@rapidmx/web-client 0.36.0 → 0.37.0

package/dist/apps/www/calendar/index.js

@@ -12,10 +12,13 @@ import { addDays, addMonths, addWeeks, eachDayOfInterval, endOfDay, endOfMonth,
 import { ApiRequestError } from "../../../lib/util/api.js";
 import { useApiClient } from "../../../lib/util/apiClientContext.js";
 import useIsMobile from "../../../lib/util/useIsMobile.js";
-import { getCalendarEvent, listCalendarEvents } from "../../../lib/calendar/calendarApi.js";
+import { fullyOpenedEvent, getCalendarEvent, listCalendarEvents } from "../../../lib/calendar/calendarApi.js";
+import { isOpenedRecord, isProtectedRecord } from "../../../lib/zeroAccess/sealedRecords.js";
+import { isSealedRecord } from "../../../lib/zeroAccess/sealedMoves.js";
+import { useKeysLocked } from "../../shared/zeroAccess/useKeysLocked.js";
 import { openSealedEvent, openSealedEvents } from "../../shared/calendar/sealedEvents.js";
 import { useFolderLiveUpdates } from "../../shared/live/useFolderLiveUpdates.js";
-import { moveOccurrence, resizeOccurrenceEnd } from "../../../lib/calendar/calendarMutations.js";
+import { SealedOccurrenceError, moveOccurrence, resizeOccurrenceEnd } from "../../../lib/calendar/calendarMutations.js";
 import { resolveDragAction } from "../../../lib/calendar/calendarDragIds.js";
 import { createFolder } from "../../../lib/mail/mailApi.js";
 import { expandAllOccurrences, expandOccurrences } from "../../../lib/calendar/recurrence.js";
@@ -48,6 +51,8 @@ import { SHORTCUTS } from "../../shared/keyboard/keymap.js";
 import { useShortcut } from "../../shared/keyboard/useShortcut.js";
 import { useShortcutProps } from "../../shared/keyboard/useShortcutProps.js";
 import { notifyApiError } from "../../shared/notifications/apiErrors.js";
+import { notify } from "../../shared/notifications/store.js";
+import { KeysLockedError } from "../../../lib/crypto/masterKey.js";
 import { bookingSettingsHref } from "../../shared/calendar/bookingPlugin.js";
 import { changedEventOf } from "../../shared/calendar/calendarLiveUpdates.js";
 /** The push client channel group (`PushClient.setChannels()`) the page's calendars are subscribed under. */
@@ -295,11 +300,41 @@ function CalendarContent({ userUid, bookingHref }) {
     // Today moves on at midnight: the List's "from today on" is worked out again then (`listDay` is only a dependency).
     const listDay = useDayKey();
     const dayOfList = view === "list" ? listDay : "";
+    // A search matches descriptions too, which a list leaves sealed (`EVENT_LIST_FIELDS`): the protected events are opened in full once one
+    // runs, and searched as they are until then.
+    const [searchable, setSearchable] = useState(null);
+    useEffect(() => {
+        if (!searching || !events.some((event) => isProtectedRecord(event) && !isOpenedRecord(event))) {
+            return;
+        }
+        let cancelled = false;
+        void Promise.all(events.map((event) => fullyOpenedEvent(event))).then((opened) => {
+            if (!cancelled) {
+                setSearchable({ from: events, events: opened });
+            }
+        });
+        return () => {
+            cancelled = true;
+        };
+    }, [events, searching]);
+    const searchedEvents = searchable?.from === events ? searchable.events : events;
+    // The calendar holds protected events opened with their mailboxes' keys: a lock of one takes them off screen - read again with their
+    // placeholders, the search's fully opened copies dropped, and an open card or form of a protected event closed - its own mailbox's
+    // lock closes it too when it isn't one of the listed events (opened from a reminder, its calendar unchecked).
+    useKeysLocked((locked) => {
+        const listed = events.some((event) => event.mailboxUid === locked);
+        setModal((current) => current?.occurrence && isSealedRecord(current.occurrence) && (listed || current.occurrence.mailboxUid === locked) ? null : current);
+        if (!listed) {
+            return;
+        }
+        reload();
+        setSearchable(null);
+    });
     const matches = useMemo(() => {
-        const found = searching ? searchOccurrences(events, query) : [];
+        const found = searching ? searchOccurrences(searchedEvents, query) : [];
         const today = new Date();
         return view === "list" ? found.filter((occurrence) => isUpcoming(occurrence, today)) : found;
-    }, [events, query, searching, view, dayOfList]);
+    }, [searchedEvents, query, searching, view, dayOfList]);
     const activeIndex = matches.findIndex((m) => m.occurrenceKey === activeKey);
     // What an open event card steps through, in order: the matches while a search runs, else every event of the checked calendars (bounded as a
     // search is). The List holds only what is from today on, so that is all its card steps through. Worked out only when something needs it.
@@ -536,7 +571,14 @@ function CalendarContent({ userUid, bookingHref }) {
             reload();
         }
         catch (err) {
-            notifyApiError(err, action.type === "move" ? "Couldn't move the event" : "Couldn't resize the event");
+            const context = action.type === "move" ? "Couldn't move the event" : "Couldn't resize the event";
+            if (err instanceof KeysLockedError || err instanceof SealedOccurrenceError) {
+                // A protected occurrence while the mailbox is locked, or one of a zero-access invitation: nothing was written.
+                notify({ kind: "warning", title: context, message: err.message });
+            }
+            else {
+                notifyApiError(err, context);
+            }
             // A refused change (a 409 most of all) means the page holds a stale version: load again, or every later drag of this event fails the same way.
             reload();
         }

package/dist/apps/www/contacts/index.js

@@ -7,7 +7,7 @@ import { pageTitle } from "../../shared/navigation/pageTitle.js";
 import { useNavigate } from "../../shared/navigation/index.js";
 import { useEffect, useMemo, useRef, useState } from "react";
 import { ApiRequestError } from "../../../lib/util/api.js";
-import { createContact, deleteContact, getContact, listContacts, ensureSuggestedContacts, listContactsInFolders, listDeletedContacts, setContactFavorite, updateContact, } from "../../../lib/contacts/contactsApi.js";
+import { createContact, deleteContact, getContact, CONTACT_LIST_FIELDS, CONTACT_MATCH_FIELDS, listContacts, ensureSuggestedContacts, listContactsInFolders, listDeletedContacts, setContactFavorite, updateContact, } from "../../../lib/contacts/contactsApi.js";
 import { VCARD_MAX_CHARS, VCARD_MAX_CONTACTS, contactsToVCardFile, contactToVCard, parseVCards } from "../../../lib/contacts/vcard.js";
 import { withoutDuplicates } from "../../shared/components/contacts/participantDetails.js";
 import useIsMobile from "../../../lib/util/useIsMobile.js";
@@ -34,6 +34,8 @@ import { useShortcut } from "../../shared/keyboard/useShortcut.js";
 import { notifyApiError } from "../../shared/notifications/apiErrors.js";
 import { notify } from "../../shared/notifications/store.js";
 import { changedItemOf, useFolderLiveUpdates } from "../../shared/live/useFolderLiveUpdates.js";
+import { isOpenedRecord, isProtectedRecord, openSealedRecord, openSealedRecords } from "../../../lib/zeroAccess/sealedRecords.js";
+import { useKeysLocked } from "../../shared/zeroAccess/useKeysLocked.js";
 /** The published model class name of a contact on either database (`ContactMongo`, `ContactSQL`) - not a `ContactList`'s. */
 const CONTACT_MODEL = /^Contact(Mongo|SQL)$/;
 /** The push client channel group (`PushClient.setChannels()`) the page's contacts folders are subscribed under. */
@@ -113,6 +115,7 @@ function ContactsContent({ userUid }) {
             void loadSuggested(suggestedFolderUid);
         }
         return listAllPages((page) => listContacts(folderUid, { limit: LIST_PAGE_SIZE, page }, client))
+            .then(async (result) => ({ ...result, items: await openSealedRecords(result.items, CONTACT_LIST_FIELDS) }))
             .then((result) => {
             setContacts(result.items);
             setTruncated(result.truncated);
@@ -123,10 +126,24 @@ function ContactsContent({ userUid }) {
     useEffect(() => {
         void reload();
     }, [folderUid]);
+    // The lists hold protected contacts opened with the mailbox's keys: its lock takes them off screen, read again with their placeholders (the
+    // contacts, the suggested ones and the Deleted view). They leave the lists first, so a reload that fails can't leave them shown. An open
+    // contact's pane and form drop what they opened themselves (`useOpenedRecord`).
