1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
|
package main
// Drafts.
//
// A draft is a message being written. Most are replies, and those derive their
// recipients, subject and threading from the message being answered; a draft
// with no parent is a new mail, and differs only in having nothing to derive
// them from. It is the first thing mailweb stores that did not come off the
// IMAP server, and the difference matters: the mirror is derived and can be
// thrown away and re-fetched, whereas a draft is the only copy of something the
// account owner wrote. So drafts live in their own tables, nothing that
// reconciles the mirror looks at them, and a draft outlives the message it
// answers.
//
// The shape is taken from blocks(1), which solves the same problem for prose: an
// ordered list of typed blocks, with the server owning the ordering. A draft is
// not one string because what goes on the wire is decided by what the blocks
// are — prose and quotes can be sent as text/plain, a code listing or an image
// cannot — and keeping the parts separate is what lets that be answered at send
// time rather than guessed while typing.
//
// Nothing here sends anything. Creating, editing and discarding a draft are
// inert: they touch this database and nothing leaves the machine, which is why
// they may be done by anything that can reach the listen address, including a
// model reading through the text rendering. Sending is a separate route and is
// the act. See "Composing without committing" in mailweb(7).
import (
"crypto/sha256"
"database/sql"
"encoding/hex"
"encoding/json"
"fmt"
"strings"
"time"
"codeberg.org/Profpatsch/Profpatsch/users/Profpatsch/mailtext"
)
// ============================================================================
// Block kinds
// ============================================================================
// The kinds a draft block may have. Each answers a different question about how
// the content survives being turned into mail:
//
// - text is prose, and may be reflowed.
// - quote is a passage of the message being answered, and is marked as
// somebody else's words wherever it is rendered.
// - code is a listing, and must not be reflowed, wrapped or reindented —
// which is precisely what plain-text mail does to it, and why a draft
// containing one is sent as MIME rather than as text/plain.
// - image is an inline illustration, carried as a related part.
// - file is an attachment: bytes enclosed beside the message rather than
// part of it. It contributes nothing to either body rendering, which is
// the whole difference between it and an image.
const (
blockText = "text"
blockQuote = "quote"
blockCode = "code"
blockImage = "image"
blockFile = "file"
)
// validBlockKinds gates what the HTTP layer may write into draft_blocks.kind,
// so a typo in a request cannot create a block no renderer knows about — the
// same guard blocks(1) puts on its own kinds.
//
// blockFile is deliberately absent. Every other kind is empty when created and
// filled in afterwards, which is exactly what a file block must not be: it is
// the asset that gives it meaning, and a file block with no bytes would render
// as an attachment nobody can open. It is created by the upload route, in the
// same transaction as its asset, and by nothing else. See addFileBlock.
var validBlockKinds = map[string]bool{
blockText: true,
blockQuote: true,
blockCode: true,
blockImage: true,
}
// needsRichFormat reports whether a block cannot be represented faithfully in
// a plain-text mail.
//
// This is the whole of the format decision, in one place. Prose and quotes
// survive plain text — that is what plain text is for — while a code listing
// depends on its own whitespace and an image is not text at all. A draft
// containing either is therefore sent as multipart/alternative, with the plain
// rendering still generated alongside for readers who want it.
//
// An attachment is not here, and that is the point of the distinction: it does
// not damage a plain-text body because it is not in the body at all. It is
// enclosed beside it, which is what multipart/mixed says and what
// isAttachmentKind decides.
func needsRichFormat(kind string) bool {
return kind == blockCode || kind == blockImage
}
// isAttachmentKind reports whether a block is carried beside the body rather
// than rendered into it.
func isAttachmentKind(kind string) bool {
return kind == blockFile
}
// ============================================================================
// Recipient sets
// ============================================================================
// The named sets of addresses a draft may be sent to.
//
// The first three are derived from the message being answered, resolved once
// when the draft is created and never recomputed. They are named rather than
// being a free recipient field because the choice a reply actually presents is
// not "which addresses" but "which of these three conversations am I
// answering" — the sender, everybody who was on it, or the list. Naming them
// lets the send button say which one it is about to do, and lets the addresses
// be shown in full underneath.
//
// setEntered is the fourth and is different in kind: nobody derived it, the
// account owner typed it. It exists because the derived sets can only ever
// reach somebody already in a thread, so without it there is no way to write to
// an address that has never written here — which is most of the addresses one
// needs to write to, and was the reason a new mail could not be composed at
// all.
