@remit/web-client 0.0.325 → 0.0.326

package/dist/src/lib/app-info.js

@@ -0,0 +1,26 @@
+/**
+ * Build-time constants injected by vite.config.ts via `define`.
+ * __APP_SHA__ is the full git SHA (or "dev" in local builds without git).
+ * __APP_BUILD_TIME__ is an ISO timestamp.
+ *
+ * Read through `typeof` because not every host that renders this app's
+ * components applies the `define` — Storybook's test runner mounts them
+ * without it — and a bare reference is a ReferenceError at module scope that
+ * takes the importing story down with it. An unknown build is the same
+ * "dev" the git-less local build already resolves to.
+ */
+export const APP_SHA = typeof __APP_SHA__ === "undefined" ? "dev" : __APP_SHA__;
+export const APP_BUILD_TIME = typeof __APP_BUILD_TIME__ === "undefined" ? "unknown" : __APP_BUILD_TIME__;
+/** First 7 characters of the SHA, matching git's default short form. */
+export const APP_SHORT_SHA = APP_SHA.slice(0, 7);
+/**
+ * True when `APP_SHA` is a real git commit — a build that was given the commit
+ * (via `GITHUB_SHA` at build time). A local build with no git resolves to the
+ * literal "dev", which is not a commit and must not be linked (a
+ * `/commit/dev` URL is a dead link).
+ */
+export const APP_SHA_IS_COMMIT = /^[0-9a-f]{40}$/.test(APP_SHA);
+/** Commit URL for the build, or undefined when the build has no real SHA. */
+export const GITHUB_COMMIT_URL = APP_SHA_IS_COMMIT
+    ? `https://github.com/remit-mail/reader/commit/${APP_SHA}`
+    : undefined;

package/dist/src/lib/attachment-download.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Why an attachment download failed. Same edge/origin discrimination the body
+ * fetch performs (`classifyBodyFetchFailure`) — the bytes travel the same
+ * `/content/*` route — narrowed to the outcomes a download can act on.
+ *
+ * - `auth` — the edge denied the request; the session has to be renewed.
+ * - `link-expired` — the self-host signature on the URL aged out (1 hour, and
+ *   `describeMessage` is cached for 30 minutes, so an open message outlives it).
+ *   Fixed by re-reading the message, which mints a fresh signature.
+ * - `missing` — the request passed auth and storage had no object at the key.
+ * - `not-ready` — 202: the part has not been stored yet and a cue was re-armed.
+ * - `generic` — anything else, including a transport failure.
+ */
+export type AttachmentFetchReason = "auth" | "link-expired" | "missing" | "not-ready" | "generic";
+/**
+ * The failures a fresh `describeMessage` read repairs on its own: it re-signs
+ * every `contentUrl`, and materializing the deferred per-part objects is a side
+ * effect of that same read.
+ */
+export declare const isRepairableByRefetch: (reason: AttachmentFetchReason) => boolean;
+export declare class AttachmentFetchError extends Error {
+    readonly reason: AttachmentFetchReason;
+    readonly status?: number;
+    constructor(reason: AttachmentFetchReason, message: string, status?: number);
+}
+export declare const classifyAttachmentFailure: (status: number, reasonHeader: string | null) => AttachmentFetchReason;
+/**
+ * Fetch one attachment's bytes from its `contentUrl`.
+ *
+ * The self-host stack authorizes `/content/*` with the signature already in the
+ * URL; AWS authorizes it with the session bearer token at the edge. Sending the
+ * token when there is one covers both, and matches `fetchBodyContent`.
+ *
+ * Throws on anything that is not a 200 so the caller renders the failure. A
+ * download that silently produces no file is the bug this whole change exists
+ * to remove — including the silence of a transfer that stalls, which the
+ * timeout converts into a stated failure.
+ */
+export declare const ATTACHMENT_FETCH_TIMEOUT_MS: number;
+export declare const fetchAttachment: (url: string, getToken: () => Promise<string | null>) => Promise<Blob>;
+export interface AttachmentFailureContent {
+    title: string;
+    detail: string;
+}
+export declare const attachmentFailureContent: (reason: AttachmentFetchReason, filename: string, fallback: string) => AttachmentFailureContent;
+export declare const extractAttachmentFailureReason: (error: unknown) => AttachmentFetchReason;
+export declare const extractAttachmentFailureDetail: (error: unknown) => string;
+/**
+ * A prefilled issue URL for a download failure, so the user has somewhere to go
+ * that is not "try again forever". Not offered for an expired session, which is
+ * the user's to fix and not a bug.
+ */
+export declare const attachmentReportUrl: (reason: AttachmentFetchReason, filename: string, detail: string) => string | undefined;
+/**
+ * Hand the fetched bytes to the browser's download machinery under the
+ * sanitized name.
+ *
+ * A plain `<a href={contentUrl} download>` cannot do this job: on AWS the
+ * content URL is a different origin, where the `download` attribute is ignored
+ * and the browser navigates instead. The object URL is same-origin, so the
+ * attribute holds and the filename we chose is the filename that lands.
+ */
+export declare const saveBlob: (blob: Blob, filename: string) => void;

