@rapidmx/web-client 0.35.0 → 0.37.0

package/lib/calendar/calendarApi.ts

@@ -7,8 +7,12 @@
  * expansion happens entirely client-side (see `apps/shared/lib/recurrence.ts`) — the backend stores/returns
  * `RecurrenceRule` as-is and does no RFC5545 expansion of its own. */
 
-import { ApiClient, withClient } from "../util/api.js";
+import { ApiClient, ApiRequestError, withClient } from "../util/api.js";
 import { ListParams, buildQuery } from "../util/apiQuery.js";
+import { INVALID_REQUEST_CODE, guardSealedMove } from "../zeroAccess/sealedMoves.js";
+import { isOpenedRecord, isProtectedRecord, openSealedRecord, openSealedRecords } from "../zeroAccess/sealedRecords.js";
+import { EVENT_CONTENT_FIELDS, type InvitationContent, invitationContentOf, isSealedContentOpened, markSealedContentOpened, protectedEventWrite } from "./protectedEvents.js";
+import { meetingLinkSecrets } from "../videoconf/protectedMeetings.js";
 
 export type AttendeeRole = "required" | "optional" | "resource";
 export type AttendeeResponseStatus = "needsAction" | "accepted" | "declined" | "tentative";
@@ -135,6 +139,13 @@ export interface CalendarEvent {
      * `mailto` only). Still to be rendered through `sanitizeEventDescriptionHtml()` (`eventDescription.ts`), never trusted as it stands. `null` or absent:
      * the description, if any, is plain text. */
     descriptionHtml?: string | null;
+    /** Response-only. An event made from an invitation that reached a zero-access mailbox: its title, location and description are only
+     * sealed to the mailbox's zero-access key (`title` is `[...]`). `apps/shared/calendar/sealedEvents.ts` opens them. */
+    sealedContent?: { keyFingerprint: string; sealed: string };
+    /** Response-only. An event of a calendar zero-access encryption protects: its title, location and description, each sealed to the
+     * mailbox's zero-access key (the readable `title` is "Protected event"). Every function here returns events with them opened when the
+     * mailbox is unlocked (`lib/zeroAccess/sealedRecords.ts`); writes go through `protectedEvents.ts`. */
+    sealedFields?: Record<string, string> | null;
     /** Who may see the event's details - absent (or `null`, on a row stored before this existed) reads as `"default"`; see `visibilityOf()`. */
     visibility?: EventVisibility | null;
     /** Whether the guests may ask for the event to change (default `false`). Absent or `null` reads as the default; see `guestPermissionsOf()`. */
@@ -170,6 +181,22 @@ const EVENT_SORT = JSON.stringify({ uid: "ASC" });
  * `LIST_CALENDAR_EVENTS_MAX_PAGES` pages guards against looping forever should a server ever ignore
  * `page` and keep returning full pages.
  */
+/** What a list opens of a protected event: what the calendar views draw. Each field is one decryption, and a calendar lists every event
+ * it has - the rest (the description) is opened by the view that shows or edits it, by a search, and by a save. */
+export const EVENT_LIST_FIELDS = ["title", "location"] as const;
+
+/** `event` with every protected field opened, when only some were (a listed event) - for a write, which sends only what changed and
+ * invites with the whole content. The title of one whose `sealedContent` was opened stays: a row can hold both, and its per-field copy
+ * (`sealedFields.title`) is then an older title the sealed content's replaced (renamed since) - or, sealed without one, the same title
+ * `openSealedEvents()` already shows. */
+export async function fullyOpenedEvent<T extends CalendarEvent | undefined>(event: T): Promise<T> {
+    if (!event || !isProtectedRecord(event) || isOpenedRecord(event)) {
+        return event;
+    }
+    const full = await openSealedRecord(event);
+    return isSealedContentOpened(event) ? { ...full, title: event.title } : full;
+}
+
 export async function listCalendarEvents(folderUid: string, client?: ApiClient): Promise<CalendarEvent[]> {
     const events: CalendarEvent[] = [];
     for (let page = 0; page < LIST_CALENDAR_EVENTS_MAX_PAGES; page++) {
@@ -182,11 +209,14 @@ export async function listCalendarEvents(folderUid: string, client?: ApiClient):
             break;
         }
     }
-    return events;
+    return openSealedRecords(events, EVENT_LIST_FIELDS);
 }
 
