Merge branch 'ci/gitea-actions' into 'main'

ci: add Gitea Actions workflow

See merge request inbuxa/inbuxa-server!5

.gitea/workflows/ci.yml

@@ -0,0 +1,42 @@
+# CI on the self-hosted Gitea, ported from .gitlab-ci.yml during the move off
+# GitLab (2026-09-22). Gitea reads .gitea/workflows and ignores .github/ once
+# this directory exists; .github/workflows stays as it was for GitHub.
+#
+# Every job runs in an image pinned by digest (tag in the trailing comment),
+# and the only action used is coffey-labs/actions/checkout pinned by SHA. The
+# instance resolves short `uses:` against itself, never GitHub, so nothing
+# unreviewed can be pulled in.
+#
+# Not ported, as on GitLab: publish.yml and release.yml still need doing.
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: docker
+    container:
+      image: rust:1-bookworm@sha256:93ce27a88655056a51dbdd8f5f2d7ddc071c7b0070fb288a37b5a285fc83971e # 1-bookworm
+    # Both kept inside the workspace (a per-job volume on the project disk),
+    # deliberately not on /tmp, which on this host is a tmpfs that a Rust
+    # build of this size has filled before. There is no cache between runs
+    # here -- the runner's cache server is off -- so every build is cold.
+    env:
+      CARGO_INCREMENTAL: "0"
+    steps:
+      - uses: coffey-labs/actions/checkout@fab0c4d45e0162963965f1555df27b7bed5e20ec
+      - run: |
+          echo "CARGO_HOME=$GITHUB_WORKSPACE/.cargo" >> "$GITHUB_ENV"
+          echo "CARGO_TARGET_DIR=$GITHUB_WORKSPACE/target" >> "$GITHUB_ENV"
+      - run: apt-get update -qq && apt-get install -y -qq --no-install-recommends clang >/dev/null
+      - run: cargo build -p inbuxa --locked
+      # --no-run: the workflow compiled every test target without running them,
+      # which catches a test that no longer builds without paying for the suite.
+      - run: cargo test --workspace --locked --no-run

.gitignore

@@ -10,6 +10,7 @@ run.sh
 !.gitattributes
 !.github
 !.gitlab-ci.yml
+!.gitea
 CLAUDE.md
 
 # The cutover rehearsal writes its fixture and state here.

crates/common/src/config/network.rs

@@ -47,9 +47,6 @@ pub struct Network {
 #[derive(Clone)]
 pub struct NetworkInfo {
     pub pacc: Pacc,
-    /// inbuxa: the same document without IMAP, POP3, SMTP and ManageSieve,
-    /// served while legacy protocols are off (legacy-protocols LP-7).
-    pub pacc_jmap_only: Pacc,
     pub mxs: Vec<MailExchanger>,
     pub services: VecMap<ServiceProtocol, Service>,
 }
@@ -323,26 +320,11 @@ impl Network {
             }
         }
 
-        let split = |pacc: &Configuration| {
-            serde_json::to_string(pacc)
-                .unwrap_or_default()
-                .rsplit_once(SPLIT_HERE)
-                .map(|(prefix, suffix)| Pacc {
-                    prefix: prefix.to_string(),
-                    suffix: suffix.to_string(),
-                })
-                .unwrap()
-        };
-        // inbuxa: legacy-protocols LP-7
-        let pacc_jmap_only = {
-            let mut pacc = pacc.clone();
-            pacc.protocols.imap = None;
-            pacc.protocols.pop3 = None;
-            pacc.protocols.smtp = None;
-            pacc.protocols.managesieve = None;
-            split(&pacc)
-        };
-        let pacc = split(&pacc);
+        let (prefix, suffix) = serde_json::to_string(&pacc)
+            .unwrap_or_default()
+            .rsplit_once(SPLIT_HERE)
+            .map(|(prefix, suffix)| (prefix.to_string(), suffix.to_string()))
+            .unwrap();
         let mut network = Network {
             node_id: bp.node_id() as u64,
             server_name: default_hostname.to_string(),
@@ -357,8 +339,7 @@ impl Network {
             info: NetworkInfo {
                 mxs: system.mail_exchangers.into_iter().collect(),
                 services: system.services,
-                pacc,
-                pacc_jmap_only,
+                pacc: Pacc { prefix, suffix },
             },
         };
 

crates/common/src/network/autoconfig/autodiscover.rs

@@ -2,11 +2,9 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
- *
- * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
-use crate::{Server, manager::application::Resource, network::legacy::is_legacy_service};
+use crate::{Server, manager::application::Resource};
 use quick_xml::Reader;
 use quick_xml::XmlVersion;
 use quick_xml::events::Event;
@@ -57,15 +55,7 @@ impl Server {
         let _ = writeln!(&mut config, "\t\t<Account>");
         let _ = writeln!(&mut config, "\t\t\t<AccountType>email</AccountType>");
         let _ = writeln!(&mut config, "\t\t\t<Action>settings</Action>");
-        // inbuxa: legacy-protocols LP-7, LP-14a
-        let legacy_off = match emailaddress.rsplit_once('@') {
-            Some((_, domain)) => self.legacy_protocols_off_for(domain).await?,
-            None => self.legacy_protocols_off_for("").await?,
-        };
         for (protocol, service) in &self.core.network.info.services {
-            if legacy_off && is_legacy_service(protocol) {
-                continue;
-            }
             let (protocol, ports) = match protocol {
                 ServiceProtocol::Imap => ("IMAP", [143, 993]),
                 ServiceProtocol::Pop3 => ("POP3", [110, 995]),

crates/common/src/network/autoconfig/legacy_autoconfig.rs

@@ -2,11 +2,9 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
- *
- * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
-use crate::{Server, manager::application::Resource, network::legacy::is_legacy_service};
+use crate::{Server, manager::application::Resource};
 use registry::schema::enums::ServiceProtocol;
 use std::fmt::Write;
 use utils::url_params::UrlParams;
@@ -30,9 +28,6 @@ impl Server {
             ("%EMAILADDRESS%", default_host.as_str())
         };
 
-        // inbuxa: legacy-protocols LP-7, LP-14a
-        let legacy_off = self.legacy_protocols_off_for(domain).await?;
-
         // Build XML response
         let mut config = String::with_capacity(1024);
         config.push_str("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");
@@ -45,9 +40,6 @@ impl Server {
             "\t\t<displayShortName>{domain}</displayShortName>"
         );
         for (protocol, service) in &self.core.network.info.services {
-            if legacy_off && is_legacy_service(protocol) {
-                continue;
-            }
             let (protocol, tag, ports) = match protocol {
                 ServiceProtocol::Smtp => ("smtp", "outgoingServer", [587, 465]),
                 ServiceProtocol::Imap => ("imap", "incomingServer", [143, 993]),

crates/common/src/network/dns/records.rs

@@ -2,15 +2,9 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
- *
- * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
-use crate::{
-    Server,
-    config::network::Pacc,
-    network::{dkim::generate_dkim_dns_record, legacy::is_legacy_service},
-};
+use crate::{Server, config::network::Pacc, network::dkim::generate_dkim_dns_record};
 use ahash::{AHashMap, AHashSet};
 use base64::{Engine, engine::general_purpose};
 use dns_update::{
@@ -40,8 +34,6 @@ impl Server {
         let network = &self.core.network;
         let default_host = network.server_name.as_str();
         let domain_name = domain.name.as_str();
-        // inbuxa: legacy-protocols LP-7, LP-14a
-        let legacy_off = self.legacy_protocols_off_for(domain_name).await?;
         let domain_name_suffix = format!(".{domain_name}");
 
         for record_type in record_types {
@@ -201,25 +193,6 @@ impl Server {
                             ServiceProtocol::Smtp => [("submission", 587), ("submissions", 465)],
                         };
 
-                        // inbuxa: legacy-protocols LP-7. While they are off, every
-                        // name says "not offered" -- target "." (RFC 6186 section
-                        // 3.4) -- rather than vanishing, so a client that looks
-                        // is told, and an old record left in the zone is replaced.
-                        if legacy_off && is_legacy_service(protocol) {
-                            for (service_name, _) in services {
-                                records.push(NamedDnsRecord {
-                                    name: format!("_{service_name}._tcp.{domain_name}."),
-                                    record: DnsRecord::SRV(SRVRecord {
-                                        target: ".".to_string(),
-                                        priority: 0,
-                                        weight: 0,
-                                        port: 0,
-                                    }),
-                                });
-                            }
-                            continue;
-                        }
-
                         for (is_tls, (service_name, port)) in services.into_iter().enumerate() {
                             if is_tls == 1 || service.cleartext {
                                 records.push(NamedDnsRecord {
@@ -304,14 +277,6 @@ impl Server {
                     for (protocol, service) in &network.info.services {
                         let hostname = service.hostname.as_deref().unwrap_or(default_host);
                         if hostname.ends_with(&domain_name_suffix) || hostname == domain_name {
-                            // inbuxa: legacy-protocols LP-7. No TLS pin for a port
-                            // the switch has closed. Submission's port stays open
-                            // (the SMTP lock), so its record stays.
-                            if legacy_off
-                                && matches!(protocol, ServiceProtocol::Imap | ServiceProtocol::Pop3)
-                            {
-                                continue;
-                            }
                             let port = match protocol {
                                 ServiceProtocol::Imap => 993,
                                 ServiceProtocol::Pop3 => 995,
@@ -417,12 +382,6 @@ impl Server {
     }
 
     pub async fn get_pacc_for_domain(&self, domain_name: &str) -> trc::Result<String> {
-        // inbuxa: legacy-protocols LP-7, LP-14a
-        let pacc = if self.legacy_protocols_off_for(domain_name).await? {
-            &self.core.network.info.pacc_jmap_only
-        } else {
-            &self.core.network.info.pacc
-        };
         self.get_directory_for_domain(domain_name)
             .await
             .caused_by(trc::location!())
@@ -431,9 +390,15 @@ impl Server {
                     .and_then(|directory| {
                         directory
                             .oidc_discovery_document()
-                            .map(|doc| pacc.build(&doc.url))
+                            .map(|doc| self.core.network.info.pacc.build(&doc.url))
+                    })
+                    .unwrap_or_else(|| {
+                        self.core
+                            .network
+                            .info
+                            .pacc
+                            .build(&self.core.network.http.url_https)
                     })
-                    .unwrap_or_else(|| pacc.build(&self.core.network.http.url_https))
             })
     }
 }

crates/common/src/network/legacy.rs

@@ -21,23 +21,16 @@
 //! a legacy protocol is refused before any password is looked at, so a
 //! listener that exists by mistake still lets nobody in.
 //!
-//! And nothing advertises what is closed (LP-7): client configuration and
-//! the suggested DNS records leave the legacy services out, or mark them as
-//! not offered, while the switch is off -- the server's, or for a tenant's
-//! domains, the tenant's (LP-14a).
-//!
 //! Nothing here touches the host's firewall, NAT port-forwards or any proxy
 //! (LP-20). The server stops answering; what still routes the port is the
 //! operator's to reconcile.
 
