Radicale 3.8.1__tar.gz → 3.8.2__tar.gz

{radicale-3.8.1 → radicale-3.8.2}/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 3.8.2
+* Add: tests: sharing API plus CalDAV/CardDAV workflow and corrupt CSV handling (covers #2259)
+* Add: tests: mocked LDAP, IMAP, OAuth2 and PAM authentication servers (covers #2259)
+* Improve: storage hook: avoid using preexc_fn, use process_group
+* Add: sharing/token: plain GET and HEAD serve free/busy when Actions config `view` is `freebusy`
+* Add: WebUI read-only free/busy calendar URL under each calendar
+* Add: read-only free/busy view via GET ?view=freebusy
+* Fix: free-busy REPORT returns one VFREEBUSY with FREEBUSY periods and no event details (RFC 4791)
+* Add: rights permission `f` to read free-busy time without event details
+* Fix: free-busy REPORT does not expand transparent recurrences
+* Fix: sharing/bday-conversion: add proper RRULE and RECURRENCE-ID in case of "age" support is triggered
+* Fix: sharing/bday-conversion: do not serve item.vcf in parallel of item.ics
+* Fix: sharing/bday-conversion: adjust etag depending on template (item) or content (collection)
+* Fix: sharing/propfind: remove unexpected additional shares listed in case of request on collection with HTTP_DEPTH=1
+* Add: sharing/bday-conversion: X-RADICALE-NAME to generated bday items
+* Fix: sharing/propfind: suppress (resolved) shares having same URI as native ones
+* Fix: sharing/mkcol+mkcalendar: detect conflict with existing resolved shares
+* Fix: WebUI/sharing: display permissions and share-by-group
+* Performance: guard expensive logging with isEnabledFor (where missed)
+* Performance: use lazy formatting for logger calls (where missed)
+* Fix: delete/sharing: neither allow resolved share nor still mapped collections to be deleted
+* Fix: sharing: resolved share resulting in same path as original requested will not have precedence
+
 ## 3.8.1
 * Add: tests: optional caldav-server-tester based CalDAV compatibility test suite (caldav_compat_tests)
 * Fix: sharing/bday-conversion: add missing support for comma separated text components in vcard field N (name)

{radicale-3.8.1 → radicale-3.8.2}/DOCUMENTATION.md

@@ -2269,6 +2269,35 @@ is thrown instead of returning the results.
 
 Default: 10000
 
+##### freebusy_view_past_days
+
+_(>= 3.8.2)_
+
+Number of days before today included in the default window of the
+read-only free/busy view (`GET` or `HEAD` with `?view=freebusy`). The
+window starts at midnight UTC. `0` starts the window at midnight UTC
+today. A request that provides both `start` and `end`
+(`YYYYMMDDTHHMMSSZ`) overrides this default and
+`freebusy_view_future_days`.
+
+Default: 365
+
+##### freebusy_view_future_days
+
+_(>= 3.8.2)_
+
+Number of days after today included in the default window of the
+read-only free/busy view. The window ends at midnight UTC that many
+days ahead. `0` ends the window at midnight UTC today.
+
+Default: 365
+
+A share-by-token can omit `?view=freebusy`. Set that token's Actions
+config `view` to `freebusy`. Plain `GET` and `HEAD` of the token then
+use this view, including an optional `start` and `end`. Any other
+`view` value is rejected. Other methods keep the token permissions.
+See [Collection Sharing](https://github.com/Kozea/Radicale/blob/master/SHARING.md).
+
 #### [sharing]
 
 _(>= 3.7.0)_
@@ -2370,7 +2399,7 @@ Default permissions for create token-based sharing
 
 Default: `r`
 
-Supported: `rwEePp`
+Supported: `rfwEePp`
 
 ##### default_permissions_create_map
 
@@ -2380,7 +2409,7 @@ Default permissions for map-based sharing
 
 Default: `r`
 
-Supported: `rwEePp`
+Supported: `rfwEePp`
 
 ##### conversion_bday_summary_template
 
@@ -2388,7 +2417,7 @@ _(>= 3.7.5)_
 
 Global template for summary of conversion "bday"
 
