@rapidmx/web-client 0.35.0 → 0.37.0

package/dist/apps/shared/components/settings/ZeroAccessTypes.js

@@ -0,0 +1,107 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useState } from "react";
+import { getMailbox, updateMailbox } from "../../../../lib/mail/mailApi.js";
+import { ApiRequestError } from "../../../../lib/util/api.js";
+import { useApiClient } from "../../../../lib/util/apiClientContext.js";
+import { notifyApiError } from "../../notifications/apiErrors.js";
+import { useSettingsShell } from "./layout/SettingsShell.js";
+/** What each data type's protection covers, what stays readable and why, and what it breaks on a phone or Outlook - the copy restapi
+ * `specs/search.md` §3 *What It Covers* requires settings to state plainly. */
+export const ZERO_ACCESS_TYPE_INFO = {
+    mail: {
+        label: "Mail",
+        encrypted: "Message bodies, subjects, previews and attachments",
+        readable: "Sender, recipients, dates, size, flags and folder - to deliver, thread and search your mail",
+        onDevices: "can't open protected mail until you install your exported keys on it (Export keys below)",
+    },
+    calendar: {
+        label: "Calendar",
+        encrypted: "Event titles, locations and descriptions",
+        readable: "Times, repeats, time zone, attendees, responses and busy status - for free/busy, invitations and reminders",
+        onDevices: "shows protected events only as busy blocks named “Protected event”, and attendees aren't told when it changes a meeting (a phone) or sends one (Outlook) - send those from RapidMX",
+    },
+    contacts: {
+        label: "Contacts",
+        encrypted: "Names, company, job title, phone numbers, postal addresses, notes, categories and photos",
+        readable: "Email addresses - the server needs them to deliver mail and to find each contact's encryption keys",
+        onDevices: "shows protected contacts by their email address only",
+    },
+    tasks: {
+        label: "Tasks",
+        encrypted: "Task titles and notes",
+        readable: "Due dates, reminders, priority, completion and list",
+        onDevices: "shows protected tasks as “Protected task”",
+    },
+};
+/** Whether `type` is included: the owner's choice, else (undecided) mail on and the rest off - restapi's `zeroAccessTypeIncluded()`. */
+export function typeIncluded(types, type) {
+    const chosen = types?.[type];
+    return typeof chosen === "boolean" ? chosen : type === "mail";
+}
+/** The names of the owner's ActiveSync devices that sync `type`, and Outlook when it syncs the mailbox. */
+export function devicesSyncing(mailbox, type) {
+    const names = (mailbox.syncClients?.activesync?.devices ?? []).filter((device) => device.types.includes(type)).map((device) => device.model || "A phone");
+    return [...new Set(names), ...(mailbox.syncClients?.mapi ? ["Outlook"] : [])];
+}
+/**
+ * "What to protect": one switch per data type zero-access encryption covers, each saying what it encrypts and - for a type one of the
+ * owner's ActiveSync devices or Outlook syncs - plainly what that device will no longer show (restapi `specs/search.md` §3 *What It
+ * Covers*). Then the table of what stays readable to the server and why.
+ */
+export default function ZeroAccessTypes({ mailbox, types, canManage, disabled = false }) {
+    const client = useApiClient();
+    const { patchMailbox } = useSettingsShell();
+    const [chosen, setChosen] = useState(mailbox.zeroAccessTypes ?? {});
+    const [saving, setSaving] = useState(false);
+    // What the server saved, once the mailbox has it (turning zero-access on decides the undecided types there): shown instead of what this
+    // was mounted with - set while rendering, so the stale switches are never drawn.
+    const storedTypes = JSON.stringify(mailbox.zeroAccessTypes ?? {});
+    const [shownTypes, setShownTypes] = useState(storedTypes);
+    if (shownTypes !== storedTypes) {
+        setShownTypes(storedTypes);
+        setChosen(JSON.parse(storedTypes));
+    }
+    async function save(type, on) {
