@rapidmx/web-client 0.35.0 → 0.37.0

package/lib/calendar/protectedEvents.ts

@@ -0,0 +1,143 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * Writes to an event of a calendar zero-access encryption protects (restapi `specs/search.md` §3 *What It Covers*, *Calendar invitations*).
+ * The server stores its title, location and description sealed, with placeholders in their place, so it can't tell what changed or invite
+ * with them by itself. A write therefore sends only the content fields that differ from what this device shows, and - when the event was
+ * opened here - the whole content as `invitationContent`, which the server invites with and never stores. A content field of an opened
+ * event that held a value and is emptied is named in `clearedFields`, the only way restapi applies an empty sealed field as a clear.
+ */
+import type { CalendarEvent } from "./calendarApi.js";
+import { isOpenedRecord, isProtectedRecord } from "../zeroAccess/sealedRecords.js";
+import { KeysLockedError } from "../crypto/masterKey.js";
+
+/** The fields zero-access encryption seals on an event. */
+export const EVENT_CONTENT_FIELDS = ["title", "location", "description", "descriptionHtml"] as const;
+
+/** What the server composes a protected event's invitations with. */
+export interface InvitationContent {
+    title: string;
+    location?: string;
+    description?: string;
+    descriptionHtml?: string;
+}
+
+const text = (value: unknown): string => (typeof value === "string" ? value : "");
+
+/** Set on an event made from a zero-access invitation (`sealedContent`) whose sealed content was opened on this device
+ * (`apps/shared/calendar/sealedEvents.ts`). A symbol, so it survives a spread copy (an occurrence) and is never sent. */
+const CONTENT_OPENED = Symbol("openedSealedContent");
+
+/** `event` marked as holding its opened `sealedContent` (its real title, location and description). */
+export function markSealedContentOpened<T extends CalendarEvent>(event: T): T {
+    return { ...event, [CONTENT_OPENED]: true };
+}
+
+/** Whether `event`'s `sealedContent` was opened on this device: its title, location and description are the real ones. */
+export function isSealedContentOpened(event: CalendarEvent | undefined): boolean {
+    return !!event && (event as any)[CONTENT_OPENED] === true;
+}
+
+/** Whether `event` shows its real content: nothing of it is sealed, or every sealed part (`sealedFields`, `sealedContent`) was opened. */
+function shownOpened(event: CalendarEvent): boolean {
+    return (!isProtectedRecord(event) || isOpenedRecord(event)) && (!event.sealedContent || isSealedContentOpened(event));
+}
+
+/** `current`'s content with `changes` applied, for the server to invite (or name a reply or change request) with - `undefined` unless
+ * `current` is protected (`sealedFields`) or made from a zero-access invitation (`sealedContent`) and was opened on this device (its values
+ * are otherwise placeholders). */
+export function invitationContentOf(current: CalendarEvent | undefined, changes: Record<string, unknown> = {}): InvitationContent | undefined {
+    if (!current || !(isProtectedRecord(current) || current.sealedContent) || !shownOpened(current)) {
+        return undefined;
+    }
+    const value = (field: (typeof EVENT_CONTENT_FIELDS)[number]): string => text(field in changes ? changes[field] : current[field]);
+    const title = value("title");
+    if (!title) {
+        return undefined;
+    }
+    const optional = (field: (typeof EVENT_CONTENT_FIELDS)[number]): string | undefined => value(field) || undefined;
+    return { title, location: optional("location"), description: optional("description"), descriptionHtml: optional("descriptionHtml") };
+}
+
+/**
+ * `input` as written to `current`: unchanged when `current` isn't protected. Otherwise without the content fields whose values `current`
+ * already shows (a placeholder is "unchanged" too, so a locked device's write never overwrites the sealed value), and with
+ * `invitationContent` when `current` was opened - and `clearedFields` naming the sealed ones it empties.
+ */
+export function protectedEventWrite<T extends object>(current: CalendarEvent | undefined, input: T): T {
