Avii/Radicale
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #2066 from pbiering/sharing-propfind-expose-permissions

Browse Source 
Sharing propfind expose permissions
This commit is contained in:
Peter Bieringer
2026-04-03 17:31:58 +02:00
committed by GitHub
parent 7703af5eb5 a4aa42ec20
commit 6a90250192
6 changed files with 350 additions and 97 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
SHARING.md
View File

@@ -589,6 +589,24 @@ Whitelisted ones are defined in `OVERLAY_PROPERTIES_WHITELIST` in `radicale/shar
* `enforce_properties_overlay`
* supported *share* permissions: `Ee`
#### Properties Overlay Control Precedence
##### General Permission for Overlay
1. permission of particular share configuration: `p` or `P`
2. permission based on `rights` per location: `p` or `P`
3. config option: `permit_properties_overlay`
##### Enforce Overlay on Write
1. permission of particular share configuration: `e` or `E`
2. permission based on `rights` per location: `e` or `E`
3. config option: `enforce_properties_overlay`
### Properties Overlay Example
#### Requirements

111
radicale/app/propfind.py
View File

@@ -34,10 +34,16 @@ from radicale.app.base import Access, ApplicationBase
from radicale.log import logger
def xml_propfind(base_prefix: str, path: str,
xml_request: Optional[ET.Element],
allowed_items: Iterable[Tuple[types.CollectionOrItem, str, str]],
user: str, encoding: str, max_resource_size: int, shares: dict = {}) -> Optional[ET.Element]:
def xml_propfind(
self,
base_prefix: str,
path: str,
xml_request: Optional[ET.Element],
allowed_items: Iterable[Tuple[types.CollectionOrItem, str, str, str]],
user: str, encoding: str,
max_resource_size: int,
shares: dict = {},
) -> Optional[ET.Element]:
"""Read and answer PROPFIND requests.
Read rfc4918-9.1 for info.
@@ -73,19 +79,46 @@ def xml_propfind(base_prefix: str, path: str,
if logger.isEnabledFor(logging.DEBUG):
logger.debug("TRACE/PROPFIND/xml_propfind: shares=%r", shares)
for item, permission, conversion in allowed_items:
for item, permission, raw_permissions, conversion in allowed_items:
write = permission == "w"
multistatus.append(xml_propfind_response(
base_prefix, path, item, props, user, encoding, write=write,
allprop=allprop, propname=propname, max_resource_size=max_resource_size, shares=shares, conversion=conversion))
multistatus.append(
xml_propfind_response(
self,
base_prefix,
path,
item,
props,
user,
encoding,
write=write,
allprop=allprop,
propname=propname,
max_resource_size=max_resource_size,
shares=shares,
conversion=conversion,
raw_permissions=raw_permissions,
)
)
return multistatus
def xml_propfind_response(
base_prefix: str, path: str, item: types.CollectionOrItem,
props: Sequence[str], user: str, encoding: str, max_resource_size: int, write: bool = False,
propname: bool = False, allprop: bool = False, shares: dict = {}, conversion: Union[str, None] = None) -> ET.Element:
self,
base_prefix: str,
path: str,
item: types.CollectionOrItem,
props: Sequence[str],
user: str,
encoding: str,
max_resource_size: int,
write: bool = False,
propname: bool = False,
allprop: bool = False,
shares: dict = {},
conversion: Union[str, None] = None,
raw_permissions: str = "",
) -> ET.Element:
"""Build and return a PROPFIND response."""