+    const [lockCount, setLockCount] = useState(0);
+    useKeysLocked((locked) => {
+        if (locked === mailboxUid) {
+            const readable = (list) => list.filter((contact) => !isProtectedRecord(contact));
+            setContacts(readable);
+            setSuggestedContacts(readable);
+            setDeletedContacts(readable);
+            void reload();
+            setLockCount((count) => count + 1);
+        }
+    });
     /** Reads the Suggested Contacts folder's contacts. A failure leaves the list as it was. */
     function loadSuggested(suggestedUid) {
         return listAllPages((page) => listContacts(suggestedUid, { limit: LIST_PAGE_SIZE, page }, client))
-            .then((result) => setSuggestedContacts(result.items))
+            .then(async (result) => setSuggestedContacts(await openSealedRecords(result.items, CONTACT_LIST_FIELDS)))
             .catch(() => undefined);
     }
     // Asks the server to turn the people this mailbox has corresponded with into suggested contacts (it does so once for each person, so this is cheap when
@@ -158,7 +175,9 @@ function ContactsContent({ userUid }) {
             remove(change.uid);
             return;
         }
-        void getContact(change.uid, client).then((fresh) => {
+        void getContact(change.uid, client)
+            .then((fresh) => openSealedRecord(fresh, CONTACT_LIST_FIELDS))
+            .then((fresh) => {
             if (fresh.deleted === true) {
                 remove(fresh.uid);
             }
@@ -213,6 +232,7 @@ function ContactsContent({ userUid }) {
         setDeletedLoading(true);
         setDeletedError(null);
         listAllPages((page) => listDeletedContacts(folderUid, { limit: LIST_PAGE_SIZE, page }, client))
+            .then(async (result) => ({ ...result, items: await openSealedRecords(result.items, CONTACT_LIST_FIELDS) }))
             .then((result) => {
             // A server that dropped the `deleted` filter (no delete+update right on this folder) answers with live
             // contacts, which must never be listed as deleted.
@@ -228,8 +248,8 @@ function ContactsContent({ userUid }) {
             .catch((err) => setDeletedError(err instanceof ApiRequestError ? err.message : "Could not load deleted contacts."))
             .finally(() => setDeletedLoading(false));
         // Re-fetches every time the Deleted view is (re-)selected, matching this page's own `reload()`
-        // convention elsewhere rather than caching a possibly-stale list across visits.
-    }, [view, folderUid]);
+        // convention elsewhere rather than caching a possibly-stale list across visits - and when the mailbox locks.
+    }, [view, folderUid, lockCount]);
     const viewFiltered = useMemo(() => {
         switch (view.type) {
             case "all":
@@ -406,9 +426,17 @@ function ContactsContent({ userUid }) {
         if (!category?.trim()) {
             return;
         }
-        for (const contact of checkedContacts) {
-            const categories = Array.from(new Set([...(contact.categories ?? []), category.trim()]));
+        let locked = 0;
+        for (const listed of checkedContacts) {
             try {
+                // A protected one's categories are added to as opened: one that won't open here (the mailbox is locked) shows a placeholder
+                // (none), and saving that plus the new one would replace its real categories for good. It is left as it is.
+                const contact = await openSealedRecord(listed);
+                if (isProtectedRecord(contact) && !isOpenedRecord(contact)) {
+                    locked++;
+                    continue;
+                }
+                const categories = Array.from(new Set([...(contact.categories ?? []), category.trim()]));
                 // Only the changed field - sending the whole fetched contact back includes server-managed
                 // fields restapi rejects, and would overwrite any concurrent edit to the other fields.
                 await updateContact({ uid: contact.uid, version: contact.version, categories }, client);
@@ -417,14 +445,30 @@ function ContactsContent({ userUid }) {
                 notifyApiError(err, "Couldn't update some of the contacts");
             }
         }
+        if (locked > 0) {
+            notify({
+                kind: "warning",
+                title: "Some contacts weren't categorized",
+                message: `${locked === 1 ? "A contact is" : `${locked} contacts are`} protected and can't be changed while your mailbox is locked. Unlock it, then add the category again.`,
+            });
+        }
         clearPinnedSignerCache();
         await reload();
     });
     // A suggested contact becomes one of the mailbox's own: a copy in its contacts folder, and the suggestion removed (the person is not suggested again).
     const handleAddToContacts = singleFlight(async () => {
         // In the All contacts view the selection can hold contacts that already are the mailbox's own: only the suggested ones are added.
-        for (const contact of checkedContacts.filter((checked) => checked.folderUid === suggestedFolderUid)) {
+        let locked = 0;
+        for (const listed of checkedContacts.filter((checked) => checked.folderUid === suggestedFolderUid)) {
             try {
+                // Copied in full: the list opened only what it shows.
+                const contact = await openSealedRecord(listed);
+                // A protected one that won't open here (the mailbox is locked) holds only placeholders: copying them would replace its real
+                // name for good once the original is deleted. It is left as it is.
+                if (isProtectedRecord(contact) && !isOpenedRecord(contact)) {
+                    locked++;
+                    continue;
+                }
                 await createContact({
                     mailboxUid: contact.mailboxUid,
                     folderUid: folderUid,
@@ -445,11 +489,20 @@ function ContactsContent({ userUid }) {
                 notifyApiError(err, "Couldn't add some of the contacts");
             }
         }
+        if (locked > 0) {
+            notify({
+                kind: "warning",
+                title: "Some contacts weren't added",
+                message: `${locked === 1 ? "A suggested contact is" : `${locked} suggested contacts are`} protected and can't be opened while your mailbox is locked. Unlock it, then add ${locked === 1 ? "it" : "them"} again.`,
+            });
+        }
         setCheckedUids(new Set());
         await reload();
     });
-    function handleExportVCard() {
-        downloadTextFile(checkedContacts.length === 1 ? `${checkedContacts[0].displayName}.vcf` : "contacts.vcf", checkedContacts.length === 1 ? contactToVCard(checkedContacts[0]) : contactsToVCardFile(checkedContacts));
+    async function handleExportVCard() {
+        // Exported in full: the list opened only what it shows.
+        const contacts = await openSealedRecords(checkedContacts);
+        downloadTextFile(contacts.length === 1 ? `${contacts[0].displayName}.vcf` : "contacts.vcf", contacts.length === 1 ? contactToVCard(contacts[0]) : contactsToVCardFile(contacts));
     }
     async function handleImportFile(file) {
         if (!mailboxUid || !folderUid) {
@@ -476,7 +529,7 @@ function ContactsContent({ userUid }) {
         // earlier card's in the file - is left alone. The folder is read in full for that, not just the page of it the list holds.
         let fresh;
         try {
-            fresh = withoutDuplicates(parsed, await listContactsInFolders([folderUid], client)).fresh;
+            fresh = withoutDuplicates(parsed, await openSealedRecords(await listContactsInFolders([folderUid], client), CONTACT_MATCH_FIELDS)).fresh;
         }
         catch (err) {
             notifyApiError(err, "Couldn't check the file against your contacts");

package/dist/apps/www/index.js

@@ -99,6 +99,9 @@ async function decryptEncryptedRows(messages, unlocked) {
     let securityModule;
     // A few at a time: each is a download and a public-key decryption.
     const entries = await mapWithConcurrency(encrypted, DECRYPT_CONCURRENCY, async (message) => {
+        // A lock while a row was opened has already cleared the shared store: what it opened must not go back in (`decryptForDisplay()`
+        // asks the same). The caller's lock generation keeps it off this page.
+        const stillUnlocked = () => getUnlockedKeys(message.mailboxUid) === unlocked;
         try {
             // Loaded here, on first use: the S/MIME code (PKI.js, ASN.1, X.509) is over half a megabyte and an inbox with
             // no encrypted mail in it never needs it.
@@ -107,11 +110,17 @@ async function decryptEncryptedRows(messages, unlocked) {
             const summary = message.zeroAccess ? await securityApi.openZeroAccessSummary(message.zeroAccess.sealedSummary, unlocked.zeroAccessKeys) : undefined;
             if (summary) {
                 const preview = summary.preview.slice(0, LIST_PREVIEW_MAX_LENGTH);
-                rememberDecrypted(message.uid, message.mailboxUid, { subject: summary.subject, preview });
+                if (stillUnlocked()) {
+                    rememberDecrypted(message.uid, message.mailboxUid, { subject: summary.subject, preview });
+                }
                 return [message.uid, { subject: summary.subject, preview }];
             }
             const rawMime = await getMessageRawContent(message.uid);
             const security = await securityApi.evaluateMessageSecurity(rawMime, unlocked);
+            // Nor is a lock a failure to decrypt.
+            if (!stillUnlocked()) {
+                return null;
+            }
             if (!security.subject && !security.html) {
                 markDecryptFailed(message.uid);
                 return null;

package/dist/apps/www/settings/encryption/index.js

@@ -6,8 +6,8 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 import { pageTitle } from "../../../shared/navigation/pageTitle.js";
 import { useEffect, useState } from "react";
 import { ApiRequestError } from "../../../../lib/util/api.js";
-import { addMasterKeyWrap, cancelSignEnrollment, findActivePublicKey, getCurrentSignEnrollment, getEscrowInfo, getKeyVault, rekey, removeMasterKeyWrap, startSignEnrollment, } from "../../../../lib/crypto/keyvaultApi.js";
-import { ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE, SIGNING_PRIVATE_KEY_AAD_PURPOSE, destroyUnlockedKeys, getUnlockedKeys, unlockWithPassword, } from "../../../../lib/crypto/keySession.js";
+import { addMasterKeyWrap, cancelSignEnrollment, findActivePublicKey, getCurrentSignEnrollment, getEscrowInfo, getKeyVault, isOpenPgpKey, rekey, removeMasterKeyWrap, startSignEnrollment, } from "../../../../lib/crypto/keyvaultApi.js";
+import { ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE, OPENPGP_PRIVATE_KEY_AAD_PURPOSE, SIGNING_PRIVATE_KEY_AAD_PURPOSE, ZERO_ACCESS_PRIVATE_KEY_AAD_PURPOSE, destroyUnlockedKeys, getUnlockedKeys, unlockWithPassword, } from "../../../../lib/crypto/keySession.js";
 import { IDLE_TIMEOUT_OPTIONS_MINUTES, getIdleTimeoutMinutes, setIdleTimeoutMinutes } from "../../../../lib/crypto/idleTimeout.js";
 import { LOCAL_INDEX_SIZE_OPTIONS, getDefaultLocalIndexByteBudget, getLocalIndexByteBudget, setLocalIndexByteBudget, } from "../../../shared/search/localIndexSizePreference.js";
 import { fromBase64 } from "../../../../lib/crypto/encoding.js";
@@ -27,6 +27,7 @@ import Button from "../../../../lib/components/buttons/Button.js";
 import Modal from "../../../../lib/components/overlays/Modal.js";
 import ZeroAccessSetting from "../../../shared/components/settings/ZeroAccessSetting.js";
 import KeyExportSetting from "../../../shared/components/settings/KeyExportSetting.js";
+import OpenPgpKeySetting from "../../../shared/components/settings/OpenPgpKeySetting.js";
 import SigningCertificateCard from "../../../shared/components/settings/SigningCertificateCard.js";
 import { readStoredSignEnrollment, storeSignEnrollment } from "../../../shared/signing/enrollmentStorage.js";
 import { checkEnrollmentNow, forgetEnrollment, recordEnrollmentResult, useEnrollmentSnapshot, watchCurrentEnrollment, watchEnrollment, } from "../../../shared/signing/enrollmentTracker.js";
@@ -63,7 +64,14 @@ class StaleSessionKeysError extends Error {
     }
 }
 const STALE_KEYS_MESSAGE = "Your encryption keys were changed on another device (for example, rotated), so the copy unlocked in this session no longer works. Nothing was changed. Unlock again with your current password, then try again.";
+/** The AAD a vault key is sealed with - by what it is: an OpenPGP secret key, a zero-access key, a signing key or an encryption key. */
 function wrappedKeyAad(mailboxUid, entry) {
+    if (isOpenPgpKey(entry)) {
+        return buildAad(mailboxUid, OPENPGP_PRIVATE_KEY_AAD_PURPOSE);
+    }
+    if (entry.useType === "zero-access") {
+        return buildAad(mailboxUid, ZERO_ACCESS_PRIVATE_KEY_AAD_PURPOSE);
+    }
     return buildAad(mailboxUid, entry.useType === "sign" ? SIGNING_PRIVATE_KEY_AAD_PURPOSE : ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE);
 }
 /**
@@ -125,6 +133,8 @@ async function rewrapVaultPrivateKeys(mailboxUid, currentMasterKey, wrappedKeys)
                 algorithm: "AES-256-GCM",
                 fingerprint: entry.fingerprint,
                 useType: entry.useType,
+                // An OpenPGP secret key stays one: without its type it would read back as an S/MIME key.
+                ...(isOpenPgpKey(entry) ? { type: entry.type } : {}),
             });
         }
         return { mk, wrappedKeys: rewrapped };
@@ -167,7 +177,7 @@ function EncryptionGate({ userUid, impersonating }) {
     // restapi only lets the mailbox's actual owner write its key vault (`requireMailboxOwner()`), so a
     // delegate (or an admin impersonating the owner) never provisions keys here, and sees no write actions.
