Introduce internal/db, a small SQLite-backed store (pure-Go
modernc.org/sqlite, no CGO) at <data_dir>/nidus.db holding
calendar_shares and addressbook_shares grant tables (owner, resource
name, shared-with user, read/write permission). This is the first step
towards user management and a web UI: a real datastore that a future
admin CLI/UI can build on, instead of the static config.yaml.
Wire sharing into the CalDAV/CardDAV backends:
- ListCalendars/ListAddressBooks now also include resources shared with
the requesting user, exposed under the synthetic local name
"<owner>~<name>" in the grantee's own home-set — no separate account,
no data copying, the object still physically lives under the owner's
store.Store namespace.
- All read paths (Get/List/QueryCalendarObjects, address book
equivalents) resolve the synthetic name back to (owner, real name) and
require any share (read or write) to exist.
- All write paths (Put/Delete object, DeleteCalendar/AddressBook)
additionally require a write-permission share; read-only shares get a
403 Forbidden.
- CreateCalendar/CreateAddressBook remain scoped to the acting user's own
namespace — sharing an existing collection is done via ShareCalendar/
ShareAddressBook, not by creating one directly in someone else's name.
Add internal/db/shares_test.go (grant/lookup/update/unshare/list
semantics) and internal/{caldav,carddav}/backend_test.go (shared
calendar/address book visibility, write permission enforcement,
unauthorized access rejection). Update README (features, new "Sharing
calendars and address books" section, project layout, dependencies) and
copilot-instructions.md to document the new package and sharing model.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
145 lines
4.0 KiB
Go
145 lines
4.0 KiB
Go
package caldav
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"io"
|
|
"log/slog"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
ical "github.com/emersion/go-ical"
|
|
"github.com/yourusername/caldav-server/internal/auth"
|
|
"github.com/yourusername/caldav-server/internal/config"
|
|
"github.com/yourusername/caldav-server/internal/db"
|
|
"github.com/yourusername/caldav-server/internal/store"
|
|
)
|
|
|
|
func newTestBackend(t *testing.T) (*Backend, *db.DB) {
|
|
t.Helper()
|
|
dir := t.TempDir()
|
|
|
|
st, err := store.NewStore(filepath.Join(dir, "data"))
|
|
if err != nil {
|
|
t.Fatalf("NewStore: %v", err)
|
|
}
|
|
dbase, err := db.Open(filepath.Join(dir, "test.db"))
|
|
if err != nil {
|
|
t.Fatalf("db.Open: %v", err)
|
|
}
|
|
t.Cleanup(func() { dbase.Close() })
|
|
|
|
cfg := &config.Config{
|
|
Users: map[string]config.UserConfig{
|
|
"alice": {Calendars: []string{"work"}},
|
|
"bob": {Calendars: []string{"personal"}},
|
|
},
|
|
}
|
|
logger := slog.New(slog.NewTextHandler(io.Discard, nil))
|
|
return NewBackend(cfg, st, dbase, logger), dbase
|
|
}
|
|
|
|
func ctxFor(username string) context.Context {
|
|
return auth.NewContext(context.Background(), &auth.Principal{Username: username})
|
|
}
|
|
|
|
// minimalEvent returns a minimal, valid VCALENDAR/VEVENT for use in tests.
