@rapidmx/web-client 0.14.1 → 0.16.0

package/apps/shared/appearance/AppearanceForm.tsx

@@ -75,7 +75,15 @@ export default function AppearanceForm() {
 
     // The kind the radio shows: chosen before it can take effect ("Image" is chosen before there is one).
     const [kind, setKind] = useState<BackgroundKind>(background?.kind ?? "none");
-    useEffect(() => setKind(background?.kind ?? "none"), [background?.kind]);
+    // Follows a change of the stored kind (the server's answer, another tab, a reset) - not the first render, which `useState()` above
+    // already started from: that effect can run after a choice made right after the page appeared, and would put the old kind back.
+    const shownKind = useRef(background?.kind);
+    useEffect(() => {
+        if (shownKind.current !== background?.kind) {
+            shownKind.current = background?.kind;
+            setKind(background?.kind ?? "none");
+        }
+    }, [background?.kind]);
     const [fileError, setFileError] = useState<string | null>(null);
     const [dragging, setDragging] = useState(false);
     const [uploading, setUploading] = useState<string | null>(null);

package/apps/shared/auth/adminAccess.ts

@@ -1,99 +1,99 @@
-///////////////////////////////////////////////////////////////////////////////
-// Copyright (C) 2026 Jean-Philippe Steinmetz
-// SPDX-License-Identifier: MPL-2.0
-///////////////////////////////////////////////////////////////////////////////
-import { authApiFetch } from "@rapidmx/react-shared/util/api.js";
-
-/**
- * Whether the signed-in user holds an administrator role, learned without elevating.
- *
- * The JWT the browser carries can't say: auth-server strips every trusted role from a token that isn't elevated
- * (`TokenUtils.resolveTokenUser()`), so `trusted` (from the JWT) is false for a real administrator until they confirm
- * their identity on auth-server's elevation page. The role itself lives on the caller's own `User` record, which they may
- * always read - `GET {authServerUrl}/api/users/me` (the same call auth-server's own UI makes "to check for admin access") -
- * so the answer is read from there, with the same cross-origin credentials the profile lookups use.
- *
- * This only decides whether a menu item is shown. The `/admin` pages and API stay authoritative: they check the role and
- * the elevation themselves, and the link only navigates (`/admin` then runs the elevation redirect), so a wrong answer
- * - a stale cache, a tampered `sessionStorage` - can show a link that leads to "no administrator access", never more.
- */
-
-/** The roles the server treats as trusted when it isn't configured otherwise (`trusted_roles`, default `["admin"]`). */
-export const DEFAULT_TRUSTED_ROLES: readonly string[] = ["admin"];
-
-/** `sessionStorage` key prefix of a remembered answer; the user's uid follows, so another account signing in in the same
- * tab never inherits it. */
-export const ADMIN_ACCESS_KEY_PREFIX = "rapidmx-admin-access:";
-
-/** How long a remembered answer is trusted - long enough that navigating between the apps costs no request, short enough
- * that a role granted or removed shows up within the sitting. */
-export const ADMIN_ACCESS_TTL_MS = 30 * 60 * 1000;
-
-/** Lookups in flight, by key, so two components asking at once make one request. */
-const lookups = new Map<string, Promise<boolean | undefined>>();
-
-/** Forgets the lookups in flight (tests). */
-export function resetAdminAccessLookups(): void {