+        const previous = chosen;
+        const next = { ...chosen, [type]: on };
+        setChosen(next);
+        setSaving(true);
+        try {
+            const write = (version) => updateMailbox({ uid: mailbox.uid, version, zeroAccessTypes: { [type]: on } }, client);
+            let saved;
+            try {
+                saved = await write(mailbox.version);
+            }
+            catch (err) {
+                // The server records devices on the mailbox, moving its version on: read it again and retry once.
+                if (!(err instanceof ApiRequestError && err.status === 409)) {
+                    throw err;
+                }
+                saved = await write((await getMailbox(mailbox.uid, {}, client)).version);
+            }
+            // Kept by the shell, so turning zero-access off and on again (which mounts this anew) shows what was saved: the server's merge of
+            // this choice into the stored one.
+            const merged = saved.zeroAccessTypes ?? next;
+            setChosen(merged);
+            patchMailbox?.(mailbox.uid, { zeroAccessTypes: merged, version: saved.version });
+        }
+        catch (err) {
+            setChosen(previous);
+            notifyApiError(err, "Couldn't save what zero-access encryption protects");
+        }
+        finally {
+            setSaving(false);
+        }
+    }
+    return (_jsxs("div", { className: "mt-3", children: [_jsx("h3", { className: "text-sm font-semibold mb-1", children: "What to protect" }), _jsx("ul", { className: "flex flex-col gap-2", children: types.map((type) => {
+                    const info = ZERO_ACCESS_TYPE_INFO[type];
+                    const devices = devicesSyncing(mailbox, type);
+                    const on = typeIncluded(chosen, type);
+                    const keyInstalled = type === "mail" && !!mailbox.zeroAccessKeysExportedAt;
+                    return (_jsx("li", { children: _jsxs("label", { className: "flex items-start gap-2 text-sm", children: [_jsx("input", { type: "checkbox", className: "mt-1", checked: on, disabled: !canManage || saving || disabled, onChange: (e) => void save(type, e.target.checked) }), _jsxs("span", { children: [_jsx("span", { className: "font-semibold block", children: info.label }), _jsxs("span", { className: "text-xs text-text-muted block", children: [info.encrypted, "."] }), devices.length > 0 && !keyInstalled && (_jsxs("span", { role: on ? "alert" : undefined, className: `text-xs block ${on ? "text-danger" : "text-text-muted"}`, children: [on ? "Breaks: " : "Left off because ", devices.join(", "), " ", devices.length === 1 ? "syncs" : "sync", " this - ", on ? "it " : "protected, it ", info.onDevices, "."] }))] })] }) }, type));
+                }) }), _jsxs("details", { className: "mt-3 text-sm", children: [_jsx("summary", { className: "cursor-pointer font-semibold", children: "What\u2019s encrypted, and what isn\u2019t" }), _jsxs("table", { className: "mt-2 w-full text-xs border-collapse", children: [_jsx("thead", { children: _jsxs("tr", { className: "text-left", children: [_jsx("th", { className: "py-1 pr-2", children: "Type" }), _jsx("th", { className: "py-1 pr-2", children: "Encrypted" }), _jsx("th", { className: "py-1", children: "Readable by the server, and why" })] }) }), _jsx("tbody", { children: types.map((type) => (_jsxs("tr", { className: "border-t border-border align-top", children: [_jsx("td", { className: "py-1 pr-2 font-semibold", children: ZERO_ACCESS_TYPE_INFO[type].label }), _jsx("td", { className: "py-1 pr-2", children: typeIncluded(chosen, type) ? ZERO_ACCESS_TYPE_INFO[type].encrypted : "Nothing - not protected" }), _jsx("td", { className: "py-1", children: ZERO_ACCESS_TYPE_INFO[type].readable })] }, type))) })] }), _jsx("p", { className: "mt-2 text-xs text-text-muted", children: "For every type, the server can also see folder and list names, how many items there are and when they change. Zero-access encryption protects what is stored: the server sees what you save while it saves it, then keeps only the encrypted copy." })] })] }));
+}