//
// It does not weaken the rule that the sending route will not take an address
// from the request. That rule is about sending; entering a recipient is inert,
// exactly as composing is: it writes a row on this machine, the draft page then
// shows the address in full beside every other, and sending still names a *set*
// rather than an address. What the rule forbids is an address used without
// anybody having read it, and one stored, displayed and then chosen by name has
// been read. See "Choosing who a draft goes to" in mailweb(7).
const (
setSender = "sender" // whoever the reply goes back to: Reply-To, else From
setAll = "all" // the sender plus everyone in To and Cc
setList = "list" // the mailing list, from List-Post
setEntered = "entered" // addresses the account owner wrote by hand
)
// derivedSets are the sets that come out of the message being answered. They
// are read-only for the life of the draft: recomputing them at send time is
// what "Choosing who a draft goes to" rules out, and letting a request edit
// them would be the same failure by another route — the label a person read
// would stop describing the rows the envelope is built from.
var derivedSets = map[string]bool{
setSender: true,
setAll: true,
setList: true,
}
// Recipient kinds within a set: which header an address goes into.
const (
rcptTo = "to"
rcptCc = "cc"
)
// recipientSet is one candidate answer to "who does this go to".
type recipientSet struct {
// Name is one of setSender, setAll, setList.
Name string
// To and Cc are the addresses, already parsed. A set that survived loading
// contains only addresses that parsed as addresses.
To []Recipient
Cc []Recipient
}
// Count is how many addresses the set names in total, which is the number the
// send button leads with: a reply going to nine people should say nine before
// it says anything else.
func (s recipientSet) Count() int { return len(s.To) + len(s.Cc) }
// Empty reports whether the set names nobody, in which case no button for it is
// offered — a message with no List-Post has no list to reply to.
func (s recipientSet) Empty() bool { return s.Count() == 0 }
// ============================================================================
// Types
// ============================================================================
// draft is a reply being written.
type draft struct {
ID int64
Token string
// ParentID is the message being answered, 0 when that message has since
// been expunged from the mirror. A draft outlives its parent: everything it
// needs was copied out at creation.
ParentID int64
// ParentGone records that the draft names a parent the mirror no longer
// holds, so a view can say so rather than silently showing no context.
ParentGone bool
Subject string
InReplyTo string
References string
CreatedAt time.Time
UpdatedAt time.Time
SentAt *time.Time
SentMsgID string
Blocks []draftBlock
Recipients map[string]recipientSet
}
// Sent reports whether this draft has already gone out.
func (d draft) Sent() bool { return d.SentAt != nil }
// draftBlock is one entry in a draft's ordered contents.
type draftBlock struct {
ID int64
Position int
Kind string
Content string
Meta blockMeta
AssetID int64
// Asset is what AssetID names, without its bytes, filled in for file
// blocks when the draft is loaded. A file block whose asset is missing
// leaves this zero, and every renderer falls back to Content, which is the
// filename — the block still says what it was rather than vanishing.
Asset draftAsset
}
// HasAsset reports whether a file block's asset was found, which is what lets a
// view offer a link to the bytes rather than a link to a 404.
func (b draftBlock) HasAsset() bool { return b.Asset.ID != 0 }
// blockMeta is the per-kind extra data, stored as JSON so a new knob costs no
// migration — the same reasoning blocks(1) uses.
type blockMeta struct {
// Language is the syntax of a code block, "" to leave it unmarked.
Language string `json:"language,omitempty"`
// Attribution is the line introducing a quoted passage, as it will appear
// in the sent mail: "On <date>, <name> <addr> wrote:".
//
// It holds the name the sender gave themselves, never a petname. A petname
// is local by definition and must not travel, and this string is body text
// that goes out to everyone the reply is addressed to — mailing list
// included. Composing it with a petname would publish the account owner's
// private name for a correspondent to that correspondent and to strangers.
//
// It is stored rather than derived at send time so that a quote still says
// whose words it is after the parent has been expunged from the mirror.
//
// It is untrusted text: it came from a From: header. Every rendering puts
// it through the same escaping as any other quoted matter.
Attribution string `json:"attribution,omitempty"`
// QuoteFrom is the address the quoted passage came from, kept so that a
// *display* of this block can resolve it to a petname. What is shown and
// what is sent differ here on purpose: the reader should see the name they
// chose, the recipient must see the name their correspondent chose.
QuoteFrom string `json:"quote_from,omitempty"`
// QuoteName is the display name that came with QuoteFrom, so a draft whose
// parent has since been expunged can still show the claimed name to a
// reader who assigned no petname. Untrusted, like every claimed name.
QuoteName string `json:"quote_name,omitempty"`
// Alt is an image's accessible description.
Alt string `json:"alt,omitempty"`
}
// RichFormat reports whether this draft's *body* must be MIME rather than
// plain text, which is true as soon as it holds anything a plain-text mail
// would damage.
