@rapidmx/web-client 0.15.1 → 0.17.0

package/apps/shared/mail/outbox/sendOutcomes.ts

@@ -9,6 +9,7 @@ import { loadOriginalMessage } from "../../components/mail/compose/quotedBody.js
 import { notifyApiError } from "../../notifications/apiErrors.js";
 import { dismiss, notify } from "../../notifications/store.js";
 import { beginPendingSend, finishPendingSend, setPendingStage } from "./pendingSends.js";
+import { failOutgoing, forgetOutgoing, markOutgoingSending, markOutgoingSent } from "./outgoingReplies.js";
 import { openComposeFromOutside } from "./composeBridge.js";
 import { describeMessage, forgetRetainedRequest, notifySent, openDraftFromRequest, retainedRequest } from "./sendJob.js";
 
@@ -45,6 +46,8 @@ function escapeHtml(text: string): string {
 async function openFailedDraft(event: SendEvent): Promise<void> {
     try {
         const moved = await moveBackToDrafts(event.uid, event.mailboxUid ?? "");
+        // Back in Drafts it is no longer a message on its way in its conversation.
+        forgetOutgoing(event.uid);
         const request = retainedRequest(event.uid);
         if (request) {
             openDraftFromRequest({ ...request, draft: moved });
@@ -90,6 +93,7 @@ async function retryFailed(event: SendEvent): Promise<void> {
         return;
     }
     dismiss(failedId(event.uid));
+    markOutgoingSending(event.uid);
     try {
         setPendingStage(event.uid, "queuing");
         const result = await queueMessageSend(event.uid);
@@ -108,6 +112,8 @@ export function handleSendEvent(event: SendEvent): void {
     if (event.action === "send-succeeded") {
         dismiss(retryId(event.uid));
         dismiss(failedId(event.uid));
+        // The conversation on screen swaps the message it drew for the Sent Items copy (a message this tab did not send has nothing drawn).
+        markOutgoingSent(event.uid);
         // The server reports every message it relays, scheduled ones from long ago included: only a message this tab queued in the background is
         // worth a confirmation (several are one pop-up counting up). Anything else - a send-later message going out, another tab's send - is quiet.
         if (retainedRequest(event.uid)) {
@@ -132,15 +138,18 @@ export function handleSendEvent(event: SendEvent): void {
         return;
     }
     dismiss(retryId(event.uid));
+    const actions = [
+        { label: "Retry", onClick: () => void retryFailed(event) },
+        { label: "Open draft", onClick: () => void openFailedDraft(event) },
+    ];
     notify({
         id: failedId(event.uid),
         kind: "error",
         title: "This message wasn't sent",
         message: `${what}: ${failure.message}`,
         details: failure.lines,
-        actions: [
-            { label: "Retry", onClick: () => void retryFailed(event) },
-            { label: "Open draft", onClick: () => void openFailedDraft(event) },
-        ],
+        actions,
     });
+    // The conversation on screen shows the same failure under the message, with the same ways out.
+    failOutgoing(event.uid, failure.message, actions);
 }

package/apps/shared/mail/permanentDelete.ts

@@ -0,0 +1,160 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { Message, emptyFolder, listMessages, purgeMessage } from "@rapidmx/react-shared/mail/mailApi.js";
+import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
+import { displaySubject } from "../components/mail/reading/EncryptedPreview.js";
+import { notifySessionExpired } from "../notifications/apiErrors.js";
+import { notify } from "../notifications/store.js";
+import { LIST_PAGE_SIZE, MAX_LIST_PAGES, listAllPages } from "./listAllPages.js";
+
+/**
+ * Permanent delete: what "Delete" does to a message that is already in Deleted Items (and what "Empty folder" does to Deleted Items and
+ * Junk Email). Unlike a move into Deleted Items it cannot be undone, so it is never reached without a confirmation (see
+ * `usePermanentDelete()`, which asks it, runs what is in here and tells the folder badges and the reader).
