fix(imap): address code review feedback - named constants, error context in JS, security docs

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

app/models.py

@@ -402,7 +402,9 @@ class UserImapAccount(Base):
     host = Column(String(255), nullable=False)
     port = Column(Integer, nullable=False, default=993)
     username = Column(String(255), nullable=False)
-    # Password stored in plain text — the admin is responsible for access control
+    # Password stored in plain text — the admin is responsible for access control.
+    # TODO: Encrypt at rest using cryptography.fernet before deploying in high-security
+    # environments. See SECURITY_AUDIT.md for full risk assessment and mitigation notes.
     password = Column(String(1024), nullable=False)
     use_ssl = Column(Boolean, nullable=False, default=True)
 

app/tasks/imap_tasks.py

@@ -18,6 +18,9 @@ from app.utils.allowed_types import ALLOWED_EXTENSIONS, ALLOWED_MIME_TYPES
 # Database session for per-user IMAP accounts (imported lazily to avoid circular imports)
 _db_session_factory = None
 
+# Maximum length to store as last_error to prevent DB bloat
+_MAX_ERROR_LENGTH = 500
+
 
 def _get_db_session():
     """Return a new SQLAlchemy session (lazy import to avoid startup issues)."""
@@ -149,10 +152,11 @@ def _pull_user_imap_accounts() -> None:
             accounts = db.query(UserImapAccount).filter(UserImapAccount.is_active.is_(True)).all()
             logger.info("Processing %d per-user IMAP account(s)", len(accounts))
             for acct in accounts:
-                mailbox_key = f"user_{acct.owner_id}_{acct.id}"
+                # Use a descriptive identifier for logging and processed-email cache keys
+                account_identifier = f"user_{acct.owner_id}_{acct.id}"
                 try:
                     pull_inbox(
-                        mailbox_key=mailbox_key,
+                        mailbox_key=account_identifier,
                         host=acct.host,
                         port=acct.port,
                         username=acct.username,
@@ -165,7 +169,7 @@ def _pull_user_imap_accounts() -> None:
                     acct.last_error = None
                     db.commit()
                 except Exception as exc:  # noqa: BLE001
-                    error_msg = str(exc)[:500]
+                    error_msg = str(exc)[:_MAX_ERROR_LENGTH]
                     logger.error(
                         "Error pulling user IMAP account %d (%s@%s): %s",
                         acct.id,