package/dist/src/lib/attachment-download.js

@@ -0,0 +1,130 @@
+import { classifyBodyFetchFailure } from "../hooks/useMessageBodyContent";
+import { buildBugReportContext, buildGitHubIssueUrl } from "./bug-report";
+import { taggedFetch } from "./network-error";
+/**
+ * The failures a fresh `describeMessage` read repairs on its own: it re-signs
+ * every `contentUrl`, and materializing the deferred per-part objects is a side
+ * effect of that same read.
+ */
+export const isRepairableByRefetch = (reason) => reason === "link-expired" || reason === "not-ready";
+export class AttachmentFetchError extends Error {
+    reason;
+    status;
+    constructor(reason, message, status) {
+        super(message);
+        this.name = "AttachmentFetchError";
+        this.reason = reason;
+        this.status = status;
+    }
+}
+const REASON_HEADER = "x-remit-403-reason";
+/** The `verifyContentSignature` failure the self-host `/content` route reports. */
+const EXPIRED_SIGNATURE_REASON = "expired";
+export const classifyAttachmentFailure = (status, reasonHeader) => {
+    if (reasonHeader?.trim() === EXPIRED_SIGNATURE_REASON)
+        return "link-expired";
+    const bodyReason = classifyBodyFetchFailure(status, reasonHeader);
+    if (bodyReason === "auth")
+        return "auth";
+    if (bodyReason === "body-missing")
+        return "missing";
+    return "generic";
+};
+/**
+ * Fetch one attachment's bytes from its `contentUrl`.
+ *
+ * The self-host stack authorizes `/content/*` with the signature already in the
+ * URL; AWS authorizes it with the session bearer token at the edge. Sending the
+ * token when there is one covers both, and matches `fetchBodyContent`.
+ *
+ * Throws on anything that is not a 200 so the caller renders the failure. A
+ * download that silently produces no file is the bug this whole change exists
+ * to remove — including the silence of a transfer that stalls, which the
+ * timeout converts into a stated failure.
+ */
+export const ATTACHMENT_FETCH_TIMEOUT_MS = 5 * 60 * 1000;
+export const fetchAttachment = async (url, getToken) => {
+    const headers = {};
+    const token = await getToken();
+    if (token)
+        headers.Authorization = `Bearer ${token}`;
+    const response = await taggedFetch(url, {
+        headers,
+        signal: AbortSignal.timeout(ATTACHMENT_FETCH_TIMEOUT_MS),
+    });
+    if (response.status === 202) {
+        throw new AttachmentFetchError("not-ready", "Attachment is still being fetched from the mail server", 202);
+    }
+    if (!response.ok) {
+        throw new AttachmentFetchError(classifyAttachmentFailure(response.status, response.headers.get(REASON_HEADER)), `Failed to download attachment (${response.status} ${response.statusText})`, response.status);
+    }
+    return response.blob();
+};
+export const attachmentFailureContent = (reason, filename, fallback) => {
+    switch (reason) {
+        case "auth":
+            return {
+                title: "Your session expired",
+                detail: `Sign in again, then download ${filename} once more. Other parts of the app may also stop responding until you do.`,
+            };
+        case "link-expired":
+            return {
+                title: "This download link expired and could not be renewed",
+                detail: `Reload the page, then download ${filename} again. If that keeps failing, this is worth reporting.`,
+            };
+        case "missing":
+            return {
+                title: "This attachment is missing from storage",
+                detail: "Remit has the message but not the file. Re-sync the account from Settings, then try again.",
+            };
+        case "not-ready":
+            return {
+                title: "Still fetching this attachment",
+                detail: "Remit is downloading it from the mail server now. Try again in a few seconds.",
+            };
+        default:
+            return { title: "Couldn't download this attachment", detail: fallback };
+    }
+};
+export const extractAttachmentFailureReason = (error) => error instanceof AttachmentFetchError ? error.reason : "generic";
+export const extractAttachmentFailureDetail = (error) => {
+    if (error instanceof Error)
+        return error.message;
+    if (typeof error === "string")
+        return error;
+    return "An unexpected error occurred while downloading this attachment.";
+};
+/**
+ * A prefilled issue URL for a download failure, so the user has somewhere to go
+ * that is not "try again forever". Not offered for an expired session, which is
+ * the user's to fix and not a bug.
+ */
+export const attachmentReportUrl = (reason, filename, detail) => {
+    if (reason === "auth")
+        return undefined;
+    return buildGitHubIssueUrl(buildBugReportContext({
+        title: `Bug: attachment download failed (${reason})`,
+        errorMessage: `Downloading "${filename}" failed: ${detail}`,
+    }));
+};
+/**
+ * Hand the fetched bytes to the browser's download machinery under the
+ * sanitized name.
+ *
+ * A plain `<a href={contentUrl} download>` cannot do this job: on AWS the
+ * content URL is a different origin, where the `download` attribute is ignored
+ * and the browser navigates instead. The object URL is same-origin, so the
+ * attribute holds and the filename we chose is the filename that lands.
+ */
+export const saveBlob = (blob, filename) => {
+    const objectUrl = URL.createObjectURL(blob);
+    const anchor = document.createElement("a");
+    anchor.href = objectUrl;
+    anchor.download = filename;
+    anchor.rel = "noopener";
+    document.body.append(anchor);
+    anchor.click();
+    anchor.remove();
+    // Revoking in the same task as the click cancels the download in WebKit.
+    setTimeout(() => URL.revokeObjectURL(objectUrl), 0);
+};