+ *
+ * Server side it is `DELETE /mail/messages/:uid?purge=true` (a hard delete - the row and its search document are gone, not a
+ * recoverable soft delete) per message, and `DELETE /mail/messages?folderUid=` (`truncate`) for a whole folder. Both refuse a message under
+ * an active legal hold with a `409`; the per-message form refuses one message at a time, so a selection is deleted as far as it can be and
+ * each refusal is reported (`PurgeFailure`), rather than the first stopping the rest.
+ */
+
+/** How many purge requests are on the wire at once: a few at a time is quick, and the server publishes each folder's counts as they land. */
+export const PURGE_CONCURRENCY = 4;
+
+/** The folder types "Empty folder" is offered for: Outlook's Deleted Items and Junk Email. */
+export const EMPTIABLE_FOLDER_TYPES: readonly string[] = ["deleted_items", "junk"];
+
+/** A message the server refused to delete, and what it said. */
+export interface PurgeFailure {
+    message: Message;
+    /** The server's own words (a legal hold names itself), or a stand-in when it did not answer. */
+    reason: string;
+    /** The response's status - `undefined` when there was no response. */
+    status?: number;
+}
+
+/** What deleting several messages came to: those that are gone, and those that are not (with why). Together they are all that was asked for. */
+export interface PurgeOutcome {
+    deleted: Message[];
+    failed: PurgeFailure[];
+}
+
+/** What emptying a folder came to. */
+export interface EmptyFolderOutcome extends PurgeOutcome {
+    /** Nothing is left in the folder as far as this knows: the whole-folder request went through, or every message listed was deleted. */
+    emptied: boolean;
+}
+
+function describeFailure(err: unknown): { reason: string; status?: number } {
+    if (err instanceof ApiRequestError) {
+        return { reason: err.message || `The server answered ${err.status}.`, status: err.status };
+    }
+    return { reason: "The server couldn't be reached." };
+}
+
+/** `1 message`, `3 messages`. */
+export function messageCount(count: number): string {
+    return `${count} message${count === 1 ? "" : "s"}`;
+}
+
+/**
+ * Permanently deletes `messages`, each in its own request, a few at a time. Never rejects: a refusal (a legal hold, a share without the right
+ * to delete, a message that is already gone) is recorded against its message and the rest carry on. `deleted` and `failed` keep the order of
+ * `messages`.
+ */
+export async function purgeMessages(messages: Message[]): Promise<PurgeOutcome> {
+    const failures: (PurgeFailure | null)[] = new Array(messages.length).fill(null);
+    let next = 0;
+    async function worker(): Promise<void> {
+        while (next < messages.length) {
+            const index = next++;
+            try {
+                await purgeMessage(messages[index].uid);
+            } catch (err) {
+                failures[index] = { message: messages[index], ...describeFailure(err) };
+            }
+        }
+    }
+    await Promise.all(Array.from({ length: Math.min(PURGE_CONCURRENCY, messages.length) }, worker));
+    return {
+        deleted: messages.filter((_, index) => failures[index] === null),
+        failed: failures.filter((failure): failure is PurgeFailure => failure !== null),
+    };
+}
+
+/**
+ * Permanently deletes everything in `folderUid`: one request for the whole folder, which is all or nothing. The server refuses it as a whole
+ * when a message in it is under a legal hold (`409`) or when the caller may delete messages but not empty a folder (`403`, a delegate) - and
+ * then this lists the folder and deletes message by message instead, so what may go does and each refusal is reported. Any other failure
+ * (the server is down) rejects, and the caller says so.
