JMAP Blob management extension

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 13 January 2022.¶

Copyright Notice

Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.¶

Table of Contents

1. Introduction

Sometimes JMAP ([RFC8620]) interactions require creating a Blob and then referencing it. In the same way that IMAP Literals ([RFC7888]) were extended to reduce roundtrips for simple data, embedding simple small blobs into the JMAP method stream can reduce roundtrips.¶

Likewise, when fetching an object, it can be useful to also fetch the raw content of that object without a separate roundtrip.¶

Where JMAP is being proxied through a system which applies additional access restrictions, it can be useful to be able to see where a blob is referenced in order to decide whether to allow it to be downloaded.¶

2. Conventions Used In This Document

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

3. Blobs

A blob is a sequence of zero or more octets.¶

The JMAP base spec [RFC8210] defines the Blob/copy method, which is unchanged by this specfication.¶

Method Call:

[ "Blob/set", {
  "accountId" : "account1",
  "create" : {
    "1": {
      "data:asBase64": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABAQMAAAAl21bKA
                        AAAA1BMVEX/AAAZ4gk3AAAAAXRSTlN/gFy0ywAAAApJRE
                        FUeJxjYgAAAAYAAzY3fKgAAAAASUVORK5CYII=",
      "type" : "image/png"
    },
  },
}, "R1" ]

Response:

[ "Blob/set", {
  "accountId" : "account1",
  "created" : {
    "1": {
      "id" : "G4c6751edf9dd6903ff54b792e432fba781271beb",
      "type" : "image/png",
      "size" : 95
    },
  },
}, "R1" ]

[ "Blob/lookup", {
  "datatypes": ["Mailbox", "Thread", "Email"],
  "ids": ["Gd2f81008cf07d2425418f7f02a3ca63a8bc82003",
          "G6f954bcb620f7f50fc8f21426bde3669da3d9067"]
}, "R1" ]

[ "Blob/lookup", {
  "list": [
    {
      "id": "Gd2f81008cf07d2425418f7f02a3ca63a8bc82003",
      "datatypes": {
        "Mailbox": ["M54e97373", Mcbe6b662"],
        "Thread": ["T1530616e"],
        "Email": ["E16e70a73eb4", "E84b0930cf16"]
      }
    }
  ],
  "notFound": ["G6f954bcb620f7f50fc8f21426bde3669da3d9067"]
}, "R1"]

4. Security considerations

TO BE IMPROVED:¶

JSON parsers are not all consistent in handling non-UTF-8 data. JMAP requires that all JSON data be UTF-8 encoded, so servers MUST either return data:asBase64 or isEncodingProblem: true and modify the data to be UTF-8 safe.¶

Servers MUST apply any access controls such that if the authenticated user would be unable to discover the blobId by making queries, then this fact can't be discovered via a Blob/lookup. For example, if an Email exists in a Mailbox which the authenticated user does not have access to see, then that emailId MUST not be returned in a lookup for a blob which is referenced by that email.¶

If a blob is not visible to a user at all, then the server SHOULD return that blobId in the notFound array, however it may also return an empty list for each datatype, as it may not be able to know if other datatypes do reference that blob.¶

5. IANA considerations

6. Acknowledgements

TBD¶

Author's Address