[JMAP] Re: JMAP for Calendars comments

[Mauro De Gennaro <[e-mail]>]

> - Section 3 (ParticipantIdentity): It’s not clear whether participant identities are associated with each calendar or if they’re account-level objects like email identities. If they are calendar-specific, which permissions apply when viewing or modifying them?

Sorry, I just realized I hit send a bit too quickly on my previous email.

The question I wrote there didn’t really make sense. What I was trying to ask is how this works when a user has access to shared accounts. For example, let’s say a user with accountId A1 has access to a shared account A2, and that shared account contains a calendar. Are the ParticipantIdentity objects defined in the user’s account (A1), or in the account where the calendar lives (A2)?

After re-reading Section 3, I now understand that ParticipantIdentity objects are per-account. If that’s the case, would it perhaps be clearer to expose them by extending the Principal object with a new property, similar to how CalDAV handles this with the calendar-user-address-set property?

For example, in Stalwart, calendar addresses are derived from the account’s email address(es) and cannot be modified by users. If we allow users to add other participant identities that are not their email addresses, how should the server validate that they are authorized to use those identities?


Thanks,
Mauro