+    if (current?.sealedContent) {
+        return sealedContentWrite(current, input);
+    }
+    if (!isProtectedRecord(current)) {
+        return input;
+    }
+    const changes: Record<string, unknown> = { ...(input as Record<string, unknown>) };
+    const clearedFields: string[] = [];
+    for (const field of EVENT_CONTENT_FIELDS) {
+        if (!(field in changes)) {
+            continue;
+        }
+        if (text(changes[field]) === text(current![field])) {
+            delete changes[field];
+        } else if (!text(changes[field]) && current!.sealedFields![field] !== undefined && isOpenedRecord(current)) {
+            clearedFields.push(field);
+        }
+    }
+    if (clearedFields.length > 0) {
+        changes.clearedFields = clearedFields;
+    }
+    const invitationContent = invitationContentOf(current, changes);
+    return (invitationContent ? { ...changes, invitationContent } : changes) as T;
+}
+
+/**
+ * `input` as written to `current`, an event made from a zero-access invitation (`sealedContent`). restapi seals its whole content again
+ * from the content fields a write sends (`BaseCalendarEventRoute.keepSealed()`), dropping one the write leaves out, since it can't read the
+ * sealed value to keep it. So a write that sends any of them sends them all: those it leaves out (the event dialog sends an unchanged
+ * description not at all) are filled in with what `current` shows opened - the description and its HTML as one, as the dialog sends them.
+ * This holds too for a row that also keeps its title sealed field by field (`sealedFields.title`), whose sealed content's title is empty.
+ * Shown with placeholders (its mailbox is locked), the placeholders it would send back are left out, so nothing is sealed again, and a
+ * changed content field is refused (`KeysLockedError`) before anything is sent: the rest of the content can't be sent with it. Opened, a
+ * write whose location, description or description HTML differs from the one shown raises `sequence` past `current`'s, the only way
+ * restapi learns it changed.
+ */
+function sealedContentWrite<T extends object>(current: CalendarEvent, input: T): T {
+    const given = input as Record<string, unknown>;
+    if (!EVENT_CONTENT_FIELDS.some((field) => given[field] !== undefined)) {
+        return input;
+    }
+    const changes: Record<string, unknown> = { ...given };
+    if (!shownOpened(current)) {
+        for (const field of EVENT_CONTENT_FIELDS) {
+            if (field in changes && text(changes[field]) === text(current[field])) {
+                delete changes[field];
+            }
+        }
+        if (EVENT_CONTENT_FIELDS.some((field) => changes[field] !== undefined)) {
+            throw new KeysLockedError("This event is protected and your mailbox is locked. Unlock it to change its title, location or description.");
+        }
+        return changes as T;
+    }
+    for (const field of ["title", "location"] as const) {
+        if (changes[field] === undefined) {
+            changes[field] = current[field] ?? null;
+        }
+    }
+    if (changes.description === undefined && changes.descriptionHtml === undefined) {
+        changes.description = current.description ?? null;
+        changes.descriptionHtml = current.descriptionHtml ?? null;
+    }
+    // restapi can't compare a location or description sealed whole (it holds placeholders), so a real change raises the sequence here: an
+    // organizer-owned meeting then invites again, as for a readable event's new location or description. A description field the write
+    // doesn't send is compared no more than restapi compares it for a readable event. An unchanged one leaves it alone.
+    const descriptionChanged = (["description", "descriptionHtml"] as const).some(
+        (field) => changes[field] !== undefined && text(changes[field]) !== text(current[field])
+    );
+    if (descriptionChanged || text(changes.location) !== text(current.location)) {
+        changes.sequence = (current.sequence ?? 0) + 1;
+    }
+    const invitationContent = isProtectedRecord(current) ? invitationContentOf(current, changes) : undefined;
+    return (invitationContent ? { ...changes, invitationContent } : changes) as T;
+}

