@rndmjoker/proton-mcp 0.4.13 → 0.5.1

package/dist/web/server.js

@@ -11,13 +11,13 @@
  * for what each one defends against.
  */
 var _a;
-import { createServer } from 'node:http';
+import { createServer, request as httpRequest, } from 'node:http';
 import { STORE_DESCRIPTIONS } from '../credentials/store.js';
 import { listStores, recommend, recommendationReason } from '../credentials/availability.js';
-import { createSession, checkRequest, csrfToken, securityHeaders } from './security.js';
+import { createSession, checkRequest, csrfToken, securityHeaders, hashPin, pinMatches, pinProblem, AttemptLimiter, } from './security.js';
 import { loginPage, rejectionPage, unlockPage } from './pages.js';
-import { overviewSection, bridgeSection, credentialsSection, activitySection, mailboxSection, } from './sections.js';
-import { pendingPage, noPendingPage } from './pending.js';
+import { overviewSection, bridgeSection, credentialsSection, permissionsSection, activitySection, mailboxSection, } from './sections.js';
+import { UNLOCKABLE } from '../filters/sieve.js';
 /**
  * Upper bound for a request body.
  *
@@ -39,26 +39,71 @@ const SECTION_PATHS = {
     '/mailboxes': 'mailboxes',
     '/bridge': 'bridge',
     '/credentials': 'credentials',
+    '/permissions': 'permissions',
     '/activity': 'activity',
 };
+/**
+ * Where an answer to each form lands, so a wrong PIN is reported on the page the
+ * user was on. Anything not listed lands on the overview.
+ */
+const FORM_SECTIONS = {
+    '/settings': 'bridge',
+    '/test-connection': 'bridge',
+    '/sign-out': 'credentials',
+    '/pin': 'permissions',
+    '/permissions/levels': 'permissions',
+    '/permissions/limits': 'permissions',
+    '/permissions/record': 'permissions',
+    '/permissions/filter-actions': 'permissions',
+};
+/**
+ * Posts that change nothing worth a PIN. Testing the connection only reads, and
+ * the notice about not being Proton's software only hides a paragraph.
+ */
+const WITHOUT_PIN = new Set(['/test-connection', '/dismiss-notice']);
+/**
+ * What `/health` answers, so a server that finds the port taken can tell a
+ * running proton-mcp from some other program. Says nothing else on purpose.
+ */
+const HEALTH_BODY = JSON.stringify({ app: 'proton-mcp' });
 /** The same names as a set, for checking a section that arrived in a form. */
 const SECTIONS = new Set(Object.values(SECTION_PATHS));
 /**
- * The port tried first.
+ * The one address of the interface, shared by every running server.
  *
- * A fixed default rather than a random one, because the interface runs for as
- * long as the server does and is meant to be opened again and again. A port that
- * moved on every start would make that needlessly awkward.
+ * Fixed rather than random, and since 2026-11-05 also not walked upwards when
+ * taken: every client session starts its own server, and the interface they
+ * share has to be at the same address for all of them. The first server to
+ * start serves it; the others take over when it stops.
  */
 export const DEFAULT_WEB_PORT = 7345;
+/** How often a server that does not serve the interface tries to take it over. */
+export const TAKEOVER_INTERVAL_MS = 10_000;
+/**
+ * How much of an answer the probe reads: the health answer of a current
+ * proton-mcp, and the head of an older one's page, whose title comes within
+ * the first 300 bytes.
+ */
+const PROBE_BYTES = 1024;
 /**
- * How many consecutive ports to try.
+ * Names the occupant from the start of its answer to /health.
  *
- * Several clients may each start their own server, and the second one must not
- * fail over a port the first one took. Failing outright would be worse than
- * moving up by one.
+ * A current proton-mcp answers with a small JSON object. An older one has no
+ * such address and answers every request without its token with a page of its
+ * own, titled "Not available - proton-mcp": measured with 0.4.13, and the
+ * title has had this form since 0.3.0. Anything else is another program.
