rfc9425.original | rfc9425.txt | |||
---|---|---|---|---|
JMAP Working Group R.C. Cordier, Ed. | Internet Engineering Task Force (IETF) R. Cordier, Ed. | |||
Internet-Draft Linagora Vietnam | Request for Comments: 9425 Linagora Vietnam | |||
Intended status: Standards Track 6 February 2023 | Category: Standards Track June 2023 | |||
Expires: 10 August 2023 | ISSN: 2070-1721 | |||
JMAP for Quotas | JSON Meta Application Protocol (JMAP) for Quotas | |||
draft-ietf-jmap-quotas-12 | ||||
Abstract | Abstract | |||
This document specifies a data model for handling quotas on accounts | This document specifies a data model for handling quotas on accounts | |||
with a server using the JSON Meta Application Protocol (JMAP). | with a server using the JSON Meta Application Protocol (JMAP). | |||
Status of This Memo | Status of This Memo | |||
This Internet-Draft is submitted in full conformance with the | This is an Internet Standards Track document. | |||
provisions of BCP 78 and BCP 79. | ||||
Internet-Drafts are working documents of the Internet Engineering | ||||
Task Force (IETF). Note that other groups may also distribute | ||||
working documents as Internet-Drafts. The list of current Internet- | ||||
Drafts is at https://datatracker.ietf.org/drafts/current/. | ||||
Internet-Drafts are draft documents valid for a maximum of six months | This document is a product of the Internet Engineering Task Force | |||
and may be updated, replaced, or obsoleted by other documents at any | (IETF). It represents the consensus of the IETF community. It has | |||
time. It is inappropriate to use Internet-Drafts as reference | received public review and has been approved for publication by the | |||
material or to cite them other than as "work in progress." | Internet Engineering Steering Group (IESG). Further information on | |||
Internet Standards is available in Section 2 of RFC 7841. | ||||
This Internet-Draft will expire on 10 August 2023. | Information about the current status of this document, any errata, | |||
and how to provide feedback on it may be obtained at | ||||
https://www.rfc-editor.org/info/rfc9425. | ||||
Copyright Notice | Copyright Notice | |||
Copyright (c) 2023 IETF Trust and the persons identified as the | Copyright (c) 2023 IETF Trust and the persons identified as the | |||
document authors. All rights reserved. | document authors. All rights reserved. | |||
This document is subject to BCP 78 and the IETF Trust's Legal | This document is subject to BCP 78 and the IETF Trust's Legal | |||
Provisions Relating to IETF Documents (https://trustee.ietf.org/ | Provisions Relating to IETF Documents | |||
license-info) in effect on the date of publication of this document. | (https://trustee.ietf.org/license-info) in effect on the date of | |||
Please review these documents carefully, as they describe your rights | publication of this document. Please review these documents | |||
and restrictions with respect to this document. Code Components | carefully, as they describe your rights and restrictions with respect | |||
extracted from this document must include Revised BSD License text as | to this document. Code Components extracted from this document must | |||
described in Section 4.e of the Trust Legal Provisions and are | include Revised BSD License text as described in Section 4.e of the | |||
provided without warranty as described in the Revised BSD License. | Trust Legal Provisions and are provided without warranty as described | |||
in the Revised BSD License. | ||||
Table of Contents | Table of Contents | |||
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 | 1. Introduction | |||
1.1. Notational conventions . . . . . . . . . . . . . . . . . 3 | 1.1. Notational Conventions | |||
1.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3 | 1.2. Terminology | |||
2. Addition to the capabilities object . . . . . . . . . . . . . 3 | 2. Addition to the Capabilities Object | |||
2.1. urn:ietf:params:jmap:quota . . . . . . . . . . . . . . . 3 | 2.1. urn:ietf:params:jmap:quota | |||
3. Sub-types of the Quota data type . . . . . . . . . . . . . . 3 | 3. Sub-types of the Quota Data Type | |||
