@remit/web-client 0.0.192 → 0.0.194

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/web-client",
-  "version": "0.0.192",
+  "version": "0.0.194",
   "type": "module",
   "description": "Remit web client, published as composable primitives — the app shell, auth shells, and runtime config. A distributor imports what it composes and bundles it.",
   "exports": {

package/src/components/mail/DailyBrief.tsx

@@ -101,6 +101,7 @@ import { useMailFreshness } from "@/lib/mail-freshness";
 import { relatedSearchResults, rowToSearchResult } from "@/lib/search-result";
 import { showInlineSearchResults } from "@/lib/search-surface";
 import { parseSearchTokens } from "@/lib/search-tokens";
+import { resolveSelectionAccountScope } from "@/lib/selection-account-scope";
 import { spamOfferForResults } from "@/lib/spam-offer";
 import {
 	type SelectionWizardControl,
@@ -206,30 +207,24 @@ export const resolveBriefSelectionScope = (
 	selectedIds: ReadonlySet<string>,
 ): BriefSelectionScope => {
 	if (selectedIds.size === 0) return {};
-	const accountIds = new Set<string>();
+	const selected = rows.filter((row) => selectedIds.has(row.id));
+	const account = resolveSelectionAccountScope(
+		selected.map((row) => row.accountId),
+	);
+	if (account.restriction) return account;
 	const mailboxIds = new Set<string>();
-	for (const row of rows) {
-		if (!selectedIds.has(row.id)) continue;
-		if (row.accountId) accountIds.add(row.accountId);
+	for (const row of selected) {
 		if (row.mailboxId) mailboxIds.add(row.mailboxId);
 	}
-	if (accountIds.size > 1) {
-		return {
-			restriction: "spansAccounts",
-			moveDisabledHint:
-				"Move only works within one account — clear selection or pick messages from a single account",
-		};
-	}
-	const accountId = accountIds.size === 1 ? [...accountIds][0] : undefined;
 	if (mailboxIds.size > 1) {
 		return {
-			accountId,
+			accountId: account.accountId,
 			restriction: "spansFolders",
 			moveDisabledHint: `Move only works within one folder — this selection spans ${mailboxIds.size} folders`,
 		};
 	}
 	return {
-		accountId,
+		accountId: account.accountId,
 		mailboxId: mailboxIds.size === 1 ? [...mailboxIds][0] : undefined,
 	};
 };

package/src/components/mail/MessageList.move-guard.test.ts

@@ -0,0 +1,64 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { makeThreadMessage } from "@/test-support/fixtures";
+import { resolveMoveDisabledHint } from "./MessageList";
+
+/**
+ * Regression for #456: every account of one user shares an `accountConfigId`,
+ * so a guard built from it can never trip. These rows share one and differ only
+ * in `accountId`, which is the fact Move is scoped by.
+ */
+const work = makeThreadMessage({ messageId: "m1", accountId: "acc-work" });
+const personal = makeThreadMessage({
+	messageId: "m2",
+	accountId: "acc-personal",
+});
+const alsoWork = makeThreadMessage({ messageId: "m3", accountId: "acc-work" });
+const unattributed = makeThreadMessage({
+	messageId: "m4",
+	accountId: undefined,
+});
+
+const hintFor = (
+	threads: ReturnType<typeof makeThreadMessage>[],
+	ids: string[],
+	listAccountId?: string,
+) => resolveMoveDisabledHint(threads, new Set(ids), listAccountId);
+
+describe("the move guard over a thread-list selection", () => {
+	it("withholds Move from rows owned by different accounts", () => {
+		assert.match(
+			hintFor([work, personal], ["m1", "m2"]) ?? "",
+			/only works within one account/,
+		);
+	});
+
+	it("offers Move to rows owned by the same account", () => {
+		assert.equal(hintFor([work, alsoWork], ["m1", "m3"]), undefined);
+	});
+
+	it("ignores rows the selection does not hold", () => {
+		assert.equal(hintFor([work, personal], ["m1"]), undefined);
+	});
+
+	// A per-mailbox list attaches no account to its rows, so the list's own
+	// account stands in for them — otherwise the guard sees an empty set and
+	// under-fires on a selection that really does span two accounts.
+	it("withholds Move when a row without an account sits under another one", () => {
+		assert.match(
+			hintFor([unattributed, work], ["m4", "m1"], "acc-personal") ?? "",
+			/only works within one account/,
+		);
+	});
+
+	it("offers Move when the list's account is the one every row falls back to", () => {
+		assert.equal(
+			hintFor([unattributed, work], ["m4", "m1"], "acc-work"),
+			undefined,
+		);
+	});
+
+	it("offers Move when neither the rows nor the list name an account", () => {
+		assert.equal(hintFor([unattributed], ["m4"], undefined), undefined);
+	});
+});

