Distribution groups

​

The capability object

"urn:oximail:params:jmap:distributiongroups": {
  "maxNestingDepth": 10,
  "maxFlatSize": 1000,
  "maxGroupsPerTenant": 1000,
  "maxGroupsPerOwner": 100
}

​

Objects and methods

​

Behaviours worth knowing

• Anyone may create; the owner or an admin may change. A create by any member of the organization makes the caller the owner; naming a different ownerAccountId requires an admin. Update and destroy are the owner’s or an admin’s. Every membership mutation and every destroy writes an audit line in the handler’s transaction, since a group used in a shareWith grant changes the effective rights of N accounts.
• A group cannot shadow a colleague. Inbound expansion runs before account resolution, deliberately, so a group named after a colleague’s local part would silently divert their mail to the members; create and rename refuse any name already carried by a live group, a historical alias, an account address or an email alias of the organization. The guard is per organization: a group team in one organization never expands a message sent to team@ another organization’s domain, which is passed through verbatim.
• Renaming keeps the old name alive. The previous name becomes a historical alias, served in aliases (oldest first), and old-name@ keeps resolving.
• Who sees the members. An admin, the owner (whoever manages the membership must read it), a member, or anyone when membersVisibleToTenant is true; everyone else receives members: null. memberCount is always served.
• Nesting is bounded and precomputed. A set recomputes the flat expansion of the group and of every ancestor in the same transaction, refusing a cycle, a depth over the cap and a flat size over the cap with a typed error; the refused object rolls back to its savepoint while the other objects of the call proceed. Delivery and submission then read the flat cache, one SQL lookup and no recursion.
• A fan-out budget per organization. Each expansion consumes N units of a sliding one-minute window (fanout_per_minute); over it, the resolution fails rather than sending, so a runaway sender cannot turn a group into a flood.
• A full member is skipped. On delivery to a group, a member whose mailbox is over quota is skipped, logged and counted; the other members receive the message (storage). When a colleague leaves, oximail account offboard names the groups they belong to and changes none of them: group mail already follows the address redirection member by member (CLI).