- Shipped
- August 10, 2026 at 2:52 PM UTC
- Author
- Kamo
- Commit
- 7746fce
mkCol built a ContactBook carrying neither an organisation nor an owner and returned 201 regardless, so creating an address book from a CardDAV client failed at flush every time: ORGANIZATION_ID is NOT NULL, and an ownerless book violates OWNER_ID IS NOT NULL OR IS_ORG_DEFAULT = TRUE. MKCOL is routed and advertised in its own Allow header, so this was reachable, not dead code. Both scopes now come from the session the DAV auth filter established — davUserId and davOrgId, the same pair every other write here uses. That also matters more than it used to: ownership became access control with the per-member address-book change, so a book created without an owner would be invisible to the member it was made for even if the insert had succeeded. Two smaller corrections while here: - MKCOL against a collection that already exists answers 405 rather than silently creating a second book (RFC 4918 section 9.3.1). - The response carries a Location header. The path segment cannot become the new book's id — ids are database-generated — so the collection lands at its own URL, and Location is how the client is meant to find it. The accompanying test pins the entity contract MKCOL has to satisfy: the handler needs a servlet container to exercise, but the NOT NULL organisation, the owner-or-org-default check constraint and the mandatory name are exactly what the old code violated.