if propname and allprop or (props and (propname or allprop)):
raise ValueError("Only use one of props, propname and allprops")
@@ -274,17 +307,34 @@ def xml_propfind_response(
elif tag == xmlutils.make_clark("D:current-user-privilege-set"):
privileges = ["D:read"]
if share:
if logger.isEnabledFor(logging.DEBUG):
logger.debug("TRACE/PROPFIND/xml_propfind_response/current-user-privilege-set: raw_permissions=%r share[Permissions]=%r permit_properties_overlay=%s", raw_permissions, share['Permissions'], self._sharing.permit_properties_overlay)
if write:
if "P" in share['Permissions']:
privileges.append("D:write-properties")
if "w" in share['Permissions']:
if not share_bday_automap:
privileges.append("D:write-content")
# priority share->rights->global
if ("P" in share['Permissions'] or
("P" in raw_permissions and "p" not in share['Permissions']) or
(self._sharing.permit_properties_overlay and "p" not in raw_permissions and "p" not in share['Permissions'])
) and not (
"p" in share['Permissions'] or
("p" in raw_permissions and "P" not in share['Permissions']) or
(self._sharing.permit_properties_overlay and "P" not in raw_permissions and "P" not in share['Permissions'])):
if logger.isEnabledFor(logging.DEBUG):
logger.debug("TRACE/PROPFIND/xml_propfind_response/current-user-privilege-set: add D:write-properties")
privileges.append("D:write-properties")
elif write:
privileges.append("D:all")
privileges.append("D:write")
privileges.append("D:write-properties")
privileges.append("D:write-content")
if ("T" in raw_permissions or (self._sharing.permit_create_token and "t" not in raw_permissions)):
privileges.append("RADICALE:share-token")
if ("M" in raw_permissions or (self._sharing.permit_create_map and "m" not in raw_permissions)):
privileges.append("RADICALE:share-map")
for human_tag in privileges:
privilege = ET.Element(xmlutils.make_clark("D:privilege"))
privilege.append(ET.Element(
@@ -470,26 +520,25 @@ class ApplicationPartPropfind(ApplicationBase):
def _collect_allowed_items(
self, items: Iterable[types.CollectionOrItem], user: str
) -> Iterator[Tuple[types.CollectionOrItem, str]]:
) -> Iterator[Tuple[types.CollectionOrItem, str, str]]:
"""Get items from request that user is allowed to access."""
for item in items:
if isinstance(item, storage.BaseCollection):
path = pathutils.unstrip_path(item.path, True)
raw_permissions = self._rights.authorization(user, path)
if logger.isEnabledFor(logging.DEBUG):
logger.debug("TRACE/PROPFIND/_collect_allowed_items/BaseCollection: path=%r user=%r", path, user)
logger.debug("TRACE/PROPFIND/_collect_allowed_items/BaseCollection: path=%r user=%r raw_permissions=%r", path, user, raw_permissions)
if item.tag:
permissions = rights.intersect(
self._rights.authorization(user, path), "rw")
permissions = rights.intersect(raw_permissions, "rw")
target = "collection with tag %r" % item.path
else:
permissions = rights.intersect(
self._rights.authorization(user, path), "RW")
permissions = rights.intersect(raw_permissions, "RW")
target = "collection %r" % item.path
else:
assert item.collection is not None
path = pathutils.unstrip_path(item.collection.path, True)
permissions = rights.intersect(
self._rights.authorization(user, path), "rw")
raw_permissions = self._rights.authorization(user, path)
permissions = rights.intersect(raw_permissions, "rw")
target = "item %r from %r" % (item.href, item.collection.path)
if rights.intersect(permissions, "Ww"):
permission = "w"
@@ -504,7 +553,7 @@ class ApplicationPartPropfind(ApplicationBase):
"%s has %s access to %s",
repr(user) if user else "anonymous user", status, target)
if permission:
yield item, permission
yield item, permission, raw_permissions
def do_PROPFIND(self, environ: types.WSGIEnviron, base_prefix: str,
path: str, user: str, remote_host: str, remote_useragent: str) -> types.WSGIResponse:
@@ -548,14 +597,14 @@ class ApplicationPartPropfind(ApplicationBase):
return httputils.NOT_ALLOWED
# put item back
items_iter = itertools.chain([item], items_iter)
for item, permission in list(self._collect_allowed_items(items_iter, user)):
for item, permission, raw_permissions in list(self._collect_allowed_items(items_iter, user)):
if self._sharing._enabled and share:
if share['Conversion'] == "bday" and not isinstance(item, storage.BaseCollection):
if not item.convert_vcf_to_ics():
continue
allowed_items.append((item, permission, share['Conversion']))
allowed_items.append((item, permission, raw_permissions, share['Conversion']))
else:
allowed_items.append((item, permission, None))
