@rapidmx/web-client 0.35.0 → 0.37.0

package/lib/videoconf/videoMeetingsApi.ts

@@ -21,6 +21,7 @@
  * `apiFetch<T>()` call (see `crypto/signingProviderApi.ts`'s own note on the same choice).
  */
 
+import type { MeetingProtectionInput } from "./protectedMeetings.js";
 import { ApiClient, withClient } from "../util/api.js";
 import { ListParams, buildQuery } from "../util/apiQuery.js";
 
@@ -47,6 +48,11 @@ export interface VideoMeeting {
      * (its oldest non-cancelled public meeting - see that app's own doc comment) out of `listVideoMeetings()`'s
      * results. */
     dateCreated: string;
+    /** Protected end to end (meet-plugin `specs/meeting_privacy.md`): `title` is `"Meeting"`, the real one sealed, and every link works
+     * only with the meeting key after `#` - see `protectedMeetings.ts`. */
+    keyProtected?: boolean | null;
+    /** A protected meeting's key, sealed to the organizer's zero-access certificate. */
+    keyWraps?: { mailboxUid: string; recipientFingerprint: string; kind: string; cms: string }[] | null;
 }
 
 /**
@@ -80,8 +86,9 @@ export interface VideoMeetingInviteeJoinInfo extends VideoMeetingInvitee {
 export interface CreateVideoMeetingInput {
     /** The mailbox that owns the meeting — the one whose ACL every later call on it is checked against. */
     mailboxUid: string;
-    /** Non-empty, at most 200 characters (the server rejects anything else with a 400). */
-    title: string;
+    /** Non-empty, at most 200 characters (the server rejects anything else with a 400). Omitted for a protected meeting, whose title is
+     * sealed in `protection`. */
+    title?: string;
     visibility: VideoMeetingVisibility;
     /** The `CalendarEvent` this meeting is being minted for, when there is one. */
     calendarEventUid?: string;
@@ -90,7 +97,9 @@ export interface CreateVideoMeetingInput {
     /** Required, and non-empty, for a `"private"` meeting — the server mints one personal join link per entry
      * and 400s a private meeting with none. Never send the organizer here: they reach their own meeting
      * through ownership (and `organizerJoinUrl`), not as a guest. */
-    invitees?: VideoMeetingInvitee[];
+    invitees?: (VideoMeetingInvitee | { email: string; sealedFields?: { displayName: string } })[];
+    /** Makes the meeting protected end to end - `protectMeeting()` in `protectedMeetings.ts`. */
+    protection?: MeetingProtectionInput;
 }
 
 export interface VideoMeetingCreateResult {
@@ -120,9 +129,11 @@ export function createVideoMeeting(input: CreateVideoMeetingInput, client?: ApiC
 export interface UpdateVideoMeetingInput {
     title?: string;
     status?: "cancelled";
+    /** A protected meeting's new key expiry (ISO), when its event's end moved - `followMeetingKeyExpiry()` in `protectedMeetings.ts`. */
+    keyExpiresAt?: string;
 }
 
-/** Renames or cancels a meeting. Requires UPDATE on its owning mailbox. */
+/** Renames, cancels or moves the key expiry of a meeting. Requires UPDATE on its owning mailbox. */
 export function updateVideoMeeting(uid: string, input: UpdateVideoMeetingInput, client?: ApiClient): Promise<VideoMeeting> {
     return withClient(client, `/mail/video-meetings/${encodeURIComponent(uid)}`, { method: "PUT", body: JSON.stringify(input) });
 }

