@bobfrankston/rmfmail 1.2.170 → 1.2.171

package/client/android-bootstrap.bundle.js

@@ -2588,7 +2588,8 @@ __export(web_settings_exports, {
   savePreferences: () => savePreferences,
   saveSettings: () => saveSettings,
   setGDriveFolderId: () => setGDriveFolderId,
-  setGDriveTokenProvider: () => setGDriveTokenProvider
+  setGDriveTokenProvider: () => setGDriveTokenProvider,
+  updateAllowlist: () => updateAllowlist
 });
 function openSettingsDb() {
   return new Promise((resolve, reject) => {
@@ -2665,17 +2666,28 @@ async function cloudStat(filename) {
     return null;
   }
 }
+async function gDriveFindFile(filename, token) {
+  const q = encodeURIComponent(`name='${filename}' and '${gDriveFolderId}' in parents and trashed=false`);
+  const res = await globalThis.fetch(`https://www.googleapis.com/drive/v3/files?q=${q}&fields=files(id,modifiedTime,ownedByMe,capabilities(canEdit))`, { headers: { "Authorization": `Bearer ${token}` } });
+  if (!res.ok)
+    return null;
+  const files = (await res.json()).files || [];
+  if (files.length === 0)
+    return null;
+  if (files.length > 1) {
+    console.warn(`[settings] ${filename}: ${files.length} same-named files in the shared folder \u2014 using own/newest. Clean the duplicates (owners differ?).`);
+    files.sort((a, b) => (b.ownedByMe === true ? 1 : 0) - (a.ownedByMe === true ? 1 : 0) || String(b.modifiedTime).localeCompare(String(a.modifiedTime)));
+  }
+  const f = files[0];
+  return { id: f.id, modifiedTime: f.modifiedTime || "", ownedByMe: f.ownedByMe === true, capabilitiesCanEdit: f.capabilities?.canEdit !== false };
+}
 async function gDriveRead(filename) {
   if (!tokenProvider || !gDriveFolderId)
     return null;
   try {
     const token = await tokenProvider();
-    const q = encodeURIComponent(`name='${filename}' and '${gDriveFolderId}' in parents and trashed=false`);
-    const listRes = await globalThis.fetch(`https://www.googleapis.com/drive/v3/files?q=${q}&fields=files(id)`, { headers: { "Authorization": `Bearer ${token}` } });
-    if (!listRes.ok)
-      return null;
-    const listData = await listRes.json();
-    const fileId = listData.files?.[0]?.id;
+    const found = await gDriveFindFile(filename, token);
+    const fileId = found?.id;
     if (!fileId)
       return null;
     const res = await globalThis.fetch(`https://www.googleapis.com/drive/v3/files/${fileId}?alt=media`, { headers: { "Authorization": `Bearer ${token}` } });
@@ -2692,13 +2704,13 @@ async function gDriveWrite(filename, content) {
     return false;
   try {
     const token = await tokenProvider();
-    const q = encodeURIComponent(`name='${filename}' and '${gDriveFolderId}' in parents and trashed=false`);
-    const listRes = await globalThis.fetch(`https://www.googleapis.com/drive/v3/files?q=${q}&fields=files(id)`, { headers: { "Authorization": `Bearer ${token}` } });
-    if (!listRes.ok)
-      return false;
-    const listData = await listRes.json();
-    const fileId = listData.files?.[0]?.id;
+    const found = await gDriveFindFile(filename, token);
+    const fileId = found?.id;
     if (fileId) {
+      if (!found.capabilitiesCanEdit) {
+        console.error(`[settings] ${filename}: existing shared file is not editable by this account \u2014 NOT creating a duplicate. Change kept locally.`);
+        return false;
+      }
       const res = await globalThis.fetch(`https://www.googleapis.com/upload/drive/v3/files/${fileId}?uploadType=media`, {
         method: "PATCH",
         headers: {
@@ -2707,6 +2719,8 @@ async function gDriveWrite(filename, content) {
         },
         body: content
       });
+      if (!res.ok)
+        console.error(`[settings] ${filename}: cloud update failed (${res.status})`);
       return res.ok;
     } else {
       const metadata = JSON.stringify({
@@ -2948,9 +2962,43 @@ async function loadAllowlist() {
   }
   return { ...DEFAULT_ALLOWLIST };
 }
+function allowlistEntryCount(l) {
+  return ALLOWLIST_KEYS.reduce((n, k) => n + (Array.isArray(l?.[k]) ? l[k].length : 0), 0);
+}
+async function updateAllowlist(mutate) {
+  let base = null;
+  try {
+    const fresh = await gDriveRead("allowlist.jsonc");
+    if (fresh) {
+      await idbWrite("allowlist.jsonc", fresh);
+      try {
+        base = parseJsonc(fresh);
+      } catch {
+      }
+    }
+  } catch {
+  }
