@rapidmx/web-client 0.36.0 → 0.37.0

package/apps/shared/calendar/calendarReminders.ts

@@ -5,7 +5,9 @@
 /** Pure helpers behind `useCalendarReminders.ts` - kept apart from the hook so the push-payload parsing, the snooze
  * arithmetic and the pop-up's wording are each testable without a React tree or a socket. */
 
+import { getCalendarEvent } from "../../../lib/calendar/calendarApi.js";
 import type { PushEvent } from "../../../lib/mail/pushClient.js";
+import { openSealedEvent } from "./sealedEvents.js";
 
 /** How long "Snooze" waits before the alarm comes back. */
 export const SNOOZE_MS = 5 * 60_000;
@@ -19,6 +21,39 @@ export interface CalendarReminderNotice {
     /** The event's own `location`, verbatim - `undefined`/`null` when the event has none. Not necessarily a URL;
      * see `joinMeetingUrl()` for when it's shown as a join link. */
     location?: string | null;
+    /** The event is of a calendar zero-access encryption protects, or was made from a zero-access invitation: `title` and `location` are
+     * placeholders (`openedReminder()`). */
+    protected?: boolean;
+    /** Set by `openedReminder()` on a protected notice it opened: the placeholder title the push carried, for anything recorded beyond
+     * this tab's memory (the notification history is kept in `sessionStorage` and outlives a mailbox lock). */
+    sealedTitle?: string;
+    /** Set with `sealedTitle`: the placeholder location the push carried, which `sealedReminder()` puts back. */
+    sealedLocation?: string | null;
+}
+
+/** `notice` with a protected event's real title and location, read from the event itself (opened with the mailbox's keys); `notice` as it
+ * came when the event can't be read or opened - the alarm still goes off, with the placeholder. Never rejects. */
+export async function openedReminder(notice: CalendarReminderNotice): Promise<CalendarReminderNotice> {
+    if (!notice.protected) {
+        return notice;
+    }
+    try {
+        // `getCalendarEvent()` opens sealed fields; an event made from a zero-access invitation keeps its content in `sealedContent`.
+        const event = await openSealedEvent(await getCalendarEvent(notice.eventUid));
+        return { ...notice, title: event.title, location: event.location ?? null, sealedTitle: notice.title, sealedLocation: notice.location ?? null };
+    } catch {
+        return notice;
+    }
+}
+
+/** `notice` as the push carried it, when `openedReminder()` opened it - for an alarm still shown, or snoozed, when the mailbox locks: its real
+ * title and location go with the keys that opened them. `openedReminder()` opens it again (it is still `protected`). */
+export function sealedReminder(notice: CalendarReminderNotice): CalendarReminderNotice {
+    if (notice.sealedTitle === undefined) {
+        return notice;
+    }
+    const { sealedTitle, sealedLocation, ...rest } = notice;
+    return { ...rest, title: sealedTitle, location: sealedLocation ?? null };
 }
 
 function isReminderNotice(data: unknown): data is CalendarReminderNotice {

package/apps/shared/calendar/sealedEvents.ts

@@ -9,8 +9,9 @@
  * decryption code is loaded only when a sealed event is actually seen.
  */
 import type { CalendarEvent } from "../../../lib/calendar/calendarApi.js";
-import { getUnlockedKeys } from "../../../lib/crypto/keySession.js";
+import { getUnlockedKeys, subscribeKeySession } from "../../../lib/crypto/keySession.js";
 import { fromBase64 } from "../../../lib/crypto/encoding.js";
+import { markSealedContentOpened } from "../../../lib/calendar/protectedEvents.js";
 import { onSigningOut } from "../components/mail/compose/composeFlushRegistry.js";
 
 /** What `sealedContent.sealed` decrypts to. */
@@ -24,31 +25,55 @@ interface SealedEventFields {
 /** Opened fields by sealed text - the same sealed content always opens to the same fields. Cleared with `clearSealedEvents()`. */
 const opened: Map<string, Partial<CalendarEvent>> = new Map();
 
