ElyOffice/tasks/reviews/C12.1-r2.md

FAIL

1. crates/ely-mail-engine/src/imap.rs:60 — [P2] IMAP command refusals become successful empty results. async-imap's LIST and FETCH streams discard the tagged completion without checking its status. A server replying to LIST with NO [UNAVAILABLE] Mailbox listing temporarily unavailable makes mailboxes() return Ok([]); replying to UID FETCH with NO [UNAVAILABLE] Message store temporarily unavailable makes fetch() return Ok(None), falsely reporting a missing UID. Both lose the server's explanation and swallow an operation failure. Ensure the tagged completion is checked for NO/BAD before returning collected results, and cover refusals for both operations. Reproduced on Windows and Linux: imap_list_refusal_is_an_error, imap_fetch_refusal_is_an_error; .work/c12.1-r2-probe.log, .work/c12.1-r2-linux-probe.log.

2. crates/ely-mail-engine/src/imap.rs:44 — [P2] BYE explanations are still discarded during authentication. The round 1 greeting scenario is fixed, but after a normal greeting, a server answering LOGIN with * BYE [UNAVAILABLE] Too many simultaneous connections and closing produces only cannot connect: peer closed connection without sending TLS close_notify. async-imap ignores the untagged BYE while waiting for a tagged completion. This still violates C12.1's requirement to preserve server wording on failure. Propagate BYE and its explanation through authentication and command response handling, rather than handling it only as the initial greeting; add regression coverage after authentication starts. Reproduced on both platforms: imap_login_bye_keeps_server_words, the two probe logs above.

3. crates/ely-mail-engine/src/smtp.rs:131 — [P2] Envelope validation rejects valid quoted mailbox addresses. For example, sending to "bo smith"@example.com returns Error::Invalid before any transaction, so that recipient cannot receive mail through this engine. Spaces inside a quoted local part are permitted by RFC 5321 §4.1.2. Validate SMTP mailbox grammar with quoting awareness while retaining command-injection protection, and test valid quoted senders and recipients alongside the injection cases. Reproduced on both platforms: smtp_accepts_a_quoted_local_part, the two probe logs above.

4. crates/ely-mail-engine/src/smtp.rs:82 — [P2] SMTP DATA omits dot stuffing on the first line. A valid message beginning with the optional header .X-Trace: yes is transmitted with that single initial period, whereas subsequent dot-prefixed lines are escaped. A conforming receiver removes the period and changes the header name: RFC 5321 §4.5.2 requires escaping each dot-prefixed line, and RFC 5322 §3.6.8 permits this header name. The selected mail-send writer only escapes dots following CR/LF. Correct the transparency handling at the first byte as well, and test the exact DATA bytes of a message starting with a period. Reproduced on both platforms: smtp_stuffs_a_dot_in_the_first_data_line, the two probe logs above.