mirror of
https://github.com/go-vikunja/vikunja.git
synced 2026-08-29 07:46:00 -05:00
kolaente
7f69fdc60b
caldav-go hardcodes PUT and DELETE into the Allow header of every collection, so a client had no way to learn that a read-only share or an archived project will refuse them, and kept retrying and surfacing sync errors. One CanWrite call answers for all of those, and costs no more than resolving the collection already does. Pseudo collections keep advertising both, because writes to the tasks they aggregate go through to the real projects. getProjectFromParam resolves a collection without any permission check, so answering OPTIONS with 200 told the caller which project and filter ids exist. It now answers 404 for anything the caller cannot read, like every other verb.