Linus Rath
cd3005e036
fix: offer undo in the main window after archiving or deleting in a message window
2026-11-04 06:03:07 +01:00
Linus Rath
ec4fd9c529
fix: keep mail shortcuts working after a click into an HTML message
2026-11-04 06:03:05 +01:00
Linus Rath
c49c68ffbd
Merge branch 'feat/desktop-offline' into feat/do-proxy-fixes
2026-11-04 04:12:23 +01:00
Linus Rath
8cd9d72558
Merge branch 'feat/desktop-offline' into feat/do-proxy-fixes
2026-11-04 03:55:52 +01:00
Linus Rath
bce0c0b744
Merge branch 'feat/desktop-offline' into feat/do-keystore-fixes
2026-11-04 03:52:09 +01:00
Linus Rath
7443654459
Merge branch 'feat/do-package-fixes' into feat/desktop-offline
2026-11-04 03:43:04 +01:00
Linus Rath
92e6ee1bfa
Merge branch 'feat/do-trust-fixes' into feat/desktop-offline
2026-11-04 03:43:04 +01:00
Linus Rath
be8aba2ae7
Merge remote-tracking branch 'origin/main' into feat/desktop-offline
...
# Conflicts:
# stores/auth-store.ts
2026-11-04 03:42:18 +01:00
Linus Rath
d3308e7729
Merge branch 'feat/desktop-offline' into feat/do-keystore-fixes
...
# Conflicts:
# lib/desktop/__tests__/policy-schema.test.ts
2026-11-04 03:31:22 +01:00
Linus Rath
2f846bb2da
fix: list the browser sign-in budget as shared server state
2026-11-04 03:30:48 +01:00
Linus Rath
9b61b79d5c
fix: sign only CMS signed attributes through api.keystore, and ask a user about a managed plugin's keystore
...
The shell now takes a message's signed attributes where it took a digest,
so a page can't get a login or TLS digest signed. A quiet option lets a
plugin answer from what's allowed, for anything the user didn't ask for.
An admin's install no longer covers the certificates on someone's own
computer: a managed plugin gets `keystore` when that person says yes, also
when an update adds it, and it's forgotten once everyone has signed out.
Changed test assertions: the fixture plugin needs a grant now, as managed
alone is no longer enough, and the bridge gets an options argument.
2026-11-04 03:23:45 +01:00
Linus Rath
b1f26a93bf
feat: let an organisation turn the system certificate store off by policy
2026-11-04 03:23:44 +01:00
Linus Rath
484ce34f5d
Merge branch 'feat/do-browser-signin' into feat/desktop-offline
2026-11-04 03:19:32 +01:00
Linus Rath
cb9a5ac810
Merge branch 'feat/do-edit-attachments' into feat/desktop-offline
2026-11-04 03:16:35 +01:00
Linus Rath
466fa7f974
fix: keep the desktop app's session secret and admin password out of its server's environment
2026-11-04 03:15:42 +01:00
Linus Rath
a9e33ec2d6
fix: stop a page wiping another account's plugin secrets by naming it in the desktop app
...
A wipe by name took any username and server with no session behind it. It
now needs a sealed cookie the account got while it was signed in, since a
dropped account has no session cookie left. The old wipe test asserted that
a name alone was enough, which is the behaviour being removed.
2026-11-04 03:15:35 +01:00
Linus Rath
149d08d87b
test: load the preview route once before its cases, so a slow import can't spill into them
2026-11-04 03:13:59 +01:00
Linus Rath
f39cff2377
fix: call no relay from the worker in no-third-party mode, and handle several accounts in one push side by side
2026-11-04 03:13:59 +01:00
Linus Rath
d8e2a4f42c
fix: keep a waiting re-sync from undoing what another tab turned off, and note the relay on refresh
2026-11-04 03:13:59 +01:00
Linus Rath
9432345440
fix: keep a nothing-new notification from closing or replacing a real one
2026-11-04 03:13:59 +01:00
Linus Rath
8cb218ce3c
fix: apply email notifications off and do not disturb per login, not to every login's mail
2026-11-04 03:13:59 +01:00
Linus Rath
248f9c261b
fix: take down push for logins with no connection when signing out of everything
2026-11-04 03:13:59 +01:00
Linus Rath
9bc31b54ab
fix: keep notifications generic after the browser closed when the organisation has idle limits
2026-11-04 03:13:59 +01:00
Linus Rath
6dbda4424e
fix: stop a stuck push setup from holding up every tab and login
2026-11-04 03:13:58 +01:00
Linus Rath
bc8653de8b
fix: only replace a browser subscription on the relay's own answer, and move the other logins along
2026-11-04 03:13:58 +01:00
Linus Rath
226b9383ce
fix: show a generic notification instead of guessing which login a push is for
2026-11-04 03:13:58 +01:00
Linus Rath
f0617a61b1
fix: only treat a server subscription as this browser's when its device id matches
2026-11-04 03:13:58 +01:00
Linus Rath
6ffa0a3715
fix: show the real sender and subject for a push after the browser was closed
2026-11-04 03:13:57 +01:00
Linus Rath
5c62c57657
fix: replace a browser subscription the push service gave up on
2026-11-04 03:13:57 +01:00
Linus Rath