//
// Attachments do not count. They are enclosed beside the body and leave it
// exactly as it was, so a draft of prose with six photos attached still sends
// its prose as text/plain — inside a multipart/mixed. See HasAttachments.
func (d draft) RichFormat() bool {
for _, b := range d.Blocks {
if needsRichFormat(b.Kind) {
return true
}
}
return false
}
// HasAttachments reports whether anything is enclosed beside the body, which is
// what makes the message a multipart/mixed.
func (d draft) HasAttachments() bool {
for _, b := range d.Blocks {
if isAttachmentKind(b.Kind) {
return true
}
}
return false
}
// Attachments are the blocks carried beside the body, in order.
func (d draft) Attachments() []draftBlock {
var out []draftBlock
for _, b := range d.Blocks {
if isAttachmentKind(b.Kind) {
out = append(out, b)
}
}
return out
}
// WireFormat names the MIME structure this draft will be sent as, in the words
// the draft page and the text rendering both use.
//
// It is one function so that the two cannot describe the same draft
// differently, and it is derived from the blocks rather than chosen — the page
// states what will happen, it does not offer a setting.
func (d draft) WireFormat() string {
body := "text/plain"
if d.RichFormat() {
body = "multipart/alternative (text and HTML)"
}
if d.HasAttachments() {
return "multipart/mixed { " + body + ", attachments }"
}
return body
}
// ============================================================================
// Creating
// ============================================================================
// newDraftToken draws the token a draft is addressed by.
//
// Drafts are reachable by whoever can reach the listen address, and mailweb has
// no authentication, so a sequential id would let anything able to guess "2"
// read a half-written letter and press send on it. The token is drawn from the
// same primitive the text renderings use for their delimiters, so there is one
// place in this tree where that entropy is decided.
func newDraftToken() (string, error) {
return mailtext.NewToken()
}
// createDraft inserts a draft with its blocks and recipient sets in one
// transaction.
//
// All of it or none: a draft that existed with its blocks but without its
// recipients would render as a reply to nobody, and one with recipients but no
// blocks would offer to send an empty message. Neither is a state worth being
// able to reach.
func createDraft(db *sql.DB, d *draft) error {
token, err := newDraftToken()
if err != nil {
return fmt.Errorf("draft token: %w", err)
}
now := time.Now()
tx, err := db.Begin()
if err != nil {
return fmt.Errorf("begin: %w", err)
}
defer tx.Rollback()
var parent any
if d.ParentID != 0 {
parent = d.ParentID
}
res, err := tx.Exec(
`INSERT INTO drafts (token, parent_msg_id, subject, in_reply_to,
references_, created_at, updated_at)
VALUES (?,?,?,?,?,?,?)`,
token, parent, d.Subject, d.InReplyTo, d.References,
now.Unix(), now.Unix(),
)
if err != nil {
return fmt.Errorf("insert draft: %w", err)
}
id, err := res.LastInsertId()
if err != nil {
return fmt.Errorf("draft id: %w", err)
}
for i, b := range d.Blocks {
meta, err := json.Marshal(b.Meta)
if err != nil {
return fmt.Errorf("marshal block meta: %w", err)
}
if _, err := tx.Exec(
`INSERT INTO draft_blocks (draft_id, position, kind, content, meta)
VALUES (?,?,?,?,?)`,
id, i, b.Kind, b.Content, string(meta),
); err != nil {
return fmt.Errorf("insert block %d: %w", i, err)
}
}
for name, set := range d.Recipients {
if err := insertRecipientSet(tx, id, name, set); err != nil {
return err
}
}
if err := tx.Commit(); err != nil {
return fmt.Errorf("commit: %w", err)
}
d.ID, d.Token, d.CreatedAt, d.UpdatedAt = id, token, now, now
return nil
}
// insertRecipientSet writes one named set of addresses for a draft.
func insertRecipientSet(tx *sql.Tx, draftID int64, name string, set recipientSet) error {
write := func(kind string, rs []Recipient) error {
for i, r := range rs {
if _, err := tx.Exec(
`INSERT OR IGNORE INTO draft_recipients
(draft_id, set_name, kind, address, position)
VALUES (?,?,?,?,?)`,
draftID, name, kind, r.Address(), i,
); err != nil {
return fmt.Errorf("insert recipient %s/%s: %w", name, kind, err)
}
}
return nil
}
if err := write(rcptTo, set.To); err != nil {
return err
}
return write(rcptCc, set.Cc)
}
// ============================================================================
// Entered recipients
// ============================================================================
// addEnteredRecipient stores one address the account owner wrote by hand.
//
// The set name is hardcoded rather than taken from the caller, and that is the
// safety of the whole feature: no path through the HTTP layer can name
// 'sender', 'all' or 'list' here, so the derived sets stay exactly as they were
// resolved from the parent. A caller that wants to edit those has to write new
// SQL, which is a change somebody reviews rather than a parameter somebody
// passes.