package/dist/src/lib/auto-moved.d.ts

@@ -0,0 +1,46 @@
+import type { RemitImapAutoMovedInfo } from "@remit/api-http-client/types.gen.ts";
+/** The two folder roles the account's mailboxes can resolve for this feature. */
+export interface AutoMovedRoleMailboxes {
+    inboxMailboxId: string | undefined;
+    junkMailboxId: string | undefined;
+}
+/**
+ * Plain-language badge text, e.g. "Moved from Junk by Remit". No jargon
+ * (verdict/confidence/dryRun never surface) — mirrors the no-jargon precedent
+ * in `rescue-candidates.ts`.
+ *
+ * A classifier move reads its source from the `fromPlacement` role. A
+ * standing-filter move moved from an arbitrary folder, so the caller resolves
+ * that folder's display name and passes it as `sourceFolderName`; absent (name
+ * not resolved yet) falls back to "another folder".
+ */
+export declare const autoMovedLabel: (autoMoved: RemitImapAutoMovedInfo, sourceFolderName?: string) => string;
+/**
+ * True only while the auto-move is still in effect: the message currently sits
+ * in the mailbox the move targeted. A standing-filter move targets the
+ * `destinationMailboxId` it recorded; a classifier move targets the mailbox its
+ * `action` implies. Once the message moves elsewhere (an undo, or any other
+ * move), this returns false — the badge has no local "dismissed" flag; it
+ * re-derives from current placement every render, per the data-flow rule that a
+ * projection never forks from its source (doc/rules/data-flow.md).
+ */
+export declare const isAutoMoveInEffect: (autoMoved: RemitImapAutoMovedInfo | undefined, currentMailboxId: string | undefined, mailboxes: AutoMovedRoleMailboxes) => boolean;
+/**
+ * Plain-language label for a user-initiated spam report (issue #648).
+ * Deliberately not derived from placement the way `autoMovedLabel` is: a
+ * report on a message already in Junk (the provider's own filter put it
+ * there) is a real, no-op-move case, so the badge can't name a "from" folder
+ * the way a classifier/filter move can.
+ */
+export declare const spamReportLabel = "Reported as spam";
+/**
+ * Resolve the undo destination: where the message was before the move. A
+ * standing-filter move recorded the exact source mailbox (`fromMailboxId`),
+ * used verbatim. A classifier move recorded only a role (`fromPlacement`,
+ * always `inbox` or `junk` for an actionable verdict — the Tier 0 classifier
+ * only fires move-to-inbox from junk and move-to-junk from inbox, see
+ * `classifyPlacement.ts`), resolved to the account's mailbox for that role.
+ * `undefined` when the account has no mailbox for that role, or the source
+ * cannot be resolved.
+ */
+export declare const resolveUndoTargetMailboxId: (autoMoved: RemitImapAutoMovedInfo | undefined, mailboxes: AutoMovedRoleMailboxes) => string | undefined;

package/dist/src/lib/auto-moved.js

@@ -0,0 +1,82 @@
+import { PlacementAction } from "@remit/domain-enums";
+const FROM_PLACEMENT_LABEL = {
+    inbox: "Inbox",
+    junk: "Junk",
+};
+/** A standing-filter move names an arbitrary destination via `destinationMailboxId`; a classifier move names a direction via `action`. */
+const isFilterMove = (autoMoved) => autoMoved.destinationMailboxId !== undefined;
+/**
+ * Plain-language badge text, e.g. "Moved from Junk by Remit". No jargon
+ * (verdict/confidence/dryRun never surface) — mirrors the no-jargon precedent
