chore: update version number to 0.1.89

.maestro/features/07-move-delete-tag.yaml

@@ -81,24 +81,23 @@ tags:
     commands:
       - tapOn: "More actions.*"
 - tapOn: "Star|Unstar"
-# A bulk action ends selection mode by itself once the server has the
-# change, so the bar stays up for a moment: wait for it to go rather than
-# tap Clear selection (the tap can land after the bar is gone).
-- extendedWaitUntil:
-    notVisible: "Clear selection"
-    timeout: 15000
+# A bulk action ends selection mode by itself.
+- runFlow:
+    when:
+      visible: "Clear selection"
+    commands:
+      - tapOn: "Clear selection"
 - longPressOn:
     id: email-row
     text: ".*Grüße aus München.*"
-- extendedWaitUntil:
-    visible: "Clear selection"
-    timeout: 10000
 - runFlow:
     when:
       notVisible: "Unstar|Star"
     commands:
       - tapOn: "More actions.*"
 - tapOn: "Unstar|Star"
-- extendedWaitUntil:
-    notVisible: "Clear selection"
-    timeout: 15000
+- runFlow:
+    when:
+      visible: "Clear selection"
+    commands:
+      - tapOn: "Clear selection"

.maestro/features/13-settings-more.yaml

@@ -16,9 +16,6 @@ tags:
 # Each Q matches its page near the top. A PROOF the search lists under the
 # row would pass on the iPad without the page, so those differ. The Themes
 # cards are one element each, named by the theme: check the page's text.
-# "Storage" also finds Account and Files, which puts Storage & backup third,
-# under the keyboard in landscape (a tap there types on the keys): search
-# "Offline", which only that page has.
 - runFlow: {file: ../subflows/settings-page.yaml, env: {NAME: folders, ROW: "Folders, .*", Q: "New folder", PROOF: ".*Inbox.*"}}
 - runFlow: {file: ../subflows/settings-page.yaml, env: {NAME: tags, ROW: "Tags, .*", Q: "Tags", PROOF: "Email Tags"}}
 - runFlow: {file: ../subflows/settings-page.yaml, env: {NAME: downloads, ROW: "Downloads, .*", Q: "Downloads", PROOF: "Email .*eml.* filename"}}
@@ -29,7 +26,7 @@ tags:
 - runFlow: {file: ../subflows/settings-page.yaml, env: {NAME: files, ROW: "Files, .*", Q: "Files", PROOF: "Default View"}}
 - runFlow: {file: ../subflows/settings-page.yaml, env: {NAME: sidebar-apps, ROW: "Sidebar Apps, .*", Q: "Sidebar", PROOF: "Keep Apps Loaded"}}
 - runFlow: {file: ../subflows/settings-page.yaml, env: {NAME: themes, ROW: "Themes, .*", Q: "Themes", PROOF: "Pick a colou?r theme.*"}}
-- runFlow: {file: ../subflows/settings-page.yaml, env: {NAME: storage, ROW: "Storage & backup, .*", Q: "Offline", PROOF: "Offline mail.*"}}
+- runFlow: {file: ../subflows/settings-page.yaml, env: {NAME: storage, ROW: "Storage & backup, .*", Q: "Storage", PROOF: "Offline mail.*"}}
 - runFlow: {file: ../subflows/settings-page.yaml, env: {NAME: about, ROW: "About, .*", Q: "About", PROOF: "This device"}}
 - tapOn:
     id: tab-mail

.maestro/subflows/settings-page.yaml

@@ -18,8 +18,8 @@ appId: org.bulwarkmail.mobile
       - inputText: ${Q}
       - waitForAnimationToEnd:
           timeout: 3000
-      # Now and then the simulator drops or garbles a typed character:
-      # type it again, a few times if need be.
+      # Now and then the simulator drops or garbles a typed character
+      # (seen: "Storagew,"): type it again, a few times if need be.
       - repeat:
           while:
             notVisible: ${ROW}