-use crate::{Server, auth::AccessToken, config::server::Listeners, network::TcpAcceptor};
+use crate::{Server, config::server::Listeners, network::TcpAcceptor};
 use directory::Credentials;
 use inbuxa_features::security::{
     listeners,
     protocol_policy::{self, ProtocolPolicy, SavedListener},
-    tenant_protocol_policy,
 };
-use registry::schema::enums::ServiceProtocol;
 use registry::types::{error::Error, id::ObjectId};
 use store::registry::bootstrap::Bootstrap;
 
@@ -109,37 +102,6 @@ impl Server {
 
         protocol_policy::set(&self.core.storage.data, &policy).await?;
 
-        // LP-8. Raised here rather than by the JMAP method, so whatever turns
-        // the switch is reported. A /set that changed nothing -- the switch
-        // already where it was asked to be, nothing to close or reopen -- is
-        // not a change.
-        if previous.legacy_protocols != policy.legacy_protocols || !change.is_empty() {
-            let (moved, direction) = if policy.legacy_protocols.is_disabled() {
-                (&change.closed, "closed")
-            } else {
-                (&change.reopened, "reopened")
-            };
-            trc::event!(
-                Security(trc::SecurityEvent::LegacyProtocolsChanged),
-                Policy = "server",
-                Value = if policy.legacy_protocols.is_disabled() {
-                    "disabled"
-                } else {
-                    "enabled"
-                },
-                AccountId = policy.changed_by.clone(),
-                Details = direction,
-                ListenerId = listener_names(moved.iter().map(|l| l.id.clone())),
-                // Only when a listener could not be put back (LP-5).
-                Reason = (!change.failed.is_empty()).then(|| listener_names(
-                    change
-                        .failed
-                        .iter()
-                        .map(|(l, why)| format!("{}: {why}", l.id))
-                )),
-            );
-        }
-
         Ok(change)
     }
 
@@ -253,12 +215,6 @@ impl Server {
     }
 }
 
-/// Names for an event field: the listeners a change closed, reopened or
-/// failed to reopen (LP-8).
-fn listener_names<T: Into<trc::Value>>(names: impl Iterator<Item = T>) -> trc::Value {
-    trc::Value::Array(names.map(Into::into).collect())
-}
-
 /// A protocol a mail app signs in over, which the switch refuses (LP-6).
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum LegacyProtocol {
@@ -280,71 +236,39 @@ impl LegacyProtocol {
         }
     }
 
-    /// What the mail app is told (LP-12). Each protocol's own framing --
-    /// IMAP's `[ALERT]`, ManageSieve's quoting -- is added by its session;
-    /// POP3 carries `[AUTH]` in the text, since its errors have no separate
-    /// code, and SMTP is the whole reply line. At server scope "Your
-    /// organization" reads "This server" (LP-6).
-    pub fn refusal(&self, scope: RefusalScope) -> &'static str {
-        match (scope, self) {
-            (RefusalScope::Server, LegacyProtocol::Imap) => {
+    /// What the mail app is told, at server scope (LP-12, LP-6). Each
+    /// protocol's own framing — IMAP's `[ALERT]`, ManageSieve's quoting —
+    /// is added by its session; POP3 carries `[AUTH]` in the text, since its
+    /// errors have no separate code, and SMTP is the whole reply line.
+    pub fn refusal(&self) -> &'static str {
+        match self {
+            LegacyProtocol::Imap => {
                 "This server allows only INBUXA webmail and JMAP apps. This mail app can't sign in."
             }
-            (RefusalScope::Server, LegacyProtocol::Pop3) => {
+            LegacyProtocol::Pop3 => {
                 "[AUTH] This server allows only INBUXA webmail and JMAP apps. This mail app can't sign in."
             }
-            (RefusalScope::Server, LegacyProtocol::ManageSieve) => {
-                "This server allows only INBUXA webmail and JMAP apps."
-            }
-            (RefusalScope::Server, LegacyProtocol::Submission) => {
+            LegacyProtocol::ManageSieve => "This server allows only INBUXA webmail and JMAP apps.",
+            LegacyProtocol::Submission => {
                 "535 5.7.0 This server allows only INBUXA webmail and JMAP apps. This mail app can't send.\r\n"
             }
-            (RefusalScope::Tenant(_), LegacyProtocol::Imap) => {
-                "Your organization allows only INBUXA webmail and JMAP apps. This mail app can't sign in."
-            }
-            (RefusalScope::Tenant(_), LegacyProtocol::Pop3) => {
-                "[AUTH] Your organization allows only INBUXA webmail and JMAP apps. This mail app can't sign in."
-            }
-            (RefusalScope::Tenant(_), LegacyProtocol::ManageSieve) => {
-                "Your organization allows only INBUXA webmail and JMAP apps."
-            }
-            (RefusalScope::Tenant(_), LegacyProtocol::Submission) => {
-                "535 5.7.0 Your organization allows only INBUXA webmail and JMAP apps. This mail app can't send.\r\n"
-            }
         }
     }
 
     /// The refusal as an error: `auth.legacy-protocol-refused`, not
     /// `auth.failed`, so it never counts against the account or feeds the
-    /// auto-ban (LP-11). It names the protocol, the scope and the domain,
-    /// never the account; the session adds the remote IP.
-    ///
-    /// Not the tenant's id: `Id` is what IMAP answers a command's tag from,
-    /// so an error carrying one is sent under the wrong tag and the mail app
-    /// waits for a reply that never comes. The domain names the tenant.
-    pub fn refused(&self, scope: RefusalScope, domain: Option<String>) -> trc::Error {
+    /// auto-ban (LP-11). It names the protocol and the domain, never the
+    /// account; the session it is raised in adds the remote IP.
+    pub fn refused(&self, credentials: &Credentials) -> trc::Error {
         trc::AuthEvent::LegacyProtocolRefused
             .into_err()
-            .details(self.refusal(scope))
+            .details(self.refusal())
             .ctx(trc::Key::Source, self.as_str())
-            .ctx(
-                trc::Key::Policy,
-                match scope {
-                    RefusalScope::Server => "server",
-                    RefusalScope::Tenant(_) => "tenant",
-                },
-            )
-            .ctx_opt(trc::Key::Domain, domain)
+            .ctx(trc::Key::Policy, "server")
+            .ctx_opt(trc::Key::Domain, domain_of(credentials))
     }
 }
 
-/// Whose switch refused a sign-in: the server's (LP-6) or a tenant's (LP-10).
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum RefusalScope {
-    Server,
-    Tenant(u32),
-}
-
 /// The domain a sign-in is for, from the name it gives, if it gives one.
 fn domain_of(credentials: &Credentials) -> Option<String> {
     let username = match credentials {
@@ -359,106 +283,21 @@ fn domain_of(credentials: &Credentials) -> Option<String> {
 
 impl Server {
     /// Refuses a sign-in over a legacy protocol while the server-wide switch
-    /// is off (LP-6), or while the switch of the tenant that owns the named
-    /// domain is (LP-10). Called before the credentials are checked, so the
-    /// answer is the same for a right password, a wrong one and an address
-    /// that doesn't exist (LP-11): a tenant's domain answers for every address
-    /// on it.
+    /// is off (LP-6). Called before the credentials are checked, so the
+    /// answer is the same for a right password, a wrong one and an account
+    /// that doesn't exist (LP-11).
     ///
     /// Read from the store on each sign-in rather than cached, so every node
-    /// of a cluster answers the same the moment a switch turns.
+    /// of a cluster answers the same the moment the switch turns.
     pub async fn refuse_legacy_sign_in(
         &self,
         protocol: LegacyProtocol,
         credentials: &Credentials,
     ) -> trc::Result<()> {
-        let domain = domain_of(credentials);
         if self.protocol_policy().await?.legacy_protocols.is_disabled() {
-            return Err(protocol.refused(RefusalScope::Server, domain));
-        }
-        if let Some(name) = &domain
-            && let Some(domain) = self.domain(name).await?
-            && let Some(tenant_id) = domain.id_tenant
-            && self.tenant_legacy_protocols_off(tenant_id).await?
-        {
-            return Err(protocol.refused(RefusalScope::Tenant(tenant_id), Some(name.clone())));
-        }
-        Ok(())
-    }
-
-    /// The same, once the account is known (LP-10). A bearer token needn't
-    /// name an account, so a sign-in with one can't be judged by its domain
-    /// beforehand; this judges it by the tenant the token turned out to
-    /// belong to. For a password sign-in it has already been decided.
-    pub async fn refuse_legacy_session(
-        &self,
-        protocol: LegacyProtocol,
-        access_token: &AccessToken,
-    ) -> trc::Result<()> {
-        if let Some(tenant_id) = access_token.tenant_id()
-            && self.tenant_legacy_protocols_off(tenant_id).await?
-        {
-            return Err(protocol.refused(RefusalScope::Tenant(tenant_id), None));
-        }
-        Ok(())
-    }
-
-    /// Whether legacy protocols are off for this account: the stricter of the
-    /// server's switch and its tenant's. What the JMAP session tells the
-    /// account's apps (legacy-protocols spec, Interfaces), so the webmail can
-    /// say why a mail app won't connect (LP-19).
-    pub async fn legacy_protocols_off_for_account(
-        &self,
-        access_token: &AccessToken,
-    ) -> trc::Result<bool> {
-        if self.protocol_policy().await?.legacy_protocols.is_disabled() {
-            return Ok(true);
-        }
-        match access_token.tenant_id() {
-            Some(tenant_id) => self.tenant_legacy_protocols_off(tenant_id).await,
-            None => Ok(false),
-        }
-    }
-
-    /// Whether a tenant has turned legacy protocols off for itself (LP-10).
-    pub async fn tenant_legacy_protocols_off(&self, tenant_id: u32) -> trc::Result<bool> {
-        Ok(
-            tenant_protocol_policy::get(&self.core.storage.data, tenant_id)
-                .await?
-                .legacy_protocols
-                .is_disabled(),
-        )
-    }
-}
-
-/// The services mail apps sign in to, which the switch turns off: nothing may
-/// offer them while it is (LP-7). SMTP here is submission -- mail apps
-/// sending -- since inbound mail is never a configured service.
-pub fn is_legacy_service(protocol: &ServiceProtocol) -> bool {
-    matches!(
-        protocol,
-        ServiceProtocol::Imap
-            | ServiceProtocol::Pop3
-            | ServiceProtocol::Smtp
-            | ServiceProtocol::Managesieve
-    )
-}
-
-impl Server {
-    /// Whether legacy services are off for this domain, for the answers that
-    /// must stop offering them: off for the whole server (LP-7), or for the
-    /// tenant the domain belongs to (LP-14a). Read per answer, as sign-in
-    /// reads it. A name that is no domain here answers for the server alone.
-    pub async fn legacy_protocols_off_for(&self, domain_name: &str) -> trc::Result<bool> {
-        if self.protocol_policy().await?.legacy_protocols.is_disabled() {
-            return Ok(true);
-        }
-        match self.domain(domain_name).await? {
-            Some(domain) => match domain.id_tenant {
-                Some(tenant_id) => self.tenant_legacy_protocols_off(tenant_id).await,
-                None => Ok(false),
-            },
-            None => Ok(false),
+            Err(protocol.refused(credentials))
+        } else {
+            Ok(())
         }
     }
 }
@@ -478,57 +317,28 @@ mod tests {
     #[test]
     fn refusals_read_as_the_spec_writes_them() {
         // LP-12, with "Your organization" read as "This server" (LP-6).
-        let server = RefusalScope::Server;
         assert_eq!(
-            LegacyProtocol::Imap.refusal(server),
+            LegacyProtocol::Imap.refusal(),
             "This server allows only INBUXA webmail and JMAP apps. This mail app can't sign in."
         );
         assert!(
             LegacyProtocol::Pop3
-                .refusal(server)
+                .refusal()
                 .starts_with("[AUTH] This server allows")
         );
         assert_eq!(
-            LegacyProtocol::ManageSieve.refusal(server),
+            LegacyProtocol::ManageSieve.refusal(),
             "This server allows only INBUXA webmail and JMAP apps."
         );
         assert_eq!(
-            LegacyProtocol::Submission.refusal(server),
+            LegacyProtocol::Submission.refusal(),
             "535 5.7.0 This server allows only INBUXA webmail and JMAP apps. This mail app can't send.\r\n"
         );
     }
 
