Confine CardDAV requests to configured origins

2026-07-21 03:16:38 +02:00
parent 3d52cc86f9
commit 22d12d674b
3 changed files with 248 additions and 7 deletions
--- a/src/govoplan_addresses/backend/router.py
+++ b/src/govoplan_addresses/backend/router.py
@@ -618,7 +618,7 @@ def api_discover_carddav_address_books(
    principal: ApiPrincipal = Depends(get_api_principal),
    session: Session = Depends(get_session),
 ):
-    _require_scope(principal, "addresses:sync:read")
+    _require_scope(principal, "addresses:sync:write")
    try:
        address_books = discover_carddav_address_books(session, principal, payload)
        return AddressCardDavDiscoveryResponse(