Add calendar/address-book sharing backend

Introduce internal/db, a small SQLite-backed store (pure-Go
modernc.org/sqlite, no CGO) at <data_dir>/nidus.db holding
calendar_shares and addressbook_shares grant tables (owner, resource
name, shared-with user, read/write permission). This is the first step
towards user management and a web UI: a real datastore that a future
admin CLI/UI can build on, instead of the static config.yaml.

Wire sharing into the CalDAV/CardDAV backends:
- ListCalendars/ListAddressBooks now also include resources shared with
  the requesting user, exposed under the synthetic local name
  "<owner>~<name>" in the grantee's own home-set — no separate account,
  no data copying, the object still physically lives under the owner's
  store.Store namespace.
- All read paths (Get/List/QueryCalendarObjects, address book
  equivalents) resolve the synthetic name back to (owner, real name) and
  require any share (read or write) to exist.
- All write paths (Put/Delete object, DeleteCalendar/AddressBook)
  additionally require a write-permission share; read-only shares get a
  403 Forbidden.
- CreateCalendar/CreateAddressBook remain scoped to the acting user's own
  namespace — sharing an existing collection is done via ShareCalendar/
  ShareAddressBook, not by creating one directly in someone else's name.

Add internal/db/shares_test.go (grant/lookup/update/unshare/list
semantics) and internal/{caldav,carddav}/backend_test.go (shared
calendar/address book visibility, write permission enforcement,
unauthorized access rejection). Update README (features, new "Sharing
calendars and address books" section, project layout, dependencies) and
copilot-instructions.md to document the new package and sharing model.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

internal/caldav/backend.go

@@ -14,24 +14,34 @@ import (
 	"github.com/emersion/go-webdav/caldav"
 	"github.com/yourusername/caldav-server/internal/auth"
 	"github.com/yourusername/caldav-server/internal/config"
+	"github.com/yourusername/caldav-server/internal/db"
 	"github.com/yourusername/caldav-server/internal/store"
 )
 
+// sharedNameSep separates the owner from the calendar name in the
+// synthetic name used for calendars shared with another user, e.g.
+// "alice~work" for alice's "work" calendar as seen by whoever it was
+// shared with. It must not collide with characters allowed in real
+// calendar names (validated wherever calendar names are taken as input).
+const sharedNameSep = "~"
+
 // Backend implements caldav.Backend using a filesystem store.
 type Backend struct {
 	cfg    *config.Config
 	store  *store.Store
+	dbase  *db.DB // may be nil if sharing is not configured
 	logger *slog.Logger
 }
 
-// NewBackend creates a CalDAV backend.
-func NewBackend(cfg *config.Config, st *store.Store, logger *slog.Logger) *Backend {
-	return &Backend{cfg: cfg, store: st, logger: logger}
+// NewBackend creates a CalDAV backend. dbase may be nil, in which case
+// calendar sharing is disabled (only a user's own calendars are visible).
+func NewBackend(cfg *config.Config, st *store.Store, dbase *db.DB, logger *slog.Logger) *Backend {
+	return &Backend{cfg: cfg, store: st, dbase: dbase, logger: logger}
 }
 
 // NewHandler returns an http.Handler for the /cal/ prefix.
-func NewHandler(cfg *config.Config, st *store.Store, logger *slog.Logger) http.Handler {
-	b := NewBackend(cfg, st, logger)
+func NewHandler(cfg *config.Config, st *store.Store, dbase *db.DB, logger *slog.Logger) http.Handler {
+	b := NewBackend(cfg, st, dbase, logger)
 	return &caldav.Handler{Backend: b}
 }
 
@@ -74,7 +84,7 @@ func (b *Backend) ListCalendars(ctx context.Context) ([]caldav.Calendar, error)
 			b.logger.Warn("ensuring calendar directory", "calendar", name, "error", err)
 			continue
 		}
-		cals = append(cals, b.calendarMeta(p.Username, name))
+		cals = append(cals, b.calendarMeta(p.Username, name, name))
 	}
 
 	// Also include any extra calendars that exist on disk but aren't in config
@@ -86,7 +96,22 @@ func (b *Backend) ListCalendars(ctx context.Context) ([]caldav.Calendar, error)
 	for _, dir := range disk {
 		if strings.HasPrefix(dir, "cal-") && !configured[dir] {
 			name := strings.TrimPrefix(dir, "cal-")
-			cals = append(cals, b.calendarMeta(p.Username, name))
+			cals = append(cals, b.calendarMeta(p.Username, name, name))
+		}
+	}
+
+	// Include calendars other users have shared with this one.
+	if b.dbase != nil {
+		shares, err := b.dbase.CalendarsSharedWith(p.Username)
+		if err != nil {
+			b.logger.Warn("listing shared calendars", "error", err)
+		}
+		for _, sh := range shares {
+			if _, err := b.store.GetCollection(sh.Owner, "cal-"+sh.CalendarName); err != nil {
+				continue // owner's calendar no longer exists
+			}
+			localName := sharedCalendarName(sh.Owner, sh.CalendarName)
+			cals = append(cals, b.calendarMeta(sh.Owner, sh.CalendarName, localName))
 		}
 	}
 
@@ -94,24 +119,32 @@ func (b *Backend) ListCalendars(ctx context.Context) ([]caldav.Calendar, error)
 }
 
 func (b *Backend) GetCalendar(ctx context.Context, calPath string) (*caldav.Calendar, error) {
-	user, name, err := b.parseCalPath(ctx, calPath)
+	requester, localName, err := b.parseCalPath(ctx, calPath)
 	if err != nil {
 		return nil, err
 	}
-	if _, err := b.store.GetCollection(user, "cal-"+name); err != nil {
+	owner, realName, _, err := b.resolveCalendar(requester, localName, false)
+	if err != nil {
+		return nil, err
+	}
+	if _, err := b.store.GetCollection(owner, "cal-"+realName); err != nil {
 		return nil, webdav.NewHTTPError(http.StatusNotFound, err)
 	}
-	cal := b.calendarMeta(user, name)
+	cal := b.calendarMeta(owner, realName, localName)
 	return &cal, nil
 }
 
 func (b *Backend) GetCalendarObject(ctx context.Context, objPath string, req *caldav.CalendarCompRequest) (*caldav.CalendarObject, error) {
-	user, calName, objID, err := b.parseObjPath(ctx, objPath)
+	requester, localName, objID, err := b.parseObjPath(ctx, objPath)
+	if err != nil {
+		return nil, err
+	}
+	owner, realName, _, err := b.resolveCalendar(requester, localName, false)
 	if err != nil {
 		return nil, err
 	}
 
