From 25ee86bc88e13733bfa391a2742717a26814d458 Mon Sep 17 00:00:00 2001
From: Hamza <hamzamahjoubi221@gmail.com>
Date: Fri, 17 Apr 2026 15:29:05 +0200
Subject: [PATCH 1/5] test(integration): add tests for calendar delegation

Signed-off-by: Hamza <hamzamahjoubi221@gmail.com>
---
 .../features/bootstrap/CalDavContext.php      | 133 ++++++++++++++++++
 .../features/caldav-delegation.feature        |  21 +++
 2 files changed, 154 insertions(+)
 create mode 100644 build/integration/features/caldav-delegation.feature

diff --git a/build/integration/features/bootstrap/CalDavContext.php b/build/integration/features/bootstrap/CalDavContext.php
index 49d8c8e596357..e00588a94289c 100644
--- a/build/integration/features/bootstrap/CalDavContext.php
+++ b/build/integration/features/bootstrap/CalDavContext.php
@@ -104,6 +104,139 @@ public function requestsCalendar($user, $calendar, $endpoint) {
 		}
 	}
 
+	/**
+	 * @When :user requests principal :principal on the endpoint :endpoint
+	 */
+	public function requestsPrincipal(string $user, string $principal, string $endpoint): void {
+		$davUrl = $this->baseUrl . $endpoint . $principal;
+
+		$password = ($user === 'admin') ? 'admin' : '123456';
+		try {
+			$this->response = $this->client->request(
+				'PROPFIND',
+				$davUrl,
+				[
+					'headers' => [
+						'Content-Type' => 'application/xml; charset=UTF-8',
+						'Depth' => 0,
+					],
+					'body' => '<x0:propfind xmlns:x0="DAV:"><x0:prop><x0:displayname/><x1:calendar-user-type xmlns:x1="urn:ietf:params:xml:ns:caldav"/><x1:calendar-user-address-set xmlns:x1="urn:ietf:params:xml:ns:caldav"/><x0:principal-URL/><x0:alternate-URI-set/><x2:email-address xmlns:x2="http://sabredav.org/ns"/><x3:language xmlns:x3="http://nextcloud.com/ns"/><x1:calendar-home-set xmlns:x1="urn:ietf:params:xml:ns:caldav"/><x1:schedule-inbox-URL xmlns:x1="urn:ietf:params:xml:ns:caldav"/><x1:schedule-outbox-URL xmlns:x1="urn:ietf:params:xml:ns:caldav"/><x1:schedule-default-calendar-URL xmlns:x1="urn:ietf:params:xml:ns:caldav"/><x3:resource-type xmlns:x3="http://nextcloud.com/ns"/><x3:resource-vehicle-type xmlns:x3="http://nextcloud.com/ns"/><x3:resource-vehicle-make xmlns:x3="http://nextcloud.com/ns"/><x3:resource-vehicle-model xmlns:x3="http://nextcloud.com/ns"/><x3:resource-vehicle-is-electric xmlns:x3="http://nextcloud.com/ns"/><x3:resource-vehicle-range xmlns:x3="http://nextcloud.com/ns"/><x3:resource-vehicle-seating-capacity xmlns:x3="http://nextcloud.com/ns"/><x3:resource-contact-person xmlns:x3="http://nextcloud.com/ns"/><x3:resource-contact-person-vcard xmlns:x3="http://nextcloud.com/ns"/><x3:room-type xmlns:x3="http://nextcloud.com/ns"/><x3:room-seating-capacity xmlns:x3="http://nextcloud.com/ns"/><x3:room-building-address xmlns:x3="http://nextcloud.com/ns"/><x3:room-building-story xmlns:x3="http://nextcloud.com/ns"/><x3:room-building-room-number xmlns:x3="http://nextcloud.com/ns"/><x3:room-features xmlns:x3="http://nextcloud.com/ns"/><x0:principal-collection-set/><x0:supported-report-set/></x0:prop></x0:propfind>',
+					'auth' => [
+						$user,
+						$password,
+					],
+				]
+			);
+		} catch (\GuzzleHttp\Exception\ClientException $e) {
+			$this->response = $e->getResponse();
+		}
+	}
+
+	/**
+	 * @Then The CalDAV response should contain a property :key
+	 * @throws \Exception
+	 */
+	public function theCaldavResponseShouldContainAProperty(string $key): void {
+		/** @var \Sabre\DAV\Xml\Response\MultiStatus $multiStatus */
+		$multiStatus = $this->responseXml['value'];
+		$responses = $multiStatus->getResponses()[0]->getResponseProperties();
+		if (!isset($responses[200])) {
+			throw new \Exception(
+				sprintf(
+					'Expected code 200 got [%s]',
+					implode(',', array_keys($responses)),
+				)
+			);
+		}
+
+		$props = $responses[200];
+		if (!array_key_exists($key, $props)) {
+			throw new \Exception(
+				sprintf(
+					'Expected property %s in %s',
+					$key,
+					json_encode($props, JSON_PRETTY_PRINT),
+				)
+			);
+		}
+	}
+
+	/**
