@rapidmx/web-client 0.4.0 → 0.6.0

package/dist/apps/shared/components/admin/mailboxes/EscrowScopeCard.js

@@ -0,0 +1,72 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useEffect, useState } from "react";
+import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
+import { listEscrowScopes } from "@rapidmx/react-shared/admin/escrowScopesApi.js";
+import { updateMailbox } from "@rapidmx/react-shared/mail/mailApi.js";
+import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
+import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+import Modal from "@rapidmx/react-shared/components/overlays/Modal.js";
+const SELECT_CLASS = "text-sm py-2 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
+/** Enough for any realistic deployment's scopes in one list. */
+const SCOPE_LIST_LIMIT = 200;
+/**
+ * Assigns a mailbox to an escrow scope (or none), which decides whose holders can recover its encrypted mail. Only
+ * shown in the admin console, whose trusted-role gate the server enforces again for `escrowScopeId`.
+ */
+export default function EscrowScopeCard({ mailbox, onUpdate }) {
+    const [scopes, setScopes] = useState(null);
+    const [loadError, setLoadError] = useState(null);
+    const [escrowScopeId, setEscrowScopeId] = useState(mailbox.escrowScopeId ?? "");
+    const [saving, setSaving] = useState(false);
+    const [saveError, setSaveError] = useState(null);
+    const [saved, setSaved] = useState(false);
+    const [confirming, setConfirming] = useState(false);
+    useEffect(() => {
+        listEscrowScopes({ limit: SCOPE_LIST_LIMIT })
+            .then(setScopes)
+            .catch((err) => setLoadError(err instanceof ApiRequestError ? err.message : "Could not load escrow scopes."));
+    }, []);
+    // Changing the scope changes who can recover this mailbox's encrypted mail, so it's confirmed first.
+    function handleSubmit(e) {
+        e.preventDefault();
+        setConfirming(true);
+    }
+    async function save() {
+        setConfirming(false);
+        setSaveError(null);
+        setSaved(false);
+        setSaving(true);
+        try {
+            const updated = await updateMailbox({ uid: mailbox.uid, version: mailbox.version, escrowScopeId: escrowScopeId || null });
+            onUpdate(updated);
+            setSaved(true);
+        }
+        catch (err) {
+            setSaveError(err instanceof ApiRequestError ? err.message : "Could not save the escrow scope.");
+        }
+        finally {
+            setSaving(false);
+        }
+    }
+    const current = mailbox.escrowScopeId ?? "";
+    const unknownCurrent = !!current && !!scopes && !scopes.some((scope) => scope.uid === current);
+    return (_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-1", children: "Escrow scope" }), _jsx("p", { className: "text-sm text-text-muted mb-4", children: "The holders of this scope can jointly recover this mailbox\u2019s encrypted mail, for example for legal discovery. With no scope, nobody can." }), loadError && _jsx(Alert, { children: loadError }), saveError && _jsx(Alert, { children: saveError }), saved && !saveError && _jsx("div", { className: "mb-4 text-sm text-success font-medium", children: "Saved." }), scopes && (_jsxs("form", { onSubmit: handleSubmit, className: "flex items-end gap-3 flex-wrap", children: [_jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Scope" }), _jsxs("select", { "aria-label": "Escrow scope", className: SELECT_CLASS, value: escrowScopeId, onChange: (e) => {
+                                    setEscrowScopeId(e.target.value);
+                                    setSaved(false);
+                                }, children: [_jsx("option", { value: "", children: "No escrow" }), unknownCurrent && _jsxs("option", { value: current, children: ["Unknown scope (", current, ")"] }), scopes.map((scope) => (_jsx("option", { value: scope.uid, children: scope.name }, scope.uid)))] })] }), _jsx(Button, { type: "submit", className: "!w-auto", loading: saving, disabled: saving || escrowScopeId === current, children: "Save escrow scope" })] })), _jsxs(Modal, { open: confirming, onClose: () => setConfirming(false), title: "Change escrow scope", children: [_jsxs("p", { className: "text-sm mb-3", children: ["This changes who can jointly recover ", _jsx("strong", { className: "break-all", children: mailbox.primarySmtpAddress }), "\u2019s encrypted mail."] }), _jsxs("dl", { className: "grid grid-cols-[auto_1fr] gap-x-4 gap-y-1 text-sm mb-4", children: [_jsx("dt", { className: "text-text-muted", children: "From" }), _jsx("dd", { className: "break-all", children: _jsx(ScopeSummary, { uid: current, scopes: scopes ?? [] }) }), _jsx("dt", { className: "text-text-muted", children: "To" }), _jsx("dd", { className: "break-all", children: _jsx(ScopeSummary, { uid: escrowScopeId, scopes: scopes ?? [] }) })] }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setConfirming(false), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto", onClick: () => void save(), children: "Confirm and save" })] })] })] }));
+}
+/** A scope's name, holders and required approvals - or what having no (or an unlisted) scope means. */
+function ScopeSummary({ uid, scopes }) {
+    if (!uid) {
+        return _jsx("span", { children: "No escrow - nobody can recover this mailbox\u2019s encrypted mail" });
+    }
+    const scope = scopes.find((candidate) => candidate.uid === uid);
+    if (!scope) {
+        return _jsxs("span", { children: ["Unknown scope (", uid, ")"] });
+    }
+    return (_jsxs("span", { children: [_jsx("strong", { children: scope.name }), " - holders ", scope.holderUserUids.join(", "), "; ", scope.requiredHolders, " of", " ", scope.holderUserUids.length, " must approve"] }));
+}

