feat(aliases): add admin setting to disable alias creation

appinfo/routes.php

@@ -345,6 +345,11 @@
 			'url' => '/api/settings/allownewaccounts',
 			'verb' => 'POST'
 		],
+		[
+			'name' => 'settings#setAllowNewMailAliases',
+			'url' => '/api/settings/allownewaliases',
+			'verb' => 'POST'
+		],
 		[
 			'name' => 'settings#setEnabledLlmProcessing',
 			'url' => '/api/settings/llm',

lib/Controller/PageController.php

@@ -304,6 +304,11 @@ public function index(): TemplateResponse {
 			$this->config->getAppValue('mail', 'allow_new_mail_accounts', 'yes') === 'yes'
 		);
 
+		$this->initialStateService->provideInitialState(
+			'allow-new-aliases',
+			$this->config->getAppValue('mail', 'allow_new_mail_aliases', 'yes') === 'yes'
+		);
+
 		$this->initialStateService->provideInitialState(
 			'llm_summaries_available',
 			$this->aiIntegrationsService->isLlmProcessingEnabled() && $this->aiIntegrationsService->isLlmAvailable(SummaryTaskType::class)

lib/Controller/SettingsController.php

@@ -114,6 +114,11 @@ public function setAllowNewMailAccounts(bool $allowed): void {
 		$this->config->setAppValue('mail', 'allow_new_mail_accounts', $allowed ? 'yes' : 'no');
 	}
 
+	public function setAllowNewMailAliases(bool $allowed): JSONResponse {
+		$this->config->setAppValue('mail', 'allow_new_mail_aliases', $allowed ? 'yes' : 'no');
+		return new JSONResponse([]);
+	}
+
 	public function setEnabledLlmProcessing(bool $enabled): JSONResponse {
 		$this->config->setAppValue('mail', 'llm_processing', $enabled ? 'yes' : 'no');
 		return new JSONResponse([]);

lib/Service/AliasesService.php

@@ -15,17 +15,21 @@
 use OCA\Mail\Db\MailAccountMapper;
 use OCA\Mail\Exception\ClientException;
 use OCP\AppFramework\Db\DoesNotExistException;
+use OCP\IConfig;
 
 class AliasesService {
 	/** @var AliasMapper */
 	private $aliasMapper;
 
 	/** @var MailAccountMapper */
 	private $mailAccountMapper;
+	/** @var IConfig */
+	private $config;
 
-	public function __construct(AliasMapper $aliasMapper, MailAccountMapper $mailAccountMapper) {
+	public function __construct(AliasMapper $aliasMapper, MailAccountMapper $mailAccountMapper, IConfig $config) {
 		$this->aliasMapper = $aliasMapper;
 		$this->mailAccountMapper = $mailAccountMapper;
+		$this->config = $config;
 	}
 
 	/**
@@ -67,6 +71,10 @@ public function findByAliasAndUserId(string $aliasEmail, string $userId): Alias
 	 * @throws DoesNotExistException
 	 */
 	public function create(string $userId, int $accountId, string $alias, string $aliasName): Alias {
+		if ($this->config->getAppValue('mail', 'allow_new_mail_aliases', 'yes') === 'no') {
+			throw new ClientException('Creating aliases has been disabled by the administrator.');
+		}
+
 		$this->mailAccountMapper->find($userId, $accountId);
 
 		$aliasEntity = new Alias();

lib/Settings/AdminSettings.php

@@ -82,6 +82,12 @@ public function getForm() {
 			$this->config->getAppValue('mail', 'allow_new_mail_accounts', 'yes') === 'yes'
 		);
 
+		$this->initialStateService->provideInitialState(
+			Application::APP_ID,
+			'allow_new_mail_aliases',
+			$this->config->getAppValue('mail', 'allow_new_mail_aliases', 'yes') === 'yes'
+		);
+
 		$this->initialStateService->provideInitialState(
 			Application::APP_ID,
 			'layout_message_view',

src/components/AccountSettings.vue

@@ -11,7 +11,12 @@
 		:additional-trap-elements="trapElements"
 		:name="t('mail', 'Account settings')"
 		@update:open="updateOpen">
-		<AppSettingsSection
+		<AppSettingsSection v-if="showProviderAppPassword"
+			id="provider-app-password"
+			:name="t('mail', 'IMAP access / password')">
+			<ProviderAppPassword :account="account" :provider-id="account.managedByProvider" />
+		</AppSettingsSection>
+		<AppSettingsSection v-if="allowNewAliases"
 			id="alias-settings"
 			:name="t('mail', 'Aliases')">
 			<AliasSettings :account="account" @rename-primary-alias="scrollToAccountSettings" />
@@ -85,14 +90,14 @@
 			id="mail-filters"
 			:name="t('mail', 'Filters')">
 			<div id="mail-filters">
 				<MailFilters :key="account.accountId" ref="mailFilters" :account="account" />
 			</div>
 		</AppSettingsSection>
 		<AppSettingsSection
 			v-if="account"
 			id="quick-actions-settings"
 			:name="t('mail', 'Quick actions')">
 			<Settings :key="account.accountId" ref="quickActions" :account="account" />
 		</AppSettingsSection>
 		<AppSettingsSection
 			v-if="account && account.sieveEnabled"
@@ -101,7 +106,7 @@
 			<div id="sieve-filter">
 				<SieveFilterForm
 					:key="account.accountId"
 					ref="sieveFilterForm"
 					:account="account" />
 			</div>
 		</AppSettingsSection>
@@ -125,7 +130,7 @@
 			<div id="sieve-settings">
 				<SieveAccountForm
 					:key="account.accountId"
 					ref="sieveAccountForm"
 					:account="account" />
 			</div>
 		</AppSettingsSection>
@@ -208,11 +213,21 @@
 