+	 * @Then The CalDAV response should contain a property :key with a href value :value
+	 * @throws \Exception
+	 */
+	public function theCaldavResponseShouldContainAPropertyWithHrefValue(
+		string $key,
+		string $value,
+	): void {
+		/** @var \Sabre\DAV\Xml\Response\MultiStatus $multiStatus */
+		$multiStatus = $this->responseXml['value'];
+		$responses = $multiStatus->getResponses()[0]->getResponseProperties();
+		if (!isset($responses[200])) {
+			throw new \Exception(
+				sprintf(
+					'Expected code 200 got [%s]',
+					implode(',', array_keys($responses)),
+				)
+			);
+		}
+
+		$props = $responses[200];
+		if (!array_key_exists($key, $props)) {
+			throw new \Exception("Cannot find property \"$key\"");
+		}
+
+		$actualValue = $props[$key]->getHref();
+		if ($actualValue !== $value) {
+			throw new \Exception("Property \"$key\" found with value \"$actualValue\", expected \"$value\"");
+		}
+	}
+
+	/**
+	 * @Then The CalDAV response should contain an href :href
+	 * @throws \Exception
+	 */
+	public function theCaldavResponseShouldContainAnHref(string $href): void {
+		/** @var \Sabre\DAV\Xml\Response\MultiStatus $multiStatus */
+		$multiStatus = $this->responseXml['value'];
+		foreach ($multiStatus->getResponses() as $response) {
+			if ($response->getHref() === $href) {
+				return;
+			}
+		}
+		throw new \Exception(
+			sprintf(
+				'Expected href %s not found in response',
+				$href,
+			)
+		);
+	}
+
+	/**
+	 * @Then The CalDAV response should be multi status
+	 * @throws \Exception
+	 */
+	public function theCaldavResponseShouldBeMultiStatus(): void {
+		if ($this->response->getStatusCode() !== 207) {
+			throw new \Exception(
+				sprintf(
+					'Expected code 207 got %s',
+					$this->response->getStatusCode()
+				)
+			);
+		}
+
+		$body = $this->response->getBody()->getContents();
+		if ($body && substr($body, 0, 1) === '<') {
+			$reader = new Sabre\Xml\Reader();
+			$reader->xml($body);
+			$reader->elementMap['{DAV:}multistatus'] = \Sabre\DAV\Xml\Response\MultiStatus::class;
+			$reader->elementMap['{DAV:}response'] = \Sabre\DAV\Xml\Element\Response::class;
+			$reader->elementMap['{urn:ietf:params:xml:ns:caldav}schedule-default-calendar-URL'] = \Sabre\DAV\Xml\Property\Href::class;
+			$this->responseXml = $reader->parse();
+		}
+	}
+
 	/**
 	 * @Then The CalDAV HTTP status code should be :code
 	 * @param int $code
diff --git a/build/integration/features/caldav-delegation.feature b/build/integration/features/caldav-delegation.feature
new file mode 100644
index 0000000000000..ce52bca6ab837
--- /dev/null
+++ b/build/integration/features/caldav-delegation.feature
@@ -0,0 +1,21 @@
+# SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+Feature: calendar delegation
+  Calendar delegation grants another user/principal control of a calendar account,
+  including all calendars the delegator can access.
+
+  Scenario: admin grants user0 read access to her calendar account
+    Given user "admin" exists
+    And user "user0" exists
+    When "admin" updates property "{DAV:}group-member-set" to href "/remote.php/dav/principals/users/user0" of principal "users/admin/calendar-proxy-read" on the endpoint "/remote.php/dav/principals/"
+    Then The CalDAV response should be multi status
+    And The CalDAV response should contain an href "/remote.php/dav/principals/users/admin/calendar-proxy-read"
+    And The CalDAV response should contain a property "{DAV:}group-member-set"
+
+  Scenario: admin grants write access to her calendar account
+    Given user "admin" exists
+    And user "user0" exists
+    When "admin" updates property "{DAV:}group-member-set" to href "/remote.php/dav/principals/users/user0" of principal "users/admin/calendar-proxy-write" on the endpoint "/remote.php/dav/principals/"
+    Then The CalDAV response should be multi status
+    And The CalDAV response should contain an href "/remote.php/dav/principals/users/admin/calendar-proxy-write"
+    And The CalDAV response should contain a property "{DAV:}group-member-set"
\ No newline at end of file