-	data, err := b.store.GetObject(user, "cal-"+calName, objID)
+	data, err := b.store.GetObject(owner, "cal-"+realName, objID)
 	if err != nil {
 		return nil, webdav.NewHTTPError(http.StatusNotFound, err)
 	}
@@ -120,23 +153,27 @@ func (b *Backend) GetCalendarObject(ctx context.Context, objPath string, req *ca
 }
 
 func (b *Backend) ListCalendarObjects(ctx context.Context, calPath string, req *caldav.CalendarCompRequest) ([]caldav.CalendarObject, error) {
-	user, calName, err := b.parseCalPath(ctx, calPath)
+	requester, localName, err := b.parseCalPath(ctx, calPath)
+	if err != nil {
+		return nil, err
+	}
+	owner, realName, _, err := b.resolveCalendar(requester, localName, false)
 	if err != nil {
 		return nil, err
 	}
 
-	ids, err := b.store.ListObjects(user, "cal-"+calName)
+	ids, err := b.store.ListObjects(owner, "cal-"+realName)
 	if err != nil {
 		return nil, err
 	}
 
 	var objs []caldav.CalendarObject
 	for _, id := range ids {
-		data, err := b.store.GetObject(user, "cal-"+calName, id)
+		data, err := b.store.GetObject(owner, "cal-"+realName, id)
 		if err != nil {
 			continue
 		}
-		obj, err := b.decodeObject(calObjectPath(calName, id), data)
+		obj, err := b.decodeObject(calObjectPath(localName, id), data)
 		if err != nil {
 			b.logger.Warn("decoding calendar object", "id", id, "error", err)
 			continue
@@ -160,21 +197,32 @@ func (b *Backend) CreateCalendar(ctx context.Context, calendar *caldav.Calendar)
 	if p == nil {
 		return webdav.NewHTTPError(http.StatusUnauthorized, fmt.Errorf("not authenticated"))
 	}
-	// Derive collection name from the trailing path segment.
+	// Derive collection name from the trailing path segment. Calendars are
+	// always created under the acting user's own namespace — sharing an
+	// existing calendar is done via ShareCalendar, not by creating one
+	// directly in someone else's name.
 	name := path.Base(strings.TrimSuffix(calendar.Path, "/"))
 	return b.store.EnsureCollection(p.Username, "cal-"+name)
 }
 
 func (b *Backend) DeleteCalendar(ctx context.Context, calPath string) error {
-	user, name, err := b.parseCalPath(ctx, calPath)
+	requester, localName, err := b.parseCalPath(ctx, calPath)
 	if err != nil {
 		return err
 	}
-	return b.store.DeleteCollection(user, "cal-"+name)
+	owner, realName, _, err := b.resolveCalendar(requester, localName, true)
+	if err != nil {
+		return err
+	}
+	return b.store.DeleteCollection(owner, "cal-"+realName)
 }
 
 func (b *Backend) PutCalendarObject(ctx context.Context, objPath string, calendar *ical.Calendar, opts *caldav.PutCalendarObjectOptions) (*caldav.CalendarObject, error) {
-	user, calName, objID, err := b.parseObjPath(ctx, objPath)
+	requester, localName, objID, err := b.parseObjPath(ctx, objPath)
+	if err != nil {
+		return nil, err
+	}
+	owner, realName, _, err := b.resolveCalendar(requester, localName, true)
 	if err != nil {
 		return nil, err
 	}
@@ -186,7 +234,7 @@ func (b *Backend) PutCalendarObject(ctx context.Context, objPath string, calenda
 	}
 
 	data := []byte(buf.String())
-	if err := b.store.PutObject(user, "cal-"+calName, objID, data); err != nil {
+	if err := b.store.PutObject(owner, "cal-"+realName, objID, data); err != nil {
 		return nil, fmt.Errorf("storing calendar object: %w", err)
 	}
 
@@ -194,11 +242,15 @@ func (b *Backend) PutCalendarObject(ctx context.Context, objPath string, calenda
 }
 
 func (b *Backend) DeleteCalendarObject(ctx context.Context, objPath string) error {
-	user, calName, objID, err := b.parseObjPath(ctx, objPath)
+	requester, localName, objID, err := b.parseObjPath(ctx, objPath)
 	if err != nil {
 		return err
 	}
-	if err := b.store.DeleteObject(user, "cal-"+calName, objID); err != nil {
+	owner, realName, _, err := b.resolveCalendar(requester, localName, true)
+	if err != nil {
+		return err
+	}
+	if err := b.store.DeleteObject(owner, "cal-"+realName, objID); err != nil {
 		return webdav.NewHTTPError(http.StatusNotFound, err)
 	}
 	return nil
@@ -206,11 +258,44 @@ func (b *Backend) DeleteCalendarObject(ctx context.Context, objPath string) erro
 
 // -------- helpers --------
 
-func (b *Backend) calendarMeta(user, name string) caldav.Calendar {
+// sharedCalendarName builds the synthetic local name a shared calendar is
+// exposed under to the user it was shared with.
+func sharedCalendarName(owner, calName string) string {
+	return owner + sharedNameSep + calName
+}
+
+// resolveCalendar maps a local calendar name (as seen in a URL path by
+// requester) to its real owner and on-disk name, checking permissions
+// along the way. If localName contains sharedNameSep, it's treated as a
+// reference to another user's calendar and looked up in the shares table;
+// otherwise it's assumed to be one of requester's own calendars.
+//
+// If requireWrite is true, a share must grant PermWrite or this returns a
+// 403 Forbidden error. Owners always have full access to their own
+// calendars.
+func (b *Backend) resolveCalendar(requester, localName string, requireWrite bool) (owner, realName string, perm db.Permission, err error) {
+	if ownerName, calName, ok := strings.Cut(localName, sharedNameSep); ok {
+		if b.dbase == nil {
+			return "", "", "", webdav.NewHTTPError(http.StatusNotFound, fmt.Errorf("sharing not enabled"))
+		}
+		share, err := b.dbase.CalendarShareFor(ownerName, calName, requester)
+		if err != nil {
+			return "", "", "", webdav.NewHTTPError(http.StatusForbidden, fmt.Errorf("calendar not shared with you"))
+		}
+		if requireWrite && share.Permission != db.PermWrite {
+			return "", "", "", webdav.NewHTTPError(http.StatusForbidden, fmt.Errorf("read-only share"))
+		}
+		return ownerName, calName, share.Permission, nil
+	}
+	return requester, localName, db.PermWrite, nil
+}
+
+func (b *Backend) calendarMeta(owner, realName, localName string) caldav.Calendar {
+	desc := fmt.Sprintf("%s's %s calendar", owner, realName)
 	return caldav.Calendar{
-		Path:                  calHomePath() + name + "/",
-		Name:                  name,
-		Description:           fmt.Sprintf("%s's %s calendar", user, name),
+		Path:                  calHomePath() + localName + "/",
+		Name:                  localName,
+		Description:           desc,
 		SupportedComponentSet: []string{"VEVENT", "VTODO", "VJOURNAL"},
 		MaxResourceSize:       10 * 1024 * 1024, // 10 MiB
 	}

