feat(mail): enforce owned profile self-service

tests/test_documentation.py

@@ -70,6 +70,20 @@ class MailRuntimeDocumentationTests(unittest.TestCase):
         self.assertEqual(task.metadata["help_contexts"], ["mail.profiles", "app.settings"])
         self.assertIn("current account's user scope", task.metadata["prerequisites"][0])
 
+        self_service = self.topics(
+            self.context(
+                {"mail:profile:read", "mail:profile:write_own"}
+            ),
+            enabled,
+        )
+        self.assertIn("mail.workflow.create-custom-profile", self_service)
+        condition = self_service["mail.workflow.create-custom-profile"].conditions[0]
+        self.assertEqual(condition.required_scopes, ("mail:profile:read",))
+        self.assertEqual(
+            condition.any_scopes,
+            ("mail:profile:write", "mail:profile:write_own"),
+        )
+
     def test_custom_profile_task_distinguishes_secret_test_and_use_authority(self) -> None:
         policy = EffectiveMailProfilePolicy()
         cases = (
@@ -79,6 +93,7 @@ class MailRuntimeDocumentationTests(unittest.TestCase):
             ({"mail:profile:use"}, False, False, True),
             ({"mail:profile:test", "mail:profile:use"}, False, True, True),
             ({"mail:secret:manage", "mail:profile:test", "mail:profile:use"}, True, True, True),
+            ({"mail:secret:manage_own"}, True, False, False),
         )
         for extra_scopes, credentials, testing, use in cases:
             with self.subTest(extra_scopes=extra_scopes):