-export function getCalendarEvent(uid: string, client?: ApiClient): Promise<CalendarEvent> {
-    return withClient(client, `/mail/calendar-events/${encodeURIComponent(uid)}`);
+/** An event the server returned, opened. */
+const opened = (event: CalendarEvent): Promise<CalendarEvent> => openSealedRecord(event);
+
+export async function getCalendarEvent(uid: string, client?: ApiClient): Promise<CalendarEvent> {
+    return opened(await withClient<CalendarEvent>(client, `/mail/calendar-events/${encodeURIComponent(uid)}`));
 }
 
 export interface CalendarEventInput {
@@ -218,10 +248,18 @@ export interface CalendarEventInput {
     guestsCanModify?: boolean;
     guestsCanInviteOthers?: boolean;
     guestsCanSeeGuestList?: boolean;
+    /**
+     * What the server sends a protected event's save-time invitations with (restapi `BaseCalendarEventRoute.takeInvitationContent()`).
+     * On a create, `{ defer: true }` holds them back for the save that follows - the event editor's, which attaches the video meeting and
+     * its link keys first - so attendees get one invitation, the one with the link. On an update, `{ defer: true }` sends none with this
+     * save either (they stay pending), and a content (`title`...) is what `updateCalendarEvent()` invites with when `current` couldn't be
+     * opened on this device - the content it opened wins otherwise.
+     */
+    invitationContent?: Partial<InvitationContent> & { defer?: boolean };
 }
 
-export function createCalendarEvent(input: CalendarEventInput, client?: ApiClient): Promise<CalendarEvent> {
-    return withClient(client, "/mail/calendar-events", {
+export async function createCalendarEvent(input: CalendarEventInput, client?: ApiClient): Promise<CalendarEvent> {
+    const created = await withClient<CalendarEvent>(client, "/mail/calendar-events", {
         method: "POST",
         body: JSON.stringify({
             allDay: false,
@@ -233,6 +271,7 @@ export function createCalendarEvent(input: CalendarEventInput, client?: ApiClien
             ...input,
         }),
     });
+    return opened(created);
 }
 
 export interface UpdateCalendarEventInput extends Partial<CalendarEventInput> {
@@ -240,10 +279,87 @@ export interface UpdateCalendarEventInput extends Partial<CalendarEventInput> {
     version: number;
 }
 
