Merge branch 'feat/legacy-change-event' into feat/tenant-legacy-switch

The Hardening link merged to main changed the packaged schema, which this
branch also changes. The file is gzipped, so the two can't be merged line
by line: this takes main's schema and adds security.legacy-protocols-changed
to it again, with the hash recomputed.

.gitea/workflows/ci.yml

@@ -1,62 +0,0 @@
-# CI on the self-hosted Gitea, ported from .gitlab-ci.yml during the move off
-# GitLab (2026-09-22). Gitea reads .gitea/workflows and ignores .github/ once
-# this directory exists; .github/workflows stays as it was for GitHub.
-#
-# Every job runs in an image pinned by digest (tag in the trailing comment),
-# and the only action used is coffey-labs/actions/checkout pinned by SHA. The
-# instance resolves short `uses:` against itself, never GitHub, so nothing
-# unreviewed can be pulled in.
-#
-# Not ported, as on GitLab: publish.yml and release.yml still need doing.
-name: ci
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  build:
-    # Either runner (host1 or host2): the build needs no docker socket.
-    runs-on: light
-    container:
-      image: rust:1-bookworm@sha256:93ce27a88655056a51dbdd8f5f2d7ddc071c7b0070fb288a37b5a285fc83971e # 1-bookworm
-      # A named volume per host that outlives the job: Cargo's registry/git
-      # cache and the target dir. Without it every run recompiled RocksDB and
-      # the rest of the dependency tree from scratch. Each runner allows this
-      # one volume in its valid_volumes; each host keeps its own copy.
-      volumes:
-        - inbuxa-server-cargo:/cache
-    env:
-      CARGO_HOME: /cache/cargo-home
-      CARGO_TARGET_DIR: /cache/target
-      # Dependencies are reused whole; incremental data for the workspace
-      # crates would only bloat a shared target dir.
-      CARGO_INCREMENTAL: "0"
-    steps:
-      - uses: coffey-labs/actions/checkout@fab0c4d45e0162963965f1555df27b7bed5e20ec
-      # Cargo sizes its parallelism from the host's core count, not the job's
-      # CPU cap (2 on host2, 4 on host1); a C++ build of RocksDB at 8-way
-      # parallelism inside 6 GB gets OOM-killed. Match jobs to the cap.
-      - run: |
-          jobs=$(awk '$1 != "max" { printf "%d", $1 / $2 }' /sys/fs/cgroup/cpu.max 2>/dev/null)
-          echo "CARGO_BUILD_JOBS=${jobs:-$(nproc)}" >> "$GITHUB_ENV"
-          echo "cargo jobs: ${jobs:-$(nproc)}; cache: $(du -sh /cache 2>/dev/null | cut -f1)"
-      - run: apt-get update -qq && apt-get install -y -qq --no-install-recommends clang >/dev/null
-      - run: cargo build -p inbuxa --locked
-      # --no-run: the workflow compiled every test target without running them,
-      # which catches a test that no longer builds without paying for the suite.
-      - run: cargo test --workspace --locked --no-run
-      # Keep the cache from growing without bound: past 60 GB the target dir
-      # is dropped and the next build starts cold. The download cache stays.
-      # Two builds (dev + test profiles) already fill ~22 GB, so the limit
-      # has to sit well above that or it would wipe a warm cache every run.
-      - if: always()
-        run: |
-          used=$(du -s --block-size=1G /cache/target 2>/dev/null | cut -f1)
-          echo "target dir: ${used:-0} GB"
-          if [ "${used:-0}" -gt 60 ]; then rm -rf /cache/target && echo "over 60 GB: target dir cleared"; fi

.gitea/workflows/publish.yml

@@ -1,138 +0,0 @@
-# Publish the container image, ported from .github/workflows/publish.yml when
-# the project moved to the self-hosted Gitea (2026-09-22). Starts on a v* tag,
-# whether a person pushed it or weekly-release.yml created it through the
-# releases API.
-#
-# The image is multi-arch (linux/amd64, linux/arm64) as before, but built in
-# one buildx run on host1 instead of one native runner per architecture: the
-# Dockerfile's builder stage runs on the build platform and cross-compiles
-# with an aarch64 linker, so only the small final stage (apt, setcap) goes
-# through QEMU for arm64. No digest-joining job is needed.
-#
-# Two guards before anything is pushed:
-#   * the tag must be v<brand_version!>. The version is a string in
-#     crates/types/src/branding.rs, not Cargo.toml, and the image is tagged
-#     with it, so a tag beside an unbumped macro would publish an image that
-#     reports a different version from its tag.
-#   * the tag must be on main, so an image never describes code that was never
-#     reviewed onto the default branch.
-#
-# :latest moves with every published tag: tags are cut by the weekly release
-# (or by hand for a real release); there are no prerelease tags here.
-#
-# The push logs in with PACKAGE_TOKEN (jcoffey-dev, write:package): the job's
-# own token is refused by the container registry.
-name: publish
-
-on:
-  push:
-    tags: ['v*']
-
-jobs:
-  version:
-    runs-on: light
-    container:
-      image: python:3.13-slim@sha256:8d9d0b8bcf6506481eae4907c18f5e3e7902e629f5f6d684f9e7c32e85e3ddf0 # 3.13-slim
-    outputs:
-      version: ${{ steps.v.outputs.version }}
-    steps:
-      # Full history: the ancestry check cannot be answered from a shallow
-      # clone. The checkout also fetches every branch as origin/*.
-      - uses: coffey-labs/actions/checkout@fab0c4d45e0162963965f1555df27b7bed5e20ec
-        with:
-          fetch-depth: 0
-      - id: v
-        shell: bash
-        env:
-          TAG: ${{ github.ref_name }}
-        run: |
-          set -euo pipefail
-          # Scoped to the macro body: branding.rs holds other string literals,
-          # and tagging an image from one of those would be worse than failing.
-          V="$(awk '/macro_rules! brand_version /,/^}/' crates/types/src/branding.rs \
-               | grep -om1 '"[0-9][^"]*"' | tr -d '"')"
-          [ -n "$V" ] || { echo "could not read brand_version! from branding.rs" >&2; exit 1; }
-          if [ "$TAG" != "v$V" ]; then
-            echo "Tag $TAG names a commit whose brand_version! says $V." >&2
-            echo "Refusing to publish an image that would report the wrong version." >&2
-            exit 1
-          fi
-          git merge-base --is-ancestor "$(git rev-parse "${TAG}^{commit}")" origin/main \
-            || { echo "$TAG is not on main" >&2; exit 1; }
-          echo "version=$V" >> "$GITHUB_OUTPUT"
-          echo "version $V"
-
-  publish:
-    needs: [version]
-    runs-on: docker
-    container:
-      image: docker:28-cli@sha256:625d9431a9f54c5a2bc90f24f0e1c3d55b1349fd857dd85035f98c2c9acbdd4d # 28-cli
-      volumes:
-        - /var/run/docker.sock:/var/run/docker.sock
-    env:
-      DOCKER_BUILDKIT: "1"
-      REGISTRY: ${{ vars.REGISTRY }}
-      IMAGE: ${{ vars.REGISTRY }}/${{ github.repository }}
-      VERSION: ${{ needs.version.outputs.version }}
-      PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
-    steps:
-      - uses: coffey-labs/actions/checkout@fab0c4d45e0162963965f1555df27b7bed5e20ec
-      - run: |
-          test -n "$REGISTRY" && test -n "$VERSION"
-          test -n "$PACKAGE_TOKEN" || { echo "PACKAGE_TOKEN secret is not set on this repository" >&2; exit 1; }
-          echo "$PACKAGE_TOKEN" | docker login -u jcoffey-dev --password-stdin "$REGISTRY"
-          docker run --privileged --rm tonistiigi/binfmt --install arm64
-          docker buildx create --use --name gitea-builder --driver docker-container || docker buildx use gitea-builder
-      # Attestations off, as before: they add manifests of their own to the
-      # index, and the index should hold the two images and nothing else.
-      - run: |
-          docker buildx build \
-            --platform linux/amd64,linux/arm64 \
-            --provenance=false --sbom=false \
-            --tag "$IMAGE:$VERSION" \
-            --tag "$IMAGE:latest" \
-            --push .
-          docker buildx imagetools inspect "$IMAGE:$VERSION"
-      # Gitea keeps a container package on its owner; linking it shows it on
-      # the repository's Packages tab. Idempotent.
-      - run: |
-          apk add --no-cache -q curl
-          curl -fsS -o /dev/null -X POST -H "Authorization: token $PACKAGE_TOKEN" \
-            "$CI_SERVER_INTERNAL/api/v1/packages/${GITHUB_REPOSITORY%%/*}/container/${GITHUB_REPOSITORY#*/}/-/link/${GITHUB_REPOSITORY#*/}" \
-            || echo "package already linked (or link refused); not fatal"
-      - if: always()
-        run: docker logout "$REGISTRY" || true
-
-  # The weekly release creates its Release (and so the tag) first; a tag
-  # pushed by hand has none. Either way the tag ends up with exactly one
-  # Release, created after the image exists so its pull instructions work.
-  release:
-    needs: [version, publish]
-    runs-on: light
-    container:
-      image: python:3.13-slim@sha256:8d9d0b8bcf6506481eae4907c18f5e3e7902e629f5f6d684f9e7c32e85e3ddf0 # 3.13-slim
-    steps:
-      - shell: bash
-        env:
-          TAG: ${{ github.ref_name }}
-          VERSION: ${{ needs.version.outputs.version }}
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPO: ${{ github.repository }}
-          REGISTRY: ${{ vars.REGISTRY }}
-        run: |
-          python3 - <<'PY'
-          import json, os, urllib.request, urllib.error
-          api = f"{os.environ['CI_SERVER_INTERNAL']}/api/v1/repos/{os.environ['REPO']}"
-          h = {"Authorization": f"token {os.environ['TOKEN']}", "Content-Type": "application/json"}
-          tag, version = os.environ["TAG"], os.environ["VERSION"]
-          try:
-              urllib.request.urlopen(urllib.request.Request(f"{api}/releases/tags/{tag}", headers=h))
-              print(f"{tag} already has a release"); raise SystemExit
-          except urllib.error.HTTPError as e:
-              if e.code != 404: raise
-          image = f"{os.environ['REGISTRY']}/{os.environ['REPO']}:{version}"
-          body = f"Container image: `{image}` (linux/amd64, linux/arm64); also `:latest`."
-          data = json.dumps({"tag_name": tag, "name": f"INBUXA {version}", "body": body}).encode()
-          r = json.load(urllib.request.urlopen(urllib.request.Request(f"{api}/releases", data=data, headers=h)))
-          print(f"created release {r['tag_name']}")
-          PY