internal/caldav/backend_test.go

@@ -0,0 +1,144 @@
+package caldav
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"log/slog"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	ical "github.com/emersion/go-ical"
+	"github.com/yourusername/caldav-server/internal/auth"
+	"github.com/yourusername/caldav-server/internal/config"
+	"github.com/yourusername/caldav-server/internal/db"
+	"github.com/yourusername/caldav-server/internal/store"
+)
+
+func newTestBackend(t *testing.T) (*Backend, *db.DB) {
+	t.Helper()
+	dir := t.TempDir()
+
+	st, err := store.NewStore(filepath.Join(dir, "data"))
+	if err != nil {
+		t.Fatalf("NewStore: %v", err)
+	}
+	dbase, err := db.Open(filepath.Join(dir, "test.db"))
+	if err != nil {
+		t.Fatalf("db.Open: %v", err)
+	}
+	t.Cleanup(func() { dbase.Close() })
+
+	cfg := &config.Config{
+		Users: map[string]config.UserConfig{
+			"alice": {Calendars: []string{"work"}},
+			"bob":   {Calendars: []string{"personal"}},
+		},
+	}
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+	return NewBackend(cfg, st, dbase, logger), dbase
+}
+
+func ctxFor(username string) context.Context {
+	return auth.NewContext(context.Background(), &auth.Principal{Username: username})
+}
+
+// minimalEvent returns a minimal, valid VCALENDAR/VEVENT for use in tests.
+func minimalEvent() *ical.Calendar {
+	const raw = "BEGIN:VCALENDAR\r\n" +
+		"VERSION:2.0\r\n" +
+		"PRODID:-//nidus//test//EN\r\n" +
+		"BEGIN:VEVENT\r\n" +
+		"UID:event1@nidus.test\r\n" +
+		"DTSTAMP:20240101T000000Z\r\n" +
+		"DTSTART:20240101T100000Z\r\n" +
+		"SUMMARY:Test Event\r\n" +
+		"END:VEVENT\r\n" +
+		"END:VCALENDAR\r\n"
+	cal, err := ical.NewDecoder(strings.NewReader(raw)).Decode()
+	if err != nil {
+		panic(fmt.Sprintf("minimalEvent: %v", err))
+	}
+	return cal
+}
+
+func TestListCalendarsIncludesSharedCalendar(t *testing.T) {
+	b, dbase := newTestBackend(t)
+
+	if err := dbase.ShareCalendar("alice", "work", "bob", db.PermRead); err != nil {
+		t.Fatalf("ShareCalendar: %v", err)
+	}
+	// The shared calendar must exist on disk for it to be listed; normally
+	// this happens when alice's own ListCalendars runs and ensures it.
+	if _, err := b.ListCalendars(ctxFor("alice")); err != nil {
+		t.Fatalf("ListCalendars(alice): %v", err)
+	}
+
+	cals, err := b.ListCalendars(ctxFor("bob"))
+	if err != nil {
+		t.Fatalf("ListCalendars: %v", err)
+	}
+
+	var found bool
+	wantName := sharedCalendarName("alice", "work")
+	for _, c := range cals {
+		if c.Name == wantName {
+			found = true
+		}
+	}
+	if !found {
+		t.Errorf("shared calendar %q not found in ListCalendars result: %+v", wantName, cals)
+	}
+}
+
+func TestSharedCalendarReadOnlyRejectsWrite(t *testing.T) {
+	b, dbase := newTestBackend(t)
+
+	if err := dbase.ShareCalendar("alice", "work", "bob", db.PermRead); err != nil {
+		t.Fatalf("ShareCalendar: %v", err)
+	}
+
+	localName := sharedCalendarName("alice", "work")
+	objPath := calObjectPath(localName, "event1.ics")
+
+	_, err := b.PutCalendarObject(ctxFor("bob"), objPath, minimalEvent(), nil)
+	if err == nil {
+		t.Fatal("expected error writing to read-only shared calendar, got nil")
+	}
+}
+
+func TestSharedCalendarWriteAllowed(t *testing.T) {
+	b, dbase := newTestBackend(t)
+
+	if err := dbase.ShareCalendar("alice", "work", "bob", db.PermWrite); err != nil {
+		t.Fatalf("ShareCalendar: %v", err)
+	}
+
+	localName := sharedCalendarName("alice", "work")
+	objPath := calObjectPath(localName, "event1.ics")
+
+	if _, err := b.PutCalendarObject(ctxFor("bob"), objPath, minimalEvent(), nil); err != nil {
+		t.Fatalf("PutCalendarObject with write share: %v", err)
+	}
+
+	// The object should now be visible under alice's own calendar too,
+	// since it's stored in her namespace.
+	obj, err := b.GetCalendarObject(ctxFor("alice"), calObjectPath("work", "event1.ics"), nil)
+	if err != nil {
+		t.Fatalf("GetCalendarObject as owner: %v", err)
+	}
+	if obj == nil {
+		t.Fatal("expected non-nil object")
+	}
+}
+
+func TestUnauthorizedUserCannotAccessUnsharedCalendar(t *testing.T) {
+	b, _ := newTestBackend(t)
+
+	localName := sharedCalendarName("alice", "work")
+	_, err := b.GetCalendar(ctxFor("bob"), calHomePath()+localName+"/")
+	if err == nil {
+		t.Fatal("expected error accessing unshared calendar, got nil")
+	}
+}

internal/carddav/backend.go

@@ -14,24 +14,32 @@ import (
 	"github.com/emersion/go-webdav/carddav"
 	"github.com/yourusername/caldav-server/internal/auth"
 	"github.com/yourusername/caldav-server/internal/config"
+	"github.com/yourusername/caldav-server/internal/db"
 	"github.com/yourusername/caldav-server/internal/store"
 )
 
