fix(dav): repair CalDAV/CardDAV client connectivity (#480)

Standard CalDAV/CardDAV clients (Thunderbird, DAVx5, Apple Calendar/Contacts) failed to connect, mounted collections read-only, or could not discover address books, even though curl worked. Three protocol-compliance gaps caused this: 1. Missing Basic-auth challenge on /caldav and /carddav. The 401 returned for these surfaces carried no `WWW-Authenticate` header (only /webdav did). Spec-compliant clients never send credentials preemptively the way `curl -u` does — they wait for the challenge — so Thunderbird never authenticated and failed with "discovery failed" / 401. Extend the challenge to all DAV surfaces via shared `is_dav_path` / `dav_basic_auth_challenge` helpers. 2. Calendars always advertised read-only. The `current-user-privilege-set` write gate compared `owner_id` against the literal string "current_user_id", which never matched a real UUID, so `<D:write/>` was never emitted and clients mounted every calendar read-only. Thread the caller's id through the CalDAV adapter and grant write when the caller owns the calendar. 3. CardDAV discovery was incomplete. There was no `/.well-known/carddav` route and the root PROPFIND exposed neither `current-user-principal` nor `addressbook-home-set`, so clients could not locate address books. Add the well-known redirect and root/principal discovery responses mirroring the CalDAV adapter. Adds unit tests for the auth challenge predicate, the calendar owner/non-owner privilege split, and the CardDAV root/principal discovery responses. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016cVV9nRQjP6G6a8zbNUWMw
2026-06-19 08:38:27 +00:00
parent 8c325302b4
commit fe852d3b79
8 changed files with 605 additions and 48 deletions
@@ -218,6 +218,9 @@ async fn handle_propfind(
        .to_string();

    let user = extract_user(&req)?;
+    // Caller UUID (string form) — gates the `<D:write/>` privilege on calendars
+    // the caller owns, so clients mount their own calendars read-write.
+    let caller_id = user.id.to_string();
    let calendar_service = get_calendar_service(&state)?;

    let body_bytes = body::to_bytes(req.into_body(), MAX_CALDAV_BODY)
@@ -256,6 +259,7 @@ async fn handle_propfind(
            &propfind_request,
            base_href,
            &user.username,
+            &caller_id,
        )
        .map_err(|e| AppError::internal_error(format!("Failed to generate XML: {}", e)))?;

@@ -333,6 +337,7 @@ async fn handle_propfind(
                    &propfind_request,
                    base_href,
                    &depth,
+                    &caller_id,
                )
                .map_err(|e| AppError::internal_error(format!("Failed to generate XML: {}", e)))?;

@@ -359,6 +364,7 @@ async fn handle_propfind(
                    &calendars,
                    &propfind_request,
                    base_href,
+                    &caller_id,
                )
                .map_err(|e| AppError::internal_error(format!("Failed to generate XML: {}", e)))?;

@@ -407,6 +413,7 @@ async fn handle_propfind(
                        &propfind_request,
                        base_href,
                        &depth,
+                        &caller_id,
                    )
                    .map_err(|e| {
                        AppError::internal_error(format!("Failed to generate XML: {}", e))
@@ -58,6 +58,24 @@ pub fn carddav_routes() -> Router<Arc<AppState>> {
        .route("/carddav", axum::routing::any(handle_carddav_methods_root))
 }

+/// Creates the RFC 6764 well-known discovery route for CardDAV.
+/// Public (no auth) — simply redirects to the CardDAV root so clients that
+/// bootstrap from `/.well-known/carddav` can locate the service.
+pub fn well_known_routes() -> Router<Arc<AppState>> {
+    Router::new().route(
+        "/.well-known/carddav",
+        axum::routing::any(handle_well_known_carddav),
+    )
+}
+
+async fn handle_well_known_carddav() -> Response<Body> {
+    Response::builder()
+        .status(StatusCode::MOVED_PERMANENTLY)
+        .header(header::LOCATION, "/carddav/")
+        .body(Body::empty())
+        .unwrap()
+}
+
 async fn handle_carddav_methods_root(
    axum::extract::State(state): axum::extract::State<Arc<AppState>>,
    req: Request<Body>,
@@ -226,10 +244,66 @@ async fn handle_propfind(
        .map_err(|e| AppError::bad_request(format!("Failed to parse PROPFIND: {}", e)))?
    };

+    // Discovery: the true root `/carddav/` advertises current-user-principal and
+    // addressbook-home-set so clients (DAVx5, Apple Contacts) can locate the
+    // address books. Depth 0 → only the root entry; Depth 1+ → also the books.
+    if path.is_empty() {
+        let address_books = if depth == "0" {
+            vec![]
+        } else {
+            addressbook_service
+                .list_user_address_books(user.id)
+                .await
+                .map_err(|e| {
+                    AppError::internal_error(format!("Failed to list address books: {}", e))
+                })?
+        };
+
+        let mut response_body = Vec::new();
+        CardDavAdapter::generate_root_propfind_response(
+            &mut response_body,
+            &address_books,
+            &propfind_request,
+            "/carddav/",
+            &user.username,
+        )
+        .map_err(|e| AppError::internal_error(format!("Failed to generate XML: {}", e)))?;
+
+        return Ok(Response::builder()
+            .status(StatusCode::MULTI_STATUS)
+            .header(header::CONTENT_TYPE, "application/xml; charset=utf-8")
+            .body(Body::from(response_body))
+            .unwrap());
+    }
+
+    // Discovery: principal resource `/carddav/principals/{username}/` returns the
+    // addressbook-home-set the client should enumerate next.
+    if path == "principals" || path.starts_with("principals/") {
+        let username = path
+            .strip_prefix("principals/")
+            .map(|s| s.trim_end_matches('/'))
+            .filter(|s| !s.is_empty())
+            .unwrap_or(&user.username);
+
+        let mut response_body = Vec::new();
+        CardDavAdapter::generate_principal_propfind_response(
+            &mut response_body,
+            &propfind_request,
+            username,
+        )
+        .map_err(|e| AppError::internal_error(format!("Failed to generate XML: {}", e)))?;
+
+        return Ok(Response::builder()
+            .status(StatusCode::MULTI_STATUS)
+            .header(header::CONTENT_TYPE, "application/xml; charset=utf-8")
+            .body(Body::from(response_body))
+            .unwrap());
+    }
+
    let effective_path = strip_username_prefix(path);

    if effective_path.is_empty() {
-        // Root CardDAV path or user home — list user's address books
+        // User address-book home `/carddav/{username}/` — list the user's books.
        let address_books = addressbook_service
            .list_user_address_books(user.id)
            .await
@@ -237,12 +311,8 @@ async fn handle_propfind(
                AppError::internal_error(format!("Failed to list address books: {}", e))
            })?;

-        let base_href = if path.is_empty() {
-            "/carddav/".to_string()
-        } else {
-            let user_part = path.split('/').next().unwrap_or(path);
-            format!("/carddav/{}/", user_part)
-        };
+        let user_part = path.split('/').next().unwrap_or(path);
+        let base_href = format!("/carddav/{}/", user_part);
        let mut response_body = Vec::new();
        CardDavAdapter::generate_addressbooks_propfind_response(
            &mut response_body,