Move users, calendars, and address books from config.yaml into the database

BREAKING CHANGE: the users:/config-based collection setup is gone. All
user, calendar, and address-book data now lives in the SQLite DB
(internal/db) and is managed exclusively via nidusctl or the web UI.
Existing deployments must recreate their users after upgrading:
  nidusctl user create <username>
  nidusctl calendar create <username> <name>
  nidusctl addressbook create <username> <name>

- internal/db: new users, calendars, addressbooks tables with FK cascade
  delete; foreign_keys pragma enabled; internal/db/users.go implements
  full CRUD + bcrypt auth (CreateUser, VerifyPassword, ListUsers,
  CreateCalendar/AddressBook, etc).
- internal/config: removed Users/UserConfig entirely.
- internal/auth: Basic Auth now checks credentials via db.DB instead of
  cfg.Users.
- internal/caldav, internal/carddav: ListCalendars/ListAddressBooks and
  Create/Delete now backed by the DB.
- internal/web: login uses db.VerifyPassword; new resources.go adds
  create/delete handlers for calendars/address books at
  /web/resources/{calendar,addressbook}; dashboard gained create forms
  and per-card delete buttons (templ + htmx, no hyperscript).
- tools/nidusctl: new user create/delete/list/passwd commands (masked
  interactive password prompt via golang.org/x/term) plus create/delete/
  list subcommands for calendar/addressbook.
- cmd/server/main.go: pre-creates on-disk collections from the DB at
  startup instead of cfg.Users; warns when no users exist yet.
- Updated tests to seed data via the DB; added resources_test.go for the
  new web UI handlers.
- README.md and .github/copilot-instructions.md updated to document the
  new nidusctl commands and the DB-backed architecture.

Verified end-to-end against a live test server: nidusctl user/calendar/
addressbook create, DAV Basic Auth PROPFIND, web login, dashboard
rendering, and web UI create/delete of resources all confirmed working.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

internal/auth/middleware.go

@@ -6,7 +6,7 @@ import (
 	"net/http"
 
 	"github.com/yourusername/caldav-server/internal/config"
-	"golang.org/x/crypto/bcrypt"
+	"github.com/yourusername/caldav-server/internal/db"
 )
 
 type contextKey string
@@ -16,11 +16,12 @@ const userContextKey contextKey = "authenticated_user"
 // Middleware wraps an http.Handler with HTTP Basic Auth enforcement.
 type Middleware struct {
 	cfg    *config.Config
+	dbase  *db.DB
 	logger *slog.Logger
 }
 
-func NewMiddleware(cfg *config.Config, logger *slog.Logger) *Middleware {
-	return &Middleware{cfg: cfg, logger: logger}
+func NewMiddleware(cfg *config.Config, dbase *db.DB, logger *slog.Logger) *Middleware {
+	return &Middleware{cfg: cfg, dbase: dbase, logger: logger}
 }
 
 // Wrap returns an http.Handler that requires valid Basic Auth credentials
@@ -65,20 +66,16 @@ func (m *Middleware) challenge(w http.ResponseWriter) {
 	_, _ = w.Write([]byte("Unauthorized"))
 }
 
-// authenticate validates username/password against config.
-func (m *Middleware) authenticate(username, password string) (*config.UserConfig, error) {
-	user, ok := m.cfg.Users[username]
-	if !ok {
-		// constant-time comparison to avoid timing attacks
-		_ = bcrypt.CompareHashAndPassword([]byte("$2b$12$invalid"), []byte(password))
+// authenticate validates username/password against the database.
+func (m *Middleware) authenticate(username, password string) (*db.User, error) {
+	user, err := m.dbase.GetUser(username)
+	if err != nil {
 		return nil, errUnauthorized
 	}
-
-	if err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)); err != nil {
+	if !m.dbase.VerifyPassword(username, password) {
 		return nil, errUnauthorized
 	}
-
-	return &user, nil
+	return user, nil
 }
 
 // Principal holds the authenticated user's identity.

internal/caldav/backend.go

@@ -73,13 +73,13 @@ func (b *Backend) ListCalendars(ctx context.Context) ([]caldav.Calendar, error)
 		return nil, webdav.NewHTTPError(http.StatusUnauthorized, fmt.Errorf("not authenticated"))
 	}
 
-	user, ok := b.cfg.Users[p.Username]
-	if !ok {
-		return nil, fmt.Errorf("user not found")
+	names, err := b.dbase.ListCalendars(p.Username)
+	if err != nil {
+		return nil, fmt.Errorf("listing calendars: %w", err)
 	}
 
 	var cals []caldav.Calendar
-	for _, name := range user.Calendars {
+	for _, name := range names {
 		if err := b.store.EnsureCollection(p.Username, "cal-"+name); err != nil {
 			b.logger.Warn("ensuring calendar directory", "calendar", name, "error", err)
 			continue
@@ -87,10 +87,10 @@ func (b *Backend) ListCalendars(ctx context.Context) ([]caldav.Calendar, error)
 		cals = append(cals, b.calendarMeta(p.Username, name, name))
 	}
 
-	// Also include any extra calendars that exist on disk but aren't in config
+	// Also include any extra calendars that exist on disk but aren't registered
 	disk, _ := b.store.ListCollections(p.Username)
 	configured := make(map[string]bool)
-	for _, n := range user.Calendars {
+	for _, n := range names {
 		configured["cal-"+n] = true
 	}
 	for _, dir := range disk {
@@ -202,6 +202,9 @@ func (b *Backend) CreateCalendar(ctx context.Context, calendar *caldav.Calendar)
 	// existing calendar is done via ShareCalendar, not by creating one
 	// directly in someone else's name.
 	name := path.Base(strings.TrimSuffix(calendar.Path, "/"))
+	if err := b.dbase.CreateCalendar(p.Username, name); err != nil && err != db.ErrResourceExists {
+		return fmt.Errorf("registering calendar: %w", err)
+	}
 	return b.store.EnsureCollection(p.Username, "cal-"+name)
 }
 
@@ -214,6 +217,9 @@ func (b *Backend) DeleteCalendar(ctx context.Context, calPath string) error {
 	if err != nil {
 		return err
 	}
+	if err := b.dbase.DeleteCalendar(owner, realName); err != nil && err != db.ErrResourceNotFound {
+		return fmt.Errorf("unregistering calendar: %w", err)
+	}
 	return b.store.DeleteCollection(owner, "cal-"+realName)
 }
 

internal/caldav/backend_test.go

@@ -30,11 +30,18 @@ func newTestBackend(t *testing.T) (*Backend, *db.DB) {
 	}
 	t.Cleanup(func() { dbase.Close() })
 
-	cfg := &config.Config{
-		Users: map[string]config.UserConfig{
-			"alice": {Calendars: []string{"work"}},
-			"bob":   {Calendars: []string{"personal"}},
-		},
+	cfg := &config.Config{}
+	if err := dbase.CreateUser("alice", "pw", "", ""); err != nil {
+		t.Fatalf("CreateUser alice: %v", err)
+	}
+	if err := dbase.CreateUser("bob", "pw", "", ""); err != nil {
+		t.Fatalf("CreateUser bob: %v", err)
+	}
+	if err := dbase.CreateCalendar("alice", "work"); err != nil {
+		t.Fatalf("CreateCalendar alice/work: %v", err)
+	}
+	if err := dbase.CreateCalendar("bob", "personal"); err != nil {
+		t.Fatalf("CreateCalendar bob/personal: %v", err)
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
 	return NewBackend(cfg, st, dbase, logger), dbase

internal/carddav/backend.go

@@ -67,13 +67,13 @@ func (b *Backend) ListAddressBooks(ctx context.Context) ([]carddav.AddressBook,
 		return nil, webdav.NewHTTPError(http.StatusUnauthorized, fmt.Errorf("not authenticated"))
 	}
 