allowed_items.append((item, permission, raw_permissions, None))
if self._sharing._enabled:
if http_depth == "1":
if logger.isEnabledFor(logging.DEBUG):
@@ -569,24 +618,24 @@ class ApplicationPartPropfind(ApplicationBase):
c_user = share['Owner']
c_permissions_filter = share['Permissions']
if logger.isEnabledFor(logging.DEBUG):
logger.debug("TRACE/PROPFIND: test shared collection: PathOrToken=%r PathMapped=%r Owner=%r Permissions=%s", c_share, c_path, c_user, c_permissions_filter)
logger.debug("TRACE/PROPFIND: test shared collection: PathOrToken=%r PathMapped=%r Owner=%r Permissions=%r", c_share, c_path, c_user, c_permissions_filter)
c_access = Access(self._rights, c_user, c_path, c_permissions_filter)
if not c_access.check("r"):
if logger.isEnabledFor(logging.DEBUG):
logger.debug("TRACE/PROPFIND: skip shared collection: PathOrToken=%r PathMapped=%r Owner=%r Permissions=%s (permissions not matching)", c_share, c_path, c_user, c_permissions_filter)
logger.debug("TRACE/PROPFIND: skip shared collection: PathOrToken=%r PathMapped=%r Owner=%r Permissions=%r (permissions not matching)", c_share, c_path, c_user, c_permissions_filter)
continue
if logger.isEnabledFor(logging.DEBUG):
logger.debug("TRACE/PROPFIND: append shared collection: PathOrToken=%r PathMapped=%r Owner=%r", c_share, c_path, c_user)
logger.debug("TRACE/PROPFIND: append shared collection: PathOrToken=%r PathMapped=%r Owner=%r Permissions=%r", c_share, c_path, c_user, c_permissions_filter)
with self._storage.acquire_lock("r", c_user):
c_items_iter = iter(self._storage.discover(c_path, "0"))
c_allowed_items = list(self._collect_allowed_items(c_items_iter, c_user))
for item, permission in c_allowed_items:
allowed_items.append((item, permission, share['Conversion']))
for item, permission, raw_permissions in c_allowed_items:
allowed_items.append((item, permission, raw_permissions, share['Conversion']))
shares[c_share] = share
headers = {"DAV": httputils.DAV_HEADERS,
"Content-Type": "text/xml; charset=%s" % self._encoding}
xml_answer = xml_propfind(base_prefix, path, xml_content,
xml_answer = xml_propfind(self, base_prefix, path, xml_content,
allowed_items, user, self._encoding, max_resource_size=self._max_resource_size, shares=shares)
if xml_answer is None:
return httputils.NOT_ALLOWED

37
radicale/app/proppatch.py
View File

@@ -20,6 +20,7 @@
# along with Radicale. If not, see <http://www.gnu.org/licenses/>.
import errno
import logging
import re
import socket
import xml.etree.ElementTree as ET
@@ -112,24 +113,30 @@ class ApplicationPartProppatch(ApplicationBase):
user = share['Owner']
permissions_filter = share['Permissions']
access = Access(self._rights, user, path, permissions_filter)
raw_permissions = self._rights.authorization(user, path)
if not access.check("w"):
logger.debug("TRACE/PROPPATCH/xml_proppatch: no write-access: %r", path)
logger.debug("TRACE/PROPPATCH/xml_proppatch: no native write-access: %r", path)
if share:
# no write access -> use properties overlay
if self._sharing.permit_properties_overlay:
if permissions_filter is not None and "p" in permissions_filter:
logger.info("PROPPATCH request on shared %r: no write-permissions, overlay permitted, but denied by permission 'p'", path_orig)
return httputils.NOT_ALLOWED
# priority share->rights->global
if logger.isEnabledFor(logging.DEBUG):
logger.debug("TRACE/PROPPATCH/share: raw_permissions=%r share[Permissions]=%r permit_properties_overlay=%s enforce_properties_overlay=%s", raw_permissions, share['Permissions'], self._sharing.permit_properties_overlay, self._sharing.enforce_properties_overlay)
if ("P" in share['Permissions'] or
("P" in raw_permissions and "p" not in share['Permissions']) or
(self._sharing.permit_properties_overlay and "p" not in raw_permissions and "p" not in share['Permissions'])
) and not (
"p" in share['Permissions'] or
("p" in raw_permissions and "P" not in share['Permissions']) or
(self._sharing.permit_properties_overlay and "P" not in raw_permissions and "P" not in share['Permissions'])):
logger.info("PROPPATCH request on shared %r: write-access", path_orig)
if permissions_filter is not None and "e" in permissions_filter:
logger.info("PROPPATCH request on shared %r: write-access, overlay enforced, but disabled by share permission 'e'", path_orig)
elif "e" in raw_permissions:
logger.info("PROPPATCH request on shared %r: write-access, overlay enforced, but disabled by rights permission 'e'", path_orig)
else:
logger.info("PROPPATCH request on shared %r: no write-permissions, overlay permitted by option", path_orig)