3.1. Scope . . . . . . . . . . . . . . . . . . . . . . . . . . 3 | 3.1. Scope | |||
3.2. ResourceType . . . . . . . . . . . . . . . . . . . . . . 4 | 3.2. ResourceType | |||
4. Quota . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 | 4. Quota | |||
4.1. Properties of the quota object . . . . . . . . . . . . . 4 | 4.1. Properties of the Quota Object | |||
4.2. Quota/get . . . . . . . . . . . . . . . . . . . . . . . . 6 | 4.2. Quota/get | |||
4.3. Quota/changes . . . . . . . . . . . . . . . . . . . . . . 6 | 4.3. Quota/changes | |||
4.4. Quota/query . . . . . . . . . . . . . . . . . . . . . . . 6 | 4.4. Quota/query | |||
4.5. Quota/queryChanges . . . . . . . . . . . . . . . . . . . 7 | 4.5. Quota/queryChanges | |||
5. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . 7 | 5. Examples | |||
5.1. Fetching quotas . . . . . . . . . . . . . . . . . . . . . 7 | 5.1. Fetching Quotas | |||
5.2. Requesting latest quota changes . . . . . . . . . . . . . 8 | 5.2. Requesting Latest Quota Changes | |||
6. Push . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 | 6. Push | |||
7. Security considerations . . . . . . . . . . . . . . . . . . . 9 | 7. IANA Considerations | |||
8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 10 | 7.1. JMAP Capability Registration for "quota" | |||
8.1. JMAP Capability Registration for "quota" . . . . . . . . 10 | 7.2. JMAP Data Type Registration for "Quota" | |||
8.2. JMAP Datatype Registration for "Quota" . . . . . . . . . 10 | 8. Security Considerations | |||
9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 10 | 9. Normative References | |||
10. Normative References . . . . . . . . . . . . . . . . . . . . 11 | Acknowledgements | |||
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 11 | Author's Address | |||
1. Introduction | 1. Introduction | |||
JMAP ([RFC8620] – (U+2013) JSON Meta Application Protocol) is a | The JSON Meta Application Protocol (JMAP) [RFC8620] is a generic | |||
generic protocol for synchronising data, such as mails, calendars or | protocol for synchronizing data, such as mails, calendars, or | |||
contacts, between a client and a server. It is optimised for mobile | contacts between a client and a server. It is optimized for mobile | |||
and web environments, and aims to provide a consistent interface to | and web environments and aims to provide a consistent interface to | |||
different data types. | different data types. | |||
This specification defines a data model for handling quotas over | This specification defines a data model for handling quotas over | |||
JMAP, allowing a user to obtain details about a certain quota. | JMAP, allowing a user to obtain details about a certain quota. | |||
This specification does not address quota administration, which | This specification does not address quota administration, which | |||
should be handled by other means. | should be handled by other means. | |||
1.1. Notational conventions | 1.1. Notational Conventions | |||
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", | The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", | |||
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and | "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and | |||
"OPTIONAL" in this document are to be interpreted as described in BCP | "OPTIONAL" in this document are to be interpreted as described in | |||
14 [RFC2119] [RFC8174] when, and only when, they appear in all | BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all | |||
capitals, as shown here. | capitals, as shown here. | |||
Type signatures, examples and property descriptions in this document | Type signatures, examples, and property descriptions in this document | |||
follow the conventions established in section 1.1 of [RFC8620]. Data | follow the conventions established in Section 1.1 of [RFC8620]. Data | |||
types defined in the core specification are also used in this | types defined in the core specification are also used in this | |||
document. | document. | |||
1.2. Terminology | 1.2. Terminology | |||
This document reuses the terminology from the core JMAP specification | This document reuses the terminology from the core JMAP specification | |||