-export function updateCalendarEvent(input: UpdateCalendarEventInput, client?: ApiClient): Promise<CalendarEvent> {
-    return withClient(client, `/mail/calendar-events/${encodeURIComponent(input.uid)}`, {
-        method: "PUT",
-        body: JSON.stringify(input),
+/** Saves `input`. `current` is the event as this device shows it: for an event of a protected calendar, the write then sends only the
+ * content that changed, and the content the server invites with (`protectedEventWrite()`; `input.invitationContent` when `current` isn't
+ * opened, none with `{ defer: true }`). For an event whose video meeting is protected,
+ * every attendee's link key goes with it (`meetingLinkSecrets()`), for the server to add to their links in the invitations it sends. */
+export function updateCalendarEvent(input: UpdateCalendarEventInput, client?: ApiClient, current?: CalendarEvent): Promise<CalendarEvent> {
+    // A move of a protected event to another mailbox is refused (`SealedMoveError`), before anything is opened or sent when `current` says so.
+    return guardSealedMove(current, input.mailboxUid, () => saveCalendarEvent(input, client, current));
+}
+
+/** The title restapi shows for an event whose title is sealed (its `PROTECTED_SUBJECT`). */
+const PLACEHOLDER_TITLE = "[...]";
+
+/** What `SealedEventContentError` says. */
+export const SEALED_EVENT_CONTENT_MESSAGE =
+    "This event came from an invitation to a zero-access mailbox and its details are sealed, so its location or description can only be changed together with its title. Unlock your mailbox, open the event again and make the change there.";
+
+/**
+ * restapi's refusal (409) of a location or description change to an event made from a zero-access invitation (`sealedContent`) sent
+ * with its placeholder title or none: resealing would lose the title. `saveCalendarEvent()` leaves out the placeholders of one it hasn't
+ * opened, so this comes back only when this device didn't know the event was sealed (it was filed sealed after it was loaded). An
+ * `ApiRequestError` (409), as `SealedMoveError` is, so the event dialog and the drag handler show its message.
+ */
+export class SealedEventContentError extends ApiRequestError {
+    constructor() {
+        super(SEALED_EVENT_CONTENT_MESSAGE, 409, "sealed-event-content");
+        this.name = "SealedEventContentError";
+    }
+}
+
+/** Whether `err` is restapi's refusal of `body`, a write carrying a location or description without a real title. */
+function isSealedContentTitleRefusal(err: unknown, body: Record<string, any>): boolean {
+    const hasValue = (field: string): boolean => body[field] !== undefined && body[field] !== null && body[field] !== "";
+    return (
+        err instanceof ApiRequestError &&
+        err.status === 409 &&
+        err.code === INVALID_REQUEST_CODE &&
+        (body.title === undefined || body.title === PLACEHOLDER_TITLE) &&
+        ["location", "description", "descriptionHtml"].some(hasValue)
+    );
+}
+
+async function saveCalendarEvent(input: UpdateCalendarEventInput, client: ApiClient | undefined, current: CalendarEvent | undefined): Promise<CalendarEvent> {
+    current = await fullyOpenedEvent(current);
+    const { invitationContent: given, ...changes } = input;
+    const body: Record<string, any> = protectedEventWrite(current, changes);
+    if (given?.defer) {
+        body.invitationContent = { defer: true };
+    } else if (given?.title && !body.invitationContent && isProtectedRecord(current)) {
+        body.invitationContent = { title: given.title, location: given.location, description: given.description, descriptionHtml: given.descriptionHtml };
+    }
+    // A save that defers its invitations sends no link keys either: they go with the save that invites.
+    const secrets = given?.defer
+        ? undefined
+        : await meetingLinkSecrets(
+              { videoMeetingUid: input.videoMeetingUid ?? current?.videoMeetingUid, attendees: input.attendees ?? current?.attendees, organizer: current?.organizer ?? input.organizer },
+              client,
+          );
+    if (secrets) {
+        body.invitationContent = { ...(body.invitationContent ?? {}), meetingLinkSecrets: secrets };
+    }
+    let updated: CalendarEvent;
+    try {
+        updated = await withClient<CalendarEvent>(client, `/mail/calendar-events/${encodeURIComponent(input.uid)}`, {
+            method: "PUT",
+            body: JSON.stringify(body),
+        });
+    } catch (err) {
+        throw isSealedContentTitleRefusal(err, body) ? new SealedEventContentError() : err;
+    }
+    if (!updated.sealedContent || !isSealedContentOpened(current)) {
+        return opened(updated);
+    }
+    // An event made from a zero-access invitation, opened here, comes back with its placeholders: shown with the content this save sealed
+    // again (`protectedEventWrite()` sends all of it, or none and the sealed content stays), so a save that follows still writes it whole.
+    const content = Object.fromEntries(EVENT_CONTENT_FIELDS.map((field) => [field, field in body ? body[field] : current![field]]));
+    return markSealedContentOpened({
+        ...(await opened(updated)),
+        title: content.title ?? "",
+        location: content.location ?? undefined,
+        description: content.description ?? null,
+        descriptionHtml: content.descriptionHtml ?? null,
     });
 }
 
@@ -262,17 +378,21 @@ export type AttendeeResponseInput = Exclude<AttendeeResponseStatus, "needsAction
  * `"accepted"`/`"tentative"` the whole updated `CalendarEvent` comes back, with only the calling
  * attendee's own `responseStatus` changed. On `"declined"`, the backend instead soft-deletes the
  * mailbox's own copy of the event and returns only `{ uid }` — the caller should treat a decline the
- * same as a delete rather than expecting an updated event back.
+ * same as a delete rather than expecting an updated event back. `current` (the event as this device shows it) names a protected event's
+ * reply by its real title (`invitationContentOf()`).
  */
-export function respondToEvent(
+export async function respondToEvent(
     uid: string,
     responseStatus: AttendeeResponseInput,
     client?: ApiClient,
+    current?: CalendarEvent,
 ): Promise<CalendarEvent | { uid: string }> {
-    return withClient(client, `/mail/calendar-events/${encodeURIComponent(uid)}/respond`, {
+    const invitationContent = invitationContentOf(await fullyOpenedEvent(current));
+    const result = await withClient<CalendarEvent | { uid: string }>(client, `/mail/calendar-events/${encodeURIComponent(uid)}/respond`, {
         method: "POST",
-        body: JSON.stringify({ responseStatus }),
+        body: JSON.stringify(invitationContent ? { responseStatus, invitationContent } : { responseStatus }),
     });
+    return "mailboxUid" in result ? opened(result) : result;
 }
 