-/** Forgets every opened event (sign-out, or the test seam). */
+/** Forgets every opened event (a mailbox locking, sign-out, or the test seam). */
 export function clearSealedEvents(): void {
     opened.clear();
 }
 
+let watchingKeys = false;
+
+/** Opened fields go when keys are locked, so nothing opened outlives its key session. Subscribed when the first sealed event is seen,
+ * not on import. */
+function forgetOnLock(): void {
+    if (watchingKeys) {
+        return;
+    }
+    watchingKeys = true;
+    subscribeKeySession((event) => {
+        if (event.state === "locked") {
+            clearSealedEvents();
+        }
+    });
+}
+
 async function openFields(event: CalendarEvent): Promise<Partial<CalendarEvent> | undefined> {
     const sealed: string = event.sealedContent!.sealed;
-    const known = opened.get(sealed);
-    if (known) {
-        return known;
-    }
+    // Checked before the cache: a locked mailbox's events show their placeholders, whatever was opened before.
     const keys = getUnlockedKeys(event.mailboxUid)?.zeroAccessKeys;
     if (!keys?.length) {
         return undefined;
     }
+    const known = opened.get(sealed);
+    if (known) {
+        return known;
+    }
     try {
         const { decryptEnvelopedDataWithKeys } = await import("../../../lib/crypto/smime.js");
         const fields = JSON.parse(new TextDecoder().decode(await decryptEnvelopedDataWithKeys(fromBase64(sealed), keys))) as SealedEventFields;
         const text = (value: unknown): string | undefined => (typeof value === "string" ? value : undefined);
         const result: Partial<CalendarEvent> = {
-            title: text(fields.title) ?? event.title,
+            // An empty sealed title is no title: a newer revision without SUMMARY over a row that keeps its title sealed field by field
+            // (`sealedFields.title`) is sealed with an empty one, and the title opened from that copy (or the row's own) shows instead.
+            // Left out here, not copied from `event`, as the cache is shared by every row with this sealed content.
+            ...(text(fields.title) ? { title: text(fields.title) } : {}),
             location: text(fields.location),
             description: text(fields.description) ?? null,
             descriptionHtml: text(fields.descriptionHtml) ?? null,
         };
+        // The mailbox locked while this was opened: the lock's clear has already run, so it is neither kept nor shown.
+        if (!getUnlockedKeys(event.mailboxUid)) {
+            return undefined;
+        }
         opened.set(sealed, result);
         return result;
     } catch {
@@ -56,18 +81,26 @@ async function openFields(event: CalendarEvent): Promise<Partial<CalendarEvent>
     }
 }
 
-/** `events` with every sealed one this device can open shown with its real title, location and description. Never rejects. */
+/** `events` with every sealed one this device can open shown with its real title, location and description (and marked opened,
+ * `isSealedContentOpened()`). Never rejects. */
 export async function openSealedEvents(events: CalendarEvent[]): Promise<CalendarEvent[]> {
     if (!events.some((event) => event.sealedContent)) {
         return events;
     }
+    forgetOnLock();
     return Promise.all(
         events.map(async (event) => {
             if (!event.sealedContent) {
                 return event;
             }
             const fields = await openFields(event);
-            return fields ? { ...event, ...fields } : event;
+            if (!fields) {
+                return event;
+            }
+            // Marked, so a reply or change request names it by its real title (`invitationContentOf()`). An empty sealed title with no
+            // per-field copy to show instead (an invitation without SUMMARY) is an untitled event: opened, it never shows the row's `[...]`.
+            const untitled = fields.title === undefined && !event.sealedFields?.title ? { title: "" } : {};
+            return markSealedContentOpened({ ...event, ...fields, ...untitled });
         }),
     );
 }

