Merge pull request #613 from AtalayaLabs/claude/performance-optimization-round-5

perf: round 5 — CalDAV cursor streaming, SPA interning gaps, NC href prefix, per-request micro-allocs

src/application/adapters/caldav_adapter.rs

@@ -1064,71 +1064,142 @@ impl CalDavAdapter {
         // Write the calendar collection itself
         Self::write_calendar_response(&mut xml_writer, calendar, request, base_href, caller_id)?;
 
-        // If depth > 0, include event resources — folded per UID
-        // so a recurring event's master + per-instance exception
-        // overrides share ONE D:response (RFC 4791 §4.1 + RFC
-        // 5545 §3.6.1). Pre-fix this loop emitted one D:response
-        // per DB row, and since master + exception share the
-        // same href (base + uid.ics) clients saw a duplicate
-        // href and deduped — the exception appeared to have
-        // vanished.
+        // If depth > 0, include event resources — see
+        // `write_collection_event_page`, which the streaming emitter
+        // reuses page by page.
         if depth != "0" {
-            for bundle in group_events_by_uid(events) {
-                // The master (sorted first by group_events_by_uid)
-                // supplies the ETag anchor + getlastmodified. If
-                // the bundle is all exceptions (no master row),
-                // fall back to the first exception.
-                let anchor = match bundle.first() {
-                    Some(e) => *e,
-                    None => continue,
-                };
-                let event_href = format!("{}{}.ics", base_href, anchor.ical_uid);
-
-                xml_writer.write_event(Event::Start(BytesStart::new("D:response")))?;
-                xml_writer.write_event(Event::Start(BytesStart::new("D:href")))?;
-                xml_writer.write_event(Event::Text(BytesText::new(&event_href)))?;
-                xml_writer.write_event(Event::End(BytesEnd::new("D:href")))?;
-
-                xml_writer.write_event(Event::Start(BytesStart::new("D:propstat")))?;
-                xml_writer.write_event(Event::Start(BytesStart::new("D:prop")))?;
-
-                // resourcetype (empty for non-collection)
-                xml_writer.write_event(Event::Empty(BytesStart::new("D:resourcetype")))?;
-
-                // getetag — anchor row's id
-                xml_writer.write_event(Event::Start(BytesStart::new("D:getetag")))?;
-                xml_writer
-                    .write_event(Event::Text(BytesText::new(&format!("\"{}\"", anchor.id))))?;
-                xml_writer.write_event(Event::End(BytesEnd::new("D:getetag")))?;
-
-                // getcontenttype
-                xml_writer.write_event(Event::Start(BytesStart::new("D:getcontenttype")))?;
-                xml_writer.write_event(Event::Text(BytesText::new(
-                    "text/calendar; component=vevent",
-                )))?;
-                xml_writer.write_event(Event::End(BytesEnd::new("D:getcontenttype")))?;
-
-                // getlastmodified — anchor row's updated_at
-                xml_writer.write_event(Event::Start(BytesStart::new("D:getlastmodified")))?;
-                xml_writer
-                    .write_event(Event::Text(BytesText::new(&anchor.updated_at.to_rfc2822())))?;
-                xml_writer.write_event(Event::End(BytesEnd::new("D:getlastmodified")))?;
-
-                xml_writer.write_event(Event::End(BytesEnd::new("D:prop")))?;
-
-                xml_writer.write_event(Event::Start(BytesStart::new("D:status")))?;
-                xml_writer.write_event(Event::Text(BytesText::new("HTTP/1.1 200 OK")))?;
-                xml_writer.write_event(Event::End(BytesEnd::new("D:status")))?;
-
-                xml_writer.write_event(Event::End(BytesEnd::new("D:propstat")))?;
-                xml_writer.write_event(Event::End(BytesEnd::new("D:response")))?;
-            }
+            Self::write_collection_event_page(&mut xml_writer, events, base_href)?;
         }
 
