@bobfrankston/rmfmail 1.2.170 → 1.2.172

package/packages/mailx-store-web/web-settings.ts

@@ -61,6 +61,17 @@ async function idbDelete(key: string): Promise<void> {
     });
 }
 
+/** All keys with the given prefix (prev-version pruning). */
+async function idbListKeys(prefix: string): Promise<string[]> {
+    const db = await openSettingsDb();
+    return new Promise((resolve, reject) => {
+        const tx = db.transaction(STORE_NAME, "readonly");
+        const req = tx.objectStore(STORE_NAME).getAllKeys(IDBKeyRange.bound(prefix, prefix + "￿"));
+        req.onsuccess = () => resolve((req.result as IDBValidKey[]).map(String));
+        req.onerror = () => reject(req.error);
+    });
+}
+
 // ── GDrive API ──
 
 /** GDrive folder ID for the ".rmfmail" app folder */
@@ -112,19 +123,36 @@ export async function cloudStat(filename: string): Promise<{ id: string; modifie
     }
 }
 
+
+/** Find a config file by name in the .rmfmail folder, DETERMINISTICALLY.
+ *  Drive allows duplicate names; a second device signed into a different
+ *  Google account created its own allowlist.jsonc in the shared folder and
+ *  files?.[0] then made every device's pick a coin flip — stale bases and
+ *  cross-account clobbers (2026-07-23 wipe). Preference order: a file THIS
+ *  account owns, then newest modifiedTime. Duplicates are logged loudly. */
+async function gDriveFindFile(filename: string, token: string): Promise<{ id: string; modifiedTime: string; ownedByMe: boolean; capabilitiesCanEdit: boolean } | null> {
+    const q = encodeURIComponent(`name='${filename}' and '${gDriveFolderId}' in parents and trashed=false`);
+    const res = await globalThis.fetch(
+        `https://www.googleapis.com/drive/v3/files?q=${q}&fields=files(id,modifiedTime,ownedByMe,capabilities(canEdit))`,
+        { headers: { "Authorization": `Bearer ${token}` } }
+    );
+    if (!res.ok) return null;
+    const files: any[] = ((await res.json()) as any).files || [];
+    if (files.length === 0) return null;
+    if (files.length > 1) {
+        console.warn(`[settings] ${filename}: ${files.length} same-named files in the shared folder — using own/newest. Clean the duplicates (owners differ?).`);
+        files.sort((a, b) => (b.ownedByMe === true ? 1 : 0) - (a.ownedByMe === true ? 1 : 0) || String(b.modifiedTime).localeCompare(String(a.modifiedTime)));
+    }
+    const f = files[0];
+    return { id: f.id, modifiedTime: f.modifiedTime || '', ownedByMe: f.ownedByMe === true, capabilitiesCanEdit: f.capabilities?.canEdit !== false };
+}
+
 async function gDriveRead(filename: string): Promise<string | null> {
     if (!tokenProvider || !gDriveFolderId) return null;
     try {
         const token = await tokenProvider();
-        // Find file by name in folder
-        const q = encodeURIComponent(`name='${filename}' and '${gDriveFolderId}' in parents and trashed=false`);
-        const listRes = await globalThis.fetch(
-            `https://www.googleapis.com/drive/v3/files?q=${q}&fields=files(id)`,
-            { headers: { "Authorization": `Bearer ${token}` } }
-        );
-        if (!listRes.ok) return null;
-        const listData = await listRes.json() as any;
-        const fileId = listData.files?.[0]?.id;
+        const found = await gDriveFindFile(filename, token);
+        const fileId = found?.id;
         if (!fileId) return null;
         // Download content
         const res = await globalThis.fetch(
@@ -143,17 +171,18 @@ async function gDriveWrite(filename: string, content: string): Promise<boolean>
     if (!tokenProvider || !gDriveFolderId) return false;
     try {
         const token = await tokenProvider();
-        // Check if file exists
-        const q = encodeURIComponent(`name='${filename}' and '${gDriveFolderId}' in parents and trashed=false`);
-        const listRes = await globalThis.fetch(
-            `https://www.googleapis.com/drive/v3/files?q=${q}&fields=files(id)`,
-            { headers: { "Authorization": `Bearer ${token}` } }
-        );
-        if (!listRes.ok) return false;
-        const listData = await listRes.json() as any;
-        const fileId = listData.files?.[0]?.id;
+        const found = await gDriveFindFile(filename, token);
+        const fileId = found?.id;
 
