@rapidmx/web-client 0.35.0 → 0.37.0

package/apps/shared/components/layout/KeyEnrollmentGate.tsx

@@ -20,9 +20,12 @@ import {
 import {
     ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE,
     getUnlockedKeys,
+    subscribeKeySession,
     unlockWithPassword,
     type UnlockResult,
 } from "../../../../lib/crypto/keySession.js";
+import { ensureZeroAccessKey, provisionZeroAccessKey } from "../../../../lib/crypto/zeroAccessKey.js";
+import { ensureOpenPgpKey } from "../../../../lib/crypto/openPgpKey.js";
 import { buildAad, generateMasterKey, sealWithKey } from "../../../../lib/crypto/masterKey.js";
 import { buildPasswordWrap, buildRecoveryWraps } from "../../../../lib/crypto/masterKeyWraps.js";
 import { exportPrivateKeyPkcs8, generateKeyPairWithCsr } from "../../../../lib/crypto/keys.js";
@@ -46,13 +49,17 @@ async function provisionEncryptionKey(
     const privateKeyRaw = await exportPrivateKeyPkcs8(keyPair.privateKey);
     const wrappedKeySealed = await sealWithKey(mk, privateKeyRaw, buildAad(mailboxUid, ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE));
 
-    await enrollKey(mailboxUid, {
+    const vault = await enrollKey(mailboxUid, {
         useType: "encrypt",
         csr: csrPem,
         wrappedKey: { ciphertext: wrappedKeySealed.ciphertext, nonce: wrappedKeySealed.nonce, algorithm: "AES-256-GCM" },
         masterKeyWraps: [passwordWrap, ...recoveryWraps],
     });
 
+    // The zero-access key (restapi specs/search.md §3), under the same master key. Not fatal: setup is done once the
+    // encryption key is in, and a mailbox without a zero-access key gets one on its next unlock (`ensureZeroAccessKey()`).
+    await provisionZeroAccessKey(mailboxUid, mailboxAddress, mk, vault.masterKeyGeneration).catch(() => undefined);
+
     return { recoveryCodes };
 }
 
@@ -154,6 +161,28 @@ export default function KeyEnrollmentGate({
         };
     }, [mailboxUid, canProvision]);
 
+    // A mailbox set up before zero-access encryption existed has no zero-access key, and one set up before OpenPGP was supported
+    // has no OpenPGP key (restapi specs/end-to-end_encryption.md *OpenPGP Interoperability*): give it each whenever its owner has
+    // it unlocked - now, or on a later unlock from anywhere (this gate, an unlock prompt, recovery, first-time setup). Best
+    // effort: a failure is retried on the next unlock.
+    useEffect(() => {
+        if (!mailboxUid || !mailboxAddress || !canProvision) {
+            return;
+        }
+        // One after the other: both enrollments update the vault, which a concurrent write would refuse (409).
+        const ensure = () =>
+            void ensureZeroAccessKey(mailboxUid, mailboxAddress)
+                .catch(() => undefined)
+                .then(() => ensureOpenPgpKey(mailboxUid, mailboxAddress))
+                .catch(() => undefined);
+        ensure();
+        return subscribeKeySession((event) => {
+            if (event.mailboxUid === mailboxUid && event.state === "unlocked") {
+                ensure();
+            }
+        });
+    }, [mailboxUid, mailboxAddress, canProvision]);
+
     async function handleUnlock(e: React.FormEvent) {
         e.preventDefault();
         setError(null);