//
// A Recipient is required rather than a string, so the address was parsed
// before it reached storage; see recipient.go.
func addEnteredRecipient(db *sql.DB, draftID int64, kind string, r Recipient) error {
if kind != rcptTo && kind != rcptCc {
return fmt.Errorf("unknown recipient kind %q", kind)
}
tx, err := db.Begin()
if err != nil {
return fmt.Errorf("begin: %w", err)
}
defer tx.Rollback()
// Position puts a new address at the end of its kind. It is computed here
// rather than being sent, for the reason the block positions are: the
// server owns the ordering.
var pos int
if err := tx.QueryRow(
`SELECT COUNT(*) FROM draft_recipients
WHERE draft_id = ? AND set_name = ? AND kind = ?`,
draftID, setEntered, kind,
).Scan(&pos); err != nil {
return fmt.Errorf("count entered recipients: %w", err)
}
// INSERT OR IGNORE: the primary key is (draft, set, kind, address), so
// entering the same address twice is a no-op rather than an error. Adding
// somebody who is already there is what a person does when they cannot
// remember whether they did, and the answer they want is "they are on it".
if _, err := tx.Exec(
`INSERT OR IGNORE INTO draft_recipients
(draft_id, set_name, kind, address, position)
VALUES (?,?,?,?,?)`,
draftID, setEntered, kind, r.Address(), pos,
); err != nil {
return fmt.Errorf("insert entered recipient: %w", err)
}
if err := touchDraft(tx, draftID); err != nil {
return err
}
return tx.Commit()
}
// removeEnteredRecipient drops one hand-entered address.
//
// Only from the entered set, for the same reason as above: a derived set
// records who the parent named, and a request that could delete from it would
// let the addresses be edited into something the label no longer describes.
// Removing an address that is not there succeeds — the caller wanted it gone,
// and it is.
func removeEnteredRecipient(db *sql.DB, draftID int64, kind, address string) error {
tx, err := db.Begin()
if err != nil {
return fmt.Errorf("begin: %w", err)
}
defer tx.Rollback()
if _, err := tx.Exec(
`DELETE FROM draft_recipients
WHERE draft_id = ? AND set_name = ? AND kind = ? AND address = ?`,
draftID, setEntered, kind, contactAddress(address),
); err != nil {
return fmt.Errorf("delete entered recipient: %w", err)
}
if err := touchDraft(tx, draftID); err != nil {
return err
}
return tx.Commit()
}
// ============================================================================
// Assets
// ============================================================================
// draftAsset is a file attached to a draft.
//
// Bytes is nil when the asset was loaded for listing rather than for sending:
// the draft page names every attachment and a message index may hold ten
// editors, so reading a few megabytes per row to print a filename is the one
// thing this type must make easy to avoid. loadDraftAsset fetches the bytes,
// loadDraftAssetMeta does not.
type draftAsset struct {
ID int64
Filename string
MimeType string
Size int64
SHA256 string
Bytes []byte
}
// addFileBlock stores an uploaded file and the block that carries it, in one
// transaction.
//
// The two are inseparable: a block with no asset renders as an attachment that
// cannot be opened, and an asset with no block is bytes nothing will ever send
// and nothing will ever delete. This is the only way either is created, which
// is why blockFile is not in validBlockKinds — the generic block route would
// make the first of those two states.
//
// The MIME type is passed in already decided by the caller from the bytes; see
// detectAssetType. Nothing here trusts what the request said it was uploading.
func addFileBlock(db *sql.DB, draftID int64, filename, mimeType string, data []byte) (int64, error) {
sum := sha256.Sum256(data)
now := time.Now()
tx, err := db.Begin()
if err != nil {
return 0, fmt.Errorf("begin: %w", err)
}
defer tx.Rollback()
res, err := tx.Exec(
`INSERT INTO draft_assets (draft_id, sha256, mime_type, filename, bytes, created_at)
VALUES (?,?,?,?,?,?)`,
draftID, hex.EncodeToString(sum[:]), mimeType, filename, data, now.Unix())
if err != nil {
return 0, fmt.Errorf("insert asset: %w", err)
}
assetID, err := res.LastInsertId()
if err != nil {
return 0, fmt.Errorf("asset id: %w", err)
}
var count int
if err := tx.QueryRow(
`SELECT COUNT(*) FROM draft_blocks WHERE draft_id = ?`, draftID,
).Scan(&count); err != nil {
return 0, fmt.Errorf("count blocks: %w", err)
}
// The content is the filename, so that a block still names what it carries
// if its asset is ever lost, and so the listing needs no join to say
// something true.