package/dist/apps/shared/components/admin/mailboxes/MailboxTable.d.ts

@@ -0,0 +1,6 @@
+import React from "react";
+import { Mailbox } from "@rapidmx/react-shared/mail/mailApi.js";
+export interface MailboxTableProps {
+    mailboxes: Mailbox[];
+}
+export default function MailboxTable({ mailboxes }: MailboxTableProps): React.JSX.Element;

package/dist/apps/shared/components/admin/mailboxes/ResourceSettingsCard.d.ts

@@ -0,0 +1,19 @@
+import React from "react";
+import { Mailbox } from "@rapidmx/react-shared/mail/mailApi.js";
+export interface ResourceSettingsCardProps {
+    mailbox: Mailbox;
+    /** Called with the freshly-saved mailbox after a successful save — mirrors `MemberListCard`'s
+     * identical push-up-rather-than-reload pattern, since the caller already has everything the
+     * response would return. */
+    onUpdate: (mailbox: Mailbox) => void;
+}
+/**
+ * Lets an admin view and edit a resource mailbox's booking settings — same load/edit/PUT/reload
+ * interaction shape as `ShareAccessCard`, adapted the same way `MemberListCard` already adapted it:
+ * these seven fields live directly on the `Mailbox` the parent detail page already loaded (not a
+ * separate resource fetched by its own endpoint, unlike a mailbox's ACL), so this receives the
+ * already-loaded `mailbox` and pushes the `PUT` response back up rather than fetching independently.
+ * Only rendered by the detail page when `mailbox.isResource` is already `true` — a mailbox becomes a
+ * resource at creation time (`apps/admin/mailboxes/new`), not retroactively from here.
+ */
+export default function ResourceSettingsCard({ mailbox, onUpdate }: ResourceSettingsCardProps): React.JSX.Element;

package/dist/apps/shared/components/admin/mailboxes/ResourceSettingsCard.js

@@ -39,11 +39,11 @@ export default function ResourceSettingsCard({ mailbox, onUpdate }) {
                 uid: mailbox.uid,
                 version: mailbox.version,
                 resourceType,
-                resourceCapacity: resourceCapacity ? Number(resourceCapacity) : undefined,
+                resourceCapacity: resourceCapacity ? Number(resourceCapacity) : null,
                 autoAcceptBookings,
                 allowConflicts,
-                bookingWindowDays: bookingWindowDays ? Number(bookingWindowDays) : undefined,
-                maxDurationMinutes: maxDurationMinutes ? Number(maxDurationMinutes) : undefined,
+                bookingWindowDays: bookingWindowDays ? Number(bookingWindowDays) : null,
+                maxDurationMinutes: maxDurationMinutes ? Number(maxDurationMinutes) : null,
             });
             onUpdate(updated);
             setSaved(true);

package/dist/apps/shared/components/admin/mailboxes/ShareAccessCard.d.ts

@@ -0,0 +1,12 @@
+import React from "react";
+export interface ShareAccessCardProps {
+    mailboxUid: string;
+    /** The mailbox's owner - their own grant is shown but can't be revoked from here. */
+    ownerUserUid?: string;
+}
+/**
+ * Lets an admin (or, eventually, the mailbox owner) view and edit a mailbox's delegate access — the
+ * mechanism behind Exchange-style shared mailboxes. `records` on a mailbox's own ACL doubles as both the
+ * owner's grant (if any) and every delegate's — see `BaseMailboxRoute`'s doc comment in `@rapidmx/restapi`.
+ */
+export default function ShareAccessCard({ mailboxUid, ownerUserUid }: ShareAccessCardProps): React.JSX.Element;

