Introduce internal/db, a small SQLite-backed store (pure-Go
modernc.org/sqlite, no CGO) at <data_dir>/nidus.db holding
calendar_shares and addressbook_shares grant tables (owner, resource
name, shared-with user, read/write permission). This is the first step
towards user management and a web UI: a real datastore that a future
admin CLI/UI can build on, instead of the static config.yaml.
Wire sharing into the CalDAV/CardDAV backends:
- ListCalendars/ListAddressBooks now also include resources shared with
the requesting user, exposed under the synthetic local name
"<owner>~<name>" in the grantee's own home-set — no separate account,
no data copying, the object still physically lives under the owner's
store.Store namespace.
- All read paths (Get/List/QueryCalendarObjects, address book
equivalents) resolve the synthetic name back to (owner, real name) and
require any share (read or write) to exist.
- All write paths (Put/Delete object, DeleteCalendar/AddressBook)
additionally require a write-permission share; read-only shares get a
403 Forbidden.
- CreateCalendar/CreateAddressBook remain scoped to the acting user's own
namespace — sharing an existing collection is done via ShareCalendar/
ShareAddressBook, not by creating one directly in someone else's name.
Add internal/db/shares_test.go (grant/lookup/update/unshare/list
semantics) and internal/{caldav,carddav}/backend_test.go (shared
calendar/address book visibility, write permission enforcement,
unauthorized access rejection). Update README (features, new "Sharing
calendars and address books" section, project layout, dependencies) and
copilot-instructions.md to document the new package and sharing model.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
155 lines
4.4 KiB
Go
155 lines
4.4 KiB
Go
package db
|
|
|
|
import (
|
|
"errors"
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
func openTestDB(t *testing.T) *DB {
|
|
t.Helper()
|
|
dbase, err := Open(filepath.Join(t.TempDir(), "test.db"))
|
|
if err != nil {
|
|
t.Fatalf("Open: %v", err)
|
|
}
|
|
t.Cleanup(func() { dbase.Close() })
|
|
return dbase
|
|
}
|
|
|
|
func TestShareCalendarAndLookup(t *testing.T) {
|
|
dbase := openTestDB(t)
|
|
|
|
if err := dbase.ShareCalendar("alice", "work", "bob", PermRead); err != nil {
|
|
t.Fatalf("ShareCalendar: %v", err)
|
|
}
|
|
|
|
share, err := dbase.CalendarShareFor("alice", "work", "bob")
|
|
if err != nil {
|
|
t.Fatalf("CalendarShareFor: %v", err)
|
|
}
|
|
if share.Permission != PermRead {
|
|
t.Errorf("Permission = %q, want %q", share.Permission, PermRead)
|
|
}
|
|
|
|
// Re-sharing with a different permission updates in place rather than
|
|
// erroring or duplicating.
|
|
if err := dbase.ShareCalendar("alice", "work", "bob", PermWrite); err != nil {
|
|
t.Fatalf("ShareCalendar (update): %v", err)
|
|
}
|
|
share, err = dbase.CalendarShareFor("alice", "work", "bob")
|
|
if err != nil {
|
|
t.Fatalf("CalendarShareFor after update: %v", err)
|
|
}
|
|
if share.Permission != PermWrite {
|
|
t.Errorf("Permission after update = %q, want %q", share.Permission, PermWrite)
|
|
}
|
|
|
|
shares, err := dbase.SharesOfCalendar("alice", "work")
|
|
if err != nil {
|
|
t.Fatalf("SharesOfCalendar: %v", err)
|
|
}
|
|
if len(shares) != 1 || shares[0].SharedWith != "bob" {
|
|
t.Errorf("SharesOfCalendar = %+v, want single share with bob", shares)
|
|
}
|
|
}
|
|
|
|
func TestCalendarShareForNotFound(t *testing.T) {
|
|
dbase := openTestDB(t)
|
|
|
|
_, err := dbase.CalendarShareFor("alice", "work", "bob")
|
|
if !errors.Is(err, ErrShareNotFound) {
|
|
t.Errorf("err = %v, want ErrShareNotFound", err)
|
|
}
|
|
}
|
|
|
|
func TestUnshareCalendar(t *testing.T) {
|
|
dbase := openTestDB(t)
|
|
|
|
if err := dbase.ShareCalendar("alice", "work", "bob", PermRead); err != nil {
|
|
t.Fatalf("ShareCalendar: %v", err)
|
|
}
|
|
if err := dbase.UnshareCalendar("alice", "work", "bob"); err != nil {
|
|
t.Fatalf("UnshareCalendar: %v", err)
|
|
}
|
|
if _, err := dbase.CalendarShareFor("alice", "work", "bob"); !errors.Is(err, ErrShareNotFound) {
|
|
t.Errorf("share still present after unshare: err = %v", err)
|
|
}
|
|
|
|
// Unsharing a non-existent share reports ErrShareNotFound.
