Security says why a mail app won't connect, when legacy protocols are off

When the mail server has turned off legacy mail protocols -- IMAP, POP3,
ManageSieve and sending from mail apps -- for this account, whether for
the whole server or for the account's organization, Settings › Security
says so at the top of App passwords, the section people come to when a
phone won't connect:

  Your organization allows only {app} and JMAP apps, so phone and desktop
  mail apps can't connect to this account.

This is INBUXA's legacy-protocols LP-19. The server reports it per
account as legacyProtocols on the urn:inbuxa:jmap account capability
(contract C-1); anything short of a plain "disabled" -- an older server,
another server, no session yet -- reads as on, so the line never appears
where it isn't true.

The app's name comes from {app}, as everywhere else. Translated into all
nine languages, in the register each catalog already uses.

web/src/jmap/__tests__/legacy-protocols.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, it } from "vitest";
+import { INBUXA_CAP, legacyProtocolsOff } from "../client";
+import type { JmapSession } from "../types";
+
+/**
+ * The server says, per account, whether legacy mail protocols are off for it
+ * (legacy-protocols LP-19, contract C-1). Anything short of a plain
+ * "disabled" -- an older server, another server, no session yet -- reads as
+ * on, so the notice never appears where it isn't true.
+ */
+describe("legacyProtocolsOff", () => {
+  const session = (cap: Record<string, unknown> | undefined) =>
+    ({
+      accounts: { a: { name: "[email protected]", accountCapabilities: cap ? { [INBUXA_CAP]: cap } : {} } },
+    }) as unknown as JmapSession;
+
+  it("is on only when the account's capability says disabled", () => {
+    expect(legacyProtocolsOff(session({ legacyProtocols: "disabled" }), "a")).toBe(true);
+    expect(legacyProtocolsOff(session({ legacyProtocols: "enabled" }), "a")).toBe(false);
+  });
+
+  it("reads an older or other server, or no session, as on", () => {
+    expect(legacyProtocolsOff(session({ logo: null }), "a")).toBe(false);
+    expect(legacyProtocolsOff(session(undefined), "a")).toBe(false);
+    expect(legacyProtocolsOff(session({ legacyProtocols: "disabled" }), "b")).toBe(false);
+    expect(legacyProtocolsOff(null, "a")).toBe(false);
+    expect(legacyProtocolsOff(session({ legacyProtocols: "disabled" }), null)).toBe(false);
+  });
+});

web/src/jmap/client.ts

@@ -22,6 +22,21 @@ export const CAP = {
 /** Stalwart's own capability, which carries its `x:` registry methods. */
 export const STALWART_CAP = "urn:stalwart:jmap";
 
+/** INBUXA's own capability (contract C-1), on the signed-in account. */
+export const INBUXA_CAP = "urn:inbuxa:jmap";
+
+/**
+ * Whether legacy mail protocols -- IMAP, POP3, ManageSieve, sending from mail
+ * apps -- are off for this account: the stricter of the server's switch and
+ * its organization's, as the server reports it (legacy-protocols LP-19). Any
+ * server that doesn't say reads as on.
+ */
+export function legacyProtocolsOff(session: JmapSession | null, accountId: Id | null): boolean {
+  if (!session || !accountId) return false;
+  const cap = session.accounts[accountId]?.accountCapabilities?.[INBUXA_CAP] as { legacyProtocols?: string } | undefined;
+  return cap?.legacyProtocols === "disabled";
+}
+
 export class JmapMethodError extends Error {
   constructor(
     public readonly method: string,