Radicale 3.8.2__tar.gz → 3.9.0__tar.gz

{radicale-3.8.2 → radicale-3.9.0}/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 3.9.0
+* Add: [server] type: serve with hypercorn, which additionally speaks HTTP/2 over cleartext (H2C) on the same socket (`pip install radicale[h2]`)
+* Adjustment WebUI: show incoming shares as cards
+* Fix: typo in /.mobileconfig
+* Fix: empty text-match filter no longer fails the REPORT
+* Improvement: sharing/api: reject unsupported overlay properties depending on collection type and conversion
+* Improvement: sharing/bday: remove default "(BDAY)" suffix from overlayed "displayname"
+* Fix: WebUI/Sharing: property overrides on transformed shares
+* Fix: PUT request: accept If-Match: * for an existing item
+* Add: new permission 'l' for locking properties by blocking write access to properties (PROPPATCH) and suppressing write-properties (PROPFIND)
+* Add: storage-hook supports now placeholder 'actor' (useful for shared collection)
+* Fix: REPORT with calendar-data parses every item with vobject just to count VEVENTs (10× slower than needed)
+* Fix: Honor zero-offset VALARM triggers in time-range filters
+* Fix: time-range filter on VTODO with only CREATED and COMPLETED
+* Fix: addressbook-query prop-filter defaults to test="anyof"
+* Fix: REPORT expand: non-recurring events with a TZID were time-range filtered by their local time read as UTC
+* Fix: sharing: broken support for custom database_path
+* Fix: auth/login-cache: add lock around remove expired entry
+* Fix: sharing/delete collection: fix uncatched collection URI without trailing '/'
+* Fix: auth/sharing+rights: refactoring "user_groups" handling to be thread-safe
+* Fix: auth/login-cache: partially missing thread-safety
+* Extension: contrib/Apache reference config supports now also HTTP2
+* Extension: HTTP version added to request log
+
+## 3.8.3
+* Fix: [group] htgroup: fix not working htgroup_cache=True
+* Fix: auth: clear rights/user_groups before conditional set depending on group_type/auth_type
+
 ## 3.8.2
 * Add: tests: sharing API plus CalDAV/CardDAV workflow and corrupt CSV handling (covers #2259)
 * Add: tests: mocked LDAP, IMAP, OAuth2 and PAM authentication servers (covers #2259)

{radicale-3.8.2 → radicale-3.9.0}/DOCUMENTATION.md

@@ -306,13 +306,13 @@ To enable and manage the service run:
 
 ```bash
 # Enable the service
-$ systemctl enable radicale
+systemctl enable radicale
 # Start the service
-$ systemctl start radicale
+systemctl start radicale
 # Check the status of the service
-$ systemctl status radicale
+systemctl status radicale
 # View all log messages
-$ journalctl --unit radicale.service
+journalctl --unit radicale.service
 ```
 
 #### Linux with systemd as a user
@@ -340,13 +340,13 @@ To enable and manage the service run:
 
 ```bash
 # Enable the service
-$ systemctl --user enable radicale
+systemctl --user enable radicale
 # Start the service
-$ systemctl --user start radicale
+systemctl --user start radicale
 # Check the status of the service
-$ systemctl --user status radicale
+systemctl --user status radicale
 # View all log messages
-$ journalctl --user --unit radicale.service
+journalctl --user --unit radicale.service
 ```
 
 #### Windows with "NSSM - the Non-Sucking Service Manager"
@@ -467,6 +467,34 @@ Be reminded that Radicale's default configuration enforces limits on the
 maximum number of parallel connections, the maximum file size and the rate of
 incorrect authentication attempts. Connections are terminated after a timeout.
 
