@bobfrankston/rmfmail 1.2.310 → 1.2.313

package/client/components/message-viewer.js

@@ -1506,6 +1506,60 @@ export async function showMessage(accountId, uid, folderId, specialUse, isRetry
                             items.push({ label: `✓ Trust all senders at ${dom}`, action: () => void approve("domain", dom) });
                         items.push({ label: "", action: () => { }, separator: true });
                     }
+                    // "Trust the ‹list› mailing list" (Bob 2026-09-09: "how do I
+                    // say that this is a valid mailing list message"). A list
+                    // that keeps the poster's From — MIT's Mailman, for a Gmail
+                    // author — leaves nothing per-sender to trust: the author
+                    // is unproved on every post, by the list's own doing. The
+                    // LIST is proved (its host passed SPF for the bounce
+                    // address), so the list is what the reader vouches for.
+                    // Offered from the chip's own advice, which is the only
+                    // thing an unflagged list post shows; the banner has its
+                    // own button.
+                    //
+                    // Offered on every proved post, trusted or not: the write
+                    // is a toggle, and once the list is trusted the chip and
+                    // banner are gone, so this menu is the only place an
+                    // approval can be undone without editing allowlist.jsonc
+                    // by hand (Bob 2026-09-09: "how would I undo an approval").
+                    const listSpam = msg.spamScore;
+                    if (listSpam?.listProved && listSpam.listId) {
+                        const listId = listSpam.listId;
+                        const untrust = !!listSpam.listTrusted;
+                        items.push({
+                            label: untrust ? `✗ Stop trusting the ${listId} mailing list` : `✓ Trust the ${listId} mailing list`,
+                            action: async () => {
+                                const st = document.getElementById("status-sync");
+                                try {
+                                    // A toggle: the answer says which way it went,
+                                    // and it must match what was asked for — a
+                                    // mismatch means the write did not land.
+                                    const res = await trustSenderOrDomain("list", listId);
+                                    if (!res || !!res.trusted === untrust)
+                                        throw new Error("the list did not save");
+                                    listSpam.listTrusted = res.trusted;
+                                    if (res.trusted) {
+                                        document.querySelector(".mv-spamscore")?.remove();
+                                        document.querySelector(".mv-spamscore-action")?.remove();
+                                        document.querySelector(".mv-trust")?.remove();
+                                    }
+                                    if (st)
+                                        st.textContent = res.trusted
+                                            ? `Trusting the ${listId} mailing list`
+                                            : `No longer trusting the ${listId} mailing list — reopen the message to see its score again`;
+                                }
+                                catch (e) {
+                                    // The reader chose an action and must know whether it took.
+                                    if (st) {
+                                        st.textContent = `Couldn't trust the ${listId} list — ${e?.message || e}`;
+                                        st.style.color = "oklch(0.65 0.2 25)";
+                                    }
+                                    console.error("[allowlist] trust list failed:", e);
+                                }
+                            },
+                        });
+                        items.push({ label: "", action: () => { }, separator: true });
+                    }
                 }
                 if (omitted > 0) {
                     items.push({
@@ -1860,9 +1914,48 @@ export async function showMessage(accountId, uid, folderId, specialUse, isRetry
                         : "No forgery rule scored. The rules that did are listed below.")
                 : level === "high"
                     ? "Your mail server scored this at or above its spam threshold and flagged it."
-                    : "Below your server's spam threshold, but more than halfway to it.") + why;
+                    : "Below your server's spam threshold, but more than halfway to it.") + why
+                // The list that provably delivered this, and where the action
+                // lives — the chip is the only thing an unflagged list post
+                // shows, so it has to say how to make it stop (2026-09-09).
+                + (spam.listProved && spam.listId && !spam.listTrusted
+                    ? `\n\nDelivered by the ${spam.listId} mailing list, which your server proved sent it. Right-click the From address to trust the list.`
+                    : "");
             chip.textContent = `spam score ${spam.score} of ${spam.threshold}`;
             bodyEl.appendChild(chip);
+            // The action beside the warning it answers (Bob 2026-09-09: "it
+            // would be nice to have an [approve this list] on the red warning
+            // banner"). An unflagged list post has no banner — the chip IS
+            // the warning — so the button sits next to it. Same write as the
+            // From-menu item and the banner button: trustedLists by List-Id.
+            if (spam.listProved && spam.listId && !spam.listTrusted) {
+                const listId = spam.listId;
+                const b = document.createElement("button");
+                b.className = "mv-trust-action mv-spamscore-action";
+                b.textContent = `Trust the ${listId} list`;
+                b.title = `Delivered by the ${listId} mailing list, which your server proved sent it. Trusting the list hides this score on every post the list delivers.`;
+                b.addEventListener("click", async () => {
+                    b.disabled = true;
+                    try {
+                        // Only ever ADDS, so anything but `trusted: true` means
+                        // the write did not land — never hide the chip on a
+                        // failed save.
+                        const res = await trustSenderOrDomain("list", listId);
+                        if (!res?.trusted)
+                            throw new Error("the list did not save");
+                        spam.listTrusted = true;
+                        chip.remove();
+                        b.remove();
+                        document.querySelector(".mv-trust")?.remove();
+                    }
+                    catch (e) {
+                        // The reader pressed a button and must know whether it took.
+                        b.disabled = false;
+                        b.textContent = `Could not save: ${e?.message || e}`;
+                    }
+                });
+                bodyEl.appendChild(b);
+            }
         }
         const trust = (msg.trust || []);
         if (trust.length) {
@@ -1941,6 +2034,40 @@ export async function showMessage(accountId, uid, folderId, specialUse, isRetry
                 }
                 warn.appendChild(actions);
             }
+            // "Trust the ‹list› list" (Bob 2026-09-09: "how do I say that this
+            // is a valid mailing list message"). A finding carries `list` only
+            // when the receiving server proved the list's host sent the
+            // message and the list is not yet trusted; the entry it writes
+            // (`trustedLists`, keyed on List-Id) counts only on such mail.
+            // Not on a danger banner, for the same reason as every other
+            // button here.
+            const lists = worst === "danger" ? [] : Array.from(new Set(trust.map(f => f.list).filter(Boolean)));
+            if (lists.length) {
+                const actions = document.createElement("div");
+                actions.className = "mv-trust-actions";
+                for (const listId of lists) {
+                    const b = document.createElement("button");
+                    b.className = "mv-trust-action";
+                    b.textContent = `Trust the ${listId} list`;
+                    b.addEventListener("click", async () => {
+                        b.disabled = true;
+                        try {
+                            const res = await trustSenderOrDomain("list", listId);
+                            if (!res?.trusted)
+                                throw new Error("the list did not save");
+                            warn.remove();
+                            document.querySelector(".mv-spamscore")?.remove();
+                        }
+                        catch (e) {
+                            // The reader pressed a button and must know whether it took.
+                            b.disabled = false;
+                            b.textContent = `Could not save: ${e?.message || e}`;
+                        }
+                    });
+                    actions.appendChild(b);
+                }
+                warn.appendChild(actions);
+            }
             // "Trust ‹service› as an intermediary" (Bob 2026-09-08: "how do I
             // mark zoom and sites like that as trusted intermediaries?"). A
             // finding carries `via` only when a party PROVABLY handled the