Access token permissions

crates/managesieve/src/op/authenticate.rs

@@ -5,6 +5,7 @@
  */
 
 use common::listener::{limiter::ConcurrencyLimiter, SessionStream};
+use directory::Permission;
 use imap::op::authenticate::{decode_challenge_oauth, decode_challenge_plain};
 use imap_proto::{
     protocol::authenticate::Mechanism,
@@ -116,6 +117,9 @@ impl<T: SessionStream> Session<T> {
             }
         };
 
+        // Validate access
+        access_token.assert_has_permission(Permission::SieveAuthenticate)?;
+
         // Cache access token
         let access_token = Arc::new(access_token);
         self.jmap.cache_access_token(access_token.clone());

crates/managesieve/src/op/checkscript.rs

@@ -6,13 +6,17 @@
 
 use std::time::Instant;
 
+use common::listener::SessionStream;
+use directory::Permission;
 use imap_proto::receiver::Request;
-use tokio::io::{AsyncRead, AsyncWrite};
 
 use crate::core::{Command, Session, StatusResponse};
 
-impl<T: AsyncRead + AsyncWrite> Session<T> {
+impl<T: SessionStream> Session<T> {
     pub async fn handle_checkscript(&mut self, request: Request<Command>) -> trc::Result<Vec<u8>> {
+        // Validate access
+        self.assert_has_permission(Permission::SieveCheckScript)?;
+
         let op_start = Instant::now();
 
         if request.tokens.is_empty() {

crates/managesieve/src/op/deletescript.rs

@@ -6,16 +6,20 @@
 
 use std::time::Instant;
 
+use common::listener::SessionStream;
+use directory::Permission;
 use imap_proto::receiver::Request;
 use jmap_proto::types::collection::Collection;
 use store::write::log::ChangeLogBuilder;
-use tokio::io::{AsyncRead, AsyncWrite};
 use trc::AddContext;
 
 use crate::core::{Command, ResponseCode, Session, StatusResponse};
 
-impl<T: AsyncRead + AsyncWrite> Session<T> {
+impl<T: SessionStream> Session<T> {
     pub async fn handle_deletescript(&mut self, request: Request<Command>) -> trc::Result<Vec<u8>> {
+        // Validate access
+        self.assert_has_permission(Permission::SieveDeleteScript)?;
+
         let op_start = Instant::now();
 
         let name = request

crates/managesieve/src/op/getscript.rs

@@ -6,19 +6,23 @@
 
 use std::time::Instant;
 
+use common::listener::SessionStream;
+use directory::Permission;
 use imap_proto::receiver::Request;
 use jmap::sieve::set::ObjectBlobId;
 use jmap_proto::{
     object::Object,
     types::{collection::Collection, property::Property, value::Value},
 };
-use tokio::io::{AsyncRead, AsyncWrite};
 use trc::AddContext;
 
 use crate::core::{Command, ResponseCode, Session, StatusResponse};
 
-impl<T: AsyncRead + AsyncWrite> Session<T> {
+impl<T: SessionStream> Session<T> {
     pub async fn handle_getscript(&mut self, request: Request<Command>) -> trc::Result<Vec<u8>> {
+        // Validate access
+        self.assert_has_permission(Permission::SieveGetScript)?;
+
         let op_start = Instant::now();
         let name = request
             .tokens

crates/managesieve/src/op/havespace.rs

@@ -6,14 +6,18 @@
 
 use std::time::Instant;
 
+use common::listener::SessionStream;
+use directory::Permission;
 use imap_proto::receiver::Request;
-use tokio::io::{AsyncRead, AsyncWrite};
 use trc::AddContext;
 
 use crate::core::{Command, ResponseCode, Session, StatusResponse};
 
-impl<T: AsyncRead + AsyncWrite> Session<T> {
+impl<T: SessionStream> Session<T> {
     pub async fn handle_havespace(&mut self, request: Request<Command>) -> trc::Result<Vec<u8>> {
+        // Validate access
+        self.assert_has_permission(Permission::SieveHaveSpace)?;
+
         let op_start = Instant::now();
         let mut tokens = request.tokens.into_iter();
         let name = tokens

crates/managesieve/src/op/listscripts.rs

@@ -6,17 +6,21 @@
 
 use std::time::Instant;
 
+use common::listener::SessionStream;
+use directory::Permission;
 use jmap_proto::{
     object::Object,
     types::{collection::Collection, property::Property, value::Value},
 };
-use tokio::io::{AsyncRead, AsyncWrite};
 use trc::AddContext;
 
 use crate::core::{Session, StatusResponse};
 
