MailItem item = mbox.getItemById(new Mailbox.OperationContext(authId), iid.getId(), MailItem.TYPE_UNKNOWN);
MailItem item = mbox.getItemById(new Mailbox.OperationContext(authId, token.isAdmin() || token.isDomainAdmin()), iid.getId(), MailItem.TYPE_UNKNOWN);
    private void getCommand(HttpServletRequest req, HttpServletResponse resp, AuthToken authToken)    throws ServletException, IOException {        ItemId iid = null;        try {            iid = new ItemId(req.getParameter(PARAM_MSGID), null);        } catch (ServiceException e) {            resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "invalid id requested");            return;        }        String part = req.getParameter(PARAM_PART);        String fmt = req.getParameter(PARAM_FORMAT);        try {            // need to proxy the fetch if the mailbox lives on another server            if (!iid.isLocal()) {                // wrong server; proxy to the right one...                proxyServletRequest(req, resp, iid.getAccountId());                return;            }            String authId = authToken.getAccountId();            String accountId = iid.getAccountId() != null ? iid.getAccountId() : authId;            Account.addAccountToLogContext(accountId, ZimbraLog.C_NAME, ZimbraLog.C_ID);            if (!accountId.equalsIgnoreCase(authId))                ZimbraLog.addToContext(ZimbraLog.C_AID, authId);            ZimbraLog.addIpToContext(req.getRemoteAddr());            Mailbox mbox = MailboxManager.getInstance().getMailboxByAccountId(accountId);            if (mbox == null) {                resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "mailbox not found");                return;				            }            ZimbraLog.addMboxToContext(mbox.getId());            MailItem item = mbox.getItemById(new Mailbox.OperationContext(authId), iid.getId(), MailItem.TYPE_UNKNOWN);            if (item == null) {                resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "message not found");                return;				            }            try {                if (part == null) {                    // they want the entire message...                    boolean sync = "1".equals(req.getParameter(PARAM_SYNC));                    StringBuffer hdr = new StringBuffer();                    if (sync) {                        // for sync, return metadata as headers to avoid extra SOAP round-trips                        resp.addHeader("X-Zimbra-Tags", item.getTagString());                        resp.addHeader("X-Zimbra-Flags", item.getFlagString());                        resp.addHeader("X-Zimbra-Received", Long.toString(item.getDate()));                        resp.addHeader("X-Zimbra-Modified", Long.toString(item.getChangeDate()));                        // also return metadata inline in the message content for now                        hdr.append("X-Zimbra-Tags: ").append(item.getTagString()).append("\n");                        hdr.append("X-Zimbra-Flags: ").append(item.getFlagString()).append("\n");                        hdr.append("X-Zimbra-Received: ").append(item.getDate()).append("\n");                        hdr.append("X-Zimbra-Modified: ").append(item.getChangeDate()).append("\n");                    }                                        if (item instanceof Message) {                        Message msg = (Message) item;                        if (sync) {                            resp.addHeader("X-Zimbra-Conv", Integer.toString(msg.getConversationId()));                            hdr.append("X-Zimbra-Conv: ").append(msg.getConversationId()).append("\n");                            resp.getOutputStream().write(hdr.toString().getBytes());                        }                        resp.setContentType(Mime.CT_TEXT_PLAIN);                        InputStream is = msg.getRawMessage();                        ByteUtil.copy(is, true, resp.getOutputStream(), false);                    } else if (item instanceof Appointment) {                        Appointment appt = (Appointment) item;                        if (sync) {                            resp.getOutputStream().write(hdr.toString().getBytes());                        }                                                resp.setContentType(Mime.CT_TEXT_PLAIN);                        if (iid.hasSubpart()) {                            MimeMessage mm = appt.getSubpartMessage(iid.getSubpartId());                            mm.writeTo(resp.getOutputStream());                        } else { //                            Invite[] invites = appt.getInvites();//                            for (int i = 0; i < invites.length; i++)//                            {//                                Calendar cal = invites[i].toICalendar();//                                cal.toString();//                                resp.getWriter().write(cal.toString());//                            }                                                        InputStream is = appt.getRawMessage();                            ByteUtil.copy(is, true, resp.getOutputStream(), false);                        }                    }                    return;                } else {                    MimePart mp;                    if (item instanceof Message) {                        mp = getMimePart((Message) item, part);                     } else {                        Appointment appt = (Appointment) item;                        if (iid.hasSubpart()) {                            MimeMessage mbp = appt.getSubpartMessage(iid.getSubpartId());                            mp = Mime.getMimePart(mbp, part);                        } else {                            mp = getMimePart(appt, part);                        }                    }                    if (mp != null) {                        String contentType = mp.getContentType();                        if (contentType == null) {                            contentType = Mime.CT_APPLICATION_OCTET_STREAM;                        }                        if (contentType.toLowerCase().startsWith(Mime.CT_TEXT_HTML) && (FORMAT_DEFANGED_HTML.equals(fmt) || FORMAT_DEFANGED_HTML_NOT_IMAGES.equals(fmt))) {                            sendbackDefangedHtml(mp, contentType, resp, fmt);                        } else {                            if (!isTrue(Provisioning.A_zimbraAttachmentsViewInHtmlOnly, mbox.getAccountId())) {                                sendbackOriginalDoc(mp, contentType, req, resp);                            } else {                                req.setAttribute(ATTR_MIMEPART, mp);                                req.setAttribute(ATTR_MSGDIGEST, item.getDigest());                                req.setAttribute(ATTR_CONTENTURL, req.getRequestURL().toString());                                RequestDispatcher dispatcher = getServletContext().getRequestDispatcher(CONVERSION_PATH);                                dispatcher.forward(req, resp);                            }                        }                        return;                    }                    resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "part not found");                }            } catch (MessagingException e) {                resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e.getMessage());            }         } catch (NoSuchItemException e) {            resp.sendError(HttpServletResponse.SC_NOT_FOUND, "no such item");        } catch (ServiceException e) {            throw new ServletException(e);		} finally {            ZimbraLog.clearContext();              }        /*         out.println("hello world "+req.getParameter("id"));         out.println("path info: "+req.getPathInfo());         out.println("pathtrans: "+req.getPathTranslated());         */    }