@aglyn/plugins-email 1.0.0-beta.143

package/src/lib/components/sending-sender-drawer.js

@@ -0,0 +1,543 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ 'use client';
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { hostRoleFor, HOST_ACCESS_ROLES, pluginDocsHelp } from "@aglyn/aglyn";
+import { ICON_VARIANT_CLOSE } from "@aglyn/shared-data-enums";
+import { Container, HelpTip, MdiIcon, SrOnly } from "@aglyn/shared-ui-jsx";
+import { NavigationDrawerComponent } from "@aglyn/shared-ui-jsx/components/navigation-drawer.component";
+import { normalizeLocalPart, validateSendingLocalPart } from "@aglyn/shared-util-email";
+import { useFirestore, useFirestoreCollection } from "@aglyn/tenant-feature-instance";
+import { Alert, Button, Divider, IconButton, InputAdornment, MenuItem, Stack, TextField, Typography } from "@mui/material";
+import { collection, limit, query, where } from "firebase/firestore";
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { useSendingApi } from "@aglyn/tenant-feature-instance/hooks/use-sending-identity-api";
+/**
+ * How many people each of the roster reads may return.
+ *
+ * A ceiling rather than a page, because this control is a shortcut and not a
+ * roster: somebody choosing a sender knows who they are looking for, and a
+ * site large enough to overflow this has an admin who can type the three
+ * fields directly. Bounded because the read happens on a merchant's settings
+ * screen, and an unbounded one would grow with the site for no benefit.
+ *
+ * 250 is the largest per-site collaborator allowance any finite plan grants
+ * (`membersPerHost`), so on every plan below Enterprise the whole entitled
+ * set fits and nothing is cut. Where it does bite it cuts in document-id
+ * order, which is a stable slice and not a ranked one — the queries below are
+ * already narrowed to people who can reach this site, so what is dropped is a
+ * tail of an entitled roster rather than an arbitrary sample of a workspace.
+ */ const SENDER_PICKER_CEILING = 250;
+/**
+ * ONE SENDER THIS SITE MAY SEND AS.
+ *
+ * Three fields, and they are not three of a kind. The MAILBOX is the part of
+ * the address in front of the `@`; the domain behind it is whatever this
+ * site's verified identity resolves to and is not editable here, because
+ * DMARC on the sending apex is published `adkim=s` and the `From:` domain has
+ * to be exactly the domain whose DKIM key signed the message. The NAME is
+ * what a recipient reads in their inbox list. The REPLY ADDRESS is the only
+ * one of the three that may name a mailbox on a domain nobody here has
+ * verified — which is what makes "replies reach me personally" possible
+ * without pretending the mail came from a personal account.
+ *
+ * ## Why a site holds a LIST, and why the composer picks from it
+ *
+ * The composer already carries a from name and a reply-to per campaign, and
+ * keeps them: those are per-message facts. The mailbox is not, because it is
+ * an address that has to work — a bounce returns to it, and a mail client
+ * that ignores `Reply-To:` answers to it. A mailbox that exists in one
+ * campaign's headers and nowhere else is an address nobody serves.
+ *
+ * So a mailbox is configured HERE, once, and a campaign chooses among the
+ * senders that were configured. A per-send address field would be the thing
+ * that closure removed; a per-send choice between approved senders is not.
+ *
+ * The gates differ for the same reason. Deciding which addresses this site's
+ * mail may leave on is an organization-admin decision and lives here beside
+ * the domain it depends on; the composer is admin-or-editor and may pick
+ * among them and name the person in front of the address.
+ *
+ * ## The picker
+ *
+ * "Send as a person" is mostly one action — take a teammate's name and their
+ * mailbox and make the mail read as theirs — so the picker does all three
+ * fields at once and then lets any of them be edited. The address it proposes
+ * is derived from the part of their email in front of the `@`, which is the
+ * name they already answer to, and their real address becomes the reply
+ * target rather than the sender: a `From:` on their own mail provider's
+ * domain could never align, and would be rejected rather than delivered.
+ *
+ * Opened to ADD, it fills a new sender and leaves the ones this site already
+ * has alone — which is what makes "send as Jamie" an address beside the
+ * others rather than a rename of the only one.
+ *
+ * ## Who is on the list
+ *
+ * Everybody who can reach this site, from wherever their access comes from:
+ * the organization's team, whose members reach a site through an org role or
+ * an `allHosts` flag or a per-site grant, and the site's own collaborators,
+ * who are on it and nowhere else. Both, because either alone is a picker that
+ * is missing people — and a workspace that manages its team entirely at the
+ * org level has an empty site roster, so reading only that one offered no
+ * teammates at all.
+ *
+ * Nobody else. An org member scoped to other sites is not a candidate sender
+ * for this one: the address would work, and the person would be signing mail
+ * for a site they cannot open. `hostRoleFor` draws that line, and it is the
+ * same one the rules and every server gate draw.
+ *
+ * The roster is read only while this drawer is open. It is four collection
+ * reads on a settings surface, and ones that happen because somebody asked for
+ * them are a different thing from ones that happen because a card mounted.
+ */ export function SendingSenderDrawer(props) {
+    var _find, _ref, _ref1, _ref2;
+    const { open, hostId, view, senderId, onClose, onSaved } = props;
+    const call = useSendingApi();
+    const firestore = useFirestore();
+    const [mailbox, setMailbox] = useState('');
+    const [fromName, setFromName] = useState('');
+    const [replyTo, setReplyTo] = useState('');
+    const [busy, setBusy] = useState(false);
+    const [error, setError] = useState('');
+    /**
+   * The row being edited, or null while adding one.
+   *
+   * Resolved from the view the card already holds rather than read again here:
+   * the list and the editor open from one answer, so they cannot disagree
+   * about what a sender currently is.
+   */ const editing = senderId ? (_find = ((_ref = view == null ? void 0 : view.senders) != null ? _ref : []).find((sender)=>sender.id === senderId)) != null ? _find : null : null;
+    /*
+   * The stored values are copied in when the drawer OPENS, not on every
+   * render of the card.
+   *
+   * A settings form seeded from a prop that keeps arriving would discard what
+   * somebody was halfway through typing the moment the card re-read the
+   * identity behind them — so the dependencies are the row's FIELDS and not
+   * the array they came in, which is a new array on every read.
+   */ useEffect(()=>{
+        var _ref, _ref1, _ref2;
+        if (!open) return;
+        setMailbox((_ref = editing == null ? void 0 : editing.localPart) != null ? _ref : '');
+        setFromName((_ref1 = editing == null ? void 0 : editing.fromName) != null ? _ref1 : '');
+        setReplyTo((_ref2 = editing == null ? void 0 : editing.replyTo) != null ? _ref2 : '');
+        setError('');
+    }, [
+        open,
+        senderId,
+        editing == null ? void 0 : editing.localPart,
+        editing == null ? void 0 : editing.fromName,
+        editing == null ? void 0 : editing.replyTo
+    ]);
+    /*
+   * The org this site belongs to, as the identity route resolved it.
+   *
+   * Taken from the view rather than read again here, so the drawer and the
+   * card it opens from agree about which workspace they are looking at, and
+   * so the org reads below cannot start before the route has answered.
+   */ const orgId = String((_ref1 = view == null ? void 0 : view.orgId) != null ? _ref1 : '');
+    const reading = open && Boolean(hostId);
+    /*
+   * THE SITE'S OWN COLLABORATOR ROSTER — `hosts/{hostId}/members`.
+   *
+   * Not the whole answer, and reading it alone was the defect: this
+   * subcollection holds only people added TO ONE SITE by
+   * `POST /api/hosts/members`. A workspace whose team reaches every site
+   * through their org membership has no rows here at all, so a picker built
+   * on it offered whichever one address happened to have been added this way
+   * and no teammates whatsoever.
+   *
+   * It stays because it is the only source for one population: somebody
+   * invited to the site by an address with no Aglyn account behind it yet has
+   * a roster row and, until they accept, no org member document. They are a
+   * real person with a real mailbox who has been granted access, which is all
+   * a reply address needs.
+   *
+   * Ordered by nothing, and capped: see {@link SENDER_PICKER_CEILING}. This
+   * subcollection has exactly one writer and it writes `email` on every
+   * document, so an `orderBy('email')` would be safe here — it buys nothing,
+   * because the merged set below is arranged for display after the fact and a
+   * server order over one of four reads cannot survive the merge.
