@rapidmx/web-client 0.10.0 → 0.11.0

package/apps/www/settings/sharing/index.tsx

@@ -3,21 +3,22 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import { routedPage } from "../../_routedPage.js";
-import React, { FormEvent, useEffect, useState } from "react";
+import React, { useEffect, useState } from "react";
 import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
 import {
     MailboxAccessMember,
     MailboxAccessRole,
     listMailboxAccess,
-    lookupMailboxOwnerByEmail,
     removeMailboxAccess,
     setMailboxAccess,
 } from "@rapidmx/react-shared/mail/mailboxAccessApi.js";
 import SettingsShell, { SettingsShellProps, useSettingsShell } from "../../../shared/components/settings/layout/SettingsShell.js";
+import PrincipalPicker from "../../../shared/components/sharing/PrincipalPicker.js";
 import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
 import Button from "@rapidmx/react-shared/components/buttons/Button.js";
 import Modal from "@rapidmx/react-shared/components/overlays/Modal.js";
 import { SkeletonList } from "@rapidmx/react-shared/components/feedback/Skeleton.js";
+import { notifyApiError } from "../../../shared/notifications/apiErrors.js";
 
 const ROLE_LABELS: Record<MailboxAccessRole, string> = { viewer: "Can view", manager: "Can manage" };
 
@@ -49,10 +50,8 @@ function SharingContent() {
     const [status, setStatus] = useState<Status>("loading");
     const [error, setError] = useState<string | null>(null);
 
-    const [emailInput, setEmailInput] = useState("");
-    const [newRole, setNewRole] = useState<MailboxAccessRole>("viewer");
-    const [adding, setAdding] = useState(false);
-    const [addError, setAddError] = useState<string | null>(null);
+    // An entry that is not a user uid, being replaced with the user it was meant for.
+    const [replacing, setReplacing] = useState<MailboxAccessMember | null>(null);
 
     const [pendingRoleChange, setPendingRoleChange] = useState<string | null>(null);
     const [removeTarget, setRemoveTarget] = useState<MailboxAccessMember | null>(null);
@@ -84,39 +83,27 @@ function SharingContent() {
 
     useEffect(reload, [mailboxUid]);
 
-    async function handleAdd(e: FormEvent) {
-        e.preventDefault();
-        const email = emailInput.trim();
-        if (!email) {
-            return;
-        }
-        setAddError(null);
-        setAdding(true);
-        try {
-            const found = await lookupMailboxOwnerByEmail(email);
-            if (!found) {
-                setAddError("No one found with that email on this platform.");
-                return;
+    // Once the person is granted, the entry they replace (if any) is removed: the string it named never matched anyone.
+    async function handleGranted() {
+        const stale = replacing;
+        setReplacing(null);
+        if (stale) {
+            try {
+                await removeMailboxAccess(mailboxUid!, stale.userOrRoleId);
+            } catch (err) {
+                notifyApiError(err, "Couldn't remove the old entry");
             }
-            await setMailboxAccess(mailboxUid!, found.userUid, newRole);
-            setEmailInput("");
-            setNewRole("viewer");
-            reload();
-        } catch (err) {
-            setAddError(err instanceof ApiRequestError ? err.message : "Could not grant access.");
-        } finally {
-            setAdding(false);
         }
+        reload();
     }
 
     async function handleRoleChange(userOrRoleId: string, role: MailboxAccessRole) {
         setPendingRoleChange(userOrRoleId);
-        setError(null);
         try {
             await setMailboxAccess(mailboxUid!, userOrRoleId, role);
             reload();
         } catch (err) {
-            setError(err instanceof ApiRequestError ? err.message : "Could not update this member's role.");
+            notifyApiError(err, "Couldn't change this member's role");
         } finally {
             setPendingRoleChange(null);
         }
@@ -130,13 +117,12 @@ function SharingContent() {
         // Only reachable from the confirm modal's own "Remove" button, and `Modal` renders nothing at all
         // unless `removeTarget` is set, so `removeTarget` is always non-null here.
         setRemoving(true);
-        setError(null);
         try {
             await removeMailboxAccess(mailboxUid!, removeTarget!.userOrRoleId);
             setRemoveTarget(null);
             reload();
         } catch (err) {
-            setError(err instanceof ApiRequestError ? err.message : "Could not remove this member.");
+            notifyApiError(err, "Couldn't remove this member");
         } finally {
             setRemoving(false);
         }
@@ -164,8 +150,6 @@ function SharingContent() {
 