package/dist/apps/shared/components/settings/layout/SettingsShell.d.ts

@@ -30,6 +30,9 @@ export interface SettingsShellContextValue {
      * every settings section so far (Automatic Replies) edits mailbox-scoped fields. */
     mailboxUid?: string;
     mailboxes: Mailbox[];
+    /** Merges what a section just saved of a mailbox (its new `version` included) into the shell's copy, so a section mounted again for
+     * it - after the mailbox switcher, say - starts from what was saved rather than from the list loaded once. */
+    patchMailbox?: (mailboxUid: string, patch: Partial<Mailbox>) => void;
 }
 /** Reads the mailbox Settings is currently scoped to, as resolved by the enclosing `SettingsShell`. */
 export declare function useSettingsShell(): SettingsShellContextValue;

package/dist/apps/shared/components/settings/layout/SettingsShell.js

@@ -3,7 +3,7 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { createContext, useContext, useEffect, useMemo, useState } from "react";
+import { createContext, useCallback, useContext, useEffect, useMemo, useState } from "react";
 import { HiOutlineArrowUturnLeft, HiOutlineBars3, HiOutlineEnvelopeOpen, HiOutlineFunnel, HiOutlineLockClosed, HiOutlineNoSymbol, HiOutlinePaintBrush, HiOutlinePencilSquare, HiOutlineShieldCheck, HiOutlineTag, HiOutlineUserCircle, HiOutlineUsers, } from "react-icons/hi2";
 import { ApiRequestError } from "../../../../../lib/util/api.js";
 import Drawer from "../../../../../lib/components/overlays/Drawer.js";
@@ -89,7 +89,8 @@ export default function SettingsShell({ active, userUid, authServerUrl, imperson
     }, [userUid]);
     const mailboxUid = (requestedMailboxUid && mailboxes.some((mb) => mb.uid === requestedMailboxUid) ? requestedMailboxUid : undefined) ??
         primaryMailboxUid(mailboxes, userUid);
-    const contextValue = useMemo(() => ({ mailboxUid, mailboxes }), [mailboxUid, mailboxes]);
+    const patchMailbox = useCallback((uid, patch) => setMailboxes((list) => list.map((mb) => (mb.uid === uid ? { ...mb, ...patch } : mb))), []);
+    const contextValue = useMemo(() => ({ mailboxUid, mailboxes, patchMailbox }), [mailboxUid, mailboxes, patchMailbox]);
     // A full-screen takeover, not nested inside the rest of the app's chrome — same as ContactsShell/
     // TasksShell, there's nothing else for a mailbox-less caller to configure here yet.
     if (userUid && status === "ready" && !mailboxUid) {

package/dist/apps/shared/mail/decryptedMessages.d.ts

@@ -32,4 +32,4 @@ export declare function useUnlockEpoch(): number;
  * Decrypts one message to recover its subject and preview, when its mailbox's keys are unlocked and it isn't already known. Best effort: a
  * message that can't be fetched or opened is simply left as it was. Never prompts.
  */
-export declare function decryptForDisplay(uid: string, mailboxUid: string): Promise<void>;
+export declare function decryptForDisplay(uid: string, mailboxUid: string, sealedSummary?: string): Promise<void>;

package/dist/apps/shared/mail/decryptedMessages.js

@@ -113,16 +113,24 @@ export function useUnlockEpoch() {
  * Decrypts one message to recover its subject and preview, when its mailbox's keys are unlocked and it isn't already known. Best effort: a
  * message that can't be fetched or opened is simply left as it was. Never prompts.
  */
-export async function decryptForDisplay(uid, mailboxUid) {
+export async function decryptForDisplay(uid, mailboxUid, sealedSummary) {
     const unlocked = getUnlockedKeys(mailboxUid);
     if (!unlocked || entries[uid] || inFlight.has(uid) || decryptFailedBefore(uid)) {
         return;
     }
     inFlight.add(uid);
     try {
+        const securityApi = await import("../../../lib/crypto/messageSecurity.js");
+        // A message sealed at rest has its subject and preview sealed on its row: opening that small summary saves downloading it.
+        const summary = sealedSummary ? await securityApi.openZeroAccessSummary(sealedSummary, unlocked.zeroAccessKeys) : undefined;
+        if (summary) {
+            if (getUnlockedKeys(mailboxUid) === unlocked) {
+                rememberDecrypted(uid, mailboxUid, { subject: summary.subject, preview: summary.preview.slice(0, PREVIEW_MAX_LENGTH) });
+            }
+            return;
+        }
         const rawMime = await getMessageRawContent(uid);
-        const { evaluateMessageSecurity } = await import("../../../lib/crypto/messageSecurity.js");
-        const security = await evaluateMessageSecurity(rawMime, unlocked);
+        const security = await securityApi.evaluateMessageSecurity(rawMime, unlocked);
         // A lock while this ran: the result must not go back on screen.
         if (getUnlockedKeys(mailboxUid) === unlocked) {
             rememberDecrypted(uid, mailboxUid, { subject: security.subject, preview: security.html ? previewOf(security.html) : security.text?.slice(0, PREVIEW_MAX_LENGTH) });