+// sharedNameSep separates the owner from the address book name in the
+// synthetic name used for address books shared with another user (see
+// caldav.sharedNameSep, kept identical for consistency).
+const sharedNameSep = "~"
+
 // Backend implements carddav.Backend using a filesystem store.
 type Backend struct {
 	cfg    *config.Config
 	store  *store.Store
+	dbase  *db.DB // may be nil if sharing is not configured
 	logger *slog.Logger
 }
 
-// NewBackend creates a CardDAV backend.
-func NewBackend(cfg *config.Config, st *store.Store, logger *slog.Logger) *Backend {
-	return &Backend{cfg: cfg, store: st, logger: logger}
+// NewBackend creates a CardDAV backend. dbase may be nil, in which case
+// address book sharing is disabled (only a user's own books are visible).
+func NewBackend(cfg *config.Config, st *store.Store, dbase *db.DB, logger *slog.Logger) *Backend {
+	return &Backend{cfg: cfg, store: st, dbase: dbase, logger: logger}
 }
 
 // NewHandler returns an http.Handler for the /card/ prefix.
-func NewHandler(cfg *config.Config, st *store.Store, logger *slog.Logger) http.Handler {
-	b := NewBackend(cfg, st, logger)
+func NewHandler(cfg *config.Config, st *store.Store, dbase *db.DB, logger *slog.Logger) http.Handler {
+	b := NewBackend(cfg, st, dbase, logger)
 	return &carddav.Handler{Backend: b}
 }
 
@@ -70,7 +78,7 @@ func (b *Backend) ListAddressBooks(ctx context.Context) ([]carddav.AddressBook,
 			b.logger.Warn("ensuring address book directory", "book", name, "error", err)
 			continue
 		}
-		books = append(books, b.bookMeta(p.Username, name))
+		books = append(books, b.bookMeta(p.Username, name, name))
 	}
 
 	// Also include extra books that exist on disk
@@ -82,7 +90,22 @@ func (b *Backend) ListAddressBooks(ctx context.Context) ([]carddav.AddressBook,
 	for _, dir := range disk {
 		if strings.HasPrefix(dir, "card-") && !configured[dir] {
 			name := strings.TrimPrefix(dir, "card-")
-			books = append(books, b.bookMeta(p.Username, name))
+			books = append(books, b.bookMeta(p.Username, name, name))
+		}
+	}
+
+	// Include address books other users have shared with this one.
+	if b.dbase != nil {
+		shares, err := b.dbase.AddressBooksSharedWith(p.Username)
+		if err != nil {
+			b.logger.Warn("listing shared address books", "error", err)
+		}
+		for _, sh := range shares {
+			if _, err := b.store.GetCollection(sh.Owner, "card-"+sh.AddressBookName); err != nil {
+				continue // owner's address book no longer exists
+			}
+			localName := sharedBookName(sh.Owner, sh.AddressBookName)
+			books = append(books, b.bookMeta(sh.Owner, sh.AddressBookName, localName))
 		}
 	}
 
@@ -90,24 +113,32 @@ func (b *Backend) ListAddressBooks(ctx context.Context) ([]carddav.AddressBook,
 }
 
 func (b *Backend) GetAddressBook(ctx context.Context, bookPath string) (*carddav.AddressBook, error) {
-	user, name, err := b.parseBookPath(ctx, bookPath)
+	requester, localName, err := b.parseBookPath(ctx, bookPath)
 	if err != nil {
 		return nil, err
 	}
-	if _, err := b.store.GetCollection(user, "card-"+name); err != nil {
+	owner, realName, _, err := b.resolveBook(requester, localName, false)
+	if err != nil {
+		return nil, err
+	}
+	if _, err := b.store.GetCollection(owner, "card-"+realName); err != nil {
 		return nil, webdav.NewHTTPError(http.StatusNotFound, err)
 	}
-	book := b.bookMeta(user, name)
+	book := b.bookMeta(owner, realName, localName)
 	return &book, nil
 }
 
 func (b *Backend) GetAddressObject(ctx context.Context, objPath string, req *carddav.AddressDataRequest) (*carddav.AddressObject, error) {
-	user, bookName, objID, err := b.parseObjPath(ctx, objPath)
+	requester, localName, objID, err := b.parseObjPath(ctx, objPath)
+	if err != nil {
+		return nil, err
+	}
+	owner, realName, _, err := b.resolveBook(requester, localName, false)
 	if err != nil {
 		return nil, err
 	}
 
-	data, err := b.store.GetObject(user, "card-"+bookName, objID)
+	data, err := b.store.GetObject(owner, "card-"+realName, objID)
 	if err != nil {
 		return nil, webdav.NewHTTPError(http.StatusNotFound, err)
 	}
@@ -116,23 +147,27 @@ func (b *Backend) GetAddressObject(ctx context.Context, objPath string, req *car
 }
 
 func (b *Backend) ListAddressObjects(ctx context.Context, bookPath string, req *carddav.AddressDataRequest) ([]carddav.AddressObject, error) {
-	user, bookName, err := b.parseBookPath(ctx, bookPath)
+	requester, localName, err := b.parseBookPath(ctx, bookPath)
+	if err != nil {
+		return nil, err
+	}
+	owner, realName, _, err := b.resolveBook(requester, localName, false)
 	if err != nil {
 		return nil, err
 	}
 