 /** A change a guest asks the organizer for (`requestEventChange()`): only what is to differ. */
@@ -301,11 +421,17 @@ export interface EventChangeRequestResult {
  * Asks the organizer to change an event, as a guest (not the organizer) whose copy allows it: the title, location, description or time need
  * `guestsCanModify`, added guests need `guestsCanInviteOthers` (403 otherwise; 400 when nothing differs from what the event has, or a value is invalid).
  * Nothing changes on this mailbox's own copy - the request is mailed to the organizer, and when the change is allowed it is applied there and
- * arrives back later as an ordinary update of the invitation.
+ * arrives back later as an ordinary update of the invitation. `invitationContent` (the event's real content, `invitationContentOf()`)
+ * names a protected event in the request by its real title.
  */
-export function requestEventChange(uid: string, request: EventChangeRequest, client?: ApiClient): Promise<EventChangeRequestResult> {
+export function requestEventChange(
+    uid: string,
+    request: EventChangeRequest,
+    client?: ApiClient,
+    invitationContent?: InvitationContent,
+): Promise<EventChangeRequestResult> {
     return withClient(client, `/mail/calendar-events/${encodeURIComponent(uid)}/request-change`, {
         method: "POST",
-        body: JSON.stringify(request),
+        body: JSON.stringify(invitationContent ? { ...request, invitationContent } : request),
     });
 }

package/lib/calendar/calendarMutations.ts

@@ -22,12 +22,17 @@ import {
     UpdateCalendarEventInput,
     createCalendarEvent,
     deleteCalendarEvent,
+    fullyOpenedEvent,
     getCalendarEvent,
     listCalendarEvents,
     updateCalendarEvent,
 } from "./calendarApi.js";
-import { CalendarOccurrence, fromEventWallClock, toEventWallClock } from "./recurrence.js";
-import { ApiClient } from "../util/api.js";
+import { CalendarOccurrence, fromEventWallClock, seriesEndDate, toEventWallClock } from "./recurrence.js";
+import { ApiClient, ApiRequestError } from "../util/api.js";
+import { KeysLockedError } from "../crypto/masterKey.js";
+import { isOpenedRecord, isProtectedRecord } from "../zeroAccess/sealedRecords.js";
+import { followMeetingKeyExpiry } from "../videoconf/protectedMeetings.js";
+import { isSealedContentOpened, markSealedContentOpened } from "./protectedEvents.js";
 
 /** `client`, given by every function below, is an explicit `ApiClient` from `createApiClient()` (e.g. one
  * account of a multi-account app) to call instead of the default global `apiFetch()` - see `withClient()`'s
@@ -36,6 +41,24 @@ import { ApiClient } from "../util/api.js";
 
 const MS_PER_DAY = 24 * 60 * 60 * 1000;
 
+/** What `SealedOccurrenceError` says. */
+export const SEALED_OCCURRENCE_MESSAGE =
+    "This event came from an invitation to a zero-access mailbox, so one occurrence of it can't be changed on its own when it moves to another calendar or the server can't keep it protected. Change the entire series, or ask the organizer to.";
+
+/**
+ * One occurrence of an event made from an invitation that reached a zero-access mailbox (`sealedContent`) that `detachOccurrence()` can't
+ * split off without its content being stored readable: one moved to another calendar (restapi re-seals a detached occurrence's content
+ * only in the calendar of the series it belongs to; it refuses to move a sealed event for the same reason), or one a server stored
+ * unsealed (one from before restapi re-sealed such a create - the copy is deleted at once). An `ApiRequestError` (409), as
+ * `SealedMoveError` is, so the event dialog and the drag handler show its message.
+ */
+export class SealedOccurrenceError extends ApiRequestError {
+    constructor() {
+        super(SEALED_OCCURRENCE_MESSAGE, 409, "sealed-occurrence");
+        this.name = "SealedOccurrenceError";
+    }
+}
+
 function positiveModulo(value: number, modulus: number): number {
     return ((value % modulus) + modulus) % modulus;
 }
@@ -49,6 +72,7 @@ function addException(event: CalendarEvent, occurrenceStart: string, client?: Ap
             recurrenceRule: { ...rule, exceptions: [...rule.exceptions, occurrenceStart] },
         },
         client,
+        event,
     );
 }
 