                 {status === "ready" && (
                     <>
-                        {error && <Alert>{error}</Alert>}
-
                         <div>
                             <h2 className="text-sm font-semibold mb-2">People with access</h2>
                             {members.length === 0 ? (
@@ -177,8 +161,20 @@ function SharingContent() {
                                             key={member.userOrRoleId}
                                             className="flex items-center justify-between gap-3 text-sm py-1.5 px-3 bg-surface-alt rounded-sm"
                                         >
-                                            <span className="truncate">{member.userOrRoleId}</span>
+                                            <span className="truncate">
+                                                {member.userOrRoleId}
+                                                {member.noEffect && (
+                                                    <span className="block text-xs text-danger">
+                                                        Not a user - this entry has no effect. Replace it with the person it was meant for, or remove it.
+                                                    </span>
+                                                )}
+                                            </span>
                                             <span className="flex items-center gap-2 shrink-0">
+                                                {member.noEffect && (
+                                                    <Button type="button" variant="text" className="!w-auto" onClick={() => setReplacing(member)}>
+                                                        Replace with a user
+                                                    </Button>
+                                                )}
                                                 <select
                                                     aria-label={`Role for ${member.userOrRoleId}`}
                                                     className="text-sm border border-border rounded-sm py-1 px-2 bg-surface"
@@ -216,37 +212,20 @@ function SharingContent() {
                             )}
                         </div>
 
-                        <form onSubmit={handleAdd} className="flex flex-col gap-2">
-                            <h2 className="text-sm font-semibold">Add someone</h2>
-                            {addError && <Alert>{addError}</Alert>}
-                            <div className="flex gap-2">
-                                <input
-                                    type="email"
-                                    aria-label="Email address"
-                                    placeholder="Email address"
-                                    className="flex-1 text-sm border border-border rounded-sm py-1.5 px-2 bg-surface"
-                                    value={emailInput}
-                                    onChange={(e) => setEmailInput(e.target.value)}
-                                    disabled={adding}
-                                />
-                                <select
-                                    aria-label="Role to grant"
-                                    className="text-sm border border-border rounded-sm py-1.5 px-2 bg-surface"
-                                    value={newRole}
-                                    onChange={(e) => setNewRole(e.target.value as MailboxAccessRole)}
-                                    disabled={adding}
-                                >
-                                    {(Object.keys(ROLE_LABELS) as MailboxAccessRole[]).map((role) => (
-                                        <option key={role} value={role}>
-                                            {ROLE_LABELS[role]}
-                                        </option>
-                                    ))}
-                                </select>
-                                <Button type="submit" loading={adding} disabled={adding} className="!w-auto">
-                                    Add
-                                </Button>
-                            </div>
-                        </form>
+                        <div className="flex flex-col gap-2">
+                            <h2 className="text-sm font-semibold">{replacing ? `Replace ${replacing.userOrRoleId}` : "Add someone"}</h2>
+                            {/* The person is looked up and shown - name and address - before anything is saved. */}
+                            <PrincipalPicker
+                                key={replacing?.userOrRoleId ?? "new"}
+                                mailboxUid={mailboxUid!}
+                                roleLabels={ROLE_LABELS}
+                                initialPrincipal={replacing?.userOrRoleId}
+                                defaultRole={replacing?.role === "manager" ? "manager" : "viewer"}
+                                placeholder="Email address or username"
+                                onGranted={handleGranted}
+                                onCancel={replacing ? () => setReplacing(null) : undefined}
+                            />
+                        </div>
                     </>
                 )}
 

package/apps/www/settings/signatures/[uid].tsx

@@ -12,6 +12,7 @@ import RichTextEditor from "../../../shared/components/mail/compose/RichTextEdit
 import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
 import Button from "@rapidmx/react-shared/components/buttons/Button.js";
 import FormField from "@rapidmx/react-shared/components/forms/FormField.js";
+import { notifyApiError } from "../../../shared/notifications/apiErrors.js";
 
 const INPUT_CLASS =
     "w-full text-sm py-2.5 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
@@ -91,7 +92,8 @@ function SignatureDetailContent({ uid }: { uid: string }) {
             setOriginal(updated);
             setSaved(true);
         } catch (err) {
-            setError(err instanceof ApiRequestError ? err.message : "Could not save this signature.");
+            // A pop-up: `error` is only this form's own validation (and the load failure above).
+            notifyApiError(err, "Couldn't save the signature");
         } finally {
             setSaving(false);
         }

