From 2bc9b0ccc6f3a0710ccde53a1d44999f4d86d161 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Mon, 2 Nov 2026 23:37:35 +0100
Subject: [PATCH] test: check that attachment text is read only from accounts
 this login shows

---
 lib/__tests__/plugin-host-attachment-text.test.ts | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/lib/__tests__/plugin-host-attachment-text.test.ts b/lib/__tests__/plugin-host-attachment-text.test.ts
index 00d0a5dac..bb5f0e9e5 100644
--- a/lib/__tests__/plugin-host-attachment-text.test.ts
+++ b/lib/__tests__/plugin-host-attachment-text.test.ts
@@ -52,7 +52,8 @@ let client: Record<string, ReturnType<typeof vi.fn>>;
 beforeEach(() => {
   resetPluginRateLimits();
   client = {
-    getEmail: vi.fn(async (id: string, accountId?: string) => (id === 'm1' && (!accountId || accountId === 'shared-acc') ? message : null)),
+    // Every account has an m1: only the host's routing keeps a plugin out of the ones it may not read.
+    getEmail: vi.fn(async (id: string) => (id === 'm1' ? message : null)),
     fetchBlobArrayBuffer: vi.fn(async (blobId: string) => {
       const bytes = BLOBS[blobId];
       return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
@@ -110,9 +111,17 @@ describe('api.email.getAttachmentText', () => {
     await expect(call(ASSISTANT, 'missing', 'blob-notes')).rejects.toThrow(/no message with id "missing"/);
     // An account this login doesn't show is not asked.
     await expect(call(ASSISTANT, 'm1', 'blob-notes', { accountId: 'stranger' })).rejects.toThrow(/no message with id/);
+    expect(client.getEmail).not.toHaveBeenCalledWith('m1', 'stranger');
     expect(client.fetchBlobArrayBuffer).not.toHaveBeenCalled();
   });
 
+  it('reads an attachment of a shared folder from that account', async () => {
+    useEmailStore.setState({ mailboxes: [{ id: 'shared-acc:inbox', originalId: 'inbox', name: 'Team', isShared: true, accountId: 'shared-acc' } as never] });
+    expect(await call(ASSISTANT, 'm1', 'blob-notes', { accountId: 'shared-acc' })).toMatchObject({ status: 'ok' });
+    expect(client.getEmail).toHaveBeenCalledWith('m1', 'shared-acc');
+    expect(client.fetchBlobArrayBuffer).toHaveBeenCalledWith('blob-notes', 'workshop-notes.txt', 'text/plain', 'shared-acc');
+  });
+
   it('checks its options', async () => {
     await expect(call(ASSISTANT, 'm1', 'blob-notes', { maxChars: 100_001 })).rejects.toThrow(/maxChars must be a whole number from 1 to 100000/);
     await expect(call(ASSISTANT, 'm1', 'blob-notes', { pages: 3 })).rejects.toThrow(/unknown property "pages"/);