diff --git a/docs/audits/evidence/mail-001/README.md b/docs/audits/evidence/mail-001/README.md index b8b9ff3..f4c6677 100644 --- a/docs/audits/evidence/mail-001/README.md +++ b/docs/audits/evidence/mail-001/README.md @@ -3,8 +3,9 @@ Updated: 2026-08-09 - Progress report: `docs/verification/mail-001-job-email-hub.md` -- Commands/results: `docs/audits/verification-log.md` V-126–V-128 +- Commands/results: `docs/audits/verification-log.md` V-126–V-130 - Hub/legacy-route tests: `job-tracker-ui/src/correspondence-inbox-page.test.tsx` - Reused review decision tests: `job-tracker-ui/src/gmail-review-page.test.tsx` -- Implementation commit: `6008b4a` +- Provider-neutral API tests: `JobTrackerApi.Tests/EmailControllerTests.cs` +- Implementation commits: `6008b4a`, `536d403` - Mocked provider data only; no real email, provider connection, private content, production service or external request was used. diff --git a/docs/audits/verification-log.md b/docs/audits/verification-log.md index 95d2bc2..903e6c3 100644 --- a/docs/audits/verification-log.md +++ b/docs/audits/verification-log.md @@ -160,3 +160,5 @@ Output was reduced to filenames and commit counts. The token artifact appears un | V-126 | Bounded `rg`/`Get-Content` of Phase 9 requirements, correspondence/Gmail routes/pages/shared job component, provider files/tests and architecture/audit reports | Repository root | Revalidate MAIL-001 duplicated navigation, domain ownership, provider and send boundaries | PASS/PARTIAL — inbox and Gmail review were separate routes; job workspace already reuses `Correspondence`; Gmail link/import is mature but provider-neutral hub state and explicit provider draft/send are not implemented | Source inspection only; no provider/account/email access | Confirmed product/domain gaps | | V-127 | `npm.cmd test -- --runInBand --forceExit src/correspondence-inbox-page.test.tsx src/gmail-review-page.test.tsx` | `job-tracker-ui` | Verify canonical hub views, review reuse, decisions and legacy redirect | PASS — 2 suites, 5/5 tests | Non-force run retained an open handle; force-exit run completed in 50.051s | Existing test-runtime limitation | | V-128 | `npm.cmd run build`; full `npm.cmd test -- --runInBand --forceExit`; `git diff --check` | `job-tracker-ui` / repository root | MAIL-001 route increment regression, TypeScript/build and patch hygiene | PASS — build; 49/49 suites and 186/186 tests; no whitespace errors | Full Jest took 228.709s and retained existing open-handle notice. One build process remained after compilation; exact task-owned PIDs were stopped and clean rerun passed | Environmental/tooling limitation | +| V-129 | Bounded `rg`/`Get-Content` of `IEmailProvider`, Gmail/Graph/IMAP services/scopes/controllers, correspondence model/controller and follow-up draft/send path | Repository root | Revalidate provider capabilities and every existing send boundary before MAIL-001 design | PASS/PARTIAL — the neutral provider seam is registered but previously consumed only by Gmail; all three mailbox contracts are read-only. Follow-up send bypasses connected providers through application SMTP, has no explicit confirmation/idempotency ledger, and logs a sent correspondence after a void sender call | Source inspection only; vulnerable/failed behavior was not relabeled as runtime reproduction. No provider, SMTP or email was invoked | Confirmed contract gaps plus external verification blocker | +| V-130 | `dotnet test ... --filter FullyQualifiedName~EmailControllerTests --no-restore`; focused hub/review Jest; full backend/frontend; `npm.cmd run build`; `git diff --check` | Repository root / `job-tracker-ui` | Verify owner-scoped neutral status/search/detail, honest read-only capability UI and regression/build hygiene | PASS — provider controller 3/3; hub/review 5/5; backend 604/604; frontend 49/49 suites and 186/186 tests; production build and patch check pass | Provider tests use fakes; frontend uses mocked provider data. Full Jest took 170.377s and retained its existing force-exit/open-handle notice | Browser/provider/production verification remains | diff --git a/docs/verification/mail-001-job-email-hub.md b/docs/verification/mail-001-job-email-hub.md index 831f1a3..41cfc2c 100644 --- a/docs/verification/mail-001-job-email-hub.md +++ b/docs/verification/mail-001-job-email-hub.md @@ -2,7 +2,7 @@ Updated: 2026-08-09 -Status: `IN PROGRESS`. Canonical hub routing is implemented and locally verified; provider/domain/draft-send work remains. +Status: `IN PROGRESS`. Canonical hub routing and provider-neutral read capability discovery are implemented and locally verified; provider actions and draft/send work remain. ## Revalidated current boundaries @@ -20,16 +20,24 @@ Status: `IN PROGRESS`. Canonical hub routing is implemented and locally verified - Switching to review does not issue the linked-correspondence query; switching views reuses the existing tested review component and APIs. - No provider connection, sync, import, link or send behavior changed. +## Implemented provider-neutral read increment + +- Added one authenticated `/api/email` controller over the existing `IEmailProviderRegistry` for provider status, search, thread summaries and plain-text message detail. +- Every operation passes the authenticated owner ID into the registered Gmail, Outlook or IMAP adapter and rejects unknown or disconnected providers before mailbox access. +- Message detail intentionally omits provider HTML. Untrusted provider markup is not exposed through this shared endpoint. +- The hub now identifies connected and disconnected providers and advertises their actual capability. Gmail, Outlook and IMAP are currently shown as read-only because their installed scopes/contracts do not implement provider send. +- The controller does not change OAuth scopes, connect accounts, invoke providers in tests or claim that the legacy SMTP follow-up sender is provider-native. + ## Verification -- Focused hub/review: 2 suites, 5/5 tests, including legacy redirect. -- Full frontend: 49/49 suites, 186/186 tests. +- Focused provider controller: 3/3 tests; focused hub/review: 2 suites, 5/5 tests. +- Full backend: 604/604; full frontend: 49/49 suites, 186/186 tests. - Production build/TypeScript and `git diff --check`: pass. -- Implementation commit: `6008b4a`. +- Implementation commits: `6008b4a`, `536d403`. ## Remaining MAIL-001 work -- Define one provider-neutral thread/list/detail view while preserving Gmail/Graph/IMAP capability differences. +- Use the provider-neutral thread/list/detail API in a shared hub/application message view while preserving provider capability differences. - Surface provider identity, reauthorization, read/unread, pin/read-later/archive/spam/trash only where the provider supports it. - Share thread detail and link/unlink actions between hub and job workspace. - Design editable provider drafts with recipient/subject/thread/provider review and explicit confirmed, idempotent send; uncertain failures must not be retried blindly. @@ -42,4 +50,4 @@ The first focused Jest invocation exhibited the repository's open-handle delay. ## Rollback -Revert `6008b4a`. Both underlying pages/APIs and persisted email/correspondence data remain unchanged; the legacy route returns to direct rendering. +Revert `536d403` to remove the provider-neutral API/status chips, then `6008b4a` to restore the separate route presentation. Persisted email/correspondence data and provider scopes remain unchanged. diff --git a/docs/work-programmes/decisions.md b/docs/work-programmes/decisions.md index 52ecf9f..02c29ae 100644 --- a/docs/work-programmes/decisions.md +++ b/docs/work-programmes/decisions.md @@ -379,3 +379,13 @@ - **Consequences:** existing links remain compatible and there is one user-facing hub. Provider-neutral thread state and explicit draft/send remain separate MAIL-001 increments and are not implied by this routing change. - **User approval required:** No; the product decision to consolidate and preserve route compatibility is explicit. - **Reversible:** Yes. Revert `6008b4a`; no persisted correspondence/provider data changes. + +## DEC-039 — Connected email capabilities are explicit and provider-neutral + +- **Date:** 2026-08-09 +- **Decision:** Consume the existing `IEmailProviderRegistry` through one owner-scoped read controller and expose provider status/search/thread/plain-text detail without changing scopes or adding a second provider abstraction. Report send as unavailable until a provider has an implemented, tested