chore: update version number to 0.1.52

VERSION

@@ -1 +1 @@
-0.1.50
+0.1.52

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "bulwark-mobile",
-  "version": "0.1.50",
+  "version": "0.1.52",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "bulwark-mobile",
-      "version": "0.1.50",
+      "version": "0.1.52",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@react-native-async-storage/async-storage": "2.2.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "bulwark-mobile",
-  "version": "0.1.50",
+  "version": "0.1.52",
   "license": "AGPL-3.0-only",
   "main": "index.ts",
   "scripts": {

src/api/calendar.ts

@@ -89,7 +89,18 @@ export async function getCalendars(): Promise<Calendar[]> {
           USING,
         );
         const list = methodResult<{ list: Calendar[] }>(sharedRes).list ?? [];
-        return list.map((cal) => ({ ...cal, accountId: sharedAccountId, isShared: true }));
+        // JMAP calendar ids are only unique within an account, so a shared
+        // "default" calendar collides with the user's own "default". Namespace
+        // the id (keeping the real id in originalId) so visibility toggles,
+        // event-query routing, and create/default mutations don't cross wires.
+        // Mirrors webmail's getAllCalendars.
+        return list.map((cal) => ({
+          ...cal,
+          id: `${sharedAccountId}:${cal.id}`,
+          originalId: cal.id,
+          accountId: sharedAccountId,
+          isShared: true,
+        }));
       } catch {
         return [];
       }
@@ -189,9 +200,10 @@ export async function createEvent(
 export async function batchCreateEvents(
   events: Partial<CalendarEvent>[],
   calendarId: string,
+  targetAccountId?: string,
 ): Promise<number> {
   if (events.length === 0) return 0;
-  const accountId = jmapClient.accountId;
+  const accountId = targetAccountId || jmapClient.accountId;
   const create: Record<string, Partial<CalendarEvent>> = {};
   events.forEach((e, i) => {
     create[`evt-${i}`] = { ...e, calendarIds: { [calendarId]: true } };

src/api/types.ts

@@ -455,6 +455,9 @@ export interface CalendarEvent {
   excludedRecurrenceRules?: RecurrenceRule[];
   recurrenceId?: string;
   originalId?: string;
+  // Client-only: the event's server-side calendarIds (raw, unprefixed), kept
+  // when `calendarIds` is remapped to namespaced store ids for shared events.
+  originalCalendarIds?: Record<string, boolean>;
   useDefaultAlerts?: boolean;
   alerts?: Record<string, Alert>;
   locations?: Record<string, EventLocation>;
@@ -474,6 +477,8 @@ export interface CalendarEvent {
   // primary account; set for events on calendars shared with the user so
   // mutations can be routed to the owning account.
   accountId?: string;
+  // Client-only: true when the event lives on a calendar shared with the user.
+  isShared?: boolean;
 }
 
 export interface CalendarRights {
@@ -502,6 +507,10 @@ export interface Calendar {
   // Client-only: JMAP account the calendar was fetched from. Absent for the
   // primary account; set for calendars shared with the user.
   accountId?: string;
+  // Client-only: the real JMAP id of a shared calendar, before its `id` was
+  // namespaced as `${accountId}:${id}` to stay unique in the store. Mutations
+  // and event queries must use this raw id against the owning account.
+  originalId?: string;
   // Client-only: true when the calendar lives in another account (shared
   // with the user by its owner).
   isShared?: boolean;

src/lib/__tests__/push-notifications.test.ts

@@ -0,0 +1,131 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+// Provide the Android native FCM surface setupPushNotifications needs. The
+// global test-setup mocks react-native with an empty NativeModules, so override
+// it here with a BulwarkFcm module and a pre-33 Platform.Version (which skips
+// the runtime permission request).
+vi.mock('react-native', () => {
+  class NativeEventEmitter {
+    addListener() {
+      return { remove: () => undefined };
+    }
+  }
+  return {
+    Platform: { OS: 'android', Version: 30, select: <T,>(s: { default?: T; android?: T }) => s.android ?? s.default },
+    NativeModules: {
+      BulwarkFcm: {
+        getToken: vi.fn(async () => 'fcm-token-xyz'),
+        deleteToken: vi.fn(async () => undefined),
+      },
+    },
+    NativeEventEmitter,
+    PermissionsAndroid: { RESULTS: { GRANTED: 'granted' }, request: vi.fn(async () => 'granted') },
+  };
+});
+
+vi.mock('../../api/jmap-client', () => ({
+  jmapClient: { username: 'user@example.com', serverUrl: 'https://mail.example.com' },
+}));
+
+vi.mock('../../api/push', () => ({
+  listPushSubscriptions: vi.fn(async () => []),
+  createPushSubscription: vi.fn(async () => 'new-server-id'),
+  verifyPushSubscription: vi.fn(async () => undefined),
+  destroyPushSubscription: vi.fn(async () => undefined),
+  updatePushSubscription: vi.fn(async () => true),
+}));
+
+import AsyncStorage from '@react-native-async-storage/async-storage';
+import { setupPushNotifications, deviceClientIdKey } from '../push-notifications';
+import {
+  listPushSubscriptions,
+  destroyPushSubscription,
+} from '../../api/push';
+import { generateAccountId } from '../account-utils';
+
+const OUR_DCID = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';
+const ACCOUNT_ID = generateAccountId('user@example.com', 'https://mail.example.com');
+const RELAY = 'https://relay.example.com';
+
+// State the fake relay reports for each foreign deviceClientId's /active probe.
+type RelayState = 'dead' | 'live' | 'unknown';
+
+function installFetch(states: Record<string, RelayState>): void {
+  global.fetch = vi.fn(async (input: RequestInfo | URL) => {
+    const url = typeof input === 'string' ? input : input.toString();
+    if (url.includes('/api/push/register')) {
+      return { ok: true, status: 200, json: async () => ({ ok: true }) } as Response;
+    }
+    if (url.includes('/api/push/verify/')) {
+      return { ok: true, status: 200, json: async () => ({ verificationCode: 'CODE' }) } as Response;
+    }
+    const active = url.match(/\/api\/push\/active\/([^/?]+)$/);
+    if (active) {
+      const dcid = decodeURIComponent(active[1]);
+      const state = states[dcid] ?? 'unknown';
+      if (state === 'unknown') {
+        return { ok: false, status: 404, json: async () => ({ error: 'Unknown subscription' }) } as Response;
+      }
+      return { ok: true, status: 200, json: async () => ({ active: state === 'live' }) } as Response;
+    }
+    throw new Error(`unexpected fetch: ${url}`);
+  }) as typeof fetch;
+}
+
+const destroyMock = destroyPushSubscription as ReturnType<typeof vi.fn>;
+const listMock = listPushSubscriptions as ReturnType<typeof vi.fn>;
+
+function sub(id: string, deviceClientId: string) {
+  return { id, deviceClientId, expires: new Date(Date.now() + 86400000).toISOString(), types: ['Email'] };
+}
+
+describe('setupPushNotifications leftover reaping', () => {
+  beforeEach(async () => {
+    vi.clearAllMocks();
+    await AsyncStorage.clear();
+    // Pin our deviceClientId so we control which leftovers are "ours".
+    await AsyncStorage.setItem(deviceClientIdKey(ACCOUNT_ID), OUR_DCID);
+  });
+
+  it('reaps our own and relay-confirmed-dead leftovers, keeps live and unverifiable ones', async () => {
+    listMock.mockResolvedValue([
+      sub('own-old', OUR_DCID), // our own previous attempt -> reap
+      sub('foreign-dead', 'deaddeaddeaddeaddeaddeaddeaddead'), // relay: dead -> reap
+      sub('foreign-live', 'livelivelivelivelivelivelivelive'), // relay: live -> keep
+      sub('foreign-unknown', 'unknwunknwunknwunknwunknwunknwun'), // relay: 404 -> keep
+    ]);
+    installFetch({
+      deaddeaddeaddeaddeaddeaddeaddead: 'dead',
+      livelivelivelivelivelivelivelive: 'live',
+      unknwunknwunknwunknwunknwunknwun: 'unknown',
+    });
+
+    const result = await setupPushNotifications({ relayBaseUrl: RELAY });
+
+    expect(result.verified).toBe(true);
+    const reaped = destroyMock.mock.calls.map((c) => c[0]);
+    expect(reaped).toContain('own-old');
+    expect(reaped).toContain('foreign-dead');
+    expect(reaped).not.toContain('foreign-live');
+    expect(reaped).not.toContain('foreign-unknown');
+  });
+
+  it('keeps foreign subs when the relay probe fails (network error)', async () => {
+    listMock.mockResolvedValue([sub('foreign-x', 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx')]);
+    global.fetch = vi.fn(async (input: RequestInfo | URL) => {
+      const url = typeof input === 'string' ? input : input.toString();
+      if (url.includes('/api/push/register')) {
+        return { ok: true, status: 200, json: async () => ({ ok: true }) } as Response;
+      }
+      if (url.includes('/api/push/verify/')) {
+        return { ok: true, status: 200, json: async () => ({ verificationCode: 'CODE' }) } as Response;
+      }
+      if (url.includes('/api/push/active/')) throw new Error('network down');
+      throw new Error(`unexpected fetch: ${url}`);
+    }) as typeof fetch;
+
+    await setupPushNotifications({ relayBaseUrl: RELAY });
+
+    expect(destroyMock.mock.calls.map((c) => c[0])).not.toContain('foreign-x');
+  });
+});