+#### HTTP/2 to the backend
+
+The examples above forward to Radicale over HTTP/1.x. The built-in server
+answers HTTP/1.0 and closes after each request; with `type = hypercorn` (see
+[Configuration/Server](#server)) the hop keeps connections alive instead, and it
+can speak **HTTP/2 over cleartext (H2C)** on the same socket: the connection
+starts with the HTTP/2 client preface, so a proxy configured to use HTTP/2 for
+this upstream gets it without terminating TLS itself.
+
+The reason to prefer it is request smuggling. Smuggling needs a connection that
+carries more than one request, and two peers that disagree on where the first
+one ends: most commonly a `Content-Length` header pulling against a
+`Transfer-Encoding` header, or duplicate `Transfer-Encoding` headers that the
+two peers combine or drop differently. HTTP/2 leaves nothing to disagree
+about — every frame carries its own length, a request ends at an explicit
+end-of-stream, and a `content-length` that contradicts the data is a stream
+error (RFC 9113). The hop that changes is the last one, so no HTTP/1.1
+downgrade is introduced, and the client-side hop is unchanged: this removes
+the ambiguity on one hop, not on the path end to end.
+
+With `ssl = True` `hypercorn` serves HTTP/2 over TLS by ALPN too, so the
+encrypted hop described under [Secure connection between Radicale and the
+reverse proxy](#secure-connection-between-radicale-and-the-reverse-proxy) can
+use it; the proxy still has to be told to use HTTP/2 for that upstream.
+
+`type = builtin` stays the default, so a proxy that forwards to it keeps working
+exactly as before.
+
 #### Manage user accounts with the reverse proxy
 
 Set the configuration option `type` in the `auth` section to
@@ -798,9 +826,60 @@ The following describes all configuration sections and options.
 The configuration options in this section are only relevant in standalone
 mode; they are ignored, when Radicale runs on WSGI.
 
+##### type
+
+_(>= 3.9.0)_
+
+The server to run: `builtin` (the default) or `hypercorn`.
+
+The built-in server answers HTTP/1.0 and closes after each request. `hypercorn`
+keeps connections alive and also serves **HTTP/2 over cleartext (H2C)** on the
+same socket, which is what a reverse proxy in front of Radicale needs to speak
+HTTP/2 without terminating TLS itself; it is an optional dependency, installed
+with the `h2` extra using `pip install radicale[h2]` or by underlying
+OS (package name: 'python3-hypercorn'), supported version: hypercorn>=0.17.
+Asking for it when it is not installed fails with an error
+naming the extra instead of falling back to the built-in server.
+
+With `hypercorn` the TLS options are used as they are (`ssl`, `certificate`,
+`key`, `certificate_authority`, `ciphersuite`) and `max_content_length` is
+handed over to it — without that, hypercorn's own WSGI body limit of 16 Mbyte
+would answer a larger request with `400` before Radicale sees it. Two details
+change: `protocol` is **ignored** (hypercorn sets its own TLS versions, TLSv1.2
+at the minimum) and an unset `ciphersuite` means hypercorn's default cipher
+list rather than the system one. `max_connections` and `timeout` configure the
+built-in server only, and a request that is still in flight is given three
+seconds when the server stops.
+
+Default: `builtin`
+
+Note: while `builtin` has internal support for handling IPv4 and IPv6 binding
+ separate, `hypercorn` hasn't as of now. Following config runs into error
+message
+
+```ini
+[server]
+hosts = [::]:5232,0.0.0.0:5232
+```
+
+while having (here OS Linux):
+
+``` bash
+# Sysctl status:
+sysctl net.ipv6.bindv6only
+net.ipv6.bindv6only = 0
+```
+
+Solutions:
+ - reduce `hosts` config to IPv4 or IPv6
+ - adjust toggle on OS Linux by `sysctl -w net.ipv6.bindv6only=1` (don't forget to make this permanent)
+
 ##### hosts
 
-A comma separated list of addresses that the server will bind to.
+A comma separated list of addresses that the server will bind to. A host name
+is bound on every address it resolves to, as with the built-in server; with
+`hypercorn` a failure to bind one of them stops the server, while the built-in
+one logs it and serves the others.
 