+        Self::write_caldav_multistatus_end(&mut xml_writer)?;
+        Ok(())
+    }
+
+    /// Multistatus opening + the calendar collection's own
+    /// `D:response` — the head of a depth-1 collection PROPFIND. The
+    /// streaming emitter calls this once, then
+    /// [`Self::write_collection_event_page`] per hydrated UID page,
+    /// then [`Self::write_caldav_multistatus_end`].
+    pub fn write_collection_head<W: Write>(
+        xml_writer: &mut Writer<W>,
+        calendar: &CalendarDto,
+        request: &PropFindRequest,
+        base_href: &str,
+        caller_id: &str,
+    ) -> Result<()> {
+        Self::write_caldav_multistatus_start(xml_writer)?;
+        Self::write_calendar_response(xml_writer, calendar, request, base_href, caller_id)
+    }
+
+    /// One depth-1 collection page: event resources folded per UID so a
+    /// recurring master + per-instance exception overrides share ONE
+    /// `D:response` (RFC 4791 §4.1 + RFC 5545 §3.6.1) — emitting one
+    /// response per DB row made clients dedupe the shared href and the
+    /// exception appeared to vanish. Callers guarantee same-UID rows
+    /// arrive within a single page.
+    pub fn write_collection_event_page<W: Write>(
+        xml_writer: &mut Writer<W>,
+        events: &[CalendarEventDto],
+        base_href: &str,
+    ) -> Result<()> {
+        for bundle in group_events_by_uid(events) {
+            // The master (sorted first by group_events_by_uid)
+            // supplies the ETag anchor + getlastmodified. If
+            // the bundle is all exceptions (no master row),
+            // fall back to the first exception.
+            let anchor = match bundle.first() {
+                Some(e) => *e,
+                None => continue,
+            };
+            let event_href = format!("{}{}.ics", base_href, anchor.ical_uid);
+
+            xml_writer.write_event(Event::Start(BytesStart::new("D:response")))?;
+            xml_writer.write_event(Event::Start(BytesStart::new("D:href")))?;
+            xml_writer.write_event(Event::Text(BytesText::new(&event_href)))?;
+            xml_writer.write_event(Event::End(BytesEnd::new("D:href")))?;
+
+            xml_writer.write_event(Event::Start(BytesStart::new("D:propstat")))?;
+            xml_writer.write_event(Event::Start(BytesStart::new("D:prop")))?;
+
+            // resourcetype (empty for non-collection)
+            xml_writer.write_event(Event::Empty(BytesStart::new("D:resourcetype")))?;
+
+            // getetag — anchor row's id
+            xml_writer.write_event(Event::Start(BytesStart::new("D:getetag")))?;
+            xml_writer.write_event(Event::Text(BytesText::new(&format!("\"{}\"", anchor.id))))?;
+            xml_writer.write_event(Event::End(BytesEnd::new("D:getetag")))?;
+
+            // getcontenttype
+            xml_writer.write_event(Event::Start(BytesStart::new("D:getcontenttype")))?;
+            xml_writer.write_event(Event::Text(BytesText::new(
+                "text/calendar; component=vevent",
+            )))?;
+            xml_writer.write_event(Event::End(BytesEnd::new("D:getcontenttype")))?;
+
+            // getlastmodified — anchor row's updated_at
+            xml_writer.write_event(Event::Start(BytesStart::new("D:getlastmodified")))?;
+            xml_writer.write_event(Event::Text(BytesText::new(&anchor.updated_at.to_rfc2822())))?;
+            xml_writer.write_event(Event::End(BytesEnd::new("D:getlastmodified")))?;
+
+            xml_writer.write_event(Event::End(BytesEnd::new("D:prop")))?;
+
+            xml_writer.write_event(Event::Start(BytesStart::new("D:status")))?;
+            xml_writer.write_event(Event::Text(BytesText::new("HTTP/1.1 200 OK")))?;
+            xml_writer.write_event(Event::End(BytesEnd::new("D:status")))?;
+
+            xml_writer.write_event(Event::End(BytesEnd::new("D:propstat")))?;
+            xml_writer.write_event(Event::End(BytesEnd::new("D:response")))?;
+        }
+        Ok(())
+    }
+
+    /// Write the CalDAV `<D:multistatus>` opening tag (DAV + CalDAV +
+    /// CalendarServer namespaces). Streaming emitters call this once,
+    /// then [`Self::write_report_page`] per hydrated UID page, then
+    /// [`Self::write_caldav_multistatus_end`].
+    pub fn write_caldav_multistatus_start<W: Write>(xml_writer: &mut Writer<W>) -> Result<()> {
+        xml_writer.write_event(Event::Start(
+            BytesStart::new("D:multistatus").with_attributes([
+                ("xmlns:D", "DAV:"),
+                ("xmlns:C", "urn:ietf:params:xml:ns:caldav"),
+                ("xmlns:CS", "http://calendarserver.org/ns/"),
+            ]),
+        ))?;
+        Ok(())
+    }
+
+    /// Close the multistatus opened by
+    /// [`Self::write_caldav_multistatus_start`].
+    pub fn write_caldav_multistatus_end<W: Write>(xml_writer: &mut Writer<W>) -> Result<()> {
         xml_writer.write_event(Event::End(BytesEnd::new("D:multistatus")))?;
         Ok(())
     }
 
