feat(webui): complete calendar quick access

tests/test_service.py

@@ -5,8 +5,20 @@ from datetime import datetime, timedelta, timezone
 from types import SimpleNamespace
 from unittest.mock import patch
 
+from sqlalchemy import create_engine
+from sqlalchemy.orm import Session
+
+from govoplan_access.backend.db.models import Account, User
+from govoplan_calendar.backend.db.models import CalendarCollection, CalendarEvent
 from govoplan_calendar.backend.schemas import CalendarCollectionDeleteRequest, CalendarEventResponse
-from govoplan_calendar.backend.service import calendar_is_visible_to_principal, delete_calendar, event_response
+from govoplan_calendar.backend.service import (
+    calendar_is_visible_to_principal,
+    delete_calendar,
+    event_response,
+    list_event_occurrences,
+    list_events,
+)
+from govoplan_core.db.base import Base
 
 
 class FakeSession:
@@ -108,6 +120,81 @@ class CalendarVisibilityTests(unittest.TestCase):
             )
         )
 
+    def test_event_queries_apply_visible_calendar_fence_and_limit(self) -> None:
+        engine = create_engine("sqlite://")
+        Base.metadata.create_all(
+            engine,
+            tables=(
+                Account.__table__,
+                User.__table__,
+                CalendarCollection.__table__,
+                CalendarEvent.__table__,
+            ),
+        )
+        session = Session(engine)
+        start = datetime(2026, 8, 19, 9, tzinfo=timezone.utc)
+        try:
+            session.add_all(
+                (
+                    CalendarCollection(
+                        id="visible-calendar",
+                        tenant_id="tenant-1",
+                        slug="visible",
+                        name="Visible",
+                        visibility="tenant",
+                    ),
+                    CalendarCollection(
+                        id="private-calendar",
+                        tenant_id="tenant-1",
+                        slug="private",
+                        name="Private",
+                        visibility="private",
+                        owner_type="user",
+                        owner_id="other-user",
+                    ),
+                    CalendarEvent(
+                        id="visible-event",
+                        tenant_id="tenant-1",
+                        calendar_id="visible-calendar",
+                        uid="visible@example.test",
+                        summary="Visible event",
+                        start_at=start,
+                        end_at=start + timedelta(hours=1),
+                    ),
+                    CalendarEvent(
+                        id="private-event",
+                        tenant_id="tenant-1",
+                        calendar_id="private-calendar",
+                        uid="private@example.test",
+                        summary="Private event",
+                        start_at=start + timedelta(hours=2),
+                        end_at=start + timedelta(hours=3),
+                    ),
+                )
+            )
+            session.commit()
+
+            events = list_events(
+                session,
+                tenant_id="tenant-1",
+                visible_calendar_ids=("visible-calendar",),
+                limit=1,
+            )
+            occurrences = list_event_occurrences(
+                session,
+                tenant_id="tenant-1",
+                start_at=start - timedelta(hours=1),
+                end_at=start + timedelta(days=1),
+                visible_calendar_ids=("visible-calendar",),
+                limit=1,
+            )
+
+            self.assertEqual(["visible-event"], [event.id for event in events])
+            self.assertEqual(["visible-event"], [event["id"] for event in occurrences])
+        finally:
+            session.close()
+            engine.dispose()
+
     def test_private_calendar_is_hidden_from_other_readers_but_visible_to_admin(self) -> None:
         calendar = self.calendar()
         self.assertFalse(