established in section 1.6 of [RFC8620]. | established in Section 1.6 of [RFC8620]. | |||
The term Quota (when capitalized) is used to refer to the data type | The term "Quota" (when capitalized) is used to refer to the data type | |||
defined in this document in Section 4 and instance of that data type. | defined in Section 4 and instance of that data type. | |||
2. Addition to the capabilities object | 2. Addition to the Capabilities Object | |||
The capabilities object is returned as part of the JMAP Session | The capabilities object is returned as part of the JMAP Session | |||
object; see [RFC8620], section 2. | object; see [RFC8620], Section 2. | |||
This document defines one additional capability URI. | This document defines one additional capability URI. | |||
2.1. urn:ietf:params:jmap:quota | 2.1. urn:ietf:params:jmap:quota | |||
This represents support for the Quota data type and associated API | This represents support for the Quota data type and associated API | |||
methods. Servers supporting this specification MUST add a property | methods. Servers supporting this specification MUST add a property | |||
called urn:ietf:params:jmap:quota to the capabilities object. | called "urn:ietf:params:jmap:quota" to the capabilities object. | |||
The value of this property is an empty object in both the JMAP | The value of this property is an empty object in both the JMAP | |||
session capabilities property and an account's accountCapabilities | Session capabilities property and an account's accountCapabilities | |||
property. | property. | |||
3. Sub-types of the Quota data type | 3. Sub-types of the Quota Data Type | |||
There are two fields within the Quota datatype which have an | There are two fields within the Quota data type, which have an | |||
enumerated set of possible values. These are: | enumerated set of possible values. These are: | |||
3.1. Scope | 3.1. Scope | |||
The *Scope* data type is used to represent the entities the Quota | The Scope data type is used to represent the entities the quota | |||
applies to. It is defined as a "String" with values from the | applies to. It is defined as a "String" with values from the | |||
following set: | following set: | |||
* account: The Quota information applies to just the client's | * account: The quota information applies to just the client's | |||
account | account. | |||
* domain: The Quota information applies to all accounts sharing this | ||||
domain | * domain: The quota information applies to all accounts sharing this | |||
* global: The Quota information applies to all accounts belonging to | domain. | |||
the server | ||||
* global: The quota information applies to all accounts belonging to | ||||
the server. | ||||
3.2. ResourceType | 3.2. ResourceType | |||
The *ResourceType* data type is used to act as a unit of measure for | The ResourceType data type is used to act as a unit of measure for | |||
the quota usage. It is defined as a "String" with values from the | the quota usage. It is defined as a "String" with values from the | |||
following set: | following set: | |||
* count: The quota is measured in number of data type objects. For | * count: The quota is measured in a number of data type objects. | |||
example, a quota can have a limit of 50 "Mail" objects. | For example, a quota can have a limit of 50 "Mail" objects. | |||
* octets: The quota is measured in size (in "octets"). For example, | ||||
a quota can have a limit of 25000 "octets". | * octets: The quota is measured in size (in octets). For example, a | |||
quota can have a limit of 25000 octets. | ||||
4. Quota | 4. Quota | |||
The quota is an object that displays the limit set to an account | The Quota is an object that displays the limit set to an account | |||
usage. It then shows as well the current usage in regard to that | usage. It then shows as well the current usage in regard to that | |||
limit. | limit. | |||
4.1. Properties of the quota object | 4.1. Properties of the Quota Object | |||
The quota object MUST contain the following fields: | The Quota object MUST contain the following fields: | |||
* id: "Id" | * id: Id | |||
The unique identifier for this object. | The unique identifier for this object. | |||