package/dist/apps/shared/components/admin/mailboxes/ShareAccessCard.js

@@ -8,18 +8,21 @@ import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
 import { getMailboxAcl, grantMailboxAccess, revokeMailboxAccess } from "@rapidmx/react-shared/mail/mailApi.js";
 import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
 import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+import Modal from "@rapidmx/react-shared/components/overlays/Modal.js";
 const DEFAULT_DELEGATE_ACTIONS = ["read", "list", "count", "exists"];
 /**
  * Lets an admin (or, eventually, the mailbox owner) view and edit a mailbox's delegate access — the
  * mechanism behind Exchange-style shared mailboxes. `records` on a mailbox's own ACL doubles as both the
  * owner's grant (if any) and every delegate's — see `BaseMailboxRoute`'s doc comment in `@rapidmx/restapi`.
  */
-export default function ShareAccessCard({ mailboxUid }) {
+export default function ShareAccessCard({ mailboxUid, ownerUserUid }) {
     const [acl, setAcl] = useState(null);
     const [loading, setLoading] = useState(true);
     const [error, setError] = useState(null);
+    const [notice, setNotice] = useState(null);
     const [newUserUid, setNewUserUid] = useState("");
     const [saving, setSaving] = useState(false);
+    const [revokeTarget, setRevokeTarget] = useState(null);
     function reload() {
         setLoading(true);
         setError(null);
@@ -37,8 +40,19 @@ export default function ShareAccessCard({ mailboxUid }) {
         }
         setSaving(true);
         setError(null);
+        setNotice(null);
         try {
-            await grantMailboxAccess(mailboxUid, userUid, DEFAULT_DELEGATE_ACTIONS);
+            // `grantMailboxAccess()` replaces any existing record for this uid, so granting read access to someone
+            // who already has more (e.g. the owner) would silently downgrade them. Merge with their current actions.
+            const current = await getMailboxAcl(mailboxUid);
+            const existing = current.records.find((record) => record.userOrRoleId === userUid)?.actions ?? [];
+            const missing = DEFAULT_DELEGATE_ACTIONS.filter((action) => !existing.includes(action));
+            if (missing.length === 0) {
+                setNotice(`${userUid} already has this access.`);
+                setNewUserUid("");
+                return;
+            }
+            await grantMailboxAccess(mailboxUid, userUid, [...existing, ...missing]);
             setNewUserUid("");
             reload();
         }
@@ -49,9 +63,13 @@ export default function ShareAccessCard({ mailboxUid }) {
             setSaving(false);
         }
     }
-    async function handleRevoke(userOrRoleId) {
+    // Only ever invoked from the revoke-confirmation modal below, which only renders once `revokeTarget` is set.
+    async function handleRevoke() {
+        const userOrRoleId = revokeTarget;
+        setRevokeTarget(null);
         setSaving(true);
         setError(null);
+        setNotice(null);
         try {
             await revokeMailboxAccess(mailboxUid, userOrRoleId);
             reload();
@@ -63,5 +81,5 @@ export default function ShareAccessCard({ mailboxUid }) {
             setSaving(false);
         }
     }
-    return (_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-1", children: "Shared access" }), _jsx("p", { className: "text-sm text-text-muted mb-4", children: "Grants read access to this mailbox for another user, independent of ownership." }), error && _jsx(Alert, { children: error }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : (_jsxs("ul", { className: "flex flex-col gap-2 mb-4", children: [(acl?.records ?? []).length === 0 && (_jsx("li", { className: "text-sm text-text-muted", children: "No grants on this mailbox yet." })), acl?.records.map((record) => (_jsxs("li", { className: "flex items-center justify-between gap-3 py-2 px-3 border border-border rounded-sm", children: [_jsxs("div", { children: [_jsx("div", { className: "text-sm font-medium", children: record.userOrRoleId }), _jsx("div", { className: "text-xs text-text-muted", children: record.actions.join(", ") })] }), _jsx("button", { type: "button", onClick: () => handleRevoke(record.userOrRoleId), disabled: saving, className: "text-sm text-danger hover:underline disabled:opacity-55", children: "Revoke" })] }, record.userOrRoleId)))] })), _jsxs("form", { onSubmit: handleGrant, className: "flex gap-2", children: [_jsx("input", { type: "text", value: newUserUid, onChange: (e) => setNewUserUid(e.target.value), placeholder: "User uid to grant access to", className: "flex-1 text-sm py-2 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary" }), _jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Grant" })] })] }));
+    return (_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-1", children: "Shared access" }), _jsx("p", { className: "text-sm text-text-muted mb-4", children: "Grants read access to this mailbox for another user, independent of ownership." }), error && _jsx(Alert, { children: error }), notice && !error && _jsx("div", { className: "mb-4 text-sm text-text-muted", children: notice }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : (_jsxs("ul", { className: "flex flex-col gap-2 mb-4", children: [(acl?.records ?? []).length === 0 && (_jsx("li", { className: "text-sm text-text-muted", children: "No grants on this mailbox yet." })), acl?.records.map((record) => (_jsxs("li", { className: "flex items-center justify-between gap-3 py-2 px-3 border border-border rounded-sm", children: [_jsxs("div", { children: [_jsx("div", { className: "text-sm font-medium", children: record.userOrRoleId }), _jsx("div", { className: "text-xs text-text-muted", children: record.actions.join(", ") })] }), record.userOrRoleId === ownerUserUid ? (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide text-text-muted", children: "Owner" })) : (_jsx("button", { type: "button", onClick: () => setRevokeTarget(record.userOrRoleId), disabled: saving, className: "text-sm text-danger hover:underline disabled:opacity-55", children: "Revoke" }))] }, record.userOrRoleId)))] })), _jsxs("form", { onSubmit: handleGrant, className: "flex gap-2", children: [_jsx("input", { type: "text", value: newUserUid, onChange: (e) => setNewUserUid(e.target.value), placeholder: "User uid to grant access to", className: "flex-1 text-sm py-2 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary" }), _jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Grant" })] }), _jsxs(Modal, { open: revokeTarget !== null, onClose: () => setRevokeTarget(null), title: "Revoke access", children: [_jsxs("p", { className: "text-sm mb-5", children: ["Revoke ", _jsx("strong", { className: "break-all", children: revokeTarget }), "\u2019s access to this mailbox? They lose it immediately."] }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setRevokeTarget(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", onClick: () => void handleRevoke(), children: "Revoke" })] })] })] }));
 }

package/dist/apps/shared/components/admin/settings/BrandingForm.d.ts

@@ -0,0 +1,9 @@
+import React from "react";
+import { Branding } from "@rapidmx/react-shared/branding/brandingApi.js";
+/** SVG logo/icon uploads are refused (the server refuses them too): an SVG served from this origin can carry script. */
+export declare function isSvgFile(file: File): boolean;
+/** The branding editor, shared by the Branding page and the setup wizard. */
+export default function BrandingForm({ branding, onChange }: {
+    branding: Branding;
+    onChange: (b: Branding) => void;
+}): React.JSX.Element;

