Decide: who may see a household event — ListOccurrences and Read disagree #187

New issue

Closed

opened 2026-08-23 22:54:05 +00:00 by nalum · 1 comment

nalum commented

2026-08-23 22:54:05 +00:00

Owner

Blocking for the whole calendar redesign. Nothing in the new views or the event card is safe to build until this is settled.

EventService.ListOccurrences applies no membership filter (internal/services/event/occurrences.go): it returns every event in the window — names, locations, attendees — to any authenticated caller, a Guest included (pkg/roles/permissions.go:64). Every other door disagrees. Read (read.go:32), Update, Delete, AddUser, RemoveUser, SplitOccurrence and CancelOccurrence all require event membership, and ListEvents filters to your own (list.go:35).

Both cannot be right about who may see a household event.

	A. Household-wide visibility	B. Filter the grid
Change	Relax `Read` to household membership	Filter `ListOccurrences` to the caller's events
The grid	Everyone's events, all views, as designed	Only your own; the who-filter loses its point
Editing	Still member-only, so a non-member sheet is read-only	Everything you see, you can edit
Joining	Needs `AddUser` to allow self-add	Unreachable events cannot be joined
Feels like	A family calendar	Four private calendars in one app

The handoff recommends A, and A is also the smaller change: the shipped app already behaves that way. The grid is unfiltered today and Calendar.tsx already draws everyone's events with a who-filter over them. A makes Read agree with what the grid has always done; B changes shipped behaviour and removes a working feature.

This is an authorization change either way, so it needs an ADR (the repo rule: auth, schema and service-shape changes get one). The implementation under A is #188.

Whichever way it goes, write it down — the next reader of occurrences.go will otherwise read the missing filter as an oversight and 'fix' it.

**Blocking for the whole calendar redesign.** Nothing in the new views or the event card is safe to build until this is settled. `EventService.ListOccurrences` applies **no membership filter** (`internal/services/event/occurrences.go`): it returns every event in the window — names, locations, attendees — to any authenticated caller, a Guest included (`pkg/roles/permissions.go:64`). Every other door disagrees. `Read` (`read.go:32`), `Update`, `Delete`, `AddUser`, `RemoveUser`, `SplitOccurrence` and `CancelOccurrence` all require event membership, and `ListEvents` filters to your own (`list.go:35`). Both cannot be right about who may see a household event. | | **A. Household-wide visibility** | **B. Filter the grid** | |---|---|---| | Change | Relax `Read` to household membership | Filter `ListOccurrences` to the caller's events | | The grid | Everyone's events, all views, as designed | Only your own; the who-filter loses its point | | Editing | Still member-only, so a non-member sheet is read-only | Everything you see, you can edit | | Joining | Needs `AddUser` to allow self-add | Unreachable events cannot be joined | | Feels like | A family calendar | Four private calendars in one app | **The handoff recommends A**, and A is also the smaller change: the shipped app already behaves that way. The grid is unfiltered today and `Calendar.tsx` already draws everyone's events with a who-filter over them. A makes `Read` agree with what the grid has always done; B changes shipped behaviour and removes a working feature. This is an authorization change either way, so it needs an ADR (the repo rule: auth, schema and service-shape changes get one). The implementation under A is #188. Whichever way it goes, write it down — the next reader of `occurrences.go` will otherwise read the missing filter as an oversight and 'fix' it.

nalum added the

question

adr

labels

2026-08-23 22:54:05 +00:00

nalum referenced this issue

2026-08-23 22:54:05 +00:00

EventService: household-wide event visibility and self-add #188

nalum referenced this issue

2026-08-23 22:54:30 +00:00

Order of work for the calendar redesign (#187-#198) #199

nalum added the