+ * in `rescue-candidates.ts`.
+ *
+ * A classifier move reads its source from the `fromPlacement` role. A
+ * standing-filter move moved from an arbitrary folder, so the caller resolves
+ * that folder's display name and passes it as `sourceFolderName`; absent (name
+ * not resolved yet) falls back to "another folder".
+ */
+export const autoMovedLabel = (autoMoved, sourceFolderName) => {
+    if (isFilterMove(autoMoved)) {
+        return `Moved from ${sourceFolderName ?? "another folder"} by Remit`;
+    }
+    const from = autoMoved.fromPlacement ?? "";
+    return `Moved from ${FROM_PLACEMENT_LABEL[from] ?? "another folder"} by Remit`;
+};
+/**
+ * The mailbox the verdict's `action` implies as the destination — where a
+ * classifier-moved message should currently sit for the move to still be "in
+ * effect".
+ */
+const impliedDestinationMailboxId = (action, mailboxes) => {
+    if (action === PlacementAction.MoveToInbox)
+        return mailboxes.inboxMailboxId;
+    if (action === PlacementAction.MoveToJunk)
+        return mailboxes.junkMailboxId;
+    return undefined;
+};
+/**
+ * True only while the auto-move is still in effect: the message currently sits
+ * in the mailbox the move targeted. A standing-filter move targets the
+ * `destinationMailboxId` it recorded; a classifier move targets the mailbox its
+ * `action` implies. Once the message moves elsewhere (an undo, or any other
+ * move), this returns false — the badge has no local "dismissed" flag; it
+ * re-derives from current placement every render, per the data-flow rule that a
+ * projection never forks from its source (doc/rules/data-flow.md).
+ */
+export const isAutoMoveInEffect = (autoMoved, currentMailboxId, mailboxes) => {
+    if (!autoMoved || !currentMailboxId)
+        return false;
+    const destination = isFilterMove(autoMoved)
+        ? autoMoved.destinationMailboxId
+        : impliedDestinationMailboxId(autoMoved.action, mailboxes);
+    return destination !== undefined && destination === currentMailboxId;
+};
+/**
+ * Plain-language label for a user-initiated spam report (issue #648).
+ * Deliberately not derived from placement the way `autoMovedLabel` is: a
+ * report on a message already in Junk (the provider's own filter put it
+ * there) is a real, no-op-move case, so the badge can't name a "from" folder
+ * the way a classifier/filter move can.
+ */
+export const spamReportLabel = "Reported as spam";
+/**
+ * Resolve the undo destination: where the message was before the move. A
+ * standing-filter move recorded the exact source mailbox (`fromMailboxId`),
+ * used verbatim. A classifier move recorded only a role (`fromPlacement`,
+ * always `inbox` or `junk` for an actionable verdict — the Tier 0 classifier
+ * only fires move-to-inbox from junk and move-to-junk from inbox, see
+ * `classifyPlacement.ts`), resolved to the account's mailbox for that role.
+ * `undefined` when the account has no mailbox for that role, or the source
+ * cannot be resolved.
+ */
+export const resolveUndoTargetMailboxId = (autoMoved, mailboxes) => {
+    if (!autoMoved)
+        return undefined;
+    if (isFilterMove(autoMoved))
+        return autoMoved.fromMailboxId;
+    if (autoMoved.fromPlacement === "inbox")
+        return mailboxes.inboxMailboxId;
+    if (autoMoved.fromPlacement === "junk")
+        return mailboxes.junkMailboxId;
+    return undefined;
+};