package/dist/apps/shared/components/admin/settings/BrandingForm.js

@@ -10,6 +10,11 @@ import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
 import Button from "@rapidmx/react-shared/components/buttons/Button.js";
 const INPUT_CLASS = "w-full text-sm py-2 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
 const MAX_UPLOAD_BYTES = 5 * 1024 * 1024;
+/** SVG logo/icon uploads are refused (the server refuses them too): an SVG served from this origin can carry script. */
+export function isSvgFile(file) {
+    return file.type === "image/svg+xml" || file.name.toLowerCase().endsWith(".svg");
+}
+const RASTER_IMAGE_ACCEPT = "image/png,image/jpeg,image/gif,image/webp,image/x-icon,image/vnd.microsoft.icon";
 /** The branding editor, shared by the Branding page and the setup wizard. */
 export default function BrandingForm({ branding, onChange }) {
     const [companyName, setCompanyName] = useState(branding.companyName);
@@ -43,7 +48,10 @@ export default function BrandingForm({ branding, onChange }) {
         const file = e.target.files?.[0];
         if (!file)
             return;
-        if (file.size > MAX_UPLOAD_BYTES) {
+        if (isSvgFile(file)) {
+            setError(`"${file.name}" is an SVG — upload a PNG, JPEG, GIF, or WebP logo instead.`);
+        }
+        else if (file.size > MAX_UPLOAD_BYTES) {
             setError(`"${file.name}" is too large — logos must be 5MB or smaller.`);
         }
         else {
@@ -55,7 +63,10 @@ export default function BrandingForm({ branding, onChange }) {
         const file = e.target.files?.[0];
         if (!file)
             return;
-        if (file.size > MAX_UPLOAD_BYTES) {
+        if (isSvgFile(file)) {
+            setError(`"${file.name}" is an SVG — upload a PNG, JPEG, GIF, WebP, or ICO icon instead.`);
+        }
+        else if (file.size > MAX_UPLOAD_BYTES) {
             setError(`"${file.name}" is too large — icons must be 5MB or smaller.`);
         }
         else {
@@ -92,10 +103,10 @@ export default function BrandingForm({ branding, onChange }) {
             setSaving(false);
         }
     }
-    return (_jsxs("div", { className: "max-w-2xl", children: [_jsx("h1", { className: "text-xl font-bold uppercase tracking-wide mb-1", children: "Branding" }), _jsx("p", { className: "text-sm text-text-muted mb-5", children: "Customize the logo, nav-header icon, product name, and chrome shown to every visitor of the webmail and admin console \u2014 including anonymous booking-page visitors." }), error && _jsx(Alert, { children: error }), saved && !error && _jsx("div", { className: "mb-4 text-sm text-success font-medium", children: "Saved." }), _jsxs("div", { className: "flex flex-col gap-6", children: [_jsxs("section", { className: "flex flex-col gap-3", children: [_jsx("h2", { className: "text-sm font-bold uppercase tracking-wide text-text-muted", children: "Logo" }), _jsxs("div", { className: "flex items-center gap-4", children: [_jsx("img", { src: branding.logoUrl || "/images/logo.svg", alt: "Current logo", width: "64", height: "64", className: "border border-border rounded-sm bg-surface-alt p-1" }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: assetBusy === "logo-upload", disabled: assetBusy !== null, onClick: () => logoFileRef.current?.click(), children: "Upload logo" }), _jsx("input", { ref: logoFileRef, type: "file", accept: "image/*", "aria-label": "Upload logo", className: "hidden", onChange: handleLogoFileChange }), branding.logoUrl && (_jsx(Button, { type: "button", variant: "text", disabled: assetBusy !== null, loading: assetBusy === "logo-delete", onClick: () => void runAsset("logo-delete", async () => {
+    return (_jsxs("div", { className: "max-w-2xl", children: [_jsx("h1", { className: "text-xl font-bold uppercase tracking-wide mb-1", children: "Branding" }), _jsx("p", { className: "text-sm text-text-muted mb-5", children: "Customize the logo, nav-header icon, product name, and chrome shown to every visitor of the webmail and admin console \u2014 including anonymous booking-page visitors." }), error && _jsx(Alert, { children: error }), saved && !error && _jsx("div", { className: "mb-4 text-sm text-success font-medium", children: "Saved." }), _jsxs("div", { className: "flex flex-col gap-6", children: [_jsxs("section", { className: "flex flex-col gap-3", children: [_jsx("h2", { className: "text-sm font-bold uppercase tracking-wide text-text-muted", children: "Logo" }), _jsxs("div", { className: "flex items-center gap-4", children: [_jsx("img", { src: branding.logoUrl || "/images/logo.svg", alt: "Current logo", width: "64", height: "64", className: "border border-border rounded-sm bg-surface-alt p-1" }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: assetBusy === "logo-upload", disabled: assetBusy !== null, onClick: () => logoFileRef.current?.click(), children: "Upload logo" }), _jsx("input", { ref: logoFileRef, type: "file", accept: RASTER_IMAGE_ACCEPT, "aria-label": "Upload logo", className: "hidden", onChange: handleLogoFileChange }), branding.logoUrl && (_jsx(Button, { type: "button", variant: "text", disabled: assetBusy !== null, loading: assetBusy === "logo-delete", onClick: () => void runAsset("logo-delete", async () => {
                                                     await deleteBrandingLogo();
                                                     return { ...branding, logoUrl: undefined };
-                                                }), children: "Remove logo" }))] })] }), _jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Or use an external image URL" }), _jsxs("div", { className: "flex gap-2", children: [_jsx("input", { "aria-label": "Logo URL", className: INPUT_CLASS, value: logoUrlInput, onChange: (e) => setLogoUrlInput(e.target.value) }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: assetBusy !== null || logoUrlInput === (branding.logoUrl ?? ""), loading: assetBusy === "logo-url", onClick: () => void runAsset("logo-url", () => updateBranding({ logoUrl: logoUrlInput })), children: "Set" })] })] })] }), _jsxs("section", { className: "flex flex-col gap-3", children: [_jsx("h2", { className: "text-sm font-bold uppercase tracking-wide text-text-muted", children: "Icon" }), _jsx("p", { className: "text-xs text-text-muted -mt-1", children: "A compact mark for navigation headers, independent of the full logo above. Falls back to the logo, then a default asset, when not set." }), _jsxs("div", { className: "flex items-center gap-4", children: [_jsx("img", { src: branding.iconUrl || branding.logoUrl || "/images/logo.svg", alt: "Current icon", width: "64", height: "64", className: "border border-border rounded-sm bg-surface-alt p-1" }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: assetBusy === "icon-upload", disabled: assetBusy !== null, onClick: () => iconFileRef.current?.click(), children: "Upload icon" }), _jsx("input", { ref: iconFileRef, type: "file", accept: "image/*", "aria-label": "Upload icon", className: "hidden", onChange: handleIconFileChange }), branding.iconUrl && (_jsx(Button, { type: "button", variant: "text", disabled: assetBusy !== null, loading: assetBusy === "icon-delete", onClick: () => void runAsset("icon-delete", async () => {
+                                                }), children: "Remove logo" }))] })] }), _jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Or use an external image URL" }), _jsxs("div", { className: "flex gap-2", children: [_jsx("input", { "aria-label": "Logo URL", className: INPUT_CLASS, value: logoUrlInput, onChange: (e) => setLogoUrlInput(e.target.value) }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: assetBusy !== null || logoUrlInput === (branding.logoUrl ?? ""), loading: assetBusy === "logo-url", onClick: () => void runAsset("logo-url", () => updateBranding({ logoUrl: logoUrlInput })), children: "Set" })] })] })] }), _jsxs("section", { className: "flex flex-col gap-3", children: [_jsx("h2", { className: "text-sm font-bold uppercase tracking-wide text-text-muted", children: "Icon" }), _jsx("p", { className: "text-xs text-text-muted -mt-1", children: "A compact mark for navigation headers, independent of the full logo above. Falls back to the logo, then a default asset, when not set." }), _jsxs("div", { className: "flex items-center gap-4", children: [_jsx("img", { src: branding.iconUrl || branding.logoUrl || "/images/logo.svg", alt: "Current icon", width: "64", height: "64", className: "border border-border rounded-sm bg-surface-alt p-1" }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: assetBusy === "icon-upload", disabled: assetBusy !== null, onClick: () => iconFileRef.current?.click(), children: "Upload icon" }), _jsx("input", { ref: iconFileRef, type: "file", accept: RASTER_IMAGE_ACCEPT, "aria-label": "Upload icon", className: "hidden", onChange: handleIconFileChange }), branding.iconUrl && (_jsx(Button, { type: "button", variant: "text", disabled: assetBusy !== null, loading: assetBusy === "icon-delete", onClick: () => void runAsset("icon-delete", async () => {
                                                     await deleteBrandingIcon();
                                                     return { ...branding, iconUrl: undefined };
                                                 }), children: "Remove icon" }))] })] }), _jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Or use an external image URL" }), _jsxs("div", { className: "flex gap-2", children: [_jsx("input", { "aria-label": "Icon URL", className: INPUT_CLASS, value: iconUrlInput, onChange: (e) => setIconUrlInput(e.target.value) }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: assetBusy !== null || iconUrlInput === (branding.iconUrl ?? ""), loading: assetBusy === "icon-url", onClick: () => void runAsset("icon-url", () => updateBranding({ iconUrl: iconUrlInput })), children: "Set" })] })] })] }), _jsxs("section", { className: "flex flex-col gap-3", children: [_jsx("h2", { className: "text-sm font-bold uppercase tracking-wide text-text-muted", children: "Custom stylesheet" }), _jsx("div", { className: "flex items-center gap-3", children: _jsx("span", { className: "text-sm text-text-muted truncate", children: branding.stylesheetUrl || "None configured" }) }), _jsxs("div", { className: "flex gap-2", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: assetBusy === "stylesheet-upload", disabled: assetBusy !== null, onClick: () => stylesheetFileRef.current?.click(), children: "Upload CSS file" }), _jsx("input", { ref: stylesheetFileRef, type: "file", accept: "text/css,.css", "aria-label": "Upload stylesheet", className: "hidden", onChange: handleStylesheetFileChange }), branding.stylesheetUrl && (_jsx(Button, { type: "button", variant: "text", disabled: assetBusy !== null, loading: assetBusy === "stylesheet-delete", onClick: () => void runAsset("stylesheet-delete", async () => {