package/apps/shared/components/layout/SharedMailboxKeyManager.tsx

@@ -0,0 +1,122 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useEffect, useRef } from "react";
+import { getUnlockedKeys, personallyUnlockedKeys, subscribeKeySession } from "../../../../lib/crypto/keySession.js";
+import type { Mailbox } from "../../../../lib/mail/mailApi.js";
+import type { ApiClient } from "../../../../lib/util/api.js";
+import { useApiClient } from "../../../../lib/util/apiClientContext.js";
+import { notify } from "../../notifications/store.js";
+
+/** How often the shared mailboxes are looked after again while some own mailbox stays unlocked. */
+export const SHARED_MAILBOX_CHECK_INTERVAL_MS = 5 * 60 * 1000;
+
+/** The shared mailbox key code (pkijs and friends), loaded only once an own mailbox is unlocked. */
+let loaded: Promise<typeof import("../../../../lib/crypto/sharedMailboxKeys.js")> | undefined;
+const loadSharedKeys = () =>
+    (loaded ??= import("../../../../lib/crypto/sharedMailboxKeys.js").catch((err) => {
+        loaded = undefined;
+        throw err;
+    }));
+
+/** The refused rotations already shown, per mailbox (the reason): each is shown once a session, not on every pass that retries it. */
+const shownRefusals = new Map<string, string>();
+
+/** Forgets which refused rotations were shown (tests). */
+export function resetSharedMailboxKeyManager(): void {
+    shownRefusals.clear();
+}
+
+export interface SharedMailboxKeyManagerProps {
+    /** Every mailbox the user can open. */
+    mailboxes: Mailbox[];
+    userUid?: string;
+}
+
+/**
+ * Looks after the zero-access keys of the user's shared mailboxes (`lib/crypto/sharedMailboxKeys.ts`) whenever a mailbox of their own is
+ * unlocked, and every `SHARED_MAILBOX_CHECK_INTERVAL_MS` after that: opens each mailbox shared with them through their member key wraps (no
+ * password), and - for a mailbox they own or manage - provisions, rotates and shares its key with members still waiting. Best effort and
+ * silent (a pass that fails is tried again on the next), except for a rotation the server refuses, shown once as a warning. Renders nothing; mounted by `MailShell`.
+ */
+export default function SharedMailboxKeyManager({ mailboxes, userUid }: SharedMailboxKeyManagerProps) {
+    const client = useApiClient();
+    const latest = useRef({ mailboxes, userUid, client });
+    latest.current = { mailboxes, userUid, client };
+    const running = useRef(false);
+
+    useEffect(() => {
+        async function pass(): Promise<void> {
+            if (running.current || personallyUnlockedKeys().length === 0) {
+                return;
+            }
+            running.current = true;
+            try {
+                const { maintainSharedMailbox, unlockSharedMailbox } = await loadSharedKeys();
+                const { mailboxes: current, userUid: me, client: apiClient } = latest.current;
+                for (const mailbox of current) {
+                    await look(mailbox, me, apiClient, unlockSharedMailbox, maintainSharedMailbox).catch(() => undefined);
+                }
+            } catch {
+                // Nothing to do until the next pass.
+            } finally {
+                running.current = false;
+            }
+        }
+        void pass();
+        const unsubscribe = subscribeKeySession((event) => {
+            if (event.state === "unlocked" && !getUnlockedKeys(event.mailboxUid)?.shared) {
+                void pass();
+            }
+        });
+        const interval = setInterval(() => void pass(), SHARED_MAILBOX_CHECK_INTERVAL_MS);
+        return () => {
+            unsubscribe();
+            clearInterval(interval);
+        };
+    }, []);
+
+    return null;
+}
+
+async function look(
+    mailbox: Mailbox,
+    me: string | undefined,
+    client: ApiClient | undefined,
+    unlockSharedMailbox: (uid: string, client?: ApiClient, refresh?: boolean) => Promise<string>,
+    maintainSharedMailbox: (
+        uid: string,
+        address: string,
+        client?: ApiClient,
+    ) => Promise<{ provisioned: boolean; rotated: boolean; rotationRefused?: string }>,
+): Promise<void> {
+    const owned = !!mailbox.ownerUserUid && mailbox.ownerUserUid === me;
+    if (!owned) {
+        // Opened, or - once open - opened again when a rotation left it without the active key.
+        await unlockSharedMailbox(mailbox.uid, client, true);
+    }
+    const unlocked = getUnlockedKeys(mailbox.uid);
+    // An owner looks after their mailbox with its own keys; a member, with full access, whether or not it is open yet (a mailbox
+    // without an owner may have no key to open).
+    if (owned ? unlocked && !unlocked.shared : true) {
+        const done = await maintainSharedMailbox(mailbox.uid, mailbox.primarySmtpAddress, client);
+        // The server kept the current key (its vault can't take the new key's member wraps): say so once, members keep reading.
+        if (done.rotationRefused && shownRefusals.get(mailbox.uid) !== done.rotationRefused) {
+            shownRefusals.set(mailbox.uid, done.rotationRefused);
+            notify({
+                kind: "warning",
+                title: `${mailbox.displayName || mailbox.primarySmtpAddress}: the zero-access key wasn't replaced`,
+                message: "A member has left, but the server refused a new key for this shared mailbox. The current key stays active.",
+                details: done.rotationRefused,
+                dedupeKey: `shared-rotation-refused:${mailbox.uid}`,
+            });
+        } else if (!done.rotationRefused) {
+            shownRefusals.delete(mailbox.uid);
+        }
+        // A key this member just made (a mailbox without an owner) goes into their session now, not on the next pass.
+        if (!owned && (done.provisioned || done.rotated)) {
+            await unlockSharedMailbox(mailbox.uid, client, true);
+        }
+    }
+}