package/apps/www/settings/signatures/new/index.tsx

@@ -5,7 +5,6 @@
 import { routedPage } from "../../../_routedPage.js";
 import { useNavigate } from "../../../../shared/navigation/AppRouter.js";
 import React, { FormEvent, useState } from "react";
-import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
 import { createMailSignature, listMailSignatures } from "@rapidmx/react-shared/mail/mailSignaturesApi.js";
 import { clearPreviousDefaults } from "../signatureDefaults.js";
 import SettingsShell, { SettingsShellProps, useSettingsShell } from "../../../../shared/components/settings/layout/SettingsShell.js";
@@ -13,6 +12,7 @@ import RichTextEditor from "../../../../shared/components/mail/compose/RichTextE
 import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
 import Button from "@rapidmx/react-shared/components/buttons/Button.js";
 import FormField from "@rapidmx/react-shared/components/forms/FormField.js";
+import { notifyApiError } from "../../../../shared/notifications/apiErrors.js";
 
 const INPUT_CLASS =
     "w-full text-sm py-2.5 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
@@ -68,7 +68,8 @@ function NewSignatureForm() {
             });
             navigate(`/settings/signatures/${encodeURIComponent(created.uid)}?mailboxUid=${encodeURIComponent(mailboxUid!)}`);
         } catch (err) {
-            setError(err instanceof ApiRequestError ? err.message : "Could not create the signature.");
+            // A pop-up: `error` above is only the form's own validation.
+            notifyApiError(err, "Couldn't create the signature");
         } finally {
             setSaving(false);
         }

package/apps/www/tasks/index.tsx

@@ -30,6 +30,7 @@ import { LIST_PAGE_SIZE, MAX_LIST_PAGES, listAllPages } from "../../shared/mail/
 import { SHORTCUTS } from "../../shared/keyboard/keymap.js";
 import { useShortcut } from "../../shared/keyboard/useShortcut.js";
 import { useShortcutProps } from "../../shared/keyboard/useShortcutProps.js";
+import { notifyApiError } from "../../shared/notifications/apiErrors.js";
 
 const INPUT_CLASS =
     "text-sm py-1.5 px-2 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
@@ -198,7 +199,6 @@ function TasksContent() {
     }
 
     async function handleToggle(task: Task) {
-        setError(null);
         const nextCompleted = !task.completed;
         setTasks((prev) => prev.map((t) => (t.uid === task.uid ? { ...t, completed: nextCompleted } : t)));
         try {
@@ -206,17 +206,16 @@ function TasksContent() {
             setTasks((prev) => prev.map((t) => (t.uid === task.uid ? updated : t)));
         } catch (err) {
             setTasks((prev) => prev.map((t) => (t.uid === task.uid ? task : t)));
-            setError(err instanceof ApiRequestError ? err.message : "Could not update this task.");
+            notifyApiError(err, "Couldn't update the task");
         }
     }
 
     async function handleDelete(task: Task) {
-        setError(null);
         try {
             await deleteTask(task.uid, task.version);
             setTasks((prev) => prev.filter((t) => t.uid !== task.uid));
         } catch (err) {
-            setError(err instanceof ApiRequestError ? err.message : "Could not delete this task.");
+            notifyApiError(err, "Couldn't delete the task");
         }
     }
 
@@ -258,46 +257,41 @@ function TasksContent() {
 
     const checkedTasks = viewFiltered.filter((t) => checkedUids.has(t.uid));
 
+    // The bulk handlers try every task and report each failure: the same failure repeated is one pop-up with a count.
     async function handleBulkComplete() {
-        let bulkError: string | null = null;
         for (const task of checkedTasks) {
             try {
                 await setTaskCompleted(task, true);
             } catch (err) {
-                bulkError = err instanceof ApiRequestError ? err.message : "Could not update one or more tasks.";
+                notifyApiError(err, "Couldn't update some of the tasks");
             }
         }
         setCheckedUids(new Set());
         await reload();
-        setError(bulkError);
     }
 
     async function handleBulkAddToMyDay() {
-        let bulkError: string | null = null;
         for (const task of checkedTasks) {
             try {
                 await setTaskMyDay(task, true);
             } catch (err) {
-                bulkError = err instanceof ApiRequestError ? err.message : "Could not update one or more tasks.";
+                notifyApiError(err, "Couldn't update some of the tasks");
             }
         }
         setCheckedUids(new Set());
         await reload();
-        setError(bulkError);
     }
 
