#21: fill in message metadata and stop losing mail to a missing folder

Two problems the mail screens exposed, both in the delivery path.

The subject, snippet, sender name and message-id columns have existed
since the first migration, but nothing ever wrote them: every row went in
with those fields NULL. A message list built on the database would have
shown blank subjects for every message. Delivery now parses them once per
message and stores them, decoding RFC 2047 encoded words so an accented
subject is readable rather than raw. Parsing failures are non-fatal: a
message with unreadable headers is still delivered, just with less
metadata, because refusing it would lose mail over a malformed Subject.

Worse, a message the spam filter routed to Junk failed delivery outright
when the mailbox had no Junk folder - the sender got 451 and retried
forever against a mailbox that would never grow one on its own. Delivery
now falls back to INBOX and says so in the log. Found by sending a real
message through port 25 against the running stack.

The SMTP handler also swallowed the cause of any unexpected failure: the
peer saw "temporary error" and the operator got nothing. It is logged now,
which is how the missing folder was diagnosed at all.

Also adds the JWT verifier the mail API needs. The tokens are minted by
the auth service and verified here under the same secret, so the test
fixtures are real tokens produced by that service: if the two
implementations drift, this fails before the webmail does. Challenge
tokens, wrong secrets, tampered payloads, expired tokens and the other
surface's audience are all rejected.

The dev seed gained the standard folder set, which is what a provisioned
mailbox has and what the fallback above should not have to compensate for.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/protocols/internal/presentation/http/websession.go

@@ -0,0 +1,102 @@
+package httppresentation
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"strings"
+	"time"
+)
+
+// WebSession is the claim set the auth service puts in its session tokens.
+// The two services share only this shape and the signing secret; the tokens
+// themselves are issued in one place and verified in both.
+type WebSession struct {
+	Subject      string `json:"sub"`
+	Email        string `json:"email"`
+	Role         string `json:"role"`
+	DomainID     string `json:"domainId"`
+	Surface      string `json:"surface"`
+	Audience     string `json:"aud"`
+	MfaSatisfied bool   `json:"mfaSatisfied"`
+	Purpose      string `json:"purpose"`
+	IssuedAt     int64  `json:"iat"`
+	ExpiresAt    int64  `json:"exp"`
+}
+
+var (
+	ErrTokenMalformed = errors.New("web session: token is not a three-part JWT")
+	ErrBadSignature   = errors.New("web session: signature does not verify")
+	ErrTokenExpired   = errors.New("web session: token has expired")
+	ErrNotASession    = errors.New("web session: token is not a session token")
+	ErrWrongAudience  = errors.New("web session: token was issued for a different surface")
+)
+
+// WebSessionVerifier validates the tokens minted by the auth service.
+//
+// The secret is shared rather than the tokens being re-checked over HTTP: a
+// round trip to the auth service on every mail request would put a second
+// network hop in the read path for no extra safety, since both services
+// already trust the same secret to say who the user is.
+type WebSessionVerifier struct {
+	secret []byte
+	now    func() time.Time
+}
+
+func NewWebSessionVerifier(secret string) *WebSessionVerifier {
+	return &WebSessionVerifier{secret: []byte(secret), now: time.Now}
+}
+
+// Verify checks the signature, the expiry, and that this is a real session
+// rather than the short-lived challenge issued between the password and the
+// second factor.
+func (v *WebSessionVerifier) Verify(token string) (*WebSession, error) {
+	parts := strings.Split(token, ".")
+	if len(parts) != 3 {
+		return nil, ErrTokenMalformed
+	}
+
+	mac := hmac.New(sha256.New, v.secret)
+	mac.Write([]byte(parts[0] + "." + parts[1]))
+	expected := base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
+
+	// Compared with hmac.Equal so a wrong signature costs the same time as a
+	// right one, whatever the mismatch position.
+	if !hmac.Equal([]byte(parts[2]), []byte(expected)) {
+		return nil, ErrBadSignature
+	}
+
+	raw, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return nil, ErrTokenMalformed
+	}
+
+	var session WebSession
+	if err := json.Unmarshal(raw, &session); err != nil {
+		return nil, ErrTokenMalformed
+	}
+
+	if session.ExpiresAt > 0 && v.now().Unix() >= session.ExpiresAt {
+		return nil, ErrTokenExpired
+	}
+	if session.Purpose != "session" {
+		return nil, ErrNotASession
+	}
+
+	return &session, nil
+}
+
+// RequireSurface additionally pins the token to one surface, which is what
+// keeps a /user token out of an admin-only endpoint (PLAN.md section 14.1).
+func (v *WebSessionVerifier) RequireSurface(token, surface string) (*WebSession, error) {
+	session, err := v.Verify(token)
+	if err != nil {
+		return nil, err
+	}
+	if session.Surface != surface || session.Audience != "lambdamail:"+surface {
+		return nil, ErrWrongAudience
+	}
+	return session, nil
+}

services/protocols/internal/presentation/http/websession_test.go

@@ -0,0 +1,93 @@
+package httppresentation
+
+import (
+	"errors"
+	"testing"
+	"time"
+)
+
+// These tokens were minted by the auth service itself (services/auth,
+// session.ts) under the secret below. They are the real wire format: if the
+// two implementations ever drift, every mail request from the webmail starts
+// failing and this test says so first.
+const (
+	interopSecret    = "shared-secret-for-interop-test"
+	interopSession   = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJtYi0xIiwiZW1haWwiOiJ1c2VyQGV4YW1wbGUudGVzdCIsInJvbGUiOiJVU0VSIiwiZG9tYWluSWQiOiJkb20tMSIsInN1cmZhY2UiOiJ1c2VyIiwiYXVkIjoibGFtYmRhbWFpbDp1c2VyIiwibWZhU2F0aXNmaWVkIjp0cnVlLCJtZmFTYXRpc2ZpZWRBdCI6MTc4NTY3NDI0MzYzMiwicHVycG9zZSI6InNlc3Npb24iLCJpYXQiOjE3ODU2NzQyNDMsImV4cCI6MTc4NTcwMzA0M30.vrXM2T9HKfHDOThmx0LD_n05jfsr4iaKYpZrKTBa5NM"
+	interopChallenge = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJtYi0xIiwiZW1haWwiOiJ1c2VyQGV4YW1wbGUudGVzdCIsInJvbGUiOiJVU0VSIiwiZG9tYWluSWQiOiJkb20tMSIsInN1cmZhY2UiOiJ1c2VyIiwiYXVkIjoibGFtYmRhbWFpbDp1c2VyIiwibWZhU2F0aXNmaWVkIjpmYWxzZSwicHVycG9zZSI6Im1mYV9jaGFsbGVuZ2UiLCJpYXQiOjE3ODU2NzQyNDMsImV4cCI6MTc4NTY3NDU0M30.7OqmI9A1L9Efbt6AX4lqojZZ8IKuWi-6oe_VJNgJAxM"
+	// The captured tokens carry a fixed validity window. Verification is
+	// pinned to an instant inside it, so these tests assert on the signature
+	// and the claims rather than quietly turning red once the tokens age out.
+	interopIssuedAt = 1785674243
+)
+
+func testVerifier(secret string) *WebSessionVerifier {
+	v := NewWebSessionVerifier(secret)
+	v.now = func() time.Time { return time.Unix(interopIssuedAt+60, 0) }
+	return v
+}
+
+func TestWebSessionVerifier_AcceptsTokenIssuedByTheAuthService(t *testing.T) {
+	session, err := testVerifier(interopSecret).Verify(interopSession)
+	if err != nil {
+		t.Fatalf("a token minted by the auth service was rejected: %v", err)
+	}
+	if session.Email != "user@example.test" {
+		t.Errorf("Email = %q, want user@example.test", session.Email)
+	}
+	if session.Surface != "user" || session.Audience != "lambdamail:user" {
+		t.Errorf("surface/aud = %q/%q, want user/lambdamail:user", session.Surface, session.Audience)
+	}
+}
+
+// The challenge token is issued after the password but before the second
+// factor. Accepting it here would let the mail API be opened without MFA.
+func TestWebSessionVerifier_RejectsChallengeToken(t *testing.T) {
+	_, err := testVerifier(interopSecret).Verify(interopChallenge)
+	if !errors.Is(err, ErrNotASession) {
+		t.Fatalf("error = %v, want ErrNotASession", err)
+	}
+}
+
+func TestWebSessionVerifier_RejectsWrongSecret(t *testing.T) {
+	_, err := testVerifier("not-the-secret").Verify(interopSession)
+	if !errors.Is(err, ErrBadSignature) {
+		t.Fatalf("error = %v, want ErrBadSignature", err)
+	}
+}
+
+// A tampered payload must not survive: this is the check that stops a user
+// from promoting their own token to the admin surface.
+func TestWebSessionVerifier_RejectsTamperedPayload(t *testing.T) {
+	tampered := interopSession[:len(interopSession)-6] + "AAAAAA"
+	if _, err := testVerifier(interopSecret).Verify(tampered); err == nil {
+		t.Fatal("a tampered token verified")
+	}
+}
+
+func TestWebSessionVerifier_RequireSurfaceRejectsOtherSurface(t *testing.T) {
+	_, err := testVerifier(interopSecret).RequireSurface(interopSession, "admin")
+	if !errors.Is(err, ErrWrongAudience) {
+		t.Fatalf("error = %v, want ErrWrongAudience", err)
+	}
+	if _, err := testVerifier(interopSecret).RequireSurface(interopSession, "user"); err != nil {
+		t.Fatalf("the matching surface was rejected: %v", err)
+	}
+}
+
+func TestWebSessionVerifier_RejectsMalformed(t *testing.T) {
+	v := testVerifier(interopSecret)
+	for _, token := range []string{"", "a.b", "a.b.c.d", "not-a-token"} {
+		if _, err := v.Verify(token); err == nil {
+			t.Errorf("token %q verified", token)
+		}
+	}
+}
+
+// Expiry still has to bite: pinning the clock must not disable the check.
+func TestWebSessionVerifier_RejectsExpiredToken(t *testing.T) {
+	v := NewWebSessionVerifier(interopSecret)
+	v.now = func() time.Time { return time.Unix(interopIssuedAt+9*60*60, 0) }
+	if _, err := v.Verify(interopSession); !errors.Is(err, ErrTokenExpired) {
+		t.Fatalf("error = %v, want ErrTokenExpired", err)
+	}
+}

services/protocols/internal/presentation/smtp/backend.go

@@ -7,6 +7,7 @@ import (
 	"context"
 	"errors"
 	"io"
+	"log"
 	"net"
 
 	gosmtp "github.com/emersion/go-smtp"
@@ -157,6 +158,10 @@ func (s *session) Data(r io.Reader) error {
 		// Anything else is an internal failure. It is reported as temporary so
 		// the sender retries: the message was not stored, and telling the peer
 		// it failed permanently would discard mail over a bug on this side.
+		//
+		// Logged because the peer only ever sees "temporary error"; without
+		// this line an operator has a bounced delivery and no cause.
+		log.Printf("smtp: could not store message from %s: %v", s.from, err)
 		return &gosmtp.SMTPError{
 			Code:         451,
 			EnhancedCode: gosmtp.EnhancedCode{4, 3, 0},