Shared calendars not appearing in CalDAV discovery response

[kjp949]

Issue Description

PROPFIND on /dav/pal/ correctly returns both principals including shared ones, but PROPFIND on /dav/cal/ only returns the authenticated user's own calendars; shared calendars are missing from the calendar discovery response

Expected Behavior

/dav/cal returns shared calendars

Actual Behavior

No response

Reproduction Steps

No response

Relevant Log Output

No response

Stalwart Version

v0.16.x

Installation Method

Docker

Database Backend

RocksDB

Blob Storage

RocksDB

Search Engine

Internal

Directory Backend

Internal

Additional Context

PROPFIND on /dav/pal/ correctly returns both principals:
curl -u user@example.com -X PROPFIND https://mail.example.com/dav/pal/ -H "Depth: 1"
Returns both user@example.com and shareduser@example.com.
PROPFIND on /dav/cal/ only returns the authenticated user's own calendars:
curl -u user@example.com -X PROPFIND https://mail.example.com/dav/cal/ -H "Depth: 1"
Only returns /dav/cal/user%40example.com/. The shared calendar at /dav/cal/shareduser%40example.com/ is not in the response.
Directly accessing the shared calendar URL works fine though:
curl -u user@example.com -X PROPFIND https://mail.example.com/dav/cal/shareduser%40example.com/ -H "Depth: 1"
Returns 200 with the correct data. So the permissions are working at the resource level, the discovery just doesn't include shared calendars from other principals.

I acknowledge that:

• I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.
• I have searched the Stalwart repository (both open and closed Discussions and Issues) and confirm this is not a duplicate.
• I have set the logging level to trace and included relevant log output if applicable.
• I agree to follow the project's Code of Conduct.

[stalwart-labs]

Have you shared them? Which client are you using? Logs?

[kjp949]

Yes calendars are shared from another account. Here's logs from when I try to add a calendar through betterbird.