+    /// One REPORT page: group `events` per UID and emit one
+    /// `D:response` per bundle. Callers guarantee same-UID rows arrive
+    /// within a single page (the uid-keyset pager does).
+    pub fn write_report_page<W: Write>(
+        xml_writer: &mut Writer<W>,
+        events: &[CalendarEventDto],
+        request: &CalDavReportType,
+        base_href: &str,
+    ) -> Result<()> {
+        let props = match request {
+            CalDavReportType::CalendarQuery { props, .. } => props,
+            CalDavReportType::CalendarMultiget { props, .. } => props,
+            CalDavReportType::SyncCollection { props, .. } => props,
+        };
+        for bundle in group_events_by_uid(events) {
+            let anchor = match bundle.first() {
+                Some(e) => *e,
+                None => continue,
+            };
+            let href = format!("{}{}.ics", base_href, anchor.ical_uid);
+            Self::write_event_response(xml_writer, &bundle, props, &href)?;
+        }
+        Ok(())
+    }
+
     /// Generate a response for calendar events
     pub fn generate_calendar_events_response<W: Write>(
         writer: W,
@@ -1138,42 +1209,15 @@ impl CalDavAdapter {
     ) -> Result<()> {
         let mut xml_writer = Writer::new(writer);
 
-        // Start multistatus response
-        xml_writer.write_event(Event::Start(
-            BytesStart::new("D:multistatus").with_attributes([
-                ("xmlns:D", "DAV:"),
-                ("xmlns:C", "urn:ietf:params:xml:ns:caldav"),
-                ("xmlns:CS", "http://calendarserver.org/ns/"),
-            ]),
-        ))?;
+        Self::write_caldav_multistatus_start(&mut xml_writer)?;
 
-        // Determine which properties to include based on request type —
-        // borrowed straight out of the request (the old `clone()` copied
-        // the whole Vec of owned QualifiedName strings per REPORT).
-        let props = match request {
-            CalDavReportType::CalendarQuery { props, .. } => props,
-            CalDavReportType::CalendarMultiget { props, .. } => props,
-            CalDavReportType::SyncCollection { props, .. } => props,
-        };
+        // Responses folded per UID so a recurring master + exception
+        // overrides share ONE D:response (RFC 4791 §4.1) — see
+        // `write_report_page`, which the streaming emitters reuse
+        // page by page.
+        Self::write_report_page(&mut xml_writer, events, request, base_href)?;
 
-        // Add responses for events — folded per UID so a
-        // recurring master + per-instance exception overrides
-        // share ONE D:response with all VEVENTs concatenated
-        // into the calendar-data payload (RFC 4791 §4.1). Pre-
-        // fix this loop emitted one D:response per DB row, so
-        // master + exception carried duplicate hrefs and clients
-        // deduped, hiding the exception from the resulting sync.
-        for bundle in group_events_by_uid(events) {
-            let anchor = match bundle.first() {
-                Some(e) => *e,
-                None => continue,
-            };
-            let href = format!("{}{}.ics", base_href, anchor.ical_uid);
-            Self::write_event_response(&mut xml_writer, &bundle, props, &href)?;
-        }
-
-        // End multistatus
-        xml_writer.write_event(Event::End(BytesEnd::new("D:multistatus")))?;
+        Self::write_caldav_multistatus_end(&mut xml_writer)?;
 
         Ok(())
     }

src/application/adapters/carddav_adapter.rs

@@ -663,17 +663,27 @@ impl CardDavAdapter {
             ]),
         ))?;
 