package/apps/shared/components/layout/UnlockPromptProvider.tsx

@@ -15,6 +15,7 @@ import Modal from "../../../../lib/components/overlays/Modal.js";
 import Alert from "../../../../lib/components/feedback/Alert.js";
 import Button from "../../../../lib/components/buttons/Button.js";
 import FormField from "../../../../lib/components/forms/FormField.js";
+import { notify } from "../../notifications/store.js";
 import {
     RECOVERY_CODE_ERROR,
     RecoveryFollowUp,
@@ -98,6 +99,34 @@ const UnlockPromptContext = createContext<UnlockPromptContextValue | null>(null)
  * mailbox happens to resolve - see `KeyEnrollmentGate`'s `blocking` prop, which `MailShell` now sets to
  * `false` for exactly this reason.
  */
+/** Messages for a shared mailbox `openShared()` can't open. */
+export const SHARED_ACCESS_PENDING_MESSAGE = "This mailbox is shared with you, and is waiting for another member to share its key with you. Try again shortly.";
+export const SHARED_OWN_KEYS_LOCKED_MESSAGE = "Unlock your own mailbox first: it holds the key that opens the mailboxes shared with you.";
+
+/**
+ * Opens `mailboxUid` through the user's member key wraps when it is a mailbox shared with them (`sharedMailboxKeys.ts`): its keys, or
+ * `undefined` when it isn't one of theirs (the password prompt applies). Rejects, after saying why, when it is shared with them but can't
+ * open yet. The shared key code is loaded only here.
+ */
+async function openShared(mailboxUid: string): Promise<UnlockedKeys | undefined> {
+    let outcome: string;
+    try {
+        const { unlockSharedMailbox } = await import("../../../../lib/crypto/sharedMailboxKeys.js");
+        outcome = await unlockSharedMailbox(mailboxUid);
+    } catch {
+        return undefined;
+    }
+    if (outcome === "unlocked") {
+        return getUnlockedKeys(mailboxUid);
+    }
+    if (outcome === "pending" || outcome === "own_keys_locked") {
+        const message = outcome === "pending" ? SHARED_ACCESS_PENDING_MESSAGE : SHARED_OWN_KEYS_LOCKED_MESSAGE;
+        notify({ kind: "info", title: "Shared mailbox", message });
+        throw new Error(message);
+    }
+    return undefined;
+}
+
 export function UnlockPromptProvider({ children }: { children: React.ReactNode }) {
     const [pending, setPendingState] = useState<PendingUnlock | null>(null);
     // Mirrors `pending` synchronously, so two requests issued in the same tick see each other.
@@ -122,6 +151,11 @@ export function UnlockPromptProvider({ children }: { children: React.ReactNode }
         if (existing) {
             return Promise.resolve(existing);
         }
+        // A mailbox shared with the user opens through their member key wraps, not a password - and its password, if it has one, isn't theirs.
+        return openShared(mailboxUid).then((shared) => shared ?? promptForPassword(mailboxUid, mailboxKeys));
+    }, []);
+
+    const promptForPassword = useCallback((mailboxUid: string, mailboxKeys: PublicKey[]): Promise<UnlockedKeys> => {
         return new Promise<UnlockedKeys>((resolve, reject) => {
             const current = pendingRef.current;
             if (current?.mailboxUid === mailboxUid) {

package/apps/shared/components/mail/ConversationList.tsx

@@ -125,7 +125,7 @@ export default function ConversationList({
         let stale = false;
         void mapWithConcurrency(conversations.filter(conversationLooksEncrypted), 4, async (conversation) => {
             if (!stale) {
-                await decryptForDisplay(conversation.latestMessageUid, conversation.mailboxUid ?? mailboxUid);
+                await decryptForDisplay(conversation.latestMessageUid, conversation.mailboxUid ?? mailboxUid, conversation.latestZeroAccess?.sealedSummary);
             }
         });
         return () => {

package/apps/shared/components/mail/InviteCard.tsx

@@ -15,6 +15,7 @@ import {
     respondToMessageInvite,
 } from "../../../../lib/calendar/inviteApi.js";
 import { guestPermissionsOf } from "../../../../lib/calendar/calendarApi.js";
+import { openSealedEvent } from "../../calendar/sealedEvents.js";
 import { formatMailAddress } from "../../../../lib/mail/mailAddress.js";
 import { useApiClient } from "../../../../lib/util/apiClientContext.js";
 import Button from "../../../../lib/components/buttons/Button.js";
@@ -334,7 +335,7 @@ export default function InviteCard({ messageUid, headingLevel = 2 }: InviteCardP
                             aria-busy={pending === "acceptProposal" || undefined}
                             loading={pending === "acceptProposal"}
                             disabled={busy}
-                            onClick={() => void run("acceptProposal", "Couldn't accept the proposed time", () => acceptProposal(messageUid, client))}
+                            onClick={() => void run("acceptProposal", "Couldn't accept the proposed time", () => acceptProposal(messageUid, client, invite.calendarEventUid, openSealedEvent))}
                         >
                             Accept proposal
                         </Button>
@@ -387,6 +388,15 @@ export default function InviteCard({ messageUid, headingLevel = 2 }: InviteCardP
                             description: invite.description,
                             descriptionHtml: invite.descriptionHtml,
                             guestAddresses: invite.attendees.map((attendee) => attendee.address),
+                            // The invitation's own content: what a protected copy of the event is named by.
+                            invitationContent: invite.summary
+                                ? {
+                                      title: invite.summary,
+                                      location: invite.location ?? undefined,
+                                      description: invite.description ?? undefined,
+                                      descriptionHtml: invite.descriptionHtml ?? undefined,
+                                  }
+                                : undefined,
                         }}
                         canChange={!!invite.canRequestChange}
                         canInvite={!!invite.canRequestInvite}

package/apps/shared/components/mail/MessageDetailPane.tsx

@@ -48,12 +48,13 @@ import MoveToFolderDialog from "./MoveToFolderDialog.js";
 import InviteCard from "./InviteCard.js";
 import { isCalendarAttachment } from "./invite/inviteFormat.js";
 import { useMessageInvite } from "./invite/inviteStore.js";
+import { rememberSealedInvite } from "../../../../lib/calendar/sealedInvites.js";
 import { getUnlockedKeys, subscribeKeySession } from "../../../../lib/crypto/keySession.js";
-import type { MessageSecurityResult, SignatureFailureReason } from "../../../../lib/crypto/messageSecurity.js";
+import type { MessageSecurityResult, SignatureFailureReason, SignerPinsInput } from "../../../../lib/crypto/messageSecurity.js";
 import { extractAddresses, type MimeAttachment } from "../../../../lib/crypto/mime.js";
 import { SignerKeyConflictError, signingKeyFingerprints, trustSigner } from "../../../../lib/crypto/keyvaultApi.js";
 import { isLikelyMailingList } from "../../../../lib/crypto/composeSecurity.js";
-import { SenderKeyState, clearPinnedSignerCache, getPinnedSignerFingerprints, getSignerKeyState } from "./pinnedSigners.js";
+import { SenderKeyState, clearPinnedSignerCache, getPinnedSigners, getSignerKeyState } from "./pinnedSigners.js";
 import { currentVerificationSeal, getVaultGeneration, sendVerificationSeal } from "./verificationSeals.js";
 import { getMyMailboxAccess } from "../../../../lib/mail/mailboxAccessApi.js";
 import { useApiClient } from "../../../../lib/util/apiClientContext.js";
@@ -116,6 +117,9 @@ const SECURITY_INDICATOR: Record<MessageSecurityResult["state"], { label: string
     // Verified when first opened (a verification seal), but not live: muted, never the green verified pill. A signer key
     // later reported compromised switches it to `LATER_COMPROMISED_INDICATOR_CLASS`.
     verified_at_first_open: { label: "Verified when first opened", className: "bg-surface-alt text-text-muted" },
+    // Sealed by the server on arrival (zero-access): distinct from "Encrypted" - the server held this message in the clear while it
+    // delivered it - and never worded as end-to-end, per the spec's indicator table.
+    protected_at_rest: { label: "Protected at rest", className: "bg-primary/5 text-text" },
 };
 
 /** The amber `verified_at_first_open` badge for a signer key since reported compromised. */
@@ -289,11 +293,14 @@ function IconAction({
     );
 }
 
-function SecurityIndicator({ security }: { security: MessageSecurityResult }) {
-    const { label, className } = SECURITY_INDICATOR[security.state];
+function SecurityIndicator({ security, zeroAccess }: { security: MessageSecurityResult; zeroAccess?: boolean }) {
+    // A zero-access message this device can't open yet (keys locked) evaluates as an encrypted one it has no key for: it is still
+    // labelled for what it is.
+    const state = zeroAccess && security.state === "encrypted" && security.decryptError !== undefined ? "protected_at_rest" : security.state;
+    const { label, className } = SECURITY_INDICATOR[state];
     if (security.state !== "verified_at_first_open") {
         // Every encrypted state carries a small lock, so the badge reads at a glance; the words are unchanged.
-        const encrypted = security.state.startsWith("encrypted");
+        const encrypted = state.startsWith("encrypted") || state === "protected_at_rest";
         return (
             <span className={`inline-flex items-center gap-1 text-xs font-medium shrink-0 py-1 px-2.5 rounded-pill ${className}`}>
                 {encrypted && <HiOutlineLockClosed size={12} aria-hidden="true" />}
@@ -473,7 +480,7 @@ export default function MessageDetailPane(props: MessageDetailPaneProps) {
  * surfaced as an attachment - so a message with neither flag can't carry a signature to verify, and
  * fetching its full raw source (attachments included) would be pure waste. */
 function needsRawSecurityEvaluation(message: Message): boolean {
-    return !!message.encrypted || message.hasAttachments;
+    return !!message.encrypted || !!message.zeroAccess || message.hasAttachments;
 }
 
 function MessageDetailContent({
@@ -605,9 +612,9 @@ function MessageDetailContent({
         // mailbox's own signing keys when it sent the message itself. A failed lookup means no pins, which can only
         // ever make a signature "signer not verified", never verified.
         const senderAddress = message.from.address;
-        const pinsPromise = getPinnedSignerFingerprints(message.mailboxUid, senderAddress, client).then(
-            (fingerprints) => ({ loaded: true, fingerprints }),
-            () => ({ loaded: false, fingerprints: [] as string[] }),
+        const pinsPromise = getPinnedSigners(message.mailboxUid, senderAddress, client).then(
+            (signers) => ({ loaded: true, ...signers }),
+            () => ({ loaded: false, fingerprints: [] as string[], openPgpKeys: [] as string[] }),
         );
         // Verification seals (see `verificationSeals.ts`) need unlocked keys and the vault's current master key
         // generation; without either the message is evaluated exactly as before, with no seal. The sender's key records
@@ -633,7 +640,9 @@ function MessageDetailContent({
                 const ownPins = signingKeyFingerprints(ownKeys);
                 const [contactPins, sealContext] = await Promise.all([pinsPromise, sealContextPromise]);
                 const pins = [...new Set([...contactPins.fingerprints, ...ownPins])];
-                const pinned = pins.length > 0 ? pins : undefined;
+                // An OpenPGP signature is checked against the sender's pinned OpenPGP certificates themselves (it names only a key ID).
+                const pinned: SignerPinsInput =
+                    contactPins.openPgpKeys.length > 0 ? { fingerprints: pins, openPgpKeys: contactPins.openPgpKeys } : pins.length > 0 ? pins : undefined;
                 // The raw content is a byte string - only ever handed to evaluateMessageSecurity(), never shown. Keys
                 // are read after the pin lookup's await, so a lock that happened meanwhile is honored.
                 const unlocked = getUnlockedKeys(message.mailboxUid);
@@ -670,7 +679,7 @@ function MessageDetailContent({
                     const viaAlias = await messageSecurity.evaluateMessageSecurity(rawMime, unlocked, pinned, alias);
                     result = { ...result, notAddressedToReader: viaAlias.notAddressedToReader };
                 }
-                const unpinned = contactPins.loaded && pins.length === 0;
+                const unpinned = contactPins.loaded && pins.length === 0 && contactPins.openPgpKeys.length === 0;
                 const keyChanged = signerKeyChanged(result);
                 const [keyState, access] = await Promise.all([
                     keyChanged || (unpinned && UNVERIFIED_SIGNER_STATES.has(result.state)) ? loadKeyState() : undefined,
@@ -686,14 +695,14 @@ function MessageDetailContent({
             .catch(() => {
                 if (!cancelled) {
                     setSecurity(
-                        message.encrypted ? { state: "encrypted", decryptError: ENCRYPTED_LOAD_ERROR } : { state: "unprotected" },
+                        message.encrypted || message.zeroAccess ? { state: "encrypted", decryptError: ENCRYPTED_LOAD_ERROR } : { state: "unprotected" },
                     );
                 }
             });
         return () => {
             cancelled = true;
         };
-    }, [message.uid, message.mailboxUid, message.from.address, message.encrypted, rawEvaluationNeeded, unlockRefresh, readerAddressesKey, client]);
+    }, [message.uid, message.mailboxUid, message.from.address, message.encrypted, message.zeroAccess?.keyFingerprint, rawEvaluationNeeded, unlockRefresh, readerAddressesKey, client]);
 
     // Whether the body is the locked state right now (an encrypted message this device holds no unlocked keys for), for the subscription below.
     const lockedRef = useRef(false);
@@ -776,11 +785,11 @@ function MessageDetailContent({
     // Only ever invoked from the "Trust this signer" dialog, which only opens for an unverified-signer result carrying
     // `signerCertificate`. The pin goes on the contact in the mailbox the message belongs to; the evaluation is then
     // re-run against a fresh pinned-signer lookup, so the badge turns verified.
-    async function handleTrustSigner(address: string, certificate: string) {
+    async function handleTrustSigner(address: string, certificate: string, type?: "openpgp") {
         setTrusting(true);
         setTrustError(null);
         try {
-            await trustSigner(message.mailboxUid, { address, certificate }, client);
+            await trustSigner(message.mailboxUid, { address, certificate, ...(type ? { type } : {}) }, client);
             clearPinnedSignerCache();
             setTrustConfirmOpen(false);
             setUnlockRefresh((n) => n + 1);
@@ -1078,7 +1087,11 @@ function MessageDetailContent({
     // listed with a warning. A signed-only failure never carries recovered attachments.
     const innerAttachments =
         security?.attachments !== undefined &&
-        (verifiedOrSealed || security.state === "encrypted" || security.state === "encrypted_unverified_signer" || security.state === "signature_failed")
+        (verifiedOrSealed ||
+            security.zeroAccess ||
+            security.state === "encrypted" ||
+            security.state === "encrypted_unverified_signer" ||
+            security.state === "signature_failed")
             ? security.attachments
             : undefined;
     // Any state with a valid signature shows the address actually signed for (the protected From when the message
@@ -1101,7 +1114,10 @@ function MessageDetailContent({
             ? security.signerCertificate
             : undefined;
     const keyChanged = security && signerKeyChanged(security) ? security : undefined;
-    const pinnedSignerKey = senderKeyState?.pinned[0];
+    // An OpenPGP signer's key is pinned as the contact's OpenPGP certificate, not a signing certificate.
+    const openPgpSigner = keyChanged?.signerKeyType === "openpgp";
+    const pinnedSignerKey = openPgpSigner ? senderKeyState?.openPgp?.[0] : senderKeyState?.pinned[0];
+    const pinnedSignerSince = openPgpSigner ? senderKeyState?.openPgpPinnedSince : senderKeyState?.pinnedSince;
     const recordedConflict =
         keyChanged && sameFingerprint(senderKeyState?.conflict?.observedKey.fingerprint, keyChanged.signerFingerprint)
             ? senderKeyState!.conflict
@@ -1132,7 +1148,18 @@ function MessageDetailContent({
     // Only a message the server can read and that carries a calendar file is worth asking about an invitation. An encrypted message is out: the
     // server holds only its ciphertext (the calendar file is inside it), so there is nothing for it to find. Drafts and Outbox hold messages
     // that are being written or sent, not received invitations.
-    const mayHoldInvite = !message.encrypted && !inOutbox && message.folderUid !== draftsFolderUid && attachments.some(isCalendarAttachment);
+    // A zero-access message's calendar file is inside the sealed copy: the server reads the invitation from the one decrypted here.
+    const sealedCalendar: string | undefined = security?.zeroAccess ? security.calendar : undefined;
+    // Registered while rendering, not in an effect: the invitation lookup below must find it the moment it is enabled. Writing the same
+    // file for the same message again is a no-op.
+    if (sealedCalendar !== undefined) {
+        rememberSealedInvite(message.uid, sealedCalendar, message.mailboxUid);
+    }
+    const mayHoldInvite =
+        !message.encrypted &&
+        !inOutbox &&
+        message.folderUid !== draftsFolderUid &&
+        (attachments.some(isCalendarAttachment) || sealedCalendar !== undefined);
     // The calendar file of a message whose invitation card is drawn is the card, not a chip in the attachment list (a nameless "attachment" to click):
     // it is listed again if the card could not be drawn (no invitation the server can read, or the lookup failed), so the file is never out of reach.
     const { invite: shownInvite } = useMessageInvite(message.uid, mayHoldInvite);
@@ -1247,7 +1274,7 @@ function MessageDetailContent({
     /** The rules page's "New mail filter", started from this message: its sender and (for a message the server can read) its subject. */
     function handleCreateRule() {
         const params = new URLSearchParams({ mailboxUid: message.mailboxUid, from: message.from.address });
-        const subject = message.encrypted ? "" : withoutSubjectPrefixes(message.subject);
+        const subject = message.encrypted || message.zeroAccess ? "" : withoutSubjectPrefixes(message.subject);
         if (subject) {
             params.set("subject", subject);
         }
@@ -1273,7 +1300,7 @@ function MessageDetailContent({
         createRule: handleCreateRule,
     };
     // An encrypted message can be printed once it has been opened here: while it is still opening, or when it can't be, there is nothing to print.
-    const printReason = !message.encrypted
+    const printReason = !message.encrypted && !message.zeroAccess
         ? undefined
         : security === null
           ? "Still opening this message"
@@ -1325,8 +1352,13 @@ function MessageDetailContent({
                                 </ParticipantLink>
                             </p>
                         )}
-                        {security && <SecurityIndicator security={security} />}
+                        {security && <SecurityIndicator security={security} zeroAccess={!!message.zeroAccess} />}
                     </div>
+                    {security?.signerKeyUnknown && (
+                        <p role="status" className="mt-2 text-sm text-text-muted">
+                            Signed with an OpenPGP key RapidMX doesn&rsquo;t have for this sender yet, so the signature couldn&rsquo;t be checked.
+                        </p>
+                    )}
                     {senderNameCheck.misleading && (
                         <p role="status" className="mt-2 py-2 px-3 rounded-sm text-sm bg-warning/15 text-text">
                             The sender&rsquo;s name &ldquo;{senderName}&rdquo; looks like an email address, but this message was
@@ -1555,9 +1587,10 @@ function MessageDetailContent({
                         <KeyChangeReview
                             mailboxUid={message.mailboxUid}
                             address={senderAddress}
-                            useType="sign"
+                            useType={openPgpSigner ? "encrypt" : "sign"}
+                            {...(openPgpSigner ? { keyType: "openpgp" as const } : {})}
                             ownerName="the sender"
-                            current={pinnedSignerKey && { fingerprint: pinnedSignerKey.fingerprint, since: senderKeyState.pinnedSince! }}
+                            current={pinnedSignerKey && { fingerprint: pinnedSignerKey.fingerprint, since: pinnedSignerSince! }}
                             proposed={{
                                 fingerprint: keyChanged.signerFingerprint!,
                                 emails: keyChanged.signerEmails,
@@ -1711,7 +1744,7 @@ function MessageDetailContent({
                     body never came through the server's own sanitizer (the server never saw the plaintext); `MessageBody` sanitizes every body
                     client-side regardless, behind a no-remote-loads CSP, in a frame that runs no script. */}
                 <div ref={bodyRegionRef} tabIndex={-1} className="outline-none">
-                    {message.encrypted && security === null ? (
+                    {(message.encrypted || message.zeroAccess) && security === null ? (
                         <BodySkeleton />
                     ) : security?.decryptError !== undefined ? (
                         // An encrypted message that could not be read: locked (no unlocked keys - the button asks the app's own unlock prompt, and the message
@@ -1804,7 +1837,7 @@ function MessageDetailContent({
                 onClose={closeSource}
                 mode={sourceView?.mode ?? "source"}
                 source={sourceView?.source ?? { status: "loading" }}
-                encrypted={!!message.encrypted}
+                encrypted={!!message.encrypted || !!message.zeroAccess}
             />
             <Modal open={confirming} onClose={() => setConfirming(false)} title="Recall this message?">
                 <p className="text-sm text-text-muted mb-4">
@@ -1857,7 +1890,7 @@ function MessageDetailContent({
                             className="!w-auto"
                             loading={trusting}
                             disabled={trusting}
-                            onClick={() => handleTrustSigner(senderAddress, trustableCertificate!)}
+                            onClick={() => handleTrustSigner(senderAddress, trustableCertificate!, security?.signerKeyType)}
                         >
                             Trust
                         </Button>

package/apps/shared/components/mail/compose/ComposeWindow.tsx

@@ -48,7 +48,7 @@ import { notify } from "../../../notifications/store.js";
 import { isFileDrag, isInlineImage } from "./dropFiles.js";
 import { evaluateEncryptionRequirement } from "./encryptionRequirement.js";
 import { decideSend, SendBlock } from "../../../mail/outbox/sendDecision.js";
-import { SendRequest, sendDecisionInput, startSend } from "../../../mail/outbox/sendJob.js";
+import { SendRequest, sendDecisionInput, senderCanUseOpenPgp, startSend } from "../../../mail/outbox/sendJob.js";
 import { useCompose, type ComposeSession } from "./ComposeContext.js";
 import { ariaKeyShortcuts, withHint } from "../../../keyboard/format.js";
 import { SHORTCUTS, ShortcutDef } from "../../../keyboard/keymap.js";
@@ -492,7 +492,14 @@ export default function ComposeWindow({
                         return;
                     }
                     lookupFailuresRef.current.delete(key);
-                    const status = resolveRecipientEncryption(mailbox.primarySmtpAddress, ownPrefersMutual, encryptionPolicy, recipient.address, result.lookup);
+                    const status = resolveRecipientEncryption(
+                        mailbox.primarySmtpAddress,
+                        ownPrefersMutual,
+                        encryptionPolicy,
+                        recipient.address,
+                        result.lookup,
+                        senderCanUseOpenPgp(getUnlockedKeys(mailbox.uid)),
+                    );
                     setRecipientStatuses((prev) => ({ ...prev, [key]: status }));
                 });
         }

