From ed0618cf7566b25aec884a31931e167e431212d5 Mon Sep 17 00:00:00 2001
From: Ulas Kalayci <ulas.kalayci@googlemail.com>
Date: Mon, 20 Apr 2026 23:55:20 +0200
Subject: [PATCH] fix(calendar): apply ICS visibility filter to /upcoming
 endpoint

---
 server/routes/calendar.js | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/server/routes/calendar.js b/server/routes/calendar.js
index 33b1bc1..72e6038 100644
--- a/server/routes/calendar.js
+++ b/server/routes/calendar.js
@@ -190,8 +190,14 @@ router.get('/upcoming', (req, res) => {
         OR
         (e.recurrence_rule IS NOT NULL AND DATE(e.start_datetime) <= ?)
       )
+      AND (
+        e.external_source != 'ics'
+        OR e.subscription_id IN (
+          SELECT id FROM ics_subscriptions WHERE shared = 1 OR created_by = ?
+        )
+      )
       ORDER BY e.start_datetime ASC
-    `).all(nowDate, future, future);
+    `).all(nowDate, future, future, req.session.userId);
 
     const expanded = expandRecurringEvents(rawEvents, nowDate, future)
       .filter((e) => e.start_datetime >= new Date().toISOString())