fix(drafts): guard immutable draft replacement and preserve originals #45

Merged

jlxq0 merged 4 commits from fix/safe-draft-replacement-20261029 into main

2026-10-28 17:37:06 +00:00

jlxq0 commented

2026-10-28 16:45:24 +00:00

Owner

update_draft previously patched immutable JMAP content and accepted Email IDs without draft ownership or concurrency guards. It now requires the saved account state and draft revision, creates and verifies a replacement, then conditionally moves the verified original to Trash and reads both back. It never permanently deletes or submits email. Partial/unknown outcomes carry recovery IDs and permanently consume the workflow generation; clients must serialize updates and reconcile manually before accepting a new generation.

save_draft returns verified ID/state/revision; read-only get_draft_version supports safe conflict checks. The server accepts any account-owned plain draft, so autonomous clients must separately track their own created IDs and unchanged generation revisions. Blank/foreign From fields, sent/moved mail and unsupported rich/MIME content are refused. RFC line endings, empty subject text and bracketed reply IDs are normalized before writing; the same plain part in both text/HTML display lists is supported. Existing update clients must migrate to required preconditions and the newly returned Email ID.

Rebased onto separately reviewed/green/merged dependency PR46. Exact current head 2e19f3e03b8489835b105c767bfd6fad6fa81add: pinned Rust1.93.0 fmt, clippy(all targets/features, locked, -Dwarnings),274tests pass. Nine deliberate guard-removal mutations each fail named handler tests; restored source hash matches current module. Cargo audit0vulnerabilities (existing allowed chacha20 yankedwarning), deny bans/licenses/sources and checksum-pinned OSV2.5.1 pass. Native read-only Stalwart metadata corrected fixture shape; it does not prove live writes.

Fresh independent Claude Code print review (claude-opus-5-5) APPROVE exact 2e19f3e03b8489835b105c767bfd6fad6fa81add; CI158 all required and Docker jobs success. The reviewer read source independently and did not run tests; exact-headCI supplies execution evidence. Source-only: no release/tag, credential/scope/profile changes, production mailbox writes or deployment. Release remains gated on Lucy caller/allowlist migration with a serialized durable created-ID/generation ledger and the disposable live Stalwart acceptance matrix, including normalization, race/unknown outcomes and Trash retention. Existing Lucy-own sends are outside this draft workflow and unchanged.

`update_draft` previously patched immutable JMAP content and accepted Email IDs without draft ownership or concurrency guards. It now requires the saved account state and draft revision, creates and verifies a replacement, then conditionally moves the verified original to Trash and reads both back. It never permanently deletes or submits email. Partial/unknown outcomes carry recovery IDs and permanently consume the workflow generation; clients must serialize updates and reconcile manually before accepting a new generation. `save_draft` returns verified ID/state/revision; read-only `get_draft_version` supports safe conflict checks. The server accepts any account-owned plain draft, so autonomous clients must separately track their own created IDs and unchanged generation revisions. Blank/foreign From fields, sent/moved mail and unsupported rich/MIME content are refused. RFC line endings, empty subject text and bracketed reply IDs are normalized before writing; the same plain part in both text/HTML display lists is supported. Existing update clients must migrate to required preconditions and the newly returned Email ID. Rebased onto separately reviewed/green/merged dependency PR46. Exact current head `2e19f3e03b8489835b105c767bfd6fad6fa81add`: pinned Rust1.93.0 fmt, clippy(all targets/features, locked, -Dwarnings),274tests pass. Nine deliberate guard-removal mutations each fail named handler tests; restored source hash matches current module. Cargo audit0vulnerabilities (existing allowed chacha20 yankedwarning), deny bans/licenses/sources and checksum-pinned OSV2.5.1 pass. Native read-only Stalwart metadata corrected fixture shape; it does not prove live writes. Fresh independent Claude Code print review (claude-opus-5-5) APPROVE exact `2e19f3e03b8489835b105c767bfd6fad6fa81add`; [CI158](https://forge.oddie.app/jlxq0/jmap-mcp/actions/runs/158) all required and Docker jobs success. The reviewer read source independently and did not run tests; exact-headCI supplies execution evidence. Source-only: no release/tag, credential/scope/profile changes, production mailbox writes or deployment. Release remains gated on Lucy caller/allowlist migration with a serialized durable created-ID/generation ledger and the disposable live Stalwart acceptance matrix, including normalization, race/unknown outcomes and Trash retention. Existing Lucy-own sends are outside this draft workflow and unchanged.

jlxq0 added 1 commit

2026-10-28 16:45:24 +00:00

fix(drafts): replace immutable mail with guarded recoverable updates

CI / tag-ancestry (pull_request) Successful in 2s

Details

CI / cargo (pull_request) Failing after 2m13s

Details

CI / docker (pull_request) Has been skipped

Details

0986fbb4d3

jlxq0 added 1 commit

2026-10-28 17:02:57 +00:00