src/lib/push-notifications.ts

@@ -217,6 +217,33 @@ async function registerWithRelay(params: {
   }
 }
 
+/**
+ * Ask the relay whether a leftover subscription is dead. Returns true ONLY when
+ * the relay positively reports it inactive - a record it knows about that has
+ * never forwarded a push and isn't freshly registered. Every other outcome (the
+ * relay doesn't recognise the id, an older relay without this endpoint, a
+ * network blip, or a live subscription) returns false, so we never reap
+ * anything we can't confirm is dead. This is what lets setup clear its own
+ * abandoned attempts - and dead siblings left by reinstalls that regenerated
+ * the deviceClientId - without disturbing another live device or the PWA that
+ * shares the account.
+ */
+async function relayReportsDead(
+  relayBaseUrl: string,
+  subscriptionId: string,
+): Promise<boolean> {
+  try {
+    const res = await fetch(
+      buildRelayUrl(relayBaseUrl, `/api/push/active/${encodeURIComponent(subscriptionId)}`),
+    );
+    if (!res.ok) return false;
+    const body = (await res.json()) as { active?: unknown };
+    return body.active === false;
+  } catch {
+    return false;
+  }
+}
+
 async function pollVerificationCode(
   relayBaseUrl: string,
   subscriptionId: string,
@@ -306,19 +333,29 @@ export async function setupPushNotifications(
     await AsyncStorage.removeItem(subKey);
   }
 