+ */
+export async function purgeFolder(
+    folderUid: string,
+    paging: { pageSize: number; maxPages: number } = { pageSize: LIST_PAGE_SIZE, maxPages: MAX_LIST_PAGES },
+): Promise<EmptyFolderOutcome> {
+    try {
+        await emptyFolder(folderUid);
+        return { emptied: true, deleted: [], failed: [] };
+    } catch (err) {
+        if (!(err instanceof ApiRequestError) || (err.status !== 403 && err.status !== 409)) {
+            throw err;
+        }
+    }
+    const listed = await listAllPages((page) => listMessages(folderUid, { limit: paging.pageSize, page }), paging.pageSize, paging.maxPages);
+    const outcome = await purgeMessages(listed.items);
+    return { ...outcome, emptied: outcome.failed.length === 0 && !listed.truncated };
+}
+
+/** The line for one refusal, in the notification's details. */
+function failureLine(failure: PurgeFailure): string {
+    return `${displaySubject(failure.message.subject) || "(no subject)"}: ${failure.reason}`;
+}
+
+/**
+ * Tells the reader what a delete of several messages came to: "3 messages permanently deleted" (no Undo - there is none), or "2 deleted, 1
+ * could not be deleted" with the server's reasons.
+ */
+export function notifyPurged(outcome: PurgeOutcome): void {
+    const { deleted, failed } = outcome;
+    if (failed.length === 0) {
+        notify({ kind: "success", title: `${messageCount(deleted.length)} permanently deleted` });
+        return;
+    }
+    if (failed.some((failure) => failure.status === 401)) {
+        notifySessionExpired();
+        return;
+    }
+    const reasons = [...new Set(failed.map((failure) => failure.reason))];
+    notify({
+        kind: deleted.length > 0 ? "warning" : "error",
+        title:
+            deleted.length > 0
+                ? `${deleted.length} deleted, ${failed.length} could not be deleted`
+                : `Couldn't permanently delete ${failed.length === 1 ? "that message" : "those messages"}`,
+        message: reasons.slice(0, 3).join(" ") + (reasons.length > 3 ? ` (and ${reasons.length - 3} more reasons)` : ""),
+        details: failed.map(failureLine),
+        sticky: true,
+    });
+}
+
+/**
+ * Tells the reader what emptying `folderName` came to. `count` is how many messages it held, when that was known: the whole-folder request
+ * does not say. A folder that had to be deleted message by message reports as `notifyPurged()` does, plus a word when it was too big to be
+ * done in one go.
+ */
+export function notifyFolderEmptied(folderName: string, outcome: EmptyFolderOutcome, count?: number): void {
+    if (outcome.deleted.length === 0 && outcome.failed.length === 0 && outcome.emptied) {
+        notify({
+            kind: "success",
+            title: count === undefined ? `${folderName} emptied` : `${messageCount(count)} permanently deleted`,
+            message: count === undefined ? "Everything in it was permanently deleted." : `${folderName} is now empty.`,
+        });
+        return;
+    }
+    notifyPurged(outcome);
+    if (!outcome.emptied && outcome.failed.length === 0) {
+        notify({ kind: "info", title: `${folderName} is not empty yet`, message: "It holds more than could be deleted in one go. Empty it again to carry on." });
+    }
+}

package/apps/shared/mail/primaryMailbox.ts

@@ -0,0 +1,71 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * Which of the caller's mailboxes is "theirs", and the order every list of them is shown in - the one definition the mail, calendar,
+ * contacts, tasks and settings shells, the compose window's From picker and the account menu all use, so a shared mailbox that happens
+ * to sort first (or that the server lists first) is never the one an app opens on or a picker defaults to.
+ *
+ * An **own** mailbox is one whose `ownerUserUid` is the signed-in user.
+ *
+ * A **shared** mailbox is any other one the caller merely has access to: an ownerless (shared/organization) mailbox, or a delegate grant on
+ * somebody else's (`isSharedWithMe()`).
+ *
+ * The **primary** mailbox is the caller's own mailbox - the earliest created, when they own several - else the first mailbox that isn't
+ * shared, else the first one there is.
+ *
+ * `orderMailboxes()` puts the primary mailbox first, then the caller's other mailboxes, then the shared ones, each group alphabetical.
