Show an administrator a share as a share #187

Merged

jcoffey-dev merged 1 commits from fix/admin-calendar-rights into main

2026-10-10 07:53:40 +00:00

Author	SHA1	Message	Date
jcoffey-dev	c2ea132d3a	Show an administrator a share as a share ci / fork-checks (pull_request) Skipped Details ci / build (pull_request) Skipped Details github/ci (branch) GitHub Actions Details ci / github (pull_request) Successful in 6m5s Details In an account that shared something with them, an administrator's JMAP reads now go through the share like anyone else's: Mailbox/get, Calendar/get, AddressBook/get and FileNode/get list only what was shared, with the share's myRights, and mail, events, contacts, files, threads, changes, free/busy and blob downloads stay inside it. Before, Impersonate made the administrator the owner of every account, so clients listed every calendar of a sharing account as shared, with full rights, and loaded its private events. A share grant also counts only for its own principal and its groups now. Matching it with is_member made an Impersonate holder every grantee. Writes still follow is_member, and so does any account that hasn't shared with the administrator. The audit record for an administrator in a sharing account stays as GHSA-m992-gp7g-wc2j left it. Fixes #186	2026-10-10 00:36:17 -07:00

Author

SHA1

Message

Date

jcoffey-dev

c2ea132d3a

Show an administrator a share as a share

ci / fork-checks (pull_request) Skipped

Details

ci / build (pull_request) Skipped

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 6m5s

Details

In an account that shared something with them, an administrator's JMAP
reads now go through the share like anyone else's: Mailbox/get,
Calendar/get, AddressBook/get and FileNode/get list only what was shared,
with the share's myRights, and mail, events, contacts, files, threads,
changes, free/busy and blob downloads stay inside it. Before, Impersonate
made the administrator the owner of every account, so clients listed every
calendar of a sharing account as shared, with full rights, and loaded its
private events.

A share grant also counts only for its own principal and its groups now.
Matching it with is_member made an Impersonate holder every grantee.

Writes still follow is_member, and so does any account that hasn't shared
with the administrator. The audit record for an administrator in a sharing
account stays as GHSA-m992-gp7g-wc2j left it.

Fixes #186

2026-10-10 00:36:17 -07:00