Add Administration, starting with accounts

An account whose Stalwart role manages accounts now finds Administration in the account menu. It lists, searches, creates and edits accounts -- display name, other addresses, role, storage limit -- sets a new password, and deletes, each offered only when the role holds the matching permission. The server keeps the permissions list from GET /api/account, which it already called for the edition and threw the rest away. Everything else is JMAP x:Account, x:Domain and x:Role calls through the existing /api/jmap proxy, so nothing new is stored and Stalwart decides every call. Stalwart checks a grant against the caller's permissions but not a password change or a delete, so an account that outranks the viewer is shown read-only. Your own password is changed in Settings, which re-seals the session; changing it here would strand it. The mock server gains a directory behind the same permission names, with MOCK_ROLE choosing admin, tenant-admin, helpdesk or user. 68 new strings, translated in all nine catalogues; strings falling back to English stay at 16.
2026-09-13 15:11:55 -07:00
parent b0564679e6
commit 82e217155b
34 changed files with 2684 additions and 22 deletions
@@ -0,0 +1,45 @@
+import { describe, expect, it } from "vitest";
+import { aliasList, describeDirectoryError, DirectoryError, hasPassword, passwordPatch, quotasWithDisk } from "@/lib/adminDirectory";
+
+describe("setting a password", () => {
+  it("writes into the existing password credential, keeping its place", () => {
+    const account = { credentials: { "0": { "@type": "AppPassword" as const }, "2": { "@type": "Password" as const, secret: "[********]" } } };
+    expect(passwordPatch(account, "new secret")).toEqual({ "credentials/2/secret": "new secret" });
+  });
+
+  it("adds one after the last index when the account has none", () => {
+    const account = { credentials: { "0": { "@type": "AppPassword" as const }, "3": { "@type": "ApiKey" as const } } };
+    expect(passwordPatch(account, "s")).toEqual({ "credentials/4": { "@type": "Password", secret: "s" } });
+    expect(passwordPatch({}, "s")).toEqual({ "credentials/0": { "@type": "Password", secret: "s" } });
+    expect(hasPassword(account)).toBe(false);
+  });
+});
+
+describe("lists written back", () => {
+  it("re-index aliases the way the server stores a list", () => {
+    expect(aliasList([{ name: "b", domainId: "d1" }, { name: "c", domainId: "d2", enabled: false }])).toEqual({
+      "0": { enabled: true, name: "b", domainId: "d1", description: null },
+      "1": { enabled: false, name: "c", domainId: "d2", description: null },
+    });
+  });
+
+  it("change the disk limit without touching the other quotas", () => {
+    expect(quotasWithDisk({ maxEmails: 10, maxDiskQuota: 5 }, 7)).toEqual({ maxEmails: 10, maxDiskQuota: 7 });
+    expect(quotasWithDisk({ maxEmails: 10, maxDiskQuota: 5 }, null)).toEqual({ maxEmails: 10 });
+    expect(quotasWithDisk(undefined, 0)).toEqual({});
+  });
+});
+
+describe("explaining a refusal", () => {
+  it("says what a taken address means", () => {
+    expect(describeDirectoryError(new DirectoryError("primaryKeyViolation", "exists"))).toMatch(/already in use/);
+  });
+
+  it("keeps the server's own words for a password policy", () => {
+    expect(describeDirectoryError(new DirectoryError("invalidProperties", "Password must be at least 8 characters long.", ["secret"]))).toContain("at least 8 characters");
+  });
+
+  it("handles a method-level refusal as well as a set error", () => {
+    expect(describeDirectoryError({ type: "forbidden", message: "x:Account/set: forbidden" })).toMatch(/refused/);
+  });
+});