mssql remaps a user only when orphaned; mailu's operator tool no longer re-enables

ALTER USER ... WITH LOGIN runs only when the user's SID is not the
login's, so an already-mapped user is left alone. The provisioner
enables a mailbox through its own method; the password tool an
operator uses keeps changing the password only.

modules/mailu/client.ts

@@ -127,8 +127,16 @@ export class MailuClient {
   }
 
   async changePassword(email: string, password: string): Promise<void> {
-    // enabled: a disabled mailbox is what the provisioner's check reports as lost, so applying the
-    // mesh's password again also enables it; otherwise the two would disagree for ever.
+    await this.api("PATCH", `/user/${encodeURIComponent(email)}`, { raw_password: password });
+  }
+
+  /**
+   * Set the mesh's password on a mailbox the mesh provisions, and enable it. A disabled mailbox is
+   * what the provisioner's check reports as lost, so applying again must enable it, or the two would
+   * disagree for ever. Separate from changePassword, which an operator's tool uses and which must
+   * not re-enable a mailbox someone disabled.
+   */
+  async applyProvisioned(email: string, password: string): Promise<void> {
     await this.api("PATCH", `/user/${encodeURIComponent(email)}`, { raw_password: password, enabled: true });
   }
 

modules/mailu/provisioner/index.ts

@@ -48,7 +48,7 @@ runProvisioner("smtp", {
     try {
       await mailu.createUser(email, p.password);
     } catch {
-      await mailu.changePassword(email, p.password);
+      await mailu.applyProvisioned(email, p.password);
     }
   },