Fix: IMAP over SSL connected without TLS; never lose a sent message's copy

v1.3.26's IMAP4_SSL subclass put its create_client ahead of aioimaplib's,
which is where the TLS context is made — so port 993 got plain TCP, the
server waited for a handshake, and every SSL account timed out ("Can't
reach the mail server"). The context is now made in our create_client too,
and a test checks an SSL client really gets one (it fails without the fix).

With IMAP down, a send could still be delivered by SMTP while filing its copy
in Sent failed — the send then counted as done and the copy was lost. The
copy is now kept and filed by file_sent_copy_job, retried (arq Retry) for
about 24 hours, then shown in Sent as usual.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/tests/outbox/test_outbox.py

@@ -11,7 +11,9 @@ from datetime import UTC, datetime, timedelta
 from email.policy import default as default_policy
 
 import httpx
+import pytest
 import pytest_asyncio
+from arq import Retry
 from httpx import ASGITransport
 from sqlalchemy import delete, select
 from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
@@ -615,6 +617,24 @@ async def test_delivered_but_not_filed_counts_as_sent(ctx: Ctx, monkeypatch) ->
     await outbox_jobs.send_job({"job_try": 1}, str(oid))
     assert (await _outbox(ctx, oid)).state == "sent" and len(fake.sent) == 1
 
+    # The copy is not lost: kept, and a job files it once IMAP answers again.
+    args, _ = ctx.enqueued[-1]
+    assert args[0] == "file_sent_copy_job"
+    _, account_id, user_id, sha = args
+    with pytest.raises(Retry):  # still unreachable: tried again later
+        await outbox_jobs.file_sent_copy_job({"job_try": 1}, account_id, user_id, sha)
+    fake.append_error = None
+    await outbox_jobs.file_sent_copy_job({"job_try": 2}, account_id, user_id, sha)
+    assert fake.appended == ["Sent"]
+    ctx.session.expunge_all()
+    async with session_scope() as verify:
+        sent_msg = await verify.scalar(
+            select(Message)
+            .join(Mailbox, Mailbox.id == Message.mailbox_id)
+            .where(Mailbox.account_id == ctx.account_id, Mailbox.special_use == "sent")
+        )
+        assert sent_msg is not None and sent_msg.subject == "Re: Hi"
+
 
 async def test_two_jobs_for_one_send_send_once(ctx: Ctx, monkeypatch) -> None:  # type: ignore[no-untyped-def]
     oid = await _make_outbox(ctx, state="retrying")

backend/tests/sync/test_account_health.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import contextlib
 import uuid
 from collections.abc import AsyncIterator
 
@@ -125,3 +126,27 @@ async def test_refused_sign_in_stops_syncing(account_id: uuid.UUID) -> None:
     await health.failed(ProviderAuthError("AUTHENTICATIONFAILED"))
     account = await _account(account_id)
     assert account.state == "auth_failed" and "AUTHENTICATIONFAILED" in account.state_detail
+
+
+async def test_ssl_connections_really_use_tls(monkeypatch) -> None:  # type: ignore[no-untyped-def]
+    """Regression (v1.3.26): our IMAP4_SSL subclass skipped aioimaplib's TLS
+    setup, so port 993 got plain TCP and every account timed out."""
+    import asyncio
+    import ssl
+
+    from app.providers.imap_smtp.provider import _IMAP4, _IMAP4_SSL
+
+    seen: list[object] = []
+    loop = asyncio.get_running_loop()
+
+    async def fake_create_connection(factory, host, port, ssl=None):  # type: ignore[no-untyped-def]
+        seen.append(ssl)
+        raise ConnectionRefusedError
+
+    monkeypatch.setattr(loop, "create_connection", fake_create_connection)
+    for cls in (_IMAP4_SSL, _IMAP4):
+        client = cls(host="imap.example.com", port=993, timeout=1)
+        with contextlib.suppress(ConnectionRefusedError):
+            await client.connect_task
+    assert isinstance(seen[0], ssl.SSLContext)  # SSL: a TLS context
+    assert seen[1] is None  # plain / STARTTLS: none up front