docs(quick-260907-let): Verbindungstest fuer das Postfach — Plan, Bericht, Verifikation

Abschluss-Dokumentation zum nachgeruesteten Verbindungstest (WINDOWS #16).

Verifikation unabhaengig nachgemessen, nicht aus dem Ausfuehrungsbericht
uebernommen: 646/646 API-Tests, 228/228 Web-Tests, beide Typpruefungen
sauber, und das Sprachschluessel-Gate ist von rot ("de fehlt testConnection")
auf gruen gewechselt. Sicherheitsseitig geprueft: die DTO traegt kein
Eigentuemer-Feld, der Handler zieht userId ausschliesslich aus dem
Auth-Kontext (eigener IDOR-Test mit Koeder-userId), Rueckfall auf gespeicherte
Zugangsdaten sucht nur ueber denselben userId, und in den geaenderten Dateien
findet sich keine Log- oder Antwortstelle mit Zugangsdaten.

Status bleibt human_needed: die Browser-Abnahme gegen ein echtes Postfach
steht aus und braucht einen Neubau durch den User. WINDOWS #16 bleibt
deshalb offen.

Ausserdem workflow.use_worktrees auf false: origin/HEAD ist in diesem Repo
nicht aufloesbar, der Basis-Check des Workflows verlangt daher selbst
sequenzielle Ausfuehrung ("fork-ref-unknown"). Ein isolierter Arbeitsbaum
wuerde von einem veralteten Stand abzweigen.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FYZcd3SSmo14QTqWx2KKzU

.planning/quick/260907-let-verbindungstest-fuer-das-postfach-im-aus/260907-let-SUMMARY.md

@@ -0,0 +1,165 @@
+---
+phase: quick-260907-let
+plan: 01
+subsystem: api
+tags: [nestjs, next-intl, vitest, inbox-provider, imap, exchange-ews]
+
+# Dependency graph
+requires:
+  - phase: 14-portal-alert-mailbox-inbox-extraction
+    provides: ImapProvider/ExchangeInboxProvider.testConnection (apps/api/src/inbox), shared by DKV and now Tender-Radar
+  - phase: 17-eigene-ausschreibungs-quellen-je-nutzer
+    provides: per-user TenderEmailConfig ownership (userId @unique) and the extractTriageContext auth-context pattern
+provides:
+  - "POST /modules/tender-radar/email-config/test — per-user connection test, no persistence"
+  - "TenderEmailConfigService.testConnection(userId, dto) with stored-credential fallback for username AND password"
+  - "Verbindung testen button in EmailAlertConfigForm with wait/success/error feedback"
+affects: [tender-radar, inbox, windows-ledger]
+
+# Actuals (#2632)
+actuals:
+  tokens: 6600
+  tasks: 2
+  commits: 2
+
+tech-stack:
+  added: []
+  patterns:
+    - "Optional trailing-constructor-param provider injection (ImapProvider/ExchangeInboxProvider) so existing 2-arg spec call sites stay type-correct — mirrors TendersController.tenderIngestionService"
+
+key-files:
+  created: []
+  modified:
+    - apps/api/src/tenders/tender-email-config.service.ts
+    - apps/api/src/tenders/tenders.controller.ts
+    - apps/api/src/tenders/tender-email-config.service.spec.ts
+    - apps/api/src/tenders/tenders.controller.spec.ts
+    - apps/web/src/lib/tender-radar-api.ts
+    - "apps/web/src/app/(portal)/modules/tender-radar/settings/components/EmailAlertConfigForm.tsx"
+    - "apps/web/src/app/(portal)/modules/tender-radar/settings/components/EmailAlertConfigForm.test.tsx"
+    - "apps/web/src/app/(portal)/modules/tender-radar/my-sources/my-sources.test.tsx"
+    - apps/web/src/messages/de.json
+    - apps/web/src/messages/en.json
+
+key-decisions:
+  - "testConnection backfills BOTH username and password independently from stored, decrypted credentials — broader than saveConfig's credChanged branching, since a fully-blank test-connection form needs both fields, not just the one the caller didn't touch on a partial re-save."
+  - "Route-order comment corrected to state the accurate reason: NestJS resolves routes per HTTP verb, so a GET :id placeholder cannot shadow this POST route today. Ordering is defensive consistency with the surrounding email-config handlers, not a live 404 risk."