* resourceType: "String" | * resourceType: String | |||
The resource type of the quota as defined in Section 3.2. | The resource type of the quota as defined in Section 3.2. | |||
* used: "UnsignedInt" | * used: UnsignedInt | |||
The current usage of the defined quota, using the "resourceType" | The current usage of the defined quota, using the "resourceType" | |||
defined as unit of measure. Computation of this value is handled | defined as unit of measure. Computation of this value is handled | |||
by the server. | by the server. | |||
* hardLimit: "UnsignedInt" | * hardLimit: UnsignedInt | |||
The hard limit set by this quota, using the "resourceType" defined | The hard limit set by this quota, using the "resourceType" defined | |||
as unit of measure. Objects in scope may not be created or | as unit of measure. Objects in scope may not be created or | |||
updated if this limit is reached. | updated if this limit is reached. | |||
* scope: "String" | * scope: String | |||
The "Scope" of this quota as defined in Section 3.1. | The "Scope" of this quota as defined in Section 3.1. | |||
* name: "String" | * name: String | |||
The name of the quota object. Useful for managing quotas and | The name of the quota. Useful for managing quotas and using | |||
using queries for searching. | queries for searching. | |||
* types: "String[]" | * types: String[] | |||
A list of all the type names as defined in the "JMAP Types Names" | A list of all the type names as defined in the "JMAP Types Names" | |||
registry (e.g., Email, Calendar, etc.) to which this quota | registry (e.g., Email, Calendar, etc.) to which this quota | |||
applies. This allows to assign quotas to distinct or shared data | applies. This allows the quotas to be assigned to distinct or | |||
types. | shared data types. | |||
The server MUST filter out any types for which the client did not | The server MUST filter out any types for which the client did not | |||
request the associated capability in the "using" section of the | request the associated capability in the "using" section of the | |||
request. Further, the server MUST NOT return Quota objects for | request. Further, the server MUST NOT return Quota objects for | |||
which there are no types recognised by the client. | which there are no types recognized by the client. | |||
The quota object MAY contain the following fields: | The Quota object MAY contain the following fields: | |||
* warnLimit: "UnsignedInt|null" | * warnLimit: UnsignedInt|null | |||
The warn limit set by this quota object, using the "resourceType" | The warn limit set by this quota, using the "resourceType" defined | |||
defined as unit of measure. It can be used to send a warning to | as unit of measure. It can be used to send a warning to an entity | |||
an entity about to reach the hard limit soon, but with no action | about to reach the hard limit soon, but with no action taken yet. | |||
taken yet. If set, it SHOULD be lower than the "softLimit" (if | If set, it SHOULD be lower than the "softLimit" (if present and | |||
present and different from null) and the "hardLimit". | different from null) and the "hardLimit". | |||
* softLimit: "UnsignedInt|null" | * softLimit: UnsignedInt|null | |||
The soft limit set by this quota object, using the "resourceType" | The soft limit set by this quota, using the "resourceType" defined | |||
defined as unit of measure. It can be used to still allow some | as unit of measure. It can be used to still allow some operations | |||
operations, but refuse some others. What is allowed or not is up | but refuse some others. What is allowed or not is up to the | |||
to the server. For example, it could be used for blocking | server. For example, it could be used for blocking outgoing | |||
outgoing events of an entity (sending emails, creating calendar | events of an entity (sending emails, creating calendar events, | |||
events, ...) while still receiving incoming events (receiving | etc.) while still receiving incoming events (receiving emails, | |||
emails, receiving calendars events, ...). If set, it SHOULD be | receiving calendars events, etc.). If set, it SHOULD be higher | |||
