CalDAV: support Apple's private-events extension for iOS privacy controls

Feature Ideas
1

Summary

Apple Calendar on iOS does not offer an event privacy control for a Stalwart
CalDAV account. Stalwart stores and transmits the standard iCalendar
CLASS:PRIVATE value when another client supplies it, but its CalDAV endpoint
does not advertise or implement Apple’s CalendarServer private-events
extension. Consequently an iOS organizer cannot mark a newly created external
invitation as private before Stalwart sends it.

This is user-visible in mixed Stalwart/Microsoft environments: an invitation
created on iOS arrives in Outlook without the private sensitivity that the same
user could select in the former Exchange environment.

Environment

  • Stalwart v0.16.21
  • Apple Calendar on iOS
  • CalDAV scheduling and external iMIP recipients
  • official Stalwart container image, RocksDB storage and internal directory

Upstream status checked 2026-10-14

  • The official Stalwart v0.16.26 release notes contain only an unrelated
    VacationResponse/set fix and do not mention Apple private-events support.
  • The current official WebDAV, scheduling and sharing documentation describes
    standard CalDAV scheduling and ACLs but does not document
    calendarserver-private-events or X-CALENDARSERVER-ACCESS.
  • A targeted search of the public Stalwart GitHub repository and support forum
    found no existing report under either extension name.

Reproduction

  1. Configure a Stalwart CalDAV account in Apple Calendar on iOS.
  2. Create an event and add an external attendee.
  3. Observe that the iOS event editor has no privacy/private control.
  4. Save the invitation.
  5. Inspect the organizer copy and the outgoing iMIP payload. They have no
    CLASS:PRIVATE value, and Microsoft Outlook does not mark the event private.
  6. Query the Stalwart CalDAV endpoint with OPTIONS.

The production response on 2026-09-17 was:

DAV: 1, 2, 3, access-control, extended-mkcol, calendar-access,
     calendar-auto-schedule, calendar-no-timezone, addressbook

The calendarserver-private-events token is absent.

Expected result

Stalwart implements Apple’s CalendarServer private-events extension:

  • advertise calendarserver-private-events in the DAV response header;
  • accept and preserve X-CALENDARSERVER-ACCESS on stored CalDAV resources;
  • map it consistently to the event’s standard iCalendar classification;
  • enforce the required owner and non-owner access restrictions;
  • expose the classification correctly in organizer and attendee views; and
  • retain the appropriate CLASS/sensitivity semantics in outgoing iTIP/iMIP
    messages without putting X-CALENDARSERVER-ACCESS into an outbox POST.

With complete server support, Apple Calendar should expose its corresponding
privacy control for the Stalwart calendar.

Actual result

The extension is not advertised. iOS does not provide a private-event control,
so a user cannot create a private external invitation in the native calendar
app. Merely injecting the DAV token at a reverse proxy is not a valid
workaround because the extension requires server-side ACL and scheduling
semantics.

Acceptance test

  1. The authenticated calendar collection advertises the extension.
  2. iOS exposes a privacy control for a new event.
  3. A private event is stored with the intended classification.
  4. A non-attending shared-calendar reader receives only the data permitted by
    the selected access level.
  5. An external iMIP recipient receives CLASS:PRIVATE and Microsoft Outlook
    displays the meeting as private.
  6. Updates, cancellations, recurrences and restore round-trips preserve the
    classification.

References

1 Like