react-native-email-imap-smtp 0.1.0

package/windows/TlsSocket.cpp

@@ -0,0 +1,818 @@
+// ============================================================
+// TlsSocket.cpp — WinSock2 TCP + Schannel TLS implementation
+// ============================================================
+
+#include "TlsSocket.h"
+
+#include <sstream>
+#include <cstring>
+#include <chrono>
+#include <algorithm>
+#include <cctype>
+#include <iomanip>
+
+#ifndef SCH_CRED_NO_SYSTEM_MAPPER
+#define SCH_CRED_NO_SYSTEM_MAPPER 0x00000002
+#endif
+#ifndef SCH_CRED_NO_SERVERNAME_CHECK
+#define SCH_CRED_NO_SERVERNAME_CHECK 0x00000004
+#endif
+
+namespace emailimap {
+
+// ═══════════════════════════════════════════════════════════
+//  Utility functions
+// ═══════════════════════════════════════════════════════════
+
+std::string trim(const std::string& str) {
+  size_t first = str.find_first_not_of(" \t\r\n");
+  if (first == std::string::npos) return "";
+  size_t last = str.find_last_not_of(" \t\r\n");
+  return str.substr(first, last - first + 1);
+}
+
+std::string toUpper(const std::string& str) {
+  std::string result = str;
+  std::transform(result.begin(), result.end(), result.begin(), ::toupper);
+  return result;
+}
+
+std::vector<std::string> split(const std::string& str, char delimiter) {
+  std::vector<std::string> tokens;
+  std::stringstream ss(str);
+  std::string token;
+  while (std::getline(ss, token, delimiter)) {
+    tokens.push_back(token);
+  }
+  return tokens;
+}
+
+std::string currentTimestamp() {
+  auto now = std::chrono::system_clock::now();
+  auto tt = std::chrono::system_clock::to_time_t(now);
+  std::tm tm;
+  gmtime_s(&tm, &tt);
+  std::stringstream ss;
+  ss << std::put_time(&tm, "%Y-%m-%dT%H:%M:%S+0000");
+  return ss.str();
+}
+
+std::string formatDate(std::time_t t) {
+  std::tm tm;
+  gmtime_s(&tm, &t);
+  std::stringstream ss;
+  ss << std::put_time(&tm, "%d-%b-%Y %H:%M:%S +0000");
+  return ss.str();
+}
+
+// ═══════════════════════════════════════════════════════════
+//  Base64
+// ═══════════════════════════════════════════════════════════
+
+static const char BASE64_CHARS[] =
+  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+std::string encodeBase64(const std::vector<char>& data) {
+  std::string result;
+  int i = 0;
+  int j = 0;
+  unsigned char array3[3];
+  unsigned char array4[4];
+
+  for (unsigned char c : data) {
+    array3[i++] = c;
+    if (i == 3) {
+      array4[0] = (array3[0] & 0xfc) >> 2;
+      array4[1] = ((array3[0] & 0x03) << 4) + ((array3[1] & 0xf0) >> 4);
+      array4[2] = ((array3[1] & 0x0f) << 2) + ((array3[2] & 0xc0) >> 6);
+      array4[3] = array3[2] & 0x3f;
+      for (i = 0; i < 4; i++)
+        result += BASE64_CHARS[array4[i]];
+      i = 0;
+    }
+  }
+
+  if (i) {
+    for (j = i; j < 3; j++)
+      array3[j] = '\0';
+    array4[0] = (array3[0] & 0xfc) >> 2;
+    array4[1] = ((array3[0] & 0x03) << 4) + ((array3[1] & 0xf0) >> 4);
+    array4[2] = ((array3[1] & 0x0f) << 2) + ((array3[2] & 0xc0) >> 6);
+    array4[3] = array3[2] & 0x3f;
+    for (j = 0; j < i + 1; j++)
+      result += BASE64_CHARS[array4[j]];
+    while ((i++ < 3))
+      result += '=';
+  }
+
+  return result;
+}
+
+std::vector<char> decodeBase64(const std::string& data) {
+  std::vector<char> result;
+  std::string tmp;
