From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
To: Notmuch Mail <notmuch@notmuchmail.org>
Subject: [PATCH v2 3/7] fix thread breakage via ghost-on-removal
Date: Sat,  2 Apr 2016 11:15:37 -0300
Message-Id: <1459606541-23889-3-git-send-email-dkg@fifthhorseman.net>
In-Reply-To: <1459606541-23889-1-git-send-email-dkg@fifthhorseman.net>
References: <1459445693-3900-1-git-send-email-dkg@fifthhorseman.net>
 <1459606541-23889-1-git-send-email-dkg@fifthhorseman.net>
Precedence: list

ghost-on-removal the solution to T590-thread-breakage.sh that just
adds a ghost message after removing each message.

It leaks information about whether we've ever seen a given message id,
but it's a fairly simple implementation.

Note that _resolve_message_id_to_thread_id also introduces new
message_ids to the database, so i think just searching for a given
message ID may introduce the same metadata leakage.

This differs from v1 of this changeset in that we implement the change
in _notmuch_message_delete, a more "internal" function.
---
 lib/database.cc |  2 +-
 lib/message.cc  | 29 ++++++++++++++++++++++++++---
 2 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/lib/database.cc b/lib/database.cc
index 3b342f1..d5733c9 100644
--- a/lib/database.cc
+++ b/lib/database.cc
@@ -2557,7 +2557,7 @@ notmuch_database_remove_message (notmuch_database_t *notmuch,
 
     if (status == NOTMUCH_STATUS_SUCCESS && message) {
 	    status = _notmuch_message_remove_filename (message, filename);
-	    if (status == NOTMUCH_STATUS_SUCCESS)
+	    if (status == NOTMUCH_STATUS_SUCCESS) 
 		_notmuch_message_delete (message);
 	    else if (status == NOTMUCH_STATUS_DUPLICATE_MESSAGE_ID)
 		_notmuch_message_sync (message);
diff --git a/lib/message.cc b/lib/message.cc
index 8d72ea2..e414e9c 100644
--- a/lib/message.cc
+++ b/lib/message.cc
@@ -1037,20 +1037,43 @@ _notmuch_message_sync (notmuch_message_t *message)
     message->modified = FALSE;
 }
 
-/* Delete a message document from the database. */
+/* Delete a message document from the database, leaving a ghost
+ * message in its place */
 notmuch_status_t
 _notmuch_message_delete (notmuch_message_t *message)
 {
     notmuch_status_t status;
     Xapian::WritableDatabase *db;
+    const char *mid, *tid;
+    notmuch_message_t *ghost;
+    notmuch_private_status_t private_status;
+    notmuch_database_t *notmuch;
+	    
+    mid = notmuch_message_get_message_id (message);
+    tid = notmuch_message_get_thread_id (message);
+    notmuch = message->notmuch;
 
     status = _notmuch_database_ensure_writable (message->notmuch);
     if (status)
 	return status;
 
-    db = static_cast <Xapian::WritableDatabase *> (message->notmuch->xapian_db);
+    db = static_cast <Xapian::WritableDatabase *> (notmuch->xapian_db);
     db->delete_document (message->doc_id);
-    return NOTMUCH_STATUS_SUCCESS;
+	    
+    /* and reintroduce a ghost in its place */
+    ghost = _notmuch_message_create_for_message_id (notmuch, mid, &private_status);
+    if (private_status == NOTMUCH_PRIVATE_STATUS_SUCCESS) {
+	/* this is deeply weird, and we should not have gotten into
+	   this state.  is there a better error message to return
+	   here? */
+	return NOTMUCH_STATUS_DUPLICATE_MESSAGE_ID;
+    } else if (private_status == NOTMUCH_PRIVATE_STATUS_NO_DOCUMENT_FOUND) {
+	private_status = _notmuch_message_initialize_ghost (ghost, tid);
+	if (! private_status)
+	    _notmuch_message_sync (ghost);
+    }
+    notmuch_message_destroy (ghost);
+    return COERCE_STATUS (private_status, "Error converting to ghost message");
 }
 
 /* Transform a blank message into a ghost message.  The caller must
-- 
2.8.0.rc3