-Default: `{{n:f} {n:g}|{fn}|{nickname}} ({year}) (BDAY)`
+Default: `[{n:f} {n:g}|{fn}|{nickname}] ({year}) (BDAY)`
 
 Supported placeholders (data used from VCARD)
  * `{year}`: year of birthday (RFC6350#6.2.5)
@@ -2677,6 +2706,8 @@ The following `permissions` are recognized:
 * **r:** read address book and calendar collections
 * **i:** subset of **r** that only allows direct access via HTTP method GET
   (CalDAV/CardDAV is susceptible to expensive search requests)
+* **f:** read the free-busy time of a calendar, without event details
+  (**r** includes this)
 * **W:** write collections (excluding address books and calendars)
 * **w:** write address book and calendar collections
 * **D:** allow deleting a collection in case `permit_delete_collection=False` _(>= 3.3.0)_

{radicale-3.8.1 → radicale-3.8.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Radicale
-Version: 3.8.1
+Version: 3.8.2
 Summary: CalDAV and CardDAV Server
 Author-email: Guillaume Ayoub <guillaume.ayoub@kozea.fr>, Unrud <unrud@outlook.com>, Peter Bieringer <pb@bieringer.de>
 License: GNU GPL v3

{radicale-3.8.1 → radicale-3.8.2}/Radicale.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Radicale
-Version: 3.8.1
+Version: 3.8.2
 Summary: CalDAV and CardDAV Server
 Author-email: Guillaume Ayoub <guillaume.ayoub@kozea.fr>, Unrud <unrud@outlook.com>, Peter Bieringer <pb@bieringer.de>
 License: GNU GPL v3

{radicale-3.8.1 → radicale-3.8.2}/Radicale.egg-info/SOURCES.txt

@@ -7,7 +7,6 @@ config
 pyproject.toml
 radicale.wsgi
 rights
-setup.cfg
 Radicale.egg-info/PKG-INFO
 Radicale.egg-info/SOURCES.txt
 Radicale.egg-info/dependency_links.txt

{radicale-3.8.1 → radicale-3.8.2}/config

@@ -372,11 +372,11 @@ type = none
 #enforce_properties_overlay = true
 
 # Default permissions for token-based sharing
-#   Supported: rwEePp
+#   Supported: rfwEePp
 #default_permissions_create_token = rp
 
 # Default permissions for map-based sharing
-#   Supported: rwEePp
+#   Supported: rfwEePp
 #default_permissions_create_map = r
 
 # Global template for summary of conversion "bday"
@@ -526,3 +526,9 @@ Content-Security-Policy = default-src 'self'; object-src 'none'
 # When returning a free-busy report, limit the number of returned
 # occurences per event to prevent DoS attacks.
 #max_freebusy_occurrence = 10000
+
+# Days before and after today in the default free-busy view
+# (?view=freebusy). The window is aligned to midnight UTC.
+# A request can override both with start and end.
+#freebusy_view_past_days = 365
+#freebusy_view_future_days = 365

{radicale-3.8.1 → radicale-3.8.2}/pyproject.toml

@@ -3,7 +3,7 @@ name = "Radicale"
 # When the version is updated, a new section in the CHANGELOG.md file must be
 # added too.
 readme = "README.md"
-version = "3.8.1"
+version = "3.8.2"
 authors = [{name = "Guillaume Ayoub", email = "guillaume.ayoub@kozea.fr"}, {name = "Unrud", email = "unrud@outlook.com"}, {name = "Peter Bieringer", email = "pb@bieringer.de"}]
 license = {text = "GNU GPL v3"}
 description = "CalDAV and CardDAV Server"
@@ -60,6 +60,7 @@ min_version = "4.0"
 envlist = ["flake8", "isort", "mypy", "py_loglevel_info", "py_radicale_loglevel_info", "py_radicale_loglevel_trace", "py", "integ_test", "caldav_compat_test", "html5validator"]
 
 [tool.tox.env.py]
+description = "Server: run 'pytest' (incl. coverage report)"
 extras = ["test"]
 deps = [
     "pytest",
@@ -68,6 +69,7 @@ deps = [
 commands = [["pytest", "-r", "s", "--cov", "--cov-report=term", "--cov-report=xml", "."]]
 