meta, err := json.Marshal(blockMeta{})
if err != nil {
return 0, fmt.Errorf("marshal meta: %w", err)
}
// Attachments go at the end, always. They are not prose and have no place
// in the middle of it; a file block between two paragraphs would suggest
// an ordering the recipient's client will not honour anyway, since an
// attachment is enclosed beside the body rather than positioned in it.
if _, err := tx.Exec(
`INSERT INTO draft_blocks (draft_id, position, kind, content, meta, asset_id)
VALUES (?,?,?,?,?,?)`,
draftID, count, blockFile, filename, string(meta), assetID,
); err != nil {
return 0, fmt.Errorf("insert file block: %w", err)
}
if err := touchDraft(tx, draftID); err != nil {
return 0, err
}
return assetID, tx.Commit()
}
// loadDraftAsset reads one asset with its bytes, scoped to its draft so an
// asset id from one draft cannot be fetched through another draft's URL.
func loadDraftAsset(db *sql.DB, draftID, assetID int64) (*draftAsset, error) {
var a draftAsset
err := db.QueryRow(
`SELECT id, filename, mime_type, sha256, bytes FROM draft_assets
WHERE id = ? AND draft_id = ?`, assetID, draftID,
).Scan(&a.ID, &a.Filename, &a.MimeType, &a.SHA256, &a.Bytes)
if err != nil {
return nil, err
}
a.Size = int64(len(a.Bytes))
return &a, nil
}
// draftAssetsSize is what a draft's attachments already amount to, which is
// what the per-draft cap is checked against.
//
// It is summed with SQL rather than by reading the blobs: the question is how
// many bytes are there, and answering it by fetching them would make the check
// cost what it is meant to prevent.
func draftAssetsSize(db *sql.DB, draftID int64) (int64, error) {
var total sql.NullInt64
if err := db.QueryRow(
`SELECT SUM(LENGTH(bytes)) FROM draft_assets WHERE draft_id = ?`, draftID,
).Scan(&total); err != nil {
return 0, fmt.Errorf("sum asset sizes: %w", err)
}
return total.Int64, nil
}
// loadDraftAssetMeta reads what a draft's assets are, without their bytes.
//
// Keyed by asset id so a block can find its own. This is what every render
// uses; see draftAsset for why the bytes are not in it.
func loadDraftAssetMeta(db *sql.DB, draftID int64) (map[int64]draftAsset, error) {
rows, err := db.Query(
`SELECT id, filename, mime_type, sha256, LENGTH(bytes)
FROM draft_assets WHERE draft_id = ? ORDER BY id`, draftID)
if err != nil {
return nil, fmt.Errorf("query assets: %w", err)
}
defer rows.Close()
out := make(map[int64]draftAsset)
for rows.Next() {
var a draftAsset
if err := rows.Scan(&a.ID, &a.Filename, &a.MimeType, &a.SHA256, &a.Size); err != nil {
return nil, fmt.Errorf("scan asset: %w", err)
}
out[a.ID] = a
}
return out, rows.Err()
}
// ============================================================================
// Loading
// ============================================================================
// loadDraft reads a draft by its token, with blocks and recipient sets.
//
// Returns sql.ErrNoRows when no such draft exists, which callers answer with a
// 404: a token that names nothing is indistinguishable from one that has been
// discarded, and both are "not here".
func loadDraft(db *sql.DB, token string) (*draft, error) {
var (
d draft
parent sql.NullInt64
created int64
updated int64
sentAt sql.NullInt64
sentMsgID sql.NullString
)
err := db.QueryRow(
`SELECT id, token, parent_msg_id, subject, in_reply_to, references_,
created_at, updated_at, sent_at, sent_message_id
FROM drafts WHERE token = ?`, token,
).Scan(&d.ID, &d.Token, &parent, &d.Subject, &d.InReplyTo, &d.References,
&created, &updated, &sentAt, &sentMsgID)
if err != nil {
return nil, err
}
d.CreatedAt = time.Unix(created, 0)
d.UpdatedAt = time.Unix(updated, 0)
d.SentMsgID = sentMsgID.String
if sentAt.Valid {
t := time.Unix(sentAt.Int64, 0)
d.SentAt = &t
}
// A parent that no longer resolves is reported as gone rather than as
// absent. The mirror deletes messages the server has expunged, and a reply
// whose context vanished should say that plainly — the alternative is a
// draft that looks as though it were never a reply to anything.
if parent.Valid {
d.ParentID = parent.Int64
var exists bool
if err := db.QueryRow(
`SELECT EXISTS (SELECT 1 FROM messages WHERE id = ?)`, d.ParentID,
).Scan(&exists); err != nil {
return nil, fmt.Errorf("check parent: %w", err)
}
d.ParentGone = !exists
}
if d.Blocks, err = loadDraftBlocks(db, d.ID); err != nil {
return nil, err
}
if d.Recipients, err = loadRecipientSets(db, d.ID); err != nil {
return nil, err
}
return &d, nil
}
// loadDraftBlocks reads a draft's blocks in order, with the metadata of any
// assets they carry.