  */
-export const PORT_ATTEMPTS = 10;
+function classifyOccupant(start) {
+    try {
+        const body = JSON.parse(start);
+        if (body.app === 'proton-mcp')
+            return 'proton-mcp';
+    }
+    catch {
+        // Not JSON, so not a current proton-mcp. Perhaps an older one.
+    }
+    return /<title>[^<]* - proton-mcp<\/title>/.test(start) ? 'older' : 'other';
+}
 /**
  * Reads a form body, refusing anything oversized.
  *
@@ -105,88 +150,176 @@ export class WebInterface {
     #server;
     #secrets = createSession();
     #port = 0;
+    /** Who held the port when this server last found it taken. */
+    #occupant = 'none';
+    #takeover;
+    #limiter = new AttemptLimiter();
     #options;
     #notify;
     constructor(options) {
         this.#options = options;
         this.#notify = options.notify ?? ((m) => process.stderr.write(`proton-mcp: ${m}\n`));
     }
-    /** The URL the user has to open, including the access token. */
+    /**
+     * The address of the interface. The same for every running server, whichever
+     * of them serves it, and nothing in it is secret.
+     */
     get url() {
-        return `http://${BIND_ADDRESS}:${this.#port}/?token=${this.#secrets.accessToken}`;
+        const port = this.#port || this.#options.port || DEFAULT_WEB_PORT;
+        return `http://${BIND_ADDRESS}:${port}/`;
     }
     get port() {
         return this.#port;
     }
+    /** True while this server serves the interface itself. */
     get running() {
         return this.#server?.listening === true;
     }
-    async start() {
-        if (this.#server?.listening)
-            return this.url;
-        const build = () => {
-            const created = createServer((request, response) => {
-                void this.#handle(request, response).catch(() => {
-                    // A handler that throws must not take the process down, and must not
-                    // leak anything either.
-                    this.#send(response, 500, 'text/plain; charset=utf-8', 'Internal error.');
-                });
+    /**
+     * Whether the interface can be reached at `url`, from this server or from
+     * another running proton-mcp. False when something else holds the port.
+     */
+    get reachable() {
+        return this.running || this.#occupant === 'proton-mcp';
+    }
+    /** Who held the port when this server last found it taken. */
+    get occupant() {
+        return this.running ? 'none' : this.#occupant;
+    }
+    #build() {
+        const created = createServer((request, response) => {
+            void this.#handle(request, response).catch(() => {
+                // A handler that throws must not take the process down, and must not
+                // leak anything either.
+                this.#send(response, 500, 'text/plain; charset=utf-8', 'Internal error.');
             });
-            // Slow clients must not be able to tie up the server indefinitely.
-            created.headersTimeout = 10_000;
-            created.requestTimeout = 30_000;
-            return created;
-        };
-        const wanted = this.#options.port ?? DEFAULT_WEB_PORT;
-        // Port 0 means "any free port" and needs no retry loop.
-        const attempts = wanted === 0 ? 1 : PORT_ATTEMPTS;
-        let server;
-        let lastError;
-        for (let i = 0; i < attempts; i++) {
-            const candidate = wanted === 0 ? 0 : wanted + i;
-            // A fresh instance per attempt: after a failed listen() the old one is not
-            // reliably reusable.
-            const attempt = build();
-            try {
-                await new Promise((resolve, reject) => {
-                    const onError = (error) => reject(error);
-                    attempt.once('error', onError);
-                    // Explicitly loopback: binding to 0.0.0.0 would put a page that stores
-                    // credentials onto the network.
-                    attempt.listen(candidate, BIND_ADDRESS, () => {
-                        attempt.removeListener('error', onError);
-                        resolve();
-                    });
+        });
+        // Slow clients must not be able to tie up the server indefinitely.