-	user, ok := b.cfg.Users[p.Username]
-	if !ok {
-		return nil, fmt.Errorf("user not found")
+	names, err := b.dbase.ListAddressBooks(p.Username)
+	if err != nil {
+		return nil, fmt.Errorf("listing address books: %w", err)
 	}
 
 	var books []carddav.AddressBook
-	for _, name := range user.AddressBooks {
+	for _, name := range names {
 		if err := b.store.EnsureCollection(p.Username, "card-"+name); err != nil {
 			b.logger.Warn("ensuring address book directory", "book", name, "error", err)
 			continue
@@ -81,10 +81,10 @@ func (b *Backend) ListAddressBooks(ctx context.Context) ([]carddav.AddressBook,
 		books = append(books, b.bookMeta(p.Username, name, name))
 	}
 
-	// Also include extra books that exist on disk
+	// Also include extra books that exist on disk but aren't registered
 	disk, _ := b.store.ListCollections(p.Username)
 	configured := make(map[string]bool)
-	for _, n := range user.AddressBooks {
+	for _, n := range names {
 		configured["card-"+n] = true
 	}
 	for _, dir := range disk {
@@ -191,6 +191,9 @@ func (b *Backend) CreateAddressBook(ctx context.Context, book *carddav.AddressBo
 		return webdav.NewHTTPError(http.StatusUnauthorized, fmt.Errorf("not authenticated"))
 	}
 	name := path.Base(strings.TrimSuffix(book.Path, "/"))
+	if err := b.dbase.CreateAddressBook(p.Username, name); err != nil && err != db.ErrResourceExists {
+		return fmt.Errorf("registering address book: %w", err)
+	}
 	return b.store.EnsureCollection(p.Username, "card-"+name)
 }
 
@@ -203,6 +206,9 @@ func (b *Backend) DeleteAddressBook(ctx context.Context, bookPath string) error
 	if err != nil {
 		return err
 	}
+	if err := b.dbase.DeleteAddressBook(owner, realName); err != nil && err != db.ErrResourceNotFound {
+		return fmt.Errorf("unregistering address book: %w", err)
+	}
 	return b.store.DeleteCollection(owner, "card-"+realName)
 }
 

internal/carddav/backend_test.go

@@ -29,11 +29,18 @@ func newTestBackend(t *testing.T) (*Backend, *db.DB) {
 	}
 	t.Cleanup(func() { dbase.Close() })
 
-	cfg := &config.Config{
-		Users: map[string]config.UserConfig{
-			"alice": {AddressBooks: []string{"contacts"}},
-			"bob":   {AddressBooks: []string{"personal"}},
-		},
+	cfg := &config.Config{}
+	if err := dbase.CreateUser("alice", "pw", "", ""); err != nil {
+		t.Fatalf("CreateUser alice: %v", err)
+	}
+	if err := dbase.CreateUser("bob", "pw", "", ""); err != nil {
+		t.Fatalf("CreateUser bob: %v", err)
+	}
+	if err := dbase.CreateAddressBook("alice", "contacts"); err != nil {
+		t.Fatalf("CreateAddressBook alice/contacts: %v", err)
+	}
+	if err := dbase.CreateAddressBook("bob", "personal"); err != nil {
+		t.Fatalf("CreateAddressBook bob/personal: %v", err)
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
 	return NewBackend(cfg, st, dbase, logger), dbase

internal/config/config.go

@@ -9,12 +9,11 @@ import (
 
 // Config is the top-level server configuration.
 type Config struct {
-	Server  ServerConfig          `yaml:"server"`
-	Auth    AuthConfig            `yaml:"auth"`
-	Storage StorageConfig         `yaml:"storage"`
-	Users   map[string]UserConfig `yaml:"users"`
-	TLS     TLSConfig             `yaml:"tls"`
-	Logging LoggingConfig         `yaml:"logging"`
+	Server  ServerConfig  `yaml:"server"`
+	Auth    AuthConfig    `yaml:"auth"`
+	Storage StorageConfig `yaml:"storage"`
+	TLS     TLSConfig     `yaml:"tls"`
+	Logging LoggingConfig `yaml:"logging"`
 }
 
 type ServerConfig struct {
@@ -34,15 +33,6 @@ type StorageConfig struct {
 	DataDir string `yaml:"data_dir"`
 }
 
-type UserConfig struct {
-	// bcrypt-hashed password (use `htpasswd -nB <user>`)
-	Password     string   `yaml:"password"`
-	DisplayName  string   `yaml:"display_name"`
-	Email        string   `yaml:"email"`
-	Calendars    []string `yaml:"calendars"`
-	AddressBooks []string `yaml:"address_books"`
-}
-
 type TLSConfig struct {
 	Enabled  bool   `yaml:"enabled"`
 	CertFile string `yaml:"cert_file"`
@@ -105,8 +95,5 @@ func (c *Config) validate() error {
 			return fmt.Errorf("tls.cert_file and tls.key_file are required when tls is enabled")
 		}
 	}
-	if len(c.Users) == 0 {
-		return fmt.Errorf("at least one user must be configured")
-	}
 	return nil
 }

internal/db/db.go

@@ -30,7 +30,7 @@ func Open(path string) (*DB, error) {
 		}
 	}
 
-	conn, err := sql.Open("sqlite", path)
+	conn, err := sql.Open("sqlite", path+"?_pragma=foreign_keys(1)")
 	if err != nil {
 		return nil, fmt.Errorf("opening database %q: %w", path, err)
 	}
@@ -53,6 +53,28 @@ func (d *DB) Close() error {
 
 func (d *DB) migrate() error {
 	const schema = `
+CREATE TABLE IF NOT EXISTS users (
+	username TEXT PRIMARY KEY,
+	password_hash TEXT NOT NULL,
+	display_name TEXT NOT NULL DEFAULT '',
+	email TEXT NOT NULL DEFAULT '',
+	created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE TABLE IF NOT EXISTS calendars (
+	owner TEXT NOT NULL REFERENCES users (username) ON DELETE CASCADE,
+	name TEXT NOT NULL,
+	created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	PRIMARY KEY (owner, name)
+);
+
+CREATE TABLE IF NOT EXISTS addressbooks (
+	owner TEXT NOT NULL REFERENCES users (username) ON DELETE CASCADE,
+	name TEXT NOT NULL,
+	created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	PRIMARY KEY (owner, name)
+);
+
 CREATE TABLE IF NOT EXISTS calendar_shares (
 	id INTEGER PRIMARY KEY AUTOINCREMENT,
 	owner TEXT NOT NULL,