+ */
+import { isSharedWithMe, type Mailbox } from "@rapidmx/react-shared/mail/mailApi.js";
+
+/** Whether `mailbox` is the signed-in user's own. */
+export function isOwnMailbox(mailbox: Mailbox, userUid: string | undefined): boolean {
+    return !!userUid && mailbox.ownerUserUid === userUid;
+}
+
+/** Whether `mailbox` is one the caller only has access to (an ownerless one, or somebody else's shared with them). */
+export function isSharedMailbox(mailbox: Mailbox, userUid: string | undefined): boolean {
+    if (isOwnMailbox(mailbox, userUid)) {
+        return false;
+    }
+    // The server says how the caller reaches a mailbox (`accessRole`); an older one doesn't, and then a mailbox that isn't the known
+    // caller's own is somebody else's.
+    return mailbox.accessRole ? isSharedWithMe(mailbox) : !!userUid || isSharedWithMe(mailbox);
+}
+
+function createdAt(mailbox: Mailbox): number {
+    const time = Date.parse(mailbox.dateCreated);
+    return Number.isNaN(time) ? Infinity : time;
+}
+
+/** The caller's own mailboxes, earliest created first (the given order among ones created together). */
+export function ownMailboxes(mailboxes: readonly Mailbox[], userUid: string | undefined): Mailbox[] {
+    return mailboxes.filter((mailbox) => isOwnMailbox(mailbox, userUid)).sort((a, b) => createdAt(a) - createdAt(b));
+}
+
+/** The mailbox to open and to default pickers to: see the rules at the top of this file. `undefined` only for no mailboxes at all. */
+export function primaryMailbox(mailboxes: readonly Mailbox[], userUid: string | undefined): Mailbox | undefined {
+    return ownMailboxes(mailboxes, userUid)[0] ?? mailboxes.find((mailbox) => !isSharedMailbox(mailbox, userUid)) ?? mailboxes[0];
+}
+
+/** `primaryMailbox()`'s uid. */
+export function primaryMailboxUid(mailboxes: readonly Mailbox[], userUid: string | undefined): string | undefined {
+    return primaryMailbox(mailboxes, userUid)?.uid;
+}
+
+/** `mailboxes` in display order: the primary mailbox, then the caller's other mailboxes, then the shared ones - each group by name. Never
+ * changes the list it is given. */
+export function orderMailboxes(mailboxes: readonly Mailbox[], userUid: string | undefined): Mailbox[] {
+    const primary = primaryMailbox(mailboxes, userUid);
+    const rank = (mailbox: Mailbox) => (mailbox === primary ? 0 : isSharedMailbox(mailbox, userUid) ? 2 : 1);
+    // Tolerates a mailbox that says nothing of its name or address (an older server's, or a test fixture's).
+    const name = (mailbox: Mailbox) => mailbox.displayName ?? "";
+    const address = (mailbox: Mailbox) => mailbox.primarySmtpAddress ?? "";
+    return [...mailboxes].sort(
+        (a, b) =>
+            rank(a) - rank(b) ||
+            name(a).localeCompare(name(b), undefined, { sensitivity: "base" }) ||
+            address(a).localeCompare(address(b)),
+    );
+}

package/apps/shared/mail/reportNotices.ts

@@ -0,0 +1,66 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import type { MessageReportKind, MessageReportResult } from "@rapidmx/react-shared/mail/mailApi.js";
+
+/** Where a notification's "Manage blocked senders" goes: the Blocked and safe senders page of the mailbox. */
+export function senderListsHref(mailboxUid: string): string {
+    return `/settings/blocked-senders?mailboxUid=${encodeURIComponent(mailboxUid)}`;
+}
+
+/** What a pop-up says about reporting `kind`: the title, and the folder the message goes to. */
+const KINDS: Record<MessageReportKind, { title: string; noun: string; folder: string }> = {
+    junk: { title: "Reported as junk", noun: "junk", folder: "Junk Email" },
+    phishing: { title: "Reported as phishing", noun: "phishing", folder: "Junk Email" },
+    not_junk: { title: "Marked as not junk", noun: "not junk", folder: "the Inbox" },
+};
+
+/** The noun of `kind` for a failure's title ("Couldn't report this message as phishing"). */
+export function reportNoun(kind: MessageReportKind): string {
+    return KINDS[kind].noun;
+}
+
+/** The title of a pop-up for a report of `kind`. */
+export function reportTitle(kind: MessageReportKind): string {
+    return KINDS[kind].title;
+}
+
+/** The name of the folder a report of `kind` files the message in. */
+export function reportFolderName(kind: MessageReportKind): string {
+    return KINDS[kind].folder;
+}
+
+/** What a pop-up for a report says. `hint` is the small muted line: only for the two things a reader may want to know about (the filter could not be
+ * taught, or the message is encrypted so it was not), never for the ones that are simply how the server is set up. */
+export interface ReportNotice {
+    title: string;
+    message: string;
+    hint?: string;
+}
+
+/**
+ * The words for what the server did with a report (`reportMessage()`'s answer): where the message went, whether the spam filter learned from it, and - for
+ * a report of phishing - that the server recorded it. `subject` names the message. `alwaysTrust` says the reader asked for the sender to be trusted.
