From b83de657d7365372fedf22a89470b7bc75aa7856 Mon Sep 17 00:00:00 2001 From: John Coffey Date: Tue, 1 Sep 2026 22:24:03 -0700 Subject: [PATCH] Gather the privacy settings into a section of their own General had grown five unrelated headings and was where anything without an obvious home ended up. Remote images were filed under "Reading", the read-receipt policy under "Composing", the undo-send window beside the default message format. They are the same kind of decision -- what reaches a sender, and what asks before something happens -- and they were the hardest settings in the app to find. Privacy & safety now holds all six, in three groups: remote content, read receipts, and the things that ask before it is too late. General keeps what it is actually about and is thirty lines shorter. The line against Security & sessions is worth stating, because two similar words next to each other in a nav is how a menu becomes something people hunt through. Security & sessions is credentials and access: password, two-factor state, app passwords, live sessions. Privacy & safety is how the app behaves towards the reader and towards senders. Nothing moved in storage. Settings are a flat object in settings.json and sections are only how they are grouped on screen, so this is a UI change with no migration and no key renames. Two things beyond the move. The senders trusted with remote images are now listed and can be withdrawn one at a time. A sender was added from a message and could then only be removed by finding another message from that same sender, which is not a way to review a list you cannot see. And General's lead said settings are stored in this browser, which is only true when the server has no FileNode support. They normally live in the account's own Files and follow it between devices, so the sentence contradicted the feature it sat above. --- .gitignore | 3 + FEATURES.md | 17 ++- web/src/styles/app.css | 3 + web/src/views/settings/GeneralSettings.tsx | 36 +----- web/src/views/settings/PrivacySettings.tsx | 93 +++++++++++++++ web/src/views/settings/SettingsView.tsx | 4 +- .../__tests__/privacy-settings.test.tsx | 107 ++++++++++++++++++ 7 files changed, 227 insertions(+), 36 deletions(-) create mode 100644 web/src/views/settings/PrivacySettings.tsx create mode 100644 web/src/views/settings/__tests__/privacy-settings.test.tsx diff --git a/.gitignore b/.gitignore index 117c18b..9ab5d28 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,6 @@ dist/ server/data/ .vite/ coverage/ + +# Worktrees used by parallel agents; never part of a commit. +.claude/worktrees/ diff --git a/FEATURES.md b/FEATURES.md index 17b8ce0..28849ce 100644 --- a/FEATURES.md +++ b/FEATURES.md @@ -654,7 +654,8 @@ not reach another that already has ihasmail open until it signs in again. | Section | Holds | | --- | --- | -| **General** | Reading pane, mark-as-read delay, auto-advance, remote images, conversation view, snippets, avatars, confirm-before-delete; compose format, undo-send window, quoting, signature placement, attachment reminder, read-receipt policy, spell check; time zone, week start, language & region, date format, time format; `mailto:` handler; export / import / reset | +| **General** | Reading pane, mark-as-read delay, auto-advance, conversation view, snippets, avatars; compose format, quoting, signature placement, spell check; time zone, week start, language & region, date format, time format; `mailto:` handler; export / import / reset | +| **Privacy & safety** | Remote images and the senders trusted with them, read receipts asked for and answered, undo-send window, attachment reminder, confirm-before-delete | | **Appearance** | Theme, accent colour, density, font size, sidebar, swipe actions, interface language | | **Identities & signatures** | Addresses, names, Reply-To, HTML signatures, the default, and which to hide from the picker | | **Filters & rules** | The visual builder and raw Sieve editor | @@ -668,6 +669,20 @@ not reach another that already has ihasmail open until it signs in again. | **Keyboard shortcuts** | The full list, grouped | | **About** | Version, source URL, server, and the capabilities it advertises | +**Privacy & safety is separate from Security & sessions**, and the line +between them is worth stating because two similar words in one nav is how a +menu becomes something people hunt through. Security & sessions is credentials +and access: password, two-factor state, app passwords, live sessions. Privacy & +safety is how the app behaves towards the reader and towards senders: what +loads, what leaks, and what asks before it happens. These had been spread +through General, which had grown five unrelated headings — remote images filed +under "Reading", the read-receipt policy under "Composing", the undo-send window +beside the default message format. + +The senders trusted with remote images are listed there and can be withdrawn +one at a time. Previously a sender was added from a message and could only be +removed by finding another message from the same sender. + Settings **export** to a JSON file and **import** back, and reset to defaults. ## Dates, times and locale diff --git a/web/src/styles/app.css b/web/src/styles/app.css index dc349c6..01e0d01 100644 --- a/web/src/styles/app.css +++ b/web/src/styles/app.css @@ -1376,3 +1376,6 @@ button.dp-open:disabled { cursor: default; opacity: .5; } .composer-field label .link-btn { background: none; border: 0; padding: 0; font: inherit; color: inherit; cursor: pointer; text-decoration: underline; text-decoration-style: dotted; text-underline-offset: 3px; } .composer-field label .link-btn:hover { color: var(--accent); } .composer-field label .link-btn:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; border-radius: 3px; } + +/* The senders whose remote images load without asking, in Privacy & safety. */ +.trusted-senders { display: flex; flex-wrap: wrap; gap: 6px; margin-bottom: 6px; } diff --git a/web/src/views/settings/GeneralSettings.tsx b/web/src/views/settings/GeneralSettings.tsx index 8b323e1..aa204fb 100644 --- a/web/src/views/settings/GeneralSettings.tsx +++ b/web/src/views/settings/GeneralSettings.tsx @@ -1,4 +1,4 @@ -import { useSettings, type ReadReceiptPolicy } from "@/store/settings"; +import { useSettings } from "@/store/settings"; import { Switch } from "@/ui/misc"; import { browserTimeZone, listTimeZones } from "@/lib/dates"; import { toast } from "@/ui/toast"; @@ -47,7 +47,7 @@ export function GeneralSettings() { return (

