feat(filesharing): accept signer name from passport/idcard/drivinglicence

Replace the previous (PR #239) mandatory pbdf.gemeente.personalData.fullname
disclosure with a Yivi disjunction-of-conjunctions: the signer must
disclose a name, but they may satisfy that from any one of four
credentials -- gemeente fullname, OR firstName+lastName from
pbdf.pbdf.{passport,idcard,drivinglicence}.

This addresses dobby's review of #239: requiring only the gemeente
credential silently locked out everyone without a Dutch municipality
attestation. The disjunction is mandatory -- disclosure refuses to
complete unless at least one option is satisfied. Optional
mobilenumber and dateofbirth remain unchanged.

The disjunction lives in a new signAttributes.ts module exporting a
typed AttrConItem[] consumed by SendButton.svelte. Splitting it out
keeps the component file focused and the attribute list reviewable
in isolation.

Locale copy updates flagged by dobby on en.json/nl.json:
- emailSenderSubHeading describes the four-credential rule.
- yiviTip no longer frames the name as optional.

The $derived.by + (!canEncrypt) call-site fixes from #239 are preserved.

Depends on encryption4all/postguard#198 (PKG), postguard-js#78
(sign.yivi attrs), and cryptify#170 (render firstName+lastName).
Supersedes #239 in this repo.

npm run check: 0 errors, 0 warnings.

Author: rubenhensen

src/lib/components/filesharing/SendButton.svelte

@@ -19,6 +19,7 @@
     import { MAX_UPLOAD_SIZE, ROLLING_LIMIT } from '$lib/env'
     import { parseLimitExceededBody, bytesToGB } from '$lib/usage'
     import { recordUpload, getLocalUsedBytes } from '$lib/localUsage'
+    import { SIGN_ATTRIBUTES } from './signAttributes'
 
     interface props {
         encryptState: EncryptState
@@ -37,7 +38,7 @@
     const emailRegex =
         /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/
 
-    let canEncrypt = $derived(() => {
+    let canEncrypt = $derived.by(() => {
         if (encryptState.files.length === 0) return false
         const totalSize = encryptState.files.reduce((a, f) => a + f.size, 0)
         if (totalSize >= MAX_UPLOAD_SIZE) return false
@@ -138,7 +139,7 @@
         await tick()
 
         try {
-            if (!canEncrypt()) return
+            if (!canEncrypt) return
 
             // Build recipients
             const recipients = encryptState.recipients.map(
@@ -151,23 +152,13 @@
                 }
             )
 
-            // Build sign method — email always included, other attributes optional
+            // Build sign method — email and a name attribute are always
+            // required so the recipient mail can show a real name. The
+            // name may come from any one of four credentials; see
+            // signAttributes.ts for the disjunction.
             const sign = pg.sign.yivi({
                 element: '#crypt-irma-qr',
-                attributes: [
-                    {
-                        t: 'pbdf.gemeente.personalData.fullname',
-                        optional: true,
-                    },
-                    {
-                        t: 'pbdf.sidn-pbdf.mobilenumber.mobilenumber',
-                        optional: true,
-                    },
-                    {
-                        t: 'pbdf.gemeente.personalData.dateofbirth',
-                        optional: true,
-                    },
-                ],
+                attributes: SIGN_ATTRIBUTES,
                 includeSender: true,
             })
 

src/lib/components/filesharing/signAttributes.ts

@@ -0,0 +1,37 @@
+import type { AttrConItem } from '@e4a/pg-js'
+
+/**
+ * Yivi attributes the sender must (or may) disclose when signing a
+ * PostGuard file share. The PostGuard PKG prepends the email attribute,
+ * so it's not listed here.
+ *
+ * The first entry is the **mandatory name disjunction** — the sender
+ * proves their name from any one of four credentials:
+ *
+ *   - `pbdf.gemeente.personalData.fullname` (Dutch municipality), OR
+ *   - `pbdf.pbdf.passport.{firstName,lastName}`, OR
+ *   - `pbdf.pbdf.idcard.{firstName,lastName}`, OR
+ *   - `pbdf.pbdf.drivinglicence.{firstName,lastName}`.
+ *
+ * The remaining entries are unchanged optional extras from before
+ * postguard#239 — kept in the legacy flat shape with `optional: true`.
+ */
+export const SIGN_ATTRIBUTES: AttrConItem[] = [
+    [
+        [{ t: 'pbdf.gemeente.personalData.fullname' }],
+        [
+            { t: 'pbdf.pbdf.passport.firstName' },
+            { t: 'pbdf.pbdf.passport.lastName' },
+        ],
+        [
+            { t: 'pbdf.pbdf.idcard.firstName' },
+            { t: 'pbdf.pbdf.idcard.lastName' },
+        ],
+        [
+            { t: 'pbdf.pbdf.drivinglicence.firstName' },
+            { t: 'pbdf.pbdf.drivinglicence.lastName' },
+        ],
+    ],
+    { t: 'pbdf.sidn-pbdf.mobilenumber.mobilenumber', optional: true },
+    { t: 'pbdf.gemeente.personalData.dateofbirth', optional: true },
+]