+ */
+export function reportNotice(result: MessageReportResult, subject: string, alwaysTrust: boolean): ReportNotice {
+    const kind = KINDS[result.kind];
+    const where = result.moved ? `was moved to ${kind.folder}` : `is already in ${kind.folder}`;
+    const learned = result.learned ? " and used to train the spam filter" : "";
+    const parts = [`“${subject}” ${where}${learned}.`];
+    if (result.kind === "phishing") {
+        parts.push("The report was recorded in the audit log.");
+    }
+    if (result.safeSender) {
+        parts.push(`Mail from ${result.safeSender} that passes authentication is no longer sent to Junk Email.`);
+    } else if (alwaysTrust) {
+        parts.push("The message names no address that could be trusted.");
+    }
+    const hint =
+        result.learnSkipped === "failed"
+            ? "The spam filter could not be trained from this report."
+            : result.learnSkipped === "encrypted"
+              ? "Not used to train the spam filter: the message is encrypted."
+              : undefined;
+    return { title: kind.title, message: parts.join(" "), hint };
+}

package/apps/shared/mail/senderBlocking.ts

@@ -0,0 +1,141 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import {
+    MailFilterRule,
+    createMailFilterRule,
+    deleteMailFilterRule,
+    listMailFilterRules,
+    updateMailFilterRule,
+} from "@rapidmx/react-shared/mail/mailFilterRulesApi.js";
+
+/**
+ * "Block sender" and "Never block sender", expressed as the mailbox's own mail filter rules - the server has no blocked-senders list.
+ * A rule's "From contains" is a case-insensitive substring match on the From header (restapi's `matchesConditions()`), which is the
+ * closest thing there is to "from equals": it also matches a longer address that ends in this one (`joann@x.com` for `ann@x.com`).
+ *
+ * - **Block** is `From contains <address>` -> move to the mailbox's Junk Email, stop processing more rules, ahead of every other rule
+ * (a sequence below all of them), so nothing else files the sender's mail first.
+ * - **Never block** is `From contains <address>` -> move to the Inbox, stop processing, likewise first. It keeps the sender's mail out of
+ * the reader's own blocking and filing rules. It cannot keep it out of Junk when the spam filter sends it there: mail the spam filter
+ * has judged junk skips every rule (restapi's `ScanQueueJob.deliverMessage()`).
+ *
+ * Rules are found by what they do, not by their name, so one the reader renamed or made by hand is still the rule for that sender.