{t("General")}

-

{t("Reading, sending and list behaviour. Settings are stored in this browser.")}

+

{t("Reading, sending, and how dates and times are shown. What reaches a sender lives in Privacy & safety.")}

{t("Reading")}

@@ -76,19 +76,10 @@ export function GeneralSettings() {
-
- - -
update({ conversationMode: v })} label={t("Conversation view")} hint={t("Group messages from the same thread together.")} /> update({ showPreview: v })} label={t("Show message snippets")} hint={t("Preview the first line of each message in the list.")} /> update({ showAvatars: v })} label={t("Show sender avatars")} /> - update({ confirmDelete: v })} label={t("Confirm before deleting")} />

{t("Composing")}

@@ -99,32 +90,9 @@ export function GeneralSettings() {
-
- - -
update({ includeQuote: v })} label={t("Quote original message in replies")} /> update({ signatureAboveQuote: v })} label={t("Place signature above quoted text")} /> - update({ attachmentReminder: v })} label={t("Attachment reminder")} hint={t("Warn when the message mentions an attachment but none is attached.")} /> - update({ requestReadReceipt: v })} label={t("Always request read receipts")} /> -
- - -

- - {t("A receipt tells whoever asked that this address is live and when the message was read, and the sender chooses where it goes — so there is no automatic option. Bulk mail, mailing lists and anything marked auto-submitted are never offered one at all.")} -