+  for (char c : data) {
+    if (c == '=') break;
+    if (std::isalnum(c) || c == '+' || c == '/')
+      tmp += c;
+  }
+  if (tmp.empty()) return result;
+
+  int i = 0;
+  unsigned char array4[4], array3[3];
+  for (char c : tmp) {
+    char* p = strchr(const_cast<char*>(BASE64_CHARS), c);
+    if (!p) continue;
+    array4[i++] = static_cast<unsigned char>(p - BASE64_CHARS);
+    if (i == 4) {
+      array3[0] = (array4[0] << 2) + ((array4[1] & 0x30) >> 4);
+      array3[1] = ((array4[1] & 0xf) << 4) + ((array4[2] & 0x3c) >> 2);
+      array3[2] = ((array4[2] & 0x3) << 6) + array4[3];
+      for (i = 0; i < 3; i++)
+        result.push_back(array3[i]);
+      i = 0;
+    }
+  }
+  return result;
+}
+
+std::string encodeBase64Text(const std::string& text) {
+  std::vector<char> data(text.begin(), text.end());
+  return encodeBase64(data);
+}
+
+// ═══════════════════════════════════════════════════════════
+//  TlsSocket
+// ═══════════════════════════════════════════════════════════
+
+TlsSocket::TlsSocket()
+  : m_socket(INVALID_SOCKET)
+  , m_tls(false)
+  , m_hasCredHandle(false)
+  , m_hasCtxtHandle(false)
+  , m_checkCertificate(true)
+{
+  WSADATA wsaData;
+  WSAStartup(MAKEWORD(2, 2), &wsaData);
+}
+
+TlsSocket::~TlsSocket() {
+  disconnect();
+  WSACleanup();
+}
+
+bool TlsSocket::connect(const std::string& host, int port, int timeoutMs, bool checkCertificate) {
+  std::lock_guard<std::mutex> lock(m_mutex);
+  m_lastError = 0;
+
+  m_serverName = host;
+  m_checkCertificate = checkCertificate;
+
+  struct addrinfo hints = {}, *addrList = nullptr;
+  hints.ai_family = AF_UNSPEC;
+  hints.ai_socktype = SOCK_STREAM;
+  hints.ai_protocol = IPPROTO_TCP;
+
+  std::string portStr = std::to_string(port);
+  if (getaddrinfo(host.c_str(), portStr.c_str(), &hints, &addrList) != 0 || !addrList) {
+    m_lastError = WSAGetLastError();
+    return false;
+  }
+
+  for (struct addrinfo* addr = addrList; addr; addr = addr->ai_next) {
+    m_socket = ::socket(addr->ai_family, addr->ai_socktype, addr->ai_protocol);
+    if (m_socket == INVALID_SOCKET) {
+      m_lastError = WSAGetLastError();
+      continue;
+    }
+
+    u_long mode = 1;
+    ioctlsocket(m_socket, FIONBIO, &mode);
+
+    ::connect(m_socket, addr->ai_addr, static_cast<int>(addr->ai_addrlen));
+
+    fd_set fd;
+    FD_ZERO(&fd);
+    FD_SET(m_socket, &fd);
+    timeval tv = { timeoutMs / 1000, (timeoutMs % 1000) * 1000 };
+    int sel = select(static_cast<int>(m_socket) + 1, nullptr, &fd, nullptr, &tv);
+    if (sel <= 0) {
+      m_lastError = WSAGetLastError();
+      closesocket(m_socket);
+      m_socket = INVALID_SOCKET;
+      continue;
+    }
+
+    int error = 0;
+    socklen_t len = sizeof(error);
+    getsockopt(m_socket, SOL_SOCKET, SO_ERROR, reinterpret_cast<char*>(&error), &len);
+    if (error != 0) {
+      m_lastError = error;
+      closesocket(m_socket);
+      m_socket = INVALID_SOCKET;
+      continue;
+    }
+
+    mode = 0;
+    ioctlsocket(m_socket, FIONBIO, &mode);
+
+    DWORD tv_ms = timeoutMs;
+    setsockopt(m_socket, SOL_SOCKET, SO_RCVTIMEO, reinterpret_cast<const char*>(&tv_ms), sizeof(tv_ms));
+    setsockopt(m_socket, SOL_SOCKET, SO_SNDTIMEO, reinterpret_cast<const char*>(&tv_ms), sizeof(tv_ms));
+
+    break;
+  }
+
+  freeaddrinfo(addrList);
+