//
// The asset bytes are deliberately not read. A draft with six photos is tens of
// megabytes, the index mounts an editor per message, and every one of those
// renders needs a filename and a size rather than a JPEG. The bytes are fetched
// by exactly two callers: the route that serves one asset, and the one that
// builds the message.
func loadDraftBlocks(db *sql.DB, draftID int64) ([]draftBlock, error) {
rows, err := db.Query(
`SELECT b.id, b.position, b.kind, b.content, b.meta,
COALESCE(b.asset_id, 0),
COALESCE(a.id, 0), COALESCE(a.filename, ''),
COALESCE(a.mime_type, ''), COALESCE(LENGTH(a.bytes), 0)
FROM draft_blocks b
LEFT JOIN draft_assets a ON a.id = b.asset_id
WHERE b.draft_id = ? ORDER BY b.position`, draftID)
if err != nil {
return nil, fmt.Errorf("query blocks: %w", err)
}
defer rows.Close()
var out []draftBlock
for rows.Next() {
var b draftBlock
var meta string
if err := rows.Scan(&b.ID, &b.Position, &b.Kind, &b.Content, &meta, &b.AssetID,
&b.Asset.ID, &b.Asset.Filename, &b.Asset.MimeType, &b.Asset.Size); err != nil {
return nil, fmt.Errorf("scan block: %w", err)
}
// A meta blob that will not parse costs the knobs, not the block: the
// content is what the account owner wrote and must not disappear
// because a JSON field went bad.
if err := json.Unmarshal([]byte(meta), &b.Meta); err != nil {
b.Meta = blockMeta{}
}
out = append(out, b)
}
return out, rows.Err()
}
// loadRecipientSets reads a draft's stored recipient sets.
//
// An address that no longer parses is dropped and the set is marked short of
// it, rather than being passed along: these rows were written by
// parseRecipient, so a row that fails now means the database was edited by
// hand, and the one thing that must not happen is a send to something nobody
// checked.
func loadRecipientSets(db *sql.DB, draftID int64) (map[string]recipientSet, error) {
rows, err := db.Query(
`SELECT set_name, kind, address FROM draft_recipients
WHERE draft_id = ? ORDER BY set_name, kind, position`, draftID)
if err != nil {
return nil, fmt.Errorf("query recipients: %w", err)
}
defer rows.Close()
out := make(map[string]recipientSet)
for rows.Next() {
var name, kind, address string
if err := rows.Scan(&name, &kind, &address); err != nil {
return nil, fmt.Errorf("scan recipient: %w", err)
}
r, err := parseRecipient(address)
if err != nil {
return nil, fmt.Errorf("stored recipient in set %q: %w", name, err)
}
set := out[name]
set.Name = name
if kind == rcptCc {
set.Cc = append(set.Cc, r)
} else {
set.To = append(set.To, r)
}
out[name] = set
}
return out, rows.Err()
}
// listDrafts returns the unsent drafts, most recently touched first.
func listDrafts(db *sql.DB) ([]draft, error) {
rows, err := db.Query(
`SELECT id, token, COALESCE(parent_msg_id, 0), subject, updated_at
FROM drafts WHERE sent_at IS NULL ORDER BY updated_at DESC`)
if err != nil {
return nil, fmt.Errorf("list drafts: %w", err)
}
defer rows.Close()
var out []draft
for rows.Next() {
var d draft
var updated int64
if err := rows.Scan(&d.ID, &d.Token, &d.ParentID, &d.Subject, &updated); err != nil {
return nil, fmt.Errorf("scan draft: %w", err)
}
d.UpdatedAt = time.Unix(updated, 0)
out = append(out, d)
}
return out, rows.Err()
}
// draftsByParent returns the unsent drafts written against each of the given
// messages, keyed by message id.
//
// The listings use it to show a reply already in progress beside the message it
// answers. Without it, pressing reply twice makes a second draft and neither
// page says the first exists — and since a draft is only reachable by its
// token, the forgotten one is then findable only through /drafts.