 [tool.tox.env.py_loglevel_info]
+description = "Server: run 'pytest' with log level 'INFO'"
 extras = ["test"]
 deps = [
     "pytest"
@@ -75,6 +77,7 @@ deps = [
 commands = [["pytest", "-r", "s", "--log-level", "INFO", "."]]
 
 [tool.tox.env.py_radicale_loglevel_info]
+description = "Server: run 'pytest' with radicale  on log level 'INFO'"
 extras = ["test"]
 setenv = { PYTEST_RADICALE_LOGLEVEL = "info" }
 deps = [
@@ -83,6 +86,7 @@ deps = [
 commands = [["pytest", "-r", "s", "--log-level", "INFO", "."]]
 
 [tool.tox.env.py_radicale_loglevel_trace]
+description = "Server: run 'pytest' with radicale  on log level 'TRACE'"
 extras = ["test"]
 setenv = { PYTEST_RADICALE_LOGLEVEL = "trace" }
 deps = [
@@ -91,6 +95,7 @@ deps = [
 commands = [["pytest", "-r", "s", "--log-level", "5", "."]]
 
 [tool.tox.env.py_filesystem_vfat]
+description = "Server: run 'pytest' with collection storage filesystem 'vfat' (on Linux)"
 allowlist_externals = [ "sudo", "dd", "mkfs.vfat", "mkdir", "rm", "rmdir", "chmod" ]
 extras = ["test"]
 deps = [
@@ -118,6 +123,7 @@ commands_post = [
 ]
 
 [tool.tox.env.py_filesystem_vfat_utf8]
+description = "Server: run 'pytest' with collection storage filesystem 'vfat+utf8' (on Linux)"
 allowlist_externals = [ "sudo", "dd", "mkfs.vfat", "mkdir", "rm", "rmdir", "chmod" ]
 extras = ["test"]
 deps = [
@@ -145,6 +151,7 @@ commands_post = [
 ]
 
 [tool.tox.env.py_filesystem_hfsplus]
+description = "Server: run 'pytest' with collection storage filesystem 'hfsplus' (on Linux)"
 # Fedora
 allowlist_externals = [ "sudo", "dd", "mkfs.hfsplus", "mkdir", "rm", "rmdir", "chmod" ]
 extras = ["test"]
@@ -173,6 +180,7 @@ commands_post = [
 ]
 
 [tool.tox.env.py_filesystem_ntfs]
+description = "Server: run 'pytest' with collection storage filesystem 'ntfs' (on Linux)"
 allowlist_externals = [ "sudo", "dd", "mkfs.ntfs", "mkdir", "rm", "rmdir", "chmod" ]
 extras = ["test"]
 deps = [
@@ -200,21 +208,25 @@ commands_post = [
 ]
 
 [tool.tox.env.flake8]
+description = "Server: test code style"
 deps = ["flake8==7.1.0"]
 commands = [["flake8", "."]]
 skip_install = true
 
 [tool.tox.env.isort]
+description = "Server: test import sort order"
 deps = ["isort==5.13.2"]
 commands = [["isort", "--check", "--diff", "."]]
 skip_install = true
 
 [tool.tox.env.mypy]
+description = "Server: test static types"
 deps = ["mypy==1.11.0"]
 commands = [["mypy", "--install-types", "--non-interactive", "."]]
 skip_install = true
 
 [tool.tox.env.integ_test]
+description = "Server+WebUI: run 'playwright' integration tests (with 'chromium')"
 deps = ["pytest", "pytest-playwright"]
 # Store Playwright browsers inside .tox for better caching
 setenv = { PLAYWRIGHT_BROWSERS_PATH = "{toxworkdir}/.playwright" }
@@ -222,15 +234,25 @@ commands_pre = [["playwright", "install", "chromium"]]
 commands = [["pytest", "integ_tests"]]
 