-	ids, err := b.store.ListObjects(user, "card-"+bookName)
+	ids, err := b.store.ListObjects(owner, "card-"+realName)
 	if err != nil {
 		return nil, err
 	}
 
 	var objs []carddav.AddressObject
 	for _, id := range ids {
-		data, err := b.store.GetObject(user, "card-"+bookName, id)
+		data, err := b.store.GetObject(owner, "card-"+realName, id)
 		if err != nil {
 			continue
 		}
-		obj, err := b.decodeObject(cardObjectPath(bookName, id), data)
+		obj, err := b.decodeObject(cardObjectPath(localName, id), data)
 		if err != nil {
 			b.logger.Warn("decoding vcard object", "id", id, "error", err)
 			continue
@@ -160,15 +195,23 @@ func (b *Backend) CreateAddressBook(ctx context.Context, book *carddav.AddressBo
 }
 
 func (b *Backend) DeleteAddressBook(ctx context.Context, bookPath string) error {
-	user, name, err := b.parseBookPath(ctx, bookPath)
+	requester, localName, err := b.parseBookPath(ctx, bookPath)
 	if err != nil {
 		return err
 	}
-	return b.store.DeleteCollection(user, "card-"+name)
+	owner, realName, _, err := b.resolveBook(requester, localName, true)
+	if err != nil {
+		return err
+	}
+	return b.store.DeleteCollection(owner, "card-"+realName)
 }
 
 func (b *Backend) PutAddressObject(ctx context.Context, objPath string, card vcard.Card, opts *carddav.PutAddressObjectOptions) (*carddav.AddressObject, error) {
-	user, bookName, objID, err := b.parseObjPath(ctx, objPath)
+	requester, localName, objID, err := b.parseObjPath(ctx, objPath)
+	if err != nil {
+		return nil, err
+	}
+	owner, realName, _, err := b.resolveBook(requester, localName, true)
 	if err != nil {
 		return nil, err
 	}
@@ -180,7 +223,7 @@ func (b *Backend) PutAddressObject(ctx context.Context, objPath string, card vca
 	}
 
 	data := []byte(buf.String())
-	if err := b.store.PutObject(user, "card-"+bookName, objID, data); err != nil {
+	if err := b.store.PutObject(owner, "card-"+realName, objID, data); err != nil {
 		return nil, fmt.Errorf("storing address object: %w", err)
 	}
 
@@ -188,11 +231,15 @@ func (b *Backend) PutAddressObject(ctx context.Context, objPath string, card vca
 }
 
 func (b *Backend) DeleteAddressObject(ctx context.Context, objPath string) error {
-	user, bookName, objID, err := b.parseObjPath(ctx, objPath)
+	requester, localName, objID, err := b.parseObjPath(ctx, objPath)
 	if err != nil {
 		return err
 	}
-	if err := b.store.DeleteObject(user, "card-"+bookName, objID); err != nil {
+	owner, realName, _, err := b.resolveBook(requester, localName, true)
+	if err != nil {
+		return err
+	}
+	if err := b.store.DeleteObject(owner, "card-"+realName, objID); err != nil {
 		return webdav.NewHTTPError(http.StatusNotFound, err)
 	}
 	return nil
@@ -200,11 +247,37 @@ func (b *Backend) DeleteAddressObject(ctx context.Context, objPath string) error
 
 // -------- helpers --------
 
-func (b *Backend) bookMeta(user, name string) carddav.AddressBook {
+// sharedBookName builds the synthetic local name a shared address book is
+// exposed under to the user it was shared with.
+func sharedBookName(owner, bookName string) string {
+	return owner + sharedNameSep + bookName
+}
+
+// resolveBook maps a local address book name (as seen in a URL path by
+// requester) to its real owner and on-disk name, checking permissions
+// along the way. Mirrors caldav.Backend.resolveCalendar.
+func (b *Backend) resolveBook(requester, localName string, requireWrite bool) (owner, realName string, perm db.Permission, err error) {
+	if ownerName, bookName, ok := strings.Cut(localName, sharedNameSep); ok {
+		if b.dbase == nil {
+			return "", "", "", webdav.NewHTTPError(http.StatusNotFound, fmt.Errorf("sharing not enabled"))
+		}
+		share, err := b.dbase.AddressBookShareFor(ownerName, bookName, requester)
+		if err != nil {
+			return "", "", "", webdav.NewHTTPError(http.StatusForbidden, fmt.Errorf("address book not shared with you"))
+		}
+		if requireWrite && share.Permission != db.PermWrite {
+			return "", "", "", webdav.NewHTTPError(http.StatusForbidden, fmt.Errorf("read-only share"))
+		}
+		return ownerName, bookName, share.Permission, nil
+	}
+	return requester, localName, db.PermWrite, nil
+}
+
+func (b *Backend) bookMeta(owner, realName, localName string) carddav.AddressBook {
 	return carddav.AddressBook{
-		Path:            cardHomePath() + name + "/",
-		Name:            name,
-		Description:     fmt.Sprintf("%s's %s address book", user, name),
+		Path:            cardHomePath() + localName + "/",
+		Name:            localName,
+		Description:     fmt.Sprintf("%s's %s address book", owner, realName),
 		MaxResourceSize: 10 * 1024 * 1024,
 	}
 }