-
update({ spellcheck: v })} label={t("Spell check while typing")} />

{t("Locale")}

diff --git a/web/src/views/settings/PrivacySettings.tsx b/web/src/views/settings/PrivacySettings.tsx new file mode 100644 index 0000000..94c0cd5 --- /dev/null +++ b/web/src/views/settings/PrivacySettings.tsx @@ -0,0 +1,93 @@ +import { useSettings, type ReadReceiptPolicy } from "@/store/settings"; +import { Switch } from "@/ui/misc"; +import { X } from "lucide-react"; +import { t } from "@/lib/i18n"; + +/** + * Everything about what reaches a sender, and what asks before it happens. + * + * These settings were spread through General, which had grown into five + * unrelated headings -- remote images filed under "Reading", the read-receipt + * policy under "Composing", the undo-send window beside the default message + * format. They are the same kind of decision and they belong together, and + * gathering them leaves General smaller as well. + * + * The boundary against **Security & sessions** is worth keeping sharp, since + * two similar words next to each other in a nav is how a menu becomes + * something people hunt through: that section is credentials and access -- + * password, two-factor, app passwords, live sessions. This one is how the app + * behaves towards the reader and towards senders. + */ +export function PrivacySettings() { + const s = useSettings((st) => st.settings); + const update = useSettings((st) => st.update); + const trusted = s.trustedImageSenders; + + return ( +
+

{t("Privacy & safety")}

+

{t("What reaches a sender, and what asks before it happens.")}

+ +

{t("Remote content")}

+
+ + +

+ {t("An image loaded from a sender's server tells them the message was opened, when, and from roughly where. Approved images are fetched by ihasmail's own server rather than the browser, so the sender learns none of those.")} +

+
+ {trusted.length > 0 && ( +
+ +
+ {trusted.map((addr) => ( + + {addr} + + + ))} +
+

{t("Added from a message, and removable here — previously the only way to undo one was to find another message from the same sender.")}

+
+ )} + +

{t("Read receipts")}

+ update({ requestReadReceipt: v })} label={t("Always request read receipts")} /> +
+ + +

+ {t("A receipt tells whoever asked that this address is live and when the message was read, and the sender chooses where it goes — so there is no automatic option. Bulk mail, mailing lists and anything marked auto-submitted are never offered one at all.")} +

+
+ +

{t("Before it happens")}

+
+ + +

{t("The message is held in this browser and has not been submitted yet, so taking it back costs nothing.")}