internal/db/users.go

@@ -0,0 +1,291 @@
+package db
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+	"strings"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+// ErrUserNotFound is returned when a username doesn't exist.
+var ErrUserNotFound = errors.New("user not found")
+
+// ErrUserExists is returned when trying to create a user that already
+// exists.
+var ErrUserExists = errors.New("user already exists")
+
+// ErrResourceExists is returned when creating a calendar/address book that
+// already exists for that owner.
+var ErrResourceExists = errors.New("resource already exists")
+
+// ErrResourceNotFound is returned when deleting a calendar/address book
+// that doesn't exist.
+var ErrResourceNotFound = errors.New("resource not found")
+
+// User is an account stored in the database.
+type User struct {
+	Username     string
+	PasswordHash string
+	DisplayName  string
+	Email        string
+}
+
+// CreateUser adds a new account with the given (already plaintext)
+// password, which is bcrypt-hashed before being stored. Returns
+// ErrUserExists if the username is already taken.
+func (d *DB) CreateUser(username, password, displayName, email string) error {
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return fmt.Errorf("hashing password: %w", err)
+	}
+	_, err = d.conn.Exec(
+		`INSERT INTO users (username, password_hash, display_name, email) VALUES (?, ?, ?, ?)`,
+		username, string(hash), displayName, email,
+	)
+	if err != nil {
+		if isUniqueConstraintErr(err) {
+			return ErrUserExists
+		}
+		return fmt.Errorf("creating user: %w", err)
+	}
+	return nil
+}
+
+// SetPassword updates username's password hash. Returns ErrUserNotFound
+// if the user doesn't exist.
+func (d *DB) SetPassword(username, password string) error {
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return fmt.Errorf("hashing password: %w", err)
+	}
+	res, err := d.conn.Exec(`UPDATE users SET password_hash = ? WHERE username = ?`, string(hash), username)
+	if err != nil {
+		return fmt.Errorf("setting password: %w", err)
+	}
+	return requireRowsAffected(res, ErrUserNotFound)
+}
+
+// DeleteUser removes username along with all of its calendars, address
+// books, and sharing grants (calendars/addressbooks cascade via foreign
+// key; shares are cleaned up explicitly since they reference usernames as
+// plain text, not a foreign key, on both sides of the grant).
+func (d *DB) DeleteUser(username string) error {
+	tx, err := d.conn.Begin()
+	if err != nil {
+		return fmt.Errorf("deleting user: %w", err)
+	}
+	defer tx.Rollback()
+
+	res, err := tx.Exec(`DELETE FROM users WHERE username = ?`, username)
+	if err != nil {
+		return fmt.Errorf("deleting user: %w", err)
+	}
+	if err := requireRowsAffected(res, ErrUserNotFound); err != nil {
+		return err
+	}
+	if _, err := tx.Exec(`DELETE FROM calendar_shares WHERE owner = ? OR shared_with = ?`, username, username); err != nil {
+		return fmt.Errorf("deleting user's calendar shares: %w", err)
+	}
+	if _, err := tx.Exec(`DELETE FROM addressbook_shares WHERE owner = ? OR shared_with = ?`, username, username); err != nil {
+		return fmt.Errorf("deleting user's address book shares: %w", err)
+	}
+	if _, err := tx.Exec(`DELETE FROM web_sessions WHERE username = ?`, username); err != nil {
+		return fmt.Errorf("deleting user's sessions: %w", err)
+	}
+	return tx.Commit()
+}
+
+// GetUser looks up a user by username. Returns ErrUserNotFound if it
+// doesn't exist.
+func (d *DB) GetUser(username string) (*User, error) {
+	row := d.conn.QueryRow(
+		`SELECT username, password_hash, display_name, email FROM users WHERE username = ?`,
+		username,
+	)
+	var u User
+	if err := row.Scan(&u.Username, &u.PasswordHash, &u.DisplayName, &u.Email); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, ErrUserNotFound
+		}
+		return nil, fmt.Errorf("looking up user: %w", err)
+	}
+	return &u, nil
+}
+
+// VerifyPassword returns true if password matches username's stored hash.
+// It also returns false (without distinguishing why) if the user doesn't
+// exist, running a dummy bcrypt comparison first to keep the timing
+// consistent regardless of whether the account exists.
+func (d *DB) VerifyPassword(username, password string) bool {
+	u, err := d.GetUser(username)
+	if err != nil {
+		_ = bcrypt.CompareHashAndPassword([]byte("$2b$12$invalidinvalidinvalidinvalidinvalidinval"), []byte(password))
+		return false
+	}
+	return bcrypt.CompareHashAndPassword([]byte(u.PasswordHash), []byte(password)) == nil
+}
+
+// ListUsers returns all usernames, sorted.
+func (d *DB) ListUsers() ([]User, error) {
+	rows, err := d.conn.Query(`SELECT username, password_hash, display_name, email FROM users ORDER BY username`)
+	if err != nil {
+		return nil, fmt.Errorf("listing users: %w", err)
+	}
+	defer rows.Close()
+
+	var users []User
+	for rows.Next() {
+		var u User
+		if err := rows.Scan(&u.Username, &u.PasswordHash, &u.DisplayName, &u.Email); err != nil {
+			return nil, fmt.Errorf("scanning user: %w", err)
+		}
+		users = append(users, u)
+	}
+	return users, rows.Err()
+}
+
+// UserCount returns the number of users in the database (used to detect a
+// fresh install so config.yaml's legacy `users:` section, if present, can
+// be imported once).
+func (d *DB) UserCount() (int, error) {
+	var n int
+	err := d.conn.QueryRow(`SELECT COUNT(*) FROM users`).Scan(&n)
+	if err != nil {
+		return 0, fmt.Errorf("counting users: %w", err)
+	}
+	return n, nil
+}
+
+// -------- calendars --------
+
+// CreateCalendar registers a new calendar owned by owner. Returns
+// ErrResourceExists if it already exists.
+func (d *DB) CreateCalendar(owner, name string) error {
+	_, err := d.conn.Exec(`INSERT INTO calendars (owner, name) VALUES (?, ?)`, owner, name)
+	if err != nil {
+		if isUniqueConstraintErr(err) {
+			return ErrResourceExists
+		}
+		return fmt.Errorf("creating calendar: %w", err)
+	}
+	return nil
+}
+
+// DeleteCalendar removes a calendar registration (not the underlying
+// files/objects — callers are responsible for also removing those via
+// store.Store). Returns ErrResourceNotFound if it doesn't exist. Any
+// sharing grants for it are removed as well.
+func (d *DB) DeleteCalendar(owner, name string) error {
+	tx, err := d.conn.Begin()
+	if err != nil {
+		return fmt.Errorf("deleting calendar: %w", err)
+	}
+	defer tx.Rollback()
+
+	res, err := tx.Exec(`DELETE FROM calendars WHERE owner = ? AND name = ?`, owner, name)
+	if err != nil {
+		return fmt.Errorf("deleting calendar: %w", err)
+	}
+	if err := requireRowsAffected(res, ErrResourceNotFound); err != nil {
+		return err
+	}
+	if _, err := tx.Exec(`DELETE FROM calendar_shares WHERE owner = ? AND calendar_name = ?`, owner, name); err != nil {
+		return fmt.Errorf("deleting calendar's shares: %w", err)
+	}
+	return tx.Commit()
+}
+
+// ListCalendars returns the names of all calendars owner has registered,
+// sorted.
+func (d *DB) ListCalendars(owner string) ([]string, error) {
+	return listNames(d, `SELECT name FROM calendars WHERE owner = ? ORDER BY name`, owner)
+}
+
+// -------- address books --------
+
+// CreateAddressBook registers a new address book owned by owner. Returns
+// ErrResourceExists if it already exists.
+func (d *DB) CreateAddressBook(owner, name string) error {
+	_, err := d.conn.Exec(`INSERT INTO addressbooks (owner, name) VALUES (?, ?)`, owner, name)
+	if err != nil {
+		if isUniqueConstraintErr(err) {
+			return ErrResourceExists
+		}
+		return fmt.Errorf("creating address book: %w", err)
+	}
+	return nil
+}
+
+// DeleteAddressBook removes an address book registration (not the
+// underlying files/objects — callers are responsible for also removing
+// those via store.Store). Returns ErrResourceNotFound if it doesn't
+// exist. Any sharing grants for it are removed as well.
+func (d *DB) DeleteAddressBook(owner, name string) error {
+	tx, err := d.conn.Begin()
+	if err != nil {
+		return fmt.Errorf("deleting address book: %w", err)
+	}
+	defer tx.Rollback()
+
+	res, err := tx.Exec(`DELETE FROM addressbooks WHERE owner = ? AND name = ?`, owner, name)
+	if err != nil {
+		return fmt.Errorf("deleting address book: %w", err)
+	}
+	if err := requireRowsAffected(res, ErrResourceNotFound); err != nil {
+		return err
+	}
+	if _, err := tx.Exec(`DELETE FROM addressbook_shares WHERE owner = ? AND addressbook_name = ?`, owner, name); err != nil {
+		return fmt.Errorf("deleting address book's shares: %w", err)
+	}
+	return tx.Commit()
+}
+
+// ListAddressBooks returns the names of all address books owner has
+// registered, sorted.
+func (d *DB) ListAddressBooks(owner string) ([]string, error) {
+	return listNames(d, `SELECT name FROM addressbooks WHERE owner = ? ORDER BY name`, owner)
+}
+
+// -------- helpers --------
+
+func listNames(d *DB, query, arg string) ([]string, error) {
+	rows, err := d.conn.Query(query, arg)
+	if err != nil {
+		return nil, fmt.Errorf("listing: %w", err)
+	}
+	defer rows.Close()
+
+	var names []string
+	for rows.Next() {
+		var n string
+		if err := rows.Scan(&n); err != nil {
+			return nil, fmt.Errorf("scanning: %w", err)
+		}
+		names = append(names, n)
+	}
+	return names, rows.Err()
+}
+
+func requireRowsAffected(res sql.Result, errIfZero error) error {
+	n, err := res.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if n == 0 {
+		return errIfZero
+	}
+	return nil
+}
+
+// isUniqueConstraintErr reports whether err looks like a SQLite UNIQUE /
+// PRIMARY KEY constraint violation. modernc.org/sqlite doesn't expose a
+// typed error for this, so this matches on the driver's error message.
+func isUniqueConstraintErr(err error) bool {
+	if err == nil {
+		return false
+	}
+	msg := err.Error()
+	return strings.Contains(msg, "UNIQUE constraint failed") || strings.Contains(msg, "constraint failed: UNIQUE")
+}

