feat(signatures): read a directory of markdown signatures

One file per signature under a directory the caller names, the stem being
the name shown to the user. A name containing a path separator is refused:
it arrives from the config file, and it reaches a path that is read into a
message about to be sent.

Part of item 152.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KEcn3u19xPqv6ggD15PG4c

5 files changed, 249 insertions, 0 deletions

diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 2cebfef..700b185 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -37,6 +37,7 @@ add_library(qtmaildir_lib STATIC
     querycompleter.cpp
     rulequery.cpp
     searchterm.cpp
+    signatures.cpp
 )
 
 target_include_directories(qtmaildir_lib
diff --git a/src/signatures.cpp b/src/signatures.cpp
new file mode 100644
index 0000000..67bf491
--- /dev/null
+++ b/src/signatures.cpp
@@ -0,0 +1,67 @@
+/*
+ * qtmaildir - a Qt6 mail client for notmuch-indexed Maildirs
+ * Copyright (C) 2026 Danilo M. <danix@danix.xyz>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include "signatures.h"
+
+#include <QDir>
+#include <QFile>
+#include <QFileInfo>
+
+namespace Signatures {
+
+QStringList names(const QString &dir)
+{
+    QDir directory(dir);
+    if (!directory.exists())
+        return {};
+
+    QStringList result;
+    const QStringList files =
+        directory.entryList({ QStringLiteral("*.md") }, QDir::Files, QDir::Name);
+    result.reserve(files.size());
+    for (const QString &file : files)
+        result.append(QFileInfo(file).completeBaseName());
+    return result;
+}
+
+QString text(const QString &dir, const QString &name)
+{
+    // A name arriving from the config file is untrusted input reaching a path.
+    // Stems from names() never contain a separator, so rejecting one costs
+    // nothing and stops a name like `../../.ssh/id_rsa` from being read into a
+    // message the user is about to send.
+    if (name.isEmpty() || name.contains(QLatin1Char('/'))
+        || name.contains(QLatin1Char('\\')))
+        return {};
+
+    QFile file(dir + QStringLiteral("/") + name + QStringLiteral(".md"));
+    if (!file.open(QIODevice::ReadOnly | QIODevice::Text))
+        return {};
+    return QString::fromUtf8(file.readAll());
+}
+
+QString replace(const QString &buffer, const QString &signature,
+                const QStringList &known, Position position)
+{
+    Q_UNUSED(signature);
+    Q_UNUSED(known);
+    Q_UNUSED(position);
+    return buffer;
+}
+
+}  // namespace Signatures
diff --git a/src/signatures.h b/src/signatures.h
new file mode 100644
index 0000000..e2bfd9c
--- /dev/null
+++ b/src/signatures.h
@@ -0,0 +1,76 @@
+/*
+ * qtmaildir - a Qt6 mail client for notmuch-indexed Maildirs
+ * Copyright (C) 2026 Danilo M. <danix@danix.xyz>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#pragma once
+
+#include <QString>
+#include <QStringList>
+
+/// Signatures, as markdown files spliced into the composer's buffer.
+///
+/// Free functions over values, with no widget anywhere, matching
+/// MarkdownFormat, MessageBuilder and DraftStore. The splice is the part worth
+/// testing and it is testable with no painter.
+///
+/// MARKDOWN, and that is what makes this small: MessageBuilder already builds
+/// text/plain from the buffer verbatim and text/html from MarkdownRenderer
+/// over the same string, so a signature in the buffer yields both forms with
+/// no change there and no second code path. One choice by the user serves both
+/// parts, which is what the feature was asked for.
+namespace Signatures {
+
+/// Where a newly inserted signature goes, from [compose] signature_position.
+enum class Position {
+    End,        ///< The end of the buffer. The default and the user's habit.
+    AboveQuote  ///< Before the first quoted line, or the end when there is none.
+};
+
+/// The stems of every `*.md` in \p dir, sorted, without the extension.
+///
+/// A missing or unreadable directory yields an empty list. That is not a
+/// misconfiguration: it means the user keeps no signatures, and the switch
+/// then offers only "None".
+QStringList names(const QString &dir);
+
+/// The content of `<dir>/<name>.md`, or empty when it cannot be read.
+///
+/// \p name is a stem from names(), never a path. It is rejected if it contains
+/// a path separator, so a value arriving from the config file cannot reach
+/// outside \p dir.
+QString text(const QString &dir, const QString &name);
