setDraft({ ...draft, name: event.target.value })} /> setDraft({ ...draft, slug: event.target.value })} placeholder="Generated from name" />

setDraft({ ...draft, description: event.target.value })} /></FormField>
      </div>

{policyMessages.length > 0 && (
        <DismissibleAlert tone="warning" resetKey={policyMessages.map((item) => `${item.key}:${item.value}`).join("|")} dismissible={false}>
          <strong>Effective mail policy blocks the current profile values.</strong>
          <ul>{policyMessages.map((item) => <li key={`${item.key}:${item.value}`}>{item.message}</li>)}</ul>
        </DismissibleAlert>
      )}

<MailServerSettingsPanel
        smtp={{ host: draft.smtpHost, port: draft.smtpPort, security: draft.smtpSecurity, timeout_seconds: draft.smtpTimeout }}
        imap={{ host: draft.imapHost, port: draft.imapPort, security: draft.imapSecurity, sent_folder: draft.imapSentFolder, timeout_seconds: draft.imapTimeout }}
        smtpCredentials={{ username: draft.smtpUsername, password: draft.smtpPassword }}
        imapCredentials={{ username: draft.imapUsername, password: draft.imapPassword }}
        onSmtpChange={patchSmtpSettings}
        onImapChange={patchImapSettings}
        onSmtpCredentialsChange={patchSmtpCredentials}
        onImapCredentialsChange={patchImapCredentials}
        smtpDisabled={disabled}
        smtpCredentialDisabled={credentialDisabled}
        smtpPasswordSaved={Boolean(existingProfile?.smtp_password_configured)}
        imapServerDisabled={disabled}
        imapCredentialDisabled={credentialDisabled}
        imapPasswordSaved={Boolean(existingProfile?.imap_password_configured)}
        imapActionDisabled={disabled || !draftHasImap}
        smtpTestLabel={useSavedSmtpTest ? "Test saved SMTP" : "Test SMTP"}
        imapTestLabel={useSavedImapTest ? "Test saved IMAP" : "Test IMAP"}
        busyAction={mailActionState}
        onTestSmtp={() => void runSmtpTest()}
        onTestImap={() => void runImapTest()}
        onLookupFolders={() => void runFolderLookup()}
        smtpTestResult={smtpTestResult}
        imapTestResult={imapTestResult}
        folderLookupResult={folderResult}
        onUseDetectedFolder={useDetectedSentFolder}
        useDetectedFolderDisabled={disabled || !draftHasImap}
      />
    </div>
  );
}

function pluralizeLabel(label: string): string {
  if (label.endsWith("s")) return label;
  if (label.endsWith("y")) return `${label.slice(0, -1)}ies`;
  return `${label}s`;
}

function emptyProfileDraft(): ProfileDraft {
  return {
    name: "",
    slug: "",
    description: "",
    isActive: true,
    smtpHost: "",
    smtpPort: "587",
    smtpSecurity: "starttls",
    smtpUsername: "",
    smtpPassword: "",
    smtpTimeout: "30",
    imapHost: "",
    imapPort: "993",
    imapSecurity: "tls",
    imapUsername: "",
    imapPassword: "",
    imapSentFolder: "auto",
    imapTimeout: "30"
  };
}

function profileToDraft(profile: MailServerProfile): ProfileDraft {
  return {
    name: profile.name,
    slug: profile.slug,
    description: profile.description || "",
    isActive: profile.is_active,
    smtpHost: stringValue(profile.smtp.host),
    smtpPort: stringValue(profile.smtp.port ?? 587),
    smtpSecurity: readSecurity(String(profile.smtp.security || "starttls"), "starttls"),
    smtpUsername: stringValue(profile.credentials?.smtp?.username ?? profile.smtp.username),
    smtpPassword: "",
    smtpTimeout: stringValue(profile.smtp.timeout_seconds ?? 30),
    imapHost: stringValue(profile.imap?.host),
    imapPort: stringValue(profile.imap?.port ?? 993),
    imapSecurity: readSecurity(String(profile.imap?.security || "tls"), "tls"),
    imapUsername: stringValue(profile.credentials?.imap?.username ?? profile.imap?.username),
    imapPassword: "",
    imapSentFolder: stringValue(profile.imap?.sent_folder || "auto"),
    imapTimeout: stringValue(profile.imap?.timeout_seconds ?? 30)
  };
}