+        created.headersTimeout = 10_000;
+        created.requestTimeout = 30_000;
+        return created;
+    }
+    /** One attempt at the port. Resolves with the error instead of throwing. */
+    async #listen(port) {
+        const attempt = this.#build();
+        try {
+            await new Promise((resolve, reject) => {
+                const onError = (error) => reject(error);
+                attempt.once('error', onError);
+                // Explicitly loopback: binding to 0.0.0.0 would put a page that stores
+                // credentials onto the network.
+                attempt.listen(port, BIND_ADDRESS, () => {
+                    attempt.removeListener('error', onError);
+                    resolve();
                 });
-                server = attempt;
-                lastError = undefined;
-                break;
-            }
-            catch (error) {
-                attempt.close();
-                lastError = error;
-                if (error.code !== 'EADDRINUSE')
-                    break;
-                // Taken, most likely by another instance of this server. Try the next.
-            }
+            });
         }
-        if (!server || lastError) {
-            const code = lastError?.code;
-            throw new Error(code === 'EADDRINUSE'
-                ? `Ports ${wanted} to ${wanted + attempts - 1} are all in use, so the web interface ` +
-                    'could not start. Set PROTON_MCP_WEB_PORT to a free port.'
-                : `The web interface could not start: ${lastError?.message ?? 'unknown reason'}`);
+        catch (error) {
+            attempt.close();
+            return error;
         }
-        const address = server.address();
+        const address = attempt.address();
         this.#port = typeof address === 'object' && address ? address.port : 0;
-        this.#server = server;
+        this.#server = attempt;
+        this.#occupant = 'none';
+        this.#options.onServingChange?.(true);
+        return undefined;
+    }
+    /**
+     * Asks whoever holds the port whether it is a proton-mcp.
+     *
+     * The answer decides between "another session serves the interface, all is
+     * well" and "something else sits on this port", which the user has to hear
+     * about, because then nobody serves the interface at all. An older proton-mcp
+     * is the third answer: no interface either, but the remedy is to restart the
+     * sessions that still run it, not to move every server to another port.
+     */
+    static async probe(port, timeoutMs = 1500) {
+        return new Promise((resolve) => {
+            const request = httpRequest({ host: BIND_ADDRESS, port, path: '/health', method: 'GET', timeout: timeoutMs }, (response) => {
+                // The start of the answer, however long the whole is. Collecting
+                // only answers that were short in total missed an older proton-mcp,
+                // whose page runs to a few kilobytes and arrives in one piece.
+                const chunks = [];
+                let kept = 0;
+                response.on('data', (chunk) => {
+                    if (kept >= PROBE_BYTES)
+                        return;
+                    const part = chunk.subarray(0, PROBE_BYTES - kept);
+                    chunks.push(part);
+                    kept += part.length;
+                });
+                response.on('end', () => resolve(classifyOccupant(Buffer.concat(chunks).toString('utf8'))));
+            });
+            request.on('timeout', () => request.destroy());
+            request.on('error', (error) => {
+                resolve(error.code === 'ECONNREFUSED' ? 'none' : 'other');
+            });
+            request.end();
+        });
+    }
+    /**
+     * Serves the interface, or leaves it to the server that already does.
+     *
+     * Never throws over a taken port. Another proton-mcp on it is the ordinary
+     * case with several sessions; this server then tries every few seconds to
+     * take over, so the interface survives the session that started it. Anything
+     * else on the port is reported once, and taken over too if it ever leaves.