.gitea/workflows/weekly-release.yml

@@ -1,135 +0,0 @@
-# Weekly release, ported from .github/workflows/release.yml when the project
-# moved to the self-hosted Gitea (2026-09-22): cut a release once a week, but
-# only if there is something in it. A release with nothing in it moves
-# :latest to an identical build, spends a version number, and notifies
-# everybody about nothing.
-#
-# The version is the date, YYYY.M.D unpadded, with a .N suffix from 2 for a
-# second release on one day. It lives in crates/types/src/branding.rs
-# (brand_version!), deliberately not in Cargo.toml so upstream's version bumps
-# merge without conflicts. The bump is committed to main and the tag names that
-# commit, so the tree a tag points at reports the version the tag claims --
-# publish.yml refuses a tag that doesn't.
-#
-# Mondays 10:07 UTC, last of the three INBUXA releases: Admin and the webmail
-# release ahead of the server they talk to. Run it by hand with
-# workflow_dispatch; dry_run defaults to true.
-#
-# NOT LIVE YET: this only ever dry-runs unless the Actions variable
-# RELEASE_LIVE is '1' (repo or org). Going live also needs a repo secret
-# RELEASE_TOKEN (jcoffey-dev, write:repository, allowed to push to main):
-#   * a tag Gitea creates for the job's own token raises no event, and the
-#     tag must start publish.yml;
-#   * the bump is committed through the contents API. Gitea has no "only if
-#     the branch is still at X" guard, so the job checks main's head right
-#     before writing and refuses if it moved since the commit it counted from;
-#     run it again. (The API does refuse if the file itself changed, via its
-#     blob sha.)
-name: weekly-release
-
-on:
-  schedule:
-    - cron: '7 10 * * 1'
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: Show the decision and stop
-        type: boolean
-        default: true
-
-# One at a time: two overlapping runs would race to write the same version and
-# create the same tag.
-concurrency:
-  group: weekly-release
-  cancel-in-progress: false
-
-jobs:
-  weekly-release:
-    runs-on: light
-    container:
-      image: python:3.13-slim@sha256:8d9d0b8bcf6506481eae4907c18f5e3e7902e629f5f6d684f9e7c32e85e3ddf0 # 3.13-slim
-    env:
-      READ_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
-      # Live only with RELEASE_LIVE=1 AND either the schedule or a manual run
-      # with dry_run unticked.
-      DRY_RUN: ${{ (vars.RELEASE_LIVE == '1' && (github.event_name == 'schedule' || inputs.dry_run == false || inputs.dry_run == 'false')) && '0' || '1' }}
-      RELEASE_LIVE: ${{ vars.RELEASE_LIVE }}
-      REPO: ${{ github.repository }}
-    steps:
-      - uses: coffey-labs/actions/checkout@fab0c4d45e0162963965f1555df27b7bed5e20ec
-        with:
-          fetch-depth: 0
-      - shell: bash
-        run: |
-          python3 - <<'PY'
-          import base64, datetime, json, os, re, subprocess, sys, urllib.request
-
-          api = f"{os.environ['CI_SERVER_INTERNAL']}/api/v1/repos/{os.environ['REPO']}"
-          def call(method, path, token, body=None):
-              req = urllib.request.Request(api + path, method=method,
-                  data=json.dumps(body).encode() if body is not None else None,
-                  headers={"Authorization": f"token {token}", "Content-Type": "application/json"})
-              with urllib.request.urlopen(req) as r:
-                  return json.load(r)
-          def git(*a):
-              return subprocess.run(["git", *a], check=True, capture_output=True, text=True).stdout.strip()
-          def has_tag(t):
-              # show-ref matches an exact ref; rev-parse --verify on this git
-              # can read some tag names as describe output and "find" a tag
-              # that isn't there.
-              return subprocess.run(["git", "show-ref", "--verify", "--quiet", f"refs/tags/{t}"]).returncode == 0
-
-          sha = git("rev-parse", "HEAD")
-          # The newest published release, or empty on a project that has never
-          # had one -- in which case everything counts as new. A release can
-          # outlive its tag; falling back to the whole history over-counts,
-          # which cuts a release that was due anyway.
-          rels = call("GET", "/releases?draft=false&pre-release=false&limit=1", os.environ["READ_TOKEN"])
-          previous = rels[0]["tag_name"] if rels else ""
-          rng = f"{previous}..HEAD" if previous and has_tag(previous) else "HEAD"
-          count = int(git("rev-list", "--count", rng))
-          if count == 0:
-              print(f"Nothing to release: no commits since {previous}."); sys.exit(0)
-
-          d = datetime.datetime.now(datetime.timezone.utc)
-          today = f"{d.year}.{d.month}.{d.day}"
-          version, n = today, 2
-          while has_tag(f"v{version}"):
-              version, n = f"{today}.{n}", n + 1
-          tag = f"v{version}"
-          print(f"Releasing {tag} -- {count} commit(s) since {previous or 'the beginning'}, from {sha}.")
-          if os.environ["DRY_RUN"] == "1":
-              print(f"Dry run (RELEASE_LIVE='{os.environ.get('RELEASE_LIVE', '')}'): stopping here."); sys.exit(0)
-
-          token = os.environ.get("RELEASE_TOKEN", "")
-          if not token:
-              print("RELEASE_TOKEN secret is not set on this repository", file=sys.stderr); sys.exit(1)
-
-          # Scoped to the macro body rather than replacing the first quoted
-          # string in the file, and asserted to have matched exactly once:
-          # branding.rs holds other string literals.
-          path = "crates/types/src/branding.rs"
-          src = open(path, encoding="utf-8").read()
-          out, hits = re.subn(r'(macro_rules! brand_version \{\s*\(\) => \{\s*")[^"]+(")',
-                              lambda m: m.group(1) + version + m.group(2), src, count=1)
-          assert hits == 1, f"brand_version! not found in {path}"
-
-          head = call("GET", "/branches/main", token)["commit"]["id"]
-          if head != sha:
-              print(f"main moved from {sha} to {head} since this run counted; run it again.", file=sys.stderr); sys.exit(1)
-          blob = call("GET", f"/contents/{path}?ref={sha}", token)["sha"]
-          bump = call("PUT", f"/contents/{path}", token, {
-              "branch": "main", "message": f"Version {version}", "sha": blob,
-              "content": base64.b64encode(out.encode()).decode()})["commit"]["sha"]
-          print(f"committed the bump as {bump}")
-
-          # Notes bounded to what is new: one line per change on main's
-          # first-parent history. Creating the release creates the tag, which
-          # is an ordinary push, so publish.yml builds and pushes the image.
-          notes = git("log", "--first-parent", "--format=- %s", rng)
-          rel = call("POST", "/releases", token, {
-              "tag_name": tag, "target_commitish": bump, "name": f"INBUXA {version}",
-              "body": f"{count} commit(s) since {previous or 'the beginning'}.\n\n{notes}"})
-          print(f"created release {rel['tag_name']}")
-          PY

.gitignore

@@ -10,7 +10,6 @@ run.sh
 !.gitattributes
 !.github
 !.gitlab-ci.yml
-!.gitea
 CLAUDE.md
 
 # The cutover rehearsal writes its fixture and state here.

SECURITY.md

@@ -35,8 +35,8 @@ to Stalwart Labs with credit to you, and you'll be told that has happened.
 
 This repository is the mail server. The web front ends have their own:
 
-- [inbuxa-admin](https://git.coffeylabs.org/inbuxa/inbuxa-admin)
-- [ihasmail-inbuxa](https://git.coffeylabs.org/inbuxa/ihasmail-inbuxa)
+- [inbuxa-admin](https://github.com/inbuxa/inbuxa-admin)
+- [ihasmail-inbuxa](https://github.com/inbuxa/ihasmail-inbuxa)
 
 Upstream's own security documents are kept in `.github-upstream/` for
 reference. They describe Stalwart Labs' process, not this project's.

crates/common/src/config/network.rs

@@ -47,6 +47,9 @@ pub struct Network {
 #[derive(Clone)]
 pub struct NetworkInfo {
     pub pacc: Pacc,
+    /// inbuxa: the same document without IMAP, POP3, SMTP and ManageSieve,
+    /// served while legacy protocols are off (legacy-protocols LP-7).
+    pub pacc_jmap_only: Pacc,
     pub mxs: Vec<MailExchanger>,
     pub services: VecMap<ServiceProtocol, Service>,
 }
@@ -320,11 +323,26 @@ impl Network {
             }
         }
 
-        let (prefix, suffix) = serde_json::to_string(&pacc)
-            .unwrap_or_default()
-            .rsplit_once(SPLIT_HERE)
-            .map(|(prefix, suffix)| (prefix.to_string(), suffix.to_string()))
-            .unwrap();
+        let split = |pacc: &Configuration| {
+            serde_json::to_string(pacc)
+                .unwrap_or_default()
+                .rsplit_once(SPLIT_HERE)
+                .map(|(prefix, suffix)| Pacc {
+                    prefix: prefix.to_string(),
+                    suffix: suffix.to_string(),
+                })
+                .unwrap()
+        };
+        // inbuxa: legacy-protocols LP-7
+        let pacc_jmap_only = {
+            let mut pacc = pacc.clone();
+            pacc.protocols.imap = None;
+            pacc.protocols.pop3 = None;
+            pacc.protocols.smtp = None;
+            pacc.protocols.managesieve = None;
+            split(&pacc)
+        };
+        let pacc = split(&pacc);
         let mut network = Network {
             node_id: bp.node_id() as u64,
             server_name: default_hostname.to_string(),
@@ -339,7 +357,8 @@ impl Network {
             info: NetworkInfo {
                 mxs: system.mail_exchangers.into_iter().collect(),
                 services: system.services,
-                pacc: Pacc { prefix, suffix },
+                pacc,
+                pacc_jmap_only,
             },
         };
 

crates/common/src/network/autoconfig/autodiscover.rs

@@ -2,9 +2,11 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
-use crate::{Server, manager::application::Resource};
+use crate::{Server, manager::application::Resource, network::legacy::is_legacy_service};
 use quick_xml::Reader;
 use quick_xml::XmlVersion;
 use quick_xml::events::Event;
@@ -55,7 +57,15 @@ impl Server {
         let _ = writeln!(&mut config, "\t\t<Account>");
         let _ = writeln!(&mut config, "\t\t\t<AccountType>email</AccountType>");
         let _ = writeln!(&mut config, "\t\t\t<Action>settings</Action>");
+        // inbuxa: legacy-protocols LP-7, LP-14a
+        let legacy_off = match emailaddress.rsplit_once('@') {
+            Some((_, domain)) => self.legacy_protocols_off_for(domain).await?,
+            None => self.legacy_protocols_off_for("").await?,
+        };
         for (protocol, service) in &self.core.network.info.services {
+            if legacy_off && is_legacy_service(protocol) {
+                continue;
+            }
             let (protocol, ports) = match protocol {
                 ServiceProtocol::Imap => ("IMAP", [143, 993]),
                 ServiceProtocol::Pop3 => ("POP3", [110, 995]),

crates/common/src/network/autoconfig/legacy_autoconfig.rs

@@ -2,9 +2,11 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
-use crate::{Server, manager::application::Resource};
+use crate::{Server, manager::application::Resource, network::legacy::is_legacy_service};
 use registry::schema::enums::ServiceProtocol;
 use std::fmt::Write;
 use utils::url_params::UrlParams;
@@ -28,6 +30,9 @@ impl Server {
             ("%EMAILADDRESS%", default_host.as_str())
         };
 
+        // inbuxa: legacy-protocols LP-7, LP-14a
+        let legacy_off = self.legacy_protocols_off_for(domain).await?;
+
         // Build XML response
         let mut config = String::with_capacity(1024);
         config.push_str("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");
@@ -40,6 +45,9 @@ impl Server {
             "\t\t<displayShortName>{domain}</displayShortName>"
         );
         for (protocol, service) in &self.core.network.info.services {
+            if legacy_off && is_legacy_service(protocol) {
+                continue;
+            }
             let (protocol, tag, ports) = match protocol {
                 ServiceProtocol::Smtp => ("smtp", "outgoingServer", [587, 465]),
                 ServiceProtocol::Imap => ("imap", "incomingServer", [143, 993]),

crates/common/src/network/dns/records.rs

@@ -2,9 +2,15 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
-use crate::{Server, config::network::Pacc, network::dkim::generate_dkim_dns_record};
+use crate::{
+    Server,
+    config::network::Pacc,
+    network::{dkim::generate_dkim_dns_record, legacy::is_legacy_service},
+};
 use ahash::{AHashMap, AHashSet};
 use base64::{Engine, engine::general_purpose};
 use dns_update::{
@@ -34,6 +40,8 @@ impl Server {
         let network = &self.core.network;
         let default_host = network.server_name.as_str();
         let domain_name = domain.name.as_str();
+        // inbuxa: legacy-protocols LP-7, LP-14a
+        let legacy_off = self.legacy_protocols_off_for(domain_name).await?;
         let domain_name_suffix = format!(".{domain_name}");
 
         for record_type in record_types {
@@ -193,6 +201,25 @@ impl Server {
                             ServiceProtocol::Smtp => [("submission", 587), ("submissions", 465)],
                         };
 
+                        // inbuxa: legacy-protocols LP-7. While they are off, every
+                        // name says "not offered" -- target "." (RFC 6186 section
+                        // 3.4) -- rather than vanishing, so a client that looks
+                        // is told, and an old record left in the zone is replaced.
+                        if legacy_off && is_legacy_service(protocol) {
+                            for (service_name, _) in services {
+                                records.push(NamedDnsRecord {
+                                    name: format!("_{service_name}._tcp.{domain_name}."),
+                                    record: DnsRecord::SRV(SRVRecord {
+                                        target: ".".to_string(),
+                                        priority: 0,
+                                        weight: 0,
+                                        port: 0,
+                                    }),
+                                });
+                            }
+                            continue;
+                        }
+
                         for (is_tls, (service_name, port)) in services.into_iter().enumerate() {
                             if is_tls == 1 || service.cleartext {
                                 records.push(NamedDnsRecord {
@@ -277,6 +304,14 @@ impl Server {
                     for (protocol, service) in &network.info.services {
                         let hostname = service.hostname.as_deref().unwrap_or(default_host);
                         if hostname.ends_with(&domain_name_suffix) || hostname == domain_name {
+                            // inbuxa: legacy-protocols LP-7. No TLS pin for a port
+                            // the switch has closed. Submission's port stays open
+                            // (the SMTP lock), so its record stays.
+                            if legacy_off
+                                && matches!(protocol, ServiceProtocol::Imap | ServiceProtocol::Pop3)
+                            {
+                                continue;
+                            }
                             let port = match protocol {
                                 ServiceProtocol::Imap => 993,
                                 ServiceProtocol::Pop3 => 995,
@@ -382,6 +417,12 @@ impl Server {
     }
 
     pub async fn get_pacc_for_domain(&self, domain_name: &str) -> trc::Result<String> {
+        // inbuxa: legacy-protocols LP-7, LP-14a
+        let pacc = if self.legacy_protocols_off_for(domain_name).await? {
+            &self.core.network.info.pacc_jmap_only
+        } else {
+            &self.core.network.info.pacc
+        };
         self.get_directory_for_domain(domain_name)
             .await
             .caused_by(trc::location!())
@@ -390,15 +431,9 @@ impl Server {
                     .and_then(|directory| {
                         directory
                             .oidc_discovery_document()
-                            .map(|doc| self.core.network.info.pacc.build(&doc.url))
-                    })
-                    .unwrap_or_else(|| {
-                        self.core
-                            .network
-                            .info
-                            .pacc
-                            .build(&self.core.network.http.url_https)
+                            .map(|doc| pacc.build(&doc.url))
                     })
+                    .unwrap_or_else(|| pacc.build(&self.core.network.http.url_https))
             })
     }
 }

crates/common/src/network/legacy.rs

@@ -21,16 +21,23 @@
 //! a legacy protocol is refused before any password is looked at, so a
 //! listener that exists by mistake still lets nobody in.
 //!
+//! And nothing advertises what is closed (LP-7): client configuration and
+//! the suggested DNS records leave the legacy services out, or mark them as
+//! not offered, while the switch is off -- the server's, or for a tenant's
+//! domains, the tenant's (LP-14a).
+//!
 //! Nothing here touches the host's firewall, NAT port-forwards or any proxy
 //! (LP-20). The server stops answering; what still routes the port is the
 //! operator's to reconcile.
 