+
+patterns-established:
+  - "A per-user connection-test endpoint (userId from extractTriageContext, never the body) is now the second instance of this pattern after DkvController.testConnection — a template for any future per-user inbox-config module."
+
+requirements-completed: [WINDOWS-16]
+
+coverage:
+  - id: D1
+    description: "POST /modules/tender-radar/email-config/test resolves userId from the auth context, never the body, and delegates to TenderEmailConfigService.testConnection"
+    requirement: WINDOWS-16
+    verification:
+      - kind: unit
+        ref: "apps/api/src/tenders/tenders.controller.spec.ts#POST /email-config/test resolves userId from the auth context, even when the body carries a different identity field (T-QT16-01, IDOR)"
+        status: pass
+      - kind: unit
+        ref: "apps/api/src/tenders/tenders.controller.spec.ts#declares getEmailConfig/saveEmailConfig/testEmailConnection before getTender so GET /:id cannot shadow \"email-config\""
+        status: pass
+    human_judgment: false
+  - id: D2
+    description: "TenderEmailConfigService.testConnection falls back to the same user's stored, decrypted credentials when username/password are left blank, and selects IMAP vs Exchange provider by dto.protocol"
+    requirement: WINDOWS-16
+    verification:
+      - kind: unit
+        ref: "apps/api/src/tenders/tender-email-config.service.spec.ts#testConnection (Quick 260907-let, WINDOWS #16) — all 3 cases"
+        status: pass
+    human_judgment: false
+  - id: D3
+    description: "\"Verbindung testen\" button in EmailAlertConfigForm — wait state, success/error feedback, form-change clears the previous result"
+    requirement: WINDOWS-16
+    verification:
+      - kind: unit
+        ref: "apps/web/.../EmailAlertConfigForm.test.tsx#clicking \"Verbindung testen\" calls testEmailConnection once with a body carrying no password field"
+        status: pass
+      - kind: unit
+        ref: "apps/web/.../EmailAlertConfigForm.test.tsx#a failed connection test shows the server's error message in the document"
+        status: pass
+    human_judgment: false
+  - id: D4
+    description: "Browser UAT against a real mailbox: false-positive-free failure on a bad server, success on a real one, password-optional retest, credential-free API logs"
+    requirement: WINDOWS-16
+    verification: []
+    human_judgment: true
+    rationale: "The plan's own human-check block states this explicitly: the capability proves itself only against a real IMAP/EWS mailbox, never against mocks. Runs at phase end (human_verify_mode = end-of-phase); the Docker rebuild/restart needed to exercise it belongs to the user, not this executor."
+
+# Metrics
+duration: 25min
+completed: 2026-09-07
+status: complete
+---
+
+# Quick Task 260907-let: Verbindungstest fuer das Postfach unter "Meine Quellen" Summary
+
+**POST /modules/tender-radar/email-config/test wires the already-existing ImapProvider/ExchangeInboxProvider.testConnection into a per-user endpoint, plus a "Verbindung testen" button in EmailAlertConfigForm — closes WINDOWS #16.**
+
+## Performance
+
+- **Duration:** ~25 min
+- **Completed:** 2026-09-07T13:44:17Z
+- **Tasks:** 2
+- **Files modified:** 10
+
+## Accomplishments
+- Backend: `TenderEmailConfigService.testConnection(userId, dto)` — types in the DTO's password go straight to the provider; a blank username or password independently falls back to this same user's stored, decrypted credentials; `dto.protocol === 'exchange'` selects the Exchange provider, everything else IMAP.
+- `POST /modules/tender-radar/email-config/test` on `TendersController` — `userId` comes exclusively from `extractTriageContext(req)`, proven by a dedicated IDOR test where the body carries a decoy `userId` field that never reaches the service call.
+- Declaration-order guard extended to cover `testEmailConnection` alongside the existing `getEmailConfig`/`saveEmailConfig` entries, so a future reshuffle above `@Get(':id')` fails the test immediately.
+- Frontend: "Verbindung testen" button in `EmailAlertConfigForm`, positioned before "Speichern", sharing the disabled-during-either-request semantics with the DKV Fleet `InboxConfigForm` it mirrors. Shows a waiting label, then a green success line or a red line with the server's literal error text; any form-field change clears the previous result.