2026-04-28T15:06:30Z DEBUG HTTP request URL (http.request-url)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/dav/cal"
2026-04-28T15:06:30Z DEBUG Cache hit (store.cache-hit)
        key = "mydomain.xx"
        collection = "domainName"
2026-04-28T15:06:30Z DEBUG Cache hit (store.cache-hit)
        key = 1
        collection = "domainId"
2026-04-28T15:06:30Z DEBUG Cache hit (store.cache-hit)
        key = "myuser"
        domain = 1
        collection = "email"
2026-04-28T15:06:30Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "accessToken"
2026-04-28T15:06:30Z INFO Authentication successful (auth.success)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        accountName = "myuser@mydomain.xx"
        accountId = 2
2026-04-28T15:06:30Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "account"
2026-04-28T15:06:30Z DEBUG WebDAV PROPFIND request (web-dav.propfind)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/dav/cal"
        type = "CalDAV"
        details = ["Depth", 0, "Content-Type", "text/xml; charset=utf-8"]
        result = 207
        elapsed = 0ms
2026-04-28T15:06:30Z DEBUG HTTP request URL (http.request-url)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/dav/cal/myuser%40mydomain.xx/"
2026-04-28T15:06:30Z DEBUG Authentication failed (auth.failed)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        details = "Missing Authorization header."
        causedBy = "crates/http/src/auth/authenticate.rs:117"
2026-04-28T15:06:30Z DEBUG HTTP request URL (http.request-url)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/dav/cal/myuser%40mydomain.xx/"
2026-04-28T15:06:30Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "accessToken"
2026-04-28T15:06:30Z DEBUG Cache hit (store.cache-hit)
        key = "mydomain.xx"
        collection = "domainName"
2026-04-28T15:06:30Z DEBUG Cache hit (store.cache-hit)
        key = 1
        collection = "domainId"
2026-04-28T15:06:30Z DEBUG Cache hit (store.cache-hit)
        key = "myuser"
        domain = 1
        collection = "email"
2026-04-28T15:06:30Z DEBUG Cache hit (store.cache-hit)
        accountId = 2
        collection = "calendar"
        changeId = 1670
        elapsed = 0ms
2026-04-28T15:06:30Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "account"
2026-04-28T15:06:30Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "account"
2026-04-28T15:06:30Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "account"
2026-04-28T15:06:30Z DEBUG WebDAV PROPFIND request (web-dav.propfind)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/dav/cal/myuser%40mydomain.xx/"
        type = "CalDAV"
        details = ["Depth", 1, "Content-Type", "text/xml; charset=utf-8"]
        result = 207
        elapsed = 0ms
2026-04-28T15:06:31Z DEBUG SMTP QUIT command (smtp.quit)
        listenerId = "smtp"
        localPort = 25
        remoteIp = 216.221.169.107
        remotePort = 44047
2026-04-28T15:06:31Z DEBUG SMTP connection ended (smtp.connection-end)
        listenerId = "smtp"
        localPort = 25
        remoteIp = 216.221.169.107
        remotePort = 44047
        elapsed = 29739ms
2026-04-28T15:06:35Z DEBUG HTTP request URL (http.request-url)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/dav/cal/myuser%40mydomain.xx/default/"
2026-04-28T15:06:35Z DEBUG Authentication failed (auth.failed)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        details = "Missing Authorization header."
        causedBy = "crates/http/src/auth/authenticate.rs:117"
2026-04-28T15:06:35Z DEBUG HTTP request URL (http.request-url)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/dav/cal/myuser%40mydomain.xx/default/"
2026-04-28T15:06:35Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "accessToken"
2026-04-28T15:06:35Z DEBUG Cache hit (store.cache-hit)
        key = "mydomain.xx"
        collection = "domainName"
2026-04-28T15:06:35Z DEBUG Cache hit (store.cache-hit)
        key = 1
        collection = "domainId"
2026-04-28T15:06:35Z DEBUG Cache hit (store.cache-hit)
        key = "myuser"
        domain = 1
        collection = "email"
2026-04-28T15:06:35Z DEBUG Cache hit (store.cache-hit)
        accountId = 2
        collection = "calendar"
        changeId = 1670
        elapsed = 0ms
2026-04-28T15:06:35Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "account"
2026-04-28T15:06:35Z DEBUG WebDAV PROPFIND request (web-dav.propfind)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/dav/cal/myuser%40mydomain.xx/default/"
        type = "CalDAV"
        details = ["Depth", 0, "Content-Type", "text/xml; charset=utf-8"]
        result = 207
        elapsed = 0ms
2026-04-28T15:06:35Z DEBUG HTTP request URL (http.request-url)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/dav/cal/myuser%40mydomain.xx/"
2026-04-28T15:06:35Z DEBUG HTTP request URL (http.request-url)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/dav/pal/myuser%2540mydomain.xx/"
2026-04-28T15:06:35Z DEBUG Authentication failed (auth.failed)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        details = "Missing Authorization header."
        causedBy = "crates/http/src/auth/authenticate.rs:117"
2026-04-28T15:06:35Z DEBUG HTTP request URL (http.request-url)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/dav/pal/myuser%2540mydomain.xx/"
2026-04-28T15:06:35Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "accessToken"
2026-04-28T15:06:35Z DEBUG WebDAV PROPFIND request (web-dav.propfind)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/dav/pal/myuser%2540mydomain.xx/"
        type = "Principal"
        details = ["Depth", 0, "Content-Type", "text/xml; charset=utf-8"]
        result = 404
        elapsed = 0ms
2026-04-28T15:06:35Z DEBUG HTTP request URL (http.request-url)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/dav/cal/myuser%40mydomain.xx/default/"
2026-04-28T15:06:35Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "accessToken"
2026-04-28T15:06:35Z DEBUG Cache hit (store.cache-hit)
        key = "mydomain.xx"
        collection = "domainName"
2026-04-28T15:06:35Z DEBUG Cache hit (store.cache-hit)
        key = 1
        collection = "domainId"
2026-04-28T15:06:35Z DEBUG Cache hit (store.cache-hit)
        key = "myuser"
        domain = 1
        collection = "email"
2026-04-28T15:06:35Z DEBUG Cache hit (store.cache-hit)
        accountId = 2
