@bobfrankston/rmfmail 1.2.310 → 1.2.312

package/client/components/message-viewer.js

@@ -1506,6 +1506,47 @@ export async function showMessage(accountId, uid, folderId, specialUse, isRetry
                             items.push({ label: `✓ Trust all senders at ${dom}`, action: () => void approve("domain", dom) });
                         items.push({ label: "", action: () => { }, separator: true });
                     }
+                    // "Trust the ‹list› mailing list" (Bob 2026-09-09: "how do I
+                    // say that this is a valid mailing list message"). A list
+                    // that keeps the poster's From — MIT's Mailman, for a Gmail
+                    // author — leaves nothing per-sender to trust: the author
+                    // is unproved on every post, by the list's own doing. The
+                    // LIST is proved (its host passed SPF for the bounce
+                    // address), so the list is what the reader vouches for.
+                    // Offered from the chip's own advice, which is the only
+                    // thing an unflagged list post shows; the banner has its
+                    // own button.
+                    const listSpam = msg.spamScore;
+                    if (listSpam?.listProved && listSpam.listId && !listSpam.listTrusted) {
+                        const listId = listSpam.listId;
+                        items.push({
+                            label: `✓ Trust the ${listId} mailing list`,
+                            action: async () => {
+                                const st = document.getElementById("status-sync");
+                                try {
+                                    // The action only ever ADDS, so anything but
+                                    // `trusted: true` means the write did not land.
+                                    const res = await trustSenderOrDomain("list", listId);
+                                    if (!res?.trusted)
+                                        throw new Error("the list did not save");
+                                    listSpam.listTrusted = true;
+                                    document.querySelector(".mv-spamscore")?.remove();
+                                    document.querySelector(".mv-trust")?.remove();
+                                    if (st)
+                                        st.textContent = `Trusting the ${listId} mailing list`;
+                                }
+                                catch (e) {
+                                    // The reader chose an action and must know whether it took.
+                                    if (st) {
+                                        st.textContent = `Couldn't trust the ${listId} list — ${e?.message || e}`;
+                                        st.style.color = "oklch(0.65 0.2 25)";
+                                    }
+                                    console.error("[allowlist] trust list failed:", e);
+                                }
+                            },
+                        });
+                        items.push({ label: "", action: () => { }, separator: true });
+                    }
                 }
                 if (omitted > 0) {
                     items.push({
@@ -1860,7 +1901,13 @@ export async function showMessage(accountId, uid, folderId, specialUse, isRetry
                         : "No forgery rule scored. The rules that did are listed below.")
                 : level === "high"
                     ? "Your mail server scored this at or above its spam threshold and flagged it."
-                    : "Below your server's spam threshold, but more than halfway to it.") + why;
+                    : "Below your server's spam threshold, but more than halfway to it.") + why
+                // The list that provably delivered this, and where the action
+                // lives — the chip is the only thing an unflagged list post
+                // shows, so it has to say how to make it stop (2026-09-09).
+                + (spam.listProved && spam.listId && !spam.listTrusted
+                    ? `\n\nDelivered by the ${spam.listId} mailing list, which your server proved sent it. Right-click the From address to trust the list.`
+                    : "");
             chip.textContent = `spam score ${spam.score} of ${spam.threshold}`;
             bodyEl.appendChild(chip);
         }
@@ -1941,6 +1988,40 @@ export async function showMessage(accountId, uid, folderId, specialUse, isRetry
                 }
                 warn.appendChild(actions);
             }
+            // "Trust the ‹list› list" (Bob 2026-09-09: "how do I say that this
+            // is a valid mailing list message"). A finding carries `list` only
+            // when the receiving server proved the list's host sent the
+            // message and the list is not yet trusted; the entry it writes
+            // (`trustedLists`, keyed on List-Id) counts only on such mail.
+            // Not on a danger banner, for the same reason as every other
+            // button here.
+            const lists = worst === "danger" ? [] : Array.from(new Set(trust.map(f => f.list).filter(Boolean)));
+            if (lists.length) {
+                const actions = document.createElement("div");
+                actions.className = "mv-trust-actions";
+                for (const listId of lists) {
+                    const b = document.createElement("button");
+                    b.className = "mv-trust-action";
+                    b.textContent = `Trust the ${listId} list`;
+                    b.addEventListener("click", async () => {
+                        b.disabled = true;
+                        try {
+                            const res = await trustSenderOrDomain("list", listId);
+                            if (!res?.trusted)
+                                throw new Error("the list did not save");
+                            warn.remove();
+                            document.querySelector(".mv-spamscore")?.remove();
+                        }
+                        catch (e) {
+                            // The reader pressed a button and must know whether it took.
+                            b.disabled = false;
+                            b.textContent = `Could not save: ${e?.message || e}`;
+                        }
+                    });
+                    actions.appendChild(b);
+                }
+                warn.appendChild(actions);
+            }
             // "Trust ‹service› as an intermediary" (Bob 2026-09-08: "how do I
             // mark zoom and sites like that as trusted intermediaries?"). A
             // finding carries `via` only when a party PROVABLY handled the