package/lib/zeroAccess/sealedMoves.ts

@@ -0,0 +1,79 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * A calendar event, contact or task whose content is sealed to its mailbox's zero-access key - field by field (`sealedFields`), as one
+ * blob (`sealedContent`, an event from a zero-access invitation) or its photo (`photoSealed`) - can't move to another mailbox: what it
+ * keeps sealed is addressed to the mailbox it is in, and the server can't seal it again to the destination's key. restapi refuses such a
+ * move with a `409` (`ZeroAccessRouteSealing.refuseSealedMove()`).
+ *
+ * The record API wrappers (`updateContact()`, `updateCalendarEvent()`, `updateTask()`) refuse it before sending anything when they know the
+ * record (`guardSealedMove()`), and turn the server's refusal into the same `SealedMoveError` when they don't - one request, so nothing is
+ * left half moved. A UI offering a move asks `canMoveToMailbox()` first, and shows `SealedMoveError`'s message.
+ */
+import { ApiRequestError } from "../util/api.js";
+
+/** The fields of a record that say whether its content is sealed, and where. */
+export interface MovableRecord {
+    mailboxUid: string;
+    sealedFields?: Record<string, string> | null;
+    sealedContent?: unknown;
+    photoSealed?: boolean | null;
+}
+
+/** What a refused move says. */
+export const SEALED_MOVE_MESSAGE =
+    "This item is protected by its mailbox's zero-access encryption, so it can't be moved to another mailbox. Create a copy there instead.";
+
+/** `SealedMoveError.code`. */
+export const SEALED_MOVE_CODE = "sealed-move";
+
+/** restapi's `ApiErrors.INVALID_REQUEST`, the code of its sealed-move refusal and of its other zero-access refusals (a version conflict,
+ * also a `409`, is `api-012`; an identifier already taken, `api-011`). */
+export const INVALID_REQUEST_CODE = "api-003";
+
+/** A move of a protected record to another mailbox, refused - by this client before sending it, or by the server. Nothing was written. */
+export class SealedMoveError extends ApiRequestError {
+    constructor(message: string = SEALED_MOVE_MESSAGE) {
+        super(message, 409, SEALED_MOVE_CODE);
+        this.name = "SealedMoveError";
+    }
+}
+
+/** Whether `record` keeps any of its content sealed to its mailbox's key. */
+export function isSealedRecord(record: MovableRecord): boolean {
+    return (!!record.sealedFields && Object.keys(record.sealedFields).length > 0) || !!record.sealedContent || !!record.photoSealed;
+}
+
+/** Whether `record` may move to mailbox `targetMailboxUid`: always within its own mailbox, and to another only when nothing of it is sealed. */
+export function canMoveToMailbox(record: MovableRecord, targetMailboxUid: string): boolean {
+    return targetMailboxUid === record.mailboxUid || !isSealedRecord(record);
+}
+
+/** Whether `err` is restapi's refusal of a sealed record's move. */
+export function isSealedMoveRefusal(err: unknown): err is ApiRequestError {
+    return err instanceof SealedMoveError || (err instanceof ApiRequestError && err.status === 409 && err.code === INVALID_REQUEST_CODE);
+}
+
+/**
+ * Runs `write`, a save of a record that sets its `mailboxUid` to `targetMailboxUid` (`undefined`: the save doesn't set it). With `current`,
+ * the record as this device has it, a move of a sealed one is refused before anything is sent. A move the server refuses for the same reason
+ * rejects with `SealedMoveError` too.
+ */
+export async function guardSealedMove<T>(current: MovableRecord | undefined, targetMailboxUid: string | undefined, write: () => Promise<T>): Promise<T> {
+    if (targetMailboxUid === undefined) {
+        return write();
+    }
+    if (current && !canMoveToMailbox(current, targetMailboxUid)) {
+        throw new SealedMoveError();
+    }
+    try {
+        return await write();
+    } catch (err) {
+        if (current?.mailboxUid !== targetMailboxUid && isSealedMoveRefusal(err) && !(err instanceof SealedMoveError)) {
+            throw new SealedMoveError();
+        }
+        throw err;
+    }
+}

package/lib/zeroAccess/sealedRecords.ts

@@ -0,0 +1,153 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * Calendar events, contacts and tasks of a mailbox whose zero-access encryption covers their type keep their protected fields only
+ * sealed, field by field, to the mailbox's zero-access key (`sealedFields`; the readable column holds a placeholder - restapi
+ * `specs/search.md` §3 *What It Covers*). They are opened here with the mailbox's unlocked keys; while it is locked a record keeps its
+ * placeholders. The decryption code is loaded only when a sealed record is actually seen.
+ *
+ * Writing needs nothing here: the client sends plaintext and the server seals it on arrival.
+ */
+import { fromBase64 } from "../crypto/encoding.js";
+import { getUnlockedKeys, subscribeKeySession } from "../crypto/keySession.js";
+
+/** A record that may carry sealed fields. */
+export interface SealedRecord {
+    mailboxUid: string;
+    /** Protected field name -> base64 CMS of its JSON value. */
+    sealedFields?: Record<string, string> | null;
+}
+
+/** Opened values by sealed text - the same sealed text always opens to the same value. Cleared with `clearSealedRecords()`. */
+const opened: Map<string, unknown> = new Map();
+
+/** Forgets every opened value (a mailbox locking, or the test seam). */
+export function clearSealedRecords(): void {
+    opened.clear();
+}
+
+/** Set on a record whose every sealed field was opened. A symbol, so it survives a spread copy (an occurrence of an event) and is never sent. */
+const OPENED = Symbol("openedSealedRecord");
+
+/** Whether every protected field of `record` holds its real value - opened on this device - rather than its placeholder. */
+export function isOpenedRecord(record: SealedRecord | undefined): boolean {
+    return !!record && (record as any)[OPENED] === true;
+}
+
+/** Whether `record` has protected fields. */
+export function isProtectedRecord(record: SealedRecord | undefined): boolean {
+    return !!record?.sealedFields && Object.keys(record.sealedFields).length > 0;
+}
+
+/** `record` with every sealed field (of `only`, when given) this device can open set to its value; `undefined` when it can't open them
+ * (locked, or not its key). */
+async function openRecord<T extends SealedRecord>(record: T, only?: readonly string[]): Promise<T | undefined> {
+    const keys = getUnlockedKeys(record.mailboxUid)?.zeroAccessKeys;
+    if (!keys?.length) {
+        return undefined;
+    }
+    try {
+        const values: Record<string, unknown> = {};
+        for (const [name, sealed] of Object.entries(record.sealedFields!)) {
+            if (only && !only.includes(name)) {
+                continue;
+            }
+            if (!opened.has(sealed)) {
+                const { decryptEnvelopedDataWithKeys } = await import("../crypto/smime.js");
+                const value: unknown = JSON.parse(new TextDecoder().decode(await decryptEnvelopedDataWithKeys(fromBase64(sealed), keys)));
+                // The mailbox locked while this was opened: the lock's clear has already run, so nothing is kept or shown.
+                if (!getUnlockedKeys(record.mailboxUid)) {
+                    return undefined;
+                }
+                opened.set(sealed, value);
+            }
+            values[name] = opened.get(sealed);
+        }
+        return only ? { ...record, ...values } : { ...record, ...values, [OPENED]: true };
+    } catch {
+        return undefined;
+    }
+}
+
+let watchingKeys = false;
+
+/** Opened values go when keys are locked (which signing out does), so nothing opened outlives its key session. Subscribed when the
+ * first protected record is opened, not on import. */
+function forgetOnLock(): void {
+    if (watchingKeys) {
+        return;
+    }
+    watchingKeys = true;
+    subscribeKeySession((event) => {
+        if (event.state === "locked") {
+            clearSealedRecords();
+        }
+    });
+}
+
+/** `records` with every protected one this device can open shown with its real values - only the fields in `only`, when given (a list
+ * shows a contact's name before anyone asks for its phone numbers: each field is one decryption). Never rejects. */
+export async function openSealedRecords<T extends SealedRecord>(records: T[], only?: readonly string[]): Promise<T[]> {
+    if (!records.some(isProtectedRecord)) {
+        return records;
+    }
+    forgetOnLock();
+    return Promise.all(records.map(async (record) => (isProtectedRecord(record) ? ((await openRecord(record, only)) ?? record) : record)));
+}
+
+/** `der` (a blob the server sealed to `mailboxUid`'s zero-access key, e.g. a protected contact's photo) opened, or `undefined` when this
+ * device can't (the mailbox is locked, or it isn't its key). */
+export async function openSealedBytes(mailboxUid: string, der: Uint8Array): Promise<Uint8Array | undefined> {
+    const keys = getUnlockedKeys(mailboxUid)?.zeroAccessKeys;
+    if (!keys?.length) {
+        return undefined;
+    }
+    try {
+        const { decryptEnvelopedDataWithKeys } = await import("../crypto/smime.js");
+        const bytes = await decryptEnvelopedDataWithKeys(der, keys);
+        // Locked while it was opened: not handed out.
+        return getUnlockedKeys(mailboxUid) ? bytes : undefined;
+    } catch {
+        return undefined;
+    }
+}
+
+/** A field's value for comparing what a write sends with what was shown: every empty form (`null`, `undefined`, `""`, `[]`) is one. */
+function comparable(value: unknown): string {
+    return value === null || value === undefined || value === "" || (Array.isArray(value) && value.length === 0) ? "" : JSON.stringify(value);
+}
+
+/**
+ * `input` as written to `shown` - the record the edit started from, as this device showed it: unchanged when `shown` isn't protected.
+ * Otherwise without the protected fields (those `shown.sealedFields` names) whose values are what `shown` has: an opened record's write
+ * sends only what changed, and a placeholder a record that couldn't be opened showed is never sent back as its value. A field of an opened
+ * record that held a value and is emptied is named in `clearedFields`: restapi applies an empty value of a sealed field as a clear only
+ * then (`ZeroAccessRouteSealing.takeClearedFields()`), since an empty placeholder sent back by a client that couldn't open the record would
+ * otherwise wipe the sealed value for good. `opened`: `shown` holds the real values (by default, whether it was opened here).
+ */
+export function protectedRecordWrite<T extends object>(shown: SealedRecord | undefined, input: T, opened: boolean = isOpenedRecord(shown)): T {
+    if (!isProtectedRecord(shown)) {
+        return input;
+    }
+    const changes: Record<string, unknown> = { ...(input as Record<string, unknown>) };
+    const clearedFields: string[] = [];
+    for (const field of Object.keys(shown!.sealedFields!)) {
+        if (!(field in changes)) {
+            continue;
+        }
+        const value: string = comparable(changes[field]);
+        if (value === comparable((shown as unknown as Record<string, unknown>)[field])) {
+            delete changes[field];
+        } else if (value === "" && opened) {
+            clearedFields.push(field);
+        }
+    }
+    return (clearedFields.length > 0 ? { ...changes, clearedFields } : changes) as T;
+}
+
+/** `openSealedRecords()` for one record. */
+export async function openSealedRecord<T extends SealedRecord>(record: T, only?: readonly string[]): Promise<T> {
+    return (await openSealedRecords([record], only))[0];
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rapidmx/web-client",
-  "version": "0.35.0",
+  "version": "0.37.0",
   "description": "RapidMX's webmail and admin console React UI for web-based clients.",
   "type": "module",
   "repository": "https://github.com/rapidmx/web-client",
@@ -37,7 +37,7 @@
     "trailingComma": "es5"
   },
   "peerDependencies": {
-    "@rapidrest/react": ">=2.1.0 <3",
+    "@rapidrest/react": "2.x",
     "react": "19.x",
     "react-dom": "19.x"
   },
@@ -59,15 +59,17 @@
     "@tiptap/starter-kit": "^3.31.3",
     "asn1js": "^3.0.10",
     "date-fns": "^4.4.0",
-    "dompurify": "^3.4.15",
+    "dompurify": "^3.4.17",
     "hash-wasm": "^4.12.0",
+    "openpgp": "^6.3.2",
     "pkijs": "^3.4.0",
     "react-icons": "^5.7.0",
     "reflect-metadata": "^0.2.2",
     "rrule": "^2.8.1"
   },
   "devDependencies": {
-    "@rapidrest/react": "^2.1.0",
+    "@openpgp/web-stream-tools": "~0.3.1",
+    "@rapidrest/react": "^2.2.0",
     "@tailwindcss/vite": "^4.3.3",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.1",
@@ -92,9 +94,16 @@
     "tailwindcss": "^4.3.3",
     "tsx": "^4.23.13",
     "typescript": "^6.0.3",
-    "vite": "^8.2.2",
+    "vite": "^8.3.5",
     "vitest": "^5.0.0"
   },
+  "resolutions": {
+    "brace-expansion@npm:^1.1.7": "^1.1.21",
+    "brace-expansion@npm:^5.0.8": "^5.0.12",
+    "source-map-js@npm:^1.2.1": "^1.2.2",
+    "undici@npm:^8.4.1": "^8.12.3",
+    "undici@npm:^8.9.0": "^8.12.3"
+  },
   "packageManager": "yarn@4.5.3",
   "engines": {
     "node": ">=24.0.0"