 		email() {
 			return this.account.emailAddress
 		},
+		allowNewAliases() {
+			return this.mainStore.getPreference('allow-new-aliases', true)
+		},
+		showProviderAppPassword() {
+			// Show the password reset section if:
+			// 1. Account is managed by a provider (managedByProvider is set)
+			// 2. Provider supports app passwords
+			return this.account.managedByProvider
+				&& this.account.providerCapabilities?.appPasswords === true
+		},
 	},
 
 	watch: {
 		open(newState, oldState) {
 			if (newState === true && this.fetchActiveSieveScript === true) {
 				logger.debug(`Load active sieve script for account ${this.account.accountId}`)
 				this.fetchActiveSieveScript = false

src/components/AliasSettings.vue

@@ -53,7 +53,7 @@
 
 		<div v-if="!account.provisioningId" class="aliases-controls">
 			<ButtonVue
-				v-if="!showForm"
+				v-if="!showForm && allowNewAliases"
 				type="primary"
 				:aria-label="t('mail', 'Add alias')"
 				@click="showForm = true">
@@ -124,8 +124,10 @@
 		...mapStores(useMainStore),
 		aliases() {
 			return this.account.aliases
 		},
-
+		allowNewAliases() {
+			return this.mainStore.getPreference('allow-new-aliases', true)
+		},
 		accountAlias() {
 			return {
 				alias: this.account.emailAddress,

src/components/settings/AdminSettings.vue

@@ -136,6 +136,18 @@
 				</p>
 			</article>
 		</div>
+		<div class="app-description">
+			<h3>{{ t('mail', 'Allow aliases') }}</h3>
+			<article>
+				<p>
+					<NcCheckboxRadioSwitch :checked.sync="allowNewMailAliases"
+						type="switch"
+						@update:checked="updateAllowNewMailAliases">
+						{{ t('mail', 'Allow users to create mail aliases') }}
+					</NcCheckboxRadioSwitch>
+				</p>
+			</article>
+		</div>
 		<div
 			v-if="isLlmSummaryConfigured"
 			class="app-description">
@@ -300,6 +312,7 @@
 	setImportanceClassificationEnabledByDefault,
 	setLayoutMessageView,
 	updateAllowNewMailAccounts,
+	updateAllowNewMailAliases,
 	updateEnabledSmartReply,
 	updateLlmEnabled,
 	updateProvisioningSettings,
@@ -368,6 +381,7 @@
 			},
 
 			allowNewMailAccounts: loadState('mail', 'allow_new_mail_accounts', true),
+			allowNewMailAliases: loadState('mail', 'allow_new_mail_aliases', true),
 			isLlmSummaryConfigured: loadState('mail', 'enabled_llm_summary_backend'),
 			isLlmEnabled: loadState('mail', 'llm_processing', true),
 			isLlmFreePromptConfigured: loadState('mail', 'enabled_llm_free_prompt_backend'),
@@ -430,7 +444,10 @@
 
 		async updateAllowNewMailAccounts(checked) {
 			await updateAllowNewMailAccounts(checked)
 		},
+		async updateAllowNewMailAliases(checked) {
+			await updateAllowNewMailAliases(checked)
+		},
 
 		async updateLlmEnabled(checked) {
 			await updateLlmEnabled(checked)

src/init.js

@@ -69,6 +69,10 @@ export default function initAfterAppCreation() {
 		key: 'allow-new-accounts',
 		value: loadState('mail', 'allow-new-accounts', true),
 	})
+	mainStore.savePreferenceMutation({
+		key: 'allow-new-aliases',
+		value: loadState('mail', 'allow-new-aliases', true),
+	})
 	mainStore.savePreferenceMutation({
 		key: 'password-is-unavailable',
 		value: loadState('mail', 'password-is-unavailable', false),

src/service/SettingsService.js

@@ -61,6 +61,14 @@ export function updateAllowNewMailAccounts(allowed) {
 	return axios.post(url, data).then((resp) => resp.data)
 }
 
+export function updateAllowNewMailAliases(allowed) {
+	const url = generateUrl('/apps/mail/api/settings/allownewaliases')
+	const data = {
+		allowed,
+	}
+	return axios.post(url, data).then((resp) => resp.data)
+}
+
 export async function updateLlmEnabled(enabled) {
 	const url = generateUrl('/apps/mail/api/settings/llm')
 	const data = {

tests/Unit/Controller/AliasesControllerTest.php

@@ -18,6 +18,7 @@
 use OCP\AppFramework\Db\DoesNotExistException;
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\JSONResponse;
+use OCP\IConfig;
 
 class AliasesControllerTest extends TestCase {
 	private $controller;
@@ -46,8 +47,12 @@ public function setUp(): void {
 
