feat(mail): add governed POP3 legacy import

tests/test_provider_state.py

@@ -14,14 +14,17 @@ from govoplan_mail.backend.db.models import (
     MailDeliveryCommand,
     MailMailboxFolderIndex,
     MailMailboxMessageIndex,
+    MailPop3Import,
     MailServerEndpoint,
     MailServerProfile,
 )
 from govoplan_mail.backend.manifest import manifest
 from govoplan_mail.backend.provider_state import (
     IMAP_PROVIDER_ID,
+    POP3_PROVIDER_ID,
     SMTP_PROVIDER_ID,
     imap_provider_states,
+    pop3_provider_states,
     smtp_provider_states,
 )
 
@@ -38,6 +41,7 @@ class MailProviderStateTests(unittest.TestCase):
                 MailMailboxFolderIndex.__table__,
                 MailMailboxMessageIndex.__table__,
                 MailBounceSource.__table__,
+                MailPop3Import.__table__,
             ),
         )
         self.session = sessionmaker(bind=self.engine, expire_on_commit=False)()
@@ -120,17 +124,89 @@ class MailProviderStateTests(unittest.TestCase):
             ),
         )
         self.assertEqual(
-            {SMTP_PROVIDER_ID, IMAP_PROVIDER_ID},
+            {SMTP_PROVIDER_ID, IMAP_PROVIDER_ID, POP3_PROVIDER_ID},
             {item.id for item in manifest.external_providers},
         )
         self.assertEqual(
-            {SMTP_PROVIDER_ID, IMAP_PROVIDER_ID},
+            {SMTP_PROVIDER_ID, IMAP_PROVIDER_ID, POP3_PROVIDER_ID},
             {
                 item.provider_id
                 for item in manifest.external_provider_state_providers
             },
         )
 
+    def test_pop3_state_is_disabled_by_default_and_projects_deletion_evidence(self) -> None:
+        endpoint = MailServerEndpoint(
+            id="pop3-server-1",
+            profile_id=self.profile.id,
+            tenant_id="tenant-1",
+            protocol="pop3",
+            name="Legacy POP3",
+            config={"host": "pop3.example.test", "legacy_import_enabled": False},
+            scope_type="tenant",
+            scope_id="tenant-1",
+            is_active=True,
+        )
+        self.session.add(endpoint)
+        self.session.flush()
+
+        disabled = pop3_provider_states(
+            ExternalProviderStateContext(session=self.session, tenant_id="tenant-1")
+        )[0]
+        self.assertFalse(disabled.active)
+        self.assertEqual("inactive", disabled.health)
+
+        endpoint.config = {
+            "host": "pop3.example.test",
+            "legacy_import_enabled": True,
+        }
+        self.session.add(
+            MailPop3Import(
+                id="pop3-import-1",
+                tenant_id="tenant-1",
+                profile_id=self.profile.id,
+                pop3_server_id=endpoint.id,
+                transport_revision=endpoint.transport_revision,
+                provider_uidl="uid-1",
+                fingerprint="a" * 64,
+                raw_sha256="b" * 64,
+                raw_message_encrypted="ciphertext-do-not-project",
+                size_bytes=42,
+                imported_at=datetime.now(UTC),
+                deletion_requested=True,
+                deletion_status="outcome_unknown",
+            )
+        )
+        self.session.add(
+            MailPop3Import(
+                id="pop3-import-tenant-2",
+                tenant_id="tenant-2",
+                profile_id=self.profile.id,
+                pop3_server_id=endpoint.id,
+                transport_revision=endpoint.transport_revision,
+                provider_uidl="uid-tenant-2",
+                fingerprint="c" * 64,
+                raw_sha256="d" * 64,
+                raw_message_encrypted="other-tenant-ciphertext",
+                size_bytes=42,
+                imported_at=datetime.now(UTC),
+                deletion_requested=True,
+                deletion_status="failed",
+            )
+        )
+        self.session.flush()
+
+        state = pop3_provider_states(
+            ExternalProviderStateContext(session=self.session, tenant_id="tenant-1")
+        )[0]
+        self.assertTrue(state.active)
+        self.assertEqual("warning", state.health)
+        self.assertEqual("pending", state.conflict)
+        self.assertEqual(1, state.metrics["outcome_unknown_deletions"])
+        self.assertEqual(0, state.metrics["failed_deletions"])
+        self.assertNotIn("pop3.example.test", str(state.to_dict()))
+        self.assertNotIn("ciphertext-do-not-project", str(state.to_dict()))
+
 
 if __name__ == "__main__":
     unittest.main()