package/src/components/mail/MessageList.tsx

@@ -50,6 +50,7 @@ import { junkDestination } from "@/lib/junk-destination";
 import { tabStopId } from "@/lib/list-focus";
 import { useListHeaderChrome } from "@/lib/list-header-chrome";
 import { listVerbRequest } from "@/lib/list-verb-request";
+import { resolveSelectionAccountScope } from "@/lib/selection-account-scope";
 import { shouldExitSelectionOnNavigate } from "@/lib/selection-mode";
 import { useSelectionWizard, useWizardStepValue } from "@/lib/wizard-history";
 import type { WizardSelectionMessage } from "@/lib/wizard-selection";
@@ -207,6 +208,23 @@ const SearchResultsHeader = ({ query }: { query: string }) => (
 	</div>
 );
 
+/**
+ * Why Move is withheld from a selection, in the toolbar's own words. Rows from
+ * a per-mailbox endpoint carry no account of their own, so the list's own
+ * account stands in for them and a row that does carry one is still compared
+ * against it. Pure, so it tests without a DOM.
+ */
+export const resolveMoveDisabledHint = (
+	threads: readonly RemitImapThreadMessageResponse[],
+	selectedIds: ReadonlySet<string>,
+	listAccountId: string | undefined,
+): string | undefined =>
+	resolveSelectionAccountScope(
+		threads
+			.filter((thread) => selectedIds.has(thread.messageId))
+			.map((thread) => thread.accountId ?? listAccountId),
+	).moveDisabledHint;
+
 export const MessageList = ({
 	mailboxId,
 	threads,
@@ -776,28 +794,13 @@ export const MessageList = ({
 		setFocusedMessageId(restoreTo);
 	}, [setFocusedMessageId]);
 
-	// Cross-account guard: every selected thread row must belong to the
-	// same account as the current mailbox. The list is already scoped to
-	// one mailbox so in practice this is always single-account, but we
-	// detect drift defensively (e.g. a future global selection mode) and
-	// disable Move with an inline hint rather than silently aggregating.
-	//
-	// `MessageList` re-renders on every virtualizer scroll tick. Memoize
-	// the guard so we only walk the selected slice when selection or
-	// thread identity actually changes.
-	const moveDisabledHint = useMemo(() => {
-		if (selectedCount === 0) return undefined;
-		const selectedAccountConfigIds = new Set<string>();
-		for (const thread of threads) {
-			if (selectedIds.has(thread.messageId)) {
-				selectedAccountConfigIds.add(thread.accountConfigId);
-			}
-		}
-		if (selectedAccountConfigIds.size > 1) {
-			return "Move only works within one account — clear selection or pick messages from a single account";
-		}
-		return undefined;
-	}, [selectedCount, selectedIds, threads]);
+	// `MessageList` re-renders on every virtualizer scroll tick. Memoize the
+	// guard so we only walk the selected slice when selection or thread
+	// identity actually changes.
+	const moveDisabledHint = useMemo(
+		() => resolveMoveDisabledHint(threads, selectedIds, accountId),
+		[accountId, selectedIds, threads],
+	);
 
 	// Organize builds a rule out of clauses, and a search predicate is not a set
 	// of clauses — its facets have no `ClauseField`. Over an escalated selection

package/src/lib/delete-folder.test.ts

@@ -2,7 +2,6 @@ import assert from "node:assert/strict";
 import { describe, it } from "node:test";
 import {
 	advanceMove,
-	appointedRole,
 	beginMove,
 	excludeFolder,
 	type FolderNode,
@@ -11,6 +10,7 @@ import {
 	hasChildFolders,
 	initialStage,
 	moveProgressLabel,
+	vouchedRole,
 } from "./delete-folder.js";
 
 const folder = (
@@ -36,13 +36,74 @@ describe("guardFolderDeletion", () => {
 		const guard = guardFolderDeletion(
 			target,
 			[target],
-			[{ role: "Archive", mailboxId: "arch" }],
+			[{ role: "Archive", source: "Appointed", mailboxId: "arch" }],
 		);
 		assert.equal(guard.deletable, false);
 		assert.equal(guard.reason, "role");
 		assert.match(guard.message ?? "", /Archive/);
 	});
 