-    lookups.clear();
-}
-
-function readRemembered(key: string, now: number): boolean | undefined {
-    try {
-        const stored = JSON.parse(sessionStorage.getItem(key) ?? "null") as { admin?: unknown; at?: unknown } | null;
-        if (typeof stored?.admin === "boolean" && typeof stored.at === "number" && now - stored.at >= 0 && now - stored.at < ADMIN_ACCESS_TTL_MS) {
-            return stored.admin;
-        }
-    } catch {
-        // Unreadable, or storage unavailable - ask again.
-    }
-    return undefined;
-}
-
-function remember(key: string, admin: boolean, now: number): void {
-    try {
-        sessionStorage.setItem(key, JSON.stringify({ admin, at: now }));
-    } catch {
-        // Storage unavailable - the next page load asks again.
-    }
-}
-
-/**
- * Resolves `true` when `userUid`'s own `User` record on auth-server carries one of `trustedRoles`, `false` when it
- * doesn't, and `undefined` when that couldn't be established (unreachable, blocked by CORS, not signed in, an unexpected
- * body, or a record that isn't this user's). Only a real answer is remembered; a failure is asked again on the next page.
- * Never rejects.
- */
-export function lookUpAdminAccess(
-    authServerUrl: string,
-    userUid: string,
-    trustedRoles: readonly string[] = DEFAULT_TRUSTED_ROLES,
-    now: number = Date.now(),
-): Promise<boolean | undefined> {
-    const key = `${ADMIN_ACCESS_KEY_PREFIX}${userUid}`;
-    const remembered = readRemembered(key, now);
-    if (remembered !== undefined) {
-        return Promise.resolve(remembered);
-    }
-    const inFlight = lookups.get(key);
-    if (inFlight) {
-        return inFlight;
-    }
-    const lookup = (async (): Promise<boolean | undefined> => {
-        try {
-            const user = await authApiFetch<{ uid?: unknown; roles?: unknown } | null>(authServerUrl, "/users/me");
-            if (!user || user.uid !== userUid || !Array.isArray(user.roles)) {
-                return undefined;
-            }
-            const admin = user.roles.some((role) => typeof role === "string" && trustedRoles.includes(role));
-            remember(key, admin, now);
-            return admin;
-        } catch {
-            return undefined;
-        } finally {
-            // Answered: what was learned is in storage; a failure may be asked again.
-            lookups.delete(key);
-        }
-    })();
-    lookups.set(key, lookup);
-    return lookup;
-}
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { authApiFetch } from "@rapidmx/react-shared/util/api.js";
+
+/**
+ * Whether the signed-in user holds an administrator role, learned without elevating.
+ *
+ * The JWT the browser carries can't say: auth-server strips every trusted role from a token that isn't elevated
+ * (`TokenUtils.resolveTokenUser()`), so `trusted` (from the JWT) is false for a real administrator until they confirm
+ * their identity on auth-server's elevation page. The role itself lives on the caller's own `User` record, which they may
+ * always read - `GET {authServerUrl}/api/users/me` (the same call auth-server's own UI makes "to check for admin access") -
+ * so the answer is read from there, with the same cross-origin credentials the profile lookups use.
+ *
+ * This only decides whether a menu item is shown. The `/admin` pages and API stay authoritative: they check the role and
+ * the elevation themselves, and the link only navigates (`/admin` then runs the elevation redirect), so a wrong answer