        collection = "calendar"
        changeId = 1670
        elapsed = 0ms
2026-04-28T15:06:35Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "account"
2026-04-28T15:06:35Z DEBUG WebDAV REPORT request (web-dav.report)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/dav/cal/myuser%40mydomain.xx/default/"
        type = "CalDAV"
        details = ["Depth", 1, "Content-Type", "text/xml; charset=utf-8"]
        result = 207
        elapsed = 0ms
2026-04-28T15:06:45Z DEBUG HTTP request URL (http.request-url)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/jmap/"
2026-04-28T15:06:45Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "accessToken"
2026-04-28T15:06:45Z DEBUG JMAP method call (jmap.method-call)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        id = "x:SystemSettings/get"
        accountId = 2
        elapsed = 0ms
2026-04-28T15:06:49Z DEBUG HTTP request URL (http.request-url)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/jmap/"
2026-04-28T15:06:49Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "accessToken"
2026-04-28T15:06:49Z DEBUG HTTP request URL (http.request-url)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/jmap/"
2026-04-28T15:06:49Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "accessToken"
2026-04-28T15:06:49Z DEBUG JMAP method call (jmap.method-call)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        id = "x:Tracer/query"
        accountId = 2
        elapsed = 0ms
2026-04-28T15:06:49Z DEBUG JMAP method call (jmap.method-call)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        id = "x:Tracer/query"
        accountId = 2
        elapsed = 0ms
2026-04-28T15:06:49Z DEBUG JMAP method call (jmap.method-call)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        id = "x:Tracer/get"
        accountId = 2
        elapsed = 0ms
2026-04-28T15:06:49Z DEBUG JMAP method call (jmap.method-call)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        id = "x:Tracer/get"
        accountId = 2
        elapsed = 0ms
2026-04-28T15:06:51Z DEBUG HTTP request URL (http.request-url)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/jmap/"
2026-04-28T15:06:51Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "accessToken"
2026-04-28T15:06:51Z DEBUG JMAP method call (jmap.method-call)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        id = "x:Tracer/get"
        accountId = 2
        elapsed = 0ms
2026-04-28T15:06:51Z DEBUG HTTP connection started (http.connection-start)
        listenerId = "https"
        localPort = 443
        remoteIp = 127.0.0.1
        remotePort = 54482
2026-04-28T15:06:51Z DEBUG HTTP request URL (http.request-url)
        listenerId = "https"
        localPort = 443
        remoteIp = 127.0.0.1
        remotePort = 54482
        url = "/healthz/live"
2026-04-28T15:06:51Z DEBUG HTTP connection ended (http.connection-end)
        listenerId = "https"
        localPort = 443
        remoteIp = 127.0.0.1
        remotePort = 54482
        elapsed = 4ms
2026-04-28T15:06:55Z DEBUG HTTP request URL (http.request-url)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/jmap/"
2026-04-28T15:06:55Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "accessToken"
2026-04-28T15:06:55Z DEBUG JMAP method call (jmap.method-call)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        id = "x:Tracer/set"
        accountId = 2
        elapsed = 0ms
2026-04-28T15:06:55Z DEBUG HTTP request URL (http.request-url)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/jmap/"
2026-04-28T15:06:55Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "accessToken"
2026-04-28T15:06:55Z DEBUG HTTP request URL (http.request-url)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/jmap/"
2026-04-28T15:06:55Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "accessToken"
2026-04-28T15:06:55Z DEBUG JMAP method call (jmap.method-call)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        id = "x:Tracer/query"
        accountId = 2
        elapsed = 0ms
2026-04-28T15:06:55Z DEBUG JMAP method call (jmap.method-call)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        id = "x:Tracer/query"
        accountId = 2
        elapsed = 0ms
2026-04-28T15:06:55Z DEBUG JMAP method call (jmap.method-call)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        id = "x:Tracer/get"
        accountId = 2
        elapsed = 0ms
2026-04-28T15:06:55Z DEBUG JMAP method call (jmap.method-call)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        id = "x:Tracer/get"
        accountId = 2
        elapsed = 0ms
2026-04-28T15:06:58Z DEBUG HTTP request URL (http.request-url)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/jmap/"
2026-04-28T15:06:58Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "accessToken"
2026-04-28T15:06:58Z DEBUG JMAP method call (jmap.method-call)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        id = "x:Account/query"
        accountId = 2
        elapsed = 0ms
2026-04-28T15:06:58Z DEBUG Cache hit (store.cache-hit)
        key = 1
        collection = "domainId"
2026-04-28T15:06:58Z DEBUG Cache hit (store.cache-hit)
        key = 1
        collection = "domainId"
2026-04-28T15:06:58Z DEBUG JMAP method call (jmap.method-call)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        id = "x:Account/get"
        accountId = 2
        elapsed = 0ms
2026-04-28T15:06:58Z DEBUG HTTP request URL (http.request-url)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/jmap/"
2026-04-28T15:06:58Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "accessToken"
2026-04-28T15:06:58Z DEBUG JMAP method call (jmap.method-call)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        id = "x:Account/query"
        accountId = 2
        elapsed = 0ms
2026-04-28T15:06:58Z DEBUG Cache hit (store.cache-hit)
        key = 1
        collection = "domainId"
2026-04-28T15:06:58Z DEBUG Cache hit (store.cache-hit)
        key = 1
        collection = "domainId"
2026-04-28T15:06:58Z DEBUG JMAP method call (jmap.method-call)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        id = "x:Account/get"
        accountId = 2
        elapsed = 0ms
2026-04-28T15:07:00Z DEBUG HTTP request URL (http.request-url)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/jmap/"
2026-04-28T15:07:00Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "accessToken"

