Ah, okay, this is helpful.
Yes, from your description it sounds like a bug. We haven't had a chance to explore the "multiple calendars per package instance" capability at Sloan. The simplest workaround is to set up separate instances of the calendar package --- one for Family and one for Friends.
However, if you'd like to fix it, the first thing to do is modify the queries on the main page to filter all listed calendar items by permission. There is a standard technique for doing this, which involves adding a clause that would look something like this (warning: I have not tested this for correctness or speed!):
and exists (
select 1
from acs_object_party_privilege_map ppm
where ppm.object_id = cal_items.cal_item_id
and ppm.party_id = :user_id
and ppm.privilege = 'read'
)
Andrew