higher than the "warnLimit" (if present and different from null) | than the "warnLimit" (if present and different from null) but | |||
but lower than the "hardLimit". | lower than the "hardLimit". | |||
* description: "String|null" | * description: String|null | |||
Arbitrary free, human-readable, description of this quota. It | Arbitrary, free, human-readable description of this quota. It | |||
might be used to explain where the different limits come from and | might be used to explain where the different limits come from and | |||
explain the entities and data types this quota applies to. The | explain the entities and data types this quota applies to. The | |||
description MUST be encoded in UTF-8 [RFC3629] as described in | description MUST be encoded in UTF-8 [RFC3629] as described in | |||
[RFC8620] section 1.5, selected based on an Accept-Language header | [RFC8620], Section 1.5, and selected based on an Accept-Language | |||
in the request (as defined in [RFC9110], Section 12.5.4) or out- | header in the request (as defined in [RFC9110], Section 12.5.4) or | |||
of-band information about the user's language/locale. | out-of-band information about the user's language or locale. | |||
The following JMAP methods are supported. | The following JMAP methods are supported. | |||
4.2. Quota/get | 4.2. Quota/get | |||
Standard "/get" method as described in [RFC8620] section 5.1. The | Standard "/get" method as described in [RFC8620], Section 5.1. The | |||
_ids_ argument may be "null" to fetch all Quotas of the account at | _id_'s argument may be "null" to fetch all quotas of the account at | |||
once, as demonstrated in this document in Section 5.1. | once, as demonstrated in Section 5.1. | |||
4.3. Quota/changes | 4.3. Quota/changes | |||
Standard "/changes" method as described in [RFC8620] section 5.2 but | Standard "/changes" method as described in [RFC8620], Section 5.2, | |||
with one extra argument in the response: | but with one extra argument in the response: | |||
* updatedProperties: "String[]|null" | * updatedProperties: String[]|null | |||
If only the "used" Quota property has changed since the old state, | If only the "used" Quota property has changed since the old state, | |||
this will be a list containing only that property. If the server | this will be a list containing only that property. If the server | |||
is unable to tell if only "used" has changed, it MUST be null. | is unable to tell if only "used" has changed, it MUST be null. | |||
Since "used" frequently changes but other properties are generally | Since "used" frequently changes, but other properties are generally | |||
only changed rarely, the server can help the client optimise data | only changed rarely, the server can help the client optimize data | |||
transfer by keeping track of changes to Quota usage separate from | transfer by keeping track of changes to quota usage separate from | |||
other state changes. The updatedProperties array may be used | other state changes. The updatedProperties array may be used | |||
directly via a back-reference in a subsequent Quota/get call in the | directly via a back-reference in a subsequent Quota/get call in the | |||
same request, so only these properties are returned if nothing else | same request, so only these properties are returned if nothing else | |||
has changed. | has changed. | |||
Servers MAY decide to add other properties to the list that they | Servers MAY decide to add other properties to the list that they | |||
judge to be changing frequently. | judge to be changing frequently. | |||
This method's usage is demonstrated in this document at Section 5.2. | This method's usage is demonstrated in Section 5.2. | |||
4.4. Quota/query | 4.4. Quota/query | |||
This is a standard "/query" method as described in [RFC8620], | This is a standard "/query" method as described in [RFC8620], | |||
Section 5.5. | Section 5.5. | |||
A *FilterCondition* object has the following properties, any of which | A FilterCondition object has the following properties, any of which | |||
may be included or omitted: | may be included or omitted: | |||
* name: "String" | * name: String | |||