-    #[test]
-    fn a_tenant_refusal_speaks_for_the_organization() {
-        // LP-12, exactly as the spec writes them.
-        let tenant = RefusalScope::Tenant(7);
-        assert_eq!(
-            LegacyProtocol::Imap.refusal(tenant),
-            "Your organization allows only INBUXA webmail and JMAP apps. This mail app can't sign in."
-        );
-        assert_eq!(
-            LegacyProtocol::Pop3.refusal(tenant),
-            "[AUTH] Your organization allows only INBUXA webmail and JMAP apps. This mail app can't sign in."
-        );
-        assert_eq!(
-            LegacyProtocol::ManageSieve.refusal(tenant),
-            "Your organization allows only INBUXA webmail and JMAP apps."
-        );
-        assert_eq!(
-            LegacyProtocol::Submission.refusal(tenant),
-            "535 5.7.0 Your organization allows only INBUXA webmail and JMAP apps. This mail app can't send.\r\n"
-        );
-        let err = LegacyProtocol::Imap.refused(tenant, Some("example.org".into()));
-        assert_eq!(err.value_as_str(trc::Key::Policy), Some("tenant"));
-        // IMAP answers the command's tag from Id; the refusal must leave it be.
-        assert!(err.value(trc::Key::Id).is_none());
-        assert!(err.matches(trc::EventType::Auth(trc::AuthEvent::LegacyProtocolRefused)));
-    }
-
     #[test]
     fn a_refusal_is_not_a_failed_sign_in() {
-        let err = LegacyProtocol::Imap
-            .refused(RefusalScope::Server, domain_of(&basic("[email protected]")));
+        let err = LegacyProtocol::Imap.refused(&basic("[email protected]"));
         assert!(err.matches(trc::EventType::Auth(trc::AuthEvent::LegacyProtocolRefused)));
         assert!(!err.matches(trc::EventType::Auth(trc::AuthEvent::Failed)));
         // The session stays open: the mail app is told, not thrown off.
@@ -539,26 +349,6 @@ mod tests {
         assert_eq!(err.value_as_str(trc::Key::AccountName), None);
     }
 
-    #[test]
-    fn only_the_services_mail_apps_sign_in_to_are_legacy() {
-        for protocol in [
-            ServiceProtocol::Imap,
-            ServiceProtocol::Pop3,
-            ServiceProtocol::Smtp,
-            ServiceProtocol::Managesieve,
-        ] {
-            assert!(is_legacy_service(&protocol), "{protocol:?}");
-        }
-        for protocol in [
-            ServiceProtocol::Jmap,
-            ServiceProtocol::Caldav,
-            ServiceProtocol::Carddav,
-            ServiceProtocol::Webdav,
-        ] {
-            assert!(!is_legacy_service(&protocol), "{protocol:?}");
-        }
-    }
-
     #[test]
     fn the_domain_comes_from_the_name_given() {
         assert_eq!(domain_of(&basic("[email protected]")), Some("b.test".to_string()));

crates/features/src/security/mod.rs

@@ -12,4 +12,3 @@
 
 pub mod listeners;
 pub mod protocol_policy;
-pub mod tenant_protocol_policy;

crates/features/src/security/tenant_protocol_policy.rs

@@ -1,157 +0,0 @@
-/*
- * SPDX-FileCopyrightText: 2026 Coffey Labs
- *
- * SPDX-License-Identifier: AGPL-3.0-only
- */
-
-//! `inbuxa:TenantProtocolPolicy`, one tenant's legacy mail protocols switch
-//! (legacy-protocols spec, LP-9 to LP-14a). Stored as JSON under `P` `t` and
-//! the tenant id in the fork's subspace; a tenant with nothing stored has
-//! legacy protocols on.
-//!
-//! A tenant's switch closes no port -- other tenants share them (LP-13). It
-//! refuses sign-in on the tenant's domains, and keeps client configuration
-//! for them from offering what's refused. That is all it is: one fact per
-//! tenant, easy to turn back, touching no listener, role or permission.
-
-use crate::security::protocol_policy::{LegacyProtocols, ProtocolPolicy};
-use serde::{Deserialize as SerdeDeserialize, Serialize as SerdeSerialize};
-use store::{
-    Deserialize, SUBSPACE_INBUXA, Store, ValueKey,
-    write::{AnyClass, BatchBuilder, ValueClass},
-};
-use trc::AddContext;
-
-/// One tenant's switch.
-#[derive(Debug, Clone, PartialEq, Default, SerdeSerialize, SerdeDeserialize)]
-#[serde(rename_all = "camelCase", default)]
-pub struct TenantProtocolPolicy {
-    /// The switch itself.
-    pub legacy_protocols: LegacyProtocols,
-    /// When it last changed, in milliseconds since the epoch.
-    pub changed_at: Option<u64>,
-    /// The account that last changed it.
-    pub changed_by: Option<String>,
-}
-
-/// Why a tenant's switch can't be set this way, if it can't (LP-9).
-///
-/// A tenant can always turn legacy protocols off for itself. It can turn
-/// them back on only while the server has them on: server off means off for
-/// everyone.
-pub fn refusal(server: &ProtocolPolicy, requested: LegacyProtocols) -> Option<&'static str> {
-    (server.legacy_protocols.is_disabled() && !requested.is_disabled()).then_some(
-        "Legacy mail protocols are off for the whole server (inbuxa:ProtocolPolicy), \
-         so they can't be turned back on for one organization.",
-    )
-}
-
-fn key(tenant_id: u32) -> ValueClass {
-    let mut key = Vec::with_capacity(6);
-    key.extend_from_slice(b"Pt");
-    key.extend_from_slice(&tenant_id.to_be_bytes());
-    ValueClass::Any(AnyClass {
-        subspace: SUBSPACE_INBUXA,
-        key,
-    })
-}
-
-struct Json(TenantProtocolPolicy);
-
-impl Deserialize for Json {
-    fn deserialize(bytes: &[u8]) -> trc::Result<Self> {
-        serde_json::from_slice(bytes).map(Json).map_err(|err| {
-            trc::StoreEvent::DataCorruption
-                .caused_by(trc::location!())
-                .reason(err)
-        })
-    }
-}
-
-/// The tenant's policy, or the default (on) when it has never been set.
-pub async fn get(data: &Store, tenant_id: u32) -> trc::Result<TenantProtocolPolicy> {
-    Ok(data
-        .get_value::<Json>(ValueKey::from(key(tenant_id)))
-        .await
-        .caused_by(trc::location!())?
-        .map(|Json(policy)| policy)
-        .unwrap_or_default())
-}
-
-/// Stores the tenant's policy.
-pub async fn set(data: &Store, tenant_id: u32, policy: &TenantProtocolPolicy) -> trc::Result<()> {
-    let bytes = serde_json::to_vec(policy).map_err(|err| {
-        trc::StoreEvent::UnexpectedError
-            .caused_by(trc::location!())
-            .reason(err)
-    })?;
-    let mut batch = BatchBuilder::new();
-    batch.set(key(tenant_id), bytes);
-    data.write(batch.build_all())
-        .await
-        .caused_by(trc::location!())
-        .map(|_| ())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn server(legacy_protocols: LegacyProtocols) -> ProtocolPolicy {
-        ProtocolPolicy {
-            legacy_protocols,
-            ..Default::default()
-        }
-    }
-
-    #[test]
-    fn a_tenant_starts_with_legacy_protocols_on() {
-        assert!(
-            !TenantProtocolPolicy::default()
-                .legacy_protocols
-                .is_disabled()
-        );
-    }
-
-    #[test]
-    fn a_tenant_can_always_turn_them_off() {
-        for s in [LegacyProtocols::Enabled, LegacyProtocols::Disabled] {
-            assert_eq!(refusal(&server(s), LegacyProtocols::Disabled), None);
-        }
-    }
-
-    #[test]
-    fn a_tenant_can_turn_them_on_only_while_the_server_has_them_on() {
-        // LP-9, acceptance test 9.
-        assert_eq!(
-            refusal(&server(LegacyProtocols::Enabled), LegacyProtocols::Enabled),
-            None
-        );
-        let why =
-            refusal(&server(LegacyProtocols::Disabled), LegacyProtocols::Enabled).expect("refused");
-        assert!(why.contains("inbuxa:ProtocolPolicy"), "{why}");
-    }
-
-    #[test]
-    fn keys_are_per_tenant_and_clear_of_the_server_policy() {
-        let ValueClass::Any(a) = key(1) else { panic!() };
-        let ValueClass::Any(b) = key(2) else { panic!() };
-        assert_ne!(a.key, b.key);
-        assert_eq!(&a.key[..2], b"Pt");
-        assert_ne!(a.key, b"Pp".to_vec());
-    }
-
-    #[test]
-    fn stored_json_reads_back() {
-        let policy = TenantProtocolPolicy {
-            legacy_protocols: LegacyProtocols::Disabled,
-            changed_at: Some(1),
-            changed_by: Some("b".into()),
-        };
-        let Json(back) = Json::deserialize(&serde_json::to_vec(&policy).unwrap()).unwrap();
-        assert_eq!(back, policy);
-        // Unknown and missing fields read as defaults.
-        let Json(back) = Json::deserialize(br#"{"futureField":1}"#).unwrap();
-        assert_eq!(back, TenantProtocolPolicy::default());
-    }
-}

crates/imap/src/op/authenticate.rs

@@ -100,12 +100,6 @@ impl<T: SessionStream> Session<T> {
             })
             .and_then(|token| token.assert_has_permission(Permission::ImapAuthenticate))?;
 
-        // inbuxa: legacy-protocols LP-10, for a bearer token that named no account
-        self.server
-            .refuse_legacy_session(LegacyProtocol::Imap, &access_token)
-            .await
-            .map_err(|err| err.code(ResponseCode::Alert).id(tag.clone()))?;
-
         // Enforce concurrency limits
         let in_flight = match access_token.is_imap_request_allowed() {
             LimiterResult::Allowed(in_flight) => Some(in_flight),