+     */
+    async start() {
+        if (this.running)
+            return this.url;
+        const wanted = this.#options.port ?? DEFAULT_WEB_PORT;
+        const failure = await this.#listen(wanted);
+        if (!failure)
+            return this.url;
+        if (failure.code !== 'EADDRINUSE' || wanted === 0) {
+            throw new Error(`The web interface could not start: ${failure.message}`);
+        }
+        this.#occupant = await _a.probe(wanted);
+        if (this.#occupant === 'other') {
+            this.#notify(`port ${wanted} is held by a program that is not proton-mcp, so the web interface is not ` +
+                'available. Set PROTON_MCP_WEB_PORT to a free port for every proton-mcp, or stop that ' +
+                'program. This server takes the port as soon as it is free.');
+        }
+        else if (this.#occupant === 'older') {
+            this.#notify(`port ${wanted} is held by an older proton-mcp, from a session started before the update. ` +
+                'It serves an interface of its own and knows nothing of the shared one, so the web ' +
+                'interface is not available until that session ends. This server takes the port over ' +
+                'then; restarting the sessions that still run the older version makes that happen now.');
+        }
+        this.#scheduleTakeover(wanted);
         return this.url;
     }
+    #scheduleTakeover(port) {
+        if (this.#takeover)
+            return;
+        this.#takeover = setInterval(() => {
+            void (async () => {
+                if (this.running)
+                    return;
+                if (await this.#listen(port)) {
+                    // Still taken. Find out by whom, so the status stays honest.
+                    this.#occupant = await _a.probe(port);
+                    return;
+                }
+                clearInterval(this.#takeover);
+                this.#takeover = undefined;
+                this.#notify(`took over the web interface at ${this.url}`);
+            })();
+        }, this.#options.takeoverIntervalMs ?? TAKEOVER_INTERVAL_MS);
+        // Waiting to take over must not keep the process alive on its own.
+        this.#takeover.unref();
+    }
     async stop() {
+        if (this.#takeover)
+            clearInterval(this.#takeover);
+        this.#takeover = undefined;
         const server = this.#server;
         this.#server = undefined;
         if (!server)
             return;
+        this.#options.onServingChange?.(false);
         // close() alone only stops accepting new connections and then waits for the
         // existing ones. A browser keeps its connection alive, so a single open tab
         // would hold the shutdown forever and the MCP server would never exit.
@@ -194,11 +327,6 @@ export class WebInterface {
         server.closeAllConnections();
         await new Promise((resolve) => server.close(() => resolve()));
     }
-    /** Invalidates the current link and issues a new one. */
-    rotateToken() {
-        this.#secrets = createSession();
-        return this.url;
-    }
     #send(response, status, contentType, body) {
         response.writeHead(status, { ...securityHeaders(), 'Content-Type': contentType });
         response.end(body);
@@ -217,9 +345,9 @@ export class WebInterface {
             this.#reject(response, 405);
             return;
         }
-        // Answered before the token check and without a log line. Browsers ask for
-        // it on every page view, and each one would otherwise be recorded as a
-        // refused request, which buries the refusals that mean something.
+        // Answered before the checks and without a log line. Browsers ask for it on
+        // every page view, and each one would otherwise be recorded as a refused
+        // request, which buries the refusals that mean something.
         if (path === '/favicon.ico') {
             response.writeHead(404, { ...securityHeaders(), 'Content-Length': '0' });
             response.end();
@@ -240,7 +368,6 @@ export class WebInterface {
             request,
             secrets: this.#secrets,
             port: this.#port,
-            presentedToken: url.searchParams.get('token') ?? undefined,
             writing,
             ...(writing ? { csrf: { purpose, presented: body.fields.csrf } } : {}),
         });
@@ -252,19 +379,49 @@ export class WebInterface {
             return;
         }
         if (method === 'GET') {
+            if (path === '/health') {
+                response.writeHead(200, { ...securityHeaders(), 'Content-Type': 'application/json' });
+                response.end(HEALTH_BODY);
+                return;
+            }
             const section = SECTION_PATHS[path];
             if (section) {
                 await this.#render(section, response);
                 return;
             }
-            // The message waiting for an answer. Its own path rather than a section,
-            // because it exists only while a question is open and is reached from a
-            // link in that question.
-            if (path.startsWith('/pending/')) {
-                await this.#renderPending(response, path.slice('/pending/'.length));
+        }
+        // The PIN, for every change. A wrong one is the user's mistake and gets a
+        // page that says so, unlike the refusals above, which say nothing.