+- Four new i18n keys (`testConnection`, `testTesting`, `testSuccess`, `testFailed`) added under `tenderRadar.emailAlerts` in both `de.json` and `en.json`, wording taken verbatim from `dkvFleet.form`'s existing four keys.
+- The component's doc comment, which previously stated no test-connection endpoint exists for this form, was rewritten to describe the button that now exists — only the D-15 rationale for the *absent interval field* survived unchanged.
+
+## Task Commits
+
+Each task was committed atomically:
+
+1. **Task 1: Endpunkt POST email-config/test — vom Formularrumpf bis zum Mailserver** - `3bf550b` (feat)
+2. **Task 2: Knopf "Verbindung testen" im Postfach-Formular samt Beschriftungen** - `c4db3b2` (feat)
+
+_Both tasks were `tdd="true"`; test cases were authored alongside the implementation in the same commit per this plan's task-scoping (no separate RED/GREEN split was required by the plan)._
+
+## Files Created/Modified
+- `apps/api/src/tenders/tender-email-config.service.ts` - added `testConnection(userId, dto)`, optional `ImapProvider`/`ExchangeInboxProvider` constructor params, a service-level `Logger`
+- `apps/api/src/tenders/tenders.controller.ts` - added `POST email-config/test` handler (`testEmailConnection`) directly after `saveEmailConfig`, above `@Get(':id')`
+- `apps/api/src/tenders/tender-email-config.service.spec.ts` - 3 new cases (typed password passthrough, stored-credential fallback, protocol→provider selection)
+- `apps/api/src/tenders/tenders.controller.spec.ts` - `makeFakeEmailConfigService` gained `testConnection`; 1 new IDOR test; declaration-order guard extended
+- `apps/web/src/lib/tender-radar-api.ts` - added `testEmailConnection(payload)`
+- `apps/web/src/app/(portal)/modules/tender-radar/settings/components/EmailAlertConfigForm.tsx` - test button, `isTesting`/`testResult` state, `handleTestConnection`, feedback rendering, corrected doc comment
+- `apps/web/src/app/(portal)/modules/tender-radar/settings/components/EmailAlertConfigForm.test.tsx` - mock factory extended with `testEmailConnection`, next-intl mock gained `params` interpolation + 4 new keys, 2 new test cases
+- `apps/web/src/app/(portal)/modules/tender-radar/my-sources/my-sources.test.tsx` - mock factory and translation table extended so component import doesn't throw (no new test cases required by the plan)
+- `apps/web/src/messages/de.json` / `apps/web/src/messages/en.json` - 4 new keys each under `tenderRadar.emailAlerts`
+
+## Decisions Made
+- `testConnection` backfills username AND password independently, unlike `saveConfig`'s `credChanged` gate which only ever needs to fill in the one field the caller left out on a partial re-save. A connection test can arrive with a fully blank form (test right after loading a saved config), so both fields need their own fallback.
+- Used NestJS `Logger` (matching every other service in `apps/api/src/tenders/`) instead of `console.error` for the credential-decrypt failure path, consistent with codebase convention rather than the DKV analog's inline `this.logger`.
+- Route-order comment states the accurate mechanism (NestJS resolves per HTTP verb; a GET placeholder cannot shadow a POST route today) instead of the "sonst 404" phrasing the plan explicitly flagged as false — per the plan-check trap warning.
+
+## Deviations from Plan
+
+None - plan executed exactly as written, including the three traps called out in execution notes (mock-factory export gap, stale doc-comment, route-order comment accuracy).
+
+## Issues Encountered
+
+None.
+
+## User Setup Required
+
+None - no external service configuration required. The browser UAT in Task 2's human-check block (real IMAP/EWS mailbox test) requires a Docker rebuild/restart, which is explicitly the user's responsibility per this repository's conventions (Kein Docker-Deploy auf Testserver) — it runs at phase end, not during this execution.
+
+## Next Phase Readiness
+
+- Backend and frontend automated verification green: API 646/646 tests (up from a 60-test baseline in the two touched spec files, now 64), typecheck clean; Web 228/228 tests (touched files: 5→7 in `EmailAlertConfigForm.test.tsx`), typecheck clean, locale-key check passes for both languages.
