store: unparseable stored account protocol silently coerces to ImapSmtp #426

New Issue

2026-08-15T01:32:24Z

KofTwentyTwo commented

2026-08-15 01:32:24 +00:00

(Migrated from github.com)

Found while fixing #271, deliberately left out of scope there.

`list_accounts` does `serde_json::from_str(&protocol_str).unwrap_or(AccountProtocol::ImapSmtp)`. An unrecognised or corrupted stored `protocol` discriminator is coerced to `ImapSmtp` rather than rejected — and the row is then read through the wrong columns for that account type, so the account comes back plausible and wrong with no error and no log line.

Same shape as #271 (which coerced an unparseable TLS mode to `ImplicitTls`) and sits a few lines from it. #271 now fails closed with `DatabaseError::Corrupted` naming the account, column and raw value; this should do the same.

Note the deliberate asymmetry established in #271: the salvage path in `recovery.rs` stays lenient because it has no caller to return an error to. Preserve that distinction.

Found while fixing #271, deliberately left out of scope there. \`list_accounts\` does \`serde_json::from_str(&protocol_str).unwrap_or(AccountProtocol::ImapSmtp)\`. An unrecognised or corrupted stored \`protocol\` discriminator is coerced to \`ImapSmtp\` rather than rejected — and the row is then read through the *wrong columns* for that account type, so the account comes back plausible and wrong with no error and no log line. Same shape as #271 (which coerced an unparseable TLS mode to \`ImplicitTls\`) and sits a few lines from it. #271 now fails closed with \`DatabaseError::Corrupted\` naming the account, column and raw value; this should do the same. Note the deliberate asymmetry established in #271: the salvage path in \`recovery.rs\` stays lenient because it has no caller to return an error to. Preserve that distinction.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/nuncio#426