package/lib/calendar/recurrence.ts

@@ -334,3 +334,20 @@ export const WEEKDAY_LABELS: Record<WeekdayCode, string> = {
     SA: "Sat",
     SU: "Sun",
 };
+
+/** When `event`'s last occurrence ends: its own end, or a series' last occurrence's - far ahead for a series without an end. */
+export function seriesEndDate(event: CalendarEvent): Date {
+    const rule = event.recurrenceRule;
+    const end = new Date(event.endDate);
+    if (!rule) {
+        return end;
+    }
+    if (!rule.until && !rule.count) {
+        return new Date(8.64e15);
+    }
+    const duration = end.valueOf() - new Date(event.startDate).valueOf();
+    const horizon = new Date(rule.until ? new Date(rule.until).valueOf() + 86_400_000 : Date.now() + 5 * 365 * 86_400_000);
+    const occurrences = expandOccurrences(event, new Date(event.startDate), horizon);
+    const last = occurrences[occurrences.length - 1];
+    return last ? new Date(new Date(last.startDate).valueOf() + duration) : end;
+}

package/lib/calendar/sealedInvites.ts

@@ -0,0 +1,73 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * The calendar files of zero-access messages, as decrypted on this device (`MessageSecurityResult.calendar`). The server holds only
+ * the sealed copy of such a message, so every invitation call for it (`inviteApi.ts`) sends the file along. Kept in memory for the
+ * messages read most recently, only while their mailbox is unlocked: its lock forgets them (telling `onSealedInvitesForgotten()`
+ * listeners, so what was read with them goes too), and so does sign-out (`clearSealedInvites()`).
+ */
+import { getUnlockedKeys, subscribeKeySession } from "../crypto/keySession.js";
+
+/** How many messages' calendar files are kept. */
+const MAX_SEALED_INVITES = 100;
+
+const calendars: Map<string, { mailboxUid: string; ics: string }> = new Map();
+const forgottenListeners = new Set<(messageUids: string[]) => void>();
+
+let watchingKeys = false;
+
+/** A mailbox's files go the moment it locks, so nothing opened outlives its key session. Subscribed on the first file, not on import. */
+function forgetOnLock(): void {
+    if (watchingKeys) {
+        return;
+    }
+    watchingKeys = true;
+    subscribeKeySession(({ mailboxUid, state }) => {
+        if (state !== "locked") {
+            return;
+        }
+        const forgotten: string[] = [];
+        for (const [messageUid, entry] of calendars) {
+            if (entry.mailboxUid === mailboxUid) {
+                calendars.delete(messageUid);
+                forgotten.push(messageUid);
+            }
+        }
+        if (forgotten.length) {
+            forgottenListeners.forEach((listener) => listener(forgotten));
+        }
+    });
+}
+
+/** Remembers the decrypted calendar file of zero-access message `messageUid` of `mailboxUid` - not while that mailbox is locked (a
+ * pane still drawing what it decrypted before the lock). */
+export function rememberSealedInvite(messageUid: string, ics: string, mailboxUid: string): void {
+    if (!getUnlockedKeys(mailboxUid)) {
+        return;
+    }
+    forgetOnLock();
+    calendars.delete(messageUid);
+    calendars.set(messageUid, { mailboxUid, ics });
+    while (calendars.size > MAX_SEALED_INVITES) {
+        calendars.delete(calendars.keys().next().value!);
+    }
+}
+
+/** The decrypted calendar file of zero-access message `messageUid`, when this device has read it and its mailbox is unlocked. */
+export function sealedInviteCalendar(messageUid: string): string | undefined {
+    const entry = calendars.get(messageUid);
+    return entry && getUnlockedKeys(entry.mailboxUid) ? entry.ics : undefined;
+}
+
+/** Calls `listener` with the messages whose files a mailbox's lock forgot. Returns the unsubscribe. */
+export function onSealedInvitesForgotten(listener: (messageUids: string[]) => void): () => void {
+    forgottenListeners.add(listener);
+    return () => forgottenListeners.delete(listener);
+}
+
+/** Forgets every remembered calendar file (sign-out). */
+export function clearSealedInvites(): void {
+    calendars.clear();
+}

package/lib/contacts/contactsApi.ts

@@ -5,16 +5,10 @@
 /** Typed wrappers over `@rapidmx/restapi`'s `/mail/contacts` REST surface — see `mailApi.ts`'s own header
  * comment for the shared ACL/authorization model every wrapper file here follows. */
 