+   */ const { data: siteMemberDocs } = useFirestoreCollection(()=>reading ? query(collection(firestore, 'hosts', hostId, 'members'), limit(SENDER_PICKER_CEILING)) : null, [
+        firestore,
+        hostId,
+        reading
+    ], {
+        idField: '$id'
+    });
+    /*
+   * THE ORG'S TEAM — `orgs/{orgId}/members`, in the three shapes that reach
+   * one host.
+   *
+   * `hostRoleFor` is the predicate the rules, the ~20 server gates and
+   * `useHostRole` all resolve a member's access to a site with, and it is a
+   * disjunction of exactly three cases: an owner or admin spans every site; an
+   * editor or viewer with `allHosts` spans every site at their org role; and
+   * anybody may carry an explicit per-site grant in `hostAccess`. Firestore
+   * cannot express that as one query, so it is asked as three and merged.
+   *
+   * ## Three narrow reads rather than one broad one
+   *
+   * The alternative — read the roster and filter in the browser — reads every
+   * member of the workspace to find the few who work on this site, and the cap
+   * would then apply BEFORE the filter: in an org of 400 where five people
+   * have this site, the picker could contain none of them. Splitting the
+   * predicate across the wire means the cap only ever cuts a tail of people
+   * who all belong in the list.
+   *
+   * ## The `orderBy` trap, and why there is no `orderBy` here
+   *
+   * `orderBy` matches only documents that HAVE the field, so ordering on one
+   * some writer omits hides rows instead of arranging them. `email` is NOT
+   * safe to order on in this collection: `AglynOrgMember` declares it
+   * optional, and two production paths create a member document without it —
+   * `PATCH /api/hosts/members` re-grants host access with no identity fields,
+   * and `POST /api/orgs/members` omits it entirely when the auth record
+   * carries no email. Ordering on it would drop exactly the teammates this
+   * change exists to surface, silently.
+   *
+   * Each `where` below is safe in a way an `orderBy` is not, and for the same
+   * reason it looks unsafe: a document missing `role`, missing `allHosts` or
+   * missing `hostAccess` is dropped by the filter — and `hostRoleFor` resolves
+   * every one of those to "no access" anyway. The predicate and the index
+   * agree about what absence means, so the query cannot hide anybody the
+   * filter would have kept.
+   */ const orgMembers = (constrain)=>()=>reading && orgId ? constrain(collection(firestore, 'orgs', orgId, 'members')) : null;
+    const { data: orgAdminDocs } = useFirestoreCollection(orgMembers((base)=>query(base, where('role', 'in', [
+            'owner',
+            'admin'
+        ]), limit(SENDER_PICKER_CEILING))), [
+        firestore,
+        orgId,
+        reading
+    ], {
+        idField: '$id'
+    });
+    const { data: orgWideDocs } = useFirestoreCollection(orgMembers((base)=>query(base, where('allHosts', '==', true), limit(SENDER_PICKER_CEILING))), [
+        firestore,
+        orgId,
+        reading
+    ], {
+        idField: '$id'
+    });
+    /*
+   * `HOST_ACCESS_ROLES` rather than a written-out array, for the reason it
+   * exists: a role added to `HostAccessRole` and missing from an `in` list is
+   * a person who holds access and cannot be seen to, with no error to explain
+   * it. The constant is built from a `Record` so a new role fails to compile
+   * there instead of quietly shortening this query.
+   */ const { data: orgScopedDocs } = useFirestoreCollection(orgMembers((base)=>query(base, where(`hostAccess.${hostId}`, 'in', HOST_ACCESS_ROLES), limit(SENDER_PICKER_CEILING))), [
+        firestore,
+        orgId,
+        hostId,
+        reading
+    ], {
+        idField: '$id'
+    });
+    const candidates = useMemo(()=>{
+        /*
+     * ONE ROW PER PERSON, keyed by uid.
+     *
+     * The same teammate legitimately appears in several of these reads — an
+     * org admin who is also an explicit collaborator is in two, and an org
+     * member who accepted a site invite has a roster row as well — so the
+     * merge is by identity rather than by document. The org member document
+     * and the site roster row are keyed by the same uid, which is what makes
+     * that possible: `POST /api/hosts/members` names the roster document after
+     * the auth uid whenever an account exists, and falls back to a generated
+     * id only for an address that has none. Such a row has no org document to
+     * collide with, so the fallback cannot merge two people into one.
+     *
+     * Fields are taken from the first read that has them rather than from a
+     * chosen winner. Neither source is complete on its own: the site roster
+     * always carries an `email` and never a `displayName`, and an org member
+     * document usually carries both but is allowed to omit either.
+     */ const byPerson = new Map();
+        const fold = (id, entry)=>{
+            var _byPerson_get, _ref, _ref1;
+            if (!id) return;
+            const current = (_byPerson_get = byPerson.get(id)) != null ? _byPerson_get : {
+                id,
+                email: '',
+                displayName: ''
+            };
+            byPerson.set(id, {
+                id,
+                email: current.email || String((_ref = entry == null ? void 0 : entry.email) != null ? _ref : '').trim(),
+                displayName: current.displayName || String((_ref1 = entry == null ? void 0 : entry.displayName) != null ? _ref1 : '').trim()
+            });
+        };
+        /*
+     * THE PREDICATE IS APPLIED AGAIN HERE, over the documents themselves.
+     *
+     * The three queries are the predicate projected onto an index, and an
+     * index answers a coarser question than the function does — `allHosts`
+     * reaches every site only for a member who HAS an org role, and a document
+     * carrying the flag with no role is a member of nothing. `hostRoleFor` is
+     * the one definition of "can this person reach this site", so it decides,
+     * and the queries are only what keeps the reads narrow.
+     */ for (const entry of [
+            ...orgAdminDocs != null ? orgAdminDocs : [],
+            ...orgWideDocs != null ? orgWideDocs : [],
+            ...orgScopedDocs != null ? orgScopedDocs : []
+        ]){
+            var _ref;
+            if (!hostRoleFor(entry, hostId)) continue;
+            fold(String((_ref = entry == null ? void 0 : entry.$id) != null ? _ref : ''), entry);
+        }
+        /*
+     * The site's roster rows carry no role of their own to resolve — being in
+     * this subcollection IS access to this site, which is what the Users card
+     * on the site's own settings page renders it as. `uid` before `$id` so an
+     * accepted collaborator merges onto their org member document rather than
+     * arriving as a second row for the same person.
+     */ for (const entry of siteMemberDocs != null ? siteMemberDocs : []){
+            fold(String((entry == null ? void 0 : entry.uid) || (entry == null ? void 0 : entry.$id) || ''), entry);
+        }
+        return [
+            ...byPerson.values()
+        ]/*
+         * An address is not optional. It is what the mailbox is derived from
+         * and what replies are pointed at, so a person recorded without one
+         * has nothing this picker could fill in.
+         */ .filter((entry)=>entry.email)/*
+         * Sorted here rather than by the server, because this is a COMPLETE
+         * set and not a page: four reads have been merged, so no server order
+         * survives, and arranging a page in the browser is what makes an
+         * arbitrary slice read as a ranked one. By the name a person is
+         * looking for, falling back to the address for somebody who has none.
+         */ .sort((left, right)=>(left.displayName || left.email).localeCompare(right.displayName || right.email, undefined, {
+                sensitivity: 'base'
+            }));
+    }, [
+        orgAdminDocs,
+        orgWideDocs,
+        orgScopedDocs,
+        siteMemberDocs,
+        hostId
+    ]);
+    /*
+   * The domain half, shown as a fixed suffix rather than as a field.
+   *
+   * A person setting a sender is choosing an address, and an address with its
+   * domain missing from the screen is one they have to assemble in their head
+   * from the alert above. Read from the identity the server resolved, so it
+   * is the domain a send would actually use.
+   */ const domain = String((_ref2 = view == null ? void 0 : view.selected) != null ? _ref2 : '');
+    const pooled = Boolean(view) && !(view == null ? void 0 : view.localPartInUse);
+    const handleSave = useCallback(async ()=>{
+        var _ref;
+        if (busy) return;
+        /*
+     * A POOLED SITE SENDS NO MAILBOX AT ALL, rather than sending one the
+     * route will refuse.