+        // Borrowed straight out of the request — the old `clone()` copied
+        // the whole Vec of owned QualifiedName strings per REPORT (same
+        // fix the CalDAV surface got in ROUND4).
         let props = match report {
-            CardDavReportType::AddressbookQuery { props } => props.clone(),
-            CardDavReportType::AddressbookMultiget { props, .. } => props.clone(),
-            CardDavReportType::SyncCollection { props, .. } => props.clone(),
+            CardDavReportType::AddressbookQuery { props } => props,
+            CardDavReportType::AddressbookMultiget { props, .. } => props,
+            CardDavReportType::SyncCollection { props, .. } => props,
         };
 
+        // One reused href buffer for the whole listing instead of a
+        // fresh String per contact.
+        let mut href = String::with_capacity(base_href.len() + 48);
         for contact in contacts {
-            let href = format!("{}{}.vcf", base_href, contact.uid);
+            href.clear();
+            let _ = std::fmt::Write::write_fmt(
+                &mut href,
+                format_args!("{}{}.vcf", base_href, contact.uid),
+            );
             // `write_contact_response` generates the vCard on demand when (and
             // only when) address-data is actually requested.
-            Self::write_contact_response(&mut xml_writer, contact, &props, &href)?;
+            Self::write_contact_response(&mut xml_writer, contact, props, &href)?;
         }
 
         xml_writer.write_event(Event::End(BytesEnd::new("D:multistatus")))?;
@@ -701,10 +711,11 @@ impl CardDavAdapter {
             xml_writer.write_event(Event::Empty(BytesStart::new("D:resourcetype")))?;
 
             xml_writer.write_event(Event::Start(BytesStart::new("D:getetag")))?;
-            xml_writer.write_event(Event::Text(BytesText::new(&format!(
-                "\"{}\"",
-                contact.etag
-            ))))?;
+            let mut quoted = String::with_capacity(contact.etag.len() + 2);
+            quoted.push('"');
+            quoted.push_str(&contact.etag);
+            quoted.push('"');
+            xml_writer.write_event(Event::Text(BytesText::new(&quoted)))?;
             xml_writer.write_event(Event::End(BytesEnd::new("D:getetag")))?;
 
             xml_writer.write_event(Event::Start(BytesStart::new("D:getcontenttype")))?;
@@ -724,10 +735,11 @@ impl CardDavAdapter {
                     }
                     ("DAV:", "getetag") => {
                         xml_writer.write_event(Event::Start(BytesStart::new("D:getetag")))?;
-                        xml_writer.write_event(Event::Text(BytesText::new(&format!(
-                            "\"{}\"",
-                            contact.etag
-                        ))))?;
+                        let mut quoted = String::with_capacity(contact.etag.len() + 2);
+                        quoted.push('"');
+                        quoted.push_str(&contact.etag);
+                        quoted.push('"');
+                        xml_writer.write_event(Event::Text(BytesText::new(&quoted)))?;
                         xml_writer.write_event(Event::End(BytesEnd::new("D:getetag")))?;
                     }
                     ("DAV:", "getcontenttype") => {

src/application/ports/calendar_ports.rs

@@ -116,6 +116,12 @@ pub trait CalendarStoragePort: Send + Sync + 'static {
         &self,
         calendar_id: &str,
     ) -> Result<Vec<CalendarEventDto>, DomainError>;
+    /// Cursor stream over the calendar's events in bundle order (see
+    /// the repository doc) — feeds the streaming CalDAV emitters.
+    fn stream_events_uid_order(
+        &self,
+        calendar_id: &str,
+    ) -> futures::stream::BoxStream<'static, Result<CalendarEventDto, DomainError>>;
     async fn list_events_by_calendar_paginated(
         &self,
         calendar_id: &str,
@@ -218,6 +224,16 @@ pub trait CalendarUseCase: Send + Sync + 'static {
         offset: Option<i64>,
         user_id: Uuid,
     ) -> Result<Vec<CalendarEventDto>, DomainError>;
+    /// Streaming support: cursor over the calendar's events in bundle
+    /// order, behind the same Read authz gate as [`Self::list_events`].
+    async fn stream_events_uid_order(
+        &self,
+        calendar_id: &str,
+        user_id: Uuid,
+    ) -> Result<
+        futures::stream::BoxStream<'static, Result<CalendarEventDto, DomainError>>,
+        DomainError,
+    >;
     async fn get_events_in_range(
         &self,
         calendar_id: &str,

src/application/services/calendar_service.rs

@@ -356,6 +356,28 @@ impl CalendarUseCase for CalendarService {
         }
     }
 