package/dist/apps/shared/components/admin/settings/DomainDnsSetup.d.ts

@@ -0,0 +1,12 @@
+import React from "react";
+import { Domain } from "@rapidmx/react-shared/admin/domainsApi.js";
+export interface DomainDnsSetupProps {
+    uid: string;
+    /** Called with the domain every time it's (re)loaded - e.g. after "Verify now". */
+    onLoaded?: (domain: Domain) => void;
+}
+/**
+ * A domain's status, its ownership TXT record with "Verify now", and the DNS setup checklist - shared by the domain
+ * detail page and the setup wizard.
+ */
+export default function DomainDnsSetup({ uid, onLoaded }: DomainDnsSetupProps): React.JSX.Element;

package/dist/apps/shared/components/admin/settings/DomainDnsSetup.js

@@ -25,11 +25,12 @@ export default function DomainDnsSetup({ uid, onLoaded }) {
     const [loading, setLoading] = useState(true);
     const [error, setError] = useState(null);
     const [verifying, setVerifying] = useState(false);
+    const [verifyError, setVerifyError] = useState(null);
     const [copied, setCopied] = useState(false);
     function reload(id) {
         setLoading(true);
         setError(null);
-        Promise.all([getDomain(id), getDnsSetup(id)])
+        return Promise.all([getDomain(id), getDnsSetup(id)])
             .then(([d, checks]) => {
             setDomain(d);
             setDnsSetup(checks);
@@ -39,18 +40,23 @@ export default function DomainDnsSetup({ uid, onLoaded }) {
             .finally(() => setLoading(false));
     }
     useEffect(() => {
-        reload(uid);
+        void reload(uid);
     }, [uid]);
-    // Only ever invoked from the "Verify now" button below, which only renders once `domain` is loaded.
+    // Only ever invoked from the "Verify now" button below, which only renders once `domain` is loaded. Any failure -
+    // verifying, or refreshing afterwards - is shown next to the button with the panel kept, so it can be retried
+    // (e.g. once a DNS record has propagated) instead of the whole panel being replaced by an error.
     async function handleVerify() {
         setVerifying(true);
-        setError(null);
+        setVerifyError(null);
         try {
             await verifyDomain(domain.uid);
-            reload(domain.uid);
+            const [d, checks] = await Promise.all([getDomain(domain.uid), getDnsSetup(domain.uid)]);
+            setDomain(d);
+            setDnsSetup(checks);
+            onLoaded?.(d);
         }
         catch (err) {
-            setError(err instanceof ApiRequestError ? err.message : "Could not verify this domain.");
+            setVerifyError(err instanceof ApiRequestError ? err.message : "Could not verify this domain.");
         }
         finally {
             setVerifying(false);
@@ -73,5 +79,5 @@ export default function DomainDnsSetup({ uid, onLoaded }) {
         return _jsx(Alert, { children: error ?? "Domain not found." });
     }
     const ownershipValue = dnsSetup.find((c) => c.type === "ownership")?.recommendedValue ?? `rapidmx-domain-verification=${domain.verificationToken}`;
-    return (_jsxs("div", { className: "flex flex-col gap-5", children: [_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsxs("dl", { className: "grid grid-cols-1 sm:grid-cols-2 gap-x-6 gap-y-3 text-sm", children: [_jsx("dt", { className: "text-text-muted", children: "Enabled" }), _jsx("dd", { children: domain.enabled ? "Yes" : "No" }), _jsx("dt", { className: "text-text-muted", children: "Verification" }), _jsx("dd", { children: domain.verified ? (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-success text-white", children: "Verified" })) : (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-surface-alt text-text-muted", children: "Unverified" })) }), _jsx("dt", { className: "text-text-muted", children: "Last checked" }), _jsx("dd", { children: domain.lastCheckedAt ? new Date(domain.lastCheckedAt).toLocaleString() : "Never" })] }), !domain.verified && (_jsxs("div", { className: "mt-5 pt-5 border-t border-border", children: [_jsxs("p", { className: "text-sm mb-2", children: ["Add the following TXT record to ", _jsx("strong", { children: domain.name }), " to prove ownership, then verify:"] }), _jsxs("div", { className: "flex items-center gap-2", children: [_jsx("code", { className: "flex-1 text-xs bg-surface-alt border border-border rounded-sm py-2 px-3 overflow-x-auto whitespace-nowrap", children: ownershipValue }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto shrink-0", onClick: () => handleCopy(ownershipValue), children: copied ? "Copied" : "Copy" })] }), _jsx(Button, { type: "button", className: "!w-auto mt-3", loading: verifying, disabled: verifying, onClick: handleVerify, children: "Verify now" })] }))] }), dnsSetup.length > 0 && (_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-sm font-bold uppercase tracking-wide mb-3", children: "DNS setup checklist" }), _jsx("div", { className: "overflow-x-auto", children: _jsxs("table", { className: "w-full text-sm border-collapse", children: [_jsx("thead", { children: _jsx("tr", { children: ["Record", "Status", "Recommended value"].map((h) => (_jsx("th", { className: "text-left text-xs uppercase tracking-wide text-text-muted py-2 px-2.5 border-b border-border", children: h }, h))) }) }), _jsx("tbody", { children: dnsSetup.map((check) => (_jsxs("tr", { children: [_jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: RECORD_TYPE_LABELS[check.type] }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: !check.configured ? (_jsx("span", { className: "text-xs text-text-muted", children: "Not configured" })) : check.matches ? (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-success text-white", children: "Live" })) : (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-surface-alt text-text-muted", children: "Not found" })) }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border text-text-muted", children: _jsx("code", { className: "text-xs", children: check.recommendedValue ?? "—" }) })] }, check.type))) })] }) })] }))] }));
+    return (_jsxs("div", { className: "flex flex-col gap-5", children: [_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsxs("dl", { className: "grid grid-cols-1 sm:grid-cols-2 gap-x-6 gap-y-3 text-sm", children: [_jsx("dt", { className: "text-text-muted", children: "Enabled" }), _jsx("dd", { children: domain.enabled ? "Yes" : "No" }), _jsx("dt", { className: "text-text-muted", children: "Verification" }), _jsx("dd", { children: domain.verified ? (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-success text-white", children: "Verified" })) : (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-surface-alt text-text-muted", children: "Unverified" })) }), _jsx("dt", { className: "text-text-muted", children: "Last checked" }), _jsx("dd", { children: domain.lastCheckedAt ? new Date(domain.lastCheckedAt).toLocaleString() : "Never" })] }), !domain.verified && (_jsxs("div", { className: "mt-5 pt-5 border-t border-border", children: [_jsxs("p", { className: "text-sm mb-2", children: ["Add the following TXT record to ", _jsx("strong", { children: domain.name }), " to prove ownership, then verify:"] }), _jsxs("div", { className: "flex items-center gap-2", children: [_jsx("code", { className: "flex-1 text-xs bg-surface-alt border border-border rounded-sm py-2 px-3 overflow-x-auto whitespace-nowrap", children: ownershipValue }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto shrink-0", onClick: () => handleCopy(ownershipValue), children: copied ? "Copied" : "Copy" })] }), verifyError && (_jsx("div", { className: "mt-3", children: _jsx(Alert, { children: verifyError }) })), _jsx(Button, { type: "button", className: "!w-auto mt-3", loading: verifying, disabled: verifying, onClick: handleVerify, children: verifyError ? "Try again" : "Verify now" })] }))] }), dnsSetup.length > 0 && (_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-sm font-bold uppercase tracking-wide mb-3", children: "DNS setup checklist" }), _jsx("div", { className: "overflow-x-auto", children: _jsxs("table", { className: "w-full text-sm border-collapse", children: [_jsx("thead", { children: _jsx("tr", { children: ["Record", "Status", "Recommended value"].map((h) => (_jsx("th", { className: "text-left text-xs uppercase tracking-wide text-text-muted py-2 px-2.5 border-b border-border", children: h }, h))) }) }), _jsx("tbody", { children: dnsSetup.map((check) => (_jsxs("tr", { children: [_jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: RECORD_TYPE_LABELS[check.type] }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: !check.configured ? (_jsx("span", { className: "text-xs text-text-muted", children: "Not configured" })) : check.matches ? (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-success text-white", children: "Live" })) : (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-surface-alt text-text-muted", children: "Not found" })) }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border text-text-muted", children: _jsx("code", { className: "text-xs", children: check.recommendedValue ?? "—" }) })] }, check.type))) })] }) })] }))] }));
 }