package/dist/src/lib/autodiscovery.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Client-side autodiscovery for IMAP/SMTP server settings.
+ *
+ * Strategy (stop at first hit):
+ * 1. Curated provider table (top ~30 providers)
+ * 2. Mozilla Autoconfig: GET https://autoconfig.thunderbird.net/v1.1/{domain}
+ * 3. Domain-hosted autoconfig: GET https://autoconfig.{domain}/mail/config-v1.1.xml
+ * 4. Fallback heuristics: imap.{domain}:993/tls, smtp.{domain}:587/starttls
+ *
+ * NOTE: A future backend endpoint `GET /autodiscovery?email=…` (TypeSpec-first)
+ * is planned to handle DNS SRV lookups and CORS-blocked domains server-side.
+ * Until it exists, this client-side implementation covers the majority of providers.
+ */
+export type SecurityMode = "tls" | "starttls" | "none";
+export interface ServerSettings {
+    host: string;
+    port: number;
+    security: SecurityMode;
+}
+export interface DiscoveryResult {
+    imap: ServerSettings;
+    smtp: ServerSettings;
+    /** Source of the discovery result */
+    source: "provider-table" | "mozilla-autoconfig" | "domain-autoconfig" | "heuristic";
+}
+/** App-password doc links per domain (static lookup) */
+export declare const APP_PASSWORD_URLS: Record<string, string>;
+/**
+ * Run autodiscovery for the given email address.
+ * Returns null if discovery fails after all strategies; caller should show manual-entry UI.
+ *
+ * Timeout defaults to 1.5s (not the spec's 5s): the browser autoconfig
+ * fetches (Mozilla ISPDB + autoconfig.{domain}) almost always reject on CORS,
+ * so for any non-table domain we'd otherwise burn ~5s on two doomed requests
+ * before the heuristic fallback. A short budget keeps the address step snappy.
+ * The real fix is the backend `/autodiscovery` endpoint (see module header).
+ */
+export declare function discoverSettings(email: string, timeoutMs?: number): Promise<DiscoveryResult | null>;
+/** Get a human-readable "looking up …" message shown during autodiscovery */
+export declare function getDiscoveryStatusMessage(email: string): string;
+/** Get app-password URL for the email's domain, if known */
+export declare function getAppPasswordUrl(email: string): string | undefined;