//
// Sent drafts are excluded: what they belong beside is the copy in the Sent
// mailbox, which the mirror already holds as a message of its own.
func draftsByParent(db *sql.DB, ids []int64) (map[int64][]draft, error) {
out := make(map[int64][]draft)
if len(ids) == 0 {
return out, nil
}
q := `SELECT id, token, parent_msg_id, subject, updated_at
FROM drafts
WHERE sent_at IS NULL AND parent_msg_id IN (` +
strings.TrimSuffix(strings.Repeat("?,", len(ids)), ",") +
`) ORDER BY updated_at DESC`
args := make([]any, len(ids))
for i, id := range ids {
args[i] = id
}
rows, err := db.Query(q, args...)
if err != nil {
return nil, fmt.Errorf("drafts by parent: %w", err)
}
defer rows.Close()
for rows.Next() {
var d draft
var updated int64
if err := rows.Scan(&d.ID, &d.Token, &d.ParentID, &d.Subject, &updated); err != nil {
return nil, fmt.Errorf("scan draft: %w", err)
}
d.UpdatedAt = time.Unix(updated, 0)
out[d.ParentID] = append(out[d.ParentID], d)
}
return out, rows.Err()
}
// ============================================================================
// Editing
// ============================================================================
// touchDraft records that a draft changed, which is what orders the listing.
func touchDraft(tx *sql.Tx, draftID int64) error {
_, err := tx.Exec(`UPDATE drafts SET updated_at = ? WHERE id = ?`,
time.Now().Unix(), draftID)
return err
}
// updateDraftSubject writes a draft's subject.
//
// Separate from the blocks because it is not one: the subject is a header, it
// is the one field of a reply that a client may already have overridden at
// creation, and being unable to correct it in a browser afterwards would be an
// odd gap in an editor that can rewrite every other part of the message.
func updateDraftSubject(db *sql.DB, draftID int64, subject string) error {
tx, err := db.Begin()
if err != nil {
return fmt.Errorf("begin: %w", err)
}
defer tx.Rollback()
if _, err := tx.Exec(
`UPDATE drafts SET subject = ? WHERE id = ?`, subject, draftID,
); err != nil {
return fmt.Errorf("update subject: %w", err)
}
if err := touchDraft(tx, draftID); err != nil {
return err
}
return tx.Commit()
}
// updateDraftBlock writes one block's content and meta.
func updateDraftBlock(db *sql.DB, draftID, blockID int64, content string, meta blockMeta) error {
raw, err := json.Marshal(meta)
if err != nil {
return fmt.Errorf("marshal meta: %w", err)
}
tx, err := db.Begin()
if err != nil {
return fmt.Errorf("begin: %w", err)
}
defer tx.Rollback()
// draft_id is in the WHERE clause so a block id from one draft cannot be
// edited through another draft's URL.
res, err := tx.Exec(
`UPDATE draft_blocks SET content = ?, meta = ?
WHERE id = ? AND draft_id = ?`,
content, string(raw), blockID, draftID)
if err != nil {
return fmt.Errorf("update block: %w", err)
}
if n, _ := res.RowsAffected(); n == 0 {
return sql.ErrNoRows
}
if err := touchDraft(tx, draftID); err != nil {
return err
}
return tx.Commit()
}
// addDraftBlock appends a block after the given position, or at the end when
// after is negative.
func addDraftBlock(db *sql.DB, draftID int64, kind string, after int) (int64, error) {
if !validBlockKinds[kind] {
return 0, fmt.Errorf("unknown block kind %q", kind)
}
tx, err := db.Begin()
if err != nil {
return 0, fmt.Errorf("begin: %w", err)
}
defer tx.Rollback()
var count int
if err := tx.QueryRow(
`SELECT COUNT(*) FROM draft_blocks WHERE draft_id = ?`, draftID,
).Scan(&count); err != nil {
return 0, fmt.Errorf("count blocks: %w", err)
}
pos := count
if after >= 0 && after+1 < count {
pos = after + 1
}
if _, err := tx.Exec(
`UPDATE draft_blocks SET position = position + 1
WHERE draft_id = ? AND position >= ?`, draftID, pos,
); err != nil {
return 0, fmt.Errorf("shift positions: %w", err)
}
res, err := tx.Exec(
`INSERT INTO draft_blocks (draft_id, position, kind, content, meta)
VALUES (?,?,?,'','{}')`, draftID, pos, kind)
if err != nil {
return 0, fmt.Errorf("insert block: %w", err)
}
id, err := res.LastInsertId()
if err != nil {
return 0, fmt.Errorf("block id: %w", err)
}
if err := touchDraft(tx, draftID); err != nil {
return 0, err
}
return id, tx.Commit()
}
// deleteDraftBlock removes a block and closes the gap it leaves.
