fix: pass XOAUTH2 token as str, not bytes (was corrupting the Bearer value)

aioimaplib's mail.xoauth2(user, token) builds the SASL string by f-string interpolating the token, so a bytes token injects the b'...' repr into auth=Bearer and breaks every XOAUTH2 login. dropped the .encode() (token is already str via _resolve_token/_as_str). corrected the inline comment and the CLAUDE.md note that both wrongly claimed bytes was required — that false note propagated the bug through prior review passes.

Signed-off-by: disqualifier <dev@disqualifier.me>

README.md

@@ -11,16 +11,16 @@ This reads codes from email; it does not generate them (that is `pyotp`'s job).
 `requirements.txt`:
 
 ```
-aiomail @ git+ssh://git@git.rethinkstudios.io/rethink-public/aiomail.git@v0.1.0
+aiomail @ git+ssh://git@git.rethinkstudios.io/rethink-public/aiomail.git@v0.1.1
 # OAuth token providers (Microsoft / Google) need the extra:
-aiomail[oauth] @ git+ssh://git@git.rethinkstudios.io/rethink-public/aiomail.git@v0.1.0
+aiomail[oauth] @ git+ssh://git@git.rethinkstudios.io/rethink-public/aiomail.git@v0.1.1
 ```
 
 Direct:
 
 ```bash
-pip install "aiomail @ git+ssh://git@git.rethinkstudios.io/rethink-public/aiomail.git@v0.1.0"
+pip install "aiomail @ git+ssh://git@git.rethinkstudios.io/rethink-public/aiomail.git@v0.1.1"
-pip install "aiomail[oauth] @ git+ssh://git@git.rethinkstudios.io/rethink-public/aiomail.git@v0.1.0"
+pip install "aiomail[oauth] @ git+ssh://git@git.rethinkstudios.io/rethink-public/aiomail.git@v0.1.1"
 ```
 
 Requires `aioimaplib` and `beautifulsoup4` (pulled transitively). The `oauth`

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "aiomail"
-version = "0.1.0"
+version = "0.1.1"
 description = "async IMAP one-time-code retrieval with password/OAuth2 auth and dynamic matching"
 requires-python = ">=3.10"
 dependencies = [

src/aiomail/__init__.py

@@ -29,4 +29,4 @@ __all__ = [
     "DEFAULT_FOLDERS",
 ]
 
-__version__ = "0.1.0"
+__version__ = "0.1.1"

src/aiomail/auth.py

@@ -38,6 +38,15 @@ class PasswordAuth:
             raise RuntimeError(f"login failed: {result} {data}")
 
 
+def _as_str(token) -> str:
+    """coerce a token to str (a provider may hand back bytes)
+
+    both XOAUTH2 entrypoints downstream need a str (one .encode()s it, the SASL
+    builder interpolates it), so normalize here rather than crashing on bytes.
+    """
+    return token.decode() if isinstance(token, bytes) else token
+
+
 def _sasl_xoauth2(user: str, token: str) -> str:
     """build the base64 XOAUTH2 SASL initial-response string"""
     raw = f"user={user}\x01auth=Bearer {token}\x01\x01".encode()
@@ -71,17 +80,19 @@ class OAuth2Auth:
             token = await result if hasattr(result, "__await__") else result
             if not token:
                 raise RuntimeError("token provider returned an empty token")
-            return token
+            return _as_str(token)
-        return self._token  # type: ignore[return-value]
+        return _as_str(self._token)  # type: ignore[arg-type]
 
     async def authenticate(self, mail) -> None:
         token = await self._resolve_token()
-        # aioimaplib exposes mail.xoauth2(user, token: bytes) — note the token must
+        # aioimaplib's mail.xoauth2(user, token) builds the SASL string by f-string
-        # be bytes, not str. older/other clients that lack it but expose a generic
+        # interpolating the token, so token MUST be str — passing bytes interpolates
-        # authenticate() are driven via the SASL string from _sasl_xoauth2.
+        # the b'...' repr and corrupts the Bearer value. _resolve_token already
+        # returns str (via _as_str). clients lacking .xoauth2 are driven via the
+        # SASL callback from _sasl_xoauth2.
         xoauth2 = getattr(mail, "xoauth2", None)
         if xoauth2 is not None:
-            result, data = await xoauth2(self.user, token.encode())
+            result, data = await xoauth2(self.user, token)
         elif hasattr(mail, "authenticate"):
             result, data = await mail.authenticate(
                 "XOAUTH2", lambda _: _sasl_xoauth2(self.user, token)

src/aiomail/client.py

@@ -67,6 +67,11 @@ class IMAPClient:
                 return True
             except Exception as exc:
                 log.warning("connect attempt %d/%d failed: %s", attempt + 1, self.max_retries, exc)
+                if self._mail is not None:
+                    try:
+                        await self._mail.logout()
+                    except Exception as teardown:
+                        log.debug("logout error ignored during failed connect: %s", teardown)
                     self._mail = None
                 await asyncio.sleep(2 * (attempt + 1))
         return False
@@ -138,7 +143,14 @@ class IMAPClient:
             return []
         if result != "OK" or not data or not data[0]:
             return []
-        ids = [int(x) for x in data[0].split()]
+        ids = []
+        for token in data[0].split():
+            try:
+                ids.append(int(token))
+            except (TypeError, ValueError):
+                # tolerate a malformed/non-numeric token in the SEARCH response
+                # instead of crashing the whole search
+                log.debug("skipping non-numeric search token: %r", token)
         return sorted(set(ids), reverse=True)
 
     async def fetch(self, email_id: int, *, icloud: bool = False) -> Optional[email.message.Message]:

src/aiomail/oauth.py

@@ -6,6 +6,7 @@ without aiohttp raises a clear error only when a provider is instantiated.
 
 credentials (client_id, refresh_token) are always supplied by the caller.
 """
+import asyncio
 import logging
 import time
 from typing import Optional, Sequence
@@ -85,8 +86,6 @@ class _RefreshTokenProvider:
                 except Exception as exc:
                     log.warning("token request to %s failed: %s", endpoint, exc)
             if attempt < self.max_retries - 1:
-                import asyncio
-
                 await asyncio.sleep(2 ** attempt)
 
         self._failures += 1