     async function handleBulkDelete() {
-        let bulkError: string | null = null;
         for (const task of checkedTasks) {
             try {
                 await deleteTask(task.uid, task.version);
             } catch (err) {
-                bulkError = err instanceof ApiRequestError ? err.message : "Could not delete one or more tasks.";
+                notifyApiError(err, "Couldn't delete some of the tasks");
             }
         }
         setCheckedUids(new Set());
         await reload();
-        setError(bulkError);
     }
 
     function requestDelete(task: Task) {
@@ -329,7 +323,8 @@ function TasksContent() {
     const completedTasks = viewFiltered.filter((t) => t.completed);
 
     return (
-        <div className="flex-1 flex min-h-0">
+        // Below `lg` the tasks menu is a drawer (its button sits above the list), so the list keeps the whole width.
+        <div className="flex-1 min-w-0 min-h-0 flex flex-col lg:flex-row">
             <TasksSidebar mailboxUid={mailboxUid} tasks={tasks} userUid={userUid} active={view} onSelect={handleSelectView} />
             <div className="flex-1 min-w-0 flex flex-col overflow-y-auto">
                 <TasksToolbar
@@ -354,13 +349,13 @@ function TasksContent() {
                         <FlaggedEmailList loading={flaggedLoading} error={flaggedError} messages={flaggedMessages} />
                     ) : (
                         <>
-                            <form onSubmit={handleCreate} className="flex items-center gap-2 bg-surface border border-border rounded-md p-2">
+                            <form onSubmit={handleCreate} className="flex flex-wrap items-center gap-2 bg-surface border border-border rounded-md p-2">
                                 <input
                                     ref={addTaskRef}
                                     type="text"
                                     aria-label="Add a task"
                                     {...addTaskHint}
-                                    className={`${INPUT_CLASS} flex-1`}
+                                    className={`${INPUT_CLASS} min-w-40 basis-40 flex-1`}
                                     value={title}
                                     onChange={(e) => setTitle(e.target.value)}
                                     placeholder="Add a task"

package/dist/apps/admin/_layout.d.ts

@@ -4,5 +4,9 @@ export interface LayoutProps {
     /** See `apps/www/_layout.tsx`'s `LayoutProps` doc comment - identical mechanism, supplied by
      * `AdminConsoleRoute`'s `fetchProps()` override. */
     branding?: Branding;
+    /** The signed-in user's stored appearance preferences (a page prop from the same `fetchProps()`, present only on the www pages and only when the user has any): rendered as a stylesheet in the `<head>` so the very first paint is themed - see `AppearanceHead`. */
+    appearance?: unknown;
+    /** The signed-in user (supplied by the framework), so a cached appearance from another account on this browser is never applied. */
+    userUid?: string;
 }
-export default function Layout({ children, branding }: PropsWithChildren<LayoutProps>): React.JSX.Element;
+export default function Layout({ children, branding, appearance, userUid }: PropsWithChildren<LayoutProps>): React.JSX.Element;

package/dist/apps/admin/_layout.js

@@ -1,10 +1,11 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { AppearanceHead, appearanceHtmlAttributes } from "../shared/appearance/AppearanceHead.js";
 import { CUSTOM_STYLESHEET_LINK_ID } from "@rapidmx/react-shared/branding/useBranding.js";
-export default function Layout({ children, branding }) {
+export default function Layout({ children, branding, appearance, userUid }) {
     const title = branding?.title || branding?.companyName
         ? `${branding?.title || branding?.companyName}: Mail Admin Console`
         : "RapidMX: Mail Admin Console";
     const iconHref = branding?.iconUrl || branding?.logoUrl || "/images/logo.svg";
     const stylesheetHref = branding?.stylesheetUrl;
-    return (_jsxs("html", { lang: "en", children: [_jsxs("head", { children: [_jsx("meta", { charSet: "utf-8" }), _jsx("meta", { name: "viewport", content: "width=device-width, initial-scale=1" }), _jsx("title", { children: title }), _jsx("link", { rel: "icon", type: "image/svg+xml", href: iconHref }), _jsx("link", { rel: "alternate icon", href: "/favicon.ico" }), _jsx("link", { rel: "preconnect", href: "https://fonts.googleapis.com" }), _jsx("link", { rel: "preconnect", href: "https://fonts.gstatic.com", crossOrigin: "anonymous" }), _jsx("link", { rel: "stylesheet", href: "https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" }), stylesheetHref && _jsx("link", { rel: "stylesheet", href: stylesheetHref, id: CUSTOM_STYLESHEET_LINK_ID })] }), _jsx("body", { children: children })] }));
+    return (_jsxs("html", { lang: "en", ...appearanceHtmlAttributes(appearance, userUid), children: [_jsxs("head", { children: [_jsx("meta", { charSet: "utf-8" }), _jsx("meta", { name: "viewport", content: "width=device-width, initial-scale=1" }), _jsx("title", { children: title }), _jsx("link", { rel: "icon", type: "image/svg+xml", href: iconHref }), _jsx("link", { rel: "alternate icon", href: "/favicon.ico" }), _jsx("link", { rel: "preconnect", href: "https://fonts.googleapis.com" }), _jsx("link", { rel: "preconnect", href: "https://fonts.gstatic.com", crossOrigin: "anonymous" }), _jsx("link", { rel: "stylesheet", href: "https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" }), stylesheetHref && _jsx("link", { rel: "stylesheet", href: stylesheetHref, id: CUSTOM_STYLESHEET_LINK_ID }), _jsx(AppearanceHead, { appearance: appearance })] }), _jsx("body", { children: children })] }));
 }

