@redsift/products 12.5.9 → 12.5.10-muiv8-alpha.2

package/_internal/SignalCardSpfDomain.js

@@ -5,7 +5,7 @@ import styled, { css } from 'styled-components';
 import pako from 'pako';
 import { interpolateTranslation, mapStatusToDetailedCardColor, isStructuredData, calculateSankeyHeight, create2LevelSankey, extractDmarcData, extractSpfData, extractTlsData, extractFcrdnsData, extractDnssecData, extractThreatIntelligenceData, extractUrlsData, extractBimiData, extractAmpData, extractSubdoData, extractDomainAnalyzerDkimData, extractDomainAnalyzerSpfData, extractDmarcDomainData, extractSpfDomainData, extractMtaStsFullData, extractDkimData, recordStatus } from '@redsift/signal-logic';
 import { useLocalizedStringFormatter, useTheme, Button, Icon, DetailedCard, ButtonLink, Flexbox } from '@redsift/design-system';
-import { mdiHelpCircle, mdiClose, mdiAlert, mdiEmail, mdiEarth, mdiInformationOutline, mdiCheck, mdiInformation } from '@redsift/icons';
+import { mdiHelpCircle, mdiClose, mdiAlert, mdiEmail, mdiEarth, mdiInformationOutline, mdiCheck, mdiInformation, mdiFormatAlignRight, mdiFormatAlignJustify } from '@redsift/icons';
 import { createPortal } from 'react-dom';
 
 const COLOR = {
@@ -283,6 +283,7 @@ var EXTRACTOR_STRINGS = {
     "card.dkim.unavailable-try-later_md": "Please try sending another email later.",
     "card.dkim.unavailable_md": "**[](DKIM#:glossary) evaluation temporarily unavailable.**",
     "card.dmarc.domain-aligned": "The domain is aligned with the From Domain. It can contribute to passing DMARC.",
+    "card.dmarc.domain-aligned-not-verified": "The domain is aligned with the From Domain, but its signature did not verify, so it cannot contribute to passing DMARC.",
     "card.dmarc.domain-not-aligned": "The domain is not aligned with the From Domain. It cannot contribute to passing DMARC.",
     "card.dmarc.error.dns-timeout": "DNS timeout when looking up DMARC record",
     "card.dmarc.error.invalid-pct-value": "Pct value must be between 0 and 100",
@@ -766,6 +767,7 @@ var EXTRACTOR_STRINGS = {
     "card.dkim.unavailable-try-later_md": "Veuillez essayer d'envoyer un autre courriel plus tard.",
     "card.dkim.unavailable_md": "**[](DKIM#:glossary) \xE9valuation temporairement indisponible.**",
     "card.dmarc.domain-aligned": "Le domaine est align\xE9 avec le domaine exp\xE9diteur. Il peut contribuer \xE0 la r\xE9ussite de DMARC.",
+    "card.dmarc.domain-aligned-not-verified": "Le domaine est align\xE9 avec le domaine exp\xE9diteur, mais sa signature n'a pas \xE9t\xE9 v\xE9rifi\xE9e, il ne peut donc pas contribuer \xE0 la r\xE9ussite de DMARC.",
     "card.dmarc.domain-not-aligned": "Le domaine n'est pas align\xE9 avec le domaine exp\xE9diteur. Il ne peut pas contribuer \xE0 la r\xE9ussite de DMARC.",
     "card.dmarc.error.dns-timeout": "D\xE9lai d'attente DNS lors de la recherche de l'enregistrement DMARC",
     "card.dmarc.error.invalid-pct-value": "La valeur pct doit \xEAtre entre 0 et 100",
@@ -1334,7 +1336,7 @@ var enUS = {
 	"investigate.card.dmarc.void-dynamic-dmarc-ns-record": "Dynamic DMARC record (NS) is added but Dynamic Services aren't enabled",
 	"investigate.card.dmarc.policy-none-pct-0_md": "No reports will be sent with this policy, because the sample rate [](PCT#:glossary) is set to `0`.",
 	"investigate.card.dmarc.policy-not-none-pct-0_md": "All **unauthorized** email will be delivered to receivers although the policy is set to [{policy}](DMARC_POLICY#:glossary), because the sample rate [](PCT#:glossary) is set to `0`.",
