zele 0.3.15 → 0.3.17

package/src/gmail-client.ts

@@ -22,6 +22,18 @@ import type { AccountId } from './auth.js'
 // Types
 // ---------------------------------------------------------------------------
 
+export type AuthVerdict = 'pass' | 'fail' | 'softfail' | 'neutral' | 'none' | 'temperror' | 'permerror' | 'bestguesspass'
+
+export interface AuthResult {
+  spf: AuthVerdict
+  dkim: AuthVerdict
+  dmarc: AuthVerdict
+  /** true when all three are 'pass' — the email is fully authenticated */
+  authentic: boolean
+  /** raw Authentication-Results header value */
+  raw: string
+}
+
 export interface Sender {
   name?: string
   email: string
@@ -50,6 +62,8 @@ export interface ParsedMessage {
   mimeType: string // 'text/plain' or 'text/html'
   textBody: string | null // decoded text/plain body when available (for reply parsing)
   attachments: AttachmentMeta[]
+  /** SPF/DKIM/DMARC authentication results from Gmail. null for sent/draft messages. */
+  auth: AuthResult | null
 }
 
 export interface AttachmentMeta {
@@ -78,10 +92,16 @@ export interface ThreadListItem {
   snippet: string
   subject: string
   from: Sender
+  to: Sender[]
+  cc: Sender[]
   date: string
   labelIds: string[]
   unread: boolean
+  starred: boolean
   messageCount: number
+  inReplyTo: string | null
+  hasAttachments: boolean
+  listUnsubscribe: string | null
 }
 
 export interface ThreadListResult {
@@ -806,7 +826,8 @@ export class GmailClient {
     )
     if (messageIds instanceof Error) return messageIds
     if (messageIds.length === 0) return
-    await this.batchModifyMessages(messageIds, { removeLabelIds: ['UNREAD'] })
+    const mod = await this.batchModifyMessages(messageIds, { removeLabelIds: ['UNREAD'] })
+    if (mod instanceof Error) return mod
     await this.invalidateAfterThreadMutation(threadIds)
   }
 
@@ -816,7 +837,8 @@ export class GmailClient {
     )
     if (messageIds instanceof Error) return messageIds
     if (messageIds.length === 0) return
-    await this.batchModifyMessages(messageIds, { addLabelIds: ['UNREAD'] })
+    const mod = await this.batchModifyMessages(messageIds, { addLabelIds: ['UNREAD'] })
+    if (mod instanceof Error) return mod
     await this.invalidateAfterThreadMutation(threadIds)
   }
 
@@ -824,7 +846,8 @@ export class GmailClient {
     const messageIds = await this.getMessageIdsForThreads(threadIds)
     if (messageIds instanceof Error) return messageIds
     if (messageIds.length === 0) return
-    await this.batchModifyMessages(messageIds, { addLabelIds: ['STARRED'] })
+    const mod = await this.batchModifyMessages(messageIds, { addLabelIds: ['STARRED'] })
+    if (mod instanceof Error) return mod
     await this.invalidateAfterThreadMutation(threadIds)
   }
 
@@ -834,7 +857,8 @@ export class GmailClient {
     )
     if (messageIds instanceof Error) return messageIds
     if (messageIds.length === 0) return
-    await this.batchModifyMessages(messageIds, { removeLabelIds: ['STARRED'] })
+    const mod = await this.batchModifyMessages(messageIds, { removeLabelIds: ['STARRED'] })
+    if (mod instanceof Error) return mod
     await this.invalidateAfterThreadMutation(threadIds)
   }
 
@@ -861,10 +885,11 @@ export class GmailClient {
     if (messageIds instanceof Error) return messageIds
     if (messageIds.length === 0) return
 
-    await this.batchModifyMessages(messageIds, {
+    const mod = await this.batchModifyMessages(messageIds, {
       addLabelIds: resolvedAdd.filter((r): r is string => typeof r === 'string'),
       removeLabelIds: resolvedRemove,
     })
+    if (mod instanceof Error) return mod
     await this.invalidateAfterThreadMutation(threadIds)
   }
 