+  if (m_socket == INVALID_SOCKET) {
+    return false;
+  }
+
+  m_tls = (port == 993 || port == 465);
+  if (m_tls) {
+    if (!initializeSchannel()) {
+      // acquireCredentialsHandle failed; SECURITY_STATUS stored in m_lastError
+      closesocket(m_socket);
+      m_socket = INVALID_SOCKET;
+      return false;
+    }
+    if (!performClientHandshake()) {
+      // InitializeSecurityContext failed; SECURITY_STATUS stored in m_lastError
+      disconnectInternal();
+      return false;
+    }
+  }
+
+  return true;
+}
+
+void TlsSocket::disconnectInternal() {
+  if (m_hasCtxtHandle) {
+    DeleteSecurityContext(&m_ctxtHandle);
+    m_hasCtxtHandle = false;
+  }
+  if (m_hasCredHandle) {
+    FreeCredentialsHandle(&m_credHandle);
+    m_hasCredHandle = false;
+  }
+  if (m_socket != INVALID_SOCKET) {
+    ::shutdown(m_socket, SD_BOTH);
+    closesocket(m_socket);
+    m_socket = INVALID_SOCKET;
+  }
+  m_receiveBuffer.clear();
+  m_pendingTlsData.clear();
+}
+
+void TlsSocket::disconnect() {
+  std::lock_guard<std::mutex> lock(m_mutex);
+  disconnectInternal();
+}
+
+bool TlsSocket::isConnected() const {
+  return m_socket != INVALID_SOCKET;
+}
+
+// ─── TLS: Initialize Schannel ───────────────────────────────
+
+bool TlsSocket::initializeSchannel() {
+  SCHANNEL_CRED schannelCred = {};
+  schannelCred.dwVersion = SCHANNEL_CRED_VERSION;
+
+  // Explicitly enable TLS 1.2 only to avoid compatibility issues
+  schannelCred.grbitEnabledProtocols = SP_PROT_TLS1_2;
+
+  if (!m_checkCertificate) {
+    schannelCred.dwFlags |= SCH_CRED_MANUAL_CRED_VALIDATION;
+    schannelCred.dwFlags |= SCH_CRED_NO_SYSTEM_MAPPER;
+    schannelCred.dwFlags |= SCH_CRED_NO_SERVERNAME_CHECK;
+  }
+
+  TimeStamp expiry;
+  SECURITY_STATUS status = AcquireCredentialsHandle(
+    nullptr,
+    const_cast<char*>(UNISP_NAME),
+    SECPKG_CRED_OUTBOUND,
+    nullptr,
+    &schannelCred,
+    nullptr,
+    nullptr,
+    &m_credHandle,
+    &expiry
+  );
+
+  if (status != SEC_E_OK) {
+    fprintf(stderr, "[TLS] AcquireCredentialsHandle failed: 0x%08x\n", (unsigned int)status);
+    m_lastError = static_cast<int>(status);
+    return false;
+  }
+  m_hasCredHandle = true;
+  return true;
+}
+
+// ─── TLS: Perform Handshake ─────────────────────────────────
+
+bool TlsSocket::performClientHandshake() {
+  fprintf(stderr, "[TLS] Starting handshake with %s\n", m_serverName.c_str());
+  SecBuffer outBuffers[1] = {};
+  SecBufferDesc outDesc = {};
+  outDesc.ulVersion = SECBUFFER_VERSION;
+  outDesc.cBuffers = 1;
+  outDesc.pBuffers = outBuffers;
+  outBuffers[0].BufferType = SECBUFFER_TOKEN;
+
+  DWORD flags = ISC_REQ_SEQUENCE_DETECT | ISC_REQ_REPLAY_DETECT |
+                ISC_REQ_CONFIDENTIALITY | ISC_REQ_ALLOCATE_MEMORY |
+                ISC_REQ_STREAM;
+
+  if (!m_checkCertificate) {
+    flags |= ISC_REQ_MANUAL_CRED_VALIDATION;
+  }
+
+  std::wstring wServerName(m_serverName.begin(), m_serverName.end());
+
+  SECURITY_STATUS status;
+  DWORD outFlags;
+  TimeStamp expiry;
+
+  status = InitializeSecurityContextW(
+    &m_credHandle,
+    nullptr,
+    const_cast<wchar_t*>(wServerName.c_str()),
+    flags,
+    0,
+    0,
+    nullptr,
+    0,
+    &m_ctxtHandle,
+    &outDesc,
+    &outFlags,
+    &expiry
+  );
+
+  if (status != SEC_I_CONTINUE_NEEDED) {