 Default: `localhost:5232`
 
@@ -1705,11 +1784,12 @@ tutorial for an example.
 Default: (unset)
 
 Supported placeholders:
- - `%(user)s`: logged-in user
+ - `%(user)s`: logged-in (or in case of sharing: mapped) user
  - `%(cwd)s`: current working directory _(>= 3.5.1)_
  - `%(path)s`: full path of item _(>= 3.5.1)_
  - `%(to_path)s`: full path of destination item (only set on MOVE request) _(>= 3.5.5)_
  - `%(request)s`: request method _(>= 3.5.5)_
+ - `%(actor)s`: logged-in user _(>= 3.9.0)_
 
 The command will be executed with base directory defined in `filesystem_folder` (see above)
 
@@ -1939,7 +2019,7 @@ Log storage cache actions on `level = debug`
 
 Default: `False`
 
-##### profiling_per_request
+##### profiling
 
 _(>= 3.5.10)_
 
@@ -2076,7 +2156,7 @@ _(>= 3.5.5)_
 
 Port on SMTP server to connect to.
 
-Default:
+Default: `25`
 
 ##### smtp_security
 
@@ -2397,7 +2477,7 @@ _(>= 3.7.0)_
 
 Default permissions for create token-based sharing
 
-Default: `r`
+Default: `r` _(< 3.7.1)_ / `rp` _(>= 3.7.1)_
 
 Supported: `rfwEePp`
 
@@ -2580,7 +2660,7 @@ address books. Use Radicale's web interface or a client with support for it
 To create a new calendar run something like:
 
 ```bash
-$ curl -u user -X MKCOL 'http://localhost:5232/user/calendar' --data \
+curl -u user -X MKCOL 'http://localhost:5232/user/calendar' --data \
 '<?xml version="1.0" encoding="UTF-8" ?>
 <create xmlns="DAV:" xmlns:C="urn:ietf:params:xml:ns:caldav" xmlns:I="http://apple.com/ns/ical/">
   <set>
@@ -2605,7 +2685,7 @@ $ curl -u user -X MKCOL 'http://localhost:5232/user/calendar' --data \
 To create a new address book run something like:
 
 ```bash
-$ curl -u user -X MKCOL 'http://localhost:5232/user/addressbook' --data \
+curl -u user -X MKCOL 'http://localhost:5232/user/addressbook' --data \
 '<?xml version="1.0" encoding="UTF-8" ?>
 <create xmlns="DAV:" xmlns:CR="urn:ietf:params:xml:ns:carddav">
   <set>
@@ -2718,6 +2798,11 @@ The following `permissions` are recognized:
 * **t:** deny create of token-based sharing of collection in case `permit_create_token=True` _(>= 3.7.0)_
 * **M:** permit create of map-based sharing of collection in case `permit_create_map= False` _(>= 3.7.0)_
 * **m:** deny create of map-based sharing of collection in case `permit_create_map=True` _(>= 3.7.0)_
+* **P:** permit properties overlay in case permit_properties_overlay=False _(>= 3.7.0)_
+* **p:** deny properties overlay in case permit_properties_overlay=True _(>= 3.7.0)_
+* **E:** enable enforce properties overlay in case enforce_properties_overlay=False _(>= 3.7.0)_
+* **e:** disable enforce of properties overlay in case enforce_properties_overlay=True _(>= 3.7.0)_
+* **l:** lock properties (disable write-properties) _(>= 3.8.4)_
 