-impl<T: AsyncRead + AsyncWrite> Session<T> {
+impl<T: SessionStream> Session<T> {
     pub async fn handle_listscripts(&mut self) -> trc::Result<Vec<u8>> {
+        // Validate access
+        self.assert_has_permission(Permission::SieveListScripts)?;
+
         let op_start = Instant::now();
         let account_id = self.state.access_token().primary_id();
         let document_ids = self

crates/managesieve/src/op/mod.rs

@@ -5,8 +5,9 @@
  */
 
 use common::listener::SessionStream;
+use directory::Permission;
 
-use crate::core::{Session, StatusResponse};
+use crate::core::{Session, State, StatusResponse};
 
 pub mod authenticate;
 pub mod capability;
@@ -31,4 +32,13 @@ impl<T: SessionStream> Session<T> {
 
         Ok(StatusResponse::ok("Begin TLS negotiation now").into_bytes())
     }
+
+    pub fn assert_has_permission(&self, permission: Permission) -> trc::Result<()> {
+        match &self.state {
+            State::Authenticated { access_token, .. } => {
+                access_token.assert_has_permission(permission)
+            }
+            State::NotAuthenticated { .. } => Ok(()),
+        }
+    }
 }

crates/managesieve/src/op/putscript.rs

@@ -6,6 +6,8 @@
 
 use std::time::Instant;
 
+use common::listener::SessionStream;
+use directory::Permission;
 use imap_proto::receiver::Request;
 use jmap::sieve::set::{ObjectBlobId, SCHEMA};
 use jmap_proto::{
@@ -18,13 +20,15 @@ use store::{
     write::{assert::HashedValue, log::LogInsert, BatchBuilder, BlobOp, DirectoryClass},
     BlobClass,
 };
-use tokio::io::{AsyncRead, AsyncWrite};
 use trc::AddContext;
 
 use crate::core::{Command, ResponseCode, Session, StatusResponse};
 
-impl<T: AsyncRead + AsyncWrite> Session<T> {
+impl<T: SessionStream> Session<T> {
     pub async fn handle_putscript(&mut self, request: Request<Command>) -> trc::Result<Vec<u8>> {
+        // Validate access
+        self.assert_has_permission(Permission::SievePutScript)?;
+
         let op_start = Instant::now();
         let mut tokens = request.tokens.into_iter();
         let name = tokens

crates/managesieve/src/op/renamescript.rs

@@ -6,6 +6,8 @@
 
 use std::time::Instant;
 
+use common::listener::SessionStream;
+use directory::Permission;
 use imap_proto::receiver::Request;
 use jmap::sieve::set::SCHEMA;
 use jmap_proto::{
@@ -13,13 +15,15 @@ use jmap_proto::{
     types::{collection::Collection, property::Property, value::Value},
 };
 use store::write::{assert::HashedValue, log::ChangeLogBuilder, BatchBuilder};
-use tokio::io::{AsyncRead, AsyncWrite};
 use trc::AddContext;
 
 use crate::core::{Command, ResponseCode, Session, StatusResponse};
 
-impl<T: AsyncRead + AsyncWrite> Session<T> {
+impl<T: SessionStream> Session<T> {
     pub async fn handle_renamescript(&mut self, request: Request<Command>) -> trc::Result<Vec<u8>> {
+        // Validate access
+        self.assert_has_permission(Permission::SieveRenameScript)?;
+
         let op_start = Instant::now();
         let mut tokens = request.tokens.into_iter();
         let name = tokens

crates/managesieve/src/op/setactive.rs

@@ -6,16 +6,20 @@
 
 use std::time::Instant;
 
+use common::listener::SessionStream;
+use directory::Permission;
 use imap_proto::receiver::Request;
 use jmap_proto::types::collection::Collection;
 use store::write::log::ChangeLogBuilder;
-use tokio::io::{AsyncRead, AsyncWrite};
 use trc::AddContext;
 
 use crate::core::{Command, Session, StatusResponse};
 
-impl<T: AsyncRead + AsyncWrite> Session<T> {
+impl<T: SessionStream> Session<T> {
     pub async fn handle_setactive(&mut self, request: Request<Command>) -> trc::Result<Vec<u8>> {
+        // Validate access
+        self.assert_has_permission(Permission::SieveSetActive)?;
+
         let op_start = Instant::now();
         let name = request
             .tokens