 [tool.tox.env.caldav_compat_test]
+description = "Server: run caldav compatibility tests"
 extras = ["caldav_test"]
 deps = [
     "caldav",
-    "caldav_server_tester",
+    "caldav_server_tester==1.2.0",  # synchronize version with .github/workflows/test.yml#caldav-compat-test
     "pytest"
 ]
 commands = [["pytest", "caldav_compat_tests"]]
 
+[tool.tox.env.js]
+# for optional local test as of now, copied from .github/workflows/test.yml
+# Fedora (will install nodejs): yum install npx
+description = "WebUI: validate JavaScript"
+allowlist_externals = [ "npx" ]
+commands = [["npx", "-y", "-p", "typescript@7.0.2", "tsc", "-p", "radicale/web/jsconfig.json"]]
+skip_install = true
+
 [tool.tox.env.html5validator]
+description = "WebUI: validate HTML"
 deps = ["html5validator-2"]
 commands = [["html5validator", "--root", "radicale/web/internal_data/", "--also-check-css"]]
 

{radicale-3.8.1 → radicale-3.8.2}/radicale/app/__init__.py

@@ -45,7 +45,7 @@ from radicale import config, httputils, log, pathutils, types, utils
 from radicale.app import base as app_base
 from radicale.app.base import ApplicationBase
 from radicale.app.delete import ApplicationPartDelete
-from radicale.app.get import ApplicationPartGet
+from radicale.app.get import ApplicationPartGet, requests_freebusy_view
 from radicale.app.head import ApplicationPartHead
 from radicale.app.mkcalendar import ApplicationPartMkcalendar
 from radicale.app.mkcol import ApplicationPartMkcol
@@ -305,7 +305,8 @@ class Application(ApplicationPartDelete, ApplicationPartHead,
                                     condition=self._response_content_on_notice_condition,
                                     value=request_info,
                                     ):
-                                logger.notice("Response content (nonXML, log condition passed):\n%s", utils.textwrap_str(answer, self._limit_content))
+                                if logger.isEnabledFor(log.LOG_LEVEL_NOTICE):
+                                    logger.notice("Response content (nonXML, log condition passed):\n%s", utils.textwrap_str(answer, self._limit_content))
                         else:
                             if logger.isEnabledFor(logging.DEBUG):
                                 logger.debug("Response content: suppressed by config/option [logging] response_content_on_debug")
@@ -340,7 +341,8 @@ class Application(ApplicationPartDelete, ApplicationPartHead,
                             condition=self._response_header_on_notice_condition,
                             value=request_info,
                             ):
-                        logger.notice("Response header (log condition passed):\n%s", utils.textwrap_str(pprint.pformat(headers), self._limit_content))
+                        if logger.isEnabledFor(log.LOG_LEVEL_NOTICE):
+                            logger.notice("Response header (log condition passed):\n%s", utils.textwrap_str(pprint.pformat(headers), self._limit_content))
                 else:
                     if logger.isEnabledFor(logging.DEBUG):
                         logger.debug("Response header: suppressed by config/option [logging] response_header_on_debug")
@@ -474,8 +476,9 @@ class Application(ApplicationPartDelete, ApplicationPartHead,
                     request_method, unsafe_path, depthinfo,
                     remote_host, remote_useragent_txt, https_info)
         if self._request_header_on_debug:
-            logger.debug("Request header:\n%s",
-                         utils.textwrap_str(pprint.pformat(self._scrub_headers(environ)), self._limit_content))
+            if logger.isEnabledFor(logging.DEBUG):
+                logger.debug("Request header:\n%s",
+                             utils.textwrap_str(pprint.pformat(self._scrub_headers(environ)), self._limit_content))
         else:
             if not self._request_header_on_notice_condition != {}:
                 # conditional request header logging is later
@@ -570,7 +573,8 @@ class Application(ApplicationPartDelete, ApplicationPartHead,
                     condition=self._request_header_on_notice_condition,
                     value=request_info,
                     ):
-                logger.notice("Request header (log condition passed):\n%s", utils.textwrap_str(pprint.pformat(self._scrub_headers(environ)), self._limit_content))
+                if logger.isEnabledFor(log.LOG_LEVEL_NOTICE):
+                    logger.notice("Request header (log condition passed):\n%s", utils.textwrap_str(pprint.pformat(self._scrub_headers(environ)), self._limit_content))
 