 ### Storage
 

{radicale-3.8.2 → radicale-3.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Radicale
-Version: 3.8.2
+Version: 3.9.0
 Summary: CalDAV and CardDAV Server
 Author-email: Guillaume Ayoub <guillaume.ayoub@kozea.fr>, Unrud <unrud@outlook.com>, Peter Bieringer <pb@bieringer.de>
 License: GNU GPL v3
@@ -39,6 +39,9 @@ Requires-Dist: bcrypt; extra == "test"
 Requires-Dist: argon2-cffi; extra == "test"
 Requires-Dist: pam; extra == "test"
 Requires-Dist: ldap3; extra == "test"
+Requires-Dist: hypercorn>=0.17; extra == "test"
+Provides-Extra: h2
+Requires-Dist: hypercorn>=0.17; extra == "h2"
 Provides-Extra: bcrypt
 Requires-Dist: bcrypt; extra == "bcrypt"
 Provides-Extra: argon2
@@ -56,8 +59,11 @@ Requires-Dist: pytest-playwright; extra == "dev"
 Requires-Dist: html5validator; extra == "dev"
 Provides-Extra: caldav-test
 Requires-Dist: pytest>=7; extra == "caldav-test"
-Requires-Dist: caldav>=3.0; python_version >= "3.10" and extra == "caldav-test"
-Requires-Dist: caldav-server-tester<2,>=1.2; python_version >= "3.10" and extra == "caldav-test"
+Requires-Dist: caldav==3.5.0; python_version >= "3.10" and extra == "caldav-test"
+Requires-Dist: caldav-server-tester==1.4.0; python_version >= "3.10" and extra == "caldav-test"
+Requires-Dist: icalendar==7.3.0; python_version >= "3.10" and extra == "caldav-test"
+Requires-Dist: icalendar-searcher==1.2.0; python_version >= "3.10" and extra == "caldav-test"
+Requires-Dist: recurring-ical-events==3.8.2; python_version >= "3.10" and extra == "caldav-test"
 Dynamic: license-file
 
 # Radicale

{radicale-3.8.2 → radicale-3.9.0}/Radicale.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Radicale
-Version: 3.8.2
+Version: 3.9.0
 Summary: CalDAV and CardDAV Server
 Author-email: Guillaume Ayoub <guillaume.ayoub@kozea.fr>, Unrud <unrud@outlook.com>, Peter Bieringer <pb@bieringer.de>
 License: GNU GPL v3
@@ -39,6 +39,9 @@ Requires-Dist: bcrypt; extra == "test"
 Requires-Dist: argon2-cffi; extra == "test"
 Requires-Dist: pam; extra == "test"
 Requires-Dist: ldap3; extra == "test"
+Requires-Dist: hypercorn>=0.17; extra == "test"
+Provides-Extra: h2
+Requires-Dist: hypercorn>=0.17; extra == "h2"
 Provides-Extra: bcrypt
 Requires-Dist: bcrypt; extra == "bcrypt"
 Provides-Extra: argon2
@@ -56,8 +59,11 @@ Requires-Dist: pytest-playwright; extra == "dev"
 Requires-Dist: html5validator; extra == "dev"
 Provides-Extra: caldav-test
 Requires-Dist: pytest>=7; extra == "caldav-test"
-Requires-Dist: caldav>=3.0; python_version >= "3.10" and extra == "caldav-test"
-Requires-Dist: caldav-server-tester<2,>=1.2; python_version >= "3.10" and extra == "caldav-test"
+Requires-Dist: caldav==3.5.0; python_version >= "3.10" and extra == "caldav-test"
+Requires-Dist: caldav-server-tester==1.4.0; python_version >= "3.10" and extra == "caldav-test"
+Requires-Dist: icalendar==7.3.0; python_version >= "3.10" and extra == "caldav-test"
+Requires-Dist: icalendar-searcher==1.2.0; python_version >= "3.10" and extra == "caldav-test"
+Requires-Dist: recurring-ical-events==3.8.2; python_version >= "3.10" and extra == "caldav-test"
 Dynamic: license-file
 
