Multi-tenancy: the inbuxa-features crate, the permission ceiling and tenant disk quota (MT-12, MT-13, MT-14, MT-15, MT-16, MT-19, MT-20)

New crate crates/features (inbuxa-features), AGPL-3.0-only, holding the
tenancy rules. Hooks in common: a tenant's roles and permission lists cap
its people's permissions; a change to a tenant, or to a role a tenant holds,
drops its members' cached permissions; delivery and every other write check
the tenant's maxDiskQuota; usedDiskQuota reads the tenant usage counter.
The default Tenant Administrator role gains sysTenantGet and sysTenantQuery.

crates/common/Cargo.toml

@@ -13,6 +13,7 @@ directory = { path = "../directory" }
 coordinator = { path = "../coordinator" }
 types = { path = "../types" }
 registry = { path = "../registry" }
+inbuxa-features = { path = "../features" }
 jmap_proto = { path = "../jmap-proto" }
 sieve-rs = { version = "0.7", features = ["rkyv", "serde"] }
 mail-parser = { version = "0.11", features = ["full_encoding"] } 

crates/common/src/auth/permissions.rs

@@ -45,8 +45,7 @@ impl Server {
         &self,
         permissions: &structs::Permissions,
         role_ids: &[Id],
-        // inbuxa: unused until multi-tenancy is rebuilt: the tenant permission ceiling (docs/spec/features/multi-tenancy.md MT-13)
-        _tenant_id: Option<u32>,
+        tenant_id: Option<u32>,
     ) -> trc::Result<PermissionsGroup> {
         // Calculate effective permissions
         let (mut permissions, roles) = match permissions {
@@ -65,10 +64,46 @@ impl Server {
                 .caused_by(trc::location!())?
         }
 
+        // inbuxa: MT-13, MT-14, MT-15: cut down to what the tenant allows
+        if let Some(tenant_id) = tenant_id {
+            self.apply_tenant_ceiling(&mut permissions, tenant_id)
+                .await
+                .caused_by(trc::location!())?;
+        }
 
         Ok(permissions)
     }
 
+    /// inbuxa: MT-13. The tenant's roles give the base; its own permission
+    /// lists adjust it (`inbuxa_features::tenancy::ceiling`).
+    async fn apply_tenant_ceiling(
+        &self,
+        permissions: &mut PermissionsGroup,
+        tenant_id: u32,
+    ) -> trc::Result<()> {
+        use inbuxa_features::tenancy::ceiling::{Policy, ceiling};
+
+        let tenant = self.tenant(tenant_id).await?;
+        let base = self
+            .add_role_permissions(PermissionsGroup::default(), tenant.id_roles.iter().copied())
+            .await?
+            .finalize();
+        let policy = match tenant.permissions.as_deref() {
+            None => Policy::Inherit,
+            Some(list) if list.merge => Policy::Merge {
+                enabled: &list.enabled,
+                disabled: &list.disabled,
+            },
+            Some(list) => Policy::Replace {
+                enabled: &list.enabled,
+                disabled: &list.disabled,
+            },
+        };
+        ceiling(base, policy).apply(&mut permissions.enabled, &mut permissions.disabled);
+
+        Ok(())
+    }
+
     pub async fn can_set_permissions(
         &self,
         access_token: &AccessToken,
@@ -225,6 +260,11 @@ impl Default for DefaultPermissions {
                     default.superuser.push(permission);
                     default.tenant.push(permission);
                 }
+                // inbuxa: MT-12: a tenant administrator reads its own tenant
+                Permission::SysTenantGet | Permission::SysTenantQuery => {
+                    default.superuser.push(permission);
+                    default.tenant.push(permission);
+                }
                 permission => {
                     let name = permission.as_str();
                     if name.starts_with("jmap")

crates/common/src/cache/invalidate.rs

@@ -280,6 +280,15 @@ impl Server {
                         .registry()
                         .linked_objects(ObjectId::new(ObjectType::Role, role_id.into()))
                         .await?;
+                    // inbuxa: MT-16: a role a tenant holds sets its ceiling
+                    for tenant_id in inbuxa_features::tenancy::members::tenants_using_role(
+                        self.registry(),
+                        &linked_objects,
+                    )
+                    .await?
+                    {
+                        changes.insert(CacheInvalidation::Tenant(tenant_id));
+                    }
                     for linked_object in linked_objects {
                         match linked_object.object() {
                             ObjectType::Account => {
@@ -297,6 +306,22 @@ impl Server {
             }
         }
 
+        // inbuxa: MT-16: a tenant's change reaches its people on their next request
+        let tenant_ids = changes
+            .iter()
+            .filter_map(|change| match change {
+                CacheInvalidation::Tenant(tenant_id) => Some(*tenant_id),
+                _ => None,
+            })
+            .collect::<Vec<_>>();
+        for tenant_id in tenant_ids {
+            for account_id in
+                inbuxa_features::tenancy::members::accounts(self.registry(), tenant_id).await?
+            {
+                changes.insert(CacheInvalidation::AccessToken(account_id));
+            }
+        }
+
         let changes = changes.into_iter().collect::<Vec<_>>();
         self.invalidate_local_caches(&changes).await;
         self.cluster_broadcast(BroadcastEvent::CacheInvalidate(changes))

crates/common/src/storage/quota.rs

@@ -31,9 +31,9 @@ impl Server {
             .add_context(|err| err.caused_by(trc::location!()).account_id(account_id))
     }
 
-    #[cfg(not(feature = "enterprise"))]
-    pub async fn get_used_quota_tenant(&self, _tenant_id: u32) -> trc::Result<i64> {
-        Ok(0)
+    // inbuxa: MT-20: storage used by all a tenant's members together
+    pub async fn get_used_quota_tenant(&self, tenant_id: u32) -> trc::Result<i64> {
+        inbuxa_features::tenancy::quota::used(&self.core.storage.data, tenant_id).await
     }
 
     pub async fn has_available_quota(
@@ -52,6 +52,21 @@ impl Server {
             }
         }
 
+        // inbuxa: MT-19: the tenant's limit applies too, whichever is reached first
+        if let Some(tenant_id) = account.id_tenant {
+            let tenant = self.tenant(tenant_id).await?;
+            if tenant.quota_disk != 0 {
+                let used_quota = self.get_used_quota_tenant(tenant_id).await?.max(0) as u64;
+
+                if used_quota + item_size > tenant.quota_disk {
+                    return Err(trc::LimitEvent::TenantQuota
+                        .into_err()
+                        .ctx(trc::Key::Id, tenant_id)
+                        .ctx(trc::Key::Limit, tenant.quota_disk)
+                        .ctx(trc::Key::Size, used_quota));
+                }
+            }
+        }
 
         Ok(())
     }