package/dist/apps/admin/index.js

@@ -24,7 +24,8 @@ function MailboxesListContent() {
     useEffect(() => {
         setLoading(true);
         setError(null);
-        listMailboxes({ page, limit: PAGE_SIZE })
+        // The administration scope: every mailbox as administrative metadata - the console never shows anybody's mail.
+        listMailboxes({ page, limit: PAGE_SIZE, scope: "admin" })
             .then(setMailboxes)
             .catch((err) => setError(err instanceof ApiRequestError ? err.message : "Could not load mailboxes."))
             .finally(() => setLoading(false));
@@ -44,5 +45,5 @@ function MailboxesListContent() {
             setConfirmingSetup(false);
         }
     }
-    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "flex items-center justify-between mb-5", children: [_jsx("h1", { className: "text-xl font-bold uppercase tracking-wide", children: "Mailboxes" }), _jsxs("div", { className: "flex gap-2", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: reopening, onClick: () => setConfirmingSetup(true), children: "Run setup again" }), _jsx("a", { href: "/admin/mailboxes/new", children: _jsx(Button, { type: "button", className: "!w-auto", children: "+ New mailbox" }) })] })] }), error && _jsx(Alert, { children: error }), _jsxs(Modal, { open: confirmingSetup, onClose: () => setConfirmingSetup(false), title: "Run setup again?", children: [_jsx("p", { className: "text-sm mb-4", children: "Setup starts again from its first step, and the admin console sends administrators to it until it's finished. Your existing settings, domains and mailboxes are kept." }), _jsxs("div", { className: "flex gap-2 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setConfirmingSetup(false), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto", loading: reopening, disabled: reopening, onClick: () => void handleRunSetup(), children: "Run setup" })] })] }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : (_jsx(MailboxTable, { mailboxes: mailboxes })), _jsxs("div", { className: "flex gap-3 items-center mt-4", children: [_jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: page === 0 || loading, onClick: () => setPage((p) => Math.max(0, p - 1)), children: "Previous" }), _jsxs("span", { className: "text-sm text-text-muted", children: ["Page ", page + 1] }), _jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: !hasNextPage || loading, onClick: () => setPage((p) => p + 1), children: "Next" })] })] }));
+    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "flex items-center justify-between mb-5", children: [_jsx("h1", { className: "text-xl font-bold uppercase tracking-wide", children: "Mailboxes" }), _jsxs("div", { className: "flex gap-2", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: reopening, onClick: () => setConfirmingSetup(true), children: "Run setup again" }), _jsx("a", { href: "/admin/mailboxes/new", children: _jsx(Button, { type: "button", className: "!w-auto", children: "+ New mailbox" }) })] })] }), _jsx("p", { className: "text-sm text-text-muted mb-4", children: "Administrative details only (addresses, owners, quota). The console never shows a mailbox\u2019s mail: to see someone\u2019s account, impersonate them from their mailbox page." }), error && _jsx(Alert, { children: error }), _jsxs(Modal, { open: confirmingSetup, onClose: () => setConfirmingSetup(false), title: "Run setup again?", children: [_jsx("p", { className: "text-sm mb-4", children: "Setup starts again from its first step, and the admin console sends administrators to it until it's finished. Your existing settings, domains and mailboxes are kept." }), _jsxs("div", { className: "flex gap-2 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setConfirmingSetup(false), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto", loading: reopening, disabled: reopening, onClick: () => void handleRunSetup(), children: "Run setup" })] })] }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : (_jsx(MailboxTable, { mailboxes: mailboxes })), _jsxs("div", { className: "flex gap-3 items-center mt-4", children: [_jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: page === 0 || loading, onClick: () => setPage((p) => Math.max(0, p - 1)), children: "Previous" }), _jsxs("span", { className: "text-sm text-text-muted", children: ["Page ", page + 1] }), _jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: !hasNextPage || loading, onClick: () => setPage((p) => p + 1), children: "Next" })] })] }));
 }