-use crate::{Server, config::server::Listeners, network::TcpAcceptor};
+use crate::{Server, auth::AccessToken, config::server::Listeners, network::TcpAcceptor};
 use directory::Credentials;
 use inbuxa_features::security::{
     listeners,
     protocol_policy::{self, ProtocolPolicy, SavedListener},
+    tenant_protocol_policy,
 };
+use registry::schema::enums::ServiceProtocol;
 use registry::types::{error::Error, id::ObjectId};
 use store::registry::bootstrap::Bootstrap;
 
@@ -102,6 +109,37 @@ impl Server {
 
         protocol_policy::set(&self.core.storage.data, &policy).await?;
 
+        // LP-8. Raised here rather than by the JMAP method, so whatever turns
+        // the switch is reported. A /set that changed nothing -- the switch
+        // already where it was asked to be, nothing to close or reopen -- is
+        // not a change.
+        if previous.legacy_protocols != policy.legacy_protocols || !change.is_empty() {
+            let (moved, direction) = if policy.legacy_protocols.is_disabled() {
+                (&change.closed, "closed")
+            } else {
+                (&change.reopened, "reopened")
+            };
+            trc::event!(
+                Security(trc::SecurityEvent::LegacyProtocolsChanged),
+                Policy = "server",
+                Value = if policy.legacy_protocols.is_disabled() {
+                    "disabled"
+                } else {
+                    "enabled"
+                },
+                AccountId = policy.changed_by.clone(),
+                Details = direction,
+                ListenerId = listener_names(moved.iter().map(|l| l.id.clone())),
+                // Only when a listener could not be put back (LP-5).
+                Reason = (!change.failed.is_empty()).then(|| listener_names(
+                    change
+                        .failed
+                        .iter()
+                        .map(|(l, why)| format!("{}: {why}", l.id))
+                )),
+            );
+        }
+
         Ok(change)
     }
 
@@ -215,6 +253,12 @@ impl Server {
     }
 }
 
+/// Names for an event field: the listeners a change closed, reopened or
+/// failed to reopen (LP-8).
+fn listener_names<T: Into<trc::Value>>(names: impl Iterator<Item = T>) -> trc::Value {
+    trc::Value::Array(names.map(Into::into).collect())
+}
+
 /// A protocol a mail app signs in over, which the switch refuses (LP-6).
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum LegacyProtocol {
@@ -236,39 +280,71 @@ impl LegacyProtocol {
         }
     }
 
-    /// What the mail app is told, at server scope (LP-12, LP-6). Each
-    /// protocol's own framing — IMAP's `[ALERT]`, ManageSieve's quoting —
-    /// is added by its session; POP3 carries `[AUTH]` in the text, since its
-    /// errors have no separate code, and SMTP is the whole reply line.
-    pub fn refusal(&self) -> &'static str {
-        match self {
-            LegacyProtocol::Imap => {
+    /// What the mail app is told (LP-12). Each protocol's own framing --
+    /// IMAP's `[ALERT]`, ManageSieve's quoting -- is added by its session;
+    /// POP3 carries `[AUTH]` in the text, since its errors have no separate
+    /// code, and SMTP is the whole reply line. At server scope "Your
+    /// organization" reads "This server" (LP-6).
+    pub fn refusal(&self, scope: RefusalScope) -> &'static str {
+        match (scope, self) {
+            (RefusalScope::Server, LegacyProtocol::Imap) => {
                 "This server allows only INBUXA webmail and JMAP apps. This mail app can't sign in."
             }
-            LegacyProtocol::Pop3 => {
+            (RefusalScope::Server, LegacyProtocol::Pop3) => {
                 "[AUTH] This server allows only INBUXA webmail and JMAP apps. This mail app can't sign in."
             }
-            LegacyProtocol::ManageSieve => "This server allows only INBUXA webmail and JMAP apps.",
-            LegacyProtocol::Submission => {
+            (RefusalScope::Server, LegacyProtocol::ManageSieve) => {
+                "This server allows only INBUXA webmail and JMAP apps."
+            }
+            (RefusalScope::Server, LegacyProtocol::Submission) => {
                 "535 5.7.0 This server allows only INBUXA webmail and JMAP apps. This mail app can't send.\r\n"
             }
+            (RefusalScope::Tenant(_), LegacyProtocol::Imap) => {
+                "Your organization allows only INBUXA webmail and JMAP apps. This mail app can't sign in."
+            }
+            (RefusalScope::Tenant(_), LegacyProtocol::Pop3) => {
+                "[AUTH] Your organization allows only INBUXA webmail and JMAP apps. This mail app can't sign in."
+            }
+            (RefusalScope::Tenant(_), LegacyProtocol::ManageSieve) => {
+                "Your organization allows only INBUXA webmail and JMAP apps."
+            }
+            (RefusalScope::Tenant(_), LegacyProtocol::Submission) => {
+                "535 5.7.0 Your organization allows only INBUXA webmail and JMAP apps. This mail app can't send.\r\n"
+            }
         }
     }
 
     /// The refusal as an error: `auth.legacy-protocol-refused`, not
     /// `auth.failed`, so it never counts against the account or feeds the
-    /// auto-ban (LP-11). It names the protocol and the domain, never the
-    /// account; the session it is raised in adds the remote IP.
-    pub fn refused(&self, credentials: &Credentials) -> trc::Error {
+    /// auto-ban (LP-11). It names the protocol, the scope and the domain,
+    /// never the account; the session adds the remote IP.
+    ///
+    /// Not the tenant's id: `Id` is what IMAP answers a command's tag from,
+    /// so an error carrying one is sent under the wrong tag and the mail app
+    /// waits for a reply that never comes. The domain names the tenant.
+    pub fn refused(&self, scope: RefusalScope, domain: Option<String>) -> trc::Error {
         trc::AuthEvent::LegacyProtocolRefused
             .into_err()
-            .details(self.refusal())
+            .details(self.refusal(scope))
             .ctx(trc::Key::Source, self.as_str())
-            .ctx(trc::Key::Policy, "server")
-            .ctx_opt(trc::Key::Domain, domain_of(credentials))
+            .ctx(
+                trc::Key::Policy,
+                match scope {
+                    RefusalScope::Server => "server",
+                    RefusalScope::Tenant(_) => "tenant",
+                },
+            )
+            .ctx_opt(trc::Key::Domain, domain)
     }
 }
 
+/// Whose switch refused a sign-in: the server's (LP-6) or a tenant's (LP-10).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum RefusalScope {
+    Server,
+    Tenant(u32),
+}
+
 /// The domain a sign-in is for, from the name it gives, if it gives one.
 fn domain_of(credentials: &Credentials) -> Option<String> {
     let username = match credentials {
@@ -283,21 +359,89 @@ fn domain_of(credentials: &Credentials) -> Option<String> {
 
 impl Server {
     /// Refuses a sign-in over a legacy protocol while the server-wide switch
-    /// is off (LP-6). Called before the credentials are checked, so the
-    /// answer is the same for a right password, a wrong one and an account
-    /// that doesn't exist (LP-11).
+    /// is off (LP-6), or while the switch of the tenant that owns the named
+    /// domain is (LP-10). Called before the credentials are checked, so the
+    /// answer is the same for a right password, a wrong one and an address
+    /// that doesn't exist (LP-11): a tenant's domain answers for every address
+    /// on it.
     ///
     /// Read from the store on each sign-in rather than cached, so every node
-    /// of a cluster answers the same the moment the switch turns.
+    /// of a cluster answers the same the moment a switch turns.
     pub async fn refuse_legacy_sign_in(
         &self,
         protocol: LegacyProtocol,
         credentials: &Credentials,
     ) -> trc::Result<()> {
+        let domain = domain_of(credentials);
         if self.protocol_policy().await?.legacy_protocols.is_disabled() {
-            Err(protocol.refused(credentials))
-        } else {
-            Ok(())
+            return Err(protocol.refused(RefusalScope::Server, domain));
+        }
+        if let Some(name) = &domain
+            && let Some(domain) = self.domain(name).await?
+            && let Some(tenant_id) = domain.id_tenant
+            && self.tenant_legacy_protocols_off(tenant_id).await?
+        {
+            return Err(protocol.refused(RefusalScope::Tenant(tenant_id), Some(name.clone())));
+        }
+        Ok(())
+    }
+
+    /// The same, once the account is known (LP-10). A bearer token needn't
+    /// name an account, so a sign-in with one can't be judged by its domain
+    /// beforehand; this judges it by the tenant the token turned out to
+    /// belong to. For a password sign-in it has already been decided.
+    pub async fn refuse_legacy_session(
+        &self,
+        protocol: LegacyProtocol,
+        access_token: &AccessToken,
+    ) -> trc::Result<()> {
+        if let Some(tenant_id) = access_token.tenant_id()
+            && self.tenant_legacy_protocols_off(tenant_id).await?
+        {
+            return Err(protocol.refused(RefusalScope::Tenant(tenant_id), None));
+        }
+        Ok(())
+    }
+
+    /// Whether a tenant has turned legacy protocols off for itself (LP-10).
+    pub async fn tenant_legacy_protocols_off(&self, tenant_id: u32) -> trc::Result<bool> {
+        Ok(
+            tenant_protocol_policy::get(&self.core.storage.data, tenant_id)
+                .await?
+                .legacy_protocols
+                .is_disabled(),
+        )
+    }
+}
+
+/// The services mail apps sign in to, which the switch turns off: nothing may
+/// offer them while it is (LP-7). SMTP here is submission -- mail apps
+/// sending -- since inbound mail is never a configured service.
+pub fn is_legacy_service(protocol: &ServiceProtocol) -> bool {
+    matches!(
+        protocol,
+        ServiceProtocol::Imap
+            | ServiceProtocol::Pop3
+            | ServiceProtocol::Smtp
+            | ServiceProtocol::Managesieve
+    )
+}
+
+impl Server {
+    /// Whether legacy services are off for this domain, for the answers that
+    /// must stop offering them: off for the whole server (LP-7), or for the
+    /// tenant the domain belongs to (LP-14a). Read per answer, as sign-in
+    /// reads it. A name that is no domain here answers for the server alone.
+    pub async fn legacy_protocols_off_for(&self, domain_name: &str) -> trc::Result<bool> {
+        if self.protocol_policy().await?.legacy_protocols.is_disabled() {
+            return Ok(true);
+        }
+        match self.domain(domain_name).await? {
+            Some(domain) => match domain.id_tenant {
+                Some(tenant_id) => self.tenant_legacy_protocols_off(tenant_id).await,
+                None => Ok(false),
+            },
+            None => Ok(false),
         }
     }
 }
@@ -317,28 +461,57 @@ mod tests {
     #[test]
     fn refusals_read_as_the_spec_writes_them() {
         // LP-12, with "Your organization" read as "This server" (LP-6).
+        let server = RefusalScope::Server;
         assert_eq!(
-            LegacyProtocol::Imap.refusal(),
+            LegacyProtocol::Imap.refusal(server),
             "This server allows only INBUXA webmail and JMAP apps. This mail app can't sign in."
         );
         assert!(
             LegacyProtocol::Pop3
-                .refusal()
+                .refusal(server)
                 .starts_with("[AUTH] This server allows")
         );
         assert_eq!(
-            LegacyProtocol::ManageSieve.refusal(),
+            LegacyProtocol::ManageSieve.refusal(server),
             "This server allows only INBUXA webmail and JMAP apps."
         );
         assert_eq!(
-            LegacyProtocol::Submission.refusal(),
+            LegacyProtocol::Submission.refusal(server),
             "535 5.7.0 This server allows only INBUXA webmail and JMAP apps. This mail app can't send.\r\n"
         );
     }
 
+    #[test]
+    fn a_tenant_refusal_speaks_for_the_organization() {
+        // LP-12, exactly as the spec writes them.
+        let tenant = RefusalScope::Tenant(7);
+        assert_eq!(
+            LegacyProtocol::Imap.refusal(tenant),
+            "Your organization allows only INBUXA webmail and JMAP apps. This mail app can't sign in."
+        );
+        assert_eq!(
+            LegacyProtocol::Pop3.refusal(tenant),
+            "[AUTH] Your organization allows only INBUXA webmail and JMAP apps. This mail app can't sign in."
+        );
+        assert_eq!(
+            LegacyProtocol::ManageSieve.refusal(tenant),
+            "Your organization allows only INBUXA webmail and JMAP apps."
+        );
+        assert_eq!(
+            LegacyProtocol::Submission.refusal(tenant),
+            "535 5.7.0 Your organization allows only INBUXA webmail and JMAP apps. This mail app can't send.\r\n"
+        );
+        let err = LegacyProtocol::Imap.refused(tenant, Some("example.org".into()));
+        assert_eq!(err.value_as_str(trc::Key::Policy), Some("tenant"));
+        // IMAP answers the command's tag from Id; the refusal must leave it be.
+        assert!(err.value(trc::Key::Id).is_none());
+        assert!(err.matches(trc::EventType::Auth(trc::AuthEvent::LegacyProtocolRefused)));
+    }
+
     #[test]
     fn a_refusal_is_not_a_failed_sign_in() {
-        let err = LegacyProtocol::Imap.refused(&basic("[email protected]"));
+        let err = LegacyProtocol::Imap
+            .refused(RefusalScope::Server, domain_of(&basic("[email protected]")));
         assert!(err.matches(trc::EventType::Auth(trc::AuthEvent::LegacyProtocolRefused)));
         assert!(!err.matches(trc::EventType::Auth(trc::AuthEvent::Failed)));
         // The session stays open: the mail app is told, not thrown off.
@@ -349,6 +522,26 @@ mod tests {
         assert_eq!(err.value_as_str(trc::Key::AccountName), None);
     }
 
+    #[test]
+    fn only_the_services_mail_apps_sign_in_to_are_legacy() {
+        for protocol in [
+            ServiceProtocol::Imap,
+            ServiceProtocol::Pop3,
+            ServiceProtocol::Smtp,
+            ServiceProtocol::Managesieve,
+        ] {
+            assert!(is_legacy_service(&protocol), "{protocol:?}");
+        }
+        for protocol in [
+            ServiceProtocol::Jmap,
+            ServiceProtocol::Caldav,
+            ServiceProtocol::Carddav,
+            ServiceProtocol::Webdav,
+        ] {
+            assert!(!is_legacy_service(&protocol), "{protocol:?}");
+        }
+    }
+
     #[test]
     fn the_domain_comes_from_the_name_given() {
         assert_eq!(domain_of(&basic("[email protected]")), Some("b.test".to_string()));

crates/features/src/security/mod.rs

@@ -12,3 +12,4 @@
 
 pub mod listeners;
 pub mod protocol_policy;
+pub mod tenant_protocol_policy;

crates/features/src/security/tenant_protocol_policy.rs

@@ -0,0 +1,157 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+//! `inbuxa:TenantProtocolPolicy`, one tenant's legacy mail protocols switch
+//! (legacy-protocols spec, LP-9 to LP-14a). Stored as JSON under `P` `t` and
+//! the tenant id in the fork's subspace; a tenant with nothing stored has
+//! legacy protocols on.
+//!
+//! A tenant's switch closes no port -- other tenants share them (LP-13). It
+//! refuses sign-in on the tenant's domains, and keeps client configuration
+//! for them from offering what's refused. That is all it is: one fact per
+//! tenant, easy to turn back, touching no listener, role or permission.
+
+use crate::security::protocol_policy::{LegacyProtocols, ProtocolPolicy};
+use serde::{Deserialize as SerdeDeserialize, Serialize as SerdeSerialize};
+use store::{
+    Deserialize, SUBSPACE_INBUXA, Store, ValueKey,
+    write::{AnyClass, BatchBuilder, ValueClass},
+};
+use trc::AddContext;
+
+/// One tenant's switch.
+#[derive(Debug, Clone, PartialEq, Default, SerdeSerialize, SerdeDeserialize)]
+#[serde(rename_all = "camelCase", default)]
+pub struct TenantProtocolPolicy {
+    /// The switch itself.
+    pub legacy_protocols: LegacyProtocols,
+    /// When it last changed, in milliseconds since the epoch.
+    pub changed_at: Option<u64>,
+    /// The account that last changed it.
+    pub changed_by: Option<String>,
+}
+
+/// Why a tenant's switch can't be set this way, if it can't (LP-9).
+///
+/// A tenant can always turn legacy protocols off for itself. It can turn
+/// them back on only while the server has them on: server off means off for
+/// everyone.
+pub fn refusal(server: &ProtocolPolicy, requested: LegacyProtocols) -> Option<&'static str> {
+    (server.legacy_protocols.is_disabled() && !requested.is_disabled()).then_some(
+        "Legacy mail protocols are off for the whole server (inbuxa:ProtocolPolicy), \
+         so they can't be turned back on for one organization.",
+    )
+}
+
+fn key(tenant_id: u32) -> ValueClass {
+    let mut key = Vec::with_capacity(6);
+    key.extend_from_slice(b"Pt");
+    key.extend_from_slice(&tenant_id.to_be_bytes());
+    ValueClass::Any(AnyClass {
+        subspace: SUBSPACE_INBUXA,
+        key,
+    })
+}
+
+struct Json(TenantProtocolPolicy);
+
+impl Deserialize for Json {
+    fn deserialize(bytes: &[u8]) -> trc::Result<Self> {
+        serde_json::from_slice(bytes).map(Json).map_err(|err| {
+            trc::StoreEvent::DataCorruption
+                .caused_by(trc::location!())
+                .reason(err)
+        })
+    }
+}
+
+/// The tenant's policy, or the default (on) when it has never been set.
+pub async fn get(data: &Store, tenant_id: u32) -> trc::Result<TenantProtocolPolicy> {
+    Ok(data
+        .get_value::<Json>(ValueKey::from(key(tenant_id)))
+        .await
+        .caused_by(trc::location!())?
+        .map(|Json(policy)| policy)
+        .unwrap_or_default())
+}
+
+/// Stores the tenant's policy.
+pub async fn set(data: &Store, tenant_id: u32, policy: &TenantProtocolPolicy) -> trc::Result<()> {
+    let bytes = serde_json::to_vec(policy).map_err(|err| {
+        trc::StoreEvent::UnexpectedError
+            .caused_by(trc::location!())
+            .reason(err)
+    })?;
+    let mut batch = BatchBuilder::new();
+    batch.set(key(tenant_id), bytes);
+    data.write(batch.build_all())
+        .await
+        .caused_by(trc::location!())
+        .map(|_| ())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn server(legacy_protocols: LegacyProtocols) -> ProtocolPolicy {
+        ProtocolPolicy {
+            legacy_protocols,
+            ..Default::default()
+        }
+    }
+
+    #[test]
+    fn a_tenant_starts_with_legacy_protocols_on() {
+        assert!(
+            !TenantProtocolPolicy::default()
+                .legacy_protocols
+                .is_disabled()
+        );
+    }
+
+    #[test]
+    fn a_tenant_can_always_turn_them_off() {
+        for s in [LegacyProtocols::Enabled, LegacyProtocols::Disabled] {
+            assert_eq!(refusal(&server(s), LegacyProtocols::Disabled), None);
+        }
+    }
+
+    #[test]
+    fn a_tenant_can_turn_them_on_only_while_the_server_has_them_on() {
+        // LP-9, acceptance test 9.
+        assert_eq!(
+            refusal(&server(LegacyProtocols::Enabled), LegacyProtocols::Enabled),
+            None
+        );
+        let why =
+            refusal(&server(LegacyProtocols::Disabled), LegacyProtocols::Enabled).expect("refused");
+        assert!(why.contains("inbuxa:ProtocolPolicy"), "{why}");
+    }
+
+    #[test]
+    fn keys_are_per_tenant_and_clear_of_the_server_policy() {
+        let ValueClass::Any(a) = key(1) else { panic!() };
+        let ValueClass::Any(b) = key(2) else { panic!() };
+        assert_ne!(a.key, b.key);
+        assert_eq!(&a.key[..2], b"Pt");
+        assert_ne!(a.key, b"Pp".to_vec());
+    }
+
+    #[test]
+    fn stored_json_reads_back() {
+        let policy = TenantProtocolPolicy {
+            legacy_protocols: LegacyProtocols::Disabled,
+            changed_at: Some(1),
+            changed_by: Some("b".into()),
+        };
+        let Json(back) = Json::deserialize(&serde_json::to_vec(&policy).unwrap()).unwrap();
+        assert_eq!(back, policy);
+        // Unknown and missing fields read as defaults.
+        let Json(back) = Json::deserialize(br#"{"futureField":1}"#).unwrap();
+        assert_eq!(back, TenantProtocolPolicy::default());
+    }
+}

crates/imap/src/op/authenticate.rs

@@ -100,6 +100,12 @@ impl<T: SessionStream> Session<T> {
             })
             .and_then(|token| token.assert_has_permission(Permission::ImapAuthenticate))?;
 
+        // inbuxa: legacy-protocols LP-10, for a bearer token that named no account
+        self.server
+            .refuse_legacy_session(LegacyProtocol::Imap, &access_token)
+            .await
+            .map_err(|err| err.code(ResponseCode::Alert).id(tag.clone()))?;
+
         // Enforce concurrency limits
         let in_flight = match access_token.is_imap_request_allowed() {
             LimiterResult::Allowed(in_flight) => Some(in_flight),

crates/jmap-proto/src/object/inbuxa_tenant_protocol_policy.rs

@@ -0,0 +1,180 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+//! `inbuxa:TenantProtocolPolicy/get` and `/set` under `urn:inbuxa:jmap`: one
+//! tenant's legacy mail protocols switch (legacy-protocols spec, LP-9 to
+//! LP-14). One per tenant; its id is the tenant's id.
+//!
+//! `tenantId`, `changedAt` and `changedBy` are the server's to say. A client
+//! that sets them is answered with `invalidProperties`.
+
+use crate::object::{AnyId, JmapObject, JmapObjectId};
+use jmap_tools::{Element, Key, Property};
+use std::{borrow::Cow, str::FromStr};
+use types::id::Id;
+
+#[derive(Debug, Clone, Default)]
+pub struct TenantProtocolPolicy;
+
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum TenantProtocolPolicyProperty {
+    Id,
+    /// Server-set: the tenant this is the switch of.
+    TenantId,
+    /// The switch: `enabled` or `disabled`.
+    LegacyProtocols,
+    ChangedAt,
+    ChangedBy,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum TenantProtocolPolicyValue {
+    Id(Id),
+}
+
+impl Property for TenantProtocolPolicyProperty {
+    fn try_parse(_: Option<&Key<'_, Self>>, value: &str) -> Option<Self> {
+        TenantProtocolPolicyProperty::parse(value)
+    }
+
+    fn to_cow(&self) -> Cow<'static, str> {
+        match self {
+            TenantProtocolPolicyProperty::Id => "id",
+            TenantProtocolPolicyProperty::TenantId => "tenantId",
+            TenantProtocolPolicyProperty::LegacyProtocols => "legacyProtocols",
+            TenantProtocolPolicyProperty::ChangedAt => "changedAt",
+            TenantProtocolPolicyProperty::ChangedBy => "changedBy",
+        }
+        .into()
+    }
+}
+
+impl TenantProtocolPolicyProperty {
+    fn parse(value: &str) -> Option<Self> {
+        hashify::tiny_map!(value.as_bytes(),
+            b"id" => TenantProtocolPolicyProperty::Id,
+            b"tenantId" => TenantProtocolPolicyProperty::TenantId,
+            b"legacyProtocols" => TenantProtocolPolicyProperty::LegacyProtocols,
+            b"changedAt" => TenantProtocolPolicyProperty::ChangedAt,
+            b"changedBy" => TenantProtocolPolicyProperty::ChangedBy,
+        )
+    }
+}
+
+impl TenantProtocolPolicyProperty {
+    /// Whether this property is the server's to say. A client that sets one
+    /// is answered with `invalidProperties`.
+    pub fn is_server_set(&self) -> bool {
+        matches!(
+            self,
+            TenantProtocolPolicyProperty::TenantId
+                | TenantProtocolPolicyProperty::ChangedAt
+                | TenantProtocolPolicyProperty::ChangedBy
+        )
+    }
+}
+
+impl FromStr for TenantProtocolPolicyProperty {
+    type Err = ();
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        TenantProtocolPolicyProperty::parse(s).ok_or(())
+    }
+}
+
+impl Element for TenantProtocolPolicyValue {
+    type Property = TenantProtocolPolicyProperty;
+
+    fn try_parse<P>(key: &Key<'_, Self::Property>, value: &str) -> Option<Self> {
+        match key {
+            Key::Property(TenantProtocolPolicyProperty::Id) => {
+                Id::from_str(value).ok().map(TenantProtocolPolicyValue::Id)
+            }
+            _ => None,
+        }
+    }
+
+    fn to_cow(&self) -> Cow<'static, str> {
+        match self {
+            TenantProtocolPolicyValue::Id(id) => id.to_string().into(),
+        }
+    }
+}
+
+impl JmapObject for TenantProtocolPolicy {
+    type Property = TenantProtocolPolicyProperty;
+
+    type Element = TenantProtocolPolicyValue;
+
+    type Id = Id;
+
+    type Filter = ();
+
+    type Comparator = ();
+
+    type GetArguments = ();
+
+    type SetArguments<'de> = ();
+
+    type QueryArguments = ();
+
+    type CopyArguments = ();
+
+    type ParseArguments = ();
+
+    const ID_PROPERTY: Self::Property = TenantProtocolPolicyProperty::Id;
+}
+
+impl From<Id> for TenantProtocolPolicyValue {
+    fn from(id: Id) -> Self {
+        TenantProtocolPolicyValue::Id(id)
+    }
+}
+
+impl JmapObjectId for TenantProtocolPolicyValue {
+    fn as_id(&self) -> Option<Id> {
+        match self {
+            TenantProtocolPolicyValue::Id(id) => Some(*id),
+        }
+    }
+
+    fn as_any_id(&self) -> Option<AnyId> {
+        match self {
+            TenantProtocolPolicyValue::Id(id) => Some(AnyId::Id(*id)),
+        }
+    }
+
+    fn as_id_ref(&self) -> Option<&str> {
+        None
+    }
+
+    fn try_set_id(&mut self, new_id: AnyId) -> bool {
+        if let AnyId::Id(id) = new_id {
+            *self = TenantProtocolPolicyValue::Id(id);
+            true
+        } else {
+            false
+        }
+    }
+}
+
+impl JmapObjectId for TenantProtocolPolicyProperty {
+    fn as_id(&self) -> Option<Id> {
+        None
+    }
+
+    fn as_any_id(&self) -> Option<AnyId> {
+        None
+    }
+
+    fn as_id_ref(&self) -> Option<&str> {
+        None
+    }
+
+    fn try_set_id(&mut self, _: AnyId) -> bool {
+        false
+    }
+}