package/dist/apps/shared/mail/outbox/sendJob.d.ts

@@ -1,6 +1,7 @@
 import { type ApiClient } from "../../../../lib/util/api.js";
 import { Attachment, ComposeRecipientInput, DraftThreading, Mailbox, Message } from "../../../../lib/mail/mailApi.js";
 import { RecipientEncryptionStatus } from "../../../../lib/crypto/composeSecurity.js";
+import { type UnlockedKeys } from "../../../../lib/crypto/keySession.js";
 import { EncryptionPolicy } from "../../../../lib/crypto/keyvaultApi.js";
 import { SendDecisionInput } from "./sendDecision.js";
 import { OutboxCountTracker } from "./sendState.js";
@@ -39,20 +40,52 @@ export interface SendRequest {
      * show the message as soon as it is sent (see `outgoingReplies.ts`). Absent for a new message, and for a draft opened again, which the draft's own
      * `inReplyTo`/`references` stand in for. */
     threading?: DraftThreading;
+    /** The copies of this message (`assemble()`: one per encryption format) already built but not handed over yet, after an attempt that
+     * failed part-way: a retry hands over just these - never one that already went, and without building them again. */
+    pendingCopies?: Message[];
+    /** Some copies already went (`pendingCopies` holds only the rest): every later failure says so, and never offers "Open draft", which
+     * would send those recipients a second copy - kept across any number of retries. */
+    partial?: boolean;
+    /** The uids of every copy of this message, when it is more than one (one per encryption format, each delivered only to its own
+     * recipients): the request is retained under each, and a failure the server reports later for one of them offers no "Open draft",
+     * which would send the other copy's recipients a second message. */
+    copyUids?: string[];
+    /** What has become of each of those copies, by uid: one map shared by every request made from this one (a retry's, the one retained), so
+     * how any copy went is known to all of them. */
+    copyFates?: Map<string, CopyFate>;
 }
+/** One copy of a message sent as several (`SendRequest.copyFates`): `unsent` - not handed over (or its hand-over failed), `pending` - handed
+ * over, how it went still to be reported, `sent`, or `failed` - the server reported it couldn't relay it. */
+export type CopyFate = "unsent" | "pending" | "sent" | "failed";
 /** How long a background send waits for the mailbox / encryption policy it did not have, before it goes ahead treating them as unknown. Nobody waits for it. */
 export declare const CONTEXT_GRACE_MS = 4000;
 export declare function registerOutboxCounter(tracker: (mailboxUid: string) => OutboxCountTracker, onQueued: (mailboxUid: string) => void): () => void;
-/** The request a message was queued from, while this tab still holds it: what lets "Open draft" and "Retry" work on a failure the server reports later. */
+/** The request a message was queued from, while this tab still holds it: what lets "Open draft" and "Retry" work on a failure the server
+ * reports later. A message sent as several copies (`SendRequest.copyUids`) is held under each copy still to go, from just before it is handed
+ * over - how the first went can be reported while the next is still being handed over. */
 export declare function retainedRequest(draftUid: string): SendRequest | undefined;
-/** Drops the request a message was queued from, and the pictures remembered as attached to its draft: it has gone, so neither is wanted again. */
-export declare function forgetRetainedRequest(draftUid: string): void;
+/** Drops the request a message (or one of its copies) was queued from, and the pictures remembered as attached to its draft: it has gone, so
+ * neither is wanted again. Whether the message has now gone in full - the last of its copies to go. */
+export declare function forgetRetainedRequest(draftUid: string): boolean;
+/** Records that the server couldn't relay copy `uid` of the message `request` sent as several copies (nothing for a message sent as one). */
+export declare function copyFailed(request: SendRequest | undefined, uid: string): void;
+/** Copy `uid` of the message `request` sent as several copies is handed over again (a Retry): how it goes is to be reported once more, and
+ * finds the request held under it. Nothing for a message sent as one. */
+export declare function copyRetried(request: SendRequest | undefined, uid: string): void;
+/** Every copy of the message `request` sent as several, when none of them has gone nor may still go - each failed, or was never handed over:
+ * nobody has the message. `undefined` while one has gone or may, and for a message sent as one. */
+export declare function unsentCopies(request: SendRequest | undefined): string[] | undefined;
+/** Stops holding a message sent as several copies under any of them: it is being written again. */
+export declare function forgetCopies(fates: Map<string, CopyFate>): void;
 /** The sender's signing/encryption key state right now, read from the tab's key session (they can lock mid-send). */
 export declare function readSendKeys(mailboxUid: string, signEnabled: boolean, mailbox: Mailbox | undefined): {
-    unlocked: import("../../../../lib/crypto/keySession.js").UnlockedKeys | undefined;
+    unlocked: UnlockedKeys | undefined;
     canSign: boolean;
     canEncryptSelf: boolean;
 };
+/** Whether the sender can make an OpenPGP copy (it is encrypted to them too, with their own OpenPGP key) - or can't be told yet, the
+ * mailbox being locked: `decideSend()` then asks for the unlock rather than settling for another format, or none. */
+export declare function senderCanUseOpenPgp(unlocked: UnlockedKeys | undefined): boolean;
 /** Whether this sender could encrypt at all: an encryption key unlocked here, enrolled on the mailbox, or offered earlier this session. */
 export declare function senderHasEncryptionKey(request: Pick<SendRequest, "mailbox" | "offeredEncrypt">, canEncryptSelf: boolean): boolean;
 /** The input `decideSend()` reads, from a request and what has been looked up. */