@rapidmx/web-client 0.4.0 → 0.5.0

package/dist/apps/escrow/matters/[uid].js

@@ -3,7 +3,7 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { useEffect, useState } from "react";
+import { useEffect, useRef, useState } from "react";
 import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
 import { closeMatter, getMatter } from "@rapidmx/react-shared/admin/mattersApi.js";
 import { approveAccessRequest, createAccessRequest, denyAccessRequest, getAccessRequestMaterial, listAccessRequests, } from "@rapidmx/react-shared/admin/escrowAccessRequestsApi.js";
@@ -11,35 +11,44 @@ import { createMatterExportRequest, listMatterExportRequests, matterExportReques
 import { searchMatter } from "@rapidmx/react-shared/admin/matterSearchApi.js";
 import { parseSearchQuery } from "@rapidmx/react-shared/search/queryGrammar.js";
 import EscrowShell from "../../shared/components/escrow/layout/EscrowShell.js";
+import { LoadMoreButton, usePagedList } from "../../shared/components/admin/usePagedList.js";
 import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
 import Button from "@rapidmx/react-shared/components/buttons/Button.js";
 import FormField from "@rapidmx/react-shared/components/forms/FormField.js";
 import Modal from "@rapidmx/react-shared/components/overlays/Modal.js";
 const INPUT_CLASS = "w-full text-sm py-2.5 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
-// `BaseEscrowAccessRequestRoute.find()` always returns every request under every scope the caller holds
-// (it unconditionally overwrites any `matterId` filter with its own held-scopes-derived one — see
-// `escrowAccessRequestsApi.ts`'s own doc comment) — there is no server-side way to ask for just this one
-// matter's requests. This page fetches a generously-sized single page and filters client-side instead of
-// paginating a second, matter-scoped list UI on top of an already-scoped one; a holder with more than this
-// many *total* in-flight requests across every matter they hold is not the common case this v1 targets.
-const REQUESTS_FETCH_LIMIT = 200;
+/** Request statuses still waiting or running - shown as a neutral in-progress badge, never as success. Includes
+ * restapi's `processing` (exports/imports) and `in_progress` (an erasure that is running). */
+const IN_PROGRESS_STATUSES = new Set(["pending", "processing", "in_progress"]);
 function statusBadgeClass(status) {
-    if (status === "denied" || status === "failed")
+    if (status === "failed" || status === "denied")
         return "bg-danger-bg text-danger";
-    if (status === "pending")
+    if (IN_PROGRESS_STATUSES.has(status))
         return "bg-surface-alt text-text-muted";
     return "bg-success text-white";
 }
+/** A status as shown on its badge (`in_progress` -> `in progress`). */
+function statusLabel(status) {
+    return status.replace(/_/g, " ");
+}
 export default function MatterDetailPage(props) {
     return (_jsx(EscrowShell, { ...props, active: "matters", children: _jsx(MatterDetailContent, { uid: props.params.uid }) }));
 }
+function formatDateRange(matter) {
+    return `${new Date(matter.dateRangeStart).toLocaleDateString()} – ${new Date(matter.dateRangeEnd).toLocaleDateString()}`;
+}
 function MatterDetailContent({ uid }) {
     const [matter, setMatter] = useState(null);
-    const [requests, setRequests] = useState([]);
     const [loading, setLoading] = useState(true);
     const [error, setError] = useState(null);
+    // Both lists are fetched for this matter only (`matterId`), newest first, a page at a time. Rows are still
+    // checked against this matter in case an older server ignores the filter.
+    const requests = usePagedList((params) => listAccessRequests({ ...params, matterId: uid }), "Could not load this matter's access requests.");
+    const exportRequests = usePagedList((params) => listMatterExportRequests({ ...params, matterId: uid }), "Could not load this matter's export requests.");
+    const [confirmingClose, setConfirmingClose] = useState(false);
     const [closing, setClosing] = useState(false);
     const [closeError, setCloseError] = useState(null);
+    const [approveTarget, setApproveTarget] = useState(null);
     const [showNewRequest, setShowNewRequest] = useState(false);
     const [newRequestMailboxUid, setNewRequestMailboxUid] = useState("");
     const [creatingRequest, setCreatingRequest] = useState(false);
@@ -51,41 +60,44 @@ function MatterDetailContent({ uid }) {
     const [materialText, setMaterialText] = useState("");
     const [materialError, setMaterialError] = useState(null);
     const [loadingMaterial, setLoadingMaterial] = useState(false);
-    const [exportRequests, setExportRequests] = useState([]);
+    // Bumped whenever the material modal closes (or the matter does), so a slow "Get material" response for a
+    // modal that's already gone - or for an earlier request - is never shown.
+    const materialSeq = useRef(0);
     const [creatingExport, setCreatingExport] = useState(false);
     const [exportError, setExportError] = useState(null);
     const [searchText, setSearchText] = useState("");
     const [searching, setSearching] = useState(false);
     const [searchError, setSearchError] = useState(null);
     const [searchResults, setSearchResults] = useState(null);
-    // Same "no server-side single-matter filter, fetch a generous page and filter client-side" shape
-    // REQUESTS_FETCH_LIMIT's own doc comment already establishes for access requests -
-    // listMatterExportRequests() has the identical held-scopes-derived scoping, not a per-matter one.
-    function reload() {
+    // Bumped by every search and by closing the matter, so a search still in flight when the matter closes (or
+    // superseded by a newer search) never shows its results.
+    const searchSeq = useRef(0);
+    useEffect(() => {
         setLoading(true);
         setError(null);
-        Promise.all([getMatter(uid), listAccessRequests({ limit: REQUESTS_FETCH_LIMIT }), listMatterExportRequests()])
-            .then(([loadedMatter, allRequests, allExportRequests]) => {
-            setMatter(loadedMatter);
-            setRequests(allRequests.filter((r) => r.matterId === uid));
-            setExportRequests(allExportRequests.filter((r) => r.matterId === uid));
-        })
+        getMatter(uid)
+            .then(setMatter)
             .catch((err) => setError(err instanceof ApiRequestError ? err.message : "Could not load this matter."))
             .finally(() => setLoading(false));
-    }
-    useEffect(() => {
-        reload();
+        void requests.reload();
+        void exportRequests.reload();
     }, [uid]);
-    // Only ever invoked from the "Close matter" button below, which itself only renders once `matter` is
+    // Only ever invoked from the close-confirmation modal below, which itself only renders once `matter` is
     // resolved (children only render once loaded — see the early returns further down) — the non-null
-    // assertion reflects that real invariant, not an unchecked assumption. Matches `DomainDetailContent.
-    // handleVerify`'s identical pattern.
+    // assertion reflects that real invariant, not an unchecked assumption.
     async function handleClose() {
         setClosing(true);
         setCloseError(null);
         try {
             const updated = await closeMatter(matter.uid);
             setMatter(updated);
+            setConfirmingClose(false);
+            // Nothing more may be read under a closed matter - drop any material or search results already on
+            // screen, including a search still in flight, and any approval still being confirmed.
+            closeMaterialModal();
+            searchSeq.current++;
+            setSearchResults(null);
+            setSearching(false);
         }
         catch (err) {
             setCloseError(err instanceof ApiRequestError ? err.message : "Could not close this matter.");
@@ -94,6 +106,10 @@ function MatterDetailContent({ uid }) {
             setClosing(false);
         }
     }
+    function closeCloseModal() {
+        setConfirmingClose(false);
+        setCloseError(null);
+    }
     async function handleCreateRequest(e) {
         e.preventDefault();
         setNewRequestError(null);
@@ -106,7 +122,7 @@ function MatterDetailContent({ uid }) {
             await createAccessRequest({ matterId: uid, mailboxUid: newRequestMailboxUid.trim() });
             setShowNewRequest(false);
             setNewRequestMailboxUid("");
-            reload();
+            void requests.reload();
         }
         catch (err) {
             setNewRequestError(err instanceof ApiRequestError ? err.message : "Could not create this access request.");
@@ -115,12 +131,15 @@ function MatterDetailContent({ uid }) {
             setCreatingRequest(false);
         }
     }
-    async function handleApprove(request) {
+    // Only ever invoked from the approve-confirmation modal below, which only renders once `approveTarget` is set.