|
|
if err := dbase.UnshareCalendar("alice", "work", "bob"); !errors.Is(err, ErrShareNotFound) {
|
|
t.Errorf("UnshareCalendar (already gone) = %v, want ErrShareNotFound", err)
|
|
}
|
|
}
|
|
|
|
func TestCalendarsSharedWith(t *testing.T) {
|
|
dbase := openTestDB(t)
|
|
|
|
if err := dbase.ShareCalendar("alice", "work", "bob", PermRead); err != nil {
|
|
t.Fatalf("ShareCalendar: %v", err)
|
|
}
|
|
if err := dbase.ShareCalendar("carol", "family", "bob", PermWrite); err != nil {
|
|
t.Fatalf("ShareCalendar: %v", err)
|
|
}
|
|
// A share for a different user shouldn't show up for bob.
|
|
if err := dbase.ShareCalendar("alice", "personal", "dave", PermRead); err != nil {
|
|
t.Fatalf("ShareCalendar: %v", err)
|
|
}
|
|
|
|
shares, err := dbase.CalendarsSharedWith("bob")
|
|
if err != nil {
|
|
t.Fatalf("CalendarsSharedWith: %v", err)
|
|
}
|
|
if len(shares) != 2 {
|
|
t.Fatalf("len(shares) = %d, want 2", len(shares))
|
|
}
|
|
}
|
|
|
|
func TestShareCalendarInvalidPermission(t *testing.T) {
|
|
dbase := openTestDB(t)
|
|
if err := dbase.ShareCalendar("alice", "work", "bob", Permission("admin")); err == nil {
|
|
t.Error("expected error for invalid permission, got nil")
|
|
}
|
|
}
|
|
|
|
func TestShareAddressBookAndLookup(t *testing.T) {
|
|
dbase := openTestDB(t)
|
|
|
|
if err := dbase.ShareAddressBook("alice", "contacts", "bob", PermRead); err != nil {
|
|
t.Fatalf("ShareAddressBook: %v", err)
|
|
}
|
|
|
|
share, err := dbase.AddressBookShareFor("alice", "contacts", "bob")
|
|
if err != nil {
|
|
t.Fatalf("AddressBookShareFor: %v", err)
|
|
}
|
|
if share.Permission != PermRead {
|
|
t.Errorf("Permission = %q, want %q", share.Permission, PermRead)
|
|
}
|
|
|
|
if err := dbase.UnshareAddressBook("alice", "contacts", "bob"); err != nil {
|
|
t.Fatalf("UnshareAddressBook: %v", err)
|
|
}
|
|
if _, err := dbase.AddressBookShareFor("alice", "contacts", "bob"); !errors.Is(err, ErrShareNotFound) {
|
|
t.Errorf("share still present after unshare: err = %v", err)
|
|
}
|
|
}
|
|
|
|
func TestAddressBooksSharedWith(t *testing.T) {
|
|
dbase := openTestDB(t)
|
|
|
|
if err := dbase.ShareAddressBook("alice", "contacts", "bob", PermRead); err != nil {
|
|
t.Fatalf("ShareAddressBook: %v", err)
|
|
}
|
|
if err := dbase.ShareAddressBook("carol", "friends", "bob", PermWrite); err != nil {
|
|
t.Fatalf("ShareAddressBook: %v", err)
|
|
}
|
|
|
|
shares, err := dbase.AddressBooksSharedWith("bob")
|
|
if err != nil {
|
|
t.Fatalf("AddressBooksSharedWith: %v", err)
|
|
}
|
|
if len(shares) != 2 {
|
|
t.Fatalf("len(shares) = %d, want 2", len(shares))
|
|
}
|
|
}
|