feat: implement message deletion functionality and improve draft handling
- Added `MoveToTrash` method in `WebmailRepository` to move messages to the Trash folder instead of deleting them permanently. - Introduced `handleDelete` method in `mailAPI` to handle message deletion requests from the client. - Updated router to include a new route for message deletion. - Enhanced the compose page to manage draft integrity, ensuring drafts are correctly associated with sent messages. - Implemented UI changes to allow users to delete messages from the mail folder view. - Added tests to verify the correct behavior of message deletion and draft handling. - Updated database migration scripts to reconcile folder counters and ensure accurate unread counts. - Added tests for TLS-RPT report parsing and webmail repository functionalities.
This commit is contained in:
Lucas Rayan committed
1 parent
4f1b9c5217
commit
880dced9e4
20 files changed
+1053
-30
No files matched your search
@@ -34,3 +34,5 @@ Thumbs.db
|
||||
|
||||
# TypeScript incremental build cache
|
||||
*.tsbuildinfo
|
||||
*json
|
||||
*.json.gz
|
||||
@@ -0,0 +1,5 @@
|
||||
-- Irreversible by nature: this migration replaced incorrect counter values and
|
||||
-- added the flags that describe what a message is. Restoring the old numbers
|
||||
-- would mean restoring known-wrong data, and dropping the \Seen and \Draft
|
||||
-- flags would discard read state the user may since have set by hand.
|
||||
SELECT 1;
|
||||
@@ -0,0 +1,74 @@
|
||||
-- Reconcile folders.unread_count and folders.total_count with the messages
|
||||
-- that are actually in each folder.
|
||||
--
|
||||
-- These columns are a denormalised cache. Every write path maintained them,
|
||||
-- but one did not: a message the user composed themselves - their own Sent
|
||||
-- copy, and every draft autosave - was filed through the inbound path, which
|
||||
-- raised unread_count unconditionally. Nothing ever opens your own outgoing
|
||||
-- copy, so the flag that would bring the counter back down was never set and
|
||||
-- the drift only accumulated.
|
||||
--
|
||||
-- The webmail now derives these numbers at read time and is self-healing, but
|
||||
-- IMAP's STATUS answers from these columns, so the stored values are corrected
|
||||
-- here once for the mailboxes that already drifted.
|
||||
UPDATE folders f
|
||||
SET unread_count = c.unread,
|
||||
total_count = c.total
|
||||
FROM (
|
||||
SELECT f2.id,
|
||||
COUNT(e.id) FILTER (
|
||||
WHERE NOT EXISTS (
|
||||
SELECT 1 FROM message_flags mf
|
||||
WHERE mf.message_id = e.id
|
||||
AND mf.received_at = e.received_at
|
||||
AND mf.flag = '\Seen')
|
||||
)::int AS unread,
|
||||
COUNT(e.id)::int AS total
|
||||
FROM folders f2
|
||||
LEFT JOIN email_messages e
|
||||
ON e.folder_id = f2.id AND e.expunged_at IS NULL
|
||||
GROUP BY f2.id
|
||||
) AS c
|
||||
WHERE f.id = c.id
|
||||
AND (f.unread_count IS DISTINCT FROM c.unread
|
||||
OR f.total_count IS DISTINCT FROM c.total);
|
||||
|
||||
-- Existing Sent and Drafts messages were filed without the flags that say what
|
||||
-- they are, so they read as unread mail that nothing could clear.
|
||||
INSERT INTO message_flags (message_id, received_at, flag)
|
||||
SELECT e.id, e.received_at, '\Seen'
|
||||
FROM email_messages e
|
||||
JOIN folders f ON f.id = e.folder_id
|
||||
WHERE e.expunged_at IS NULL
|
||||
AND (f.special_use IN ('sent', 'drafts')
|
||||
OR LOWER(f.name) IN ('sent', 'drafts'))
|
||||
ON CONFLICT DO NOTHING;
|
||||
|
||||
INSERT INTO message_flags (message_id, received_at, flag)
|
||||
SELECT e.id, e.received_at, '\Draft'
|
||||
FROM email_messages e
|
||||
JOIN folders f ON f.id = e.folder_id
|
||||
WHERE e.expunged_at IS NULL
|
||||
AND (f.special_use = 'drafts' OR LOWER(f.name) = 'drafts')
|
||||
ON CONFLICT DO NOTHING;
|
||||
|
||||
-- Re-run the reconciliation now those flags exist, so the Sent and Drafts
|
||||
-- counters land on zero unread rather than on their pre-flag values.
|
||||
UPDATE folders f
|
||||
SET unread_count = c.unread
|
||||
FROM (
|
||||
SELECT f2.id,
|
||||
COUNT(e.id) FILTER (
|
||||
WHERE NOT EXISTS (
|
||||
SELECT 1 FROM message_flags mf
|
||||
WHERE mf.message_id = e.id
|
||||
AND mf.received_at = e.received_at
|
||||
AND mf.flag = '\Seen')
|
||||
)::int AS unread
|
||||
FROM folders f2
|
||||
LEFT JOIN email_messages e
|
||||
ON e.folder_id = f2.id AND e.expunged_at IS NULL
|
||||
GROUP BY f2.id
|
||||
) AS c
|
||||
WHERE f.id = c.id
|
||||
AND f.unread_count IS DISTINCT FROM c.unread;
|
||||
@@ -22,7 +22,12 @@ type PersistInboundMessageInput struct {
|
||||
FromDisplayName string
|
||||
MessageIDHeader string
|
||||
HasAttachments bool
|
||||
SPFResult string
|
||||
// AlreadySeen marks a copy the user themselves composed - their own Sent
|
||||
// copy, or a draft. It is not unread mail, and counting it as such is why
|
||||
// the Sent folder carried an unread badge that nothing could clear: no
|
||||
// reader ever opens their own outgoing copy, so the flag was never set.
|
||||
AlreadySeen bool
|
||||
SPFResult string
|
||||
DKIMResult string
|
||||
DMARCResult string
|
||||
}
|
||||
|
||||
@@ -2,6 +2,7 @@ package port
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"time"
|
||||
|
||||
"github.com/google/uuid"
|
||||
@@ -63,4 +64,16 @@ type WebmailRepository interface {
|
||||
MarkSeen(ctx context.Context, mailboxID, folderName string, uid uint32, seen bool) error
|
||||
// Expunge soft-deletes one message, keeping the folder counters in step.
|
||||
Expunge(ctx context.Context, mailboxID, folderName string, uid uint32) error
|
||||
// MoveToTrash relocates one message into Trash and returns its new UID
|
||||
// there. This is what deleting a message means everywhere but in Trash
|
||||
// itself, where Expunge is the operation instead.
|
||||
MoveToTrash(ctx context.Context, mailboxID, folderName string, uid uint32) (uint32, error)
|
||||
}
|
||||
|
||||
// ErrNoTrashFolder reports a mailbox with nowhere to put deleted mail, rather
|
||||
// than the message being destroyed instead.
|
||||
var ErrNoTrashFolder = errors.New("webmail: this mailbox has no Trash folder")
|
||||
|
||||
// ErrAlreadyInTrash tells the caller to expunge rather than move: a message
|
||||
// already in Trash has no further destination.
|
||||
var ErrAlreadyInTrash = errors.New("webmail: message is already in Trash")
|
||||
@@ -121,9 +121,11 @@ func TestHtmlToPlainTextIsReadable(t *testing.T) {
|
||||
// --- draft storage -------------------------------------------------------
|
||||
|
||||
type stubWebmailRepo struct {
|
||||
mailboxID string
|
||||
expunged []uint32
|
||||
expungeErr error
|
||||
mailboxID string
|
||||
expunged []uint32
|
||||
expungeErr error
|
||||
movedToTrash []uint32
|
||||
moveErr error
|
||||
}
|
||||
|
||||
func (s *stubWebmailRepo) FindMailboxIDByAddress(context.Context, string) (string, error) {
|
||||
@@ -143,6 +145,39 @@ func (s *stubWebmailRepo) Expunge(_ context.Context, _, _ string, uid uint32) er
|
||||
s.expunged = append(s.expunged, uid)
|
||||
return s.expungeErr
|
||||
}
|
||||
func (s *stubWebmailRepo) MoveToTrash(_ context.Context, _, _ string, uid uint32) (uint32, error) {
|
||||
if s.moveErr != nil {
|
||||
return 0, s.moveErr
|
||||
}
|
||||
s.movedToTrash = append(s.movedToTrash, uid)
|
||||
return uid, nil
|
||||
}
|
||||
|
||||
// newSendableUseCase wires the smallest use case that can actually complete a
|
||||
// Send: a real submission path over recording stubs.