send contract. +- **Reason/evidence:** Gmail, Microsoft Graph and IMAP already implement the same read seam, but only Gmail consumed it and the hub could not state actual capabilities. Their current OAuth/service contracts are read-only. The separate follow-up action uses application SMTP and cannot honestly represent connected-provider send. +- **Alternatives considered:** copy Gmail controller behavior for each provider; claim SMTP as provider send; add speculative provider-action interfaces; broaden OAuth scopes before designing re-consent/audit/uncertain delivery; return untrusted HTML through the shared detail API. These duplicate logic, mislead users, widen privileges prematurely or create an unsafe rendering path. +- **Consequences:** the hub can truthfully identify connected Gmail/Outlook/IMAP accounts and a shared API exists for later UI composition. Provider-native state changes and send remain unavailable and must be introduced with capability flags, re-consent and delivery-state tests. Message detail returns plain text only. +- **User approval required:** No; this is a local, fake-tested repository increment within MAIL-001 and invokes no provider or email service. +- **Reversible:** Yes. Revert `536d403`; no schema, dependency, OAuth scope, provider token or persisted message changes. diff --git a/docs/work-programmes/master-progress.md b/docs/work-programmes/master-progress.md index 9135830..3e95acb 100644 --- a/docs/work-programmes/master-progress.md +++ b/docs/work-programmes/master-progress.md @@ -2,8 +2,8 @@ Updated: 2026-08-09 -- **Overall programme status:** Active. Six packages are locally verified; nineteen packages through CAREER-002 are implemented with automated/runtime evidence but blocked from applicable browser/provider/production gates; MAIL-001 is in progress. -- **Current work package:** `MAIL-001` — consolidated job-email hub and explicit sending (`IN PROGRESS`); canonical routing is pushed, and provider-neutral shared thread/detail plus explicit draft/send is next. +- **Overall programme status:** Active. Six packages are locally verified; nineteen packages through CAREER-002 are implemented with automated/runtime evidence but blocked from applicable browser/provider/production gates; MAIL-001 is in progress with two pushed increments. +- **Current work package:** `MAIL-001` — consolidated job-email hub and explicit sending (`IN PROGRESS`); canonical routing and an owner-scoped provider-neutral read API/status are pushed. Shared detail consumption and a safe provider-send ledger remain. - **Completed work packages:** None are `DONE`; all repository security/AI packages still have applicable browser, provider and/or production gates. - **Locally verified work:** SEC-001, SEC-002, SEC-003, SEC-005A, CORE-001 and PROD-002 (`VERIFIED LOCALLY`). - **Implemented, verification incomplete:** SEC-004, SEC-005B, SEC-008, CORE-002, BG-001, OPS-001A/B/C, POL-001/002, AI-001/002/003/004, UX-001/002, QA-001, CAREER-001 and CAREER-002 (`IMPLEMENTED — NOT VERIFIED`). CAREER-002 now protects unsaved edits and provides tested structured custom-entry, profile-override and preview-error interactions; all automated/build gates pass. @@ -12,10 +12,10 @@ Updated: 2026-08-09 - **Deferred work:** None. Conditional multi-replica coordination, model deletion, realtime operation delivery and unrelated production changes remain outside current packages. - **Next five work packages:** MAIL-001 consolidated email experience; JOBS-001 job-search/application redesign; HOME-001 homepage/Pro promotion; UX-003 authentication/profile polish; PRODUCT-001 homepage/Pro claims. SEC-006/007 resume after package-index permission. - **Status counts:** 6 `VERIFIED LOCALLY`; 19 `IMPLEMENTED — NOT VERIFIED`; 1 `IN PROGRESS`; 8 `NOT STARTED`; 5 `BLOCKED`; 0 `DONE`; 0 `DEFERRED`. -- **Test status:** backend 601/601; frontend 49/49 suites and 186/186 tests; MAIL-001 focused 5/5; CAREER-002 focused 17/17 and CAREER-001 16/16; production build and patch check pass. Jest open-handle/slow-run behavior is recorded in V-127/V-128. +- **Test status:** backend 604/604; frontend 49/49 suites and 186/186 tests; MAIL-001 provider controller 3/3 and hub/review 5/5; CAREER-002 focused 17/17 and CAREER-001 