@rapidmx/web-client 0.36.0 → 0.37.0

package/dist/apps/shared/calendar/calendarReminders.js

@@ -4,8 +4,34 @@
 ///////////////////////////////////////////////////////////////////////////////
 /** Pure helpers behind `useCalendarReminders.ts` - kept apart from the hook so the push-payload parsing, the snooze
  * arithmetic and the pop-up's wording are each testable without a React tree or a socket. */
+import { getCalendarEvent } from "../../../lib/calendar/calendarApi.js";
+import { openSealedEvent } from "./sealedEvents.js";
 /** How long "Snooze" waits before the alarm comes back. */
 export const SNOOZE_MS = 5 * 60000;
+/** `notice` with a protected event's real title and location, read from the event itself (opened with the mailbox's keys); `notice` as it
+ * came when the event can't be read or opened - the alarm still goes off, with the placeholder. Never rejects. */
+export async function openedReminder(notice) {
+    if (!notice.protected) {
+        return notice;
+    }
+    try {
+        // `getCalendarEvent()` opens sealed fields; an event made from a zero-access invitation keeps its content in `sealedContent`.
+        const event = await openSealedEvent(await getCalendarEvent(notice.eventUid));
+        return { ...notice, title: event.title, location: event.location ?? null, sealedTitle: notice.title, sealedLocation: notice.location ?? null };
+    }
+    catch {
+        return notice;
+    }
+}
+/** `notice` as the push carried it, when `openedReminder()` opened it - for an alarm still shown, or snoozed, when the mailbox locks: its real
+ * title and location go with the keys that opened them. `openedReminder()` opens it again (it is still `protected`). */
+export function sealedReminder(notice) {
+    if (notice.sealedTitle === undefined) {
+        return notice;
+    }
+    const { sealedTitle, sealedLocation, ...rest } = notice;
+    return { ...rest, title: sealedTitle, location: sealedLocation ?? null };
+}
 function isReminderNotice(data) {
     const notice = data;
     return (!!notice &&

package/dist/apps/shared/calendar/sealedEvents.d.ts

@@ -5,9 +5,10 @@
  * decryption code is loaded only when a sealed event is actually seen.
  */
 import type { CalendarEvent } from "../../../lib/calendar/calendarApi.js";
-/** Forgets every opened event (sign-out, or the test seam). */
+/** Forgets every opened event (a mailbox locking, sign-out, or the test seam). */
 export declare function clearSealedEvents(): void;
-/** `events` with every sealed one this device can open shown with its real title, location and description. Never rejects. */
+/** `events` with every sealed one this device can open shown with its real title, location and description (and marked opened,
+ * `isSealedContentOpened()`). Never rejects. */
 export declare function openSealedEvents(events: CalendarEvent[]): Promise<CalendarEvent[]>;
 /** `openSealedEvents()` for one event. */
 export declare function openSealedEvent(event: CalendarEvent): Promise<CalendarEvent>;

