Delegates reach the whole locked account

A delegate's token listed the locked account only for kinds of data it held grants on, so one with no files (or no calendar) was refused to the delegate outright: "You do not have access to account". The token now lists the locked account for mail, calendars, contacts and files alike, so an empty kind reads as empty. What the delegate may see or change is still each container's grant (AL-7).
2026-09-27 17:58:50 -07:00
parent 7720a57ac9
commit d4d127fa7d
2 changed files with 37 additions and 0 deletions
@@ -143,6 +143,29 @@ impl Server {
                        }
                    }
                }
+                // inbuxa: AL-7: a delegate reaches the whole locked account,
+                // mail, calendars, contacts and files, even a kind it holds
+                // none of yet, so an empty one reads as empty rather than
+                // refused. What it may see or change there is still each
+                // container's grant.
+                for delegation in delegations.iter() {
+                    let whole: Bitmap<Collection> = Bitmap::from_iter([
+                        Collection::Mailbox,
+                        Collection::Email,
+                        Collection::Calendar,
+                        Collection::CalendarEvent,
+                        Collection::AddressBook,
+                        Collection::ContactCard,
+                        Collection::FileNode,
+                    ]);
+                    match access_to.iter_mut().find(|a| a.account_id == delegation.account_id) {
+                        Some(entry) => entry.collections.union(&whole),
+                        None => access_to.push(AccessTo {
+                            account_id: delegation.account_id,
+                            collections: whole,
+                        }),
+                    }
+                }

                let now = now();
                let mut credential_version = 0;