From 72498f81b25612383a4cf044081a57588d8d88b6 Mon Sep 17 00:00:00 2001
From: anti <samuel@securejump.cl>
Date: Thu, 30 Apr 2026 14:11:08 -0400
Subject: [PATCH] fix(ui): surface attacker date_hdr in mail table and drawer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

MailDrawer was reading fields.date / from_addr / message_id —
all wrong; actual log field names are date_hdr, from_hdr,
message_id_hdr, to_hdr.  The mail table in AttackerDetail
showed only DECNET capture time and used from_addr instead
of from_hdr.  Add a DATE (attacker) column so the attacker-
supplied Date header (including timezone) is visible at a
glance — useful for correlating campaigns like the Tiscali
run where IPs used distinct TZs (+0800 vs -0700).
---
 decnet_web/src/components/AttackerDetail.tsx |  8 ++++++--
 decnet_web/src/components/MailDrawer.tsx     | 12 ++++++------
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/decnet_web/src/components/AttackerDetail.tsx b/decnet_web/src/components/AttackerDetail.tsx
index 124bbf57..88257903 100644
--- a/decnet_web/src/components/AttackerDetail.tsx
+++ b/decnet_web/src/components/AttackerDetail.tsx
@@ -1479,7 +1479,7 @@ const AttackerDetail: React.FC = () => {
   }
 
   return (
-    <div className="dashboard">
+    <div className="dashboard page-scroll">
       {/* Back Button */}
       <button onClick={() => navigate('/attackers')} className="back-button">
         <ArrowLeft size={18} />
@@ -2059,6 +2059,7 @@ const AttackerDetail: React.FC = () => {
                   <th>DECKY</th>
                   <th>SUBJECT</th>
                   <th>FROM</th>
+                  <th>DATE (attacker)</th>
                   <th>SIZE</th>
                   <th></th>
                 </tr>
@@ -2078,7 +2079,10 @@ const AttackerDetail: React.FC = () => {
                         {fields.subject || '—'}
                       </td>
                       <td className="matrix-text" style={{ fontFamily: 'monospace', wordBreak: 'break-all' }}>
-                        {fields.from_addr || fields.mail_from || '—'}
+                        {fields.from_hdr || fields.from_addr || fields.mail_from || '—'}
+                      </td>
+                      <td className="matrix-text" style={{ fontFamily: 'monospace', whiteSpace: 'nowrap', fontSize: '0.75rem' }}>
+                        {fields.date_hdr || '—'}
                       </td>
                       <td className="matrix-text" style={{ fontFamily: 'monospace' }}>
                         {fields.size ? `${fields.size} B` : '—'}
diff --git a/decnet_web/src/components/MailDrawer.tsx b/decnet_web/src/components/MailDrawer.tsx
index f2657121..9f43b315 100644
--- a/decnet_web/src/components/MailDrawer.tsx
+++ b/decnet_web/src/components/MailDrawer.tsx
@@ -81,9 +81,9 @@ const MailDrawer: React.FC<MailDrawerProps> = ({ decky, storedAs, fields, onClos
     }
   };
 
-  const recipients = Array.isArray(fields.rcpts)
-    ? fields.rcpts.join(', ')
-    : (typeof fields.rcpts === 'string' ? fields.rcpts : null);
+  const recipients = fields.to_hdr
+    || (Array.isArray(fields.rcpts) ? fields.rcpts.join(', ') : null)
+    || (typeof fields.rcpts === 'string' ? fields.rcpts : null);
 
   return (
     <div
@@ -156,10 +156,10 @@ const MailDrawer: React.FC<MailDrawerProps> = ({ decky, storedAs, fields, onClos
             HEADERS
           </h3>
           <Row label="Subject" value={fields.subject} />
-          <Row label="From" value={fields.from_addr ?? fields.from} />
+          <Row label="From" value={fields.from_hdr || fields.from_addr || fields.from} />
           <Row label="To" value={recipients} />
-          <Row label="Date" value={fields.date} />
-          <Row label="Message-ID" value={fields.message_id} />
+          <Row label="Date" value={fields.date_hdr || fields.date} />
+          <Row label="Message-ID" value={fields.message_id_hdr || fields.message_id} />
           <Row label="Mail from" value={fields.mail_from} />
         </section>