+    fprintf(stderr, "[TLS] InitSecCtx(first) failed: status=0x%08x\n", (unsigned int)status);
+    m_lastError = static_cast<int>(status);
+    return false;
+  }
+
+  fprintf(stderr, "[TLS] ClientHello generated: %d bytes\n", (int)outBuffers[0].cbBuffer);
+  if (outBuffers[0].cbBuffer > 0) {
+    int sent = ::send(m_socket, reinterpret_cast<const char*>(outBuffers[0].pvBuffer),
+           outBuffers[0].cbBuffer, 0);
+    fprintf(stderr, "[TLS] Sent ClientHello: %d bytes\n", sent);
+    FreeContextBuffer(outBuffers[0].pvBuffer);
+  }
+
+  std::vector<char> extraBuf;
+  int loopCount = 0;
+  while (status == SEC_I_CONTINUE_NEEDED ||
+         status == SEC_E_INCOMPLETE_MESSAGE) {
+    loopCount++;
+    fprintf(stderr, "[TLS] Loop #%d status=0x%08x extraBuf=%zu\n",
+            loopCount, (unsigned int)status, extraBuf.size());
+    fflush(stderr);
+    // If we don't have saved extra data, recv from socket
+    if (extraBuf.empty()) {
+      char buf[4096];
+      int bytes = ::recv(m_socket, buf, sizeof(buf), 0);
+      fprintf(stderr, "[TLS] recv: %d bytes", bytes);
+      if (bytes <= 0) {
+        fprintf(stderr, " (WSAError=%d)\n", WSAGetLastError());
+        m_lastError = WSAGetLastError();
+        return false;
+      }
+      fprintf(stderr, " (first byte=0x%02x)\n", (unsigned char)buf[0]);
+      extraBuf.assign(buf, buf + bytes);
+    }
+
+    // Provide 4 input buffers so Schannel can report SECBUFFER_EXTRA
+    SecBuffer inBuffers[4] = {};
+    inBuffers[0].cbBuffer = static_cast<unsigned long>(extraBuf.size());
+    inBuffers[0].BufferType = SECBUFFER_TOKEN;
+    inBuffers[0].pvBuffer = extraBuf.data();
+    // remaining 3 buffers are SECBUFFER_EMPTY (zero-initialized)
+
+    SecBufferDesc inDesc = {};
+    inDesc.ulVersion = SECBUFFER_VERSION;
+    inDesc.cBuffers = 4;
+    inDesc.pBuffers = inBuffers;
+
+    outBuffers[0].pvBuffer = nullptr;
+    outBuffers[0].cbBuffer = 0;
+    outBuffers[0].BufferType = SECBUFFER_TOKEN;
+
+    status = InitializeSecurityContextW(
+      &m_credHandle,
+      &m_ctxtHandle,
+      const_cast<wchar_t*>(wServerName.c_str()),
+      flags,
+      0,
+      0,
+      &inDesc,
+      0,
+      nullptr,
+      &outDesc,
+      &outFlags,
+      &expiry
+    );
+
+    fprintf(stderr, "[TLS] InitSecCtx(loop) -> status=0x%08x, outBuf=%d bytes\n",
+            (unsigned int)status, (int)outBuffers[0].cbBuffer);
+
+    // Send output token (e.g. ClientKeyExchange) if generated
+    if (outBuffers[0].cbBuffer > 0) {
+      int sent = (int)::send(m_socket, reinterpret_cast<const char*>(outBuffers[0].pvBuffer),
+             outBuffers[0].cbBuffer, 0);
+      fprintf(stderr, "[TLS] Sent response: %d bytes\n", sent);
+      FreeContextBuffer(outBuffers[0].pvBuffer);
+    }
+
+    // Handle extra (unconsumed) data or incomplete messages
+    // Schannel may report:
+    //   SECBUFFER_EXTRA  — unconsumed data remaining in our buffer
+    //   SECBUFFER_MISSING — number of additional bytes needed for a complete message
+    {
+      size_t extraBytes = 0;
+      size_t missingBytes = 0;
+      for (int i = 0; i < 4; i++) {
+        if (inBuffers[i].BufferType == SECBUFFER_EXTRA && inBuffers[i].cbBuffer > 0) {
+          extraBytes = inBuffers[i].cbBuffer;
+        }
+        if (inBuffers[i].BufferType == SECBUFFER_MISSING && inBuffers[i].cbBuffer > 0) {
