Masked email: upstream's x:MaskedEmail API (ME-2, ME-3, ME-6a, ME-7a, ME-12 to ME-19)

x:MaskedEmail is no longer refused as unbuilt. Creates generate the address
on an allowed domain and check the prefix, maxMaskedAddresses and the create
rate; updates keep server-set fields; enabled reads and writes map to the
shared state; query filters on enabled, forDomain and text; a tenant
administrator reaches its tenant's accounts' masks.

crates/jmap/src/registry/get.rs

@@ -196,6 +196,7 @@ impl RegistryGet for Server {
             | ObjectType::Domain => {
                 let is_singleton = (get.object_flags & OBJ_SINGLETON) != 0;
 
+                let ids_requested = get.ids.is_some();
                 let ids = if let Some(ids) = get.ids.take() {
                     ids
                 } else if object_type == ObjectType::Tenant
@@ -217,7 +218,7 @@ impl RegistryGet for Server {
                 get.response.list.reserve(ids.len());
 
                 for id in ids {
-                    let object = if let Some(object) = self
+                    let mut object = if let Some(object) = self
                         .registry()
                         .get(ObjectId::new(object_type, id))
                         .await
@@ -245,6 +246,16 @@ impl RegistryGet for Server {
                         continue;
                     };
 
+                    // inbuxa: ME-6a, ME-8
+                    if let ObjectInner::MaskedEmail(mask) = &mut object.inner
+                        && !crate::inbuxa::masked_email::read(self, id, mask).await?
+                    {
+                        if ids_requested {
+                            get.not_found(id);
+                        }
+                        continue;
+                    }
+
                     let mut extra_properties: VecMap<Property, _> = VecMap::new();
                     match &object.inner {
                         ObjectInner::DkimSignature(obj)