[mdecimus]

Please include the logs in trace mode so the full requests can be analyzed. Also include the XML requests when your client is sharing the calendars.

[mdecimus]

Hi, took a closer look at this together with #3135 since the symptoms are very similar. I set up a fresh v0.16 instance with two test accounts and shared a calendar between them via every code path I could think of: JMAP Calendar/set with shareWith, the WebDAV ACL command with a <D:read/> grant, and a few share / unshare / re-share cycles. In all cases the sharee's discovery worked correctly. The JMAP session listed the sharer as a secondary account, PROPFIND /dav/cal/ Depth 1 returned both home URLs, PROPFIND on the sharee's own home with assisted-discovery enabled injected the sharer's calendar into the response, and direct PROPFIND on the sharer's home returned 200.

So the sharing logic itself is fine on a clean v0.16 install; whatever you are hitting is state-dependent.

One concrete cause that produces exactly this symptom: in v0.16, account names must be full email addresses, while v0.15.x accepted plain local-parts as well. The URL parser in v0.16 only resolves account segments of the form local@domain (or the fallback _<numeric_id>), so any href the server emits like /dav/cal/oldname/ will return 404 on a fresh PROPFIND even though the underlying ACL grant in the store is intact. Old clients usually keep showing cached calendars because they don't drop entries when sync silently fails, which is why old DAVx5 setups continue to "see" them while new clients cannot find them.

Could you try removing the calendar account from your client and adding it back from scratch? That forces a fresh discovery against the new URL format. If your accounts were originally created on v0.15.x with non-email names, you may also need to rename them on the server to local@domain form first.

If re-adding the client account doesn't help, please raise the log level to trace and capture one full PROPFIND request from the sharee right after re-adding, plus the XML body the client sends when configuring the share (or a JMAP Calendar/get of the sharer's calendar showing shareWith). That should let us pin down whether the ACL is persisted with the correct account id and whether the sharee's access token sees it.