     const isOwner = mailbox.ownerUserUid !== undefined && mailbox.ownerUserUid === userUid && !impersonating;
-    return (_jsx(KeyEnrollmentGate, { mailboxUid: mailboxUid, mailboxAddress: mailbox.primarySmtpAddress, mailboxKeys: mailbox.keys, canProvision: isOwner, children: _jsx(EncryptionContent, { canManageKeys: isOwner }) }));
+    return (_jsx(KeyEnrollmentGate, { mailboxUid: mailboxUid, mailboxAddress: mailbox.primarySmtpAddress, mailboxKeys: mailbox.keys, canProvision: isOwner, children: _jsx(EncryptionContent, { canManageKeys: isOwner }, mailboxUid) }));
 }
 function EncryptionContent({ canManageKeys }) {
     const { mailboxUid, mailboxes } = useSettingsShell();
@@ -801,7 +811,7 @@ function EncryptionContent({ canManageKeys }) {
                     : null;
     const certificateEnrollment = certificateMode === "issued" && enrollmentResult?.status !== "issued" ? null : certificateMode === "expired" ? null : enrollmentResult;
     return (_jsx("div", { className: "flex-1 min-w-0 overflow-y-auto p-6", children: _jsxs("div", { className: "max-w-xl flex flex-col gap-6", children: [_jsxs("div", { children: [_jsx("h1", { className: "text-lg font-bold tracking-tight mb-1", children: "Encryption" }), _jsxs("p", { className: "text-sm text-text-muted", children: ["Manage how ", mailbox.displayName, " unlocks its encryption keys on this and other devices."] })] }), loadError && _jsx(Alert, { children: loadError }), actionError && _jsx(Alert, { children: actionError }), !canManageKeys && (_jsx("p", { className: "text-sm text-text-muted", children: "Only this mailbox\u2019s owner, signed in as themselves, can change its encryption keys and unlock methods." })), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Encryption keys" }), displayedKeys.length > 0 ? (_jsx("ul", { className: "flex flex-col gap-1 text-sm", children: displayedKeys.map((key) => (_jsxs("li", { className: "font-mono text-xs", children: [key.useType === "sign" ? "Signing" : "Encryption", " key: ", key.fingerprint, key.revokedAt &&
-                                        (key.revocationReason === "superseded" ? (_jsx("span", { className: "text-text-muted", children: " (superseded)" })) : (_jsx("span", { className: "text-danger", children: " (revoked)" })))] }, key.fingerprint))) })) : (_jsx("p", { className: "text-sm text-text-muted", children: "No keys enrolled yet." }))] }), _jsx(ZeroAccessSetting, { mailbox: mailbox, canManage: canManageKeys }), _jsx(KeyExportSetting, { mailbox: mailbox, canManage: canManageKeys }), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Digital signatures" }), activeSigningKey && signingStatus !== "pending" && (_jsx("p", { className: ["text-sm text-text-muted", certificateMode ? "mb-3" : ""].join(" "), children: "Enabled \u2014 outgoing mail from this mailbox is signed with a publicly-trusted certificate." })), certificateMode && (_jsxs("div", { className: "flex flex-col gap-2", children: [certificateMode === "failed" && signingError && _jsx(Alert, { children: signingError }), _jsx(SigningCertificateCard, { mode: certificateMode, enrollment: certificateEnrollment, snapshot: enrollment, info: signingInfo, address: mailbox.primarySmtpAddress, keyNotAfter: certificateMode === "expired" ? expiredSigningKey?.notAfter : activeSigningKey?.notAfter, canRequest: canManageKeys, requesting: signingStatus === "enrolling", onCheck: canManageKeys ? () => void checkEnrollmentNow(mailboxUid) : undefined, onRequest: handleEnrollSigning })] })), !activeSigningKey && !certificateMode && !canManageKeys ? (_jsx("p", { className: "text-sm text-text-muted", children: "Not enabled." })) : activeSigningKey || certificateMode ? null : (_jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("p", { className: "text-xs text-text-muted", children: "Lets recipients verify that mail from this mailbox is genuinely from you. Optional \u2014 encryption already works without it." }), beforeRequestText(signingInfo, mailbox.primarySmtpAddress) && (_jsx("p", { className: "text-xs text-text-muted", children: beforeRequestText(signingInfo, mailbox.primarySmtpAddress) })), healthWarning(signingInfo) && _jsx(Alert, { children: healthWarning(signingInfo) }), enrollment?.gone && _jsx(Alert, { children: STALE_REQUEST_TEXT }), signingError && _jsx(Alert, { children: signingError }), signingInfo?.backend !== "none" && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: signingStatus === "enrolling", disabled: signingStatus !== "idle", onClick: handleEnrollSigning, children: "Enable digital signatures" }))] }))] }), mailbox.escrowScopeId && (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Escrow" }), escrowError && _jsx(Alert, { children: escrowError }), hasEscrowWrap ? (_jsx("p", { className: "text-sm text-text-muted", children: "This mailbox is under legal/compliance escrow \u2014 an authorized holder in your organization can recover its encrypted mail if needed. This does not weaken protection against anyone else." })) : (_jsxs("div", { className: "flex flex-col gap-2", children: [_jsxs("p", { className: "text-xs text-text-muted", children: ["Your organization has assigned this mailbox to an escrow scope, but nothing has been protected yet \u2014 an authorized holder cannot recover this mailbox\u2019s encrypted mail until you complete this step.", " ", "This does not weaken protection against anyone else."] }), canManageKeys && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: wrappingEscrow, disabled: wrappingEscrow, onClick: handleWrapEscrow, children: "Add escrow protection" }))] })), _jsxs(Modal, { open: pendingEscrow !== null, onClose: () => setPendingEscrow(null), title: "Confirm escrow certificate", children: [_jsx("p", { className: "text-sm mb-3", children: "Anyone holding the private key for this certificate will be able to recover this mailbox\u2019s encrypted mail. Confirm it is the escrow certificate your organization expects before continuing." }), _jsxs("dl", { className: "text-sm mb-5 flex flex-col gap-1", children: [_jsxs("div", { children: [_jsx("dt", { className: "text-xs text-text-muted", children: "Escrow scope" }), _jsx("dd", { className: "break-all", children: pendingEscrow?.escrowScopeId })] }), _jsxs("div", { children: [_jsx("dt", { className: "text-xs text-text-muted", children: "Certificate fingerprint" }), _jsx("dd", { className: "font-mono break-all", children: pendingEscrow?.publicKey.fingerprint })] })] }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setPendingEscrow(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto", onClick: () => void handleConfirmEscrow(pendingEscrow), children: "Trust this certificate" })] })] })] })), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Unlock methods" }), _jsxs("p", { className: "text-xs text-text-muted mb-3", children: ["Removing a method here stops it from being usable to unlock this mailbox going forward, but it is ", _jsx("strong", { children: "not" }), " full revocation \u2014 anyone who already captured a wrapped copy and knows its secret could still use it. For real revocation (e.g. after a lost device), rotate your keys entirely below instead."] }), vault && vault.masterKeyWraps.length > 0 ? (_jsx("ul", { className: "flex flex-col gap-2", children: [...passwordWraps, ...recoveryWraps, ...otherWraps].map((wrap) => {