package/dist/apps/admin/ingest-queue/index.js

@@ -41,7 +41,8 @@ function IngestQueueContent() {
         let cancelled = false;
         setLoading(true);
         setError(null);
-        listIngestQueue(mailboxUid, { page, limit: PAGE_SIZE })
+        // The administration scope: any mailbox's pending mail, recorded in the audit log.
+        listIngestQueue(mailboxUid, { page, limit: PAGE_SIZE, scope: "admin" })
             .then((data) => {
             if (!cancelled)
                 setEntries(data);

package/dist/apps/admin/mailboxes/[uid].js

@@ -23,9 +23,9 @@ function formatBytes(bytes) {
     return `${bytes} B`;
 }
 export default function MailboxDetailPage(props) {
-    return (_jsx(AdminShell, { ...props, active: "mailboxes", children: _jsx(MailboxDetailContent, { uid: props.params.uid, impersonationBaseUrl: props.impersonationBaseUrl }) }));
+    return (_jsx(AdminShell, { ...props, active: "mailboxes", children: _jsx(MailboxDetailContent, { uid: props.params.uid, impersonationBaseUrl: props.impersonationBaseUrl, currentUserUid: props.userUid }) }));
 }
-function MailboxDetailContent({ uid, impersonationBaseUrl }) {
+function MailboxDetailContent({ uid, impersonationBaseUrl, currentUserUid, }) {
     const [mailbox, setMailbox] = useState(null);
     const [loading, setLoading] = useState(true);
     const [error, setError] = useState(null);
@@ -43,7 +43,7 @@ function MailboxDetailContent({ uid, impersonationBaseUrl }) {
         setConfirmingAccess(false);
         setAccessError(null);
     }
-    // Only ever invoked from the access-confirmation modal below, which only renders for a loaded mailbox that has
+    // Only ever invoked from the impersonation-confirmation modal below, which only renders for a loaded mailbox that has
     // an owner. A failure stays in the modal rather than replacing the whole page.
     async function handleAccessMailbox() {
         setImpersonating(true);
@@ -53,7 +53,7 @@ function MailboxDetailContent({ uid, impersonationBaseUrl }) {
             window.location.href = "/";
         }
         catch (err) {
-            setAccessError(err instanceof ApiRequestError ? err.message : "Could not access this mailbox.");
+            setAccessError(err instanceof ApiRequestError ? err.message : "Could not impersonate this user.");
             setImpersonating(false);
         }
     }
@@ -82,7 +82,8 @@ function MailboxDetailContent({ uid, impersonationBaseUrl }) {
     useEffect(() => {
         setLoading(true);
         setError(null);
-        getMailbox(uid)
+        // The administration scope: administrative metadata only - the console never shows a mailbox's mail or settings.
+        getMailbox(uid, { scope: "admin" })
             .then(setMailbox)
             .catch((err) => setError(err instanceof ApiRequestError ? err.message : "Could not load this mailbox."))
             .finally(() => setLoading(false));
@@ -95,5 +96,7 @@ function MailboxDetailContent({ uid, impersonationBaseUrl }) {
     }
     const quarantineHref = `/admin/quarantine?mailboxUid=${encodeURIComponent(mailbox.uid)}`;
     const ingestQueueHref = `/admin/ingest-queue?mailboxUid=${encodeURIComponent(mailbox.uid)}`;
-    return (_jsxs("div", { className: "max-w-3xl flex flex-col gap-5", children: [_jsxs("div", { className: "flex items-start justify-between gap-4", children: [_jsxs("div", { children: [_jsx("a", { href: "/admin", className: "text-sm text-primary-dark hover:underline", children: "\u2190 All mailboxes" }), _jsx("h1", { className: "text-xl font-bold tracking-tight mt-1", children: mailbox.primarySmtpAddress })] }), _jsxs("div", { className: "flex gap-3 shrink-0", children: [mailbox.ownerUserUid && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setConfirmingAccess(true), children: "Access this mailbox" })), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto !border-danger !text-danger hover:!border-danger hover:!text-danger", onClick: () => setConfirmingDelete(true), children: "Delete mailbox" })] })] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsxs("dl", { className: "grid grid-cols-1 sm:grid-cols-2 gap-x-6 gap-y-3 text-sm", children: [_jsx("dt", { className: "text-text-muted", children: "Display name" }), _jsx("dd", { children: mailbox.displayName }), _jsx("dt", { className: "text-text-muted", children: "Owner" }), _jsx("dd", { children: mailbox.ownerUserUid ?? "None (shared mailbox)" }), _jsx("dt", { className: "text-text-muted", children: "Timezone" }), _jsx("dd", { children: mailbox.timezone }), _jsx("dt", { className: "text-text-muted", children: "Quota" }), _jsxs("dd", { children: [formatBytes(mailbox.usedBytes), " / ", formatBytes(mailbox.quotaBytes)] }), _jsx("dt", { className: "text-text-muted", children: "Alias addresses" }), _jsx("dd", { children: mailbox.aliasAddresses.length > 0 ? mailbox.aliasAddresses.join(", ") : "None" }), mailbox.isResource && (_jsxs(_Fragment, { children: [_jsx("dt", { className: "text-text-muted", children: "Resource type" }), _jsx("dd", { className: "capitalize", children: mailbox.resourceType ?? "room" })] })), _jsx("dt", { className: "text-text-muted", children: "Created" }), _jsx("dd", { children: new Date(mailbox.dateCreated).toLocaleString() })] }), _jsxs("div", { className: "flex gap-4 mt-5 pt-5 border-t border-border text-sm font-medium", children: [_jsx("a", { href: quarantineHref, className: "text-primary-dark hover:underline", children: "View quarantine" }), _jsx("a", { href: ingestQueueHref, className: "text-primary-dark hover:underline", children: "View ingest queue" })] })] }), _jsx(ShareAccessCard, { mailboxUid: mailbox.uid, ownerUserUid: mailbox.ownerUserUid }), _jsx(EscrowScopeCard, { mailbox: mailbox, onUpdate: setMailbox }), mailbox.isResource && _jsx(ResourceSettingsCard, { mailbox: mailbox, onUpdate: setMailbox }), _jsxs(Modal, { open: confirmingAccess, onClose: closeAccessModal, title: "Access this mailbox", children: [_jsxs("p", { className: "text-sm mb-3", children: ["You\u2019ll be signed in as ", _jsx("strong", { className: "break-all", children: mailbox.ownerUserUid }), ", the owner of ", _jsx("strong", { className: "break-all", children: mailbox.primarySmtpAddress }), ", and see everything they can - and act as them, until you stop impersonating."] }), accessError && _jsx(Alert, { children: accessError }), _jsxs("div", { className: "flex gap-3 justify-end mt-5", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: impersonating, onClick: closeAccessModal, children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto", loading: impersonating, disabled: impersonating, onClick: handleAccessMailbox, children: "Access mailbox" })] })] }), _jsxs(Modal, { open: confirmingDelete, onClose: closeDeleteModal, title: "Delete mailbox", children: [_jsxs("p", { className: "text-sm mb-5", children: ["Are you sure you want to delete ", _jsx("strong", { children: mailbox.primarySmtpAddress }), "? This permanently deletes the mailbox and everything in it, and cannot be undone. It fails if this mailbox is a custodian on an active legal hold."] }), deleteError && _jsx(Alert, { children: deleteError }), _jsxs("div", { className: "flex gap-3 justify-end mt-5", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: deleting, onClick: closeDeleteModal, children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", loading: deleting, disabled: deleting, onClick: handleDelete, children: "Delete" })] })] })] }));
+    return (_jsxs("div", { className: "max-w-3xl flex flex-col gap-5", children: [_jsxs("div", { className: "flex items-start justify-between gap-4", children: [_jsxs("div", { children: [_jsx("a", { href: "/admin", className: "text-sm text-primary-dark hover:underline", children: "\u2190 All mailboxes" }), _jsx("h1", { className: "text-xl font-bold tracking-tight mt-1", children: mailbox.primarySmtpAddress })] }), _jsxs("div", { className: "flex gap-3 shrink-0", children: [mailbox.ownerUserUid && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setConfirmingAccess(true), children: "Impersonate this user" })), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto !border-danger !text-danger hover:!border-danger hover:!text-danger", onClick: () => setConfirmingDelete(true), children: "Delete mailbox" })] })] }), _jsxs("p", { className: "text-sm text-text-muted", children: ["The console shows administrative details only - never a mailbox\u2019s mail or settings.", mailbox.ownerUserUid
+                        ? " To see this mailbox as its owner sees it, impersonate them: that is recorded, and you can stop at any time."