package/dist/apps/shared/calendar/sealedEvents.js

@@ -1,32 +1,55 @@
-import { getUnlockedKeys } from "../../../lib/crypto/keySession.js";
+import { getUnlockedKeys, subscribeKeySession } from "../../../lib/crypto/keySession.js";
 import { fromBase64 } from "../../../lib/crypto/encoding.js";
+import { markSealedContentOpened } from "../../../lib/calendar/protectedEvents.js";
 import { onSigningOut } from "../components/mail/compose/composeFlushRegistry.js";
 /** Opened fields by sealed text - the same sealed content always opens to the same fields. Cleared with `clearSealedEvents()`. */
 const opened = new Map();
-/** Forgets every opened event (sign-out, or the test seam). */
+/** Forgets every opened event (a mailbox locking, sign-out, or the test seam). */
 export function clearSealedEvents() {
     opened.clear();
 }
+let watchingKeys = false;
+/** Opened fields go when keys are locked, so nothing opened outlives its key session. Subscribed when the first sealed event is seen,
+ * not on import. */
+function forgetOnLock() {
+    if (watchingKeys) {
+        return;
+    }
+    watchingKeys = true;
+    subscribeKeySession((event) => {
+        if (event.state === "locked") {
+            clearSealedEvents();
+        }
+    });
+}
 async function openFields(event) {
     const sealed = event.sealedContent.sealed;
-    const known = opened.get(sealed);
-    if (known) {
-        return known;
-    }
+    // Checked before the cache: a locked mailbox's events show their placeholders, whatever was opened before.
     const keys = getUnlockedKeys(event.mailboxUid)?.zeroAccessKeys;
     if (!keys?.length) {
         return undefined;
     }
+    const known = opened.get(sealed);
+    if (known) {
+        return known;
+    }
     try {
         const { decryptEnvelopedDataWithKeys } = await import("../../../lib/crypto/smime.js");
         const fields = JSON.parse(new TextDecoder().decode(await decryptEnvelopedDataWithKeys(fromBase64(sealed), keys)));
         const text = (value) => (typeof value === "string" ? value : undefined);
         const result = {
-            title: text(fields.title) ?? event.title,
+            // An empty sealed title is no title: a newer revision without SUMMARY over a row that keeps its title sealed field by field
+            // (`sealedFields.title`) is sealed with an empty one, and the title opened from that copy (or the row's own) shows instead.
+            // Left out here, not copied from `event`, as the cache is shared by every row with this sealed content.
+            ...(text(fields.title) ? { title: text(fields.title) } : {}),
             location: text(fields.location),
             description: text(fields.description) ?? null,
             descriptionHtml: text(fields.descriptionHtml) ?? null,
         };
+        // The mailbox locked while this was opened: the lock's clear has already run, so it is neither kept nor shown.
+        if (!getUnlockedKeys(event.mailboxUid)) {
+            return undefined;
+        }
         opened.set(sealed, result);
         return result;
     }
@@ -34,17 +57,25 @@ async function openFields(event) {
         return undefined;
     }
 }
-/** `events` with every sealed one this device can open shown with its real title, location and description. Never rejects. */
+/** `events` with every sealed one this device can open shown with its real title, location and description (and marked opened,
+ * `isSealedContentOpened()`). Never rejects. */
 export async function openSealedEvents(events) {
     if (!events.some((event) => event.sealedContent)) {
         return events;
     }
+    forgetOnLock();
     return Promise.all(events.map(async (event) => {
         if (!event.sealedContent) {
             return event;
         }
         const fields = await openFields(event);
-        return fields ? { ...event, ...fields } : event;
+        if (!fields) {
+            return event;
+        }
+        // Marked, so a reply or change request names it by its real title (`invitationContentOf()`). An empty sealed title with no
+        // per-field copy to show instead (an invitation without SUMMARY) is an untitled event: opened, it never shows the row's `[...]`.
+        const untitled = fields.title === undefined && !event.sealedFields?.title ? { title: "" } : {};
+        return markSealedContentOpened({ ...event, ...fields, ...untitled });
     }));
 }
 /** `openSealedEvents()` for one event. */

package/dist/apps/shared/calendar/useCalendarReminders.d.ts

@@ -28,6 +28,7 @@ export interface CalendarAlarms {
  * with the bell again - after exactly `SNOOZE_MS`. A snooze is this tab's own `setTimeout`, cleared on unmount or sign-out; like the alarm itself (the
  * push event is never replayed), it does not survive the tab closing.
  *
- * With pop-ups turned off (`getNotificationsEnabled()`) no dialog is shown and nothing is heard: the alarm is only recorded in "Recent notifications".
+ * With pop-ups turned off (`getNotificationsEnabled()`) no dialog is shown and nothing is heard: the alarm is only recorded in "Recent notifications"
+ * - a protected event's under its placeholder title, never the opened one (the history is kept in `sessionStorage`, past a lock).
  */
 export declare function useCalendarReminders({ userUid, enabled }: UseCalendarRemindersOptions): CalendarAlarms;