+          missingBytes = inBuffers[i].cbBuffer;
+        }
+      }
+
+      if (status == SEC_E_INCOMPLETE_MESSAGE) {
+        // Schannel needs more data — keep existing extraBuf and recv more
+        char buf[4096];
+        int bytes = ::recv(m_socket, buf, sizeof(buf), 0);
+        fprintf(stderr, "[TLS] recv (incomplete): %d bytes", bytes);
+        if (bytes > 0) {
+          fprintf(stderr, " (first byte=0x%02x, missing=%zu)\n",
+                  (unsigned char)buf[0], missingBytes);
+          extraBuf.insert(extraBuf.end(), buf, buf + bytes);
+        } else {
+          fprintf(stderr, " (WSAError=%d)\n", WSAGetLastError());
+          m_lastError = WSAGetLastError();
+          return false;
+        }
+      } else if (extraBytes > 0 && extraBytes < extraBuf.size()) {
+        // Extra data is at the tail of our input buffer
+        size_t consumed = extraBuf.size() - extraBytes;
+        std::vector<char> tmp(extraBuf.begin() + static_cast<ptrdiff_t>(consumed),
+                              extraBuf.end());
+        extraBuf = std::move(tmp);
+        fprintf(stderr, "[TLS] Extra data: %zu bytes (consumed=%zu)\n", extraBuf.size(), consumed);
+      } else if (extraBytes >= extraBuf.size()) {
+        // All data was extra (nothing consumed) - shouldn't happen
+        fprintf(stderr, "[TLS] Warning: all %zu bytes were extra\n", extraBuf.size());
+        extraBuf.clear();
+      } else {
+        // No extra data - need to recv more
+        extraBuf.clear();
+      }
+    }
+
+    if (status == SEC_E_OK) {
+      QueryContextAttributes(&m_ctxtHandle, SECPKG_ATTR_STREAM_SIZES, &m_streamSizes);
+      m_hasCtxtHandle = true;
+      // Save any extra (unconsumed) data to m_receiveBuffer so the caller
+      // can read it (e.g. IMAP greeting piggybacked on the handshake).
+      if (!extraBuf.empty()) {
+        fprintf(stderr, "[TLS] Handshake extra data: %zu bytes saved to buffer\n", extraBuf.size());
+        m_receiveBuffer.append(extraBuf.data(), extraBuf.size());
+      }
+      fprintf(stderr, "[TLS] Handshake successful!\n");
+      return true;
+    }
+
+    if (status != SEC_I_CONTINUE_NEEDED && status != SEC_E_INCOMPLETE_MESSAGE) {
+      fprintf(stderr, "[TLS] Unexpected status: 0x%08x\n", (unsigned int)status);
+      m_lastError = static_cast<int>(status);
+    }
+  }
+
+  fprintf(stderr, "[TLS] Handshake failed, final status=0x%08x\n", (unsigned int)status);
+  m_lastError = static_cast<int>(status);
+  return false;
+}
+
+// ─── TLS: Encrypt ───────────────────────────────────────────
+
+bool TlsSocket::encryptMessage(const std::string& plaintext, std::vector<char>& ciphertext) {
+  if (!m_hasCtxtHandle) return false;
+
+  int needed = m_streamSizes.cbHeader + static_cast<int>(plaintext.size()) + m_streamSizes.cbTrailer;
+  std::vector<char> msg(needed);
+
+  SecBuffer buffers[4];
+  buffers[0].cbBuffer = m_streamSizes.cbHeader;
+  buffers[0].BufferType = SECBUFFER_STREAM_HEADER;
+  buffers[0].pvBuffer = msg.data();
+
+  buffers[1].cbBuffer = static_cast<unsigned long>(plaintext.size());
+  buffers[1].BufferType = SECBUFFER_DATA;
+  buffers[1].pvBuffer = msg.data() + m_streamSizes.cbHeader;
+  memcpy(buffers[1].pvBuffer, plaintext.data(), plaintext.size());
+