+- Plan-level commit ledger: `plan_head_before: 5da58ad1827e86ea26cbe89e120a3a6cbcbe4f7f`, `commits: 2` (measured via `git rev-list --count`).
+- Outstanding: the browser UAT itself (Task 2's `human-check` block) is not yet run — it needs a real mailbox and the user's own Docker rebuild, and per `human_verify_mode = end-of-phase` is expected to happen at phase close, not mid-execution. WINDOWS #16 stays open until that UAT is confirmed.
+
+---
+*Phase: quick-260907-let*
+*Completed: 2026-09-07*
+
+## Self-Check: PASSED
+
+All 10 modified/created files verified present on disk; both task commits (3bf550b, c4db3b2) verified present in `git log`.

.planning/quick/260907-let-verbindungstest-fuer-das-postfach-im-aus/260907-let-VERIFICATION.md

@@ -0,0 +1,143 @@
+---
+phase: quick-260907-let
+verified: 2026-09-07T15:50:00Z
+status: human_needed
+score: 5/5 must-haves verified
+covered_files:
+  - ".planning/quick/260907-let-verbindungstest-fuer-das-postfach-im-aus/260907-let-PLAN.md"
+  - ".planning/quick/260907-let-verbindungstest-fuer-das-postfach-im-aus/260907-let-SUMMARY.md"
+  - "apps/api/src/tenders/tender-email-config.service.spec.ts"
+  - "apps/api/src/tenders/tender-email-config.service.ts"
+  - "apps/api/src/tenders/tenders.controller.spec.ts"
+  - "apps/api/src/tenders/tenders.controller.ts"
+  - "apps/web/src/app/(portal)/modules/tender-radar/my-sources/my-sources.test.tsx"
+  - "apps/web/src/app/(portal)/modules/tender-radar/settings/components/EmailAlertConfigForm.test.tsx"
+  - "apps/web/src/app/(portal)/modules/tender-radar/settings/components/EmailAlertConfigForm.tsx"
+  - "apps/web/src/lib/tender-radar-api.ts"
+  - "apps/web/src/messages/de.json"
+  - "apps/web/src/messages/en.json"
+covered_digest: "v1:sha256:0b706eb0b8e627aaaa7991076fbf755fcc4353f44fbbd1221d2ac28bf7fcc2e9"
+behavior_unverified: 0
+overrides_applied: 0
+human_verification:
+  - test: "Meine Quellen -> Mein Postfach -> absichtlich falschen Servernamen (z.B. gibtesnicht.example) eintragen -> Verbindung testen druecken"
+    expected: "Kurz 'Verbindung wird getestet...', danach rote Zeile 'Verbindung fehlgeschlagen:' mit dem Klartext-Fehler des Mailservers"
+    why_human: "Reales Fehlverhalten eines echten Mailservers ist nur gegen einen echten IMAP/EWS-Endpunkt beobachtbar, nicht gegen Attrappen; Unit-Tests decken nur die Rendering-Verzweigung ab, nicht die Unterscheidung Erfolg/Misserfolg an einem realen Server"
+  - test: "Dieselbe Seite -> echte Postfachdaten samt Passwort eintragen -> Verbindung testen druecken"
+    expected: "Gruene Zeile 'Verbindung erfolgreich'"
+    why_human: "Erfordert einen erreichbaren, echten Mailserver; kann nicht gegen Mocks bewiesen werden"
+  - test: "Postfach ohne Passwort speichern, Seite neu laden (Passwortfeld bleibt leer), nur den Testknopf druecken"
+    expected: "Wieder 'Verbindung erfolgreich' — der Server hat auf die gespeicherten, verschluesselten Zugangsdaten zurueckgegriffen"
+    why_human: "Bestaetigt den Rueckfall-Pfad am echten Server-Roundtrip, nicht nur an der Unit-Test-Attrappe"
+  - test: "Kurzer Blick in die API-Protokollzeilen des Laufs waehrend der drei obigen Schritte"
+    expected: "Weder Benutzername noch Passwort tauchen in den Protokollzeilen auf"
+    why_human: "Laufzeit-Log-Ausgabe eines echten Prozesses ist nur am laufenden System beobachtbar; Code-Review bestaetigt nur, dass kein Log-Statement Zugangsdaten referenziert, nicht dass zur Laufzeit tatsaechlich nichts geloggt wird"
+---
+
+# Quick Task 260907-let: Verbindungstest fuer das Postfach unter "Meine Quellen" Verification Report
+
+**Task Goal:** Verbindungstest fuer das Postfach im Ausschreibungs-Radar nachruesten (schliesst WINDOWS.md Ledger-Eintrag #16)
+**Verified:** 2026-09-07T15:50:00Z
+**Status:** human_needed