share_overlay = True
else:
if permissions_filter is not None and "P" in permissions_filter:
logger.info("PROPPATCH request on shared %r: no write-permissions, overlay denied, but granted by permission 'P'", path_orig)
share_overlay = True
else:
logger.info("PROPPATCH request on shared %r: no write-permissions and overlay denied by option", path_orig)
return httputils.NOT_ALLOWED
logger.info("PROPPATCH request on shared %r: no write-access", path_orig)
return httputils.NOT_ALLOWED
else:
return httputils.NOT_ALLOWED
else:
@@ -139,7 +146,9 @@ class ApplicationPartProppatch(ApplicationBase):
logger.debug("TRACE/PROPPATCH/xml_proppatch: write-access/sharing: %r", path_orig)
if self._sharing.enforce_properties_overlay:
if permissions_filter is not None and "e" in permissions_filter:
logger.info("PROPPATCH request on shared %r: write-permissions, overlay enforced, but disabled by permission 'e'", path_orig)
logger.info("PROPPATCH request on shared %r: write-permissions, overlay enforced, but disabled by share permission 'e'", path_orig)
elif "e" in raw_permissions:
logger.info("PROPPATCH request on shared %r: write-permissions, overlay enforced, but disabled by rights permission 'e'", path_orig)
else:
share_overlay = True
else:

6
radicale/config.py
View File

@@ -69,7 +69,11 @@ def positive_float(value: Any) -> float:
def rights_permission(value: Any) -> str:
for permission in value:
if permission not in rights.INTERNAL_PERMISSIONS:
raise ValueError("unsupported permssion %r found in: %r" % (permission, value))
raise ValueError("unsupported permission %r found in: %r" % (permission, value))
if "p" in value and "P" in value:
raise ValueError("invalid combination of permissions (P+p) found in %r", value)
if "e" in value and "E" in value:
raise ValueError("invalid combination of permissions (E+e) found in %r", value)
return value

18
radicale/sharing/__init__.py
View File

@@ -406,16 +406,6 @@ class BaseSharing:
if logger.isEnabledFor(logging.DEBUG):
logger.debug("TRACE/sharing/map: not active")
if share is not None:
if self.permit_properties_overlay:
if share['Permissions'] and "p" not in share['Permissions']:
# add permit permission
share['Permissions'] += "P"
else:
if share['Permissions'] and "P" not in share['Permissions']:
# add deny permission
share['Permissions'] += "p"
return share
# adjust a share
@@ -749,6 +739,10 @@ class BaseSharing:
for permission in request_data[key]:
if permission not in rights.INTERNAL_PERMISSIONS:
return httputils.bad_request("Invalid value for Permissions")
if "p" in request_data[key] and "P" in request_data[key]:
return httputils.bad_request("Invalid combination of Permissions (P+p)")
if "e" in request_data[key] and "E" in request_data[key]:
return httputils.bad_request("Invalid combination of Permissions (E+e)")
elif key == "PathOrToken":
if ShareType == "token":
if not re.search('^/.token/' + TOKEN_PATTERN_V1 + '/$', request_data[key]):
@@ -916,8 +910,8 @@ class BaseSharing:
if Conversion == "bday":
# bday is read-only
for permission in Permissions:
if permission not in "r":
logger.warning(api_info + ": PathMapped=%r Permissions=%r not supported for Conversion=%r", PathMapped, Permissions, Conversion)
if permission not in "rPpEe":
logger.warning(api_info + ": PathMapped=%r Permissions=%r not supported for Conversion=%r", PathMapped, Permissions, Conversion)
return httputils.METHOD_NOT_ALLOWED
if Enabled is None:

257
radicale/tests/test_sharing.py
View File

@@ -89,14 +89,14 @@ class TestSharingApiSanity(BaseTest):
assert not isinstance(response, int)
return response
def _propfind_priviledges(self, path: str, login) -> list[str]:
def _propfind_privileges(self, path: str, login) -> list[str]:
response = self._propfind_allprop(path, login)
status, prop = response["D:current-user-privilege-set"]
logging.debug("prop: %r", prop)
priviledges = prop.findall(xmlutils.make_clark("D:privilege"))
assert len(priviledges) >= 1
priviledges_list = [xmlutils.make_human_tag(priviledge.findall("*")[0].tag) for priviledge in priviledges]
return priviledges_list
privileges = prop.findall(xmlutils.make_clark("D:privilege"))
assert len(privileges) >= 1
privileges_list = [xmlutils.make_human_tag(privilege.findall("*")[0].tag) for privilege in privileges]
return privileges_list
def _propfind_calendar_color(self, path, login) -> Union[str, None]:
propfind_calendar_color = get_file_content("propfind_calendar_color.xml")
@@ -2976,6 +2976,14 @@ permissions: RrWwM
user: owner1
collection: {user}/cal-m-lc(/.*)?