+    async function handleApprove() {
+        const request = approveTarget;
+        setApproveTarget(null);
         setActingOn((prev) => ({ ...prev, [request.uid]: true }));
         setActionErrors((prev) => ({ ...prev, [request.uid]: "" }));
         try {
             const updated = await approveAccessRequest(request.uid);
-            setRequests((prev) => prev.map((r) => (r.uid === updated.uid ? updated : r)));
+            requests.replaceItem(updated);
         }
         catch (err) {
             setActionErrors((prev) => ({
@@ -137,7 +156,7 @@ function MatterDetailContent({ uid }) {
         setActionErrors((prev) => ({ ...prev, [request.uid]: "" }));
         try {
             const updated = await denyAccessRequest(request.uid);
-            setRequests((prev) => prev.map((r) => (r.uid === updated.uid ? updated : r)));
+            requests.replaceItem(updated);
         }
         catch (err) {
             setActionErrors((prev) => ({
@@ -150,30 +169,39 @@ function MatterDetailContent({ uid }) {
         }
     }
     async function handleGetMaterial(request) {
+        const seq = ++materialSeq.current;
         setMaterialFor(request);
         setMaterialText("");
         setMaterialError(null);
         setLoadingMaterial(true);
         try {
             const material = await getAccessRequestMaterial(request.uid);
-            setMaterialText(JSON.stringify(material.masterKeyWraps, null, 2));
+            if (seq === materialSeq.current)
+                setMaterialText(JSON.stringify(material.masterKeyWraps, null, 2));
         }
         catch (err) {
-            setMaterialError(err instanceof ApiRequestError ? err.message : "Could not read this request's material.");
+            if (seq === materialSeq.current) {
+                setMaterialError(err instanceof ApiRequestError ? err.message : "Could not read this request's material.");
+            }
         }
         finally {
-            setLoadingMaterial(false);
+            if (seq === materialSeq.current)
+                setLoadingMaterial(false);
         }
     }
     function closeMaterialModal() {
+        materialSeq.current++;
         setMaterialFor(null);
+        setMaterialText("");
+        setMaterialError(null);
+        setLoadingMaterial(false);
     }
     async function handleCreateExport() {
         setExportError(null);
         setCreatingExport(true);
         try {
             await createMatterExportRequest(uid);
-            reload();
+            void exportRequests.reload();
         }
         catch (err) {
             setExportError(err instanceof ApiRequestError ? err.message : "Could not start this export.");
@@ -184,6 +212,7 @@ function MatterDetailContent({ uid }) {
     }
     async function handleSearch(e) {
         e.preventDefault();
+        const seq = ++searchSeq.current;
         setSearchError(null);
         setSearching(true);
         try {
@@ -207,13 +236,17 @@ function MatterDetailContent({ uid }) {
                 flags: parsed.flags,
                 labels: parsed.labels,
             });
-            setSearchResults(results);
+            if (seq === searchSeq.current)
+                setSearchResults(results);
         }
         catch (err) {
-            setSearchError(err instanceof ApiRequestError ? err.message : "Could not search this matter.");
+            if (seq === searchSeq.current) {
+                setSearchError(err instanceof ApiRequestError ? err.message : "Could not search this matter.");
+            }
         }
         finally {
-            setSearching(false);
+            if (seq === searchSeq.current)
+                setSearching(false);
         }
     }
     if (loading) {
@@ -222,13 +255,15 @@ function MatterDetailContent({ uid }) {
     if (error || !matter) {
         return _jsx(Alert, { children: error ?? "Matter not found." });
     }
-    return (_jsxs("div", { className: "max-w-4xl flex flex-col gap-5", children: [_jsxs("div", { className: "flex items-start justify-between gap-4", children: [_jsxs("div", { children: [_jsx("a", { href: "/escrow", className: "text-sm text-primary-dark hover:underline", children: "\u2190 All matters" }), _jsx("h1", { className: "text-xl font-bold tracking-tight mt-1", children: matter.name })] }), !matter.closedAt && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto shrink-0", loading: closing, disabled: closing, onClick: handleClose, children: "Close matter" }))] }), closeError && _jsx(Alert, { children: closeError }), _jsx("div", { className: "bg-surface border border-border rounded-md p-6", children: _jsxs("dl", { className: "grid grid-cols-1 sm:grid-cols-2 gap-x-6 gap-y-3 text-sm", children: [_jsx("dt", { className: "text-text-muted", children: "Description" }), _jsx("dd", { children: matter.description ?? "None" }), _jsx("dt", { className: "text-text-muted", children: "Escrow scope" }), _jsx("dd", { className: "font-mono text-xs", children: matter.escrowScopeId }), _jsx("dt", { className: "text-text-muted", children: "Custodian mailboxes" }), _jsx("dd", { children: matter.custodianMailboxUids.join(", ") }), _jsx("dt", { className: "text-text-muted", children: "Date range" }), _jsxs("dd", { children: [new Date(matter.dateRangeStart).toLocaleDateString(), " \u2013", " ", new Date(matter.dateRangeEnd).toLocaleDateString()] }), _jsx("dt", { className: "text-text-muted", children: "Status" }), _jsx("dd", { children: matter.closedAt ? `Closed ${new Date(matter.closedAt).toLocaleString()}` : "Open" })] }) }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsxs("div", { className: "flex items-center justify-between mb-3", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide", children: "Access requests" }), !matter.closedAt && (_jsx(Button, { type: "button", className: "!w-auto", onClick: () => setShowNewRequest(true), children: "+ New access request" }))] }), requests.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No access requests yet." })) : (_jsx("ul", { className: "flex flex-col gap-3", children: requests.map((request) => (_jsxs("li", { className: "border border-border rounded-sm p-4", children: [_jsxs("div", { className: "flex items-center justify-between gap-3 flex-wrap", children: [_jsxs("div", { children: [_jsx("div", { className: "text-sm font-semibold", children: request.mailboxUid }), _jsxs("div", { className: "text-xs text-text-muted", children: [request.approvals.length, " of ", request.requiredHoldersAtCreation, " approvals \u00B7 requested by ", request.requestedByUserUid] })] }), _jsx("span", { className: [
+    const matterRequests = requests.items.filter((request) => request.matterId === uid);
+    const matterExportRequests = exportRequests.items.filter((request) => request.matterId === uid);
+    return (_jsxs("div", { className: "max-w-4xl flex flex-col gap-5", children: [_jsxs("div", { className: "flex items-start justify-between gap-4", children: [_jsxs("div", { children: [_jsx("a", { href: "/escrow", className: "text-sm text-primary-dark hover:underline", children: "\u2190 All matters" }), _jsx("h1", { className: "text-xl font-bold tracking-tight mt-1", children: matter.name })] }), !matter.closedAt && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto shrink-0", onClick: () => setConfirmingClose(true), children: "Close matter" }))] }), _jsx("div", { className: "bg-surface border border-border rounded-md p-6", children: _jsxs("dl", { className: "grid grid-cols-1 sm:grid-cols-2 gap-x-6 gap-y-3 text-sm", children: [_jsx("dt", { className: "text-text-muted", children: "Description" }), _jsx("dd", { children: matter.description ?? "None" }), _jsx("dt", { className: "text-text-muted", children: "Escrow scope" }), _jsx("dd", { className: "font-mono text-xs", children: matter.escrowScopeId }), _jsx("dt", { className: "text-text-muted", children: "Custodian mailboxes" }), _jsx("dd", { children: matter.custodianMailboxUids.join(", ") }), _jsx("dt", { className: "text-text-muted", children: "Date range" }), _jsx("dd", { children: formatDateRange(matter) }), _jsx("dt", { className: "text-text-muted", children: "Status" }), _jsx("dd", { children: matter.closedAt ? `Closed ${new Date(matter.closedAt).toLocaleString()}` : "Open" })] }) }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsxs("div", { className: "flex items-center justify-between mb-3", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide", children: "Access requests" }), !matter.closedAt && (_jsx(Button, { type: "button", className: "!w-auto", onClick: () => setShowNewRequest(true), children: "+ New access request" }))] }), requests.loadError && _jsx(Alert, { children: requests.loadError }), matterRequests.