+**Re-verification:** No — initial verification
+
+## Goal Achievement
+
+### Observable Truths
+
+| # | Truth | Status | Evidence |
+|---|-------|--------|----------|
+| 1 | Angemeldeter Nutzer kann auf "Meine Quellen" die Postfach-Verbindung pruefen, ohne zu speichern; sieht Erfolg oder Klartext-Fehler | ✓ VERIFIED (code + unit tests); runtime distinction against a real server → human-check | Button + `testResult` rendering in `EmailAlertConfigForm.tsx:450-478`; `handleTestConnection` calls `testEmailConnection(formToPayload(form))` without persisting; unit tests cover the click path and the failure-message render path (`EmailAlertConfigForm.test.tsx:182`, `:203`). Real-server success/failure discrimination is the deferred browser UAT (see Human Verification). |
+| 2 | Gespeichertes Postfach laesst sich erneut pruefen ohne erneute Passworteingabe — Server nutzt verschluesselt hinterlegte Zugangsdaten | ✓ VERIFIED | `TenderEmailConfigService.testConnection` (`tender-email-config.service.ts:220-243`): `if (!username \|\| !password)` reads `prisma.tenderEmailConfig.findUnique({where:{userId}})`, decrypts `encryptedInboxCreds`, backfills whichever field is missing. Unit test `tender-email-config.service.spec.ts:266` proves the password-fallback path end to end (saveConfig then testConnection with blank creds). |
+| 3 | Test laeuft ausschliesslich gegen das Postfach des angemeldeten Nutzers; ein im Rumpf mitgeschicktes Fremdfeld aendert daran nichts | ✓ VERIFIED | `TenderEmailConfigDto` carries no ownership/userId field at all (`dto/tender-email-config.dto.ts`); controller resolves `userId` exclusively via `extractTriageContext(req)` (`tenders.controller.ts:385`). Dedicated IDOR test `tenders.controller.spec.ts:1137` sends `dto.userId = 'attacker-supplied-id'` and asserts the service is called with `'u1'` (the auth-context id), proving the decoy field is ignored. |
+| 4 | Weder Antwort noch Protokollzeilen enthalten Benutzername oder Passwort | ✓ VERIFIED | Return value is the provider's unmodified `{success, message?}` (no credential fields ever added). The only log statement in the new code path (`tender-email-config.service.ts:241`) logs `` `testConnection: failed to load stored credentials for user ${userId}` `` — userId only, no credential value. `grep -i "password\|username\|creds\|secret"` over `logger.`/`console.` calls in both changed backend files returns zero matches. |
+| 5 | Neue Beschriftungen liegen in beiden Sprachdateien vor (Deutsch und Englisch) | ✓ VERIFIED | `de.json` and `en.json` both carry `tenderRadar.emailAlerts.{testConnection,testTesting,testSuccess,testFailed}` with correct wording (verbatim from `dkvFleet.form`, per plan). Plan's own locale-key gate script run directly by this verifier — result: `locale keys ok` (was `Error: de fehlt testConnection` before this work per task brief). |
+
+**Score:** 5/5 truths verified (0 present-but-behavior-unverified)
+
+### Required Artifacts
+
+| Artifact | Expected | Status | Details |
+|----------|----------|--------|---------|
+| `apps/api/src/tenders/tender-email-config.service.ts` — `testConnection` | Method exists, wired to providers | ✓ VERIFIED | Lines 205-247; selects `exchangeProvider`/`imapProvider` by `dto.protocol`; falls back to stored creds; returns provider result unmodified |
+| `apps/api/src/tenders/tenders.controller.ts` — `POST email-config/test` | Route above `@Get(':id')` | ✓ VERIFIED | `@Post('email-config/test')` at line 382, `getTender`/`@Get(':id')` declared later in the file; order-guard test enforces this structurally |
+| `apps/web/src/lib/tender-radar-api.ts` — `testEmailConnection` | Exported function, POST to the new route | ✓ VERIFIED | Lines 580-595; `credentials: 'include'`, `extractErrorMessage` on non-ok, matches sibling functions' style |