+        if (writing && !WITHOUT_PIN.has(path)) {
+            const refusal = await this.#checkPin(body.fields.pin);
+            if (refusal) {
+                await this.#render(FORM_SECTIONS[path] ?? 'overview', response, {
+                    error: refusal,
+                    ...(path === '/sign-in' && body.fields.address ? { address: body.fields.address } : {}),
+                });
                 return;
             }
         }
+        if (writing && path === '/pin') {
+            await this.#handlePin(response, body.fields);
+            return;
+        }
+        if (writing && path === '/permissions/levels') {
+            await this.#handleLevels(response, body.fields);
+            return;
+        }
+        if (writing && path === '/permissions/limits') {
+            await this.#handleLimits(response, body.fields);
+            return;
+        }
+        if (writing && path === '/permissions/record') {
+            await this.#handleRecord(response, body.fields);
+            return;
+        }
+        if (writing && path === '/permissions/filter-actions') {
+            await this.#handleFilterActions(response, body.fields);
+            return;
+        }
         if (writing && path === '/dismiss-notice') {
             await this.#handleDismissNotice(response, body.fields);
             return;
@@ -313,11 +470,11 @@ export class WebInterface {
     async #render(section, response, outcome = {}) {
         const { error, notice, address, store, showAdvanced } = outcome;
         const status = await this.#options.getStatus();
-        const token = this.#secrets.accessToken;
+        const pinRequired = this.#options.getPin?.() !== undefined;
         const disclaimer = this.#disclaimerFor(section);
         if (!status.connected && status.locked) {
             const page = unlockPage({
-                token,
+                pinRequired,
                 disclaimer,
                 csrf: csrfToken(this.#secrets, '/unlock'),
                 csrfDiscard: csrfToken(this.#secrets, '/discard-encrypted'),
@@ -330,7 +487,7 @@ export class WebInterface {
         if (!status.connected) {
             const stores = await listStores();
             const page = loginPage({
-                token,
+                pinRequired,
                 disclaimer,
                 csrf: csrfToken(this.#secrets, '/sign-in'),
                 stores,
@@ -350,6 +507,7 @@ export class WebInterface {
         }
         const banners = {
             disclaimer,
+            pinRequired,
             ...(error ? { error } : {}),
             ...(notice ? { notice } : {}),
         };
@@ -359,11 +517,10 @@ export class WebInterface {
         let page;
         switch (section) {
             case 'mailboxes':
-                page = await this.#renderMailboxes(token, banners);
+                page = await this.#renderMailboxes(banners);
                 break;
             case 'bridge':
                 page = bridgeSection({
-                    token,
                     csrfSettings: csrfToken(this.#secrets, '/settings'),
                     csrfTest: csrfToken(this.#secrets, '/test-connection'),
                     bridgeHost: status.bridgeHost,
@@ -377,7 +534,6 @@ export class WebInterface {
                 break;
             case 'credentials':
                 page = credentialsSection({
-                    token,
                     csrfSignOut: csrfToken(this.#secrets, '/sign-out'),
                     ...(status.address ? { address: status.address } : {}),
                     ...(status.storeKind ? { storeKind: status.storeKind } : {}),
@@ -385,15 +541,46 @@ export class WebInterface {
                     ...banners,
                 });
                 break;
+            case 'permissions': {
+                const permissions = this.#options.getPermissions?.();
+                page = permissionsSection({
+                    csrfPin: csrfToken(this.#secrets, '/pin'),
+                    csrfLevels: csrfToken(this.#secrets, '/permissions/levels'),
+                    csrfLimits: csrfToken(this.#secrets, '/permissions/limits'),
+                    csrfRecord: csrfToken(this.#secrets, '/permissions/record'),
+                    csrfFilterActions: csrfToken(this.#secrets, '/permissions/filter-actions'),
+                    ...(permissions ? { tools: permissions.tools, limits: permissions.limits } : {}),