package/dist/apps/shared/calendar/useCalendarReminders.js

@@ -7,7 +7,8 @@ import { getPushClient } from "../../../lib/mail/pushClient.js";
 import { getNotificationsEnabled } from "../notifications/preferences.js";
 import { playNotificationSound } from "../notifications/sounds.js";
 import { notify } from "../notifications/store.js";
-import { SNOOZE_MS, calendarReminderOf, reminderMessage, reminderNotificationId } from "./calendarReminders.js";
+import { useKeysLocked } from "../zeroAccess/useKeysLocked.js";
+import { SNOOZE_MS, calendarReminderOf, openedReminder, reminderMessage, reminderNotificationId, sealedReminder } from "./calendarReminders.js";
 /**
  * Calendar alarms. restapi's `CalendarReminderJob` fires a `"CalendarEvent"`/`"reminder"` push event (`{ eventUid, title, startDate, location }`)
  * when an event's `reminderMinutesBeforeStart` comes due, over the same shared push connection Mail already keeps open (`getPushClient()`) -
@@ -20,18 +21,25 @@ import { SNOOZE_MS, calendarReminderOf, reminderMessage, reminderNotificationId
  * with the bell again - after exactly `SNOOZE_MS`. A snooze is this tab's own `setTimeout`, cleared on unmount or sign-out; like the alarm itself (the
  * push event is never replayed), it does not survive the tab closing.
  *
- * With pop-ups turned off (`getNotificationsEnabled()`) no dialog is shown and nothing is heard: the alarm is only recorded in "Recent notifications".
+ * With pop-ups turned off (`getNotificationsEnabled()`) no dialog is shown and nothing is heard: the alarm is only recorded in "Recent notifications"
+ * - a protected event's under its placeholder title, never the opened one (the history is kept in `sessionStorage`, past a lock).
  */
 export function useCalendarReminders({ userUid, enabled }) {
     const [queue, setQueue] = useState([]);
     // The queue as of the last render, for the callbacks below to read (a state updater must not start a timer: React may run it twice).
     const queueRef = useRef(queue);
     queueRef.current = queue;
-    const timers = useRef(new Set());
+    // Each snoozed alarm by its timer: what it shows when it comes back (a lock meanwhile puts back its placeholders).
+    const timers = useRef(new Map());
     const present = useCallback((notice) => {
         if (!getNotificationsEnabled()) {
-            // Off: only the history keeps it.
-            notify({ id: reminderNotificationId(notice.eventUid, notice.startDate), kind: "calendar", title: notice.title, message: reminderMessage(notice.startDate) });
+            // Off: only the history keeps it - with a protected event's placeholder title, since the history is stored in sessionStorage.
+            notify({
+                id: reminderNotificationId(notice.eventUid, notice.startDate),
+                kind: "calendar",
+                title: notice.sealedTitle ?? notice.title,
+                message: reminderMessage(notice.startDate),
+            });
             return;
         }
         const id = reminderNotificationId(notice.eventUid, notice.startDate);
@@ -45,28 +53,38 @@ export function useCalendarReminders({ userUid, enabled }) {
         const offEvent = getPushClient().onEvent((event) => {
             const notice = calendarReminderOf(event);
             if (notice) {
-                present(notice);
+                void openedReminder(notice).then(present);
             }
         });
         const pending = timers.current;
         return () => {
             offEvent();
-            for (const timer of pending) {
+            for (const timer of pending.keys()) {
                 clearTimeout(timer);
             }
             pending.clear();
             setQueue([]);
         };
     }, [enabled, userUid, present]);
+    // A protected event's alarm shows its title and location opened with the mailbox's keys: on a lock - a notice doesn't say which mailbox,
+    // so any - the alarms shown or snoozed go back to the placeholders the push carried.
+    useKeysLocked(() => {
+        setQueue((current) => current.map(sealedReminder));
+        for (const [timer, notice] of timers.current) {
+            timers.current.set(timer, sealedReminder(notice));
+        }
+    });
     const dismiss = useCallback(() => setQueue((current) => current.slice(1)), []);
     const snooze = useCallback(() => {
         const first = queueRef.current[0];
         if (first) {
             const timer = setTimeout(() => {
+                const notice = timers.current.get(timer);
                 timers.current.delete(timer);
-                present(first);
+                // Put back to its placeholders by a lock: opened again if the mailbox is unlocked now.
+                void (notice.protected && notice.sealedTitle === undefined ? openedReminder(notice) : Promise.resolve(notice)).then(present);
             }, SNOOZE_MS);
-            timers.current.add(timer);
+            timers.current.set(timer, first);
         }
         setQueue((current) => current.slice(1));
     }, [present]);