internal/carddav/backend_test.go

@@ -0,0 +1,138 @@
+package carddav
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	vcard "github.com/emersion/go-vcard"
+	"github.com/yourusername/caldav-server/internal/auth"
+	"github.com/yourusername/caldav-server/internal/config"
+	"github.com/yourusername/caldav-server/internal/db"
+	"github.com/yourusername/caldav-server/internal/store"
+)
+
+func newTestBackend(t *testing.T) (*Backend, *db.DB) {
+	t.Helper()
+	dir := t.TempDir()
+
+	st, err := store.NewStore(filepath.Join(dir, "data"))
+	if err != nil {
+		t.Fatalf("NewStore: %v", err)
+	}
+	dbase, err := db.Open(filepath.Join(dir, "test.db"))
+	if err != nil {
+		t.Fatalf("db.Open: %v", err)
+	}
+	t.Cleanup(func() { dbase.Close() })
+
+	cfg := &config.Config{
+		Users: map[string]config.UserConfig{
+			"alice": {AddressBooks: []string{"contacts"}},
+			"bob":   {AddressBooks: []string{"personal"}},
+		},
+	}
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+	return NewBackend(cfg, st, dbase, logger), dbase
+}
+
+func ctxFor(username string) context.Context {
+	return auth.NewContext(context.Background(), &auth.Principal{Username: username})
+}
+
+// minimalCard returns a minimal, valid vCard for use in tests.
+func minimalCard() vcard.Card {
+	const raw = "BEGIN:VCARD\r\n" +
+		"VERSION:3.0\r\n" +
+		"UID:card1@nidus.test\r\n" +
+		"FN:Test Person\r\n" +
+		"END:VCARD\r\n"
+	card, err := vcard.NewDecoder(strings.NewReader(raw)).Decode()
+	if err != nil {
+		panic("minimalCard: " + err.Error())
+	}
+	return card
+}
+
+func TestListAddressBooksIncludesSharedBook(t *testing.T) {
+	b, dbase := newTestBackend(t)
+
+	if err := dbase.ShareAddressBook("alice", "contacts", "bob", db.PermRead); err != nil {
+		t.Fatalf("ShareAddressBook: %v", err)
+	}
+	// The shared book must exist on disk for it to be listed; normally this
+	// happens when alice's own ListAddressBooks runs and ensures it.
+	if _, err := b.ListAddressBooks(ctxFor("alice")); err != nil {
+		t.Fatalf("ListAddressBooks(alice): %v", err)
+	}
+
+	books, err := b.ListAddressBooks(ctxFor("bob"))
+	if err != nil {
+		t.Fatalf("ListAddressBooks: %v", err)
+	}
+
+	var found bool
+	wantName := sharedBookName("alice", "contacts")
+	for _, book := range books {
+		if book.Name == wantName {
+			found = true
+		}
+	}
+	if !found {
+		t.Errorf("shared address book %q not found in ListAddressBooks result: %+v", wantName, books)
+	}
+}
+
+func TestSharedAddressBookReadOnlyRejectsWrite(t *testing.T) {
+	b, dbase := newTestBackend(t)
+
+	if err := dbase.ShareAddressBook("alice", "contacts", "bob", db.PermRead); err != nil {
+		t.Fatalf("ShareAddressBook: %v", err)
+	}
+
+	localName := sharedBookName("alice", "contacts")
+	objPath := cardObjectPath(localName, "card1.vcf")
+
+	_, err := b.PutAddressObject(ctxFor("bob"), objPath, minimalCard(), nil)
+	if err == nil {
+		t.Fatal("expected error writing to read-only shared address book, got nil")
+	}
+}
+
+func TestSharedAddressBookWriteAllowed(t *testing.T) {
+	b, dbase := newTestBackend(t)
+
+	if err := dbase.ShareAddressBook("alice", "contacts", "bob", db.PermWrite); err != nil {
+		t.Fatalf("ShareAddressBook: %v", err)
+	}
+
+	localName := sharedBookName("alice", "contacts")
+	objPath := cardObjectPath(localName, "card1.vcf")
+
+	if _, err := b.PutAddressObject(ctxFor("bob"), objPath, minimalCard(), nil); err != nil {
+		t.Fatalf("PutAddressObject with write share: %v", err)
+	}
+
+	// The object should now be visible under alice's own address book too,
+	// since it's stored in her namespace.
+	obj, err := b.GetAddressObject(ctxFor("alice"), cardObjectPath("contacts", "card1.vcf"), nil)
+	if err != nil {
+		t.Fatalf("GetAddressObject as owner: %v", err)
+	}
+	if obj == nil {
+		t.Fatal("expected non-nil object")
+	}
+}
+
+func TestUnauthorizedUserCannotAccessUnsharedBook(t *testing.T) {
+	b, _ := newTestBackend(t)
+
+	localName := sharedBookName("alice", "contacts")
+	_, err := b.GetAddressBook(ctxFor("bob"), cardHomePath()+localName+"/")
+	if err == nil {
+		t.Fatal("expected error accessing unshared address book, got nil")
+	}
+}

internal/db/db.go

@@ -0,0 +1,69 @@
+// Package db provides a lightweight SQLite-backed store for data that
+// doesn't fit the plain-file model used by internal/store — currently
+// calendar/address-book sharing grants. It's intentionally small: no ORM,
+// just database/sql with hand-written queries, so it stays easy to
+// extend when user management and the web UI are added later.
+package db
+
+import (
+	"database/sql"
+	"fmt"
+
+	_ "modernc.org/sqlite"
+)
+
+// DB wraps a SQLite connection and exposes typed helpers for the
+// application's tables.
+type DB struct {
+	conn *sql.DB
+}
+
+// Open opens (creating if necessary) the SQLite database at path and runs
+// schema migrations.
+func Open(path string) (*DB, error) {
+	conn, err := sql.Open("sqlite", path)
+	if err != nil {
+		return nil, fmt.Errorf("opening database %q: %w", path, err)
+	}
+	// SQLite only supports one writer at a time; a single connection avoids
+	// "database is locked" errors under concurrent access.
+	conn.SetMaxOpenConns(1)
+
+	d := &DB{conn: conn}
+	if err := d.migrate(); err != nil {
+		conn.Close()
+		return nil, fmt.Errorf("migrating database: %w", err)
+	}
+	return d, nil
+}
+
+// Close closes the underlying connection.
+func (d *DB) Close() error {
+	return d.conn.Close()
+}
+
+func (d *DB) migrate() error {
+	const schema = `
+CREATE TABLE IF NOT EXISTS calendar_shares (
+	id INTEGER PRIMARY KEY AUTOINCREMENT,
+	owner TEXT NOT NULL,
+	calendar_name TEXT NOT NULL,
+	shared_with TEXT NOT NULL,
+	permission TEXT NOT NULL CHECK (permission IN ('read', 'write')),
+	created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	UNIQUE (owner, calendar_name, shared_with)
+);
+
+CREATE TABLE IF NOT EXISTS addressbook_shares (
+	id INTEGER PRIMARY KEY AUTOINCREMENT,
+	owner TEXT NOT NULL,
+	addressbook_name TEXT NOT NULL,
+	shared_with TEXT NOT NULL,
+	permission TEXT NOT NULL CHECK (permission IN ('read', 'write')),
+	created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	UNIQUE (owner, addressbook_name, shared_with)
+);
+`
+	_, err := d.conn.Exec(schema)
+	return err
+}