+                    ...(this.#options.getRecord ? { record: this.#options.getRecord() } : {}),
+                    ...(this.#options.getFilterActions ? { filterActions: this.#options.getFilterActions() } : {}),
+                    ...banners,
+                });
+                break;
+            }
             case 'activity': {
                 const activity = this.#options.getActivity?.() ?? { running: [], recent: [] };
-                page = activitySection({ token, ...activity, ...banners });
+                page = activitySection({ ...activity, ...banners });
                 break;
             }
             default:
                 page = overviewSection({
-                    token,
                     connected: true,
+                    ...(this.#options.getServers ? { servers: this.#options.getServers() } : {}),
+                    ...(() => {
+                        const record = this.#options.getRecord?.();
+                        return record?.address ? { record: { address: record.address, mode: record.mode ?? 'bcc' } } : {};
+                    })(),
+                    ...(this.#options.getFilterActions ? { filterActions: this.#options.getFilterActions().allowed } : {}),
+                    ...(this.#options.getPermissions
+                        ? {
+                            departures: this.#options
+                                .getPermissions()
+                                .tools.filter((tool) => tool.departs)
+                                .map((tool) => ({
+                                tool: tool.tool,
+                                level: { off: 'off', ask: 'ask first', act: 'act on its own' }[tool.level],
+                            })),
+                        }
+                        : {}),
                     ...(status.address ? { address: status.address } : {}),
                     ...storeTitle,
                     ...(status.mailboxCount !== undefined ? { mailboxCount: status.mailboxCount } : {}),
@@ -411,35 +598,209 @@ export class WebInterface {
         this.#send(response, 200, 'text/html; charset=utf-8', page);
     }
     /**
-     * Shows a message that is waiting to be sent.
+     * Checks the PIN of a change. Returns why it was refused, or nothing.
      *
-     * Deliberately not a section: it is reached from the confirmation, exists
-     * only while that question is unanswered, and belongs to no part of the
-     * navigation. A digest nobody is holding gives the empty page rather than a
-     * refusal, because the ordinary reason to land here is having answered
-     * already.
+     * No PIN set means nothing to check: then anything on this machine can make
+     * changes, which the pages say. Too many wrong attempts lock out every attempt
+     * for a while, the right one included, so the lock cannot be used to tell
+     * when a guess was right.
+     */
+    async #checkPin(presented) {
+        const stored = this.#options.getPin?.();
+        if (!stored)
+            return undefined;
+        if (!this.#limiter.allowed()) {
+            return 'Too many wrong PINs. Changes are refused for a minute, whichever PIN is entered.';
+        }
+        if (presented && (await pinMatches(presented, stored))) {
+            this.#limiter.reset();
+            return undefined;
+        }
+        this.#limiter.fail();
+        this.#notify('web interface refused a change with a wrong or missing PIN');
+        return presented ? 'The PIN is not right.' : 'This change needs the PIN.';
+    }
+    /**
+     * Takes the levels from the form.
      *
-     * **No answer is given here.** The page carries no button and must not grow
-     * one: the token in this address reaches the assistant, so a control here
-     * could be operated by the thing being supervised.
+     * Only tools the page offered, only levels each one offers, and nothing the
+     * environment fixed: the form is untrusted input like any other, and a value
+     * it should not carry is refused rather than quietly dropped.
      */
-    async #renderPending(response, digest) {
-        const status = await this.#options.getStatus();
-        const token = this.#secrets.accessToken;
-        const disclaimer = this.#disclaimerFor('none');
-        // Nobody signed in means nothing can be waiting, and the sign-in form is
-        // the more useful answer than an empty preview.