package/dist/apps/shared/components/admin/settings/EncryptionPolicyForm.d.ts

@@ -0,0 +1,12 @@
+import React from "react";
+import { EncryptionPolicy } from "@rapidmx/react-shared/crypto/keyvaultApi.js";
+/** Whether end-to-end encryption can be used at all under `policy` - i.e. any tier allows it. */
+export declare function isEncryptionEnabled(policy: EncryptionPolicy): boolean;
+export interface EncryptionPolicyFormProps {
+    policy: EncryptionPolicy;
+    onChange: (policy: EncryptionPolicy) => void;
+    /** Told whether the form has edits that haven't been saved. */
+    onDirtyChange?: (dirty: boolean) => void;
+}
+/** The end-to-end encryption policy editor, shared by the Encryption Policy page and the setup wizard. */
+export default function EncryptionPolicyForm({ policy, onChange, onDirtyChange }: EncryptionPolicyFormProps): React.JSX.Element;

package/dist/apps/shared/components/admin/settings/EncryptionPolicyForm.js

@@ -3,7 +3,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { useState } from "react";
+import { useEffect, useState } from "react";
 import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
 import { updateEncryptionPolicy } from "@rapidmx/react-shared/crypto/keyvaultApi.js";
 import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
@@ -28,11 +28,15 @@ export function isEncryptionEnabled(policy) {
     return TIERS.some((tier) => policy[tier.key] !== "prohibited");
 }
 /** The end-to-end encryption policy editor, shared by the Encryption Policy page and the setup wizard. */
-export default function EncryptionPolicyForm({ policy, onChange }) {
+export default function EncryptionPolicyForm({ policy, onChange, onDirtyChange }) {
     const [values, setValues] = useState(policy);
     const [error, setError] = useState(null);
     const [saving, setSaving] = useState(false);
     const [saved, setSaved] = useState(false);
+    // Edits are unsaved until they match what was loaded or last saved.
+    const [savedValues, setSavedValues] = useState(policy);
+    const dirty = TIERS.some((tier) => values[tier.key] !== savedValues[tier.key]);
+    useEffect(() => onDirtyChange?.(dirty), [dirty]);
     async function handleSubmit(e) {
         e.preventDefault();
         setError(null);
@@ -41,6 +45,7 @@ export default function EncryptionPolicyForm({ policy, onChange }) {
         try {
             const updated = await updateEncryptionPolicy(values);
             onChange(updated);
+            setSavedValues(values);
             setSaved(true);
         }
         catch (err) {

package/dist/apps/shared/components/admin/settings/LoadedSettingsForm.d.ts

@@ -0,0 +1,9 @@
+import React, { ReactNode } from "react";
+export interface LoadedSettingsFormProps<T> {
+    load: () => Promise<T>;
+    /** Shown when loading fails with something other than an API error message. */
+    loadErrorMessage: string;
+    children: (value: T, onChange: (value: T) => void) => ReactNode;
+}
+/** Loads a settings object, then renders its form - the loading and error states every settings page shares. */
+export default function LoadedSettingsForm<T>({ load, loadErrorMessage, children }: LoadedSettingsFormProps<T>): React.JSX.Element;

package/dist/apps/shared/components/admin/settings/MailboxCreateForm.d.ts

@@ -0,0 +1,19 @@
+import React from "react";
+import { Mailbox } from "@rapidmx/react-shared/mail/mailApi.js";
+export interface MailboxCreateFormProps {
+    onCreated: (mailbox: Mailbox) => void;
+    /** Initial field values, e.g. the signed-in admin's own mailbox in the setup wizard. */
+    defaults?: {
+        localPart?: string;
+        domain?: string;
+        displayName?: string;
+        ownerUserUid?: string;
+    };
+    submitLabel?: string;
+    cancelHref?: string;
+}
+/**
+ * The "New mailbox" form, shared by the New Mailbox page and the setup wizard. The quota starts at the mailbox
+ * policy's default.
+ */
+export default function MailboxCreateForm({ onCreated, defaults, submitLabel, cancelHref }: MailboxCreateFormProps): React.JSX.Element;

