5 Commits

Include renames

Author	SHA1	Message	Date
jcoffey-dev	966241070e	Name Coffey Labs LLC as the copyright holder ... Coffey Labs is now Coffey Labs LLC, an Arizona limited liability company. Copyright lines and SPDX-FileCopyrightText headers naming Coffey Labs or John Coffey now name Coffey Labs LLC. Upstream copyright notices are unchanged.	2026-10-05 23:33:00 -07:00
jcoffey-dev	3d28f6bff2	record-compat: tell reach apart from permission in a refusal ... "You are not an owner of account X" is not a permission the server is withholding; it is how far that identity can see. Answering it with "needs sysMaskedEmailGet" sends you off to grant something that changes nothing. A refusal that mentions ownership now says so, and says which account the run wants: the administrator with the run of the server, with tenant administrators passed as --tenant-admin.	2026-09-19 19:52:37 -07:00
jcoffey-dev	045e9f6234	record-compat: a refused section costs its file, not the run ... A recording runs against a server that may not be up again soon, so an administrator missing one permission shouldn't throw away the whole pass. Each of the three is recorded on its own now: what the server allows is written, what it refuses is named at the end with the permission it wants, and the exit is still non-zero so an incomplete recording can't pass for a finished one. A refusal used to print the raw JMAP error. It now reads, for example, "[email protected] may not x:Tenant/get: You are not authorized to perform this action (needs sysTenantGet)". Checked both ways: the refusal path against a stubbed client, where the other two sections still record; the whole thing against a live test server, which recorded 3 tenants and 53 masked addresses and exited 0.	2026-09-19 19:21:22 -07:00
jcoffey-dev	7816f38c29	record-compat: check every credential before reading anything ... A wrong tenant-administrator password failed only once the script had already enumerated every account, on a server that may not be up for long. All the identities are now checked against the session endpoint first, and a refusal names each one that failed, with the two things that usually explain it: basic authentication wants the account's name rather than its email address, and an account with two-factor or OAuth-only sign-in needs an app password. It also gives the curl line to test one on its own. The unreachable message no longer suggests --insecure for a refused connection; that hint is now only for a certificate it couldn't verify.	2026-09-19 19:10:03 -07:00
jcoffey-dev	fd7747ef21	Fork tooling: record what the compat tests compare against ... Three of the eight compat tests check INBUXA's data against a recording of how the Enterprise server read it, and that recording can only be made while that server is still up. SPEC §7 gives it 45 days from the notice, so the capture shouldn't wait on the cutover being scheduled. record-compat.py writes all three files: the tenants with their quotas and members and what each tenant administrator sees, every masked address and its state, and every archived item whole, since undelete_compat compares every property it recorded. It only reads, and refuses to send a method that isn't /get or /query, because it is the one tool here that runs against the live server. Queries follow their pages, so a server that caps one doesn't leave a short recording behind. Exercised against the fork's own test server, which answers the same JMAP: 3 tenants with members, 8 masked addresses and 3 archived items, each in the shape its test reads.	2026-09-19 18:42:25 -07:00