Edit/Delete on an event in a shared (writable) calendar is sent to the reader's own account; can't create events in a shared calendar

dwofford commented

2026-10-09 22:18:34 +00:00

Found by reading the source; not yet reproduced with two live accounts.

What happens

EventInstance (web/src/store/calendar.ts:13-21) carries no account id.
createEvent, updateEvent, destroyEvent and rsvp all use get().accountId, the reader's own account (store/calendar.ts around lines 710-781).
EventPopover.tsx:26 still shows Edit and Delete when the share grants mayWriteAll / mayWriteOwn.
So an edit or delete of a shared event is sent as CalendarEvent/set to the reader's account with the owner's event id. JMAP ids are per account, so the result is notFound, or, if the reader happens to own an event with the same id, a change to the reader's own unrelated event.
EventEditor.tsx:110 only lists the reader's own calendars as a save target, so a new event can't be created in a shared calendar even with write rights.

Expected
Writes to a shared calendar go to the owner's account (the accountId the shared calendar was loaded from), and writable shared calendars appear in the editor's calendar picker.

Suggested fix
Add accountId to EventInstance (shared events already have it via sharedKey), pass it to the four store calls instead of get().accountId, and include writable SharedCalendars in the editor's picker.

Environment
ihasmail 2026.10.5+g20c32ed / main 2649c00, Stalwart 0.16.23 with calendar shares (shareWith) between accounts.

Found by reading the source; not yet reproduced with two live accounts. **What happens** - EventInstance (web/src/store/calendar.ts:13-21) carries no account id. - createEvent, updateEvent, destroyEvent and rsvp all use get().accountId, the reader's own account (store/calendar.ts around lines 710-781). - EventPopover.tsx:26 still shows Edit and Delete when the share grants mayWriteAll / mayWriteOwn. - So an edit or delete of a shared event is sent as CalendarEvent/set to the reader's account with the owner's event id. JMAP ids are per account, so the result is notFound, or, if the reader happens to own an event with the same id, a change to the reader's own unrelated event. - EventEditor.tsx:110 only lists the reader's own calendars as a save target, so a new event can't be created in a shared calendar even with write rights. **Expected** Writes to a shared calendar go to the owner's account (the accountId the shared calendar was loaded from), and writable shared calendars appear in the editor's calendar picker. **Suggested fix** Add accountId to EventInstance (shared events already have it via sharedKey), pass it to the four store calls instead of get().accountId, and include writable SharedCalendars in the editor's picker. **Environment** ihasmail 2026.10.5+g20c32ed / main 2649c00, Stalwart 0.16.23 with calendar shares (shareWith) between accounts.

jcoffey-dev added the bug

priority

p1

labels 2026-10-09 22:22:48 +00:00

jcoffey-dev self-assigned this 2026-10-09 22:22:48 +00:00

jcoffey-dev added the due date 2026-10-11

2026-10-09 22:28:44 +00:00

jcoffey-dev referenced this issue from a commit

2026-10-09 22:34:01 +00:00

Calendar: write shared events in the account that holds them

jcoffey-dev referenced a pull request that will close this issue

2026-10-09 22:34:22 +00:00

Calendar: write shared events in the account that holds them #50

jcoffey-dev referenced this issue from a commit

2026-10-09 22:35:12 +00:00

Calendar: write shared events in the account that holds them

jcoffey-dev referenced this issue from inbuxa/inbuxa-webmail

2026-10-09 22:35:17 +00:00

Calendar: write shared events in the account that holds them #61

jcoffey-dev closed this issue

2026-10-09 22:53:19 +00:00

jcoffey-dev commented

2026-10-09 22:53:37 +00:00

Owner

Thanks @dwofford, this was a great catch and your write-up made it easy. Fixed in #50: changes to a shared event now go to the owner's account, and you can add events to a calendar shared with you for writing. It'll be in Monday's release.

dwofford commented

2026-10-09 22:58:17 +00:00

Author

Thanks John, that was fast! Really appreciate it. I'll update as soon as Monday's release is out and let you know if anything looks off with a real share between two accounts.

jcoffey-dev commented

2026-10-10 01:47:09 +00:00

Owner

This is live on ihasmail.com now too. Self-hosted gets it in Monday's release.

jcoffey-dev referenced this issue from inbuxa/inbuxa-server

2026-10-10 07:47:21 +00:00

Show an administrator a share as a share #187

Edit/Delete on an event in a shared (writable) calendar is sent to the reader's own account; can't create events in a shared calendar #49