-import { ApiClient, apiUrl, withClient, withClientRaw } from "../util/api.js";
+import { ApiClient, apiUrl, withClient, withClientBlob, withClientRaw } from "../util/api.js";
 import { ListParams, SETTINGS_LIST_LIMIT, buildQuery } from "../util/apiQuery.js";
-import {
-    type EncryptionPreference,
-    type KeyConflict,
-    type PreviousKey,
-    type PublicKey,
-    type RejectedKey,
-    signingKeyFingerprints,
-} from "../crypto/keyvaultApi.js";
+import { guardSealedMove } from "../zeroAccess/sealedMoves.js";
+import { type EncryptionPreference, type EndToEndFormat, type KeyConflict, type PreviousKey, type PublicKey, type RejectedKey, signingKeyFingerprints, isOpenPgpKey, isTrustedForVerification } from "../crypto/keyvaultApi.js";
 
 export type ContactAddressKind = "home" | "work" | "other";
 
@@ -68,6 +62,15 @@ export interface Contact {
      * via `crypto/keyvaultApi.ts`'s `lookupKeys()` at compose time, never fetched on message receipt
      * (that would leak read timing to the sender's server). */
     encryptPreference?: EncryptionPreference;
+    /** The protected details sealed to the mailbox's zero-access key while it protects contacts (`displayName` then shows the first email
+     * address, the other protected fields are empty) - opened with `openSealedRecords()`. Server-written. */
+    sealedFields?: Record<string, string> | null;
+    /** The photo (`photoBlobKey`) is sealed to the mailbox's zero-access key: it is fetched and opened, never shown by URL. Server-written. */
+    photoSealed?: boolean | null;
+    /** The end-to-end format the user chose for this contact ("Preferred format"); absent or null for automatic. */
+    preferredFormat?: EndToEndFormat | null;
+    /** The format this address was last seen using, from authenticated mail it sent (server-written). */
+    observedFormat?: { format: EndToEndFormat; at: number } | null;
     /** This contact's pinned public keys. Trust is TOFU (trust-on-first-use) — see `keyConflicts` for what
      * happens when a newly observed key differs from one of these. */
     keys?: PublicKey[];
@@ -89,6 +92,13 @@ const CONTACT_SORT = JSON.stringify({ displayName: "ASC", uid: "ASC" });
 
 /** Lists a folder's contacts, alphabetically by display name. Never includes soft-deleted contacts — see
  * `listDeletedContacts()` for those. */
+/** The protected contact fields a list of contacts shows - all a list opens (`openSealedRecords(contacts, CONTACT_LIST_FIELDS)`); a view of
+ * one contact opens the rest. */
+export const CONTACT_LIST_FIELDS: readonly string[] = ["displayName", "phones", "categories"];
+
+/** The protected fields a duplicate check compares (an address-less card is matched by name and phone). */
+export const CONTACT_MATCH_FIELDS: readonly string[] = ["displayName", "phones"];
+
 export function listContacts(folderUid: string, params: ListParams = {}, client?: ApiClient): Promise<Contact[]> {
     return withClient(client, `/mail/contacts?${buildQuery(params, { folderUid, sort: CONTACT_SORT })}`);
 }
@@ -106,6 +116,14 @@ export function pinnedSigningFingerprintsFor(contacts: Contact[], address: strin
     return [...new Set(contactsMatching(contacts, address).flatMap((contact) => signingKeyFingerprints(contact.keys, contact.previousKeys)))];
 }
 
+/** The OpenPGP certificates (base64, `PublicKey.publicKey`) pinned on every contact in `contacts` for `address` - current and
+ * previous ones still trusted for verification (`isTrustedForVerification()`) - which an OpenPGP signature from that sender is
+ * checked against (an OpenPGP signature carries only a key ID, so the key itself is needed). De-duplicated by fingerprint. */
+export function pinnedOpenPgpKeysFor(contacts: Contact[], address: string): string[] {
+    const keys = contactsMatching(contacts, address).flatMap((contact) => [...(contact.keys ?? []), ...(contact.previousKeys ?? [])]);
+    return uniqueByFingerprint(keys.filter((key) => isOpenPgpKey(key) && isTrustedForVerification(key))).map((key) => key.publicKey);
+}
+
 /** Page size and page cap for `fetchPinnedSigningFingerprints()` and `fetchSignerKeyState()` (500 is restapi's own
  * `limit` cap). */
 export const PINNED_FINGERPRINT_PAGE_SIZE = 500;
@@ -149,6 +167,9 @@ export interface SignerKeyState {
     previous: PreviousKey[];
     /** The first unresolved signing-key conflict found, if any. */
     conflict?: KeyConflict;
+    /** The pinned OpenPGP certificates (which sign as well as encrypt), de-duplicated by fingerprint - what an OpenPGP signer's
+     * key-changed comparison shows. Absent when there are none. */
+    openPgp?: PublicKey[];
 }
 