crates/jmap-proto/src/object/mod.rs

@@ -23,6 +23,7 @@ pub mod email_submission;
 pub mod fastmail_masked_email; // inbuxa: masked email
 pub mod inbuxa_ai_limits; // inbuxa: AI spam classification
 pub mod inbuxa_protocol_policy; // inbuxa: legacy protocols off
+pub mod inbuxa_tenant_protocol_policy; // inbuxa: legacy protocols off, per tenant
 pub mod inbuxa_deleted_account; // inbuxa: undelete
 pub mod file_node;
 pub mod identity;

crates/jmap-proto/src/references/eval.rs

@@ -64,6 +64,9 @@ impl Response<'_> {
                         GetResponseMethod::ProtocolPolicy(response) => {
                             response.eval_jptr(path, &mut results)
                         }
+                        GetResponseMethod::TenantProtocolPolicy(response) => {
+                            response.eval_jptr(path, &mut results)
+                        }
                         GetResponseMethod::Principal(response) => {
                             response.eval_jptr(path, &mut results)
                         }

crates/jmap-proto/src/references/resolve.rs

@@ -47,6 +47,9 @@ impl Response<'_> {
                 GetRequestMethod::DeletedAccount(request) => request.resolve_references(self)?,
                 GetRequestMethod::AiLimits(request) => request.resolve_references(self)?,
                 GetRequestMethod::ProtocolPolicy(request) => request.resolve_references(self)?,
+                GetRequestMethod::TenantProtocolPolicy(request) => {
+                    request.resolve_references(self)?
+                }
                 GetRequestMethod::Principal(request) => request.resolve_references(self)?,
                 GetRequestMethod::Quota(request) => request.resolve_references(self)?,
                 GetRequestMethod::Blob(request) => request.resolve_references(self)?,
@@ -93,6 +96,9 @@ impl Response<'_> {
                 SetRequestMethod::ProtocolPolicy(request) => {
                     request.resolve_references(self, 1, false)?
                 }
+                SetRequestMethod::TenantProtocolPolicy(request) => {
+                    request.resolve_references(self, 1, false)?
+                }
                 SetRequestMethod::AddressBook(request) => {
                     request.resolve_references(self, 1, false)?
                 }

crates/jmap-proto/src/request/method.rs

@@ -50,6 +50,7 @@ pub enum MethodObject {
     // inbuxa: AI call limits
     AiLimits,
     ProtocolPolicy,
+    TenantProtocolPolicy,
 }
 
 impl MethodObject {
@@ -77,6 +78,7 @@ impl MethodObject {
             MethodObject::DeletedAccount => Capability::Inbuxa,
             MethodObject::AiLimits => Capability::Inbuxa,
             MethodObject::ProtocolPolicy => Capability::Inbuxa,
+            MethodObject::TenantProtocolPolicy => Capability::Inbuxa,
         }
     }
 }
@@ -256,6 +258,12 @@ impl MethodName {
             (MethodFunction::Set, MethodObject::AiLimits) => "inbuxa:AiLimits/set",
             (MethodFunction::Get, MethodObject::ProtocolPolicy) => "inbuxa:ProtocolPolicy/get",
             (MethodFunction::Set, MethodObject::ProtocolPolicy) => "inbuxa:ProtocolPolicy/set",
+            (MethodFunction::Get, MethodObject::TenantProtocolPolicy) => {
+                "inbuxa:TenantProtocolPolicy/get"
+            }
+            (MethodFunction::Set, MethodObject::TenantProtocolPolicy) => {
+                "inbuxa:TenantProtocolPolicy/set"
+            }
             (method, MethodObject::Registry(obj)) => {
                 return Cow::Owned(format!("x:{}/{}", obj.as_str(), method.as_str()));
             }
@@ -383,6 +391,8 @@ impl MethodName {
             "inbuxa:AiLimits/set" => (MethodObject::AiLimits, MethodFunction::Set),
             "inbuxa:ProtocolPolicy/get" => (MethodObject::ProtocolPolicy, MethodFunction::Get),
             "inbuxa:ProtocolPolicy/set" => (MethodObject::ProtocolPolicy, MethodFunction::Set),
+            "inbuxa:TenantProtocolPolicy/get" => (MethodObject::TenantProtocolPolicy, MethodFunction::Get),
+            "inbuxa:TenantProtocolPolicy/set" => (MethodObject::TenantProtocolPolicy, MethodFunction::Set),
 
         ).or_else(|| {
             let (obj, fnc) = s.strip_prefix("x:")?.split_once('/')?;
@@ -437,6 +447,7 @@ impl Display for MethodObject {
             MethodObject::DeletedAccount => "inbuxa:DeletedAccount",
             MethodObject::AiLimits => "inbuxa:AiLimits",
             MethodObject::ProtocolPolicy => "inbuxa:ProtocolPolicy",
+            MethodObject::TenantProtocolPolicy => "inbuxa:TenantProtocolPolicy",
             MethodObject::Registry(obj) => {
                 f.write_str("x:")?;
                 return f.write_str(obj.as_str());

crates/jmap-proto/src/request/mod.rs

@@ -117,6 +117,9 @@ pub enum GetRequestMethod {
     DeletedAccount(Box<GetRequest<crate::object::inbuxa_deleted_account::DeletedAccount>>),
     AiLimits(Box<GetRequest<crate::object::inbuxa_ai_limits::AiLimits>>),
     ProtocolPolicy(Box<GetRequest<crate::object::inbuxa_protocol_policy::ProtocolPolicy>>),
+    TenantProtocolPolicy(
+        Box<GetRequest<crate::object::inbuxa_tenant_protocol_policy::TenantProtocolPolicy>>,
+    ),
 }
 
 #[derive(Debug)]
@@ -141,6 +144,9 @@ pub enum SetRequestMethod<'x> {
     DeletedAccount(Box<SetRequest<'x, crate::object::inbuxa_deleted_account::DeletedAccount>>),
     AiLimits(Box<SetRequest<'x, crate::object::inbuxa_ai_limits::AiLimits>>),
     ProtocolPolicy(Box<SetRequest<'x, crate::object::inbuxa_protocol_policy::ProtocolPolicy>>),
+    TenantProtocolPolicy(
+        Box<SetRequest<'x, crate::object::inbuxa_tenant_protocol_policy::TenantProtocolPolicy>>,
+    ),
 }
 
 #[derive(Debug)]

crates/jmap-proto/src/request/parser.rs

@@ -176,6 +176,15 @@ impl<'de> Visitor<'de> for CallVisitor {
                     return Err(de::Error::invalid_length(1, &self));
                 }
             },
+            (MethodFunction::Get, MethodObject::TenantProtocolPolicy) => match seq.next_element() {
+                Ok(Some(value)) => {
+                    RequestMethod::Get(GetRequestMethod::TenantProtocolPolicy(value))
+                }
+                Err(err) => RequestMethod::invalid(err),
+                Ok(None) => {
+                    return Err(de::Error::invalid_length(1, &self));
+                }
+            },
             (MethodFunction::Get, MethodObject::VacationResponse) => match seq.next_element() {
                 Ok(Some(value)) => RequestMethod::Get(GetRequestMethod::VacationResponse(value)),
                 Err(err) => RequestMethod::invalid(err),
@@ -348,6 +357,15 @@ impl<'de> Visitor<'de> for CallVisitor {
                     return Err(de::Error::invalid_length(1, &self));
                 }
             },
+            (MethodFunction::Set, MethodObject::TenantProtocolPolicy) => match seq.next_element() {
+                Ok(Some(value)) => {
+                    RequestMethod::Set(SetRequestMethod::TenantProtocolPolicy(value))
+                }
+                Err(err) => RequestMethod::invalid(err),
+                Ok(None) => {
+                    return Err(de::Error::invalid_length(1, &self));
+                }
+            },
             (MethodFunction::Set, MethodObject::VacationResponse) => match seq.next_element() {
                 Ok(Some(value)) => RequestMethod::Set(SetRequestMethod::VacationResponse(value)),
                 Err(err) => RequestMethod::invalid(err),

crates/jmap-proto/src/response/mod.rs

@@ -104,6 +104,9 @@ pub enum GetResponseMethod {
     DeletedAccount(GetResponse<crate::object::inbuxa_deleted_account::DeletedAccount>),
     AiLimits(GetResponse<crate::object::inbuxa_ai_limits::AiLimits>),
     ProtocolPolicy(GetResponse<crate::object::inbuxa_protocol_policy::ProtocolPolicy>),
+    TenantProtocolPolicy(
+        GetResponse<crate::object::inbuxa_tenant_protocol_policy::TenantProtocolPolicy>,
+    ),
 }
 
 #[derive(Debug, serde::Serialize)]
@@ -129,6 +132,9 @@ pub enum SetResponseMethod {
     DeletedAccount(Box<SetResponse<crate::object::inbuxa_deleted_account::DeletedAccount>>),
     AiLimits(Box<SetResponse<crate::object::inbuxa_ai_limits::AiLimits>>),
     ProtocolPolicy(Box<SetResponse<crate::object::inbuxa_protocol_policy::ProtocolPolicy>>),
+    TenantProtocolPolicy(
+        Box<SetResponse<crate::object::inbuxa_tenant_protocol_policy::TenantProtocolPolicy>>,
+    ),
 }
 
 #[derive(Debug, serde::Serialize)]
@@ -305,6 +311,26 @@ impl<'x> From<SetResponse<crate::object::inbuxa_protocol_policy::ProtocolPolicy>
     }
 }
 
+impl<'x> From<GetResponse<crate::object::inbuxa_tenant_protocol_policy::TenantProtocolPolicy>>
+    for ResponseMethod<'x>
+{
+    fn from(
+        value: GetResponse<crate::object::inbuxa_tenant_protocol_policy::TenantProtocolPolicy>,
+    ) -> Self {
+        ResponseMethod::Get(GetResponseMethod::TenantProtocolPolicy(value))
+    }
+}
+
+impl<'x> From<SetResponse<crate::object::inbuxa_tenant_protocol_policy::TenantProtocolPolicy>>
+    for ResponseMethod<'x>
+{
+    fn from(
+        value: SetResponse<crate::object::inbuxa_tenant_protocol_policy::TenantProtocolPolicy>,
+    ) -> Self {
+        ResponseMethod::Set(SetResponseMethod::TenantProtocolPolicy(Box::new(value)))
+    }
+}
+
 impl<'x> From<GetResponse<crate::object::inbuxa_ai_limits::AiLimits>> for ResponseMethod<'x> {
     fn from(value: GetResponse<crate::object::inbuxa_ai_limits::AiLimits>) -> Self {
         ResponseMethod::Get(GetResponseMethod::AiLimits(value))

crates/jmap/src/api/auth.rs

@@ -80,6 +80,10 @@ impl JmapAuthorization for AccessToken {
                 // inbuxa: legacy protocols off. It takes listeners away and
                 // puts them back, so it takes the listener's permissions
                 GetRequestMethod::ProtocolPolicy(_) => Permission::SysNetworkListenerGet,
+                // inbuxa: legacy protocols off, per tenant. It governs
+                // sign-in on the tenant's domains, so it takes the domain's
+                // permissions, which a tenant administrator already holds.
+                GetRequestMethod::TenantProtocolPolicy(_) => Permission::SysDomainGet,
                 GetRequestMethod::Principal(_) => Permission::JmapPrincipalGet,
                 GetRequestMethod::Quota(_) => Permission::JmapQuotaGet,
                 GetRequestMethod::Blob(_) => Permission::JmapBlobGet,
@@ -184,6 +188,14 @@ impl JmapAuthorization for AccessToken {
                         Permission::SysNetworkListenerUpdate,
                         Permission::SysNetworkListenerUpdate,
                     ),
+                    // inbuxa: legacy protocols off, per tenant, with the domain's
+                    SetRequestMethod::TenantProtocolPolicy(s) => validate_set(
+                        s,
+                        self,
+                        Permission::SysDomainUpdate,
+                        Permission::SysDomainUpdate,
+                        Permission::SysDomainUpdate,
+                    ),
                     SetRequestMethod::VacationResponse(s) => validate_set(
                         s,
                         self,
@@ -294,7 +306,8 @@ impl JmapAuthorization for AccessToken {
                 | MethodObject::MaskedEmail
                 | MethodObject::DeletedAccount
                 | MethodObject::AiLimits
-                | MethodObject::ProtocolPolicy => Permission::JmapEmailChanges,
+                | MethodObject::ProtocolPolicy
+                | MethodObject::TenantProtocolPolicy => Permission::JmapEmailChanges,
                 // inbuxa: x:MaskedEmail/changes reads what /get reads
                 MethodObject::Registry(object_type) => object_type.get_permission(),
             },