|
||||
func newSendableUseCase(t *testing.T, mailboxID uuid.UUID, repo *stubWebmailRepo) *WebmailUseCase {
|
||||
t.Helper()
|
||||
return newSendableUseCaseWith(t, mailboxID, repo, &recordingMessageRepository{})
|
||||
}
|
||||
|
||||
func newSendableUseCaseWith(
|
||||
t *testing.T, mailboxID uuid.UUID, repo *stubWebmailRepo, messages *recordingMessageRepository,
|
||||
) *WebmailUseCase {
|
||||
t.Helper()
|
||||
account := &port.MailboxAuth{
|
||||
ID: mailboxID, EmailAddress: "me@example.test",
|
||||
DomainName: "example.test", MaxRecipientsPerHour: 100,
|
||||
}
|
||||
submission := NewProcessOutboundEmailUseCase(
|
||||
nil, &countingOutboundRepo{}, &capturingBlobStorage{}, &recordingSigner{})
|
||||
return (&WebmailUseCase{
|
||||
repo: repo,
|
||||
auth: &stubAuthRepo{account: account},
|
||||
submission: submission,
|
||||
localHost: "mail.example.test",
|
||||
}).WithLocalFiling(
|
||||
&stubBlobStorage{ref: port.BlobRef{ID: uuid.New(), SHA256: "d", SizeBytes: 5}}, messages)
|
||||
}
|
||||
|
||||
type stubAuthRepo struct{ account *port.MailboxAuth }
|
||||
|
||||
@@ -210,3 +245,130 @@ func TestDraftSavesWithoutRecipients(t *testing.T) {
|
||||
t.Fatalf("a draft with no recipients must still save: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// --- sending, and what it leaves behind ----------------------------------
|
||||
|
||||
// The bug as the user hit it: write a message, send it, and the draft the
|
||||
// autosave had stored was still sitting in Drafts afterwards - a duplicate of
|
||||
// a message already on its way, that nothing on any screen could remove.
|
||||
func TestSendingDiscardsTheDraftItCameFrom(t *testing.T) {
|
||||
mailboxID := uuid.New()
|
||||
repo := &stubWebmailRepo{mailboxID: mailboxID.String()}
|
||||
uc := newSendableUseCase(t, mailboxID, repo)
|
||||
|
||||
if err := uc.Send(context.Background(), ComposeInput{
|
||||
From: "me@example.test",
|
||||
To: []string{"you@example.test"},
|
||||
Subject: "Finished",
|
||||
HTML: "<p>done</p>",
|
||||
DraftUID: 42,
|
||||
}); err != nil {
|
||||
t.Fatalf("send: %v", err)
|
||||
}
|
||||
|
||||
if len(repo.expunged) != 1 || repo.expunged[0] != 42 {
|
||||
t.Errorf("the draft was left in Drafts after sending: expunged %v, want [42]", repo.expunged)
|
||||
}
|
||||
}
|
||||
|
||||
// A message composed from scratch has no draft behind it, and must not try to
|
||||
// remove UID 0 - which is not a UID at all.
|
||||
func TestSendingWithoutADraftExpungesNothing(t *testing.T) {
|
||||
mailboxID := uuid.New()
|
||||
repo := &stubWebmailRepo{mailboxID: mailboxID.String()}
|
||||
uc := newSendableUseCase(t, mailboxID, repo)
|
||||
|
||||
if err := uc.Send(context.Background(), ComposeInput{
|
||||
From: "me@example.test", To: []string{"you@example.test"}, Text: "hi",
|
||||
}); err != nil {
|
||||
t.Fatalf("send: %v", err)
|
||||
}
|
||||
if len(repo.expunged) != 0 {
|
||||
t.Errorf("nothing should have been expunged, got %v", repo.expunged)
|
||||
}
|
||||
}
|
||||
|
||||
// The Sent copy is a message the user wrote; it is not unread mail, and filing
|
||||
// it as unread is what left the Sent folder with a badge nothing could clear.
|
||||
func TestSentCopyIsFiledAsAlreadyRead(t *testing.T) {
|
||||
mailboxID := uuid.New()
|
||||
repo := &stubWebmailRepo{mailboxID: mailboxID.String()}
|
||||
messages := &recordingMessageRepository{}
|
||||
uc := newSendableUseCaseWith(t, mailboxID, repo, messages)
|
||||
|
||||
if err := uc.Send(context.Background(), ComposeInput{
|
||||
From: "me@example.test", To: []string{"you@example.test"}, Text: "hi",
|
||||
}); err != nil {
|
||||
t.Fatalf("send: %v", err)
|
||||
}
|
||||
|
||||
if len(messages.persisted) != 1 {
|
||||
t.Fatalf("want one filed copy, got %d", len(messages.persisted))
|
||||
}
|
||||
if !messages.persisted[0].AlreadySeen {
|
||||
t.Error("the Sent copy was filed as unread mail")
|
||||
}
|
||||
}
|
||||
|
||||
// Likewise a draft: nothing ever opens one, so if it is filed unread its
|
||||
// folder carries a badge forever.
|
||||
func TestDraftIsFiledAsAlreadyRead(t *testing.T) {
|
||||
mailboxID := uuid.New()
|
||||
messages := &recordingMessageRepository{}
|
||||
uc := (&WebmailUseCase{
|
||||
repo: &stubWebmailRepo{mailboxID: mailboxID.String()},
|
||||
auth: &stubAuthRepo{account: &port.MailboxAuth{ID: mailboxID, EmailAddress: "me@example.test"}},
|
||||
localHost: "mail.example.test",
|
||||
}).WithLocalFiling(
|
||||
&stubBlobStorage{ref: port.BlobRef{ID: uuid.New(), SHA256: "d", SizeBytes: 5}}, messages)
|
||||
|
||||
if _, err := uc.SaveDraft(context.Background(), ComposeInput{
|
||||
From: "me@example.test", Subject: "half",
|
||||
}, 0); err != nil {
|
||||
t.Fatalf("save draft: %v", err)
|
||||
}
|
||||
if len(messages.persisted) != 1 || !messages.persisted[0].AlreadySeen {
|
||||
t.Error("the draft was filed as unread mail")
|
||||
}
|
||||
}
|
||||
|
||||
// --- deleting ------------------------------------------------------------
|
||||
|
||||
// Deleting from an ordinary folder moves the message to Trash.
|
||||
func TestDeleteMovesToTrash(t *testing.T) {
|
||||
mailboxID := uuid.New()
|
||||
repo := &stubWebmailRepo{mailboxID: mailboxID.String()}
|
||||
uc := &WebmailUseCase{
|
||||
repo: repo,
|
||||
auth: &stubAuthRepo{account: &port.MailboxAuth{ID: mailboxID, EmailAddress: "me@example.test"}},
|
||||
localHost: "mail.example.test",
|
||||
}
|
||||
|
||||
if err := uc.Delete(context.Background(), "me@example.test", "inbox", 7); err != nil {
|
||||
t.Fatalf("delete: %v", err)
|
||||
}
|
||||
if len(repo.movedToTrash) != 1 || repo.movedToTrash[0] != 7 {
|
||||
t.Errorf("the message was not moved to Trash: %v", repo.movedToTrash)
|
||||
}
|
||||
if len(repo.expunged) != 0 {
|
||||
t.Errorf("deleting from the inbox must not destroy the message: expunged %v", repo.expunged)
|
||||
}
|
||||
}
|
||||
|
||||
// Deleting from Trash is the second press, and that one really removes it.
|
||||
func TestDeleteFromTrashExpunges(t *testing.T) {
|
||||
mailboxID := uuid.New()
|
||||
repo := &stubWebmailRepo{mailboxID: mailboxID.String(), moveErr: port.ErrAlreadyInTrash}
|
||||
uc := &WebmailUseCase{
|
||||
repo: repo,
|
||||
auth: &stubAuthRepo{account: &port.MailboxAuth{ID: mailboxID, EmailAddress: "me@example.test"}},
|
||||
localHost: "mail.example.test",
|
||||
}
|
||||
|
||||
if err := uc.Delete(context.Background(), "me@example.test", "trash", 3); err != nil {
|
||||
t.Fatalf("delete from trash: %v", err)
|
||||
}
|
||||
if len(repo.expunged) != 1 || repo.expunged[0] != 3 {
|
||||
t.Errorf("emptying from Trash did not remove the message: %v", repo.expunged)
|
||||
}
|
||||
}
|
||||
@@ -138,6 +138,13 @@ type ComposeInput struct {
|
||||
// that cannot or will not render HTML still has something to show.
|
||||
Text string
|
||||
HTML string
|
||||
// DraftUID is the autosaved draft this message grew out of, or 0 when it
|
||||
// was composed without one ever being stored.
|
||||
//
|
||||
// Sending used to ignore it entirely, so a message that had been autosaved
|
||||
// went out and its draft stayed in Drafts: a duplicate of mail already on
|
||||
// its way, which no screen in the webmail could then delete.