+	it("blocks a folder the mail server flagged for the role", () => {
+		const target = folder({ mailboxId: "sent", fullPath: "Sent" });
+		const guard = guardFolderDeletion(
+			target,
+			[target],
+			[{ role: "Sent", source: "Flagged", mailboxId: "sent" }],
+		);
+		assert.equal(guard.deletable, false);
+		assert.equal(guard.reason, "role");
+	});
+
+	it("deletes a folder whose only role claim is a name proposal", () => {
+		const target = folder({ mailboxId: "arch", fullPath: "Archive" });
+		const guard = guardFolderDeletion(
+			target,
+			[target],
+			[{ role: "Archive", source: "Proposed", mailboxId: "arch" }],
+		);
+		assert.deepEqual(guard, { deletable: true });
+	});
+
+	it("deletes the name-proposed fallback a stale appointment resolves to", () => {
+		const target = folder({ mailboxId: "deleted-items", fullPath: "Deleted" });
+		const guard = guardFolderDeletion(
+			target,
+			[target],
+			[{ role: "Trash", source: "Stale", mailboxId: "deleted-items" }],
+		);
+		assert.deepEqual(guard, { deletable: true });
+	});
+
+	it("blocks the flagged folder a stale appointment falls back to", () => {
+		const target = folder({
+			mailboxId: "server-trash",
+			fullPath: "Trash",
+			specialUse: ["Trash"],
+		});
+		const guard = guardFolderDeletion(
+			target,
+			[target],
+			[{ role: "Trash", source: "Stale", mailboxId: "server-trash" }],
+		);
+		assert.equal(guard.deletable, false);
+		assert.equal(guard.reason, "role");
+		assert.match(guard.message ?? "", /Trash/);
+	});
+
+	it("reads the flag for the role the entry names, not any flag the folder has", () => {
+		const target = folder({
+			mailboxId: "archive",
+			fullPath: "Archive",
+			specialUse: ["Archive"],
+		});
+		const guard = guardFolderDeletion(
+			target,
+			[target],
+			[{ role: "Trash", source: "Stale", mailboxId: "archive" }],
+		);
+		assert.deepEqual(guard, { deletable: true });
+	});
+
 	it("blocks a folder that has subfolders", () => {
 		const target = folder({ mailboxId: "work", fullPath: "Work" });
 		const child = folder({ mailboxId: "sub", fullPath: "Work/Shop" });
@@ -62,14 +123,18 @@ describe("guardFolderDeletion", () => {
 		const guard = guardFolderDeletion(
 			target,
 			[target, other],
-			[{ role: "Archive", mailboxId: "other-box" }],
+			[{ role: "Archive", source: "Appointed", mailboxId: "other-box" }],
 		);
 		assert.deepEqual(guard, { deletable: true });
 	});
 
 	it("ignores an unfilled role appointment with no mailbox", () => {
 		const target = folder({ mailboxId: "r", fullPath: "Receipts" });
-		const guard = guardFolderDeletion(target, [target], [{ role: "Junk" }]);
+		const guard = guardFolderDeletion(
+			target,
+			[target],
+			[{ role: "Junk", source: "None" }],
+		);
 		assert.equal(guard.deletable, true);
 	});
 });
@@ -106,20 +171,42 @@ describe("hasChildFolders", () => {
 	});
 });
 
-describe("appointedRole", () => {
+describe("vouchedRole", () => {
 	it("returns the role a mailbox fills", () => {
 		assert.equal(
-			appointedRole("a", [{ role: "Trash", mailboxId: "a" }]),
+			vouchedRole({ mailboxId: "a" }, [
+				{ role: "Trash", source: "Appointed", mailboxId: "a" },
+			]),
 			"Trash",
 		);
 	});
 
 	it("returns undefined when the mailbox fills no role", () => {
 		assert.equal(
-			appointedRole("a", [{ role: "Trash", mailboxId: "b" }]),
+			vouchedRole({ mailboxId: "a" }, [
+				{ role: "Trash", source: "Appointed", mailboxId: "b" },
+			]),
+			undefined,
+		);
+	});
+
+	it("returns undefined for a role nobody vouched for", () => {
+		assert.equal(
+			vouchedRole({ mailboxId: "a" }, [
+				{ role: "Trash", source: "Proposed", mailboxId: "a" },
+			]),
 			undefined,
 		);
 	});
+
+	it("returns the role a stale entry falls back to when the server flags it", () => {
+		assert.equal(
+			vouchedRole({ mailboxId: "a", specialUse: ["Trash"] }, [
+				{ role: "Trash", source: "Stale", mailboxId: "a" },
+			]),
+			"Trash",
+		);
+	});
 });
 
 describe("excludeFolder", () => {

package/src/lib/delete-folder.ts

@@ -1,3 +1,5 @@
+import type { RemitImapFolderAppointment } from "@remit/api-http-client/types.gen.ts";
+
 export const MOVE_BATCH_SIZE = 100;
 
 export interface FolderNode {
@@ -5,10 +7,16 @@ export interface FolderNode {
 	fullPath: string;
 	hierarchyDelimiter: string;
 	messageCount: number;
+	/** RFC 6154 SPECIAL-USE flags, bare (`Trash`, not `\Trash`). */
+	specialUse?: readonly string[];
 }
 