function createProfilePayload(draft: ProfileDraft, scopeType: MailProfileScope, scopeId: string | null): MailServerProfilePayload {
  return {
    name: draft.name.trim(),
    slug: mailTextOrNull(draft.slug),
    description: mailTextOrNull(draft.description),
    is_active: draft.isActive,
    scope_type: scopeType,
    scope_id: scopeId,
    smtp: smtpServerPayload(draft),
    imap: hasDraftImapSettings(draft) ? imapServerPayload(draft) : null,
    credentials: profileCredentialsPayload(draft, false)
  };
}

function updateProfilePayload(draft: ProfileDraft, profile: MailServerProfile): MailServerProfileUpdatePayload {
  return {
    name: draft.name.trim(),
    slug: mailTextOrNull(draft.slug),
    description: draft.description.trim(),
    is_active: draft.isActive,
    smtp: smtpServerPayload(draft),
    imap: hasDraftImapSettings(draft) ? imapServerPayload(draft) : null,
    credentials: profileCredentialsPayload(draft, true),
    clear_imap: !hasDraftImapSettings(draft) && Boolean(profile.imap)
  };
}

function smtpServerPayload(draft: ProfileDraft): MailSmtpTestPayload {
  return mailSmtpSettingsPayload<MailSecurity>(
    { host: draft.smtpHost, port: draft.smtpPort, security: draft.smtpSecurity, timeout_seconds: draft.smtpTimeout },
    { fallbackSecurity: "starttls", allowedSecurity: securityOptions },
  );
}

function imapServerPayload(draft: ProfileDraft): MailImapTestPayload {
  return mailImapSettingsPayload<MailSecurity>(
    { host: draft.imapHost, port: draft.imapPort, security: draft.imapSecurity, sent_folder: draft.imapSentFolder, timeout_seconds: draft.imapTimeout },
    { fallbackSecurity: "tls", allowedSecurity: securityOptions },
  );
}

function profileCredentialsPayload(draft: ProfileDraft, preserveBlankPassword: boolean) {
  return {
    smtp: mailTransportCredentialsPayload(draft.smtpUsername, draft.smtpPassword, preserveBlankPassword),
    imap: mailTransportCredentialsPayload(draft.imapUsername, draft.imapPassword, preserveBlankPassword)
  };
}

function rawSmtpPayload(draft: ProfileDraft, preserveBlankPassword: boolean): MailSmtpTestPayload {
  return { ...smtpServerPayload(draft), ...mailTransportCredentialsPayload(draft.smtpUsername, draft.smtpPassword, preserveBlankPassword) };
}

function rawImapPayload(draft: ProfileDraft, preserveBlankPassword: boolean): MailImapTestPayload {
  return { ...imapServerPayload(draft), ...mailTransportCredentialsPayload(draft.imapUsername, draft.imapPassword, preserveBlankPassword) };
}

function hasDraftImapSettings(draft: ProfileDraft): boolean {
  return hasMailImapSettings([draft.imapHost, draft.imapUsername, draft.imapPassword]);
}

function normalizePolicy(value: MailProfilePolicy | null | undefined): MailProfilePolicy {
  return {
    allowed_profile_ids: [...(value?.allowed_profile_ids ?? [])].filter(Boolean),
    allow_user_profiles: value?.allow_user_profiles ?? null,
    allow_group_profiles: value?.allow_group_profiles ?? null,
    allow_campaign_profiles: value?.allow_campaign_profiles ?? null,
    smtp_credentials: normalizeCredentialPolicy(value?.smtp_credentials),
    imap_credentials: normalizeCredentialPolicy(value?.imap_credentials),
    whitelist: normalizeRules(value?.whitelist),
    blacklist: normalizeRules(value?.blacklist),
    allow_lower_level_limits: normalizeMailLowerLevelLimits(value?.allow_lower_level_limits)
  };
}