internal/web/dashboard.go

@@ -2,6 +2,7 @@ package web
 
 import (
 	"context"
+	"fmt"
 	"net/http"
 
 	"github.com/yourusername/caldav-server/internal/db"
@@ -10,83 +11,93 @@ import (
 
 func (s *Server) handleDashboard(w http.ResponseWriter, r *http.Request) {
 	username := userFromContext(r.Context())
-	user, ok := s.cfg.Users[username]
-	if !ok {
-		http.Error(w, "user not found in configuration", http.StatusInternalServerError)
+
+	resources, err := s.resourceCards(username)
+	if err != nil {
+		s.logger.Error("listing resources", "error", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
 
-	var resources []templates.ResourceCard
-
-	for _, calName := range user.Calendars {
-		card := templates.ResourceCard{Kind: "calendar", Name: calName}
-		if s.dbase != nil {
-			shares, err := s.dbase.SharesOfCalendar(username, calName)
-			if err != nil {
-				s.logger.Warn("listing calendar shares", "error", err)
-			}
-			for _, sh := range shares {
-				card.Shares = append(card.Shares, templates.ShareRow{
-					ResourceName: calName,
-					SharedWith:   sh.SharedWith,
-					Permission:   string(sh.Permission),
-				})
-			}
-		}
-		resources = append(resources, card)
-	}
-
-	for _, bookName := range user.AddressBooks {
-		card := templates.ResourceCard{Kind: "addressbook", Name: bookName}
-		if s.dbase != nil {
-			shares, err := s.dbase.SharesOfAddressBook(username, bookName)
-			if err != nil {
-				s.logger.Warn("listing address book shares", "error", err)
-			}
-			for _, sh := range shares {
-				card.Shares = append(card.Shares, templates.ShareRow{
-					ResourceName: bookName,
-					SharedWith:   sh.SharedWith,
-					Permission:   string(sh.Permission),
-				})
-			}
-		}
-		resources = append(resources, card)
-	}
-
 	var sharedWithMe []templates.SharedWithMeItem
-	if s.dbase != nil {
-		calShares, err := s.dbase.CalendarsSharedWith(username)
-		if err != nil {
-			s.logger.Warn("listing calendars shared with user", "error", err)
-		}
-		for _, sh := range calShares {
-			sharedWithMe = append(sharedWithMe, templates.SharedWithMeItem{
-				Kind: "calendar", Owner: sh.Owner, Name: sh.CalendarName, Permission: string(sh.Permission),
-			})
-		}
-		bookShares, err := s.dbase.AddressBooksSharedWith(username)
-		if err != nil {
-			s.logger.Warn("listing address books shared with user", "error", err)
-		}
-		for _, sh := range bookShares {
-			sharedWithMe = append(sharedWithMe, templates.SharedWithMeItem{
-				Kind: "addressbook", Owner: sh.Owner, Name: sh.AddressBookName, Permission: string(sh.Permission),
-			})
-		}
+	calShares, err := s.dbase.CalendarsSharedWith(username)
+	if err != nil {
+		s.logger.Warn("listing calendars shared with user", "error", err)
+	}
+	for _, sh := range calShares {
+		sharedWithMe = append(sharedWithMe, templates.SharedWithMeItem{
+			Kind: "calendar", Owner: sh.Owner, Name: sh.CalendarName, Permission: string(sh.Permission),
+		})
+	}
+	bookShares, err := s.dbase.AddressBooksSharedWith(username)
+	if err != nil {
+		s.logger.Warn("listing address books shared with user", "error", err)
+	}
+	for _, sh := range bookShares {
+		sharedWithMe = append(sharedWithMe, templates.SharedWithMeItem{
+			Kind: "addressbook", Owner: sh.Owner, Name: sh.AddressBookName, Permission: string(sh.Permission),
+		})
 	}
 
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	_ = templates.Dashboard(username, resources, sharedWithMe).Render(context.Background(), w)
 }
 
+// resourceCards builds the full list of ResourceCards (calendars, then
+// address books) owned by username, each with its current shares — used
+// both for the initial dashboard render and to re-render the whole
+// #resources list after a create/delete (since the set of cards changes,
+// unlike a share update which only changes one card's contents).
+func (s *Server) resourceCards(username string) ([]templates.ResourceCard, error) {
+	var resources []templates.ResourceCard
+
+	calNames, err := s.dbase.ListCalendars(username)
+	if err != nil {
+		return nil, fmt.Errorf("listing calendars: %w", err)
+	}
+	for _, calName := range calNames {
+		card := templates.ResourceCard{Kind: "calendar", Name: calName}
+		shares, err := s.dbase.SharesOfCalendar(username, calName)
+		if err != nil {
+			s.logger.Warn("listing calendar shares", "error", err)
+		}
+		for _, sh := range shares {
+			card.Shares = append(card.Shares, templates.ShareRow{
+				ResourceName: calName,
+				SharedWith:   sh.SharedWith,
+				Permission:   string(sh.Permission),
+			})
+		}
+		resources = append(resources, card)
+	}
+
+	bookNames, err := s.dbase.ListAddressBooks(username)
+	if err != nil {
+		return nil, fmt.Errorf("listing address books: %w", err)
+	}
+	for _, bookName := range bookNames {
+		card := templates.ResourceCard{Kind: "addressbook", Name: bookName}
+		shares, err := s.dbase.SharesOfAddressBook(username, bookName)
+		if err != nil {
+			s.logger.Warn("listing address book shares", "error", err)
+		}
+		for _, sh := range shares {
+			card.Shares = append(card.Shares, templates.ShareRow{
+				ResourceName: bookName,
+				SharedWith:   sh.SharedWith,
+				Permission:   string(sh.Permission),
+			})
+		}
+		resources = append(resources, card)
+	}
+
+	return resources, nil
+}
+
 // resourceCardFor rebuilds a single ResourceCard (used to re-render just
 // the card an htmx request just changed, for partial updates).
 func (s *Server) resourceCardFor(username, kind, name string) (templates.ResourceCard, error) {
 	card := templates.ResourceCard{Kind: kind, Name: name}
-	if s.dbase == nil {
-		return card, nil
-	}
 