-	"investigate.card.dmarc.policy-inherited-from-org-domain_md": "The DMARC policy for the [](FROM#:glossary) `{fromDomain}` comes from the [](ORGANIZATIONAL_DOMAIN#:glossary) `{orgDomain}`",
+	"investigate.card.dmarc.policy-inherited-from-org-domain_md": "The DMARC policy for the [](FROM#:glossary) `{fromDomain}` comes from the [Organizational Domain](ORGANIZATIONAL_DOMAIN#:glossary) `{orgDomain}`",
 	"investigate.card.dmarc.category-policy-good_md": "The policy on your DNS conforms with the DMARC specification.",
 	"investigate.card.dmarc.all-emails-reported_md": "All emails will be [REPORTED](DMARC_POLICY#:glossary).",
 	"investigate.card.dmarc.all-emails-reported-only_md": "DMARC configured in report-only mode. All emails will only be [REPORTED](DMARC_POLICY#:glossary).",
@@ -1924,6 +1926,7 @@ var enUS = {
 	"investigate.section-titles.bimi-domain": "DMARC Domains",
 	"investigate.section-titles.dmarc-domain": "DMARC Domains",
 	"investigate.card.dmarc.domain-aligned": "The domain is aligned with the From Domain. It can contribute to passing DMARC.",
+	"investigate.card.dmarc.domain-aligned-not-verified": "The domain is aligned with the From Domain, but its signature did not verify, so it cannot contribute to passing DMARC.",
 	"investigate.card.dmarc.domain-not-aligned": "The domain is not aligned with the From Domain. It cannot contribute to passing DMARC."
 };
 
@@ -2022,11 +2025,11 @@ var frFR = {
 	"investigate.card.dmarc.policy-remaining-emails-pct-reject_md": "Les **{remainingPercent}%** restants de courriels non autorisés seront soumis à la politique de **mise en quarantaine**.",
 	"investigate.card.dmarc.policy-remaining-emails-pct-quarantine_md": "Les **{remainingPercent}%** restants de courriels non autorisés seront **livrés normalement**.",
 	"investigate.card.dmarc.no-policy_md": "**Aucune [FULL](DMARC_POLICY#:glossary) publiée sur le domaine**\n\n**`{policyDomain}`**",
-	"investigate.card.dmarc.dmarc-passed_md": "[](DMARC#:glossary) **passé**",
-	"investigate.card.dmarc.dmarc-passed-no-rua_md": "[](DMARC#:glossary) est conforme au BIMI **MAIS** il n'a pas d'entrée **aggregate report address** (rua).",
-	"investigate.card.dmarc.dmarc-no-rua_md": "[](DMARC#:glossary) n'a pas d'entrée **aggregate report address** (rua).",
+	"investigate.card.dmarc.dmarc-passed_md": "[](DMARC#:glossary) **réussi**",
+	"investigate.card.dmarc.dmarc-passed-no-rua_md": "[](DMARC#:glossary) est conforme à BIMI **MAIS** n'a pas d'**adresse de rapport agrégé** (rua).",
+	"investigate.card.dmarc.dmarc-no-rua_md": "[](DMARC#:glossary) n'a pas d'**adresse de rapport agrégé** (rua).",
 	"investigate.card.dmarc.dmarc-invalid-record_md": "[](DMARC#:glossary) a un enregistrement **invalide** .",
-	"investigate.card.dmarc.dmarc-failed_md": "[](DMARC#:glossary) **ne sont pas** conformes au BIMI",
+	"investigate.card.dmarc.dmarc-failed_md": "Les paramètres [](DMARC#:glossary) **ne sont pas** conformes à BIMI",
 	"investigate.card.dmarc.misplaced-policy_md": "**Le [FULL](DMARC_POLICY#:glossary) est mal placé.",
 	"investigate.card.dmarc.misplaced-bad-policy_md": "**Le [FULL](DMARC_POLICY#:glossary) est mal placé et a une erreur de syntaxe:**",
 	"investigate.card.dmarc.bad-policy_md_one": "**Le [FULL](DMARC_POLICY#:glossary) présente l'erreur de syntaxe suivante:**.",
@@ -2049,7 +2052,7 @@ var frFR = {
 	"investigate.card.dmarc.void-dynamic-dmarc-ns-record": "L'enregistrement DMARC dynamique (NS) est ajouté mais les Dynamic Services ne sont pas activés.",
 	"investigate.card.dmarc.policy-none-pct-0_md": "Aucun rapport ne sera envoyé avec cette politique, car le taux d'échantillonnage [](PCT#:glossary) est fixé à `0`.",
