From 0df9e73e6c7a79b9d21a0d4c0dc80e8f778cf0c9 Mon Sep 17 00:00:00 2001
From: Richard Steinmetz <richard@steinmetz.cloud>
Date: Wed, 8 Oct 2025 17:14:00 +0200
Subject: [PATCH] fix(caldav): disable remote access when calendar federation
 is off

Signed-off-by: Richard Steinmetz <richard@steinmetz.cloud>
---
 apps/dav/lib/Listener/SabrePluginAuthInitListener.php | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/apps/dav/lib/Listener/SabrePluginAuthInitListener.php b/apps/dav/lib/Listener/SabrePluginAuthInitListener.php
index 241ebea625ac3..562c9411cdf2b 100644
--- a/apps/dav/lib/Listener/SabrePluginAuthInitListener.php
+++ b/apps/dav/lib/Listener/SabrePluginAuthInitListener.php
@@ -9,6 +9,7 @@
 
 namespace OCA\DAV\Listener;
 
+use OCA\DAV\CalDAV\Federation\CalendarFederationConfig;
 use OCA\DAV\CalDAV\Federation\FederatedCalendarAuth;
 use OCA\DAV\Events\SabrePluginAuthInitEvent;
 use OCP\EventDispatcher\Event;
@@ -20,11 +21,20 @@
  * @template-implements IEventListener<Event|SabrePluginAuthInitEvent>
  */
 class SabrePluginAuthInitListener implements IEventListener {
+	public function __construct(
+		private readonly CalendarFederationConfig $calendarFederationConfig,
+	) {
+	}
+
 	public function handle(Event $event): void {
 		if (!($event instanceof SabrePluginAuthInitEvent)) {
 			return;
 		}
 
+		if (!$this->calendarFederationConfig->isFederationEnabled()) {
+			return;
+		}
+
 		$server = $event->getServer();
 		$authPlugin = $server->getPlugin('auth');
 		if ($authPlugin instanceof Plugin) {