+    async fn stream_events_uid_order(
+        &self,
+        calendar_id: &str,
+        user_id: Uuid,
+    ) -> Result<
+        futures::stream::BoxStream<'static, Result<CalendarEventDto, DomainError>>,
+        DomainError,
+    > {
+        // Same Read gate as `list_events`, checked ONCE before the
+        // cursor opens — the stream itself carries no further authz
+        // (single request, same caller, same resource).
+        let calendar = self.calendar_storage.get_calendar(calendar_id).await?;
+        let allowed = calendar.is_public
+            || self
+                .has_calendar_perm(calendar_id, user_id, Permission::Read)
+                .await?;
+        if !allowed {
+            return Err(DomainError::not_found("Calendar", calendar_id));
+        }
+        Ok(self.calendar_storage.stream_events_uid_order(calendar_id))
+    }
+
     async fn get_events_in_range(
         &self,
         calendar_id: &str,

src/application/services/search_service.rs

@@ -359,7 +359,7 @@ impl SearchService {
         // grants are honoured inline by `storage.caller_group_ids` on
         // the SQL side, so no Rust-side subject expansion here.
         let accessible_drives: Vec<Uuid> = match drive_repo.list_readable_by(user_id).await {
-            Ok(drives) => drives.into_iter().map(|d| d.drive.id).collect(),
+            Ok(drives) => drives.iter().map(|d| d.drive.id).collect(),
             Err(e) => {
                 tracing::warn!("Content-index: drive lookup failed — degrading to empty: {e}");
                 return Vec::new();
@@ -529,28 +529,34 @@ impl SearchService {
         // Pre-compute once — avoids N heap allocations inside the loops.
         let query_lower = query.to_lowercase();
 
-        for file in &files {
-            let file_dto = FileDto::from(file.clone());
+        // Consume the entities: the old loop deep-cloned every File into
+        // the DTO conversion and then cloned name/id/path AGAIN into the
+        // suggestion — 3 field clones + a full entity clone per row on
+        // an every-keystroke path.
+        for file in files {
+            let file_dto = FileDto::from(file);
             let score = compute_relevance(&file_dto.name, &query_lower);
+            let icon_class = get_icon_class(&file_dto.name, &file_dto.mime_type);
+            let icon_special_class = get_icon_special_class(&file_dto.name, &file_dto.mime_type);
             suggestions.push(SearchSuggestionItem {
-                name: file_dto.name.clone(),
+                name: file_dto.name,
                 item_type: "file".to_string(),
-                id: file_dto.id.clone(),
-                path: file_dto.path.clone(),
-                icon_class: get_icon_class(&file_dto.name, &file_dto.mime_type),
-                icon_special_class: get_icon_special_class(&file_dto.name, &file_dto.mime_type),
+                id: file_dto.id,
+                path: file_dto.path,
+                icon_class,
+                icon_special_class,
                 relevance_score: score,
             });
         }
 
-        for folder in &folders {
-            let folder_dto = FolderDto::from(folder.clone());
+        for folder in folders {
+            let folder_dto = FolderDto::from(folder);
             let score = compute_relevance(&folder_dto.name, &query_lower);
             suggestions.push(SearchSuggestionItem {
-                name: folder_dto.name.clone(),
+                name: folder_dto.name,
                 item_type: "folder".to_string(),
-                id: folder_dto.id.clone(),
-                path: folder_dto.path.clone(),
+                id: folder_dto.id,
+                path: folder_dto.path,
                 icon_class: "fas fa-folder".to_string(),
                 icon_special_class: "folder-icon".to_string(),
                 relevance_score: score,

src/application/services/trash_service.rs

@@ -801,7 +801,7 @@ impl TrashService {
         // role_grants on resource_type='drive', including group-mediated
         // grants). Empty set → empty page without a SQL round-trip.
         let drive_ids: Vec<Uuid> = match self.drive_repo.list_readable_by(user_id).await {
-            Ok(drives) => drives.into_iter().map(|d| d.drive.id).collect(),
+            Ok(drives) => drives.iter().map(|d| d.drive.id).collect(),
             Err(e) => {
                 return Err(DomainError::internal_error(
                     "Trash",