From 8788b823a295bb0ca6e07bf79c35632c76a492b1 Mon Sep 17 00:00:00 2001
From: Hamza <hamzamahjoubi221@gmail.com>
Date: Mon, 20 Apr 2026 14:17:47 +0200
Subject: [PATCH 2/5] test(integration): add proper cleanup for caldav
 scenarios

test(integration): add proper cleanup for caldav scenarios

Signed-off-by: Hamza <hamzamahjoubi221@gmail.com>
---
 .../features/bootstrap/CalDavContext.php      | 46 +++++++++++++------
 .../features/caldav-delegation.feature        |  2 +
 2 files changed, 34 insertions(+), 14 deletions(-)

diff --git a/build/integration/features/bootstrap/CalDavContext.php b/build/integration/features/bootstrap/CalDavContext.php
index e00588a94289c..3d0fd58ad327e 100644
--- a/build/integration/features/bootstrap/CalDavContext.php
+++ b/build/integration/features/bootstrap/CalDavContext.php
@@ -60,21 +60,39 @@ public function setUpScenario() {
 
 	/** @AfterScenario */
 	public function afterScenario() {
-		$davUrl = $this->baseUrl. '/remote.php/dav/calendars/admin/MyCalendar';
-		try {
-			$this->client->delete(
-				$davUrl,
-				[
-					'auth' => [
-						'admin',
-						'admin',
-					],
-					'headers' => [
-						'X-NC-CalDAV-No-Trashbin' => '1',
+		foreach (['MyCalendar', 'MyCalendar2'] as $calendarName) {
+			try {
+				$this->client->delete(
+					$this->baseUrl . '/remote.php/dav/calendars/admin/' . $calendarName,
+					[
+						'auth' => ['admin', 'admin'],
+						'headers' => ['X-NC-CalDAV-No-Trashbin' => '1'],
 					]
-				]
-			);
-		} catch (\GuzzleHttp\Exception\ClientException $e) {
+				);
+			} catch (\GuzzleHttp\Exception\ClientException $e) {
+			}
+		}
+	}
+
+	/** @AfterScenario @caldav-delegation */
+	public function afterDelegationScenario() {
+		foreach (['calendar-proxy-read', 'calendar-proxy-write'] as $proxyType) {
+			try {
+				$propPatch = new \Sabre\DAV\Xml\Request\PropPatch();
+				$propPatch->properties = ['{DAV:}group-member-set' => new \Sabre\DAV\Xml\Property\Href([])];
+				$xml = new \Sabre\Xml\Service();
+				$body = $xml->write('{DAV:}propertyupdate', $propPatch, '/');
+				$this->client->request(
+					'PROPPATCH',
+					$this->baseUrl . '/remote.php/dav/principals/users/admin/' . $proxyType,
+					[
+						'headers' => ['Content-Type' => 'application/xml; charset=UTF-8'],
+						'body' => $body,
+						'auth' => ['admin', 'admin'],
+					]
+				);
+			} catch (\GuzzleHttp\Exception\ClientException $e) {
+			}
 		}
 	}
 
diff --git a/build/integration/features/caldav-delegation.feature b/build/integration/features/caldav-delegation.feature
index ce52bca6ab837..d4cc781f320e6 100644
--- a/build/integration/features/caldav-delegation.feature
+++ b/build/integration/features/caldav-delegation.feature
@@ -4,6 +4,7 @@ Feature: calendar delegation
   Calendar delegation grants another user/principal control of a calendar account,
   including all calendars the delegator can access.
 