internal/db/shares.go

@@ -0,0 +1,227 @@
+package db
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+)
+
+// Permission is the access level granted by a share.
+type Permission string
+
+const (
+	PermRead  Permission = "read"
+	PermWrite Permission = "write"
+)
+
+// ErrShareNotFound is returned when revoking a share that doesn't exist.
+var ErrShareNotFound = errors.New("share not found")
+
+// CalendarShare describes a grant of access to owner's calendar to another
+// user.
+type CalendarShare struct {
+	Owner        string
+	CalendarName string
+	SharedWith   string
+	Permission   Permission
+}
+
+// ShareCalendar grants sharedWith access (read or write) to owner's
+// calendar calName. Calling it again for the same (owner, calName,
+// sharedWith) updates the permission.
+func (d *DB) ShareCalendar(owner, calName, sharedWith string, perm Permission) error {
+	if perm != PermRead && perm != PermWrite {
+		return fmt.Errorf("invalid permission %q", perm)
+	}
+	_, err := d.conn.Exec(`
+		INSERT INTO calendar_shares (owner, calendar_name, shared_with, permission)
+		VALUES (?, ?, ?, ?)
+		ON CONFLICT (owner, calendar_name, shared_with)
+		DO UPDATE SET permission = excluded.permission`,
+		owner, calName, sharedWith, string(perm))
+	if err != nil {
+		return fmt.Errorf("sharing calendar: %w", err)
+	}
+	return nil
+}
+
+// UnshareCalendar revokes sharedWith's access to owner's calendar calName.
+func (d *DB) UnshareCalendar(owner, calName, sharedWith string) error {
+	res, err := d.conn.Exec(`
+		DELETE FROM calendar_shares
+		WHERE owner = ? AND calendar_name = ? AND shared_with = ?`,
+		owner, calName, sharedWith)
+	if err != nil {
+		return fmt.Errorf("unsharing calendar: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("unsharing calendar: %w", err)
+	}
+	if n == 0 {
+		return ErrShareNotFound
+	}
+	return nil
+}
+
+// SharesOfCalendar lists everyone owner's calendar calName has been shared
+// with.
+func (d *DB) SharesOfCalendar(owner, calName string) ([]CalendarShare, error) {
+	rows, err := d.conn.Query(`
+		SELECT owner, calendar_name, shared_with, permission
+		FROM calendar_shares
+		WHERE owner = ? AND calendar_name = ?
+		ORDER BY shared_with`,
+		owner, calName)
+	if err != nil {
+		return nil, fmt.Errorf("listing calendar shares: %w", err)
+	}
+	defer rows.Close()
+	return scanCalendarShares(rows)
+}
+
+// CalendarsSharedWith lists all calendars (from any owner) that have been
+// shared with user.
+func (d *DB) CalendarsSharedWith(user string) ([]CalendarShare, error) {
+	rows, err := d.conn.Query(`
+		SELECT owner, calendar_name, shared_with, permission
+		FROM calendar_shares
+		WHERE shared_with = ?
+		ORDER BY owner, calendar_name`,
+		user)
+	if err != nil {
+		return nil, fmt.Errorf("listing calendars shared with user: %w", err)
+	}
+	defer rows.Close()
+	return scanCalendarShares(rows)
+}
+
+// CalendarShare looks up the share record granting user access to
+// owner's calendar calName, if any.
+func (d *DB) CalendarShareFor(owner, calName, user string) (*CalendarShare, error) {
+	row := d.conn.QueryRow(`
+		SELECT owner, calendar_name, shared_with, permission
+		FROM calendar_shares
+		WHERE owner = ? AND calendar_name = ? AND shared_with = ?`,
+		owner, calName, user)
+
+	var s CalendarShare
+	var perm string
+	if err := row.Scan(&s.Owner, &s.CalendarName, &s.SharedWith, &perm); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, ErrShareNotFound
+		}
+		return nil, fmt.Errorf("looking up calendar share: %w", err)
+	}
+	s.Permission = Permission(perm)
+	return &s, nil
+}
+
+func scanCalendarShares(rows *sql.Rows) ([]CalendarShare, error) {
+	var shares []CalendarShare
+	for rows.Next() {
+		var s CalendarShare
+		var perm string
+		if err := rows.Scan(&s.Owner, &s.CalendarName, &s.SharedWith, &perm); err != nil {
+			return nil, fmt.Errorf("scanning calendar share: %w", err)
+		}
+		s.Permission = Permission(perm)
+		shares = append(shares, s)
+	}
+	return shares, rows.Err()
+}
+
+// AddressBookShare describes a grant of access to owner's address book to
+// another user.
+type AddressBookShare struct {
+	Owner           string
+	AddressBookName string
+	SharedWith      string
+	Permission      Permission
+}
+
+// ShareAddressBook grants sharedWith access (read or write) to owner's
+// address book bookName.
+func (d *DB) ShareAddressBook(owner, bookName, sharedWith string, perm Permission) error {
+	if perm != PermRead && perm != PermWrite {
+		return fmt.Errorf("invalid permission %q", perm)
+	}
+	_, err := d.conn.Exec(`
+		INSERT INTO addressbook_shares (owner, addressbook_name, shared_with, permission)
+		VALUES (?, ?, ?, ?)
+		ON CONFLICT (owner, addressbook_name, shared_with)
+		DO UPDATE SET permission = excluded.permission`,
+		owner, bookName, sharedWith, string(perm))
+	if err != nil {
+		return fmt.Errorf("sharing address book: %w", err)
+	}
+	return nil
+}
+
+// UnshareAddressBook revokes sharedWith's access to owner's address book
+// bookName.
+func (d *DB) UnshareAddressBook(owner, bookName, sharedWith string) error {
+	res, err := d.conn.Exec(`
+		DELETE FROM addressbook_shares
+		WHERE owner = ? AND addressbook_name = ? AND shared_with = ?`,
+		owner, bookName, sharedWith)
+	if err != nil {
+		return fmt.Errorf("unsharing address book: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("unsharing address book: %w", err)
+	}
+	if n == 0 {
+		return ErrShareNotFound
+	}
+	return nil
+}
+
+// AddressBooksSharedWith lists all address books (from any owner) that
+// have been shared with user.
+func (d *DB) AddressBooksSharedWith(user string) ([]AddressBookShare, error) {
+	rows, err := d.conn.Query(`
+		SELECT owner, addressbook_name, shared_with, permission
+		FROM addressbook_shares
+		WHERE shared_with = ?
+		ORDER BY owner, addressbook_name`,
+		user)
+	if err != nil {
+		return nil, fmt.Errorf("listing address books shared with user: %w", err)
+	}
+	defer rows.Close()
+
+	var shares []AddressBookShare
+	for rows.Next() {
+		var s AddressBookShare
+		var perm string
+		if err := rows.Scan(&s.Owner, &s.AddressBookName, &s.SharedWith, &perm); err != nil {
+			return nil, fmt.Errorf("scanning address book share: %w", err)
+		}
+		s.Permission = Permission(perm)
+		shares = append(shares, s)
+	}
+	return shares, rows.Err()
+}
+
+// AddressBookShareFor looks up the share record granting user access to
+// owner's address book bookName, if any.
+func (d *DB) AddressBookShareFor(owner, bookName, user string) (*AddressBookShare, error) {
+	row := d.conn.QueryRow(`
+		SELECT owner, addressbook_name, shared_with, permission
+		FROM addressbook_shares
+		WHERE owner = ? AND addressbook_name = ? AND shared_with = ?`,
+		owner, bookName, user)
+
+	var s AddressBookShare
+	var perm string
+	if err := row.Scan(&s.Owner, &s.AddressBookName, &s.SharedWith, &perm); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, ErrShareNotFound
+		}
+		return nil, fmt.Errorf("looking up address book share: %w", err)
+	}
+	s.Permission = Permission(perm)
+	return &s, nil
+}