+  buffers[2].cbBuffer = m_streamSizes.cbTrailer;
+  buffers[2].BufferType = SECBUFFER_STREAM_TRAILER;
+  buffers[2].pvBuffer = msg.data() + m_streamSizes.cbHeader + plaintext.size();
+
+  buffers[3].cbBuffer = 0;
+  buffers[3].BufferType = SECBUFFER_EMPTY;
+
+  SecBufferDesc desc;
+  desc.ulVersion = SECBUFFER_VERSION;
+  desc.cBuffers = 4;
+  desc.pBuffers = buffers;
+
+  SECURITY_STATUS status = EncryptMessage(&m_ctxtHandle, 0, &desc, 0);
+  if (status != SEC_E_OK) return false;
+
+  int totalSize = buffers[0].cbBuffer + buffers[1].cbBuffer + buffers[2].cbBuffer;
+  ciphertext.resize(totalSize);
+  memcpy(ciphertext.data(), msg.data(), totalSize);
+  return true;
+}
+
+// ─── TLS: Decrypt ───────────────────────────────────────────
+// Returns: 1=success, 0=incomplete (need more data), -1=fatal error
+int TlsSocket::decryptMessage(std::vector<char>& buffer, std::vector<char>& plaintext) {
+  if (!m_hasCtxtHandle) return -1;
+
+  // Save original data so we can locate SECBUFFER_EXTRA after DecryptMessage
+  std::vector<char> originalBuf = buffer;
+
+  SecBuffer buffers[4];
+  buffers[0].cbBuffer = static_cast<unsigned long>(buffer.size());
+  buffers[0].BufferType = SECBUFFER_DATA;
+  buffers[0].pvBuffer = buffer.data();
+  buffers[1].cbBuffer = 0;
+  buffers[1].BufferType = SECBUFFER_EMPTY;
+  buffers[2].cbBuffer = 0;
+  buffers[2].BufferType = SECBUFFER_EMPTY;
+  buffers[3].cbBuffer = 0;
+  buffers[3].BufferType = SECBUFFER_EMPTY;
+
+  SecBufferDesc desc;
+  desc.ulVersion = SECBUFFER_VERSION;
+  desc.cBuffers = 4;
+  desc.pBuffers = buffers;
+
+  SECURITY_STATUS status = DecryptMessage(&m_ctxtHandle, &desc, 0, nullptr);
+  if (status == SEC_E_INCOMPLETE_MESSAGE) {
+    // need more data
+    return 0; // need more data
+  }
+  if (status != SEC_E_OK) {
+    // decrypt failed
+    return -1; // fatal
+  }
+
+  // Find decrypted plaintext and any extra (unconsumed) encrypted data
+  const char* decPtr = nullptr;
+  unsigned long decLen = 0;
+  size_t extraOffset = 0; // offset within the ORIGINAL buffer
+  unsigned long extraLen = 0;
+
+  for (int i = 0; i < 4; i++) {
+    if (buffers[i].BufferType == SECBUFFER_DATA && buffers[i].cbBuffer > 0) {
+      decPtr = reinterpret_cast<const char*>(buffers[i].pvBuffer);
+      decLen = buffers[i].cbBuffer;
+    }
+    if (buffers[i].BufferType == SECBUFFER_EXTRA && buffers[i].cbBuffer > 0) {
+      // extraPtr points into buffer.data(); compute offset from there
+      const char* extraPtr = reinterpret_cast<const char*>(buffers[i].pvBuffer);
+      extraOffset = static_cast<size_t>(extraPtr - buffer.data());
+      extraLen = buffers[i].cbBuffer;
+    }
+  }
+
+  if (!decPtr || decLen == 0) return -1;
+
+  // Output: plaintext = decrypted data
+  plaintext.assign(decPtr, decPtr + decLen);
+
+  // Output: buffer = remaining encrypted data (from the saved original copy)
+  if (extraLen > 0 && extraOffset + extraLen <= originalBuf.size()) {
+    buffer.assign(originalBuf.data() + extraOffset,
+                  originalBuf.data() + extraOffset + extraLen);
+  } else {
+    buffer.clear();
+  }
+
+  return 1;
+}
+
+bool TlsSocket::sendEncrypted(const std::vector<char>& data) {
+  int totalSent = 0;
+  while (totalSent < static_cast<int>(data.size())) {
+    int n = ::send(m_socket, data.data() + totalSent,