+ */
+
+/** Every rule listing asks for up to this many, which is the most the mail server reads when it filters a delivery. */
+const RULE_LIMIT = 500;
+
+export const BLOCK_RULE_PREFIX = "Block ";
+export const NEVER_BLOCK_RULE_PREFIX = "Never block ";
+
+/** `addresses` trimmed, lowercased and without repeats, keeping only what has an `@`. */
+export function normalizeAddresses(addresses: (string | undefined)[]): string[] {
+    return [...new Set(addresses.map((address) => address?.trim().toLowerCase() ?? "").filter((address) => address.includes("@")))];
+}
+
+/** Whether `rule` is "From contains ..." (every address of `addresses` among them, and nothing else) and moves to `folderUid` and stops. */
+function isSenderRule(rule: MailFilterRule, addresses: string[], folderUid: string): boolean {
+    const conditions = rule.conditions as Record<string, unknown>;
+    const only = Object.keys(conditions).every((key) => key === "fromContains" || conditions[key] === undefined);
+    const from = (rule.conditions.fromContains ?? []).map((entry) => entry.toLowerCase());
+    return (
+        only &&
+        addresses.every((address) => from.includes(address)) &&
+        rule.stopProcessingRules &&
+        rule.actions.length === 1 &&
+        rule.actions[0].type === "move_to_folder" &&
+        rule.actions[0].folderUid === folderUid
+    );
+}
+
+/** What blocking a sender did: `created` the rule, found it `existing` (and on), or turned an existing one back on. */
+export interface BlockResult {
+    outcome: "created" | "existing" | "enabled";
+    rule: MailFilterRule;
+}
+
+/** What "Never block" did: the block rules it took away, and the rule that keeps the sender in the Inbox (`created` now or found). */
+export interface NeverBlockResult {
+    removed: MailFilterRule[];
+    outcome: "created" | "existing" | "enabled";
+    rule: MailFilterRule;
+}
+
+/** A sequence that puts a new rule ahead of every rule the mailbox has. */
+function firstSequence(rules: MailFilterRule[]): number {
+    return Math.min(0, ...rules.map((rule) => rule.sequence)) - 1;
+}
+
+/** Finds the rule that does `folderUid` for `addresses`, makes one (named `${prefix}${addresses[0]}`) if there is none, and turns a found one on. */
+async function ensureRule(
+    rules: MailFilterRule[],
+    mailboxUid: string,
+    addresses: string[],
+    folderUid: string,
+    prefix: string,
+): Promise<{ outcome: "created" | "existing" | "enabled"; rule: MailFilterRule }> {
+    const found = rules.find((rule) => isSenderRule(rule, addresses, folderUid));
+    if (found) {
+        if (found.enabled) {
+            return { outcome: "existing", rule: found };
+        }
+        // The whole rule, as the filters page saves one: the update replaces the record.
+        const { uid, version, name, sequence, stopProcessingRules, conditions, actions } = found;
+        return { outcome: "enabled", rule: await updateMailFilterRule({ uid, version, name, enabled: true, sequence, stopProcessingRules, conditions, actions }) };
+    }
+    const rule = await createMailFilterRule({
+        mailboxUid,
+        name: `${prefix}${addresses[0]}`,
+        sequence: firstSequence(rules),
+        stopProcessingRules: true,
+        conditions: { fromContains: addresses },
+        actions: [{ type: "move_to_folder", folderUid }],
+    });
+    return { outcome: "created", rule };
+}
+
+/** Takes away every rule that is `folderUid` for `addresses`. */
+async function removeRules(rules: MailFilterRule[], addresses: string[], folderUid: string): Promise<MailFilterRule[]> {
+    const doomed = rules.filter((rule) => isSenderRule(rule, addresses, folderUid));
+    for (const rule of doomed) {
+        await deleteMailFilterRule(rule.uid, rule.version);
+    }
+    return doomed;
+}
+
+/**
+ * Blocks a sender: mail from `addresses` (its envelope sender and From header address, when they differ - a mailing list or a bulk sender
+ * usually has both) goes to `junkFolderUid` from now on. Idempotent: the rule is made once, and a rule that was turned off is turned on.
+ * A "Never block" rule for the same sender is taken away, since the two would fight.