permissions: RrWwm
[owner1-P]
user: owner1
collection: {user}/cal-P-uc(/.*)?
permissions: RrWwP
[owner1-p]
user: owner1
collection: {user}/cal-p-lc(/.*)?
permissions: RrWwp
[default]
user: .+
collection: {user}(/.*)?
@@ -2992,7 +3000,7 @@ permissions: RrWw""")
"collection_by_map": "True",
"collection_by_token": "True"},
"logging": {"request_header_on_debug": "False",
"response_content_on_debug": "False",
"response_content_on_debug": "True",
"rights_rule_doesnt_match_on_debug": "True",
"request_content_on_debug": "True"},
"rights": {"type": "from_file"}})
@@ -3004,12 +3012,16 @@ permissions: RrWw""")
path_owner1_t = "/owner1/cal-t-lc/"
path_owner1_M = "/owner1/cal-M-uc/"
path_owner1_m = "/owner1/cal-m-lc/"
path_owner1_P = "/owner1/cal-P-uc/"
path_owner1_p = "/owner1/cal-p-lc/"
logging.info("\n*** prepare")
self.mkcalendar(path_owner1_T, login="owner1:owner1pw")
self.mkcalendar(path_owner1_t, login="owner1:owner1pw")
self.mkcalendar(path_owner1_M, login="owner1:owner1pw")
self.mkcalendar(path_owner1_m, login="owner1:owner1pw")
self.mkcalendar(path_owner1_P, login="owner1:owner1pw")
self.mkcalendar(path_owner1_p, login="owner1:owner1pw")
for db_type in list(filter(lambda item: item != "none", sharing.INTERNAL_TYPES)):
logging.info("\n*** test: %s", db_type)
@@ -3043,7 +3055,7 @@ permissions: RrWw""")
json_dict['PathOrToken'] = path_user1.replace(".ics", "dm-lc" + db_type + ".ics")
_, headers, answer = self._sharing_api_json("map", "create", check=200, login="owner1:owner1pw", json_dict=json_dict)
logging.info("\n*** deletee map user1/owner1, globally disabled / granted m -> 200")
logging.info("\n*** delete map user1/owner1, globally disabled / granted m -> 200")
json_dict['PathMapped'] = path_owner1_m
json_dict['PathOrToken'] = path_user1.replace(".ics", "dm-lc" + db_type + ".ics")
_, headers, answer = self._sharing_api_json("map", "delete", check=200, login="owner1:owner1pw", json_dict=json_dict)
@@ -3112,6 +3124,171 @@ permissions: RrWw""")
json_dict['PathMapped'] = path_owner1_t
_, headers, answer = self._sharing_api_json("token", "create", check=200, login="owner1:owner1pw", json_dict=json_dict)
logging.info("\n*** check PROPFIND privileges list on collections directly: RADICALE:share-token T (permit=True)")
privileges_T = self._propfind_privileges(path_owner1_T, login="owner1:owner1pw")
assert "RADICALE:share-token" in privileges_T
logging.info("\n*** check PROPFIND privileges list on collections directly: RADICALE:share-token t (permit=True)")
privileges_t = self._propfind_privileges(path_owner1_t, login="owner1:owner1pw")
assert "RADICALE:share-token" not in privileges_t
logging.info("\n*** check PROPFIND privileges list on collections directly: RADICALE:share-token * (permit=True)")
privileges_p = self._propfind_privileges(path_owner1_p, login="owner1:owner1pw")
assert "RADICALE:share-token" in privileges_p
logging.info("\n*** check PROPFIND privileges list on collections directly: RADICALE:share-map M (permit=True)")
privileges_M = self._propfind_privileges(path_owner1_M, login="owner1:owner1pw")
assert "RADICALE:share-map" in privileges_M
logging.info("\n*** check PROPFIND privileges list on collections directly: RADICALE:share-map m (permit=True)")
privileges_m = self._propfind_privileges(path_owner1_m, login="owner1:owner1pw")
assert "RADICALE:share-map" not in privileges_m
logging.info("\n*** check PROPFIND privileges list on collections directly: RADICALE:share-map * (permit=True)")
privileges_t = self._propfind_privileges(path_owner1_t, login="owner1:owner1pw")
assert "RADICALE:share-map" in privileges_t
self.configure({"sharing": {"permit_create_token": "False", "permit_create_map": "False"}})