 # Radicale

{radicale-3.8.2 → radicale-3.9.0}/Radicale.egg-info/SOURCES.txt

@@ -99,11 +99,13 @@ radicale/web/internal_data/css/icon.png
 radicale/web/internal_data/css/loading.svg
 radicale/web/internal_data/css/logo.svg
 radicale/web/internal_data/css/main.css
+radicale/web/internal_data/css/icons/check-circle.svg
 radicale/web/internal_data/css/icons/delete.svg
 radicale/web/internal_data/css/icons/download.svg
 radicale/web/internal_data/css/icons/edit.svg
 radicale/web/internal_data/css/icons/eye.svg
 radicale/web/internal_data/css/icons/key.svg
+radicale/web/internal_data/css/icons/minus-circle.svg
 radicale/web/internal_data/css/icons/new.svg
 radicale/web/internal_data/css/icons/repeat.svg
 radicale/web/internal_data/css/icons/share.svg
@@ -119,7 +121,6 @@ radicale/web/internal_data/js/scenes/CollectionsScene.js
 radicale/web/internal_data/js/scenes/CreateEditCollectionScene.js
 radicale/web/internal_data/js/scenes/CreateEditShareScene.js
 radicale/web/internal_data/js/scenes/DeleteConfirmationScene.js
-radicale/web/internal_data/js/scenes/IncomingSharingScene.js
 radicale/web/internal_data/js/scenes/LoadingScene.js
 radicale/web/internal_data/js/scenes/LoginScene.js
 radicale/web/internal_data/js/scenes/ShareCollectionScene.js

{radicale-3.8.2 → radicale-3.9.0}/Radicale.egg-info/requires.txt

@@ -14,8 +14,11 @@ bcrypt
 pytest>=7
 
 [caldav_test:python_version >= "3.10"]
-caldav>=3.0
-caldav-server-tester<2,>=1.2
+caldav==3.5.0
+caldav-server-tester==1.4.0
+icalendar==7.3.0
+icalendar-searcher==1.2.0
+recurring-ical-events==3.8.2
 
 [dev]
 flake8
@@ -25,6 +28,9 @@ pytest
 pytest-playwright
 html5validator
 
+[h2]
+hypercorn>=0.17
+
 [ldap]
 ldap3
 
@@ -38,3 +44,4 @@ bcrypt
 argon2-cffi
 pam
 ldap3
+hypercorn>=0.17

{radicale-3.8.2 → radicale-3.9.0}/config

@@ -11,7 +11,11 @@
 
 [server]
 
-# CalDAV server hostnames separated by a comma
+# Server to run
+# Value: builtin (HTTP/1.0) | hypercorn (HTTP/1 + HTTP/2 incl. H2C)
+#type = builtin
+
+# Server IP addresses or hostnames separated by a comma the server will bind to
 # IPv4 syntax: address:port
 # IPv6 syntax: [address]:port
 # Hostname syntax (using "getaddrinfo" to resolve to IPv4/IPv6 adress(es)): hostname:port
@@ -178,7 +182,7 @@
 #oauth2_client_secret =
 
 # PAM service
-#pam_serivce = radicale
+#pam_service = radicale
 
 # PAM group user should be member of
 #pam_group_membership =

{radicale-3.8.2 → radicale-3.9.0}/pyproject.toml

@@ -3,7 +3,7 @@ name = "Radicale"
 # When the version is updated, a new section in the CHANGELOG.md file must be
 # added too.
 readme = "README.md"
-version = "3.8.2"
+version = "3.9.0"
 authors = [{name = "Guillaume Ayoub", email = "guillaume.ayoub@kozea.fr"}, {name = "Unrud", email = "unrud@outlook.com"}, {name = "Peter Bieringer", email = "pb@bieringer.de"}]
 license = {text = "GNU GPL v3"}
 description = "CalDAV and CardDAV Server"
@@ -40,13 +40,25 @@ dependencies = [
 