crates/jmap-proto/src/object/inbuxa_tenant_protocol_policy.rs

@@ -1,180 +0,0 @@
-/*
- * SPDX-FileCopyrightText: 2026 Coffey Labs
- *
- * SPDX-License-Identifier: AGPL-3.0-only
- */
-
-//! `inbuxa:TenantProtocolPolicy/get` and `/set` under `urn:inbuxa:jmap`: one
-//! tenant's legacy mail protocols switch (legacy-protocols spec, LP-9 to
-//! LP-14). One per tenant; its id is the tenant's id.
-//!
-//! `tenantId`, `changedAt` and `changedBy` are the server's to say. A client
-//! that sets them is answered with `invalidProperties`.
-
-use crate::object::{AnyId, JmapObject, JmapObjectId};
-use jmap_tools::{Element, Key, Property};
-use std::{borrow::Cow, str::FromStr};
-use types::id::Id;
-
-#[derive(Debug, Clone, Default)]
-pub struct TenantProtocolPolicy;
-
-#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
-pub enum TenantProtocolPolicyProperty {
-    Id,
-    /// Server-set: the tenant this is the switch of.
-    TenantId,
-    /// The switch: `enabled` or `disabled`.
-    LegacyProtocols,
-    ChangedAt,
-    ChangedBy,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
-pub enum TenantProtocolPolicyValue {
-    Id(Id),
-}
-
-impl Property for TenantProtocolPolicyProperty {
-    fn try_parse(_: Option<&Key<'_, Self>>, value: &str) -> Option<Self> {
-        TenantProtocolPolicyProperty::parse(value)
-    }
-
-    fn to_cow(&self) -> Cow<'static, str> {
-        match self {
-            TenantProtocolPolicyProperty::Id => "id",
-            TenantProtocolPolicyProperty::TenantId => "tenantId",
-            TenantProtocolPolicyProperty::LegacyProtocols => "legacyProtocols",
-            TenantProtocolPolicyProperty::ChangedAt => "changedAt",
-            TenantProtocolPolicyProperty::ChangedBy => "changedBy",
-        }
-        .into()
-    }
-}
-
-impl TenantProtocolPolicyProperty {
-    fn parse(value: &str) -> Option<Self> {
-        hashify::tiny_map!(value.as_bytes(),
-            b"id" => TenantProtocolPolicyProperty::Id,
-            b"tenantId" => TenantProtocolPolicyProperty::TenantId,
-            b"legacyProtocols" => TenantProtocolPolicyProperty::LegacyProtocols,
-            b"changedAt" => TenantProtocolPolicyProperty::ChangedAt,
-            b"changedBy" => TenantProtocolPolicyProperty::ChangedBy,
-        )
-    }
-}
-
-impl TenantProtocolPolicyProperty {
-    /// Whether this property is the server's to say. A client that sets one
-    /// is answered with `invalidProperties`.
-    pub fn is_server_set(&self) -> bool {
-        matches!(
-            self,
-            TenantProtocolPolicyProperty::TenantId
-                | TenantProtocolPolicyProperty::ChangedAt
-                | TenantProtocolPolicyProperty::ChangedBy
-        )
-    }
-}
-
-impl FromStr for TenantProtocolPolicyProperty {
-    type Err = ();
-
-    fn from_str(s: &str) -> Result<Self, Self::Err> {
-        TenantProtocolPolicyProperty::parse(s).ok_or(())
-    }
-}
-
-impl Element for TenantProtocolPolicyValue {
-    type Property = TenantProtocolPolicyProperty;
-
-    fn try_parse<P>(key: &Key<'_, Self::Property>, value: &str) -> Option<Self> {
-        match key {
-            Key::Property(TenantProtocolPolicyProperty::Id) => {
-                Id::from_str(value).ok().map(TenantProtocolPolicyValue::Id)
-            }
-            _ => None,
-        }
-    }
-
-    fn to_cow(&self) -> Cow<'static, str> {
-        match self {
-            TenantProtocolPolicyValue::Id(id) => id.to_string().into(),
-        }
-    }
-}
-
-impl JmapObject for TenantProtocolPolicy {
-    type Property = TenantProtocolPolicyProperty;
-
-    type Element = TenantProtocolPolicyValue;
-
-    type Id = Id;
-
-    type Filter = ();
-
-    type Comparator = ();
-
-    type GetArguments = ();
-
-    type SetArguments<'de> = ();
-
-    type QueryArguments = ();
-
-    type CopyArguments = ();
-
-    type ParseArguments = ();
-
-    const ID_PROPERTY: Self::Property = TenantProtocolPolicyProperty::Id;
-}
-
-impl From<Id> for TenantProtocolPolicyValue {
-    fn from(id: Id) -> Self {
-        TenantProtocolPolicyValue::Id(id)
-    }
-}
-
-impl JmapObjectId for TenantProtocolPolicyValue {
-    fn as_id(&self) -> Option<Id> {
-        match self {
-            TenantProtocolPolicyValue::Id(id) => Some(*id),
-        }
-    }
-
-    fn as_any_id(&self) -> Option<AnyId> {
-        match self {
-            TenantProtocolPolicyValue::Id(id) => Some(AnyId::Id(*id)),
-        }
-    }
-
-    fn as_id_ref(&self) -> Option<&str> {
-        None
-    }
-
-    fn try_set_id(&mut self, new_id: AnyId) -> bool {
-        if let AnyId::Id(id) = new_id {
-            *self = TenantProtocolPolicyValue::Id(id);
-            true
-        } else {
-            false
-        }
-    }
-}
-
-impl JmapObjectId for TenantProtocolPolicyProperty {
-    fn as_id(&self) -> Option<Id> {
-        None
-    }
-
-    fn as_any_id(&self) -> Option<AnyId> {
-        None
-    }
-
-    fn as_id_ref(&self) -> Option<&str> {
-        None
-    }
-
-    fn try_set_id(&mut self, _: AnyId) -> bool {
-        false
-    }
-}

crates/jmap-proto/src/object/mod.rs

@@ -23,7 +23,6 @@ pub mod email_submission;
 pub mod fastmail_masked_email; // inbuxa: masked email
 pub mod inbuxa_ai_limits; // inbuxa: AI spam classification
 pub mod inbuxa_protocol_policy; // inbuxa: legacy protocols off
-pub mod inbuxa_tenant_protocol_policy; // inbuxa: legacy protocols off, per tenant
 pub mod inbuxa_deleted_account; // inbuxa: undelete
 pub mod file_node;
 pub mod identity;

crates/jmap-proto/src/references/eval.rs

@@ -64,9 +64,6 @@ impl Response<'_> {
                         GetResponseMethod::ProtocolPolicy(response) => {
                             response.eval_jptr(path, &mut results)
                         }
-                        GetResponseMethod::TenantProtocolPolicy(response) => {
-                            response.eval_jptr(path, &mut results)
-                        }
                         GetResponseMethod::Principal(response) => {
                             response.eval_jptr(path, &mut results)
                         }

crates/jmap-proto/src/references/resolve.rs

@@ -47,9 +47,6 @@ impl Response<'_> {
                 GetRequestMethod::DeletedAccount(request) => request.resolve_references(self)?,
                 GetRequestMethod::AiLimits(request) => request.resolve_references(self)?,
                 GetRequestMethod::ProtocolPolicy(request) => request.resolve_references(self)?,
-                GetRequestMethod::TenantProtocolPolicy(request) => {
-                    request.resolve_references(self)?
-                }
                 GetRequestMethod::Principal(request) => request.resolve_references(self)?,
                 GetRequestMethod::Quota(request) => request.resolve_references(self)?,
                 GetRequestMethod::Blob(request) => request.resolve_references(self)?,
@@ -96,9 +93,6 @@ impl Response<'_> {
                 SetRequestMethod::ProtocolPolicy(request) => {
                     request.resolve_references(self, 1, false)?
                 }
-                SetRequestMethod::TenantProtocolPolicy(request) => {
-                    request.resolve_references(self, 1, false)?
-                }
                 SetRequestMethod::AddressBook(request) => {
                     request.resolve_references(self, 1, false)?
                 }

crates/jmap-proto/src/request/capability.rs

@@ -142,11 +142,6 @@ pub struct InbuxaAccountCapabilities {
     /// The logo that applies to the principal (MT-22): a URL or a data URL.
     #[serde(rename(serialize = "logo"))]
     pub logo: Option<String>,
-    /// Whether legacy mail protocols are `enabled` or `disabled` for the
-    /// principal: the stricter of the server's switch and its tenant's
-    /// (legacy-protocols spec, Interfaces; LP-19).
-    #[serde(rename(serialize = "legacyProtocols"))]
-    pub legacy_protocols: &'static str,
 }
 
 #[derive(Debug, Clone, serde::Serialize)]

crates/jmap-proto/src/request/method.rs

@@ -50,7 +50,6 @@ pub enum MethodObject {
     // inbuxa: AI call limits
     AiLimits,
     ProtocolPolicy,
-    TenantProtocolPolicy,
 }
 
 impl MethodObject {
@@ -78,7 +77,6 @@ impl MethodObject {
             MethodObject::DeletedAccount => Capability::Inbuxa,
             MethodObject::AiLimits => Capability::Inbuxa,
             MethodObject::ProtocolPolicy => Capability::Inbuxa,
-            MethodObject::TenantProtocolPolicy => Capability::Inbuxa,
         }
     }
 }
@@ -258,12 +256,6 @@ impl MethodName {
             (MethodFunction::Set, MethodObject::AiLimits) => "inbuxa:AiLimits/set",
             (MethodFunction::Get, MethodObject::ProtocolPolicy) => "inbuxa:ProtocolPolicy/get",
             (MethodFunction::Set, MethodObject::ProtocolPolicy) => "inbuxa:ProtocolPolicy/set",
-            (MethodFunction::Get, MethodObject::TenantProtocolPolicy) => {
-                "inbuxa:TenantProtocolPolicy/get"
-            }
-            (MethodFunction::Set, MethodObject::TenantProtocolPolicy) => {
-                "inbuxa:TenantProtocolPolicy/set"
-            }
             (method, MethodObject::Registry(obj)) => {
                 return Cow::Owned(format!("x:{}/{}", obj.as_str(), method.as_str()));
             }
@@ -391,8 +383,6 @@ impl MethodName {
             "inbuxa:AiLimits/set" => (MethodObject::AiLimits, MethodFunction::Set),
             "inbuxa:ProtocolPolicy/get" => (MethodObject::ProtocolPolicy, MethodFunction::Get),
             "inbuxa:ProtocolPolicy/set" => (MethodObject::ProtocolPolicy, MethodFunction::Set),
-            "inbuxa:TenantProtocolPolicy/get" => (MethodObject::TenantProtocolPolicy, MethodFunction::Get),
-            "inbuxa:TenantProtocolPolicy/set" => (MethodObject::TenantProtocolPolicy, MethodFunction::Set),
 
         ).or_else(|| {
             let (obj, fnc) = s.strip_prefix("x:")?.split_once('/')?;
@@ -447,7 +437,6 @@ impl Display for MethodObject {
             MethodObject::DeletedAccount => "inbuxa:DeletedAccount",
             MethodObject::AiLimits => "inbuxa:AiLimits",
             MethodObject::ProtocolPolicy => "inbuxa:ProtocolPolicy",
-            MethodObject::TenantProtocolPolicy => "inbuxa:TenantProtocolPolicy",
             MethodObject::Registry(obj) => {
                 f.write_str("x:")?;
                 return f.write_str(obj.as_str());

crates/jmap-proto/src/request/mod.rs

@@ -117,9 +117,6 @@ pub enum GetRequestMethod {
     DeletedAccount(Box<GetRequest<crate::object::inbuxa_deleted_account::DeletedAccount>>),
     AiLimits(Box<GetRequest<crate::object::inbuxa_ai_limits::AiLimits>>),
     ProtocolPolicy(Box<GetRequest<crate::object::inbuxa_protocol_policy::ProtocolPolicy>>),
-    TenantProtocolPolicy(
-        Box<GetRequest<crate::object::inbuxa_tenant_protocol_policy::TenantProtocolPolicy>>,
-    ),
 }
 
 #[derive(Debug)]
@@ -144,9 +141,6 @@ pub enum SetRequestMethod<'x> {
     DeletedAccount(Box<SetRequest<'x, crate::object::inbuxa_deleted_account::DeletedAccount>>),
     AiLimits(Box<SetRequest<'x, crate::object::inbuxa_ai_limits::AiLimits>>),
     ProtocolPolicy(Box<SetRequest<'x, crate::object::inbuxa_protocol_policy::ProtocolPolicy>>),
-    TenantProtocolPolicy(
-        Box<SetRequest<'x, crate::object::inbuxa_tenant_protocol_policy::TenantProtocolPolicy>>,
-    ),
 }
 
 #[derive(Debug)]

crates/jmap-proto/src/request/parser.rs

@@ -176,15 +176,6 @@ impl<'de> Visitor<'de> for CallVisitor {
                     return Err(de::Error::invalid_length(1, &self));
                 }
             },
-            (MethodFunction::Get, MethodObject::TenantProtocolPolicy) => match seq.next_element() {
-                Ok(Some(value)) => {
-                    RequestMethod::Get(GetRequestMethod::TenantProtocolPolicy(value))
-                }
-                Err(err) => RequestMethod::invalid(err),
-                Ok(None) => {
-                    return Err(de::Error::invalid_length(1, &self));
-                }
-            },
             (MethodFunction::Get, MethodObject::VacationResponse) => match seq.next_element() {
                 Ok(Some(value)) => RequestMethod::Get(GetRequestMethod::VacationResponse(value)),
                 Err(err) => RequestMethod::invalid(err),
@@ -357,15 +348,6 @@ impl<'de> Visitor<'de> for CallVisitor {
                     return Err(de::Error::invalid_length(1, &self));
                 }
             },
-            (MethodFunction::Set, MethodObject::TenantProtocolPolicy) => match seq.next_element() {
-                Ok(Some(value)) => {
-                    RequestMethod::Set(SetRequestMethod::TenantProtocolPolicy(value))
-                }
-                Err(err) => RequestMethod::invalid(err),
-                Ok(None) => {
-                    return Err(de::Error::invalid_length(1, &self));
-                }
-            },
             (MethodFunction::Set, MethodObject::VacationResponse) => match seq.next_element() {
                 Ok(Some(value)) => RequestMethod::Set(SetRequestMethod::VacationResponse(value)),
                 Err(err) => RequestMethod::invalid(err),

crates/jmap-proto/src/response/mod.rs

@@ -104,9 +104,6 @@ pub enum GetResponseMethod {
     DeletedAccount(GetResponse<crate::object::inbuxa_deleted_account::DeletedAccount>),
     AiLimits(GetResponse<crate::object::inbuxa_ai_limits::AiLimits>),
     ProtocolPolicy(GetResponse<crate::object::inbuxa_protocol_policy::ProtocolPolicy>),
-    TenantProtocolPolicy(
-        GetResponse<crate::object::inbuxa_tenant_protocol_policy::TenantProtocolPolicy>,
-    ),
 }
 