         if user and login == user:
             logger.info("Successful login: %r (%s)", user, info)
@@ -668,8 +672,12 @@ class Application(ApplicationPartDelete, ApplicationPartHead,
                     profiler_active = True
 
             try:
-                status, headers, answer, xml_request = function(
-                    environ, base_prefix, path, user, request_info)
+                if (requests_freebusy_view(environ) and
+                        request_method not in ("GET", "HEAD")):
+                    status, headers, answer, xml_request = httputils.METHOD_NOT_ALLOWED
+                else:
+                    status, headers, answer, xml_request = function(
+                        environ, base_prefix, path, user, request_info)
             except PermissionError as e:
                 logger.error("PermissionError: %s", e)
                 status, headers, answer, xml_request = httputils.INTERNAL_SERVER_ERROR

{radicale-3.8.1 → radicale-3.8.2}/radicale/app/base.py

@@ -215,7 +215,8 @@ class ApplicationBase:
                         condition=self._request_content_on_notice_condition,
                         value=request_info,
                         ):
-                    logger.notice("Request content (XML, log condition passed):\n%s", utils.textwrap_str(xmlutils.pretty_xml(xml_content)))
+                    if logger.isEnabledFor(log.LOG_LEVEL_NOTICE):
+                        logger.notice("Request content (XML, log condition passed):\n%s", utils.textwrap_str(xmlutils.pretty_xml(xml_content)))
                 else:
                     if logger.isEnabledFor(logging.DEBUG):
                         logger.debug("Request content (XML, log condition skipped): suppressed")
@@ -236,7 +237,8 @@ class ApplicationBase:
                         condition=self._response_content_on_notice_condition,
                         value=request_info,
                         ):
-                    logger.notice("Response content (XML, log condition passed):\n%s", utils.textwrap_str(xmlutils.pretty_xml(xml_content)))
+                    if logger.isEnabledFor(log.LOG_LEVEL_NOTICE):
+                        logger.notice("Response content (XML, log condition passed):\n%s", utils.textwrap_str(xmlutils.pretty_xml(xml_content)))
                 else:
                     if logger.isEnabledFor(logging.DEBUG):
                         logger.debug("Response content (XML, log condition skipped): suppressed")
@@ -255,6 +257,12 @@ class ApplicationBase:
         return status, headers, content, None
 
 
+def _with_implied_freebusy(permissions: str) -> str:
+    if "r" in permissions and "f" not in permissions:
+        return permissions + "f"
+    return permissions
+
+
 class Access:
     """Helper class to check access rights of an item"""
 
@@ -275,8 +283,8 @@ class Access:
         self.permissions = self._rights.authorization(self.user, self.path)
         if permissions_filter is not None:
             self._permissions_filter = permissions_filter
-            permissions_filtered = intersect(self.permissions, permissions_filter)
-            self.permissions = permissions_filtered
+            self.permissions = intersect(
+                _with_implied_freebusy(self.permissions), permissions_filter)
         self._parent_permissions = None
 
     @property
@@ -287,8 +295,9 @@ class Access:
             self._parent_permissions = self._rights.authorization(
                 self.user, self.parent_path)
         if self._permissions_filter is not None:
-            parent_permissions_filtered = intersect(self._parent_permissions, self._permissions_filter)
-            self._parent_permissions = parent_permissions_filtered
+            self._parent_permissions = intersect(
+                _with_implied_freebusy(self._parent_permissions),
+                self._permissions_filter)
         return self._parent_permissions
 
     def check(self, permission: str,
@@ -310,3 +319,11 @@ class Access:
         return bool(rights.intersect(self.permissions, permissions) or (
             self.path != self.parent_path and
             rights.intersect(self.parent_permissions, parent_permissions)))
+
+    def allows_freebusy(self, item: Optional[types.CollectionOrItem] = None
+                        ) -> bool:
+        if item is not None and (
+                not isinstance(item, storage.BaseCollection) or
+                item.tag != "VCALENDAR"):
+            return False
+        return "r" in self.permissions or "f" in self.permissions