-        if (!status.connected) {
-            await this.#render('overview', response);
+    async #handleLevels(response, fields) {
+        const view = this.#options.getPermissions?.();
+        if (!view || !this.#options.onLevels) {
+            await this.#render('permissions', response, { error: 'This server cannot store levels.' });
             return;
         }
-        const waiting = /^[0-9a-f]{64}$/.test(digest)
-            ? this.#options.getPending?.(digest)
-            : undefined;
-        const page = waiting
-            ? pendingPage({ ...waiting, token, disclaimer })
-            : noPendingPage(token, disclaimer);
-        this.#send(response, 200, 'text/html; charset=utf-8', page);
+        const levels = {};
+        for (const tool of view.tools) {
+            if (tool.fixed)
+                continue;
+            const value = fields[`level:${tool.tool}`];
+            if (value === undefined)
+                continue;
+            if (!tool.options.includes(value)) {
+                await this.#render('permissions', response, {
+                    error: `"${value}" is not a level ${tool.tool} offers.`,
+                });
+                return;
+            }
+            levels[tool.tool] = value;
+        }
+        const failure = await this.#options.onLevels(levels);
+        await this.#render('permissions', response, failure ? { error: failure } : { notice: 'The levels are saved.' });
+    }
+    /** Takes the bounds on sending without asking from the form, each one checked. */
+    async #handleLimits(response, fields) {
+        if (!this.#options.onLimits) {
+            await this.#render('permissions', response, { error: 'This server cannot store bounds.' });
+            return;
+        }
+        const limits = {};
+        const allowed = (fields.allowed ?? '')
+            .split(/[\s,]+/)
+            .map((entry) => entry.trim())
+            .filter(Boolean);
+        const malformed = allowed.find((entry) => !/^[^\s@]*@[^\s@]+\.[^\s@]+$/.test(entry));
+        if (malformed) {
+            await this.#render('permissions', response, {
+                error: `"${malformed}" is neither an address nor a domain written as @example.com.`,
+            });
+            return;
+        }
+        if (allowed.length > 0)
+            limits.allowed = allowed;
+        const max = (fields.maxPerHour ?? '').trim();
+        if (max) {
+            const value = Number(max);
+            if (!Number.isInteger(value) || value < 1 || value > 10_000) {
+                await this.#render('permissions', response, {
+                    error: `"${max}" is not a usable number of messages per hour.`,
+                });
+                return;
+            }
+            limits.maxPerHour = value;
+        }
+        const until = (fields.until ?? '').trim();
+        if (until) {
+            if (!/^\d{4}-\d{2}-\d{2}$/.test(until) || Number.isNaN(Date.parse(`${until}T00:00:00Z`))) {
+                await this.#render('permissions', response, { error: `"${until}" is not a day.` });
+                return;
+            }
+            limits.until = until;
+        }
+        const failure = await this.#options.onLimits(limits);
+        await this.#render('permissions', response, failure ? { error: failure } : { notice: 'The bounds are saved.' });
+    }
+    /**
+     * Takes what filters may do from the form: only the actions the page
+     * offers, each only as a ticked box, and nothing the environment fixed.
+     */
+    async #handleFilterActions(response, fields) {
+        if (!this.#options.onFilterActions || !this.#options.getFilterActions) {
+            await this.#render('permissions', response, { error: 'This server cannot store what filters may do.' });
+            return;
+        }
+        if (this.#options.getFilterActions().fixed) {
+            await this.#render('permissions', response, {
+                error: 'What filters may do is set in the environment (PROTON_MCP_FILTER_ACTIONS), so it is not changed here.',
+            });
+            return;
+        }
+        const named = Object.keys(fields)
+            .filter((key) => key.startsWith('action:'))
+            .map((key) => key.slice('action:'.length));
+        const unknown = named.find((name) => !UNLOCKABLE.includes(name));
+        if (unknown !== undefined) {
+            await this.#render('permissions', response, { error: `"${unknown}" is not an action a filter can be allowed.` });
+            return;
+        }
+        const odd = named.find((name) => fields[`action:${name}`] !== 'on');
+        if (odd !== undefined) {
+            await this.#render('permissions', response, { error: `The box for ${odd} came back with a value it does not have.` });
+            return;
+        }
+        const failure = await this.#options.onFilterActions(UNLOCKABLE.filter((action) => named.includes(action)));
+        await this.#render('permissions', response, failure ? { error: failure } : { notice: 'What filters may do is saved.' });
+    }
+    /** Takes the copy recipient from the form. An empty address removes it. */
+    async #handleRecord(response, fields) {
+        if (!this.#options.onRecord) {
+            await this.#render('permissions', response, { error: 'This server cannot store a copy recipient.' });
+            return;
+        }
+        // The page shows no form when the environment sets the copy, but a
+        // request does not need the page. Storing it anyway would change nothing,
+        // since the environment wins, and the notice would claim otherwise.