logging.info("\n*** check PROPFIND privileges list on collections directly: RADICALE:share-token T (permit=False)")
privileges_T = self._propfind_privileges(path_owner1_T, login="owner1:owner1pw")
assert "RADICALE:share-token" in privileges_T
logging.info("\n*** check PROPFIND privileges list on collections directly: RADICALE:share-token t (permit=False)")
privileges_t = self._propfind_privileges(path_owner1_t, login="owner1:owner1pw")
assert "RADICALE:share-token" not in privileges_t
logging.info("\n*** check PROPFIND privileges list on collections directly: RADICALE:share-token * (permit=False)")
privileges_t = self._propfind_privileges(path_owner1_t, login="owner1:owner1pw")
assert "RADICALE:share-token" not in privileges_t
logging.info("\n*** check PROPFIND privileges list on collections directly: RADICALE:share-map M (permit=False)")
privileges_M = self._propfind_privileges(path_owner1_M, login="owner1:owner1pw")
assert "RADICALE:share-map" in privileges_M
logging.info("\n*** check PROPFIND privileges list on collections directly: RADICALE:share-map m (permit=False)")
privileges_m = self._propfind_privileges(path_owner1_m, login="owner1:owner1pw")
assert "RADICALE:share-map" not in privileges_m
logging.info("\n*** check PROPFIND privileges list on collections directly: RADICALE:share-map * (permit=False)")
privileges_t = self._propfind_privileges(path_owner1_t, login="owner1:owner1pw")
assert "RADICALE:share-map" not in privileges_t
# continue
self.configure({"sharing": {"permit_create_token": "True", "permit_create_map": "True"}})
logging.info("\n*** check PROPFIND privileges list on collections directly by owner")
privileges_P = self._propfind_privileges(path_owner1_P, login="owner1:owner1pw")
assert "D:write-properties" in privileges_P
privileges_p = self._propfind_privileges(path_owner1_p, login="owner1:owner1pw")
assert "D:write-properties" in privileges_p
logging.info("\n*** check PROPFIND privileges list on collections directly by user")
logging.info("\n*** create map user1/owner1 P -> 200")
path_share = path_user1.replace(".ics", "P-uc" + db_type + ".ics")
json_dict = {}
json_dict['PathMapped'] = path_owner1_P
json_dict['Hidden'] = False
json_dict['Enabled'] = True
json_dict['User'] = "user1"
json_dict['Permissions'] = "r"
json_dict['PathOrToken'] = path_share
_, headers, answer = self._sharing_api_json("map", "create", check=200, login="owner1:owner1pw", json_dict=json_dict)
_, headers, answer = self._sharing_api_json("map", "enable", check=200, login="user1:user1pw", json_dict=json_dict)
_, headers, answer = self._sharing_api_json("map", "unhide", check=200, login="user1:user1pw", json_dict=json_dict)
logging.info("\n*** check PROPFIND privileges list on collections directly by user: rights=P r (permit_properties_overlay=False)")
self.configure({"sharing": {"permit_properties_overlay": "False"}})
privileges_P = self._propfind_privileges(path_share, login="user1:user1pw")
assert "D:write-properties" in privileges_P
logging.info("\n*** check PROPFIND privileges list on collections directly by user: r (permit_properties_overlay=True)")
self.configure({"sharing": {"permit_properties_overlay": "True"}})
privileges_P = self._propfind_privileges(path_share, login="user1:user1pw")
assert "D:write-properties" in privileges_P
logging.info("\n*** update map with illegal combination pP")
json_dict = {}
json_dict['PathMapped'] = path_owner1_P
json_dict['PathOrToken'] = path_share
json_dict['User'] = "user1"
json_dict['Permissions'] = "rpP"
_, headers, answer = self._sharing_api_json("map", "update", check=400, login="owner1:owner1pw", json_dict=json_dict)
logging.info("\n*** update map with illegal combination eE")
json_dict = {}
json_dict['PathMapped'] = path_owner1_P
json_dict['PathOrToken'] = path_share
json_dict['User'] = "user1"
json_dict['Permissions'] = "reE"
_, headers, answer = self._sharing_api_json("map", "update", check=400, login="owner1:owner1pw", json_dict=json_dict)
logging.info("\n*** update map with only p")
json_dict = {}
json_dict['PathMapped'] = path_owner1_p
json_dict['PathOrToken'] = path_share
json_dict['User'] = "user1"
json_dict['Permissions'] = "rp"
_, headers, answer = self._sharing_api_json("map", "update", check=200, login="owner1:owner1pw", json_dict=json_dict)
logging.info("\n*** check PROPFIND privileges list on collections directly by user: rights=P rp (permit_properties_overlay=False)")
self.configure({"sharing": {"permit_properties_overlay": "False"}})
privileges_P = self._propfind_privileges(path_share, login="user1:user1pw")
assert "D:write-properties" not in privileges_P
logging.info("\n*** check PROPFIND privileges list on collections directly by user: rights=P rp (permit_properties_overlay=True)")
self.configure({"sharing": {"permit_properties_overlay": "True"}})
privileges_P = self._propfind_privileges(path_share, login="user1:user1pw")
assert "D:write-properties" not in privileges_P
json_dict = {}
json_dict['PathMapped'] = path_owner1_P
json_dict['PathOrToken'] = path_share
json_dict['User'] = "user1"
_, headers, answer = self._sharing_api_json("map", "delete", check=200, login="owner1:owner1pw", json_dict=json_dict)
logging.info("\n*** create map user1/owner1 p -> 200")
path_share = path_user1.replace(".ics", "p-lc" + db_type + ".ics")
json_dict = {}
json_dict['PathMapped'] = path_owner1_p
json_dict['Hidden'] = False
json_dict['Enabled'] = True
json_dict['User'] = "user1"
json_dict['Permissions'] = "r"
json_dict['PathOrToken'] = path_share
_, headers, answer = self._sharing_api_json("map", "create", check=200, login="owner1:owner1pw", json_dict=json_dict)
_, headers, answer = self._sharing_api_json("map", "enable", check=200, login="user1:user1pw", json_dict=json_dict)
_, headers, answer = self._sharing_api_json("map", "unhide", check=200, login="user1:user1pw", json_dict=json_dict)
logging.info("\n*** check PROPFIND privileges list on collections directly by user: rights=p r (permit_properties_overlay=False)")
self.configure({"sharing": {"permit_properties_overlay": "False"}})
privileges_p = self._propfind_privileges(path_share, login="user1:user1pw")
assert "D:write-properties" not in privileges_p
logging.info("\n*** check PROPFIND privileges list on collections directly by user: rights=p r (permit_properties_overlay=True)")
self.configure({"sharing": {"permit_properties_overlay": "True"}})
privileges_p = self._propfind_privileges(path_share, login="user1:user1pw")
assert "D:write-properties" not in privileges_p
json_dict = {}
json_dict['PathMapped'] = path_owner1_p
json_dict['PathOrToken'] = path_share
json_dict['User'] = "user1"
json_dict['Permissions'] = "rP"
_, headers, answer = self._sharing_api_json("map", "update", check=200, login="owner1:owner1pw", json_dict=json_dict)
logging.info("\n*** check PROPFIND privileges list on collections directly by user: rights=p rP (permit_properties_overlay=False)")
self.configure({"sharing": {"permit_properties_overlay": "False"}})
privileges_P = self._propfind_privileges(path_share, login="user1:user1pw")
assert "D:write-properties" in privileges_P
logging.info("\n*** check PROPFIND privileges list on collections directly by user: rights=p rP (permit_properties_overlay=True)")
self.configure({"sharing": {"permit_properties_overlay": "True"}})
privileges_P = self._propfind_privileges(path_share, login="user1:user1pw")
assert "D:write-properties" in privileges_P
def test_sharing_api_permissions_default(self) -> None:
"""sharing API usage tests related to global permissions."""