@@ -84,7 +108,7 @@ export async function saveEventSeries(
     // master's existing (unchanged) instant onto a different wall clock, exactly as the doc comment above
     // promises - so all three fields, not just startDate, gate entry into the shift path below.
     if (fields.startDate === undefined && fields.timezone === undefined && fields.allDay === undefined) {
-        return updateCalendarEvent(update, client);
+        return updateCalendarEvent(update, client, occurrence);
     }
     const master = await getCalendarEvent(occurrence.uid, client);
     const newTimezone = fields.timezone ?? master.timezone;
@@ -93,7 +117,7 @@ export async function saveEventSeries(
     const newStartInstant = Date.parse(fields.startDate ?? master.startDate);
     const deltaWallMs = toEventWallClock(newStartInstant, newTimezone, newAllDay) - oldStartWall;
     if (deltaWallMs === 0 && newTimezone === master.timezone && newAllDay === master.allDay) {
-        return updateCalendarEvent(update, client);
+        return updateCalendarEvent(update, client, occurrence);
     }
     // An occurrence is identified by its nominal wall-clock start (the rule's date + the master's time of day),
     // not by the instant's own wall time: one that fell in a DST gap was pushed forward (02:30 -> 03:30 EDT),
@@ -112,7 +136,7 @@ export async function saveEventSeries(
     if (rule) {
         update.recurrenceRule = { ...rule, exceptions: rule.exceptions.map(shift) };
     }
-    const saved = await updateCalendarEvent(update, client);
+    const saved = await updateCalendarEvent(update, client, occurrence);
 
     let detachedOccurrenceSyncFailed = false;
     try {
@@ -126,6 +150,7 @@ export async function saveEventSeries(
                 await updateCalendarEvent(
                     { uid: event.uid, version: event.version, recurrenceId: shift(event.recurrenceId!) } as UpdateCalendarEventInput,
                     client,
+                    event,
                 );
             } catch {
                 detachedOccurrenceSyncFailed = true;
@@ -148,12 +173,34 @@ export async function saveEventSeries(
  * original start as its `recurrenceId` (the RFC5545 way of identifying a modified instance), and never
  * carries the series' `recurrenceRule` — even if `fields` includes one (e.g. the event modal's full
  * field set).
+ *
+ * A protected occurrence (zero-access) is copied from its opened content: one that can't be opened here - its mailbox is locked - holds
+ * only placeholders, which the new event would store as its real title, location and description. It throws `KeysLockedError` instead,
+ * before anything is written. One of an event made from a zero-access invitation (`sealedContent`) is sent opened too: restapi's create
+ * seals it again to the series' key (`prepareCreate()` finds the series by `icalUid` in the same mailbox), storing only placeholders, and
+ * the event returned is marked opened with the content sent. Moved to another calendar it throws `SealedOccurrenceError` before anything
+ * is sent (the series isn't there to seal it to), and a copy the server returns unsealed is deleted and refused the same way.
  */
 export async function detachOccurrence(
     occurrence: CalendarOccurrence,
     fields: Partial<CalendarEventInput>,
     client?: ApiClient,
 ): Promise<CalendarEvent> {
+    occurrence = await fullyOpenedEvent(occurrence);
+    // Nor one of an event made from an invitation to a zero-access mailbox (`sealedContent`) whose content wasn't opened - asked of the
+    // mark, not of its title: an untitled one opens to an empty title, and a title can be anything.
+    if ((isProtectedRecord(occurrence) && !isOpenedRecord(occurrence)) || (occurrence.sealedContent && !isSealedContentOpened(occurrence))) {
+        throw new KeysLockedError("This event is protected and your mailbox is locked. Unlock it to change one occurrence of the event.");
+    }
+    const sealedContent: boolean = !!occurrence.sealedContent;
+    // Sealed again only in the series' own calendar (see `SealedOccurrenceError`).
+    if (
+        sealedContent &&
+        ((fields.mailboxUid !== undefined && fields.mailboxUid !== occurrence.mailboxUid) ||
+            (fields.folderUid !== undefined && fields.folderUid !== occurrence.folderUid))
+    ) {
+        throw new SealedOccurrenceError();
+    }
     const originalStart = occurrence.recurrenceId!;
     // `icalUid`/`recurrenceId` aren't part of `CalendarEventInput`, but `@rapidmx/restapi`'s
     // `CalendarEvent` model accepts both on create (and `createCalendarEvent` already sends `icalUid`).
@@ -186,13 +233,27 @@ export async function detachOccurrence(
         recurrenceId: originalStart,
     };
     const created = await createCalendarEvent(input, client);
+    if (sealedContent && !created.sealedContent) {
+        // A server that stored the opened content readable: taken back at once, and the occurrence left as it was.
+        await deleteCalendarEvent(created.uid, created.version, client).catch(() => undefined);
+        throw new SealedOccurrenceError();
+    }
     try {
         await addException(occurrence, originalStart, client);
     } catch (err) {
         await deleteCalendarEvent(created.uid, created.version, client).catch(() => undefined);
         throw err;
     }
-    return created;
+    // Stored with placeholders: shown with the content it was given, as an opened event.
+    return sealedContent
+        ? markSealedContentOpened({
+              ...created,
+              title: input.title,
+              location: input.location,
+              description: input.description ?? null,
+              descriptionHtml: input.descriptionHtml ?? null,
+          })
+        : created;
 }
 