package/apps/shared/components/mail/compose/RecipientInput.tsx

@@ -5,6 +5,7 @@
 import React, { ChangeEvent, KeyboardEvent, useEffect, useLayoutEffect, useRef, useState } from "react";
 import { createPortal } from "react-dom";
 import { HiOutlineXMark } from "react-icons/hi2";
+import { fetchSuggestionsWithProtectedContacts } from "./protectedContactSuggestions.js";
 import {
     fetchRecipientSuggestions,
     RECIPIENT_SUGGESTION_MIN_QUERY_LENGTH,
@@ -111,7 +112,7 @@ export default function RecipientInput({
     onBlur,
     onCommit,
     mailboxUid,
-    fetchSuggestions = fetchRecipientSuggestions,
+    fetchSuggestions = fetchSuggestionsWithProtectedContacts,
     debounceMs = RECIPIENT_SUGGESTION_DEBOUNCE_MS,
     disabled,
     autoFocus,

package/apps/shared/components/mail/compose/draftResume.ts

@@ -2,7 +2,9 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { type Message, type Recipient, type RecipientType, listAttachments } from "../../../../../lib/mail/mailApi.js";
+import { getUnlockedKeys } from "../../../../../lib/crypto/keySession.js";
+import { evaluateMessageSecurity, type MessageSecurityResult } from "../../../../../lib/crypto/messageSecurity.js";
+import { getMessageRawContent, type Message, type Recipient, type RecipientType, listAttachments } from "../../../../../lib/mail/mailApi.js";
 import { formatMailAddress } from "../../../../../lib/mail/mailAddress.js";
 import type { ApiClient } from "../../../../../lib/util/api.js";
 import type { ResumeCompose } from "../../../mail/outbox/composeBridge.js";
@@ -29,13 +31,22 @@ function textToHtml(text: string): string {
  * What the compose window needs to continue `draft` - a message in the Drafts folder the reader opened rather than one a window of this tab
  * saved - read back from the server: its recipients and subject from the record, its body from the server's copy (with its embedded pictures)
  * and its attachments. `undefined` for a draft that cannot be edited here: an encrypted one holds only its ciphertext, which is never opened.
+ * A draft saved in a zero-access mailbox is stored sealed to the mailbox's zero-access key: it is decrypted here with the unlocked keys (its
+ * subject comes from the decrypted message too, the record holding only `[...]`), and is `undefined` - left to read - while they're locked.
  * Never rejects for a body that could not be loaded - the draft then opens with the preview, as a reply's quote does.
  */
 export async function resumeFromDraft(draft: Message, client?: ApiClient): Promise<ResumeCompose | undefined> {
     if (draft.encrypted) {
         return undefined;
     }
-    const [original, attachments] = await Promise.all([loadOriginalMessage(draft, null), listAttachments(draft.folderUid, draft.uid, client)]);
+    let security: MessageSecurityResult | null = null;
+    if (draft.zeroAccess) {
+        security = await openSealedDraft(draft, client);
+        if (!security) {
+            return undefined;
+        }
+    }
+    const [original, attachments] = await Promise.all([loadOriginalMessage(draft, security), listAttachments(draft.folderUid, draft.uid, client)]);
     const html =
         original.body.html !== undefined ? original.body.html : original.body.text !== undefined ? textToHtml(original.body.text) : textToHtml(draft.bodyPreview ?? "");
     return {
@@ -44,7 +55,7 @@ export async function resumeFromDraft(draft: Message, client?: ApiClient): Promi
         to: recipientText(draft.recipients, "to"),
         cc: recipientText(draft.recipients, "cc"),
         bcc: recipientText(draft.recipients, "bcc"),
-        subject: draft.subject,
+        subject: security?.subject ?? draft.subject,
         html,
         attachments,
         requestReceipt: !!draft.requestReceipt,
@@ -52,3 +63,17 @@ export async function resumeFromDraft(draft: Message, client?: ApiClient): Promi
         encryptRequested: false,
     };
 }
+
+/** `draft`'s sealed message decrypted with its mailbox's unlocked keys, or `null` when they're locked or it won't open with them. */
+async function openSealedDraft(draft: Message, client?: ApiClient): Promise<MessageSecurityResult | null> {
+    const unlocked = getUnlockedKeys(draft.mailboxUid);
+    if (!unlocked) {
+        return null;
+    }
+    try {
+        const security = await evaluateMessageSecurity(await getMessageRawContent(draft.uid, client), unlocked);
+        return security.zeroAccess ? security : null;
+    } catch {
+        return null;
+    }
+}