@@ -892,7 +917,28 @@ export class GmailClient {
     const messageIds = await this.getMessageIdsForThreads(threadIds)
     if (messageIds instanceof Error) return messageIds
     if (messageIds.length === 0) return
-    await this.batchModifyMessages(messageIds, { removeLabelIds: ['INBOX'] })
+    const mod = await this.batchModifyMessages(messageIds, { removeLabelIds: ['INBOX'] })
+    if (mod instanceof Error) return mod
+    await this.invalidateAfterThreadMutation(threadIds)
+  }
+
+  async markAsSpam({ threadIds }: { threadIds: string[] }): Promise<void | AuthError | ApiError> {
+    const messageIds = await this.getMessageIdsForThreads(threadIds)
+    if (messageIds instanceof Error) return messageIds
+    if (messageIds.length === 0) return
+    const mod = await this.batchModifyMessages(messageIds, { addLabelIds: ['SPAM'], removeLabelIds: ['INBOX'] })
+    if (mod instanceof Error) return mod
+    await this.invalidateAfterThreadMutation(threadIds)
+  }
+
+  async unmarkSpam({ threadIds }: { threadIds: string[] }): Promise<void | AuthError | ApiError> {
+    const messageIds = await this.getMessageIdsForThreads(threadIds, (labelIds) =>
+      labelIds.includes('SPAM'),
+    )
+    if (messageIds instanceof Error) return messageIds
+    if (messageIds.length === 0) return
+    const mod = await this.batchModifyMessages(messageIds, { removeLabelIds: ['SPAM'], addLabelIds: ['INBOX'] })
+    if (mod instanceof Error) return mod
     await this.invalidateAfterThreadMutation(threadIds)
   }
 
@@ -919,10 +965,11 @@ export class GmailClient {
       const threadIds = res.threads.map((t) => t.id)
       const messageIds = await this.getMessageIdsForThreads(threadIds)
       if (messageIds instanceof Error) return messageIds
-      await this.batchModifyMessages(messageIds, {
+      const mod = await this.batchModifyMessages(messageIds, {
         addLabelIds: ['TRASH'],
         removeLabelIds: ['SPAM', 'INBOX'],
       })
+      if (mod instanceof Error) return mod
 
       totalDeleted += threadIds.length
       pageToken = res.nextPageToken ?? undefined
@@ -1021,6 +1068,61 @@ export class GmailClient {
     await this.invalidateLabels()
   }
 
+  // =========================================================================
+  // Filters
+  // =========================================================================
+
+  async listFilters(): Promise<{ parsed: gmail_v1.Schema$Filter[] } | AuthError | ApiError> {
+    const res = await gmailBoundary(this.account?.email ?? 'unknown', () =>
+      withRetry(() => this.gmail.users.settings.filters.list({ userId: 'me' })),
+    )
+    if (res instanceof Error) return res
+    return { parsed: res.data.filter ?? [] }
+  }
+
+  async createFilter(opts: {
+    from?: string
+    query?: string
+    addLabelIds?: string[]
+    removeLabelIds?: string[]
+  }): Promise<gmail_v1.Schema$Filter | AuthError | ApiError> {
+    const criteria: gmail_v1.Schema$FilterCriteria = {}
+    if (opts.from) criteria.from = opts.from
+    if (opts.query) criteria.query = opts.query
+
+    const action: gmail_v1.Schema$FilterAction = {}
+    if (opts.addLabelIds?.length) action.addLabelIds = opts.addLabelIds
+    if (opts.removeLabelIds?.length) action.removeLabelIds = opts.removeLabelIds
+
+    const res = await gmailBoundary(this.account?.email ?? 'unknown', () =>
+      withRetry(() =>
+        this.gmail.users.settings.filters.create({
+          userId: 'me',
+          requestBody: { criteria, action },
+        }),
+      ),
+    )
+    if (res instanceof Error) return res
+    return res.data
+  }
+
+  async deleteFilter(filterId: string): Promise<void | AuthError | ApiError> {
+    const res = await gmailBoundary(this.account?.email ?? 'unknown', () =>
+      withRetry(() =>
+        this.gmail.users.settings.filters.delete({
+          userId: 'me',
+          id: filterId,
+        }),
+      ),
+    )
+    if (res instanceof Error) return res
+  }
+
+  /** Resolve a label name to its ID, auto-creating if missing. Public wrapper for filter commands. */
+  async resolveLabel(nameOrId: string): Promise<string | AuthError | ApiError> {
+    return this.resolveLabelId(nameOrId)
+  }
+
   // =========================================================================
   // Label counts (unread counts per folder/label)
   // =========================================================================
@@ -1194,6 +1296,20 @@ export class GmailClient {
 
