/* Popitron Mail — the inbox, inside the app. Loaded by index.html as a Babel script. Talks only to /api/mail/* (the proxy); never to Stalwart directly. Exposes window.PopMail = { Mail } for index.html to render under the Mail tile. */ (function () { const { useState, useEffect, useMemo, useCallback, useRef } = React; const API = "/api/mail"; const tok = () => { try { return localStorage.getItem("pop.jwt"); } catch { return null; } }; async function req(path, init = {}) { const h = { Accept: "application/json", ...(init.body ? { "Content-Type": "application/json" } : {}) }; if (tok()) h.Authorization = "Bearer " + tok(); const r = await fetch(API + path, { ...init, headers: h, body: init.body ? JSON.stringify(init.body) : undefined }); const t = await r.text(); let d = null; try { d = t ? JSON.parse(t) : null; } catch {} if (!r.ok) throw new Error((d && d.error) || `Mail request failed (${r.status})`); return d; } const m = { boxes: () => req("/mailboxes"), list: (mailbox, page, q) => req(`/messages?mailbox=${encodeURIComponent(mailbox || "")}&page=${page}&q=${encodeURIComponent(q || "")}`), get: (id) => req(`/message?id=${encodeURIComponent(id)}`), flag: (ids, key, value) => req("/flag", { method: "POST", body: { ids, key, value } }), move: (ids, to) => req("/move", { method: "POST", body: { ids, to } }), del: (ids) => req("/delete", { method: "POST", body: { ids } }), send: (msg) => req("/send", { method: "POST", body: msg }), blobUrl: (a) => `${API}/blob?id=${encodeURIComponent(a.blobId)}&name=${encodeURIComponent(a.name)}&type=${encodeURIComponent(a.type || "application/octet-stream")}`, }; const when = (ts) => { if (!ts) return ""; const d = new Date(ts), now = new Date(); const sameDay = d.toDateString() === now.toDateString(); if (sameDay) return d.toLocaleTimeString([], { hour: "numeric", minute: "2-digit" }); if (now - d < 6 * 86400000) return d.toLocaleDateString([], { weekday: "short" }); return d.toLocaleDateString([], { month: "short", day: "numeric", year: d.getFullYear() !== now.getFullYear() ? "numeric" : undefined }); }; const who = (list, me) => (list || []).map((a) => a.email === me ? "me" : (a.name || a.email || "")).join(", "); const fmtAddr = (a) => a.name ? `${a.name} <${a.email}>` : a.email; const size = (n) => n > 1048576 ? (n / 1048576).toFixed(1) + " MB" : n > 1024 ? Math.round(n / 1024) + " KB" : n + " B"; const ROLE_LABEL = { inbox: "Inbox", drafts: "Drafts", sent: "Sent", archive: "Archive", junk: "Junk", trash: "Trash" }; // Render HTML mail in a fully sandboxed iframe via srcdoc: no scripts, no same-origin // access, so nothing in a message can touch the app. Remote images are blocked by a // CSP inside the frame until the reader asks for them. Height is read via postMessage. function HtmlBody({ html, allowRemote }) { const ref = useRef(null); const [h, setH] = useState(160); const csp = allowRemote ? "default-src 'none'; img-src * data: cid:; style-src 'unsafe-inline'; font-src *; script-src 'unsafe-inline'" : "default-src 'none'; img-src data: cid:; style-src 'unsafe-inline'; script-src 'unsafe-inline'"; // the only script in the frame is ours: it reports the content height const doc = `${html}`; useEffect(() => { const on = (e) => { if (e.source === (ref.current && ref.current.contentWindow) && e.data && e.data.popmail) setH(Math.min(4000, e.data.popmail + 16)); }; window.addEventListener("message", on); return () => window.removeEventListener("message", on); }, []); return