Skip to content

fix(#192): HIGH: a read-write sharee can DELETE the owner's entire calendar — the rights pl - #372

Merged
BeSovereign merged 1 commit into
masterfrom
fix/issue-192
Oct 13, 2026
Merged

BeSovereign merged 1 commit into
masterfrom
fix/issue-192

Conversation

@BeSovereign

Copy link
Copy Markdown
Contributor

Refs #192

The Radicale rights plugin now returns deny-delete 'rwd'/'rd' for sharees at every depth (including the calendar itself), so a read-write sharee can no longer delete the owner's calendar. The owner gets 'rw' instead of 'RWDrwd', since D/d are deny bits that blocked owners from deleting their own calendars. Tests that pinned the old strings were inverted to assert the owner can delete and sharees cannot.

Driver gates (measured, not claimed)

  • Suites: node: 1497 passed, 0 failed | python: 51 passed, 0 failed | e2e: 30 passed, 0 failed
  • Red/green check on declared tests: server/test/issue192_sharee_deny_delete_permission.test.js, server/test/python/test_radicale_custom_rights.py, server/test/issue201_prevent_unauthenticated_calendar_deletion.test.js, server/test/issue277_radicale_custom_rights_case_sensitivity.test.js
red/green output
RED without the change:
cale_custom_rights.py", line 131, in test_sharee_read_only_access
    self.assertEqual(perm, "rd")
AssertionError: 'r' != 'rd'
- r
+ rd
?  +


======================================================================
FAIL: test_sharee_write_access (test_radicale_custom_rights.TestRadicaleCustomRights.test_sharee_write_access)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/agent-user/Coding/Freeshard/vacation_framework/worktrees/issue-192/server/test/python/test_radicale_custom_rights.py", line 140, in test_sharee_write_access
    self.assertEqual(perm, "rwd")
AssertionError: 'rw' != 'rwd'
- rw
+ rwd
?   +


----------------------------------------------------------------------
Ran 12 tests in 0.372s

FAILED (failures=5)


GREEN with the change:
    1..3
ok 2 - Issue \#201 — Prevent Unauthenticated & Sharee Permanent Calendar Deletion
  ---
  duration_ms: 102.936764
  ...
# Subtest: Issue \#277 — Radicale Custom Rights Case-Insensitive Sharee & Owner Matching
    # Subtest: radicale_custom_rights.py matches sharee and owner usernames case-insensitively
    ok 1 - radicale_custom_rights.py matches sharee and owner usernames case-insensitively
      ---
      duration_ms: 58.600861
      ...
    1..1
ok 3 - Issue \#277 — Radicale Custom Rights Case-Insensitive Sharee & Owner Matching
  ---
  duration_ms: 59.232737
  ...
1..3
# tests 8
# suites 0
# pass 8
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 493.409122

............
----------------------------------------------------------------------
Ran 12 tests in 0.374s

OK

🤖 Generated with Claude Code

The Radicale rights plugin now returns deny-delete 'rwd'/'rd' for sharees at every depth (including the calendar itself), so a read-write sharee can no longer delete the owner's calendar. The owner gets 'rw' instead of 'RWDrwd', since D/d are deny bits that blocked owners from deleting their own calendars. Tests that pinned the old strings were inverted to assert the owner can delete and sharees cannot.

Refs #192

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@BeSovereign
BeSovereign merged commit ffc23ea into master Oct 13, 2026
0 of 5 checks passed
@BeSovereign
BeSovereign deleted the fix/issue-192 branch October 13, 2026 08:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant