mesh-mail: byte-bounded fetch, accounts only to granted callers, grants error kept, secret only stat'ed (hq issue 733) #315

Merged

mesh-tools merged 2 commits from adr-359-mesh-mail-733 into main 2026-10-15 08:49:32 +00:00

Conversation 1 Commits 2 Files Changed 6

+216 -36

mesh-tools commented 2026-10-15 08:45:29 +00:00

Member

Copy Link

Copy Source

Issue 733. This replaces #305, which was independently reviewed and approved at be53f516.

#305 was based on adr-359-mesh-mail, the branch of #300. That branch was deleted when #300 was merged, and gitea refuses to move a PR's base, so this PR targets main instead. The only new commit since be53f516 is a normal merge of origin/main (b5417c2). There was no force-push and no other change.

Changes (as reviewed in #305)

1. A fetch is bounded by bytes. The keeper fetches RFC822.SIZE first, then bodies in batches of at most 64 MiB and 25 messages. A larger message is fetched alone, and the keeper logs that it was.
2. mail_accounts lists only the accounts the caller is granted. It says nothing of any other account: not its name, folders, counts, state or error text.
3. The reason grants could not be read is kept. Every refusal states it.
4. SecretGiven only stats the file. The watch never reads the password.

Each change has tests (see #305).

Checks at b5417c2

• go test -race passes.
• module check, with the controller built from mesh-controller main 20e58907, says mesh-mail: ok, 4 tool(s), ready: keep by unit every 30s; watch by its tool mail_health every 1m0s.
• merge-check.sh exits 0. The count of resources without health stays at 62, as kept.

Issue 733. This replaces #305, which was independently reviewed and approved at be53f516. #305 was based on `adr-359-mesh-mail`, the branch of #300. That branch was deleted when #300 was merged, and gitea refuses to move a PR's base, so this PR targets main instead. The only new commit since be53f516 is a normal merge of origin/main (b5417c2). There was no force-push and no other change. ## Changes (as reviewed in #305) 1. **A fetch is bounded by bytes.** The keeper fetches RFC822.SIZE first, then bodies in batches of at most 64 MiB and 25 messages. A larger message is fetched alone, and the keeper logs that it was. 2. **`mail_accounts` lists only the accounts the caller is granted.** It says nothing of any other account: not its name, folders, counts, state or error text. 3. **The reason `grants` could not be read is kept.** Every refusal states it. 4. **`SecretGiven` only stats the file.** The watch never reads the password. Each change has tests (see #305). ## Checks at b5417c2 - `go test -race` passes. - `module check`, with the controller built from mesh-controller main 20e58907, says `mesh-mail: ok, 4 tool(s), ready: keep by unit every 30s; watch by its tool mail_health every 1m0s`. - `merge-check.sh` exits 0. The count of resources without health stays at 62, as kept.

mesh-tools added 2 commits 2026-10-15 08:45:29 +00:00

mesh-mail: bound a fetch by bytes, show mail_accounts only to its grantees, say why grants are unread, judge a secret without reading it (hq issue 733) ... be53f5167a

The review of #300 found a batch of 25 whole messages could hold a gigabyte,
mail_accounts told ungranted callers folder names, counts and server errors,
an unreadable grants setting was refused without its reason, and the watch
read the password only to learn it was there.

Merge remote-tracking branch 'origin/main' into adr-359-mesh-mail-733 b5417c28d0

mesh-tools commented 2026-10-15 08:47:53 +00:00

Author

Member

Copy Link

Copy Source

Merge check at b5417c28
Judged: head b5417c28d026 merged into trunk 5f6a41146c3a; read beside it: mesh-controller 0b7e740b299c, mesh-controller-main 20e58907b0f8, mesh-host 198fd34ec497, mesh-tools 6b3e15042fee

• mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-mail)
• mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds mesh-mail, sent nowhere; no bus step

• tier 0: mesh-mail
• read by no module's build: modules/mesh-mail/cmd/mesh-mail/config_test.go, modules/mesh-mail/cmd/mesh-mail/imap_test.go, modules/mesh-mail/cmd/mesh-mail/tools_test.go

Run by the build seat on shanks as build-1792053931104179443 (builds --log build-1792053931104179443).

--- the gate: mesh-mail
mesh-mail: ok, 4 tool(s), ready: keep by unit every 30s; watch by its tool mail_health every 1m0s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-15T01:09:40Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-15T01:09:40Z

modules the change moves:
  - mesh-mail (added)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 0 module(s) in 0 tier(s)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.003s
words: 12 retired words and 70 daemons' lines, none in the 48145 strings of 737 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.013s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.013s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 62, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.205s
testing modules/mesh-mail
ok  	mesh-mail/cmd/mesh-mail	3.093s
--- its merge-check-typescript.sh (typescript toolchain)

**Merge check** at `b5417c28` Judged: head `b5417c28d026` merged into trunk `5f6a41146c3a`; read beside it: mesh-controller `0b7e740b299c`, mesh-controller-main `20e58907b0f8`, mesh-host `198fd34ec497`, mesh-tools `6b3e15042fee` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-mail) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds mesh-mail, sent nowhere; no bus step - tier 0: mesh-mail - read by no module's build: modules/mesh-mail/cmd/mesh-mail/config_test.go, modules/mesh-mail/cmd/mesh-mail/imap_test.go, modules/mesh-mail/cmd/mesh-mail/tools_test.go Run by the build seat on shanks as `build-1792053931104179443` (`builds --log build-1792053931104179443`). ``` --- the gate: mesh-mail mesh-mail: ok, 4 tool(s), ready: keep by unit every 30s; watch by its tool mail_health every 1m0s long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-15T01:09:40Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-15T01:09:40Z modules the change moves: - mesh-mail (added) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 0 module(s) in 0 tier(s) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.003s words: 12 retired words and 70 daemons' lines, none in the 48145 strings of 737 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.013s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/secrets 0.013s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 62, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.205s testing modules/mesh-mail ok mesh-mail/cmd/mesh-mail 3.093s --- its merge-check-typescript.sh (typescript toolchain) ```

mesh-tools merged commit 0914a33fba into main 2026-10-15 08:49:32 +00:00

mesh-tools deleted branch adr-359-mesh-mail-733 2026-10-15 08:49:33 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

mesh/ready

Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

jschoubben mesh-tools miel.truyen

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#315