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: requests.loading ? "Loading…" : "No access requests yet." })) : (_jsx("ul", { className: "flex flex-col gap-3", children: matterRequests.map((request) => (_jsxs("li", { className: "border border-border rounded-sm p-4", children: [_jsxs("div", { className: "flex items-center justify-between gap-3 flex-wrap", children: [_jsxs("div", { children: [_jsx("div", { className: "text-sm font-semibold", children: request.mailboxUid }), _jsxs("div", { className: "text-xs text-text-muted", children: [request.approvals.length, " of ", request.requiredHoldersAtCreation, " approvals \u00B7 requested by ", request.requestedByUserUid] })] }), _jsx("span", { className: [
                                                 "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill",
                                                 request.status === "denied"
                                                     ? "bg-danger-bg text-danger"
                                                     : request.status === "pending"
                                                         ? "bg-surface-alt text-text-muted"
                                                         : "bg-success text-white",
-                                            ].join(" "), children: request.status })] }), actionErrors[request.uid] && _jsx(Alert, { children: actionErrors[request.uid] }), _jsxs("div", { className: "flex gap-3 mt-3", children: [request.status === "pending" && (_jsxs(_Fragment, { children: [_jsx(Button, { type: "button", className: "!w-auto", loading: actingOn[request.uid], disabled: actingOn[request.uid], onClick: () => handleApprove(request), children: "Approve" }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: actingOn[request.uid], disabled: actingOn[request.uid], onClick: () => handleDeny(request), children: "Deny" })] })), (request.status === "approved" || request.status === "fulfilled") && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => handleGetMaterial(request), children: "Get material" }))] })] }, request.uid))) }))] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsxs("div", { className: "flex items-center justify-between mb-3", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide", children: "Export this matter" }), _jsx(Button, { type: "button", className: "!w-auto", loading: creatingExport, disabled: creatingExport, onClick: handleCreateExport, children: "+ New export" })] }), _jsx("p", { className: "text-xs text-text-muted mb-3", children: "Exports messages (narrowed to this matter\u2019s own date range), plus full contacts, calendar events, tasks, and notes, from every custodian mailbox actually assigned to this matter\u2019s escrow scope, as one combined NDJSON file." }), exportError && _jsx(Alert, { children: exportError }), exportRequests.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No export requests yet." })) : (_jsx("ul", { className: "flex flex-col gap-2", children: exportRequests.map((request) => (_jsxs("li", { className: "flex items-center justify-between gap-3 text-sm py-1.5 px-3 bg-surface-alt rounded-sm", children: [_jsxs("span", { children: [new Date(request.dateCreated).toLocaleString(), request.status === "failed" && request.errorMessage && (_jsxs("span", { className: "text-danger", children: [" \u2014 ", request.errorMessage] }))] }), _jsxs("span", { className: "flex items-center gap-3", children: [_jsx("span", { className: `text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill ${statusBadgeClass(request.status)}`, children: request.status }), request.status === "ready" && (_jsx("a", { href: matterExportRequestDownloadUrl(request.uid), className: "text-primary-dark hover:underline font-medium", children: "Download" }))] })] }, request.uid))) }))] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-3", children: "Search this matter\u2019s custodians" }), _jsxs("form", { onSubmit: handleSearch, className: "flex gap-3 mb-4", children: [_jsx("input", { "aria-label": "Search this matter", className: INPUT_CLASS, value: searchText, onChange: (e) => setSearchText(e.target.value), placeholder: "Free text or an operator filter, e.g. from:alice@example.com" }), _jsx(Button, { type: "submit", className: "!w-auto shrink-0", loading: searching, disabled: searching || !searchText.trim(), children: "Search" })] }), searchError && _jsx(Alert, { children: searchError }), searchResults &&
-                        (Object.keys(searchResults).length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No custodian mailboxes could be searched." })) : (_jsx("div", { className: "flex flex-col gap-4", children: Object.entries(searchResults).map(([mailboxUid, page]) => (_jsxs("div", { children: [_jsx("h3", { className: "text-sm font-semibold mb-2", children: mailboxUid }), page.results.length === 0 ? (_jsx("p", { className: "text-xs text-text-muted", children: "No matches." })) : (_jsx("ul", { className: "flex flex-col gap-1", children: page.results.map((result) => (_jsxs("li", { className: "text-sm py-1 px-2 bg-surface-alt rounded-sm", children: [result.entityType, " \u00B7 ", result.entityUid, result.snippet && _jsxs("span", { className: "text-text-muted", children: [" \u2014 ", result.snippet] })] }, `${result.entityType}-${result.entityUid}`))) }))] }, mailboxUid))) })))] }), _jsx(Modal, { open: showNewRequest, onClose: () => setShowNewRequest(false), title: "New access request", children: _jsxs("form", { onSubmit: handleCreateRequest, className: "flex flex-col gap-4", children: [newRequestError && _jsx(Alert, { children: newRequestError }), _jsx(FormField, { label: "Mailbox uid", htmlFor: "newRequestMailboxUid", children: _jsx("input", { id: "newRequestMailboxUid", type: "text", className: INPUT_CLASS, value: newRequestMailboxUid, onChange: (e) => setNewRequestMailboxUid(e.target.value) }) }), _jsx("p", { className: "text-xs text-text-muted", children: "Must be one of this matter's own custodian mailboxes, currently assigned to this matter's escrow scope. Your own creation counts as the first approval." }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: creatingRequest, onClick: () => setShowNewRequest(false), children: "Cancel" }), _jsx(Button, { type: "submit", className: "!w-auto", loading: creatingRequest, disabled: creatingRequest, children: "Create request" })] })] }) }), _jsx(Modal, { open: materialFor !== null, onClose: closeMaterialModal, title: "Escrow key material", children: loadingMaterial ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : materialError ? (_jsx(Alert, { children: materialError })) : (_jsxs(_Fragment, { children: [_jsxs("p", { className: "text-sm text-text-muted mb-3", children: ["Still-encrypted master key wraps for ", _jsx("strong", { children: materialFor?.mailboxUid }), " \u2014 this server cannot decrypt these either. Copy the JSON below into your own offline tooling."] }), _jsx("pre", { className: "text-xs font-mono bg-surface-alt border border-border rounded-sm p-3 overflow-x-auto whitespace-pre-wrap break-all", children: materialText })] })) })] }));