The Quota _name_ property contains the given string. | The Quota _name_ property contains the given string. | |||
* scope: "String" | * scope: String | |||
The Quota _scope_ property must match the given value exactly. | The Quota _scope_ property must match the given value exactly. | |||
* resourceType: "String" | * resourceType: String | |||
The Quota _resourceType_ property must match the given value | The Quota _resourceType_ property must match the given value | |||
exactly. | exactly. | |||
* type: "String" | * type: String | |||
The Quota _types_ property contains the given value. | The Quota _types_ property contains the given value. | |||
A Quota object matches the FilterCondition if and only if all the | A Quota object matches the FilterCondition if, and only if, all the | |||
given conditions match. If zero properties are specified, it is | given conditions match. If zero properties are specified, it is | |||
automatically true for all objects. | automatically true for all objects. | |||
The following Quota properties MUST be supported for sorting: | The following Quota properties MUST be supported for sorting: | |||
* name | * name | |||
* used | * used | |||
4.5. Quota/queryChanges | 4.5. Quota/queryChanges | |||
This is a standard "/queryChanges" method as described in [RFC8620], | This is a standard "/queryChanges" method as described in [RFC8620], | |||
Section 5.6. | Section 5.6. | |||
5. Examples | 5. Examples | |||
5.1. Fetching quotas | 5.1. Fetching Quotas | |||
Request fetching all quotas related to an account : | Request fetching all quotas related to an account: | |||
[[ "Quota/get", { | [[ "Quota/get", { | |||
"accountId": "u33084183", | "accountId": "u33084183", | |||
"ids": null | "ids": null | |||
}, "0" ]] | }, "0" ]] | |||
With response : | With response: | |||
[[ "Quota/get", { | [[ "Quota/get", { | |||
"accountId": "u33084183", | "accountId": "u33084183", | |||
"state": "78540", | "state": "78540", | |||
"list": [{ | "list": [{ | |||
"id": "2a06df0d-9865-4e74-a92f-74dcc814270e", | "id": "2a06df0d-9865-4e74-a92f-74dcc814270e", | |||
"resourceType": "count", | "resourceType": "count", | |||
"used": 1056, | "used": 1056, | |||
"warnLimit": 1600, | "warnLimit": 1600, | |||
"softLimit": 1800, | "softLimit": 1800, | |||
"hardLimit": 2000, | "hardLimit": 2000, | |||
"scope": "account", | "scope": "account", | |||
"name": "bob@example.com", | "name": "bob@example.com", | |||
"description": "Personal account usage. When the soft limit is reached, the user is not allowed to send mails or create contacts and calendar events anymore.", | "description": "Personal account usage. When the soft limit is | |||
"types" : [ "Mail", "Calendar", "Contact" ] | reached, the user is not allowed to send mails or | |||
}, { | create contacts and calendar events anymore.", | |||
"id": "3b06df0e-3761-4s74-a92f-74dcc963501x", | "types" : [ "Mail", "Calendar", "Contact" ] | |||
"resourceType": "octets", | }, { | |||
... | "id": "3b06df0e-3761-4s74-a92f-74dcc963501x", | |||
}, ...], | "resourceType": "octets", | |||
"notFound": [] | ... | |||
}, "0" ]] | }, ...], | |||
"notFound": [] | ||||
}, "0" ]] | ||||
5.2. Requesting latest quota changes | 5.2. Requesting Latest Quota Changes | |||
Request fetching the changes for a specific quota: | Request fetching the changes for a specific quota: | |||
[[ "Quota/changes", { | [[ "Quota/changes", { | |||
"accountId": "u33084183", | "accountId": "u33084183", | |||
"sinceState": "78540", | "sinceState": "78540", | |||
"maxChanges": 20 | "maxChanges": 20 | |||
}, "0" ], | }, "0" ], | |||
[ "Quota/get", { | [ "Quota/get", { | |||
"accountId": "u33084183", | "accountId": "u33084183", | |||
skipping to change at page 9, line 28 ¶ | skipping to change at line 395 ¶ | |||
"list": [{ | "list": [{ | |||
"id": "2a06df0d-9865-4e74-a92f-74dcc814270e", | "id": "2a06df0d-9865-4e74-a92f-74dcc814270e", | |||
"used": 1246 | "used": 1246 | |||
}], | }], | |||
"notFound": [] | "notFound": [] | |||
}, "1" ]] | }, "1" ]] | |||
6. Push | 6. Push | |||
Servers MUST support the JMAP push mechanisms, as specified in | Servers MUST support the JMAP push mechanisms, as specified in | |||