+
+ update({ attachmentReminder: v })} label={t("Attachment reminder")} hint={t("Warn when the message mentions an attachment but none is attached.")} /> + update({ confirmDelete: v })} label={t("Confirm before deleting")} /> +
+ ); +} diff --git a/web/src/views/settings/SettingsView.tsx b/web/src/views/settings/SettingsView.tsx index 4878997..58c8113 100644 --- a/web/src/views/settings/SettingsView.tsx +++ b/web/src/views/settings/SettingsView.tsx @@ -1,6 +1,6 @@ import { lazy, Suspense, type ReactNode } from "react"; import { Link, useLocation } from "wouter"; -import { ArrowLeft, Bell, Filter, Folder, Info, Keyboard, LayoutTemplate, Palette, PenLine, Plane, Settings as SettingsIcon, ShieldCheck, Tag, Users, Calendar } from "lucide-react"; +import { ArrowLeft, Bell, EyeOff, Filter, Folder, Info, Keyboard, LayoutTemplate, Palette, PenLine, Plane, Settings as SettingsIcon, ShieldCheck, Tag, Users, Calendar } from "lucide-react"; import { Spinner } from "@/ui/misc"; import { GeneralSettings } from "./GeneralSettings"; import { AppearanceSettings } from "./AppearanceSettings"; @@ -9,6 +9,7 @@ import { FoldersSettings } from "./FoldersSettings"; import { LabelsSettings } from "./LabelsSettings"; import { TemplatesSettings } from "./TemplatesSettings"; import { NotificationsSettings } from "./NotificationsSettings"; +import { PrivacySettings } from "./PrivacySettings"; import { SecuritySettings } from "./SecuritySettings"; import { AboutSettings } from "./AboutSettings"; import { ShortcutsSettings } from "./ShortcutsSettings"; @@ -29,6 +30,7 @@ const SECTIONS: Array<{ id: string; label: string; icon: ReactNode; el: ReactNod { id: "templates", label: "Templates", icon: , el: }, { id: "calendar", label: "Calendar & contacts", icon: , el: }, { id: "notifications", label: "Notifications", icon: , el: }, + { id: "privacy", label: "Privacy & safety", icon: , el: }, { id: "security", label: "Security & sessions", icon: , el: }, { id: "shortcuts", label: "Keyboard shortcuts", icon: , el: }, { id: "about", label: "About", icon: , el: }, diff --git a/web/src/views/settings/__tests__/privacy-settings.test.tsx b/web/src/views/settings/__tests__/privacy-settings.test.tsx new file mode 100644 index 0000000..e0950a8 --- /dev/null +++ b/web/src/views/settings/__tests__/privacy-settings.test.tsx @@ -0,0 +1,107 @@ +import { act } from "react"; +import { createRoot, type Root } from "react-dom/client"; +import { afterEach, beforeEach, describe, expect, it } from "vitest"; +import { PrivacySettings } from "../PrivacySettings"; +import { GeneralSettings } from "../GeneralSettings"; +import { useSettings, DEFAULT_SETTINGS } from "@/store/settings"; + +(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true; + +/** + * The point of the section is that nothing was lost on the way out of General. + * A setting that stops being reachable is still stored, still applied, and + * impossible to change -- which is worse than leaving it where it was. + */ +describe("Privacy & safety", () => { + let host: HTMLDivElement; + let root: Root; + + const render = async (el: React.ReactNode) => { + await act(async () => { + root.render(el); + }); + }; + + beforeEach(() => { + host = document.createElement("div"); + document.body.appendChild(host); + root = createRoot(host); + useSettings.setState({ settings: { ...DEFAULT_SETTINGS } }); + }); + + afterEach(async () => { + await act(async () => root.unmount()); + host.remove(); + }); + + it("offers every control that left General", async () => { + await render(); + const text = host.textContent ?? ""; + expect(text).toContain("Remote images"); + expect(text).toContain("Always request read receipts"); + expect(text).toContain("When someone requests a read receipt"); + expect(text).toContain("Undo send window"); + expect(text).toContain("Attachment reminder"); + expect(text).toContain("Confirm before deleting"); + }); + + it("leaves none of them behind in General", async () => { + await render(); + const text = host.textContent ?? ""; + for (const gone of [ + "Remote images", + "Always request read receipts", + "When someone requests a read receipt", + "Undo send window", + "Attachment reminder", + "Confirm before deleting", + ]) { + expect(text, `${gone} is in both sections`).not.toContain(gone); + } + }); + + it("keeps General's own settings where they were", async () => { + await render(); + const text = host.textContent ?? ""; + expect(text).toContain("Reading pane"); + expect(text).toContain("Conversation view"); + expect(text).toContain("Default format"); + expect(text).toContain("Spell check while typing"); + }); + + it("writes through to the same stored settings the old controls used", async () => { + await render(); + const select = [...host.querySelectorAll("select")].find((el) => + [...el.options].some((o) => o.value === "always"), + ); + expect(select, "remote images select").toBeTruthy(); + await act(async () => { + select!.value = "always"; + select!.dispatchEvent(new Event("change", { bubbles: true })); + }); + expect(useSettings.getState().settings.imagePolicy).toBe("always"); + }); + + it("hides the trusted-sender list until there is one", async () => { + await render(); + expect(host.textContent).not.toContain("Always showing images from"); + + await act(async () => { + useSettings.setState({ settings: { ...DEFAULT_SETTINGS, trustedImageSenders: ["ada@example.com"] } }); + }); + await render(); + expect(host.textContent).toContain("Always showing images from"); + expect(host.textContent).toContain("ada@example.com"); + }); + + it("removes a trusted sender, which nothing outside a message could do before", async () => { + useSettings.setState({ settings: { ...DEFAULT_SETTINGS, trustedImageSenders: ["ada@example.com", "bob@example.com"] } }); + await render(); + const remove = host.querySelector('button[aria-label*="ada@example.com"]'); + expect(remove, "remove button").toBeTruthy(); + await act(async () => { + remove!.dispatchEvent(new MouseEvent("click", { bubbles: true })); + }); + expect(useSettings.getState().settings.trustedImageSenders).toEqual(["bob@example.com"]); + }); +});