 
 [project.optional-dependencies]
-test = ["pytest>=7", "waitress", "bcrypt", "argon2-cffi", "pam", "ldap3"]
+test = ["pytest>=7", "waitress", "bcrypt", "argon2-cffi", "pam", "ldap3", "hypercorn>=0.17"]
+h2 = ["hypercorn>=0.17"]
 bcrypt = ["bcrypt"]
 argon2 = ["argon2-cffi"]
 ldap = ["ldap3"]
 pam = ["pam"]
 dev = ["flake8", "isort", "mypy", "pytest", "pytest-playwright", "html5validator"]
-caldav_test = ["pytest>=7", "caldav>=3.0; python_version >= '3.10'", "caldav-server-tester>=1.2,<2; python_version >= '3.10'"]
+# Exact pins: the observed feature report depends on the client libraries
+# (feature model, search matching, recurrence expansion), not only on
+# caldav-server-tester, so they are all frozen together. This is the single
+# place to bump them, see caldav_compat_tests/README.md.
+caldav_test = [
+    "pytest>=7",
+    "caldav==3.5.0; python_version >= '3.10'",
+    "caldav-server-tester==1.4.0; python_version >= '3.10'",
+    "icalendar==7.3.0; python_version >= '3.10'",
+    "icalendar-searcher==1.2.0; python_version >= '3.10'",
+    "recurring-ical-events==3.8.2; python_version >= '3.10'",
+]
 
 [project.scripts]
 radicale = "radicale.__main__:run"
@@ -226,7 +238,7 @@ commands = [["mypy", "--install-types", "--non-interactive", "."]]
 skip_install = true
 
 [tool.tox.env.integ_test]
-description = "Server+WebUI: run 'playwright' integration tests (with 'chromium')"
+description = "Server+WebUI: run 'playwright' integration tests (with 'chromium', may require additional system libs, check with 'ldd `find .tox/ -name chrome-headless-shell` | grep found')"
 deps = ["pytest", "pytest-playwright"]
 # Store Playwright browsers inside .tox for better caching
 setenv = { PLAYWRIGHT_BROWSERS_PATH = "{toxworkdir}/.playwright" }
@@ -235,12 +247,10 @@ commands = [["pytest", "integ_tests"]]
 
 [tool.tox.env.caldav_compat_test]
 description = "Server: run caldav compatibility tests"
+# versions are pinned in project.optional-dependencies.caldav_test
 extras = ["caldav_test"]
-deps = [
-    "caldav",
-    "caldav_server_tester==1.2.0",  # synchronize version with .github/workflows/test.yml#caldav-compat-test
-    "pytest"
-]
+deps = "{[project.optional-dependencies]caldav_test}"
+allowlist_externals = [ "pytest" ]
 commands = [["pytest", "caldav_compat_tests"]]
 
 [tool.tox.env.js]
@@ -252,7 +262,7 @@ commands = [["npx", "-y", "-p", "typescript@7.0.2", "tsc", "-p", "radicale/web/j
 skip_install = true
 
 [tool.tox.env.html5validator]
-description = "WebUI: validate HTML"
+description = "WebUI: validate HTML (requires 'java', e.g. 'java-latest-openjdk-headless')"
 deps = ["html5validator-2"]
 commands = [["html5validator", "--root", "radicale/web/internal_data/", "--also-check-css"]]
 

{radicale-3.8.2 → radicale-3.9.0}/radicale/app/__init__.py

@@ -472,9 +472,10 @@ class Application(ApplicationPartDelete, ApplicationPartHead,
             https_info = " " + environ.get("SSL_PROTOCOL", "") + " " + environ.get("SSL_CIPHER", "")
         else:
             https_info = ""
-        logger.info("%s request for %r%s received from %s%s%s",
+        http_proto = " " + environ["SERVER_PROTOCOL"]
+        logger.info("%s request for %r%s received from %s%s%s%s",
                     request_method, unsafe_path, depthinfo,
-                    remote_host, remote_useragent_txt, https_info)
+                    remote_host, remote_useragent_txt, http_proto, https_info)
         if self._request_header_on_debug:
             if logger.isEnabledFor(logging.DEBUG):
                 logger.debug("Request header:\n%s",
@@ -554,11 +555,12 @@ class Application(ApplicationPartDelete, ApplicationPartHead,
                 self.configuration, environ, base64.b64decode(
                     authorization.encode("ascii"))).split(":", 1)
 