{radicale-3.8.1 → radicale-3.8.2}/radicale/app/delete.py

@@ -79,6 +79,9 @@ class ApplicationPartDelete(ApplicationBase):
                 user_lookup += sharing.SHARING_SEPARATOR_GROUP + ','.join(self._rights._user_groups)
             share = self._sharing.sharing_collection_resolver(path, user_lookup)
             if share:
+                if path.endswith('/'):
+                    logger.notice("delete of a mapped collection is never permitted: %r -> %r", share['PathOrToken'], path)
+                    return httputils.NOT_ALLOWED
                 # overwrite and run through extended permission check
                 path = share['PathMapped']
                 user = share['Owner']
@@ -86,6 +89,12 @@ class ApplicationPartDelete(ApplicationBase):
         access = Access(self._rights, user, path, permissions_filter)
         if not access.check("w"):
             return httputils.NOT_ALLOWED
+        if self._sharing._enabled:
+            if not share:
+                collections_share_list = self._sharing.database_list_sharing(PathMapped=path)
+                if collections_share_list is not None and len(collections_share_list) > 0:
+                    logger.notice("delete of a mapped collection in use (%d) is not permitted: %r", len(collections_share_list), path)
+                    return httputils.CONFLICT
         with self._storage.acquire_lock("w", user, path=path, request="DELETE"):
             item = next(iter(self._storage.discover(path)), None)
             if not item:
@@ -100,11 +109,11 @@ class ApplicationPartDelete(ApplicationBase):
             if isinstance(item, storage.BaseCollection):
                 if self._permit_delete_collection:
                     if access.check("d", item):
-                        logger.info("delete of collection is permitted by config/option [rights] permit_delete_collection but explicit forbidden by permission 'd': %s", path)
+                        logger.info("delete of collection is permitted by config/option [rights] permit_delete_collection but explicit forbidden by permission 'd': %r", path)
                         return httputils.NOT_ALLOWED
                 else:
                     if not access.check("D", item):
-                        logger.info("delete of collection is prevented by config/option [rights] permit_delete_collection and not explicit allowed by permission 'D': %s", path)
+                        logger.info("delete of collection is prevented by config/option [rights] permit_delete_collection and not explicit allowed by permission 'D': %r", path)
                         return httputils.NOT_ALLOWED
                 if self._hook.enabled:
                     for i in item.get_all():

{radicale-3.8.1 → radicale-3.8.2}/radicale/app/get.py

@@ -18,17 +18,22 @@
 # You should have received a copy of the GNU General Public License
 # along with Radicale.  If not, see <http://www.gnu.org/licenses/>.
 
+import contextlib
+import datetime
 import plistlib
 import posixpath
+import re
 import urllib
 import uuid
 from http import client
-from typing import Union
-from urllib.parse import quote
+from typing import Tuple, Union
+from urllib.parse import parse_qs, quote
 
 from radicale import (httputils, pathutils, sharing, storage, types, utils,
                       xmlutils)
 from radicale.app.base import Access, ApplicationBase
+from radicale.app.report import freebusy_collection_text
+from radicale.item import get_etag
 from radicale.log import logger
 
 
@@ -57,6 +62,35 @@ def propose_filename(collection: storage.BaseCollection, share: Union[dict, None
     return title
 
