Locked accounts: keep receiving mail, no sign-in, hand to delegates #65

Merged

jcoffey-dev merged 1 commits from feature/account-lock into main

2026-09-27 22:55:36 +00:00

jcoffey-dev commented

2026-09-27 21:46:53 +00:00

Owner

Phase 2 of the audit, hold and lock work (AL-1 to AL-12).

A locked account keeps receiving mail, but:

sign-in fails as a wrong password does, on every protocol, and refresh tokens stop issuing;
open sessions end on every node (new EndSessions cluster broadcast); IMAP refuses from the next command;
Sieve forwards, vacation replies and rejections do nothing.

Delegates (up to ten; read, organize or full; optional send-as and end date) get real ACL grants on the account's mailboxes, calendars, address books and files, so every protocol honors them. Replaced rights are restored on unlock. Folders made later are granted after the create and by a daily sweep. Organize never destroys (JMAP destroy and IMAP EXPUNGE refused; Trash and Junk read-only). Send-as needs organize or full.

New inbuxa:AccountLock get/set; permissions 665-668, granted to tenant admins and superusers; tenant admins stay in their tenant.
Lock, unlock and delegate changes need a reason (AU-12) and are audited; delegate access (hourly) and writes are audited.
The JMAP session marks delegated accounts in urn:inbuxa:jmap (delegation) and sets isReadOnly for read delegates.
Schema: Compliance > Locked Accounts.

Known gap: an already signed-in POP3 or ManageSieve session runs until it disconnects.

Tests: system::account_lock on RocksDB, PostgreSQL and MySQL (includes a vacation-reply control); system, jmap, imap, webdav, scim and audit suites pass on RocksDB.

Phase 2 of the audit, hold and lock work (AL-1 to AL-12). A locked account keeps receiving mail, but: - sign-in fails as a wrong password does, on every protocol, and refresh tokens stop issuing; - open sessions end on every node (new `EndSessions` cluster broadcast); IMAP refuses from the next command; - Sieve forwards, vacation replies and rejections do nothing. Delegates (up to ten; read, organize or full; optional send-as and end date) get real ACL grants on the account's mailboxes, calendars, address books and files, so every protocol honors them. Replaced rights are restored on unlock. Folders made later are granted after the create and by a daily sweep. Organize never destroys (JMAP destroy and IMAP EXPUNGE refused; Trash and Junk read-only). Send-as needs organize or full. - New `inbuxa:AccountLock` get/set; permissions 665-668, granted to tenant admins and superusers; tenant admins stay in their tenant. - Lock, unlock and delegate changes need a reason (AU-12) and are audited; delegate access (hourly) and writes are audited. - The JMAP session marks delegated accounts in `urn:inbuxa:jmap` (`delegation`) and sets `isReadOnly` for read delegates. - Schema: Compliance > Locked Accounts. Known gap: an already signed-in POP3 or ManageSieve session runs until it disconnects. Tests: `system::account_lock` on RocksDB, PostgreSQL and MySQL (includes a vacation-reply control); system, jmap, imap, webdav, scim and audit suites pass on RocksDB.

jcoffey-dev added 1 commit 2026-09-27 21:46:53 +00:00

Lock accounts: keep receiving mail, no sign-in, hand to delegates

ci / fork-checks (pull_request) Successful in 1m4s

Details

ci / build (pull_request) Successful in 8m47s

Details

447229f871

A locked account can't sign in (it fails as a wrong password does), its
sessions end on every node, refresh tokens stop working, and its Sieve
scripts forward and reply to nothing. Mail keeps arriving.

Delegates get real ACL grants on the account's mailboxes, calendars,
address books and files at read, organize or full, with the rights they
replaced restored on unlock. Folders made later are granted after the
create and in a daily sweep. Organize delegates can't destroy; send-as
needs organize or full. The JMAP session marks delegated accounts in
urn:inbuxa:jmap.

New inbuxa:AccountLock object with get/set, permissions 665-668, and a
Compliance > Locked Accounts entry in the schema. Lock, unlock and
delegate changes need a reason and are audited; delegate access and
writes are audited too (audit-hold-lock spec AL-1 to AL-12).

jcoffey-dev merged commit 224597cab2 into main

2026-09-27 22:55:36 +00:00

jcoffey-dev deleted branch feature/account-lock

2026-09-27 22:55:37 +00:00

jcoffey-dev referenced this issue from a commit

2026-09-27 23:35:47 +00:00

Release 2026.9.27.1

jcoffey-dev referenced this pull request

2026-09-27 23:35:52 +00:00

Release 2026.9.27.1 #67