16/16; production build and patch check pass. Jest open-handle/slow-run behavior is recorded in V-127/V-128/V-130. - **Deployment status:** No deployment performed. No production migrations were run. AI operation worker remains disabled by default. - **Production status:** Unchanged and unverified. No provider/model call, model pull, external request or paid API occurred. -- **Known regressions:** None found by automated suites. Jest still needs `--forceExit` and reports its existing open-handle notice. Direct clean EF-only SQLite migration still hits the pre-existing historical blank-chain defect before later migrations; normal startup owns reconciliation. Cross-feature monthly AI usage accounting remains a rollout gap. +- **Known regressions:** None found by automated suites. Jest still needs `--forceExit` and reports its existing open-handle notice. Email-provider tests are fake/local only; no send capability is claimed. Direct clean EF-only SQLite migration still hits the pre-existing historical blank-chain defect before later migrations; normal startup owns reconciliation. Cross-feature monthly AI usage accounting remains a rollout gap. - **Outstanding security findings:** JT-001 repository ownership remains High deployment risk until migration/inventory/provider checks; production portion of JT-002; JT-006/JT-009 and associated JT-011/JT-012/JT-022 prerequisites. JT-005 foundations are implemented; AI worker activation awaits controlled rollout. JT-007/JT-008/JT-010 lack browser/provider/production verification. ## Current evidence diff --git a/docs/work-programmes/master-work-plan.md b/docs/work-programmes/master-work-plan.md index b1d7a23..3ac1cc5 100644 --- a/docs/work-programmes/master-work-plan.md +++ b/docs/work-programmes/master-work-plan.md @@ -651,9 +651,9 @@ Ordering differences from the suggested list: - **Required production verification:** provider read/draft/send requires explicit authorized synthetic account; never real unsolicited email. - **Status:** `IN PROGRESS`. - **Blocker:** real provider verification external; mocked/local implementation not blocked after dependencies. -- **Evidence:** `docs/verification/mail-001-job-email-hub.md`; V-126–V-128. Canonical hub/review/legacy redirect passes 5/5 focused, 49/49 suites and 186/186 full plus build. -- **Commit:** `6008b4a` (`feat(email): consolidate correspondence routes`) — first increment only. -- **Remaining work:** provider-neutral shared detail/state; reauth/capability actions; editable explicit/idempotent draft/send and audit; tenant/free/pro/application tests; browser/production. No real email; uncertain sends need manual reconciliation. +- **Evidence:** `docs/verification/mail-001-job-email-hub.md`; V-126–V-130. Canonical hub/review passes 5/5 focused; provider-neutral controller 3/3; backend 604/604; frontend 49/49 suites and 186/186 tests plus build. +- **Commit:** `6008b4a` (canonical hub) and `536d403` (provider-neutral owner-scoped read API/status). +- **Remaining work:** consume shared thread/detail in hub/application views; reauth/capability actions; editable explicit/idempotent provider draft/send and audit; tenant/free/pro/application tests; browser/production. Existing provider scopes are read-only and legacy follow-up uses application SMTP; do not mislabel either. No real email; uncertain sends need manual reconciliation. ### JOBS-001 — Job-search source and assessment redesign diff --git a/docs/work-programmes/session-handoff.md b/docs/work-programmes/session-handoff.md index cd4e6bb..04b2503 100644 --- a/docs/work-programmes/session-handoff.md +++ b/docs/work-programmes/session-handoff.md @@ -2,17 +2,17 @@ Updated: 2026-08-09 -- **Exact current task:** MAIL-001 — trace backend provider capabilities and every draft/send endpoint/audit/idempotency path, then design the provider-neutral shared thread/detail and explicit-send contract without sending real email. -- **Last completed step:** the canonical Job email hub and legacy Gmail-review redirect were committed/pushed as `6008b4a`. Linked and review views reuse existing APIs/components and pass focused/full/build gates. +- **Exact current task:** MAIL-001 — consume the new neutral read API in shared thread/detail UI, then design the explicit