+                                        (key.revocationReason === "superseded" ? (_jsx("span", { className: "text-text-muted", children: " (superseded)" })) : (_jsx("span", { className: "text-danger", children: " (revoked)" })))] }, key.fingerprint))) })) : (_jsx("p", { className: "text-sm text-text-muted", children: "No keys enrolled yet." }))] }), _jsx(ZeroAccessSetting, { mailbox: mailbox, canManage: canManageKeys }), _jsx(KeyExportSetting, { mailbox: mailbox, canManage: canManageKeys }), _jsx(OpenPgpKeySetting, { mailbox: mailbox, canManage: canManageKeys }), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Digital signatures" }), activeSigningKey && signingStatus !== "pending" && (_jsx("p", { className: ["text-sm text-text-muted", certificateMode ? "mb-3" : ""].join(" "), children: "Enabled \u2014 outgoing mail from this mailbox is signed with a publicly-trusted certificate." })), certificateMode && (_jsxs("div", { className: "flex flex-col gap-2", children: [certificateMode === "failed" && signingError && _jsx(Alert, { children: signingError }), _jsx(SigningCertificateCard, { mode: certificateMode, enrollment: certificateEnrollment, snapshot: enrollment, info: signingInfo, address: mailbox.primarySmtpAddress, keyNotAfter: certificateMode === "expired" ? expiredSigningKey?.notAfter : activeSigningKey?.notAfter, canRequest: canManageKeys, requesting: signingStatus === "enrolling", onCheck: canManageKeys ? () => void checkEnrollmentNow(mailboxUid) : undefined, onRequest: handleEnrollSigning })] })), !activeSigningKey && !certificateMode && !canManageKeys ? (_jsx("p", { className: "text-sm text-text-muted", children: "Not enabled." })) : activeSigningKey || certificateMode ? null : (_jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("p", { className: "text-xs text-text-muted", children: "Lets recipients verify that mail from this mailbox is genuinely from you. Optional \u2014 encryption already works without it." }), beforeRequestText(signingInfo, mailbox.primarySmtpAddress) && (_jsx("p", { className: "text-xs text-text-muted", children: beforeRequestText(signingInfo, mailbox.primarySmtpAddress) })), healthWarning(signingInfo) && _jsx(Alert, { children: healthWarning(signingInfo) }), enrollment?.gone && _jsx(Alert, { children: STALE_REQUEST_TEXT }), signingError && _jsx(Alert, { children: signingError }), signingInfo?.backend !== "none" && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: signingStatus === "enrolling", disabled: signingStatus !== "idle", onClick: handleEnrollSigning, children: "Enable digital signatures" }))] }))] }), mailbox.escrowScopeId && (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Escrow" }), escrowError && _jsx(Alert, { children: escrowError }), hasEscrowWrap ? (_jsx("p", { className: "text-sm text-text-muted", children: "This mailbox is under legal/compliance escrow \u2014 an authorized holder in your organization can recover its encrypted mail if needed. This does not weaken protection against anyone else." })) : (_jsxs("div", { className: "flex flex-col gap-2", children: [_jsxs("p", { className: "text-xs text-text-muted", children: ["Your organization has assigned this mailbox to an escrow scope, but nothing has been protected yet \u2014 an authorized holder cannot recover this mailbox\u2019s encrypted mail until you complete this step.", " ", "This does not weaken protection against anyone else."] }), canManageKeys && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: wrappingEscrow, disabled: wrappingEscrow, onClick: handleWrapEscrow, children: "Add escrow protection" }))] })), _jsxs(Modal, { open: pendingEscrow !== null, onClose: () => setPendingEscrow(null), title: "Confirm escrow certificate", children: [_jsx("p", { className: "text-sm mb-3", children: "Anyone holding the private key for this certificate will be able to recover this mailbox\u2019s encrypted mail. Confirm it is the escrow certificate your organization expects before continuing." }), _jsxs("dl", { className: "text-sm mb-5 flex flex-col gap-1", children: [_jsxs("div", { children: [_jsx("dt", { className: "text-xs text-text-muted", children: "Escrow scope" }), _jsx("dd", { className: "break-all", children: pendingEscrow?.escrowScopeId })] }), _jsxs("div", { children: [_jsx("dt", { className: "text-xs text-text-muted", children: "Certificate fingerprint" }), _jsx("dd", { className: "font-mono break-all", children: pendingEscrow?.publicKey.fingerprint })] })] }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setPendingEscrow(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto", onClick: () => void handleConfirmEscrow(pendingEscrow), children: "Trust this certificate" })] })] })] })), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Unlock methods" }), _jsxs("p", { className: "text-xs text-text-muted mb-3", children: ["Removing a method here stops it from being usable to unlock this mailbox going forward, but it is ", _jsx("strong", { children: "not" }), " full revocation \u2014 anyone who already captured a wrapped copy and knows its secret could still use it. For real revocation (e.g. after a lost device), rotate your keys entirely below instead."] }), vault && vault.masterKeyWraps.length > 0 ? (_jsx("ul", { className: "flex flex-col gap-2", children: [...passwordWraps, ...recoveryWraps, ...otherWraps].map((wrap) => {
                                 const key = `${wrap.method}:${wrap.methodId ?? ""}`;
                                 return (_jsxs("li", { className: "flex items-center justify-between gap-3 text-sm py-1.5 px-3 bg-surface-alt rounded-sm", children: [_jsx("span", { children: METHOD_LABELS[wrap.method] ?? wrap.method }), wrap.method !== "escrow" &&
                                             canManageKeys &&

package/dist/apps/www/settings/privacy/index.js

@@ -7,7 +7,8 @@ import { pageTitle } from "../../../shared/navigation/pageTitle.js";
 import { useEffect, useRef, useState } from "react";
 import { ApiRequestError } from "../../../../lib/util/api.js";
 import { createExportRequest, exportRequestDownloadUrl, listExportRequests, } from "../../../../lib/mail/dataExportApi.js";
-import { listImportRequests, uploadMailboxImport, } from "../../../../lib/mail/mailboxImportApi.js";
+import { ZERO_ACCESS_IMPORT_MESSAGE, listImportRequests, mailIsZeroAccess, uploadMailboxImport, } from "../../../../lib/mail/mailboxImportApi.js";
+import { getEncryptionPolicy } from "../../../../lib/crypto/keyvaultApi.js";
 import { createErasureRequest, listErasureRequests, } from "../../../../lib/mail/erasureRequestApi.js";
 import { listFolders } from "../../../../lib/mail/mailApi.js";
 import { useApiClient } from "../../../../lib/util/apiClientContext.js";
@@ -16,6 +17,7 @@ import Alert from "../../../../lib/components/feedback/Alert.js";
 import Button from "../../../../lib/components/buttons/Button.js";
 import Modal from "../../../../lib/components/overlays/Modal.js";
 import { notifyApiError } from "../../../shared/notifications/apiErrors.js";
+import { INVALID_REQUEST_CODE } from "../../../../lib/zeroAccess/sealedMoves.js";
 import GravatarSetting from "../../../shared/components/settings/GravatarSetting.js";
 const NON_MAIL_FOLDER_TYPES = new Set(["calendar", "contacts", "tasks", "notes"]);
 function importFormatFromFilename(filename) {
@@ -50,7 +52,7 @@ function PrivacyContent({ userUid }) {
     const ownedMailboxes = mailboxes.filter((mb) => mb.ownerUserUid !== undefined && mb.ownerUserUid === userUid);
     const ownMailbox = ownedMailboxes.length === 1 ? ownedMailboxes[0] : undefined;
     const selectedIsOwn = selected.uid === ownMailbox?.uid;
-    return (_jsx("div", { className: "flex-1 min-w-0 overflow-y-auto p-6", children: _jsxs("div", { className: "max-w-xl flex flex-col gap-8", children: [_jsxs("div", { children: [_jsx("h1", { className: "text-lg font-bold tracking-tight mb-1", children: "Privacy & Data" }), _jsx("p", { className: "text-sm text-text-muted", children: "Export or manage the data associated with this mailbox." })] }), _jsx(GravatarSetting, {}), selectedIsOwn ? (_jsxs(_Fragment, { children: [_jsx(ExportSection, { mailboxUid: mailboxUid, mailboxLabel: `${selected.displayName} (${selected.primarySmtpAddress})` }), _jsx(ImportSection, { mailboxUid: mailboxUid }), _jsx(ErasureSection, { mailboxLabel: `${selected.displayName} (${selected.primarySmtpAddress})` })] })) : (_jsx(OwnMailboxOnlyNotice, { ownedMailboxCount: ownedMailboxes.length, ownMailboxLabel: ownMailbox && `${ownMailbox.displayName} (${ownMailbox.primarySmtpAddress})` }))] }) }));
