@rapidmx/web-client 0.3.1 → 0.5.0

package/dist/apps/shared/components/rules/RuleBuilder.js

@@ -6,6 +6,20 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useState } from "react";
 import Button from "@rapidmx/react-shared/components/buttons/Button.js";
 const INPUT_CLASS = "flex-1 text-sm py-2 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
+/**
+ * Whether `conditions` holds at least one real condition: a list with a non-blank entry, a ticked
+ * boolean, or a chosen select value. A rule with none would match *every* message, so the pages that save
+ * a `RuleBuilder` value (mail filters, transport rules) must refuse to save unless this returns `true`.
+ */
+export function hasConditions(conditions) {
+    return Object.values(conditions).some((v) => {
+        if (Array.isArray(v))
+            return v.some((entry) => typeof entry !== "string" || entry.trim() !== "");
+        if (typeof v === "string")
+            return v.trim() !== "";
+        return v !== undefined && v !== null && v !== false;
+    });
+}
 /**
  * Shared condition-row editor and enabled/sequence/stop-processing chrome for a rule that matches
  * conditions and runs actions in order — `TransportRule` (admin, org-wide) and `MailFilterRule`
@@ -19,7 +33,7 @@ const INPUT_CLASS = "flex-1 text-sm py-2 px-3 border border-border rounded-sm bg
  * add-header/add-recipient vs. move/copy/delete/mark-read/forward) are different enough that one
  * component special-casing both would be worse than this split.
  */
-export default function RuleBuilder({ value, onChange, conditionFields, actionTypes, }) {
+export default function RuleBuilder({ value, onChange, conditionFields, actionTypes, showValidation = false, }) {
     const [draftText, setDraftText] = useState({});
     const [newActionType, setNewActionType] = useState(actionTypes[0]?.value ?? "");
     const conditions = value.conditions;
@@ -36,12 +50,22 @@ export default function RuleBuilder({ value, onChange, conditionFields, actionTy
         patch({ conditions: { ...conditions, [key]: [...existing, text] } });
         setDraftText({ ...draftText, [key]: "" });
     }
+    // Only invoked from a chip's own "Remove" button, which only renders while `conditions[key]` holds
+    // that entry. Removing the last entry deletes the key rather than leaving an empty list behind.
     function removeListEntry(key, entry) {
-        const existing = conditions[key] ?? [];
-        patch({ conditions: { ...conditions, [key]: existing.filter((e) => e !== entry) } });
+        const remaining = conditions[key].filter((e) => e !== entry);
+        const next = { ...conditions };
+        if (remaining.length > 0) {
+            next[key] = remaining;
+        }
+        else {
+            delete next[key];
+        }
+        patch({ conditions: next });
     }
     function toggleBoolean(key) {
-        patch({ conditions: { ...conditions, [key]: !conditions[key] } });
+        // Unticking stores `undefined` (no condition), not `false`.
+        patch({ conditions: { ...conditions, [key]: conditions[key] ? undefined : true } });
     }
     function setSelect(key, value) {
         patch({ conditions: { ...conditions, [key]: value || undefined } });
@@ -58,14 +82,18 @@ export default function RuleBuilder({ value, onChange, conditionFields, actionTy
     function removeAction(index) {
         patch({ actions: value.actions.filter((_, i) => i !== index) });
     }
-    return (_jsxs("div", { className: "flex flex-col gap-5", children: [_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-4", children: "Conditions" }), _jsx("div", { className: "flex flex-col gap-4", children: conditionFields.map((field) => {
+    return (_jsxs("div", { className: "flex flex-col gap-5", children: [_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-4", children: "Conditions" }), !hasConditions(value.conditions) && (_jsx("p", { role: showValidation ? "alert" : undefined, className: `text-sm mb-4 ${showValidation ? "text-danger" : "text-text-muted"}`, children: "Add at least one condition. A rule without conditions would apply to every message." })), _jsx("div", { className: "flex flex-col gap-4", children: conditionFields.map((field) => {
                             if (field.kind === "boolean") {
                                 return (_jsxs("label", { className: "flex items-center gap-2 text-sm", children: [_jsx("input", { type: "checkbox", checked: !!conditions[field.key], onChange: () => toggleBoolean(field.key) }), field.label] }, field.key));
                             }
                             if (field.kind === "select") {
                                 return (_jsxs("div", { children: [_jsx("label", { className: "text-sm font-semibold mb-1.5 block", htmlFor: `condition-${field.key}`, children: field.label }), _jsxs("select", { id: `condition-${field.key}`, className: INPUT_CLASS, value: conditions[field.key] ?? "", onChange: (e) => setSelect(field.key, e.target.value), children: [_jsx("option", { value: "", children: "Any" }), (field.options ?? []).map((opt) => (_jsx("option", { value: opt.value, children: opt.label }, opt.value)))] })] }, field.key));
                             }
-                            return (_jsxs("div", { children: [_jsx("div", { className: "text-sm font-semibold mb-1.5", children: field.label }), _jsx("div", { className: "flex flex-wrap gap-2 mb-2", children: (conditions[field.key] ?? []).map((entry) => (_jsxs("span", { className: "inline-flex items-center gap-1.5 text-xs py-1 px-2.5 rounded-pill bg-surface-alt", children: [entry, _jsx("button", { type: "button", "aria-label": `Remove ${entry}`, onClick: () => removeListEntry(field.key, entry), className: "text-text-muted hover:text-danger", children: "\u00D7" })] }, entry))) }), _jsxs("div", { className: "flex gap-2", children: [_jsx("input", { type: "text", "aria-label": field.label, className: INPUT_CLASS, placeholder: field.placeholder ?? "Add a value", value: draftText[field.key] ?? "", onChange: (e) => setDraftText({ ...draftText, [field.key]: e.target.value }), onKeyDown: (e) => {
+                            return (_jsxs("div", { children: [_jsx("div", { className: "text-sm font-semibold mb-1.5", children: field.label }), _jsx("div", { className: "flex flex-wrap gap-2 mb-2", children: (conditions[field.key] ?? []).map((entry) => (_jsxs("span", { className: "inline-flex items-center gap-1.5 text-xs py-1 px-2.5 rounded-pill bg-surface-alt", children: [entry, _jsx("button", { type: "button", "aria-label": `Remove ${entry}`, onClick: () => removeListEntry(field.key, entry), className: "text-text-muted hover:text-danger", children: "\u00D7" })] }, entry))) }), _jsxs("div", { className: "flex gap-2", children: [_jsx("input", { type: "text", "aria-label": field.label, className: INPUT_CLASS, placeholder: field.placeholder ?? "Add a value", value: draftText[field.key] ?? "", onChange: (e) => setDraftText({ ...draftText, [field.key]: e.target.value }), 
+                                                // Text typed but never added (no Add/Enter) is committed when the field
+                                                // loses focus - e.g. to the page's Save button - so it's never silently
+                                                // dropped from the saved rule.
+                                                onBlur: () => addListEntry(field.key), onKeyDown: (e) => {
                                                     if (e.key === "Enter") {
                                                         e.preventDefault();
                                                         addListEntry(field.key);