 	"investigate.card.dmarc.policy-not-none-pct-0_md": "Tous les emails **non autorisés** seront délivrés aux destinataires bien que la politique soit définie sur [{policy}](DMARC_POLICY#:glossary), parce que le taux d'échantillonnage [](PCT#:glossary) est défini sur `0`.",
-	"investigate.card.dmarc.policy-inherited-from-org-domain_md": "La politique DMARC du [](FROM#:glossary) `{fromDomain}` provient du [](ORGANIZATIONAL_DOMAIN#:glossary) `{orgDomain}`",
+	"investigate.card.dmarc.policy-inherited-from-org-domain_md": "La politique DMARC du [](FROM#:glossary) `{fromDomain}` provient du [domaine organisationnel](ORGANIZATIONAL_DOMAIN#:glossary) `{orgDomain}`",
 	"investigate.card.dmarc.category-policy-good_md": "La politique de votre DNS est conforme à la spécification DMARC.",
 	"investigate.card.dmarc.all-emails-reported_md": "Tous les courriels seront [REPORTED](DMARC_POLICY#:glossary).",
 	"investigate.card.dmarc.all-emails-reported-only_md": "DMARC configuré en mode rapport uniquement. Tous les courriels seront uniquement [REPORTED](DMARC_POLICY#:glossary).",
@@ -2104,21 +2107,21 @@ var frFR = {
 	"investigate.card.subdo.blog": "Vous pouvez obtenir un aperçu complet de votre configuration SPF sur notre vérificateur SPF, ou en savoir plus sur l'attaque SubdoMailing sur notre base de connaissances.",
 	"investigate.card.subdo.spf-subdo-poisoned-include_md": "Inclusion compromise : **{raw}**",
 	"investigate.card.subdo.spf-subdo-poisoned-mechanism_md": "Inclusion compromise : **{raw}**",
-	"investigate.card.spf.spf-no-spf_md": "Pas de SPF configuré pour le domaine.",
+	"investigate.card.spf.spf-no-spf_md": "Aucun SPF configuré pour le domaine.",
 	"investigate.card.spf.spf-ipf-error-spf_md": "Erreur SPF : {msg}",
 	"investigate.card.spf.spf-extra-spf-lookups_md": "Trop de recherches SPF ({lookupCount} trouvées, 10 autorisées)",
 	"investigate.card.spf.spf-multiple-mx-providers_md": "Plusieurs fournisseurs de messagerie configurés dans les enregistrements MX de ce domaine.",
-	"investigate.card.spf.spf-multiple-spf_md": "Plusieurs enregistrements SPF ont été trouvés pour ce domaine",
-	"investigate.card.spf.spf-multiple-all_md": "Plusieurs mécanismes **tous** dans l'enregistrement SPF",
-	"investigate.card.spf.spf-recursive-include-spf_md": "L'inclusion SPF redondante peut être supprimée car elle renvoie à votre propre domaine.",
-	"investigate.card.spf.spf-v-tag-duplicated-spf_md": "La balise de la version est dupliquée.",
-	"investigate.card.spf.spf-all-not-last_md": "Toute donnée située après le **tout** est ignorée.",
-	"investigate.card.spf.spf-all-and-redirect_md": "Toute **redirection** est ignorée s'il existe un mécanisme **tous**.",
-	"investigate.card.spf.spf-all-plus-warning_md": "Le mécanisme **+all** ne doit pas être utilisé car il autorise toutes les adresses IP d'envoi.",
+	"investigate.card.spf.spf-multiple-spf_md": "Plusieurs enregistrements SPF trouvés pour ce domaine",
+	"investigate.card.spf.spf-multiple-all_md": "Plusieurs mécanismes **all** dans l'enregistrement SPF",
+	"investigate.card.spf.spf-recursive-include-spf_md": "L'inclusion SPF redondante peut être supprimée car elle pointe vers votre propre domaine",
+	"investigate.card.spf.spf-v-tag-duplicated-spf_md": "La balise de version est dupliquée.",
+	"investigate.card.spf.spf-all-not-last_md": "Toute donnée après le **all** est ignorée.",
+	"investigate.card.spf.spf-all-and-redirect_md": "Toute **redirection** est ignorée s'il y a un mécanisme **all**.",
