- Shipped
- August 10, 2026 at 6:35 PM UTC
- Author
- Kamo
- Commit
- 8ae5f92
The shared calendar has no owner, so the account-scoped DAV listing could never return it: company events were plainly there on the web and invisible on every phone. The home collection now unions the account's own calendars with its organisation's shared one. The reason this needed care rather than one extra query: CalDAV authenticates an account, not a membership, so simply exposing the calendar would have made it writable by anyone whose phone could reach it — a way round the publishing right the web path enforces. PUT and DELETE now resolve the membership behind the DAV credentials and apply the same rule: CREATE_ORG_CALENDAR_EVENTS to write to the shared calendar, ownership to write to a personal one, 403 otherwise. Read access stays deliberately wider than write. The shared calendar is meant to be visible to everyone in the organisation; that is the point of it. Only publishing is restricted. Tests cover the bypass specifically: no right, no membership in that organisation, and another organisation's shared calendar are each refused, while a holder of the right is allowed.