//
// A file block takes its asset with it. Nothing else references an asset, so a
// block deleted without it would leave megabytes in the database that no page
// lists, no message sends and no deletion reaches — invisible except as a file
// that keeps growing.
func deleteDraftBlock(db *sql.DB, draftID, blockID int64) error {
tx, err := db.Begin()
if err != nil {
return fmt.Errorf("begin: %w", err)
}
defer tx.Rollback()
var pos int
var assetID int64
err = tx.QueryRow(
`SELECT position, COALESCE(asset_id, 0) FROM draft_blocks
WHERE id = ? AND draft_id = ?`,
blockID, draftID).Scan(&pos, &assetID)
if err != nil {
return err
}
if _, err := tx.Exec(
`DELETE FROM draft_blocks WHERE id = ? AND draft_id = ?`,
blockID, draftID); err != nil {
return fmt.Errorf("delete block: %w", err)
}
if assetID != 0 {
if _, err := tx.Exec(
`DELETE FROM draft_assets WHERE id = ? AND draft_id = ?`,
assetID, draftID); err != nil {
return fmt.Errorf("delete asset: %w", err)
}
}
if _, err := tx.Exec(
`UPDATE draft_blocks SET position = position - 1
WHERE draft_id = ? AND position > ?`, draftID, pos); err != nil {
return fmt.Errorf("close gap: %w", err)
}
if err := touchDraft(tx, draftID); err != nil {
return err
}
return tx.Commit()
}
// moveDraftBlock moves a block to a new position, renumbering the rest.
//
// The whole list is rewritten rather than the two affected rows patched,
// because that is what makes the result independent of what the client
// believed: positions come out dense and ordered whatever they were before.
func moveDraftBlock(db *sql.DB, draftID, blockID int64, to int) error {
tx, err := db.Begin()
if err != nil {
return fmt.Errorf("begin: %w", err)
}
defer tx.Rollback()
rows, err := tx.Query(
`SELECT id FROM draft_blocks WHERE draft_id = ? ORDER BY position`, draftID)
if err != nil {
return fmt.Errorf("query order: %w", err)
}
var ids []int64
for rows.Next() {
var id int64
if err := rows.Scan(&id); err != nil {
rows.Close()
return fmt.Errorf("scan id: %w", err)
}
ids = append(ids, id)
}
rows.Close()
if err := rows.Err(); err != nil {
return err
}
from := -1
for i, id := range ids {
if id == blockID {
from = i
break
}
}
if from < 0 {
return sql.ErrNoRows
}
if to < 0 {
to = 0
}
if to >= len(ids) {
to = len(ids) - 1
}
ids = append(ids[:from], ids[from+1:]...)
rest := append([]int64{}, ids[to:]...)
ids = append(append(ids[:to], blockID), rest...)
for i, id := range ids {
if _, err := tx.Exec(
`UPDATE draft_blocks SET position = ? WHERE id = ? AND draft_id = ?`,
i, id, draftID); err != nil {
return fmt.Errorf("renumber: %w", err)
}
}
if err := touchDraft(tx, draftID); err != nil {
return err
}
return tx.Commit()
}
// deleteDraft removes a draft and everything belonging to it.
//
// The children are deleted explicitly because SQLite enforces no foreign key
// unless a connection asks it to, and none here does — the same reason
// reconcileMailbox deletes header rows by hand. A REFERENCES clause in the
// schema is documentation; this is the deletion.
func deleteDraft(db *sql.DB, draftID int64) error {
tx, err := db.Begin()
if err != nil {
return fmt.Errorf("begin: %w", err)
}
defer tx.Rollback()
for _, stmt := range []string{
`DELETE FROM draft_blocks WHERE draft_id = ?`,
`DELETE FROM draft_assets WHERE draft_id = ?`,
`DELETE FROM draft_recipients WHERE draft_id = ?`,
`DELETE FROM drafts WHERE id = ?`,
} {
if _, err := tx.Exec(stmt, draftID); err != nil {
return fmt.Errorf("delete draft: %w", err)
}
}
return tx.Commit()
}
// markDraftSent records that a draft went out, and as what.
func markDraftSent(db *sql.DB, draftID int64, messageID string) error {
_, err := db.Exec(
`UPDATE drafts SET sent_at = ?, sent_message_id = ? WHERE id = ?`,
time.Now().Unix(), messageID, draftID)
return err
}
// ============================================================================
// Quoting
// ============================================================================
// quotePrefix is what a quoted line is prefixed with in a plain-text rendering.
const quotePrefix = "> "
// quoteText renders a quote block's content as quoted plain text, prefixing
// every line including the ones already quoted, exactly as a mail client does.
func quoteText(content string) string {
lines := strings.Split(strings.TrimRight(content, "\n"), "\n")
for i, line := range lines {
if line == "" {
// A bare ">" rather than "> " avoids trailing whitespace, which
// some transports strip and others flag.
lines[i] = strings.TrimRight(quotePrefix, " ")
continue
}
lines[i] = quotePrefix + line
}
return strings.Join(lines, "\n")
}
|