From 0643cf0cb1cb470e5c1d2e8bd8856680545443ea Mon Sep 17 00:00:00 2001
From: link2xt <link2xt@testrun.org>
Date: Fri, 15 May 2026 18:43:48 +0200
Subject: [PATCH] fixup: download legacy Secure-Join messages even if
 encryption is enforced

---
 src/imap.rs         | 19 ++++++++++++-------
 src/imap/session.rs |  1 +
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/src/imap.rs b/src/imap.rs
index d6cabae0e..fbd0eaa98 100644
--- a/src/imap.rs
+++ b/src/imap.rs
@@ -1994,12 +1994,15 @@ pub(crate) async fn prefetch_should_download(
     // prevent_rename=true as this might be a mailing list message and in this case it would be bad if we rename the contact.
     // (prevent_rename is the last argument of from_field_to_contact_id())
 
-    let is_encrypted = if let Some(content_type) = headers.get_header_value(HeaderDef::ContentType)
-    {
-        mailparse::parse_content_type(&content_type).mimetype == "multipart/encrypted"
-    } else {
-        false
-    };
+    // New SecureJoin is fully encrypted,
+    // but for compatibility we still download legacy `Secure-Join: vc-request` messages.
+    let is_legacy_securejoin = headers.get_header_value(HeaderDef::SecureJoin).is_some();
+
+    let is_encrypted = headers
+        .get_header_value(HeaderDef::ContentType)
+        .is_some_and(|content_type| {
+            mailparse::parse_content_type(&content_type).mimetype == "multipart/encrypted"
+        });
 
     if flags.any(|f| f == Flag::Draft) {
         info!(context, "Ignoring draft message");
@@ -2008,7 +2011,9 @@ pub(crate) async fn prefetch_should_download(
 
     let should_download = maybe_ndn
         || (!blocked_contact
-            && (is_encrypted || !context.get_config_bool(Config::ForceEncryption).await?));
+            && (is_legacy_securejoin
+                || is_encrypted
+                || !context.get_config_bool(Config::ForceEncryption).await?));
     Ok(should_download)
 }
 
diff --git a/src/imap/session.rs b/src/imap/session.rs
index e1e397574..c9178d8f6 100644
--- a/src/imap/session.rs
+++ b/src/imap/session.rs
@@ -22,6 +22,7 @@ const PREFETCH_FLAGS: &str = "(UID RFC822.SIZE BODY.PEEK[HEADER.FIELDS (\
                               X-MICROSOFT-ORIGINAL-MESSAGE-ID \
                               FROM \
                               CONTENT-TYPE \
+                              SECURE-JOIN \
                               CHAT-VERSION \
                               CHAT-IS-POST-MESSAGE \
                               AUTOCRYPT-SETUP-MESSAGE\