+     *
+     * The field is disabled above and the alert says why, and this is the
+     * half that matters: a merchant on the shared address editing their
+     * sender name would otherwise have the whole save rejected over a field
+     * they were never offered.
+     */ const checked = pooled ? null : validateSendingLocalPart(mailbox);
+        if (checked == null ? void 0 : checked.error) return setError(checked.error);
+        setError('');
+        setBusy(true);
+        const { response, payload } = await call({
+            path: 'sending-identity',
+            method: 'POST',
+            /*
+       * No `domain` key. Absent means "this is not a decision about the
+       * domain" — an empty one would mean "move this site back to the address
+       * Aglyn issues it", which would reset a site sending as its own
+       * verified name every time somebody edited the sender.
+       */ body: _extends({
+                hostId,
+                action: senderId ? 'updateSender' : 'createSender'
+            }, senderId ? {
+                senderId
+            } : {}, (checked == null ? void 0 : checked.localPart) ? {
+                localPart: checked.localPart
+            } : {}, {
+                fromName: fromName.trim(),
+                replyTo: replyTo.trim()
+            })
+        });
+        setBusy(false);
+        if (!response.ok) {
+            var _ref1;
+            return setError((_ref1 = payload == null ? void 0 : payload.error) != null ? _ref1 : 'Could not save who this site sends as');
+        }
+        onSaved(String((_ref = payload == null ? void 0 : payload.senderId) != null ? _ref : '') || undefined);
+        onClose();
+    }, [
+        busy,
+        call,
+        hostId,
+        senderId,
+        mailbox,
+        pooled,
+        fromName,
+        replyTo,
+        onSaved,
+        onClose
+    ]);
+    const applyCandidate = useCallback((candidate)=>{
+        const at = candidate.email.lastIndexOf('@');
+        const proposed = normalizeLocalPart(at > 0 ? candidate.email.slice(0, at) : '');
+        if (proposed) setMailbox(proposed);
+        if (candidate.displayName) setFromName(candidate.displayName);
+        setReplyTo(candidate.email);
+        setError('');
+    }, []);
+    return /*#__PURE__*/ _jsx(NavigationDrawerComponent, {
+        open: open,
+        anchor: "right",
+        variant: "temporary",
+        onClose: onClose,
+        AppBarProps: {
+            color: 'surface'
+        },
+        appBarLeft: /*#__PURE__*/ _jsxs(_Fragment, {
+            children: [
+                /*#__PURE__*/ _jsxs(IconButton, {
+                    color: "inherit",
+                    edge: "start",
+                    onClick: onClose,
+                    sx: {
+                        mr: 2
+                    },
+                    children: [
+                        /*#__PURE__*/ _jsx(MdiIcon, {
+                            path: ICON_VARIANT_CLOSE.path
+                        }),
+                        /*#__PURE__*/ _jsx(SrOnly, {
+                            children: "close drawer"
+                        })
+                    ]
+                }),
+                /*#__PURE__*/ _jsx(Typography, {
+                    variant: "h6",
+                    component: "div",
+                    children: senderId ? 'Edit this sender' : 'Add a sender'
+                }),
+                /*#__PURE__*/ _jsx(HelpTip, _extends({}, pluginDocsHelp('emailCampaigns', {
+                    anchor: '#senders',
+                    title: 'Senders',
+                    excerpt: 'A mailbox this site may send as, with the name and reply ' + 'address that go out in front of it. A campaign picks one of ' + 'them rather than typing an address.'
+                })))
+            ]
+        }),
+        children: /*#__PURE__*/ _jsx(Container, {
+            gutterY: true,
+            children: /*#__PURE__*/ _jsxs(Stack, {
+                spacing: 2,
+                children: [
+                    /*#__PURE__*/ _jsx(Typography, {
+                        variant: "body2",
+                        color: "text.secondary",
+                        children: 'An address your email may leave on, and the name in front of ' + 'it. The domain is your site’s verified sending domain and ' + 'cannot be changed here — the part before the @ can. To have ' + 'replies reach a personal or company mailbox, use the reply ' + 'address: sending as an address on somebody else’s mail ' + 'provider is refused by the receiving side, not delivered.'
+                    }),
+                    /*#__PURE__*/ _jsx(Typography, {
+                        variant: "body2",
+                        color: "text.secondary",
+                        children: (editing == null ? void 0 : editing.isDefault) ? 'Every email you compose picks a sender. This is the one an ' + 'email that names no other goes out as.' : 'Every email you compose picks a sender, and this will be ' + 'one of the choices.'
+                    }),
+                    candidates.length ? /*#__PURE__*/ _jsxs(_Fragment, {
+                        children: [
+                            /*#__PURE__*/ _jsx(TextField, {
+                                select: true,
+                                label: "Send as a person",
+                                value: "",
+                                size: "small",
+                                onChange: (event)=>{
+                                    const match = candidates.find((entry)=>entry.id === event.target.value);
+                                    if (match) applyCandidate(match);
+                                },
+                                helperText: "Fills the three fields below from someone who works on this site",
+                                children: candidates.map((candidate)=>/*#__PURE__*/ _jsx(MenuItem, {
+                                        value: candidate.id,
+                                        children: /*#__PURE__*/ _jsxs(Stack, {
+                                            spacing: 0,
+                                            children: [
+                                                candidate.displayName ? /*#__PURE__*/ _jsx(Typography, {
+                                                    variant: "body2",
+                                                    children: candidate.displayName
+                                                }) : null,
+                                                /*#__PURE__*/ _jsx(Typography, {
+                                                    variant: candidate.displayName ? 'caption' : 'body2',
+                                                    color: candidate.displayName ? 'text.secondary' : undefined,
+                                                    children: candidate.email
+                                                })
+                                            ]
+                                        })
+                                    }, candidate.id))
+                            }),
+                            /*#__PURE__*/ _jsx(Divider, {})
+                        ]
+                    }) : null,
+                    pooled ? /*#__PURE__*/ _jsx(Alert, {
+                        severity: "info",
+                        children: 'This site sends on a shared Aglyn address, whose mailbox is ' + 'fixed and shared with the other sites on it. The name and ' + 'reply address below apply to that mail; the mailbox takes ' + 'effect once this site has a domain of its own.'