[RFC8620] Section 7, to allow clients to receive notifications when | [RFC8620], Section 7, to allow clients to receive notifications when | |||
the state changes for the Quota type defined in this specification. | the state changes for the Quota type defined in this specification. | |||
7. Security considerations | 7. IANA Considerations | |||
All security considerations of JMAP ([RFC8620]) apply to this | 7.1. JMAP Capability Registration for "quota" | |||
IANA has registered the "quota" JMAP Capability as follows: | ||||
Capability Name: urn:ietf:params:jmap:quota | ||||
Reference: RFC 9425 | ||||
Intended Use: common | ||||
Change Controller: IETF | ||||
Security and Privacy Considerations: RFC 9425, Section 8 | ||||
7.2. JMAP Data Type Registration for "Quota" | ||||
IANA has registered the "Quota" Data Type as follows: | ||||
Type Name: Quota | ||||
Can Reference Blobs: No | ||||
Can Use for State Change: Yes | ||||
Capability: urn:ietf:params:jmap:quota | ||||
Reference: RFC 9425 | ||||
8. Security Considerations | ||||
All security considerations of JMAP [RFC8620] apply to this | ||||
specification. | specification. | |||
Implementors should be careful to make sure the implementation of the | Implementors should be careful to make sure the implementation of the | |||
extension specified in this document does not violate the site's | extension specified in this document does not violate the site's | |||
security policy. The resource usage of other users is likely to be | security policy. The resource usage of other users is likely to be | |||
considered confidential information and should not be divulged to | considered confidential information and should not be divulged to | |||
unauthorized persons. | unauthorized persons. | |||
As for any resource shared across users (for example, a quota with | As for any resource shared across users (for example, a quota with | |||
the "domain" or "global" scope), a user that can consume the resource | the "domain" or "global" scope), a user that can consume the resource | |||
can affect the resources available to the other users. For example, | can affect the resources available to the other users. For example, | |||
a user could spam themselves with events and make the shared resource | a user could spam themselves with events and make the shared resource | |||
hit the limit and unusable for others (implementors could mitigate | hit the limit and unusable for others (implementors could mitigate | |||
that with some rate limiting implementation on the server). | that with some rate-limiting implementation on the server). | |||
Also, revealing domain and global quota counts to all users may cause | Also, revealing domain and global quota counts to all users may cause | |||
privacy leakage of other sensitive data, or at least the existence of | privacy leakage of other sensitive data, or at least the existence of | |||
other sensitive data. For example, some users are part of a private | other sensitive data. For example, some users are part of a private | |||
list belonging to the server, so they shouldn't know how many users | list belonging to the server, so they shouldn't know how many users | |||
are in there. But by comparing the quota count before and after | are in there. However, by comparing the quota count before and after | |||
sending a message to the list, it could reveal the number of people | sending a message to the list, it could reveal the number of people | |||
of the list, as the domain or global quota count would go up by the | of the list, as the domain or global quota count would go up by the | |||
number of people subscribed. In order to limit those attacks, quotas | number of people subscribed. In order to limit those attacks, quotas | |||
with "domain" or "global" scope SHOULD only be visible to server | with "domain" or "global" scope SHOULD only be visible to server | |||
administrators and not to general users. | administrators and not to general users. | |||
8. IANA Considerations | 9. Normative References | |||
8.1. JMAP Capability Registration for "quota" | ||||
IANA will register the "quota" JMAP Capability as follows: | ||||
Capability Name: "urn:ietf:params:jmap:quota" | ||||
Specification document: this document | ||||
