File the message on screen into a listing's history #9

New issue

Open

opened 2026-10-01 07:21:58 +00:00 by tiagoagueda · 0 comments

tiagoagueda commented

2026-10-01 07:21:58 +00:00

Owner

Postulo already has two calls made for a mail client, and nothing uses them. A listing has a history (postulo/postulo#270), and a token with the listings:bind scope may add to it: "a mail client filing the message somebody is reading", in the core's own words. That scope reaches these two calls and nothing else:

GET /api/v1/listings/choices: the person's listings, as little of each as recognising it takes (a title, a company, a place, a state), narrowed by words in the title or the company's name.
POST /api/v1/listings/{id}/events: an entry in a listing's history, of a kind such as email_received, with a summary, a body, when it happened and an external_id. Sent again with the same external_id, the first entry comes back and nothing is added.

A recruiter's reply about a posting already in Postulo is not a new posting to capture (#1); it belongs in that listing's history.

What the extension should do

In the popup, beside capturing: file this message. Search the person's listings, pick one, and add the message to its history: the subject as the summary, the date it was sent, and the message's own Message-ID as the external_id, so that filing one message twice leaves one entry.
The token needs listings:bind as well as captures. Test already lists a token's scopes; it should say which of the two things each allows, and the popup offers only what the token can do.
Offer the listing that matches first: the sender's company, words of the subject.

Decisions

How much of the message goes. The whole text, its first lines, or the subject alone. It is kept on the server and shown on the listing's page. Recommended: the text without quoted replies and signatures, shown before it is sent, with a switch to send the subject alone.
Messages the person sent. Recommended: filed too, once the history has a kind for them; the kinds a client may write are the ones the call accepts.
One token or two. Recommended: one token holding both scopes, since it is one extension on one profile.

Privacy

A filed message's text leaves Thunderbird for the person's own Postulo. PRIVACY.md and the README say so, as for capturing.

Needs from the server

Nothing: both calls exist. Not filed on postulo/postulo.

Done when

A message is filed into a chosen listing's history from the popup and shows on that listing's page; filing it again adds nothing.
With a token lacking listings:bind, the popup does not offer it and the settings say why.
test/i18n.test.mjs requires every new key in every language the extension ships, with identical placeholders: three today, more once #7 lands.

Not in the list of improvements of 2026-09-30; filed with it because the core has had these calls waiting for a mail client since postulo/postulo#270.

Postulo already has two calls made for a mail client, and nothing uses them. A listing has a history (postulo/postulo#270), and a token with the `listings:bind` scope may add to it: "a mail client filing the message somebody is reading", in the core's own words. That scope reaches these two calls and nothing else: - `GET /api/v1/listings/choices`: the person's listings, as little of each as recognising it takes (a title, a company, a place, a state), narrowed by words in the title or the company's name. - `POST /api/v1/listings/{id}/events`: an entry in a listing's history, of a kind such as `email_received`, with a summary, a body, when it happened and an `external_id`. Sent again with the same `external_id`, the first entry comes back and nothing is added. A recruiter's reply about a posting already in Postulo is not a new posting to capture (#1); it belongs in that listing's history. ## What the extension should do - In the popup, beside capturing: **file this message**. Search the person's listings, pick one, and add the message to its history: the subject as the summary, the date it was sent, and the message's own `Message-ID` as the `external_id`, so that filing one message twice leaves one entry. - **The token needs `listings:bind`** as well as `captures`. *Test* already lists a token's scopes; it should say which of the two things each allows, and the popup offers only what the token can do. - Offer the listing that matches first: the sender's company, words of the subject. ## Decisions - **How much of the message goes.** The whole text, its first lines, or the subject alone. It is kept on the server and shown on the listing's page. Recommended: the text without quoted replies and signatures, shown before it is sent, with a switch to send the subject alone. - **Messages the person sent.** Recommended: filed too, once the history has a kind for them; the kinds a client may write are the ones the call accepts. - **One token or two.** Recommended: one token holding both scopes, since it is one extension on one profile. ## Privacy A filed message's text leaves Thunderbird for the person's own Postulo. PRIVACY.md and the README say so, as for capturing. ## Needs from the server Nothing: both calls exist. Not filed on postulo/postulo. ## Done when - A message is filed into a chosen listing's history from the popup and shows on that listing's page; filing it again adds nothing. - With a token lacking `listings:bind`, the popup does not offer it and the settings say why. - `test/i18n.test.mjs` requires every new key in every language the extension ships, with identical placeholders: three today, more once #7 lands. Not in the list of improvements of 2026-09-30; filed with it because the core has had these calls waiting for a mail client since postulo/postulo#270.

tiagoagueda added the

enhancement

label

2026-10-01 07:21:58 +00:00

tiagoagueda referenced this issue

2026-10-17 10:40:22 +00:00

SEC2-085: The extension asks for a captures token, while the threat model's mail-client row promises listings:bind and nothing else #14

tiagoagueda referenced this issue

2026-10-17 10:40:25 +00:00

SEC2-087: The API token sits in storage.local in clear, outside Thunderbird's primary password, and the privacy text does not say so #16

tiagoagueda referenced this issue from a commit

2026-10-19 07:09:37 +00:00