+                    }) : null,
+                    /*#__PURE__*/ _jsx(TextField, {
+                        label: "Mailbox",
+                        value: mailbox,
+                        onChange: (event)=>setMailbox(event.target.value),
+                        size: "small",
+                        disabled: pooled,
+                        slotProps: {
+                            input: domain ? {
+                                endAdornment: /*#__PURE__*/ _jsx(InputAdornment, {
+                                    position: "end",
+                                    children: `@${domain}`
+                                })
+                            } : undefined
+                        },
+                        helperText: 'The part before the @ — for example hello, sales or jamie'
+                    }),
+                    /*#__PURE__*/ _jsx(TextField, {
+                        label: "Sender name",
+                        value: fromName,
+                        onChange: (event)=>setFromName(event.target.value),
+                        size: "small",
+                        helperText: "Shown in front of the address. A person’s name, or your brand"
+                    }),
+                    /*#__PURE__*/ _jsx(TextField, {
+                        label: "Reply address",
+                        value: replyTo,
+                        onChange: (event)=>setReplyTo(event.target.value),
+                        size: "small",
+                        type: "email",
+                        helperText: "Where replies go. May be any mailbox, including a personal one"
+                    }),
+                    error ? /*#__PURE__*/ _jsx(Alert, {
+                        severity: "error",
+                        children: error
+                    }) : null,
+                    /*#__PURE__*/ _jsx(Button, {
+                        variant: "contained",
+                        disabled: busy || !view,
+                        onClick: ()=>void handleSave(),
+                        children: busy ? 'Saving…' : senderId ? 'Save sender' : 'Add sender'
+                    })
+                ]
+            })
+        })
+    });
+}
+SendingSenderDrawer.displayName = 'SendingSenderDrawer';
+export default SendingSenderDrawer;
+
+//# sourceMappingURL=sending-sender-drawer.js.map

package/src/lib/components/sending-sender-drawer.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/email/src/lib/components/sending-sender-drawer.tsx"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n'use client'\n\nimport { hostRoleFor, HOST_ACCESS_ROLES, pluginDocsHelp } from '@aglyn/aglyn'\nimport { ICON_VARIANT_CLOSE } from '@aglyn/shared-data-enums'\nimport { Container, HelpTip, MdiIcon, SrOnly } from '@aglyn/shared-ui-jsx'\nimport { NavigationDrawerComponent } from '@aglyn/shared-ui-jsx/components/navigation-drawer.component'\nimport {\n  normalizeLocalPart,\n  validateSendingLocalPart,\n} from '@aglyn/shared-util-email'\nimport {\n  useFirestore,\n  useFirestoreCollection,\n} from '@aglyn/tenant-feature-instance'\nimport {\n  Alert,\n  Button,\n  Divider,\n  IconButton,\n  InputAdornment,\n  MenuItem,\n  Stack,\n  TextField,\n  Typography,\n} from '@mui/material'\nimport { collection, limit, query, where } from 'firebase/firestore'\nimport { useCallback, useEffect, useMemo, useState } from 'react'\nimport {\n  useSendingApi,\n  type SendingIdentityView,\n} from '@aglyn/tenant-feature-instance/hooks/use-sending-identity-api'\n\n/**\n * How many people each of the roster reads may return.\n *\n * A ceiling rather than a page, because this control is a shortcut and not a\n * roster: somebody choosing a sender knows who they are looking for, and a\n * site large enough to overflow this has an admin who can type the three\n * fields directly. Bounded because the read happens on a merchant's settings\n * screen, and an unbounded one would grow with the site for no benefit.\n *\n * 250 is the largest per-site collaborator allowance any finite plan grants\n * (`membersPerHost`), so on every plan below Enterprise the whole entitled\n * set fits and nothing is cut. Where it does bite it cuts in document-id\n * order, which is a stable slice and not a ranked one — the queries below are\n * already narrowed to people who can reach this site, so what is dropped is a\n * tail of an entitled roster rather than an arbitrary sample of a workspace.\n */\nconst SENDER_PICKER_CEILING = 250\n\nexport interface SendingSenderDrawerProps {\n  open: boolean\n  hostId: string\n  /** The identity as the route reports it. Null while the card is loading. */\n  view: SendingIdentityView | null\n  /**\n   * WHICH SENDER THIS DRAWER IS EDITING, or `null` to add one.\n   *\n   * The two modes differ in what the fields start as and in nothing else: an\n   * edit opens on the row's stored values, and an add opens empty so the\n   * picker below fills a NEW sender rather than overwriting the one this site\n   * already has.\n   */\n  senderId?: string | null\n  onClose: () => void\n  /**\n   * Called after a successful save, so the caller can re-read the identity.\n   *\n   * Carries the id the route answered with, which is what a caller that has to\n   * SELECT the new sender needs — the composer opens this drawer from its From\n   * picker, and the row it must then choose does not exist in any list it\n   * holds until it re-reads. A caller that only refreshes ignores it.\n   */\n  onSaved: (senderId?: string) => void\n}\n\n/** One row of the picker, reduced to what a sender needs from a person. */\ninterface SenderCandidate {\n  id: string\n  email: string\n  displayName: string\n}\n\n/**\n * ONE SENDER THIS SITE MAY SEND AS.\n *\n * Three fields, and they are not three of a kind. The MAILBOX is the part of\n * the address in front of the `@`; the domain behind it is whatever this\n * site's verified identity resolves to and is not editable here, because\n * DMARC on the sending apex is published `adkim=s` and the `From:` domain has\n * to be exactly the domain whose DKIM key signed the message. The NAME is\n * what a recipient reads in their inbox list. The REPLY ADDRESS is the only\n * one of the three that may name a mailbox on a domain nobody here has\n * verified — which is what makes \"replies reach me personally\" possible\n * without pretending the mail came from a personal account.\n *\n * ## Why a site holds a LIST, and why the composer picks from it\n *\n * The composer already carries a from name and a reply-to per campaign, and\n * keeps them: those are per-message facts. The mailbox is not, because it is\n * an address that has to work — a bounce returns to it, and a mail client\n * that ignores `Reply-To:` answers to it. A mailbox that exists in one\n * campaign's headers and nowhere else is an address nobody serves.\n *\n * So a mailbox is configured HERE, once, and a campaign chooses among the\n * senders that were configured. A per-send address field would be the thing\n * that closure removed; a per-send choice between approved senders is not.\n *\n * The gates differ for the same reason. Deciding which addresses this site's\n * mail may leave on is an organization-admin decision and lives here beside\n * the domain it depends on; the composer is admin-or-editor and may pick\n * among them and name the person in front of the address.