fix: default ACL to full access when remote server omits privilege info

lib/Providers/DAV/Calendar/Hybrid/EventCollection.php

@@ -116,7 +116,10 @@ public function setName($id): void {
 	public function getACL(): array {
 		$permissions = $this->collection->permissions;
 		if ($permissions === null || count($permissions) === 0) {
-			$permissions = ['{DAV:}read'];
+			// Remote server did not return ACL info; grant write-properties as a safe
+			// minimum so rename and recolor work even before a harmonization cycle
+			// has refreshed the stored permissions.
+			$permissions = ['{DAV:}read', '{DAV:}write-properties'];
 		}
 		return array_map(function ($permission) {
 			return [

lib/Providers/DAV/Contacts/Hybrid/ContactCollection.php

@@ -106,7 +106,10 @@ public function setName($id): void {
 	public function getACL(): array {
 		$permissions = $this->collection->permissions;
 		if ($permissions === null || count($permissions) === 0) {
-			$permissions = ['{DAV:}read'];
+			// Remote server did not return ACL info; grant write-properties as a safe
+			// minimum so rename and recolor work even before a harmonization cycle
+			// has refreshed the stored permissions.
+			$permissions = ['{DAV:}read', '{DAV:}write-properties'];
 		}
 		return array_map(function ($permission) {
 			return [

lib/Service/Remote/RemoteClient.php

@@ -405,15 +405,15 @@ private function transceive(string $method, string $url, array $options): IRespo
 		return $response;
 	}
 
-	private function constructUrl(string $path = '/'): string {
+	private function constructUrl(?string $path = '/'): string {
 		$host = sprintf(
 			'%s://%s:%d',
 			$this->locationProtocol,
 			$this->locationHost,
 			$this->locationPort,
 		);
 		$host = rtrim($host, '/') . '/';
-		if ($path === '') {
+		if ($path === null || $path === '') {
 			$path = '/';
 		}
 

lib/Service/Remote/RemoteContactsService.php

@@ -346,9 +346,11 @@ private function toCollectionModel(string $id, array $so): Collection {
 			if (is_array($acl)) {
 				$permissions = RemoteConvert::extractPermissions($acl);
 				$to->permissions = $permissions[$owner] ?? [];
-			} elseif ($owner !== null && $owner === $this->dataStore->getPrincipalUrl()) {
+			} elseif ($owner !== null && RemoteConvert::normalizePrincipalPath($owner) === RemoteConvert::normalizePrincipalPath($this->dataStore->getPrincipalUrl())) {
 				// Server did not return ACL entries; infer owner-level permission from the
-				// {DAV:}all property when it matches the authenticated principal.
+				// principal match. Normalize both sides to paths before comparing because
+				// some servers (e.g. Fastmail) return absolute URLs in {DAV:}owner while
+				// getPrincipalUrl() returns a relative path stored during discovery.
 				$to->permissions = ['{DAV:}all'];
 			} else {
 				$to->permissions = [];

lib/Service/Remote/RemoteConvert.php

@@ -75,6 +75,22 @@ public static function extractPrincipal($owner): ?string {
 		return null;
 	}
 
+	/**
+	 * Normalize a principal URL to its path component for comparison.
+	 * Some servers return absolute URLs (e.g. https://caldav.fastmail.com/dav/principals/user/me/)
+	 * while others return relative paths (e.g. /dav/principals/user/me/).
+	 */
+	public static function normalizePrincipalPath(?string $url): ?string {
+		if ($url === null || $url === '') {
+			return null;
+		}
+		$parsed = parse_url($url);
+		if (isset($parsed['host'])) {
+			return $parsed['path'] ?? null;
+		}
+		return $url;
+	}
+
 	public static function extractPrivilegeNames(mixed $grant): array {
 		if (!is_array($grant)) {
 			return [];

lib/Service/Remote/RemoteEventsService.php

@@ -349,9 +349,11 @@ private function toCollectionModel(string $id, array $so): Collection {
 			if (is_array($acl)) {
 				$permissions = RemoteConvert::extractPermissions($acl);
 				$to->permissions = $permissions[$owner] ?? [];
-			} elseif ($owner !== null && $owner === $this->dataStore->getPrincipalUrl()) {
+			} elseif ($owner !== null && RemoteConvert::normalizePrincipalPath($owner) === RemoteConvert::normalizePrincipalPath($this->dataStore->getPrincipalUrl())) {
 				// Server did not return ACL entries; infer owner-level permission from the
-				// {DAV:}all property when it matches the authenticated principal.
+				// principal match. Normalize both sides to paths before comparing because
+				// some servers (e.g. Fastmail) return absolute URLs in {DAV:}owner while
+				// getPrincipalUrl() returns a relative path stored during discovery.
 				$to->permissions = ['{DAV:}all'];
 			} else {
 				$to->permissions = [];