+    return (_jsx("div", { className: "flex-1 min-w-0 overflow-y-auto p-6", children: _jsxs("div", { className: "max-w-xl flex flex-col gap-8", children: [_jsxs("div", { children: [_jsx("h1", { className: "text-lg font-bold tracking-tight mb-1", children: "Privacy & Data" }), _jsx("p", { className: "text-sm text-text-muted", children: "Export or manage the data associated with this mailbox." })] }), _jsx(GravatarSetting, {}), selectedIsOwn ? (_jsxs(_Fragment, { children: [_jsx(ExportSection, { mailboxUid: mailboxUid, mailboxLabel: `${selected.displayName} (${selected.primarySmtpAddress})` }), _jsx(ImportSection, { mailboxUid: mailboxUid, mailbox: selected }), _jsx(ErasureSection, { mailboxLabel: `${selected.displayName} (${selected.primarySmtpAddress})` })] })) : (_jsx(OwnMailboxOnlyNotice, { ownedMailboxCount: ownedMailboxes.length, ownMailboxLabel: ownMailbox && `${ownMailbox.displayName} (${ownMailbox.primarySmtpAddress})` }))] }) }));
 }
 function OwnMailboxOnlyNotice({ ownedMailboxCount, ownMailboxLabel }) {
     let detail;
@@ -110,8 +112,36 @@ function ExportSection({ mailboxUid, mailboxLabel }) {
     }
     return (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Export my data" }), _jsxs("p", { className: "text-xs text-text-muted mb-3", children: ["Requests a copy of ", _jsx("strong", { children: mailboxLabel }), "\u2019s messages, contacts, calendar, tasks, and notes. This runs in the background and can take a few minutes \u2014 check back here for a download link once it\u2019s ready. Mail stored with zero-access encryption is exported encrypted: open it in a mail app that has your exported keys (Settings \u203A Encryption)."] }), _jsxs("form", { onSubmit: handleCreate, className: "flex items-end gap-3 mb-5", children: [_jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Format" }), _jsxs("select", { "aria-label": "Export format", className: "text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: format, onChange: (e) => setFormat(e.target.value), children: [_jsx("option", { value: "json", children: "JSON" }), _jsx("option", { value: "mbox", children: "Mbox" })] })] }), _jsx(Button, { type: "submit", variant: "secondary", className: "!w-auto", loading: creating, disabled: creating, children: "Request export" })] }), loadError && _jsx(Alert, { children: loadError }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : requests.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No export requests yet." })) : (_jsx("ul", { className: "flex flex-col gap-2", children: requests.map((request) => (_jsxs("li", { className: "flex items-center justify-between gap-3 text-sm py-1.5 px-3 bg-surface-alt rounded-sm", children: [_jsxs("span", { children: [request.format.toUpperCase(), " \u00B7 ", new Date(request.dateCreated).toLocaleString(), request.status === "failed" && request.errorMessage && (_jsxs("span", { className: "text-danger", children: [" \u2014 ", request.errorMessage] }))] }), _jsxs("span", { className: "flex items-center gap-3", children: [_jsx("span", { className: `text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill ${statusBadgeClass(request.status)}`, children: statusLabel(request.status) }), request.status === "ready" && (_jsx("a", { href: exportRequestDownloadUrl(request.uid), className: "text-primary-dark hover:underline font-medium", children: "Download" }))] })] }, request.uid))) }))] }));
 }
-function ImportSection({ mailboxUid }) {
+/**
+ * Uploads a mail archive for restapi's server-side import. Not offered for a mailbox whose mail is zero-access (`mailIsZeroAccess()`):
+ * restapi refuses it (409), since the archive would wait readable in its blob store until the import ran, and the reason is shown
+ * instead. The server's zero-access refusal given anyway (zero-access turned on since the page loaded) is shown in its place too; its other
+ * 409, an import already in progress, is not.
+ */
+function ImportSection({ mailboxUid, mailbox }) {
     const client = useApiClient();
+    // Only when the mailbox's own fields say its mail is zero-access is the administrator's policy asked: `undefined` until it answers
+    // (counted as allowed), and a failed read counts as allowed too, so the upload is never offered only to be refused.
+    const zeroAccessCandidate = mailIsZeroAccess(mailbox, undefined);
+    const [allowZeroAccess, setAllowZeroAccess] = useState(undefined);
+    const [refused, setRefused] = useState(null);
+    useEffect(() => {
+        if (!zeroAccessCandidate) {
+            return;
+        }
+        let cancelled = false;
+        void getEncryptionPolicy(client)
+            .then((policy) => {
+            if (!cancelled) {
+                setAllowZeroAccess(policy.allowZeroAccess);
+            }
+        })
+            .catch(() => undefined);
+        return () => {
+            cancelled = true;
+        };
+    }, [zeroAccessCandidate, client]);
+    const zeroAccess = mailIsZeroAccess(mailbox, allowZeroAccess);
     const [folders, setFolders] = useState([]);
     const [targetFolderUid, setTargetFolderUid] = useState("");
     const [foldersError, setFoldersError] = useState(null);
@@ -161,10 +191,21 @@ function ImportSection({ mailboxUid }) {
         setUploading(true);
         uploadMailboxImport(file, { format: importFormatFromFilename(file.name), targetFolderUid, mailboxUid: mailboxUid }, client)
             .then(() => loadRequests())
-            .catch((err) => notifyApiError(err, "Couldn't upload the file"))
+            .catch((err) => {
+            if (err instanceof ApiRequestError && err.status === 409 && err.code === INVALID_REQUEST_CODE) {
+                // The server refuses an import into this mailbox (its mail is zero-access): say why, in place of the upload.
+                setRefused(err.message);
+                return;
+            }
+            // Any other refusal - an import already in progress is a 409 too - leaves the upload offered, and shows that import.
+            notifyApiError(err, "Couldn't upload the file");
+            if (err instanceof ApiRequestError && err.status === 409) {
+                void loadRequests();
+            }
+        })
             .finally(() => setUploading(false));
     }
-    return (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Import mail" }), _jsx("p", { className: "text-xs text-text-muted mb-3", children: "Uploads an Mbox or PST archive and imports every message it contains into the folder you choose below. This runs in the background \u2014 check back here for its progress." }), folders.length > 0 && (_jsxs("label", { className: "flex flex-col gap-1.5 text-sm mb-3 max-w-xs", children: [_jsx("span", { className: "font-semibold", children: "Destination folder" }), _jsx("select", { "aria-label": "Destination folder", className: "text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: targetFolderUid, onChange: (e) => setTargetFolderUid(e.target.value), children: folders.map((folder) => (_jsx("option", { value: folder.uid, children: folder.name }, folder.uid))) })] })), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto mb-3", loading: uploading, disabled: uploading || !targetFolderUid, onClick: () => fileInputRef.current?.click(), children: "Upload Mbox or PST file" }), _jsx("input", { ref: fileInputRef, type: "file", accept: ".mbox,.pst", "aria-label": "Upload mail archive", className: "hidden", onChange: handleFileChange }), foldersError && _jsx(Alert, { children: foldersError }), loadError && _jsx(Alert, { children: loadError }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : requests.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No import requests yet." })) : (_jsx("ul", { className: "flex flex-col gap-2", children: requests.map((request) => (_jsxs("li", { className: "flex items-center justify-between gap-3 text-sm py-1.5 px-3 bg-surface-alt rounded-sm", children: [_jsxs("span", { children: [request.format.toUpperCase(), " \u00B7 ", new Date(request.dateCreated).toLocaleString(), request.status === "completed" && (_jsxs("span", { className: "text-text-muted", children: [" ", "\u2014 ", request.importedCount ?? 0, " imported", request.failedCount ? `, ${request.failedCount} failed` : ""] })), request.status === "failed" && request.errorMessage && (_jsxs("span", { className: "text-danger", children: [" \u2014 ", request.errorMessage] }))] }), _jsx("span", { className: `text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill ${statusBadgeClass(request.status)}`, children: statusLabel(request.status) })] }, request.uid))) }))] }));