+ */
+export async function blockSender(mailboxUid: string, addresses: string[], junkFolderUid: string, inboxFolderUid: string): Promise<BlockResult> {
+    const rules = await listMailFilterRules(mailboxUid, { limit: RULE_LIMIT });
+    await removeRules(rules, addresses, inboxFolderUid);
+    return ensureRule(rules, mailboxUid, addresses, junkFolderUid, BLOCK_RULE_PREFIX);
+}
+
+/** Never blocks a sender: takes away the block rule for `addresses` and makes (once) the rule that keeps their mail in the Inbox. */
+export async function neverBlockSender(
+    mailboxUid: string,
+    addresses: string[],
+    junkFolderUid: string,
+    inboxFolderUid: string,
+): Promise<NeverBlockResult> {
+    const rules = await listMailFilterRules(mailboxUid, { limit: RULE_LIMIT });
+    const removed = await removeRules(rules, addresses, junkFolderUid);
+    const kept = await ensureRule(
+        rules.filter((rule) => !removed.includes(rule)),
+        mailboxUid,
+        addresses,
+        inboxFolderUid,
+        NEVER_BLOCK_RULE_PREFIX,
+    );
+    return { removed, ...kept };
+}
+
+/** Takes back a rule this module made (the notification's Undo). */
+export function removeSenderRule(rule: MailFilterRule): Promise<void> {
+    return deleteMailFilterRule(rule.uid, rule.version);
+}

package/apps/shared/mail/useCollapsedSections.ts

@@ -0,0 +1,146 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * Which of the Mail sidebar's sections - "All mailboxes" and one per mailbox - are open, and the reader's own choices about it.
+ *
+ * A section the reader has never touched follows the **default rule**: "All mailboxes" and the signed-in user's primary mailbox
+ * (`primaryMailboxUid()`) are open, every other mailbox is collapsed - so a mailbox that is newly shared with them arrives closed.
+ * Once they toggle a section the choice is remembered for that section, replacing the default, whatever the default later says.
+ *
+ * **Every** section can be collapsed, the one holding the open folder and the primary mailbox included, and a collapsed one stays collapsed
+ * across reloads even while its own folder is the selected one: the toggle always toggles and always remembers.
+ *
+ * The one exception is *navigation*: when the section holding the open folder (`activeId`) **changes** - the reader picks a folder in
+ * another section, or a search result or a link lands in one - that section is shown open, so the folder just highlighted is not hidden
+ * from them. That is an in-memory override of this page view, never written as the reader's choice: it does not apply to the first
+ * section the page resolves (a reload lands on whatever was chosen), and it ends when they navigate to yet another section. Toggling
+ * the section it opened forgets the override and remembers the reader's new choice (the opposite of what was showing).
+ *
+ * The choices are kept per signed-in user, per device, in `localStorage` (`rapidmx:mail-sidebar-collapsed:<userUid>`), the way
+ * `listPreferences.ts` keeps the list arrangement: `{ "<section id>": <collapsed> }`. Every read tolerates a missing, corrupt or
+ * blocked store (and keeps only the booleans of a partly-valid one), every write swallows its failure - a blocked store only means the
+ * choices do not survive a reload.
+ */
+import { useCallback, useMemo, useRef, useState } from "react";
+
+const STORAGE_KEY_PREFIX = "rapidmx:mail-sidebar-collapsed:";
+
+/** The id of the "All mailboxes" section; every mailbox's section is its uid. */
+export const ALL_MAILBOXES_SECTION = "all";
+
+/** What the reader chose per section: `true` collapsed, `false` open. A section that is not there follows the default rule. */
+export type SectionChoices = Record<string, boolean>;
+
+/** The `localStorage` key one user's choices are kept under. */
+export function collapsedSectionsKey(userUid: string): string {
+    return `${STORAGE_KEY_PREFIX}${userUid}`;
+}
+
+/** Reads a user's stored choices - none for an unknown user, a missing entry, unparsable JSON, something that is not an object, or a store that throws. */
+export function readSectionChoices(userUid: string | undefined): SectionChoices {
+    if (!userUid) {
+        return {};
+    }
+    let stored: unknown;
+    try {
+        const raw = localStorage.getItem(collapsedSectionsKey(userUid));
+        stored = raw === null ? null : JSON.parse(raw);
+    } catch {
+        return {};
+    }
+    if (!stored || typeof stored !== "object" || Array.isArray(stored)) {
+        return {};
+    }
+    // Only what is a real choice: a value that is not a boolean falls back to the default for its own section, not for all of them.