|
||||
DraftUID uint32
|
||||
}
|
||||
|
||||
// ErrNoRecipients rejects a submission with nobody to deliver to, before it
|
||||
@@ -185,9 +192,46 @@ func (uc *WebmailUseCase) Send(ctx context.Context, input ComposeInput) error {
|
||||
if err := uc.fileLocalCopy(ctx, account.ID, account.EmailAddress, "Sent", payload); err != nil {
|
||||
log.Printf("webmail: could not file the Sent copy for %s: %v", account.EmailAddress, err)
|
||||
}
|
||||
|
||||
// The draft this message grew out of has been superseded by the real
|
||||
// thing. Swallowed like the Sent copy above and for the same reason: the
|
||||
// mail is already queued, and failing the request now would only invite a
|
||||
// second copy to be sent.
|
||||
if input.DraftUID != 0 {
|
||||
if mailboxID, idErr := uc.mailboxID(ctx, account.EmailAddress); idErr == nil {
|
||||
if err := uc.repo.Expunge(ctx, mailboxID, "Drafts", input.DraftUID); err != nil {
|
||||
log.Printf("webmail: could not discard the sent draft %d: %v", input.DraftUID, err)
|
||||
}
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// Delete removes one message the way a mail client does: from any ordinary
|
||||
// folder it goes to Trash, and from Trash it is really expunged.
|
||||
//
|
||||
// The webmail had no delete at all. Expunge existed but was reachable only
|
||||
// when an autosave superseded a draft, so anything the user wanted rid of -
|
||||
// most visibly the draft left behind by a sent message - stayed put.
|
||||
func (uc *WebmailUseCase) Delete(ctx context.Context, address, folder string, uid uint32) error {
|
||||
mailboxID, err := uc.mailboxID(ctx, address)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
_, err = uc.repo.MoveToTrash(ctx, mailboxID, folder, uid)
|
||||
switch {
|
||||
case err == nil:
|
||||
return nil
|
||||
case errors.Is(err, port.ErrAlreadyInTrash), errors.Is(err, port.ErrNoTrashFolder):
|
||||
// Already in Trash, or nowhere to move it to. Either way the second
|
||||
// press is the one that removes it for good.
|
||||
return uc.repo.Expunge(ctx, mailboxID, folder, uid)
|
||||
default:
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
// fileLocalCopy stores a message the user themselves composed into one of
|
||||
// their own folders. It reuses the inbound persistence path so the copy gets a
|
||||
// real IMAP UID and shows up over IMAP as well as in the webmail.
|
||||
@@ -213,6 +257,7 @@ func (uc *WebmailUseCase) fileLocalCopy(
|
||||
FromDisplayName: headers.FromDisplayName,
|
||||
MessageIDHeader: headers.MessageID,
|
||||
HasAttachments: headers.HasAttachments,
|
||||
AlreadySeen: true,
|
||||
}})
|
||||
return err
|
||||
}
|
||||
@@ -261,6 +306,7 @@ func (uc *WebmailUseCase) SaveDraft(ctx context.Context, input ComposeInput, rep
|
||||
FromDisplayName: headers.FromDisplayName,
|
||||
MessageIDHeader: headers.MessageID,
|
||||
HasAttachments: headers.HasAttachments,
|
||||
AlreadySeen: true,
|
||||
}})
|
||||
if err != nil {
|
||||
return 0, err
|
||||
|
||||
@@ -72,7 +72,7 @@ func TestParseTlsRptReport_ValidJSON(t *testing.T) {
|
||||
{
|
||||
"policy": {
|
||||
"policy-type": "sts",
|
||||
"domain": "example.test"
|
||||
"policy-domain": "example.test"
|
||||
},
|
||||
"summary": {
|
||||
"total-successful-session-count": 100,
|
||||
|
||||
@@ -34,7 +34,10 @@ type tlsRptJsonReport struct {
|
||||
Policies []struct {
|
||||
Policy struct {
|
||||
PolicyType string `json:"policy-type"`
|
||||
Domain string `json:"domain"`
|
||||
// RFC 8460 section 4.4 names this "policy-domain". Reading it as
|
||||
// "domain" parsed every real report to a blank domain, so a stored
|
||||
// report could not be attributed to the domain it was about.
|
||||
Domain string `json:"policy-domain"`
|
||||
} `json:"policy"`
|
||||
Summary struct {
|
||||
TotalSuccessfulSessionCount int `json:"total-successful-session-count"`
|
||||
|
||||
@@ -0,0 +1,60 @@
|
||||
package entity
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"compress/gzip"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// This is a real report, as Google sends it daily: the gzipped JSON that
|
||||
// arrives attached to a message addressed to the TLS-RPT rua.
|
||||
const googleTlsRptReport = `{"organization-name":"Google Inc.",` +
|
||||
`"date-range":{"start-datetime":"2026-08-19T00:00:00Z","end-datetime":"2026-08-19T23:59:59Z"},` +
|
||||
`"contact-info":"smtp-tls-reporting@google.com","report-id":"2026-08-19T00:00:00Z_example.test",` +
|
||||
`"policies":[{"policy":{"policy-type":"no-policy-found","policy-domain":"example.test"},` +
|
||||
`"summary":{"total-successful-session-count":2,"total-failure-session-count":0}}]}`
|
||||
|
||||
// The field is "policy-domain" (RFC 8460 section 4.4), not "domain". Reading
|
||||
// the wrong name parsed every report to a blank domain, so a stored report
|
||||
// could not be attributed to the domain it was about.
|
||||
func TestTlsRptReportCarriesThePolicyDomain(t *testing.T) {
|
||||
report, err := ParseTlsRptReport([]byte(googleTlsRptReport))
|
||||
if err != nil {
|
||||
t.Fatalf("parse: %v", err)
|
||||
}
|
||||
if report.Domain != "example.test" {
|
||||
t.Errorf("domain is %q, want example.test", report.Domain)
|
||||
}
|
||||
if report.OrganizationName != "Google Inc." {
|
||||
t.Errorf("organization is %q", report.OrganizationName)
|
||||
}
|
||||
if len(report.Policies) != 1 {
|
||||
t.Fatalf("want 1 policy, got %d", len(report.Policies))
|
||||
}
|
||||
if report.Policies[0].SuccessCount != 2 {
|
||||
t.Errorf("success count is %d, want 2", report.Policies[0].SuccessCount)
|
||||
}
|
||||
if report.Policies[0].PolicyType != "no-policy-found" {
|
||||
t.Errorf("policy type is %q", report.Policies[0].PolicyType)
|
||||
}
|
||||
}
|
||||
|
||||
// Reports arrive gzipped, which is how they land as a .json.gz attachment.
|
||||
func TestTlsRptReportParsesGzippedPayload(t *testing.T) {
|
||||
var buf bytes.Buffer
|
||||
gz := gzip.NewWriter(&buf)
|
||||
if _, err := gz.Write([]byte(googleTlsRptReport)); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := gz.Close(); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
report, err := ParseTlsRptReport(buf.Bytes())
|
||||
if err != nil {
|
||||
t.Fatalf("parse gzipped: %v", err)
|
||||
}
|
||||
if report.Domain != "example.test" {
|
||||
t.Errorf("domain is %q, want example.test", report.Domain)
|
||||
}
|
||||
}
|
||||
@@ -6,7 +6,9 @@ import (
|
||||
"fmt"
|
||||
"log"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/google/uuid"
|
||||
"github.com/jackc/pgx/v5"
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
|
||||
@@ -99,23 +101,39 @@ func persistOne(ctx context.Context, tx pgx.Tx, input port.PersistInboundMessage
|
||||
return 0, fmt.Errorf("find folder %q for mailbox %s: %w", targetFolder, input.MailboxID, err)
|
||||
}
|
||||
|
||||
// A copy the user wrote themselves arrives already read, so it must not
|
||||
// raise the unread counter. Incrementing unconditionally is what left the
|
||||
// Sent and Drafts folders advertising unread mail forever: nothing ever
|
||||
// opens your own outgoing copy, so the counter had no way back down.
|
||||
unreadDelta := 1
|
||||
if input.AlreadySeen {
|
||||
unreadDelta = 0
|
||||
}
|
||||
|
||||
var modseq int64
|
||||
if err := tx.QueryRow(ctx, `
|
||||
UPDATE folders SET uid_next = uid_next + 1, highest_modseq = highest_modseq + 1, unread_count = unread_count + 1, total_count = total_count + 1
|
||||
UPDATE folders SET uid_next = uid_next + 1, highest_modseq = highest_modseq + 1,
|
||||
unread_count = unread_count + $2, total_count = total_count + 1
|
||||
WHERE id = $1
|
||||
RETURNING highest_modseq
|
||||
`, folderID).Scan(&modseq); err != nil {
|
||||
`, folderID, unreadDelta).Scan(&modseq); err != nil {
|
||||
return 0, fmt.Errorf("advance uid_next, highest_modseq and folder counters: %w", err)
|
||||
}
|
||||
|
||||
// email_messages.id defaults to gen_random_uuid() per the migration - no explicit value needed.
