From 0232ae322bcedefce43476252ff4e6352e0db865 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Wed, 28 Oct 2026 05:11:26 +0100
Subject: [PATCH] feat: let admins hide delegates or limit them to read access
 per domain or group

---
 .../admin/org/sections/delegates-section.tsx  | 28 ++++++++++++++++---
 lib/admin/restriction-keys.ts                 |  2 ++
 2 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/components/admin/org/sections/delegates-section.tsx b/components/admin/org/sections/delegates-section.tsx
index d6af70217..59b4993fd 100644
--- a/components/admin/org/sections/delegates-section.tsx
+++ b/components/admin/org/sections/delegates-section.tsx
@@ -1,14 +1,34 @@
 'use client';
 
 import { SettingsSection } from '@/components/settings/settings-section';
+import { RESTRICTION_KEYS } from '@/lib/admin/restriction-keys';
+import { RestrictionRow } from '../org-page';
 import type { OrgPolicyDraft } from '../use-org-policy-draft';
 
-/** Organisation feature 7; filled in by its own step (local-data/org-features-plan.md). */
+const DELEGATION = RESTRICTION_KEYS.find((def) => def.key === 'delegation')!;
+const DELEGATION_RIGHTS = RESTRICTION_KEYS.find((def) => def.key === 'delegationRights')!;
+
+/** Organisation > Sharing > Delegates: whether users may delegate, and which rights. */
 export function DelegatesSection({ draft }: { draft: OrgPolicyDraft }) {
-  void draft;
+  const rights = draft.restriction(DELEGATION_RIGHTS.key).value;
+  const noneTicked = Array.isArray(rights?.allowedValues) && rights.allowedValues.length === 0;
   return (
-    <SettingsSection id="delegates" title="Delegates" description="Whether users may give a colleague access to their mail, calendars and contacts.">
-      <p className="text-sm text-muted-foreground">Nothing to set here yet.</p>
+    <SettingsSection
+      id="delegates"
+      title="Delegates"
+      description="Users can give a colleague read or read and write access to their mail folders, calendars and address books in one step, under Settings > Sharing. Stalwart doesn't let delegates send as the user; for an address several people send from, set up a shared mailbox."
+    >
+      <RestrictionRow draft={draft} def={DELEGATION} />
+      <RestrictionRow draft={draft} def={DELEGATION_RIGHTS} />
+      {noneTicked && (
+        <p className="text-xs text-destructive" role="status">
+          With neither ticked nothing is limited, so delegates can get both. Tick &quot;read&quot; to allow read access only.
+        </p>
+      )}
+      <p className="text-xs text-muted-foreground">
+        These apply to the Delegates dialog only. Sharing one folder, calendar or file from its own menu works as before, and Stalwart
+        itself enforces neither setting.
+      </p>
     </SettingsSection>
   );
 }
diff --git a/lib/admin/restriction-keys.ts b/lib/admin/restriction-keys.ts
index 089a410a4..0d11e4885 100644
--- a/lib/admin/restriction-keys.ts
+++ b/lib/admin/restriction-keys.ts
@@ -42,6 +42,8 @@ export const RESTRICTION_KEYS: readonly RestrictionKeyDef[] = [
   { key: 'calendarNotificationsEnabled', label: 'Calendar Notifications', category: 'Notifications', type: 'boolean', page: 'policy' },
   { key: 'pushNotifyInboxOnly', label: 'Inbox-only Push Notifications', category: 'Notifications', type: 'boolean', page: 'policy' },
   { key: 'debugMode', label: 'Debug Mode', category: 'Advanced', type: 'boolean', page: 'policy' },
+  { key: 'delegation', label: 'Delegates', description: 'Hide removes Settings > Sharing > Delegates, so users can no longer give someone access to mail, calendars and contacts in one step.', category: 'Sharing', type: 'boolean', page: 'org-sharing', modes: ['hidden'] },
+  { key: 'delegationRights', label: 'Rights delegates can get', description: 'Untick "write" and the Delegates dialog offers read access only.', category: 'Sharing', type: 'enum', allowedValues: ['read', 'write'], page: 'org-sharing', modes: ['allowedValues'] },
 ];
 
 export function restrictionKeysForPage(page: AdminPageId): RestrictionKeyDef[] {