@remit/web-client 0.0.128 → 0.0.129

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/web-client",
-  "version": "0.0.128",
+  "version": "0.0.129",
   "type": "module",
   "description": "Remit web client, published as composable primitives — the app shell, auth shells, and runtime config. A distributor imports what it composes and bundles it.",
   "exports": {

package/src/hooks/useIntelligenceData.test.ts

@@ -246,7 +246,11 @@ describe("buildAuthenticityIntel", () => {
 	describe("a passing signature over a claim that does not hold", () => {
 		// The InfoMedics invoice phish: an attacker's own free Atlassian tenant,
 		// so SPF/DKIM/DMARC genuinely pass for a domain nobody recognises, and the
-		// provider's own filter already called it spam.
+		// provider's own filter already called it spam. dkimDomain deliberately
+		// differs from fromDomain here (the delivery host's re-signature,
+		// custmx.one.com, is a different party than the sender's own
+		// serviceupdatebank.atlassian.net) — the display-name check was run
+		// against fromDomain, never dkimDomain, so the copy must name fromDomain.
 		const infoMedics = makeThread({
 			fromEmail: "jira@serviceupdatebank.atlassian.net",
 			fromName: "InfoMedics",
@@ -266,11 +270,17 @@ describe("buildAuthenticityIntel", () => {
 			assert.doesNotMatch(result.summary, /We verified/i);
 		});
 
-		test("names the display name and the link destination", () => {
+		// The copy must name the domain the comparison was actually run
+		// against (fromDomain), never the unrelated dkimDomain — a message
+		// signed by a relay or ESP infrastructure domain must not read as
+		// "the name looks nothing like <that other party>".
+		test("leads with the concern, naming the domain the name was actually compared to, and the link destination", () => {
 			const result = buildAuthenticityIntel(infoMedics, 0);
 			assert.equal(result.verdict, "caution");
-			assert.match(result.summary, /really was sent by/);
+			assert.match(result.summary, /^The name it shows/);
 			assert.match(result.summary, /"InfoMedics"/);
+			assert.match(result.summary, /serviceupdatebank\.atlassian\.net/);
+			assert.doesNotMatch(result.summary, /custmx\.one\.com/);
 			assert.match(result.summary, /betaal-vordering\.example/);
 			assert.doesNotMatch(result.summary, /DKIM|SPF|DMARC/i);
 		});

package/src/hooks/useIntelligenceData.ts

@@ -117,6 +117,16 @@ function joinDomains(domains: readonly string[]): string {
  * out. Empty when everything the backend compared agreed — including when it
  * compared nothing, which is every message the provider's filter did not
  * already call spam.
+ *
+ * Each clause leads with the concern and names `auth.fromDomain` — the
+ * domain `classifyDisplayNameCorrespondence` actually compared the display
+ * name against (`senderMismatch.ts` calls it with the From address's own
+ * domain, never the DKIM signing domain). Naming `auth.dkimDomain` instead
+ * would assert a comparison that was never made: on a message signed by a
+ * relay or ESP infrastructure domain, the display name was checked against
+ * the sender's own address, not that domain. These clauses are the caution
+ * tier's entire summary: there is no separate "verified" sentence in front
+ * of them for the signing fact to hide behind.
  */
 function describeSenderMismatch(
 	auth: NonNullable<RemitImapThreadMessageResponse["authenticity"]>,
@@ -128,11 +138,11 @@ function describeSenderMismatch(
 	if (claimedBrand) {
 		if (correspondence === DisplayNameCorrespondence.Unrelated) {
 			clauses.push(
-				`The name it shows, "${claimedBrand}", has nothing to do with that domain.`,
+				`The name it shows, "${claimedBrand}", has nothing to do with ${auth.fromDomain}.`,
 			);
 		} else if (correspondence === DisplayNameCorrespondence.Lookalike) {
 			clauses.push(
-				`The name it shows, "${claimedBrand}", only looks like that domain.`,
+				`The name it shows, "${claimedBrand}", only looks like ${auth.fromDomain}.`,
 			);
 		}
 	}
@@ -198,10 +208,7 @@ export function buildAuthenticityIntel(
 				fromDomain: auth.fromDomain,
 				dkimDomain: auth.dkimDomain,
 				claimedBrand: claimed,
-				summary: [
-					`This message really was sent by ${auth.fromDomain}.`,
-					...unlike,
-				].join(" "),
+				summary: unlike.join(" "),
 			};
 		}
 		return {
@@ -209,7 +216,7 @@ export function buildAuthenticityIntel(
 			fromDomain: auth.fromDomain,
 			dkimDomain: auth.dkimDomain,
 			summary: auth.dkimDomain
-				? `We verified this message was really sent by ${auth.fromDomain}.`
+				? `This message was signed by ${auth.dkimDomain}.`
 				: `Nothing looks unusual about this sender.`,
 		};
 	}
@@ -217,9 +224,17 @@ export function buildAuthenticityIntel(
 	const fromDomain = auth.fromDomain;
 	const dkimDomain = auth.dkimDomain;
 	const claimedBrand = claimedBrandOf(thread);
+	// dkimDomain is known whenever a mismatch was named against a real
+	// domain; the fallback covers the (defensive, not currently reachable)
+	// case where a mismatch fires with none — say what actually happened
+	// (a signature failed to verify) rather than inventing a sender identity
+	// we do not have.
+	const whatHappened = dkimDomain
+		? `it was actually sent from ${dkimDomain}`
+		: "its signature failed to verify";
 	const summary = claimedBrand
-		? `The display name claims "${claimedBrand}", but this message was actually sent from ${dkimDomain ?? "another sender"} — not ${fromDomain}. Real senders use their own address.`
-		: `This message claims to be from ${fromDomain}, but it was actually sent from ${dkimDomain ?? "a different sender"}.`;
+		? `The display name claims "${claimedBrand}", but ${whatHappened}${dkimDomain ? ` — not ${fromDomain}` : ""}. Real senders use their own address.`
+		: `This message claims to be from ${fromDomain}, but ${whatHappened}.`;
 	return {
 		verdict: "mismatch",
 		fromDomain,