|
||||
_, err = tx.Exec(ctx, `
|
||||
// id and received_at come back because message_flags is keyed on both:
|
||||
// email_messages is partitioned by received_at, so the flag rows cannot be
|
||||
// written without the same timestamp the row landed on.
|
||||
var messageID uuid.UUID
|
||||
var receivedAt time.Time
|
||||
err = tx.QueryRow(ctx, `
|
||||
INSERT INTO email_messages (
|
||||
mailbox_id, folder_id, uid, modseq, blob_id,
|
||||
sender_address, recipient_addresses, size_bytes,
|
||||
subject, snippet, from_display_name, message_id_header, has_attachments,
|
||||
spf_result, dkim_result, dmarc_result
|
||||
) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)
|
||||
RETURNING id, received_at
|
||||
`, input.MailboxID, folderID, uid, modseq, input.Blob.ID,
|
||||
input.SenderAddress, []string{input.RecipientAddress}, input.Blob.SizeBytes,
|
||||
nullIfEmpty(input.Subject), nullIfEmpty(input.Snippet), nullIfEmpty(input.FromDisplayName),
|
||||
@@ -129,11 +147,24 @@ func persistOne(ctx context.Context, tx pgx.Tx, input port.PersistInboundMessage
|
||||
// Sent copy and drafts have no authentication results by definition -
|
||||
// and it failed the whole insert. Sent stayed empty because that write
|
||||
// is deliberately non-fatal, and saving a draft reported an error.
|
||||
nullIfEmpty(input.SPFResult), nullIfEmpty(input.DKIMResult), nullIfEmpty(input.DMARCResult))
|
||||
nullIfEmpty(input.SPFResult), nullIfEmpty(input.DKIMResult), nullIfEmpty(input.DMARCResult)).
|
||||
Scan(&messageID, &receivedAt)
|
||||
if err != nil {
|
||||
return 0, fmt.Errorf("insert email_messages: %w", err)
|
||||
}
|
||||
|
||||
// The flags that describe what this copy is. Without \Seen on an outgoing
|
||||
// copy the unread counters never settle; without \Draft an IMAP client
|
||||
// shows a half-written message as ordinary mail and offers to reply to it.
|
||||
for _, flag := range messageFlagsFor(input, targetFolder) {
|
||||
if _, err := tx.Exec(ctx, `
|
||||
INSERT INTO message_flags (message_id, received_at, flag)
|
||||
VALUES ($1, $2, $3) ON CONFLICT DO NOTHING
|
||||
`, messageID, receivedAt, flag); err != nil {
|
||||
return 0, fmt.Errorf("set flag %s: %w", flag, err)
|
||||
}
|
||||
}
|
||||
|
||||
if _, err := tx.Exec(ctx, `UPDATE message_blobs SET ref_count = ref_count + 1 WHERE id = $1`, input.Blob.ID); err != nil {
|
||||
return 0, fmt.Errorf("increment blob ref_count: %w", err)
|
||||
}
|
||||
@@ -151,3 +182,15 @@ func persistOne(ctx context.Context, tx pgx.Tx, input port.PersistInboundMessage
|
||||
|
||||
return uid, nil
|
||||
}
|
||||
|
||||
// messageFlagsFor returns the IMAP flags a newly filed copy is born with.
|
||||
func messageFlagsFor(input port.PersistInboundMessageInput, folder string) []string {
|
||||
flags := []string{}
|
||||
if input.AlreadySeen {
|
||||
flags = append(flags, `\Seen`)
|
||||
}
|
||||
if strings.EqualFold(folder, "Drafts") {
|
||||
flags = append(flags, `\Draft`)
|
||||
}
|
||||
return flags
|
||||
}
|
||||
@@ -40,13 +40,35 @@ func (r *WebmailRepository) FindMailboxIDByAddress(ctx context.Context, address
|
||||
}
|
||||
|
||||
func (r *WebmailRepository) ListFolders(ctx context.Context, mailboxID string) ([]port.WebmailFolder, error) {
|
||||
// The counts are derived from the messages themselves rather than read out
|
||||
// of folders.unread_count/total_count.
|
||||
//
|
||||
// Those columns are a denormalised cache maintained by every write path,
|
||||
// and once any one of them was wrong nothing brought it back: the number
|
||||
// the user saw stayed wrong through a reload, a logout and a fresh login,
|
||||
// because the wrongness was stored. Deriving here is authoritative and
|
||||
// self-healing - a folder can only ever report what is actually in it.
|
||||
//
|
||||
// The columns stay maintained for IMAP's sake (STATUS answers from them),
|
||||
// so this is a correction at the read side, not their removal.
|
||||
rows, err := r.pool.Query(ctx, `
|
||||
SELECT id::text, name, COALESCE(special_use, ''), unread_count, total_count
|
||||
FROM folders WHERE mailbox_id = $1
|
||||
ORDER BY CASE special_use
|
||||
SELECT f.id::text, f.name, COALESCE(f.special_use, ''),
|
||||
COUNT(e.id) FILTER (
|
||||
WHERE NOT EXISTS (SELECT 1 FROM message_flags mf
|
||||
WHERE mf.message_id = e.id
|
||||
AND mf.received_at = e.received_at
|
||||
AND mf.flag = '\Seen')
|
||||
)::int AS unread_count,
|
||||
COUNT(e.id)::int AS total_count
|
||||
FROM folders f
|
||||
LEFT JOIN email_messages e
|
||||
ON e.folder_id = f.id AND e.expunged_at IS NULL
|
||||
WHERE f.mailbox_id = $1
|
||||
GROUP BY f.id, f.name, f.special_use
|
||||
ORDER BY CASE f.special_use
|
||||
WHEN 'inbox' THEN 0 WHEN 'drafts' THEN 1 WHEN 'sent' THEN 2
|
||||
WHEN 'archive' THEN 3 WHEN 'junk' THEN 4 WHEN 'trash' THEN 5
|
||||
ELSE 6 END, name
|
||||
ELSE 6 END, f.name
|
||||
`, mailboxID)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("list folders: %w", err)
|
||||
@@ -224,7 +246,9 @@ func (r *WebmailRepository) Expunge(
|
||||
err = tx.QueryRow(ctx, `
|
||||
SELECT e.id, f.id::text,
|
||||
NOT EXISTS (SELECT 1 FROM message_flags mf
|
||||
WHERE mf.message_id = e.id AND mf.flag = '\Seen')
|
||||
WHERE mf.message_id = e.id
|
||||
AND mf.received_at = e.received_at
|
||||
AND mf.flag = '\Seen')
|
||||
FROM email_messages e
|
||||
JOIN folders f ON f.id = e.folder_id
|
||||
WHERE e.mailbox_id = $1 AND `+folderCondition+`
|
||||
@@ -260,3 +284,110 @@ func (r *WebmailRepository) Expunge(
|
||||
|
||||
return tx.Commit(ctx)
|
||||
}
|
||||
|
||||
// MoveToTrash relocates one message into the mailbox's Trash folder and
|
||||
// returns the UID it was given there.
|
||||
//
|
||||
// This is what "delete" means in a mail client, and the webmail had no way to
|
||||
// do it at all: the only removal in the codebase was Expunge, reachable solely
|
||||
// when an autosave superseded a draft. A message the user wanted rid of - the
|
||||
// empty draft left behind by a sent message, most visibly - could not be
|
||||
// removed from any screen.
|
||||
//
|
||||
// The message keeps its identity and its blob; only the folder and the UID
|
||||
// change, because a UID is meaningful only within one folder. Deleting from
|
||||
// Trash itself is Expunge's job, not this one's.
|
||||
func (r *WebmailRepository) MoveToTrash(
|
||||
ctx context.Context, mailboxID, folderName string, uid uint32,
|
||||
) (uint32, error) {
|
||||
tx, err := r.pool.Begin(ctx)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
defer tx.Rollback(ctx)
|
||||
|
||||
var messageID uuid.UUID
|
||||
var sourceFolderID string
|
||||
var wasUnread bool
|
||||
err = tx.QueryRow(ctx, `
|
||||
SELECT e.id, f.id::text,
|
||||
NOT EXISTS (SELECT 1 FROM message_flags mf
|
||||
WHERE mf.message_id = e.id
|
||||
AND mf.received_at = e.received_at
|
||||
AND mf.flag = '\Seen')
|
||||
FROM email_messages e
|
||||
JOIN folders f ON f.id = e.folder_id
|
||||
WHERE e.mailbox_id = $1 AND `+folderCondition+`
|
||||
AND e.uid = $3 AND e.expunged_at IS NULL
|
||||
`, mailboxID, folderName, int64(uid)).Scan(&messageID, &sourceFolderID, &wasUnread)
|
||||
if errors.Is(err, pgx.ErrNoRows) {
|
||||
return 0, ErrMessageNotFound
|
||||
}
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
|
||||
// Deleting something already in Trash has no further destination, so the
|
||||
// caller is told to expunge instead of the message being moved onto itself.
|
||||
var trashFolderID string
|
||||
var trashUID int64
|
||||
err = tx.QueryRow(ctx, `
|
||||
SELECT id::text, uid_next FROM folders
|
||||
WHERE mailbox_id = $1 AND (special_use = 'trash' OR LOWER(name) = 'trash')
|
||||
ORDER BY special_use IS NOT NULL DESC
|
||||
LIMIT 1
|
||||
FOR UPDATE
|
||||
`, mailboxID).Scan(&trashFolderID, &trashUID)
|
||||
if errors.Is(err, pgx.ErrNoRows) {
|
||||
return 0, port.ErrNoTrashFolder
|
||||
}
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
if trashFolderID == sourceFolderID {
|
||||
return 0, port.ErrAlreadyInTrash
|
||||
}
|
||||
|
||||
var modseq int64
|
||||
if err := tx.QueryRow(ctx, `
|
||||
UPDATE folders SET uid_next = uid_next + 1, highest_modseq = highest_modseq + 1,
|
||||
total_count = total_count + 1, unread_count = unread_count + $2
|
||||
WHERE id = $1
|
||||
RETURNING highest_modseq
|
||||
`, trashFolderID, boolToInt(wasUnread)).Scan(&modseq); err != nil {
|
||||
return 0, err
|
||||
}
|
||||
|
||||
if _, err := tx.Exec(ctx, `
|
||||
UPDATE email_messages SET folder_id = $2, uid = $3, modseq = $4
|
||||
WHERE id = $1
|
||||
`, messageID, trashFolderID, trashUID, modseq); err != nil {
|
||||
return 0, err
|
||||
}
|
||||
|
||||
unreadDelta := 0
|
||||
if wasUnread {
|
||||
unreadDelta = -1
|
||||
}
|
||||
if _, err := tx.Exec(ctx, `
|
||||
UPDATE folders
|
||||
SET total_count = GREATEST(0, total_count - 1),
|
||||
unread_count = GREATEST(0, unread_count + $2),
|
||||
highest_modseq = highest_modseq + 1
|
||||
WHERE id = $1
|
||||
`, sourceFolderID, unreadDelta); err != nil {
|
||||
return 0, err
|
||||
}
|
||||
|
||||
if err := tx.Commit(ctx); err != nil {
|
||||
return 0, err
|
||||
}
|
||||
return uint32(trashUID), nil
|
||||
}
|
||||
|
||||
func boolToInt(b bool) int {
|
||||
if b {
|
||||
return 1
|
||||
}
|
||||
return 0
|
||||
}
|
||||
@@ -0,0 +1,211 @@
|
||||
package postgres
|
||||
|
||||
import (
|
||||
"context"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/google/uuid"
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
|
||||
"lambdamail/protocols/internal/application/port"
|
||||
)
|
||||
|
||||
// These reproduce the counters the webmail was showing wrong: an unread badge
|
||||
// that never came down however many messages were read, and a Sent folder that
|
||||
// advertised unread mail the user had written themselves.
|
||||
|
||||
// seedMailbox creates an isolated domain, mailbox and folder set for one test,
|
||||
// so tests cannot see each other's counters.
|
||||
func seedMailbox(t *testing.T, pool *pgxpool.Pool) string {
|
||||
t.Helper()
|
||||
ctx := context.Background()
|
||||
domainID := uuid.New()
|
||||
mbID := uuid.New()
|
||||
name := "t" + uuid.NewString()[:8] + ".test"
|
||||
|
||||
if _, err := pool.Exec(ctx,
|
||||
`INSERT INTO domains (id, name, punycode_name, is_active) VALUES ($1,$2,$3,true)`,
|
||||
domainID, name, name); err != nil {
|
||||
t.Fatalf("seed domain: %v", err)
|
||||
}
|
||||
if _, err := pool.Exec(ctx, `
|
||||
INSERT INTO mailboxes (id, domain_id, local_part, email_address, password_hash, is_active)
|
||||
VALUES ($1,$2,'user',$3,'x',true)`,
|
||||
mbID, domainID, "user@"+name); err != nil {
|
||||
t.Fatalf("seed mailbox: %v", err)
|
||||
}
|
||||
for _, f := range [][2]string{{"INBOX", "inbox"}, {"Sent", "sent"}, {"Drafts", "drafts"}, {"Trash", "trash"}} {
|
||||
if _, err := pool.Exec(ctx,
|
||||
`INSERT INTO folders (mailbox_id, name, special_use) VALUES ($1,$2,$3)`,
|
||||
mbID, f[0], f[1]); err != nil {
|
||||
t.Fatalf("seed folder %s: %v", f[0], err)
|
||||
}
|
||||
}
|
||||
t.Cleanup(func() {
|
||||
_, _ = pool.Exec(context.Background(), `DELETE FROM domains WHERE id = $1`, domainID)
|
||||
})
|
||||
return mbID.String()
|
||||
}
|
||||
|
||||
// deliver files a message the way the inbound path does.
|
||||
func deliver(t *testing.T, pool *pgxpool.Pool, mailboxID, folder, subject string, alreadySeen bool) uint32 {
|
||||
t.Helper()
|
||||
repo := NewInboundMessageRepository(pool)
|
||||
blobID := storeTestBlob(t, pool)
|
||||
uids, err := repo.PersistAll(context.Background(), []port.PersistInboundMessageInput{{
|
||||
MailboxID: uuid.MustParse(mailboxID),
|
||||
Blob: port.BlobRef{ID: blobID, SHA256: uuid.NewString(), SizeBytes: 10},
|
||||
SenderAddress: "someone@example.test",
|
||||
RecipientAddress: "user@example.test",
|
||||
TargetFolderName: folder,
|
||||
Subject: subject,
|
||||
AlreadySeen: alreadySeen,
|
||||
}})
|
||||
if err != nil {
|
||||
t.Fatalf("persist: %v", err)
|
||||
}
|
||||
return uint32(uids[0])
|
||||
}
|
||||
|
||||
func storeTestBlob(t *testing.T, pool *pgxpool.Pool) uuid.UUID {
|
||||
t.Helper()
|
||||
id := uuid.New()
|
||||
if _, err := pool.Exec(context.Background(), `
|
||||
INSERT INTO message_blobs (id, content_sha256, storage_driver, storage_path, size_bytes, ref_count)
|
||||
VALUES ($1, $2, 'local', $3, 10, 0)`,
|
||||
id, strings.ReplaceAll(uuid.NewString()+uuid.NewString(), "-", "")[:64], "/dev/null/"+id.String()); err != nil {
|
||||
t.Fatalf("seed blob: %v", err)
|
||||
}
|
||||
return id
|
||||
}
|
||||
|
||||
func folderByRole(t *testing.T, folders []port.WebmailFolder, role string) port.WebmailFolder {
|
||||
t.Helper()
|
||||
for _, f := range folders {
|
||||
if f.SpecialUse == role {
|
||||
return f
|
||||
}
|
||||
}
|
||||
t.Fatalf("no %q folder in %v", role, folders)
|
||||
return port.WebmailFolder{}
|
||||
}
|
||||
|
||||
// The bug the user reported: read a message, the unread number does not move,
|
||||
// and it is still wrong after logging out and back in.
|
||||
func TestUnreadCountFollowsWhatWasActuallyRead(t *testing.T) {
|
||||
pool := testPool(t)
|
||||
repo := NewWebmailRepository(pool)
|
||||
mailboxID := seedMailbox(t, pool)
|
||||
ctx := context.Background()
|
||||
|
||||
uid := deliver(t, pool, mailboxID, "INBOX", "first", false)
|
||||
deliver(t, pool, mailboxID, "INBOX", "second", false)
|
||||
|
||||
folders, err := repo.ListFolders(ctx, mailboxID)
|
||||
if err != nil {
|
||||
t.Fatalf("list folders: %v", err)
|
||||
}
|
||||
if got := folderByRole(t, folders, "inbox").UnreadCount; got != 2 {
|
||||
t.Fatalf("two unread messages delivered, folder reports %d", got)
|
||||
}
|
||||
|
||||
if err := repo.MarkSeen(ctx, mailboxID, "inbox", uid, true); err != nil {
|
||||
t.Fatalf("mark seen: %v", err)
|
||||
}
|
||||
|
||||
folders, _ = repo.ListFolders(ctx, mailboxID)
|
||||
if got := folderByRole(t, folders, "inbox").UnreadCount; got != 1 {
|
||||
t.Errorf("after reading one of two, unread is %d, want 1", got)
|
||||
}
|
||||
}
|
||||
|
||||
// A counter that has already drifted must correct itself, or the number stays
|
||||
// wrong forever no matter what the user does.
