fix(smtp): keep a copy of every submitted message in the sender's Sent folder

A message sent over SMTP submission was delivered but left nothing behind: the account's Sent folder stayed empty. Webmail files its own copy after sending, and a mail client cannot do it either, since IMAP APPEND is not implemented, so nothing ever filled Sent for SMTP clients. - ProcessOutboundEmailInput.FileSentCopy asks Submit to file the signed message in the sender's Sent folder, as read (not unread), sharing the blob the delivery jobs already reference; one copy per submission, not per recipient - the SMTP submission session sets it; the webmail leaves it off because it files its own copy without the Bcc line, and asking twice would duplicate it - filed only after the message is durably queued, so a submission refused by the send limit leaves nothing behind; a failure to file is logged, never returned, because the mail is already on its way and the client would send it again Tests: unit cases (asked/not asked, shared blob, failure swallowed, limit refusal, no repository) and an end-to-end test on the real submission server that fails with "Sent holds 0 messages" without the fix. Full go test ./... (25 packages) with TEST_DATABASE_URL, go vet and lang-lint are clean.
2026-10-16 12:51:46 -03:00
1 parent 110a240cd9
commit 9c8b9c00fc
@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log/slog"
 	"strings"
 	"time"

@@ -48,6 +49,13 @@ type ProcessOutboundEmailInput struct {
 	// MaxRecipientsPerHour is the sender's policy, carried from the
 	// authenticated session.
 	MaxRecipientsPerHour int
+	// FileSentCopy asks for a copy of the message in the sender's Sent folder.
+	// Set for SMTP submission: a mail client cannot file it itself, since IMAP
+	// APPEND is not implemented, so without this nothing a client sent ever
+	// showed up in Sent. The webmail leaves it off because it files its own copy
+	// (one that omits the Bcc line), and asking twice would show every sent
+	// message twice.
+	FileSentCopy bool
 }

 // ProcessOutboundEmailUseCase implements the submission half of PLAN.md
@@ -57,6 +65,14 @@ type ProcessOutboundEmailUseCase struct {
 	outbound port.OutboundRepository
 	blobs    port.BlobStorage
 	signer   port.DkimSigner
+	// sentCopies files the sender's copy; nil leaves FileSentCopy a no-op
+	sentCopies port.InboundMessageRepository
+}
+
+// SetSentCopies gives the use case somewhere to file the sender's copy of what
+// was submitted (see ProcessOutboundEmailInput.FileSentCopy).
+func (uc *ProcessOutboundEmailUseCase) SetSentCopies(messages port.InboundMessageRepository) {
+	uc.sentCopies = messages
 }

 func NewProcessOutboundEmailUseCase(
@@ -143,9 +159,40 @@ func (uc *ProcessOutboundEmailUseCase) Submit(ctx context.Context, input Process
 		}
 	}

+	// Only once the message is durably queued, so a submission refused by the
+	// send limit or a failed enqueue never leaves a "sent" copy behind. A
+	// failure here is logged and swallowed: the mail is on its way, and telling
+	// the client the submission failed would only make it send it again.
+	if input.FileSentCopy && uc.sentCopies != nil {
+		if err := uc.fileSentCopy(ctx, input, blob, payload); err != nil {
+			slog.Warn("could not file the Sent copy", "mailbox", input.SenderAddr, "error", err)
+		}
+	}
+
 	return nil
 }

+// fileSentCopy records the sender's copy in their Sent folder, referencing the
+// blob the delivery jobs already share, so it costs a row and no extra bytes.
+func (uc *ProcessOutboundEmailUseCase) fileSentCopy(ctx context.Context, input ProcessOutboundEmailInput, blob port.BlobRef, payload []byte) error {
+	headers := ExtractMessageHeaders(payload)
+	_, err := uc.sentCopies.PersistAll(ctx, []port.PersistInboundMessageInput{{
+		MailboxID:        input.MailboxID,
+		Blob:             blob,
+		SenderAddress:    input.SenderAddr,
+		RecipientAddress: input.SenderAddr,
+		TargetFolderName: "Sent",
+		Subject:          headers.Subject,
+		Snippet:          headers.Snippet,
+		FromDisplayName:  headers.FromDisplayName,
+		MessageIDHeader:  headers.MessageID,
+		HasAttachments:   headers.HasAttachments,
+		// The sender's own copy is not unread mail
+		AlreadySeen: true,
+	}})
+	return err
+}
+
 // checkSendLimit refuses the whole submission when accepting it would take the
 // mailbox past its hourly recipient budget. Refusing up front is what contains
 // a compromised account; accepting and dropping later would not.
@@ -0,0 +1,139 @@
+package usecase
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/google/uuid"
+
+	"lambdamail/protocols/internal/application/port"
+)
+
+// recordingMessageRepo stands in for the repository that files a message into
+// a folder; it records what it was asked to store.
+type recordingMessageRepo struct {
+	inputs []port.PersistInboundMessageInput
+	err    error
+}
+
+func (r *recordingMessageRepo) PersistAll(_ context.Context, in []port.PersistInboundMessageInput) ([]int64, error) {
+	if r.err != nil {
+		return nil, r.err
+	}
+	r.inputs = append(r.inputs, in...)
+	return make([]int64, len(in)), nil
+}
+
+func sentCopyInput(mailboxID uuid.UUID, fileCopy bool) ProcessOutboundEmailInput {
+	input := submissionInput(mailboxID, "ana@remote.test", "bruno@other.test")
+	input.FileSentCopy = fileCopy
+	input.Body = bytes.NewBufferString("From: user@example.test\r\nTo: ana@remote.test\r\nSubject: Aviso de teste\r\nMessage-ID: <abc@example.test>\r\n\r\nbody")
+	return input
+}
+
+// A mail client submitting over SMTP cannot file a copy in Sent itself (IMAP
+// APPEND is not implemented), so the server does it once the message is queued.
+func TestSubmit_FilesACopyInSentWhenAsked(t *testing.T) {
+	mailboxID := uuid.New()
+	messages := &recordingMessageRepo{}
+	blobs := &capturingBlobStorage{}
+
+	uc := NewProcessOutboundEmailUseCase(nil, &countingOutboundRepo{}, blobs, nil)
+	uc.SetSentCopies(messages)
+
+	if err := uc.Submit(context.Background(), sentCopyInput(mailboxID, true)); err != nil {
+		t.Fatalf("Submit: %v", err)
+	}
+
+	if len(messages.inputs) != 1 {
+		t.Fatalf("filed %d copies, want exactly 1 (not one per recipient)", len(messages.inputs))
+	}
+	got := messages.inputs[0]
+	if got.MailboxID != mailboxID {
+		t.Errorf("copy filed for mailbox %v, want the sender %v", got.MailboxID, mailboxID)
+	}
+	if got.TargetFolderName != "Sent" {
+		t.Errorf("folder = %q, want Sent", got.TargetFolderName)
+	}
+	if !got.AlreadySeen {
+		t.Error("the sender's own copy must not count as unread mail")
+	}
+	if got.Subject != "Aviso de teste" || got.MessageIDHeader != "abc@example.test" {
+		t.Errorf("headers not extracted: subject=%q message-id=%q", got.Subject, got.MessageIDHeader)
+	}
+	if got.RecipientAddress != "user@example.test" {
+		t.Errorf("recipient address = %q, want the sender's own address", got.RecipientAddress)
+	}
+}
+
+func TestSubmit_SentCopySharesTheStoredMessageInsteadOfDuplicatingIt(t *testing.T) {
+	repo := &countingOutboundRepo{}
+	messages := &recordingMessageRepo{}
+
+	uc := NewProcessOutboundEmailUseCase(nil, repo, &capturingBlobStorage{}, nil)
+	uc.SetSentCopies(messages)
+	if err := uc.Submit(context.Background(), sentCopyInput(uuid.New(), true)); err != nil {
+		t.Fatalf("Submit: %v", err)
+	}
+
+	if messages.inputs[0].Blob.ID != repo.jobs[0].BlobID {
+		t.Error("the Sent copy must reference the same blob as the delivery jobs")
+	}
+}
+
+// The webmail files its own copy (without the Bcc line the envelope carries),
+// so asking it to file another one would put every sent message in Sent twice.
+func TestSubmit_DoesNotFileACopyUnlessAsked(t *testing.T) {
+	messages := &recordingMessageRepo{}
+
+	uc := NewProcessOutboundEmailUseCase(nil, &countingOutboundRepo{}, &capturingBlobStorage{}, nil)
+	uc.SetSentCopies(messages)
+	if err := uc.Submit(context.Background(), sentCopyInput(uuid.New(), false)); err != nil {
+		t.Fatalf("Submit: %v", err)
+	}
+
+	if len(messages.inputs) != 0 {
+		t.Fatalf("filed %d copies although none was requested", len(messages.inputs))
+	}
+}
+
+// The mail is already queued when the copy is filed; failing the submission
+// now would make the client send it again.
+func TestSubmit_ASentCopyFailureDoesNotFailTheSubmission(t *testing.T) {
+	repo := &countingOutboundRepo{}
+	messages := &recordingMessageRepo{err: errors.New("quota exceeded")}
+
+	uc := NewProcessOutboundEmailUseCase(nil, repo, &capturingBlobStorage{}, nil)
+	uc.SetSentCopies(messages)
+
+	if err := uc.Submit(context.Background(), sentCopyInput(uuid.New(), true)); err != nil {
+		t.Fatalf("Submit must succeed even when the Sent copy cannot be filed: %v", err)
+	}
+	if len(repo.jobs) != 2 {
+		t.Fatalf("the message was not queued: %d jobs", len(repo.jobs))
+	}
+}
+
+func TestSubmit_ASubmissionRefusedByTheSendLimitLeavesNothingInSent(t *testing.T) {
+	messages := &recordingMessageRepo{}
+
+	uc := NewProcessOutboundEmailUseCase(nil, &countingOutboundRepo{recentCount: 199}, &capturingBlobStorage{}, nil)
+	uc.SetSentCopies(messages)
+
+	if err := uc.Submit(context.Background(), sentCopyInput(uuid.New(), true)); !errors.Is(err, ErrSendLimitExceeded) {
+		t.Fatalf("error = %v, want ErrSendLimitExceeded", err)
+	}
+	if len(messages.inputs) != 0 {
+		t.Fatal("a message that was refused must not appear in Sent")
+	}
+}
+
+func TestSubmit_WorksWithoutASentCopyRepository(t *testing.T) {
+	uc := NewProcessOutboundEmailUseCase(nil, &countingOutboundRepo{}, &capturingBlobStorage{}, nil)
+
+	if err := uc.Submit(context.Background(), sentCopyInput(uuid.New(), true)); err != nil {
+		t.Fatalf("Submit without a Sent repository: %v", err)
+	}
+}