 #[derive(Debug, serde::Serialize)]
@@ -132,9 +129,6 @@ pub enum SetResponseMethod {
     DeletedAccount(Box<SetResponse<crate::object::inbuxa_deleted_account::DeletedAccount>>),
     AiLimits(Box<SetResponse<crate::object::inbuxa_ai_limits::AiLimits>>),
     ProtocolPolicy(Box<SetResponse<crate::object::inbuxa_protocol_policy::ProtocolPolicy>>),
-    TenantProtocolPolicy(
-        Box<SetResponse<crate::object::inbuxa_tenant_protocol_policy::TenantProtocolPolicy>>,
-    ),
 }
 
 #[derive(Debug, serde::Serialize)]
@@ -311,26 +305,6 @@ impl<'x> From<SetResponse<crate::object::inbuxa_protocol_policy::ProtocolPolicy>
     }
 }
 
-impl<'x> From<GetResponse<crate::object::inbuxa_tenant_protocol_policy::TenantProtocolPolicy>>
-    for ResponseMethod<'x>
-{
-    fn from(
-        value: GetResponse<crate::object::inbuxa_tenant_protocol_policy::TenantProtocolPolicy>,
-    ) -> Self {
-        ResponseMethod::Get(GetResponseMethod::TenantProtocolPolicy(value))
-    }
-}
-
-impl<'x> From<SetResponse<crate::object::inbuxa_tenant_protocol_policy::TenantProtocolPolicy>>
-    for ResponseMethod<'x>
-{
-    fn from(
-        value: SetResponse<crate::object::inbuxa_tenant_protocol_policy::TenantProtocolPolicy>,
-    ) -> Self {
-        ResponseMethod::Set(SetResponseMethod::TenantProtocolPolicy(Box::new(value)))
-    }
-}
-
 impl<'x> From<GetResponse<crate::object::inbuxa_ai_limits::AiLimits>> for ResponseMethod<'x> {
     fn from(value: GetResponse<crate::object::inbuxa_ai_limits::AiLimits>) -> Self {
         ResponseMethod::Get(GetResponseMethod::AiLimits(value))

crates/jmap/src/api/auth.rs

@@ -80,10 +80,6 @@ impl JmapAuthorization for AccessToken {
                 // inbuxa: legacy protocols off. It takes listeners away and
                 // puts them back, so it takes the listener's permissions
                 GetRequestMethod::ProtocolPolicy(_) => Permission::SysNetworkListenerGet,
-                // inbuxa: legacy protocols off, per tenant. It governs
-                // sign-in on the tenant's domains, so it takes the domain's
-                // permissions, which a tenant administrator already holds.
-                GetRequestMethod::TenantProtocolPolicy(_) => Permission::SysDomainGet,
                 GetRequestMethod::Principal(_) => Permission::JmapPrincipalGet,
                 GetRequestMethod::Quota(_) => Permission::JmapQuotaGet,
                 GetRequestMethod::Blob(_) => Permission::JmapBlobGet,
@@ -188,14 +184,6 @@ impl JmapAuthorization for AccessToken {
                         Permission::SysNetworkListenerUpdate,
                         Permission::SysNetworkListenerUpdate,
                     ),
-                    // inbuxa: legacy protocols off, per tenant, with the domain's
-                    SetRequestMethod::TenantProtocolPolicy(s) => validate_set(
-                        s,
-                        self,
-                        Permission::SysDomainUpdate,
-                        Permission::SysDomainUpdate,
-                        Permission::SysDomainUpdate,
-                    ),
                     SetRequestMethod::VacationResponse(s) => validate_set(
                         s,
                         self,
@@ -306,8 +294,7 @@ impl JmapAuthorization for AccessToken {
                 | MethodObject::MaskedEmail
                 | MethodObject::DeletedAccount
                 | MethodObject::AiLimits
-                | MethodObject::ProtocolPolicy
-                | MethodObject::TenantProtocolPolicy => Permission::JmapEmailChanges,
+                | MethodObject::ProtocolPolicy => Permission::JmapEmailChanges,
                 // inbuxa: x:MaskedEmail/changes reads what /get reads
                 MethodObject::Registry(object_type) => object_type.get_permission(),
             },

crates/jmap/src/api/mod.rs

@@ -2,8 +2,6 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
- *
- * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use crate::blob::UploadResponse;
@@ -188,10 +186,7 @@ impl ToRequestError for trc::Error {
                 trc::SecurityEvent::Unauthorized | trc::SecurityEvent::IpUnauthorized => {
                     RequestError::forbidden()
                 }
-                // inbuxa: legacy-protocols LP-8 is an event, never an error
-                trc::SecurityEvent::IpBlockExpired
-                | trc::SecurityEvent::IpAllowExpired
-                | trc::SecurityEvent::LegacyProtocolsChanged => {
+                trc::SecurityEvent::IpBlockExpired | trc::SecurityEvent::IpAllowExpired => {
                     RequestError::internal_server_error()
                 }
             },

crates/jmap/src/api/request.rs

@@ -224,9 +224,6 @@ impl RequestHandler for Server {
                                     SetResponseMethod::ProtocolPolicy(set_response) => {
                                         set_response.update_created_ids(&mut response);
                                     }
-                                    SetResponseMethod::TenantProtocolPolicy(set_response) => {
-                                        set_response.update_created_ids(&mut response);
-                                    }
                                     SetResponseMethod::AddressBook(set_response) => {
                                         set_response.update_created_ids(&mut response);
                                     }
@@ -389,13 +386,6 @@ impl RequestHandler for Server {
                         .await?
                         .into()
                 }
-                // inbuxa: inbuxa:TenantProtocolPolicy/get (legacy protocols off, per tenant)
-                GetRequestMethod::TenantProtocolPolicy(mut req) => {
-                    resolve_account_id(&mut req.account_id, method_name.obj, access_token)?;
-                    crate::inbuxa::tenant_protocol_policy::get(self, access_token, *req)
-                        .await?
-                        .into()
-                }
                 GetRequestMethod::Principal(req) => {
                     self.principal_get(*req, access_token).await?.into()
                 }
@@ -644,13 +634,6 @@ impl RequestHandler for Server {
                         .await?
                         .into()
                 }
-                // inbuxa: inbuxa:TenantProtocolPolicy/set (legacy protocols off, per tenant)
-                SetRequestMethod::TenantProtocolPolicy(mut req) => {
-                    resolve_account_id(&mut req.account_id, method_name.obj, access_token)?;
-                    crate::inbuxa::tenant_protocol_policy::set(self, access_token, *req)
-                        .await?
-                        .into()
-                }
                 SetRequestMethod::AddressBook(mut req) => {
                     resolve_account_id(&mut req.account_id, method_name.obj, access_token)?;
                     access_token.assert_has_access(req.account_id, Collection::AddressBook)?;

crates/jmap/src/api/session.rs

@@ -66,18 +66,9 @@ impl SessionHandler for Server {
             Capability::Inbuxa,
             Capabilities::Empty(EmptyCapabilities::default()),
         );
-        // inbuxa: legacy-protocols, Interfaces: whichever switch is stricter
-        let legacy_protocols = if self.legacy_protocols_off_for_account(access_token).await? {
-            "disabled"
-        } else {
-            "enabled"
-        };
         account.account_capabilities.append(
             Capability::Inbuxa,
-            Capabilities::Inbuxa(InbuxaAccountCapabilities {
-                logo,
-                legacy_protocols,
-            }),
+            Capabilities::Inbuxa(InbuxaAccountCapabilities { logo }),
         );
         // inbuxa: Fastmail's Masked Email API, for accounts that may hold masks
         if access_token.has_permission(Permission::SysMaskedEmailGet) {

crates/jmap/src/changes/get.rs

@@ -419,7 +419,6 @@ impl IntermediateChangesResponse {
             | MethodObject::DeletedAccount
             | MethodObject::AiLimits
             | MethodObject::ProtocolPolicy
-            | MethodObject::TenantProtocolPolicy
             | MethodObject::Registry(_) => unreachable!(),
         })
     }

crates/jmap/src/inbuxa/mod.rs

@@ -10,7 +10,6 @@
 pub mod access;
 pub mod ai_limits;
 pub mod protocol_policy;
-pub mod tenant_protocol_policy;
 pub mod deleted_account;
 pub mod fastmail;
 pub mod masked_email;