+        user_groups: set = set([])
         if login and not app_base._check_user_format(self._storage, login, self._validate_user_value, self._urldecode_username):
             info = "not compliant to %r" % self._validate_user_value
             user = ""
         else:
-            (user, info) = self._auth.login(login, password, context) or ("", "") if login else ("", "")
+            (user, info, user_groups) = self._auth.login(login, password, context) or ("", "", set([])) if login else ("", "", set([]))
         request_info: dict = {
                               "method": request_method,
                               "login": login, # not 'user' in this step
@@ -603,14 +605,14 @@ class Application(ApplicationPartDelete, ApplicationPartHead,
 
         if user:
             group_type = self.configuration.get("group", "type")
-            if group_type in ["htgroup"]:
-                self._rights._user_groups = self._group.groups(login) if login else set([])
+            if group_type in ["htgroup"] and login:
+                user_groups = self._group.groups(login)
+                logger.debug("Groups received from %r: %r", group_type, ",".join(user_groups))
             elif group_type in ["from_auth"]:
                 auth_type = self.configuration.get("auth", "type")
                 if auth_type in ["ldap", "pam"]:
                     try:
-                        logger.debug("Groups received from %r: %r", auth_type, ",".join(self._auth._groups))
-                        self._rights._user_groups = self._auth._groups
+                        logger.debug("Groups received from %r: %r", auth_type, ",".join(user_groups))
                     except AttributeError:
                         pass
 
@@ -621,8 +623,8 @@ class Application(ApplicationPartDelete, ApplicationPartHead,
                 principal = next(iter(self._storage.discover(
                     principal_path, depth="1")), None)
             if not principal:
-                if "W" in self._rights.authorization(user, principal_path):
-                    with self._storage.acquire_lock("w", user):
+                if "W" in self._rights.authorization(user, user_groups, principal_path):
+                    with self._storage.acquire_lock("w", user, actor=user):
                         try:
                             new_coll, _, _ = self._storage.create_collection(principal_path)
                             if new_coll:
@@ -677,7 +679,7 @@ class Application(ApplicationPartDelete, ApplicationPartHead,
                     status, headers, answer, xml_request = httputils.METHOD_NOT_ALLOWED
                 else:
                     status, headers, answer, xml_request = function(
-                        environ, base_prefix, path, user, request_info)
+                        environ, base_prefix, path, user, user_groups, request_info)
             except PermissionError as e:
                 logger.error("PermissionError: %s", e)
                 status, headers, answer, xml_request = httputils.INTERNAL_SERVER_ERROR

{radicale-3.8.2 → radicale-3.9.0}/radicale/app/base.py

@@ -267,6 +267,7 @@ class Access:
     """Helper class to check access rights of an item"""
 
     user: str
+    user_groups: set
     path: str
     parent_path: str
     permissions: str
@@ -274,13 +275,14 @@ class Access:
     _parent_permissions: Optional[str]
     _permissions_filter: Union[str, None] = None
 