 function uniqueByFingerprint<T extends PublicKey>(keys: T[]): T[] {
@@ -174,7 +195,8 @@ export function signerKeyStateFor(contacts: Contact[], address: string): SignerK
         matching.flatMap((contact) => (contact.previousKeys ?? []).filter((key) => key.useType === "sign")).sort((a, b) => b.replacedAt - a.replacedAt),
     );
     const conflict = matching.flatMap((contact) => contact.keyConflicts ?? []).find((entry) => entry.useType === "sign");
-    return { pinned, previous, ...(conflict ? { conflict } : {}) };
+    const openPgp = uniqueByFingerprint(matching.flatMap((contact) => (contact.keys ?? []).filter((key) => isOpenPgpKey(key))));
+    return { pinned, previous, ...(conflict ? { conflict } : {}), ...(openPgp.length > 0 ? { openPgp } : {}) };
 }
 
 /** Fetches `signerKeyStateFor()` for `address` from the contacts in `folderUids`, paging exactly like
@@ -258,11 +280,15 @@ export interface UpdateContactInput extends ContactInput {
  * fetched `Contact`. An `UpdateContactInput` is also a valid `ContactPatch`. */
 export type ContactPatch = Partial<Contact> & Pick<Contact, "uid" | "version">;
 
-export function updateContact(patch: ContactPatch, client?: ApiClient): Promise<Contact> {
-    return withClient(client, `/mail/contacts/${encodeURIComponent(patch.uid)}`, {
-        method: "PUT",
-        body: JSON.stringify(patch),
-    });
+/** Saves `patch`. A patch moving the contact to another mailbox (`mailboxUid`) is refused with `SealedMoveError` when the contact is
+ * protected - before sending anything when `current` (the contact as this device has it) says so, else from the server's refusal. */
+export function updateContact(patch: ContactPatch, client?: ApiClient, current?: Contact): Promise<Contact> {
+    return guardSealedMove(current, patch.mailboxUid, () =>
+        withClient<Contact>(client, `/mail/contacts/${encodeURIComponent(patch.uid)}`, {
+            method: "PUT",
+            body: JSON.stringify(patch),
+        }),
+    );
 }
 
 /** Thin `updateContact()` wrapper for toggling favorite/star status — same pattern as `mailApi.ts`'s
@@ -291,8 +317,8 @@ export function uploadContactPhoto(uid: string, version: number, file: Blob, cli
 }
 
 /** The bytes of a contact's own picture through an explicit `client` - for one that authenticates with a token, whose `<img>` cannot (see `contactPhotoUrl()`). */
-export function fetchContactPhoto(uid: string, version: number, client: ApiClient): Promise<Blob> {
-    return client.fetchBlob(`/mail/contacts/${encodeURIComponent(uid)}/photo?v=${version}`);
+export function fetchContactPhoto(uid: string, version: number, client?: ApiClient): Promise<Blob> {
+    return withClientBlob(client, `/mail/contacts/${encodeURIComponent(uid)}/photo?v=${version}`, "Could not load the contact's picture.");
 }
 
 /** Removes a contact's own picture and returns the updated contact. */

package/lib/contacts/useContactPhotoSrc.ts

@@ -2,10 +2,31 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { useEffect, useState } from "react";
+import { useEffect, useRef, useState } from "react";
 import type { ApiClient } from "../util/api.js";
+import { getUnlockedKeys, subscribeKeySession } from "../crypto/keySession.js";
+import { openSealedBytes } from "../zeroAccess/sealedRecords.js";
 import { type Contact, contactPhotoUrl, fetchContactPhoto } from "./contactsApi.js";
 