self.configure({"auth": {"type": "htpasswd",
@@ -3171,14 +3348,14 @@ permissions: RrWw""")
assert answer_dict['Lines'] == 1
assert answer_dict['Content'][0]['Permissions'] == "r"
# check PROPFIND/priviledges item as user
logging.info("\n*** PROPFIND/priviledges item as user")
priviledges_list = self._propfind_priviledges(path_user1_r, login="user1:user1pw")
assert "D:read" in priviledges_list
assert "D:write-content" not in priviledges_list
assert "D:write-properties" not in priviledges_list
assert "D:write" not in priviledges_list
assert "D:all" not in priviledges_list
# check PROPFIND/privileges item as user
logging.info("\n*** PROPFIND/privileges item as user")
privileges_list = self._propfind_privileges(path_user1_r, login="user1:user1pw")
assert "D:read" in privileges_list
assert "D:write-content" not in privileges_list
assert "D:write-properties" not in privileges_list
assert "D:write" not in privileges_list
assert "D:all" not in privileges_list
logging.info("\n*** create map user1/owner1 rw -> 200")
json_dict = {}
@@ -3203,14 +3380,14 @@ permissions: RrWw""")
json_dict['PathOrToken'] = path_user1_rw
_, headers, answer = self._sharing_api_json("map", "enable", check=200, login="user1:user1pw", json_dict=json_dict)
# check PROPFIND/priviledges item as user
logging.info("\n*** PROPFIND/priviledges item as user")
priviledges_list = self._propfind_priviledges(path_user1_rw, login="user1:user1pw")
assert "D:read" in priviledges_list
assert "D:write-content" in priviledges_list
assert "D:write-properties" not in priviledges_list
assert "D:write" not in priviledges_list
assert "D:all" not in priviledges_list
# check PROPFIND/privileges item as user
logging.info("\n*** PROPFIND/privileges item as user")
privileges_list = self._propfind_privileges(path_user1_rw, login="user1:user1pw")
assert "D:read" in privileges_list
assert "D:write-content" in privileges_list
assert "D:write-properties" not in privileges_list
assert "D:write" not in privileges_list
assert "D:all" not in privileges_list
logging.info("\n*** create map user1/owner1 with adjusted default permissions -> 200")
self.configure({"sharing": {"default_permissions_create_map": "RrWw"}})
@@ -3986,14 +4163,14 @@ permissions: RrWw""")
json_dict['PathOrToken'] = path_shared_r
_, headers, answer = self._sharing_api_json("map", "enable", check=200, login="user:userpw", json_dict=json_dict)
# check PROPFIND/priviledges item as user
logging.info("\n*** PROPFIND/priviledges item as user -> calendar")
priviledges_list = self._propfind_priviledges(path_shared_r, login="user:userpw")
assert "D:read" in priviledges_list
assert "D:write-content" not in priviledges_list
assert "D:write-properties" in priviledges_list
assert "D:write" not in priviledges_list
assert "D:all" not in priviledges_list
# check PROPFIND/privileges item as user
logging.info("\n*** PROPFIND/privileges item as user -> calendar")
privileges_list = self._propfind_privileges(path_shared_r, login="user:userpw")
assert "D:read" in privileges_list
assert "D:write-content" not in privileges_list
assert "D:write-properties" in privileges_list
assert "D:write" not in privileges_list
assert "D:all" not in privileges_list
# verify PROPPATCH as user
logging.info("\n*** PROPFIND collection user -> color #AAAAAA")
@@ -4478,6 +4655,8 @@ permissions: RrWw""")
json_dict['PathMapped'] = path_mapped
json_dict['PathOrToken'] = path_shared_r
json_dict['Conversion'] = "bday"
json_dict['Permissions'] = "rP"
json_dict['Enabled'] = True
json_dict['Enabled'] = True
json_dict['Hidden'] = False
json_dict['Properties'] = {"D:displayname": "Test-BDAY"}
@@ -4513,14 +4692,14 @@ permissions: RrWw""")
assert "C:supported-calendar-component-set" in response
assert "D:current-user-privilege-set" in response
# check PROPFIND/priviledges item as user
logging.info("\n*** PROPFIND/priviledges item as user -> calendar")
priviledges_list = self._propfind_priviledges(path_shared_r, login="user:userpw")
assert "D:read" in priviledges_list
assert "D:write-content" not in priviledges_list
assert "D:write-properties" in priviledges_list
assert "D:write" not in priviledges_list
assert "D:all" not in priviledges_list
# check PROPFIND/privileges item as user
logging.info("\n*** PROPFIND/privileges item as user -> calendar")
privileges_list = self._propfind_privileges(path_shared_r, login="user:userpw")
assert "D:read" in privileges_list
assert "D:write-content" not in privileges_list
assert "D:write-properties" in privileges_list
assert "D:write" not in privileges_list
assert "D:all" not in privileges_list
# verify content as user
logging.info("\n*** GET collection user -> ok")