crates/jmap/src/api/mod.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use crate::blob::UploadResponse;
@@ -186,7 +188,10 @@ impl ToRequestError for trc::Error {
                 trc::SecurityEvent::Unauthorized | trc::SecurityEvent::IpUnauthorized => {
                     RequestError::forbidden()
                 }
-                trc::SecurityEvent::IpBlockExpired | trc::SecurityEvent::IpAllowExpired => {
+                // inbuxa: legacy-protocols LP-8 is an event, never an error
+                trc::SecurityEvent::IpBlockExpired
+                | trc::SecurityEvent::IpAllowExpired
+                | trc::SecurityEvent::LegacyProtocolsChanged => {
                     RequestError::internal_server_error()
                 }
             },

crates/jmap/src/api/request.rs

@@ -224,6 +224,9 @@ impl RequestHandler for Server {
                                     SetResponseMethod::ProtocolPolicy(set_response) => {
                                         set_response.update_created_ids(&mut response);
                                     }
+                                    SetResponseMethod::TenantProtocolPolicy(set_response) => {
+                                        set_response.update_created_ids(&mut response);
+                                    }
                                     SetResponseMethod::AddressBook(set_response) => {
                                         set_response.update_created_ids(&mut response);
                                     }
@@ -386,6 +389,13 @@ impl RequestHandler for Server {
                         .await?
                         .into()
                 }
+                // inbuxa: inbuxa:TenantProtocolPolicy/get (legacy protocols off, per tenant)
+                GetRequestMethod::TenantProtocolPolicy(mut req) => {
+                    resolve_account_id(&mut req.account_id, method_name.obj, access_token)?;
+                    crate::inbuxa::tenant_protocol_policy::get(self, access_token, *req)
+                        .await?
+                        .into()
+                }
                 GetRequestMethod::Principal(req) => {
                     self.principal_get(*req, access_token).await?.into()
                 }
@@ -634,6 +644,13 @@ impl RequestHandler for Server {
                         .await?
                         .into()
                 }
+                // inbuxa: inbuxa:TenantProtocolPolicy/set (legacy protocols off, per tenant)
+                SetRequestMethod::TenantProtocolPolicy(mut req) => {
+                    resolve_account_id(&mut req.account_id, method_name.obj, access_token)?;
+                    crate::inbuxa::tenant_protocol_policy::set(self, access_token, *req)
+                        .await?
+                        .into()
+                }
                 SetRequestMethod::AddressBook(mut req) => {
                     resolve_account_id(&mut req.account_id, method_name.obj, access_token)?;
                     access_token.assert_has_access(req.account_id, Collection::AddressBook)?;

crates/jmap/src/changes/get.rs

@@ -419,6 +419,7 @@ impl IntermediateChangesResponse {
             | MethodObject::DeletedAccount
             | MethodObject::AiLimits
             | MethodObject::ProtocolPolicy
+            | MethodObject::TenantProtocolPolicy
             | MethodObject::Registry(_) => unreachable!(),
         })
     }

crates/jmap/src/inbuxa/mod.rs

@@ -10,6 +10,7 @@
 pub mod access;
 pub mod ai_limits;
 pub mod protocol_policy;
+pub mod tenant_protocol_policy;
 pub mod deleted_account;
 pub mod fastmail;
 pub mod masked_email;

crates/jmap/src/inbuxa/tenant_protocol_policy.rs

@@ -0,0 +1,224 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+//! `inbuxa:TenantProtocolPolicy/get` and `/set`: one tenant's legacy mail
+//! protocols switch (legacy-protocols spec, LP-9 to LP-14). There is one per
+//! tenant, and its id is the tenant's.
+//!
+//! Inside a tenant, a principal reaches only its own tenant's (MT-1): `/get`
+//! with no ids answers with it, and any other id is `notFound`. At server
+//! level, `/get` with no ids answers with every tenant's.
+//!
+//! Turning it off never needs the server's leave; turning it back on is
+//! refused with `forbidden` while the server has legacy protocols off (LP-9).
+//! A tenant's switch closes no port (LP-13) -- sign-in and client
+//! configuration read it (LP-10, LP-14a).
+
+use common::{Server, auth::AccessToken};
+use inbuxa_features::{
+    security::{
+        protocol_policy::LegacyProtocols,
+        tenant_protocol_policy::{self, TenantProtocolPolicy as Policy, refusal},
+    },
+    tenancy::quota::all_tenants,
+};
+use jmap_proto::{
+    error::set::SetError,
+    method::{
+        get::{GetRequest, GetResponse},
+        set::{SetRequest, SetResponse},
+    },
+    object::inbuxa_tenant_protocol_policy::{
+        TenantProtocolPolicy, TenantProtocolPolicyProperty as P, TenantProtocolPolicyValue,
+    },
+    request::IntoValid,
+};
+use jmap_tools::{Key, Map, Value};
+use types::id::Id;
+
+type PValue = Value<'static, P, TenantProtocolPolicyValue>;
+
+const ALL: &[P] = &[
+    P::Id,
+    P::TenantId,
+    P::LegacyProtocols,
+    P::ChangedAt,
+    P::ChangedBy,
+];
+
+/// The tenants this principal may reach: its own inside a tenant (MT-1),
+/// every tenant at server level.
+async fn reachable(server: &Server, access_token: &AccessToken) -> trc::Result<Vec<u32>> {
+    match access_token.tenant_id() {
+        Some(tenant_id) => Ok(vec![tenant_id]),
+        None => all_tenants(server.registry()).await,
+    }
+}
+
+fn to_value(tenant_id: u32, policy: &Policy, properties: &[P]) -> PValue {
+    let mut out = Map::with_capacity(properties.len());
+    for property in properties {
+        let value = match property {
+            P::Id | P::TenantId => {
+                Value::Element(TenantProtocolPolicyValue::Id(Id::from(tenant_id)))
+            }
+            P::LegacyProtocols => Value::Str(
+                match policy.legacy_protocols {
+                    LegacyProtocols::Enabled => "enabled",
+                    LegacyProtocols::Disabled => "disabled",
+                }
+                .into(),
+            ),
+            P::ChangedAt => policy
+                .changed_at
+                .map(|at| Value::Number(at.into()))
+                .unwrap_or(Value::Null),
+            P::ChangedBy => policy
+                .changed_by
+                .as_ref()
+                .map(|by| Value::Str(by.clone().into()))
+                .unwrap_or(Value::Null),
+        };
+        out.insert_unchecked(Key::Property(property.clone()), value);
+    }
+    Value::Object(out)
+}
+
+/// `inbuxa:TenantProtocolPolicy/get`.
+pub async fn get(
+    server: &Server,
+    access_token: &AccessToken,
+    mut request: GetRequest<TenantProtocolPolicy>,
+) -> trc::Result<GetResponse<TenantProtocolPolicy>> {
+    let properties = request.unwrap_properties(ALL);
+    let (ids, not_found) = request.unwrap_ids(server.core.jmap.get_max_objects)?;
+    let mut response = GetResponse {
+        account_id: request.account_id.into(),
+        state: None,
+        list: Vec::new(),
+        not_found,
+    };
+
+    let reachable = reachable(server, access_token).await?;
+    let wanted = match ids {
+        None => reachable.iter().map(|id| Id::from(*id)).collect(),
+        Some(ids) => ids,
+    };
+    for id in wanted {
+        let tenant_id = id.document_id();
+        if reachable.contains(&tenant_id) {
+            let policy = tenant_protocol_policy::get(&server.core.storage.data, tenant_id).await?;
+            response
+                .list
+                .push(to_value(tenant_id, &policy, &properties));
+        } else {
+            response.push_not_found(id);
+        }
+    }
+    Ok(response)
+}
+
+/// `inbuxa:TenantProtocolPolicy/set`: turns one tenant's switch. Unset
+/// (`null`) puts legacy protocols back on, which LP-9 may refuse.
+pub async fn set(
+    server: &Server,
+    access_token: &AccessToken,
+    mut request: SetRequest<'_, TenantProtocolPolicy>,
+) -> trc::Result<SetResponse<TenantProtocolPolicy>> {
+    let mut response = SetResponse::from_request(&request, server.core.jmap.set_max_objects)?;
+    // A tenant's switch comes and goes with the tenant; it is only turned.
+    for (client_id, _) in request.unwrap_create() {
+        response.not_created.append(
+            client_id,
+            SetError::forbidden().with_description("A tenant's switch exists with the tenant."),
+        );
+    }
+    for id in request.unwrap_destroy().into_valid() {
+        response.not_destroyed.append(
+            id,
+            SetError::forbidden().with_description("A tenant's switch exists with the tenant."),
+        );
+    }
+
+    let reachable = reachable(server, access_token).await?;
+    for (id, value) in request.unwrap_update().into_valid() {
+        let tenant_id = id.document_id();
+        if !reachable.contains(&tenant_id) {
+            response.not_updated.append(id, SetError::not_found());
+            continue;
+        }
+
+        let data = &server.core.storage.data;
+        let previous = tenant_protocol_policy::get(data, tenant_id).await?;
+        let mut policy = previous.clone();
+        let mut error = None;
+        for (key, value) in value.into_expanded_object() {
+            let result = match &key {
+                Key::Property(P::LegacyProtocols) => match value {
+                    Value::Null => {
+                        policy.legacy_protocols = LegacyProtocols::Enabled;
+                        Ok(())
+                    }
+                    value => match value.as_str().as_deref() {
+                        Some("enabled") => {
+                            policy.legacy_protocols = LegacyProtocols::Enabled;
+                            Ok(())
+                        }
+                        Some("disabled") => {
+                            policy.legacy_protocols = LegacyProtocols::Disabled;
+                            Ok(())
+                        }
+                        _ => Err(r#"must be "enabled" or "disabled""#),
+                    },
+                },
+                Key::Property(P::Id) => Err("is immutable"),
+                Key::Property(_) => Err("is set by the server"),
+                _ => Err("is not a property of inbuxa:TenantProtocolPolicy"),
+            };
+            if let Err(why) = result {
+                error = Some(
+                    SetError::invalid_properties()
+                        .with_property(key.into_owned())
+                        .with_description(why),
+                );
+                break;
+            }
+        }
+        if let Some(error) = error {
+            response.not_updated.append(id, error);
+            continue;
+        }
+
+        // LP-9: server off means off for everyone.
+        if let Some(why) = refusal(&server.protocol_policy().await?, policy.legacy_protocols) {
+            response
+                .not_updated
+                .append(id, SetError::forbidden().with_description(why));
+            continue;
+        }
+
+        if policy.legacy_protocols != previous.legacy_protocols {
+            policy.changed_at = Some(store::write::now() * 1000);
+            policy.changed_by = Some(Id::from(access_token.account_id()).to_string());
+            tenant_protocol_policy::set(data, tenant_id, &policy).await?;
+
+            // LP-14. A tenant's switch closes and reopens nothing (LP-13).
+            trc::event!(
+                Security(trc::SecurityEvent::LegacyProtocolsChanged),
+                Policy = "tenant",
+                Id = tenant_id,
+                Value = if policy.legacy_protocols.is_disabled() {
+                    "disabled"
+                } else {
+                    "enabled"
+                },
+                AccountId = policy.changed_by.clone(),
+            );
+        }
+        response.updated.append(id, None);
+    }
+    Ok(response)
+}

crates/managesieve/src/op/authenticate.rs

@@ -101,6 +101,11 @@ impl<T: SessionStream> Session<T> {
             })
             .and_then(|token| token.assert_has_permission(Permission::SieveAuthenticate))?;
 
+        // inbuxa: legacy-protocols LP-10, for a bearer token that named no account
+        self.server
+            .refuse_legacy_session(LegacyProtocol::ManageSieve, &access_token)
+            .await?;
+
         // Enforce concurrency limits
         let in_flight = match access_token.is_imap_request_allowed() {
             LimiterResult::Allowed(in_flight) => Some(in_flight),

crates/pop3/src/op/authenticate.rs

@@ -99,6 +99,11 @@ impl<T: SessionStream> Session<T> {
             })
             .and_then(|token| token.assert_has_permission(Permission::Pop3Authenticate))?;
 
+        // inbuxa: legacy-protocols LP-10, for a bearer token that named no account
+        self.server
+            .refuse_legacy_session(LegacyProtocol::Pop3, &access_token)
+            .await?;
+
         // Enforce concurrency limits
         let in_flight = match access_token.is_imap_request_allowed() {
             LimiterResult::Allowed(in_flight) => Some(in_flight),

crates/smtp/src/inbound/auth.rs

@@ -121,16 +121,7 @@ impl<T: SessionStream> Session<T> {
             .refuse_legacy_sign_in(LegacyProtocol::Submission, &credentials)
             .await
         {
-            let refused = err.matches(trc::EventType::Auth(AuthEvent::LegacyProtocolRefused));
-            trc::error!(err.span_id(self.data.session_id));
-            if refused {
-                self.write(LegacyProtocol::Submission.refusal().as_bytes())
-                    .await?;
-            } else {
-                self.write(b"454 4.7.0 Temporary authentication failure\r\n")
-                    .await?;
-            }
-            return Ok(false);
+            return self.legacy_refusal(err).await;
         }
 
         // Authenticate
@@ -144,6 +135,17 @@ impl<T: SessionStream> Session<T> {
             .await
             .and_then(|access_token| access_token.assert_has_permission(Permission::EmailSend));
 
+        // inbuxa: legacy-protocols LP-10, for a bearer token that named no
+        // account and so couldn't be judged by its domain beforehand.
+        if let Ok(access_token) = &result
+            && let Err(err) = self
+                .server
+                .refuse_legacy_session(LegacyProtocol::Submission, access_token)
+                .await
+        {
+            return self.legacy_refusal(err).await;
+        }
+
         let result = match result {
             Ok(access_token) => self.server.account_info(access_token.account_id()).await,
             Err(err) => Err(err),
@@ -207,6 +209,26 @@ impl<T: SessionStream> Session<T> {
         Ok(false)
     }
 
+    /// inbuxa: legacy-protocols LP-6, LP-10. A refusal is written with the
+    /// words the error carries, which know whose switch refused; anything
+    /// else that went wrong deciding is a temporary failure. Neither counts
+    /// as an authentication error (LP-11).
+    async fn legacy_refusal(&mut self, err: trc::Error) -> Result<bool, ()> {
+        let reply = err
+            .matches(trc::EventType::Auth(AuthEvent::LegacyProtocolRefused))
+            .then(|| err.value_as_str(trc::Key::Details).map(str::to_string))
+            .flatten();
+        trc::error!(err.span_id(self.data.session_id));
+        match reply {
+            Some(reply) => self.write(reply.as_bytes()).await?,
+            None => {
+                self.write(b"454 4.7.0 Temporary authentication failure\r\n")
+                    .await?
+            }
+        }
+        Ok(false)
+    }
+
     pub async fn auth_error(&mut self, response: &[u8]) -> Result<bool, ()> {
         tokio::time::sleep(self.params.auth_errors_wait).await;
         self.data.auth_errors += 1;

crates/trc/src/event/enums.rs

@@ -9,8 +9,9 @@
 // This file is auto-generated. Do not edit directly.
 
