Show an administrator a share as a share

jcoffey-dev commented

2026-10-10 07:47:13 +00:00

Owner

Fixes #186. In an account that shared something with them, an admin now reads only what was shared, with the share's rights, so the webmail stops listing every calendar of a sharing account and stops loading its private events. Writes and accounts that never shared with the admin are unchanged, and so is the audit record from GHSA-m992.

Checked with the two-account setup from coffey-labs/ihasmail#49: as an admin, Bob now sees only Alice's Team calendar and its events.

Fixes #186. In an account that shared something with them, an admin now reads only what was shared, with the share's rights, so the webmail stops listing every calendar of a sharing account and stops loading its private events. Writes and accounts that never shared with the admin are unchanged, and so is the audit record from GHSA-m992. Checked with the two-account setup from coffey-labs/ihasmail#49: as an admin, Bob now sees only Alice's Team calendar and its events.

jcoffey-dev added 1 commit 2026-10-10 07:47:14 +00:00

Show an administrator a share as a share

ci / fork-checks (pull_request) Skipped

Details

ci / build (pull_request) Skipped

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 6m5s

Details

c2ea132d3a

In an account that shared something with them, an administrator's JMAP
reads now go through the share like anyone else's: Mailbox/get,
Calendar/get, AddressBook/get and FileNode/get list only what was shared,
with the share's myRights, and mail, events, contacts, files, threads,
changes, free/busy and blob downloads stay inside it. Before, Impersonate
made the administrator the owner of every account, so clients listed every
calendar of a sharing account as shared, with full rights, and loaded its
private events.

A share grant also counts only for its own principal and its groups now.
Matching it with is_member made an Impersonate holder every grantee.

Writes still follow is_member, and so does any account that hasn't shared
with the administrator. The audit record for an administrator in a sharing
account stays as GHSA-m992-gp7g-wc2j left it.

Fixes #186

jcoffey-dev merged commit a9922960c9 into main

2026-10-10 07:53:40 +00:00

jcoffey-dev deleted branch fix/admin-calendar-rights

2026-10-10 07:53:41 +00:00

Show an administrator a share as a share #187