+                        : " This shared mailbox has no owner: add yourself under Shared access to open it in the mail client."] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsxs("dl", { className: "grid grid-cols-1 sm:grid-cols-2 gap-x-6 gap-y-3 text-sm", children: [_jsx("dt", { className: "text-text-muted", children: "Display name" }), _jsx("dd", { children: mailbox.displayName }), _jsx("dt", { className: "text-text-muted", children: "Owner" }), _jsx("dd", { children: mailbox.ownerUserUid ?? "None (shared mailbox)" }), _jsx("dt", { className: "text-text-muted", children: "Timezone" }), _jsx("dd", { children: mailbox.timezone }), _jsx("dt", { className: "text-text-muted", children: "Quota" }), _jsxs("dd", { children: [formatBytes(mailbox.usedBytes), " / ", formatBytes(mailbox.quotaBytes)] }), _jsx("dt", { className: "text-text-muted", children: "Alias addresses" }), _jsx("dd", { children: mailbox.aliasAddresses.length > 0 ? mailbox.aliasAddresses.join(", ") : "None" }), mailbox.isResource && (_jsxs(_Fragment, { children: [_jsx("dt", { className: "text-text-muted", children: "Resource type" }), _jsx("dd", { className: "capitalize", children: mailbox.resourceType ?? "room" })] })), _jsx("dt", { className: "text-text-muted", children: "Created" }), _jsx("dd", { children: new Date(mailbox.dateCreated).toLocaleString() })] }), _jsxs("div", { className: "flex gap-4 mt-5 pt-5 border-t border-border text-sm font-medium", children: [_jsx("a", { href: quarantineHref, className: "text-primary-dark hover:underline", children: "View quarantine" }), _jsx("a", { href: ingestQueueHref, className: "text-primary-dark hover:underline", children: "View ingest queue" })] })] }), _jsx(ShareAccessCard, { mailboxUid: mailbox.uid, ownerUserUid: mailbox.ownerUserUid, currentUserUid: currentUserUid }), _jsx(EscrowScopeCard, { mailbox: mailbox, onUpdate: setMailbox }), mailbox.isResource && _jsx(ResourceSettingsCard, { mailbox: mailbox, onUpdate: setMailbox }), _jsxs(Modal, { open: confirmingAccess, onClose: closeAccessModal, title: "Impersonate this user", children: [_jsxs("p", { className: "text-sm mb-3", children: ["You\u2019ll be signed in as ", _jsx("strong", { className: "break-all", children: mailbox.ownerUserUid }), ", the owner of ", _jsx("strong", { className: "break-all", children: mailbox.primarySmtpAddress }), ", and see everything they can - and act as them, until you stop impersonating. This is the only way an administrator sees another user\u2019s mail."] }), accessError && _jsx(Alert, { children: accessError }), _jsxs("div", { className: "flex gap-3 justify-end mt-5", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: impersonating, onClick: closeAccessModal, children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto", loading: impersonating, disabled: impersonating, onClick: handleAccessMailbox, children: "Impersonate" })] })] }), _jsxs(Modal, { open: confirmingDelete, onClose: closeDeleteModal, title: "Delete mailbox", children: [_jsxs("p", { className: "text-sm mb-5", children: ["Are you sure you want to delete ", _jsx("strong", { children: mailbox.primarySmtpAddress }), "? This permanently deletes the mailbox and everything in it, and cannot be undone. It fails if this mailbox is a custodian on an active legal hold."] }), deleteError && _jsx(Alert, { children: deleteError }), _jsxs("div", { className: "flex gap-3 justify-end mt-5", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: deleting, onClick: closeDeleteModal, children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", loading: deleting, disabled: deleting, onClick: handleDelete, children: "Delete" })] })] })] }));
 }

package/dist/apps/admin/quarantine/index.js

@@ -34,7 +34,8 @@ function QuarantineContent({ userUid }) {
     function reload(uid) {
         setLoading(true);
         setError(null);
-        listQuarantine(uid, { page, limit: PAGE_SIZE })
+        // The administration scope: any mailbox's held mail, recorded in the audit log.
+        listQuarantine(uid, { page, limit: PAGE_SIZE, scope: "admin" })
             .then(setEntries)
             .catch((err) => setError(err instanceof ApiRequestError ? err.message : "Could not load quarantine."))
             .finally(() => setLoading(false));

package/dist/apps/admin/signing-certificates/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../../shared/components/admin/layout/AdminShell.js";
+export default function SigningCertificatesPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;