 // inbuxa: 637 to 641 are the fork's SCIM events (SCIM-54); 642 is
-// auth.legacy-protocol-refused (legacy-protocols LP-6)
-pub const TOTAL_EVENT_COUNT: usize = 643;
+// auth.legacy-protocol-refused (legacy-protocols LP-6); 643 is
+// security.legacy-protocols-changed (LP-8)
+pub const TOTAL_EVENT_COUNT: usize = 644;
 pub const TOTAL_METRIC_COUNT: usize = 369;
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
@@ -655,6 +656,8 @@ pub enum SecurityEvent {
     IpAllowExpired = 594,
     IpUnauthorized = 279,
     Unauthorized = 552,
+    // inbuxa: legacy-protocols LP-8
+    LegacyProtocolsChanged = 643,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]

crates/trc/src/event/enums_impl.rs

@@ -446,6 +446,8 @@ impl EventType {
             b"security.ip-allow-expired" => EventType::Security(SecurityEvent::IpAllowExpired),
             b"security.ip-unauthorized" => EventType::Security(SecurityEvent::IpUnauthorized),
             b"security.unauthorized" => EventType::Security(SecurityEvent::Unauthorized),
+            // inbuxa: legacy-protocols LP-8
+            b"security.legacy-protocols-changed" => EventType::Security(SecurityEvent::LegacyProtocolsChanged),
             b"server.startup" => EventType::Server(ServerEvent::Startup),
             b"server.shutdown" => EventType::Server(ServerEvent::Shutdown),
             b"server.startup-error" => EventType::Server(ServerEvent::StartupError),
@@ -1211,6 +1213,10 @@ impl EventType {
             EventType::Security(SecurityEvent::IpAllowExpired) => "security.ip-allow-expired",
             EventType::Security(SecurityEvent::IpUnauthorized) => "security.ip-unauthorized",
             EventType::Security(SecurityEvent::Unauthorized) => "security.unauthorized",
+            // inbuxa: legacy-protocols LP-8
+            EventType::Security(SecurityEvent::LegacyProtocolsChanged) => {
+                "security.legacy-protocols-changed"
+            }
             EventType::Server(ServerEvent::Startup) => "server.startup",
             EventType::Server(ServerEvent::Shutdown) => "server.shutdown",
             EventType::Server(ServerEvent::StartupError) => "server.startup-error",
@@ -1883,6 +1889,8 @@ impl EventType {
             EventType::Security(SecurityEvent::IpAllowExpired) => 594,
             EventType::Security(SecurityEvent::IpUnauthorized) => 279,
             EventType::Security(SecurityEvent::Unauthorized) => 552,
+            // inbuxa: legacy-protocols LP-8
+            EventType::Security(SecurityEvent::LegacyProtocolsChanged) => 643,
             EventType::Server(ServerEvent::Startup) => 393,
             EventType::Server(ServerEvent::Shutdown) => 392,
             EventType::Server(ServerEvent::StartupError) => 394,
@@ -2571,6 +2579,8 @@ impl EventType {
             594 => Some(EventType::Security(SecurityEvent::IpAllowExpired)),
             279 => Some(EventType::Security(SecurityEvent::IpUnauthorized)),
             552 => Some(EventType::Security(SecurityEvent::Unauthorized)),
+            // inbuxa: legacy-protocols LP-8
+            643 => Some(EventType::Security(SecurityEvent::LegacyProtocolsChanged)),
             393 => Some(EventType::Server(ServerEvent::Startup)),
             392 => Some(EventType::Server(ServerEvent::Shutdown)),
             394 => Some(EventType::Server(ServerEvent::StartupError)),
@@ -2990,6 +3000,8 @@ impl EventType {
             EventType::Security(SecurityEvent::IpAllowExpired) => Level::Info,
             EventType::Security(SecurityEvent::IpUnauthorized) => Level::Info,
             EventType::Security(SecurityEvent::Unauthorized) => Level::Info,
+            // inbuxa: legacy-protocols LP-8
+            EventType::Security(SecurityEvent::LegacyProtocolsChanged) => Level::Info,
             EventType::Server(ServerEvent::Startup) => Level::Info,
             EventType::Server(ServerEvent::Shutdown) => Level::Info,
             EventType::Server(ServerEvent::Licensing) => Level::Info,
@@ -3198,7 +3210,9 @@ impl EventType {
             EventType::Auth(AuthEvent::TooManyAttempts) => "Too many authentication attempts",
             EventType::Auth(AuthEvent::ClientRegistration) => "OAuth Client registration",
             // inbuxa: legacy-protocols LP-6
-            EventType::Auth(AuthEvent::LegacyProtocolRefused) => "Legacy mail protocol sign-in refused",
+            EventType::Auth(AuthEvent::LegacyProtocolRefused) => {
+                "Legacy mail protocol sign-in refused"
+            }
             EventType::Auth(AuthEvent::Error) => "Authentication error",
             EventType::Auth(AuthEvent::Warning) => "Authentication warning",
             EventType::Auth(AuthEvent::CredentialExpired) => "Credential expired",
@@ -3711,6 +3725,10 @@ impl EventType {
             EventType::Security(SecurityEvent::IpAllowExpired) => "IP allow expired",
             EventType::Security(SecurityEvent::IpUnauthorized) => "Unauthorized IP address",
             EventType::Security(SecurityEvent::Unauthorized) => "Unauthorized access",
+            // inbuxa: legacy-protocols LP-8
+            EventType::Security(SecurityEvent::LegacyProtocolsChanged) => {
+                "Legacy mail protocols switch changed"
+            }
             EventType::Server(ServerEvent::Startup) => "Starting INBUXA Server",
             EventType::Server(ServerEvent::Shutdown) => "Shutting down INBUXA Server",
             EventType::Server(ServerEvent::StartupError) => "Server startup error",
@@ -3964,7 +3982,9 @@ impl EventType {
             EventType::Auth(AuthEvent::TooManyAttempts) => "Too many authentication attempts",
             EventType::Auth(AuthEvent::ClientRegistration) => "Authentication error",
             // inbuxa: legacy-protocols LP-6
-            EventType::Auth(AuthEvent::LegacyProtocolRefused) => "This server allows only INBUXA webmail and JMAP apps",
+            EventType::Auth(AuthEvent::LegacyProtocolRefused) => {
+                "This server allows only INBUXA webmail and JMAP apps"
+            }
             EventType::Auth(AuthEvent::Error) => "Authentication error",
             EventType::Auth(AuthEvent::CredentialExpired) => "Credential expired",
             EventType::Imap(ImapEvent::ConnectionStart) => "IMAP error",
@@ -4102,6 +4122,10 @@ impl EventType {
             EventType::Security(SecurityEvent::IpAllowExpired) => "Insufficient permissions",
             EventType::Security(SecurityEvent::IpUnauthorized) => "Unauthorized IP address",
             EventType::Security(SecurityEvent::Unauthorized) => "Insufficient permissions",
+            // inbuxa: legacy-protocols LP-8
+            EventType::Security(SecurityEvent::LegacyProtocolsChanged) => {
+                "Legacy mail protocols switch changed"
+            }
             EventType::Smtp(SmtpEvent::ConnectionStart) => "SMTP error",
             EventType::Smtp(SmtpEvent::ConnectionEnd) => "SMTP error",
             EventType::Smtp(SmtpEvent::Error) => "SMTP error",
@@ -4663,6 +4687,8 @@ impl EventType {
             EventType::Security(SecurityEvent::IpAllowExpired),
             EventType::Security(SecurityEvent::IpUnauthorized),
             EventType::Security(SecurityEvent::Unauthorized),
+            // inbuxa: legacy-protocols LP-8
+            EventType::Security(SecurityEvent::LegacyProtocolsChanged),
             EventType::Server(ServerEvent::Startup),
             EventType::Server(ServerEvent::Shutdown),
             EventType::Server(ServerEvent::StartupError),

install.sh

@@ -21,6 +21,6 @@ echo >&2
 echo "A server started with no configuration comes up in bootstrap mode;" >&2
 echo "INBUXA Admin's setup wizard completes first boot over JMAP." >&2
 echo >&2
-echo "Releases:  https://git.coffeylabs.org/inbuxa/inbuxa-server/releases" >&2
+echo "Releases:  https://github.com/inbuxa/inbuxa-server/releases" >&2
 echo "Docs:      https://docs.inbuxa.org/install/fresh/" >&2
 exit 1

resources/schema/schema.json.sha256

@@ -1 +1 @@
-q-OZe-InKnF24mlL56Vvt3m_IQNRybiN61MFxBSo0WY
+rLRbZKj15KvcPMVmnisfCDsXXZEKks6BXpMkMpS0mlI

tests/e2e/legacy_protocols.py

@@ -17,7 +17,19 @@ submission -- locked open -- is refused with the spec's words, with the right
 password and with a wrong one, and refusals never add up to a disconnect
 (LP-11). And that a normal IMAP sign-in works with the switch on, before and
 after. And that while it is off, no listener the switch would close can be
-created, or made by an update (LP-4, test 4).
+created, or made by an update (LP-4, test 4), and nothing advertises what is
+closed: autoconfig, autodiscover and PACC offer no IMAP, POP3 or submission,
+and the suggested zone marks their SRV names not offered (LP-7, test 5).
+Every change of the switch, and every refused sign-in, is an event in the
+server's log (LP-8, test 14; LP-6).
+
+Then a tenant's own switch (LP-9 to LP-14a): a tenant administrator turns it
+off for its tenant, which refuses sign-in on the tenant's domains -- real
+address or made-up, right password or wrong -- in the organization's words,
+leaves every other domain alone, and stops client configuration offering
+legacy servers for those domains. It reaches only its own tenant's switch,
+and can't turn it back on while the server has legacy protocols off
+(acceptance tests 6 to 10, 14).
 