 	var shares []templates.ShareRow
 	if kind == "calendar" {

internal/web/resources.go

@@ -0,0 +1,102 @@
+package web
+
+import (
+	"context"
+	"net/http"
+	"regexp"
+	"strings"
+
+	"github.com/yourusername/caldav-server/internal/db"
+	"github.com/yourusername/caldav-server/internal/web/templates"
+)
+
+// resourceNameRe restricts calendar/address book names to characters that
+// are safe as both a URL path segment and a filesystem directory name.
+var resourceNameRe = regexp.MustCompile(`^[a-zA-Z0-9_-]{1,64}$`)
+
+// handleCalendarResource handles POST (create) and DELETE (remove) for
+// the current user's own calendars, mounted at /resources/calendar.
+func (s *Server) handleCalendarResource(w http.ResponseWriter, r *http.Request) {
+	s.handleResource(w, r, "calendar")
+}
+
+func (s *Server) handleAddressBookResource(w http.ResponseWriter, r *http.Request) {
+	s.handleResource(w, r, "addressbook")
+}
+
+func (s *Server) handleResource(w http.ResponseWriter, r *http.Request, kind string) {
+	username := userFromContext(r.Context())
+
+	// htmx v2 sends DELETE request parameters as URL query parameters, not
+	// a request body — unlike POST/PUT/PATCH (see internal/web/shares.go).
+	if r.Method == http.MethodDelete {
+		r.PostForm = r.URL.Query()
+	} else if err := r.ParseForm(); err != nil {
+		http.Error(w, "invalid form", http.StatusBadRequest)
+		return
+	}
+	name := strings.TrimSpace(r.PostForm.Get("name"))
+	if !resourceNameRe.MatchString(name) {
+		http.Error(w, "name must be 1-64 letters, digits, '-' or '_'", http.StatusBadRequest)
+		return
+	}
+
+	collPrefix := "cal-"
+	if kind == "addressbook" {
+		collPrefix = "card-"
+	}
+
+	switch r.Method {
+	case http.MethodPost:
+		var err error
+		if kind == "calendar" {
+			err = s.dbase.CreateCalendar(username, name)
+		} else {
+			err = s.dbase.CreateAddressBook(username, name)
+		}
+		if err != nil {
+			if err == db.ErrResourceExists {
+				http.Error(w, "already exists", http.StatusConflict)
+				return
+			}
+			s.logger.Error("creating resource", "kind", kind, "error", err)
+			http.Error(w, "internal error", http.StatusInternalServerError)
+			return
+		}
+		if err := s.store.EnsureCollection(username, collPrefix+name); err != nil {
+			s.logger.Error("creating resource storage", "kind", kind, "error", err)
+			http.Error(w, "internal error", http.StatusInternalServerError)
+			return
+		}
+	case http.MethodDelete:
+		var err error
+		if kind == "calendar" {
+			err = s.dbase.DeleteCalendar(username, name)
+		} else {
+			err = s.dbase.DeleteAddressBook(username, name)
+		}
+		if err != nil && err != db.ErrResourceNotFound {
+			s.logger.Error("deleting resource", "kind", kind, "error", err)
+			http.Error(w, "internal error", http.StatusInternalServerError)
+			return
+		}
+		if err := s.store.DeleteCollection(username, collPrefix+name); err != nil {
+			s.logger.Warn("deleting resource storage", "kind", kind, "error", err)
+		}
+	default:
+		w.Header().Set("Allow", "POST, DELETE")
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// The set of cards changed (one added/removed), so re-render the
+	// whole #resources list rather than a single card.
+	resources, err := s.resourceCards(username)
+	if err != nil {
+		s.logger.Error("listing resources", "error", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	_ = templates.ResourceList(resources).Render(context.Background(), w)
+}

internal/web/resources_test.go

@@ -0,0 +1,103 @@
+package web
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+)
+
+func TestCreateAndDeleteCalendarViaWebUI(t *testing.T) {
+	s := newTestServer(t)
+	handler := s.Handler(emptyStaticFS{})
+	cookie := loginAs(t, handler, "alice", "password")
+
+	// Create a new calendar.
+	form := url.Values{"name": {"vacation"}}
+	req := httptest.NewRequest(http.MethodPost, "/resources/calendar", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.AddCookie(cookie)
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("create: expected 200, got %d: %s", rr.Code, rr.Body.String())
+	}
+	if !strings.Contains(rr.Body.String(), "vacation") {
+		t.Fatalf("expected resource list to include new calendar, got: %s", rr.Body.String())
+	}
+
+	names, err := s.dbase.ListCalendars("alice")
+	if err != nil {
+		t.Fatalf("ListCalendars: %v", err)
+	}
+	found := false
+	for _, n := range names {
+		if n == "vacation" {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("expected vacation calendar to be registered, got %v", names)
+	}
+
+	// Duplicate creation should fail with 409.
+	req = httptest.NewRequest(http.MethodPost, "/resources/calendar", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.AddCookie(cookie)
+	rr = httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+	if rr.Code != http.StatusConflict {
+		t.Fatalf("expected 409 on duplicate create, got %d", rr.Code)
+	}
+
+	// Delete it — htmx v2 sends DELETE params as a URL query string.
+	req = httptest.NewRequest(http.MethodDelete, "/resources/calendar?name=vacation", nil)
+	req.AddCookie(cookie)
+	rr = httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("delete: expected 200, got %d: %s", rr.Code, rr.Body.String())
+	}
+	if strings.Contains(rr.Body.String(), "vacation") {
+		t.Fatalf("expected resource list to no longer include deleted calendar, got: %s", rr.Body.String())
+	}
+
+	names, err = s.dbase.ListCalendars("alice")
+	if err != nil {
+		t.Fatalf("ListCalendars: %v", err)
+	}
+	for _, n := range names {
+		if n == "vacation" {
+			t.Fatalf("expected vacation calendar to be gone, got %v", names)
+		}
+	}
+}
+
+func TestCreateAddressBookInvalidName(t *testing.T) {
+	s := newTestServer(t)
+	handler := s.Handler(emptyStaticFS{})
+	cookie := loginAs(t, handler, "alice", "password")
+
+	form := url.Values{"name": {"has a space"}}
+	req := httptest.NewRequest(http.MethodPost, "/resources/addressbook", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.AddCookie(cookie)
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+	if rr.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400 for invalid name, got %d", rr.Code)
+	}
+}
+
+func TestDeleteCalendarRequiresLogin(t *testing.T) {
+	s := newTestServer(t)
+	handler := s.Handler(emptyStaticFS{})
+
+	req := httptest.NewRequest(http.MethodDelete, "/resources/calendar?name=work", nil)
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+	if rr.Code != http.StatusSeeOther {
+		t.Fatalf("expected redirect to login, got %d", rr.Code)
+	}
+}

internal/web/server.go

@@ -13,7 +13,6 @@ import (
 	"github.com/yourusername/caldav-server/internal/config"
 	"github.com/yourusername/caldav-server/internal/db"
 	"github.com/yourusername/caldav-server/internal/store"
-	"golang.org/x/crypto/bcrypt"
 )
 
