@bobfrankston/rmfmail 1.2.272 → 1.2.276

package/client/components/message-viewer.ts

@@ -10,12 +10,14 @@
  */
 
 import { getMessage, updateFlags, allowRemoteContent, flagSenderOrDomain, getAttachment, openAttachment, getMessageSource, addContact, listContacts, upsertContact, unsubscribeOneClick, addPreferredContact, onEvent, subscribeStore } from "../lib/api-client.js";
+import { isSenderApproved, noteApprovedLocally, refreshApprovedSenders } from "../lib/approved-senders.js";
+import { buildInviteCard } from "./invite-card.js";
 import { showContextMenu } from "./context-menu.js";
 import type { MenuItem } from "./context-menu.js";
 import type { ListMessage } from "../lib/message-state.js";
 import { updateMessageFlags as stateUpdateFlags } from "../lib/message-state.js";
 import { setRowSeen } from "./message-list.js";
-import { setSeen, seenOf, formatSender } from "@bobfrankston/mailx-types";
+import { setSeen, seenOf, formatSender, displayNameClaimsOtherAddress } from "@bobfrankston/mailx-types";
 
 // ── "Copy image" bridge ──
 // The preview iframe encodes the image and posts the bytes back; these track
@@ -715,22 +717,27 @@ function installPreviewControls(iframe: HTMLIFrameElement): void {
             // don't preventDefault — the browser's native select-all inside
             // the iframe selects exactly this document.
             if (e.ctrlKey && !e.altKey && !e.metaKey && (e.key === "a" || e.key === "A")) return;
-            // Forward EVERY keydown to the parent — no duplicated hotkey list.
-            // If the parent's handler calls preventDefault (because it owns the
-            // shortcut), dispatchEvent returns false, and we preventDefault on
-            // the iframe side too so the browser doesn't ALSO act on it
-            // (Ctrl+N otherwise pops a new browser window in some hosts).
-            // Single source of truth = app.ts hotkey handlers. Plain typing in
-            // the email body — letters, etc. — propagates with no parent
-            // handler matching, so dispatchEvent returns true and the iframe
-            // event is left alone.
-            const synth = new KeyboardEvent("keydown", {
-                key: e.key, code: e.code,
-                ctrlKey: e.ctrlKey, shiftKey: e.shiftKey, altKey: e.altKey, metaKey: e.metaKey,
-                bubbles: true, cancelable: true,
-            });
-            const allowDefault = document.dispatchEvent(synth);
-            if (!allowDefault) e.preventDefault();
+            // Everything else is FORWARDED BY THE IFRAME ITSELF — the inline
+            // script wrapHtmlBody installs posts every keydown to the parent
+            // as `previewKey`, and app.ts re-dispatches it on document. This
+            // listener must NOT forward as well.
+            //
+            // It used to, and both routes are live on desktop WebView2 (the
+            // srcdoc document is same-origin, so this contentDocument listener
+            // attaches, and the inline script runs too). One Ctrl+F in the
+            // preview therefore reached app.ts TWICE and opened TWO compose
+            // windows — one of which never finished loading and sat blank and
+            // "(Not Responding)" until it was killed (Bob 2026-08-23,
+            // "Compose: Fwd: FirstCare Slide Deck (Not Responding)"; daemon
+            // log shows openCompose-entry mode=forward twice in the same
+            // millisecond and two popoutCompose windows). Ctrl+D / Ctrl+P
+            // doubled the same way.
+            //
+            // The inline forwarder is the one that survives, because it is the
+            // only one that works on Android WebView, where parent-side
+            // contentDocument listeners never fire. Zoom and Ctrl+A stay here:
+            // they act on THIS document and the inline script deliberately
+            // skips them. (Claude Code 2026-08-23)
         });
 
