fix: send offline edits after a restart and never to another account

The queue of offline edits (outbox) and the offline mail cache were
attached to an account only when the email store switched to it. A cold
start restores the view of the account it showed last, so there was no
switch: the queue from the last session was never loaded or sent, an
edit made meanwhile was dropped with a console warning, and the offline
cache neither stored nor served bodies.

On an account switch the queue was loaded and flushed right away,
before the new account's session was up and before the check for a
replaced server. The JMAP client still served the previous account
then, so queued edits could reach it.

- the email store attaches the outbox and the offline cache whenever it
  is pointed at an account, also the one it already shows
- the outbox holds its ops until the auth store resumes it, once the
  account's session is up and its server was checked; edits made before
  that are queued, and edits made while the queue loads are kept
- the JMAP client serves no account while it loads or signs in to
  another one; a failed switch puts the previous account and its queue
  back
- dropping an account's queue or cache for a replaced server cancels a
  read of it still under way
- the offline sync stops when the cache or the client moves to another
  account, instead of filing one account's mail under another

src/api/__tests__/jmap-client.test.ts

@@ -234,6 +234,55 @@ describe('JMAPClient', () => {
     });
   });
 
+  describe('loadAccount', () => {
+    const OTHER_SESSION: JMAPSession = {
+      ...MOCK_SESSION,
+      apiUrl: 'https://other.example.com/jmap/',
+      primaryAccounts: { 'urn:ietf:params:jmap:mail': 'acc-2' },
+      accounts: { 'acc-2': { name: 'other@example.com', isPersonal: true, isReadOnly: false } },
+    };
+
+    it('serves no account while the next one loads, then the new one', async () => {
+      global.fetch = mockFetch([{ status: 200, json: MOCK_SESSION }]) as any;
+      await client.connect('https://mail.example.com', 'user', 'pass');
+      (SecureStore.getItemAsync as any).mockResolvedValue(
+        JSON.stringify({ serverUrl: 'https://other.example.com', username: 'other', password: 'pw' }),
+      );
+      let respond!: (response: unknown) => void;
+      global.fetch = vi.fn(() => new Promise((resolve) => { respond = resolve; })) as any;
+
+      const loading = client.loadAccount('other@other.example.com');
+      // Before the stored credentials are even read: the stores already show
+      // the new account, and the old session must not serve its requests.
+      expect(client.isConnected).toBe(false);
+      await vi.waitFor(() => expect(global.fetch).toHaveBeenCalled());
+      expect(client.isConnected).toBe(false);
+      await expect(client.request([['Mailbox/get', { accountId: 'acc-1' }, '0']])).rejects.toThrow('Not connected');
+
+      respond({
+        ok: true, status: 200, statusText: 'OK', headers: { get: () => null },
+        json: async () => OTHER_SESSION, text: async () => JSON.stringify(OTHER_SESSION),
+      });
+      expect(await loading).toBe(true);
+      expect(client.isConnected).toBe(true);
+      expect(client.accountId).toBe('acc-2');
+    });
+
+    it('leaves the previous account to the snapshot when the next one cannot load', async () => {
+      global.fetch = mockFetch([{ status: 200, json: MOCK_SESSION }]) as any;
+      await client.connect('https://mail.example.com', 'user', 'pass');
+      const previous = client.snapshot();
+      (SecureStore.getItemAsync as any).mockResolvedValue(null);
+
+      expect(await client.loadAccount('gone@other.example.com')).toBe(false);
+      expect(client.isConnected).toBe(false);
+
+      client.restoreSnapshot(previous);
+      expect(client.isConnected).toBe(true);
+      expect(client.accountId).toBe('acc-1');
+    });
+  });
+
   describe('logout', () => {
     it('should clear session and stored credentials', async () => {
       global.fetch = mockFetch([{ status: 200, json: MOCK_SESSION }]) as any;

src/api/jmap-client.ts

@@ -251,6 +251,7 @@ export class JMAPClient {
     totp?: string,
   ): Promise<JMAPSession> {
     const baseUrl = serverUrl.replace(/\/+$/, '');
+    this.detachSession();
     if (totp) {
       return this.connectWithTotp(baseUrl, username, password, totp);
     }
@@ -299,6 +300,7 @@ export class JMAPClient {
 
   async connectWithToken(serverUrl: string, accessToken: string): Promise<JMAPSession> {
     const baseUrl = serverUrl.replace(/\/+$/, '');
+    this.detachSession();
     this.credentials = { serverUrl: baseUrl, username: '', password: '', accessToken };
 
     this.session = this.rewriteSessionUrls(await this.fetchSession(baseUrl), baseUrl);
@@ -319,6 +321,7 @@ export class JMAPClient {
     preferredUsername?: string,
   ): Promise<{ session: JMAPSession; username: string; accountId: string }> {
     const baseUrl = serverUrl.replace(/\/+$/, '');
+    this.detachSession();
     this.credentials = {
       serverUrl: baseUrl,
       username: '',
@@ -489,6 +492,7 @@ export class JMAPClient {
   }
 
   async loadAccount(accountId: string): Promise<boolean> {
+    this.detachSession();
     const stored = await SecureStore.getItemAsync(credentialsKey(accountId));
     if (!stored) return false;
 
@@ -528,6 +532,18 @@ export class JMAPClient {
     return true;
   }
 
+  /**
+   * Serve no account until the next session is up. The app's stores switch
+   * to the account being signed in first, and the old session would carry
+   * the new credentials once they are swapped in: a request in between (an
+   * outbox replay, a refresh) would reach the previous account. Callers that
+   * switch keep a snapshot() to put it back on failure.
+   */
+  private detachSession(): void {
+    this.session = null;
+    this._accountId = null;
+  }
+
   /**
    * Snapshot of the live connection so a failed "add account" / switch can put
    * the previous account back without a network round-trip.