Subject: [Jmap] JMAP Calendars ACLs

From: "Neil Jenkins" <[email-masked]>
Date: Mon, 02 Aug 2021 16:23:08 +1000

Hi all,

Currently, in JMAP Calendars we have the following ACLs controlling what data you may write in the calendar:
 * `mayAddItems` Can add events to calendar.
 * `mayUpdateOwn` Can update events you own or have no owner.
 * `mayUpdateAll` Can update all events (implies mayUpdateOwn, mayUpdatePrivate and mayRSVP).
 * `mayRemoveOwn` Can delete events you own or have no owner.
 * `mayRemoveAll` Can delete all events (implies mayRemoveOwn).
 * `mayUpdatePrivate` Can update private properties (ones that do not affect other participants in the event, e.g. alerts) on events you don't otherwise have permission to modify.
 * `mayRSVP` Can set the RSVP status of *your* participants in events you don't otherwise have permission to modify.
I would like to propose we change the first 5 of those to just two:
 * `mayWriteOwn` The user may create, modify or destroy an event on this calendar if either they are the owner of the event or the event has no owner.
 * `mayWriteAll` The user may create, modify or destroy all events in this calendar, or move events to or from this calendar. If this is true, the mayWriteOwn, mayUpdatePrivate and mayRSVP properties MUST all also be true.
As calendar events are completely mutable (unlike messages in Email), having separate ACLs for create/update/destroy doesn't seem very helpful, and this simplifies things. Does this sound reasonable? Any objections?

Cheers,
Neil.

---

From: "Robert Stepanek" <[email-masked]>
Date: Mon, 02 Aug 2021 08:35:27 +0200

>  * `mayWriteAll` The user may create, modify or destroy all events in this calendar, or move events to or from this calendar. If this is true, the mayWriteOwn, mayUpdatePrivate and mayRSVP properti…

Having recently implemented the current ACL scheme, I am much in favor of this proposal.