+  @caldav-delegation
   Scenario: admin grants user0 read access to her calendar account
     Given user "admin" exists
     And user "user0" exists
@@ -12,6 +13,7 @@ Feature: calendar delegation
     And The CalDAV response should contain an href "/remote.php/dav/principals/users/admin/calendar-proxy-read"
     And The CalDAV response should contain a property "{DAV:}group-member-set"
 
+  @caldav-delegation
   Scenario: admin grants write access to her calendar account
     Given user "admin" exists
     And user "user0" exists

From bdbf97b6e9484ef6d9968b7e2db9ad4a60b373df Mon Sep 17 00:00:00 2001
From: Hamza <hamzamahjoubi221@gmail.com>
Date: Fri, 13 Mar 2026 17:47:09 +0100
Subject: [PATCH 3/5] fix: add ACLs for calender delegation

Signed-off-by: Hamza <hamzamahjoubi221@gmail.com>
---
 .../composer/composer/autoload_classmap.php   |  2 +
 .../dav/composer/composer/autoload_static.php |  2 +
 apps/dav/lib/CalDAV/Principal/ProxyRead.php   | 23 +++++++++++
 apps/dav/lib/CalDAV/Principal/ProxyWrite.php  | 23 +++++++++++
 apps/dav/lib/CalDAV/Principal/User.php        | 40 +++++++++++++++++++
 5 files changed, 90 insertions(+)
 create mode 100644 apps/dav/lib/CalDAV/Principal/ProxyRead.php
 create mode 100644 apps/dav/lib/CalDAV/Principal/ProxyWrite.php

