feat(2): Q4.9 mailu — recipe_meta + health + 3 functional (create-mailbox/imap-login/mail-flow); P4 N/A deferred

mailu (full email stack). TLS_FLAVOR=notls avoids certdumper/ACME dep (cc-ci file-provider cert); MAIL_DOMAIN/HOSTNAMES=run domain; TRAEFIK_STACK_NAME for the letsencrypt-volume mount. P2 vacuous (no corpus). P3: test_mailbox (flask mailu user create + config-export read-back), test_imap_login (mailbox authenticates over dovecot IMAP:143), test_mail_flow (SMTP submission send → IMAP retrieve, auth to avoid greylisting). P4 N/A (no backupbot label) — DEFERRED.md + PARITY.md, Adversary §7.1 sign-off pending. Smoke-validated: 8 services converge, mail ports 25/587/143/993 host-open, flask CLI. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-05-29 21:13:56 +01:00
parent 3ab04cd07a
commit 916bdd8b68
8 changed files with 329 additions and 0 deletions
@@ -0,0 +1,49 @@
+"""mailu — recipe-specific functional test #2 (Phase 2 P3, distinctive: working IMAP mailbox).
+
+Beyond "the row exists in config" (test_mailbox), this proves the provisioned mailbox is a REAL,
+usable IMAP account: it authenticates against dovecot over IMAP (port 143, host-published) and can
+SELECT its INBOX. That exercises mailu's actual mail-account stack (admin provisioning → dovecot auth
+backend), not just the admin DB. notls deploy → plain IMAP on 143. Hard assertion, non-vacuous: wrong
+credentials / a non-working account fail the login.
+"""
+
+from __future__ import annotations
+
+import imaplib
+import os
+import sys
+import time
+import uuid
+
+sys.path.insert(0, os.path.dirname(__file__))
+import _mailu  # noqa: E402
+
+
+def test_created_mailbox_authenticates_over_imap(live_app):
+    mail_domain = live_app
+    local = "ccci-imap-" + uuid.uuid4().hex[:8]
+    password = "CcCi-" + uuid.uuid4().hex[:16] + "-Aa1!"
+    _mailu.ensure_domain(live_app, mail_domain)
+    email = _mailu.create_user(live_app, local, mail_domain, password)
+
+    # The account may take a moment to be usable by dovecot after admin provisioning; retry login.
+    deadline = time.time() + 90
+    last_err = None
+    while time.time() < deadline:
+        try:
+            imap = imaplib.IMAP4("127.0.0.1", 143)
+            try:
+                imap.login(email, password)
+                typ, _ = imap.select("INBOX")
+                assert typ == "OK", f"IMAP SELECT INBOX returned {typ} for {email}"
+                imap.logout()
+                return  # authenticated + selected INBOX → working mailbox
+            finally:
+                try:
+                    imap.shutdown()
+                except Exception:  # noqa: BLE001
+                    pass
+        except (imaplib.IMAP4.error, OSError) as e:  # noqa: PERF203
+            last_err = e
+            time.sleep(5)
+    raise AssertionError(f"created mailbox {email} could not authenticate over IMAP:143 — {last_err}")