Offer administration only on a device marked as your own

A session signed in without "This is my own device" can no longer administer. The server withholds the account's permissions from it and the JMAP proxy refuses registry methods beyond the account's own, the same gate ADMINISTRATION=0 uses. A borrowed or shared machine is where nobody should be able to reset a password or remove a domain. An administrator in such a session still sees Administration in the account menu, greyed out, with the reason and the fix: sign in again with the box ticked. The server tells that session only that the account administers. The gate now reads the body only when it could name a registry method -- "x: in the text, or a \u escape that could spell one -- so ordinary mail traffic from an untrusted session is forwarded untouched. 1 new string, translated in all nine catalogues, quoting each language's own label for the tickbox; strings falling back to English stay at 16.
2026-09-13 16:34:20 -07:00
parent 93c9660421
commit f1638b2fee
15 changed files with 145 additions and 19 deletions
@@ -39,8 +39,13 @@ export interface JmapSession {
      /** "oss" | "community" | "enterprise". Stalwart publishes no version. */
      edition?: string | null;
    };
-    /** False when the operator has turned in-app administration off. */
+    /**
+     * False when this session may not administer: the operator turned it off,
+     * or the session was signed in without "This is my own device".
+     */
    administration?: boolean;
+    /** An administrator on a device not marked as their own; the menu says so. */
+    administrationNeedsOwnDevice?: boolean;
    /**
     * The account's effective permissions on that server, as Stalwart reports
     * them. What the client offers is shaped by these; what is allowed is