package/dist/apps/shared/components/admin/settings/MailboxCreateForm.js

@@ -69,6 +69,12 @@ export default function MailboxCreateForm({ onCreated, defaults, submitLabel = "
             setError("A display name is required.");
             return;
         }
+        // restapi refuses these (400): a display name shown in From must not look like an address. The fullwidth and
+        // small look-alike @ signs are refused too (restapi's `AT_SIGN_LIKE`).
+        if (/[@＠﹫\r\n]/.test(displayName)) {
+            setError("A display name can't contain \"@\" (or a look-alike) or line breaks.");
+            return;
+        }
         setSaving(true);
         try {
             // ownerUserUid left blank creates a true ownerless shared mailbox (e.g. support@example.com);

package/dist/apps/shared/components/admin/settings/MailboxPolicyForm.d.ts

@@ -0,0 +1,10 @@
+import React from "react";
+import { MailboxPolicy } from "@rapidmx/react-shared/admin/mailboxPolicyApi.js";
+export interface MailboxPolicyFormProps {
+    policy: MailboxPolicy;
+    onChange: (policy: MailboxPolicy) => void;
+    /** Told whether the form has edits that haven't been saved. */
+    onDirtyChange?: (dirty: boolean) => void;
+}
+/** The mailbox defaults editor, shared by the Mailbox Policy page and the setup wizard. */
+export default function MailboxPolicyForm({ policy, onChange, onDirtyChange }: MailboxPolicyFormProps): React.JSX.Element;

package/dist/apps/shared/components/admin/settings/MailboxPolicyForm.js

@@ -3,42 +3,64 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { useState } from "react";
+import { useEffect, useState } from "react";
 import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
 import { updateMailboxPolicy } from "@rapidmx/react-shared/admin/mailboxPolicyApi.js";
 import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
 import Button from "@rapidmx/react-shared/components/buttons/Button.js";
 const INPUT_CLASS = "w-full text-sm py-2 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
 const GB = 1000000000;
+/** Unrounded, so a quota that isn't a whole number of hundredths of a GB (say 4 MB) is shown as it is. */
 function toGb(bytes) {
-    return String(Math.round((bytes / GB) * 100) / 100);
+    return String(bytes / GB);
 }
 /** The mailbox defaults editor, shared by the Mailbox Policy page and the setup wizard. */
-export default function MailboxPolicyForm({ policy, onChange }) {
+export default function MailboxPolicyForm({ policy, onChange, onDirtyChange }) {
     const [defaultQuotaGb, setDefaultQuotaGb] = useState(toGb(policy.defaultQuotaBytes));
     const [autoProvisionEnabled, setAutoProvisionEnabled] = useState(policy.autoProvisionEnabled);
     const [autoProvisionQuotaGb, setAutoProvisionQuotaGb] = useState(toGb(policy.autoProvisionQuotaBytes));
     const [error, setError] = useState(null);
     const [saving, setSaving] = useState(false);
     const [saved, setSaved] = useState(false);
+    // Edits are unsaved until they match what was loaded or last saved.
+    const [baseline, setBaseline] = useState({ defaultQuotaGb, autoProvisionEnabled, autoProvisionQuotaGb });
+    const dirty = defaultQuotaGb !== baseline.defaultQuotaGb ||
+        autoProvisionEnabled !== baseline.autoProvisionEnabled ||
+        autoProvisionQuotaGb !== baseline.autoProvisionQuotaGb;
+    useEffect(() => onDirtyChange?.(dirty), [dirty]);
     async function handleSubmit(e) {
         e.preventDefault();
         setError(null);
         setSaved(false);
-        const defaultQuota = Number(defaultQuotaGb);
-        const autoQuota = Number(autoProvisionQuotaGb);
-        if (!(defaultQuota > 0) || !(autoQuota > 0)) {
-            setError("Quotas must be more than 0 GB.");
+        // Only fields the administrator changed are sent, so a quota left alone keeps its exact stored bytes.
+        const patch = {};
+        for (const [field, text, base] of [
+            ["defaultQuotaBytes", defaultQuotaGb, baseline.defaultQuotaGb],
+            ["autoProvisionQuotaBytes", autoProvisionQuotaGb, baseline.autoProvisionQuotaGb],
+        ]) {
+            if (text === base) {
+                continue;
+            }
+            const bytes = Math.round(Number(text) * GB);
+            if (!(bytes >= 1)) {
+                setError("Quotas must be more than 0 GB.");
+                return;
+            }
+            patch[field] = bytes;
+        }
+        if (autoProvisionEnabled !== baseline.autoProvisionEnabled) {
+            patch.autoProvisionEnabled = autoProvisionEnabled;
+        }
+        const current = { defaultQuotaGb, autoProvisionEnabled, autoProvisionQuotaGb };
+        if (Object.keys(patch).length === 0) {
+            setSaved(true);
             return;
         }
         setSaving(true);
         try {
-            const updated = await updateMailboxPolicy({
-                defaultQuotaBytes: Math.round(defaultQuota * GB),
-                autoProvisionEnabled,
-                autoProvisionQuotaBytes: Math.round(autoQuota * GB),
-            });
+            const updated = await updateMailboxPolicy(patch);
             onChange(updated);
+            setBaseline(current);
             setSaved(true);
         }
         catch (err) {

package/dist/apps/shared/components/admin/settings/PluginsManager.d.ts

@@ -0,0 +1,4 @@
+import React from "react";
+/** Installed plugins with their rollout status, and every plugin action - shared by the Plugins page and the
+ * setup wizard. */
+export default function PluginsManager(): React.JSX.Element;