package/dist/apps/shared/components/settings/layout/SettingsShell.js

@@ -22,6 +22,7 @@ export const SETTINGS_SECTIONS = [
     { id: "read-receipts", href: "/settings/read-receipts", label: "Read Receipts" },
     { id: "booking-types", href: "/settings/booking-types", label: "Booking Links" },
     { id: "encryption", href: "/settings/encryption", label: "Encryption" },
+    { id: "sharing", href: "/settings/sharing", label: "Sharing" },
     { id: "privacy", href: "/settings/privacy", label: "Privacy & Data" },
 ];
 const SettingsShellContext = createContext({ mailboxes: [] });

package/dist/apps/shared/mail/findWellKnownFolderUid.js

@@ -0,0 +1,12 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { listFolders } from "@rapidmx/react-shared/mail/mailApi.js";
+/** The uid of a mailbox's well-known folder of `type` (e.g. its Contacts or Tasks folder), for creating an
+ * item in a mailbox other than the one an app currently has loaded. Resolves `undefined` if the mailbox has
+ * no such folder; rejects if the folder list can't be fetched. */
+export async function findWellKnownFolderUid(mailboxUid, type) {
+    const folders = await listFolders(mailboxUid);
+    return folders.find((folder) => folder.type === type)?.uid;
+}