         if (fileId) {
+            // A file EXISTS but this account can't edit it (someone else's
+            // copy in a shared folder). Creating a same-named sibling is how
+            // the duplicate-file mess started — never fork; fail loudly and
+            // keep the change local-only.
+            if (!found!.capabilitiesCanEdit) {
+                console.error(`[settings] ${filename}: existing shared file is not editable by this account — NOT creating a duplicate. Change kept locally.`);
+                return false;
+            }
             // Update existing
             const res = await globalThis.fetch(
                 `https://www.googleapis.com/upload/drive/v3/files/${fileId}?uploadType=media`,
@@ -166,6 +195,7 @@ async function gDriveWrite(filename: string, content: string): Promise<boolean>
                     body: content,
                 }
             );
+            if (!res.ok) console.error(`[settings] ${filename}: cloud update failed (${res.status})`);
             return res.ok;
         } else {
             // Create new
@@ -365,6 +395,24 @@ function parseJsonc(text: string): any {
 // the NEXT read sees the shared copy. Caches are caches, never the source
 // of truth. (Per-device files like devices/<id>/state.json are exempt —
 // only this device writes them.)
+// prev-versioning (Bob's prev/ convention, IndexedDB flavor): before a
+// shared config file's cache changes, stash the outgoing version under a
+// `prev:` key so a clobber leaves a local trail (the 2026-07-23 allowlist
+// wipe had NO local history anywhere — Drive revisions only reach ~30 days).
+const PREV_KEEP = 5;
+async function stashPrevIdb(filename: string, aboutToBecome: string): Promise<void> {
+    try {
+        const old = await idbRead(filename);
+        if (!old || old === aboutToBecome) return;
+        const stamp = new Date().toISOString().replace(/[:.]/g, "-").slice(0, 19);
+        await idbWrite(`prev:${filename}:${stamp}`, old);
+        const keys = await idbListKeys(`prev:${filename}:`);
+        for (const k of keys.sort().slice(0, Math.max(0, keys.length - PREV_KEEP))) {
+            await idbDelete(k);
+        }
+    } catch { /* archival never blocks a save */ }
+}
+
 const SHARED_REFRESH_MS = 5 * 60_000;
 const __lastSharedRefresh = new Map<string, number>();
 function refreshSharedFile(filename: string, cached: string): void {
@@ -462,6 +510,7 @@ export async function loadPreferences(): Promise<typeof DEFAULT_PREFERENCES> {
 /** Save preferences */
 export async function savePreferences(prefs: any): Promise<void> {
     const content = JSON.stringify(prefs, null, 2);
+    await stashPrevIdb("preferences.jsonc", content);
     await idbWrite("preferences.jsonc", content);
     await gDriveWrite("preferences.jsonc", content);
 }
@@ -503,10 +552,52 @@ export async function loadAllowlist(): Promise<typeof DEFAULT_ALLOWLIST> {
     return { ...DEFAULT_ALLOWLIST };
 }
 
-/** Save allowlist */
+const ALLOWLIST_KEYS = ["senders", "domains", "recipients", "flaggedSenders", "flaggedDomains"] as const;
+function allowlistEntryCount(l: any): number {
+    return ALLOWLIST_KEYS.reduce((n, k) => n + (Array.isArray(l?.[k]) ? l[k].length : 0), 0);
+}
+
+/** Read-modify-write against the FRESHEST copy. The load→mutate→save shape
+ *  clobbered the shared file twice (2026-07-22/23): a phone whose cached
+ *  base was 12 days stale wrote it back minus everything added since, and a
+ *  fresh install whose base was DEFAULT_ALLOWLIST wiped the file to ~nothing
+ *  (restored from Drive revisions). Mutations now apply to the live cloud
+ *  copy when reachable; the cache is only the offline fallback. */
+export async function updateAllowlist(mutate: (list: typeof DEFAULT_ALLOWLIST) => typeof DEFAULT_ALLOWLIST | void): Promise<typeof DEFAULT_ALLOWLIST> {
+    let base: typeof DEFAULT_ALLOWLIST | null = null;
+    try {
+        const fresh = await gDriveRead("allowlist.jsonc");
+        if (fresh) {
+            await idbWrite("allowlist.jsonc", fresh);
+            try { base = parseJsonc(fresh); } catch { /* corrupt cloud copy — fall back */ }
+        }
+    } catch { /* offline / auth pending */ }
+    if (!base) base = await loadAllowlist();
+    const out = mutate(base) || base;
+    await saveAllowlist(out);
+    return out;
+}
+
+/** Save allowlist. Backstop shrink guard: a write that would discard more
+ *  than half of a substantial cloud copy is the wipe signature (stale or
+ *  default base) — keep it out of the shared file. The local cache still
+ *  updates so the device's own view is consistent; the next
+ *  stale-while-revalidate pull re-syncs it with the cloud. */
 export async function saveAllowlist(list: typeof DEFAULT_ALLOWLIST): Promise<void> {
     const content = JSON.stringify(list, null, 2);
+    await stashPrevIdb("allowlist.jsonc", content);
     await idbWrite("allowlist.jsonc", content);
+    try {
+        const cloudRaw = await gDriveRead("allowlist.jsonc");
+        if (cloudRaw) {
+            const cloudCount = allowlistEntryCount(parseJsonc(cloudRaw));
+            const newCount = allowlistEntryCount(list);
+            if (cloudCount > 10 && newCount < cloudCount / 2) {
+                console.error(`[settings] REFUSING allowlist cloud write: ${cloudCount} → ${newCount} entries (stale/default base — see 2026-07-23 wipe). Local cache updated only.`);
+                return;
+            }
+        }
+    } catch { /* cloud unreadable — proceed; the guard only fires when it can verify */ }
     await gDriveWrite("allowlist.jsonc", content);
 }