a6ef818149
fix: end a login's push registration when it signs out, is removed or wiped
2026-11-04 03:13:57 +01:00
Linus Rath
8b4fb72357
fix: say in plain words why push could not be turned on or off
2026-11-04 03:13:57 +01:00
Linus Rath
d520af51b2
fix: restore push when the browser replaces its subscription with no tab open
2026-11-04 03:13:56 +01:00
Linus Rath
8a69c35206
fix: open a notification in the app window, not a pop-out or a frame
2026-11-04 03:13:56 +01:00
Linus Rath
33249ca57a
fix: show a notification even if building it fails
2026-11-04 03:13:56 +01:00
Linus Rath
2c462c304e
fix: show the right preview when an account id is in more than one login
2026-11-04 03:13:56 +01:00
Linus Rath
fc6a209727
fix: keep push notifications off screen with email notifications off or do not disturb on
2026-11-04 03:13:56 +01:00
Linus Rath
7fb0242a7b
fix: open the new message from its notification however much older mail is unread
2026-11-04 03:13:56 +01:00
Linus Rath
376465ed80
fix: notify for every account a state-change push names
2026-11-04 03:13:56 +01:00
Linus Rath
6ca6448b5e
fix: remove the record from the old relay when push moves to another one
2026-11-04 03:13:56 +01:00
Linus Rath
2551823006
fix: let tabs take turns setting up push so two can't race into two subscriptions
2026-11-04 03:13:55 +01:00
Linus Rath
4586f16c2e
fix: remove the unverified subscription when push verification fails, and poll through a network blip
2026-11-04 03:13:55 +01:00
Linus Rath
3a805d1631
fix: restart push verification when the mail server skipped it after a quick off and on
2026-11-04 03:13:55 +01:00
Linus Rath
37d0200e43
Merge branch 'feat/desktop-offline' into feat/do-browser-signin
2026-11-04 03:11:34 +01:00
Linus Rath
a048cb3553
fix: stop an approved mail server sending the desktop app to a server nobody approved
2026-11-04 03:10:26 +01:00
Linus Rath
1c201b0772
fix: stop private files with odd casing and links reaching Docker builds
2026-11-04 03:04:12 +01:00
Linus Rath
7f50113b90
fix: ask to clear a desktop app lock this profile has no PIN for
2026-11-04 02:57:04 +01:00
Linus Rath
7f3d9c5073
fix: let npm run build pass its guard, with the build run in CI
2026-11-04 02:45:46 +01:00
Linus Rath
97c0bd633a
Merge branch 'feat/desktop-offline' into feat/do-edit-attachments
...
# Conflicts:
# lib/desktop/languages.ts
# locales/ar/common.json
# locales/ca/common.json
# locales/cs/common.json
# locales/da/common.json
# locales/de/common.json
# locales/en/common.json
# locales/es/common.json
# locales/et/common.json
# locales/fa/common.json
# locales/fr/common.json
# locales/he/common.json
# locales/hu/common.json
# locales/it/common.json
# locales/ja/common.json
# locales/ko/common.json
# locales/lv/common.json
# locales/mn/common.json
# locales/nb/common.json
# locales/nl/common.json
# locales/pl/common.json
# locales/pt/common.json
# locales/ro/common.json
# locales/ru/common.json
# locales/sk/common.json
# locales/th/common.json
# locales/tr/common.json
# locales/uk/common.json
# locales/vi/common.json
# locales/zh-TW/common.json
# locales/zh/common.json
2026-11-04 02:40:47 +01:00
Linus Rath
ab21bf2df3
fix: keep a desktop sign-in in the browser's page until the user says yes
...
The hand-off parked a password before its question, for up to five
minutes, and on a shared computer another local user could ask for
someone's sign-in with a link of their own. Now nothing leaves the page
before the yes, and the instance has a switch for such machines.
- `/check` tests a password and keeps nothing, `/park` runs on the yes and
hands over tokens wherever the server allows, a password as a last
resort
- `/discard` and a timer take out what SSO has to park first, and a no
revokes the refresh token, and the shared store's TTL is the real expiry
- `DESKTOP_BROWSER_SIGN_IN`, default on, closes the routes, the page's
hand-off and the app's button; the question says which device asked
- tokens from a typed password stay a password account under the name
typed (#1432 )
- redeem refuses a server of the user's own when the device's rule says
no
- the park budget is reserved before going upstream, and only failures
count
- "Not now" ends the flow in the app at once, and the question names the
account
`desktop-handoff-routes.test.ts` now tests the two-step flow against the
real budgets. `sso-start-route.test.ts`'s config mock answers the new
setting, and the SSO test's expected answer has the account in it.
2026-11-04 02:40:37 +01:00
Linus Rath
d31d0af560
fix: say what an open program still holds, keep forwarded parts under their rules, and let main decide what a sent draft leaves
2026-11-04 02:36:48 +01:00
Linus Rath