 /** Deletes an entire recurring series (or a genuinely non-recurring event) outright. */
@@ -211,14 +272,22 @@ export function deleteEventOccurrence(occurrence: CalendarOccurrence, client?: A
  * drag behavior, which never silently reschedules an entire series from a single dragged instance;
  * moving the whole series is only ever done explicitly, via the event modal's "entire series" option.
  */
+/** Saves new times of non-recurring `occurrence`, then moves its video meeting's key expiry to follow the new end: a protected meeting's key is
+ * discarded an hour after the end it was made for, so a meeting dragged later couldn't be joined. Best effort - it never fails the move. */
+async function reschedule(occurrence: CalendarOccurrence, times: { startDate?: string; endDate: string }, client: ApiClient | undefined): Promise<CalendarEvent> {
+    const saved = await updateCalendarEvent({ uid: occurrence.uid, version: occurrence.version, ...times }, client, occurrence);
+    if (saved.videoMeetingUid) {
+        await followMeetingKeyExpiry(saved.videoMeetingUid, seriesEndDate(saved), client);
+    }
+    return saved;
+}
+
 export function moveOccurrence(occurrence: CalendarOccurrence, deltaMs: number, client?: ApiClient): Promise<CalendarEvent> {
     const fields = {
         startDate: new Date(new Date(occurrence.startDate).getTime() + deltaMs).toISOString(),
         endDate: new Date(new Date(occurrence.endDate).getTime() + deltaMs).toISOString(),
     };
-    return occurrence.isRecurringOccurrence
-        ? detachOccurrence(occurrence, fields, client)
-        : updateCalendarEvent({ uid: occurrence.uid, version: occurrence.version, ...fields }, client);
+    return occurrence.isRecurringOccurrence ? detachOccurrence(occurrence, fields, client) : reschedule(occurrence, fields, client);
 }
 
 /**
@@ -230,7 +299,5 @@ export function resizeOccurrenceEnd(occurrence: CalendarOccurrence, newEndDate:
     const start = new Date(occurrence.startDate);
     const minEnd = new Date(start.getTime() + 15 * 60_000);
     const endDate = (newEndDate.getTime() > minEnd.getTime() ? newEndDate : minEnd).toISOString();
-    return occurrence.isRecurringOccurrence
-        ? detachOccurrence(occurrence, { endDate }, client)
-        : updateCalendarEvent({ uid: occurrence.uid, version: occurrence.version, endDate }, client);
+    return occurrence.isRecurringOccurrence ? detachOccurrence(occurrence, { endDate }, client) : reschedule(occurrence, { endDate }, client);
 }

package/lib/calendar/inviteApi.ts

@@ -9,7 +9,19 @@
  * it now stands, ready to draw. */
 
 import { ApiClient, ApiRequestError, withClient } from "../util/api.js";
-import type { EventVisibility, GuestPermissions } from "./calendarApi.js";
+import { followMeetingKeyExpiry, meetingLinkSecrets } from "../videoconf/protectedMeetings.js";
+import { isProtectedRecord } from "../zeroAccess/sealedRecords.js";
+import { type CalendarEvent, type EventVisibility, type GuestPermissions, getCalendarEvent } from "./calendarApi.js";
+import { type InvitationContent, invitationContentOf } from "./protectedEvents.js";
+import { seriesEndDate } from "./recurrence.js";
+import { sealedInviteCalendar } from "./sealedInvites.js";
+
+/** The calendar file to send for `messageUid` - a zero-access message this device decrypted (`sealedInvites.ts`) - as the request body's
+ * `ics`, or nothing for a message the server reads itself. */
+function sealedSource(messageUid: string): { ics?: string } {
+    const ics = sealedInviteCalendar(messageUid);
+    return ics !== undefined ? { ics } : {};
+}
 