|
||||
func TestUnreadCountSelfHealsAfterDrift(t *testing.T) {
|
||||
pool := testPool(t)
|
||||
repo := NewWebmailRepository(pool)
|
||||
mailboxID := seedMailbox(t, pool)
|
||||
ctx := context.Background()
|
||||
|
||||
deliver(t, pool, mailboxID, "INBOX", "only one", false)
|
||||
|
||||
// Simulate the drift the old write path produced.
|
||||
if _, err := pool.Exec(ctx, `
|
||||
UPDATE folders SET unread_count = 47, total_count = 99
|
||||
WHERE mailbox_id = $1 AND special_use = 'inbox'`, mailboxID); err != nil {
|
||||
t.Fatalf("force drift: %v", err)
|
||||
}
|
||||
|
||||
folders, err := repo.ListFolders(ctx, mailboxID)
|
||||
if err != nil {
|
||||
t.Fatalf("list folders: %v", err)
|
||||
}
|
||||
inbox := folderByRole(t, folders, "inbox")
|
||||
if inbox.UnreadCount != 1 {
|
||||
t.Errorf("unread did not self-heal: got %d, want 1", inbox.UnreadCount)
|
||||
}
|
||||
if inbox.TotalCount != 1 {
|
||||
t.Errorf("total did not self-heal: got %d, want 1", inbox.TotalCount)
|
||||
}
|
||||
}
|
||||
|
||||
// A message the user wrote themselves is not unread mail.
|
||||
func TestOwnSentCopyIsNotCountedAsUnread(t *testing.T) {
|
||||
pool := testPool(t)
|
||||
repo := NewWebmailRepository(pool)
|
||||
mailboxID := seedMailbox(t, pool)
|
||||
|
||||
deliver(t, pool, mailboxID, "Sent", "something I wrote", true)
|
||||
|
||||
folders, err := repo.ListFolders(context.Background(), mailboxID)
|
||||
if err != nil {
|
||||
t.Fatalf("list folders: %v", err)
|
||||
}
|
||||
sent := folderByRole(t, folders, "sent")
|
||||
if sent.UnreadCount != 0 {
|
||||
t.Errorf("the Sent folder reports %d unread; a message you sent is not unread mail", sent.UnreadCount)
|
||||
}
|
||||
if sent.TotalCount != 1 {
|
||||
t.Errorf("Sent total is %d, want 1", sent.TotalCount)
|
||||
}
|
||||
}
|
||||
|
||||
// Deleting from an ordinary folder moves the message to Trash rather than
|
||||
// destroying it, which is what every mail client does and what makes the
|
||||
// action safe to offer.
|
||||
func TestDeleteMovesToTrashThenExpungesFromTrash(t *testing.T) {
|
||||
pool := testPool(t)
|
||||
repo := NewWebmailRepository(pool)
|
||||
mailboxID := seedMailbox(t, pool)
|
||||
ctx := context.Background()
|
||||
|
||||
uid := deliver(t, pool, mailboxID, "INBOX", "unwanted", false)
|
||||
|
||||
trashUID, err := repo.MoveToTrash(ctx, mailboxID, "inbox", uid)
|
||||
if err != nil {
|
||||
t.Fatalf("move to trash: %v", err)
|
||||
}
|
||||
|
||||
inboxRows, _ := repo.ListMessages(ctx, mailboxID, "inbox", "", 50, 0)
|
||||
if len(inboxRows) != 0 {
|
||||
t.Errorf("the message is still in the inbox after being deleted: %d rows", len(inboxRows))
|
||||
}
|
||||
trashRows, _ := repo.ListMessages(ctx, mailboxID, "trash", "", 50, 0)
|
||||
if len(trashRows) != 1 {
|
||||
t.Fatalf("the deleted message did not arrive in Trash: %d rows", len(trashRows))
|
||||
}
|
||||
|
||||
folders, _ := repo.ListFolders(ctx, mailboxID)
|
||||
if got := folderByRole(t, folders, "inbox").UnreadCount; got != 0 {
|
||||
t.Errorf("inbox still counts the moved message as unread: %d", got)
|
||||
}
|
||||
|
||||
if err := repo.Expunge(ctx, mailboxID, "trash", trashUID); err != nil {
|
||||
t.Fatalf("expunge from trash: %v", err)
|
||||
}
|
||||
trashRows, _ = repo.ListMessages(ctx, mailboxID, "trash", "", 50, 0)
|
||||
if len(trashRows) != 0 {
|
||||
t.Errorf("the message survived being emptied from Trash: %d rows", len(trashRows))
|
||||
}
|
||||
}
|
||||
@@ -259,6 +259,37 @@ func (m *mailAPI) handleSend(w http.ResponseWriter, r *http.Request) {
|
||||
writeJSON(w, http.StatusAccepted, map[string]bool{"queued": true})
|
||||
}
|
||||
|
||||
// handleDelete removes one message: to Trash from anywhere else, and for good
|
||||
// from Trash itself.
|
||||
func (m *mailAPI) handleDelete(w http.ResponseWriter, r *http.Request) {
|
||||
session, ok := m.authenticate(w, r)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
|
||||
var body struct {
|
||||
Folder string `json:"folder"`
|
||||
UID uint32 `json:"uid"`
|
||||
}
|
||||
if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 4096)).Decode(&body); err != nil {
|
||||
writeError(w, http.StatusBadRequest, "BAD_REQUEST", "Invalid JSON")
|
||||
return
|
||||
}
|
||||
if body.Folder == "" {
|
||||
body.Folder = "inbox"
|
||||
}
|
||||
if body.UID == 0 {
|
||||
writeError(w, http.StatusBadRequest, "INVALID_UID", "Message UID is required")
|
||||
return
|
||||
}
|
||||
|
||||
if err := m.useCase.Delete(r.Context(), session.Email, body.Folder, body.UID); err != nil {
|
||||
m.fail(w, err)
|
||||
return
|
||||
}
|
||||
writeJSON(w, http.StatusOK, map[string]bool{"deleted": true})
|
||||
}
|
||||
|
||||
// handleSaveDraft stores the message being composed in the Drafts folder.
|
||||
func (m *mailAPI) handleSaveDraft(w http.ResponseWriter, r *http.Request) {
|
||||
session, ok := m.authenticate(w, r)
|
||||
@@ -299,6 +330,9 @@ func (m *mailAPI) decodeCompose(
|
||||
// previous shape - still sends a readable message rather than a blank
|
||||
// one. Only used when neither text nor html is present.
|
||||
LegacyBody string `json:"body"`
|
||||
// DraftUID is the autosaved draft this message came from, so sending
|
||||
// can clear it. Without it the draft outlived the message it became.
|
||||
DraftUID uint32 `json:"draft_uid"`
|
||||
}
|
||||
if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, maxComposeBytes)).Decode(&body); err != nil {
|
||||
writeError(w, http.StatusBadRequest, "BAD_REQUEST", "Invalid JSON")
|
||||
@@ -314,13 +348,14 @@ func (m *mailAPI) decodeCompose(
|
||||
// letting the body choose From is how a webmail becomes an open relay for
|
||||
// spoofed mail.
|
||||
return usecase.ComposeInput{
|
||||
From: sender,
|
||||
To: body.To,
|
||||
Cc: body.Cc,
|
||||
Bcc: body.Bcc,
|
||||
Subject: body.Subject,
|
||||
Text: text,
|
||||
HTML: body.HTML,
|
||||
From: sender,
|
||||
To: body.To,
|
||||
Cc: body.Cc,
|
||||
Bcc: body.Bcc,
|
||||
Subject: body.Subject,
|
||||
Text: text,
|
||||
HTML: body.HTML,
|
||||
DraftUID: body.DraftUID,
|
||||
}, true
|
||||
}
|
||||
|
||||
|
||||
@@ -89,6 +89,7 @@ func (r *Router) registerRoutes() {
|
||||
r.mux.HandleFunc("/api/v1/mail/seen", r.handleMailSeen)
|
||||
r.mux.HandleFunc("/api/v1/mail/send", r.handleMailSend)
|
||||
r.mux.HandleFunc("/api/v1/mail/draft", r.handleMailDraft)
|
||||
r.mux.HandleFunc("/api/v1/mail/delete", r.handleMailDelete)
|
||||
r.mux.HandleFunc("/api/v1/reports/dmarc", r.handleDmarcIngest)
|
||||
r.mux.HandleFunc("/api/v1/reports/tlsrpt", r.handleTlsRptIngest)
|
||||
}
|
||||
@@ -303,6 +304,18 @@ func (r *Router) handleMailSend(w http.ResponseWriter, req *http.Request) {
|
||||
}
|
||||
}
|
||||
|
||||
// handleMailDelete removes one message. There was no route for this at all,
|
||||
// so nothing the webmail displayed could be deleted from it.
|
||||
func (r *Router) handleMailDelete(w http.ResponseWriter, req *http.Request) {
|
||||
if req.Method != http.MethodPost && req.Method != http.MethodDelete {
|
||||
writeError(w, http.StatusMethodNotAllowed, "METHOD_NOT_ALLOWED", "POST or DELETE required")
|
||||
return
|
||||
}
|
||||
if r.mailReady(w) {
|
||||
r.mail.handleDelete(w, req)
|
||||
}
|
||||
}
|
||||
|
||||
func (r *Router) handleMailDraft(w http.ResponseWriter, req *http.Request) {
|
||||
if req.Method != http.MethodPost {
|
||||
writeError(w, http.StatusMethodNotAllowed, "METHOD_NOT_ALLOWED", "POST required")
|
||||
|
||||
@@ -16,6 +16,28 @@ const nextConfig: NextConfig = {
|
||||
source: "/api/v1/events",
|
||||
destination: `${PROTOCOLS_SERVICE_URL}/api/v1/events`,
|
||||
},
|
||||
// The well-known documents belong to the protocols service, but the
|
||||
// hostnames senders ask for - mta-sts.<domain> above all - resolve to
|
||||
// this app. Without these rewrites the Next 404 page was served in
|
||||
// place of the MTA-STS policy: the _mta-sts TXT record advertised a
|
||||
// policy that could not be fetched, so every sender fell back to
|
||||
// "no-policy-found" and no TLS policy was enforced on inbound mail.
|
||||
// Google's daily TLS-RPT report reports precisely that.
|
||||
//
|
||||
// A rewrite rather than a redirect, because RFC 8461 section 3.3 has
|
||||
// the sender fetch that exact HTTPS path and it need not follow one.
|
||||
{
|
||||
source: "/.well-known/mta-sts.txt",
|
||||
destination: `${PROTOCOLS_SERVICE_URL}/.well-known/mta-sts.txt`,
|
||||
},
|
||||
{
|
||||
source: "/.well-known/security.txt",
|
||||
destination: `${PROTOCOLS_SERVICE_URL}/.well-known/security.txt`,
|
||||
},
|
||||
{
|
||||
source: "/.well-known/autoconfig/mail/config-v1.1.xml",
|
||||
destination: `${PROTOCOLS_SERVICE_URL}/.well-known/autoconfig/mail/config-v1.1.xml`,
|
||||
},
|
||||
];
|
||||
},
|
||||
};
|
||||
|
||||
@@ -58,11 +58,21 @@ export default function ComposePage({
|
||||
const draftUidRef = useRef<number>(0);
|
||||
|
||||
const editorRef = useRef<HTMLDivElement>(null);
|
||||
// The body, mirrored into React state.
|
||||
//
|
||||
// It used to live only inside the contenteditable, read through the ref at
|
||||
// save time. Nothing observed it, so the autosave effect - which depends on
|
||||
// what it reads - never re-ran when the message itself was typed. The draft
|
||||
// was written once, moments after the address was entered, and never again:
|
||||
// that is why a draft left behind by a sent message was empty.
|
||||
const [body, setBody] = useState("");
|
||||
|
||||
useEffect(() => {
|
||||
const savedSig = localStorage.getItem("lm_user_signature");
|
||||
if (editorRef.current && savedSig) {
|
||||
editorRef.current.innerHTML = `<br/><br/>--<br/>${savedSig}`;
|
||||
const initial = `<br/><br/>--<br/>${savedSig}`;
|
||||
editorRef.current.innerHTML = initial;
|
||||
setBody(initial);
|
||||
}
|
||||
}, []);
|
||||
|
||||
@@ -70,8 +80,8 @@ export default function ComposePage({
|
||||
// "draft saved automatically" and nothing else - no request, no storage - so
|
||||
// closing the tab lost the message while the screen had just said otherwise.
|
||||
const saveDraft = useCallback(async () => {
|
||||
const html = editorRef.current?.innerHTML ?? "";
|
||||
if (!to && !subject && !html.trim()) return;
|
||||
const html = editorRef.current?.innerHTML ?? body;
|
||||
if (!to && !subject && !body.trim() && !html.trim()) return;
|
||||
setDraftStatus(t("mail.draftSaving"));
|
||||
try {
|
||||
const res = await fetch("/api/v1/mail/draft", {
|
||||
@@ -94,20 +104,26 @@ export default function ComposePage({
|
||||
} catch {
|
||||
setDraftStatus(t("mail.draftSaveFailed"));
|
||||
}
|
||||
}, [to, cc, bcc, subject, t]);
|
||||
}, [to, cc, bcc, subject, body, t]);
|
||||
|
||||
// Debounced so a draft is written after a pause in typing rather than on
|
||||
// every keystroke. Skipped once the message is on its way out.
|
||||
useEffect(() => {
|
||||
if (sending) return;
|
||||
if (!to && !subject) return;
|
||||
// The body alone is enough: a message typed before its recipient is still
|
||||
// worth keeping, and requiring an address here is half of why drafts were
|
||||
// being stored with nothing in them.
|
||||
if (!to && !subject && !body.trim()) return;
|
||||
const timer = setTimeout(() => void saveDraft(), 2500);
|
||||
return () => clearTimeout(timer);
|
||||
}, [to, subject, cc, bcc, sending, saveDraft]);
|
||||
}, [to, subject, cc, bcc, body, sending, saveDraft]);
|
||||
|
||||
const executeFormat = (command: string, value: string | undefined = undefined) => {
|
||||
document.execCommand(command, false, value);
|
||||
editorRef.current?.focus();
|
||||
// execCommand edits the DOM directly, so the mirrored body is re-read
|
||||
// here rather than relying on an input event that may not be dispatched.
|
||||
setBody(editorRef.current?.innerHTML ?? "");
|
||||
};
|
||||
|
||||
const handleFileUpload = (e: React.ChangeEvent<HTMLInputElement>) => {
|
||||
@@ -130,7 +146,7 @@ export default function ComposePage({
|
||||
setSending(true);
|
||||
setUndoSeconds(10);
|
||||
|
||||
const bodyHtml = editorRef.current?.innerHTML || "";
|
||||
const bodyHtml = editorRef.current?.innerHTML || body;
|
||||
|
||||
const interval = setInterval(() => {
|
||||
setUndoSeconds((prev) => {
|
||||
@@ -155,6 +171,10 @@ export default function ComposePage({
|
||||
bcc: splitAddresses(bcc),
|
||||
subject,
|
||||
html: htmlBody,
|
||||
// The draft this message grew out of, so the server can discard it.
|
||||
// Without this the draft outlived the message it became and sat in
|
||||
// Drafts as a duplicate of mail already sent.
|
||||
draft_uid: draftUidRef.current,
|
||||
}),
|
||||
});
|
||||
if (!res.ok) {
|
||||
@@ -369,6 +389,8 @@ export default function ComposePage({
|
||||
ref={editorRef}
|
||||
contentEditable
|
||||
suppressContentEditableWarning
|
||||
onInput={(e) => setBody((e.target as HTMLDivElement).innerHTML)}
|
||||
onBlur={(e) => setBody((e.target as HTMLDivElement).innerHTML)}
|
||||
aria-label={t("ui.messageBody")}
|
||||
role="textbox"
|
||||
aria-multiline="true"
|
||||
|
||||
@@ -15,6 +15,7 @@ import {
|
||||
MailOpen,
|
||||
Download,
|
||||
RefreshCw,
|
||||
Trash2,
|
||||
X,
|
||||
} from "lucide-react";
|
||||
import { useI18n } from "../../../../../i18n/provider";
|
||||
@@ -202,6 +203,39 @@ export default function MailFolderPage({ params }: { params: Promise<{ folder: s
|
||||
[folder]
|
||||
);
|
||||
|
||||
/**
|
||||
* Deletes one message: to Trash from an ordinary folder, and for good from
|
||||
* Trash itself, which is what the server does with the same call.
|
||||
*
|
||||
* The webmail had no delete at all - no button and no route behind one - so
|
||||
* anything the user wanted rid of stayed. The draft a sent message left
|
||||
* behind was the case that made it impossible to ignore.
|
||||
*/
|
||||
const deleteMessage = useCallback(
|
||||
async (uid: number) => {
|
||||
// Removed from the list first so the row goes at the moment of the
|
||||
// click; the reload below is what makes the server's answer final.
|
||||
setMessages((current) => current.filter((m) => m.uid !== uid));
|
||||
setSelected((current) => (current?.uid === uid ? null : current));
|
||||
try {
|
||||
const res = await fetch("/api/v1/mail/delete", {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ folder, uid }),
|
||||
});
|
||||
if (!res.ok) throw new Error(t("errors.serverError"));
|
||||
} catch (err) {
|
||||
setError(err instanceof Error ? err.message : t("errors.serverError"));
|
||||
// The optimistic removal was wrong, so put the folder back as it is.
|
||||
void loadMessages(searchQuery);
|
||||
} finally {
|
||||
// Both the source folder and Trash moved, so the badges must re-read.
|
||||
notifyMailStateChanged();
|
||||
}
|
||||
},
|
||||
[folder, t, loadMessages, searchQuery]
|
||||
);
|
||||
|
||||
const openMessage = async (uid: number) => {
|
||||
setLoadRemoteImages(false);
|
||||
setReaderHeight(420);
|
||||
@@ -359,8 +393,12 @@ export default function MailFolderPage({ params }: { params: Promise<{ folder: s
|
||||
filteredMessages.map((msg) => {
|
||||
const isSelected = selected?.uid === msg.uid;
|
||||
return (
|
||||
/* The row and its delete control are siblings inside a
|
||||
positioned wrapper rather than nested: a button inside a
|
||||
button is invalid markup, and the browser drops the inner
|
||||
one, so the delete would never have been clickable. */
|
||||
<div key={msg.uid} className="group relative">
|
||||
<button
|
||||
key={msg.uid}
|
||||
onClick={() => void openMessage(msg.uid)}
|
||||
data-active={isSelected}
|
||||
className="lm-row w-full text-left"
|
||||
@@ -417,6 +455,19 @@ export default function MailFolderPage({ params }: { params: Promise<{ folder: s
|
||||
{!msg.seen && <span className="block h-[7px] w-[7px] rounded-full bg-indigo-500" />}
|
||||
</span>
|
||||
</button>
|
||||
{/* Reachable without opening the message first, which is what
|
||||
the leftover empty draft needed: there was nothing worth
|
||||
reading in it, and no other way to get rid of it. */}
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => void deleteMessage(msg.uid)}
|
||||
title={t("common.delete")}
|
||||
aria-label={t("common.delete")}
|
||||
className="absolute right-2 top-2 hidden h-7 w-7 items-center justify-center rounded-md text-slate-400 transition-colors hover:bg-white/[0.09] hover:text-slate-100 focus:flex focus-visible:flex group-hover:flex"
|
||||
>
|
||||
<Trash2 className="h-3.5 w-3.5" />
|
||||
</button>
|
||||
</div>
|
||||
);
|
||||
})
|
||||
)}
|
||||
@@ -466,6 +517,15 @@ export default function MailFolderPage({ params }: { params: Promise<{ folder: s
|
||||
<MailOpen className="h-3.5 w-3.5" />
|
||||
<span>{selectedRow?.seen === false ? t("mail.markRead") : t("mail.markUnread")}</span>
|
||||
</Button>
|
||||
<Button
|
||||
variant="secondary"
|
||||
size="sm"
|
||||
onClick={() => void deleteMessage(selected.uid)}
|
||||
title={t("common.delete")}
|
||||
>
|
||||
<Trash2 className="h-3.5 w-3.5" />
|
||||
<span>{t("common.delete")}</span>
|
||||
</Button>
|
||||
<Button
|
||||
variant="secondary"
|
||||
size="sm"
|
||||
|
||||
@@ -0,0 +1,82 @@
|
||||
import { describe, it, expect } from "vitest";
|
||||
import { readFileSync } from "node:fs";
|
||||
import { resolve } from "node:path";
|
||||
|
||||
/**
|
||||
* The composer's draft handling, and the delete action the mail list was
|
||||
* missing entirely.
|
||||
*
|
||||
* Every check here is a defect the user hit: a message sent from the composer
|
||||
* left its autosaved draft behind, that draft was empty because the autosave
|
||||
* never saw the body, and no screen offered any way to remove it.
|
||||
*/
|
||||
|
||||
const read = (path: string) => readFileSync(resolve(process.cwd(), path), "utf8");
|
||||
const code = (path: string) =>
|
||||
read(path)
|
||||
.replace(/\/\*[\s\S]*?\*\//g, "")
|
||||
.replace(/\{\/\*[\s\S]*?\*\/\}/g, "")
|
||||
.replace(/^\s*\/\/.*$/gm, "");
|
||||
|
||||
const COMPOSE = "src/app/(user)/user/compose/page.tsx";
|
||||
const MAIL_PAGE = "src/app/(user)/user/mail/[folder]/page.tsx";
|
||||
|
||||
describe("the draft a sent message leaves behind", () => {
|
||||
// Sending posted to /mail/send without ever naming the draft it came from,
|
||||
// so the draft stayed in Drafts as a duplicate of mail already on its way.
|
||||
it("tells the server which draft the sent message came from", () => {
|
||||
const compose = code(COMPOSE);
|
||||
expect(compose).toMatch(/draft_uid:\s*draftUidRef\.current/);
|
||||
});
|
||||
|
||||
it("posts the draft UID on the send request, not only on the autosave", () => {
|
||||
const compose = code(COMPOSE);
|
||||
const sendCall = compose.slice(compose.indexOf('"/api/v1/mail/send"'));
|
||||
expect(sendCall.slice(0, 600)).toContain("draft_uid");
|
||||
});
|
||||
});
|
||||
|
||||
describe("what the autosave actually stores", () => {
|
||||
// The body lived in a contenteditable read through a ref, and the debounce
|
||||
// depended only on the header fields. Typing a message therefore never
|
||||
// re-triggered a save, so the stored draft held the recipient and nothing
|
||||
// else - the empty draft the user could see and could not delete.
|
||||
it("re-runs when the body changes, not only the recipient and subject", () => {
|
||||
const compose = code(COMPOSE);
|
||||
const effect = compose.slice(compose.indexOf("const timer = setTimeout(() => void saveDraft()"));
|
||||
const deps = effect.slice(effect.indexOf("}, ["), effect.indexOf("]);") + 3);
|
||||
expect(deps).toContain("body");
|
||||
});
|
||||
|
||||
it("keeps the body in state so a change can be observed at all", () => {
|
||||
const compose = code(COMPOSE);
|
||||
expect(compose).toMatch(/useState.*\n?.*body|const \[body, setBody\]/);
|
||||
expect(compose).toContain("setBody");
|
||||
});
|
||||
|
||||
it("does not save a draft that has no content anywhere", () => {
|
||||
const compose = code(COMPOSE);
|
||||
expect(compose).toMatch(/if \(!to && !subject && !body/);
|
||||
});
|
||||
});
|
||||
|
||||
describe("deleting a message", () => {
|
||||
// There was no delete anywhere in the webmail: no button, and no route
|
||||
// behind one. Anything the user wanted rid of stayed forever.
|
||||
it("offers a delete action on the message list", () => {
|
||||
const page = code(MAIL_PAGE);
|
||||
expect(page).toContain("/api/v1/mail/delete");
|
||||
});
|
||||
|
||||
it("refreshes the counters after deleting, so the badges follow", () => {
|
||||
const page = code(MAIL_PAGE);
|
||||
const del = page.slice(page.indexOf('"/api/v1/mail/delete"'));
|
||||
expect(del.slice(0, 900)).toContain("notifyMailStateChanged");
|
||||
});
|
||||
|
||||
it("removes the deleted row from the list without a full reload", () => {
|
||||
const page = code(MAIL_PAGE);
|
||||
const del = page.slice(page.indexOf("const deleteMessage"));
|
||||
expect(del.slice(0, 1200)).toMatch(/setMessages\(/);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,34 @@
|
||||
import { describe, it, expect } from "vitest";
|
||||
import { readFileSync } from "node:fs";
|
||||
import { resolve } from "node:path";
|
||||
|
||||
/**
|
||||
* The well-known documents senders fetch over HTTPS.
|
||||
*
|
||||
* The protocols service serves /.well-known/mta-sts.txt, but the hostname a
|
||||
* sender asks - mta-sts.<domain> - lands on this Next app, which had no route
|
||||
* for it and answered its own 404 page. The DNS half of MTA-STS was published
|
||||
* and the HTTPS half was not, so every sender saw "no-policy-found" and no
|
||||
* TLS policy was ever enforced. Google's daily TLS-RPT report says exactly
|
||||
* that.
|
||||
*/
|
||||
|
||||
const config = readFileSync(resolve(process.cwd(), "next.config.ts"), "utf8");
|
||||
|
||||
describe("the MTA-STS policy senders fetch", () => {
|
||||
it("is routed to the service that serves it", () => {
|
||||
expect(config).toContain("/.well-known/mta-sts.txt");
|
||||
expect(config).toMatch(/mta-sts\.txt[\s\S]{0,200}PROTOCOLS_SERVICE_URL/);
|
||||
});
|
||||
|
||||
it("routes the other well-known documents the same way", () => {
|
||||
expect(config).toContain("/.well-known/security.txt");
|
||||
});
|
||||
|
||||
// A rewrite, not a redirect: RFC 8461 section 3.3 requires the policy to be
|
||||
// fetched over HTTPS from that exact path, and a sender is not obliged to
|
||||
// follow a redirect to get it.
|
||||
it("rewrites rather than redirects", () => {
|
||||
expect(config).not.toMatch(/redirects\(\)/);
|
||||
});
|
||||
});
|
||||
Reference in new issue
Block a user