VERSION

@@ -1 +1 @@
-0.1.87
+0.1.89

app.config.js

@@ -57,12 +57,13 @@ module.exports = {
       supportsTablet: true,
       bundleIdentifier: 'org.bulwarkmail.mobile',
       buildNumber: IOS_BUILD_NUMBER,
-      config: {
-        // PGP and S/MIME (#58) add end-to-end encryption beyond HTTPS/TLS,
-        // so the app declares non-exempt encryption; App Store Connect asks
-        // for the export compliance documentation on upload.
-        usesNonExemptEncryption: true,
-      },
+      // No usesNonExemptEncryption here. PGP and S/MIME (#58) are non-exempt
+      // encryption, but only standard algorithms from open-source libraries
+      // and the app is not on the French store, so App Store Connect keeps no
+      // declaration and has no ITSEncryptionExportComplianceCode to give. An
+      // Info.plist saying YES without that code fails upload validation
+      // (90592), so the key stays out and scripts/testflight-public.mjs
+      // answers the question for each build through the API.
     },
     android: {
       adaptiveIcon: {

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "bulwark-mobile",
-  "version": "0.1.87",
+  "version": "0.1.89",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "bulwark-mobile",
-      "version": "0.1.87",
+      "version": "0.1.89",
       "hasInstallScript": true,
       "license": "AGPL-3.0-only",
       "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "bulwark-mobile",
-  "version": "0.1.87",
+  "version": "0.1.89",
   "license": "AGPL-3.0-only",
   "main": "index.ts",
   "scripts": {

scripts/e2e/failed-steps.mjs

@@ -43,16 +43,14 @@ function findHierarchy(obj, seen = new Set()) {
   return null;
 }
 
-// Maestro 1 writes commands-<flow>.json, Maestro 2 <flow>/commands.json.
-for (const file of walkFiles(root).filter((f) => /(^|[\\/])commands(-[^\\/]*)?\.json$/.test(f))) {
+for (const file of walkFiles(root).filter((f) => /commands-.*\.json$/.test(f))) {
   let data;
   try {
     data = JSON.parse(fs.readFileSync(file, 'utf8'));
   } catch {
     continue;
   }
-  const base = path.basename(file);
-  out.push(`== ${base === 'commands.json' ? `${path.basename(path.dirname(file))} / ${base}` : base}`);
+  out.push(`== ${path.basename(file)}`);
   for (const entry of Array.isArray(data) ? data : []) {
     const command = entry.command || {};
     const type = Object.keys(command).find((k) => command[k]) || '?';

scripts/e2e/run-flows.sh

@@ -8,8 +8,8 @@
 # $OUT/screenshots, $OUT/run.mp4, $OUT/app.log, $OUT/steps.txt.
 #
 # Each flow runs in its own Maestro process with a time cap: when the XCTest
-# driver dies (it does, now and then), only that flow is affected: it runs
-# once more with a fresh driver, and the next flow starts a fresh one too.
+# driver dies (it does, now and then), only that flow fails and the next one
+# starts a fresh driver.
 #
 # Secrets: Maestro's debug output holds every typed text, passwords included,
 # and artifacts of this public repo are public. Only the warm-up (which types
@@ -75,43 +75,23 @@ if [ $STATUS -eq 0 ]; then
   fi
 
