Guard JMAP Request

JMAP request-envelope validator (RFC 8620 JMAP Core). Validates the shape of an HTTP request body posted to /jmap/api and refuses requests that exceed operator caps, omit required capability declarations, or contain malformed back-references.

## Request shape (RFC 8620 §3.3)

{
  "using":  ["urn:ietf:params:jmap:core", "urn:ietf:params:jmap:mail"],
  "methodCalls": [
    ["Mailbox/get",  { "accountId": "A1", "ids": null }, "c0"],
    ["Email/query",  { "filter": { "inMailbox": "#c0/list/0" } }, "c1"]
  ],
  "createdIds": null
}

using is the set of capability URIs the request invokes; the server's urn:ietf:params:jmap:core is implicit. methodCalls is an array of 3-tuples [methodName, args, clientId] where clientId echoes back on the response for client-side correlation.

## Back-reference resolution (RFC 8620 §3.7)

Subsequent methodCalls reference earlier results via { "resultOf": , "name": , "path": } placeholders inside the args object. The validator detects back-references and caps the chain depth so a pathological chain doesn't degrade into a O(2^N) blowup.

## Caps

• maxCallsInRequest — default 32 (RFC 8620 §3.6)
• maxObjectsInGet — default 500
• maxObjectsInSet — default 500
• maxSizeRequest — default 10 MiB
• maxBackRefDepth — default 8 (we add this; spec doesn't)
• maxUsingCapabilities — default 32 (refuses oversize using)

Refusals emit a urn:ietf:params:jmap:error:* URI per RFC 8620 §3.6.1.

b.guardJmap.validate(rawBody, opts?) #

{
  profile:               "strict" | "balanced" | "permissive",
  posture:               "hipaa" | "pci-dss" | "gdpr" | "soc2",
  serverCapabilities:    { "urn:ietf:params:jmap:mail": true, ... },
                         // capability URIs the server has wired; `using`
                         //   entries not in this set are refused with
                         //   urn:ietf:params:jmap:error:unknownCapability
}

Validate a JMAP request envelope. Accepts either a raw JSON string (bytes) or a pre-parsed object. Returns { using, methodCalls, createdIds } on success; throws GuardJmapError with the matching urn:ietf:params:jmap:error:* URI on refusal.

var parsed = b.guardJmap.validate(rawBody, {
  serverCapabilities: { "urn:ietf:params:jmap:mail": true },
});
// → { using: [...], methodCalls: [[methodName, args, clientId], ...] }

b.guardJmap.compliancePosture(name) #

Return the effective profile NAME for a compliance posture, or null for a name this parser does not map. Unlike the content-guard variant this returns the resolved profile string (every line-protocol parser composes gateContract.ALL_STRICT_POSTURES, so "hipaa" / "pci-dss" / "gdpr" / "soc2" all resolve to "strict") and never throws — the parser shape carries no overlay-clone, no buildProfile, and no loadRulePack. Wired by gateContract.defineParser.

b.guardJmap.compliancePosture("hipaa");                   // → "strict"
b.guardJmap.compliancePosture("not-a-regime");            // → null

Last updated 2026-08-08T16:39:49.652Z by seeder.