 // Server holds the dependencies needed by the web UI handlers.
@@ -43,19 +42,16 @@ func (s *Server) Handler(staticFS http.FileSystem) http.Handler {
 	mux.HandleFunc("/", s.requireLogin(s.handleDashboard))
 	mux.HandleFunc("/shares/calendar", s.requireLogin(s.handleCalendarShare))
 	mux.HandleFunc("/shares/addressbook", s.requireLogin(s.handleAddressBookShare))
+	mux.HandleFunc("/resources/calendar", s.requireLogin(s.handleCalendarResource))
+	mux.HandleFunc("/resources/addressbook", s.requireLogin(s.handleAddressBookResource))
 
 	return mux
 }
 
-// authenticate validates username/password against the configured users,
-// mirroring internal/auth's Basic Auth check.
+// authenticate validates username/password against the database, mirroring
+// internal/auth's Basic Auth check.
 func (s *Server) authenticate(username, password string) bool {
-	user, ok := s.cfg.Users[username]
-	if !ok {
-		_ = bcrypt.CompareHashAndPassword([]byte("$2b$12$invalidinvalidinvalidinvalidinvalidinval"), []byte(password))
-		return false
-	}
-	return bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)) == nil
+	return s.dbase.VerifyPassword(username, password)
 }
 
 func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {

internal/web/server_test.go

@@ -14,7 +14,6 @@ import (
 	"github.com/yourusername/caldav-server/internal/config"
 	"github.com/yourusername/caldav-server/internal/db"
 	"github.com/yourusername/caldav-server/internal/store"
-	"golang.org/x/crypto/bcrypt"
 )
 
 func newTestServer(t *testing.T) *Server {
@@ -31,16 +30,21 @@ func newTestServer(t *testing.T) *Server {
 	}
 	t.Cleanup(func() { dbase.Close() })
 
-	hash, err := bcrypt.GenerateFromPassword([]byte("password"), bcrypt.MinCost)
-	if err != nil {
-		t.Fatalf("GenerateFromPassword: %v", err)
+	cfg := &config.Config{}
+	if err := dbase.CreateUser("alice", "password", "", ""); err != nil {
+		t.Fatalf("CreateUser alice: %v", err)
 	}
-
-	cfg := &config.Config{
-		Users: map[string]config.UserConfig{
-			"alice": {Password: string(hash), Calendars: []string{"work"}, AddressBooks: []string{"contacts"}},
-			"bob":   {Password: string(hash), Calendars: []string{"personal"}},
-		},
+	if err := dbase.CreateUser("bob", "password", "", ""); err != nil {
+		t.Fatalf("CreateUser bob: %v", err)
+	}
+	if err := dbase.CreateCalendar("alice", "work"); err != nil {
+		t.Fatalf("CreateCalendar alice/work: %v", err)
+	}
+	if err := dbase.CreateAddressBook("alice", "contacts"); err != nil {
+		t.Fatalf("CreateAddressBook alice/contacts: %v", err)
+	}
+	if err := dbase.CreateCalendar("bob", "personal"); err != nil {
+		t.Fatalf("CreateCalendar bob/personal: %v", err)
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
 	return NewServer(cfg, st, dbase, logger)

internal/web/shares.go

@@ -24,11 +24,6 @@ func (s *Server) handleAddressBookShare(w http.ResponseWriter, r *http.Request)
 func (s *Server) handleShare(w http.ResponseWriter, r *http.Request, kind string) {
 	username := userFromContext(r.Context())
 
-	if s.dbase == nil {
-		http.Error(w, "sharing is not available (no database configured)", http.StatusServiceUnavailable)
-		return
-	}
-
 	// htmx v2 sends DELETE request parameters (including hx-vals) as URL
 	// query parameters, not a request body — unlike POST/PUT/PATCH.
 	if r.Method == http.MethodDelete {
@@ -100,15 +95,18 @@ func (s *Server) handleShare(w http.ResponseWriter, r *http.Request, kind string
 // actually configured for username, to prevent sharing arbitrary/other
 // users' resources via a forged form post.
 func (s *Server) ownsResource(username, kind, resource string) bool {
-	user, ok := s.cfg.Users[username]
-	if !ok {
-		return false
-	}
-	var list []string
+	var (
+		list []string
+		err  error
+	)
 	if kind == "calendar" {
-		list = user.Calendars
+		list, err = s.dbase.ListCalendars(username)
 	} else {
-		list = user.AddressBooks
+		list, err = s.dbase.ListAddressBooks(username)
+	}
+	if err != nil {
+		s.logger.Warn("checking resource ownership", "kind", kind, "error", err)
+		return false
 	}
 	for _, n := range list {
 		if n == resource {

internal/web/templates/dashboard.templ

@@ -28,12 +28,48 @@ type SharedWithMeItem struct {
 templ Dashboard(username string, resources []ResourceCard, sharedWithMe []SharedWithMeItem) {
 	@Layout("Dashboard", username) {
 		<h1 class="text-2xl font-semibold mb-6">Your calendars &amp; address books</h1>
-		<div id="resources" class="space-y-6">
-			for _, r := range resources {
-				@ResourceCardView(r)
-			}
+
+		<div class="flex gap-4 mb-6">
+			<form
+				class="flex items-end gap-2 bg-white rounded-lg border border-gray-200 p-4"
+				hx-post="/web/resources/calendar"
+				hx-target="#resources"
+				hx-swap="outerHTML"
+				hx-on::after-request="if(event.detail.successful) this.reset()"
+			>
+				<div>
+					<label class="block text-xs text-gray-500 mb-1">New calendar</label>
+					<input name="name" type="text" required pattern="[a-zA-Z0-9_-]{1,64}"
+						placeholder="e.g. work"
+						class="rounded-md border-gray-300 border px-2 py-1.5 text-sm"/>
+				</div>
+				<button type="submit"
+					class="bg-indigo-600 text-white rounded-md px-3 py-1.5 text-sm font-medium hover:bg-indigo-700">
+					Add
+				</button>
+			</form>
+			<form
+				class="flex items-end gap-2 bg-white rounded-lg border border-gray-200 p-4"
+				hx-post="/web/resources/addressbook"
+				hx-target="#resources"
+				hx-swap="outerHTML"
+				hx-on::after-request="if(event.detail.successful) this.reset()"
+			>
+				<div>
+					<label class="block text-xs text-gray-500 mb-1">New address book</label>
+					<input name="name" type="text" required pattern="[a-zA-Z0-9_-]{1,64}"
+						placeholder="e.g. contacts"
+						class="rounded-md border-gray-300 border px-2 py-1.5 text-sm"/>
+				</div>
+				<button type="submit"
+					class="bg-indigo-600 text-white rounded-md px-3 py-1.5 text-sm font-medium hover:bg-indigo-700">
+					Add
+				</button>
+			</form>
 		</div>
 
+		@ResourceList(resources)
+
 		if len(sharedWithMe) > 0 {
 			<h2 class="text-xl font-semibold mt-10 mb-4">Shared with you</h2>
 			<ul class="divide-y divide-gray-200 bg-white rounded-lg border border-gray-200">
@@ -51,6 +87,22 @@ templ Dashboard(username string, resources []ResourceCard, sharedWithMe []Shared
 	}
 }
 