\n *\n * ## The picker\n *\n * \"Send as a person\" is mostly one action — take a teammate's name and their\n * mailbox and make the mail read as theirs — so the picker does all three\n * fields at once and then lets any of them be edited. The address it proposes\n * is derived from the part of their email in front of the `@`, which is the\n * name they already answer to, and their real address becomes the reply\n * target rather than the sender: a `From:` on their own mail provider's\n * domain could never align, and would be rejected rather than delivered.\n *\n * Opened to ADD, it fills a new sender and leaves the ones this site already\n * has alone — which is what makes \"send as Jamie\" an address beside the\n * others rather than a rename of the only one.\n *\n * ## Who is on the list\n *\n * Everybody who can reach this site, from wherever their access comes from:\n * the organization's team, whose members reach a site through an org role or\n * an `allHosts` flag or a per-site grant, and the site's own collaborators,\n * who are on it and nowhere else. Both, because either alone is a picker that\n * is missing people — and a workspace that manages its team entirely at the\n * org level has an empty site roster, so reading only that one offered no\n * teammates at all.\n *\n * Nobody else. An org member scoped to other sites is not a candidate sender\n * for this one: the address would work, and the person would be signing mail\n * for a site they cannot open. `hostRoleFor` draws that line, and it is the\n * same one the rules and every server gate draw.\n *\n * The roster is read only while this drawer is open. It is four collection\n * reads on a settings surface, and ones that happen because somebody asked for\n * them are a different thing from ones that happen because a card mounted.\n */\nexport function SendingSenderDrawer(props: SendingSenderDrawerProps) {\n  const { open, hostId, view, senderId, onClose, onSaved } = props\n  const call = useSendingApi()\n  const firestore = useFirestore()\n\n  const [mailbox, setMailbox] = useState('')\n  const [fromName, setFromName] = useState('')\n  const [replyTo, setReplyTo] = useState('')\n  const [busy, setBusy] = useState(false)\n  const [error, setError] = useState('')\n\n  /**\n   * The row being edited, or null while adding one.\n   *\n   * Resolved from the view the card already holds rather than read again here:\n   * the list and the editor open from one answer, so they cannot disagree\n   * about what a sender currently is.\n   */\n  const editing = senderId\n    ? ((view?.senders ?? []).find((sender) => sender.id === senderId) ?? null)\n    : null\n\n  /*\n   * The stored values are copied in when the drawer OPENS, not on every\n   * render of the card.\n   *\n   * A settings form seeded from a prop that keeps arriving would discard what\n   * somebody was halfway through typing the moment the card re-read the\n   * identity behind them — so the dependencies are the row's FIELDS and not\n   * the array they came in, which is a new array on every read.\n   */\n  useEffect(() => {\n    if (!open) return\n    setMailbox(editing?.localPart ?? '')\n    setFromName(editing?.fromName ?? '')\n    setReplyTo(editing?.replyTo ?? '')\n    setError('')\n  }, [\n    open,\n    senderId,\n    editing?.localPart,\n    editing?.fromName,\n    editing?.replyTo,\n  ])\n\n  /*\n   * The org this site belongs to, as the identity route resolved it.\n   *\n   * Taken from the view rather than read again here, so the drawer and the\n   * card it opens from agree about which workspace they are looking at, and\n   * so the org reads below cannot start before the route has answered.\n   */\n  const orgId = String(view?.orgId ?? '')\n  const reading = open && Boolean(hostId)\n\n  /*\n   * THE SITE'S OWN COLLABORATOR ROSTER — `hosts/{hostId}/members`.\n   *\n   * Not the whole answer, and reading it alone was the defect: this\n   * subcollection holds only people added TO ONE SITE by\n   * `POST /api/hosts/members`. A workspace whose team reaches every site\n   * through their org membership has no rows here at all, so a picker built\n   * on it offered whichever one address happened to have been added this way\n   * and no teammates whatsoever.\n   *\n   * It stays because it is the only source for one population: somebody\n   * invited to the site by an address with no Aglyn account behind it yet has\n   * a roster row and, until they accept, no org member document. They are a\n   * real person with a real mailbox who has been granted access, which is all\n   * a reply address needs.\n   *\n   * Ordered by nothing, and capped: see {@link SENDER_PICKER_CEILING}. This\n   * subcollection has exactly one writer and it writes `email` on every\n   * document, so an `orderBy('email')` would be safe here — it buys nothing,\n   * because the merged set below is arranged for display after the fact and a\n   * server order over one of four reads cannot survive the merge.\n   */\n  const { data: siteMemberDocs } = useFirestoreCollection<any>(\n    () =>\n      reading\n        ? query(\n            collection(firestore, 'hosts', hostId, 'members'),\n            limit(SENDER_PICKER_CEILING),\n          )\n        : null,\n    [firestore, hostId, reading],\n    { idField: '$id' },\n  )\n\n  /*\n   * THE ORG'S TEAM — `orgs/{orgId}/members`, in the three shapes that reach\n   * one host.\n   *\n   * `hostRoleFor` is the predicate the rules, the ~20 server gates and\n   * `useHostRole` all resolve a member's access to a site with, and it is a\n   * disjunction of exactly three cases: an owner or admin spans every site; an\n   * editor or viewer with `allHosts` spans every site at their org role; and\n   * anybody may carry an explicit per-site grant in `hostAccess`. Firestore\n   * cannot express that as one query, so it is asked as three and merged.\n   *\n   * ## Three narrow reads rather than one broad one\n   *\n   * The alternative — read the roster and filter in the browser — reads every\n   * member of the workspace to find the few who work on this site, and the cap\n   * would then apply BEFORE the filter: in an org of 400 where five people\n   * have this site, the picker could contain none of them. Splitting the\n   * predicate across the wire means the cap only ever cuts a tail of people\n   * who all belong in the list.\n   *\n   * ## The `orderBy` trap, and why there is no `orderBy` here\n   *\n   * `orderBy` matches only documents that HAVE the field, so ordering on one\n   * some writer omits hides rows instead of arranging them. `email` is NOT\n   * safe to order on in this collection: `AglynOrgMember` declares it\n   * optional, and two production paths create a member document without it —\n   * `PATCH /api/hosts/members` re-grants host access with no identity fields,\n   * and `POST /api/orgs/members` omits it entirely when the auth record\n   * carries no email. Ordering on it would drop exactly the teammates this\n   * change exists to surface, silently.\n   *\n   * Each `where` below is safe in a way an `orderBy` is not, and for the same\n   * reason it looks unsafe: a document missing `role`, missing `allHosts` or\n   * missing `hostAccess` is dropped by the filter — and `hostRoleFor` resolves\n   * every one of those to \"no access\" anyway. The predicate and the index\n   * agree about what absence means, so the query cannot hide anybody the\n   * filter would have kept.