[oliverbates94]

Hi! First of all, thanks for davis, it's really an incredible piece of software!

I made this PR and I know it's gonna be controversial, but I need it for my use case. I have users, and this users need to share calendars; I want them to share the calendars between themselves, without having to ask an admin to do it for them.

With this fork, users can login using their CalDAV credentials, see their own calendars, share/delegate with other users (if they know their usernames), and even modify and delete their own account all without admin intervention.

If you are interested in this patch, I consider this as a starting point, maybe we can talk a bit about some decisions, there are no tests on this yet, but let me know!

[oliverbates94]

I've just read #245 (probably should have done that sooner) but I still think this stands: not all clients implement calendar sharing, most notably DAVx5 on Android, which is very popular

[oliverbates94]

Hi, I synced with main + added a switch to turn off this feature, can you please give me a feedback on this?

[tchapi]

Thanks @oliverbates94 for the work 🙏🏼

Davis is meant to be an admin dashboard on top of sabre/dav, but not a client, and I can't maintain client features on top of what Davis provides today unfortunately.

I understand that this makes sense to cater for clients that don't expose sharing for instance (most of them except macOS that I personally use), but in adding that, I'm basically putting the first stone in transforming Davis into a mini-Nextcloud, which I don't want to do (and can't maintain in the long term). A user-facing login also means a second auth surface, session handling, and per-user authorization checks across the whole dashboard — see the recent security fixes in #283 for why I’d rather keep that surface small.

Sharing without an admin

Self-serve sharing doesn’t need Davis at all: sabre/dav already implements the calendarserver-sharing extension, and Davis enables it by default. The owner of a calendar can share it by POSTing to the calendar’s URL with their own CalDAV credentials — sabre’s ACL plugin enforces that only the owner can do it, so there’s no privileged token involved and the result is exactly what Davis does in the admin.

curl -u alice:password -X POST \
  -H 'Content-Type: application/xml' \
  https://dav.example.com/dav/calendars/alice/default/ \
  --data-binary @- <<'EOF'
<CS:share xmlns:CS="http://calendarserver.org/ns/" xmlns:D="DAV:">
  <CS:set>
    <D:href>mailto:bob@example.com</D:href>
    <CS:read-write/>
  </CS:set>
</CS:share>
EOF

Use <CS:read/> for read-only, and <CS:remove><D:href>…</D:href></CS:remove> to revoke. The sharee is identified by the email set on their Davis user, and the shared calendar shows up in their clients (DAVx⁵ included) on the next collection refresh.

From there, a few options depending on how much UI your users need:

• Apple Calendar (macOS / iOS) does this natively from the “Share Calendar” dialog.
• A tiny standalone web UI: a single static HTML/JS page that logs in with the user’s CalDAV credentials, lists their calendars via PROPFIND, shows current sharees from the CS:invite property, and sends the POST above. Stateless, no backend, no admin secret. Serve it from the same origin as the DAV endpoint (or add CORS headers in your reverse proxy for PROPFIND/POST) and it just works. I’d happily link such a project from the README.
• Scripting: the curl above in a small CLI or a bot (Slack, Matrix…) if your users are comfortable with that.

That keeps the sharing logic where it belongs — in sabre/dav, enforced by the server — and Davis as the admin view of it.

Best,

[oliverbates94]

Thanks for the thoughtful reply, I understand your point of view and the direction you want to have with Davis. You also haven't mentioned that the API has a sharing utility, but still, it was more than that for me: it would have mean that users could change their own info or even delete their account, without admin intervention.

I'll probably look more into how the DAV extension works! Thanks again.