Function resolveThread

server/src/addie/email-conversation-handler.ts:313–359

(
  input: EmailConversationInput,
  threadService: ReturnType<typeof getThreadService>
)

// --- Thread resolution ---

async function resolveThread(
  input: EmailConversationInput,
  threadService: ReturnType<typeof getThreadService>
): Promise<Thread> {
  // Tier 1: Look up In-Reply-To header in stored message IDs
  // Verify sender matches thread owner to prevent thread hijacking via crafted headers
  if (input.inReplyTo) {
    const thread = await threadService.findThreadByEmailMessageId(input.inReplyTo);
    if (thread && thread.user_id === input.senderEmail) {
      logger.info({ threadId: thread.thread_id, inReplyTo: input.inReplyTo }, 'Found thread via In-Reply-To');
      return thread;
    }
    if (thread) {
      logger.warn({
        threadId: thread.thread_id,
        inReplyTo: input.inReplyTo,
        threadOwner: thread.user_id,
        sender: input.senderEmail,
      }, 'In-Reply-To matched thread owned by different sender, ignoring');
    }
  }

  // Tier 2: Find recent thread from same sender with same subject
  const thread = await threadService.findRecentEmailThread(input.senderEmail, input.subject);
  if (thread) {
    logger.info({ threadId: thread.thread_id, senderEmail: input.senderEmail }, 'Found thread via recent sender + subject');
    return thread;
  }

  // Tier 3: Create new thread
  // Always use sender email as user_id (not WorkOS ID) since email identity is unverified
  const newThread = await threadService.getOrCreateThread({
    channel: 'email',
    external_id: `email:${input.messageId}`,
    user_type: 'anonymous',
    user_id: input.senderEmail,
    user_display_name: input.senderDisplayName,
    context: {
      sender_email: input.senderEmail,
      subject: input.subject,
    },
    title: input.subject,
  });

  logger.info({ threadId: newThread.thread_id, senderEmail: input.senderEmail }, 'Created new email thread');
  return newThread;
}

// --- System context ---