filter: WHERE 'account =' condition matches folder_id, not account_id #181

New Issue

2026-07-27T13:30:22Z

KofTwentyTwo commented

2026-07-27 13:30:22 +00:00

(Migrated from github.com)

Found during the 3.A review (#177).

In crates/nuncio-filter/src/engine.rs, eval_leaf's handling of
FilterField::Account reads email.folder_id, not email.account_id. So an
NSQL WHERE-clause predicate like account = 'acct-a' silently matches
against the folder id instead of the account id.

This is distinct from the rule-level ON ACCOUNT scoping fixed in #177 (that
gates which account a whole rule applies to). This is the account condition
field inside a WHERE clause pointing at the wrong Email field.

AC

FilterField::Account evaluates against email.account_id.
Regression test: WHERE account = '<id>' matches only messages of that
account and not messages that merely share a folder id.
cargo verify green.

Found during the 3.A review (#177). In `crates/nuncio-filter/src/engine.rs`, `eval_leaf`'s handling of `FilterField::Account` reads `email.folder_id`, not `email.account_id`. So an NSQL **WHERE-clause** predicate like `account = 'acct-a'` silently matches against the folder id instead of the account id. This is distinct from the rule-level `ON ACCOUNT` scoping fixed in #177 (that gates which account a whole rule applies to). This is the `account` *condition field* inside a WHERE clause pointing at the wrong `Email` field. ### AC - [ ] `FilterField::Account` evaluates against `email.account_id`. - [ ] Regression test: `WHERE account = '<id>'` matches only messages of that account and not messages that merely share a folder id. - [ ] `cargo verify` green.

KofTwentyTwo commented

2026-07-28 14:06:09 +00:00

(Migrated from github.com)

Superseded by #191 (M4) in the roadmap restructuring (milestones M1–M7). The replacement story carries the full, self-contained spec for a remote implementer. See docs/ROADMAP.md, docs/STORY-WORKFLOW.md, docs/HANDOFF.md.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/nuncio#181