+
+/// Returns \p buffer with \p signature spliced in.
+///
+/// Any signature already present is replaced; \p signature empty removes it
+/// and inserts nothing, which is what "None" selects.
+///
+/// \p known is the text of every signature in the directory, and it is what
+/// makes this non-destructive. A `-- ` delimiter is NOT sufficient authority
+/// to delete what follows it: the block is replaced only when its text matches
+/// one of \p known, and otherwise the new signature is INSERTED with nothing
+/// removed. `-- ` reaches a buffer without the user ever choosing a signature,
+/// most plausibly pasted in with quoted text from another client, and the
+/// unguarded rule would silently delete everything after it.
+///
+/// The failure is therefore directional, which is the whole point: a wrong
+/// guess adds a visible second signature, one undo away, rather than losing
+/// the user's own writing.
+QString replace(const QString &buffer, const QString &signature,
+                const QStringList &known, Position position);
+
+}  // namespace Signatures
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 1af49bb..70f6537 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -65,6 +65,7 @@ add_qtmaildir_test(tagdialog)
 add_qtmaildir_test(tagrules)
 add_qtmaildir_test(rulequery)
 add_qtmaildir_test(searchterm)
+add_qtmaildir_test(signatures)
 add_qtmaildir_test(busyindicator)
 add_qtmaildir_test(tagstrip)
 add_qtmaildir_test(messagedetailsdialog)
diff --git a/tests/test_signatures.cpp b/tests/test_signatures.cpp
new file mode 100644
index 0000000..2a75067
--- /dev/null
+++ b/tests/test_signatures.cpp
@@ -0,0 +1,104 @@
+/*
+ * qtmaildir - a Qt6 mail client for notmuch-indexed Maildirs
+ * Copyright (C) 2026 Danilo M. <danix@danix.xyz>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include <QtTest>
+#include <QTemporaryDir>
+
+#include "signatures.h"
+
+class TestSignatures : public QObject
+{
+    Q_OBJECT
+
+private slots:
+    void namesAreTheFileStemsSorted();
+    void namesIgnoreFilesThatAreNotMarkdown();
+    void aMissingDirectoryHasNoNames();
+    void textIsTheFileContent();
+    void textOfAnUnknownNameIsEmpty();
+
+private:
+    /// Writes \p files as name -> content into a fresh temporary directory.
+    static void write(const QTemporaryDir &dir,
+                      const QList<QPair<QString, QString>> &files);
+};
+
+void TestSignatures::write(const QTemporaryDir &dir,
+                           const QList<QPair<QString, QString>> &files)
+{
+    for (const auto &entry : files) {
+        QFile file(dir.path() + QStringLiteral("/") + entry.first);
+        QVERIFY(file.open(QIODevice::WriteOnly | QIODevice::Text));
+        file.write(entry.second.toUtf8());
+        file.close();
+    }
+}
+
+void TestSignatures::namesAreTheFileStemsSorted()
+{
+    QTemporaryDir dir;
+    QVERIFY(dir.isValid());
+    write(dir, { { QStringLiteral("work.md"), QStringLiteral("Work") },
+                 { QStringLiteral("brief.md"), QStringLiteral("Brief") } });
+
+    QCOMPARE(Signatures::names(dir.path()),
+             QStringList({ QStringLiteral("brief"), QStringLiteral("work") }));
+}
+
+void TestSignatures::namesIgnoreFilesThatAreNotMarkdown()
+{
+    QTemporaryDir dir;
+    QVERIFY(dir.isValid());
+    write(dir, { { QStringLiteral("work.md"), QStringLiteral("Work") },
+                 { QStringLiteral("notes.txt"), QStringLiteral("Not one") },
+                 { QStringLiteral("README"), QStringLiteral("Nor this") } });
+
+    QCOMPARE(Signatures::names(dir.path()),
+             QStringList({ QStringLiteral("work") }));
+}
+
+void TestSignatures::aMissingDirectoryHasNoNames()
+{
+    QTemporaryDir dir;
+    QVERIFY(dir.isValid());
+    const QString missing = dir.path() + QStringLiteral("/nothing-here");
+
+    QVERIFY(Signatures::names(missing).isEmpty());
+}
+
+void TestSignatures::textIsTheFileContent()
+{
+    QTemporaryDir dir;
+    QVERIFY(dir.isValid());
+    write(dir, { { QStringLiteral("work.md"),
+                   QStringLiteral("Jane Doe\n**qtmaildir**\n") } });
+
+    QCOMPARE(Signatures::text(dir.path(), QStringLiteral("work")),
+             QStringLiteral("Jane Doe\n**qtmaildir**\n"));
+}
+
+void TestSignatures::textOfAnUnknownNameIsEmpty()
+{
+    QTemporaryDir dir;
+    QVERIFY(dir.isValid());
+
+    QVERIFY(Signatures::text(dir.path(), QStringLiteral("absent")).isEmpty());
+}
+
+QTEST_MAIN(TestSignatures)
+#include "test_signatures.moc"