Subject: [Jmap] draft-ietf-jmap-mdn-04: Require "urn:ietf:params:jmap:mail" capability when calling MDN/set?

From: cketti <[email-masked]>
Date: Wed, 29 Jan 2020 14:16:48 +0100

[Originally posted as GitHub issue jmapio/jmap#314
<https://github.com/jmapio/jmap/issues/314>, but it's probably more
appropriate here.]

This is similar to "use of EmailSubmission/set#onSuccess* without :mail
capability <https://github.com/jmapio/jmap/issues/311>".

We could require MDN/set to add the "urn:ietf:params:jmap:mail"
capability in the using property of the request because of the implicit
call to Email/set. Failing to provide the capability would return a
unknownMethod error response for the implicit call.

However, using this approach could allow a client to send multiple MDNs
because the $MDNSent keyword isn't added to the message and that keyword
is used as rejection criterion by the server.

If this is unwanted behavior, I see the following two options to forbid it:

  * require both capabilities for the MDN/set call, i.e. MDN/set will
    fail when the "urn:ietf:params:jmap:mail" capability is missing; not
    only the Email/set call

  * make the "urn:ietf:params:jmap:mail" capability implicit, so we
    can't run into an unknownMethod error

-cketti

---

From: "Bron Gondwana" <[email-masked]>
Date: Thu, 30 Jan 2020 08:36:52 +1100

On Thu, Jan 30, 2020, at 00:16, cketti wrote:
> [Originally posted as GitHub issue jmapio/jmap#314 <https://github.com/jmapio/jmap/issues/314>, but it's probably more appropriate here.] 

> This is similar to "use of EmailSubmission/set#onSuccess* without :mail capability <https://github.com/jmapio/jmap/issues/311>".
> 
>  We could require MDN/set to add the "urn:ietf:params:jmap:mail" capability in the using property of the request because of the implicit call to Email/set. Failing to provide the capability would return a unknownMethod error response for the implicit call.
> 
>  However, using this approach could allow a client to send multiple MDNs because the $MDNSent keyword isn't added to the message and that keyword is used as rejection criterion by the server. 

I'm kinda "meh" about this. A client that wants to send multiple MDNs can always do it by removing the $MDNSent keyword.

>  * require both capabilities for the MDN/set call, i.e. MDN/set will fail when the "urn:ietf:params:jmap:mail" capability is missing; not only the Email/set call
>  * make the "urn:ietf:params:jmap:mail" capability implicit, so we can't run into an unknownMethod error

I'm not a fan of implicit, but I'd be OK with MDN/set (or whatever it winds up being called) requiring the :mail capability, because the MDN is an email really, so you need the ability to process emails!

Bron.

--
 Bron Gondwana, CEO, Fastmail Pty Ltd
 [email-masked]