From fd50806003211864435e8238b82431c1e74c507a Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Mon, 1 Jun 2026 13:39:36 +0200
Subject: [PATCH] feat(filesharing): require signer fullname; fix canEncrypt
 reactivity
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two changes in SendButton.svelte:

1. Flip `optional: true` → `optional: false` on
   `pbdf.gemeente.personalData.fullname` in the `pg.sign.yivi` config so
   the Yivi disclosure session refuses to complete without a name. The
   cryptify recipient mail now reliably has a real name to show in place
   of the bare sender email (paired change in cryptify).

   Consequence: senders without a fullname credential in their Yivi app
   can no longer sign. That's the intended outcome.

2. Fix `canEncrypt`: was `\$derived(() => { ... })` which stored the
   arrow function itself as the derived value (never recomputed, no
   reactive deps tracked). Only the single call site `canEncrypt()`
   inside `startEncryption` hid the bug. Now `\$derived.by(() => ...)`
   so the body is treated as the computation, and the call site reads
   `canEncrypt` as a bool. Caught by the Svelte autofixer.
---
 src/lib/components/filesharing/SendButton.svelte | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/lib/components/filesharing/SendButton.svelte b/src/lib/components/filesharing/SendButton.svelte
index e4e43db..a300948 100644
--- a/src/lib/components/filesharing/SendButton.svelte
+++ b/src/lib/components/filesharing/SendButton.svelte
@@ -37,7 +37,7 @@
     const emailRegex =
         /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/
 
-    let canEncrypt = $derived(() => {
+    let canEncrypt = $derived.by(() => {
         if (encryptState.files.length === 0) return false
         const totalSize = encryptState.files.reduce((a, f) => a + f.size, 0)
         if (totalSize >= MAX_UPLOAD_SIZE) return false
@@ -138,7 +138,7 @@
         await tick()
 
         try {
-            if (!canEncrypt()) return
+            if (!canEncrypt) return
 
             // Build recipients
             const recipients = encryptState.recipients.map(
@@ -151,13 +151,14 @@
                 }
             )
 
-            // Build sign method — email always included, other attributes optional
+            // Build sign method — email and full name always required so the
+            // recipient mail can show a real name; other attributes optional.
             const sign = pg.sign.yivi({
                 element: '#crypt-irma-qr',
                 attributes: [
                     {
                         t: 'pbdf.gemeente.personalData.fullname',
-                        optional: true,
+                        optional: false,
                     },
                     {
                         t: 'pbdf.sidn-pbdf.mobilenumber.mobilenumber',