src/lib/locales/en.json

@@ -202,15 +202,15 @@
             "emailSender": "Email address",
             "emailSenderHeading": "Your information",
             "emailSenderSubHeadingToggle": "Why do you need this information?",
-            "emailSenderSubHeading": "Let the recipient(s) know these files are from you. Before sending, you sign the files by proving your email address and any additional personal data with the Yivi app.",
+            "emailSenderSubHeading": "Let the recipient(s) know these files are from you. Before sending, you sign the files with the Yivi app by proving your email address and your name (from a Dutch municipality credential, or from a passport, ID card, or driving licence).",
             "messageHeading": "Message (optional)",
             "messageText": "This message will not be encrypted and will be included in the notification email.",
             "messagePlaceholder": "Type your message here...",
             "encryptSend": "Sign & send",
             "yiviInfo": "What is Yivi?",
             "yiviInfoText": "Yivi is a free and privacy-friendly authentication app. With Yivi you can prove who you are by selectively sharing personal data, such as your email address, phone number, or name. At PostGuard we use Yivi to securely encrypt and decrypt files.",
             "yiviInfoLink": "Learn more about Yivi",
-            "yiviTip": "Tip: In the Yivi app you can add optional data. This way you let the recipient(s) know for sure that these files come from you.",
+            "yiviTip": "Tip: In the Yivi app you can also add an optional phone number or date of birth. This way you let the recipient(s) know for sure that these files come from you.",
             "sending": "Your files are being sent",
             "retrying": "Connection hiccup, retrying… (attempt {attempt} of {max})",
             "encrypting": "Encrypting & uploading...",

src/lib/locales/nl.json

@@ -201,15 +201,15 @@
             "emailSender": "E-mailadres",
             "emailSenderHeading": "Jouw gegevens",
             "emailSenderSubHeadingToggle": "Waarom heb je deze gegevens nodig?",
-            "emailSenderSubHeading": "Laat de ontvanger(s) weten dat deze bestanden van jou afkomstig zijn. Voor het verzenden onderteken je de bestanden door je e-mailadres en eventuele aanvullende persoonlijke gegevens aan te tonen met de Yivi-app.",
+            "emailSenderSubHeading": "Laat de ontvanger(s) weten dat deze bestanden van jou afkomstig zijn. Voor het verzenden onderteken je de bestanden met de Yivi-app door je e-mailadres en je naam aan te tonen (afkomstig uit je gemeente, paspoort, ID-kaart of rijbewijs).",
             "messageHeading": "Bericht (optioneel)",
             "messageText": "Dit bericht wordt niet versleuteld en wordt opgenomen in de notificatie-e-mail.",
             "messagePlaceholder": "Typ hier je bericht...",
             "encryptSend": "Onderteken & verzend",
             "yiviInfo": "Wat is Yivi?",
             "yiviInfoText": "Yivi is een gratis en privacy-vriendelijke authenticatie-app. Met Yivi kun je bewijzen wie je bent door selectief persoonlijke gegevens te delen, zoals je e-mailadres, telefoonnummer of naam. Bij PostGuard gebruiken we Yivi om bestanden veilig te versleutelen en ontsleutelen.",
             "yiviInfoLink": "Meer informatie over Yivi",
-            "yiviTip": "Tip: In de Yivi-app kun je optionele gegevens toevoegen. Zo laat je de ontvanger(s) zeker weten dat deze bestanden van jou komen.",
+            "yiviTip": "Tip: In de Yivi-app kun je ook een optioneel telefoonnummer of geboortedatum toevoegen. Zo laat je de ontvanger(s) zeker weten dat deze bestanden van jou komen.",
             "sending": "Je bestanden worden verzonden",
             "retrying": "Verbindingshapering, opnieuw proberen… (poging {attempt} van {max})",
             "encrypting": "Ondertekenen & verzenden...",