 
+_FREEBUSY_VIEW_TIME = re.compile(r"[0-9]{8}T[0-9]{6}Z")
+
+
+def _parse_freebusy_view_time(value: str) -> datetime.datetime:
+    if _FREEBUSY_VIEW_TIME.fullmatch(value) is None:
+        raise ValueError("invalid free-busy view time: %r" % value)
+    return datetime.datetime.strptime(
+        value, "%Y%m%dT%H%M%SZ").replace(tzinfo=datetime.timezone.utc)
+
+
+def requests_freebusy_view(environ: types.WSGIEnviron) -> bool:
+    query = parse_qs(environ.get("QUERY_STRING", ""), keep_blank_values=True)
+    view = query.get("view")
+    return view is not None and "freebusy" in view
+
+
+def share_forces_freebusy_view(share: Union[dict, None]) -> bool:
+    """A token can request the free/busy view without ``?view=freebusy``."""
+    if not share or share.get("ShareType") != "token":
+        return False
+    actions = share.get("Actions")
+    if not isinstance(actions, dict):
+        return False
+    config = actions.get("config")
+    if not isinstance(config, dict):
+        return False
+    return config.get("view") == "freebusy"
+
+
 class ApplicationPartGet(ApplicationBase):
 
     def _content_disposition_attachment(self, filename: str) -> str:
@@ -71,6 +105,74 @@ class ApplicationPartGet(ApplicationBase):
             value += "; filename*=%s''%s" % (self._encoding, encoded_filename)
         return value
 
+    def _freebusy_view_range(
+            self, query: dict) -> Tuple[datetime.datetime, datetime.datetime]:
+        starts = query.get("start", [])
+        ends = query.get("end", [])
+        if not starts and not ends:
+            today = datetime.datetime.now(datetime.timezone.utc).replace(
+                hour=0, minute=0, second=0, microsecond=0)
+            past_days = self.configuration.get(
+                "reporting", "freebusy_view_past_days")
+            future_days = self.configuration.get(
+                "reporting", "freebusy_view_future_days")
+            return (today - datetime.timedelta(days=past_days),
+                    today + datetime.timedelta(days=future_days))
+        if len(starts) != 1 or len(ends) != 1:
+            raise ValueError("free-busy view requires both start and end")
+        start = _parse_freebusy_view_time(starts[0])
+        end = _parse_freebusy_view_time(ends[0])
+        if end < start:
+            raise ValueError("free-busy view end is before start")
+        return start, end
+
+    def _freebusy_view(self, environ: types.WSGIEnviron, path: str, user: str,
+                       access: Access, share: Union[dict, None]
+                       ) -> types.WSGIResponse:
+        if not access.allows_freebusy() and "i" not in access.permissions:
+            return httputils.NOT_ALLOWED
+        query = parse_qs(environ.get("QUERY_STRING", ""), keep_blank_values=True)
+        with contextlib.ExitStack() as lock_stack:
+            lock_stack.enter_context(self._storage.acquire_lock("r", user))
+            item = next(iter(self._storage.discover(path)), None)
+            if not item:
+                return httputils.NOT_FOUND
+            if (not isinstance(item, storage.BaseCollection) or
+                    item.tag != "VCALENDAR"):
+                return httputils.NOT_ALLOWED
+            if (not access.allows_freebusy(item) and
+                    "i" not in access.permissions):
+                return httputils.NOT_ALLOWED
+            if query.get("view") != ["freebusy"]:
+                return httputils.BAD_REQUEST
+            try:
+                range_start, range_end = self._freebusy_view_range(query)
+            except ValueError as e:
+                logger.warning("Bad free-busy view on %r: %s", path, e,
+                               exc_info=True)
+                return httputils.BAD_REQUEST
+            filename = propose_filename(item, share)
+            if filename.lower().endswith(".ics"):
+                filename = filename[:-4] + "-freebusy.ics"
+            else:
+                filename += "-freebusy.ics"
+            content_disposition = self._content_disposition_attachment(filename)
+            max_occurrence = self.configuration.get(
+                "reporting", "max_freebusy_occurrence")
+            try:
+                answer = freebusy_collection_text(
+                    item, range_start, range_end, max_occurrence,
+                    lock_stack.close)
+            except ValueError as e:
+                logger.warning("Bad free-busy view on %r: %s", path, e,
+                               exc_info=True)
+                return httputils.BAD_REQUEST
+        headers = {
+            "Content-Type": xmlutils.MIMETYPES["VCALENDAR"],
+            "ETag": get_etag(answer),
+            "Content-Disposition": content_disposition}