package/dist/apps/shared/components/admin/settings/DomainDnsSetup.js

@@ -15,6 +15,7 @@ const RECORD_TYPE_LABELS = {
     spf: "SPF",
     dkim: "DKIM",
     dmarc: "DMARC",
+    openpgpkey_cname: "OpenPGP keys (CNAME)",
     autodiscover_cname: "Autodiscover (CNAME)",
     autodiscover_srv: "Autodiscover (SRV)",
 };
@@ -25,12 +26,14 @@ const RECORD_TYPE_NAMES = {
     spf: "SPF",
     dkim: "DKIM",
     dmarc: "DMARC",
+    openpgpkey_cname: "OpenPGP keys CNAME",
     autodiscover_cname: "Autodiscover CNAME",
     autodiscover_srv: "Autodiscover SRV",
 };
 /** A one-line "why this matters", shown under a checklist row's label - only for record types unfamiliar
  * enough to need one; the well-known mail records (ownership/MX/SPF/DKIM/DMARC) don't. */
 const RECORD_TYPE_HELP = {
+    openpgpkey_cname: "So Proton Mail and other OpenPGP apps can find your users' OpenPGP keys (Web Key Directory) and send them encrypted mail. This hostname also needs to be covered by this server's TLS certificate.",
     autodiscover_cname: "So EAS and Outlook clients can find this server automatically from just an email address. This hostname also needs to be covered by this server's TLS certificate.",
     autodiscover_srv: "Same purpose as the CNAME above, for clients that check DNS SRV instead - and, unlike the CNAME, needs no extra TLS certificate, since it points at a hostname already covered. Prefer this one when a second certificate is hard to obtain.",
 };