     const { body, mimeType, textBody } = this.extractBody(message.payload ?? {})
 
+    // Authentication-Results: multiple MTAs can add this header. Prefer the one
+    // stamped by Gmail's trusted authserv-id (mx.google.com) to avoid trusting
+    // headers injected by upstream/untrusted relays.
+    const authHeaders = headers
+      .filter((h) => h.name?.toLowerCase() === 'authentication-results')
+      .map((h) => h.value ?? '')
+      .filter((v) => v.length > 0)
+    const trustedAuthHeader =
+      authHeaders.find((v) => v.trim().toLowerCase().startsWith('mx.google.com'))
+      ?? authHeaders[0]
+      ?? null
+    const isSentOrDraft = labelIds.includes('SENT') || labelIds.includes('DRAFT')
+    const auth = trustedAuthHeader && !isSentOrDraft ? parseAuthResults(trustedAuthHeader) : null
+
     return {
       id: message.id ?? '',
       threadId: message.threadId ?? '',
@@ -1220,6 +1336,7 @@ export class GmailClient {
       mimeType,
       textBody,
       attachments: this.extractAttachmentMeta(message.payload?.parts ?? []),
+      auth,
     }
   }
 
@@ -1260,16 +1377,47 @@ export class GmailClient {
       }
     }
 
+    // Parse recipients from latest message
+    const toHeader = getHeader('to') ?? ''
+    const ccHeaders = headers
+      .filter((h) => h.name?.toLowerCase() === 'cc')
+      .map((h) => h.value ?? '')
+      .filter((v) => v.length > 0)
+
+    // Check if any non-draft message in the thread is a reply (has In-Reply-To header)
+    const inReplyTo =
+      nonDraftMessages
+        .map(
+          (m) =>
+            m.payload?.headers?.find((h) => h.name?.toLowerCase() === 'in-reply-to')?.value ??
+            null,
+        )
+        .find((v) => v !== null) ?? null
+
+    // Check if any message has attachments (non-inline)
+    const hasAttachments = messages.some((m) => this.hasNonInlineAttachments(m.payload))
+
+    // List-Unsubscribe from latest message
+    const listUnsubscribe = getHeader('list-unsubscribe') ?? null
+
     return {
       id: raw.id ?? '',
       historyId: raw.historyId ?? null,
       snippet: sanitizeSnippet(latest?.snippet ?? ''),
       subject: (getHeader('subject') ?? '(no subject)').replace(/"/g, '').trim(),
       from: displayFrom,
+      to: toHeader ? parseAddressList(toHeader) : [],
+      cc: ccHeaders.length > 0
+        ? ccHeaders.filter((h) => h.trim().length > 0).flatMap((h) => parseAddressList(h))
+        : [],
       date: getHeader('date') ?? '',
       labelIds: allLabels,
       unread: allLabels.includes('UNREAD'),
+      starred: allLabels.includes('STARRED'),
       messageCount: nonDraftMessages.length,
+      inReplyTo,
+      hasAttachments,
+      listUnsubscribe,
     }
   }
 