+    return Object.fromEntries(Object.entries(stored).filter((entry): entry is [string, boolean] => typeof entry[1] === "boolean"));
+}
+
+/** Stores a user's choices. Best-effort - see this module's own doc comment. */
+export function writeSectionChoices(userUid: string | undefined, choices: SectionChoices): void {
+    if (!userUid) {
+        return;
+    }
+    try {
+        localStorage.setItem(collapsedSectionsKey(userUid), JSON.stringify(choices));
+    } catch {
+        // Best-effort - see this module's own doc comment.
+    }
+}
+
+/** Whether a section is open by the reader's choice, or by the default rule where they have made none (a navigation's override not considered). */
+export function sectionChosenOpen(id: string, choices: SectionChoices, primaryUid: string | undefined): boolean {
+    const collapsed = choices[id];
+    return collapsed === undefined ? id === ALL_MAILBOXES_SECTION || id === primaryUid : !collapsed;
+}
+
+export interface SidebarSectionsOptions {
+    /** The signed-in user, whose choices these are; `undefined` keeps them for this page view only. */
+    userUid: string | undefined;
+    /** The user's primary mailbox, which - with "All mailboxes" - is open until they choose otherwise. */
+    primaryUid: string | undefined;
+    /**
+     * The section holding the folder that is open: `ALL_MAILBOXES_SECTION` for an aggregate view, else that mailbox's uid; `undefined`
+     * while that is not known yet (the address not read, the mailboxes not loaded). Moving from one section to another opens the new one
+     * (see this module's doc comment); the first section that becomes known does not.
+     */
+    activeId: string | undefined;
+}
+
+export interface SidebarSections {
+    /** Whether the section shows its folders. */
+    isExpanded: (id: string) => boolean;
+    /** Opens a collapsed section, collapses an open one, and remembers it as the reader's choice. */
+    toggle: (id: string) => void;
+}
+
+/** See this module's doc comment. */
+export function useSidebarSections({ userUid, primaryUid, activeId }: SidebarSectionsOptions): SidebarSections {
+    const [loaded, setLoaded] = useState(() => ({ userUid, choices: readSectionChoices(userUid) }));
+    let current = loaded;
+    if (loaded.userUid !== userUid) {
+        // Another user signed in on this page: theirs are not the last one's choices.
+        current = { userUid, choices: readSectionChoices(userUid) };
+        setLoaded(current);
+    }
+    // The section the last navigation opened, if any: derived while rendering from the change of `activeId` (no effect, so the section is
+    // already open in the render that highlights its folder). A first `activeId` (from undefined) is not a navigation.
+    const [nav, setNav] = useState<{ activeId: string | undefined; opened: string | undefined }>({ activeId, opened: undefined });
+    let currentNav = nav;
+    if (nav.activeId !== activeId) {
+        currentNav = { activeId, opened: nav.activeId === undefined ? undefined : activeId };
+        setNav(currentNav);
+    }
+    // Kept in step with what was last rendered, and moved on by a toggle at once, so two toggles before a re-render both count.
+    const choicesRef = useRef(current.choices);
+    choicesRef.current = current.choices;
+    const openedRef = useRef(currentNav.opened);
+    openedRef.current = currentNav.opened;
+
+    const toggle = useCallback(
+        (id: string) => {
+            const expanded = openedRef.current === id || sectionChosenOpen(id, choicesRef.current, primaryUid);
+            const next = { ...choicesRef.current, [id]: expanded };
+            choicesRef.current = next;
+            setLoaded({ userUid, choices: next });
+            writeSectionChoices(userUid, next);
+            if (openedRef.current === id) {
+                // The reader's own choice replaces the override that had opened it.
+                openedRef.current = undefined;
+                setNav({ activeId, opened: undefined });
+            }
+        },
+        [activeId, primaryUid, userUid],
+    );
+
+    const choices = current.choices;
+    const opened = currentNav.opened;
+    return useMemo(
+        () => ({
+            isExpanded: (id: string) => id === opened || sectionChosenOpen(id, choices, primaryUid),
+            toggle,
+        }),
+        [opened, choices, primaryUid, toggle],
+    );
+}