crates/jmap/src/inbuxa/tenant_protocol_policy.rs

@@ -1,224 +0,0 @@
-/*
- * SPDX-FileCopyrightText: 2026 Coffey Labs
- *
- * SPDX-License-Identifier: AGPL-3.0-only
- */
-
-//! `inbuxa:TenantProtocolPolicy/get` and `/set`: one tenant's legacy mail
-//! protocols switch (legacy-protocols spec, LP-9 to LP-14). There is one per
-//! tenant, and its id is the tenant's.
-//!
-//! Inside a tenant, a principal reaches only its own tenant's (MT-1): `/get`
-//! with no ids answers with it, and any other id is `notFound`. At server
-//! level, `/get` with no ids answers with every tenant's.
-//!
-//! Turning it off never needs the server's leave; turning it back on is
-//! refused with `forbidden` while the server has legacy protocols off (LP-9).
-//! A tenant's switch closes no port (LP-13) -- sign-in and client
-//! configuration read it (LP-10, LP-14a).
-
-use common::{Server, auth::AccessToken};
-use inbuxa_features::{
-    security::{
-        protocol_policy::LegacyProtocols,
-        tenant_protocol_policy::{self, TenantProtocolPolicy as Policy, refusal},
-    },
-    tenancy::quota::all_tenants,
-};
-use jmap_proto::{
-    error::set::SetError,
-    method::{
-        get::{GetRequest, GetResponse},
-        set::{SetRequest, SetResponse},
-    },
-    object::inbuxa_tenant_protocol_policy::{
-        TenantProtocolPolicy, TenantProtocolPolicyProperty as P, TenantProtocolPolicyValue,
-    },
-    request::IntoValid,
-};
-use jmap_tools::{Key, Map, Value};
-use types::id::Id;
-
-type PValue = Value<'static, P, TenantProtocolPolicyValue>;
-
-const ALL: &[P] = &[
-    P::Id,
-    P::TenantId,
-    P::LegacyProtocols,
-    P::ChangedAt,
-    P::ChangedBy,
-];
-
-/// The tenants this principal may reach: its own inside a tenant (MT-1),
-/// every tenant at server level.
-async fn reachable(server: &Server, access_token: &AccessToken) -> trc::Result<Vec<u32>> {
-    match access_token.tenant_id() {
-        Some(tenant_id) => Ok(vec![tenant_id]),
-        None => all_tenants(server.registry()).await,
-    }
-}
-
-fn to_value(tenant_id: u32, policy: &Policy, properties: &[P]) -> PValue {
-    let mut out = Map::with_capacity(properties.len());
-    for property in properties {
-        let value = match property {
-            P::Id | P::TenantId => {
-                Value::Element(TenantProtocolPolicyValue::Id(Id::from(tenant_id)))
-            }
-            P::LegacyProtocols => Value::Str(
-                match policy.legacy_protocols {
-                    LegacyProtocols::Enabled => "enabled",
-                    LegacyProtocols::Disabled => "disabled",
-                }
-                .into(),
-            ),
-            P::ChangedAt => policy
-                .changed_at
-                .map(|at| Value::Number(at.into()))
-                .unwrap_or(Value::Null),
-            P::ChangedBy => policy
-                .changed_by
-                .as_ref()
-                .map(|by| Value::Str(by.clone().into()))
-                .unwrap_or(Value::Null),
-        };
-        out.insert_unchecked(Key::Property(property.clone()), value);
-    }
-    Value::Object(out)
-}
-
-/// `inbuxa:TenantProtocolPolicy/get`.
-pub async fn get(
-    server: &Server,
-    access_token: &AccessToken,
-    mut request: GetRequest<TenantProtocolPolicy>,
-) -> trc::Result<GetResponse<TenantProtocolPolicy>> {
-    let properties = request.unwrap_properties(ALL);
-    let (ids, not_found) = request.unwrap_ids(server.core.jmap.get_max_objects)?;
-    let mut response = GetResponse {
-        account_id: request.account_id.into(),
-        state: None,
-        list: Vec::new(),
-        not_found,
-    };
-
-    let reachable = reachable(server, access_token).await?;
-    let wanted = match ids {
-        None => reachable.iter().map(|id| Id::from(*id)).collect(),
-        Some(ids) => ids,
-    };
-    for id in wanted {
-        let tenant_id = id.document_id();
-        if reachable.contains(&tenant_id) {
-            let policy = tenant_protocol_policy::get(&server.core.storage.data, tenant_id).await?;
-            response
-                .list
-                .push(to_value(tenant_id, &policy, &properties));
-        } else {
-            response.push_not_found(id);
-        }
-    }
-    Ok(response)
-}
-
-/// `inbuxa:TenantProtocolPolicy/set`: turns one tenant's switch. Unset
-/// (`null`) puts legacy protocols back on, which LP-9 may refuse.
-pub async fn set(
-    server: &Server,
-    access_token: &AccessToken,
-    mut request: SetRequest<'_, TenantProtocolPolicy>,
-) -> trc::Result<SetResponse<TenantProtocolPolicy>> {
-    let mut response = SetResponse::from_request(&request, server.core.jmap.set_max_objects)?;
-    // A tenant's switch comes and goes with the tenant; it is only turned.
-    for (client_id, _) in request.unwrap_create() {
-        response.not_created.append(
-            client_id,
-            SetError::forbidden().with_description("A tenant's switch exists with the tenant."),
-        );
-    }
-    for id in request.unwrap_destroy().into_valid() {
-        response.not_destroyed.append(
-            id,
-            SetError::forbidden().with_description("A tenant's switch exists with the tenant."),
-        );
-    }
-
-    let reachable = reachable(server, access_token).await?;
-    for (id, value) in request.unwrap_update().into_valid() {
-        let tenant_id = id.document_id();
-        if !reachable.contains(&tenant_id) {
-            response.not_updated.append(id, SetError::not_found());
-            continue;
-        }
-
-        let data = &server.core.storage.data;
-        let previous = tenant_protocol_policy::get(data, tenant_id).await?;
-        let mut policy = previous.clone();
-        let mut error = None;
-        for (key, value) in value.into_expanded_object() {
-            let result = match &key {
-                Key::Property(P::LegacyProtocols) => match value {
-                    Value::Null => {
-                        policy.legacy_protocols = LegacyProtocols::Enabled;
-                        Ok(())
-                    }
-                    value => match value.as_str().as_deref() {
-                        Some("enabled") => {
-                            policy.legacy_protocols = LegacyProtocols::Enabled;
-                            Ok(())
-                        }
-                        Some("disabled") => {
-                            policy.legacy_protocols = LegacyProtocols::Disabled;
-                            Ok(())
-                        }
-                        _ => Err(r#"must be "enabled" or "disabled""#),
-                    },
-                },
-                Key::Property(P::Id) => Err("is immutable"),
-                Key::Property(_) => Err("is set by the server"),
-                _ => Err("is not a property of inbuxa:TenantProtocolPolicy"),
-            };
-            if let Err(why) = result {
-                error = Some(
-                    SetError::invalid_properties()
-                        .with_property(key.into_owned())
-                        .with_description(why),
-                );
-                break;
-            }
-        }
-        if let Some(error) = error {
-            response.not_updated.append(id, error);
-            continue;
-        }
-
-        // LP-9: server off means off for everyone.
-        if let Some(why) = refusal(&server.protocol_policy().await?, policy.legacy_protocols) {
-            response
-                .not_updated
-                .append(id, SetError::forbidden().with_description(why));
-            continue;
-        }
-
-        if policy.legacy_protocols != previous.legacy_protocols {
-            policy.changed_at = Some(store::write::now() * 1000);
-            policy.changed_by = Some(Id::from(access_token.account_id()).to_string());
-            tenant_protocol_policy::set(data, tenant_id, &policy).await?;
-
-            // LP-14. A tenant's switch closes and reopens nothing (LP-13).
-            trc::event!(
-                Security(trc::SecurityEvent::LegacyProtocolsChanged),
-                Policy = "tenant",
-                Id = tenant_id,
-                Value = if policy.legacy_protocols.is_disabled() {
-                    "disabled"
-                } else {
-                    "enabled"
-                },
-                AccountId = policy.changed_by.clone(),
-            );
-        }
-        response.updated.append(id, None);
-    }
-    Ok(response)
-}

crates/managesieve/src/op/authenticate.rs

@@ -101,11 +101,6 @@ impl<T: SessionStream> Session<T> {
             })
             .and_then(|token| token.assert_has_permission(Permission::SieveAuthenticate))?;
 
-        // inbuxa: legacy-protocols LP-10, for a bearer token that named no account
-        self.server
-            .refuse_legacy_session(LegacyProtocol::ManageSieve, &access_token)
-            .await?;
-
         // Enforce concurrency limits
         let in_flight = match access_token.is_imap_request_allowed() {
             LimiterResult::Allowed(in_flight) => Some(in_flight),

crates/pop3/src/op/authenticate.rs

@@ -99,11 +99,6 @@ impl<T: SessionStream> Session<T> {
             })
             .and_then(|token| token.assert_has_permission(Permission::Pop3Authenticate))?;
 
-        // inbuxa: legacy-protocols LP-10, for a bearer token that named no account
-        self.server
-            .refuse_legacy_session(LegacyProtocol::Pop3, &access_token)
-            .await?;
-
         // Enforce concurrency limits
         let in_flight = match access_token.is_imap_request_allowed() {
             LimiterResult::Allowed(in_flight) => Some(in_flight),

crates/smtp/src/inbound/auth.rs

@@ -121,7 +121,16 @@ impl<T: SessionStream> Session<T> {
             .refuse_legacy_sign_in(LegacyProtocol::Submission, &credentials)
             .await
         {
-            return self.legacy_refusal(err).await;
+            let refused = err.matches(trc::EventType::Auth(AuthEvent::LegacyProtocolRefused));
+            trc::error!(err.span_id(self.data.session_id));
+            if refused {
+                self.write(LegacyProtocol::Submission.refusal().as_bytes())
+                    .await?;
+            } else {
+                self.write(b"454 4.7.0 Temporary authentication failure\r\n")
+                    .await?;
+            }
+            return Ok(false);
         }
 
         // Authenticate
@@ -135,17 +144,6 @@ impl<T: SessionStream> Session<T> {
             .await
             .and_then(|access_token| access_token.assert_has_permission(Permission::EmailSend));
 
-        // inbuxa: legacy-protocols LP-10, for a bearer token that named no
-        // account and so couldn't be judged by its domain beforehand.
-        if let Ok(access_token) = &result
-            && let Err(err) = self
-                .server
-                .refuse_legacy_session(LegacyProtocol::Submission, access_token)
-                .await
-        {
-            return self.legacy_refusal(err).await;
-        }
-
         let result = match result {
             Ok(access_token) => self.server.account_info(access_token.account_id()).await,
             Err(err) => Err(err),
@@ -209,26 +207,6 @@ impl<T: SessionStream> Session<T> {
         Ok(false)
     }
 
-    /// inbuxa: legacy-protocols LP-6, LP-10. A refusal is written with the
-    /// words the error carries, which know whose switch refused; anything
-    /// else that went wrong deciding is a temporary failure. Neither counts
-    /// as an authentication error (LP-11).
-    async fn legacy_refusal(&mut self, err: trc::Error) -> Result<bool, ()> {
-        let reply = err
-            .matches(trc::EventType::Auth(AuthEvent::LegacyProtocolRefused))
-            .then(|| err.value_as_str(trc::Key::Details).map(str::to_string))
-            .flatten();
-        trc::error!(err.span_id(self.data.session_id));
-        match reply {
-            Some(reply) => self.write(reply.as_bytes()).await?,
-            None => {
-                self.write(b"454 4.7.0 Temporary authentication failure\r\n")
-                    .await?
-            }
-        }
-        Ok(false)
-    }
-
     pub async fn auth_error(&mut self, response: &[u8]) -> Result<bool, ()> {
         tokio::time::sleep(self.params.auth_errors_wait).await;
         self.data.auth_errors += 1;

crates/trc/src/event/enums.rs

@@ -9,9 +9,8 @@
 // This file is auto-generated. Do not edit directly.
 
 // inbuxa: 637 to 641 are the fork's SCIM events (SCIM-54); 642 is
-// auth.legacy-protocol-refused (legacy-protocols LP-6); 643 is
-// security.legacy-protocols-changed (LP-8)
-pub const TOTAL_EVENT_COUNT: usize = 644;
+// auth.legacy-protocol-refused (legacy-protocols LP-6)
+pub const TOTAL_EVENT_COUNT: usize = 643;
 pub const TOTAL_METRIC_COUNT: usize = 369;
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
@@ -656,8 +655,6 @@ pub enum SecurityEvent {
     IpAllowExpired = 594,
     IpUnauthorized = 279,
     Unauthorized = 552,
-    // inbuxa: legacy-protocols LP-8
-    LegacyProtocolsChanged = 643,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]

