feat: surface most severe SPF result and hide "via" badge on spoofed mail

lib/jmap/client.ts

@@ -1134,7 +1134,9 @@ export class JMAPClient implements IJMAPClient {
 
     const authResultsHeader = headersRecord['Authentication-Results'];
     if (authResultsHeader) {
-      const value = Array.isArray(authResultsHeader) ? authResultsHeader[0] : authResultsHeader;
+      // Multiple Authentication-Results headers (or multiple SPF identities in
+      // one header) must all be considered so the most severe result wins.
+      const value = Array.isArray(authResultsHeader) ? authResultsHeader.join('; ') : authResultsHeader;
       email.authenticationResults = parseAuthenticationResults(value);
     }
 

lib/jmap/types.ts

@@ -75,6 +75,16 @@ export interface AuthenticationResults {
     result: 'pass' | 'fail' | 'softfail' | 'neutral' | 'none' | 'temperror' | 'permerror';
     domain?: string;
     ip?: string;
+    /**
+     * All SPF results when the server evaluated multiple identities (HELO and
+     * MAIL FROM). Present only when more than one result was found; `result`
+     * above is the most severe of these.
+     */
+    all?: Array<{
+      result: 'pass' | 'fail' | 'softfail' | 'neutral' | 'none' | 'temperror' | 'permerror';
+      domain?: string;
+      identity?: 'helo' | 'mailfrom';
+    }>;
   };
   dkim?: {
     result: 'pass' | 'fail' | 'policy' | 'neutral' | 'temperror' | 'permerror';