Access token permissions

crates/imap/src/op/acl.rs

@@ -7,7 +7,7 @@
 use std::{sync::Arc, time::Instant};
 
 use common::listener::SessionStream;
-use directory::QueryBy;
+use directory::{backend::internal::PrincipalField, Permission, QueryBy};
 use imap_proto::{
     protocol::acl::{
         Arguments, GetAclResponse, ListRightsResponse, ModRightsOp, MyRightsResponse, Rights,
@@ -36,13 +36,16 @@ use trc::AddContext;
 use utils::map::bitmap::Bitmap;
 
 use crate::{
-    core::{MailboxId, Session, SessionData},
+    core::{MailboxId, Session, SessionData, State},
     op::ImapContext,
     spawn_op,
 };
 
 impl<T: SessionStream> Session<T> {
     pub async fn handle_get_acl(&mut self, request: Request<Command>) -> trc::Result<()> {
+        // Validate access
+        self.assert_has_permission(Permission::ImapAuthenticate)?;
+
         let op_start = Instant::now();
         let arguments = request.parse_acl(self.version)?;
         let is_rev2 = self.version.is_rev2();
@@ -69,7 +72,7 @@ impl<T: SessionStream> Session<T> {
                         .query(QueryBy::Id(item.account_id), false)
                         .await
                         .imap_ctx(&arguments.tag, trc::location!())?
-                        .map(|p| p.name)
+                        .and_then(|mut p| p.take_str(PrincipalField::Name))
                     {
                         let mut rights = Vec::new();
 
@@ -142,6 +145,9 @@ impl<T: SessionStream> Session<T> {
     }
 
     pub async fn handle_my_rights(&mut self, request: Request<Command>) -> trc::Result<()> {
+        // Validate access
+        self.assert_has_permission(Permission::ImapMyRights)?;
+
         let op_start = Instant::now();
         let arguments = request.parse_acl(self.version)?;
         let data = self.state.session_data();
@@ -224,6 +230,9 @@ impl<T: SessionStream> Session<T> {
     }
 
     pub async fn handle_set_acl(&mut self, request: Request<Command>) -> trc::Result<()> {
+        // Validate access
+        self.assert_has_permission(Permission::ImapAclSet)?;
+
         let op_start = Instant::now();
         let command = request.command;
         let arguments = request.parse_acl(self.version)?;
@@ -252,7 +261,7 @@ impl<T: SessionStream> Session<T> {
                         .id(arguments.tag.to_string())
                         .caused_by(trc::location!())
                 })?
-                .id;
+                .id();
 
             // Prepare changes
             let mut changes = Object::with_capacity(1);
@@ -381,6 +390,9 @@ impl<T: SessionStream> Session<T> {
     }
 
     pub async fn handle_list_rights(&mut self, request: Request<Command>) -> trc::Result<()> {
+        // Validate access
+        self.assert_has_permission(Permission::ImapListRights)?;
+
         let op_start = Instant::now();
         let arguments = request.parse_acl(self.version)?;
 
@@ -415,6 +427,15 @@ impl<T: SessionStream> Session<T> {
         )
         .await
     }
+
+    pub fn assert_has_permission(&self, permission: Permission) -> trc::Result<()> {
+        match &self.state {
+            State::Authenticated { data } | State::Selected { data, .. } => {
+                data.access_token.assert_has_permission(permission)
+            }
+            State::NotAuthenticated { .. } => Ok(()),
+        }
+    }
 }
 
 impl<T: SessionStream> SessionData<T> {