 Passwords are generated into files under target/e2e and never printed.
 Everything is removed afterwards unless KEEP=1.
@@ -189,6 +201,168 @@ def smtp_auths(port, user, passwords):
     return replies
 
 
+def advertised(admin, admin_pw):
+    """What each client-configuration answer and the suggested zone offer."""
+    with urllib.request.urlopen(f"{HTTP}/mail/[email protected]",
+                                timeout=30) as resp:
+        autoconfig = resp.read().decode()
+    body = ('<?xml version="1.0" encoding="utf-8"?><Autodiscover xmlns="http://schemas.'
+            'microsoft.com/exchange/autodiscover/outlook/requestschema/2006"><Request>'
+            '<EMailAddress>[email protected]</EMailAddress><AcceptableResponseSchema>http://'
+            'schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a'
+            '</AcceptableResponseSchema></Request></Autodiscover>').encode()
+    req = urllib.request.Request(f"{HTTP}/autodiscover/autodiscover.xml", data=body, method="POST")
+    req.add_header("Content-Type", "text/xml")
+    with urllib.request.urlopen(req, timeout=30) as resp:
+        autodiscover = resp.read().decode()
+    with urllib.request.urlopen(f"{HTTP}/.well-known/user-agent-configuration.json",
+                                timeout=30) as resp:
+        pacc = json.load(resp).get("protocols", {})
+    got = one(admin, admin_pw, "x:Domain/get", {"ids": None, "properties": ["name", "dnsZoneFile"]})
+    zone = next((d.get("dnsZoneFile") or "" for d in got[1].get("list", [])
+                 if d.get("name") == "legacy.test"), "")
+    srv = {}
+    for line in zone.splitlines():
+        fields = line.split()
+        if "SRV" in fields and fields[0].startswith("_"):
+            srv[fields[0].split(".")[0] + "." + fields[0].split(".")[1]] = fields[-1]
+    return {
+        "autoconfig": {t for t in ("imap", "pop3", "smtp") if f'type="{t}"' in autoconfig},
+        "autodiscover": {t for t in ("IMAP", "POP3", "SMTP") if f"<Type>{t}</Type>" in autodiscover},
+        "pacc": {t for t in ("imap", "pop3", "smtp", "managesieve") if t in pacc},
+        "jmap": "jmap" in pacc,
+        "srv": srv,
+    }
+
+
+def events(name):
+    """The server's log lines for one event, from its stdout tracer. The log
+    is the container's, so it starts afresh at every restart."""
+    out = docker("logs", NAME, check_rc=False)
+    return [l for l in (out.stdout + out.stderr).splitlines() if f"({name})" in l]
+
+
+def pop3_login(port, user, password):
+    """The reply to PASS, over implicit TLS."""
+    with tls(port) as sock:
+        read = lines(sock)
+        next(read)  # greeting
+        sock.sendall(f"USER {user}\r\n".encode())
+        next(read)
+        sock.sendall(f"PASS {password}\r\n".encode())
+        return next(read, "")
+
+
+def created(res, key, what):
+    obj = (res[1].get("created") or {}).get(key)
+    if not obj:
+        sys.exit(f"creating {what} failed: " + json.dumps(res[1])[:600])
+    return obj["id"]
+
+
+def tenant_checks(admin, admin_pw, account):
+    """LP-9 to LP-14a, on a tenant with its own domain, user and admin."""
+    t = created(one(admin, admin_pw, "x:Tenant/set", {"create": {"t": {"name": "legacy-t"}}}),
+                "t", "tenant")
+    t2 = created(one(admin, admin_pw, "x:Tenant/set", {"create": {"t": {"name": "legacy-t2"}}}),
+                 "t", "second tenant")
+    domain = created(one(admin, admin_pw, "x:Domain/set", {"create": {"d": {
+        "name": "t.legacy.test", "isEnabled": True, "memberTenantId": t,
+        "certificateManagement": {"@type": "Manual"}, "dnsManagement": {"@type": "Manual"},
+        "dkimManagement": {"@type": "Manual"}}}}), "d", "tenant domain")
+    user_pw = secret_file("legacy-tenant-user")
+    tadmin_pw = secret_file("legacy-tenant-admin")
+    def user(name, password, extra=None):
+        body = {"@type": "User", "name": name, "domainId": domain,
+                "credentials": {"0": {"@type": "Password", "secret": password}}}
+        body.update(extra or {})
+        return created(one(admin, admin_pw, "x:Account/set", {"create": {"a": body}}),
+                       "a", f"account {name}")
+    user("u", user_pw)
+    user("tadmin", tadmin_pw, {"roles": {"@type": "Admin"}})
+    tu, ta = "[email protected]", "[email protected]"
+
+    tsess = session(ta, tadmin_pw)
+    tacct = tsess["primaryAccounts"].get(INBUXA) or list(tsess["accounts"])[0]
+    tget = lambda ids=None: one(ta, tadmin_pw, "inbuxa:TenantProtocolPolicy/get",
+                                {"accountId": tacct, "ids": ids})
+    tset = lambda value: one(ta, tadmin_pw, "inbuxa:TenantProtocolPolicy/set",
+                             {"accountId": tacct, "update": {t: {"legacyProtocols": value}}})
+
+    # Before: the tenant's user signs in, and its domain is offered IMAP.
+    check(imap_login(PORTS["imap"], tu, user_pw).startswith("OK"),
+          "a tenant's user signs in over IMAP with the tenant's switch on")
+    got = tget()
+    mine = [p["id"] for p in got[1].get("list", [])]
+    check(got[0] == "inbuxa:TenantProtocolPolicy/get" and mine == [t],
+          "a tenant admin's /get answers with its own tenant's switch only (test 10)")
+    if mine != [t]:
+        print("     reply:", json.dumps(got)[:400])
+    got = tget([t2])
+    check(got[1].get("notFound") == [t2], "another tenant's switch is not found (test 10, MT-1)")
+    res = one(ta, tadmin_pw, "inbuxa:TenantProtocolPolicy/set",
+              {"accountId": tacct, "update": {t2: {"legacyProtocols": "disabled"}}})
+    check(t2 in (res[1].get("notUpdated") or {}), "nor can it be changed (test 10)")
+
+    # The tenant admin turns it off for its tenant (LP-9).
+    res = tset("disabled")
+    check(t in (res[1].get("updated") or {}), "a tenant admin turns legacy protocols off (LP-9)")
+    if t not in (res[1].get("updated") or {}):
+        print("     reply:", json.dumps(res)[:400])
+    check(events_matching("security.legacy-protocols-changed", 'policy = "tenant"',
+                          'value = "disabled"'),
+          "and it is an event, scope tenant (LP-14, test 14)")
+
+    # Refused on the tenant's domain, every way in the same words (tests 6-8).
+    imap_no = ("NO [ALERT] Your organization allows only INBUXA webmail and JMAP apps. "
+               "This mail app can't sign in.")
+    check(imap_login(PORTS["imap"], tu, user_pw) == imap_no,
+          "the tenant's user is refused over IMAP with the right password (test 6)")
+    check(imap_login(PORTS["imap"], tu, "wrong") == imap_no, "and with a wrong one (test 6)")
+    check(imap_login(PORTS["imap"], "[email protected]", "x") == imap_no,
+          "and a made-up address on the domain gets the same (test 7)")
+    check(pop3_login(PORTS["pop3"], tu, user_pw) ==
+          "-ERR [AUTH] Your organization allows only INBUXA webmail and JMAP apps. "
+          "This mail app can't sign in.", "POP3 refuses in its own form (test 8)")
+    check(smtp_auths(PORTS["submissions"], tu, [user_pw])[0] ==
+          "535 5.7.0 Your organization allows only INBUXA webmail and JMAP apps. "
+          "This mail app can't send.", "submission refuses in its own form (test 8)")
+    check(imap_login(PORTS["imap"], admin, admin_pw).startswith("OK"),
+          "an account on another domain signs in over IMAP normally (test 6)")
+    check(session(tu, user_pw).get("accounts"), "the tenant's user still has JMAP (test 8)")
+    check(not events("auth.failed"), "no refusal counted as a failed sign-in (LP-11)")
+
+    # Client configuration for the tenant's domain only (LP-14a).
+    with urllib.request.urlopen(f"{HTTP}/mail/config-v1.1.xml?emailaddress={tu}", timeout=30) as r:
+        tenant_cfg = r.read().decode()
+    with urllib.request.urlopen(f"{HTTP}/mail/config-v1.1.xml?emailaddress={admin}", timeout=30) as r:
+        other_cfg = r.read().decode()
+    check('type="imap"' not in tenant_cfg and 'type="imap"' in other_cfg,
+          "autoconfig offers no IMAP for the tenant's domain, and still does elsewhere (LP-14a)")
+
+    # Server off means off for everyone: the tenant can't turn it back on (test 9).
+    one(admin, admin_pw, "inbuxa:ProtocolPolicy/set",
+        {"accountId": account, "update": {"singleton": {"legacyProtocols": "disabled"}}})
+    res = tset("enabled")
+    refused = (res[1].get("notUpdated") or {}).get(t) or {}
+    check(refused.get("type") == "forbidden"
+          and "inbuxa:ProtocolPolicy" in (refused.get("description") or ""),
+          "with the server off, the tenant can't turn them back on (LP-9, test 9)")
+    one(admin, admin_pw, "inbuxa:ProtocolPolicy/set",
+        {"accountId": account, "update": {"singleton": {"legacyProtocols": "enabled"}}})
+    check(settle(PORTS["imap"], True), "IMAP is back after the server switch returns")
+
+    # And back on, the tenant's user signs in again.
+    res = tset("enabled")
+    check(t in (res[1].get("updated") or {}), "with the server on, the tenant turns them back on")
+    check(imap_login(PORTS["imap"], tu, user_pw).startswith("OK"),
+          "and its user signs in over IMAP again")
+
+
+def events_matching(name, *parts):
+    return any(all(p in line for p in parts) for line in events(name))
+
+
 def settle(port, want, tries=30):
     """Wait for a port to reach the wanted state, so the check is not a race."""
     for _ in range(tries):
@@ -232,6 +406,15 @@ def main():
     stop()
     start()
 
+    # A tracer to stdout, so the events can be read back from the container's
+    # log. It takes effect from the next start.
+    res = one(admin, admin_pw, "x:Tracer/set", {"create": {"t": {
+        "@type": "Stdout", "level": "info", "buffered": False, "ansi": False}}})
+    if not (res[1].get("created") or {}).get("t"):
+        sys.exit("tracer create failed: " + json.dumps(res))
+    stop()
+    start()
+
     sess = session(admin, admin_pw)
     account = sess["primaryAccounts"].get(INBUXA) or list(sess["accounts"])[0]
     policy_get = {"accountId": account, "ids": None}
@@ -243,6 +426,15 @@ def main():
     check(accepts(PORTS["submissions"]), "submission accepts before the switch")
     check(accepts(PORTS["smtp"]), "inbound SMTP accepts before the switch")
 
+    # What is advertised with the switch on -- the control for LP-7.
+    before = advertised(admin, admin_pw)
+    print("     advertised before:", {k: sorted(v) if isinstance(v, set) else v
+                                      for k, v in before.items() if k != "srv"})
+    check(before["autoconfig"] and before["autodiscover"],
+          "autoconfig and autodiscover offer mail apps a server with the switch on")
+    check(before["srv"].get("_imaps._tcp", ".") != ".",
+          "the suggested zone offers IMAP with the switch on")
+
     # A normal sign-in works with the switch on -- the control for LP-6.
     check(imap_login(PORTS["imap"], admin, admin_pw).startswith("OK"),
           "IMAP sign-in works with the switch on")
@@ -295,6 +487,19 @@ def main():
     if not all(r == SMTP_REFUSAL for r in replies):
         print("     replies:", replies)
 
+    # Nothing advertises what is closed (LP-7, test 5).
+    during = advertised(admin, admin_pw)
+    check(not during["autoconfig"], "autoconfig offers no IMAP, POP3 or submission (LP-7)")
+    check(not during["autodiscover"], "autodiscover offers no IMAP, POP3 or submission (LP-7)")
+    check(not during["pacc"] and during["jmap"], "PACC offers JMAP and nothing legacy (LP-7)")
+    names = ("_imap._tcp", "_imaps._tcp", "_pop3._tcp", "_pop3s._tcp",
+             "_submission._tcp", "_submissions._tcp")
+    offered = {n: t for n, t in during["srv"].items() if n in names and t != "."}
+    check(not offered and "_imaps._tcp" in during["srv"],
+          "the suggested zone marks the legacy SRV names not offered, target . (LP-7)")
+    if offered or "_imaps._tcp" not in during["srv"]:
+        print("     srv:", during["srv"])
+
     # No listener the switch would close can be added while it is off (LP-4,
     # test 4), and the refusal names the policy.
     res = one(admin, admin_pw, "x:NetworkListener/set", {"create": {"m": {
@@ -322,6 +527,25 @@ def main():
               "turning it into an IMAP listener is refused (LP-4)")
         one(admin, admin_pw, "x:NetworkListener/set", {"destroy": [extra]})
 
+    # The change was reported (LP-8, test 14), with who made it and what closed.
+    changed = events("security.legacy-protocols-changed")
+    check(len(changed) == 1 and 'value = "disabled"' in changed[0]
+          and 'policy = "server"' in changed[0] and 'details = "closed"' in changed[0]
+          and '"imaps"' in changed[0] and "accountId = " in changed[0],
+          "turning it off is one event: scope, new value, who, listeners closed (LP-8)")
+    if len(changed) != 1:
+        print("     events:", changed)
+    # Asking for what already holds is not a change.
+    one(admin, admin_pw, "inbuxa:ProtocolPolicy/set", policy_set({"legacyProtocols": "disabled"}))
+    check(len(events("security.legacy-protocols-changed")) == 1,
+          "setting it off again when it is off raises no event (LP-8)")
+    # Every refused sign-in is an event too, and none is a failed sign-in.
+    refused = events("auth.legacy-protocol-refused")
+    check(len(refused) == 7 and all('source = "submission"' in l for l in refused),
+          "each refused sign-in is an auth.legacy-protocol-refused event (LP-6)")
+    check(not events("auth.failed") and not events("auth.too-many-attempts"),
+          "and none is logged as a failed sign-in (LP-11)")
+
     # A restart must not reopen them: the objects are gone, not just the sockets.
     stop()
     start()
@@ -340,6 +564,17 @@ def main():
     policy = got[1]["list"][0]
     check(policy["legacyProtocols"] == "enabled", "switch reads back enabled")
     check(not policy["savedListeners"], "savedListeners is empty again (LP-5)")
+    changed = events("security.legacy-protocols-changed")
+    check(len(changed) == 1 and 'value = "enabled"' in changed[0]
+          and 'details = "reopened"' in changed[0] and '"imaps"' in changed[0],
+          "turning it back on is one event, naming the listeners reopened (LP-8)")
+
+    after = advertised(admin, admin_pw)
+    check(after["autoconfig"] == before["autoconfig"] and after["srv"] == before["srv"],
+          "autoconfig and the suggested zone offer them again once back on")
+
+    # A tenant's own switch (LP-9 to LP-14a).
+    tenant_checks(admin, admin_pw, account)
 
     # And sign-in works again, with no restart.
     check(imap_login(PORTS["imap"], admin, admin_pw).startswith("OK"),