Make the AGPL's source offer point at the source being run

Three things a licence audit turned up. None of them is a conflict --
every one of the 182 installed packages is permissive, and the relicence
was within the copyright holder's gift -- but all three are ways the
AGPL fails to stick.

The offer was hard-coded to this repository. Section 13 asks whoever
runs a modified version to offer *that* version's source, so every
deployment with a patch in it was pointing at the wrong tree, and would
have gone on doing so unless its operator noticed and edited the About
page. SOURCE_URL now sets it, alongside APP_NAME, and both the sign-in
page and About read it.

The offer was also only visible after signing in. Whoever is looking at
the sign-in form is interacting with the program over a network too, so
the footer carries it now.

And the two workspace packages declared no licence at all. Private, so
npm never minded, but anything reading the tree saw a blank where the
rest of the project says AGPL-3.0-or-later.

Checked both ways round: with SOURCE_URL set to a fork, the sign-in page
and About both point at the fork; with it unset, both fall back to this
repository.

web/package.json

@@ -2,6 +2,7 @@
   "name": "@ihasmail/web",
   "version": "2.0.0",
   "private": true,
+  "license": "AGPL-3.0-or-later",
   "type": "module",
   "scripts": {
     "dev": "vite",

web/src/jmap/types.ts

@@ -25,6 +25,8 @@ export interface JmapSession {
   state: string;
   ihasmail?: {
     appName: string;
+    /** Where this instance's source can be had, for the AGPL's sake. */
+    sourceUrl?: string;
     imageProxy: boolean;
     maxUploadBytes: number;
     sessionId: string;

web/src/lib/source.ts

@@ -0,0 +1,8 @@
+/**
+ * Where to point someone who wants this instance's source.
+ *
+ * The AGPL asks whoever runs a modified version to offer *that* version's
+ * source. The server says where its own lives, via SOURCE_URL; this is only the
+ * fallback for when it has not been asked yet, or has nothing to say.
+ */
+export const DEFAULT_SOURCE_URL = "https://github.com/LINUXexpert-org/ihasmail";

web/src/views/Login.tsx

@@ -1,10 +1,23 @@
-import { useState, type FormEvent } from "react";
+import { useEffect, useState, type FormEvent } from "react";
 import { Eye, EyeOff, LogIn, ShieldCheck } from "lucide-react";
 import { useSession } from "@/store/session";
 import { ApiError } from "@/jmap/client";
+import { DEFAULT_SOURCE_URL } from "@/lib/source";
 
 export function LoginPage() {
   const login = useSession((s) => s.login);
+  // The AGPL's offer has to reach everyone who interacts with the app over the
+  // network, and that includes whoever is looking at this form. The server says
+  // where its own source lives, so a modified deployment points at its own.
+  const [sourceUrl, setSourceUrl] = useState(DEFAULT_SOURCE_URL);
+  useEffect(() => {
+    let live = true;
+    fetch("/api/config")
+      .then((r) => (r.ok ? r.json() : null))
+      .then((c) => { if (live && c?.sourceUrl) setSourceUrl(c.sourceUrl as string); })
+      .catch(() => { /* the default stands */ });
+    return () => { live = false; };
+  }, []);
   const [username, setUsername] = useState(() => localStorage.getItem("ihasmail:lastUser") ?? "");
   const [password, setPassword] = useState("");
   const [totp, setTotp] = useState("");
@@ -81,6 +94,8 @@ export function LoginPage() {
         </button>
         <p className="foot">
           ihasmail by <a href="https://linuxexpert.org" target="_blank" rel="noopener noreferrer">linuxexpert.org</a>
+          {" · "}
+          <a href={sourceUrl} target="_blank" rel="noopener noreferrer">AGPL-3.0 source</a>
         </p>
       </form>
     </div>

web/src/views/settings/AboutSettings.tsx

@@ -1,9 +1,12 @@
 import { useSession } from "@/store/session";
 import { client } from "@/jmap/client";
+import { DEFAULT_SOURCE_URL } from "@/lib/source";
 
 export function AboutSettings() {
   const session = useSession((s) => s.session);
   const caps = Object.keys(session?.capabilities ?? {});
+  // A deployment running modified code should offer its own source, not ours.
+  const sourceUrl = session?.ihasmail?.sourceUrl ?? DEFAULT_SOURCE_URL;
   return (
     <div>
       <h1>About ihasmail</h1>
@@ -12,7 +15,7 @@ export function AboutSettings() {
         <img src="/img/logo.png" alt="ihasmail" width={96} />
         <div>
           <div style={{ fontWeight: 700, fontSize: "1.2em" }}>ihasmail 2.0</div>
-          <div className="hint">AGPL-3.0-or-later · <a href="https://github.com/LINUXexpert-org/ihasmail" target="_blank" rel="noreferrer">github.com/LINUXexpert-org/ihasmail</a></div>
+          <div className="hint">AGPL-3.0-or-later · <a href={sourceUrl} target="_blank" rel="noreferrer">{sourceUrl.replace(/^https?:\/\//, "")}</a></div>
         </div>
       </div>
       <h2>Server</h2>