 /** What the reader can answer an invitation with. */
 export type InviteResponse = "accepted" | "tentative" | "declined";
@@ -104,8 +116,15 @@ export interface MessageInvite {
  * common, expected answer for a message that merely has an attachment - and rejects for any other failure.
  */
 export async function getMessageInvite(messageUid: string, client?: ApiClient): Promise<MessageInvite | null> {
+    const source = sealedSource(messageUid);
     try {
-        return await withClient<MessageInvite>(client, `/mail/calendar-events/invite/${encodeURIComponent(messageUid)}`);
+        // A zero-access message's invitation is read from the calendar file decrypted here (`POST .../view`).
+        return source.ics !== undefined
+            ? await withClient<MessageInvite>(client, `/mail/calendar-events/invite/${encodeURIComponent(messageUid)}/view`, {
+                  method: "POST",
+                  body: JSON.stringify(source),
+              })
+            : await withClient<MessageInvite>(client, `/mail/calendar-events/invite/${encodeURIComponent(messageUid)}`);
     } catch (err) {
         if (err instanceof ApiRequestError && err.status === 404) {
             return null;
@@ -122,13 +141,17 @@ export async function getMessageInvite(messageUid: string, client?: ApiClient):
 export function respondToMessageInvite(messageUid: string, responseStatus: InviteResponse, client?: ApiClient): Promise<MessageInvite> {
     return withClient(client, `/mail/calendar-events/invite/${encodeURIComponent(messageUid)}/respond`, {
         method: "POST",
-        body: JSON.stringify({ responseStatus }),
+        body: JSON.stringify({ responseStatus, ...sealedSource(messageUid) }),
     });
 }
 
 /** Takes a canceled meeting off the reader's calendar. Resolves with the invitation as it now stands. */
 export function removeMessageInvite(messageUid: string, client?: ApiClient): Promise<MessageInvite> {
-    return withClient(client, `/mail/calendar-events/invite/${encodeURIComponent(messageUid)}/remove`, { method: "POST" });
+    const source = sealedSource(messageUid);
+    return withClient(client, `/mail/calendar-events/invite/${encodeURIComponent(messageUid)}/remove`, {
+        method: "POST",
+        ...(source.ics !== undefined ? { body: JSON.stringify(source) } : {}),
+    });
 }
 
 /** A different time to suggest to the organizer. */
@@ -144,11 +167,81 @@ export interface ProposedTime {
 export function proposeNewTime(messageUid: string, proposal: ProposedTime, client?: ApiClient): Promise<MessageInvite> {
     return withClient(client, `/mail/calendar-events/invite/${encodeURIComponent(messageUid)}/propose`, {
         method: "POST",
-        body: JSON.stringify(proposal),
+        body: JSON.stringify({ ...proposal, ...sealedSource(messageUid) }),
     });
 }
 