+// ResourceList renders the #resources container. It's re-rendered as a
+// whole after a create/delete (which changes the set of cards), whereas a
+// share update only swaps a single ResourceCardView.
+templ ResourceList(resources []ResourceCard) {
+	<div id="resources" class="space-y-6">
+		for _, r := range resources {
+			@ResourceCardView(r)
+		}
+		if len(resources) == 0 {
+			<p class="text-sm text-gray-400">
+				You don't have any calendars or address books yet — add one above.
+			</p>
+		}
+	</div>
+}
+
 templ ResourceCardView(r ResourceCard) {
 	<div id={ "resource-" + r.Kind + "-" + r.Name } class="bg-white rounded-lg border border-gray-200 p-5">
 		<div class="flex items-center justify-between mb-3">
@@ -58,6 +110,16 @@ templ ResourceCardView(r ResourceCard) {
 				{ r.Name }
 				<span class="text-xs uppercase tracking-wide text-gray-400 ml-2">{ r.Kind }</span>
 			</h2>
+			<button
+				class="text-red-600 hover:underline text-xs"
+				hx-delete={ resourceEndpoint(r.Kind) }
+				hx-vals={ resourceVals(r.Name) }
+				hx-target="#resources"
+				hx-swap="outerHTML"
+				hx-confirm={ "Delete " + r.Kind + " " + r.Name + "? This removes all its data and cannot be undone." }
+			>
+				Delete
+			</button>
 		</div>
 
 		<ul class="divide-y divide-gray-100 mb-4">
@@ -121,3 +183,15 @@ func shareEndpoint(kind string) string {
 func shareVals(resource, sharedWith string) string {
 	return `{"resource": "` + resource + `", "shared_with": "` + sharedWith + `"}`
 }
+
+func resourceEndpoint(kind string) string {
+	if kind == "calendar" {
+		return "/web/resources/calendar"
+	}
+	return "/web/resources/addressbook"
+}
+
+func resourceVals(name string) string {
+	return `{"name": "` + name + `"}`
+}
+

internal/web/templates/dashboard_templ.go

@@ -66,17 +66,15 @@ func Dashboard(username string, resources []ResourceCard, sharedWithMe []SharedW
 				}()
 			}
 			ctx = templ.InitializeContext(ctx)
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<h1 class=\"text-2xl font-semibold mb-6\">Your calendars &amp; address books</h1><div id=\"resources\" class=\"space-y-6\">")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<h1 class=\"text-2xl font-semibold mb-6\">Your calendars &amp; address books</h1><div class=\"flex gap-4 mb-6\"><form class=\"flex items-end gap-2 bg-white rounded-lg border border-gray-200 p-4\" hx-post=\"/web/resources/calendar\" hx-target=\"#resources\" hx-swap=\"outerHTML\" hx-on::after-request=\"if(event.detail.successful) this.reset()\"><div><label class=\"block text-xs text-gray-500 mb-1\">New calendar</label> <input name=\"name\" type=\"text\" required pattern=\"[a-zA-Z0-9_-]{1,64}\" placeholder=\"e.g. work\" class=\"rounded-md border-gray-300 border px-2 py-1.5 text-sm\"></div><button type=\"submit\" class=\"bg-indigo-600 text-white rounded-md px-3 py-1.5 text-sm font-medium hover:bg-indigo-700\">Add</button></form><form class=\"flex items-end gap-2 bg-white rounded-lg border border-gray-200 p-4\" hx-post=\"/web/resources/addressbook\" hx-target=\"#resources\" hx-swap=\"outerHTML\" hx-on::after-request=\"if(event.detail.successful) this.reset()\"><div><label class=\"block text-xs text-gray-500 mb-1\">New address book</label> <input name=\"name\" type=\"text\" required pattern=\"[a-zA-Z0-9_-]{1,64}\" placeholder=\"e.g. contacts\" class=\"rounded-md border-gray-300 border px-2 py-1.5 text-sm\"></div><button type=\"submit\" class=\"bg-indigo-600 text-white rounded-md px-3 py-1.5 text-sm font-medium hover:bg-indigo-700\">Add</button></form></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			for _, r := range resources {
-				templ_7745c5c3_Err = ResourceCardView(r).Render(ctx, templ_7745c5c3_Buffer)
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
+			templ_7745c5c3_Err = ResourceList(resources).Render(ctx, templ_7745c5c3_Buffer)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, " ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -93,7 +91,7 @@ func Dashboard(username string, resources []ResourceCard, sharedWithMe []SharedW
 					var templ_7745c5c3_Var3 string
 					templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.JoinStringErrs(item.Owner)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 43, Col: 45}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 79, Col: 45}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var3))
 					if templ_7745c5c3_Err != nil {
@@ -106,7 +104,7 @@ func Dashboard(username string, resources []ResourceCard, sharedWithMe []SharedW
 					var templ_7745c5c3_Var4 string
 					templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.JoinStringErrs(item.Name)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 43, Col: 68}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 79, Col: 68}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var4))
 					if templ_7745c5c3_Err != nil {
@@ -119,7 +117,7 @@ func Dashboard(username string, resources []ResourceCard, sharedWithMe []SharedW
 					var templ_7745c5c3_Var5 string
 					templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.JoinStringErrs(item.Kind)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 44, Col: 47}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 80, Col: 47}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var5))
 					if templ_7745c5c3_Err != nil {
@@ -132,7 +130,7 @@ func Dashboard(username string, resources []ResourceCard, sharedWithMe []SharedW
 					var templ_7745c5c3_Var6 string
 					templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.JoinStringErrs(item.Permission)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 46, Col: 83}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 82, Col: 83}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var6))
 					if templ_7745c5c3_Err != nil {
@@ -158,7 +156,10 @@ func Dashboard(username string, resources []ResourceCard, sharedWithMe []SharedW
 	})
 }
 