+/** What a photo is fetched by: the contact's identity, and whether (and for which mailbox) it is sealed. */
+type PhotoContact = Pick<Contact, "uid" | "version" | "photoBlobKey"> & Partial<Pick<Contact, "mailboxUid" | "photoSealed">>;
+
+/** The cache identity of the global (cookie) client, for a sealed photo fetched without an explicit client. */
+const GLOBAL_CLIENT = {} as ApiClient;
+
+/** A contact's photo: the bytes as stored, or - sealed to the mailbox's zero-access key - opened (rejects when it can't be: initials show). */
+async function loadPhoto(contact: PhotoContact, client: ApiClient | undefined): Promise<Blob> {
+    const blob = await fetchContactPhoto(contact.uid, contact.version, client);
+    if (!contact.photoSealed) {
+        return blob;
+    }
+    const opened = await openSealedBytes(contact.mailboxUid ?? "", new Uint8Array(await blob.arrayBuffer()));
+    if (!opened) {
+        throw new Error("The contact's picture is protected and can't be opened here.");
+    }
+    return new Blob([opened as BlobPart]);
+}
+
 /** How many pictures stay loaded (as `blob:` URLs) after nothing shows them any more, so a list scrolled back over does not fetch them all again. */
 const CACHE_LIMIT = 50;
 
@@ -13,6 +34,8 @@ interface Entry {
     url: string;
     /** How many mounted avatars show this URL; it is never revoked while that is more than none. */
     refs: number;
+    /** A sealed picture's mailbox, whose keys opened it: dropped when that mailbox locks, shown or not, and never handed out while it is locked. */
+    mailboxUid?: string;
 }
 
 /** Least recently used first (a `Map` iterates in insertion order, and a use moves the entry to the end). */
@@ -22,6 +45,32 @@ const pending = new Map<string, { request: Promise<string>; waiters: number }>()
 const clientIds = new WeakMap<ApiClient, number>();
 let nextClientId = 0;
 
+let watchingKeys = false;
+
+/** A sealed picture opened with a mailbox's keys goes when that mailbox locks, like every other opened value (`sealedRecords.ts`): its URL
+ * is revoked even while an avatar shows it - each one drops it itself (`useContactPhoto()`). Subscribed with the first sealed picture. */
+function forgetOnLock(): void {
+    if (watchingKeys) {
+        return;
+    }
+    watchingKeys = true;
+    subscribeKeySession(({ mailboxUid, state }) => {
+        if (state === "locked") {
+            forgetSealed(mailboxUid);
+        }
+    });
+}
+
+/** Revokes and forgets `mailboxUid`'s sealed pictures. */
+function forgetSealed(mailboxUid: string): void {
+    for (const [key, entry] of entries) {
+        if (entry.mailboxUid === mailboxUid) {
+            URL.revokeObjectURL(entry.url);
+            entries.delete(key);
+        }
+    }
+}
+
 /** One key per picture of one account: the same uid never collides across the clients of a multi-account app, and a replaced picture (new version) is a new key. */
 function keyOf(client: ApiClient, uid: string, version: number): string {
     let id = clientIds.get(client);
@@ -75,8 +124,20 @@ function limited<T>(task: () => Promise<T>): Promise<T> {
     });
 }
 