+| `EmailAlertConfigForm.tsx` — Knopf + Rueckmeldung | Button + visible feedback | ✓ VERIFIED | Button before Speichern (line ~449), disabled during either request, success/error text rendered below the button row |
+| `de.json` / `en.json` — `tenderRadar.emailAlerts.*` | 4 new keys each | ✓ VERIFIED | Confirmed by direct JSON read and by the plan's locale gate script |
+| `tenders.controller.spec.ts` — order guard | Extended to include `testEmailConnection` | ✓ VERIFIED | Test at line 412 explicitly asserts `testIdx < idIdx` alongside `getIdx`/`saveIdx` |
+
+### Key Link Verification
+
+| From | To | Via | Status | Details |
+|------|----|----|--------|---------|
+| `TendersController.testEmailConnection` | `extractTriageContext(req).userId` | direct call, no body field used for identity | ✓ WIRED | `tenders.controller.ts:385`; IDOR test confirms |
+| `TenderEmailConfigService.testConnection` | `ImapProvider`/`ExchangeInboxProvider.testConnection` | `dto.protocol === 'exchange' ? exchangeProvider : imapProvider` | ✓ WIRED | `tender-email-config.service.ts:244-247`; unit test confirms exchange-vs-imap selection |
+| Blank password in body | `encryptedInboxCreds` of the SAME `userId` row | `prisma.tenderEmailConfig.findUnique({where:{userId}})` + `crypto.decrypt` | ✓ WIRED | Same-userId lookup only — no other user's row is reachable; unit test confirms |
+| `EmailAlertConfigForm` | `testEmailConnection` | `handleTestConnection` → `POST /modules/tender-radar/email-config/test` | ✓ WIRED | Component test asserts the mock is called once with a passwordless body on click |
+| `vi.mock` factories | `testEmailConnection` export | both `EmailAlertConfigForm.test.tsx` and `my-sources.test.tsx` mock factories | ✓ WIRED | Both files import/mock `testEmailConnection`; suite runs green (would throw on missing export otherwise) |
+
+### Behavioral Spot-Checks / Test Suite Runs (measured directly by this verifier, not taken from SUMMARY.md)
+
+| Command | Result | Status |
+|---------|--------|--------|
+| `cd apps/api && npx vitest run` | 46 test files, 646 tests passed | ✓ PASS |
+| `cd apps/api && npx tsc --noEmit -p tsconfig.json` | no output, exit clean | ✓ PASS |
+| `cd apps/web && npx vitest run` | 38 test files, 228 tests passed | ✓ PASS |
+| `cd apps/web && npx tsc --noEmit` | no output, exit clean | ✓ PASS |
+| Plan's locale-key gate (`node -e ...`) | `locale keys ok` | ✓ PASS (was RED — `Error: de fehlt testConnection` — before this work, per task brief) |
+| `git log --oneline` for `3bf550b`, `c4db3b2` | both commits present, correct file sets, correct attribution | ✓ PASS |
+
+### Anti-Patterns Found
+
+None. Grep for `TBD`/`FIXME`/`XXX`/`TODO`/`HACK`/`placeholder`/hardcoded-empty-return patterns across the 10 modified implementation/test files (excluding the already-reviewed doc-comment rewrite) found nothing new. The previously stale doc comment in `EmailAlertConfigForm.tsx` (claiming no test button/no endpoint exists) has been rewritten to accurately describe the new button and endpoint — confirmed by direct read of lines 119-135 (now describing the feature, not denying it).
+
+### Route-Order Comment Accuracy Check
+
+Confirmed: the comment on `testEmailConnection` (`tenders.controller.ts:365-381`) states NestJS resolves routes per HTTP verb, so a `GET :id` placeholder "could never shadow this POST route today," and frames the ordering as defensive consistency with the surrounding handlers — not a false "otherwise 404" claim. This matches the task brief's requirement precisely.
+
+### Security Review (T-17-01 / T-14-03-05 IDOR, T-05-13 credential-logging)
+
+- `TenderEmailConfigDto` has no ownership/userId field of any kind (confirmed by reading the full DTO file) — there is nothing in the body an attacker could set to redirect the test.