-func ResourceCardView(r ResourceCard) templ.Component {
+// ResourceList renders the #resources container. It's re-rendered as a
+// whole after a create/delete (which changes the set of cards), whereas a
+// share update only swaps a single ResourceCardView.
+func ResourceList(resources []ResourceCard) templ.Component {
 	return templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
 		templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
 		if templ_7745c5c3_CtxErr := ctx.Err(); templ_7745c5c3_CtxErr != nil {
@@ -179,179 +180,263 @@ func ResourceCardView(r ResourceCard) templ.Component {
 			templ_7745c5c3_Var7 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "<div id=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "<div id=\"resources\" class=\"space-y-6\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var8 string
-		templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.ResolveAttributeValue("resource-" + r.Kind + "-" + r.Name)
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 55, Col: 46}
+		for _, r := range resources {
+			templ_7745c5c3_Err = ResourceCardView(r).Render(ctx, templ_7745c5c3_Buffer)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var8)
+		if len(resources) == 0 {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "<p class=\"text-sm text-gray-400\">You don't have any calendars or address books yet — add one above.</p>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "</div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "\" class=\"bg-white rounded-lg border border-gray-200 p-5\"><div class=\"flex items-center justify-between mb-3\"><h2 class=\"font-medium\">")
+		return nil
+	})
+}
+
+func ResourceCardView(r ResourceCard) templ.Component {
+	return templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
+		templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
+		if templ_7745c5c3_CtxErr := ctx.Err(); templ_7745c5c3_CtxErr != nil {
+			return templ_7745c5c3_CtxErr
+		}
+		templ_7745c5c3_Buffer, templ_7745c5c3_IsBuffer := templruntime.GetBuffer(templ_7745c5c3_W)
+		if !templ_7745c5c3_IsBuffer {
+			defer func() {
+				templ_7745c5c3_BufErr := templruntime.ReleaseBuffer(templ_7745c5c3_Buffer)
+				if templ_7745c5c3_Err == nil {
+					templ_7745c5c3_Err = templ_7745c5c3_BufErr
+				}
+			}()
+		}
+		ctx = templ.InitializeContext(ctx)
+		templ_7745c5c3_Var8 := templ.GetChildren(ctx)
+		if templ_7745c5c3_Var8 == nil {
+			templ_7745c5c3_Var8 = templ.NopComponent
+		}
+		ctx = templ.ClearChildren(ctx)
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "<div id=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var9 string
-		templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs(r.Name)
+		templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.ResolveAttributeValue("resource-" + r.Kind + "-" + r.Name)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 58, Col: 12}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 107, Col: 46}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var9)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, " <span class=\"text-xs uppercase tracking-wide text-gray-400 ml-2\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "\" class=\"bg-white rounded-lg border border-gray-200 p-5\"><div class=\"flex items-center justify-between mb-3\"><h2 class=\"font-medium\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var10 string
-		templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(r.Kind)
+		templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(r.Name)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 59, Col: 77}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 110, Col: 12}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "</span></h2></div><ul class=\"divide-y divide-gray-100 mb-4\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, " <span class=\"text-xs uppercase tracking-wide text-gray-400 ml-2\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var11 string
+		templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(r.Kind)
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 111, Col: 77}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "</span></h2><button class=\"text-red-600 hover:underline text-xs\" hx-delete=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var12 string
+		templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.ResolveAttributeValue(resourceEndpoint(r.Kind))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 115, Col: 40}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var12)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "\" hx-vals=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var13 string
+		templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.ResolveAttributeValue(resourceVals(r.Name))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 116, Col: 34}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var13)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "\" hx-target=\"#resources\" hx-swap=\"outerHTML\" hx-confirm=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var14 string
+		templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.ResolveAttributeValue("Delete " + r.Kind + " " + r.Name + "? This removes all its data and cannot be undone.")
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 119, Col: 104}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var14)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "\">Delete</button></div><ul class=\"divide-y divide-gray-100 mb-4\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		for _, sh := range r.Shares {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "<li class=\"py-2 flex items-center justify-between text-sm\"><span>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var11 string
-			templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(sh.SharedWith)
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 66, Col: 26}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "</span> <span class=\"flex items-center gap-3\"><span class=\"text-xs uppercase tracking-wide text-gray-500\">")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var12 string
-			templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.JoinStringErrs(sh.Permission)
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 68, Col: 81}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var12))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "</span> <button class=\"text-red-600 hover:underline text-xs\" hx-delete=\"")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var13 string
-			templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.ResolveAttributeValue(shareEndpoint(r.Kind))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 71, Col: 40}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var13)
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "\" hx-vals=\"")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var14 string
-			templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.ResolveAttributeValue(shareVals(r.Name, sh.SharedWith))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 72, Col: 49}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var14)
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "\" hx-target=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "<li class=\"py-2 flex items-center justify-between text-sm\"><span>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var15 string
-			templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.ResolveAttributeValue("#resource-" + r.Kind + "-" + r.Name)
+			templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.JoinStringErrs(sh.SharedWith)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 73, Col: 55}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 128, Col: 26}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var15)
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var15))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "\" hx-swap=\"outerHTML\" hx-confirm=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "</span> <span class=\"flex items-center gap-3\"><span class=\"text-xs uppercase tracking-wide text-gray-500\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var16 string
-			templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.ResolveAttributeValue("Remove access for " + sh.SharedWith + "?")
+			templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.JoinStringErrs(sh.Permission)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 75, Col: 62}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 130, Col: 81}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var16)
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var16))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "\">Remove</button></span></li>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "</span> <button class=\"text-red-600 hover:underline text-xs\" hx-delete=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var17 string
+			templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.ResolveAttributeValue(shareEndpoint(r.Kind))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 133, Col: 40}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var17)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "\" hx-vals=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var18 string
+			templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.ResolveAttributeValue(shareVals(r.Name, sh.SharedWith))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 134, Col: 49}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var18)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "\" hx-target=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var19 string
+			templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.ResolveAttributeValue("#resource-" + r.Kind + "-" + r.Name)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 135, Col: 55}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var19)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, "\" hx-swap=\"outerHTML\" hx-confirm=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var20 string
+			templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.ResolveAttributeValue("Remove access for " + sh.SharedWith + "?")
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 137, Col: 62}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var20)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "\">Remove</button></span></li>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
 		if len(r.Shares) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "<li class=\"py-2 text-sm text-gray-400\">Not shared with anyone yet.</li>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "<li class=\"py-2 text-sm text-gray-400\">Not shared with anyone yet.</li>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "</ul><form class=\"flex items-end gap-2\" hx-post=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "</ul><form class=\"flex items-end gap-2\" hx-post=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var17 string
-		templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.ResolveAttributeValue(shareEndpoint(r.Kind))
+		var templ_7745c5c3_Var21 string
+		templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.ResolveAttributeValue(shareEndpoint(r.Kind))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 89, Col: 34}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 151, Col: 34}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var17)
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var21)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "\" hx-target=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "\" hx-target=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var18 string
-		templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.ResolveAttributeValue("#resource-" + r.Kind + "-" + r.Name)
+		var templ_7745c5c3_Var22 string
+		templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.ResolveAttributeValue("#resource-" + r.Kind + "-" + r.Name)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 90, Col: 51}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 152, Col: 51}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var18)
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var22)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "\" hx-swap=\"outerHTML\"><input type=\"hidden\" name=\"resource\" value=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "\" hx-swap=\"outerHTML\"><input type=\"hidden\" name=\"resource\" value=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var19 string
-		templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.ResolveAttributeValue(r.Name)
+		var templ_7745c5c3_Var23 string
+		templ_7745c5c3_Var23, templ_7745c5c3_Err = templ.ResolveAttributeValue(r.Name)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 93, Col: 54}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/templates/dashboard.templ`, Line: 155, Col: 54}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var19)
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var23)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, "\"><div class=\"flex-1\"><label class=\"block text-xs text-gray-500 mb-1\">Username</label> <input name=\"shared_with\" type=\"text\" required class=\"w-full rounded-md border-gray-300 border px-2 py-1.5 text-sm\"></div><div><label class=\"block text-xs text-gray-500 mb-1\">Permission</label> <select name=\"permission\" class=\"rounded-md border-gray-300 border px-2 py-1.5 text-sm\"><option value=\"read\">read</option> <option value=\"write\">write</option></select></div><button type=\"submit\" class=\"bg-indigo-600 text-white rounded-md px-3 py-1.5 text-sm font-medium hover:bg-indigo-700\">Share</button></form></div>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "\"><div class=\"flex-1\"><label class=\"block text-xs text-gray-500 mb-1\">Username</label> <input name=\"shared_with\" type=\"text\" required class=\"w-full rounded-md border-gray-300 border px-2 py-1.5 text-sm\"></div><div><label class=\"block text-xs text-gray-500 mb-1\">Permission</label> <select name=\"permission\" class=\"rounded-md border-gray-300 border px-2 py-1.5 text-sm\"><option value=\"read\">read</option> <option value=\"write\">write</option></select></div><button type=\"submit\" class=\"bg-indigo-600 text-white rounded-md px-3 py-1.5 text-sm font-medium hover:bg-indigo-700\">Share</button></form></div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -370,4 +455,15 @@ func shareVals(resource, sharedWith string) string {
 	return `{"resource": "` + resource + `", "shared_with": "` + sharedWith + `"}`
 }
 
+func resourceEndpoint(kind string) string {
+	if kind == "calendar" {
+		return "/web/resources/calendar"
+	}
+	return "/web/resources/addressbook"
+}
+
+func resourceVals(name string) string {
+	return `{"name": "` + name + `"}`
+}
+
 var _ = templruntime.GeneratedTemplate