When the same event is uploaded and deleted 3 times, DELETE fails on the 3rd try

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

When an event with the same UID/file name (for instance always imported from a file over the Nextcloud Calendar app) is created and deleted a few times (like it happens when debugging), Nextcloud suddenly stops to accept the valid requests after 2 successful times and sends an invalid 403.

Steps to reproduce

Create an ICS file:

$ cat fc03c5378a519bc5cf097a093c6d85e06859a3f7.ics 
BEGIN:VCALENDAR
CALSCALE:GREGORIAN
PRODID:-//Ximian//NONSGML Evolution Calendar//EN
VERSION:2.0
BEGIN:VEVENT
UID:fc03c5378a519bc5cf097a093c6d85e06859a3f7
DTSTAMP:20240103T163009Z
DTSTART;TZID=Europe/Vienna:20240116T090000
DTEND;TZID=Europe/Vienna:20240116T092500
SEQUENCE:2
SUMMARY:Test-Event
TRANSP:OPAQUE
CLASS:PUBLIC
END:VEVENT
END:VCALENDAR

Start with empty collection and empty trash bin.

Upload and immediately delete 2 times:

$ curl -T fc03c5378a519bc5cf097a093c6d85e06859a3f7.ics -u test:test https://example.com/nextcloud/remote.php/dav/calendars/test/67c8f397-3067-41ff-8c7e-3655d04aa274/fc03c5378a519bc5cf097a093c6d85e06859a3f7.ics
$ curl -X DELETE -u test:test https://example.com/nextcloud/remote.php/dav/calendars/test/67c8f397-3067-41ff-8c7e-3655d04aa274/fc03c5378a519bc5cf097a093c6d85e06859a3f7.ics
$ curl -T fc03c5378a519bc5cf097a093c6d85e06859a3f7.ics -u test:test https://example.com/nextcloud/remote.php/dav/calendars/test/67c8f397-3067-41ff-8c7e-3655d04aa274/fc03c5378a519bc5cf097a093c6d85e06859a3f7.ics
$ curl -X DELETE -u test:test https://example.com/nextcloud/remote.php/dav/calendars/test/67c8f397-3067-41ff-8c7e-3655d04aa274/fc03c5378a519bc5cf097a093c6d85e06859a3f7.ics

Upload a third time.

$ curl -T fc03c5378a519bc5cf097a093c6d85e06859a3f7.ics -u test:test https://example.com/nextcloud/remote.php/dav/calendars/test/67c8f397-3067-41ff-8c7e-3655d04aa274/fc03c5378a519bc5cf097a093c6d85e06859a3f7.ics

Delete a third time. It fails with 403:

$ curl -X DELETE -u test:test https://example.com/nextcloud/remote.php/dav/calendars/test/67c8f397-3067-41ff-8c7e-3655d04aa274/fc03c5378a519bc5cf097a093c6d85e06859a3f7.ics
<?xml version="1.0" encoding="utf-8"?>
<d:error xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns">
  <s:exception>Sabre\DAV\Exception\Forbidden</s:exception>
  <s:message>A calendar object with URI fc03c5378a519bc5cf097a093c6d85e06859a3f7-deleted.ics already exists in calendar 10, therefore this object can't be moved into the trashbin</s:message>
</d:error>

Expected behavior

DELETE should still work, from an outside point of view nothing has changed in comparision to the two times before.

Installation method

None

Nextcloud Server version

28

Operating system

None

PHP engine version

None

Web server

None

Database engine version

None

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

No response

List of activated Apps

No response

Nextcloud Signing status

No response

Nextcloud Logs

No response

Additional info

No response

Start by reproducing the failure with the supplied ICS file and curl requests against the remote.php/dav/calendars endpoint. Trace the DELETE handling when the same calendar object has already been moved to the trash bin, and verify that a third upload/delete cycle succeeds without the 403 conflict.