   FAILED=()
-  RETRIED=()
   for f in "${FLOWS[@]}"; do
     name=$(basename "$f" .yaml)
-    # When the XCTest driver dies during a flow ("Device became unreachable"),
-    # the flow gets one more try in a fresh Maestro process, which starts a
-    # new driver. Any other failure (an assertion, a missing element, the
-    # time cap) stays a failure. The driver's death shows in Maestro's log in
-    # the flow's debug output (never uploaded; grep -q prints nothing). Piping
-    # Maestro's console output instead loses the failure reasons it prints.
-    for attempt in 1 2; do
-      suffix=""
-      [ $attempt -gt 1 ] && suffix="-retry"
-      started=$(date +%s)
-      echo "::group::$name$suffix"
-      (cd "$OUT/screenshots" && capped maestro --device "$UDID" test \
-        --format junit --output "$OUT/junit/$name.xml" \
-        --debug-output "$DEBUG_DIR/$name$suffix" \
-        "${ARGS[@]}" "$f")
-      rc=$?
-      echo "::endgroup::"
-      echo "$name$suffix: exit $rc after $(( $(date +%s) - started )) s"
-      [ $rc -eq 0 ] && break
-      [ $attempt -eq 2 ] && break
-      grep -rqE 'DeviceUnreachableException|Device became unreachable|Transport unreachable' \
-        "$DEBUG_DIR/$name$suffix" 2>/dev/null || break
-      echo "::warning::$name: the Maestro driver became unreachable, running the flow once more"
-      RETRIED+=("$name")
-    done
+    started=$(date +%s)
+    echo "::group::$name"
+    (cd "$OUT/screenshots" && capped maestro --device "$UDID" test \
+      --format junit --output "$OUT/junit/$name.xml" \
+      --debug-output "$DEBUG_DIR/$name" \
+      "${ARGS[@]}" "$f")
+    rc=$?
+    echo "::endgroup::"
+    echo "$name: exit $rc after $(( $(date +%s) - started )) s"
     if [ $rc -ne 0 ]; then
       FAILED+=("$name")
       # What the screen showed when it failed.
       xcrun simctl io "$UDID" screenshot "$OUT/screenshots/FAILED-$name.png" >/dev/null 2>&1 || true
     fi
   done
-  if [ ${#RETRIED[@]} -gt 0 ]; then
-    echo "::warning::Flows run again after the driver died: ${RETRIED[*]}"
-  fi
   if [ ${#FAILED[@]} -gt 0 ]; then
     echo "::error::Failed flows: ${FAILED[*]}"
     STATUS=1

scripts/testflight-public.mjs

@@ -99,7 +99,7 @@ if (!group) {
 // ── Wait for the build ─────────────────────────────────────────
 const query =
   `/v1/builds?filter[app]=${app.id}&filter[version]=${encodeURIComponent(buildNumber)}` +
-  `&filter[preReleaseVersion.version]=${encodeURIComponent(version)}&fields[builds]=version,processingState`;
+  `&filter[preReleaseVersion.version]=${encodeURIComponent(version)}&fields[builds]=version,processingState,usesNonExemptEncryption`;
 const started = Date.now();
 let build;
 for (;;) {
@@ -121,6 +121,18 @@ for (;;) {
 }
 console.log(`Build ${version} (${buildNumber}) is processed.`);
 
+// ── Export compliance ──────────────────────────────────────────
+// The app uses non-exempt encryption (PGP and S/MIME, #58) with standard
+// algorithms only and is not on the French store: App Store Connect needs no
+// documentation, so Info.plist has no key and the answer is given here.
+if (build.attributes.usesNonExemptEncryption == null) {
+  const answer = await api('PATCH', `/v1/builds/${build.id}`, {
+    data: { type: 'builds', id: build.id, attributes: { usesNonExemptEncryption: true } },
+  });
+  if (!answer.ok) fail('Answering export compliance', answer);
+  console.log('Export compliance answered: standard encryption, no documentation needed.');
+}
+
 // ── Add it to the group ────────────────────────────────────────
 const add = await api('POST', `/v1/betaGroups/${group.id}/relationships/builds`, {
   data: [{ type: 'builds', id: build.id }],
@@ -150,7 +162,7 @@ const detail = await api('GET', `/v1/builds/${build.id}/buildBetaDetail`);
 if (!detail.ok) fail('Reading the build state', detail);
 const external = detail.json.data.attributes.externalBuildState;
 if (external === 'MISSING_EXPORT_COMPLIANCE') {
-  console.error('The build has no export compliance answer; set usesNonExemptEncryption in app.config.js.');
+  console.error('The build still has no export compliance answer; answer it in App Store Connect > TestFlight.');
   process.exit(1);
 }
 if (external === 'READY_FOR_BETA_SUBMISSION') {

src/components/email/structured-mail/__tests__/structured-mail-banner.test.ts

@@ -15,6 +15,7 @@ vi.mock('../booking-calendar-actions', async () => {
 });
 