+	"investigate.card.spf.spf-all-plus-warning_md": "Le mécanisme **+all** ne devrait pas être utilisé car il autorise toutes les adresses IP d'envoi.",
 	"investigate.card.spf.spf-all-question-mark-warning_md": "**?all** ne doit pas être utilisé car il permet une réponse ambiguë.",
-	"investigate.card.spf.spf-no-all_md": "Il est recommandé d'utiliser un modificateur **redirect** ou un mécanisme **all** pour mettre fin explicitement au traitement.",
-	"investigate.card.spf.spf-invalid-spf1-header_md": "Enregistrement SPF non valide",
-	"investigate.card.spf.spf-invalid-spf-header-include_md": "L'enregistrement SPF n'est pas valide car il contient un espace entre la déclaration include :.",
+	"investigate.card.spf.spf-no-all_md": "Il est recommandé d'utiliser soit un modificateur **redirect** soit un mécanisme **all** pour terminer explicitement le traitement.",
+	"investigate.card.spf.spf-invalid-spf1-header_md": "Enregistrement SPF invalide",
+	"investigate.card.spf.spf-invalid-spf-header-include_md": "L'enregistrement SPF est invalide car il a un espace entre l'instruction include:.",
 	"investigate.card.spf.spf-ip-subnet-mask-too-small_md": "Le sous-réseau **{raw}** permet à un grand nombre d'hôtes d'envoyer du courrier électronique au nom du domaine.",
 	"investigate.card.spf.spf-ip-subnet-overlaps-public-range_md": "Le sous-réseau **{raw}** chevauche la plage **{value}**, appartenant à un fournisseur de cloud accessible au public : **{sourceRef}**.",
 	"investigate.card.spf.spf-directive-permissive-exists_md": "Le mécanisme **{raw}** a été défini pour permettre à n'importe quel hôte d'envoyer un courrier électronique au nom du domaine.",
@@ -2641,6 +2644,7 @@ var frFR = {
 	"investigate.section-titles.bimi-domain": "Domaines DMARC",
 	"investigate.section-titles.dmarc-domain": "Domaines DMARC",
 	"investigate.card.dmarc.domain-aligned": "Le domaine est aligné avec le domaine expéditeur. Il peut contribuer à la réussite de DMARC.",
+	"investigate.card.dmarc.domain-aligned-not-verified": "Le domaine est aligné avec le domaine expéditeur, mais sa signature n'a pas été vérifiée, il ne peut donc pas contribuer à la réussite de DMARC.",
 	"investigate.card.dmarc.domain-not-aligned": "Le domaine n'est pas aligné avec le domaine expéditeur. Il ne peut pas contribuer à la réussite de DMARC."
 };
 
@@ -6982,6 +6986,206 @@ function renderList(items) {
   }, item)));
 }
 
+// =============================================================================
+// STATUS LIST RENDERING
+// =============================================================================
+
+/**
+ * Status-list container. Mirrors the plain `<ul>` that `renderList` emits so the
+ * two list variants sit at the same indent and rhythm, adding only the per-entry
+ * row layout the status icons need.
+ */
+const StyledStatusList = styled.ul`
+  li {
+    display: flex;
+    align-items: center;
+    gap: 0.35em;
+    min-width: 0;
+  }
+`;
+
+/**
+ * The entry's text (a domain, on the alignment row).
+ *
+ * `min-width: 0` has to be on the text itself, not just the `li`: a flex item
+ * defaults to `min-width: auto`, which refuses to shrink below its content's
+ * intrinsic width, so a long unbroken domain would push the status icon
+ * (`flex-shrink: 0`) out of the row. `overflow-wrap: anywhere` lets a label with no
+ * natural break opportunity wrap instead of overflowing.
+ *
+ * A dedicated component rather than an `li > span` descendant selector, which would
+ * also be matched by the strike wrapper if the markup were ever reshuffled.
