I guess, separately we should make sure user does not do something stupid when the form is submitted. I.e. he can still manually set mail.inbox to any subfolder. But that's a separate issue.

• Remove wrong TODO comments

Using ->withoutMiddleware(['allowedHosts']) would be shorter, but I'm not sure which I'd prefer here.

https://git.kolab.org/D5553

• Hide Wallet and Policy in the Dashboard for wallet controllers that aren't owners

• Enable wallet controllers to create users
• Enable wallet controllers to create shared folders
• Enable wallet controllers to create groups
• Enable wallet controllers to create domains
• Make wallet controllers able to create resources

In D5517#72273, @machniak wrote:

This is kinda mess. Maybe a better approach would be to just check that the request comes from the "internal" location? E.g. by having list of IP networks (or IPs). But that potentially may be more complicated. Another possibility, a "client secret", but this probably would be event more problematic.

• iTip Delegation

• iTip REQUEST notifications
• Tests

• Small refactoring
• Refactor
• Check recipient in a REQUEST
• Cleanup

• Cleanup FIXME/TODO comments
• Proper SEQUENCE handling with tests

I would probably not incorporate an obsolete features into an existing code, but ok.

I wonder if 403 in other circumstances would not be more generic. E.g. authentication issue.

This is kinda mess. Maybe a better approach would be to just check that the request comes from the "internal" location? E.g. by having list of IP networks (or IPs). But that potentially may be more complicated. Another possibility, a "client secret", but this probably would be event more problematic.

Remove the test, since we don't run the tests under swoole (so it doesn't work)

Add a minmal test

use swoole/metrics

migration test tooling