-/** Accepts an attendee's proposed time (a `COUNTER`) for a meeting the reader organizes: the server moves the event and sends the attendees the update. Resolves with the invitation as it now stands. */
-export function acceptProposal(messageUid: string, client?: ApiClient): Promise<MessageInvite> {
-    return withClient(client, `/mail/calendar-events/invite/${encodeURIComponent(messageUid)}/accept-proposal`, { method: "POST" });
+/** Opens an event's `sealedContent` with the mailbox's unlocked keys (`apps/shared/calendar/sealedEvents.ts` `openSealedEvent()`), marking it
+ * opened, or returns it as it is when it can't. */
+export type SealedContentOpener = (event: CalendarEvent) => Promise<CalendarEvent>;
+
+/** What `acceptProposal()` refuses with, before sending anything, for a protected meeting this device can't open (its mailbox is locked). */
+export const PROTECTED_PROPOSAL_MESSAGE = "This meeting is protected. Unlock your mailbox to accept the proposed time, so its guests can be sent the new time.";
+
+/**
+ * What the server needs to send the moved meeting's invitations itself (`invitationContent`): for a meeting of a protected calendar
+ * (`sealedFields`), or made from a zero-access invitation (`sealedContent`, opened with `openSealedContent`), its real title, location and
+ * description, and for a meeting protected by a per-meeting key every guest's link key
+ * (`meetingLinkSecrets`) - with the event as read. No content for a meeting that needs neither (the server's scheduling job invites for it),
+ * and nothing at all for one that isn't on the calendar or can't be read. A protected meeting this device can't open is refused (`PROTECTED_PROPOSAL_MESSAGE`) rather than left to the server's 400.
+ */
+async function proposalInvitations(
+    calendarEventUid: string | undefined,
+    client: ApiClient | undefined,
+    openSealedContent: SealedContentOpener | undefined,
+): Promise<{ event?: CalendarEvent; invitationContent?: Partial<InvitationContent> & { meetingLinkSecrets?: Record<string, string> } }> {
+    if (!calendarEventUid) {
+        return {};
+    }
+    let event: CalendarEvent;
+    try {
+        event = await getCalendarEvent(calendarEventUid, client);
+    } catch {
+        // Unreadable here: the server, which reads it, decides whether the proposal can be accepted without them.
+        return {};
+    }
+    // A meeting made from a zero-access invitation keeps its content sealed whole (`sealedContent`), which `getCalendarEvent()` doesn't
+    // open: opened here, it is invited for with its real title, location and description.
+    if (event.sealedContent && openSealedContent) {
+        event = await openSealedContent(event);
+    }
+    const content = invitationContentOf(event);
+    if ((isProtectedRecord(event) || event.sealedContent) && !content && (event as { encryptionOrigin?: string }).encryptionOrigin !== "originated") {
+        throw new ApiRequestError(PROTECTED_PROPOSAL_MESSAGE, 400);
+    }
+    const secrets = await meetingLinkSecrets({ videoMeetingUid: event.videoMeetingUid, attendees: event.attendees, organizer: event.organizer }, client);
+    if (!content && !secrets) {
+        return { event };
+    }
+    return { event, invitationContent: { ...(content ?? {}), ...(secrets ? { meetingLinkSecrets: secrets } : {}) } };
+}
+
+/**
+ * Accepts an attendee's proposed time (a `COUNTER`) for a meeting the reader organizes (`calendarEventUid`, the invitation's
+ * `calendarEventUid`): the server moves the event and sends the attendees the update. For a protected meeting - of a calendar zero-access
+ * encryption protects, or with a per-meeting key - the server can't compose the invitations by itself: this sends the decrypted title,
+ * location and description and the guests' link keys with it (`invitationContent`). Without them (the mailbox locked, or the meeting's key
+ * doesn't open here) the server answers 400 and nothing moves. A meeting made from a zero-access invitation (`sealedContent`) is opened
+ * with `openSealedContent` (the app passes `openSealedEvent()`); one that can't be is refused before anything is sent. A meeting with a
+ * video meeting has its key expiry moved to follow the new time (`followMeetingKeyExpiry()`, best effort). Resolves with the invitation as
+ * it now stands.
+ */
+export async function acceptProposal(
+    messageUid: string,
+    client?: ApiClient,
+    calendarEventUid?: string,
+    openSealedContent?: SealedContentOpener,
+): Promise<MessageInvite> {
+    const source = sealedSource(messageUid);
+    const { event, invitationContent } = await proposalInvitations(calendarEventUid, client, openSealedContent);
+    const body = { ...source, ...(invitationContent ? { invitationContent } : {}) };
+    const accepted = await withClient<MessageInvite>(client, `/mail/calendar-events/invite/${encodeURIComponent(messageUid)}/accept-proposal`, {
+        method: "POST",
+        ...(Object.keys(body).length > 0 ? { body: JSON.stringify(body) } : {}),
+    });
+    // A `COUNTER`'s `startDate`/`endDate` are the proposed time, which the meeting now has.
+    if (event?.videoMeetingUid && accepted.startDate && accepted.endDate) {
+        await followMeetingKeyExpiry(event.videoMeetingUid, seriesEndDate({ ...event, startDate: accepted.startDate, endDate: accepted.endDate }), client);
+    }
+    return accepted;
 }