1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
#!/usr/bin/env bash

# Inspects a Fastmail JMAP session: session-level capabilities, each
# account's isReadOnly and accountCapabilities, and myRights on every
# mailbox. Answers how a token's scopes surface in the session
# (read-only spike). The token comes from 1Password: pass either a full
# secret reference (op://vault/item/field) or a bare item id, whose
# credential-purpose field is used.

set -euo pipefail
if [[ "${TRACE-0}" == "1" ]]; then
    set -o xtrace
fi

readonly SESSION_URL="https://api.fastmail.com/jmap/session"

token_from_1password() {
    local ref="$1"
    if [[ "$ref" == op://* ]]; then
        op read "$ref"
    else
        op item get "$ref" --format json --reveal |
            jq --raw-output '
                [.fields[]]
                | (map(select(.purpose == "PASSWORD")) | .[0])
                  // (map(select((.label // .id) == "credential")) | .[0])
                  // (map(select(.type == "CONCEALED")) | .[0])
                | .value // empty'
    fi
}

fetch() {
    curl --silent --show-error --fail-with-body \
        --header "Authorization: Bearer ${1}" \
        "${@:2}"
}

main() {
    if [[ $# -ne 1 ]]; then
        echo "usage: $0 <op-secret-reference | 1password-item-id>" >&2
        exit 2
    fi

    local token
    token=$(token_from_1password "$1")
    if [[ -z "$token" ]]; then
        echo "no credential-purpose field found in 1Password item" >&2
        exit 1
    fi

    local session api_url
    session=$(fetch "$token" "$SESSION_URL")
    api_url=$(jq --raw-output '.apiUrl' <<<"$session")

    jq '{
        sessionCapabilities: (.capabilities | keys),
        primaryAccounts,
        accounts: (.accounts | to_entries | map({
            id: .key,
            name: .value.name,
            isPersonal: .value.isPersonal,
            isReadOnly: .value.isReadOnly,
            accountCapabilities: (.value.accountCapabilities | keys)
        }))
    }' <<<"$session"

    jq --raw-output '.accounts | keys[]' <<<"$session" |
        while IFS= read -r account_id; do
            echo "mailboxes for ${account_id}:"
            fetch "$token" \
                --header 'Content-Type: application/json' \
                --data "$(jq --null-input --arg account_id "$account_id" '{
                    using: ["urn:ietf:params:jmap:core", "urn:ietf:params:jmap:mail"],
                    methodCalls: [[
                        "Mailbox/get",
                        {accountId: $account_id, ids: null,
                         properties: ["id", "name", "role", "myRights"]},
                        "0"
                    ]]
                }')" \
                "$api_url" |
                jq 'if type == "object" and has("methodResponses")
                    then .methodResponses[0][1].list | map({name, role, myRights})
                    else . end'
        done
}

main "$@"