mirror of
https://github.com/bulwarkmail/webmail.git
synced 2026-11-01 08:12:43 +00:00
Stefan Hildebrandt
3898d0c1cb
Event editability was inferred from identity (isOrigin + organizer match) and never from the calendar's write rights. That opened events in read-only shared / iCal-subscription calendars for editing, and once the address list was widened with account aliases any alias-organized event became editable - even in calendars the user cannot write. - lib/calendar-editability.ts: getEventEditability() -> editable | rsvp-only | read-only, gating on the calendar's myRights (mayWriteAll / mayWriteOwn / mayRSVP) first, then organizer/participant identity. Subscriptions are read-only. Aliases now only refine the write-own / RSVP branches, so they can no longer over-open events (Stalwart: organizer identity does not confer calendar write; the ACL does). - collectUserCalendarAddresses(): merge identities + account aliases so an alias organizer is recognised as the user's own; calendar-app fetches the principal aliases and passes isSubscriptionCalendar through. - event-detail-popover / event-modal: derive Edit/Delete/RSVP/read-only from the resolver (three render states); read-only is new - no edit, no RSVP. Tests: calendar-editability (26 cases over rights x role x subscription x origin, incl. the alias-in-read-only regression) + calendar-participants. tsc + eslint clean.