From 54afb103454134d8f841ae50fdfd16f6e167118a Mon Sep 17 00:00:00 2001
From: dreamhunter2333 <dreamhunter2333@gmail.com>
Date: Sun, 23 Aug 2026 19:30:46 +0800
Subject: [PATCH] test: cover user mail ownership boundaries

---
 e2e/tests/api/user-send-mail.spec.ts | 37 ++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/e2e/tests/api/user-send-mail.spec.ts b/e2e/tests/api/user-send-mail.spec.ts
index 7bff1fb..c65ab5e 100644
--- a/e2e/tests/api/user-send-mail.spec.ts
+++ b/e2e/tests/api/user-send-mail.spec.ts
@@ -75,6 +75,37 @@ test.describe('User send mail API', () => {
       );
       expect(outsiderSettingsRes.status()).toBe(400);
 
+      const outsiderCredentialRes = await request.get(
+        `${WORKER_URL}/user_api/bind_address_jwt/${outsider.address_id}`,
+        { headers: { 'x-user-token': user.jwt } },
+      );
+      expect(outsiderCredentialRes.status()).toBe(400);
+
+      const outsiderAccessRes = await request.post(
+        `${WORKER_URL}/user_api/address/${outsider.address_id}/request_send_mail_access`,
+        { headers: { 'x-user-token': user.jwt } },
+      );
+      expect(outsiderAccessRes.status()).toBe(400);
+
+      const outsiderUserSendRes = await request.post(
+        `${WORKER_URL}/user_api/address/${outsider.address_id}/send_mail`,
+        {
+          headers: { 'x-user-token': user.jwt },
+          data: {
+            to_mail: 'recipient@test.example.com',
+            subject: 'Forbidden user send',
+            content: 'This message must not be sent',
+            is_html: false,
+          },
+        },
+      );
+      expect(outsiderUserSendRes.status()).toBe(400);
+
+      const unauthenticatedSendboxRes = await request.get(
+        `${WORKER_URL}/user_api/sendbox?limit=20&offset=0`,
+      );
+      expect(unauthenticatedSendboxRes.status()).toBe(401);
+
       const requestAccessRes = await request.post(
         `${WORKER_URL}/user_api/address/${accessRequest.address_id}/request_send_mail_access`,
         { headers: { 'x-user-token': user.jwt } },
@@ -135,6 +166,12 @@ test.describe('User send mail API', () => {
       ));
       expect(outsiderMail).toBeTruthy();
 
+      const unauthorizedAddressDeleteRes = await request.delete(
+        `${WORKER_URL}/user_api/address/${outsider.address_id}/sendbox/${outsiderMail.id}`,
+        { headers: { 'x-user-token': user.jwt } },
+      );
+      expect(unauthorizedAddressDeleteRes.status()).toBe(400);
+
       const unauthorizedDeleteRes = await request.delete(
         `${WORKER_URL}/user_api/sendbox/${outsiderMail.id}`,
         { headers: { 'x-user-token': user.jwt } },