This means we can only execute this command from where we also have imap admin access, but that's ok I suppose.

Use boxwarning

Boolean broken state with the rest in extraData

In D5436#70779, @machniak wrote:

We should make this new code consistent with kolab_sync_storage_kolab4::folders_list(). You can find there how we handle special folders type. kolab_storage::folders_typedata() should not be used.

In D5445#70752, @machniak wrote:

I don't see how you unset the "broken" state. You said that when you reset Outlook according to your manual it will use the same device identifier. How it will unlock itself then? A test would be nice.

This is how outlook looks once we block the device (as you can see it enters "Disconnected/Getrennt" state).

Separate kolab4 implementation

Handle blocking of devices via config option

Clearly with room for improvement, but this gets the job done.
I'm open to some easy to implement suggestions, as I'm not very familiar with registering new forms (which is why I'm hijacking the subscriptions list).

My plan is to deploy this, review which devices get marked as broken, and only then start failing requests early.

mysql.initial version

Basically the same as we do for FolderSync, but useful for loops that don't report changes on FolderSync (and thus get no counting), or for loops that don't include FolderSync at all.

Seems to work for the delegation case.

Return a 503 and sleep, because the 503 doesn't actually seem to stop the client.

If we assume 1 request per device per second and an average execution time of 1s, then we'd reduce our capacity by ~11 by making all requests take 11s, because all processing slots in php-fpm will be occupied.
So while this should work well for protecting e.g. imap from getting overloaded, we may introduce another bottleneck....

Ensure we match servids and not parent ids.

Initial log message as info, cleanup of the counterNext situation

Looks like it's at least the same logic as before.

This will turn a read-only operation into an UPDATE query, and the getting the abstraction lasagna to execute the update query is fairly messy, but I suppose it's still worth it unless there's a better approach.

Makes it a lot easier to see what's happening.

Merge the two config options

In D5406#70107, @machniak wrote:

We already have $config['activesync_force_subscriptions'] in the kolab_activesync plugin. It would make sense to de-duplicate.

My outlook is in a state where enabling the Calendar will break FolderSync because of the Add, but disabling the Calendar will result in a sync loop via Ping because the Calendar is not available.

I think a problem with this will be that if you have an existing outlook, but the Calendar has been disabled on the server, then enabling it will trigger an "Add" for the Calendar, which Outlook doesn't like, so I'm not sure how to reconcile that.
Perhaps we need to suppress the Add for folders that are supposed to be always enabled.

Tested via test in syncroton repository where I nuke all subscriptions and make sure we still get the expected default folders in FolderSync.

A more generic solution might be that the client can simply list the thing's it wants. which would be 'id' in this case (I suppose having the access_token implicit makes sense?).

I think at some point we should come up with a generic solution for more granular logging, but this will work for now.