Repository navigation
fix(mail): Open, save and enable disabled accounts without a 403 - #42
Merged
Merged
Conversation
Suite Cloud reads an account's app passwords and API keys by logging in as the account. The disabled role allows only receiving mail, so Stalwart refuses that login. Opening the form, saving, enabling or rotating a disabled account failed with a 403. A disabled account now shows the credentials stored on the site. Its saves leave them as they are. Changes and rotations ask to enable the account first. The fake Stalwart refuses the login for a receive-only account, as the real one does.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Suite Cloud reads an account's app passwords and API keys by logging in as the account (master-user login). The
suite-disabledrole allows onlyemailReceive, so Stalwart refuses that login with a 403. A disabled account failed in these places:refresh()ongetdoc).Changes in
account_credentials.py:refresh(): a disabled account opens on the credentials stored on the site. It does not ask the cluster.validate(): while the cluster has the account disabled, the credentials are not loaded or changed. Edits stop with "Enable the account before changing its app passwords" (or "API keys"). Other fields save, and the account can be enabled.rotate_site_login(): stops with the same message on a disabled account.row_by_id(): does not load from the cluster for a disabled account.The fake Stalwart refuses the session for an account whose custom roles grant nothing beyond
emailReceive, as the real server does.Relation to #40
#40 fixes only the
validate()load on the save that enables an account. With #40 applied, opening a disabled account still logs the 403 above. This PR also covers that case. Both PRs changevalidate()and the fake Stalwart, so the second one to merge needs a small merge.Test plan
test_a_disabled_account_keeps_its_mirrored_credentialscovers opening, editing, rotating, saving and enabling a disabled account. Before the fix it failed with the reported 403.suite_cloudsuite passes (416 tests, 2 skipped).ruff checkandruff format --checkpass.