+- `userId` in the controller handler comes exclusively from `extractTriageContext(req)`.
+- Dedicated IDOR unit test sends a decoy `dto.userId` and proves the service call uses the auth-context id, not the body value.
+- Credential decrypt-and-backfill happens only within `testConnection`'s local scope; decrypted values are never returned (the provider's `{success, message?}` result is returned unmodified) and never logged — the sole log line in the failure path names only `userId`.
+- Blank username OR blank password each independently fall back to the SAME `userId`'s stored, encrypted credentials (`where: { userId }` is the only lookup key) — confirmed by direct code read and by the passing "empty password falls back to stored" unit test.
+
+### Requirements Coverage
+
+| Requirement | Source Plan | Description | Status | Evidence |
+|-------------|------------|-------------|--------|----------|
+| WINDOWS-16 | 260907-let-PLAN.md | Verbindungstest fuer Postfach im Ausschreibungs-Radar | ✓ SATISFIED (automated portion); browser UAT pending | All 5 must-have truths verified in code; WINDOWS.md ledger entry #16 (id 16, status still `open` as of this verification) remains open until the human-check below is confirmed |
+
+## Human Verification Required
+
+The 4 items below are harvested directly from Task 2's `<human-check>` block (deferred per `human_verify_mode = end-of-phase`, requiring a Docker rebuild/restart that is explicitly the user's responsibility, not this executor's). They are not gaps — the plan deliberately routes them to end-of-phase human verification and states the capability "proves itself only against a real IMAP/EWS mailbox, never against mocks."
+
+### 1. Fehlgeschlagene Verbindung gegen einen falschen Server
+**Test:** Auf "Meine Quellen" einen unsinnigen Servernamen (z.B. `gibtesnicht.example`) eintragen und "Verbindung testen" druecken.
+**Expected:** Kurz "Verbindung wird getestet...", danach rote Zeile "Verbindung fehlgeschlagen:" mit dem Klartext-Fehler des Mailservers.
+**Why human:** Reale Serverfehler sind nur an einem echten Endpunkt beobachtbar.
+
+### 2. Erfolgreiche Verbindung gegen ein echtes Postfach
+**Test:** Echte Postfachdaten samt Passwort eintragen und erneut druecken.
+**Expected:** Gruene Zeile "Verbindung erfolgreich".
+**Why human:** Erfordert einen erreichbaren, echten Mailserver.
+
+### 3. Erneuter Test ohne Passworteingabe (Rueckfall auf gespeicherte Zugangsdaten)
+**Test:** Speichern, Seite neu laden, ohne Passwort einzugeben nur den Testknopf druecken.
+**Expected:** Wieder "Verbindung erfolgreich" — Server nutzt die gespeicherten Zugangsdaten.
+**Why human:** Bestaetigt den Rueckfall-Pfad am echten Server-Roundtrip.
+
+### 4. Protokollzeilen frei von Zugangsdaten
+**Test:** Waehrend der drei Laeufe oben einen Blick in die API-Protokollzeilen werfen.
+**Expected:** Weder Benutzername noch Passwort tauchen dort auf.
+**Why human:** Laufzeit-Log-Ausgabe eines echten Prozesses ist nur am laufenden System beobachtbar; Code-Review bestaetigt nur die Abwesenheit credential-tragender Log-Statements im Quelltext, nicht das tatsaechliche Laufzeitverhalten.
+
+## Gaps Summary
+
+None. All automated must-haves (5/5 truths, 6/6 artifacts, 5/5 key links) verified directly against the codebase — measured independently of SUMMARY.md's claims: 646/646 API tests, 228/228 web tests, both typechecks clean, locale-key gate green (confirmed previously red per task brief), both commits (`3bf550b`, `c4db3b2`) present with matching file sets. The security-critical properties (userId sourced only from auth context, no body-supplied ownership field, no credential leakage in response or logs, same-user-only credential fallback) are all confirmed by direct code reading and dedicated unit tests. The only outstanding item is the deliberately-deferred browser UAT against a real mailbox, which per the plan's own `human_verify_mode = end-of-phase` routing is not treated as a gap — WINDOWS.md ledger entry #16 stays `open` until that UAT is confirmed by the user.
+
+---
+
+_Verified: 2026-09-07T15:50:00Z_
+_Verifier: Claude (gsd-verifier)_