diff --git a/apps/dav/composer/composer/autoload_classmap.php b/apps/dav/composer/composer/autoload_classmap.php
index 80f963292c0c3..3021ce4b6983a 100644
--- a/apps/dav/composer/composer/autoload_classmap.php
+++ b/apps/dav/composer/composer/autoload_classmap.php
@@ -57,6 +57,8 @@
     'OCA\\DAV\\CalDAV\\Outbox' => $baseDir . '/../lib/CalDAV/Outbox.php',
     'OCA\\DAV\\CalDAV\\Plugin' => $baseDir . '/../lib/CalDAV/Plugin.php',
     'OCA\\DAV\\CalDAV\\Principal\\Collection' => $baseDir . '/../lib/CalDAV/Principal/Collection.php',
+    'OCA\\DAV\\CalDAV\\Principal\\ProxyRead' => $baseDir . '/../lib/CalDAV/Principal/ProxyRead.php',
+    'OCA\\DAV\\CalDAV\\Principal\\ProxyWrite' => $baseDir . '/../lib/CalDAV/Principal/ProxyWrite.php',
     'OCA\\DAV\\CalDAV\\Principal\\User' => $baseDir . '/../lib/CalDAV/Principal/User.php',
     'OCA\\DAV\\CalDAV\\Proxy\\Proxy' => $baseDir . '/../lib/CalDAV/Proxy/Proxy.php',
     'OCA\\DAV\\CalDAV\\Proxy\\ProxyMapper' => $baseDir . '/../lib/CalDAV/Proxy/ProxyMapper.php',
diff --git a/apps/dav/composer/composer/autoload_static.php b/apps/dav/composer/composer/autoload_static.php
index 7915cba7926d2..38482f951c976 100644
--- a/apps/dav/composer/composer/autoload_static.php
+++ b/apps/dav/composer/composer/autoload_static.php
@@ -72,6 +72,8 @@ class ComposerStaticInitDAV
         'OCA\\DAV\\CalDAV\\Outbox' => __DIR__ . '/..' . '/../lib/CalDAV/Outbox.php',
         'OCA\\DAV\\CalDAV\\Plugin' => __DIR__ . '/..' . '/../lib/CalDAV/Plugin.php',
         'OCA\\DAV\\CalDAV\\Principal\\Collection' => __DIR__ . '/..' . '/../lib/CalDAV/Principal/Collection.php',
+        'OCA\\DAV\\CalDAV\\Principal\\ProxyRead' => __DIR__ . '/..' . '/../lib/CalDAV/Principal/ProxyRead.php',
+        'OCA\\DAV\\CalDAV\\Principal\\ProxyWrite' => __DIR__ . '/..' . '/../lib/CalDAV/Principal/ProxyWrite.php',
         'OCA\\DAV\\CalDAV\\Principal\\User' => __DIR__ . '/..' . '/../lib/CalDAV/Principal/User.php',
         'OCA\\DAV\\CalDAV\\Proxy\\Proxy' => __DIR__ . '/..' . '/../lib/CalDAV/Proxy/Proxy.php',
         'OCA\\DAV\\CalDAV\\Proxy\\ProxyMapper' => __DIR__ . '/..' . '/../lib/CalDAV/Proxy/ProxyMapper.php',
diff --git a/apps/dav/lib/CalDAV/Principal/ProxyRead.php b/apps/dav/lib/CalDAV/Principal/ProxyRead.php
new file mode 100644
index 0000000000000..80349464a22a3
--- /dev/null
+++ b/apps/dav/lib/CalDAV/Principal/ProxyRead.php
@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\DAV\CalDAV\Principal;
+
+use Sabre\DAVACL;
+
+class ProxyRead extends \Sabre\CalDAV\Principal\ProxyRead implements DAVACL\IACL {
+	use DAVACL\ACLTrait;
+
+	/**
+	 * @inheritDoc
+	 */
+	public function getOwner() {
+		return $this->principalInfo['uri'];
+	}
+}
diff --git a/apps/dav/lib/CalDAV/Principal/ProxyWrite.php b/apps/dav/lib/CalDAV/Principal/ProxyWrite.php
new file mode 100644
index 0000000000000..0d9d2dd9947f2
--- /dev/null
+++ b/apps/dav/lib/CalDAV/Principal/ProxyWrite.php
@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\DAV\CalDAV\Principal;
+
+use Sabre\DAVACL;
+
+class ProxyWrite extends \Sabre\CalDAV\Principal\ProxyWrite implements DAVACL\IACL {
+	use DAVACL\ACLTrait;
+
+	/**
+	 * @inheritDoc
+	 */
+	public function getOwner() {
+		return $this->principalInfo['uri'];
+	}
+}
diff --git a/apps/dav/lib/CalDAV/Principal/User.php b/apps/dav/lib/CalDAV/Principal/User.php
index 904ecc32e893c..e2bf3d7193e92 100644
--- a/apps/dav/lib/CalDAV/Principal/User.php
+++ b/apps/dav/lib/CalDAV/Principal/User.php
@@ -51,4 +51,44 @@ public function getACL() {
 		];
 		return $acl;
 	}
+
+	/**
+	 * Returns a specific child node, referenced by its name.
+	 *
+	 * @param string $name
+	 *
+	 * @return \Sabre\DAV\INode
+	 */
+	public function getChild($name) {
+		$principal = $this->principalBackend->getPrincipalByPath($this->getPrincipalURL() . '/' . $name);
+		if (!$principal) {
+			throw new \Sabre\DAV\Exception\NotFound("Node with name $name was not found");
+		}
+		if ($name === 'calendar-proxy-read') {
+			return new ProxyRead($this->principalBackend, $this->principalProperties);
+		}
+
+		if ($name === 'calendar-proxy-write') {
+			return new ProxyWrite($this->principalBackend, $this->principalProperties);
+		}
+
+		throw new \Sabre\DAV\Exception\NotFound("Node with name $name was not found");
+	}
+
+	/**
+	 * Returns an array with all the child nodes.
+	 *
+	 * @return \Sabre\DAV\INode[]
+	 */
+	public function getChildren() {
+		$r = [];
+		if ($this->principalBackend->getPrincipalByPath($this->getPrincipalURL() . '/calendar-proxy-read')) {
+			$r[] = new ProxyRead($this->principalBackend, $this->principalProperties);
+		}
+		if ($this->principalBackend->getPrincipalByPath($this->getPrincipalURL() . '/calendar-proxy-write')) {
+			$r[] = new ProxyWrite($this->principalBackend, $this->principalProperties);
+		}
+
+		return $r;
+	}
 }

