docs(email): record draft API evidence

2026-08-10 10:06:58 +02:00
parent a9bb22e530
commit 108440d361
6 changed files with 32 additions and 13 deletions
@@ -2,7 +2,7 @@

 Updated: 2026-08-10

-Status: `IN PROGRESS`. Canonical hub routing, provider-neutral reads, explicit-confirmed send API, editable reply UI, interrupted-send recovery, legacy SMTP retirement, send-attempt/draft export coverage, shared application context and inert tenant-owned draft persistence are implemented and locally verified; remaining draft API/UI, provider actions and full account-deletion lifecycle remain.
+Status: `IN PROGRESS`. Canonical hub routing, provider-neutral reads, explicit-confirmed send API, editable reply UI, interrupted-send recovery, legacy SMTP retirement, send-attempt/draft export coverage, shared application context and tenant-owned draft persistence/API are implemented and locally verified; remaining draft UI, provider actions and full account-deletion lifecycle remain.

 ## Revalidated current boundaries

@@ -151,12 +151,20 @@ Status: `IN PROGRESS`. Canonical hub routing, provider-neutral reads, explicit-c
 - Focused export tests pass 4/4 and the full backend remains 625/625. No new public route, log, provider call or browser storage was added.
 - Daily files inherit the existing export-folder protection and retention boundary. Complete live/export/backup deletion and retention remain SEC-009 work, not an implied guarantee from MAIL-001.

+## Implemented bounded draft API
+
+- Added local-authenticated list/get/create/update/delete routes under `/api/email/drafts`; all queries use the authenticated owner and the global tenant filter.
+- Creation requires an owned job and registered provider but permits empty recipient/subject/body for incomplete autosave. Fields remain bounded, a non-empty recipient must be valid, and provider/thread/job provenance cannot be rewritten after creation.
+- Updates and deletes require the caller's current revision and execute atomically; stale writes return a reload conflict rather than silently overwriting newer content.
+- Real-SQLite tests cover foreign job creation, direct foreign IDs, foreign list/update/delete attempts, stale updates/deletes and preservation of the other tenant. Focused 4/4, backend 629/629 and build pass.
+- Saving a draft never calls a provider or send path. Delivery still requires the separate connected/send-capable, explicit-confirmed, idempotent API.
+
 ## Remaining MAIL-001 work

 - Extend shared provider-neutral thread navigation while preserving provider capability differences; application context and Gmail unlink are now shared.
 - Add read/unread, pin/read-later/archive/spam/trash only where the provider supports it; identity, disconnected/read-only/send-capable and provider-status failure states are now explicit.
 - Share thread detail and link/unlink actions between hub and job workspace.
- Add a bounded owner/job-validating draft API, refresh recovery and compose-new-message behavior on top of the persistence/export model; replies are implemented.
+- Add refresh recovery and compose-new-message UI on top of the bounded persistence/export/API model; replies are implemented.
 - Complete account deletion coverage under SEC-009 before production rollout; job-level hard-delete cascade and export coverage are verified.
 - Preserve minimal audit metadata without sensitive body logging. Free non-AI access is verified; future AI assistance remains a Pro/privacy-gated addition, not a prerequisite for basic email.
 - Complete remaining link/unlink/dismiss/draft/send/failure/two-user browser/production provider gates. Shared application-context behavior is now covered locally. No real email may be sent during repository verification.