function normalizePolicyForSave(policy: MailProfilePolicy, parentPolicy: MailProfilePolicy | null, scopeType: MailProfileScope): MailProfilePolicy {
  const normalized = normalizePolicy(policy);
  if (scopeType === "system") return concreteSystemPolicy(normalized);
  const localLimits = { ...(normalized.allow_lower_level_limits ?? {}) };
  const parentLimits = parentPolicy?.allow_lower_level_limits ?? null;

function parentAllows(key: MailProfilePolicyLimitKey): boolean {
    return !parentLimits || parentLimits[key] !== false;
  }

function clearLimit(key: MailProfilePolicyLimitKey) {
    delete localLimits[key];
  }

if (!parentAllows("allowed_profile_ids")) {
    normalized.allowed_profile_ids = [];
    clearLimit("allowed_profile_ids");
  }
  for (const key of ["allow_user_profiles", "allow_group_profiles", "allow_campaign_profiles"] as const) {
    if (!parentAllows(key)) {
      normalized[key] = null;
      clearLimit(key);
    }
  }
  for (const protocol of ["smtp_credentials", "imap_credentials"] as const) {
    const credential = normalizeCredentialPolicy(normalized[protocol]);
    const inheritKey = `${protocol}.inherit` as MailProfilePolicyLimitKey;
    if (!parentAllows(inheritKey)) {
      credential.inherit = null;
      clearLimit(inheritKey);
    }
    normalized[protocol] = credential;
  }
  for (const key of mailProfilePatternKeys) {
    const whitelistKey = `whitelist.${key}` as MailProfilePolicyLimitKey;
    const blacklistKey = `blacklist.${key}` as MailProfilePolicyLimitKey;
    if (!parentAllows(whitelistKey)) {
      delete normalized.whitelist?.[key];
      clearLimit(whitelistKey);
    }
    if (!parentAllows(blacklistKey)) {
      delete normalized.blacklist?.[key];
      clearLimit(blacklistKey);
    }
  }
  if (scopeType === "campaign") {
    normalized.allow_lower_level_limits = {};
  } else {
    normalized.allow_lower_level_limits = localLimits;
  }
  return normalized;
}

function concreteSystemPolicy(policy: MailProfilePolicy): MailProfilePolicy {
  const normalized = normalizePolicy(policy);
  return {
    ...normalized,
    allow_user_profiles: normalized.allow_user_profiles ?? true,
    allow_group_profiles: normalized.allow_group_profiles ?? true,
    allow_campaign_profiles: normalized.allow_campaign_profiles ?? true,
    smtp_credentials: concreteSystemCredentialPolicy(normalized.smtp_credentials),
    imap_credentials: concreteSystemCredentialPolicy(normalized.imap_credentials),
    allow_lower_level_limits: fullMailLowerLevelLimits(normalized.allow_lower_level_limits)
  };
}

function concreteSystemCredentialPolicy(value: MailCredentialPolicy | null | undefined): MailCredentialPolicy {
  const normalized = normalizeCredentialPolicy(value);
  return { inherit: normalized.inherit ?? true };
}

function normalizeCredentialPolicy(value: MailCredentialPolicy | null | undefined): MailCredentialPolicy {
  return { inherit: typeof value?.inherit === "boolean" ? value.inherit : null };
}

function profileBelongsToEditableScope(profile: MailServerProfile, scopeType: MailProfileScope, scopeId: string | null): boolean {
  if (profile.scope_type !== scopeType) return false;
  if (scopeType === "system") return true;
  if (scopeType === "tenant") return true;
  return Boolean(scopeId) && profile.scope_id === scopeId;
}

function scopeOrder(scopeType: MailProfileScope): number {
  if (scopeType === "system") return 0;
  if (scopeType === "tenant") return 1;
  if (scopeType === "user" || scopeType === "group") return 2;
  return 3;
}

function credentialInheritanceToValue(value: boolean | null | undefined): CredentialInheritanceValue {
  if (value === true) return "profile";
  if (value === false) return "local";
  return "inherit";
}