package/dist/apps/shared/mail/listAllPages.js

@@ -0,0 +1,25 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/** Page size the list pages (Contacts, Tasks) request per call - restapi caps `limit` at 500. */
+export const LIST_PAGE_SIZE = 500;
+/** Safety cap on pages fetched - stops a server that ignores `page` (and keeps returning a full first
+ * page) from looping forever. 40 pages x 500 = 20,000 items. */
+export const MAX_LIST_PAGES = 40;
+/**
+ * Fetches every page of a zero-based `limit`/`page` list endpoint, stopping at the first short page
+ * (fewer than `pageSize` items) - so a folder with more items than one page holds is shown in full
+ * rather than silently cut off at the first page. Stops at `maxPages` regardless, reporting `truncated`.
+ */
+export async function listAllPages(fetchPage, pageSize = LIST_PAGE_SIZE, maxPages = MAX_LIST_PAGES) {
+    const items = [];
+    for (let page = 0; page < maxPages; page++) {
+        const batch = await fetchPage(page);
+        items.push(...batch);
+        if (batch.length < pageSize) {
+            return { items, truncated: false };
+        }
+    }
+    return { items, truncated: true };
+}

package/dist/apps/shared/search/LocalIndexLifecycle.js

@@ -0,0 +1,80 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * Mounts the Tier 2 local index's lifecycle: starts the background build for the active mailbox once it's
+ * unlocked, and destroys an index on the same events that destroy that mailbox's unlocked keys (spec §11
+ * "MUST be destroyed on the same events that destroy private keys: explicit logout, session revocation,
+ * and the configurable idle timeout").
+ *
+ * **Why polling, not hooking the existing destroy call sites directly**: `destroyUnlockedKeys()`
+ * (`react-shared/src/crypto/keySession.ts`) has no observer/callback hook. Watching `getUnlockedKeys()`
+ * for a present-to-absent transition catches *every* destroy path uniformly - idle timeout, the manual
+ * button, or anything else that calls it - without needing to know which one fired.
+ *
+ * Every mailbox this component has seen unlocked is tracked for the life of the mount - not just whichever
+ * is active right now - so switching mailboxes (or a folders-list refresh re-running the build effect)
+ * can never lose a pending unlocked-to-locked transition for a mailbox whose index was already built.
+ *
+ * **Explicit logout** navigates away immediately, which may not leave time for a poll tick - `AppShell.tsx`
+ * handles that case itself via `destroyAllLocalIndexes()`.
+ */
+import { useEffect, useRef } from "react";
+import { getUnlockedKeys } from "@rapidmx/react-shared/crypto/keySession.js";
+import { buildLocalIndex, cancelLocalIndexBuild } from "./localIndexBuilder.js";
+import { destroyLocalIndex, pruneInaccessibleLocalIndexes } from "./localIndexRpcClient.js";
+export const POLL_INTERVAL_MS = 5000;
+/** Renders nothing - pure side-effect component, mounted by `MailShell.tsx`. */
+export default function LocalIndexLifecycle({ mailboxUid, folders, accessibleMailboxUids }) {
+    // mailboxUid -> whether it was unlocked at the last check. An entry exists for every mailbox whose
+    // build this component started; only ever changed by a real observed transition, never reset by an
+    // effect re-run.
+    const trackedRef = useRef(new Map());
+    // The latest props, for the long-lived polling interval below.
+    const latestRef = useRef({ mailboxUid, folders });
+    latestRef.current = { mailboxUid, folders };
+    function startBuildIfUnlocked(targetMailboxUid, targetFolders) {
+        const unlocked = getUnlockedKeys(targetMailboxUid);
+        if (!unlocked || targetFolders.length === 0 || trackedRef.current.get(targetMailboxUid)) {
+            return;
+        }
+        trackedRef.current.set(targetMailboxUid, true);
+        // Never an unhandled rejection - a broken local index is best-effort infrastructure, not a build
+        // the rest of the app depends on.
+        buildLocalIndex(targetMailboxUid, unlocked, targetFolders).catch(() => undefined);
+    }
+    useEffect(() => {
+        if (mailboxUid) {
+            startBuildIfUnlocked(mailboxUid, folders);
+        }
+    }, [mailboxUid, folders]);
+    useEffect(() => {
+        const interval = setInterval(() => {
+            for (const [trackedUid, wasUnlocked] of trackedRef.current) {
+                if (wasUnlocked && !getUnlockedKeys(trackedUid)) {
+                    // A present-to-absent transition: something just destroyed this mailbox's keys.
+                    trackedRef.current.set(trackedUid, false);
+                    // Stop the pass still running with the now-destroyed keys; the destroy itself also makes
+                    // the Worker reject anything that pass still sends.
+                    void cancelLocalIndexBuild(trackedUid);
+                    void destroyLocalIndex(trackedUid);
+                }
+            }
+            // The active mailbox was (re-)unlocked since the last check, e.g. via an on-demand unlock prompt.
+            const { mailboxUid: activeUid, folders: activeFolders } = latestRef.current;
+            if (activeUid) {
+                startBuildIfUnlocked(activeUid, activeFolders);
+            }
+        }, POLL_INTERVAL_MS);
+        return () => clearInterval(interval);
+    }, []);
+    // A stable string key so a re-render with an equal-but-new array doesn't re-scan OPFS.
+    const accessibleKey = accessibleMailboxUids && accessibleMailboxUids.length > 0 ? JSON.stringify([...accessibleMailboxUids].sort()) : "";
+    useEffect(() => {
+        if (accessibleKey) {
+            void pruneInaccessibleLocalIndexes(JSON.parse(accessibleKey));
+        }
+    }, [accessibleKey]);
+    return null;
+}