+                   static_cast<int>(data.size()) - totalSent, 0);
+    if (n <= 0) return false;
+    totalSent += n;
+  }
+  return true;
+}
+
+std::vector<char> TlsSocket::receiveEncrypted() {
+  std::vector<char> result;
+  char buf[16384];
+  int n = ::recv(m_socket, buf, sizeof(buf), 0);
+  if (n <= 0) return result;
+  result.assign(buf, buf + n);
+  // Drain any additional available data without blocking
+  u_long available = 0;
+  while (ioctlsocket(m_socket, FIONREAD, &available) == 0 && available > 0) {
+    size_t currentSize = (std::min)((size_t)available, sizeof(buf));
+    int more = ::recv(m_socket, buf, (int)currentSize, 0);
+    if (more <= 0) break;
+    result.insert(result.end(), buf, buf + more);
+  }
+  return result;
+}
+
+// ─── TLS: Send / Receive ───────────────────────────────────
+
+bool TlsSocket::send(const std::string& data) {
+  std::lock_guard<std::mutex> lock(m_mutex);
+
+  if (m_tls) {
+    std::vector<char> encrypted;
+    if (!encryptMessage(data, encrypted)) return false;
+    return sendEncrypted(encrypted);
+  } else {
+    int totalSent = 0;
+    while (totalSent < static_cast<int>(data.size())) {
+      int n = ::send(m_socket, data.data() + totalSent,
+                     static_cast<int>(data.size()) - totalSent, 0);
+      if (n <= 0) return false;
+      totalSent += n;
+    }
+    return true;
+  }
+}
+
+std::string TlsSocket::receiveLine(int timeoutMs) {
+  std::lock_guard<std::mutex> lock(m_mutex);
+
+  auto deadline = std::chrono::steady_clock::now() +
+                  std::chrono::milliseconds(timeoutMs);
+
+  while (std::chrono::steady_clock::now() < deadline) {
+    size_t pos = m_receiveBuffer.find('\n');
+    if (pos != std::string::npos) {
+      std::string line = m_receiveBuffer.substr(0, pos);
+      m_receiveBuffer.erase(0, pos + 1);
+      if (!line.empty() && line.back() == '\r') {
+        line.pop_back();
+      }
+      return line;
+    }
+
+    if (m_tls) {
+      // Use pending data, or recv fresh (FIONREAD inside drains all available)
+      std::vector<char> recvBuf;
+      if (!m_pendingTlsData.empty()) {
+        recvBuf.swap(m_pendingTlsData);
+      } else {
+        recvBuf = receiveEncrypted();
+        if (recvBuf.empty()) { break; }
+      }
+
+      // Decrypt one record at a time until all data is consumed
+      while (!recvBuf.empty()) {
+        std::vector<char> plaintext;
+        int ret = decryptMessage(recvBuf, plaintext);
+        if (ret == 1) {
+          m_receiveBuffer.append(plaintext.data(), plaintext.size());
+          // recvBuf now contains remaining encrypted data (or empty)
+          continue;
+        } else if (ret == 0) {
+          // Incomplete record - save for next call
+          if (!recvBuf.empty()) m_pendingTlsData.swap(recvBuf);
+          break;
+        } else {
+          // Fatal error - but we may have decrypted some data already
+          m_pendingTlsData.clear();
+          if (m_receiveBuffer.empty()) break;
+          break;
+        }
+      }
+      // If we got any decrypted data, continue the outer loop to find \n
+      if (!m_receiveBuffer.empty()) continue;
+      break;
+    } else {
+      char buf[4096];
+      int n = ::recv(m_socket, buf, sizeof(buf), 0);
+      if (n <= 0) break;