internal/db/shares_test.go

@@ -0,0 +1,154 @@
+package db
+
+import (
+	"errors"
+	"path/filepath"
+	"testing"
+)
+
+func openTestDB(t *testing.T) *DB {
+	t.Helper()
+	dbase, err := Open(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatalf("Open: %v", err)
+	}
+	t.Cleanup(func() { dbase.Close() })
+	return dbase
+}
+
+func TestShareCalendarAndLookup(t *testing.T) {
+	dbase := openTestDB(t)
+
+	if err := dbase.ShareCalendar("alice", "work", "bob", PermRead); err != nil {
+		t.Fatalf("ShareCalendar: %v", err)
+	}
+
+	share, err := dbase.CalendarShareFor("alice", "work", "bob")
+	if err != nil {
+		t.Fatalf("CalendarShareFor: %v", err)
+	}
+	if share.Permission != PermRead {
+		t.Errorf("Permission = %q, want %q", share.Permission, PermRead)
+	}
+
+	// Re-sharing with a different permission updates in place rather than
+	// erroring or duplicating.
+	if err := dbase.ShareCalendar("alice", "work", "bob", PermWrite); err != nil {
+		t.Fatalf("ShareCalendar (update): %v", err)
+	}
+	share, err = dbase.CalendarShareFor("alice", "work", "bob")
+	if err != nil {
+		t.Fatalf("CalendarShareFor after update: %v", err)
+	}
+	if share.Permission != PermWrite {
+		t.Errorf("Permission after update = %q, want %q", share.Permission, PermWrite)
+	}
+
+	shares, err := dbase.SharesOfCalendar("alice", "work")
+	if err != nil {
+		t.Fatalf("SharesOfCalendar: %v", err)
+	}
+	if len(shares) != 1 || shares[0].SharedWith != "bob" {
+		t.Errorf("SharesOfCalendar = %+v, want single share with bob", shares)
+	}
+}
+
+func TestCalendarShareForNotFound(t *testing.T) {
+	dbase := openTestDB(t)
+
+	_, err := dbase.CalendarShareFor("alice", "work", "bob")
+	if !errors.Is(err, ErrShareNotFound) {
+		t.Errorf("err = %v, want ErrShareNotFound", err)
+	}
+}
+
+func TestUnshareCalendar(t *testing.T) {
+	dbase := openTestDB(t)
+
+	if err := dbase.ShareCalendar("alice", "work", "bob", PermRead); err != nil {
+		t.Fatalf("ShareCalendar: %v", err)
+	}
+	if err := dbase.UnshareCalendar("alice", "work", "bob"); err != nil {
+		t.Fatalf("UnshareCalendar: %v", err)
+	}
+	if _, err := dbase.CalendarShareFor("alice", "work", "bob"); !errors.Is(err, ErrShareNotFound) {
+		t.Errorf("share still present after unshare: err = %v", err)
+	}
+
+	// Unsharing a non-existent share reports ErrShareNotFound.
+	if err := dbase.UnshareCalendar("alice", "work", "bob"); !errors.Is(err, ErrShareNotFound) {
+		t.Errorf("UnshareCalendar (already gone) = %v, want ErrShareNotFound", err)
+	}
+}
+
+func TestCalendarsSharedWith(t *testing.T) {
+	dbase := openTestDB(t)
+
+	if err := dbase.ShareCalendar("alice", "work", "bob", PermRead); err != nil {
+		t.Fatalf("ShareCalendar: %v", err)
+	}
+	if err := dbase.ShareCalendar("carol", "family", "bob", PermWrite); err != nil {
+		t.Fatalf("ShareCalendar: %v", err)
+	}
+	// A share for a different user shouldn't show up for bob.
+	if err := dbase.ShareCalendar("alice", "personal", "dave", PermRead); err != nil {
+		t.Fatalf("ShareCalendar: %v", err)
+	}
+
+	shares, err := dbase.CalendarsSharedWith("bob")
+	if err != nil {
+		t.Fatalf("CalendarsSharedWith: %v", err)
+	}
+	if len(shares) != 2 {
+		t.Fatalf("len(shares) = %d, want 2", len(shares))
+	}
+}
+
+func TestShareCalendarInvalidPermission(t *testing.T) {
+	dbase := openTestDB(t)
+	if err := dbase.ShareCalendar("alice", "work", "bob", Permission("admin")); err == nil {
+		t.Error("expected error for invalid permission, got nil")
+	}
+}
+
+func TestShareAddressBookAndLookup(t *testing.T) {
+	dbase := openTestDB(t)
+
+	if err := dbase.ShareAddressBook("alice", "contacts", "bob", PermRead); err != nil {
+		t.Fatalf("ShareAddressBook: %v", err)
+	}
+
+	share, err := dbase.AddressBookShareFor("alice", "contacts", "bob")
+	if err != nil {
+		t.Fatalf("AddressBookShareFor: %v", err)
+	}
+	if share.Permission != PermRead {
+		t.Errorf("Permission = %q, want %q", share.Permission, PermRead)
+	}
+
+	if err := dbase.UnshareAddressBook("alice", "contacts", "bob"); err != nil {
+		t.Fatalf("UnshareAddressBook: %v", err)
+	}
+	if _, err := dbase.AddressBookShareFor("alice", "contacts", "bob"); !errors.Is(err, ErrShareNotFound) {
+		t.Errorf("share still present after unshare: err = %v", err)
+	}
+}
+
+func TestAddressBooksSharedWith(t *testing.T) {
+	dbase := openTestDB(t)
+
+	if err := dbase.ShareAddressBook("alice", "contacts", "bob", PermRead); err != nil {
+		t.Fatalf("ShareAddressBook: %v", err)
+	}
+	if err := dbase.ShareAddressBook("carol", "friends", "bob", PermWrite); err != nil {
+		t.Fatalf("ShareAddressBook: %v", err)
+	}
+
+	shares, err := dbase.AddressBooksSharedWith("bob")
+	if err != nil {
+		t.Fatalf("AddressBooksSharedWith: %v", err)
+	}
+	if len(shares) != 2 {
+		t.Fatalf("len(shares) = %d, want 2", len(shares))
+	}
+}