\n   */\n  const orgMembers = (constrain: (base: any) => any) => () =>\n    reading && orgId\n      ? constrain(collection(firestore, 'orgs', orgId, 'members'))\n      : null\n\n  const { data: orgAdminDocs } = useFirestoreCollection<any>(\n    orgMembers((base) =>\n      query(\n        base,\n        where('role', 'in', ['owner', 'admin']),\n        limit(SENDER_PICKER_CEILING),\n      ),\n    ),\n    [firestore, orgId, reading],\n    { idField: '$id' },\n  )\n  const { data: orgWideDocs } = useFirestoreCollection<any>(\n    orgMembers((base) =>\n      query(base, where('allHosts', '==', true), limit(SENDER_PICKER_CEILING)),\n    ),\n    [firestore, orgId, reading],\n    { idField: '$id' },\n  )\n  /*\n   * `HOST_ACCESS_ROLES` rather than a written-out array, for the reason it\n   * exists: a role added to `HostAccessRole` and missing from an `in` list is\n   * a person who holds access and cannot be seen to, with no error to explain\n   * it. The constant is built from a `Record` so a new role fails to compile\n   * there instead of quietly shortening this query.\n   */\n  const { data: orgScopedDocs } = useFirestoreCollection<any>(\n    orgMembers((base) =>\n      query(\n        base,\n        where(`hostAccess.${hostId}`, 'in', HOST_ACCESS_ROLES),\n        limit(SENDER_PICKER_CEILING),\n      ),\n    ),\n    [firestore, orgId, hostId, reading],\n    { idField: '$id' },\n  )\n\n  const candidates = useMemo<SenderCandidate[]>(() => {\n    /*\n     * ONE ROW PER PERSON, keyed by uid.\n     *\n     * The same teammate legitimately appears in several of these reads — an\n     * org admin who is also an explicit collaborator is in two, and an org\n     * member who accepted a site invite has a roster row as well — so the\n     * merge is by identity rather than by document. The org member document\n     * and the site roster row are keyed by the same uid, which is what makes\n     * that possible: `POST /api/hosts/members` names the roster document after\n     * the auth uid whenever an account exists, and falls back to a generated\n     * id only for an address that has none. Such a row has no org document to\n     * collide with, so the fallback cannot merge two people into one.\n     *\n     * Fields are taken from the first read that has them rather than from a\n     * chosen winner. Neither source is complete on its own: the site roster\n     * always carries an `email` and never a `displayName`, and an org member\n     * document usually carries both but is allowed to omit either.\n     */\n    const byPerson = new Map<string, SenderCandidate>()\n    const fold = (id: string, entry: any) => {\n      if (!id) return\n      const current = byPerson.get(id) ?? { id, email: '', displayName: '' }\n      byPerson.set(id, {\n        id,\n        email: current.email || String(entry?.email ?? '').trim(),\n        displayName:\n          current.displayName || String(entry?.displayName ?? '').trim(),\n      })\n    }\n\n    /*\n     * THE PREDICATE IS APPLIED AGAIN HERE, over the documents themselves.\n     *\n     * The three queries are the predicate projected onto an index, and an\n     * index answers a coarser question than the function does — `allHosts`\n     * reaches every site only for a member who HAS an org role, and a document\n     * carrying the flag with no role is a member of nothing. `hostRoleFor` is\n     * the one definition of \"can this person reach this site\", so it decides,\n     * and the queries are only what keeps the reads narrow.\n     */\n    for (const entry of [\n      ...(orgAdminDocs ?? []),\n      ...(orgWideDocs ?? []),\n      ...(orgScopedDocs ?? []),\n    ]) {\n      if (!hostRoleFor(entry, hostId as never)) continue\n      fold(String(entry?.$id ?? ''), entry)\n    }\n\n    /*\n     * The site's roster rows carry no role of their own to resolve — being in\n     * this subcollection IS access to this site, which is what the Users card\n     * on the site's own settings page renders it as. `uid` before `$id` so an\n     * accepted collaborator merges onto their org member document rather than\n     * arriving as a second row for the same person.\n     */\n    for (const entry of siteMemberDocs ?? []) {\n      fold(String(entry?.uid || entry?.$id || ''), entry)\n    }\n\n    return (\n      [...byPerson.values()]\n        /*\n         * An address is not optional. It is what the mailbox is derived from\n         * and what replies are pointed at, so a person recorded without one\n         * has nothing this picker could fill in.\n         */\n        .filter((entry) => entry.email)\n        /*\n         * Sorted here rather than by the server, because this is a COMPLETE\n         * set and not a page: four reads have been merged, so no server order\n         * survives, and arranging a page in the browser is what makes an\n         * arbitrary slice read as a ranked one. By the name a person is\n         * looking for, falling back to the address for somebody who has none.\n         */\n        .sort((left, right) =>\n          (left.displayName || left.email).localeCompare(\n            right.displayName || right.email,\n            undefined,\n            { sensitivity: 'base' },\n          ),\n        )\n    )\n  }, [orgAdminDocs, orgWideDocs, orgScopedDocs, siteMemberDocs, hostId])\n\n  /*\n   * The domain half, shown as a fixed suffix rather than as a field.\n   *\n   * A person setting a sender is choosing an address, and an address with its\n   * domain missing from the screen is one they have to assemble in their head\n   * from the alert above. Read from the identity the server resolved, so it\n   * is the domain a send would actually use.\n   */\n  const domain = String(view?.selected ?? '')\n  const pooled = Boolean(view) && !view?.localPartInUse\n\n  const handleSave = useCallback(async () => {\n    if (busy) return\n    /*\n     * A POOLED SITE SENDS NO MAILBOX AT ALL, rather than sending one the\n     * route will refuse.\n     *\n     * The field is disabled above and the alert says why, and this is the\n     * half that matters: a merchant on the shared address editing their\n     * sender name would otherwise have the whole save rejected over a field\n     * they were never offered.\n     */\n    const checked = pooled ? null : validateSendingLocalPart(mailbox)\n    if (checked?.error) return setError(checked.error)\n    setError('')\n    setBusy(true)\n    const { response, payload } = await call({\n      path: 'sending-identity',\n      method: 'POST',\n      /*\n       * No `domain` key. Absent means \"this is not a decision about the\n       * domain\" — an empty one would mean \"move this site back to the address\n       * Aglyn issues it\", which would reset a site sending as its own\n       * verified name every time somebody edited the sender.\n       */\n      body: {\n        hostId,\n        action: senderId ? 'updateSender' : 'createSender',\n        ...(senderId ? { senderId } : {}),\n        ...(checked?.localPart ? { localPart: checked.localPart } : {}),\n        fromName: fromName.trim(),\n        replyTo: replyTo.trim(),\n      },\n    })\n    setBusy(false)\n    if (!response.ok) {\n      return setError(payload?.error ?? 'Could not save who this site sends as')\n    }\n    onSaved(String(payload?.senderId ?? '') || undefined)\n    onClose()\n  }, [\n    busy,\n    call,\n    hostId,\n    senderId,\n    mailbox,\n    pooled,\n    fromName,\n    replyTo,\n    onSaved,\n    onClose,\n  ])\n\n  const applyCandidate = useCallback((candidate: SenderCandidate) => {\n    const at = candidate.email.lastIndexOf('@')\n    const proposed = normalizeLocalPart(\n      at > 0 ? candidate.email.slice(0, at) : '',\n    )\n    if (proposed) setMailbox(proposed)\n    if (candidate.displayName) setFromName(candidate.displayName)\n    setReplyTo(candidate.email)\n    setError('')\n  }, [])\n\n  return (\n    <NavigationDrawerComponent\n      open={open}\n      anchor=\"right\"\n      variant=\"temporary\"\n      onClose={onClose}\n      AppBarProps={{ color: 'surface' }}\n      appBarLeft={\n        <>\n          <IconButton\n            color=\"inherit\"\n            edge=\"start\"\n            onClick={onClose}\n            sx={{ mr: 2 }}\n          >\n            <MdiIcon path={ICON_VARIANT_CLOSE.path} />\n            <SrOnly>close drawer</SrOnly>\n          </IconButton>\n          <Typography variant=\"h6\" component=\"div\">\n            {senderId ? 