[kjp949]

This is my very first time using stalwart and I started with version 0.16. Always used the full email as usernames. Happens with betterbird and davx5. I don't see shard calendars when the caldav client queries https://mail.mydomain.com. I see my own calendars fine. I can even manually add the URL to the shared calendar and that works so I don't think it's an acl problem. I'll get some trace logs tonight. Just checked in the sharing calendar section in stalwart and something is off. It's showing the letter C for my user account that this calendar is shared to. I believe that is the id of the user. Maybe this is part of my problem? Something is corrupted.

[mdecimus]

This was a display bug in the WebUI which has been fixed. However if you're still having issues sharing calendars I suggest you open an issue at the client's repository.

[kjp949]

It's happening with all caldav clients I have tried. /dav/cal doesn't list shared calendars even with assisted discovery enabled . Here's some curl tests and some trace logs.

curl -X PROPFIND \
     -u "user1@mydomain.com" \
     -H "Depth: 1" \
     "https://mail.mydomain.com/dav/cal/"

<?xml version="1.0" encoding="UTF-8"?>
<D:multistatus xmlns:D="DAV:" xmlns:A="urn:ietf:params:xml:ns:caldav">
   <D:response>
      <D:href>/dav/cal/</D:href>
      <D:propstat>
         <D:prop>
            <D:resourcetype><D:collection /></D:resourcetype>
            <D:current-user-principal><D:href>/dav/pal/user1%40mydomain.com/</D:href></D:current-user-principal>
            <D:supported-report-set>
               <D:supported-report><D:report><D:sync-collection /></D:report></D:supported-report>
               <D:supported-report><D:report><D:acl-principal-prop-set /></D:report></D:supported-report>
               <D:supported-report><D:report><D:principal-match /></D:report></D:supported-report>
               <D:supported-report><D:report><D:expand-property /></D:report></D:supported-report>
               <D:supported-report><D:report><A:calendar-query /></D:report></D:supported-report>
               <D:supported-report><D:report><A:calendar-multiget /></D:report></D:supported-report>
               <D:supported-report><D:report><A:free-busy-query /></D:report></D:supported-report>
            </D:supported-report-set>
         </D:prop>
         <D:status>HTTP/1.1 200 OK</D:status>
      </D:propstat>
   </D:response>
   <D:response>
      <D:href>/dav/cal/user1%40mydomain.com/</D:href>
      <D:propstat>
         <D:prop>
            <D:displayname>User One</D:displayname>
            <D:resourcetype><D:collection /></D:resourcetype>
            <D:supported-report-set>
               <D:supported-report><D:report><D:sync-collection /></D:report></D:supported-report>
               <D:supported-report><D:report><D:acl-principal-prop-set /></D:report></D:supported-report>
               <D:supported-report><D:report><D:principal-match /></D:report></D:supported-report>
               <D:supported-report><D:report><D:expand-property /></D:report></D:supported-report>
               <D:supported-report><D:report><A:calendar-query /></D:report></D:supported-report>
               <D:supported-report><D:report><A:calendar-multiget /></D:report></D:supported-report>
               <D:supported-report><D:report><A:free-busy-query /></D:report></D:supported-report>
            </D:supported-report-set>
            <D:current-user-principal><D:href>/dav/pal/user1%40mydomain.com/</D:href></D:current-user-principal>
            <D:sync-token>urn:stalwart:davsync:772</D:sync-token>
            <D:owner><D:href>/dav/pal/user1%40mydomain.com/</D:href></D:owner>
            <D:principal-collection-set><D:href>/dav/pal/</D:href></D:principal-collection-set>
         </D:prop>
         <D:status>HTTP/1.1 200 OK</D:status>
      </D:propstat>
   </D:response>
</D:multistatus>

curl -X PROPFIND \
     -u "user1@mydomain.com" \
     -H "Depth: 1" \
     "https://mail.mydomain.com/dav/pal/"