+ */
+const StyledStatusListText = styled.span`
+  min-width: 0;
+  overflow-wrap: anywhere;
+`;
+
+// A div, not a span: TooltipInPortalWrapper renders a <div> (TooltipInPortal.tsx),
+// and a <div> inside a <span> is invalid HTML — span is phrasing content, div is
+// flow content. `display: inline-flex` keeps it laid out inline regardless. This
+// matches the row-level alignment icon in SignalCardExtractedItems, which wraps
+// the same tooltip in a div for the same reason.
+const StyledStatusListIcon = styled.div`
+  display: inline-flex;
+  align-items: center;
+  flex-shrink: 0;
+`;
+
+/**
+ * Diagonal strike across a status icon, for the not-aligned case.
+ *
+ * Drawn in CSS over the mdi glyph rather than inlining a bespoke crossed-out SVG,
+ * so it scales with the glyph and the DS keeps a single source for the underlying
+ * icon.
+ *
+ * The colour is declared **here, once**, on the wrapper: the `::after` gradient
+ * picks it up through `currentColor`, and the `Icon` inside is passed
+ * `currentColor` too, so glyph and strike cannot drift apart. Setting it on the
+ * pseudo-element instead would make `currentColor` resolve to that local
+ * declaration rather than being inherited, which is the trap this replaced.
+ */
+const StyledStruckThrough = styled.span`
+  position: relative;
+  display: inline-flex;
+  align-items: center;
+  color: ${COLOR.main.red};
+
+  &::after {
+    content: '';
+    position: absolute;
+    inset: 0;
+    background: linear-gradient(
+      to top right,
+      transparent calc(50% - 0.7px),
+      currentColor calc(50% - 0.7px),
+      currentColor calc(50% + 0.7px),
+      transparent calc(50% + 0.7px)
+    );
+    pointer-events: none;
+  }
+`;
+
+/**
+ * Status icon for a single {@link StatusListItem}.
+ *
+ * Mirrors the icon vocabulary `getIcon` uses for row-level statuses in
+ * SignalCardExtractedItems, so a per-entry tick reads identically to a row-level
+ * one. A `''` status means "no status" — the entry renders as plain text, exactly
+ * as a `ListData` entry would.
+ *
+ * Per Antony's spec (2026-08-06) this row uses an **align** glyph rather than a
+ * generic tick/cross, with the not-aligned case struck through:
+ *
+ * | status | `matchMode` | meaning | render |
+ * | --- | --- | --- | --- |
+ * | `good`/`warning` | `exact` | signing domain equals the From domain | green `FormatAlignJustify` |
+ * | `good`/`warning` | `organizational` | shares the Organizational Domain | green `FormatAlignRight` |
+ * | `danger` | — | does not align | red `FormatAlignRight`, struck through |
+ *
+ * **`warning` renders as aligned, not amber.** This row is about *domains*, not
+ * mechanism results (Antony, option (a), 2026-08-06). signal-logic's `warning`
+ * branch fires on `aligned && !verified`, where `verified` is
+ * `signature.code === 'pass'` — a property of the crypto, not of the domain pair —
+ * and the DKIM card already reports verification per signature. Colouring it
+ * differently here would make one icon answer two questions and duplicate the DKIM
+ * card, inviting the two to disagree. The distinct `tooltipKey`
+ * (`card.dmarc.domain-aligned-not-verified`) is preserved, so the detail is still
+ * available on hover.
+ *
+ * The known cost: an aligned-but-unverified domain cannot actually contribute to
+ * DMARC passing, so green slightly overstates it. That is conveyed by the
+ * "Alignment Check" prose rows and the overall card verdict, which read as failed —
+ * the honest place for it, rather than overloading a per-domain icon.
+ *
+ * **Exact vs organizational** comes from `matchMode`, added upstream by WEB-1203.
+ * An exact match is *inherently* aligned under either `adkim` mode, so it earns the
+ * fully-justified glyph; an Organizational Domain match only aligns under `adkim=r`
+ * and gets the right-aligned one. `matchMode` is absent on non-aligned entries and
+ * on the fallback `ListData` shape, so a missing value degrades to `FormatAlignRight`
+ * rather than guessing.
