Make "Allow Directory Queries" apply to regular users

jcoffey-dev commented

2026-11-01 23:23:58 +00:00

Owner

Reported on the forum: https://community.coffeylabs.org/t/disable-global-address-book/206

With "Allow Directory Queries" off, which is the default, a regular user could still list the accounts in their tenant over JMAP. The check only refused users who lacked the matching permission, and every default user role holds it.

With the setting off:

Call	Now
`Principal/query`	refused
`Principal/get`	the account itself, its groups, and whoever shared with it; everyone else is `notFound`
`Principal/getAvailability`	those same accounts, otherwise refused
DAV `principal-property-search`	refused
DAV `principal-match`, `acl-principal-prop-set`	unchanged, since neither reads the directory

Accounts holding sysAccountQuery aren't held back: they can list accounts anyway. Results stay within the tenant. /api/account now reports the same thing the server does.

Upgrade note for the release: this changes behavior on any server that never turned the setting on. Users there lose directory suggestions when composing, can't pick new people to share with, and lose free/busy lookups for people who haven't shared with them. To keep those, turn on Settings › Files & Sharing › Sharing › Allow Directory Queries. Existing shares keep working and can still be removed.

Tested locally:

webdav::webdav_tests and jmap::jmap_tests pass with new setting-off coverage, including admin access and turning the setting back on.
Built inbuxa and all test targets, ran the unit tests for the changed crates, cargo fmt --check, and the fork checks.
On a clean server running this branch's binary, with the setting off: a regular user gets forbidden from Principal/query and 403 from the DAV search, and an admin still sees everyone. With it on, a regular user sees everyone again. The :latest image returned all accounts to a regular user with the setting off.

Not tested: the webmail in a browser against this build. From its code, it catches the refused query and its share dialog already shows a hint for this case.

Correction, after release: the table says the WebDAV ACL reports don't read the directory. That was wrong. A user could add any account to one of their own shares by its id, then read its name back through the ACL. #283 closed that: with the setting off, a new share can only go to someone you already have a connection to, on JMAP, WebDAV and IMAP. Both are in 27.1-rc.8.

Reported on the forum: https://community.coffeylabs.org/t/disable-global-address-book/206 With "Allow Directory Queries" off, which is the default, a regular user could still list the accounts in their tenant over JMAP. The check only refused users who lacked the matching permission, and every default user role holds it. **With the setting off:** | Call | Now | |---|---| | `Principal/query` | refused | | `Principal/get` | the account itself, its groups, and whoever shared with it; everyone else is `notFound` | | `Principal/getAvailability` | those same accounts, otherwise refused | | DAV `principal-property-search` | refused | | DAV `principal-match`, `acl-principal-prop-set` | unchanged, since neither reads the directory | Accounts holding `sysAccountQuery` aren't held back: they can list accounts anyway. Results stay within the tenant. `/api/account` now reports the same thing the server does. **Upgrade note for the release:** this changes behavior on any server that never turned the setting on. Users there lose directory suggestions when composing, can't pick new people to share with, and lose free/busy lookups for people who haven't shared with them. To keep those, turn on Settings › Files & Sharing › Sharing › Allow Directory Queries. Existing shares keep working and can still be removed. **Tested locally:** - `webdav::webdav_tests` and `jmap::jmap_tests` pass with new setting-off coverage, including admin access and turning the setting back on. - Built `inbuxa` and all test targets, ran the unit tests for the changed crates, `cargo fmt --check`, and the fork checks. - On a clean server running this branch's binary, with the setting off: a regular user gets `forbidden` from `Principal/query` and 403 from the DAV search, and an admin still sees everyone. With it on, a regular user sees everyone again. The `:latest` image returned all accounts to a regular user with the setting off. Not tested: the webmail in a browser against this build. From its code, it catches the refused query and its share dialog already shows a hint for this case. **Correction, after release:** the table says the WebDAV ACL reports don't read the directory. That was wrong. A user could add any account to one of their own shares by its id, then read its name back through the ACL. #283 closed that: with the setting off, a new share can only go to someone you already have a connection to, on JMAP, WebDAV and IMAP. Both are in 27.1-rc.8.

jcoffey-dev added 1 commit 2026-11-01 23:23:58 +00:00

Make "Allow Directory Queries" apply to regular users

ci / fork-checks (pull_request) Skipped

Details

ci / build (pull_request) Skipped

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 10m46s

Details

4e3c0582b8

With the setting off, Principal/query, Principal/get,
Principal/getAvailability and DAV principal-property-search still answered
anyone holding the matching permission, and every default user role holds
those. So any user could list the accounts in their tenant.

Off now means off, except for accounts holding sysAccountQuery, which can list
accounts anyway. Principal/get and getAvailability still answer for the
account itself, its groups and whoever shared with it. /api/account reports the
same thing the server now does.

principal-match and acl-principal-prop-set aren't directory reads, so the
setting doesn't apply to them. Their checks never fired and are gone.

jcoffey-dev merged commit b12db04cf0 into main

2026-11-01 23:35:36 +00:00

jcoffey-dev deleted branch fix/directory-queries-off

2026-11-01 23:35:36 +00:00

jcoffey-dev referenced this issue from a commit

2026-11-02 00:37:28 +00:00

Keep sharing to known accounts when directory queries are off

jcoffey-dev referenced this pull request

2026-11-02 00:37:31 +00:00

Keep sharing to known accounts when directory queries are off #283

jcoffey-dev referenced this pull request

2026-11-02 01:33:58 +00:00