coffey-labs/ihasmail
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Ask for the submission capability when using identities

Browse Source 
Identity is defined by RFC 8621 under urn:ietf:params:jmap:submission, not
under mail. ihasmail asked for mail alone, so Stalwart 0.16 rejected both
Identity/get and Identity/set with unknownMethod: no identities were ever
listed, none could be created, and sending then failed with "No sending
identity available". Older Stalwart builds accepted the calls anyway, which
is why this went unnoticed.

Also filter `using` down to the capabilities the session actually advertises.
A server must reject the entire request with unknownCapability when `using`
names something it does not implement, so one over-eager urn would take down
every call sharing the batch — including, on a server predating the submission
capability, the mailbox and message loads batched alongside an identity fetch.

Fixes #12
This commit is contained in:
jcoffey-dev
2026-08-24 06:31:37 -07:00
parent cfe5595882
commit a3fd236c36
2 changed files with 106 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/src/jmap/client.ts
+20 -2
View File
@@ -195,9 +195,22 @@ export class JmapClient {
}
}
/**
* Drop capabilities this session never advertised.
*
* A server MUST reject the whole request with `unknownCapability` when
* `using` names something it does not implement (RFC 8620), which would take
* down every call in the batch — not just the one that wanted the capability.
* Core always stays: it is the one urn every server has.
*/
private supportedUsing(using: string[]): string[] {
if (!this.session?.capabilities) return using;
return using.filter((u) => u === CAP.core || this.hasCapability(u));
}
/** Low-level request: send invocations verbatim, return raw response. */
async request(methodCalls: Invocation[], using: string[] = [CAP.core, CAP.mail], createdIds?: Record<string, Id>): Promise<JmapResponse> {
const body: Record<string, unknown> = { using, methodCalls };
const body: Record<string, unknown> = { using: this.supportedUsing(using), methodCalls };
if (createdIds) body.createdIds = createdIds;
const res = await apiFetch<JmapResponse>("/api/jmap", { method: "POST", body: JSON.stringify(body) });
if (res.sessionState && this.session && res.sessionState !== this.session.state) {
@@ -302,8 +315,13 @@ function usingFor(method: string): string[] {
case "Thread":
case "Email":
case "SearchSnippet":
case "Identity":
return [CAP.mail];
// Identity belongs to the submission capability (RFC 8621), not mail:
// Stalwart >= 0.16 rejects Identity/get and Identity/set outright when
// "using" names only mail. Keep mail as well, so the filter in
// supportedUsing() still leaves a usable urn on servers that predate
// advertising submission.
case "Identity":
case "EmailSubmission":
return [CAP.mail, CAP.submission];
case "VacationResponse":