crates/trc/src/event/enums_impl.rs

@@ -446,8 +446,6 @@ impl EventType {
             b"security.ip-allow-expired" => EventType::Security(SecurityEvent::IpAllowExpired),
             b"security.ip-unauthorized" => EventType::Security(SecurityEvent::IpUnauthorized),
             b"security.unauthorized" => EventType::Security(SecurityEvent::Unauthorized),
-            // inbuxa: legacy-protocols LP-8
-            b"security.legacy-protocols-changed" => EventType::Security(SecurityEvent::LegacyProtocolsChanged),
             b"server.startup" => EventType::Server(ServerEvent::Startup),
             b"server.shutdown" => EventType::Server(ServerEvent::Shutdown),
             b"server.startup-error" => EventType::Server(ServerEvent::StartupError),
@@ -1213,10 +1211,6 @@ impl EventType {
             EventType::Security(SecurityEvent::IpAllowExpired) => "security.ip-allow-expired",
             EventType::Security(SecurityEvent::IpUnauthorized) => "security.ip-unauthorized",
             EventType::Security(SecurityEvent::Unauthorized) => "security.unauthorized",
-            // inbuxa: legacy-protocols LP-8
-            EventType::Security(SecurityEvent::LegacyProtocolsChanged) => {
-                "security.legacy-protocols-changed"
-            }
             EventType::Server(ServerEvent::Startup) => "server.startup",
             EventType::Server(ServerEvent::Shutdown) => "server.shutdown",
             EventType::Server(ServerEvent::StartupError) => "server.startup-error",
@@ -1889,8 +1883,6 @@ impl EventType {
             EventType::Security(SecurityEvent::IpAllowExpired) => 594,
             EventType::Security(SecurityEvent::IpUnauthorized) => 279,
             EventType::Security(SecurityEvent::Unauthorized) => 552,
-            // inbuxa: legacy-protocols LP-8
-            EventType::Security(SecurityEvent::LegacyProtocolsChanged) => 643,
             EventType::Server(ServerEvent::Startup) => 393,
             EventType::Server(ServerEvent::Shutdown) => 392,
             EventType::Server(ServerEvent::StartupError) => 394,
@@ -2579,8 +2571,6 @@ impl EventType {
             594 => Some(EventType::Security(SecurityEvent::IpAllowExpired)),
             279 => Some(EventType::Security(SecurityEvent::IpUnauthorized)),
             552 => Some(EventType::Security(SecurityEvent::Unauthorized)),
-            // inbuxa: legacy-protocols LP-8
-            643 => Some(EventType::Security(SecurityEvent::LegacyProtocolsChanged)),
             393 => Some(EventType::Server(ServerEvent::Startup)),
             392 => Some(EventType::Server(ServerEvent::Shutdown)),
             394 => Some(EventType::Server(ServerEvent::StartupError)),
@@ -3000,8 +2990,6 @@ impl EventType {
             EventType::Security(SecurityEvent::IpAllowExpired) => Level::Info,
             EventType::Security(SecurityEvent::IpUnauthorized) => Level::Info,
             EventType::Security(SecurityEvent::Unauthorized) => Level::Info,
-            // inbuxa: legacy-protocols LP-8
-            EventType::Security(SecurityEvent::LegacyProtocolsChanged) => Level::Info,
             EventType::Server(ServerEvent::Startup) => Level::Info,
             EventType::Server(ServerEvent::Shutdown) => Level::Info,
             EventType::Server(ServerEvent::Licensing) => Level::Info,
@@ -3210,9 +3198,7 @@ impl EventType {
             EventType::Auth(AuthEvent::TooManyAttempts) => "Too many authentication attempts",
             EventType::Auth(AuthEvent::ClientRegistration) => "OAuth Client registration",
             // inbuxa: legacy-protocols LP-6
-            EventType::Auth(AuthEvent::LegacyProtocolRefused) => {
-                "Legacy mail protocol sign-in refused"
-            }
+            EventType::Auth(AuthEvent::LegacyProtocolRefused) => "Legacy mail protocol sign-in refused",
             EventType::Auth(AuthEvent::Error) => "Authentication error",
             EventType::Auth(AuthEvent::Warning) => "Authentication warning",
             EventType::Auth(AuthEvent::CredentialExpired) => "Credential expired",
@@ -3725,10 +3711,6 @@ impl EventType {
             EventType::Security(SecurityEvent::IpAllowExpired) => "IP allow expired",
             EventType::Security(SecurityEvent::IpUnauthorized) => "Unauthorized IP address",
             EventType::Security(SecurityEvent::Unauthorized) => "Unauthorized access",
-            // inbuxa: legacy-protocols LP-8
-            EventType::Security(SecurityEvent::LegacyProtocolsChanged) => {
-                "Legacy mail protocols switch changed"
-            }
             EventType::Server(ServerEvent::Startup) => "Starting INBUXA Server",
             EventType::Server(ServerEvent::Shutdown) => "Shutting down INBUXA Server",
             EventType::Server(ServerEvent::StartupError) => "Server startup error",
@@ -3982,9 +3964,7 @@ impl EventType {
             EventType::Auth(AuthEvent::TooManyAttempts) => "Too many authentication attempts",
             EventType::Auth(AuthEvent::ClientRegistration) => "Authentication error",
             // inbuxa: legacy-protocols LP-6
-            EventType::Auth(AuthEvent::LegacyProtocolRefused) => {
-                "This server allows only INBUXA webmail and JMAP apps"
-            }
+            EventType::Auth(AuthEvent::LegacyProtocolRefused) => "This server allows only INBUXA webmail and JMAP apps",
             EventType::Auth(AuthEvent::Error) => "Authentication error",
             EventType::Auth(AuthEvent::CredentialExpired) => "Credential expired",
             EventType::Imap(ImapEvent::ConnectionStart) => "IMAP error",
@@ -4122,10 +4102,6 @@ impl EventType {
             EventType::Security(SecurityEvent::IpAllowExpired) => "Insufficient permissions",
             EventType::Security(SecurityEvent::IpUnauthorized) => "Unauthorized IP address",
             EventType::Security(SecurityEvent::Unauthorized) => "Insufficient permissions",
-            // inbuxa: legacy-protocols LP-8
-            EventType::Security(SecurityEvent::LegacyProtocolsChanged) => {
-                "Legacy mail protocols switch changed"
-            }
             EventType::Smtp(SmtpEvent::ConnectionStart) => "SMTP error",
             EventType::Smtp(SmtpEvent::ConnectionEnd) => "SMTP error",
             EventType::Smtp(SmtpEvent::Error) => "SMTP error",
@@ -4687,8 +4663,6 @@ impl EventType {
             EventType::Security(SecurityEvent::IpAllowExpired),
             EventType::Security(SecurityEvent::IpUnauthorized),
             EventType::Security(SecurityEvent::Unauthorized),
-            // inbuxa: legacy-protocols LP-8
-            EventType::Security(SecurityEvent::LegacyProtocolsChanged),
             EventType::Server(ServerEvent::Startup),
             EventType::Server(ServerEvent::Shutdown),
             EventType::Server(ServerEvent::StartupError),

docs/spec/contract.md

@@ -68,12 +68,6 @@ Each has an ID, and tests name the IDs they check.
   In `accountCapabilities`, the signed-in principal's own account carries
   `urn:inbuxa:jmap` with `logo`: the logo that applies to it (multi-tenancy
   MT-22), a string (URL or data URL) or `null`. Added 2026-09-18.
-
-  It also carries `legacyProtocols`: `enabled` or `disabled`, whether IMAP,
-  POP3, ManageSieve and SMTP submission are off for the principal -- the
-  stricter of the server's switch and its tenant's (legacy-protocols spec,
-  Interfaces). A front end uses it to say why a mail app can't connect
-  (LP-19). Added 2026-09-21.
 - **C-2.** Each front end states the contract versions it supports and checks
   `contract` after signing in. Outside its range it stops, with a message
   naming both versions. For ihasmail-inbuxa this replaces public ihasmail's

resources/schema/schema.json.sha256

@@ -1 +1 @@
-rLRbZKj15KvcPMVmnisfCDsXXZEKks6BXpMkMpS0mlI
+q-OZe-InKnF24mlL56Vvt3m_IQNRybiN61MFxBSo0WY

tests/e2e/legacy_protocols.py

@@ -17,20 +17,7 @@ submission -- locked open -- is refused with the spec's words, with the right
 password and with a wrong one, and refusals never add up to a disconnect
 (LP-11). And that a normal IMAP sign-in works with the switch on, before and
 after. And that while it is off, no listener the switch would close can be
-created, or made by an update (LP-4, test 4), and nothing advertises what is
-closed: autoconfig, autodiscover and PACC offer no IMAP, POP3 or submission,
-and the suggested zone marks their SRV names not offered (LP-7, test 5).
-Every change of the switch, and every refused sign-in, is an event in the
-server's log (LP-8, test 14; LP-6).
-
-Then a tenant's own switch (LP-9 to LP-14a): a tenant administrator turns it
-off for its tenant, which refuses sign-in on the tenant's domains -- real
-address or made-up, right password or wrong -- in the organization's words,
-leaves every other domain alone, and stops client configuration offering
-legacy servers for those domains. It reaches only its own tenant's switch,
-and can't turn it back on while the server has legacy protocols off
-(acceptance tests 6 to 10, 14). Throughout, the JMAP session tells each
-account which way its switches point (test 13).
+created, or made by an update (LP-4, test 4).
 
 Passwords are generated into files under target/e2e and never printed.
 Everything is removed afterwards unless KEEP=1.
@@ -202,186 +189,6 @@ def smtp_auths(port, user, passwords):
     return replies
 