-/** The `blob:` URL for `key`, fetched with `load` unless it is cached, and counted as shown until `release()`. Concurrent callers share one fetch. */
-async function acquire(key: string, load: () => Promise<Blob>): Promise<string> {
+/**
+ * The `blob:` URL for `key`, fetched with `load` unless it is cached, and counted as shown until `release()`. Concurrent callers share one fetch.
+ * `sealedMailboxUid` is a sealed picture's mailbox: opened only while it is unlocked, it is neither fetched, handed out from the cache nor
+ * stored once that mailbox is locked (rejects).
+ */
+async function acquire(key: string, load: () => Promise<Blob>, sealedMailboxUid?: string): Promise<string> {
+    if (sealedMailboxUid !== undefined) {
+        forgetOnLock();
+        if (!getUnlockedKeys(sealedMailboxUid)) {
+            // Not fetched either: it couldn't be opened, and the avatar retries it once the mailbox unlocks (`useContactPhoto()`).
+            forgetSealed(sealedMailboxUid);
+            throw new Error("The contact's mailbox is locked.");
+        }
+    }
     const entry = entries.get(key);
     if (entry) {
         entry.refs++;
@@ -90,9 +151,13 @@ async function acquire(key: string, load: () => Promise<Blob>): Promise<string>
             waiters: 0,
             request: limited(load)
                 .then((blob) => {
+                    // Opened just before a lock came: nothing opened is kept past it.
+                    if (sealedMailboxUid !== undefined && !getUnlockedKeys(sealedMailboxUid)) {
+                        throw new Error("The contact's mailbox locked while its picture was opened.");
+                    }
                     const url = URL.createObjectURL(blob);
                     // Claimed by everyone waiting from the start: an entry nobody holds yet could be trimmed before its avatar got to it.
-                    entries.set(key, { url, refs: created.waiters });
+                    entries.set(key, { url, refs: created.waiters, mailboxUid: sealedMailboxUid });
                     return url;
                 })
                 .finally(() => pending.delete(key)),
@@ -126,7 +191,7 @@ export function clearContactPhotoCache(): void {
  * token-authenticated client (the desktop and mobile apps) cannot do that - an `<img>` sends no `Authorization` header - so the picture is fetched through the client
  * and shown as a `blob:` URL, cached per client, contact and version with a small LRU and revoked once it falls out of it and nothing shows it.
  */
-export function useContactPhotoSrc(contact: Pick<Contact, "uid" | "version" | "photoBlobKey"> | undefined, client?: ApiClient): string | undefined {
+export function useContactPhotoSrc(contact: PhotoContact | undefined, client?: ApiClient): string | undefined {
     return useContactPhoto(contact, client).src;
 }
 
@@ -135,23 +200,48 @@ export function useContactPhotoSrc(contact: Pick<Contact, "uid" | "version" | "p
  * that is not on screen yet has no reason to fetch its picture.
  */
 export function useContactPhoto(
-    contact: Pick<Contact, "uid" | "version" | "photoBlobKey"> | undefined,
+    contact: PhotoContact | undefined,
     client?: ApiClient,
     active = true,
 ): { src: string | undefined; failed: boolean } {
     const [loaded, setLoaded] = useState<{ key: string; url: string } | undefined>();
     const [failedKey, setFailedKey] = useState<string | undefined>();
-    const key = active && client && contact?.photoBlobKey ? keyOf(client, contact.uid, contact.version) : undefined;
-    const uid = contact?.uid;
-    const version = contact?.version;
+    // Bumped to load a sealed picture again: its mailbox locked (it can't be shown any more) or unlocked (one that failed can be now).
+    const [attempt, setAttempt] = useState(0);
+    // A sealed photo is always fetched (and opened) here: a URL would show the browser ciphertext.
+    const fetched = !!client || !!contact?.photoSealed;
+    const key = active && fetched && contact?.photoBlobKey ? keyOf(client ?? GLOBAL_CLIENT, contact.uid, contact.version) : undefined;
+    const sealedMailboxUid = contact?.photoSealed ? (contact.mailboxUid ?? "") : undefined;
+    const failedRef = useRef(failedKey);
+    failedRef.current = failedKey;
+
+    useEffect(() => {
+        if (!key || sealedMailboxUid === undefined) {
+            return;
+        }
+        return subscribeKeySession(({ mailboxUid, state }) => {
+            if (mailboxUid !== sealedMailboxUid) {
+                return;
+            }
+            if (state === "locked") {
+                // What the <img> decoded stays on screen until its src goes: drop it, then try again (it fails while locked: initials).
+                setLoaded(undefined);
+                setFailedKey(undefined);
+                setAttempt((n) => n + 1);
+            } else if (failedRef.current === key) {
+                setFailedKey(undefined);
+                setAttempt((n) => n + 1);
+            }
+        });
+    }, [key, sealedMailboxUid]);
 
     useEffect(() => {
-        if (!key || !client) {
+        if (!key) {
             return;
         }
         let cancelled = false;
         let held = false;
-        acquire(key, () => fetchContactPhoto(uid!, version!, client)).then(
+        acquire(key, () => loadPhoto(contact!, client), sealedMailboxUid).then(
             (url) => {
                 if (cancelled) {
                     release(key);
@@ -168,9 +258,9 @@ export function useContactPhoto(
                 release(key);
             }
         };
-    }, [key]);
+    }, [key, attempt]);
 