+ * - a stale cache, a tampered `sessionStorage` - can show a link that leads to "no administrator access", never more.
+ */
+
+/** The roles the server treats as trusted when it isn't configured otherwise (`trusted_roles`, default `["admin"]`). */
+export const DEFAULT_TRUSTED_ROLES: readonly string[] = ["admin"];
+
+/** `sessionStorage` key prefix of a remembered answer; the user's uid follows, so another account signing in in the same
+ * tab never inherits it. */
+export const ADMIN_ACCESS_KEY_PREFIX = "rapidmx-admin-access:";
+
+/** How long a remembered answer is trusted - long enough that navigating between the apps costs no request, short enough
+ * that a role granted or removed shows up within the sitting. */
+export const ADMIN_ACCESS_TTL_MS = 30 * 60 * 1000;
+
+/** Lookups in flight, by key, so two components asking at once make one request. */
+const lookups = new Map<string, Promise<boolean | undefined>>();
+
+/** Forgets the lookups in flight (tests). */
+export function resetAdminAccessLookups(): void {
+    lookups.clear();
+}
+
+function readRemembered(key: string, now: number): boolean | undefined {
+    try {
+        const stored = JSON.parse(sessionStorage.getItem(key) ?? "null") as { admin?: unknown; at?: unknown } | null;
+        if (typeof stored?.admin === "boolean" && typeof stored.at === "number" && now - stored.at >= 0 && now - stored.at < ADMIN_ACCESS_TTL_MS) {
+            return stored.admin;
+        }
+    } catch {
+        // Unreadable, or storage unavailable - ask again.
+    }
+    return undefined;
+}
+
+function remember(key: string, admin: boolean, now: number): void {
+    try {
+        sessionStorage.setItem(key, JSON.stringify({ admin, at: now }));
+    } catch {
+        // Storage unavailable - the next page load asks again.
+    }
+}
+
+/**
+ * Resolves `true` when `userUid`'s own `User` record on auth-server carries one of `trustedRoles`, `false` when it
+ * doesn't, and `undefined` when that couldn't be established (unreachable, blocked by CORS, not signed in, an unexpected
+ * body, or a record that isn't this user's). Only a real answer is remembered; a failure is asked again on the next page.
+ * Never rejects.
+ */
+export function lookUpAdminAccess(
+    authServerUrl: string,
+    userUid: string,
+    trustedRoles: readonly string[] = DEFAULT_TRUSTED_ROLES,
+    now: number = Date.now(),
+): Promise<boolean | undefined> {
+    const key = `${ADMIN_ACCESS_KEY_PREFIX}${userUid}`;
+    const remembered = readRemembered(key, now);
+    if (remembered !== undefined) {
+        return Promise.resolve(remembered);
+    }
+    const inFlight = lookups.get(key);
+    if (inFlight) {
+        return inFlight;
+    }
+    const lookup = (async (): Promise<boolean | undefined> => {
+        try {
+            const user = await authApiFetch<{ uid?: unknown; roles?: unknown } | null>(authServerUrl, "/users/me");
+            if (!user || user.uid !== userUid || !Array.isArray(user.roles)) {
+                return undefined;
+            }
+            const admin = user.roles.some((role) => typeof role === "string" && trustedRoles.includes(role));
+            remember(key, admin, now);
+            return admin;
+        } catch {
+            return undefined;
+        } finally {
+            // Answered: what was learned is in storage; a failure may be asked again.
+            lookups.delete(key);
+        }
+    })();
+    lookups.set(key, lookup);
+    return lookup;
+}