 
-def advertised(admin, admin_pw):
-    """What each client-configuration answer and the suggested zone offer."""
-    with urllib.request.urlopen(f"{HTTP}/mail/[email protected]",
-                                timeout=30) as resp:
-        autoconfig = resp.read().decode()
-    body = ('<?xml version="1.0" encoding="utf-8"?><Autodiscover xmlns="http://schemas.'
-            'microsoft.com/exchange/autodiscover/outlook/requestschema/2006"><Request>'
-            '<EMailAddress>[email protected]</EMailAddress><AcceptableResponseSchema>http://'
-            'schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a'
-            '</AcceptableResponseSchema></Request></Autodiscover>').encode()
-    req = urllib.request.Request(f"{HTTP}/autodiscover/autodiscover.xml", data=body, method="POST")
-    req.add_header("Content-Type", "text/xml")
-    with urllib.request.urlopen(req, timeout=30) as resp:
-        autodiscover = resp.read().decode()
-    with urllib.request.urlopen(f"{HTTP}/.well-known/user-agent-configuration.json",
-                                timeout=30) as resp:
-        pacc = json.load(resp).get("protocols", {})
-    got = one(admin, admin_pw, "x:Domain/get", {"ids": None, "properties": ["name", "dnsZoneFile"]})
-    zone = next((d.get("dnsZoneFile") or "" for d in got[1].get("list", [])
-                 if d.get("name") == "legacy.test"), "")
-    srv = {}
-    for line in zone.splitlines():
-        fields = line.split()
-        if "SRV" in fields and fields[0].startswith("_"):
-            srv[fields[0].split(".")[0] + "." + fields[0].split(".")[1]] = fields[-1]
-    return {
-        "autoconfig": {t for t in ("imap", "pop3", "smtp") if f'type="{t}"' in autoconfig},
-        "autodiscover": {t for t in ("IMAP", "POP3", "SMTP") if f"<Type>{t}</Type>" in autodiscover},
-        "pacc": {t for t in ("imap", "pop3", "smtp", "managesieve") if t in pacc},
-        "jmap": "jmap" in pacc,
-        "srv": srv,
-    }
-
-
-def events(name):
-    """The server's log lines for one event, from its stdout tracer. The log
-    is the container's, so it starts afresh at every restart."""
-    out = docker("logs", NAME, check_rc=False)
-    return [l for l in (out.stdout + out.stderr).splitlines() if f"({name})" in l]
-
-
-def pop3_login(port, user, password):
-    """The reply to PASS, over implicit TLS."""
-    with tls(port) as sock:
-        read = lines(sock)
-        next(read)  # greeting
-        sock.sendall(f"USER {user}\r\n".encode())
-        next(read)
-        sock.sendall(f"PASS {password}\r\n".encode())
-        return next(read, "")
-
-
-def created(res, key, what):
-    obj = (res[1].get("created") or {}).get(key)
-    if not obj:
-        sys.exit(f"creating {what} failed: " + json.dumps(res[1])[:600])
-    return obj["id"]
-
-
-def tenant_checks(admin, admin_pw, account):
-    """LP-9 to LP-14a, on a tenant with its own domain, user and admin."""
-    t = created(one(admin, admin_pw, "x:Tenant/set", {"create": {"t": {"name": "legacy-t"}}}),
-                "t", "tenant")
-    t2 = created(one(admin, admin_pw, "x:Tenant/set", {"create": {"t": {"name": "legacy-t2"}}}),
-                 "t", "second tenant")
-    domain = created(one(admin, admin_pw, "x:Domain/set", {"create": {"d": {
-        "name": "t.legacy.test", "isEnabled": True, "memberTenantId": t,
-        "certificateManagement": {"@type": "Manual"}, "dnsManagement": {"@type": "Manual"},
-        "dkimManagement": {"@type": "Manual"}}}}), "d", "tenant domain")
-    user_pw = secret_file("legacy-tenant-user")
-    tadmin_pw = secret_file("legacy-tenant-admin")
-    def user(name, password, extra=None):
-        body = {"@type": "User", "name": name, "domainId": domain,
-                "credentials": {"0": {"@type": "Password", "secret": password}}}
-        body.update(extra or {})
-        return created(one(admin, admin_pw, "x:Account/set", {"create": {"a": body}}),
-                       "a", f"account {name}")
-    user("u", user_pw)
-    user("tadmin", tadmin_pw, {"roles": {"@type": "Admin"}})
-    tu, ta = "[email protected]", "[email protected]"
-
-    tsess = session(ta, tadmin_pw)
-    tacct = tsess["primaryAccounts"].get(INBUXA) or list(tsess["accounts"])[0]
-    tget = lambda ids=None: one(ta, tadmin_pw, "inbuxa:TenantProtocolPolicy/get",
-                                {"accountId": tacct, "ids": ids})
-    tset = lambda value: one(ta, tadmin_pw, "inbuxa:TenantProtocolPolicy/set",
-                             {"accountId": tacct, "update": {t: {"legacyProtocols": value}}})
-
-    check(session_flag(tu, user_pw) == "enabled",
-          "the session says enabled for the tenant's user while both switches are on (test 13)")
-
-    # Before: the tenant's user signs in, and its domain is offered IMAP.
-    check(imap_login(PORTS["imap"], tu, user_pw).startswith("OK"),
-          "a tenant's user signs in over IMAP with the tenant's switch on")
-    got = tget()
-    mine = [p["id"] for p in got[1].get("list", [])]
-    check(got[0] == "inbuxa:TenantProtocolPolicy/get" and mine == [t],
-          "a tenant admin's /get answers with its own tenant's switch only (test 10)")
-    if mine != [t]:
-        print("     reply:", json.dumps(got)[:400])
-    got = tget([t2])
-    check(got[1].get("notFound") == [t2], "another tenant's switch is not found (test 10, MT-1)")
-    res = one(ta, tadmin_pw, "inbuxa:TenantProtocolPolicy/set",
-              {"accountId": tacct, "update": {t2: {"legacyProtocols": "disabled"}}})
-    check(t2 in (res[1].get("notUpdated") or {}), "nor can it be changed (test 10)")
-
-    # The tenant admin turns it off for its tenant (LP-9).
-    res = tset("disabled")
-    check(t in (res[1].get("updated") or {}), "a tenant admin turns legacy protocols off (LP-9)")
-    if t not in (res[1].get("updated") or {}):
-        print("     reply:", json.dumps(res)[:400])
-    check(events_matching("security.legacy-protocols-changed", 'policy = "tenant"',
-                          'value = "disabled"'),
-          "and it is an event, scope tenant (LP-14, test 14)")
-
-    check(session_flag(tu, user_pw) == "disabled",
-          "the session says disabled for the tenant's user once its tenant turns it off (test 13)")
-    check(session_flag(admin, admin_pw) == "enabled",
-          "and still enabled for an account outside the tenant (test 13)")
-
-    # Refused on the tenant's domain, every way in the same words (tests 6-8).
-    imap_no = ("NO [ALERT] Your organization allows only INBUXA webmail and JMAP apps. "
-               "This mail app can't sign in.")
-    check(imap_login(PORTS["imap"], tu, user_pw) == imap_no,
-          "the tenant's user is refused over IMAP with the right password (test 6)")
-    check(imap_login(PORTS["imap"], tu, "wrong") == imap_no, "and with a wrong one (test 6)")
-    check(imap_login(PORTS["imap"], "[email protected]", "x") == imap_no,
-          "and a made-up address on the domain gets the same (test 7)")
-    check(pop3_login(PORTS["pop3"], tu, user_pw) ==
-          "-ERR [AUTH] Your organization allows only INBUXA webmail and JMAP apps. "
-          "This mail app can't sign in.", "POP3 refuses in its own form (test 8)")
-    check(smtp_auths(PORTS["submissions"], tu, [user_pw])[0] ==
-          "535 5.7.0 Your organization allows only INBUXA webmail and JMAP apps. "
-          "This mail app can't send.", "submission refuses in its own form (test 8)")
-    check(imap_login(PORTS["imap"], admin, admin_pw).startswith("OK"),
-          "an account on another domain signs in over IMAP normally (test 6)")
-    check(session(tu, user_pw).get("accounts"), "the tenant's user still has JMAP (test 8)")
-    check(not events("auth.failed"), "no refusal counted as a failed sign-in (LP-11)")
-
-    # Client configuration for the tenant's domain only (LP-14a).
-    with urllib.request.urlopen(f"{HTTP}/mail/config-v1.1.xml?emailaddress={tu}", timeout=30) as r:
-        tenant_cfg = r.read().decode()
-    with urllib.request.urlopen(f"{HTTP}/mail/config-v1.1.xml?emailaddress={admin}", timeout=30) as r:
-        other_cfg = r.read().decode()
-    check('type="imap"' not in tenant_cfg and 'type="imap"' in other_cfg,
-          "autoconfig offers no IMAP for the tenant's domain, and still does elsewhere (LP-14a)")
-
-    # Server off means off for everyone: the tenant can't turn it back on (test 9).
-    one(admin, admin_pw, "inbuxa:ProtocolPolicy/set",
-        {"accountId": account, "update": {"singleton": {"legacyProtocols": "disabled"}}})
-    check(session_flag(admin, admin_pw) == "disabled",
-          "with the server off, the session says disabled for everyone (test 13)")
-    res = tset("enabled")
-    refused = (res[1].get("notUpdated") or {}).get(t) or {}
-    check(refused.get("type") == "forbidden"
-          and "inbuxa:ProtocolPolicy" in (refused.get("description") or ""),
-          "with the server off, the tenant can't turn them back on (LP-9, test 9)")
-    one(admin, admin_pw, "inbuxa:ProtocolPolicy/set",
-        {"accountId": account, "update": {"singleton": {"legacyProtocols": "enabled"}}})
-    check(settle(PORTS["imap"], True), "IMAP is back after the server switch returns")
-
-    # And back on, the tenant's user signs in again.
-    res = tset("enabled")
-    check(t in (res[1].get("updated") or {}), "with the server on, the tenant turns them back on")
-    check(imap_login(PORTS["imap"], tu, user_pw).startswith("OK"),
-          "and its user signs in over IMAP again")
-    check(session_flag(tu, user_pw) == "enabled", "and its session says enabled again (test 13)")
-
-
-def session_flag(user, password):
-    """legacyProtocols from the account's urn:inbuxa:jmap capability."""
-    sess = session(user, password)
-    acct = sess["primaryAccounts"].get(INBUXA) or list(sess["accounts"])[0]
-    return sess["accounts"][acct]["accountCapabilities"].get(INBUXA, {}).get("legacyProtocols")
-
-
-def events_matching(name, *parts):
-    return any(all(p in line for p in parts) for line in events(name))
-
-
 def settle(port, want, tries=30):
     """Wait for a port to reach the wanted state, so the check is not a race."""
     for _ in range(tries):
@@ -425,15 +232,6 @@ def main():
     stop()
     start()
 
-    # A tracer to stdout, so the events can be read back from the container's
-    # log. It takes effect from the next start.
-    res = one(admin, admin_pw, "x:Tracer/set", {"create": {"t": {
-        "@type": "Stdout", "level": "info", "buffered": False, "ansi": False}}})
-    if not (res[1].get("created") or {}).get("t"):
-        sys.exit("tracer create failed: " + json.dumps(res))
-    stop()
-    start()
-
     sess = session(admin, admin_pw)
     account = sess["primaryAccounts"].get(INBUXA) or list(sess["accounts"])[0]
     policy_get = {"accountId": account, "ids": None}
@@ -445,15 +243,6 @@ def main():
     check(accepts(PORTS["submissions"]), "submission accepts before the switch")
     check(accepts(PORTS["smtp"]), "inbound SMTP accepts before the switch")
 
-    # What is advertised with the switch on -- the control for LP-7.
-    before = advertised(admin, admin_pw)
-    print("     advertised before:", {k: sorted(v) if isinstance(v, set) else v
-                                      for k, v in before.items() if k != "srv"})
-    check(before["autoconfig"] and before["autodiscover"],
-          "autoconfig and autodiscover offer mail apps a server with the switch on")
-    check(before["srv"].get("_imaps._tcp", ".") != ".",
-          "the suggested zone offers IMAP with the switch on")
-
     # A normal sign-in works with the switch on -- the control for LP-6.
     check(imap_login(PORTS["imap"], admin, admin_pw).startswith("OK"),
           "IMAP sign-in works with the switch on")
@@ -506,19 +295,6 @@ def main():
     if not all(r == SMTP_REFUSAL for r in replies):
         print("     replies:", replies)
 
-    # Nothing advertises what is closed (LP-7, test 5).
-    during = advertised(admin, admin_pw)
-    check(not during["autoconfig"], "autoconfig offers no IMAP, POP3 or submission (LP-7)")
-    check(not during["autodiscover"], "autodiscover offers no IMAP, POP3 or submission (LP-7)")
-    check(not during["pacc"] and during["jmap"], "PACC offers JMAP and nothing legacy (LP-7)")
-    names = ("_imap._tcp", "_imaps._tcp", "_pop3._tcp", "_pop3s._tcp",
-             "_submission._tcp", "_submissions._tcp")
-    offered = {n: t for n, t in during["srv"].items() if n in names and t != "."}
-    check(not offered and "_imaps._tcp" in during["srv"],
-          "the suggested zone marks the legacy SRV names not offered, target . (LP-7)")
-    if offered or "_imaps._tcp" not in during["srv"]:
-        print("     srv:", during["srv"])
-
     # No listener the switch would close can be added while it is off (LP-4,
     # test 4), and the refusal names the policy.
     res = one(admin, admin_pw, "x:NetworkListener/set", {"create": {"m": {
@@ -546,25 +322,6 @@ def main():
               "turning it into an IMAP listener is refused (LP-4)")
         one(admin, admin_pw, "x:NetworkListener/set", {"destroy": [extra]})
 
-    # The change was reported (LP-8, test 14), with who made it and what closed.
-    changed = events("security.legacy-protocols-changed")
-    check(len(changed) == 1 and 'value = "disabled"' in changed[0]
-          and 'policy = "server"' in changed[0] and 'details = "closed"' in changed[0]
-          and '"imaps"' in changed[0] and "accountId = " in changed[0],
-          "turning it off is one event: scope, new value, who, listeners closed (LP-8)")
-    if len(changed) != 1:
-        print("     events:", changed)
-    # Asking for what already holds is not a change.
-    one(admin, admin_pw, "inbuxa:ProtocolPolicy/set", policy_set({"legacyProtocols": "disabled"}))
-    check(len(events("security.legacy-protocols-changed")) == 1,
-          "setting it off again when it is off raises no event (LP-8)")
-    # Every refused sign-in is an event too, and none is a failed sign-in.
-    refused = events("auth.legacy-protocol-refused")
-    check(len(refused) == 7 and all('source = "submission"' in l for l in refused),
-          "each refused sign-in is an auth.legacy-protocol-refused event (LP-6)")
-    check(not events("auth.failed") and not events("auth.too-many-attempts"),
-          "and none is logged as a failed sign-in (LP-11)")
-
     # A restart must not reopen them: the objects are gone, not just the sockets.
     stop()
     start()
@@ -583,17 +340,6 @@ def main():
     policy = got[1]["list"][0]
     check(policy["legacyProtocols"] == "enabled", "switch reads back enabled")
     check(not policy["savedListeners"], "savedListeners is empty again (LP-5)")
-    changed = events("security.legacy-protocols-changed")
-    check(len(changed) == 1 and 'value = "enabled"' in changed[0]
-          and 'details = "reopened"' in changed[0] and '"imaps"' in changed[0],
-          "turning it back on is one event, naming the listeners reopened (LP-8)")
-
-    after = advertised(admin, admin_pw)
-    check(after["autoconfig"] == before["autoconfig"] and after["srv"] == before["srv"],
-          "autoconfig and the suggested zone offer them again once back on")
-
-    # A tenant's own switch (LP-9 to LP-14a).
-    tenant_checks(admin, admin_pw, account)
 
     # And sign-in works again, with no restart.
     check(imap_login(PORTS["imap"], admin, admin_pw).startswith("OK"),