+    return (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Import mail" }), _jsx("p", { className: "text-xs text-text-muted mb-3", children: "Uploads an Mbox or PST archive and imports every message it contains into the folder you choose below. This runs in the background \u2014 check back here for its progress." }), zeroAccess || refused ? (_jsx(Alert, { children: refused ?? ZERO_ACCESS_IMPORT_MESSAGE })) : (_jsxs(_Fragment, { children: [folders.length > 0 && (_jsxs("label", { className: "flex flex-col gap-1.5 text-sm mb-3 max-w-xs", children: [_jsx("span", { className: "font-semibold", children: "Destination folder" }), _jsx("select", { "aria-label": "Destination folder", className: "text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: targetFolderUid, onChange: (e) => setTargetFolderUid(e.target.value), children: folders.map((folder) => (_jsx("option", { value: folder.uid, children: folder.name }, folder.uid))) })] })), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto mb-3", loading: uploading, disabled: uploading || !targetFolderUid, onClick: () => fileInputRef.current?.click(), children: "Upload Mbox or PST file" }), _jsx("input", { ref: fileInputRef, type: "file", accept: ".mbox,.pst", "aria-label": "Upload mail archive", className: "hidden", onChange: handleFileChange })] })), foldersError && _jsx(Alert, { children: foldersError }), loadError && _jsx(Alert, { children: loadError }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : requests.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No import requests yet." })) : (_jsx("ul", { className: "flex flex-col gap-2", children: requests.map((request) => (_jsxs("li", { className: "flex items-center justify-between gap-3 text-sm py-1.5 px-3 bg-surface-alt rounded-sm", children: [_jsxs("span", { children: [request.format.toUpperCase(), " \u00B7 ", new Date(request.dateCreated).toLocaleString(), request.status === "completed" && (_jsxs("span", { className: "text-text-muted", children: [" ", "\u2014 ", request.importedCount ?? 0, " imported", request.failedCount ? `, ${request.failedCount} failed` : ""] })), request.status === "failed" && request.errorMessage && (_jsxs("span", { className: "text-danger", children: [" \u2014 ", request.errorMessage] }))] }), _jsx("span", { className: `text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill ${statusBadgeClass(request.status)}`, children: statusLabel(request.status) })] }, request.uid))) }))] }));
 }
 function ErasureSection({ mailboxLabel }) {
     const client = useApiClient();

package/dist/apps/www/tasks/index.js

@@ -26,6 +26,9 @@ import { useShortcut } from "../../shared/keyboard/useShortcut.js";
 import { useShortcutProps } from "../../shared/keyboard/useShortcutProps.js";
 import { notifyApiError } from "../../shared/notifications/apiErrors.js";
 import { changedItemOf, useFolderLiveUpdates } from "../../shared/live/useFolderLiveUpdates.js";
+import ProtectedMark from "../../shared/zeroAccess/ProtectedMark.js";
+import { useKeysLocked } from "../../shared/zeroAccess/useKeysLocked.js";
+import { isProtectedRecord, openSealedRecord, openSealedRecords } from "../../../lib/zeroAccess/sealedRecords.js";
 /** The published model class name of a task on either database (`TaskMongo`, `TaskSQL`) - not a `TaskList`'s. */
 const TASK_MODEL = /^Task(Mongo|SQL)$/;
 /** The push client channel group (`PushClient.setChannels()`) the page's tasks folder is subscribed under. */
@@ -106,6 +109,7 @@ function TasksContent() {
         setLoading(true);
         setError(null);
         return listAllPages((page) => listTasks(folderUid, { limit: LIST_PAGE_SIZE, page }, client))
+            .then(async (result) => ({ ...result, items: await openSealedRecords(result.items) }))
             .then((result) => {
             if (run === loadRun.current) {
                 setTasks(result.items);
@@ -126,6 +130,14 @@ function TasksContent() {
     useEffect(() => {
         void reload();
     }, [folderUid]);
+    // The list holds protected tasks opened with the mailbox's keys: its lock takes them off screen, read again with their placeholders. They
+    // leave the list first, so a reload that fails can't leave them shown.
+    useKeysLocked((locked) => {
+        if (locked === mailboxUid) {
+            setTasks((list) => list.filter((task) => !isProtectedRecord(task)));
+            void reload();
+        }
+    });
     // A task created, changed or deleted anywhere - another tab, a phone over ActiveSync - is announced on its folder's channel. It is fetched again by its
     // uid and replaces (or joins) the list while it is still in this folder; one that is gone (a delete, a 404, or moved to another folder) leaves it. A
     // failed fetch changes nothing: the next load shows it as it is.
@@ -135,7 +147,7 @@ function TasksContent() {
             remove();
             return;
         }
-        void getTask(change.uid, client).then((fresh) => {
+        void getTask(change.uid, client).then(openSealedRecord).then((fresh) => {
             if (fresh.folderUid !== folderUid) {
                 remove();
                 return;
@@ -199,14 +211,14 @@ function TasksContent() {
                 setCreateError("That mailbox has no Tasks folder.");
                 return;
             }
-            const created = await createTask({
+            const created = await openSealedRecord(await createTask({
                 mailboxUid: target,
                 folderUid: targetFolderUid,
                 title: title.trim(),
                 // The date input's "yyyy-MM-dd" is stored as that day's UTC midnight - see `dueDateInstant()`.
                 dueDate: dueDate ? dueDateInstant(dueDate) : undefined,
                 priority,
-            }, client);
+            }, client));
             if (target === mailboxUid) {
                 setAddedElsewhere(null);
                 setTasks((prev) => [...prev, created]);
@@ -247,11 +259,13 @@ function TasksContent() {
         const nextCompleted = !task.completed;
         setTasks((prev) => prev.map((t) => (t.uid === task.uid ? { ...t, completed: nextCompleted } : t)));
         try {
-            const updated = await setTaskCompleted(task, nextCompleted, client);
+            const updated = await openSealedRecord(await setTaskCompleted(task, nextCompleted, client));
             setTasks((prev) => prev.map((t) => (t.uid === task.uid ? updated : t)));
         }
         catch (err) {
-            setTasks((prev) => prev.map((t) => (t.uid === task.uid ? task : t)));
+            // Only the flag goes back, on the row there now: `task` is the row as it was shown, opened, and a lock since may have
+            // reloaded it with its placeholders (#224), which putting it back whole would undo.
