Say which legacy protocols are off when only some are

inbuxa can now switch IMAP, POP3 and ManageSieve off one at a time,
server-wide and per organization, and the session lists what is still
allowed for the account (legacyAllowed). Where the webmail said
"legacy protocols are off", it now also covers the case where only
some are:

- Security & sessions, above app passwords: "Your organization has
  turned off POP3 for mail apps. Mail apps that use it can't connect
  to this account; others still can."
- The Administration dashboard: "Some legacy mail protocols are off for
  your organization: POP3."
- An organization's sheet in Administration: its switch stays the
  all-or-nothing one; when only some are off it names them and points
  to the console, where they're switched one at a time, and "Turn
  legacy protocols back on" turns them all back on.

With every protocol off, the existing wording shows, as before. From a
server that doesn't send legacyAllowed nothing new appears.

3 new strings in all nine catalogs, unreviewed.

Tested: unit tests for reading the session and a tenant's switches;
the existing tests updated for the new field; typecheck; the whole
suite (1475 tests); and in headless Chrome against a local server with
POP3 off, where Security & sessions showed the new note.

web/src/jmap/__tests__/legacy-partly-off.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from "vitest";
+import { INBUXA_CAP, legacyProtocolsPartlyOff } from "../client";
+import { parseTenantLegacy } from "@/lib/admin/adminLegacyProtocols";
+import type { JmapSession } from "../types";
+
+/**
+ * INBUXA can switch IMAP, POP3 and ManageSieve off one at a time. The session
+ * lists what is still allowed (`legacyAllowed`); the webmail names what isn't,
+ * only while some but not all are off, and never from a server that doesn't
+ * say.
+ */
+describe("legacyProtocolsPartlyOff", () => {
+  const session = (cap: Record<string, unknown> | undefined) =>
+    ({
+      accounts: { a: { name: "[email protected]", accountCapabilities: cap ? { [INBUXA_CAP]: cap } : {} } },
+    }) as unknown as JmapSession;
+
+  it("names what is off when only some are", () => {
+    const s = session({ legacyProtocols: "enabled", legacyAllowed: ["imap", "manageSieve", "submission"] });
+    expect(legacyProtocolsPartlyOff(s, "a")).toEqual(["POP3"]);
+    const two = session({ legacyProtocols: "enabled", legacyAllowed: ["pop3", "submission"] });
+    expect(legacyProtocolsPartlyOff(two, "a")).toEqual(["IMAP", "ManageSieve"]);
+  });
+
+  it("is empty with none off, all off, or an older server", () => {
+    const all = ["imap", "pop3", "manageSieve", "submission"];
+    expect(legacyProtocolsPartlyOff(session({ legacyProtocols: "enabled", legacyAllowed: all }), "a")).toEqual([]);
+    expect(legacyProtocolsPartlyOff(session({ legacyProtocols: "disabled", legacyAllowed: [] }), "a")).toEqual([]);
+    expect(legacyProtocolsPartlyOff(session({ legacyProtocols: "enabled" }), "a")).toEqual([]);
+    expect(legacyProtocolsPartlyOff(null, "a")).toEqual([]);
+  });
+});
+
+describe("parseTenantLegacy", () => {
+  it("reads a tenant with only some off, and an older server's one switch", () => {
+    expect(parseTenantLegacy({ legacyProtocols: "enabled", pop3: "disabled" }).partlyOff).toEqual(["POP3"]);
+    const all = parseTenantLegacy({ legacyProtocols: "disabled", imap: "disabled", pop3: "disabled" });
+    expect(all.off).toBe(true);
+    expect(all.partlyOff).toEqual([]);
+    expect(parseTenantLegacy({ legacyProtocols: "enabled" }).partlyOff).toEqual([]);
+  });
+});

web/src/jmap/client.ts

@@ -37,6 +37,24 @@ export function legacyProtocolsOff(session: JmapSession | null, accountId: Id |
   return cap?.legacyProtocols === "disabled";
 }
 
+/** The protocols the server can switch off one at a time, as it names them. */
+const SWITCHED = ["imap", "pop3", "manageSieve"] as const;
+const PROTOCOL_NAMES: Record<string, string> = { imap: "IMAP", pop3: "POP3", manageSieve: "ManageSieve" };
+
+/**
+ * Which of IMAP, POP3 and ManageSieve are off for this account, by name, when
+ * only some are (INBUXA legacy-protocols, one switch per protocol). Empty when
+ * none are, when all are (see `legacyProtocolsOff`), and from a server that
+ * doesn't say which (`legacyAllowed`).
+ */
+export function legacyProtocolsPartlyOff(session: JmapSession | null, accountId: Id | null): string[] {
+  if (!session || !accountId || legacyProtocolsOff(session, accountId)) return [];
+  const cap = session.accounts[accountId]?.accountCapabilities?.[INBUXA_CAP] as { legacyAllowed?: unknown } | undefined;
+  if (!Array.isArray(cap?.legacyAllowed)) return [];
+  const allowed = cap.legacyAllowed;
+  return SWITCHED.filter((p) => !allowed.includes(p)).map((p) => PROTOCOL_NAMES[p] ?? p);
+}
+
 export class JmapMethodError extends Error {
   constructor(
     public readonly method: string,