-  // Reap any leftover Stalwart subscriptions still bound to this account's
-  // deviceClientId. These pile up when a previous enable attempt failed
-  // mid-flow (verify race, network blip, app killed). Stalwart per-account
-  // rate-limits PushVerification posts, so leaving stragglers around blocks
-  // the new one's verification - the symptom is a confusing "code does not
-  // match". Only reap matches for THIS account's deviceClientId; other
-  // accounts' subscriptions on this server (rare but possible if the same
-  // JMAP server backs multiple accounts) must be left alone.
-  const stragglers = existingSubs.filter(
-    (s) => s.deviceClientId === deviceClientId && s.id !== storedServerId,
-  );
-  for (const s of stragglers) {
-    await destroyPushSubscription(s.id).catch(() => undefined);
+  // Reap leftover Stalwart subscriptions that would otherwise starve the new
+  // one's verification. Stalwart emits only one PushVerification per account
+  // per ~60s and picks the oldest unverified subscription, so a single stale
+  // straggler blocks every fresh attempt - the symptom is the confusing
+  // "Timed out waiting for PushVerification" error. We can't read a
+  // subscription's verified state or URL over JMAP (Stalwart hides both), only
+  // its deviceClientId, so we decide what's safe to remove like this:
+  //   - same deviceClientId as ours: a previous attempt from THIS device,
+  //     always safe to reap.
+  //   - a different deviceClientId: could be another live device or the PWA on
+  //     this account. Ask the relay whether it's still alive and only reap the
+  //     ones it confirms are dead. Anything live - or anything the relay can't
+  //     vouch for (a different relay, a non-Bulwark client, a network blip) -
+  //     is left untouched.
+  for (const s of existingSubs) {
+    if (s.id === storedServerId) continue;
+    if (s.deviceClientId === deviceClientId) {
+      await destroyPushSubscription(s.id).catch(() => undefined);
+      continue;
+    }
+    if (await relayReportsDead(relayBaseUrl, s.deviceClientId)) {
+      await destroyPushSubscription(s.id).catch(() => undefined);
+    }
   }
 
   const serverAssignedId = await createPushSubscription({

src/stores/__tests__/calendar-store.test.ts

@@ -129,6 +129,42 @@ describe('calendar-store', () => {
       expect(stored[0].originalId).toBe('ev1');
       expect(stored[0].accountId).toBe('acc-2');
     });
+
+    it('routes queries by account when own and shared calendars share a raw id', async () => {
+      // The user's own "default" calendar and a family group's "default"
+      // calendar collide on the raw JMAP id. The shared one is namespaced
+      // (`acc-2:default`, originalId "default"); the query must use the raw id
+      // against acc-2, and the returned event's calendarIds must be remapped to
+      // the namespaced store id so it isn't hidden with the personal calendar.
+      useCalendarStore.setState({
+        calendars: [
+          { id: 'default', name: 'Personal' } as any,
+          { id: 'acc-2:default', originalId: 'default', name: 'Family', accountId: 'acc-2', isShared: true } as any,
+        ],
+      });
+      const queried: Record<string, string[]> = {};
+      mockQueryEvents.mockImplementation(async (ids: string[], _a: string, _b: string, accountId?: string) => {
+        queried[accountId ?? 'primary'] = ids;
+        return accountId === 'acc-2' ? ['fam1'] : [];
+      });
+      mockGetEvents.mockImplementation(async (_ids: string[], accountId?: string) =>
+        accountId === 'acc-2'
+          ? [{ id: 'fam1', title: 'Soccer', start: '2026-03-20T15:00:00', calendarIds: { default: true } }]
+          : [],
+      );
+
+      await useCalendarStore.getState().fetchEvents(['default', 'acc-2:default'], '2026-03-01', '2026-03-31');
+
+      // The shared account is queried with the raw calendar id, not the prefix.
+      expect(queried['acc-2']).toEqual(['default']);
+      const ev = useCalendarStore.getState().events[0];
+      expect(ev.calendarIds).toEqual({ 'acc-2:default': true });
+
+      // Hiding the personal "default" must not hide the family event.
+      useCalendarStore.setState({ hiddenCalendarIds: ['default'] });
+      const visible = selectVisibleEvents(useCalendarStore.getState());
+      expect(visible.map((e) => e.id)).toContain('acc-2:fam1');
+    });
   });
 
   describe('ensureRange', () => {

src/stores/calendar-store.ts

@@ -25,6 +25,37 @@ function hasSchedulingParticipants(event?: Partial<CalendarEvent> | null): boole
 
 const HIDDEN_CALENDARS_STORAGE_KEY = 'webmail:calendar:hidden:v1';
 