+                                            ].join(" "), children: request.status })] }), actionErrors[request.uid] && _jsx(Alert, { children: actionErrors[request.uid] }), _jsxs("div", { className: "flex gap-3 mt-3", children: [!matter.closedAt && request.status === "pending" && (_jsxs(_Fragment, { children: [_jsx(Button, { type: "button", className: "!w-auto", loading: actingOn[request.uid], disabled: actingOn[request.uid], onClick: () => setApproveTarget(request), children: "Approve" }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: actingOn[request.uid], disabled: actingOn[request.uid], onClick: () => handleDeny(request), children: "Deny" })] })), !matter.closedAt && (request.status === "approved" || request.status === "fulfilled") && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => handleGetMaterial(request), children: "Get material" }))] })] }, request.uid))) })), _jsx(LoadMoreButton, { list: requests, label: "Load more access requests" })] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsxs("div", { className: "flex items-center justify-between mb-3", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide", children: "Export this matter" }), !matter.closedAt && (_jsx(Button, { type: "button", className: "!w-auto", loading: creatingExport, disabled: creatingExport, onClick: handleCreateExport, children: "+ New export" }))] }), _jsx("p", { className: "text-xs text-text-muted mb-3", children: "Exports messages (narrowed to this matter\u2019s own date range), plus full contacts, calendar events, tasks, and notes, from every custodian mailbox actually assigned to this matter\u2019s escrow scope, as one combined NDJSON file." }), exportError && _jsx(Alert, { children: exportError }), exportRequests.loadError && _jsx(Alert, { children: exportRequests.loadError }), matterExportRequests.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: exportRequests.loading ? "Loading…" : "No export requests yet." })) : (_jsx("ul", { className: "flex flex-col gap-2", children: matterExportRequests.map((request) => (_jsxs("li", { className: "flex items-center justify-between gap-3 text-sm py-1.5 px-3 bg-surface-alt rounded-sm", children: [_jsxs("span", { children: [new Date(request.dateCreated).toLocaleString(), request.status === "failed" && request.errorMessage && (_jsxs("span", { className: "text-danger", children: [" \u2014 ", request.errorMessage] }))] }), _jsxs("span", { className: "flex items-center gap-3", children: [_jsx("span", { className: `text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill ${statusBadgeClass(request.status)}`, children: statusLabel(request.status) }), !matter.closedAt && request.status === "ready" && (_jsx("a", { href: matterExportRequestDownloadUrl(request.uid), className: "text-primary-dark hover:underline font-medium", children: "Download" }))] })] }, request.uid))) }))] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-3", children: "Search this matter\u2019s custodians" }), matter.closedAt ? (_jsx("p", { className: "text-sm text-text-muted", children: "This matter is closed, so its custodians can no longer be searched or exported." })) : (_jsxs("form", { onSubmit: handleSearch, className: "flex gap-3 mb-4", children: [_jsx("input", { "aria-label": "Search this matter", className: INPUT_CLASS, value: searchText, onChange: (e) => setSearchText(e.target.value), placeholder: "Free text or an operator filter, e.g. from:alice@example.com" }), _jsx(Button, { type: "submit", className: "!w-auto shrink-0", loading: searching, disabled: searching || !searchText.trim(), children: "Search" })] })), searchError && _jsx(Alert, { children: searchError }), searchResults &&
+                        (Object.keys(searchResults).length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No custodian mailboxes could be searched." })) : (_jsx("div", { className: "flex flex-col gap-4", children: Object.entries(searchResults).map(([mailboxUid, page]) => (_jsxs("div", { children: [_jsx("h3", { className: "text-sm font-semibold mb-2", children: mailboxUid }), page.results.length === 0 ? (_jsx("p", { className: "text-xs text-text-muted", children: "No matches." })) : (_jsx("ul", { className: "flex flex-col gap-1", children: page.results.map((result) => (_jsxs("li", { className: "text-sm py-1 px-2 bg-surface-alt rounded-sm", children: [result.entityType, " \u00B7 ", result.entityUid, result.snippet && _jsxs("span", { className: "text-text-muted", children: [" \u2014 ", result.snippet] })] }, `${result.entityType}-${result.entityUid}`))) }))] }, mailboxUid))) })))] }), _jsxs(Modal, { open: confirmingClose, onClose: closeCloseModal, title: "Close matter", children: [_jsxs("p", { className: "text-sm mb-3", children: ["Close ", _jsx("strong", { children: matter.name }), "? Once closed, no new access requests, exports, searches, or key material reads are allowed under it. This cannot be reopened here."] }), _jsxs("dl", { className: "grid grid-cols-[auto_1fr] gap-x-4 gap-y-1 text-sm mb-4", children: [_jsx("dt", { className: "text-text-muted", children: "Custodians" }), _jsx("dd", { className: "break-all", children: matter.custodianMailboxUids.join(", ") }), _jsx("dt", { className: "text-text-muted", children: "Date range" }), _jsx("dd", { children: formatDateRange(matter) })] }), closeError && _jsx(Alert, { children: closeError }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: closing, onClick: closeCloseModal, children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", loading: closing, disabled: closing, onClick: handleClose, children: "Close matter" })] })] }), _jsxs(Modal, { open: approveTarget !== null, onClose: () => setApproveTarget(null), title: "Approve access request", children: [_jsx("p", { className: "text-sm mb-3", children: "Approving lets holders of this matter\u2019s escrow scope read the key material for this mailbox once enough holders have approved." }), _jsxs("dl", { className: "grid grid-cols-[auto_1fr] gap-x-4 gap-y-1 text-sm mb-4", children: [_jsx("dt", { className: "text-text-muted", children: "Matter" }), _jsx("dd", { children: matter.name }), _jsx("dt", { className: "text-text-muted", children: "Mailbox" }), _jsx("dd", { className: "break-all", children: approveTarget?.mailboxUid }), _jsx("dt", { className: "text-text-muted", children: "Date range" }), _jsx("dd", { children: formatDateRange(matter) }), _jsx("dt", { className: "text-text-muted", children: "Approvals" }), _jsxs("dd", { children: [approveTarget?.approvals.length, " of ", approveTarget?.requiredHoldersAtCreation, " so far, including requester ", approveTarget?.requestedByUserUid] })] }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setApproveTarget(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto", onClick: () => void handleApprove(), children: "Approve request" })] })] }), _jsx(Modal, { open: showNewRequest, onClose: () => setShowNewRequest(false), title: "New access request", children: _jsxs("form", { onSubmit: handleCreateRequest, className: "flex flex-col gap-4", children: [newRequestError && _jsx(Alert, { children: newRequestError }), _jsx(FormField, { label: "Mailbox uid", htmlFor: "newRequestMailboxUid", children: _jsx("input", { id: "newRequestMailboxUid", type: "text", className: INPUT_CLASS, value: newRequestMailboxUid, onChange: (e) => setNewRequestMailboxUid(e.target.value) }) }), _jsx("p", { className: "text-xs text-text-muted", children: "Must be one of this matter's own custodian mailboxes, currently assigned to this matter's escrow scope. Your own creation counts as the first approval." }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: creatingRequest, onClick: () => setShowNewRequest(false), children: "Cancel" }), _jsx(Button, { type: "submit", className: "!w-auto", loading: creatingRequest, disabled: creatingRequest, children: "Create request" })] })] }) }), _jsx(Modal, { open: materialFor !== null, onClose: closeMaterialModal, title: "Escrow key material", children: loadingMaterial ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : materialError ? (_jsx(Alert, { children: materialError })) : (_jsxs(_Fragment, { children: [_jsxs("p", { className: "text-sm text-text-muted mb-3", children: ["Still-encrypted master key wraps for ", _jsx("strong", { children: materialFor?.mailboxUid }), " \u2014 this server cannot decrypt these either. Copy the JSON below into your own offline tooling."] }), _jsx("pre", { className: "text-xs font-mono bg-surface-alt border border-border rounded-sm p-3 overflow-x-auto whitespace-pre-wrap break-all", children: materialText })] })) })] }));