+/** Where a role's answer came from. */
+export type RoleAppointmentSource = RemitImapFolderAppointment["source"];
+
 export interface RoleAppointment {
 	role: string;
+	source: RoleAppointmentSource;
 	mailboxId?: string | null;
 }
 
@@ -39,18 +47,48 @@ export const hasChildFolders = (
 	);
 };
 
-/** The canonical role a mailbox is appointed to, or `undefined` when unfilled. */
-export const appointedRole = (
-	mailboxId: string,
+/**
+ * Sources that vouch for the mailbox they name: a person chose it, or the
+ * server flagged it. `Proposed` is a guess at a folder's name and vouches for
+ * nothing. `Reserved` is unreachable behind the inbox branch below and stays
+ * anyway — this set is a statement about evidence, not about branch order.
+ */
+const VOUCHED_SOURCES: readonly RoleAppointmentSource[] = [
+	"Appointed",
+	"Flagged",
+	"Reserved",
+];
+
+/**
+ * A `Stale` entry resolves to whatever the account would have had with no
+ * appointment at all, and that fallback can be the folder the server itself
+ * flags for the role. The entry no longer carries which it was, so read the
+ * flag off the folder: the mail server's designation is unchanged by the
+ * user's own choice going missing, and nothing behind this guard re-checks it.
+ * Flag values are the bare RFC 6154 names, identical to the canonical roles.
+ */
+const vouchesFor = (
+	appointment: RoleAppointment,
+	folder: Pick<FolderNode, "mailboxId" | "specialUse">,
+): boolean => {
+	if (appointment.mailboxId !== folder.mailboxId) return false;
+	if (appointment.source === "Stale")
+		return folder.specialUse?.includes(appointment.role) ?? false;
+	return VOUCHED_SOURCES.includes(appointment.source);
+};
+
+/** The canonical role a folder is vouched for, or `undefined` when none is. */
+export const vouchedRole = (
+	folder: Pick<FolderNode, "mailboxId" | "specialUse">,
 	appointments: readonly RoleAppointment[],
-): string | undefined =>
-	appointments.find((a) => a.mailboxId != null && a.mailboxId === mailboxId)
-		?.role;
+): string | undefined => appointments.find((a) => vouchesFor(a, folder))?.role;
 
 /**
  * Why a folder can't be deleted, or `{ deletable: true }` when it can. The
- * inbox is reserved, a folder that fills a canonical role must be released
- * first, and a folder with subfolders must have them handled before it goes.
+ * inbox is reserved, a folder somebody vouched for in a canonical role must be
+ * released first, and a folder with subfolders must have them handled before it
+ * goes. A role a folder only fills because its name reads that way is no reason
+ * to keep the folder: the message would name a remedy that does not apply.
  */
 export function guardFolderDeletion(
 	folder: FolderNode,
@@ -64,7 +102,7 @@ export function guardFolderDeletion(
 			message: "The inbox can't be deleted.",
 		};
 
-	const role = appointedRole(folder.mailboxId, appointments);
+	const role = vouchedRole(folder, appointments);
 	if (role)
 		return {
 			deletable: false,

package/src/lib/selection-account-scope.ts

@@ -0,0 +1,40 @@
+import type { SelectionRestriction } from "@remit/ui";
+
+/** The account a selection resolves to, and what that costs it. */
+export interface SelectionAccountScope {
+	/** The one account holding every selected row, when there is one. */
+	accountId: string | undefined;
+	/** Which scope the selection spans more of than Move can take. */
+	restriction: SelectionRestriction | undefined;
+	/** Why Move is withheld, in the toolbar's own words. */
+	moveDisabledHint: string | undefined;
+}
+
+/**
+ * Move applies within one account, so every surface offering it over a
+ * selection asks the same question of the same fact — each row's own
+ * `accountId`, never `accountConfigId`, which every account of one user shares
+ * and so can never differ (#456). A row that carries no account of its own is
+ * the caller's to fill in from its list scope before it gets here.
+ */
+export const resolveSelectionAccountScope = (
+	accountIds: Iterable<string | undefined>,
+): SelectionAccountScope => {
+	const distinct = new Set<string>();
+	for (const accountId of accountIds) {
+		if (accountId) distinct.add(accountId);
+	}
+	if (distinct.size > 1) {
+		return {
+			accountId: undefined,
+			restriction: "spansAccounts",
+			moveDisabledHint:
+				"Move only works within one account — clear selection or pick messages from a single account",
+		};
+	}
+	return {
+		accountId: distinct.size === 1 ? [...distinct][0] : undefined,
+		restriction: undefined,
+		moveDisabledHint: undefined,
+	};
+};