 		$this->aliasMapper = $this->createMock(AliasMapper::class);
 		$this->mailAccountMapper = $this->createMock(MailAccountMapper::class);
+		$config = $this->createMock(IConfig::class);
+		$config->method('getAppValue')
+			->with('mail', 'allow_new_mail_aliases', 'yes')
+			->willReturn('yes');
 
-		$this->aliasService = new AliasesService($this->aliasMapper, $this->mailAccountMapper);
+		$this->aliasService = new AliasesService($this->aliasMapper, $this->mailAccountMapper, $config);
 		$this->controller = new AliasesController($this->appName, $this->request, $this->aliasService, $this->userId);
 	}
 

tests/Unit/Controller/PageControllerTest.php

@@ -269,7 +269,7 @@ public function testIndex(): void {
 				['version', '0.0.0', '26.0.0'],
 				['app.mail.attachment-size-limit', 0, 123],
 			]);
-		$this->config->expects($this->exactly(7))
+		$this->config->expects($this->exactly(8))
 			->method('getAppValue')
 			->withConsecutive(
 				[ 'mail', 'installed_version' ],
@@ -279,6 +279,7 @@ public function testIndex(): void {
 				['mail', 'microsoft_oauth_tenant_id' ],
 				['core', 'backgroundjobs_mode', 'ajax' ],
 				['mail', 'allow_new_mail_accounts', 'yes'],
+				['mail', 'allow_new_mail_aliases', 'yes'],
 			)->willReturnOnConsecutiveCalls(
 				$this->returnValue('1.2.3'),
 				$this->returnValue('threaded'),
@@ -287,7 +288,7 @@ public function testIndex(): void {
 				$this->returnValue(''),
 				$this->returnValue('cron'),
 				$this->returnValue('yes'),
-				$this->returnValue('no')
+				$this->returnValue('yes'),
 			);
 		$this->aiIntegrationsService->expects(self::exactly(4))
 			->method('isLlmProcessingEnabled')

tests/Unit/Service/AliasesServiceTest.php

@@ -14,6 +14,7 @@
 use OCA\Mail\Exception\ClientException;
 use OCA\Mail\Service\AliasesService;
 use OCP\AppFramework\Db\DoesNotExistException;
+use OCP\IConfig;
 
 class AliasesServiceTest extends TestCase {
 	/** @var AliasesService */
@@ -28,15 +29,24 @@ class AliasesServiceTest extends TestCase {
 	/** @var MailAccountMapper */
 	private $mailAccountMapper;
 
+	/** @var IConfig */
+	private $config;
+
 	protected function setUp(): void {
 		parent::setUp();
 
 		$this->aliasMapper = $this->createMock(AliasMapper::class);
 		$this->mailAccountMapper = $this->createMock(MailAccountMapper::class);
+		$this->config = $this->createMock(IConfig::class);
+
+		$this->config->method('getAppValue')
+			->with('mail', 'allow_new_mail_aliases', 'yes')
+			->willReturn('yes');
 
 		$this->service = new AliasesService(
 			$this->aliasMapper,
-			$this->mailAccountMapper
+			$this->mailAccountMapper,
+			$this->config,
 		);
 	}
 
@@ -123,6 +133,23 @@ public function testCreateForbiddenAccountId(): void {
 		);
 	}
 
+	public function testCreateDisabledByAdmin(): void {
+		$this->expectException(ClientException::class);
+		$this->expectExceptionMessage('Creating aliases has been disabled by the administrator.');
+
+		$this->config->expects(self::once())
+			->method('getAppValue')
+			->with('mail', 'allow_new_mail_aliases', 'yes')
+			->willReturn('no');
+
+		$this->mailAccountMapper->expects(self::never())
+			->method('find');
+		$this->aliasMapper->expects(self::never())
+			->method('insert');
+
+		$this->service->create(300, 200, 'jane@doe.com', 'Jane Doe');
+	}
+
 	public function testDelete(): void {
 		$entity = new Alias();
 		$entity->setId(101);

tests/Unit/Settings/AdminSettingsTest.php

@@ -37,7 +37,7 @@ public function testGetSection() {
 	}
 
 	public function testGetForm() {
-		$this->serviceMock->getParameter('initialStateService')->expects($this->exactly(14))
+		$this->serviceMock->getParameter('initialStateService')->expects($this->exactly(15))
 			->method('provideInitialState')
 			->withConsecutive(
 				[
@@ -55,6 +55,11 @@ public function testGetForm() {
 					'allow_new_mail_accounts',
 					$this->anything()
 				],
+				[
+					Application::APP_ID,
+					'allow_new_mail_aliases',
+					$this->anything()
+				],
 				[
 					Application::APP_ID,
 					'layout_message_view',