+  if (!base)
+    base = await loadAllowlist();
+  const out = mutate(base) || base;
+  await saveAllowlist(out);
+  return out;
+}
 async function saveAllowlist(list) {
   const content = JSON.stringify(list, null, 2);
   await idbWrite("allowlist.jsonc", content);
+  try {
+    const cloudRaw = await gDriveRead("allowlist.jsonc");
+    if (cloudRaw) {
+      const cloudCount = allowlistEntryCount(parseJsonc(cloudRaw));
+      const newCount = allowlistEntryCount(list);
+      if (cloudCount > 10 && newCount < cloudCount / 2) {
+        console.error(`[settings] REFUSING allowlist cloud write: ${cloudCount} \u2192 ${newCount} entries (stale/default base \u2014 see 2026-07-23 wipe). Local cache updated only.`);
+        return;
+      }
+    }
+  } catch {
+  }
   await gDriveWrite("allowlist.jsonc", content);
 }
 async function loadAutocomplete() {
@@ -3020,7 +3068,7 @@ async function loadDeviceState() {
   }
   return {};
 }
-var IDB_NAME2, IDB_VERSION, STORE_NAME2, gDriveFolderId, gDriveFolderName, gDriveFolderPath, gDriveFolderOwner, tokenProvider, PROVIDERS, DEFAULT_PREFERENCES, DEFAULT_ALLOWLIST, SHARED_REFRESH_MS, __lastSharedRefresh, DEVICE_ID_KEY;
+var IDB_NAME2, IDB_VERSION, STORE_NAME2, gDriveFolderId, gDriveFolderName, gDriveFolderPath, gDriveFolderOwner, tokenProvider, PROVIDERS, DEFAULT_PREFERENCES, DEFAULT_ALLOWLIST, SHARED_REFRESH_MS, __lastSharedRefresh, ALLOWLIST_KEYS, DEVICE_ID_KEY;
 var init_web_settings = __esm({
   "packages/mailx-store-web/web-settings.js"() {
     "use strict";
@@ -3097,6 +3145,7 @@ var init_web_settings = __esm({
     };
     SHARED_REFRESH_MS = 5 * 6e4;
     __lastSharedRefresh = /* @__PURE__ */ new Map();
+    ALLOWLIST_KEYS = ["senders", "domains", "recipients", "flaggedSenders", "flaggedDomains"];
     DEVICE_ID_KEY = "mailx-device-id";
   }
 });
@@ -5939,23 +5988,24 @@ var WebMailxService = class _WebMailxService {
    *  flaggedSenders / flaggedDomains in allowlist.jsonc, which syncs
    *  back to the cloud copy. */
   async flagSenderOrDomain(type, value) {
-    const list = await loadAllowlist();
-    const key = type === "sender" ? "flaggedSenders" : "flaggedDomains";
-    const arr = Array.isArray(list[key]) ? list[key] : [];
     const v = (value || "").trim().toLowerCase();
     if (!v)
       return { flagged: false };
-    const idx = arr.findIndex((x) => (x || "").toLowerCase() === v);
-    let flagged;
-    if (idx >= 0) {
-      arr.splice(idx, 1);
-      flagged = false;
-    } else {
-      arr.push(v);
-      flagged = true;
-    }
-    list[key] = arr;
-    await saveAllowlist(list);
+    let flagged = false;
+    await updateAllowlist((list) => {
+      const key = type === "sender" ? "flaggedSenders" : "flaggedDomains";
+      const arr = Array.isArray(list[key]) ? list[key] : [];
+      const idx = arr.findIndex((x) => (x || "").toLowerCase() === v);
+      if (idx >= 0) {
+        arr.splice(idx, 1);
+        flagged = false;
+      } else {
+        arr.push(v);
+        flagged = true;
+      }
+      list[key] = arr;
+      return list;
+    });
     return { flagged };
   }
   async updateFlags(accountId, uid, flags) {
@@ -5964,18 +6014,19 @@ var WebMailxService = class _WebMailxService {
   }
   // ── Remote content allow-list ──
   async allowRemoteContent(type, value) {
-    const list = await loadAllowlist();
-    if (type === "sender" && !list.senders.includes(value))
-      list.senders.push(value);
-    else if (type === "domain" && !list.domains.includes(value))
-      list.domains.push(value);
-    else if (type === "recipient") {
-      if (!list.recipients)
-        list.recipients = [];
-      if (!list.recipients.includes(value))
-        list.recipients.push(value);
-    }
-    await saveAllowlist(list);
+    await updateAllowlist((list) => {
+      if (type === "sender" && !list.senders.includes(value))
+        list.senders.push(value);
+      else if (type === "domain" && !list.domains.includes(value))
+        list.domains.push(value);
+      else if (type === "recipient") {
+        if (!list.recipients)
+          list.recipients = [];
+        if (!list.recipients.includes(value))
+          list.recipients.push(value);
+      }
+      return list;
+    });
   }
   // ── Search ──
   async search(q, page = 1, pageSize = 50, scope = "all", accountId, folderId) {