Summary

The Files section stays visible in the sidebar (and /files stays navigable) for accounts whose JMAP session document does not include urn:ietf:params:jmap:filenode. All file actions then fail with "You are not authorized to perform this action" / "Failed to upload file".

Given the existing i18n string "File storage is not available on this server", it looks like the intent is to hide/disable the module when the capability is absent — but the nav item renders regardless.

Environment

• Bulwark Webmail v1.4.9 (ghcr.io/bulwarkmail/webmail:main-f084b48), Docker/Kubernetes behind Traefik
• Stalwart v0.15.5, single JMAP_SERVER_URL, basic auth
• STALWART_FEATURES=true, SETTINGS_SYNC_ENABLED=true

Steps to reproduce

1. In Stalwart, create a role that inherits user but disables all jmap-file-node-* (and dav-file-*) permissions; assign it to an account.
2. Verify the account's /.well-known/jmap session document no longer lists urn:ietf:params:jmap:filenode in accountCapabilities (confirmed absent in our case).
3. Log out and log back into Bulwark with that account (fresh session).
4. Sidebar still shows Files; opening it and attempting folder creation/upload fails with authorization errors.

Expected

When urn:ietf:params:jmap:filenode is absent from the account capabilities, hide the Files nav item (or render the "File storage is not available on this server" state) instead of exposing actions that can only fail.

Actual

Files nav renders; every action errors.