Let an installation seed and lock user settings

The first two thirds of #207. A school wanting "warn about outside senders"
on for three thousand pupils cannot ask three thousand pupils, and the
reporter is right that this is a company policy rather than a preference.

Two powers, and the difference between them is the whole request. `defaults`
seed an account that has never had settings of its own and can be changed
afterwards like anything else -- a starting point, not a rule. `enforced` are
reapplied on every load and cannot be changed at all.

Enforced controls stay visible and go dead, with a line saying why. The issue
asked for that by name: a control that is simply missing reads as a bug to
somebody who has used ihasmail without a policy.

The lock is in the settings store rather than only on the controls. There is
one door -- `update` -- and putting it there means an imported settings file,
a settings file synced from a device that predates the policy, and a control
somebody adds later and forgets to check are all covered by construction.
Reset goes back to the installation's answer rather than to ihasmail's, so it
cannot be a way around a policy either.

Configured by environment variable or by a file, because ihasmail's own
production runs read-only with no volume: an installation that cannot mount a
file can still set a variable. Keys this build does not have are dropped, the
same rule an imported settings file already gets -- a policy written against a
newer ihasmail must not put a setting nothing reads into everybody's synced
settings file. Malformed JSON stops the server rather than quietly doing
nothing, since a policy that silently did not apply is indistinguishable from
the feature not working.

Tier three -- enforcing a setting once while still letting readers change it
afterwards -- is not here. It needs a decision the reporter and I have not
made yet, and it is the only part that stores anything new.

Refs #207.

server/src/app.ts

@@ -175,6 +175,9 @@ export function createApp(basePath = config.basePath): Hono<Env> {
       sourceUrl: config.sourceUrl,
       imageProxy: config.imageProxy,
       maxUploadBytes: config.maxUploadBytes,
+      /* Sent before sign-in like the rest of this: it says what the
+         installation has decided, not anything about who is asking. */
+      settingsPolicy: config.settingsPolicy,
     }),
   );
 

server/src/config.ts

@@ -111,9 +111,56 @@ export function assertImmutable(sessionFile: string, root: string): void {
 if (immutable) assertImmutable(sessionFile, fileURLToPath(new URL("../..", import.meta.url)));
 
 
+/**
+ * Settings an installation decides, rather than each reader.
+ *
+ * A school turning on "warn about outside senders" for three thousand pupils
+ * cannot ask three thousand pupils to turn it on -- issue #207. Two sections,
+ * which are two different powers:
+ *
+ * - `defaults` seed an account that has never had settings of its own. The
+ *   reader can change any of them afterwards; they are a starting point, not a
+ *   rule.
+ * - `enforced` are applied on every load and cannot be changed here at all. The
+ *   controls stay visible and go dead, which the issue asked for by name: a
+ *   missing control confuses somebody who has used ihasmail elsewhere.
+ *
+ * Read from a file or straight from the environment, because ihasmail's own
+ * production runs read-only with no volume -- an installation that cannot mount
+ * a file can still set a variable.
+ */
+function readSettingsPolicy(): { defaults: Record<string, unknown>; enforced: Record<string, unknown> } {
+  const parse = (raw: string, where: string): Record<string, unknown> => {
+    try {
+      const v = JSON.parse(raw) as unknown;
+      if (!v || typeof v !== "object" || Array.isArray(v)) throw new Error("not a JSON object");
+      return v as Record<string, unknown>;
+    } catch (err) {
+      /* Loud, and fatal. A policy that silently did not apply would look like
+         the feature not working, and the admin would have no way to tell. */
+      throw new Error(`Invalid ${where}: ${(err as Error).message}`);
+    }
+  };
+
+  const file = process.env.SETTINGS_POLICY_FILE;
+  if (file) {
+    if (!existsSync(file)) throw new Error(`SETTINGS_POLICY_FILE does not exist: ${file}`);
+    const whole = parse(readFileSync(file, "utf8"), `SETTINGS_POLICY_FILE (${file})`);
+    return {
+      defaults: (whole.defaults as Record<string, unknown>) ?? {},
+      enforced: (whole.enforced as Record<string, unknown>) ?? {},
+    };
+  }
+  return {
+    defaults: process.env.SETTINGS_DEFAULTS ? parse(process.env.SETTINGS_DEFAULTS, "SETTINGS_DEFAULTS") : {},
+    enforced: process.env.SETTINGS_ENFORCED ? parse(process.env.SETTINGS_ENFORCED, "SETTINGS_ENFORCED") : {},
+  };
+}
+
 export const config = {
   isProd,
   appName: env("APP_NAME", "ihasmail"),
+  settingsPolicy: readSettingsPolicy(),
   /**
    * What this build calls itself: `2.16.57`. Set by the image build from
    * `--build-arg IHASMAIL_VERSION`, since `.dockerignore` keeps `.git` out of