function valueToCredentialInheritance(value: CredentialInheritanceValue): boolean | null {
  if (value === "profile") return true;
  if (value === "local") return false;
  return null;
}

function policyHelp(description: string): ReactNode {
  return <span>{description}</span>;
}

type PolicySourceItem = {
  label: string;
  policy?: MailProfilePolicy | Record<string, unknown> | null;
};

function mailBooleanPolicyPathHelp(key: "allow_user_profiles" | "allow_group_profiles" | "allow_campaign_profiles", sources: PolicySourcePathItem[]): ReactNode {
  return <PolicyPathHelp lines={mailBooleanPolicyPathLines(key, normalizePolicySourceItems(sources))} />;
}

function mailCredentialPolicyPathHelp(protocol: "smtp_credentials" | "imap_credentials", sources: PolicySourcePathItem[]): ReactNode {
  return <PolicyPathHelp lines={mailCredentialPolicyPathLines(protocol, normalizePolicySourceItems(sources))} />;
}

function PolicyPathHelp({ lines }: { lines: string[] }) {
  return (
    <span className="policy-path-help">
      {lines.map((line, index) => <span className="policy-path-help-line" key={`${line}-${index}`}>{line}</span>)}
    </span>
  );
}

function policySourceRecord(item: PolicySourceItem): Record<string, unknown> {
  return asRecord(item.policy);
}

function asRecord(value: unknown): Record<string, unknown> {
  return value && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : {};
}

function policyPathPrefix(index: number): string {
  return index === 0 ? "" : `${"  ".repeat(index - 1)}> `;
}

function effectiveBooleanLabel(value: boolean | null | undefined, policy: MailProfilePolicy | null): string {
  if (!policy) return "Loading...";
  return value ? "Allowed" : "Blocked";
}

function credentialInheritanceLabel(value: MailCredentialPolicy | null | undefined): string {
  return value?.inherit === false ? "Local required" : "Profile inherited";
}

function patternPolicyNote(key: MailProfilePatternKey): string {
  if (key === "smtp_hosts") return "SMTP server host patterns.";
  if (key === "imap_hosts") return "IMAP server host patterns.";
  if (key === "envelope_senders") return "SMTP envelope sender patterns.";
  if (key === "from_headers") return "Visible From header patterns.";
  return "Recipient domain patterns.";
}

function booleanToFlag(value: boolean | null | undefined): PolicyFlagValue {
  if (value === true) return "allow";
  if (value === false) return "deny";
  return "inherit";
}

function flagToBoolean(value: PolicyFlagValue): boolean | null {
  if (value === "allow") return true;
  if (value === "deny") return false;
  return null;
}

function patternsToText(value: string[] | undefined): string {
  return (value ?? []).join("\n");
}

function effectiveProfileLabel(value: string[] | null | undefined): string {
  if (!value || value.length === 0) return "No explicit intersection";
  return `${value.length} profile(s)`;
}

function mailPolicySourcePath(scopeType: MailProfileScope): string[] {
  if (scopeType === "system") return ["System"];
  if (scopeType === "tenant") return ["System", "Tenant"];
  if (scopeType === "user") return ["System", "Tenant", "User"];
  if (scopeType === "group") return ["System", "Tenant", "Group"];
  return ["System", "Tenant", "Owner policy", "Campaign"];
}

function scopeLabel(profile: MailServerProfile): string {
  if (profile.scope_type === "system") return "System";
  if (profile.scope_type === "tenant") return "Tenant";
  if (profile.scope_type === "user") return "User";
  if (profile.scope_type === "group") return "Group";
  return "Campaign";
}

function readSecurity(value: string, fallback: MailSecurity): MailSecurity {
  return normalizeMailServerSecurity<MailSecurity>(value, { fallback, allowedSecurity: securityOptions });
}

function stringValue(value: unknown): string {
  if (value === null || value === undefined) return "";
  return String(value);
}

function errorMessage(err: unknown): string {
  return err instanceof Error ? err.message : String(err);
}

Profile allow-list

Lower-level mail definitions

Credential inheritance

Wildcard rules

Policy path