 }

package/dist/apps/shared/components/admin/escrowScopes/EscrowScopeKeyAndHoldersFields.js

@@ -18,9 +18,18 @@ export function emptyEscrowScopeKeyAndHoldersValue() {
         notifySubjectOnAccess: false,
     };
 }
-export default function EscrowScopeKeyAndHoldersFields({ value, onChange, disabled }) {
+/** The message shown when an administrator tries to make themselves a holder: whoever configures a scope must not
+ * also be able to approve access under it (separation of duties - the server refuses it too). Holders who were
+ * already on the scope (`existingHolderUserUids`) aren't treated as newly added. */
+export function selfAsHolderError(holderUserUids, adminUid, existingHolderUserUids = []) {
+    if (!adminUid || !holderUserUids.includes(adminUid) || existingHolderUserUids.includes(adminUid)) {
+        return null;
+    }
+    return "You can't add yourself as a holder of an escrow scope you configure. Ask another administrator to add you, or choose different holders.";
+}
+export default function EscrowScopeKeyAndHoldersFields({ value, onChange, disabled, keyReadOnly }) {
     function set(key, next) {
         onChange({ ...value, [key]: next });
     }
-    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-1", children: "Public key" }), _jsx("p", { className: "text-sm text-text-muted mb-4", children: "The fields of an already-issued certificate \u2014 this server never generates or holds the corresponding private key." }), _jsx(FormField, { label: "Public key (base64)", htmlFor: "publicKey", children: _jsx("textarea", { id: "publicKey", className: `${INPUT_CLASS} font-mono text-xs`, rows: 4, value: value.publicKey, disabled: disabled, onChange: (e) => set("publicKey", e.target.value) }) }), _jsx(FormField, { label: "Key type", htmlFor: "keyType", children: _jsx("input", { id: "keyType", type: "text", className: INPUT_CLASS, value: value.keyType, disabled: disabled, onChange: (e) => set("keyType", e.target.value), placeholder: "x509" }) }), _jsx(FormField, { label: "Fingerprint (hex SHA-256)", htmlFor: "fingerprint", children: _jsx("input", { id: "fingerprint", type: "text", className: `${INPUT_CLASS} font-mono`, value: value.fingerprint, disabled: disabled, onChange: (e) => set("fingerprint", e.target.value) }) }), _jsxs("div", { className: "grid grid-cols-1 sm:grid-cols-2 gap-x-4", children: [_jsx(FormField, { label: "Not before", htmlFor: "notBefore", children: _jsx("input", { id: "notBefore", type: "datetime-local", className: INPUT_CLASS, value: value.notBefore, disabled: disabled, onChange: (e) => set("notBefore", e.target.value) }) }), _jsx(FormField, { label: "Not after", htmlFor: "notAfter", children: _jsx("input", { id: "notAfter", type: "datetime-local", className: INPUT_CLASS, value: value.notAfter, disabled: disabled, onChange: (e) => set("notAfter", e.target.value) }) })] })] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-1", children: "Holders & dual control" }), _jsx("p", { className: "text-sm text-text-muted mb-4", children: "Every uid below is granted the eDiscovery/compliance holder role for this scope \u2014 a deliberately separate role from server administration. At least one holder is required." }), _jsx(StringListField, { label: "Holder user uids", id: "holderUserUids", values: value.holderUserUids, onChange: (holderUserUids) => set("holderUserUids", holderUserUids), placeholder: "User uid to add", emptyMessage: "No holders added yet.", disabled: disabled }), _jsx(FormField, { label: "Required holders (M-of-N dual control)", htmlFor: "requiredHolders", children: _jsx("input", { id: "requiredHolders", type: "number", className: INPUT_CLASS, value: value.requiredHolders, disabled: disabled, onChange: (e) => set("requiredHolders", Number(e.target.value) || 1) }) }), _jsxs("label", { className: "flex items-center gap-2 text-sm", children: [_jsx("input", { type: "checkbox", checked: value.notifySubjectOnAccess, disabled: disabled, onChange: (e) => set("notifySubjectOnAccess", e.target.checked) }), "Notify subject on access"] })] })] }));
+    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-1", children: "Public key" }), _jsx("p", { className: "text-sm text-text-muted mb-4", children: "The fields of an already-issued certificate \u2014 this server never generates or holds the corresponding private key." }), _jsx(FormField, { label: "Public key (base64)", htmlFor: "publicKey", children: _jsx("textarea", { id: "publicKey", className: `${INPUT_CLASS} font-mono text-xs`, rows: 4, value: value.publicKey, disabled: disabled, readOnly: keyReadOnly, onChange: (e) => set("publicKey", e.target.value) }) }), _jsx(FormField, { label: "Key type", htmlFor: "keyType", children: _jsx("input", { id: "keyType", type: "text", className: INPUT_CLASS, value: value.keyType, disabled: disabled, readOnly: keyReadOnly, onChange: (e) => set("keyType", e.target.value), placeholder: "x509" }) }), _jsx(FormField, { label: "Fingerprint (hex SHA-256)", htmlFor: "fingerprint", children: _jsx("input", { id: "fingerprint", type: "text", className: `${INPUT_CLASS} font-mono`, value: value.fingerprint, disabled: disabled, readOnly: keyReadOnly, onChange: (e) => set("fingerprint", e.target.value) }) }), _jsxs("div", { className: "grid grid-cols-1 sm:grid-cols-2 gap-x-4", children: [_jsx(FormField, { label: "Not before", htmlFor: "notBefore", children: _jsx("input", { id: "notBefore", type: "datetime-local", className: INPUT_CLASS, value: value.notBefore, disabled: disabled, readOnly: keyReadOnly, onChange: (e) => set("notBefore", e.target.value) }) }), _jsx(FormField, { label: "Not after", htmlFor: "notAfter", children: _jsx("input", { id: "notAfter", type: "datetime-local", className: INPUT_CLASS, value: value.notAfter, disabled: disabled, readOnly: keyReadOnly, onChange: (e) => set("notAfter", e.target.value) }) })] })] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-1", children: "Holders & dual control" }), _jsx("p", { className: "text-sm text-text-muted mb-4", children: "Every uid below is granted the eDiscovery/compliance holder role for this scope \u2014 a deliberately separate role from server administration. At least one holder is required." }), _jsx(StringListField, { label: "Holder user uids", id: "holderUserUids", values: value.holderUserUids, onChange: (holderUserUids) => set("holderUserUids", holderUserUids), placeholder: "User uid to add", emptyMessage: "No holders added yet.", disabled: disabled }), _jsx(FormField, { label: "Required holders (M-of-N dual control)", htmlFor: "requiredHolders", children: _jsx("input", { id: "requiredHolders", type: "number", className: INPUT_CLASS, value: value.requiredHolders, disabled: disabled, onChange: (e) => set("requiredHolders", Number(e.target.value) || 1) }) }), _jsxs("label", { className: "flex items-center gap-2 text-sm", children: [_jsx("input", { type: "checkbox", checked: value.notifySubjectOnAccess, disabled: disabled, onChange: (e) => set("notifySubjectOnAccess", e.target.checked) }), "Notify subject on access"] })] })] }));
 }

package/dist/apps/shared/components/admin/layout/AdminShell.js

@@ -14,6 +14,7 @@ import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
 import BottomTabBar from "@rapidmx/react-shared/components/navigation/BottomTabBar.js";
 import { BrandingFooter, BrandingHeader } from "../../layout/BrandingChrome.js";
 import UserMenu from "../../layout/UserMenu.js";
+import { signOutOfConsole } from "../signOut.js";
 /** Sections shown in the persistent icon rail / mobile tab bar — every admin area reachable from
  * anywhere in the console. Deliberately excludes `quarantine`/`ingestQueue`: those are scoped to a
  * single mailbox and only ever reached via links on that mailbox's own detail page (see
@@ -118,7 +119,8 @@ export default function AdminShell({ active, userUid, authServerUrl, children })
         });
     }, [userUid]);
     function handleSignOut() {
-        window.location.href = authServerUrl ?? "/";
+        // Ends the auth-server session and tells other tabs, not just navigates - see `signOutOfConsole()`.
