@bobfrankston/rmfmail 1.2.321 → 1.2.323

package/client/components/message-viewer.ts

@@ -1809,7 +1809,7 @@ export async function showMessage(accountId: string, uid: number, folderId?: num
             }
         }
 
-        const trust = ((msg as any).trust || []) as { id: string; severity: string; text: string; detail: string; via?: string; list?: string }[];
+        const trust = ((msg as any).trust || []) as { id: string; severity: string; text: string; detail: string; via?: string; list?: string; senderVia?: string }[];
         if (trust.length) {
             // An `info` finding is not an accusation, so it gets neither the
             // headline nor the "do not open anything" footer — it renders as a
@@ -1933,6 +1933,37 @@ export async function showMessage(accountId: string, uid: number, folderId?: num
                 }
                 warn.appendChild(actions);
             }
+            // "Trust ‹sender› via ‹relay›" (Bob 2026-09-10, Ground News: "another
+            // valid site. How do I approve it?"). A finding carries senderVia
+            // only when the reader already trusts the sender, nothing proves the
+            // From line, and a relay DID sign the message; the entry it writes
+            // counts only on mail from that sender that relay signs.
+            const senderVias = worst === "danger" ? [] : Array.from(new Set(trust.map(f => f.senderVia).filter(Boolean)));
+            if (senderVias.length) {
+                const actions = document.createElement("div");
+                actions.className = "mv-trust-actions";
+                for (const pair of senderVias) {
+                    const b = document.createElement("button");
+                    b.className = "mv-trust-action";
+                    b.textContent = `Trust ${pair}`;
+                    b.title = `Adds "${pair}" to trustedSendersVia in allowlist.jsonc. Stops this note for mail from ${pair.split(" via ")[0]} that ${pair.split(" via ")[1]} signs; a message without that signature is still checked.`;
+                    b.addEventListener("click", async () => {
+                        b.disabled = true;
+                        try {
+                            const res = await trustSenderOrDomain("via", pair);
+                            if (!res?.trusted) throw new Error("the sender-via list did not save");
+                            warn.remove();
+                            document.querySelector(".mv-spamscore")?.remove();
+                        } catch (e: any) {
+                            // The reader pressed a button and must know whether it took.
+                            b.disabled = false;
+                            b.textContent = `Could not save: ${e?.message || e}`;
+                        }
+                    });
+                    actions.appendChild(b);
+                }
+                warn.appendChild(actions);
+            }
             // "Trust ‹service› as an intermediary" (Bob 2026-09-08: "how do I
             // mark zoom and sites like that as trusted intermediaries?"). A
             // finding carries `via` only when a party PROVABLY handled the

package/client/compose/compose.bundle.js

@@ -1357,7 +1357,7 @@ function trustSenderOrDomain(type, value) {
   return ipc().trustSenderOrDomain?.(type, value) ?? Promise.resolve({ trusted: false });
 }
 function getAllowlist() {
-  return ipc().getAllowlist?.() ?? Promise.resolve({ senders: [], domains: [], recipients: [], flaggedSenders: [], flaggedDomains: [], trustedSenders: [], trustedDomains: [], trustedIntermediaries: [], trustedLists: [] });
+  return ipc().getAllowlist?.() ?? Promise.resolve({ senders: [], domains: [], recipients: [], flaggedSenders: [], flaggedDomains: [], trustedSenders: [], trustedDomains: [], trustedIntermediaries: [], trustedLists: [], trustedSendersVia: [] });
 }
 function flagSenderOrDomain(type, value) {
   return ipc().flagSenderOrDomain?.(type, value) ?? Promise.resolve({ flagged: false });