@@ -1393,6 +1541,24 @@ export class GmailClient {
     return results
   }
 
+  /** Quick check: does the message payload tree contain any non-inline attachments?
+   *  Checks the root part itself (some messages have attachment metadata there)
+   *  then recurses into child parts. */
+  private hasNonInlineAttachments(part: gmail_v1.Schema$MessagePart | undefined): boolean {
+    if (!part) return false
+    if (part.filename && part.filename.length > 0 && part.body?.attachmentId) {
+      const disposition =
+        part.headers?.find((h) => h.name?.toLowerCase() === 'content-disposition')?.value ?? ''
+      const hasContentId = part.headers?.some((h) => h.name?.toLowerCase() === 'content-id')
+      const isInline = disposition.toLowerCase().includes('inline')
+      if (!isInline || !hasContentId) return true
+    }
+    for (const child of part.parts ?? []) {
+      if (this.hasNonInlineAttachments(child)) return true
+    }
+    return false
+  }
+
   async getEmailAliases(): Promise<Array<{ email: string; name?: string; primary: boolean }> | AuthError | ApiError> {
     const profile = await this.getProfile()
     if (profile instanceof Error) return profile
@@ -1821,22 +1987,25 @@ export class GmailClient {
   private async batchModifyMessages(
     messageIds: string[],
     body: { addLabelIds?: string[]; removeLabelIds?: string[] },
-  ) {
+  ): Promise<void | AuthError | ApiError> {
     if (messageIds.length === 0) return
 
     // Gmail batchModify accepts up to 1000 IDs
     const chunkSize = 1000
     for (let i = 0; i < messageIds.length; i += chunkSize) {
       const chunk = messageIds.slice(i, i + chunkSize)
-      await withRetry(() =>
-        this.gmail.users.messages.batchModify({
-          userId: 'me',
-          requestBody: {
-            ids: chunk,
-            ...body,
-          },
-        }),
+      const res = await gmailBoundary(this.account?.email ?? 'unknown', () =>
+        withRetry(() =>
+          this.gmail.users.messages.batchModify({
+            userId: 'me',
+            requestBody: {
+              ids: chunk,
+              ...body,
+            },
+          }),
+        ),
       )
+      if (res instanceof Error) return res
     }
   }
 
@@ -1875,6 +2044,42 @@ export class GmailClient {
   }
 }
 
+// ---------------------------------------------------------------------------
+// Email authentication: parse the Authentication-Results header
+// ---------------------------------------------------------------------------
+// Gmail adds an Authentication-Results header to every received message with
+// SPF, DKIM, and DMARC verdicts. Format is semi-structured:
+//   Authentication-Results: mx.google.com;
+//       dkim=pass header.i=@example.com header.s=sel1;
+//       spf=pass (...) smtp.mailfrom=user@example.com;
+//       dmarc=pass (p=REJECT) header.from=example.com
+// We extract the verdict keyword after each protocol name.
+// ---------------------------------------------------------------------------
+
+const AUTH_VERDICTS = new Set(['pass', 'fail', 'softfail', 'neutral', 'none', 'temperror', 'permerror', 'bestguesspass'])
+
+/** Parse a Gmail Authentication-Results header into structured verdicts. */
+export function parseAuthResults(header: string): AuthResult {
+  const lower = header.toLowerCase()
+  const extract = (protocol: string): AuthVerdict => {
+    // Match "protocol=verdict" — verdict is a word that stops at whitespace, semicolons, or parens
+    const re = new RegExp(`\\b${protocol}\\s*=\\s*([a-z]+)`)
+    const match = re.exec(lower)
+    const verdict = match?.[1] ?? 'none'
+    return AUTH_VERDICTS.has(verdict) ? verdict as AuthVerdict : 'none'
+  }
+  const spf = extract('spf')
+  const dkim = extract('dkim')
+  const dmarc = extract('dmarc')
+  return {
+    spf,
+    dkim,
+    dmarc,
+    authentic: spf === 'pass' && dkim === 'pass' && dmarc === 'pass',
+    raw: header,
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Watch: folder label mapping
 // ---------------------------------------------------------------------------