package/apps/shared/calendar/bookingPlugin.ts

@@ -0,0 +1,100 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * The calendar's side of `@rapidmx/booking-plugin`: whether the plugin is running, and the one call the quick-create popover's
+ * "Appointment schedule" tab makes on it - creating a booking type (`POST /api/mail/booking-types`).
+ *
+ * The plugin ships its own typed client, but inside its own UI (`apps/shared/bookingApi.ts` of the plugin), which this package cannot import,
+ * so the few fields this popover writes are mirrored here. The plugin's `BaseBookingTypeRoute` is the authority: it normalizes the slug,
+ * assigns the uids, refuses a taken slug with a 409 and validates the availability, durations and calendar folder.
+ */
+import { apiFetch } from "@rapidmx/react-shared/util/api.js";
+import { PluginNav, isSafePluginHref } from "../plugins/pluginNav.js";
+
+/** The id of the Settings section the booking plugin's manifest contributes (`ui.settingsSections`) - what tells the client it is running. */
+export const BOOKING_SETTINGS_SECTION_ID = "booking-types";
+
+/**
+ * Where the booking plugin's Settings pages are mounted (`/settings/booking-types`), or `undefined` when the plugin is not running.
+ *
+ * A server only puts a plugin's navigation into `pluginNav` while the plugin is enabled and its pages built, so its section being there is the
+ * client's one way of knowing (the plugin list itself is admin-only).
+ */
+export function bookingSettingsHref(pluginNav: PluginNav | undefined): string | undefined {
+    const section = pluginNav?.settingsSections?.find((item) => item.id === BOOKING_SETTINGS_SECTION_ID);
+    return section && isSafePluginHref(section.href) ? section.href.replace(/\/+$/, "") : undefined;
+}
+
+/** The plugin's "new booking link" page for `mailboxUid` - the full form behind the popover's More options. */
+export function newBookingLinkHref(settingsHref: string, mailboxUid: string): string {
+    return `${settingsHref}/new?mailboxUid=${encodeURIComponent(mailboxUid)}`;
+}
+
+export interface BookingAvailabilityWindow {
+    /** 0 (Sunday) to 6 (Saturday). */
+    dayOfWeek: number;
+    startMinute: number;
+    endMinute: number;
+}
+
+export type BookingLocationType = "phone" | "video" | "other";
+
+export interface BookingMeetingType {
+    name: string;
+    durationMinutes: number;
+    locationOptions: { type: BookingLocationType }[];
+}
+
+export interface CreateBookingTypeInput {
+    mailboxUid: string;
+    calendarFolderUid: string;
+    slug: string;
+    name: string;
+    hostDisplayName: string;
+    meetingTypes: BookingMeetingType[];
+    timezone: string;
+    availability: BookingAvailabilityWindow[];
+    bufferAfterMinutes: number;
+}
+
+/** What comes back from a create: the fields the popover needs to show the link. */
+export interface CreatedBookingType {
+    uid: string;
+    mailboxUid: string;
+    slug: string;
+    name: string;
+}
+
+/** Creates a booking type with the plugin's own defaults for everything the popover leaves out (an hour's notice, 30 days ahead, no approval). */
+export function createBookingType(input: CreateBookingTypeInput): Promise<CreatedBookingType> {
+    return apiFetch("/mail/booking-types", {
+        method: "POST",
+        body: JSON.stringify({
+            dateOverrides: [],
+            bufferBeforeMinutes: 0,
+            minimumNoticeMinutes: 60,
+            bookingWindowDays: 30,
+            requiresApproval: false,
+            enabled: true,
+            ...input,
+        }),
+    });
+}
+
+/** A URL-safe slug for a schedule's name, the way the plugin's own `normalizeSlug()` reads it; `"appointments"` when nothing usable is left. */
+export function slugFor(name: string): string {
+    return (
+        name
+            .trim()
+            .toLowerCase()
+            .replace(/[^a-z0-9]+/g, "-")
+            .replace(/^-+|-+$/g, "") || "appointments"
+    );
+}
+
+/** The public page of a booking type on this site's own origin (`/book/<mailbox>/<slug>`, the `@` of a mailbox uid left as it is). Browser only. */
+export function bookingPublicUrl(mailboxUid: string, slug: string): string {
+    return `${window.location.origin}/book/${encodeURIComponent(mailboxUid).replace(/%40/g, "@")}/${encodeURIComponent(slug)}`;
+}

package/apps/shared/calendar/calendarLiveUpdates.ts

@@ -0,0 +1,27 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/** Pure helper behind the calendar page's live updates: which push events say "an event changed, and the payload is only a busy block". */
+
+import type { PushEvent } from "@rapidmx/react-shared/mail/pushClient.js";
+
+/** The published model name of a calendar event on either database (`CalendarEventMongo`, `CalendarEventSQL`) - and not the reminder's `"CalendarEvent"`,
+ * which has its own action. */
+const EVENT_MODEL = /^CalendarEvent(Mongo|SQL)$/;
+
+/**
+ * The uid of the event a push event announces as a redacted busy block, or `undefined` for anything else the shared push connection delivers.
+ *
+ * When somebody creates or changes a private or confidential event, restapi publishes it on the calendar's channel once, for every subscriber - and that one
+ * payload has to be safe for a read-only reader of a shared calendar, so it is the busy block (`redacted: true`, title "Busy", no details). It must not be
+ * stored as the event by the calendar's owner (or anybody else who may see it in full): they fetch the event again by its uid, which answers with as
+ * much as they may see.
+ */
+export function redactedEventUidOf(event: PushEvent): string | undefined {
+    if (!EVENT_MODEL.test(event.type) || (event.action !== "create" && event.action !== "update")) {
+        return undefined;
+    }
+    const data = event.data as { uid?: unknown; redacted?: unknown } | null | undefined;
+    return data?.redacted === true && typeof data.uid === "string" ? data.uid : undefined;
+}