+        void signOutOfConsole(authServerUrl);
     }
     let content;
     if (!userUid || status === "checking") {

package/dist/apps/shared/components/admin/mailboxes/EscrowScopeCard.js

@@ -0,0 +1,72 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useEffect, useState } from "react";
+import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
+import { listEscrowScopes } from "@rapidmx/react-shared/admin/escrowScopesApi.js";
+import { updateMailbox } from "@rapidmx/react-shared/mail/mailApi.js";
+import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
+import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+import Modal from "@rapidmx/react-shared/components/overlays/Modal.js";
+const SELECT_CLASS = "text-sm py-2 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
+/** Enough for any realistic deployment's scopes in one list. */
+const SCOPE_LIST_LIMIT = 200;
+/**
+ * Assigns a mailbox to an escrow scope (or none), which decides whose holders can recover its encrypted mail. Only
+ * shown in the admin console, whose trusted-role gate the server enforces again for `escrowScopeId`.
+ */
+export default function EscrowScopeCard({ mailbox, onUpdate }) {
+    const [scopes, setScopes] = useState(null);
+    const [loadError, setLoadError] = useState(null);
+    const [escrowScopeId, setEscrowScopeId] = useState(mailbox.escrowScopeId ?? "");
+    const [saving, setSaving] = useState(false);
+    const [saveError, setSaveError] = useState(null);
+    const [saved, setSaved] = useState(false);
+    const [confirming, setConfirming] = useState(false);
+    useEffect(() => {
+        listEscrowScopes({ limit: SCOPE_LIST_LIMIT })
+            .then(setScopes)
+            .catch((err) => setLoadError(err instanceof ApiRequestError ? err.message : "Could not load escrow scopes."));
+    }, []);
+    // Changing the scope changes who can recover this mailbox's encrypted mail, so it's confirmed first.
+    function handleSubmit(e) {
+        e.preventDefault();
+        setConfirming(true);
+    }
+    async function save() {
+        setConfirming(false);
+        setSaveError(null);
+        setSaved(false);
+        setSaving(true);
+        try {
+            const updated = await updateMailbox({ uid: mailbox.uid, version: mailbox.version, escrowScopeId: escrowScopeId || null });
+            onUpdate(updated);
+            setSaved(true);
+        }
+        catch (err) {
+            setSaveError(err instanceof ApiRequestError ? err.message : "Could not save the escrow scope.");
+        }
+        finally {
+            setSaving(false);
+        }
+    }
+    const current = mailbox.escrowScopeId ?? "";
+    const unknownCurrent = !!current && !!scopes && !scopes.some((scope) => scope.uid === current);
+    return (_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-1", children: "Escrow scope" }), _jsx("p", { className: "text-sm text-text-muted mb-4", children: "The holders of this scope can jointly recover this mailbox\u2019s encrypted mail, for example for legal discovery. With no scope, nobody can." }), loadError && _jsx(Alert, { children: loadError }), saveError && _jsx(Alert, { children: saveError }), saved && !saveError && _jsx("div", { className: "mb-4 text-sm text-success font-medium", children: "Saved." }), scopes && (_jsxs("form", { onSubmit: handleSubmit, className: "flex items-end gap-3 flex-wrap", children: [_jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Scope" }), _jsxs("select", { "aria-label": "Escrow scope", className: SELECT_CLASS, value: escrowScopeId, onChange: (e) => {
+                                    setEscrowScopeId(e.target.value);
+                                    setSaved(false);
+                                }, children: [_jsx("option", { value: "", children: "No escrow" }), unknownCurrent && _jsxs("option", { value: current, children: ["Unknown scope (", current, ")"] }), scopes.map((scope) => (_jsx("option", { value: scope.uid, children: scope.name }, scope.uid)))] })] }), _jsx(Button, { type: "submit", className: "!w-auto", loading: saving, disabled: saving || escrowScopeId === current, children: "Save escrow scope" })] })), _jsxs(Modal, { open: confirming, onClose: () => setConfirming(false), title: "Change escrow scope", children: [_jsxs("p", { className: "text-sm mb-3", children: ["This changes who can jointly recover ", _jsx("strong", { className: "break-all", children: mailbox.primarySmtpAddress }), "\u2019s encrypted mail."] }), _jsxs("dl", { className: "grid grid-cols-[auto_1fr] gap-x-4 gap-y-1 text-sm mb-4", children: [_jsx("dt", { className: "text-text-muted", children: "From" }), _jsx("dd", { className: "break-all", children: _jsx(ScopeSummary, { uid: current, scopes: scopes ?? [] }) }), _jsx("dt", { className: "text-text-muted", children: "To" }), _jsx("dd", { className: "break-all", children: _jsx(ScopeSummary, { uid: escrowScopeId, scopes: scopes ?? [] }) })] }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setConfirming(false), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto", onClick: () => void save(), children: "Confirm and save" })] })] })] }));
+}
+/** A scope's name, holders and required approvals - or what having no (or an unlisted) scope means. */
+function ScopeSummary({ uid, scopes }) {
+    if (!uid) {
+        return _jsx("span", { children: "No escrow - nobody can recover this mailbox\u2019s encrypted mail" });
+    }
+    const scope = scopes.find((candidate) => candidate.uid === uid);
+    if (!scope) {
+        return _jsxs("span", { children: ["Unknown scope (", uid, ")"] });
+    }
+    return (_jsxs("span", { children: [_jsx("strong", { children: scope.name }), " - holders ", scope.holderUserUids.join(", "), "; ", scope.requiredHolders, " of", " ", scope.holderUserUids.length, " must approve"] }));
+}

package/dist/apps/shared/components/admin/mailboxes/ResourceSettingsCard.js

@@ -39,11 +39,11 @@ export default function ResourceSettingsCard({ mailbox, onUpdate }) {
                 uid: mailbox.uid,
                 version: mailbox.version,
                 resourceType,
-                resourceCapacity: resourceCapacity ? Number(resourceCapacity) : undefined,
+                resourceCapacity: resourceCapacity ? Number(resourceCapacity) : null,
                 autoAcceptBookings,
                 allowConflicts,
-                bookingWindowDays: bookingWindowDays ? Number(bookingWindowDays) : undefined,
-                maxDurationMinutes: maxDurationMinutes ? Number(maxDurationMinutes) : undefined,
+                bookingWindowDays: bookingWindowDays ? Number(bookingWindowDays) : null,
+                maxDurationMinutes: maxDurationMinutes ? Number(maxDurationMinutes) : null,
             });
             onUpdate(updated);
             setSaved(true);

package/dist/apps/shared/components/admin/mailboxes/ShareAccessCard.js

@@ -8,18 +8,21 @@ import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
 import { getMailboxAcl, grantMailboxAccess, revokeMailboxAccess } from "@rapidmx/react-shared/mail/mailApi.js";
 import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
 import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+import Modal from "@rapidmx/react-shared/components/overlays/Modal.js";
 const DEFAULT_DELEGATE_ACTIONS = ["read", "list", "count", "exists"];
 /**
  * Lets an admin (or, eventually, the mailbox owner) view and edit a mailbox's delegate access — the
  * mechanism behind Exchange-style shared mailboxes. `records` on a mailbox's own ACL doubles as both the
  * owner's grant (if any) and every delegate's — see `BaseMailboxRoute`'s doc comment in `@rapidmx/restapi`.