+            setTasks((prev) => prev.map((t) => (t.uid === task.uid ? { ...t, completed: task.completed } : t)));
             notifyApiError(err, "Couldn't update the task");
         }
         finally {
@@ -415,7 +429,7 @@ function CompletionToggle({ task, onToggle, pending }) {
         ].join(" "), children: "\u2713" }));
 }
 function TaskGroup({ label, tasks, checkedUids, onToggleChecked, onToggle, toggling, onDelete }) {
-    return (_jsxs("div", { children: [_jsx("h2", { className: "text-xs font-bold uppercase tracking-wide text-text-muted mb-2", children: label }), _jsx("ul", { className: "bg-surface border border-border rounded-md divide-y divide-border", children: tasks.map((task) => (_jsxs("li", { className: "flex items-center gap-3 py-2.5 px-3", children: [_jsx("input", { type: "checkbox", "aria-label": `Select ${task.title}`, checked: checkedUids.has(task.uid), onChange: () => onToggleChecked(task.uid) }), _jsx(CompletionToggle, { task: task, onToggle: onToggle, pending: toggling.has(task.uid) }), _jsx("span", { className: ["flex-1 text-sm", task.completed ? "line-through text-text-muted" : ""].join(" "), children: task.title }), task.priority !== "normal" && (_jsx("span", { className: ["text-xs font-medium", PRIORITY_CLASS[task.priority]].join(" "), children: PRIORITY_LABEL[task.priority] })), task.dueDate && (_jsx("span", { className: "text-xs text-text-muted shrink-0", children: parseDueDate(task.dueDate).toLocaleDateString() })), _jsx("button", { type: "button", onClick: () => onDelete(task), "aria-label": `Delete "${task.title}"`, className: "text-text-muted hover:text-danger text-sm px-1", children: "\u00D7" })] }, task.uid))) })] }));
+    return (_jsxs("div", { children: [_jsx("h2", { className: "text-xs font-bold uppercase tracking-wide text-text-muted mb-2", children: label }), _jsx("ul", { className: "bg-surface border border-border rounded-md divide-y divide-border", children: tasks.map((task) => (_jsxs("li", { className: "flex items-center gap-3 py-2.5 px-3", children: [_jsx("input", { type: "checkbox", "aria-label": `Select ${task.title}`, checked: checkedUids.has(task.uid), onChange: () => onToggleChecked(task.uid) }), _jsx(CompletionToggle, { task: task, onToggle: onToggle, pending: toggling.has(task.uid) }), _jsxs("span", { className: ["flex-1 text-sm", task.completed ? "line-through text-text-muted" : ""].join(" "), children: [task.title, _jsx(ProtectedMark, { record: task })] }), task.priority !== "normal" && (_jsx("span", { className: ["text-xs font-medium", PRIORITY_CLASS[task.priority]].join(" "), children: PRIORITY_LABEL[task.priority] })), task.dueDate && (_jsx("span", { className: "text-xs text-text-muted shrink-0", children: parseDueDate(task.dueDate).toLocaleDateString() })), _jsx("button", { type: "button", onClick: () => onDelete(task), "aria-label": `Delete "${task.title}"`, className: "text-text-muted hover:text-danger text-sm px-1", children: "\u00D7" })] }, task.uid))) })] }));
 }
 function TaskTable({ tasks, checkedUids, onToggleChecked, onToggle, toggling, onDelete }) {
     const allChecked = tasks.length > 0 && tasks.every((t) => checkedUids.has(t.uid));
@@ -435,7 +449,7 @@ function TaskTable({ tasks, checkedUids, onToggleChecked, onToggle, toggling, on
             }
         }
     }
-    return (_jsx("div", { className: "overflow-x-auto", children: _jsxs("table", { className: "w-full text-sm bg-surface border border-border rounded-md", children: [_jsx("thead", { children: _jsxs("tr", { className: "border-b border-border text-left", children: [_jsx("th", { className: "w-8 px-3 py-2", children: _jsx("input", { type: "checkbox", "aria-label": "Select all tasks", checked: allChecked, onChange: toggleAll }) }), _jsx("th", { className: "w-8 px-3 py-2" }), _jsx("th", { className: "px-3 py-2 text-xs font-bold uppercase tracking-wide text-text-muted", children: "Title" }), _jsx("th", { className: "px-3 py-2 text-xs font-bold uppercase tracking-wide text-text-muted", children: "Due Date" }), _jsx("th", { className: "px-3 py-2 text-xs font-bold uppercase tracking-wide text-text-muted", children: "Importance" }), _jsx("th", { className: "w-8 px-3 py-2" })] }) }), _jsx("tbody", { children: tasks.map((task) => (_jsxs("tr", { className: "border-b border-border last:border-0", children: [_jsx("td", { className: "px-3 py-2", children: _jsx("input", { type: "checkbox", "aria-label": `Select ${task.title}`, checked: checkedUids.has(task.uid), onChange: () => onToggleChecked(task.uid) }) }), _jsx("td", { className: "px-3 py-2", children: _jsx(CompletionToggle, { task: task, onToggle: onToggle, pending: toggling.has(task.uid) }) }), _jsx("td", { className: ["px-3 py-2", task.completed ? "line-through text-text-muted" : ""].join(" "), children: task.title }), _jsx("td", { className: "px-3 py-2 text-text-muted", children: task.dueDate ? parseDueDate(task.dueDate).toLocaleDateString() : "" }), _jsx("td", { className: ["px-3 py-2", PRIORITY_CLASS[task.priority]].join(" "), children: PRIORITY_LABEL[task.priority] }), _jsx("td", { className: "px-3 py-2", children: _jsx("button", { type: "button", onClick: () => onDelete(task), "aria-label": `Delete "${task.title}"`, className: "text-text-muted hover:text-danger text-sm px-1", children: "\u00D7" }) })] }, task.uid))) })] }) }));
+    return (_jsx("div", { className: "overflow-x-auto", children: _jsxs("table", { className: "w-full text-sm bg-surface border border-border rounded-md", children: [_jsx("thead", { children: _jsxs("tr", { className: "border-b border-border text-left", children: [_jsx("th", { className: "w-8 px-3 py-2", children: _jsx("input", { type: "checkbox", "aria-label": "Select all tasks", checked: allChecked, onChange: toggleAll }) }), _jsx("th", { className: "w-8 px-3 py-2" }), _jsx("th", { className: "px-3 py-2 text-xs font-bold uppercase tracking-wide text-text-muted", children: "Title" }), _jsx("th", { className: "px-3 py-2 text-xs font-bold uppercase tracking-wide text-text-muted", children: "Due Date" }), _jsx("th", { className: "px-3 py-2 text-xs font-bold uppercase tracking-wide text-text-muted", children: "Importance" }), _jsx("th", { className: "w-8 px-3 py-2" })] }) }), _jsx("tbody", { children: tasks.map((task) => (_jsxs("tr", { className: "border-b border-border last:border-0", children: [_jsx("td", { className: "px-3 py-2", children: _jsx("input", { type: "checkbox", "aria-label": `Select ${task.title}`, checked: checkedUids.has(task.uid), onChange: () => onToggleChecked(task.uid) }) }), _jsx("td", { className: "px-3 py-2", children: _jsx(CompletionToggle, { task: task, onToggle: onToggle, pending: toggling.has(task.uid) }) }), _jsxs("td", { className: ["px-3 py-2", task.completed ? "line-through text-text-muted" : ""].join(" "), children: [task.title, _jsx(ProtectedMark, { record: task })] }), _jsx("td", { className: "px-3 py-2 text-text-muted", children: task.dueDate ? parseDueDate(task.dueDate).toLocaleDateString() : "" }), _jsx("td", { className: ["px-3 py-2", PRIORITY_CLASS[task.priority]].join(" "), children: PRIORITY_LABEL[task.priority] }), _jsx("td", { className: "px-3 py-2", children: _jsx("button", { type: "button", onClick: () => onDelete(task), "aria-label": `Delete "${task.title}"`, className: "text-text-muted hover:text-danger text-sm px-1", children: "\u00D7" }) })] }, task.uid))) })] }) }));
 }
 export default TasksPage;
 /** The tab's title: `Brand: Tasks` (see `pageTitle()`). */

package/dist/lib/admin/domainsApi.d.ts

@@ -56,7 +56,7 @@ export declare function deleteDomain(uid: string, version: number, client?: ApiC
  * Idempotent on an already-verified domain; a still-unverified result is not an error (only
  * `lastCheckedAt` advances) — always returns the domain's current state either way. */
 export declare function verifyDomain(uid: string, client?: ApiClient): Promise<Domain>;
-export type DnsRecordType = "ownership" | "mx" | "spf" | "dkim" | "dmarc" | "autodiscover_cname" | "autodiscover_srv";
+export type DnsRecordType = "ownership" | "mx" | "spf" | "dkim" | "dmarc" | "openpgpkey_cname" | "autodiscover_cname" | "autodiscover_srv";
 /** One mail-related DNS record this server recommends for a domain, live-checked against real DNS —
  * purely diagnostic, never mutates anything (unlike `verifyDomain`). The two `autodiscover_*` types are only
  * ever present while `@rapidmx/autodiscover-plugin` is active for this deployment. */