package/dist/apps/shared/search/localIndexBlockCipher.js

@@ -0,0 +1,63 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * The actual AES-256-GCM block cipher `localIndexVFS.ts`'s `EncryptingVFS` uses to encrypt/decrypt one
+ * physical storage block - deliberately split out from that file so it can be exercised with real
+ * WebCrypto in a plain unit test, with no OPFS/Worker/wa-sqlite involved at all (none of those are
+ * available under Vitest's jsdom environment, matching the same "node" test environment convention
+ * `react-shared`'s other crypto modules already use for exactly this reason).
+ *
+ * See `localIndexVFS.ts`'s own doc comment for the full design rationale (page layout, why a fresh
+ * random nonce per write, why AAD binds to filename+block index). This module is pure mechanism; that
+ * one is where the design is explained.
+ */
+/** The logical SQLite page size `EncryptingVFS` is designed for - MUST match the `PRAGMA page_size` the
+ * database was created with (`localIndexWorker.ts` sets this before the first write). */
+export const LOGICAL_BLOCK_SIZE = 4096;
+const NONCE_LENGTH = 12;
+const TAG_LENGTH = 16;
+/** One physical block on disk: `nonce || ciphertext || tag`. */
+export const PHYSICAL_BLOCK_SIZE = LOGICAL_BLOCK_SIZE + NONCE_LENGTH + TAG_LENGTH;
+/** Thrown when a stored block fails AES-GCM authentication - a wrong/rotated key, on-disk corruption, or
+ * a block moved to the wrong position (see `localIndexVFS.ts`'s doc comment on why AAD binds position).
+ * The worker's caller treats this identically to a schema-version mismatch: discard the whole index and
+ * rebuild (spec §11 "Invalidation"). */
+export class PageCorruptedError extends Error {
+    constructor(filename, blockIndex, cause) {
+        super(`Local search index block ${blockIndex} of '${filename}' failed to decrypt.`);
+        this.cause = cause;
+    }
+}
+export async function importAesGcmKey(rawKey) {
+    return crypto.subtle.importKey("raw", rawKey, "AES-GCM", false, ["encrypt", "decrypt"]);
+}
+function buildBlockAad(filename, blockIndex) {
+    return new TextEncoder().encode(`rapidmx-local-index-block:${filename}:${blockIndex}`);
+}
+/** Encrypts one logical block (`plaintext`, exactly `LOGICAL_BLOCK_SIZE` bytes) into its physical,
+ * on-disk representation (`PHYSICAL_BLOCK_SIZE` bytes: a fresh random nonce followed by
+ * ciphertext+tag). */
+export async function encryptBlock(key, filename, blockIndex, plaintext) {
+    const nonce = crypto.getRandomValues(new Uint8Array(NONCE_LENGTH));
+    const ciphertextAndTag = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv: nonce, additionalData: buildBlockAad(filename, blockIndex) }, key, plaintext));
+    const physical = new Uint8Array(PHYSICAL_BLOCK_SIZE);
+    physical.set(nonce, 0);
+    physical.set(ciphertextAndTag, NONCE_LENGTH);
+    return physical;
+}
+/** Inverse of `encryptBlock()`. Throws `PageCorruptedError` (never a raw `DOMException`) on auth
+ * failure - a wrong key, tampered ciphertext, or a block swapped into the wrong position (caught by the
+ * position-bound AAD not matching). */
+export async function decryptBlock(key, filename, blockIndex, physical) {
+    const nonce = physical.subarray(0, NONCE_LENGTH);
+    const ciphertextAndTag = physical.subarray(NONCE_LENGTH, PHYSICAL_BLOCK_SIZE);
+    try {
+        const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv: nonce, additionalData: buildBlockAad(filename, blockIndex) }, key, ciphertextAndTag);
+        return new Uint8Array(plaintext);
+    }
+    catch (err) {
+        throw new PageCorruptedError(filename, blockIndex, err);
+    }
+}