Limit delegated account settings access
@kesselb is already working on this.
Since Jun 9, 2026.
- Dominant language
- JavaScript
- Stars
- 1k
- Forks
- 348
- Avg merge
- 12h 28m
- Merged PRs (30d)
- 91
Description
Is your feature request related to a problem? Please describe.
Delegated account access currently raises a permissions question: if a delegatee can edit all account settings, they may be able to change settings that affect or break the original account. Some settings might be too powerful for delegated users.
Describe the solution you'd like
Limit which account settings are editable for delegated accounts. The original account settings could be shown read-only to delegatees, with only delegate-specific options exposed where needed. For example, a personalized signature can be handled separately in #13050 without granting write access to all original account settings.
Describe alternatives you've considered
Allowing delegatees to edit all account settings is flexible, but it gives them broad control over the original account. Another option is to expose only a small allowlist of delegated-account settings.
Additional context
Split from the account delegation tracking issue after discussion in https://github.com/nextcloud/mail/issues/12403#issuecomment-4657622078.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.