+        return client.OK, headers, answer, None
+
     def do_GET(self, environ: types.WSGIEnviron, base_prefix: str, path: str,
                user: str, request_info: dict) -> types.WSGIResponse:
         """Manage GET request."""
@@ -154,11 +256,30 @@ class ApplicationPartGet(ApplicationBase):
                 user_lookup += sharing.SHARING_SEPARATOR_GROUP + ','.join(self._rights._user_groups)
             share = self._sharing.sharing_collection_resolver(path, user_lookup)
             if share:
-                # overwrite and run through extended permission check
-                path = share['PathMapped']
-                user = share['Owner']
-                permissions_filter = share['Permissions']
+                if path != share['PathMapped']:
+                    # overwrite and run through extended permission check
+                    path = share['PathMapped']
+                    user = share['Owner']
+                    permissions_filter = share['Permissions']
+                else:
+                    logger.trace("GET/shares: skip overlap mapping: path=%r", path)
         access = Access(self._rights, user, path, permissions_filter)
+        if share_forces_freebusy_view(share):
+            query = parse_qs(environ.get("QUERY_STRING", ""), keep_blank_values=True)
+            view = query.get("view")
+            if view is None:
+                forced_environ = dict(environ)
+                current = str(forced_environ.get("QUERY_STRING") or "")
+                if current:
+                    forced_environ["QUERY_STRING"] = current + "&view=freebusy"
+                else:
+                    forced_environ["QUERY_STRING"] = "view=freebusy"
+                return self._freebusy_view(
+                    forced_environ, path, user, access, share)
+            if view != ["freebusy"]:
+                return httputils.BAD_REQUEST
+        if requests_freebusy_view(environ):
+            return self._freebusy_view(environ, path, user, access, share)
         if not access.check("r") and "i" not in access.permissions:
             return httputils.NOT_ALLOWED
         with self._storage.acquire_lock("r", user):
@@ -198,12 +319,23 @@ class ApplicationPartGet(ApplicationBase):
                 headers["Content-Disposition"] = content_disposition
             if share and share['Conversion'] == "bday":
                 if isinstance(item, storage.BaseCollection):
-                    # convert VCF to ICS
+                    # convert collection VCF to ICS
                     answer = item.serialize(vcf_to_ics=True, ShareActions=share['Actions'])
+                    # set etag header (64 <hexdigits>)
+                    #   4 chars special token: 'bda0'
+                    #   8 chars date         : 00000000
+                    #   2 chars separator    : 00
+                    #  32 chars              : leading content hash
+                    #   2 chars separator    : 00
+                    #  16 chars              : trailing original etag
+                    headers["ETag"] = '"bda0' + '00000000' + '00' + utils.sha256_str(answer)[:32] + '00' + item.etag[49:]
                 else:
+                    # convert item VCF to ICS
                     item_converted = item.convert_vcf_to_ics(ShareActions=share['Actions'])
                     if item_converted is not None:
                         answer = item_converted.serialize()
+                        # set etag header
+                        headers["ETag"] = item_converted.etag
                     else:
                         return httputils.NOT_FOUND
             else:

{radicale-3.8.1 → radicale-3.8.2}/radicale/app/mkcalendar.py

@@ -56,7 +56,7 @@ class ApplicationPartMkcalendar(ApplicationBase):
             return httputils.BAD_REQUEST
         if self._sharing._enabled:
             # check for shared collections (all)
-            collections_share_list = self._sharing.sharing_collection_list()
+            collections_share_list = self._sharing.sharing_collection_list(User=user)
             if collections_share_list:
                 for share in collections_share_list:
                     if share['PathOrToken'] == path:

{radicale-3.8.1 → radicale-3.8.2}/radicale/app/mkcol.py

@@ -63,7 +63,7 @@ class ApplicationPartMkcol(ApplicationBase):
             return httputils.NOT_ALLOWED
         if self._sharing._enabled:
             # check for shared collections (all)
-            collections_share_list = self._sharing.sharing_collection_list()
+            collections_share_list = self._sharing.sharing_collection_list(User=user)
             if collections_share_list:
                 for share in collections_share_list:
                     if share['PathOrToken'] == path: