the other sessions that have the selected mailbox open about changed flags, they get
@@ -2320,6 +2383,16 @@ class IMAPConnection {
         // section 6.2.1). STARTTLS is refused when input is waiting (the noPipelining command option), this only
         // guards against plugins that upgrade the connection otherwise
         this.discardInput();
+        // STARTTLS runs on a live connection
+        const socket = this.socket;
+        if (typeof socket.startTls === 'function') {
+            // a socket without a TLS layer that can count as encrypted (MemorySocket of server.connect())
+            return socket.startTls(() => {
+                this.secureConnection = true;
+                this.upgrading = false;
+                callback();
+            });
+        }
         const secureContext = node_tls_1.default.createSecureContext(this.server.getCredentials());
         const socketOptions = {
             secureContext: secureContext,
@@ -2330,8 +2403,6 @@ class IMAPConnection {
                 cb(null, secureContext);
             }
         };
-        // STARTTLS runs on a live connection
-        const socket = this.socket;
         // the RST of a script rule goes to the TCP socket under the TLS layer, see resetSocket. Node also has it as the
         // _parent of the TLS socket, Bun does not
         this.tcpSocket = socket;
@@ -2368,22 +2439,52 @@ class IMAPConnection {
     prepareNotifications(queue) {
         return queue;
     }
-    processNotifications(data) {
-        const options = data && this.server.getCommandOptions(data.command);
-        if (options && (options.noExpunge || (options.searchCriteria !== false && this.usesSequenceNumbers(data)))) {
-            // EXPUNGE responses are not allowed during FETCH, STORE and SEARCH (RFC 3501 section 7.4.1), during
-            // the commands that extensions add to this list (see the noExpunge command option), nor during UID
-            // SEARCH with message numbers in the search criteria (RFC 7162 section 3.2.10.2 for VANISHED, EXPUNGE
-            // may wait as well, RFC 3501 only allows it during UID commands)
-            return;
-        }
+    /**
+     * Checks if EXPUNGE responses must wait while a command runs: during FETCH, STORE and SEARCH (RFC 3501 section
+     * 7.4.1), during the commands that extensions add to this list (see the noExpunge command option), and during UID
+     * SEARCH with message numbers in the search criteria (RFC 7162 section 3.2.10.2 for VANISHED, EXPUNGE may wait as
+     * well, RFC 3501 only allows it during UID commands)
+     *
+     * @param {Object} data Parsed command
+     * @return {Boolean} true if the command holds back EXPUNGE responses
+     */
+    holdsExpunge(data) {
+        const options = this.server.getCommandOptions(data.command);
+        return options.noExpunge || (options.searchCriteria !== false && this.usesSequenceNumbers(data));
+    }
+    /**
+     * Sends the queued notifications. During a command that holds back EXPUNGE responses (see holdsExpunge), or with
+     * `beforeCommand` before a command that refers to messages by sequence number, only the notifications queued before
+     * the first pending EXPUNGE go out: new messages (EXISTS) and flag changes. RFC 3501 section 5.2: "A server MUST send
+     * mailbox size updates automatically if a mailbox size change is observed during the processing of a command",
+     * section 7.4.1 forbids only EXPUNGE during FETCH, STORE and SEARCH. What was queued after the EXPUNGE waits with it,
+     * an EXISTS sent before it would describe a list that the client can not know yet
+     *
+     * @param {Object} [data] Parsed command that runs, or null between commands
+     * @param {Boolean} [beforeCommand] true when the command has not run yet, then a command with message sequence
+     *     numbers (COPY, MOVE) also waits with the EXPUNGE responses, its numbers refer to the messages before them
+     */
+    processNotifications(data, beforeCommand) {
         if (!this.notificationQueue.length) {
             return;
         }
-        const queue = this.prepareNotifications(this.notificationQueue);
-        this.notificationQueue = [];
+        let queue = this.notificationQueue;
         // Flag updates use the sequence numbers this session knows: before the EXPUNGE responses of
         // the snapshot are sent, the snapshot, afterwards the current message list
+        const snapshot = queue.find(notification => notification.mailboxCopy);
+        let held = [];
+        if (data && (this.holdsExpunge(data) || (beforeCommand && this.usesSequenceNumbers(data)))) {
+            const first = queue.findIndex(isPendingExpunge);
+            if (first >= 0) {
+                held = queue.slice(first);
+                queue = queue.slice(0, first);
+            }
+            if (!queue.length) {
+                return;
+            }
+        }
+        this.notificationQueue = held;
+        queue = this.prepareNotifications(queue);
         const snapshotIndex = queue.findIndex(notification => notification.mailboxCopy);
         const sequenceMaps = new Map();
         const getSequence = (messages) => {
@@ -2397,16 +2498,58 @@ class IMAPConnection {
         const current = this.selectedMailbox ? this.selectedMailbox.messages : [];
         // a message changed several times is reported once, its FETCH response carries the current flags
         const reported = new Set();
+        // before the snapshot (or with all of it still held back, then the split at the first pending expunge leaves
+        // no snapshot in the queue) the session knows the old list
+        const sessionList = (i) => (snapshot && (snapshotIndex < 0 || i < snapshotIndex) ? snapshot.mailboxCopy : current);
+        // the last EXISTS response of a run of EXISTS responses, and if the run announces new messages
+        let lastExists = -1;
+        let newMessages = false;
         queue.forEach((notification, i) => {
             if (notification.flagUpdate) {
-                // i < snapshotIndex only when there is a snapshot
-                this.sendFlagUpdate(notification.flagUpdate, getSequence(i < snapshotIndex ? queue[snapshotIndex].mailboxCopy : current), reported);
+                this.sendFlagUpdate(notification.flagUpdate, getSequence(sessionList(i)), reported);
             }
             else {
                 this.send(notification);
             }
+            if (isExists(notification)) {
+                lastExists = i;
+                // the EXISTS after the EXPUNGE responses of another session carries the snapshot instead of a message
+                newMessages = newMessages || !!notification.message;
+            }
+            const next = queue[i + 1];
+            if (lastExists < 0 || isExists(next) || (next && next.fetchedMessage)) {
+                // not the end of a run of EXISTS responses (and the FETCH responses NOTIFY sends after them)
+                return;
+            }
+            // RFC 3501 section 7.3.2: the RECENT response "occurs as a result of a SELECT or EXAMINE command, and if the
+            // size of the mailbox changes (e.g., new messages)". One for consecutive EXISTS responses that announce new
+            // messages, with the number of \Recent messages among those the client was told about. After expunges the
+            // EXPUNGE responses report the change (RFC 3501 section 7.4.1). It goes after the FETCH responses that NOTIFY
+            // sends for new messages, RFC 5465 section 5.2: "an unsolicited EXISTS response, followed by an unsolicited
+            // FETCH response [...] The server MAY also send a RECENT response"
+            if (newMessages) {
+                this.sendRecent(Number(queue[lastExists].attributes[0]), getSequence(sessionList(lastExists)));
+            }
+            lastExists = -1;
+            newMessages = false;
         });
     }
+    /**
+     * Sends an untagged RECENT response with the number of \Recent messages among the first `count` messages
+     *
+     * @param {Number} count Number of messages the client was told about
+     * @param {Map} sequence Message to the sequence number this session knows it by
+     */
+    sendRecent(count, sequence) {
+        let recent = 0;
+        (this.recent || new Set()).forEach(message => {
+            const seq = sequence.get(message);
+            if (seq && seq <= count) {
+                recent++;
+            }
+        });
+        this.send({ tag: '*', notification: true, attributes: [recent, { type: 'ATOM', value: 'RECENT' }] }, 'RECENT NOTIFICATION');
+    }
     /**
      * Compile a command object to a response string and write it to socket.
      * If the command object has a skipResponse property, the command is
@@ -2449,10 +2592,11 @@ class IMAPConnection {
             response.tag === parsed.tag &&
             response.command === 'OK' &&
             this.hasPendingExpunge() &&
-            this.server.getCommandOptions(parsed.command).noExpunge &&
+            this.holdsExpunge(parsed) &&
             !(Array.isArray(response.attributes) && response.attributes.some(attr => attr && attr.type === 'SECTION'))) {
             // After the output handlers, they might add a response code of their own (MODIFIED of CONDSTORE).
-            // FETCH, STORE, SEARCH and the like can not report the EXPUNGE of another session (RFC 3501 section 7.4.1),
+            // FETCH, STORE, SEARCH and the like can not report the EXPUNGE of another session (RFC 3501 section 7.4.1), nor
+            // can UID SEARCH with message numbers in the criteria (see holdsExpunge),
             // EXPUNGEISSUED tells the client to issue NOOP soon (RFC 5530 section 3, RFC 9051 section 7.1)
             response.attributes = [{ type: 'SECTION', section: [{ type: 'ATOM', value: 'EXPUNGEISSUED' }] }].concat(response.attributes || []);
         }
@@ -2596,6 +2740,15 @@ class IMAPConnection {
      * @return {Boolean} true if the command uses message sequence numbers
      */
     usesSequenceNumbers(parsed) {
+        // the notification checks ask several times per command, the answer does not change
+        let cached = sequenceNumberUse.get(parsed);
+        if (cached === undefined) {
+            cached = this.findSequenceNumbers(parsed);
+            sequenceNumberUse.set(parsed, cached);
+        }
+        return cached;
+    }
+    findSequenceNumbers(parsed) {
         const { sequenceSet, searchCriteria } = this.server.getCommandOptions(parsed.command);
         if (sequenceSet !== false) {
             // other forms of sequence sets, like "$" of SEARCHRES (RFC 5182 section 2.3), do not use numbers
@@ -2774,12 +2927,14 @@ class IMAPConnection {
             this.refusePipelined(parsed, data);
             return;
         }
-        if (this.server.getCommandHandler(parsed.command)) {
+        // an unknown SASL mechanism is answered by its own handler, after the central checks (state, script rules)
+        const fallback = /^AUTHENTICATE /i.test(parsed.command) && !this.server.getCommandHandler(parsed.command) ? unsupportedMechanism : undefined;
+        if (fallback || this.server.getCommandHandler(parsed.command)) {
             if (this.isAmbiguous(parsed)) {
                 this.sendStatus(parsed, data, 'BAD', 'Commands with message sequence numbers must wait for the completion of earlier commands');
                 return;
             }
-            const element = { parsed, data };
+            const element = { parsed, data, handler: fallback };
             if (scripted) {
                 // processQueue runs it once the script rule released the queue
                 this._commandQueue.unshift(element);
@@ -2789,19 +2944,6 @@ class IMAPConnection {
             }
             this.processQueue();
         }
-        else if (/^AUTHENTICATE /i.test(parsed.command)) {
-            // an unsupported mechanism is a NO, not a syntax error (RFC 3501 section 6.2.2)
-            this.send({
-                tag: parsed.tag,
-                command: 'NO',
-                attributes: [
-                    {
-                        type: 'TEXT',
-                        value: 'Unsupported authentication mechanism'
-                    }
-                ]
-            }, 'UNKNOWN COMMAND', parsed, data);
-        }
         else {
             this.send({
                 tag: parsed.tag,
@@ -2969,19 +3111,25 @@ class IMAPConnection {
                 return next();
             }
         }
-        if (command.substr(0, 4) === 'UID ' && this.hasPendingExpunge()) {
-            // EXPUNGE responses may be sent during UID commands (RFC 3501 section 7.4.1). The expunges of other sessions
-            // are reported first, then the command runs on the current mailbox, where the UIDs of the expunged messages
-            // do not exist and are ignored (RFC 3501 section 6.4.8), so the ghost handling of STORE, COPY and MOVE (RFC 2180
-            // section 4) only applies to their sequence number forms. Not for UID SEARCH with message numbers in the
-            // criteria, processNotifications knows when EXPUNGE must wait
-            this.processNotifications(element.parsed);
+        if (this.state === 'Selected' &&
+            (command.startsWith('UID ') || options.noExpunge || options.sequenceSet !== false || options.searchCriteria !== false)) {
+            // A command that refers to messages runs on the message list the client was told about. Only these: CLOSE
+            // must not send pending EXPUNGE responses (RFC 3501 section 6.4.2) and SELECT leaves the old mailbox. RFC 3501 section 5.2:
+            // "A server MUST send mailbox size updates automatically if a mailbox size change is observed during the
+            // processing of a command", so the new messages and flag changes of other sessions are reported first,
+            // before the command resolves its sequence set or search criteria.
+            // EXPUNGE responses may be sent during UID commands (RFC 3501 section 7.4.1), so these report the expunges of
+            // other sessions first as well, then the command runs on the current mailbox, where the UIDs of the expunged
+            // messages do not exist and are ignored (RFC 3501 section 6.4.8). The ghost handling of STORE, COPY and MOVE
+            // (RFC 2180 section 4) only applies to their sequence number forms, these and UID SEARCH with message numbers
+            // in the criteria keep the EXPUNGE responses for later, see processNotifications
+            this.processNotifications(element.parsed, true);
         }
         // changes made while the handler runs are attributed to this session (the `origin` of notifications)
         this.server.withOrigin(this, () => {
             try {
                 const inputHandler = this.inputHandler;
-                this.server.getCommandHandler(element.parsed.command)(this, element.parsed, element.data, next);
+                (element.handler || this.server.getCommandHandler(element.parsed.command))(this, element.parsed, element.data, next);
                 if (this.inputHandler && this.inputHandler !== inputHandler) {
                     // the command reads the lines that follow (IDLE, AUTHENTICATE), script rules match them with it
                     this.inputCommand = { tag: element.parsed.tag, command: element.parsed.command };

package/dist/cjs/storage-schema.js

@@ -9,6 +9,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.storageSchema = void 0;
 exports.validateStorage = validateStorage;
 const numbers_js_1 = require("./numbers.js");
+const dates_js_1 = require("./dates.js");
 // keys of plugins, an unknown key that looks like a typo of a known key is refused unless a plugin uses it
 const PLUGIN_KEYS = [
     'acl',
@@ -151,11 +152,17 @@ function validateStorage(storage) {
         if (message.flags !== undefined && typeof message.flags !== 'string' && !isFlagList(message.flags)) {
             fail(path + '.flags', 'must be a flag or a list of flags');
         }
-        if (message.internaldate !== undefined &&
-            message.internaldate !== false &&
-            typeof message.internaldate !== 'string' &&
-            !(message.internaldate instanceof Date)) {
-            fail(path + '.internaldate', 'must be a date-time string or a Date');
+        // FETCH sends the internal date as it is and SORT ARRIVAL reads it, so it must be a date-time of RFC 3501
+        // section 9 (month names in any case, they are sent as "Jan", "Feb", ...) or a valid Date. The save date
+        // of the SAVEDATE plugin is a date-time too (RFC 8514 section 4.2)
+        for (const key of ['internaldate', 'SAVEDATE']) {
+            const value = message[key];
+            if (value === undefined || value === false || (key === 'SAVEDATE' && value === null)) {
+                continue;
+            }
+            if (value instanceof Date ? isNaN(value.getTime()) : !(0, dates_js_1.isDateTime)(value)) {
+                fail(path + '.' + key, 'must be a date-time string like "14-Sep-2013 21:22:28 -0300" or a Date, not ' + JSON.stringify(value));
+            }
         }
         if (message.recent !== undefined && typeof message.recent !== 'boolean') {
             fail(path + '.recent', 'must be true or false');

package/dist/cjs/store-operations.d.ts

@@ -6,7 +6,10 @@
  * what is specific to a session: argument checks, the selected mailbox, read-only state and the responses.
  */
 import type { IMAPConnection, IMAPServer, Mailbox, Message } from './types.js';
-/** the XOAUTH2 session timeout of the default user, and of a user the control API adds without one */
+/**
+ * the deprecated XOAUTH2 session timeout of the default user, and of a user the control API adds without one. It is
+ * stored and listed but never used, access tokens do not expire
+ */
 declare const DEFAULT_SESSION_TIMEOUT: number;
 /** An error of a failed store operation or control API call, `code` is a RFC 5530 response code or INVALID */
 declare class ImapKitError extends Error {
@@ -94,7 +97,7 @@ declare function createMailbox(server: IMAPServer, path: string): Mailbox;
  *
  * @param {Object} server IMAP server
  * @param {String} path Storage name of the mailbox
- * @throws {Error} with a RFC 5530 `code` (NONEXISTENT, CANNOT, HASCHILDREN ...)
+ * @throws {Error} with a response `code` (NONEXISTENT, CANNOT, HASCHILDREN ...)
  */
 declare function deleteMailbox(server: IMAPServer, path: string): void;
 /**

package/dist/cjs/store-operations.js

@@ -22,7 +22,10 @@ exports.unsubscribeMailbox = unsubscribeMailbox;
 const flags_js_1 = require("./commands/handlers/flags.js");
 const random_js_1 = require("./random.js");
 const numbers_js_1 = require("./numbers.js");
-/** the XOAUTH2 session timeout of the default user, and of a user the control API adds without one */
+/**
+ * the deprecated XOAUTH2 session timeout of the default user, and of a user the control API adds without one. It is
+ * stored and listed but never used, access tokens do not expire
+ */
 const DEFAULT_SESSION_TIMEOUT = 3600 * 1000;
 exports.DEFAULT_SESSION_TIMEOUT = DEFAULT_SESSION_TIMEOUT;
 /** An error of a failed store operation or control API call, `code` is a RFC 5530 response code or INVALID */
@@ -160,7 +163,7 @@ function checkFlags(server, mailbox, flags, stored) {
         catch (err) {
             throw storeError(err.message, 'INVALID');
         }
-        if (stored && mailbox.permanentFlags.indexOf(flag) < 0 && !mailbox.allowPermanentFlags) {
+        if (stored && !server.isPermanentFlag(mailbox, flag)) {
             throw storeError('Flag ' + flag + ' is not a permanent flag of ' + mailbox.path, 'INVALID');
         }
         if (list.indexOf(flag) < 0) {
@@ -234,7 +237,7 @@ function createMailbox(server, path) {
  *
  * @param {Object} server IMAP server
  * @param {String} path Storage name of the mailbox
- * @throws {Error} with a RFC 5530 `code` (NONEXISTENT, CANNOT, HASCHILDREN ...)
+ * @throws {Error} with a response `code` (NONEXISTENT, CANNOT, HASCHILDREN ...)
  */
 function deleteMailbox(server, path) {
     const mailbox = server.getMailbox(path);

package/dist/cjs/types.d.ts

@@ -212,6 +212,10 @@ export interface UserData {
     password?: string | undefined;
     xoauth2?: {
         accessToken?: string | undefined;
+        /**
+         * @deprecated kept from hoodiecrow and ignored: access tokens never expire. Change the token with
+         * `control.updateUser()` to test a client against an expired one
+         */
         sessionTimeout?: number | undefined;
     } | undefined;
     [key: string]: any;

package/dist/esm/commands/handlers/fetch.js

@@ -79,7 +79,8 @@ function getSection(data, query, global) {
     else if (query.section.length > 1) {
         throw new Error((key || 'Part number') + ' does not take any arguments');
     }
-    // RFC 3501 6.4.5: a part that does not exist is returned as an empty string
+    // a part that does not exist is returned as an empty string, like Dovecot does: RFC 3501 and RFC 9051 section
+    // 6.4.5 define no error for it, only an empty string for a partial range that starts beyond the end of the text
     const node = path ? resolveNode(data.tree, path, global) : data.tree;
     if (!node) {
         return '';