'Edit this sender' : 'Add a sender'}\n          </Typography>\n          {/*\n            The help affordance every console surface carries, pointed at the\n            section that says what a sender is and which of its three fields\n            the shared address restricts — which is the question somebody\n            standing in this drawer with a disabled Mailbox field has.\n           */}\n          <HelpTip\n            {...pluginDocsHelp('emailCampaigns', {\n              anchor: '#senders',\n              title: 'Senders',\n              excerpt:\n                'A mailbox this site may send as, with the name and reply ' +\n                'address that go out in front of it. A campaign picks one of ' +\n                'them rather than typing an address.',\n            })}\n          />\n        </>\n      }\n    >\n      <Container gutterY>\n        <Stack spacing={2}>\n          <Typography variant=\"body2\" color=\"text.secondary\">\n            {'An address your email may leave on, and the name in front of ' +\n              'it. The domain is your site’s verified sending domain and ' +\n              'cannot be changed here — the part before the @ can. To have ' +\n              'replies reach a personal or company mailbox, use the reply ' +\n              'address: sending as an address on somebody else’s mail ' +\n              'provider is refused by the receiving side, not delivered.'}\n          </Typography>\n          <Typography variant=\"body2\" color=\"text.secondary\">\n            {editing?.isDefault\n              ? 'Every email you compose picks a sender. This is the one an ' +\n                'email that names no other goes out as.'\n              : 'Every email you compose picks a sender, and this will be ' +\n                'one of the choices.'}\n          </Typography>\n\n          {candidates.length ? (\n            <>\n              <TextField\n                select\n                label=\"Send as a person\"\n                value=\"\"\n                size=\"small\"\n                onChange={(event) => {\n                  const match = candidates.find(\n                    (entry) => entry.id === event.target.value,\n                  )\n                  if (match) applyCandidate(match)\n                }}\n                helperText=\"Fills the three fields below from someone who works on this site\"\n              >\n                {/*\n                  THE NAME LEADS, and the address sits under it.\n\n                  A sender picker is answering \"which of us is this from\",\n                  which is a question about a person; a list of bare addresses\n                  makes the reader parse a local part to recognise a colleague.\n                  The address stays on the row because it is what the mailbox\n                  is derived from and where replies will land, so it is part of\n                  the choice rather than a detail behind it — and it is the\n                  whole row for somebody whose name nothing has recorded, which\n                  is an ordinary state for an invited teammate who has not\n                  signed in yet.\n                */}\n                {candidates.map((candidate) => (\n                  <MenuItem key={candidate.id} value={candidate.id}>\n                    <Stack spacing={0}>\n                      {candidate.displayName ? (\n                        <Typography variant=\"body2\">\n                          {candidate.displayName}\n                        </Typography>\n                      ) : null}\n                      <Typography\n                        variant={candidate.displayName ? 'caption' : 'body2'}\n                        color={\n                          candidate.displayName ? 'text.secondary' : undefined\n                        }\n                      >\n                        {candidate.email}\n                      </Typography>\n                    </Stack>\n                  </MenuItem>\n                ))}\n              </TextField>\n              <Divider />\n            </>\n          ) : null}\n\n          {pooled ? (\n            <Alert severity=\"info\">\n              {'This site sends on a shared Aglyn address, whose mailbox is ' +\n                'fixed and shared with the other sites on it. The name and ' +\n                'reply address below apply to that mail; the mailbox takes ' +\n                'effect once this site has a domain of its own.'}\n            </Alert>\n          ) : null}\n\n          <TextField\n            label=\"Mailbox\"\n            value={mailbox}\n            onChange={(event) => setMailbox(event.target.value)}\n            size=\"small\"\n            disabled={pooled}\n            slotProps={{\n              input: domain\n                ? {\n                    endAdornment: (\n                      <InputAdornment position=\"end\">\n                        {`@${domain}`}\n                      </InputAdornment>\n                    ),\n                  }\n                : undefined,\n            }}\n            helperText={\n              'The part before the @ — for example hello, sales or jamie'\n            }\n          />\n          <TextField\n            label=\"Sender name\"\n            value={fromName}\n            onChange={(event) => setFromName(event.target.value)}\n            size=\"small\"\n            helperText=\"Shown in front of the address. A person’s name, or your brand\"\n          />\n          <TextField\n            label=\"Reply address\"\n            value={replyTo}\n            onChange={(event) => setReplyTo(event.target.value)}\n            size=\"small\"\n            type=\"email\"\n            helperText=\"Where replies go. May be any mailbox, including a personal one\"\n          />\n\n          {error ? <Alert severity=\"error\">{error}</Alert> : null}\n\n          <Button\n            variant=\"contained\"\n            disabled={busy || !view}\n            onClick={() => void handleSave()}\n          >\n            {busy ? 'Saving…' : senderId ? 