+        if (this.#options.getRecord?.().fixed) {
+            await this.#render('permissions', response, {
+                error: 'The copy is set in the environment (PROTON_MCP_COPY_TO), so it is not changed here.',
+            });
+            return;
+        }
+        const address = (fields.address ?? '').trim();
+        if (!address) {
+            const failure = await this.#options.onRecord(undefined);
+            await this.#render('permissions', response, failure ? { error: failure } : { notice: 'No copy is added to messages any more.' });
+            return;
+        }
+        const mode = fields.mode === 'cc' ? 'cc' : 'bcc';
+        if (fields.mode !== undefined && fields.mode !== 'cc' && fields.mode !== 'bcc') {
+            await this.#render('permissions', response, { error: `"${fields.mode}" is neither cc nor bcc.` });
+            return;
+        }
+        const failure = await this.#options.onRecord({ address, mode });
+        await this.#render('permissions', response, failure ? { error: failure } : { notice: `Every message sent now also goes to ${address} as ${mode === 'cc' ? 'Cc' : 'Bcc'}.` });
+    }
+    /**
+     * Sets, changes or removes the PIN.
+     *
+     * Changing and removing have passed the PIN check before this runs, like
+     * every other change. Setting one where none exists needs nothing, because
+     * until then anything could have changed anything anyway.
+     */
+    async #handlePin(response, fields) {
+        if (!this.#options.onPinChange) {
+            await this.#render('permissions', response, {
+                error: 'This server cannot store a PIN.',
+            });
+            return;
+        }
+        const action = fields.action;
+        const existing = this.#options.getPin?.();
+        if (action === 'remove') {
+            const failure = await this.#options.onPinChange(undefined);
+            await this.#render('permissions', response, failure
+                ? { error: failure }
+                : { notice: 'The PIN is removed. Anything on this machine can change these settings again.' });
+            return;
+        }
+        if (action !== 'set' && action !== 'change') {
+            await this.#render('permissions', response);
+            return;
+        }
+        if (action === 'set' && existing) {
+            await this.#render('permissions', response, {
+                error: 'A PIN is set already. Change it with the current one.',
+            });
+            return;
+        }
+        const next = fields.next ?? '';
+        const problem = pinProblem(next);
+        if (problem) {
+            await this.#render('permissions', response, { error: problem });
+            return;
+        }
+        if (next !== (fields.nextRepeat ?? '')) {
+            await this.#render('permissions', response, { error: 'The two PINs do not match.' });
+            return;
+        }
+        const failure = await this.#options.onPinChange(await hashPin(next));
+        this.#limiter.reset();
+        await this.#render('permissions', response, failure
+            ? { error: failure }
+            : { notice: action === 'set' ? 'The PIN is set.' : 'The PIN is changed.' });
     }
     /**
      * Whether the notice is shown, and whether it carries a button.
@@ -475,7 +836,7 @@ export class WebInterface {
      * caller has already established that somebody is signed in, so the only
      * question left here is whether the Bridge answers.
      */
-    async #renderMailboxes(token, banners) {
+    async #renderMailboxes(banners) {
         let mailboxes = [];
         let error = banners.error;
         if (this.#options.getMailboxes) {
@@ -487,8 +848,8 @@ export class WebInterface {
             }
         }
         return mailboxSection({
-            token,
             mailboxes,
+            pinRequired: banners.pinRequired,
             disclaimer: banners.disclaimer,
             ...(error ? { error } : {}),
             ...(banners.notice ? { notice: banners.notice } : {}),