+// Map a server CalendarEvent onto its store representation. For events from a
+// shared/group account the JMAP id is only unique within that account, so we
+// namespace `id` (stashing the real id in originalId) and remap the event's
+// `calendarIds` from raw server ids onto the namespaced store calendar ids so
+// visibility filtering and per-calendar colour lookup line up. Events from the
+// primary account are returned unchanged. Mirrors webmail's
+// mapServerEventToStoreEvent.
+function mapServerEventToStoreEvent(
+  event: CalendarEvent,
+  calendars: Calendar[],
+  accountId?: string,
+): CalendarEvent {
+  if (!accountId) return event;
+  const mapped: Record<string, boolean> = {};
+  for (const [calId, included] of Object.entries(event.calendarIds || {})) {
+    const cal = calendars.find(
+      (c) => (c.originalId || c.id) === calId && c.accountId === accountId,
+    );
+    mapped[cal?.id || calId] = included;
+  }
+  return {
+    ...event,
+    id: `${accountId}:${event.id}`,
+    originalId: event.id,
+    originalCalendarIds: event.calendarIds,
+    calendarIds: Object.keys(mapped).length > 0 ? mapped : event.calendarIds,
+    accountId,
+    isShared: true,
+  };
+}
+
 export interface LoadedRange {
   after: string;
   before: string;
@@ -135,14 +166,20 @@ export const useCalendarStore = create<CalendarState>()(
     try {
       // Group the requested calendars by owning account: the primary account
       // (calendars without an accountId tag) plus one group per shared
-      // account, since CalendarEvent/query is scoped to a single account.
+      // account, since CalendarEvent/query is scoped to a single account. The
+      // incoming ids are store ids (shared calendars are namespaced
+      // `${accountId}:${id}`); map them back to the raw server ids the query
+      // filter expects.
       const calendars = get().calendars;
+      const byId = new Map(calendars.map((c) => [c.id, c]));
       const groups = new Map<string | undefined, string[]>();
       for (const id of calendarIds) {
-        const accountId = calendars.find((c) => c.id === id)?.accountId;
+        const cal = byId.get(id);
+        const accountId = cal?.accountId;
+        const serverId = cal?.originalId || id;
         const group = groups.get(accountId);
-        if (group) group.push(id);
-        else groups.set(accountId, [id]);
+        if (group) group.push(serverId);
+        else groups.set(accountId, [serverId]);
       }
       if (groups.size === 0) groups.set(undefined, []);
 
@@ -152,17 +189,7 @@ export const useCalendarStore = create<CalendarState>()(
           const eventIds = (await queryEvents(ids, after, before, accountId)) ?? [];
           if (eventIds.length === 0) continue;
           const fetched = (await fetchEvents(eventIds, accountId)) ?? [];
-          // Shared/group accounts: JMAP object ids are only unique *within* an
-          // account, so two accounts can return events with the same id.
-          // Namespace shared ids with the owning accountId (stashing the real id
-          // in originalId for mutations) so they don't collide with the user's
-          // own events in the store / React keys. Mirrors webmail's
-          // mapServerEventToStoreEvent.
-          raw.push(
-            ...(accountId
-              ? fetched.map((e) => ({ ...e, accountId, id: `${accountId}:${e.id}`, originalId: e.id }))
-              : fetched),
-          );
+          raw.push(...fetched.map((e) => mapServerEventToStoreEvent(e, calendars, accountId)));
         } catch (err) {
           // A failing shared account must not hide the user's own events.
           if (!accountId) throw err;
@@ -235,20 +262,22 @@ export const useCalendarStore = create<CalendarState>()(
   },
 