 import type { Email } from '../../../../api/types';
+import { usePolicyStore } from '../../../../stores/policy-store';
 import { useSettingsStore } from '../../../../stores/settings-store';
 import { StructuredMailBanner } from '../StructuredMailBanner';
 import { byTestId, render, textOf } from './render-native';
@@ -37,7 +38,11 @@ function mail(ar: string | null, subject = 'Your order'): Email {
 }
 
 const initialSettings = useSettingsStore.getState();
-afterEach(() => useSettingsStore.setState(initialSettings, true));
+const initialPolicy = usePolicyStore.getState();
+afterEach(() => {
+  useSettingsStore.setState(initialSettings, true);
+  usePolicyStore.setState(initialPolicy, true);
+});
 
 describe('StructuredMailBanner', () => {
   it('shows the order card of a verified mail', () => {
@@ -67,6 +72,8 @@ describe('StructuredMailBanner', () => {
   });
 
   it('loads product images only when remote content would load', () => {
+    // The webmail's config is known and allows third-party traffic.
+    usePolicyStore.setState({ configPending: false, links: {} });
     useSettingsStore.setState({ externalContentPolicy: 'block', trustedSenders: [] });
     expect(byTestId(render(createElement(StructuredMailBanner, { email: mail(PASS) })), 'structured-mail-item-image')).toHaveLength(0);
     useSettingsStore.setState({ trustedSenders: ['orders@shop.example'] });
@@ -74,4 +81,12 @@ describe('StructuredMailBanner', () => {
     useSettingsStore.setState({ externalContentPolicy: 'allow', trustedSenders: [] });
     expect(byTestId(render(createElement(StructuredMailBanner, { email: mail(PASS) })), 'structured-mail-item-image')).toHaveLength(1);
   });
+
+  it('loads no product images while the webmail config is unknown or forbids third-party traffic', () => {
+    useSettingsStore.setState({ externalContentPolicy: 'allow', trustedSenders: [] });
+    usePolicyStore.setState({ configPending: true, links: {} });
+    expect(byTestId(render(createElement(StructuredMailBanner, { email: mail(PASS) })), 'structured-mail-item-image')).toHaveLength(0);
+    usePolicyStore.setState({ configPending: false, links: { noThirdPartyTraffic: true } });
+    expect(byTestId(render(createElement(StructuredMailBanner, { email: mail(PASS) })), 'structured-mail-item-image')).toHaveLength(0);
+  });
 });

src/lib/__tests__/export-compliance.test.ts

@@ -2,13 +2,22 @@ import { describe, expect, it } from 'vitest';
 import fs from 'node:fs';
 import path from 'node:path';
 
-// With PGP and S/MIME in the app (#58) the encryption is no longer only
-// HTTPS/TLS, so the App Store export compliance answer must say so.
+// PGP and S/MIME (#58) are non-exempt encryption with standard algorithms, and
+// the app is not on the French store, so App Store Connect has no declaration
+// and no compliance code. Info.plist must not claim YES (upload validation
+// rejects it without the code, 90592) nor NO (that would be untrue); the
+// TestFlight script answers per build instead.
+
+const root = path.resolve(__dirname, '../../..');
 
 describe('export compliance', () => {
-  it('declares non-exempt encryption for iOS', () => {
-    const src = fs.readFileSync(path.resolve(__dirname, '../../../app.config.js'), 'utf8');
-    expect(src).toMatch(/usesNonExemptEncryption: true/);
-    expect(src).not.toMatch(/usesNonExemptEncryption: false/);
+  it('leaves the encryption key out of the iOS config', () => {
+    const src = fs.readFileSync(path.join(root, 'app.config.js'), 'utf8');
+    expect(src).not.toMatch(/usesNonExemptEncryption\s*:/);
+  });
+
+  it('answers non-exempt encryption for each TestFlight build', () => {
+    const src = fs.readFileSync(path.join(root, 'scripts/testflight-public.mjs'), 'utf8');
+    expect(src).toMatch(/attributes: \{ usesNonExemptEncryption: true \}/);
   });
 });