+      m_receiveBuffer.append(buf, n);
+    }
+  }
+
+  if (!m_receiveBuffer.empty()) {
+    size_t pos = m_receiveBuffer.find('\n');
+    if (pos != std::string::npos) {
+      std::string line = m_receiveBuffer.substr(0, pos);
+      m_receiveBuffer.erase(0, pos + 1);
+      if (!line.empty() && line.back() == '\r') line.pop_back();
+      return line;
+    }
+  }
+
+  return "";
+}
+
+std::string TlsSocket::receiveRaw(int timeoutMs, size_t maxBytes) {
+  std::lock_guard<std::mutex> lock(m_mutex);
+
+  auto deadline = std::chrono::steady_clock::now() +
+                  std::chrono::milliseconds(timeoutMs);
+
+  std::string result;
+
+  while (std::chrono::steady_clock::now() < deadline) {
+    if (!m_receiveBuffer.empty()) {
+      size_t toTake = maxBytes > 0 ? std::min(maxBytes, m_receiveBuffer.size()) : m_receiveBuffer.size();
+      result.append(m_receiveBuffer, 0, toTake);
+      m_receiveBuffer.erase(0, toTake);
+      if (!maxBytes || result.size() < maxBytes) continue;
+      break;
+    }
+
+    if (m_tls) {
+      std::vector<char> recvBuf;
+      if (!m_pendingTlsData.empty()) recvBuf.swap(m_pendingTlsData);
+      else {
+        recvBuf = receiveEncrypted();
+        if (recvBuf.empty()) break;
+      }
+      std::vector<char> plaintext;
+      int ret = decryptMessage(recvBuf, plaintext);
+      if (ret == 1) {
+        m_receiveBuffer.append(plaintext.data(), plaintext.size());
+        if (!recvBuf.empty()) m_pendingTlsData.swap(recvBuf);
+      } else if (ret == 0) {
+        if (!recvBuf.empty()) m_pendingTlsData.swap(recvBuf);
+        if (m_receiveBuffer.empty()) break;
+      } else {
+        if (m_receiveBuffer.empty()) break;
+      }
+    } else {
+      char buf[16384];
+      int n = ::recv(m_socket, buf, sizeof(buf), 0);
+      if (n <= 0) break;
+      m_receiveBuffer.append(buf, n);
+    }
+  }
+
+  return result;
+}
+
+int TlsSocket::receiveRawBuffer(char* buf, int bufSize, int timeoutMs) {
+  std::lock_guard<std::mutex> lock(m_mutex);
+
+  if (!m_receiveBuffer.empty()) {
+    int toCopy = std::min(bufSize, static_cast<int>(m_receiveBuffer.size()));
+    memcpy(buf, m_receiveBuffer.data(), toCopy);
+    m_receiveBuffer.erase(0, toCopy);
+    return toCopy;
+  }
+
+  if (m_tls) {
+    std::vector<char> recvBuf;
+    if (!m_pendingTlsData.empty()) recvBuf.swap(m_pendingTlsData);
+    else {
+      recvBuf = receiveEncrypted();
+      if (recvBuf.empty()) return -1;
+    }
+    std::vector<char> allPlaintext;
+    while (true) {
+      std::vector<char> plaintext;
+      int ret = decryptMessage(recvBuf, plaintext);
+      if (ret == 1) {
+        allPlaintext.insert(allPlaintext.end(), plaintext.begin(), plaintext.end());
+        if (!recvBuf.empty()) continue;
+        break;
+      } else if (ret == 0) {
+        if (!recvBuf.empty()) m_pendingTlsData.swap(recvBuf);
+        break;
+      } else { return -1; }
+    }
+    int toCopy = std::min(bufSize, static_cast<int>(allPlaintext.size()));
+    memcpy(buf, allPlaintext.data(), toCopy);
+    if (toCopy < static_cast<int>(allPlaintext.size())) {
+      m_receiveBuffer.append(allPlaintext.data() + toCopy, allPlaintext.size() - toCopy);
+    }
+    return toCopy;
+  } else {
+    int n = ::recv(m_socket, buf, bufSize, 0);
+    return n;
+  }
+}
+
+} // namespace emailimap