provider-send/re-consent/idempotency/uncertain-delivery ledger without sending real email. +- **Last completed step:** owner-scoped `/api/email` provider status/search/thread/plain-text detail and honest read-only hub status were committed/pushed as `536d403`; canonical hub routing remains `6008b4a`. - **Files currently modified:** MAIL-001 verification/log/master tracking documents only. Application code/tests are committed and pushed. -- **Commands already run:** Phase 9/frontend/provider/architecture/test trace; focused hub/review tests; full frontend; production build; diff review/check; exact hung task-owned Node cleanup; implementation commit/push. See V-126–V-128. -- **Test results:** MAIL-001 focused 2 suites/5 tests; frontend full 49/49 suites and 186/186 tests; production build/TypeScript and patch check pass. Jest required force exit and full run took 228.709s. +- **Commands already run:** Phase 9/provider architecture and complete legacy send trace; provider/controller and hub focused tests; full backend/frontend; production build; diff/secret review; implementation commit/push. See V-126–V-130. +- **Test results:** MAIL-001 provider controller 3/3; hub/review 5/5; backend 604/604; frontend 49/49 suites and 186/186 tests; production build/TypeScript and patch check pass. Full Jest required force exit and took 170.377s. - **Services currently running:** none started intentionally. Exact task-owned hung Jest/build Node processes were stopped; Codex browser runtimes were not touched. Pre-existing Docker services were not changed. - **Temporary files or processes:** none. No provider account, private email, external model, paid service or production service was accessed. - **Production changes currently active:** none. No deployment, migration, provider connection/sync/send or production payload occurred. -- **Rollback status:** revert `6008b4a` for hub routing; no schema/config/dependency/data migration. CAREER rollback records remain current. Production is unchanged. +- **Rollback status:** revert `536d403` for neutral API/status and `6008b4a` for hub routing; no schema/config/dependency/data migration. CAREER rollback records remain current. Production is unchanged. - **Uncommitted changes:** MAIL-001 evidence/tracking documents only; commit/push before the next application increment. -- **Known failures:** provider-neutral details/actions and explicit idempotent send remain; Gmail is the only mature review UI; real provider/SMTP/MariaDB/production unavailable; fresh browser session unavailable this turn; Jest open handles; SEC-006 needs internet/package-index permission; parser isolation remains SEC-007. -- **Exact next action:** commit/push MAIL-001 progress evidence, then inspect `GmailController`, Graph/IMAP controllers/services/models, `CorrespondenceController`, follow-up send endpoint and audit storage/tests; write a capability/send-state matrix before changing the domain. +- **Known failures:** shared thread/detail UI, provider state actions and explicit idempotent send remain; Gmail is the only mature review UI; Gmail/Graph OAuth scopes and the IMAP contract are read-only; legacy follow-up uses application SMTP without explicit confirmation/idempotency and must not be called provider send. Real provider/SMTP/MariaDB/production unavailable; Jest open handles; SEC-006 needs internet/package-index permission; parser isolation remains SEC-007. +- **Exact next action:** commit/push this evidence, then define the minimum provider-send contract and durable send-attempt states (confirmed, pending, sent, failed-before-delivery, uncertain) including OAuth scope/re-consent and duplicate-request behavior; implement only a fake-tested repository slice that cannot send real email. - **Work that can continue independently:** remaining MAIL-001 repository work and later UX packages. SEC-006/007 await package-index permission; PROD-001/003/004 await production access. - **Decisions still required from the user:** none for synthetic/code-inspected repository work. Any provider connection or send test, internet/package upgrades, private data, external/paid providers and production actions retain explicit approval/safety gates; SEC-009 retention/legal policy remains unresolved.