From ccc8d89047888df6f8d111a5f9df912b91ab4342 Mon Sep 17 00:00:00 2001
From: Hamza <hamzamahjoubi221@gmail.com>
Date: Fri, 17 Apr 2026 14:16:06 +0200
Subject: [PATCH 4/5] test(integration): write integration tests for calendar
 delegation

Signed-off-by: Hamza <hamzamahjoubi221@gmail.com>
---
 .drone.yml                                    |  26 ++++
 .../features/bootstrap/CalDavContext.php      | 127 ++++++++----------
 .../features/caldav-delegation.feature        |   9 +-
 build/integration/run.sh                      |   2 +-
 4 files changed, 90 insertions(+), 74 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index 9b3412a4224dd..d6d344597420d 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -1166,6 +1166,32 @@ trigger:
     - pull_request
     - push
 
+---
+kind: pipeline
+name: integration-caldav-delegation
+
+steps:
+- name: submodules
+  image: ghcr.io/nextcloud/continuous-integration-alpine-git:latest
+  commands:
+    - git submodule update --init
+- name: integration-caldav-delegation
+  image: ghcr.io/nextcloud/continuous-integration-integration-php7.3:latest
+  commands:
+    - curl -O -L https://getcomposer.org/download/2.9.2/composer.phar && chmod +x composer.phar && mv composer.phar /usr/local/bin/composer
+    - bash tests/drone-run-integration-tests.sh || exit 0
+    - ./occ maintenance:install --admin-pass=admin --data-dir=/dev/shm/nc_int
+    - cd build/integration
+    - ./run.sh features/caldav-delegation.feature
+
+trigger:
+  branch:
+    - master
+    - stable*
+  event:
+    - pull_request
+    - push
+
 ---
 kind: pipeline
 name: integration-comments
diff --git a/build/integration/features/bootstrap/CalDavContext.php b/build/integration/features/bootstrap/CalDavContext.php
index 3d0fd58ad327e..ca33a4065c16c 100644
--- a/build/integration/features/bootstrap/CalDavContext.php
+++ b/build/integration/features/bootstrap/CalDavContext.php
@@ -60,17 +60,21 @@ public function setUpScenario() {
 
 	/** @AfterScenario */
 	public function afterScenario() {
-		foreach (['MyCalendar', 'MyCalendar2'] as $calendarName) {
-			try {
-				$this->client->delete(
-					$this->baseUrl . '/remote.php/dav/calendars/admin/' . $calendarName,
-					[
-						'auth' => ['admin', 'admin'],
-						'headers' => ['X-NC-CalDAV-No-Trashbin' => '1'],
+		$davUrl = $this->baseUrl. '/remote.php/dav/calendars/admin/MyCalendar';
+		try {
+			$this->client->delete(
+				$davUrl,
+				[
+					'auth' => [
+						'admin',
+						'admin',
+					],
+					'headers' => [
+						'X-NC-CalDAV-No-Trashbin' => '1',
 					]
-				);
-			} catch (\GuzzleHttp\Exception\ClientException $e) {
-			}
+				]
+			);
+		} catch (\GuzzleHttp\Exception\ClientException $e) {
 		}
 	}
 
@@ -122,39 +126,11 @@ public function requestsCalendar($user, $calendar, $endpoint) {
 		}
 	}
 
-	/**
-	 * @When :user requests principal :principal on the endpoint :endpoint
-	 */
-	public function requestsPrincipal(string $user, string $principal, string $endpoint): void {
-		$davUrl = $this->baseUrl . $endpoint . $principal;
-
-		$password = ($user === 'admin') ? 'admin' : '123456';
-		try {
-			$this->response = $this->client->request(
-				'PROPFIND',
-				$davUrl,
-				[
-					'headers' => [
-						'Content-Type' => 'application/xml; charset=UTF-8',
-						'Depth' => 0,
-					],
-					'body' => '<x0:propfind xmlns:x0="DAV:"><x0:prop><x0:displayname/><x1:calendar-user-type xmlns:x1="urn:ietf:params:xml:ns:caldav"/><x1:calendar-user-address-set xmlns:x1="urn:ietf:params:xml:ns:caldav"/><x0:principal-URL/><x0:alternate-URI-set/><x2:email-address xmlns:x2="http://sabredav.org/ns"/><x3:language xmlns:x3="http://nextcloud.com/ns"/><x1:calendar-home-set xmlns:x1="urn:ietf:params:xml:ns:caldav"/><x1:schedule-inbox-URL xmlns:x1="urn:ietf:params:xml:ns:caldav"/><x1:schedule-outbox-URL xmlns:x1="urn:ietf:params:xml:ns:caldav"/><x1:schedule-default-calendar-URL xmlns:x1="urn:ietf:params:xml:ns:caldav"/><x3:resource-type xmlns:x3="http://nextcloud.com/ns"/><x3:resource-vehicle-type xmlns:x3="http://nextcloud.com/ns"/><x3:resource-vehicle-make xmlns:x3="http://nextcloud.com/ns"/><x3:resource-vehicle-model xmlns:x3="http://nextcloud.com/ns"/><x3:resource-vehicle-is-electric xmlns:x3="http://nextcloud.com/ns"/><x3:resource-vehicle-range xmlns:x3="http://nextcloud.com/ns"/><x3:resource-vehicle-seating-capacity xmlns:x3="http://nextcloud.com/ns"/><x3:resource-contact-person xmlns:x3="http://nextcloud.com/ns"/><x3:resource-contact-person-vcard xmlns:x3="http://nextcloud.com/ns"/><x3:room-type xmlns:x3="http://nextcloud.com/ns"/><x3:room-seating-capacity xmlns:x3="http://nextcloud.com/ns"/><x3:room-building-address xmlns:x3="http://nextcloud.com/ns"/><x3:room-building-story xmlns:x3="http://nextcloud.com/ns"/><x3:room-building-room-number xmlns:x3="http://nextcloud.com/ns"/><x3:room-features xmlns:x3="http://nextcloud.com/ns"/><x0:principal-collection-set/><x0:supported-report-set/></x0:prop></x0:propfind>',
-					'auth' => [
-						$user,
-						$password,
-					],
-				]
-			);
-		} catch (\GuzzleHttp\Exception\ClientException $e) {
-			$this->response = $e->getResponse();
-		}
-	}
-
 	/**
 	 * @Then The CalDAV response should contain a property :key
 	 * @throws \Exception
 	 */
-	public function theCaldavResponseShouldContainAProperty(string $key): void {
+	public function theCaldavResponseShouldContainAProperty(string $key) {
 		/** @var \Sabre\DAV\Xml\Response\MultiStatus $multiStatus */
 		$multiStatus = $this->responseXml['value'];
 		$responses = $multiStatus->getResponses()[0]->getResponseProperties();
@@ -179,42 +155,11 @@ public function theCaldavResponseShouldContainAProperty(string $key): void {
 		}
 	}
 
-	/**
-	 * @Then The CalDAV response should contain a property :key with a href value :value
-	 * @throws \Exception
-	 */
-	public function theCaldavResponseShouldContainAPropertyWithHrefValue(
-		string $key,
-		string $value,
-	): void {
-		/** @var \Sabre\DAV\Xml\Response\MultiStatus $multiStatus */
-		$multiStatus = $this->responseXml['value'];
-		$responses = $multiStatus->getResponses()[0]->getResponseProperties();
-		if (!isset($responses[200])) {
-			throw new \Exception(
-				sprintf(
-					'Expected code 200 got [%s]',
-					implode(',', array_keys($responses)),
-				)
-			);
-		}
-
-		$props = $responses[200];
-		if (!array_key_exists($key, $props)) {
-			throw new \Exception("Cannot find property \"$key\"");
-		}
-
-		$actualValue = $props[$key]->getHref();
-		if ($actualValue !== $value) {
-			throw new \Exception("Property \"$key\" found with value \"$actualValue\", expected \"$value\"");
-		}
-	}
-
 	/**
 	 * @Then The CalDAV response should contain an href :href
 	 * @throws \Exception
 	 */
-	public function theCaldavResponseShouldContainAnHref(string $href): void {
+	public function theCaldavResponseShouldContainAnHref(string $href) {
 		/** @var \Sabre\DAV\Xml\Response\MultiStatus $multiStatus */
 		$multiStatus = $this->responseXml['value'];
 		foreach ($multiStatus->getResponses() as $response) {
@@ -234,7 +179,7 @@ public function theCaldavResponseShouldContainAnHref(string $href): void {
 	 * @Then The CalDAV response should be multi status
 	 * @throws \Exception
 	 */
-	public function theCaldavResponseShouldBeMultiStatus(): void {
+	public function theCaldavResponseShouldBeMultiStatus() {
 		if ($this->response->getStatusCode() !== 207) {
 			throw new \Exception(
 				sprintf(
@@ -384,4 +329,42 @@ public function t($amount) {
 			);
 		}
 	}
+	/**
+	 * @Given :user updates property :key to href :value of principal :principal on the endpoint :endpoint
+	 */
+	public function updatesHrefPropertyOfPrincipal(
+		string $user,
+		string $key,
+		string $value,
+		string $principal,
+		string $endpoint
+	) {
+		$davUrl = $this->baseUrl . $endpoint . $principal;
+		$password = ($user === 'admin') ? 'admin' : '123456';
+
+		$propPatch = new \Sabre\DAV\Xml\Request\PropPatch();
+		$propPatch->properties = [$key => new \Sabre\DAV\Xml\Property\Href($value)];
+
+		$xml = new \Sabre\Xml\Service();
+		$body = $xml->write('{DAV:}propertyupdate', $propPatch, '/');
+
+		try {
+			$this->response = $this->client->request(
+				'PROPPATCH',
+				$davUrl,
+				[
+					'headers' => [
+						'Content-Type' => 'application/xml; charset=UTF-8',
+					],
+					'body' => $body,
+					'auth' => [
+						$user,
+						$password,
+					],
+				]
+			);
+		} catch (\GuzzleHttp\Exception\ClientException $e) {
+			$this->response = $e->getResponse();
+		}
+	}
 }
diff --git a/build/integration/features/caldav-delegation.feature b/build/integration/features/caldav-delegation.feature
index d4cc781f320e6..33cd928db7f98 100644
--- a/build/integration/features/caldav-delegation.feature
+++ b/build/integration/features/caldav-delegation.feature
@@ -20,4 +20,11 @@ Feature: calendar delegation
     When "admin" updates property "{DAV:}group-member-set" to href "/remote.php/dav/principals/users/user0" of principal "users/admin/calendar-proxy-write" on the endpoint "/remote.php/dav/principals/"
     Then The CalDAV response should be multi status
     And The CalDAV response should contain an href "/remote.php/dav/principals/users/admin/calendar-proxy-write"
-    And The CalDAV response should contain a property "{DAV:}group-member-set"
\ No newline at end of file
+    And The CalDAV response should contain a property "{DAV:}group-member-set"
+  
+  Scenario: Admin cannot grant User1 access to User0's calendar account
+    Given user "admin" exists
+    And user "user0" exists
+    And user "user1" exists
+    When "admin" updates property "{DAV:}group-member-set" to href "/remote.php/dav/principals/users/user1" of principal "users/user0/calendar-proxy-write" on the endpoint "/remote.php/dav/principals/"
+    Then The CalDAV HTTP status code should be "404"
\ No newline at end of file
diff --git a/build/integration/run.sh b/build/integration/run.sh
index a20398e8ee9ba..e7fd312d4f029 100755
--- a/build/integration/run.sh
+++ b/build/integration/run.sh
@@ -26,7 +26,7 @@ else
 fi
 NC_DATADIR=$($OCC config:system:get datadirectory)
 
-composer install
+composer install --no-audit
 
 # avoid port collision on jenkins - use $EXECUTOR_NUMBER
 if [ -z "$EXECUTOR_NUMBER" ]; then

From d9f90a7d4c25b60c36b18ac289c9b0c7cc858b98 Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Thu, 30 Apr 2026 16:40:22 +0200
Subject: [PATCH 5/5] ci(drone): Sign new drone.yml

Signed-off-by: Joas Schilling <coding@schilljs.com>
---
 .drone.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.drone.yml b/.drone.yml
index d6d344597420d..976a606b6f6e4 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -2418,6 +2418,6 @@ trigger:
 #    - push
 ---
 kind: signature
-hmac: 964c3515a08e66da50fb2657058eaafbbe88c2a43092b44d4c87f0493356f528
+hmac: 519b2f5092d6dd748b07e9841f9045261ae3f29f24087eca320a65b10464a7b4
 
 ...