mirror of
https://github.com/bulwarkmail/webmail.git
synced 2026-10-31 16:13:15 +00:00
zisisvakras
44360024bc
contactUsing(), calendarUsing(), and fileUsing() checked the base "principals" capability but then declared the separate "principals:owner" sub-capability (RFC 9670) in the request's "using" array. RFC 8620 section 3.3 requires a server to reject the whole request if it declares a capability the server does not advertise, so a server that supports base principals without the owner sub-capability rejects every one of these requests with unknownCapability. Fixed to check the specific sub-capability being declared instead of assuming it from the broader one. The calendar agenda route had the same mismatch and is fixed the same way. Note that RFC 9670 section 1.5.2 places principals:owner in accountCapabilities rather than the session capabilities, so on compliant servers the sub-capability is simply never declared, which is the intent. Nothing is lost by omitting it. The file share test asserted the old behavior by expecting the owner capability to be declared against a server that advertises only base principals. It now asserts the capability is omitted in that case and declared only when the server advertises it. The same pair of assertions is added for the contacts, calendars, and agenda route request builders, so each site this commit touches is covered against regression.