Intended use: common | ||||
Change Controller: IETF | ||||
Security and privacy considerations: this document, Section 7. | ||||
8.2. JMAP Datatype Registration for "Quota" | ||||
IANA will register the "Quota" Data Type as folows: | ||||
Type Name: "Quota" | ||||
Can reference blobs: No | ||||
Can use for state change: Yes | ||||
Capability: "urn:ietf:params:jmap:quota" | ||||
Reference: this document | ||||
9. Acknowledgements | ||||
Thank you to Michael Bailly, that co-wrote the first draft version of | ||||
this document, before deciding to turn to other matters. | ||||
Thank you to Benoit Tellier for his constant help and support on | ||||
writing this document. | ||||
Thank you to Raphael Ouazana for sharing his own experience on how to | ||||
write a RFC after finalizing his own document, the [RFC9007]. | ||||
Thank you to Bron Gondwana, Neil Jenkins, Alexei Melnikov, Joris Baum | ||||
and the people from the IETF JMAP working group in general that | ||||
helped with extensive discussions, reviews and feedbacks. | ||||
Thank you to the people in the IETF organization that took the time | ||||
to read, understand, comment and give great feedbacks in the last | ||||
rounds. | ||||
10. Normative References | ||||
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate | [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate | |||
Requirement Levels", BCP 14, RFC 2119, | Requirement Levels", BCP 14, RFC 2119, | |||
DOI 10.17487/RFC2119, March 1997, | DOI 10.17487/RFC2119, March 1997, | |||
<https://www.rfc-editor.org/info/rfc2119>. | <https://www.rfc-editor.org/info/rfc2119>. | |||
[RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO | [RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO | |||
10646", STD 63, RFC 3629, DOI 10.17487/RFC3629, November | 10646", STD 63, RFC 3629, DOI 10.17487/RFC3629, November | |||
2003, <https://www.rfc-editor.org/info/rfc3629>. | 2003, <https://www.rfc-editor.org/info/rfc3629>. | |||
skipping to change at page 11, line 42 ¶ | skipping to change at line 486 ¶ | |||
[RFC9007] Ouazana, R., Ed., "Handling Message Disposition | [RFC9007] Ouazana, R., Ed., "Handling Message Disposition | |||
Notification with the JSON Meta Application Protocol | Notification with the JSON Meta Application Protocol | |||
(JMAP)", RFC 9007, DOI 10.17487/RFC9007, March 2021, | (JMAP)", RFC 9007, DOI 10.17487/RFC9007, March 2021, | |||
<https://www.rfc-editor.org/info/rfc9007>. | <https://www.rfc-editor.org/info/rfc9007>. | |||
[RFC9110] Fielding, R., Ed., Nottingham, M., Ed., and J. Reschke, | [RFC9110] Fielding, R., Ed., Nottingham, M., Ed., and J. Reschke, | |||
Ed., "HTTP Semantics", STD 97, RFC 9110, | Ed., "HTTP Semantics", STD 97, RFC 9110, | |||
DOI 10.17487/RFC9110, June 2022, | DOI 10.17487/RFC9110, June 2022, | |||
<https://www.rfc-editor.org/info/rfc9110>. | <https://www.rfc-editor.org/info/rfc9110>. | |||
Acknowledgements | ||||
Thank you to Michael Bailly, who co-wrote the first draft version of | ||||
this document, before deciding to turn to other matters. | ||||
Thank you to Benoit Tellier for his constant help and support on | ||||
writing this document. | ||||
Thank you to Raphael Ouazana for sharing his own experience on how to | ||||
write an RFC after finalizing his own document: [RFC9007]. | ||||
Thank you to Bron Gondwana, Neil Jenkins, Alexey Melnikov, Joris | ||||
Baum, and the people from the IETF JMAP working group in general, who | ||||
helped with extensive discussions, reviews, and feedback. | ||||
Thank you to the people in the IETF organization, who took the time | ||||
to read, understand, comment, and give great feedback in the last | ||||
rounds. | ||||
Author's Address | Author's Address | |||
René Cordier (editor) | René Cordier (editor) | |||
Linagora Vietnam | Linagora Vietnam | |||
5 Dien Bien Phu | 5 Dien Bien Phu | |||
Hanoi | Hanoi | |||
10000 | 10000 | |||
Vietnam | Vietnam | |||
Email: rcordier@linagora.com | Email: rcordier@linagora.com | |||
URI: https://linagora.vn | URI: https://linagora.vn | |||
End of changes. 68 change blocks. | ||||
213 lines changed or deleted | 216 lines changed or added | |||
This html diff was produced by rfcdiff 1.48. |