fix(imap): resolve mailbox selector contexts server-side

[BillLeoutsakosvl346]

Stacked on #7095. Review the diff against the PR1 branch. Do not merge until #7095 lands and this PR is rebased and retargeted to staging.

Summary

• Migrate the IMAP Mailbox selector to PR1's authorized server-side context resolver.
• Resolve host, port, TLS, username, and password only after workflow authorization.
• Split wire acceptance from resolved coercion/validation and suppress DNS logging for secret-derived host values.
• Keep IMAP route, contract, validation option, selector wiring, and behavior-focused tests isolated in this PR.

Security behavior

• Successful personal/workspace environment mutations invalidate mounted selector, canvas-label, and workflow-search caches through PR1, so an unchanged {{KEY}} refetches without exposing its value.
• IMAP direct-secret selectors require an authorized active workflow.
• The browser sends literals or exact references; resolved credentials remain server-only.
• Missing and inaccessible references return the same sanitized error and short-circuit before IMAP client construction.
• Secret-derived host validation avoids logging resolved host plaintext.
• Query keys contain opaque dependency revisions rather than connection plaintext.

Focused coverage

• Server resolution of host, port, TLS, username, and password.
• Wire/resolved validation and coercion.
• Inaccessible-reference, DNS, and provider short-circuiting.
• Sanitized connection failures, cleanup, mailbox mapping, and concise base-key privacy.

Verification

• Provider-focused Vitest: 3 files, 13 tests passed.
• App type-check passed.
• Root lint/format, strict API validation, client-boundary, React Query, and git diff --check passed on the combined stack.
• Combined full repository tests passed: 19/19 tasks; app 2,365 files passed, 3 skipped; 34,824 tests passed, 46 skipped.
• Combined focused selector suite: 28 files, 153 tests passed.
• All ten pairwise child diff intersections are empty.

Browser verification

• After the freshness restack, a combined Jira smoke confirmed exact raw references still reach dedicated selector routes and provider/authorization failures stay sanitized. The exact mounted same-reference mutation is covered by PR1's real QueryClient regression because this local account cannot edit Secrets through the UI.
• A disposable IMAP workflow selector preserved literal, personal-reference, and shared-reference host, port, username, and password values; the password remained masked.
• Each input family reached the selector route and returned sanitized failures without echoing reference-derived values. TLS exact-reference coercion remains covered by route/contract tests.
• No secret-derived DNS or connection value appeared in server logs.
• The disposable workflow was deleted afterward.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 27, 2026 12:31am

[greptile-apps]

Greptile Summary

The PR migrates the IMAP mailbox selector to authenticated, workflow-authorized server-side context resolution.

• Keeps raw literals and exact references in the browser request while resolving credentials only on the server.
• Separates wire validation from resolved IMAP value coercion and validation.
• Scopes selector cache keys without exposing connection plaintext and suppresses secret-derived DNS details in logs.
• Adds focused contract, provider, authorization, sanitization, and cleanup coverage.

Confidence Score: 5/5

The PR appears safe to merge after its stated prerequisite PR lands and the branch is rebased and retargeted.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/app/api/tools/imap/mailboxes/route.ts	Authenticates and authorizes the workflow before resolving, validating, and using server-only IMAP connection values.
apps/sim/hooks/selectors/providers/imap/selectors.ts	Marks all connection fields for server resolution and uses workflow-scoped opaque cache-key context.
apps/sim/lib/api/contracts/tools/imap.ts	Separates permissive wire representations from coercion and validation of resolved IMAP values.
apps/sim/lib/core/security/input-validation.server.ts	Adds an option to suppress sensitive host details while preserving DNS validation behavior.
apps/sim/app/api/tools/imap/mailboxes/server-resolved-selector.test.ts	Covers authorization ordering, context resolution, short-circuiting, sanitized failures, mailbox mapping, and cleanup.
apps/sim/hooks/selectors/providers/imap/server-resolved-context.test.ts	Verifies raw-reference forwarding, workflow requirements, server-resolved fields, and base-key privacy.
apps/sim/lib/api/contracts/tools/imap.server-resolved.test.ts	Verifies wire acceptance and resolved port and TLS coercion behavior.

Sequence Diagram

sequenceDiagram
  participant UI as IMAP Selector
  participant API as Mailboxes Route
  participant Auth as Selector Authorization
  participant Resolver as Context Resolver
  participant DNS as Host Validation
  participant IMAP as IMAP Server

  UI->>API: workflowId + literals/exact references
  API->>Auth: Authenticate request
  Auth-->>API: Authorized principal
  API->>Resolver: Resolve context within workflow
  Resolver-->>API: Resolved connection fields
  API->>DNS: Validate and pin host
  DNS-->>API: Approved IP
  API->>IMAP: Connect with resolved credentials
  IMAP-->>API: Mailboxes
  API-->>UI: Sanitized mailbox options

Loading

_{Reviews (2): Last reviewed commit: "fix(imap): resolve mailbox selector cont..." | Re-trigger Greptile}

[cubic-dev-ai]

No issues found across 7 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[BillLeoutsakosvl346]

@greptileai

[BillLeoutsakosvl346]

Closing this stacked implementation while we investigate a provider-agnostic server-side selector gateway. The branches are being preserved for reference and recovery; this PR is superseded by the architecture investigation, not merged.