   createEvent: async (event, calendarId) => {
-    // Shared calendars live in the owner's account — route the create there.
-    const accountId = get().calendars.find((c) => c.id === calendarId)?.accountId;
+    // Shared calendars live in the owner's account — route the create there,
+    // and against the calendar's raw server id (calendarId is the namespaced
+    // store id for shared calendars).
+    const calendars = get().calendars;
+    const cal = calendars.find((c) => c.id === calendarId);
+    const accountId = cal?.accountId;
     const created = await apiCreateEvent(
       event,
-      calendarId,
+      cal?.originalId || calendarId,
       hasSchedulingParticipants(event) ? true : undefined,
       accountId,
     );
-    // Namespace shared/group event ids the same way fetchEvents does so the
-    // optimistic insert doesn't collide with the user's own events.
-    const storeCreated = accountId
-      ? { ...created, accountId, id: `${accountId}:${created.id}`, originalId: created.id }
-      : created;
-    set({ events: [...get().events, storeCreated] });
+    // Map the same way fetchEvents does so the optimistic insert doesn't
+    // collide with the user's own events and stays visible under the right
+    // calendar filter.
+    set({ events: [...get().events, mapServerEventToStoreEvent(created, calendars, accountId)] });
     return created;
   },
 
@@ -300,20 +329,26 @@ export const useCalendarStore = create<CalendarState>()(
 
   importEvents: async (events, calendarId) => {
     if (events.length === 0) return 0;
+    // Shared calendars live in the owner's account and carry a namespaced
+    // store id — resolve the raw server id + owning account so dedup and
+    // create target the right place.
+    const cal = get().calendars.find((c) => c.id === calendarId);
+    const accountId = cal?.accountId;
+    const serverCalendarId = cal?.originalId || calendarId;
     // Stalwart enforces UID uniqueness across calendars. Skip events whose UID
     // already exists; create the rest. (We don't attempt cross-calendar linking
     // on mobile — a duplicate is simply skipped.)
     let toCreate = events;
     try {
-      const existingIds = await queryEvents([], '', '');
-      const existing = existingIds.length > 0 ? await fetchEvents(existingIds) : [];
+      const existingIds = await queryEvents([], '', '', accountId);
+      const existing = existingIds.length > 0 ? await fetchEvents(existingIds, accountId) : [];
       const seenUids = new Set(existing.map((e) => e.uid).filter(Boolean) as string[]);
       toCreate = events.filter((e) => !e.uid || !seenUids.has(e.uid));
     } catch {
       // Couldn't dedupe — proceed and let the server reject genuine dupes.
     }
     if (toCreate.length === 0) return 0;
-    const count = await apiBatchCreateEvents(toCreate, calendarId);
+    const count = await apiBatchCreateEvents(toCreate, serverCalendarId, accountId);
     await get().refresh();
     return count;
   },
@@ -326,7 +361,7 @@ export const useCalendarStore = create<CalendarState>()(
 
   setDefaultCalendar: async (id) => {
     const cal = get().calendars.find((c) => c.id === id);
-    await apiSetDefaultCalendar(id, cal?.accountId);
+    await apiSetDefaultCalendar(cal?.originalId || id, cal?.accountId);
     set({
       calendars: get().calendars.map((c) => {
         if (c.id === id) return { ...c, isDefault: true };
@@ -341,8 +376,13 @@ export const useCalendarStore = create<CalendarState>()(
   },
 
   createTask: async (task, calendarId) => {
-    const accountId = get().calendars.find((c) => c.id === calendarId)?.accountId;
-    await apiCreateEvent({ ...task, '@type': 'Task' }, calendarId, undefined, accountId);
+    const cal = get().calendars.find((c) => c.id === calendarId);
+    await apiCreateEvent(
+      { ...task, '@type': 'Task' },
+      cal?.originalId || calendarId,
+      undefined,
+      cal?.accountId,
+    );
     await get().refresh();
   },