         doc.addEventListener("wheel", (e) => {
@@ -788,6 +795,10 @@ export function clearViewer(): void {
     if (bodyEl) bodyEl.innerHTML = `<div class="mv-empty">Select a message to read</div>`;
     if (headerEl) headerEl.hidden = true;
     if (attEl) attEl.hidden = true;
+    // The invite card is a SIBLING of the body (it sits after the header), so
+    // clearing bodyEl leaves it behind — a stale meeting hovering over "Select
+    // a message to read" is exactly the viewer-must-clear failure.
+    document.getElementById("mv-invite")?.remove();
     // Divergence watchdog: highlight and viewer are supposed to be one
     // thing. If a second after a clear some row still shows .selected while
     // the pane shows the placeholder, that's the "message selected but it's
@@ -1215,6 +1226,22 @@ export async function showMessage(accountId: string, uid: number, folderId?: num
         fromEl.textContent = formatAddr(msg.from);
         setRecipientLine(toEl, msg.to, msg.cc, msg.deliveredTo);
         headerEl.querySelector(".mv-subject")!.textContent = msg.subject;
+
+        // Calendar invite card. Lives BETWEEN the header and the body as its
+        // own element, not inside .mv-body — the body's innerHTML is replaced
+        // wholesale on every render, which would take the card with it.
+        // Removed and rebuilt per message so a non-invite never inherits the
+        // previous one (the "viewer must clear" rule).
+        document.getElementById("mv-invite")?.remove();
+        try {
+            const card = buildInviteCard((msg as any).invite, String(msg.bodyHtml || ""));
+            if (card) {
+                card.id = "mv-invite";
+                headerEl.insertAdjacentElement("afterend", card);
+            }
+        } catch (e: any) {
+            console.warn("[viewer] invite card failed:", e?.message || e);
+        }
         document.dispatchEvent(new CustomEvent("mailx-message-shown", { detail: { accountId } }));
 
         // Right-click on email addresses in header: copy name, copy address,
@@ -1312,6 +1339,39 @@ export async function showMessage(accountId: string, uid: number, folderId?: num
                     });
                     items.push({ label: "", action: () => {}, separator: true });
                 }
+                // "Mark as valid" — the display-name warning is only useful if
+                // it can be silenced per sender. Reuses the shared allowlist
+                // (same senders/domains that gate remote images), so one act of
+                // trust covers both (Bob 2026-08-20: "another variation on
+                // approved senders. If a message is flagged I should be able to
+                // mark it as valid").
+                if (el === fromEl && msg.from?.address) {
+                    const addr = String(msg.from.address);
+                    const dom = addr.split("@").pop() || "";
+                    const claimed = displayNameClaimsOtherAddress(String(msg.from.name || ""), addr);
+                    if (claimed && !isSenderApproved(addr)) {
+                        const approve = async (type: "sender" | "domain", value: string) => {
+                            noteApprovedLocally(type, value);          // optimistic — row updates now
+                            try {
+                                await allowRemoteContent(type, value);
+                                await refreshApprovedSenders();
+                                document.dispatchEvent(new CustomEvent("mailx-allowlist-changed"));
+                                const st = document.getElementById("status-sync");
+                                if (st) st.textContent = `Marked valid: ${value}`;
+                            } catch (e: any) {
+                                const st = document.getElementById("status-sync");
+                                if (st) {
+                                    st.textContent = `Couldn't save "${value}" to the allowlist — ${e?.message || e}`;
+                                    st.style.color = "oklch(0.65 0.2 25)";
+                                }
+                                console.error("[allowlist] approve failed:", e);
+                            }
+                        };
+                        items.push({ label: `✓ Mark ${addr} as a valid sender`, action: () => void approve("sender", addr) });
+                        if (dom) items.push({ label: `✓ Trust all senders at ${dom}`, action: () => void approve("domain", dom) });
+                        items.push({ label: "", action: () => {}, separator: true });
+                    }
+                }
                 if (omitted > 0) {
                     items.push({
                         label: `… ${omitted} more recipients — copy the whole list`,
@@ -2146,7 +2206,8 @@ function formatAddr(addr: { name: string; address: string }): string {
     // 2026-08-19) and reports when a display name asserts a DIFFERENT address
     // than the envelope's, which is the display-name spoof.
     const { text, claimed } = formatSender(addr);
-    if (!claimed) return text;
+    // Approved senders are never called out — see approved-senders.ts.
+    if (!claimed || isSenderApproved(addr.address)) return text;
     // Never let the claim stand unqualified: name the real address explicitly.
     return `${text} — display name claims ${claimed}`;
 }

package/client/compose/compose.bundle.js

@@ -1053,6 +1053,7 @@ __export(api_client_exports, {
   flagSenderOrDomain: () => flagSenderOrDomain,
   formatJsonc: () => formatJsonc,
   getAccounts: () => getAccounts,
+  getAllowlist: () => getAllowlist,
   getAttachment: () => getAttachment,
   getAutocompleteSettings: () => getAutocompleteSettings,
   getCalendarEvents: () => getCalendarEvents,
@@ -1347,6 +1348,9 @@ function addUserDictWords(words) {
 function removeUserDictWord(word) {
   return ipc().removeUserDictWord?.(word) ?? Promise.resolve([]);
 }
+function getAllowlist() {
+  return ipc().getAllowlist?.() ?? Promise.resolve({ senders: [], domains: [], recipients: [], flaggedSenders: [], flaggedDomains: [] });
+}
 function flagSenderOrDomain(type, value) {
   return ipc().flagSenderOrDomain?.(type, value) ?? Promise.resolve({ flagged: false });
 }