107 lines
4.9 KiB
Markdown
107 lines
4.9 KiB
Markdown
# Mail Protocol Roadmap
|
|
|
|
GovOPlaN Mail uses SMTP for sending and supports read-only mailbox access over
|
|
IMAP or JMAP. It also provides an explicitly enabled, bounded POP3
|
|
legacy-import path. The first JMAP slice is implemented on the stable,
|
|
protocol-neutral mailbox contract.
|
|
|
|
## Current Baseline
|
|
|
|
- SMTP is the send protocol.
|
|
- IMAP is the established read/append protocol and remains unchanged.
|
|
- JMAP is an opt-in read-only sync/search protocol; it is not used for sending
|
|
or append-to-Sent.
|
|
- POP3 is an optional legacy migration source, never a general mailbox
|
|
protocol or default profile endpoint.
|
|
- Mail profile policy, encrypted credentials, connection diagnostics, and the
|
|
read-only mailbox UI cover SMTP/IMAP/JMAP endpoints as applicable.
|
|
|
|
This baseline matches the first production use case: send campaign mail, append
|
|
sent copies when configured, and inspect mailboxes read-only.
|
|
|
|
## Message Protection Profiles
|
|
|
|
The product and security profile approved on 2026-08-04 makes S/MIME the first
|
|
institutional signing/encryption profile and OpenPGP an additional explicit
|
|
profile. Neither profile is implemented by treating protection as a local Mail
|
|
toggle:
|
|
|
|
- private-key custody belongs to an Encryption/KMS provider and usable private
|
|
keys are never persisted by Mail;
|
|
- recipient certificates and keys initially come from administered directory
|
|
or LDAP sources; opportunistic Internet discovery is deferred;
|
|
- required signing or encryption fails closed when material is missing,
|
|
expired, revoked, unverifiable, or its provider is unavailable;
|
|
- plaintext fallback is permitted only by an explicit, audited policy and is
|
|
never inferred from provider failure; and
|
|
- delivery evidence pins the signing identity, trust/revocation evidence,
|
|
algorithm suite, key version, and any explicit downgrade decision.
|
|
|
|
Provider-neutral S/MIME custody and interoperability fixtures are the first
|
|
implementation slice. OpenPGP uses the same no-silent-downgrade boundary after
|
|
the S/MIME profile is stable.
|
|
|
|
## JMAP
|
|
|
|
JMAP is the preferred sync/search protocol where target mail servers support
|
|
RFC 8620 Core and RFC 8621 Mail capabilities.
|
|
|
|
Reasons:
|
|
|
|
- HTTP/JSON transport fits the platform API style better than stateful IMAP
|
|
- efficient mailbox state sync and changes endpoints
|
|
- modern search and thread models
|
|
- better fit for browser-facing mailbox UX through a server proxy
|
|
|
|
The implemented first slice provides:
|
|
|
|
- authenticated Session discovery with Bearer or Basic credentials;
|
|
- explicit account selection or primary Mail-account selection;
|
|
- folder hierarchy projection through `Mailbox/get`;
|
|
- server-side text search and pagination through `Email/query` plus bounded
|
|
summaries and details through `Email/get`;
|
|
- incremental state through bounded `Email/changes`, with an explicit full
|
|
refresh when the provider can no longer calculate changes;
|
|
- per-endpoint response and body-value bounds;
|
|
- a dedicated JMAP hostname policy and fail-closed cross-origin API discovery;
|
|
and
|
|
- protocol-neutral folder/message DTOs and mailbox UI selection while keeping
|
|
the IMAP path unchanged.
|
|
|
|
The current boundary is read-only. JMAP submission, mailbox/message mutation,
|
|
threads, calendars, contacts, push subscriptions, binary attachment download,
|
|
and automatic background synchronization are deferred until a separately
|
|
governed slice needs them.
|
|
|
|
## POP3
|
|
|
|
POP3 remains legacy-only. The bounded import slice is available when a concrete
|
|
deployment must retire a mailbox that cannot offer IMAP or JMAP.
|
|
|
|
It is disabled until an administrator creates a dedicated POP3 endpoint and
|
|
sets `legacy_import_enabled`. The endpoint has its own encrypted credential,
|
|
connection/TLS/authentication diagnostics, maximum message and batch sizes, preview body
|
|
limit, and a separate `allow_delete_after_import` policy. Stable UIDL support is
|
|
mandatory; Mail refuses import when a provider cannot supply it.
|
|
|
|
Preview and ordinary import are non-destructive. Selected messages become
|
|
encrypted `pending_review` records with a content digest, pinned transport
|
|
revision, source UIDL, and audit evidence. Repeating a UIDL reports a duplicate.
|
|
Provider deletion requires both endpoint policy and `mail:pop3:delete`, is
|
|
chosen separately per batch, and runs only after the local import and its audit
|
|
event commit. A disconnect while POP3 `QUIT` commits deletions becomes
|
|
`outcome_unknown` and is never retried blindly.
|
|
|
|
POP3 does not supply folder, flag, thread, search, or synchronization semantics.
|
|
It is therefore excluded from the normal mailbox UI and from the recommended
|
|
ongoing Mail profile. Configuration-package export/import remains SMTP-focused;
|
|
legacy source rollout is an explicit operational action.
|
|
|
|
## Decision
|
|
|
|
Keep the implemented POP3 surface limited to governed legacy import. Do not
|
|
expand it into mailbox browsing. Keep the protocol-neutral mailbox DTOs and
|
|
use the implemented JMAP path for modern synchronization/search support when
|
|
an administrator explicitly configures it. Keep SMTP for sending and POP3
|
|
limited to governed legacy import.
|