feat(calendar): make external mutations durable

tests/test_service.py

@@ -6,7 +6,7 @@ from types import SimpleNamespace
 from unittest.mock import patch
 
 from govoplan_calendar.backend.schemas import CalendarCollectionDeleteRequest, CalendarEventResponse
-from govoplan_calendar.backend.service import delete_calendar, event_response
+from govoplan_calendar.backend.service import calendar_is_visible_to_principal, delete_calendar, event_response
 
 
 class FakeSession:
@@ -65,6 +65,67 @@ class CalendarServiceResponseTests(unittest.TestCase):
         self.assertEqual(response.start_at.tzinfo, timezone.utc)
 
 
+class CalendarVisibilityTests(unittest.TestCase):
+    @staticmethod
+    def calendar(**overrides):
+        values = {
+            "visibility": "private",
+            "owner_type": "user",
+            "owner_id": "owner-1",
+            "created_by_user_id": "creator-1",
+        }
+        values.update(overrides)
+        return SimpleNamespace(**values)
+
+    def test_tenant_shared_and_public_calendars_are_visible_to_readers(self) -> None:
+        for visibility in ("tenant", "shared", "public"):
+            with self.subTest(visibility=visibility):
+                self.assertTrue(
+                    calendar_is_visible_to_principal(
+                        self.calendar(visibility=visibility),
+                        user_id="reader-1",
+                    )
+                )
+
+    def test_private_calendar_is_visible_to_user_owner_creator_or_group_member(self) -> None:
+        self.assertTrue(
+            calendar_is_visible_to_principal(
+                self.calendar(),
+                user_id="owner-1",
+            )
+        )
+        self.assertTrue(
+            calendar_is_visible_to_principal(
+                self.calendar(),
+                user_id="creator-1",
+            )
+        )
+        self.assertTrue(
+            calendar_is_visible_to_principal(
+                self.calendar(owner_type="group", owner_id="group-1"),
+                user_id="member-1",
+                group_ids=("group-1",),
+            )
+        )
+
+    def test_private_calendar_is_hidden_from_other_readers_but_visible_to_admin(self) -> None:
+        calendar = self.calendar()
+        self.assertFalse(
+            calendar_is_visible_to_principal(
+                calendar,
+                user_id="other-1",
+                group_ids=("group-2",),
+            )
+        )
+        self.assertTrue(
+            calendar_is_visible_to_principal(
+                calendar,
+                user_id="other-1",
+                can_admin=True,
+            )
+        )
+
+
 class CalendarServiceDeleteTests(unittest.TestCase):
     def test_delete_default_calendar_soft_deletes_calendar_and_events(self) -> None:
         session = FakeSession()