|
|
func minimalEvent() *ical.Calendar {
|
|
const raw = "BEGIN:VCALENDAR\r\n" +
|
|
"VERSION:2.0\r\n" +
|
|
"PRODID:-//nidus//test//EN\r\n" +
|
|
"BEGIN:VEVENT\r\n" +
|
|
"UID:event1@nidus.test\r\n" +
|
|
"DTSTAMP:20240101T000000Z\r\n" +
|
|
"DTSTART:20240101T100000Z\r\n" +
|
|
"SUMMARY:Test Event\r\n" +
|
|
"END:VEVENT\r\n" +
|
|
"END:VCALENDAR\r\n"
|
|
cal, err := ical.NewDecoder(strings.NewReader(raw)).Decode()
|
|
if err != nil {
|
|
panic(fmt.Sprintf("minimalEvent: %v", err))
|
|
}
|
|
return cal
|
|
}
|
|
|
|
func TestListCalendarsIncludesSharedCalendar(t *testing.T) {
|
|
b, dbase := newTestBackend(t)
|
|
|
|
if err := dbase.ShareCalendar("alice", "work", "bob", db.PermRead); err != nil {
|
|
t.Fatalf("ShareCalendar: %v", err)
|
|
}
|
|
// The shared calendar must exist on disk for it to be listed; normally
|
|
// this happens when alice's own ListCalendars runs and ensures it.
|
|
if _, err := b.ListCalendars(ctxFor("alice")); err != nil {
|
|
t.Fatalf("ListCalendars(alice): %v", err)
|
|
}
|
|
|
|
cals, err := b.ListCalendars(ctxFor("bob"))
|
|
if err != nil {
|
|
t.Fatalf("ListCalendars: %v", err)
|
|
}
|
|
|
|
var found bool
|
|
wantName := sharedCalendarName("alice", "work")
|
|
for _, c := range cals {
|
|
if c.Name == wantName {
|
|
found = true
|
|
}
|
|
}
|
|
if !found {
|
|
t.Errorf("shared calendar %q not found in ListCalendars result: %+v", wantName, cals)
|
|
}
|
|
}
|
|
|
|
func TestSharedCalendarReadOnlyRejectsWrite(t *testing.T) {
|
|
b, dbase := newTestBackend(t)
|
|
|
|
if err := dbase.ShareCalendar("alice", "work", "bob", db.PermRead); err != nil {
|
|
t.Fatalf("ShareCalendar: %v", err)
|
|
}
|
|
|
|
localName := sharedCalendarName("alice", "work")
|
|
objPath := calObjectPath(localName, "event1.ics")
|
|
|
|
_, err := b.PutCalendarObject(ctxFor("bob"), objPath, minimalEvent(), nil)
|
|
if err == nil {
|
|
t.Fatal("expected error writing to read-only shared calendar, got nil")
|
|
}
|
|
}
|
|
|
|
func TestSharedCalendarWriteAllowed(t *testing.T) {
|
|
b, dbase := newTestBackend(t)
|
|
|
|
if err := dbase.ShareCalendar("alice", "work", "bob", db.PermWrite); err != nil {
|
|
t.Fatalf("ShareCalendar: %v", err)
|
|
}
|
|
|
|
localName := sharedCalendarName("alice", "work")
|
|
objPath := calObjectPath(localName, "event1.ics")
|
|
|
|
if _, err := b.PutCalendarObject(ctxFor("bob"), objPath, minimalEvent(), nil); err != nil {
|
|
t.Fatalf("PutCalendarObject with write share: %v", err)
|
|
}
|
|
|
|
// The object should now be visible under alice's own calendar too,
|
|
// since it's stored in her namespace.
|
|
obj, err := b.GetCalendarObject(ctxFor("alice"), calObjectPath("work", "event1.ics"), nil)
|
|
if err != nil {
|
|
t.Fatalf("GetCalendarObject as owner: %v", err)
|
|
}
|
|
if obj == nil {
|
|
t.Fatal("expected non-nil object")
|
|
}
|
|
}
|
|
|
|
func TestUnauthorizedUserCannotAccessUnsharedCalendar(t *testing.T) {
|
|
b, _ := newTestBackend(t)
|
|
|
|
localName := sharedCalendarName("alice", "work")
|
|
_, err := b.GetCalendar(ctxFor("bob"), calHomePath()+localName+"/")
|
|
if err == nil {
|
|
t.Fatal("expected error accessing unshared calendar, got nil")
|
|
}
|
|
}
|