package/dist/apps/shared/components/admin/settings/EncryptionPolicyForm.js

@@ -38,7 +38,11 @@ export default function EncryptionPolicyForm({ policy, onChange, onDirtyChange,
     const [savedValues, setSavedValues] = useState(policy);
     // A server without zero-access encryption sends no `allowZeroAccess`; the checkbox is then not shown at all.
     const zeroAccessSupported = policy.allowZeroAccess !== undefined;
-    const dirty = TIERS.some((tier) => values[tier.key] !== savedValues[tier.key]) || (zeroAccessSupported && values.allowZeroAccess !== savedValues.allowZeroAccess);
+    // Likewise `allowOpenPgp`, from a server without OpenPGP support.
+    const openPgpSupported = policy.allowOpenPgp !== undefined;
+    const dirty = TIERS.some((tier) => values[tier.key] !== savedValues[tier.key]) ||
+        (zeroAccessSupported && values.allowZeroAccess !== savedValues.allowZeroAccess) ||
+        (openPgpSupported && values.allowOpenPgp !== savedValues.allowOpenPgp);
     useEffect(() => onDirtyChange?.(dirty), [dirty]);
     // Tiers this save would newly set to "Never encrypt", which switches encryption off for everyone's mail of that kind: confirmed first.
     const [confirmingProhibit, setConfirmingProhibit] = useState(null);
@@ -86,5 +90,8 @@ export default function EncryptionPolicyForm({ policy, onChange, onDirtyChange,
                                 }, children: STATES.map((state) => (_jsx("option", { value: state.value, children: state.label }, state.value))) }), _jsx("span", { className: "text-xs text-text-muted", children: tier.help })] }, tier.key))), zeroAccessSupported && (_jsxs("div", { className: "mt-2 pt-4 border-t border-border", children: [_jsx("span", { className: "font-semibold text-sm block mb-1", children: "Zero-access encryption" }), _jsxs("label", { className: "flex items-start gap-2 text-sm", children: [_jsx("input", { type: "checkbox", className: "mt-1", checked: values.allowZeroAccess !== false, onChange: (e) => {
                                             setSaved(false);
                                             setValues({ ...values, allowZeroAccess: e.target.checked });
-                                        } }), _jsxs("span", { children: [_jsx("span", { className: "font-semibold block", children: "Allow zero-access encryption" }), _jsx("span", { className: "text-xs text-text-muted", children: "Mail that arrives unencrypted is encrypted the moment it is received, to a key only the mailbox\u2019s owner can unlock, and this server keeps no readable copy - administrators can\u2019t read it either, except through an escrow scope. People can still turn it off for their own mailbox. Search of message contents then happens in the app instead of on the server." })] })] })] })), _jsx("div", { children: _jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Save" }) })] }), _jsxs(Modal, { open: confirmingProhibit !== null, onClose: () => setConfirmingProhibit(null), title: "Turn off encryption?", children: [_jsxs("p", { className: "text-sm mb-3", children: ["Saving sets ", _jsx("strong", { children: confirmingProhibit?.join(", ") }), " to Never encrypt. Nobody on this server can then encrypt that mail end to end, whatever they have chosen for themselves, until an administrator allows it again."] }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setConfirmingProhibit(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", onClick: confirmZeroAccessThenSave, children: "Save and turn off encryption" })] })] }), _jsxs(Modal, { open: confirmingZeroAccessOff, onClose: () => setConfirmingZeroAccessOff(false), title: "Turn off zero-access encryption?", children: [_jsx("p", { className: "text-sm mb-3", children: "Mail that arrives from now on will be stored in a form this server can read, for every mailbox. Mail that is already encrypted stays encrypted - this server can\u2019t decrypt it. Everyone sees in their settings that an administrator turned it off." }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setConfirmingZeroAccessOff(false), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", onClick: () => void save(), children: "Save and turn off zero-access encryption" })] })] })] }));
+                                        } }), _jsxs("span", { children: [_jsx("span", { className: "font-semibold block", children: "Allow zero-access encryption" }), _jsx("span", { className: "text-xs text-text-muted", children: "Mail that arrives unencrypted is encrypted the moment it is received, to a key only the mailbox\u2019s owner can unlock, and this server keeps no readable copy - administrators can\u2019t read it either, except through an escrow scope. People can still turn it off for their own mailbox. Search of message contents then happens in the app instead of on the server." })] })] })] })), openPgpSupported && (_jsxs("div", { className: "mt-2 pt-4 border-t border-border", children: [_jsx("span", { className: "font-semibold text-sm block mb-1", children: "OpenPGP" }), _jsxs("label", { className: "flex items-start gap-2 text-sm", children: [_jsx("input", { type: "checkbox", className: "mt-1", checked: values.allowOpenPgp !== false, onChange: (e) => {
+                                            setSaved(false);
+                                            setValues({ ...values, allowOpenPgp: e.target.checked });
+                                        } }), _jsxs("span", { children: [_jsx("span", { className: "font-semibold block", children: "Allow OpenPGP" }), _jsx("span", { className: "text-xs text-text-muted", children: "Gives every mailbox an OpenPGP key and publishes it, so people using Proton Mail, Thunderbird and other OpenPGP apps can send encrypted mail to your users, and your users to them. RapidMX still uses S/MIME whenever a recipient can receive it. Off, no OpenPGP keys are created or published." })] })] })] })), _jsx("div", { children: _jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Save" }) })] }), _jsxs(Modal, { open: confirmingProhibit !== null, onClose: () => setConfirmingProhibit(null), title: "Turn off encryption?", children: [_jsxs("p", { className: "text-sm mb-3", children: ["Saving sets ", _jsx("strong", { children: confirmingProhibit?.join(", ") }), " to Never encrypt. Nobody on this server can then encrypt that mail end to end, whatever they have chosen for themselves, until an administrator allows it again."] }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setConfirmingProhibit(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", onClick: confirmZeroAccessThenSave, children: "Save and turn off encryption" })] })] }), _jsxs(Modal, { open: confirmingZeroAccessOff, onClose: () => setConfirmingZeroAccessOff(false), title: "Turn off zero-access encryption?", children: [_jsx("p", { className: "text-sm mb-3", children: "Mail that arrives from now on will be stored in a form this server can read, for every mailbox. Mail that is already encrypted stays encrypted - this server can\u2019t decrypt it. Everyone sees in their settings that an administrator turned it off." }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setConfirmingZeroAccessOff(false), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", onClick: () => void save(), children: "Save and turn off zero-access encryption" })] })] })] }));
 }