+ */
+function renderItemStatusIcon(status, matchMode, accessibleName) {
+  // The DS `Icon` is decorative by default — it sets aria-hidden unless given an
+  // aria-label. The status here is not decorative: it is the only thing telling a
+  // reader whether the domain aligned, and the tooltip carrying that meaning is
+  // hover-only. So pass the translated tooltip text as the accessible name, with
+  // `aria-hidden={false}` to un-hide it, and fall back to the bare status word
+  // when an entry supplies no tooltipKey.
+  const label = accessibleName !== null && accessibleName !== void 0 ? accessibleName : status || undefined;
+  const aria = label ? {
+    'aria-label': label,
+    'aria-hidden': false
+  } : {};
+  switch (status) {
+    // `warning` is deliberately identical to `good` — see above.
+    case 'good':
+    case 'warning':
+      return /*#__PURE__*/React__default.createElement(Icon, _extends({
+        icon: matchMode === 'exact' ? mdiFormatAlignJustify : mdiFormatAlignRight,
+        color: COLOR.main.green,
+        size: "small"
+      }, aria));
+    case 'danger':
+      // Struck through: aligned-looking glyph, cancelled. `currentColor` so the
+      // glyph and the strike share the one colour declared on the wrapper.
+      return /*#__PURE__*/React__default.createElement(StyledStruckThrough, null, /*#__PURE__*/React__default.createElement(Icon, _extends({
+        icon: mdiFormatAlignRight,
+        color: "currentColor",
+        size: "small"
+      }, aria)));
+    default:
+      return null;
+  }
+}
+
+/**
+ * One status-list entry: its text, plus its own status icon and tooltip.
+ *
+ * A component rather than a plain render call because the tooltip text needs
+ * translating, and `renderStructuredData` is a pure function called from the
+ * adapter layer outside React — so it has no `t` to pass down. Resolving the key
+ * here keeps the renderer's signature unchanged and matches how the rest of the
+ * card resolves strings.
+ */
+const StatusListEntry = _ref => {
+  let {
+    item
+  } = _ref;
+  const {
+    t
+  } = useSignalCardTranslation('investigate');
+  const tooltip = item.tooltipKey ? t(item.tooltipKey) : undefined;
+  // The tooltip text doubles as the icon's accessible name — see renderItemStatusIcon.
+  const icon = renderItemStatusIcon(item.status, item.matchMode, tooltip);
+  return /*#__PURE__*/React__default.createElement("li", null, /*#__PURE__*/React__default.createElement(StyledStatusListText, null, item.text), icon ? /*#__PURE__*/React__default.createElement(StyledStatusListIcon, null, tooltip ? /*#__PURE__*/React__default.createElement(TooltipInPortalWrapper, {
+    message: tooltip
+  }, /*#__PURE__*/React__default.createElement("span", {
+    style: {
+      display: 'inline-flex'
+    }
+  }, icon)) : icon) : null);
+};
+
+/**
+ * Render a list whose entries each carry their own status.
+ *
+ * Used by the DMARC card's "DKIM Signing Domain" row, where one message can
+ * carry several DKIM signatures whose alignment differs — an aligned domain gets a
+ * green align glyph while a non-aligned one gets a red struck-through glyph, in the
+ * same list. The row-level status is cleared by signal-logic whenever per-entry
+ * statuses are present, so only these icons render and nothing double-counts.
+ */
+function renderStatusList(items) {
+  if (!(items !== null && items !== void 0 && items.length)) {
+    return null;
+  }
+  return /*#__PURE__*/React__default.createElement(StyledStatusList, null, items.map((item, i) => /*#__PURE__*/React__default.createElement(StatusListEntry, {
+    key: i,
+    item: item
+  })));
+}
+
 // =============================================================================
 // SIGNED HEADERS RENDERING
 // =============================================================================
@@ -7180,6 +7384,13 @@ function renderStructuredData(data) {
       }
     case 'list':
       return renderList(data.items);
+
+    // Additive: `list` above still ships. signal-logic falls back to it whenever
+    // per-signature alignment cannot be computed (Domain Analyzer / `fromDns`
+    // results, no `fromDomain`, or a domain sourced from the `dmarc.dkimDomain`
+    // scalar rather than a signature), so both variants must keep working.
+    case 'status-list':
+      return renderStatusList(data.items);
     case 'highlighted-text':
       return /*#__PURE__*/React__default.createElement(WordHighlighter$1, {
         searchWord: data.searchWord,