<?xml version="1.0" encoding="UTF-8"?>
<D:multistatus xmlns:D="DAV:">
   <D:response>
      <D:href>/dav/pal/</D:href>
      <D:propstat>
         <D:prop>
            <D:resourcetype><D:collection /></D:resourcetype>
            <D:current-user-principal><D:href>/dav/pal/user1%40mydomain.com/</D:href></D:current-user-principal>
            <D:supported-report-set>
               <D:supported-report><D:report><D:principal-property-search /></D:report></D:supported-report>
               <D:supported-report><D:report><D:principal-search-property-set /></D:report></D:supported-report>
               <D:supported-report><D:report><D:principal-match /></D:report></D:supported-report>
            </D:supported-report-set>
         </D:prop>
         <D:status>HTTP/1.1 200 OK</D:status>
      </D:propstat>
   </D:response>
   <D:response>
      <D:href>/dav/pal/user1%40mydomain.com/</D:href>
      <D:propstat>
         <D:prop>
            <D:displayname>User One</D:displayname>
            <D:resourcetype><D:principal /><D:collection /></D:resourcetype>
            <D:supported-report-set>
               <D:supported-report><D:report><D:principal-property-search /></D:report></D:supported-report>
               <D:supported-report><D:report><D:principal-search-property-set /></D:report></D:supported-report>
               <D:supported-report><D:report><D:principal-match /></D:report></D:supported-report>
            </D:supported-report-set>
            <D:current-user-principal><D:href>/dav/pal/user1%40mydomain.com/</D:href></D:current-user-principal>
            <D:principal-collection-set><D:href>/dav/pal/</D:href></D:principal-collection-set>
            <D:alternate-URI-set />
            <D:principal-URL><D:href>/dav/pal/user1%40mydomain.com/</D:href></D:principal-URL>
            <D:group-member-set />
            <D:group-membership />
         </D:prop>
         <D:status>HTTP/1.1 200 OK</D:status>
      </D:propstat>
   </D:response>
   <D:response>
      <D:href>/dav/pal/user2%40mydomain.com/</D:href>
      <D:propstat>
         <D:prop>
            <D:displayname>User Two</D:displayname>
            <D:resourcetype><D:principal /><D:collection /></D:resourcetype>
            <D:supported-report-set>
               <D:supported-report><D:report><D:principal-property-search /></D:report></D:supported-report>
               <D:supported-report><D:report><D:principal-search-property-set /></D:report></D:supported-report>
               <D:supported-report><D:report><D:principal-match /></D:report></D:supported-report>
            </D:supported-report-set>
            <D:current-user-principal><D:href>/dav/pal/user1%40mydomain.com/</D:href></D:current-user-principal>
            <D:principal-collection-set><D:href>/dav/pal/</D:href></D:principal-collection-set>
            <D:alternate-URI-set />
            <D:principal-URL><D:href>/dav/pal/user2%40mydomain.com/</D:href></D:principal-URL>
            <D:group-member-set />
            <D:group-membership />
         </D:prop>
         <D:status>HTTP/1.1 200 OK</D:status>
      </D:propstat>
   </D:response>
</D:multistatus>

2026-05-04T17:44:32Z DEBUG HTTP request URL (http.request-url)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/dav/cal/"
2026-05-04T17:44:32Z TRACE Expression evaluation result (eval.result)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        id = "Http with id singleton"
        key = "allowedEndpoints"
        result = "Integer(200)"
2026-05-04T17:44:32Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "accessToken"
2026-05-04T17:44:32Z TRACE Write batch operation (store.data-write)
        elapsed = 0ms
        total = 2
2026-05-04T17:44:32Z TRACE HTTP request body (http.request-body)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        details = [["host", "mail.mydomain.com"], ["user-agent", "curl/8.19.0"], ["accept", "*/*"], ["authorization", "Basic [REDACTED]"], ["depth", "1"], ["via", "2.0 Caddy"], ["x-forwarded-for", "10.1.1.108"], ["x-forwarded-host", "mail.mydomain.com"], ["x-forwarded-proto", "https"], ["accept-encoding", "gzip"]]
        contents = ""
        size = 0
2026-05-04T17:44:32Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "account"
2026-05-04T17:44:32Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "account"
2026-05-04T17:44:32Z DEBUG Cache hit (store.cache-hit)
        key = 2
        collection = "account"
2026-05-04T17:44:32Z TRACE Data store iteration operation (store.data-iterate)
        elapsed = 0ms
2026-05-04T17:44:32Z DEBUG Cache hit (store.cache-hit)
        accountId = 2
        collection = "calendar"
        changeId = 1906
        elapsed = 0ms
2026-05-04T17:44:32Z DEBUG WebDAV PROPFIND request (web-dav.propfind)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        url = "/dav/cal/"
        type = "CalDAV"
        details = ["Depth", 1]
        result = 207
        elapsed = 0ms
2026-05-04T17:44:32Z TRACE HTTP response body (http.response-body)
        listenerId = "http"
        localPort = 8080
        remoteIp = 10.1.1.108
        remotePort = 0
        contents = "<?xml version=\"1.0\" encoding=\"UTF-8\"?><D:multistatus xmlns:D=\"DAV:\" xmlns:A=\"urn:ietf:params:xml:ns:caldav\"><D:response><D:href>/dav/cal/</D:href><D:propstat><D:prop><D:resourcetype><D:collection/></D:resourcetype><D:current-user-principal><D:href>/dav/pal/user1%40mydomain.com/</D:href></D:current-user-principal><D:supported-report-set><D:supported-report><D:report><D:sync-collection/></D:report></D:supported-report><D:supported-report><D:report><D:acl-principal-prop-set/></D:report></D:supported-report><D:supported-report><D:report><D:principal-match/></D:report></D:supported-report><D:supported-report><D:report><D:expand-property/></D:report></D:supported-report><D:supported-report><D:report><A:calendar-query/></D:report></D:supported-report><D:supported-report><D:report><A:calendar-multiget/></D:report></D:supported-report><D:supported-report><D:report><A:free-busy-query/></D:report></D:supported-report></D:supported-report-set></D:prop><D:status>HTTP/1.1 200 OK</D:status></D:propstat></D:response><D:response><D:href>/dav/cal/user1%40mydomain.com/</D:href><D:propstat><D:prop><D:displayname>User One</D:displayname><D:resourcetype><D:collection/></D:resourcetype><D:supported-report-set><D:supported-report><D:report><D:sync-collection/></D:report></D:supported-report><D:supported-report><D:report><D:acl-principal-prop-set/></D:report></D:supported-report><D:supported-report><D:report><D:principal-match/></D:report></D:supported-report><D:supported-report><D:report><D:expand-property/></D:report></D:supported-report><D:supported-report><D:report><A:calendar-query/></D:report></D:supported-report><D:supported-report><D:report><A:calendar-multiget/></D:report></D:supported-report><D:supported-report><D:report><A:free-busy-query/></D:report></D:supported-report></D:supported-report-set><D:current-user-principal><D:href>/dav/pal/user1%40mydomain.com/</D:href></D:current-user-principal><D:sync-token>urn:stalwart:davsync:772</D:sync-token><D:owner><D:href>/dav/pal/user1%40mydomain.com/</D:href></D:owner><D:principal-collection-set><D:href>/dav/pal/</D:href></D:principal-collection-set></D:prop><D:status>HTTP/1.1 200 OK</D:status></D:propstat></D:response></D:multistatus>"
        code = 207
        size = 2219

[kjp949]

Figured out the issue. Took a while and I almost wiped and reinstalled stalwart. Sharing a calendar user to user works fine and they appear in the users /dav/cal list. When a user is an ADMIN that PROPFIND doesn't return any shared calendars. All I had to do was make my account a regular user account and now it works as it should.

[jcrawfordor]

I was able to confirm that this is correct: administrators don't seem to be capable of seeing any shared calendars. Adding the 'User' role doesn't matter, only removing 'System Administrator' causes shared calendars to be visible for a user.