'Save sender' : 'Add sender'}\n          </Button>\n        </Stack>\n      </Container>\n    </NavigationDrawerComponent>\n  )\n}\nSendingSenderDrawer.displayName = 'SendingSenderDrawer'\n\nexport default SendingSenderDrawer\n"],"names":["hostRoleFor","HOST_ACCESS_ROLES","pluginDocsHelp","ICON_VARIANT_CLOSE","Container","HelpTip","MdiIcon","SrOnly","NavigationDrawerComponent","normalizeLocalPart","validateSendingLocalPart","useFirestore","useFirestoreCollection","Alert","Button","Divider","IconButton","InputAdornment","MenuItem","Stack","TextField","Typography","collection","limit","query","where","useCallback","useEffect","useMemo","useState","useSendingApi","SENDER_PICKER_CEILING","SendingSenderDrawer","props","open","hostId","view","senderId","onClose","onSaved","call","firestore","mailbox","setMailbox","fromName","setFromName","replyTo","setReplyTo","busy","setBusy","error","setError","editing","senders","find","sender","id","localPart","orgId","String","reading","Boolean","data","siteMemberDocs","idField","orgMembers","constrain","orgAdminDocs","base","orgWideDocs","orgScopedDocs","candidates","byPerson","Map","fold","entry","current","get","email","displayName","set","trim","$id","uid","values","filter","sort","left","right","localeCompare","undefined","sensitivity","domain","selected","pooled","localPartInUse","handleSave","checked","response","payload","path","method","body","action","ok","applyCandidate","candidate","at","lastIndexOf","proposed","slice","anchor","variant","AppBarProps","color","appBarLeft","edge","onClick","sx","mr","component","title","excerpt","gutterY","spacing","isDefault","length","select","label","value","size","onChange","event","match","target","helperText","map","severity","disabled","slotProps","input","endAdornment","position","type"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GACD;;;AAEA,SAASA,WAAW,EAAEC,iBAAiB,EAAEC,cAAc,QAAQ,eAAc;AAC7E,SAASC,kBAAkB,QAAQ,2BAA0B;AAC7D,SAASC,SAAS,EAAEC,OAAO,EAAEC,OAAO,EAAEC,MAAM,QAAQ,uBAAsB;AAC1E,SAASC,yBAAyB,QAAQ,8DAA6D;AACvG,SACEC,kBAAkB,EAClBC,wBAAwB,QACnB,2BAA0B;AACjC,SACEC,YAAY,EACZC,sBAAsB,QACjB,iCAAgC;AACvC,SACEC,KAAK,EACLC,MAAM,EACNC,OAAO,EACPC,UAAU,EACVC,cAAc,EACdC,QAAQ,EACRC,KAAK,EACLC,SAAS,EACTC,UAAU,QACL,gBAAe;AACtB,SAASC,UAAU,EAAEC,KAAK,EAAEC,KAAK,EAAEC,KAAK,QAAQ,qBAAoB;AACpE,SAASC,WAAW,EAAEC,SAAS,EAAEC,OAAO,EAAEC,QAAQ,QAAQ,QAAO;AACjE,SACEC,aAAa,QAER,gEAA+D;AAEtE;;;;;;;;;;;;;;;CAeC,GACD,MAAMC,wBAAwB;AAmC9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8DC,GACD,OAAO,SAASC,oBAAoBC,KAA+B;QAmB5D;IAlBL,MAAM,EAAEC,IAAI,EAAEC,MAAM,EAAEC,IAAI,EAAEC,QAAQ,EAAEC,OAAO,EAAEC,OAAO,EAAE,GAAGN;IAC3D,MAAMO,OAAOV;IACb,MAAMW,YAAY9B;IAElB,MAAM,CAAC+B,SAASC,WAAW,GAAGd,SAAS;IACvC,MAAM,CAACe,UAAUC,YAAY,GAAGhB,SAAS;IACzC,MAAM,CAACiB,SAASC,WAAW,GAAGlB,SAAS;IACvC,MAAM,CAACmB,MAAMC,QAAQ,GAAGpB,SAAS;IACjC,MAAM,CAACqB,OAAOC,SAAS,GAAGtB,SAAS;IAEnC;;;;;;GAMC,GACD,MAAMuB,UAAUf,YACX,QAAA,SAACD,wBAAAA,KAAMiB,OAAO,mBAAI,EAAE,EAAEC,IAAI,CAAC,CAACC,SAAWA,OAAOC,EAAE,KAAKnB,qBAArD,QAAkE,OACnE;IAEJ;;;;;;;;GAQC,GACDV,UAAU;;QACR,IAAI,CAACO,MAAM;QACXS,mBAAWS,2BAAAA,QAASK,SAAS,mBAAI;QACjCZ,qBAAYO,2BAAAA,QAASR,QAAQ,oBAAI;QACjCG,oBAAWK,2BAAAA,QAASN,OAAO,oBAAI;QAC/BK,SAAS;IACX,GAAG;QACDjB;QACAG;QACAe,2BAAAA,QAASK,SAAS;QAClBL,2BAAAA,QAASR,QAAQ;QACjBQ,2BAAAA,QAASN,OAAO;KACjB;IAED;;;;;;GAMC,GACD,MAAMY,QAAQC,gBAAOvB,wBAAAA,KAAMsB,KAAK,oBAAI;IACpC,MAAME,UAAU1B,QAAQ2B,QAAQ1B;IAEhC;;;;;;;;;;;;;;;;;;;;;GAqBC,GACD,MAAM,EAAE2B,MAAMC,cAAc,EAAE,GAAGnD,uBAC/B,IACEgD,UACIpC,MACEF,WAAWmB,WAAW,SAASN,QAAQ,YACvCZ,MAAMQ,0BAER,MACN;QAACU;QAAWN;QAAQyB;KAAQ,EAC5B;QAAEI,SAAS;IAAM;IAGnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCC,GACD,MAAMC,aAAa,CAACC,YAAkC,IACpDN,WAAWF,QACPQ,UAAU5C,WAAWmB,WAAW,QAAQiB,OAAO,cAC/C;IAEN,MAAM,EAAEI,MAAMK,YAAY,EAAE,GAAGvD,uBAC7BqD,WAAW,CAACG,OACV5C,MACE4C,MACA3C,MAAM,QAAQ,MAAM;YAAC;YAAS;SAAQ,GACtCF,MAAMQ,0BAGV;QAACU;QAAWiB;QAAOE;KAAQ,EAC3B;QAAEI,SAAS;IAAM;IAEnB,MAAM,EAAEF,MAAMO,WAAW,EAAE,GAAGzD,uBAC5BqD,WAAW,CAACG,OACV5C,MAAM4C,MAAM3C,MAAM,YAAY,MAAM,OAAOF,MAAMQ,0BAEnD;QAACU;QAAWiB;QAAOE;KAAQ,EAC3B;QAAEI,SAAS;IAAM;IAEnB;;;;;;GAMC,GACD,MAAM,EAAEF,MAAMQ,aAAa,EAAE,GAAG1D,uBAC9BqD,WAAW,CAACG,OACV5C,MACE4C,MACA3C,MAAM,CAAC,WAAW,EAAEU,QAAQ,EAAE,MAAMlC,oBACpCsB,MAAMQ,0BAGV;QAACU;QAAWiB;QAAOvB;QAAQyB;KAAQ,EACnC;QAAEI,SAAS;IAAM;IAGnB,MAAMO,aAAa3C,QAA2B;QAC5C;;;;;;;;;;;;;;;;;KAiBC,GACD,MAAM4C,WAAW,IAAIC;QACrB,MAAMC,OAAO,CAAClB,IAAYmB;gBAERH;YADhB,IAAI,CAAChB,IAAI;YACT,MAAMoB,WAAUJ,gBAAAA,SAASK,GAAG,CAACrB,eAAbgB,gBAAoB;gBAAEhB;gBAAIsB,OAAO;gBAAIC,aAAa;YAAG;YACrEP,SAASQ,GAAG,CAACxB,IAAI;gBACfA;gBACAsB,OAAOF,QAAQE,KAAK,IAAInB,eAAOgB,yBAAAA,MAAOG,KAAK,mBAAI,IAAIG,IAAI;gBACvDF,aACEH,QAAQG,WAAW,IAAIpB,gBAAOgB,yBAAAA,MAAOI,WAAW,oBAAI,IAAIE,IAAI;YAChE;QACF;QAEA;;;;;;;;;KASC,GACD,KAAK,MAAMN,SAAS;eACdR,uBAAAA,eAAgB,EAAE;eAClBE,sBAAAA,cAAe,EAAE;eACjBC,wBAAAA,gBAAiB,EAAE;SACxB,CAAE;;YACD,IAAI,CAACtE,YAAY2E,OAAOxC,SAAkB;YAC1CuC,KAAKf,eAAOgB,yBAAAA,MAAOO,GAAG,mBAAI,KAAKP;QACjC;QAEA;;;;;;KAMC,GACD,KAAK,MAAMA,SAASZ,yBAAAA,iBAAkB,EAAE,CAAE;YACxCW,KAAKf,OAAOgB,CAAAA,yBAAAA,MAAOQ,GAAG,MAAIR,yBAAAA,MAAOO,GAAG,KAAI,KAAKP;QAC/C;QAEA,OACE;eAAIH,SAASY,MAAM;SAAG,AACpB;;;;SAIC,IACAC,MAAM,CAAC,CAACV,QAAUA,MAAMG,KAAK,CAC9B;;;;;;SAMC,IACAQ,IAAI,CAAC,CAACC,MAAMC,QACX,AAACD,CAAAA,KAAKR,WAAW,IAAIQ,KAAKT,KAAK,AAAD,EAAGW,aAAa,CAC5CD,MAAMT,WAAW,IAAIS,MAAMV,KAAK,EAChCY,WACA;gBAAEC,aAAa;YAAO;IAIhC,GAAG;QAACxB;QAAcE;QAAaC;QAAeP;QAAgB5B;KAAO;IAErE;;;;;;;GAOC,GACD,MAAMyD,SAASjC,gBAAOvB,wBAAAA,KAAMyD,QAAQ,oBAAI;IACxC,MAAMC,SAASjC,QAAQzB,SAAS,EAACA,wBAAAA,KAAM2D,cAAc;IAErD,MAAMC,aAAatE,YAAY;;QAC7B,IAAIsB,MAAM;QACV;;;;;;;;KAQC,GACD,MAAMiD,UAAUH,SAAS,OAAOpF,yBAAyBgC;QACzD,IAAIuD,2BAAAA,QAAS/C,KAAK,EAAE,OAAOC,SAAS8C,QAAQ/C,KAAK;QACjDC,SAAS;QACTF,QAAQ;QACR,MAAM,EAAEiD,QAAQ,EAAEC,OAAO,EAAE,GAAG,MAAM3D,KAAK;YACvC4D,MAAM;YACNC,QAAQ;YACR;;;;;OAKC,GACDC,MAAM;gBACJnE;gBACAoE,QAAQlE,WAAW,iBAAiB;eAChCA,WAAW;gBAAEA;YAAS,IAAI,CAAC,GAC3B4D,CAAAA,2BAAAA,QAASxC,SAAS,IAAG;gBAAEA,WAAWwC,QAAQxC,SAAS;YAAC,IAAI,CAAC;gBAC7Db,UAAUA,SAASqC,IAAI;gBACvBnC,SAASA,QAAQmC,IAAI;;QAEzB;QACAhC,QAAQ;QACR,IAAI,CAACiD,SAASM,EAAE,EAAE;;YAChB,OAAOrD,kBAASgD,2BAAAA,QAASjD,KAAK,oBAAI;QACpC;QACAX,QAAQoB,eAAOwC,2BAAAA,QAAS9D,QAAQ,mBAAI,OAAOqD;QAC3CpD;IACF,GAAG;QACDU;QACAR;QACAL;QACAE;QACAK;QACAoD;QACAlD;QACAE;QACAP;QACAD;KACD;IAED,MAAMmE,iBAAiB/E,YAAY,CAACgF;QAClC,MAAMC,KAAKD,UAAU5B,KAAK,CAAC8B,WAAW,CAAC;QACvC,MAAMC,WAAWpG,mBACfkG,KAAK,IAAID,UAAU5B,KAAK,CAACgC,KAAK,CAAC,GAAGH,MAAM;QAE1C,IAAIE,UAAUlE,WAAWkE;QACzB,IAAIH,UAAU3B,WAAW,EAAElC,YAAY6D,UAAU3B,WAAW;QAC5DhC,WAAW2D,UAAU5B,KAAK;QAC1B3B,SAAS;IACX,GAAG,EAAE;IAEL,qBACE,KAAC3C;QACC0B,MAAMA;QACN6E,QAAO;QACPC,SAAQ;QACR1E,SAASA;QACT2E,aAAa;YAAEC,OAAO;QAAU;QAChCC,0BACE;;8BACE,MAACnG;oBACCkG,OAAM;oBACNE,MAAK;oBACLC,SAAS/E;oBACTgF,IAAI;wBAAEC,IAAI;oBAAE;;sCAEZ,KAACjH;4BAAQ8F,MAAMjG,mBAAmBiG,IAAI;;sCACtC,KAAC7F;sCAAO;;;;8BAEV,KAACc;oBAAW2F,SAAQ;oBAAKQ,WAAU;8BAChCnF,WAAW,qBAAqB;;8BAQnC,KAAChC,sBACKH,eAAe,kBAAkB;oBACnC6G,QAAQ;oBACRU,OAAO;oBACPC,SACE,8DACA,iEACA;gBACJ;;;kBAKN,cAAA,KAACtH;YAAUuH,OAAO;sBAChB,cAAA,MAACxG;gBAAMyG,SAAS;;kCACd,KAACvG;wBAAW2F,SAAQ;wBAAQE,OAAM;kCAC/B,kEACC,+DACA,iEACA,gEACA,4DACA;;kCAEJ,KAAC7F;wBAAW2F,SAAQ;wBAAQE,OAAM;kCAC/B9D,CAAAA,2BAAAA,QAASyE,SAAS,IACf,gEACA,2CACA,8DACA;;oBAGLtD,WAAWuD,MAAM,iBAChB;;0CACE,KAAC1G;gCACC2G,MAAM;gCACNC,OAAM;gCACNC,OAAM;gCACNC,MAAK;gCACLC,UAAU,CAACC;oCACT,MAAMC,QAAQ9D,WAAWjB,IAAI,CAC3B,CAACqB,QAAUA,MAAMnB,EAAE,KAAK4E,MAAME,MAAM,CAACL,KAAK;oCAE5C,IAAII,OAAO5B,eAAe4B;gCAC5B;gCACAE,YAAW;0CAeVhE,WAAWiE,GAAG,CAAC,CAAC9B,0BACf,KAACxF;wCAA4B+G,OAAOvB,UAAUlD,EAAE;kDAC9C,cAAA,MAACrC;4CAAMyG,SAAS;;gDACblB,UAAU3B,WAAW,iBACpB,KAAC1D;oDAAW2F,SAAQ;8DACjBN,UAAU3B,WAAW;qDAEtB;8DACJ,KAAC1D;oDACC2F,SAASN,UAAU3B,WAAW,GAAG,YAAY;oDAC7CmC,OACER,UAAU3B,WAAW,GAAG,mBAAmBW;8DAG5CgB,UAAU5B,KAAK;;;;uCAbP4B,UAAUlD,EAAE;;0CAmB/B,KAACzC;;yBAED;oBAEH+E,uBACC,KAACjF;wBAAM4H,UAAS;kCACb,iEACC,+DACA,+DACA;yBAEF;kCAEJ,KAACrH;wBACC4G,OAAM;wBACNC,OAAOvF;wBACPyF,UAAU,CAACC,QAAUzF,WAAWyF,MAAME,MAAM,CAACL,KAAK;wBAClDC,MAAK;wBACLQ,UAAU5C;wBACV6C,WAAW;4BACTC,OAAOhD,SACH;gCACEiD,4BACE,KAAC5H;oCAAe6H,UAAS;8CACtB,CAAC,CAAC,EAAElD,QAAQ;;4BAGnB,IACAF;wBACN;wBACA6C,YACE;;kCAGJ,KAACnH;wBACC4G,OAAM;wBACNC,OAAOrF;wBACPuF,UAAU,CAACC,QAAUvF,YAAYuF,MAAME,MAAM,CAACL,KAAK;wBACnDC,MAAK;wBACLK,YAAW;;kCAEb,KAACnH;wBACC4G,OAAM;wBACNC,OAAOnF;wBACPqF,UAAU,CAACC,QAAUrF,WAAWqF,MAAME,MAAM,CAACL,KAAK;wBAClDC,MAAK;wBACLa,MAAK;wBACLR,YAAW;;oBAGZrF,sBAAQ,KAACrC;wBAAM4H,UAAS;kCAASvF;yBAAiB;kCAEnD,KAACpC;wBACCkG,SAAQ;wBACR0B,UAAU1F,QAAQ,CAACZ;wBACnBiF,SAAS,IAAM,KAAKrB;kCAEnBhD,OAAO,YAAYX,WAAW,gBAAgB;;;;;;AAM3D;AACAL,oBAAoB+C,WAAW,GAAG;AAElC,eAAe/C,oBAAmB"}