  */
-export default function ShareAccessCard({ mailboxUid }) {
+export default function ShareAccessCard({ mailboxUid, ownerUserUid }) {
     const [acl, setAcl] = useState(null);
     const [loading, setLoading] = useState(true);
     const [error, setError] = useState(null);
+    const [notice, setNotice] = useState(null);
     const [newUserUid, setNewUserUid] = useState("");
     const [saving, setSaving] = useState(false);
+    const [revokeTarget, setRevokeTarget] = useState(null);
     function reload() {
         setLoading(true);
         setError(null);
@@ -37,8 +40,19 @@ export default function ShareAccessCard({ mailboxUid }) {
         }
         setSaving(true);
         setError(null);
+        setNotice(null);
         try {
-            await grantMailboxAccess(mailboxUid, userUid, DEFAULT_DELEGATE_ACTIONS);
+            // `grantMailboxAccess()` replaces any existing record for this uid, so granting read access to someone
+            // who already has more (e.g. the owner) would silently downgrade them. Merge with their current actions.
+            const current = await getMailboxAcl(mailboxUid);
+            const existing = current.records.find((record) => record.userOrRoleId === userUid)?.actions ?? [];
+            const missing = DEFAULT_DELEGATE_ACTIONS.filter((action) => !existing.includes(action));
+            if (missing.length === 0) {
+                setNotice(`${userUid} already has this access.`);
+                setNewUserUid("");
+                return;
+            }
+            await grantMailboxAccess(mailboxUid, userUid, [...existing, ...missing]);
             setNewUserUid("");
             reload();
         }
@@ -49,9 +63,13 @@ export default function ShareAccessCard({ mailboxUid }) {
             setSaving(false);
         }
     }
-    async function handleRevoke(userOrRoleId) {
+    // Only ever invoked from the revoke-confirmation modal below, which only renders once `revokeTarget` is set.
+    async function handleRevoke() {
+        const userOrRoleId = revokeTarget;
+        setRevokeTarget(null);
         setSaving(true);
         setError(null);
+        setNotice(null);
         try {
             await revokeMailboxAccess(mailboxUid, userOrRoleId);
             reload();
@@ -63,5 +81,5 @@ export default function ShareAccessCard({ mailboxUid }) {
             setSaving(false);
         }
     }
-    return (_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-1", children: "Shared access" }), _jsx("p", { className: "text-sm text-text-muted mb-4", children: "Grants read access to this mailbox for another user, independent of ownership." }), error && _jsx(Alert, { children: error }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : (_jsxs("ul", { className: "flex flex-col gap-2 mb-4", children: [(acl?.records ?? []).length === 0 && (_jsx("li", { className: "text-sm text-text-muted", children: "No grants on this mailbox yet." })), acl?.records.map((record) => (_jsxs("li", { className: "flex items-center justify-between gap-3 py-2 px-3 border border-border rounded-sm", children: [_jsxs("div", { children: [_jsx("div", { className: "text-sm font-medium", children: record.userOrRoleId }), _jsx("div", { className: "text-xs text-text-muted", children: record.actions.join(", ") })] }), _jsx("button", { type: "button", onClick: () => handleRevoke(record.userOrRoleId), disabled: saving, className: "text-sm text-danger hover:underline disabled:opacity-55", children: "Revoke" })] }, record.userOrRoleId)))] })), _jsxs("form", { onSubmit: handleGrant, className: "flex gap-2", children: [_jsx("input", { type: "text", value: newUserUid, onChange: (e) => setNewUserUid(e.target.value), placeholder: "User uid to grant access to", className: "flex-1 text-sm py-2 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary" }), _jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Grant" })] })] }));
+    return (_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-1", children: "Shared access" }), _jsx("p", { className: "text-sm text-text-muted mb-4", children: "Grants read access to this mailbox for another user, independent of ownership." }), error && _jsx(Alert, { children: error }), notice && !error && _jsx("div", { className: "mb-4 text-sm text-text-muted", children: notice }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : (_jsxs("ul", { className: "flex flex-col gap-2 mb-4", children: [(acl?.records ?? []).length === 0 && (_jsx("li", { className: "text-sm text-text-muted", children: "No grants on this mailbox yet." })), acl?.records.map((record) => (_jsxs("li", { className: "flex items-center justify-between gap-3 py-2 px-3 border border-border rounded-sm", children: [_jsxs("div", { children: [_jsx("div", { className: "text-sm font-medium", children: record.userOrRoleId }), _jsx("div", { className: "text-xs text-text-muted", children: record.actions.join(", ") })] }), record.userOrRoleId === ownerUserUid ? (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide text-text-muted", children: "Owner" })) : (_jsx("button", { type: "button", onClick: () => setRevokeTarget(record.userOrRoleId), disabled: saving, className: "text-sm text-danger hover:underline disabled:opacity-55", children: "Revoke" }))] }, record.userOrRoleId)))] })), _jsxs("form", { onSubmit: handleGrant, className: "flex gap-2", children: [_jsx("input", { type: "text", value: newUserUid, onChange: (e) => setNewUserUid(e.target.value), placeholder: "User uid to grant access to", className: "flex-1 text-sm py-2 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary" }), _jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Grant" })] }), _jsxs(Modal, { open: revokeTarget !== null, onClose: () => setRevokeTarget(null), title: "Revoke access", children: [_jsxs("p", { className: "text-sm mb-5", children: ["Revoke ", _jsx("strong", { className: "break-all", children: revokeTarget }), "\u2019s access to this mailbox? They lose it immediately."] }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setRevokeTarget(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", onClick: () => void handleRevoke(), children: "Revoke" })] })] })] }));
 }

package/dist/apps/shared/components/admin/settings/BrandingForm.js

@@ -10,6 +10,11 @@ import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
 import Button from "@rapidmx/react-shared/components/buttons/Button.js";
 const INPUT_CLASS = "w-full text-sm py-2 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
 const MAX_UPLOAD_BYTES = 5 * 1024 * 1024;
+/** SVG logo/icon uploads are refused (the server refuses them too): an SVG served from this origin can carry script. */
+export function isSvgFile(file) {
+    return file.type === "image/svg+xml" || file.name.toLowerCase().endsWith(".svg");
+}
+const RASTER_IMAGE_ACCEPT = "image/png,image/jpeg,image/gif,image/webp,image/x-icon,image/vnd.microsoft.icon";
 /** The branding editor, shared by the Branding page and the setup wizard. */
 export default function BrandingForm({ branding, onChange }) {
     const [companyName, setCompanyName] = useState(branding.companyName);
@@ -43,7 +48,10 @@ export default function BrandingForm({ branding, onChange }) {
         const file = e.target.files?.[0];
         if (!file)
             return;
-        if (file.size > MAX_UPLOAD_BYTES) {
+        if (isSvgFile(file)) {
+            setError(`"${file.name}" is an SVG — upload a PNG, JPEG, GIF, or WebP logo instead.`);
+        }
+        else if (file.size > MAX_UPLOAD_BYTES) {
             setError(`"${file.name}" is too large — logos must be 5MB or smaller.`);
         }
         else {
@@ -55,7 +63,10 @@ export default function BrandingForm({ branding, onChange }) {
         const file = e.target.files?.[0];
         if (!file)
             return;
-        if (file.size > MAX_UPLOAD_BYTES) {
+        if (isSvgFile(file)) {
+            setError(`"${file.name}" is an SVG — upload a PNG, JPEG, GIF, WebP, or ICO icon instead.`);
+        }
+        else if (file.size > MAX_UPLOAD_BYTES) {
             setError(`"${file.name}" is too large — icons must be 5MB or smaller.`);
         }
         else {
@@ -92,10 +103,10 @@ export default function BrandingForm({ branding, onChange }) {
             setSaving(false);
         }
     }
