From d0c22a0554bbdebf4461dbb46b58e5002c5a6e58 Mon Sep 17 00:00:00 2001
From: thuanle <tl@thuanle.me>
Date: Mon, 27 Apr 2026 21:59:25 +0700
Subject: [PATCH] fix(mail): restore IMAP SOCKS5 dial timeout behavior

Preserve the 30s dial timeout semantics for proxy connections by using a timeout-backed forward dialer, and add a regression test to lock this behavior.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 internal/mail/imap.go      | 14 +++++++++++++-
 internal/mail/imap_test.go | 30 ++++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/internal/mail/imap.go b/internal/mail/imap.go
index 0a48ca8..c59da47 100644
--- a/internal/mail/imap.go
+++ b/internal/mail/imap.go
@@ -37,6 +37,18 @@ type IMAPWatcher struct {
 	OnReceived func(task *database.Task)
 }
 
+const imapDialTimeout = 30 * time.Second
+
+type timeoutDialer struct {
+	timeout time.Duration
+}
+
+func (d timeoutDialer) Dial(network, address string) (net.Conn, error) {
+	return (&net.Dialer{Timeout: d.timeout}).Dial(network, address)
+}
+
+var socks5DialerFactory = proxy.SOCKS5
+
 // NewIMAPWatcher creates a new IMAP watcher.
 func NewIMAPWatcher(cfg *config.Config, db *gorm.DB) *IMAPWatcher {
 	return &IMAPWatcher{
@@ -177,7 +189,7 @@ func dialTLSViaSOCKS5(addr, proxyURL string, options *imapclient.Options) (*imap
 		auth = &proxy.Auth{User: u.User.Username(), Password: pw}
 	}
 
-	dialer, err := proxy.SOCKS5("tcp", u.Host, auth, proxy.Direct)
+	dialer, err := socks5DialerFactory("tcp", u.Host, auth, timeoutDialer{timeout: imapDialTimeout})
 	if err != nil {
 		return nil, fmt.Errorf("create socks5 dialer: %w", err)
 	}
diff --git a/internal/mail/imap_test.go b/internal/mail/imap_test.go
index 0e9cecb..70c2f97 100644
--- a/internal/mail/imap_test.go
+++ b/internal/mail/imap_test.go
@@ -3,10 +3,13 @@ package mail
 import (
 	"context"
 	"errors"
+	"net"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/emersion/go-imap/v2/imapclient"
+	"golang.org/x/net/proxy"
 	"thuanle.me/claw-email-bridge/internal/config"
 )
 
@@ -75,3 +78,30 @@ func TestDialTLSViaSOCKS5_RejectsNonSocks5Scheme(t *testing.T) {
 		t.Fatalf("expected unsupported scheme error, got %v", err)
 	}
 }
+
+type errDialer struct{}
+
+func (errDialer) Dial(network, address string) (net.Conn, error) {
+	return nil, errors.New("stop")
+}
+
+func TestDialTLSViaSOCKS5_UsesTimeoutForwardDialer(t *testing.T) {
+	orig := socks5DialerFactory
+	t.Cleanup(func() { socks5DialerFactory = orig })
+
+	socks5DialerFactory = func(network, address string, auth *proxy.Auth, forward proxy.Dialer) (proxy.Dialer, error) {
+		td, ok := forward.(timeoutDialer)
+		if !ok {
+			t.Fatalf("expected timeoutDialer, got %T", forward)
+		}
+		if td.timeout != 30*time.Second {
+			t.Fatalf("expected timeout 30s, got %s", td.timeout)
+		}
+		return errDialer{}, nil
+	}
+
+	_, err := dialTLSViaSOCKS5("imap.example.com:993", "socks5://127.0.0.1:1080", nil)
+	if err == nil || !strings.Contains(err.Error(), "proxy dial: stop") {
+		t.Fatalf("expected proxy dial stop error, got %v", err)
+	}
+}