Offer administration only on a device marked as your own #338

New Issue

Closed

opened 2026-09-13 23:34:17 +00:00 by jcoffey-dev · 0 comments

jcoffey-dev commented

2026-09-13 23:34:17 +00:00

Owner

Summary

Administration now needs a session signed in with "This is my own device" ticked.

Enforced on the server, not just the menu. It reuses the ADMINISTRATION=0 gate:
- administration in the session is true only when the installation allows it and the session is remembered;
- an untrusted session gets no permissions;
- the JMAP proxy refuses registry methods beyond the account's own, with 403 administration_needs_own_device.
The menu says why. An administrator in an untrusted session sees Administration greyed out, with "Only on a device you've marked as your own. Sign in again with “This is my own device” ticked." The server sends administrationNeedsOwnDevice, which tells the browser only that the account is an administrator, not what it may do.
Typing /admin still redirects to mail.
Cheaper gate. Untrusted sessions are now common, so the proxy only parses bodies that could name a registry method: text containing "x:, or a \u escape that could spell one. Any other body is forwarded byte for byte. A test covers a method name written as x:Account/get.
Docs: FEATURES.md has the rule under Administration, and a new row in the "This is my own device" table.

Independent of #337 (section list in the folder pane). Both touch AppShell.tsx on different lines.

Testing

Against npm run dev:mock, over the API:
- unticked: administration: false, administrationNeedsOwnDevice: true, no permissions; x:Account/query refused with administration_needs_own_device; Mailbox/get works;
- ticked: all 40 permissions, and the admin query works.
In Chrome, signed in unticked: the greyed-out entry and its wrapped hint in the account menu, and /admin/accounts redirecting to the inbox.
Unit tests:
- trusted-device gating and grantsAdministration (the menu's test on the server);
- the fast path forwarding unchanged bodies;
- the unicode-escape case;
- unreadable bodies that could name a method refused.
Checks:
- npm run typecheck: clean;
- npm test -w server: 192/192;
- npm test -w web: 1207/1207;
- npm run i18n:check: clean;
- npm run build: succeeds.

Translations

1 new key (the hint), in all nine catalogues. Each quotes that language's own label for the tickbox exactly as the sign-in page shows it. Strings falling back to English: 16 before, 16 after.

Merged 2026-09-13 as coffey-labs/ihasmail@f44987e391

_{Rebuilt from: git history, session transcript.}

## Summary Administration now needs a session signed in with **"This is my own device"** ticked. - **Enforced on the server, not just the menu.** It reuses the `ADMINISTRATION=0` gate: - `administration` in the session is true only when the installation allows it *and* the session is remembered; - an untrusted session gets no permissions; - the JMAP proxy refuses registry methods beyond the account's own, with 403 `administration_needs_own_device`. - **The menu says why.** An administrator in an untrusted session sees **Administration** greyed out, with "Only on a device you've marked as your own. Sign in again with “This is my own device” ticked." The server sends `administrationNeedsOwnDevice`, which tells the browser only that the account is an administrator, not what it may do. - **Typing `/admin` still redirects** to mail. - **Cheaper gate.** Untrusted sessions are now common, so the proxy only parses bodies that could name a registry method: text containing `"x:`, or a `\u` escape that could spell one. Any other body is forwarded byte for byte. A test covers a method name written as `x:Account/get`. - **Docs:** FEATURES.md has the rule under Administration, and a new row in the "This is my own device" table. Independent of #337 (section list in the folder pane). Both touch `AppShell.tsx` on different lines. ## Testing - **Against `npm run dev:mock`, over the API:** - unticked: `administration: false`, `administrationNeedsOwnDevice: true`, no permissions; `x:Account/query` refused with `administration_needs_own_device`; `Mailbox/get` works; - ticked: all 40 permissions, and the admin query works. - **In Chrome**, signed in unticked: the greyed-out entry and its wrapped hint in the account menu, and `/admin/accounts` redirecting to the inbox. - **Unit tests:** - trusted-device gating and `grantsAdministration` (the menu's test on the server); - the fast path forwarding unchanged bodies; - the unicode-escape case; - unreadable bodies that could name a method refused. - **Checks:** - `npm run typecheck`: clean; - `npm test -w server`: 192/192; - `npm test -w web`: 1207/1207; - `npm run i18n:check`: clean; - `npm run build`: succeeds. ## Translations **1 new key** (the hint), in all nine catalogues. Each quotes that language's own label for the tickbox exactly as the sign-in page shows it. Strings falling back to English: **16 before, 16 after**. **Merged** 2026-09-13 as coffey-labs/ihasmail@f44987e391c8 <sub>Rebuilt from: git history, session transcript.</sub>

This repo is archived. You cannot comment on issues.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: coffey-labs/ihasmail-github-archive#338