-    def __init__(self, rights: rights.BaseRights, user: str, path: str, permissions_filter: Union[str, None] = None
+    def __init__(self, rights: rights.BaseRights, user: str, user_groups: set, path: str, permissions_filter: Union[str, None] = None
                  ) -> None:
         self._rights = rights
         self.user = user
+        self.user_groups = user_groups
         self.path = path
         self.parent_path = pathutils.parent_path(path)
-        self.permissions = self._rights.authorization(self.user, self.path)
+        self.permissions = self._rights.authorization(self.user, self.user_groups, self.path)
         if permissions_filter is not None:
             self._permissions_filter = permissions_filter
             self.permissions = intersect(
@@ -293,7 +295,7 @@ class Access:
             return self.permissions
         if self._parent_permissions is None:
             self._parent_permissions = self._rights.authorization(
-                self.user, self.parent_path)
+                self.user, self.user_groups, self.parent_path)
         if self._permissions_filter is not None:
             self._parent_permissions = intersect(
                 _with_implied_freebusy(self._parent_permissions),
@@ -302,7 +304,7 @@ class Access:
 
     def check(self, permission: str,
               item: Optional[types.CollectionOrItem] = None) -> bool:
-        if permission not in "rwdDoO":
+        if permission not in rights.INTERNAL_PERMISSIONS_ITEM:
             raise ValueError("Invalid permission argument: %r" % permission)
         if not item:
             permissions = permission + permission.upper()

{radicale-3.8.2 → radicale-3.9.0}/radicale/app/delete.py

@@ -23,7 +23,7 @@ from http import client
 from typing import Optional, Union
 from urllib.parse import quote
 
-from radicale import httputils, sharing, storage, types, xmlutils
+from radicale import httputils, storage, types, xmlutils
 from radicale.app.base import Access, ApplicationBase
 from radicale.hook import HookNotificationItem, HookNotificationItemTypes
 from radicale.log import logger
@@ -66,27 +66,23 @@ def xml_delete(base_prefix: str, path: str, collection: storage.BaseCollection,
 class ApplicationPartDelete(ApplicationBase):
 
     def do_DELETE(self, environ: types.WSGIEnviron, base_prefix: str,
-                  path: str, user: str, request_info: dict) -> types.WSGIResponse:
+                  path: str, user: str, user_groups: set, request_info: dict) -> types.WSGIResponse:
         """Manage DELETE request."""
         actor = user
         permissions_filter = None
         share = None
         if self._sharing._enabled:
             # Sharing by token or map (if enabled)
-            share = self._sharing.sharing_collection_resolver(path, user)
-            user_lookup = user
-            if self._rights._user_groups is not None and len(self._rights._user_groups) > 0:
-                user_lookup += sharing.SHARING_SEPARATOR_GROUP + ','.join(self._rights._user_groups)
-            share = self._sharing.sharing_collection_resolver(path, user_lookup)
+            share = self._sharing.sharing_collection_resolver(path, user, user_groups)
             if share:
-                if path.endswith('/'):
-                    logger.notice("delete of a mapped collection is never permitted: %r -> %r", share['PathOrToken'], path)
+                if share['PathMapped'].endswith('/'):
+                    logger.notice("delete of a mapped collection is never permitted: %r -> %r", share['PathOrToken'], share['PathMapped'])
                     return httputils.NOT_ALLOWED
                 # overwrite and run through extended permission check
                 path = share['PathMapped']
                 user = share['Owner']
                 permissions_filter = share['Permissions']
-        access = Access(self._rights, user, path, permissions_filter)
+        access = Access(self._rights, user, user_groups, path, permissions_filter)
         if not access.check("w"):
             return httputils.NOT_ALLOWED
         if self._sharing._enabled:
@@ -95,7 +91,7 @@ class ApplicationPartDelete(ApplicationBase):
                 if collections_share_list is not None and len(collections_share_list) > 0:
                     logger.notice("delete of a mapped collection in use (%d) is not permitted: %r", len(collections_share_list), path)
                     return httputils.CONFLICT
-        with self._storage.acquire_lock("w", user, path=path, request="DELETE"):
+        with self._storage.acquire_lock("w", user, path=path, request="DELETE", actor=actor):
             item = next(iter(self._storage.discover(path)), None)
             if not item:
                 return httputils.NOT_FOUND