package/dist/apps/shared/components/calendar/EventDetails.js

@@ -8,10 +8,13 @@ import { HiOutlineBars3BottomLeft, HiOutlineBell, HiOutlineBriefcase, HiOutlineC
 import { ApiRequestError } from "../../../../lib/util/api.js";
 import { useApiClient } from "../../../../lib/util/apiClientContext.js";
 import { guestPermissionsOf, respondToEvent, visibilityOf } from "../../../../lib/calendar/calendarApi.js";
+import { invitationContentOf } from "../../../../lib/calendar/protectedEvents.js";
+import { organizerJoinLink } from "../../../../lib/videoconf/protectedMeetings.js";
 import { htmlToPlainText } from "../../../../lib/calendar/eventDescription.js";
 import { deleteEventOccurrence, deleteEventSeries } from "../../../../lib/calendar/calendarMutations.js";
 import { describeRecurrence } from "../../../../lib/calendar/recurrence.js";
 import { getVideoMeeting } from "../../../../lib/videoconf/videoMeetingsApi.js";
+import { useKeysLocked } from "../../zeroAccess/useKeysLocked.js";
 import { describeTimeZone, deviceTimeZone } from "../../../../lib/util/timeZone.js";
 import Alert from "../../../../lib/components/feedback/Alert.js";
 import Button from "../../../../lib/components/buttons/Button.js";
@@ -54,7 +57,7 @@ export default function EventDetails({ occurrence, isInvited, myResponse, isOwnA
         }
         let cancelled = false;
         void getVideoMeeting(videoMeetingUid, client)
-            .then((meeting) => meeting.organizerJoinUrl ?? null)
+            .then(organizerJoinLink)
             .catch(() => null)
             .then((url) => {
             if (!cancelled) {
@@ -65,6 +68,13 @@ export default function EventDetails({ occurrence, isInvited, myResponse, isOwnA
             cancelled = true;
         };
     }, [videoMeetingUid, client]);
+    // A protected meeting's link carries its key after `#`, opened with the mailbox's keys: it goes when they lock, whether or not the
+    // event itself is protected (a meeting is keyed whenever the mailbox has zero-access, its calendar protected or not).
+    useKeysLocked((locked) => {
+        if (locked === occurrence.mailboxUid) {
+            setOrganizerJoinUrl((url) => (url?.includes("#") ? null : url));
+        }
+    });
     // The same scheme allow-list a reminder's own location gets: a hostile or malformed join link never reaches `window.open()`.
     const joinUrl = joinMeetingUrl(organizerJoinUrl);
     async function handleDelete(scope) {
@@ -91,7 +101,7 @@ export default function EventDetails({ occurrence, isInvited, myResponse, isOwnA
         setError(null);
         setBusy(true);
         try {
-            await respondToEvent(occurrence.uid, responseStatus, client);
+            await respondToEvent(occurrence.uid, responseStatus, client, occurrence);
             // A decline soft-deletes the mailbox's own copy server-side - treat it the same as a
             // delete rather than a save so the calendar view drops it immediately.
             if (responseStatus === "declined") {
@@ -137,6 +147,7 @@ export default function EventDetails({ occurrence, isInvited, myResponse, isOwnA
                         description: occurrence.description,
                         descriptionHtml: occurrence.descriptionHtml,
                         guestAddresses: occurrence.attendees.map((a) => a.address),
+                        invitationContent: invitationContentOf(occurrence),
                     }, canChange: canChange, canInvite: canInvite, onSent: () => setRequesting(false), onCancel: () => setRequesting(false) }) })), myResponse !== undefined && canWrite && (_jsxs("div", { className: "flex flex-col gap-2 mx-5 mb-3 p-3 rounded-md bg-surface-alt", children: [_jsxs("div", { className: "flex items-center justify-between gap-3 flex-wrap", children: [_jsx("span", { className: "text-sm font-medium", children: "Your response" }), _jsx("div", { className: "flex gap-2", children: answers.map(({ response, label }) => {
                                     const current = myResponse === response;
                                     return (_jsxs(Button, { type: "button", variant: "secondary", className: ["!w-auto", response === "declined" ? "text-danger" : "", current ? "!bg-primary/10 !border-primary" : ""].join(" "), "aria-pressed": current, disabled: busy, onClick: () => (occurrence.isRecurringOccurrence ? setPendingResponse(response) : void handleRespond(response)), children: [current && _jsx(HiOutlineCheck, { size: 14, "aria-hidden": "true" }), label] }, response));