-    if (client) {
+    if (fetched) {
         return { src: key !== undefined && loaded?.key === key ? loaded.url : undefined, failed: key !== undefined && failedKey === key };
     }
     return { src: contact && contactPhotoUrl(contact), failed: false };

package/lib/crypto/composeSecurity.ts

@@ -47,9 +47,15 @@ function policyStateForTier(policy: EncryptionPolicy, tier: RecipientTier): Poli
 export interface RecipientEncryptionStatus {
     address: string;
     tier: RecipientTier;
-    /** The recipient's currently-active encryption certificate, if they have published (and this device
+    /** The recipient's currently-active S/MIME encryption certificate, if they have published (and this device
      * has discovered) one. */
     encryptCert?: PublicKey;
+    /** The recipient's active OpenPGP certificate - only when they have no S/MIME certificate and the server allows OpenPGP
+     * (restapi `specs/end-to-end_encryption.md` *OpenPGP Interoperability*: S/MIME is preferred whenever it can be used). */
+    openPgpKey?: PublicKey;
+    /** Which format this recipient is encrypted in: `"smime"` whenever they have an S/MIME certificate, `"openpgp"` only for
+     * a recipient whose only key is an OpenPGP one. Absent when they can't be encrypted to. */
+    format?: "smime" | "openpgp";
     /** Whether this recipient *can* be encrypted to at all right now - false when there's no usable key,
      * or the tier's policy is `prohibited`. */
     canEncrypt: boolean;
@@ -64,15 +70,24 @@ export interface RecipientEncryptionStatus {
 
 /** Per-recipient encryption eligibility, given this device's own encryption preference and the
  * system-wide policy. One entry per (address, lookup result) pair the caller already resolved via
- * `lookupKeys()` - this function does no discovery itself. */
+ * `lookupKeys()` - this function does no discovery itself. `ownCanUseOpenPgp` false: the sender has no OpenPGP key to use here
+ * (an OpenPGP copy is encrypted to the sender too), so a recipient who prefers OpenPGP but has an S/MIME certificate gets S/MIME - a
+ * preference never leaves them unencrypted (restapi `specs/end-to-end_encryption.md` *Choosing the format*). */
 export function resolveRecipientEncryption(
     ownAddress: string,
     ownPrefersMutual: boolean,
     policy: EncryptionPolicy,
     recipientAddress: string,
     lookup: KeyLookupResult | undefined,
+    ownCanUseOpenPgp: boolean = true,
 ): RecipientEncryptionStatus {
-    const encryptCert = lookup ? findActivePublicKey(lookup.keys, "encrypt") : undefined;
+    const smimeCert = lookup ? findActivePublicKey(lookup.keys, "encrypt") : undefined;
+    const usableOpenPgpKey = lookup && policy.allowOpenPgp === true ? findActivePublicKey(lookup.keys, "encrypt", "openpgp") : undefined;
+    // S/MIME, unless the recipient has no certificate or prefers OpenPGP (restapi *Choosing the format*: the user's choice for the
+    // contact, what the address advertises, what it was last seen using) - and OpenPGP only where the server allows it.
+    const useOpenPgp = !!usableOpenPgpKey && (!smimeCert || (lookup?.preferredFormat === "openpgp" && ownCanUseOpenPgp));
+    const encryptCert = useOpenPgp ? undefined : smimeCert;
+    const openPgpKey = useOpenPgp ? usableOpenPgpKey : undefined;
     const tier = classifyRecipientTier(ownAddress, recipientAddress, !!lookup && lookup.keys.length > 0);
     const policyState = policyStateForTier(policy, tier);
 
@@ -87,7 +102,7 @@ export function resolveRecipientEncryption(
         };
     }
 
-    if (!encryptCert) {
+    if (!encryptCert && !openPgpKey) {
         return { address: recipientAddress, tier, canEncrypt: false, autoEncrypt: false };
     }
 
@@ -96,7 +111,7 @@ export function resolveRecipientEncryption(
     return {
         address: recipientAddress,
         tier,
-        encryptCert,
+        ...(encryptCert ? { encryptCert, format: "smime" as const } : { openPgpKey, format: "openpgp" as const }),
         canEncrypt: true,
         autoEncrypt: policyState === "automatic" && mutual,
     };