-    return (_jsxs("div", { className: "max-w-2xl", children: [_jsx("h1", { className: "text-xl font-bold uppercase tracking-wide mb-1", children: "Branding" }), _jsx("p", { className: "text-sm text-text-muted mb-5", children: "Customize the logo, nav-header icon, product name, and chrome shown to every visitor of the webmail and admin console \u2014 including anonymous booking-page visitors." }), error && _jsx(Alert, { children: error }), saved && !error && _jsx("div", { className: "mb-4 text-sm text-success font-medium", children: "Saved." }), _jsxs("div", { className: "flex flex-col gap-6", children: [_jsxs("section", { className: "flex flex-col gap-3", children: [_jsx("h2", { className: "text-sm font-bold uppercase tracking-wide text-text-muted", children: "Logo" }), _jsxs("div", { className: "flex items-center gap-4", children: [_jsx("img", { src: branding.logoUrl || "/images/logo.svg", alt: "Current logo", width: "64", height: "64", className: "border border-border rounded-sm bg-surface-alt p-1" }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: assetBusy === "logo-upload", disabled: assetBusy !== null, onClick: () => logoFileRef.current?.click(), children: "Upload logo" }), _jsx("input", { ref: logoFileRef, type: "file", accept: "image/*", "aria-label": "Upload logo", className: "hidden", onChange: handleLogoFileChange }), branding.logoUrl && (_jsx(Button, { type: "button", variant: "text", disabled: assetBusy !== null, loading: assetBusy === "logo-delete", onClick: () => void runAsset("logo-delete", async () => {
+    return (_jsxs("div", { className: "max-w-2xl", children: [_jsx("h1", { className: "text-xl font-bold uppercase tracking-wide mb-1", children: "Branding" }), _jsx("p", { className: "text-sm text-text-muted mb-5", children: "Customize the logo, nav-header icon, product name, and chrome shown to every visitor of the webmail and admin console \u2014 including anonymous booking-page visitors." }), error && _jsx(Alert, { children: error }), saved && !error && _jsx("div", { className: "mb-4 text-sm text-success font-medium", children: "Saved." }), _jsxs("div", { className: "flex flex-col gap-6", children: [_jsxs("section", { className: "flex flex-col gap-3", children: [_jsx("h2", { className: "text-sm font-bold uppercase tracking-wide text-text-muted", children: "Logo" }), _jsxs("div", { className: "flex items-center gap-4", children: [_jsx("img", { src: branding.logoUrl || "/images/logo.svg", alt: "Current logo", width: "64", height: "64", className: "border border-border rounded-sm bg-surface-alt p-1" }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: assetBusy === "logo-upload", disabled: assetBusy !== null, onClick: () => logoFileRef.current?.click(), children: "Upload logo" }), _jsx("input", { ref: logoFileRef, type: "file", accept: RASTER_IMAGE_ACCEPT, "aria-label": "Upload logo", className: "hidden", onChange: handleLogoFileChange }), branding.logoUrl && (_jsx(Button, { type: "button", variant: "text", disabled: assetBusy !== null, loading: assetBusy === "logo-delete", onClick: () => void runAsset("logo-delete", async () => {
                                                     await deleteBrandingLogo();
                                                     return { ...branding, logoUrl: undefined };
-                                                }), children: "Remove logo" }))] })] }), _jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Or use an external image URL" }), _jsxs("div", { className: "flex gap-2", children: [_jsx("input", { "aria-label": "Logo URL", className: INPUT_CLASS, value: logoUrlInput, onChange: (e) => setLogoUrlInput(e.target.value) }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: assetBusy !== null || logoUrlInput === (branding.logoUrl ?? ""), loading: assetBusy === "logo-url", onClick: () => void runAsset("logo-url", () => updateBranding({ logoUrl: logoUrlInput })), children: "Set" })] })] })] }), _jsxs("section", { className: "flex flex-col gap-3", children: [_jsx("h2", { className: "text-sm font-bold uppercase tracking-wide text-text-muted", children: "Icon" }), _jsx("p", { className: "text-xs text-text-muted -mt-1", children: "A compact mark for navigation headers, independent of the full logo above. Falls back to the logo, then a default asset, when not set." }), _jsxs("div", { className: "flex items-center gap-4", children: [_jsx("img", { src: branding.iconUrl || branding.logoUrl || "/images/logo.svg", alt: "Current icon", width: "64", height: "64", className: "border border-border rounded-sm bg-surface-alt p-1" }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: assetBusy === "icon-upload", disabled: assetBusy !== null, onClick: () => iconFileRef.current?.click(), children: "Upload icon" }), _jsx("input", { ref: iconFileRef, type: "file", accept: "image/*", "aria-label": "Upload icon", className: "hidden", onChange: handleIconFileChange }), branding.iconUrl && (_jsx(Button, { type: "button", variant: "text", disabled: assetBusy !== null, loading: assetBusy === "icon-delete", onClick: () => void runAsset("icon-delete", async () => {
+                                                }), children: "Remove logo" }))] })] }), _jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Or use an external image URL" }), _jsxs("div", { className: "flex gap-2", children: [_jsx("input", { "aria-label": "Logo URL", className: INPUT_CLASS, value: logoUrlInput, onChange: (e) => setLogoUrlInput(e.target.value) }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: assetBusy !== null || logoUrlInput === (branding.logoUrl ?? ""), loading: assetBusy === "logo-url", onClick: () => void runAsset("logo-url", () => updateBranding({ logoUrl: logoUrlInput })), children: "Set" })] })] })] }), _jsxs("section", { className: "flex flex-col gap-3", children: [_jsx("h2", { className: "text-sm font-bold uppercase tracking-wide text-text-muted", children: "Icon" }), _jsx("p", { className: "text-xs text-text-muted -mt-1", children: "A compact mark for navigation headers, independent of the full logo above. Falls back to the logo, then a default asset, when not set." }), _jsxs("div", { className: "flex items-center gap-4", children: [_jsx("img", { src: branding.iconUrl || branding.logoUrl || "/images/logo.svg", alt: "Current icon", width: "64", height: "64", className: "border border-border rounded-sm bg-surface-alt p-1" }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: assetBusy === "icon-upload", disabled: assetBusy !== null, onClick: () => iconFileRef.current?.click(), children: "Upload icon" }), _jsx("input", { ref: iconFileRef, type: "file", accept: RASTER_IMAGE_ACCEPT, "aria-label": "Upload icon", className: "hidden", onChange: handleIconFileChange }), branding.iconUrl && (_jsx(Button, { type: "button", variant: "text", disabled: assetBusy !== null, loading: assetBusy === "icon-delete", onClick: () => void runAsset("icon-delete", async () => {
                                                     await deleteBrandingIcon();
                                                     return { ...branding, iconUrl: undefined };
                                                 }), children: "Remove icon" }))] })] }), _jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Or use an external image URL" }), _jsxs("div", { className: "flex gap-2", children: [_jsx("input", { "aria-label": "Icon URL", className: INPUT_CLASS, value: iconUrlInput, onChange: (e) => setIconUrlInput(e.target.value) }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: assetBusy !== null || iconUrlInput === (branding.iconUrl ?? ""), loading: assetBusy === "icon-url", onClick: () => void runAsset("icon-url", () => updateBranding({ iconUrl: iconUrlInput })), children: "Set" })] })] })] }), _jsxs("section", { className: "flex flex-col gap-3", children: [_jsx("h2", { className: "text-sm font-bold uppercase tracking-wide text-text-muted", children: "Custom stylesheet" }), _jsx("div", { className: "flex items-center gap-3", children: _jsx("span", { className: "text-sm text-text-muted truncate", children: branding.stylesheetUrl || "None configured" }) }), _jsxs("div", { className: "flex gap-2", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: assetBusy === "stylesheet-upload", disabled: assetBusy !== null, onClick: () => stylesheetFileRef.current?.click(), children: "Upload CSS file" }), _jsx("input", { ref: stylesheetFileRef, type: "file", accept: "text/css,.css", "aria-label": "Upload stylesheet", className: "hidden", onChange: handleStylesheetFileChange }), branding.stylesheetUrl && (_jsx(Button, { type: "button", variant: "text", disabled: assetBusy !== null, loading: assetBusy === "stylesheet-delete", onClick: () => void runAsset("stylesheet-delete", async () => {