package/apps/shared/calendar/useCalendarReminders.ts

@@ -7,7 +7,8 @@ import { getPushClient } from "../../../lib/mail/pushClient.js";
 import { getNotificationsEnabled } from "../notifications/preferences.js";
 import { playNotificationSound } from "../notifications/sounds.js";
 import { notify } from "../notifications/store.js";
-import { CalendarReminderNotice, SNOOZE_MS, calendarReminderOf, reminderMessage, reminderNotificationId } from "./calendarReminders.js";
+import { useKeysLocked } from "../zeroAccess/useKeysLocked.js";
+import { CalendarReminderNotice, SNOOZE_MS, calendarReminderOf, openedReminder, reminderMessage, reminderNotificationId, sealedReminder } from "./calendarReminders.js";
 
 export interface UseCalendarRemindersOptions {
     /** Nothing is shown without a signed-in user. */
@@ -40,19 +41,26 @@ export interface CalendarAlarms {
  * with the bell again - after exactly `SNOOZE_MS`. A snooze is this tab's own `setTimeout`, cleared on unmount or sign-out; like the alarm itself (the
  * push event is never replayed), it does not survive the tab closing.
  *
- * With pop-ups turned off (`getNotificationsEnabled()`) no dialog is shown and nothing is heard: the alarm is only recorded in "Recent notifications".
+ * With pop-ups turned off (`getNotificationsEnabled()`) no dialog is shown and nothing is heard: the alarm is only recorded in "Recent notifications"
+ * - a protected event's under its placeholder title, never the opened one (the history is kept in `sessionStorage`, past a lock).
  */
 export function useCalendarReminders({ userUid, enabled }: UseCalendarRemindersOptions): CalendarAlarms {
     const [queue, setQueue] = useState<CalendarReminderNotice[]>([]);
     // The queue as of the last render, for the callbacks below to read (a state updater must not start a timer: React may run it twice).
     const queueRef = useRef(queue);
     queueRef.current = queue;
-    const timers = useRef(new Set<ReturnType<typeof setTimeout>>());
+    // Each snoozed alarm by its timer: what it shows when it comes back (a lock meanwhile puts back its placeholders).
+    const timers = useRef(new Map<ReturnType<typeof setTimeout>, CalendarReminderNotice>());
 
     const present = useCallback((notice: CalendarReminderNotice) => {
         if (!getNotificationsEnabled()) {
-            // Off: only the history keeps it.
-            notify({ id: reminderNotificationId(notice.eventUid, notice.startDate), kind: "calendar", title: notice.title, message: reminderMessage(notice.startDate) });
+            // Off: only the history keeps it - with a protected event's placeholder title, since the history is stored in sessionStorage.
+            notify({
+                id: reminderNotificationId(notice.eventUid, notice.startDate),
+                kind: "calendar",
+                title: notice.sealedTitle ?? notice.title,
+                message: reminderMessage(notice.startDate),
+            });
             return;
         }
         const id = reminderNotificationId(notice.eventUid, notice.startDate);
@@ -67,13 +75,13 @@ export function useCalendarReminders({ userUid, enabled }: UseCalendarRemindersO
         const offEvent = getPushClient().onEvent((event) => {
             const notice = calendarReminderOf(event);
             if (notice) {
-                present(notice);
+                void openedReminder(notice).then(present);
             }
         });
         const pending = timers.current;
         return () => {
             offEvent();
-            for (const timer of pending) {
+            for (const timer of pending.keys()) {
                 clearTimeout(timer);
             }
             pending.clear();
@@ -81,15 +89,26 @@ export function useCalendarReminders({ userUid, enabled }: UseCalendarRemindersO
         };
     }, [enabled, userUid, present]);
 
+    // A protected event's alarm shows its title and location opened with the mailbox's keys: on a lock - a notice doesn't say which mailbox,
+    // so any - the alarms shown or snoozed go back to the placeholders the push carried.
+    useKeysLocked(() => {
+        setQueue((current) => current.map(sealedReminder));
+        for (const [timer, notice] of timers.current) {
+            timers.current.set(timer, sealedReminder(notice));
+        }
+    });
+
     const dismiss = useCallback(() => setQueue((current) => current.slice(1)), []);
     const snooze = useCallback(() => {
         const first = queueRef.current[0];
         if (first) {
             const timer = setTimeout(() => {
+                const notice = timers.current.get(timer)!;
                 timers.current.delete(timer);
-                present(first);
+                // Put back to its placeholders by a lock: opened again if the mailbox is unlocked now.
+                void (notice.protected && notice.sealedTitle === undefined ? openedReminder(notice) : Promise.resolve(notice)).then(present);
             }, SNOOZE_MS);
-            timers.current.add(timer);
+            timers.current.set(timer, first);
         }
         setQueue((current) => current.slice(1));
     }, [present]);

package/apps/shared/components/admin/settings/DomainDnsSetup.tsx

@@ -15,6 +15,7 @@ const RECORD_TYPE_LABELS: Record<DnsRecordCheck["type"], string> = {
     spf: "SPF",
     dkim: "DKIM",
     dmarc: "DMARC",
+    openpgpkey_cname: "OpenPGP keys (CNAME)",
     autodiscover_cname: "Autodiscover (CNAME)",
     autodiscover_srv: "Autodiscover (SRV)",
 };
@@ -26,6 +27,7 @@ const RECORD_TYPE_NAMES: Record<DnsRecordCheck["type"], string> = {
     spf: "SPF",
     dkim: "DKIM",
     dmarc: "DMARC",
+    openpgpkey_cname: "OpenPGP keys CNAME",
     autodiscover_cname: "Autodiscover CNAME",
     autodiscover_srv: "Autodiscover SRV",
 };
@@ -33,6 +35,8 @@ const RECORD_TYPE_NAMES: Record<DnsRecordCheck["type"], string> = {
 /** A one-line "why this matters", shown under a checklist row's label - only for record types unfamiliar
  * enough to need one; the well-known mail records (ownership/MX/SPF/DKIM/DMARC) don't. */
 const RECORD_TYPE_HELP: Partial<Record<DnsRecordCheck["type"], string>> = {
+    openpgpkey_cname:
+        "So Proton Mail and other OpenPGP apps can find your users' OpenPGP keys (Web Key Directory) and send them encrypted mail. This hostname also needs to be covered by this server's TLS certificate.",
     autodiscover_cname:
         "So EAS and Outlook clients can find this server automatically from just an email address. This hostname also needs to be covered by this server's TLS certificate.",
     autodiscover_srv:

package/apps/shared/components/admin/settings/EncryptionPolicyForm.tsx

@@ -56,8 +56,12 @@ export default function EncryptionPolicyForm({ policy, onChange, onDirtyChange,
     const [savedValues, setSavedValues] = useState<EncryptionPolicy>(policy);
     // A server without zero-access encryption sends no `allowZeroAccess`; the checkbox is then not shown at all.
     const zeroAccessSupported: boolean = policy.allowZeroAccess !== undefined;
+    // Likewise `allowOpenPgp`, from a server without OpenPGP support.
+    const openPgpSupported: boolean = policy.allowOpenPgp !== undefined;
     const dirty: boolean =
-        TIERS.some((tier) => values[tier.key] !== savedValues[tier.key]) || (zeroAccessSupported && values.allowZeroAccess !== savedValues.allowZeroAccess);
+        TIERS.some((tier) => values[tier.key] !== savedValues[tier.key]) ||
+        (zeroAccessSupported && values.allowZeroAccess !== savedValues.allowZeroAccess) ||
+        (openPgpSupported && values.allowOpenPgp !== savedValues.allowOpenPgp);
     useEffect(() => onDirtyChange?.(dirty), [dirty]);
 
     // Tiers this save would newly set to "Never encrypt", which switches encryption off for everyone's mail of that kind: confirmed first.
@@ -164,6 +168,30 @@ export default function EncryptionPolicyForm({ policy, onChange, onDirtyChange,
                         </label>
                     </div>
                 )}
+                {openPgpSupported && (
+                    <div className="mt-2 pt-4 border-t border-border">
+                        <span className="font-semibold text-sm block mb-1">OpenPGP</span>
+                        <label className="flex items-start gap-2 text-sm">
+                            <input
+                                type="checkbox"
+                                className="mt-1"
+                                checked={values.allowOpenPgp !== false}
+                                onChange={(e) => {
+                                    setSaved(false);
+                                    setValues({ ...values, allowOpenPgp: e.target.checked });
+                                }}
+                            />
+                            <span>
+                                <span className="font-semibold block">Allow OpenPGP</span>
+                                <span className="text-xs text-text-muted">
+                                    Gives every mailbox an OpenPGP key and publishes it, so people using Proton Mail, Thunderbird and other
+                                    OpenPGP apps can send encrypted mail to your users, and your users to them. RapidMX still uses S/MIME
+                                    whenever a recipient can receive it. Off, no OpenPGP keys are created or published.
+                                </span>
+                            </span>
+                        </label>
+                    </div>
+                )}
                 <div>
                     <Button type="submit" loading={saving} disabled={saving} className="!w-auto">
                         Save

package/apps/shared/components/calendar/EventDetails.tsx

@@ -18,10 +18,13 @@ import {
 import { ApiRequestError } from "../../../../lib/util/api.js";
 import { useApiClient } from "../../../../lib/util/apiClientContext.js";
 import { AttendeeResponseInput, guestPermissionsOf, respondToEvent, visibilityOf } from "../../../../lib/calendar/calendarApi.js";
+import { invitationContentOf } from "../../../../lib/calendar/protectedEvents.js";
+import { organizerJoinLink } from "../../../../lib/videoconf/protectedMeetings.js";
 import { htmlToPlainText } from "../../../../lib/calendar/eventDescription.js";
 import { deleteEventOccurrence, deleteEventSeries } from "../../../../lib/calendar/calendarMutations.js";
 import { CalendarOccurrence, describeRecurrence } from "../../../../lib/calendar/recurrence.js";
 import { getVideoMeeting } from "../../../../lib/videoconf/videoMeetingsApi.js";
+import { useKeysLocked } from "../../zeroAccess/useKeysLocked.js";
 import { describeTimeZone, deviceTimeZone } from "../../../../lib/util/timeZone.js";
 import Alert from "../../../../lib/components/feedback/Alert.js";
 import Button from "../../../../lib/components/buttons/Button.js";
@@ -109,7 +112,7 @@ export default function EventDetails({
         }
         let cancelled = false;
         void getVideoMeeting(videoMeetingUid, client)
-            .then((meeting) => meeting.organizerJoinUrl ?? null)
+            .then(organizerJoinLink)
             .catch(() => null)
             .then((url) => {
                 if (!cancelled) {
@@ -120,6 +123,13 @@ export default function EventDetails({
             cancelled = true;
         };
     }, [videoMeetingUid, client]);
+    // A protected meeting's link carries its key after `#`, opened with the mailbox's keys: it goes when they lock, whether or not the
+    // event itself is protected (a meeting is keyed whenever the mailbox has zero-access, its calendar protected or not).
+    useKeysLocked((locked) => {
+        if (locked === occurrence.mailboxUid) {
+            setOrganizerJoinUrl((url) => (url?.includes("#") ? null : url));
+        }
+    });
     // The same scheme allow-list a reminder's own location gets: a hostile or malformed join link never reaches `window.open()`.
     const joinUrl = joinMeetingUrl(organizerJoinUrl);
 
@@ -146,7 +156,7 @@ export default function EventDetails({
         setError(null);
         setBusy(true);
         try {
-            await respondToEvent(occurrence.uid, responseStatus, client);
+            await respondToEvent(occurrence.uid, responseStatus, client, occurrence);
             // A decline soft-deletes the mailbox's own copy server-side - treat it the same as a
             // delete rather than a save so the calendar view drops it immediately.
             if (responseStatus === "declined") {
@@ -356,6 +366,7 @@ export default function EventDetails({
                             description: occurrence.description,
                             descriptionHtml: occurrence.descriptionHtml,
                             guestAddresses: occurrence.attendees.map((a) => a.address),
+                            invitationContent: invitationContentOf(occurrence),
                         }}
                         canChange={canChange}
                         canInvite={canInvite}